summary refs log tree commit diff stats
path: root/scripts/qapi/source.py (unfollow)
Commit message (Collapse)AuthorFilesLines
2021-07-13migration: Clear error at entry of migrate_fd_connect()Peter Xu1-0/+16
For each "migrate" command, remember to clear the s->error before going on. For one reason, when there's a new error it'll be still remembered; see migrate_set_error() who only sets the error if error==NULL. Meanwhile if a failed migration completes (e.g., postcopy recovered and finished), we shouldn't dump an error when calling migrate_fd_cleanup() at last. Signed-off-by: Peter Xu <peterx@redhat.com> Message-Id: <20210708190653.252961-4-peterx@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2021-07-13migration: Don't do migrate cleanup if during postcopy resumePeter Xu1-1/+12
Below process could crash qemu with postcopy recovery: 1. (hmp) migrate -d .. 2. (hmp) migrate_start_postcopy 3. [network down, postcopy paused] 4. (hmp) migrate -r $WRONG_PORT when try the recover on an invalid $WRONG_PORT, cleanup_bh will be cleared 5. (hmp) migrate -r $RIGHT_PORT [qemu crash on assert(cleanup_bh)] The thing is we shouldn't cleanup if it's postcopy resume; the error is set mostly because the channel is wrong, so we return directly waiting for the user to retry. migrate_fd_cleanup() should only be called when migration is cancelled or completed. Signed-off-by: Peter Xu <peterx@redhat.com> Message-Id: <20210708190653.252961-3-peterx@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2021-07-13migration: Release return path early for paused postcopyPeter Xu1-4/+4
When postcopy pause triggered, we rely on the migration thread to cleanup the to_dst_file handle, and the return path thread to cleanup the from_dst_file handle (which is stored in the local variable "rp"). Within the process, from_dst_file cleanup (qemu_fclose) is postponed until it's setup again due to a postcopy recovery. It used to work before yank was born; after yank is introduced we rely on the refcount of IOC to correctly unregister yank function in channel_close(). If without the early and on-time release of from_dst_file handle the yank function will be leftover during paused postcopy. Without this patch, below steps (quoted from Xiaohui) could trigger qemu src crash: 1.Boot vm on src host 2.Boot vm on dst host 3.Enable postcopy on src&dst host 4.Load stressapptest in vm and set postcopy speed to 50M 5.Start migration from src to dst host, change into postcopy mode when migration is active. 6.When postcopy is active, down the network card(do migration via this network) on dst host. 7.Wait untill postcopy is paused on src&dst host. 8.Before up network card, recover migration on dst host, will get error like following. 9.Ignore the error of step 8, go on recovering migration on src host: After step 9, qemu on src host will core dump after some seconds: qemu-kvm: ../util/yank.c:107: yank_unregister_instance: Assertion `QLIST_EMPTY(&entry->yankfns)' failed. 1.sh: line 38: 44662 Aborted (core dumped) Reported-by: Li Xiaohui <xiaohli@redhat.com> Signed-off-by: Peter Xu <peterx@redhat.com> Message-Id: <20210708190653.252961-2-peterx@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2021-07-13migration: failover: emit a warning when the card is not fully unpluggedLaurent Vivier1-0/+4
When the migration fails or is canceled we wait the end of the unplug operation to be able to plug it back. But if the unplug operation is never finished we stop to wait and QEMU emits a warning to inform the user. Based-on: 20210629155007.629086-1-lvivier@redhat.com Signed-off-by: Laurent Vivier <lvivier@redhat.com> Message-Id: <20210701131458.112036-1-lvivier@redhat.com> Reviewed-by: Juan Quintela <quintela@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2021-07-13migration/rdma: prevent from double free the same mrLi Zhijian1-0/+1
backtrace: '0x00007ffff5f44ec2 in __ibv_dereg_mr_1_1 (mr=0x7fff1007d390) at /home/lizhijian/rdma-core/libibverbs/verbs.c:478 478 void *addr = mr->addr; (gdb) bt #0 0x00007ffff5f44ec2 in __ibv_dereg_mr_1_1 (mr=0x7fff1007d390) at /home/lizhijian/rdma-core/libibverbs/verbs.c:478 #1 0x0000555555891fcc in rdma_delete_block (block=<optimized out>, rdma=0x7fff38176010) at ../migration/rdma.c:691 #2 qemu_rdma_cleanup (rdma=0x7fff38176010) at ../migration/rdma.c:2365 #3 0x00005555558925b0 in qio_channel_rdma_close_rcu (rcu=0x555556b8b6c0) at ../migration/rdma.c:3073 #4 0x0000555555d652a3 in call_rcu_thread (opaque=opaque@entry=0x0) at ../util/rcu.c:281 #5 0x0000555555d5edf9 in qemu_thread_start (args=0x7fffe88bb4d0) at ../util/qemu-thread-posix.c:541 #6 0x00007ffff54c73f9 in start_thread () at /lib64/libpthread.so.0 #7 0x00007ffff53f3b03 in clone () at /lib64/libc.so.6 ' Signed-off-by: Li Zhijian <lizhijian@cn.fujitsu.com> Message-Id: <20210708144521.1959614-1-lizhijian@cn.fujitsu.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2021-07-13numa: Parse initiator= attribute before cpus= attributeMichal Privoznik1-22/+23
When parsing cpus= attribute of -numa object couple of checks is performed, such as correct initiator setting (see the if() statement at the end of for() loop in machine_set_cpu_numa_node()). However, with the current code cpus= attribute is parsed before initiator= attribute and thus the check may fail even though it is not obvious why. But since parsing the initiator= attribute does not depend on the cpus= attribute we can swap the order of the two. It's fairly easy to reproduce with the following command line (snippet of an actual cmd line): -smp 4,sockets=4,cores=1,threads=1 \ -object '{"qom-type":"memory-backend-ram","id":"ram-node0","size":2147483648}' \ -numa node,nodeid=0,cpus=0-1,initiator=0,memdev=ram-node0 \ -object '{"qom-type":"memory-backend-ram","id":"ram-node1","size":2147483648}' \ -numa node,nodeid=1,cpus=2-3,initiator=1,memdev=ram-node1 \ -numa hmat-lb,initiator=0,target=0,hierarchy=memory,data-type=access-latency,latency=5 \ -numa hmat-lb,initiator=0,target=0,hierarchy=first-level,data-type=access-latency,latency=10 \ -numa hmat-lb,initiator=1,target=1,hierarchy=memory,data-type=access-latency,latency=5 \ -numa hmat-lb,initiator=1,target=1,hierarchy=first-level,data-type=access-latency,latency=10 \ -numa hmat-lb,initiator=0,target=0,hierarchy=memory,data-type=access-bandwidth,bandwidth=204800K \ -numa hmat-lb,initiator=0,target=0,hierarchy=first-level,data-type=access-bandwidth,bandwidth=208896K \ -numa hmat-lb,initiator=1,target=1,hierarchy=memory,data-type=access-bandwidth,bandwidth=204800K \ -numa hmat-lb,initiator=1,target=1,hierarchy=first-level,data-type=access-bandwidth,bandwidth=208896K \ -numa hmat-cache,node-id=0,size=10K,level=1,associativity=direct,policy=write-back,line=8 \ -numa hmat-cache,node-id=1,size=10K,level=1,associativity=direct,policy=write-back,line=8 \ Signed-off-by: Michal Privoznik <mprivozn@redhat.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com> Message-Id: <b27a6a88986d63e3f610a728c845e01ff8d92e2e.1625662776.git.mprivozn@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2021-07-13numa: Report expected initiatorMichal Privoznik1-1/+2
When setting up NUMA with HMAT enabled there's a check performed in machine_set_cpu_numa_node() that reports an error when a NUMA node has a CPU but the node's initiator is not itself. The error message reported contains only the expected value and not the actual value (which is different because an error is being reported). Report both values in the error message. Signed-off-by: Michal Privoznik <mprivozn@redhat.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: Pankaj Gupta <pankaj.gupta@ionos.com> Message-Id: <ebdf871551ea995bafa7a858899a26aa9bc153d3.1625662776.git.mprivozn@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2021-07-13target/i386: Fix cpuid level for AMDzhenwei pi1-2/+9
A AMD server typically has cpuid level 0x10(test on Rome/Milan), it should not be changed to 0x1f in multi-dies case. * to maintain compatibility with older machine types, only implement this change when the CPU's "x-vendor-cpuid-only" property is false Cc: "Dr. David Alan Gilbert" <dgilbert@redhat.com> Cc: Eduardo Habkost <ehabkost@redhat.com> Cc: Richard Henderson <richard.henderson@linaro.org> Cc: Igor Mammedov <imammedo@redhat.com> Cc: zhenwei pi <pizhenwei@bytedance.com> Fixes: a94e1428991 (target/i386: Add CPUID.1F generation support for multi-dies PCMachine) Signed-off-by: zhenwei pi <pizhenwei@bytedance.com> Signed-off-by: Michael Roth <michael.roth@amd.com> Message-Id: <20210708170641.49410-1-michael.roth@amd.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2021-07-13target/i386: suppress CPUID leaves not defined by the CPU vendorMichael Roth3-0/+10
Currently all built-in CPUs report cache information via CPUID leaves 2 and 4, but these have never been defined for AMD. In the case of SEV-SNP this can cause issues with CPUID enforcement. Address this by allowing CPU types to suppress these via a new "x-vendor-cpuid-only" CPU property, which is true by default, but switched off for older machine types to maintain compatibility. Cc: "Dr. David Alan Gilbert" <dgilbert@redhat.com> Cc: Eduardo Habkost <ehabkost@redhat.com> Cc: Richard Henderson <richard.henderson@linaro.org> Cc: Igor Mammedov <imammedo@redhat.com> Cc: zhenwei pi <pizhenwei@bytedance.com> Suggested-by: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Michael Roth <michael.roth@amd.com> Message-Id: <20210708003623.18665-1-michael.roth@amd.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2021-07-13i386: Hyper-V SynIC requires POST_MESSAGES/SIGNAL_EVENTS privilegesVitaly Kuznetsov2-0/+12
When Hyper-V SynIC is enabled, we may need to allow Windows guests to make hypercalls (POST_MESSAGES/SIGNAL_EVENTS). No issue is currently observed because KVM is very permissive, allowing these hypercalls regarding of guest visible CPUid bits. Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com> Message-Id: <20210608120817.1325125-9-vkuznets@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2021-07-13i386: HV_HYPERCALL_AVAILABLE privilege bit is always neededVitaly Kuznetsov1-5/+5
According to TLFS, Hyper-V guest is supposed to check HV_HYPERCALL_AVAILABLE privilege bit before accessing HV_X64_MSR_GUEST_OS_ID/HV_X64_MSR_HYPERCALL MSRs but at least some Windows versions ignore that. As KVM is very permissive and allows accessing these MSRs unconditionally, no issue is observed. We may, however, want to tighten the checks eventually. Conforming to the spec is probably also a good idea. Enable HV_HYPERCALL_AVAILABLE bit unconditionally. Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com> Message-Id: <20210608120817.1325125-8-vkuznets@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2021-07-13i386: kill off hv_cpuid_check_and_set()Vitaly Kuznetsov1-68/+36
hv_cpuid_check_and_set() does too much: - Checks if the feature is supported by KVM; - Checks if all dependencies are enabled; - Sets the feature bit in cpu->hyperv_features for 'passthrough' mode. To reduce the complexity, move all the logic except for dependencies check out of it. Also, in 'passthrough' mode we don't really need to check dependencies because KVM is supposed to provide a consistent set anyway. Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com> Message-Id: <20210608120817.1325125-7-vkuznets@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2021-07-13i386: expand Hyper-V features during CPU feature expansion timeVitaly Kuznetsov4-4/+30
To make Hyper-V features appear in e.g. QMP query-cpu-model-expansion we need to expand and set the corresponding CPUID leaves early. Modify x86_cpu_get_supported_feature_word() to call newly intoduced Hyper-V specific kvm_hv_get_supported_cpuid() instead of kvm_arch_get_supported_cpuid(). We can't use kvm_arch_get_supported_cpuid() as Hyper-V specific CPUID leaves intersect with KVM's. Note, early expansion will only happen when KVM supports system wide KVM_GET_SUPPORTED_HV_CPUID ioctl (KVM_CAP_SYS_HYPERV_CPUID). Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com> Message-Id: <20210608120817.1325125-6-vkuznets@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2021-07-13i386: make hyperv_expand_features() return boolVitaly Kuznetsov1-19/+21
Return 'false' when hyperv_expand_features() sets an error. No functional change intended. Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com> Message-Id: <20210608120817.1325125-5-vkuznets@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2021-07-13i386: hardcode supported eVMCS version to '1'Vitaly Kuznetsov2-5/+36
Currently, the only eVMCS version, supported by KVM (and described in TLFS) is '1'. When Enlightened VMCS feature is enabled, QEMU takes the supported eVMCS version range (from KVM_CAP_HYPERV_ENLIGHTENED_VMCS enablement) and puts it to guest visible CPUIDs. When (and if) eVMCS ver.2 appears a problem on migration is expected: it doesn't seem to be possible to migrate from a host supporting eVMCS ver.2 to a host, which only support eVMCS ver.1. Hardcode eVMCS ver.1 as the result of 'hv-evmcs' enablement for now. Newer eVMCS versions will have to have their own enablement options (e.g. 'hv-evmcs=2'). Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Message-Id: <20210608120817.1325125-4-vkuznets@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2021-07-13i386: clarify 'hv-passthrough' behaviorVitaly Kuznetsov1-2/+5
Clarify the fact that 'hv-passthrough' only enables features which are already known to QEMU and that it overrides all other 'hv-*' settings. Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com> Message-Id: <20210608120817.1325125-3-vkuznets@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2021-07-13linux-user: update syscall.tbl to Linux v5.13Laurent Vivier15-73/+170
Updated running scripts/update-syscalltbl.sh Signed-off-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <20210708215756.268805-4-laurent@vivier.eu> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2021-07-13linux-user, mips: update syscall-args-o32.c.inc to Linux v5.13Laurent Vivier2-7/+11
Updated running scripts/update-mips-syscall-args.sh scripts/update-mips-syscall-args.sh has been updated to reflect file directory changes in strace repository. Signed-off-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <20210708215756.268805-3-laurent@vivier.eu> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2021-07-13linux-user: update syscall_nr.h to Linux v5.13Laurent Vivier6-6/+46
Automatically generated using scripts/gensyscalls.sh Signed-off-by: Laurent Vivier <laurent@vivier.eu> Reviewed-by: Taylor Simpson <tsimpson@quicinc.com> Message-Id: <20210708215756.268805-2-laurent@vivier.eu> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2021-07-13mv64361: Remove extra break from a switch caseBALATON Zoltan1-1/+0
The switch case of writing PCI 1 IO base address had an extra break statement that made part of the code unreachable. This did not cause a problem as guests ususally leave this register at its default value. Fixes: dcdf98a9015 ("Add emulation of Marvell MV64361 PPC system controller") Reported-by: Coverity (CID 1458135) Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Message-Id: <20210712131259.B705B7456E3@zero.eik.bme.hu> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2021-07-13pseries: Update SLOF firmware imageAlexey Kardashevskiy3-1/+1
This is all about TPM fixes and improvements. The change log is: Alexey Kardashevskiy (2): tcgbios: Fix warnings version: update to 20210711 Stefan Berger (9): tcgbios: Fix details in log entries tcgbios: Fix a typo in the sha256 algo description tcgbios: Add implementations for sha1, sha384, and sha512 tpm: Add firmware API call 2HASH-EXT-LOG tcgbios: Change format of S_CRTM_VERSION string to ucs-2 tcgbios: Use assembly for 32 bit rotr in sha256 tcgbios: Use The proper sha function for each PCR bank tcgbios: Add test cases and test script to run them Travis: Add script for running tests on Travis Thomas Huth (1): Fix bad header guard in version.h Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2021-07-13ppc/pegasos2: Allow setprop in VOFBALATON Zoltan1-0/+10
Linux needs setprop to fix up the device tree, otherwise it's not finding devices and cannot boot. Since recent VOF change now we need to add a callback to allow this which is what this patch does. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Message-Id: <20210709132920.6544E7457EF@zero.eik.bme.hu> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2021-07-12fd-trans: Fix race condition on reallocation of the translation table.Owen Anderson3-7/+52
The mapping from file-descriptors to translator functions is not guarded on realloc which may cause invalid function pointers to be read from a previously deallocated mapping. Signed-off-by: Owen Anderson <oanderso@google.com> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <20210701221255.107976-1-oanderso@google.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2021-07-12linux-user/syscall: Remove ERRNO_TABLE_SIZE checkPhilippe Mathieu-Daudé1-5/+0
Now than target_to_host_errno() always return an errno, we can remove the unused and arbitrary ERRNO_TABLE_SIZE definition. Suggested-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20210708170550.1846343-9-f4bug@amsat.org> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2021-07-12linux-user: Simplify host <-> target errno conversion using macrosPhilippe Mathieu-Daudé2-145/+154
Convert the host_to_target_errno_table[] array to a switch case to allow compiler optimizations (such noticing the identity function when host and guest errnos match). Extract the errnos list as to a new includible unit, using a generic macro. Remove the code related to target_to_host_errno_table[] initialization. Suggested-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20210708170550.1846343-8-f4bug@amsat.org> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2021-07-12linux-user/mips: Move errno definitions to 'target_errno_defs.h'Philippe Mathieu-Daudé4-423/+220
Suggested-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20210708170550.1846343-7-f4bug@amsat.org> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2021-07-12linux-user/hppa: Move errno definitions to 'target_errno_defs.h'Philippe Mathieu-Daudé2-210/+214
Reviewed-by: Laurent Vivier <laurent@vivier.eu> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20210708170550.1846343-6-f4bug@amsat.org> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2021-07-12linux-user/alpha: Move errno definitions to 'target_errno_defs.h'Philippe Mathieu-Daudé2-194/+198
Reviewed-by: Laurent Vivier <laurent@vivier.eu> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20210708170550.1846343-5-f4bug@amsat.org> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2021-07-12linux-user: Extract target errno to 'target_errno_defs.h'Philippe Mathieu-Daudé24-7/+139
We want to access the target errno indepently of the rest of the linux-user code. Move the header containing the generic errno definitions ('errno_defs.h') to 'generic/target_errno_defs.h', create a new 'target_errno_defs.h' in each target which itself includes 'generic/target_errno_defs.h'. Suggested-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20210708170550.1846343-4-f4bug@amsat.org> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2021-07-12linux-user/sparc: Rename target_errno.h -> target_errno_defs.hPhilippe Mathieu-Daudé2-3/+3
We want to have one generic target_errno.h (API to access target errno), and will add target errno definitions in target_errno_defs.h. The sparc target already have its errnos in an header, simply rename it. Reviewed-by: Laurent Vivier <laurent@vivier.eu> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20210708170550.1846343-3-f4bug@amsat.org> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2021-07-12linux-user/syscall: Fix RF-kill errno (typo in ERFKILL)Philippe Mathieu-Daudé1-1/+1
Affected targets: alpha, hppa, mips/64, sparc Fixes: fe8ed7d5794 ("linux-user: Handle ERFKILL and EHWPOISON") Reviewed-by: Laurent Vivier <laurent@vivier.eu> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20210708170550.1846343-2-f4bug@amsat.org> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2021-07-12trace, lttng: require .pc filesPaolo Bonzini3-21/+3
The next version of lttng-libs will not require liburcu at run time anymore. Therefore, it is expected that distros will not include the urcubp libraries anymore when installing lttng-ust-devel. To avoid future problems, just require pkg-config to detect lttng-ust. The .pc files for lttng-ust correctly include liburcubp.a for static builds, and have always done since pkg-config files were added in 2011. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Message-id: 20210712155710.520889-1-pbonzini@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2021-07-12trace/simple: add st_init_groupGerd Hoffmann3-0/+17
Add helper function and call it for each trace event group added. Makes sure that events added at module load time are initialized properly. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Message-id: 20210601132414.432430-6-kraxel@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2021-07-12trace/simple: pass iter to st_write_event_mappingGerd Hoffmann1-5/+5
Pass an iter to st_write_event_mapping, so the function can interate different things depending on how we initialize the iter. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Message-id: 20210601132414.432430-5-kraxel@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2021-07-12trace: add trace_event_iter_init_groupGerd Hoffmann2-3/+29
This allows to interate over an event group. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Message-id: 20210601132414.432430-4-kraxel@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2021-07-12trace: iter init tweaksGerd Hoffmann6-16/+31
Rename trace_event_iter_init() to trace_event_iter_init_pattern(), add trace_event_iter_init_all() for interating over all events. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Message-id: 20210601132414.432430-3-kraxel@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2021-07-12qemu-trace-stap: changing SYSTEMTAP_TAPSET considered harmful.Gerd Hoffmann1-10/+4
Setting SYSTEMTAP_TAPSET to some value other than /usr/share/systemtap/tapsets results in systemtap not finding the standard tapset library any more, which in turn breaks tracing because pid() and other standard systemtap functions are not available any more. So using SYSTEMTAP_TAPSET to point systemtap to the qemu probes will only work for the prefix=/usr installs because both qemu and system tapsets in the same directory then. All other prefixes are broken. Fix that by using the "-I $tapsetdir" command line switch instead. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Message-id: 20210601132414.432430-2-kraxel@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2021-07-12nbd: register yank function earlierLukas Straub1-3/+5
Although unlikely, qemu might hang in nbd_send_request(). Allow recovery in this case by registering the yank function before calling it. Signed-off-by: Lukas Straub <lukasstraub2@web.de> Message-Id: <20210704000730.1befb596@gecko.fritz.box> Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> Signed-off-by: Eric Blake <eblake@redhat.com>
2021-07-12qemu-img: Reword 'qemu-img map --output=json' docsEric Blake1-10/+10
Reword the paragraphs to list the JSON key first, rather than in the middle of prose. Suggested-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> Signed-off-by: Eric Blake <eblake@redhat.com> Message-Id: <20210707184125.2551140-1-eblake@redhat.com> Reviewed-by: Nir Soffer <nsoffer@redhat.com> Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
2021-07-12qemu-img: Make unallocated part of backing chain obvious in mapEric Blake18-690/+749
The recently-added NBD context qemu:allocation-depth is able to distinguish between locally-present data (even when that data is sparse) [shown as depth 1 over NBD], and data that could not be found anywhere in the backing chain [shown as depth 0]; and the libnbd project was recently patched to give the human-readable name "absent" to an allocation-depth of 0. But qemu-img map --output=json predates that addition, and has the unfortunate behavior that all portions of the backing chain that resolve without finding a hit in any backing layer report the same depth as the final backing layer. This makes it harder to reconstruct a qcow2 backing chain using just 'qemu-img map' output, especially when using "backing":null to artificially limit a backing chain, because it is impossible to distinguish between a QCOW2_CLUSTER_UNALLOCATED (which defers to a [missing] backing file) and a QCOW2_CLUSTER_ZERO_PLAIN cluster (which would override any backing file), since both types of clusters otherwise show as "data":false,"zero":true" (but note that we can distinguish a QCOW2_CLUSTER_ZERO_ALLOCATED, which would also have an "offset": listing). The task of reconstructing a qcow2 chain was made harder in commit 0da9856851 (nbd: server: Report holes for raw images), because prior to that point, it was possible to abuse NBD's block status command to see which portions of a qcow2 file resulted in BDRV_BLOCK_ALLOCATED (showing up as NBD_STATE_ZERO in isolation) vs. missing from the chain (showing up as NBD_STATE_ZERO|NBD_STATE_HOLE); but now qemu reports more accurate sparseness information over NBD. An obvious solution is to make 'qemu-img map --output=json' add an additional "present":false designation to any cluster lacking an allocation anywhere in the chain, without any change to the "depth" parameter to avoid breaking existing clients. The iotests have several examples where this distinction demonstrates the additional accuracy. Signed-off-by: Eric Blake <eblake@redhat.com> Message-Id: <20210701190655.2131223-3-eblake@redhat.com> Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> [eblake: fix more iotest fallout] Signed-off-by: Eric Blake <eblake@redhat.com>
2021-07-12iotests: Improve and rename test 309 to nbd-qemu-allocationEric Blake2-2/+15
Enhance the test to inspect what qemu-nbd is advertising during handshake, and rename it now that we support useful iotest names. Signed-off-by: Eric Blake <eblake@redhat.com> Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> Message-Id: <20210701190655.2131223-2-eblake@redhat.com>
2021-07-12hw/sd/sdcard: Check for valid address range in SEND_WRITE_PROT (CMD30)Philippe Mathieu-Daudé4-1/+74
OSS-Fuzz found sending illegal addresses when querying the write protection bits triggers an assertion: qemu-fuzz-i386: hw/sd/sd.c:824: uint32_t sd_wpbits(SDState *, uint64_t): Assertion `wpnum < sd->wpgrps_size' failed. ==11578== ERROR: libFuzzer: deadly signal #8 0x7ffff628e091 in __assert_fail #9 0x5555588f1a3c in sd_wpbits hw/sd/sd.c:824:9 #10 0x5555588dd271 in sd_normal_command hw/sd/sd.c:1383:38 #11 0x5555588d777c in sd_do_command hw/sd/sd.c #12 0x555558cb25a0 in sdbus_do_command hw/sd/core.c:100:16 #13 0x555558e02a9a in sdhci_send_command hw/sd/sdhci.c:337:12 #14 0x555558dffa46 in sdhci_write hw/sd/sdhci.c:1187:9 #15 0x5555598b9d76 in memory_region_write_accessor softmmu/memory.c:489:5 Similarly to commit 8573378e62d ("hw/sd: fix out-of-bounds check for multi block reads"), check the address range before sending the status of the write protection bits. Include the qtest reproducer provided by Alexander Bulekov: $ make check-qtest-i386 ... Running test qtest-i386/fuzz-sdcard-test qemu-system-i386: ../hw/sd/sd.c:824: sd_wpbits: Assertion `wpnum < sd->wpgrps_size' failed. Reported-by: OSS-Fuzz (Issue 29225) Resolves: https://gitlab.com/qemu-project/qemu/-/issues/450 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Bin Meng <bmeng.cn@gmail.com> Reviewed-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <20210702155900.148665-4-f4bug@amsat.org>
2021-07-12hw/sd/sdcard: Extract address_in_range() helper, log invalid accessesPhilippe Mathieu-Daudé1-12/+21
Multiple commands have to check the address requested is valid. Extract this code pattern as a new address_in_range() helper, and log invalid accesses as guest errors. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Bin Meng <bmeng.cn@gmail.com> Message-Id: <20210624142209.1193073-3-f4bug@amsat.org>
2021-07-12hw/sd/sdcard: When card is in wrong state, log which state it isPhilippe Mathieu-Daudé1-1/+2
We report the card is in an inconsistent state, but don't precise in which state it is. Add this information, as it is useful when debugging problems. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Bin Meng <bmeng.cn@gmail.com> Message-Id: <20210624142209.1193073-2-f4bug@amsat.org> Reviewed-by: Alexander Bulekov <alxndr@bu.edu>
2021-07-11dp8393x: don't force 32-bit register accessMark Cave-Ayland1-5/+9
Commit 3fe9a838ec "dp8393x: Always use 32-bit accesses" set .impl.min_access_size and .impl.max_access_size to 4 to try and fix the Linux jazzsonic driver which uses 32-bit accesses. The problem with forcing the register access to 32-bit in this way is that since the dp8393x uses 16-bit registers, a manual endian swap is required for devices on big endian machines with 32-bit accesses. For both access sizes and machine endians the QEMU memory API can do the right thing automatically: all that is needed is to set .impl.min_access_size to 2 to declare that the dp8393x implements 16-bit registers. Normally .impl.max_access_size should also be set to 2, however that doesn't quite work in this case since the register stride is specified using a (dynamic) it_shift property which is applied during the MMIO access itself. The effect of this is that for a 32-bit access the memory API performs 2 x 16-bit accesses, but the use of it_shift within the MMIO access itself causes the register value to be repeated in both the top 16-bits and bottom 16-bits. The Linux jazzsonic driver expects the stride to be zero-extended up to access size and therefore fails to correctly detect the dp8393x device due to the extra data in the top 16-bits. The solution here is to remove .impl.max_access_size so that the memory API will correctly zero-extend the 16-bit registers to the access size up to and including it_shift. Since it_shift is never greater than 2 than this will always do the right thing for both 16-bit and 32-bit accesses regardless of the machine endian, allowing the manual endian swap code to be removed. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Fixes: 3fe9a838ec ("dp8393x: Always use 32-bit accesses") Message-Id: <20210705214929.17222-2-mark.cave-ayland@ilande.co.uk> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Tested-by: Finn Thain <fthain@linux-m68k.org> Tested-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
2021-07-11dp8393x: Rewrite dp8393x_get() / dp8393x_put()Philippe Mathieu-Daudé1-97/+63
Instead of accessing N registers via a single address_space API call using a temporary buffer (stored in the device state) and updating each register, move the address_space call in the register put/get. The load/store and word size checks are moved to put/get too. This simplifies a bit, making the code easier to read. Co-developed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Co-developed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Tested-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Tested-by: Finn Thain <fthain@linux-m68k.org> Message-Id: <20210710174954.2577195-8-f4bug@amsat.org>
2021-07-11dp8393x: Store CAM registers as 16-bitPhilippe Mathieu-Daudé1-15/+12
Per the DP83932C datasheet from July 1995: 4.0 SONIC Registers 4.1 THE CAM UNIT The Content Addressable Memory (CAM) consists of sixteen 48-bit entries for complete address filtering of network packets. Each entry corresponds to a 48-bit destination address that is user programmable and can contain any combination of Multicast or Physical addresses. Each entry is partitioned into three 16-bit CAM cells accessible through CAM Address Ports (CAP 2, CAP 1 and CAP 0) with CAP0 corresponding to the least significant 16 bits of the Destination Address and CAP2 corresponding to the most significant bits. Store the CAM registers as 16-bit as it simplifies the code. Having now the CAM registers as arrays of 3 uint16_t, we can avoid using the VMSTATE_BUFFER_UNSAFE macro by using VMSTATE_UINT16_2DARRAY which is more appropriate. This breaks the migration stream however. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Tested-by: Finn Thain <fthain@linux-m68k.org> Message-Id: <20210710174954.2577195-5-f4bug@amsat.org> Tested-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
2021-07-11dp8393x: Replace 0x40 magic value by SONIC_REG_COUNT definitionPhilippe Mathieu-Daudé1-3/+4
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Tested-by: Finn Thain <fthain@linux-m68k.org> Message-Id: <20210710174954.2577195-3-f4bug@amsat.org> Tested-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
2021-07-11dp8393x: Replace address_space_rw(is_write=1) by address_space_write()Philippe Mathieu-Daudé1-4/+4
Replace address_space_rw(is_write=1) by address_space_write() and remove pointless cast. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Tested-by: Finn Thain <fthain@linux-m68k.org> Message-Id: <20210710174954.2577195-2-f4bug@amsat.org> Tested-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
2021-07-11dp8393x: fix CAM descriptor entry indexMark Cave-Ayland1-2/+2
Currently when a LOAD CAM command is executed the entries are loaded into the CAM from memory in order which is incorrect. According to the datasheet the first entry in the CAM descriptor is the entry index which means that each descriptor may update any single entry in the CAM rather than the Nth entry. Decode the CAM entry index and use it store the descriptor in the appropriate slot in the CAM. This fixes the issue where the MacOS toolbox loads a single CAM descriptor into the final slot in order to perform a loopback test which must succeed before the Ethernet port is enabled. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Tested-by: Finn Thain <fthain@linux-m68k.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20210625065401.30170-10-mark.cave-ayland@ilande.co.uk> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>