]> git.proxmox.com Git - mirror_qemu.git/log
mirror_qemu.git
6 years agovpc: use DIV_ROUND_UP
Marc-André Lureau [Thu, 22 Jun 2017 11:04:16 +0000 (13:04 +0200)]
vpc: use DIV_ROUND_UP

I used the clang-tidy qemu-round check to generate the fix:
https://github.com/elmarco/clang-tools-extra

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Richard Henderson <rth@twiddle.net>
6 years agoqcow2: use DIV_ROUND_UP
Marc-André Lureau [Thu, 22 Jun 2017 11:04:16 +0000 (13:04 +0200)]
qcow2: use DIV_ROUND_UP

I used the clang-tidy qemu-round check to generate the fix:
https://github.com/elmarco/clang-tools-extra

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Richard Henderson <rth@twiddle.net>
6 years agodmg: use DIV_ROUND_UP
Marc-André Lureau [Thu, 22 Jun 2017 11:04:16 +0000 (13:04 +0200)]
dmg: use DIV_ROUND_UP

I used the clang-tidy qemu-round check to generate the fix:
https://github.com/elmarco/clang-tools-extra

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Richard Henderson <rth@twiddle.net>
6 years agopcspk: use QEMU_ALIGN_DOWN
Marc-André Lureau [Thu, 22 Jun 2017 11:04:16 +0000 (13:04 +0200)]
pcspk: use QEMU_ALIGN_DOWN

I used the clang-tidy qemu-round check to generate the fix:
https://github.com/elmarco/clang-tools-extra

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Richard Henderson <rth@twiddle.net>
6 years agoi8254: use QEMU_ALIGN_DOWN
Marc-André Lureau [Thu, 22 Jun 2017 11:04:16 +0000 (13:04 +0200)]
i8254: use QEMU_ALIGN_DOWN

I used the clang-tidy qemu-round check to generate the fix:
https://github.com/elmarco/clang-tools-extra

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <rth@twiddle.net>
6 years agovhost: use QEMU_ALIGN_DOWN
Marc-André Lureau [Thu, 22 Jun 2017 11:04:16 +0000 (13:04 +0200)]
vhost: use QEMU_ALIGN_DOWN

I used the clang-tidy qemu-round check to generate the fix:
https://github.com/elmarco/clang-tools-extra

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Richard Henderson <rth@twiddle.net>
6 years agovhdx: use QEMU_ALIGN_DOWN
Marc-André Lureau [Thu, 22 Jun 2017 11:04:16 +0000 (13:04 +0200)]
vhdx: use QEMU_ALIGN_DOWN

I used the clang-tidy qemu-round check to generate the fix:
https://github.com/elmarco/clang-tools-extra

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Richard Henderson <rth@twiddle.net>
6 years agovnc: use QEMU_ALIGN_DOWN
Marc-André Lureau [Thu, 22 Jun 2017 11:04:16 +0000 (13:04 +0200)]
vnc: use QEMU_ALIGN_DOWN

I used the clang-tidy qemu-round check to generate the fix:
https://github.com/elmarco/clang-tools-extra

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Richard Henderson <rth@twiddle.net>
6 years agoi386: use ROUND_UP macro
Marc-André Lureau [Tue, 6 Jun 2017 15:44:01 +0000 (19:44 +0400)]
i386: use ROUND_UP macro

I used the clang-tidy qemu-round check (with the option OnlyAlignUp)
to generate the fix:
https://github.com/elmarco/clang-tools-extra

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Juan Quintela <quintela@redhat.com>
Acked-by: Eduardo Habkost <ehabkost@redhat.com>
Reviewed-by: Richard Henderson <rth@twiddle.net>
6 years agoslirp: fix clearing ifq_so from pending packets
Samuel Thibault [Thu, 24 Aug 2017 23:35:53 +0000 (01:35 +0200)]
slirp: fix clearing ifq_so from pending packets

The if_fastq and if_batchq contain not only packets, but queues of packets
for the same socket. When sofree frees a socket, it thus has to clear ifq_so
from all the packets from the queues, not only the first.

Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Cc: qemu-stable@nongnu.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
6 years agoOpen 2.11 development tree
Peter Maydell [Wed, 30 Aug 2017 22:10:38 +0000 (23:10 +0100)]
Open 2.11 development tree

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
6 years agoUpdate version for v2.10.0 release
Peter Maydell [Wed, 30 Aug 2017 16:02:54 +0000 (17:02 +0100)]
Update version for v2.10.0 release

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
6 years agoUpdate version for v2.10.0-rc4 release
Peter Maydell [Thu, 24 Aug 2017 16:34:26 +0000 (17:34 +0100)]
Update version for v2.10.0-rc4 release

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
6 years agoMerge remote-tracking branch 'remotes/ericb/tags/pull-nbd-2017-08-23' into staging
Peter Maydell [Wed, 23 Aug 2017 16:38:01 +0000 (17:38 +0100)]
Merge remote-tracking branch 'remotes/ericb/tags/pull-nbd-2017-08-23' into staging

nbd patches for 2017-08-23

- Fam Zheng: 0/4 block: Fix non-shared storage migration
- Stefan Hajnoczi: qemu-iotests: add 194 non-shared storage migration test
- Stefan Hajnoczi: nbd-client: avoid spurious qio_channel_yield() re-entry

# gpg: Signature made Wed 23 Aug 2017 17:22:53 BST
# gpg:                using RSA key 0xA7A16B4A2527436A
# gpg: Good signature from "Eric Blake <eblake@redhat.com>"
# gpg:                 aka "Eric Blake (Free Software Programmer) <ebb9@byu.net>"
# gpg:                 aka "[jpeg image of size 6874]"
# Primary key fingerprint: 71C2 CC22 B1C4 6029 27D2  F3AA A7A1 6B4A 2527 436A

* remotes/ericb/tags/pull-nbd-2017-08-23:
  nbd-client: avoid spurious qio_channel_yield() re-entry
  qemu-iotests: add 194 non-shared storage migration test
  block: Update open_flags after ->inactivate() callback
  mirror: Mark target BB as "force allow inactivate"
  block-backend: Allow more "can inactivate" cases
  block-backend: Refactor inactivate check

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
6 years agonbd-client: avoid spurious qio_channel_yield() re-entry
Stefan Hajnoczi [Tue, 22 Aug 2017 12:51:13 +0000 (13:51 +0100)]
nbd-client: avoid spurious qio_channel_yield() re-entry

The following scenario leads to an assertion failure in
qio_channel_yield():

1. Request coroutine calls qio_channel_yield() successfully when sending
   would block on the socket.  It is now yielded.
2. nbd_read_reply_entry() calls nbd_recv_coroutines_enter_all() because
   nbd_receive_reply() failed.
3. Request coroutine is entered and returns from qio_channel_yield().
   Note that the socket fd handler has not fired yet so
   ioc->write_coroutine is still set.
4. Request coroutine attempts to send the request body with nbd_rwv()
   but the socket would still block.  qio_channel_yield() is called
   again and assert(!ioc->write_coroutine) is hit.

The problem is that nbd_read_reply_entry() does not distinguish between
request coroutines that are waiting to receive a reply and those that
are not.

This patch adds a per-request bool receiving flag so
nbd_read_reply_entry() can avoid spurious aio_wake() calls.

Reported-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-Id: <20170822125113.5025-1-stefanha@redhat.com>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Tested-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Eric Blake <eblake@redhat.com>
6 years agoqemu-iotests: add 194 non-shared storage migration test
Stefan Hajnoczi [Wed, 23 Aug 2017 14:05:06 +0000 (15:05 +0100)]
qemu-iotests: add 194 non-shared storage migration test

Non-shared storage migration with NBD and drive-mirror is currently not
tested by qemu-iotests.  This test case covers the basic migration
scenario.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Based-on: <20170823134242.12080-1-famz@redhat.com>
Message-Id: <20170823140506.28723-1-stefanha@redhat.com>
Tested-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Eric Blake <eblake@redhat.com>
6 years agoblock: Update open_flags after ->inactivate() callback
Stefan Hajnoczi [Wed, 23 Aug 2017 13:42:42 +0000 (21:42 +0800)]
block: Update open_flags after ->inactivate() callback

In the ->inactivate() callbacks, permissions are updated, which
typically involves a recursive check of the whole graph. Setting
BDRV_O_INACTIVE right before doing that creates a state that
bdrv_is_writable() returns false, which causes permission update
failure.

Reorder them so the flag is updated after calling the function. Note
that this doesn't break the assert in bdrv_child_cb_inactivate() because
for any specific BDS, we still update its flags first before calling
->inactivate() on it one level deeper in the recursion.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Fam Zheng <famz@redhat.com>
Message-Id: <20170823134242.12080-5-famz@redhat.com>
Tested-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Signed-off-by: Eric Blake <eblake@redhat.com>
6 years agomirror: Mark target BB as "force allow inactivate"
Fam Zheng [Wed, 23 Aug 2017 13:42:41 +0000 (21:42 +0800)]
mirror: Mark target BB as "force allow inactivate"

Signed-off-by: Fam Zheng <famz@redhat.com>
Message-Id: <20170823134242.12080-4-famz@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Eric Blake <eblake@redhat.com>
6 years agoblock-backend: Allow more "can inactivate" cases
Fam Zheng [Wed, 23 Aug 2017 13:42:40 +0000 (21:42 +0800)]
block-backend: Allow more "can inactivate" cases

These two conditions corresponds to mirror job's source and target,
which need to be allowed as they are part of the non-shared storage
migration workflow: failing to inactivate either will result in a
failure during migration completion.

Signed-off-by: Fam Zheng <famz@redhat.com>
Message-Id: <20170823134242.12080-3-famz@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
[eblake: improve comment grammar]
Signed-off-by: Eric Blake <eblake@redhat.com>
6 years agoblock-backend: Refactor inactivate check
Fam Zheng [Wed, 23 Aug 2017 13:42:39 +0000 (21:42 +0800)]
block-backend: Refactor inactivate check

The logic will be fixed (extended), move it to a separate function.

Signed-off-by: Fam Zheng <famz@redhat.com>
Message-Id: <20170823134242.12080-2-famz@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Eric Blake <eblake@redhat.com>
6 years agonuma: Move numa_legacy_auto_assign_ram to pc-i440fx-2.9
Eduardo Habkost [Fri, 18 Aug 2017 19:09:43 +0000 (16:09 -0300)]
numa: Move numa_legacy_auto_assign_ram to pc-i440fx-2.9

The 'm->numa_auto_assign_ram = numa_legacy_auto_assign_ram;' line
was supposed to be in pc_i440fx_2_9_machine_options() (see commit
3bfe5716 "numa: equally distribute memory on nodes"), but the
merge commit adb354dd ("Merge remote-tracking branch
'mst/tags/for_upstream' into staging") moved it to the
pc_i440fx_2_10_machine_options().

Move the line back to pc_i440fx_2_9_machine_options().

Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Message-id: 20170818190943.23858-1-ehabkost@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
6 years agofix build failure in nbd_read_reply_entry()
Igor Mammedov [Thu, 17 Aug 2017 16:14:13 +0000 (18:14 +0200)]
fix build failure in nbd_read_reply_entry()

travis builds fail at HEAD at rc3 master with

  block/nbd-client.c: In function ‘nbd_read_reply_entry’:
  block/nbd-client.c:110:8: error: ‘ret’ may be used uninitialized in this function [-Werror=uninitialized]

fix it by initializing 'ret' to 0

Signed-off-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
6 years agoMerge remote-tracking branch 'remotes/dgibson/tags/ppc-for-2.10-20170823' into staging
Peter Maydell [Wed, 23 Aug 2017 08:04:20 +0000 (09:04 +0100)]
Merge remote-tracking branch 'remotes/dgibson/tags/ppc-for-2.10-20170823' into staging

ppc patch queue 2017-08-23

This is identical to the pull request from yesterday (20180822),
except that a bug in one patch is fixed so that it doesn't break TCG
on a ppc host.

Last minute ppc related fixes for qemu-2.10.  I'm not sure if these
are critical enough to prompt another rc, but I'm submitting them for
consideration.

First, is Cornelia's fix for 480bc11e6 which meant "make check" would
always fail on a ppc host.  Tracking that down delayed submission of
the rest of these patches, sorry.

The rest are all fairly important bugfixes for qemu crashes or guest
behaviour regression on ppc.  Patches 2-4 specifically are fixes for
regressions from qemu-2.9, caused by the compatibility mode and
hotplug handling cleanups for the pseries machine type.

# gpg: Signature made Wed 23 Aug 2017 01:31:47 BST
# gpg:                using RSA key 0x6C38CACA20D9B392
# gpg: Good signature from "David Gibson <david@gibson.dropbear.id.au>"
# gpg:                 aka "David Gibson (Red Hat) <dgibson@redhat.com>"
# gpg:                 aka "David Gibson (ozlabs.org) <dgibson@ozlabs.org>"
# gpg:                 aka "David Gibson (kernel.org) <dwg@kernel.org>"
# Primary key fingerprint: 75F4 6586 AE61 A66C C44E  87DC 6C38 CACA 20D9 B392

* remotes/dgibson/tags/ppc-for-2.10-20170823:
  hw/ppc/spapr_iommu: Fix crash when removing the "spapr-tce-table" device
  hw/ppc/spapr_rtc: Mark the RTC device with user_creatable = false
  hw/ppc/spapr: Fix segfault when instantiating a 'pc-dimm' without 'memdev'
  spapr: Allow configure-connector to be called multiple times
  ppc: fix ppc_set_compat() with KVM PR
  target/ppc: 'PVR != host PVR' in KVM_SET_SREGS workaround
  boot-serial-test: prefer tcg accelerator

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
6 years agohw/ppc/spapr_iommu: Fix crash when removing the "spapr-tce-table" device
Thomas Huth [Thu, 17 Aug 2017 14:19:16 +0000 (16:19 +0200)]
hw/ppc/spapr_iommu: Fix crash when removing the "spapr-tce-table" device

QEMU currently aborts unexpectedly when the user tries to add and
remove a "spapr-tce-table" device:

$ qemu-system-ppc64 -nographic -S -nodefaults -monitor stdio
QEMU 2.9.92 monitor - type 'help' for more information
(qemu) device_add spapr-tce-table,id=x
(qemu) device_del x
**
ERROR:qemu/qdev-monitor.c:872:qdev_unplug: assertion failed: (hotplug_ctrl)
Aborted (core dumped)

The device should not be accessable for the users at all, it's just
used internally, so mark it with user_creatable = false.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
6 years agohw/ppc/spapr_rtc: Mark the RTC device with user_creatable = false
Thomas Huth [Thu, 17 Aug 2017 05:15:10 +0000 (07:15 +0200)]
hw/ppc/spapr_rtc: Mark the RTC device with user_creatable = false

QEMU currently aborts unexpectedly when a user tries to do something
like this:

$ qemu-system-ppc64 -nographic -S -nodefaults -monitor stdio
QEMU 2.9.92 monitor - type 'help' for more information
(qemu) device_add spapr-rtc,id=spapr-rtc
(qemu) device_del spapr-rtc
**
ERROR:qemu/qdev-monitor.c:872:qdev_unplug: assertion failed: (hotplug_ctrl)
Aborted (core dumped)

The RTC device is not meant to be hot-pluggable - it's an internal
device only and it even should not be possible to create it a
second time with the "-device" parameter, so let's mark this
with "user_creatable = false".

Signed-off-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
6 years agohw/ppc/spapr: Fix segfault when instantiating a 'pc-dimm' without 'memdev'
Thomas Huth [Mon, 21 Aug 2017 06:30:29 +0000 (08:30 +0200)]
hw/ppc/spapr: Fix segfault when instantiating a 'pc-dimm' without 'memdev'

QEMU currently crashes when trying to use a 'pc-dimm' on the pseries
machine without specifying its 'memdev' property. This happens because
pc_dimm_get_memory_region() does not check whether the 'memdev' property
has properly been set by the user. Looking closer at this function, it's
also obvious that it is using &error_abort to call another function - and
this is bad in a function that is used in the hot-plugging calling chain
since this can also cause QEMU to exit unexpectedly.

So let's fix these issues in a proper way now: Add a "Error **errp"
parameter to pc_dimm_get_memory_region() which we use in case the 'memdev'
property has not been set by the user, and which we can use instead of
the &error_abort, and change the callers of get_memory_region() to make
use of this "errp" parameter for proper error checking.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
6 years agospapr: Allow configure-connector to be called multiple times
Bharata B Rao [Thu, 17 Aug 2017 05:16:42 +0000 (10:46 +0530)]
spapr: Allow configure-connector to be called multiple times

In case of in-kernel memory hot unplug, when the guest is not able
to remove all the LMBs that are requested for removal, it will add back
any LMBs that have been successfully removed. The DR Connectors of
these LMBs wouldn't have been unconfigured and hence the addition of
these LMBs will result in configure-connector call being issued on
LMB DR connectors that are already in configured state. Such
configure-connector calls will fail resulting in a DIMM which is
partially unplugged.

This however worked till recently before we overhauled the DRC
implementation in QEMU. Commit 9d4c0f4f0a71e: "spapr: Consolidate
DRC state variables" is the first commit where this problem shows up
as per git bisect.

Ideally guest shouldn't be issuing configure-connector call on an
already configured DR connector. However for now, work around this in
QEMU by allowing configure-connector to be called multiple times for
all types of DR connectors.

Signed-off-by: Bharata B Rao <bharata@linux.vnet.ibm.com>
[dwg: Corrected buglet that would have initialized fdt pointers ready
 for reading on a device not present at reset]
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
6 years agoppc: fix ppc_set_compat() with KVM PR
Greg Kurz [Mon, 14 Aug 2017 17:49:16 +0000 (19:49 +0200)]
ppc: fix ppc_set_compat() with KVM PR

When running in KVM PR mode, kvmppc_set_compat() always fail because the
current PR implementation doesn't handle KVM_REG_PPC_ARCH_COMPAT. Now that
the machine code inconditionally calls ppc_set_compat_all() at reset time
to restore the compat mode default value (commit 66d5c492dd3a9), it is
impossible to start a guest with PR:

qemu-system-ppc64: Unable to set CPU compatibility mode in KVM:
 Invalid argument

A tentative patch [1] was recently sent by Suraj to address the issue, but
it would prevent the compat mode to be turned off on reset. And we really
don't want to explicitely check for KVM PR. During the patch's review,
David suggested that we should only call the KVM ioctl() if the compat
PVR changes. This allows at least to run with KVM PR, provided no compat
mode is requested from the command line (which should be the case when
running PR nested). This is what this patch does.

While here, we also fix the side effect where KVM would fail but we would
change the CPU state in QEMU anyway.

[1] http://patchwork.ozlabs.org/patch/782039/

Signed-off-by: Greg Kurz <groug@kaod.org>
Reviewed-by: Suraj Jitindar Singh <sjitindarsingh@gmail.com>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
6 years agotarget/ppc: 'PVR != host PVR' in KVM_SET_SREGS workaround
Daniel Henrique Barboza [Wed, 9 Aug 2017 20:43:46 +0000 (17:43 -0300)]
target/ppc: 'PVR != host PVR' in KVM_SET_SREGS workaround

Commit d5fc133eed ("ppc: Rework CPU compatibility testing
across migration") changed the way cpu_post_load behaves with
the PVR setting, causing an unexpected bug in KVM-HV migrations
between hosts that are compatible (POWER8 and POWER8E, for example).
Even with pvr_match() returning true, the guest freezes right after
cpu_post_load. The reason is that the guest kernel can't handle a
different PVR value other that the running host in KVM_SET_SREGS.

In [1] it was discussed the possibility of a new KVM capability
that would indicate that the guest kernel can handle a different
PVR in KVM_SET_SREGS. Even if such feature is implemented, there is
still the problem with older kernels that will not have this capability
and will fail to migrate.

This patch implements a workaround for that scenario. If running
with KVM, check if the guest kernel does not have the capability
(named here as 'cap_ppc_pvr_compat'). If it doesn't, calls
kvmppc_is_pr() to see if the guest is running in KVM-HV. If all this
happens, set env->spr[SPR_PVR] to the same value as the current
host PVR. This ensures that we allow migrations with 'close enough'
PVRs to still work in KVM-HV but also makes the code ready for
this new KVM capability when it is done.

A new function called 'kvmppc_pvr_workaround_required' was created
to encapsulate the conditions said above and to avoid calling too
many kvm.c internals inside cpu_post_load.

[1] https://lists.gnu.org/archive/html/qemu-ppc/2017-06/msg00503.html

Signed-off-by: Daniel Henrique Barboza <danielhb@linux.vnet.ibm.com>
[dwg: Fix for the case of using TCG on a PPC host]
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
6 years agoboot-serial-test: prefer tcg accelerator
Cornelia Huck [Wed, 16 Aug 2017 08:26:50 +0000 (10:26 +0200)]
boot-serial-test: prefer tcg accelerator

Prefer to use the tcg accelarator if it is available: This is our only
real smoke test for tcg, and fast enough to use it for that.

Fixes: 480bc11e6 ("boot-serial-test: fallback to kvm accelerator")
Reported-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Cornelia Huck <cohuck@redhat.com>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
6 years agoUpdate version for v2.10.0-rc3 release
Peter Maydell [Tue, 15 Aug 2017 17:53:31 +0000 (18:53 +0100)]
Update version for v2.10.0-rc3 release

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
6 years agoMerge remote-tracking branch 'remotes/ericb/tags/pull-nbd-2017-08-15' into staging
Peter Maydell [Tue, 15 Aug 2017 17:17:02 +0000 (18:17 +0100)]
Merge remote-tracking branch 'remotes/ericb/tags/pull-nbd-2017-08-15' into staging

nbd patches for 2017-08-15

- Eric Blake: nbd: Fix trace message for disconnect
- Stefan Hajnoczi: qemu-iotests: step clock after each test iteration
- Fam Zheng: 0/4 block: Fix non-shared storage migration
- Eric Blake: nbd-client: Fix regression when server sends garbage

# gpg: Signature made Tue 15 Aug 2017 16:06:02 BST
# gpg:                using RSA key 0xA7A16B4A2527436A
# gpg: Good signature from "Eric Blake <eblake@redhat.com>"
# gpg:                 aka "Eric Blake (Free Software Programmer) <ebb9@byu.net>"
# gpg:                 aka "[jpeg image of size 6874]"
# Primary key fingerprint: 71C2 CC22 B1C4 6029 27D2  F3AA A7A1 6B4A 2527 436A

* remotes/ericb/tags/pull-nbd-2017-08-15:
  nbd-client: Fix regression when server sends garbage
  iotests: Add non-shared storage migration case 192
  block-backend: Defer shared_perm tightening migration completion
  nbd: Fix order of bdrv_set_perm and bdrv_invalidate_cache
  stubs: Add vm state change handler stubs
  qemu-iotests: step clock after each test iteration
  nbd: Fix trace message for disconnect

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
6 years agommio-interface: Mark as not user creatable
Peter Maydell [Tue, 15 Aug 2017 14:30:18 +0000 (15:30 +0100)]
mmio-interface: Mark as not user creatable

The mmio-interface device is not something we want to allow
users to create on the command line:
 * it is intended as an implementation detail of the memory
   subsystem, which gets created and deleted by that
   subsystem on demand; it makes no sense to create it
   by hand on the command line
 * it uses a pointer property 'host_ptr' which can't be
   set on the command line

Mark the device as not user_creatable to avoid confusion.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 1502807418-9994-1-git-send-email-peter.maydell@linaro.org
Reviewed-by: Thomas Huth <thuth@redhat.com>
6 years agotarget/arm: Require alignment for load exclusive
Alistair Francis [Tue, 15 Aug 2017 14:57:14 +0000 (07:57 -0700)]
target/arm: Require alignment for load exclusive

According to the ARM ARM exclusive loads require the same alignment as
exclusive stores. Let's update the memops used for the load to match
that of the store. This adds the alignment requirement to the memops.

Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20170815145714.17635-4-richard.henderson@linaro.org
[rth: Require 16-byte alignment for 64-bit LDXP.]
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
6 years agotarget/arm: Correct load exclusive pair atomicity
Richard Henderson [Tue, 15 Aug 2017 14:57:13 +0000 (07:57 -0700)]
target/arm: Correct load exclusive pair atomicity

We are not providing the required single-copy atomic semantics for
the 64-bit operation that is the 32-bit paired load.

At the same time, leave the entire 64-bit value in cpu_exclusive_val
and stop writing to cpu_exclusive_high.  This means that we do not
have to re-assemble the 64-bit quantity when it comes time to store.

At the same time, drop a redundant temporary and perform all loads
directly into the cpu_exclusive_* globals.

Tested-by: Alistair Francis <alistair.francis@xilinx.com>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20170815145714.17635-3-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
6 years agotarget/arm: Correct exclusive store cmpxchg memop mask
Alistair Francis [Tue, 15 Aug 2017 14:57:12 +0000 (07:57 -0700)]
target/arm: Correct exclusive store cmpxchg memop mask

When we perform the atomic_cmpxchg operation we want to perform the
operation on a pair of 32-bit registers. Previously we were just passing
the register size in which was set to MO_32. This would result in the
high register to be ignored. To fix this issue we hardcode the size to
be 64-bits long when operating on 32-bit pairs.

Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Tested-by: Portia Stephens <portia.stephens@xilinx.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20170815145714.17635-2-richard.henderson@linaro.org
Message-Id: <bc18dddca56e8c2ea4a3def48d33ceb5d21d1fff.1502488636.git.alistair.francis@xilinx.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
6 years agonbd-client: Fix regression when server sends garbage
Eric Blake [Mon, 14 Aug 2017 21:34:26 +0000 (16:34 -0500)]
nbd-client: Fix regression when server sends garbage

When we switched NBD to use coroutines for qemu 2.9 (in particular,
commit a12a712a), we introduced a regression: if a server sends us
garbage (such as a corrupted magic number), we quit the read loop
but do not stop sending further queued commands, resulting in the
client hanging when it never reads the response to those additional
commands.  In qemu 2.8, we properly detected that the server is no
longer reliable, and cancelled all existing pending commands with
EIO, then tore down the socket so that all further command attempts
get EPIPE.

Restore the proper behavior of quitting (almost) all communication
with a broken server: Once we know we are out of sync or otherwise
can't trust the server, we must assume that any further incoming
data is unreliable and therefore end all pending commands with EIO,
and quit trying to send any further commands.  As an exception, we
still (try to) send NBD_CMD_DISC to let the server know we are going
away (in part, because it is easier to do that than to further
refactor nbd_teardown_connection, and in part because it is the
only command where we do not have to wait for a reply).

Based on a patch by Vladimir Sementsov-Ogievskiy.

A malicious server can be created with the following hack,
followed by setting NBD_SERVER_DEBUG to a non-zero value in the
environment when running qemu-nbd:

| --- a/nbd/server.c
| +++ b/nbd/server.c
| @@ -919,6 +919,17 @@ static int nbd_send_reply(QIOChannel *ioc, NBDReply *reply, Error **errp)
|      stl_be_p(buf + 4, reply->error);
|      stq_be_p(buf + 8, reply->handle);
|
| +    static int debug;
| +    static int count;
| +    if (!count++) {
| +        const char *str = getenv("NBD_SERVER_DEBUG");
| +        if (str) {
| +            debug = atoi(str);
| +        }
| +    }
| +    if (debug && !(count % debug)) {
| +        buf[0] = 0;
| +    }
|      return nbd_write(ioc, buf, sizeof(buf), errp);
|  }

Reported-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Signed-off-by: Eric Blake <eblake@redhat.com>
Message-Id: <20170814213426.24681-1-eblake@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
6 years agoiotests: Add non-shared storage migration case 192
Fam Zheng [Tue, 15 Aug 2017 13:07:40 +0000 (21:07 +0800)]
iotests: Add non-shared storage migration case 192

Signed-off-by: Fam Zheng <famz@redhat.com>
Message-Id: <20170815130740.31229-5-famz@redhat.com>
Tested-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Eric Blake <eblake@redhat.com>
6 years agoblock-backend: Defer shared_perm tightening migration completion
Fam Zheng [Tue, 15 Aug 2017 13:07:39 +0000 (21:07 +0800)]
block-backend: Defer shared_perm tightening migration completion

As in the case of nbd_export_new(), bdrv_invalidate_cache() can be
called when migration is still in progress. In this case we are not
ready to tighten the shared permissions fenced by blk->disable_perm.

Defer to a VM state change handler.

Signed-off-by: Fam Zheng <famz@redhat.com>
Message-Id: <20170815130740.31229-4-famz@redhat.com>
Signed-off-by: Eric Blake <eblake@redhat.com>
6 years agonbd: Fix order of bdrv_set_perm and bdrv_invalidate_cache
Kevin Wolf [Tue, 15 Aug 2017 13:07:38 +0000 (21:07 +0800)]
nbd: Fix order of bdrv_set_perm and bdrv_invalidate_cache

The "inactive" state of BDS affects whether the permissions can be
granted, we must call bdrv_invalidate_cache before bdrv_set_perm to
support "-incoming defer" case.

Reported-by: Christian Ehrhardt <christian.ehrhardt@canonical.com>
Signed-off-by: Fam Zheng <famz@redhat.com>
Message-Id: <20170815130740.31229-3-famz@redhat.com>
Signed-off-by: Eric Blake <eblake@redhat.com>
6 years agostubs: Add vm state change handler stubs
Fam Zheng [Tue, 15 Aug 2017 13:07:37 +0000 (21:07 +0800)]
stubs: Add vm state change handler stubs

They will be used by BlockBackend code in block-obj-y, which doesn't
always get linked with common-obj-y. Add stubs to keep ld happy.

Signed-off-by: Fam Zheng <famz@redhat.com>
Message-Id: <20170815130740.31229-2-famz@redhat.com>
Signed-off-by: Eric Blake <eblake@redhat.com>
6 years agoqemu-iotests: step clock after each test iteration
Stefan Hajnoczi [Tue, 15 Aug 2017 13:05:02 +0000 (14:05 +0100)]
qemu-iotests: step clock after each test iteration

The 093 throttling test submits twice as many requests as the throttle
limit in order to ensure that we reach the limit.  The remaining
requests are left in-flight at the end of each test iteration.

Commit 452589b6b47e8dc6353df257fc803dfc1383bed8 ("vl.c/exit: pause cpus
before closing block devices") exposed a hang in 093.  This happens
because requests are still in flight when QEMU terminates but
QEMU_CLOCK_VIRTUAL time is frozen.  bdrv_drain_all() hangs forever since
throttled requests cannot complete.

Step the clock at the end of each test iteration so in-flight requests
actually finish.  This solves the hang and is cleaner than leaving tests
in-flight.

Note that this could also be "fixed" by disabling throttling when drives
are closed in QEMU.  That approach has two issues:

1. We must drain requests before disabling throttling, so the hang
   cannot be easily avoided!

2. Any time QEMU disables throttling internally there is a chance that
   malicious users can abuse the code path to bypass throttling limits.

Therefore it makes more sense to fix the test case than to modify QEMU.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-Id: <20170815130502.8736-1-stefanha@redhat.com>
Signed-off-by: Eric Blake <eblake@redhat.com>
6 years agonbd: Fix trace message for disconnect
Eric Blake [Fri, 11 Aug 2017 01:57:48 +0000 (20:57 -0500)]
nbd: Fix trace message for disconnect

NBD_CMD_DISC is a disconnect request, not a data discard request.

Signed-off-by: Eric Blake <eblake@redhat.com>
Message-Id: <20170811015749.20365-1-eblake@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
6 years agoqxl: call qemu_spice_display_init_common for secondary devices
Paolo Bonzini [Mon, 14 Aug 2017 23:15:52 +0000 (01:15 +0200)]
qxl: call qemu_spice_display_init_common for secondary devices

Fixes this 2.10 regression:

  $ qemu-system-x86_64  -cpu host -m 6144 -vga qxl -device qxl
  qemu-system-x86_64: util/qemu-thread-posix.c:64: qemu_mutex_lock: Assertion `mutex->initialized' failed.

Reported-by: ademaria@redhat.com
Reviewed-by: Daniel P. Berrange <berrange@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Message-id: 20170814231552.24593-1-pbonzini@redhat.com
Cc: kraxel@redhat.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
6 years agoMerge remote-tracking branch 'remotes/stefanha/tags/tracing-pull-request' into staging
Peter Maydell [Tue, 15 Aug 2017 13:29:03 +0000 (14:29 +0100)]
Merge remote-tracking branch 'remotes/stefanha/tags/tracing-pull-request' into staging

# gpg: Signature made Tue 15 Aug 2017 14:27:34 BST
# gpg:                using RSA key 0x9CA4ABB381AB73C8
# gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>"
# gpg:                 aka "Stefan Hajnoczi <stefanha@gmail.com>"
# Primary key fingerprint: 8695 A8BF D3F9 7CDA AC35  775A 9CA4 ABB3 81AB 73C8

* remotes/stefanha/tags/tracing-pull-request:
  simpletrace: fix flight recorder --no-header option
  trace: use static event ID mapping in simpletrace.stp

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
6 years agosimpletrace: fix flight recorder --no-header option
Stefan Hajnoczi [Tue, 15 Aug 2017 08:44:30 +0000 (09:44 +0100)]
simpletrace: fix flight recorder --no-header option

The simpletrace.py script can pretty-print flight recorder ring buffers.
These are not full simpletrace binary trace files but just the end of a
trace file.  There is no header and the event ID mapping information is
often unavailable since the ring buffer may have filled up and discarded
event ID mapping records.

The simpletrace.stp script that generates ring buffer traces uses the
same trace-events-all input file as simpletrace.py.  Therefore both
scripts have the same global ordering of trace events.  A dynamic event
ID mapping isn't necessary: just use the trace-events-all file as the
reference for how event IDs are numbered.

It is now possible to analyze simpletrace.stp ring buffers again using:

  $ ./simpletrace.py trace-events-all path/to/ring-buffer

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Daniel P. Berrange <berrange@redhat.com>
Message-id: 20170815084430.7128-3-stefanha@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
6 years agotrace: use static event ID mapping in simpletrace.stp
Stefan Hajnoczi [Tue, 15 Aug 2017 08:44:29 +0000 (09:44 +0100)]
trace: use static event ID mapping in simpletrace.stp

This is a partial revert of commit
7f1b588f20d027730676e627713ae3bbf6baab04 ("trace: emit name <-> ID
mapping in simpletrace header"), which broke the SystemTap flight
recorder because event mapping records may not be present in the ring
buffer when the trace is analyzed.  This means simpletrace.py
--no-header does not know the event ID mapping needed to pretty-print
the trace.

Instead of numbering events dynamically, use a static event ID mapping
as dictated by the event order in the trace-events-all file.

The simpletrace.py script also uses trace-events-all so the next patch
will fix the simpletrace.py --no-header option to take advantage of this
knowledge.

Cc: Daniel P. Berrange <berrange@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Daniel P. Berrange <berrange@redhat.com>
Message-id: 20170815084430.7128-2-stefanha@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
6 years agoMerge remote-tracking branch 'remotes/famz/tags/build-and-test-pull-request' into...
Peter Maydell [Tue, 15 Aug 2017 11:10:50 +0000 (12:10 +0100)]
Merge remote-tracking branch 'remotes/famz/tags/build-and-test-pull-request' into staging

# gpg: Signature made Tue 15 Aug 2017 11:50:36 BST
# gpg:                using RSA key 0xCA35624C6A9171C6
# gpg: Good signature from "Fam Zheng <famz@redhat.com>"
# gpg: WARNING: This key is not certified with sufficiently trusted signatures!
# gpg:          It is not certain that the signature belongs to the owner.
# Primary key fingerprint: 5003 7CB7 9706 0F76 F021  AD56 CA35 624C 6A91 71C6

* remotes/famz/tags/build-and-test-pull-request:
  docker: add centos7 image
  docker: install more packages on CentOS to extend code coverage
  docker: add Xen libs to centos6 image
  docker: use one package per line in CentOS config
  Makefile: Let "make check-help" work without running ./configure

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
6 years agoMerge remote-tracking branch 'remotes/cohuck/tags/s390x-20170815' into staging
Peter Maydell [Tue, 15 Aug 2017 08:39:14 +0000 (09:39 +0100)]
Merge remote-tracking branch 'remotes/cohuck/tags/s390x-20170815' into staging

Regression fix for 'make clean' on s390x.

# gpg: Signature made Tue 15 Aug 2017 08:24:54 BST
# gpg:                using RSA key 0xDECF6B93C6F02FAF
# gpg: Good signature from "Cornelia Huck <conny@cornelia-huck.de>"
# gpg:                 aka "Cornelia Huck <huckc@linux.vnet.ibm.com>"
# gpg:                 aka "Cornelia Huck <cornelia.huck@de.ibm.com>"
# gpg:                 aka "Cornelia Huck <cohuck@kernel.org>"
# gpg:                 aka "Cornelia Huck <cohuck@redhat.com>"
# Primary key fingerprint: C3D0 D66D C362 4FF6 A8C0  18CE DECF 6B93 C6F0 2FAF

* remotes/cohuck/tags/s390x-20170815:
  pc-bios/s390-ccw: Use rm command during make clean

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
6 years agodocker: add centos7 image
Philippe Mathieu-Daudé [Fri, 28 Jul 2017 23:33:16 +0000 (20:33 -0300)]
docker: add centos7 image

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-Id: <20170728233316.13352-5-f4bug@amsat.org>
Signed-off-by: Fam Zheng <famz@redhat.com>
6 years agodocker: install more packages on CentOS to extend code coverage
Philippe Mathieu-Daudé [Fri, 28 Jul 2017 23:33:15 +0000 (20:33 -0300)]
docker: install more packages on CentOS to extend code coverage

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-Id: <20170728233316.13352-4-f4bug@amsat.org>
Signed-off-by: Fam Zheng <famz@redhat.com>
6 years agodocker: add Xen libs to centos6 image
Philippe Mathieu-Daudé [Fri, 28 Jul 2017 23:33:14 +0000 (20:33 -0300)]
docker: add Xen libs to centos6 image

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-Id: <20170728233316.13352-3-f4bug@amsat.org>
Signed-off-by: Fam Zheng <famz@redhat.com>
6 years agodocker: use one package per line in CentOS config
Philippe Mathieu-Daudé [Fri, 28 Jul 2017 23:33:13 +0000 (20:33 -0300)]
docker: use one package per line in CentOS config

This ease rebase/cherry-pick, also it is faster to visually find if a package
is here.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-Id: <20170728233316.13352-2-f4bug@amsat.org>
Signed-off-by: Fam Zheng <famz@redhat.com>
6 years agoMakefile: Let "make check-help" work without running ./configure
Fam Zheng [Thu, 10 Aug 2017 08:50:25 +0000 (16:50 +0800)]
Makefile: Let "make check-help" work without running ./configure

Currently if you do "make check-help" in a fresh checkout, only an error
is printed which is not nice:

    $ make check-help V=1
    cc -nostdlib  -o check-help.mo
    cc: fatal error: no input files
    compilation terminated.
    rules.mak:115: recipe for target 'check-help.mo' failed
    make: *** [check-help.mo] Error 1

Move the config-host.mak condition into the body of
tests/Makefile.include and always include the rule for check-help.

Reported-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Fam Zheng <famz@redhat.com>
Message-Id: <20170810085025.14076-1-famz@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Fam Zheng <famz@redhat.com>
6 years agopc-bios/s390-ccw: Use rm command during make clean
Eric Farman [Mon, 14 Aug 2017 20:44:50 +0000 (22:44 +0200)]
pc-bios/s390-ccw: Use rm command during make clean

This reverts a change that replaced the "rm -f" command with the
undefined variable RM (expected to be set by make), and causes the
"make clean" command to fail for a s390 target:

make[1]: Entering directory '/usr/src/qemu/build/pc-bios/s390-ccw'
rm -f *.timestamp
*.o *.d *.img *.elf *~ *.a
/bin/sh: *.o: command not found
Makefile:39: recipe for target 'clean' failed
make[1]: *** [clean] Error 127
make[1]: Leaving directory '/usr/src/qemu/build/pc-bios/s390-ccw'
Makefile:489: recipe for target 'clean' failed
make: *** [clean] Error 1

Fixes: 3e4415a751d2 ("pc-bios/s390-ccw: Add core files for the network
                      bootloading program")
Signed-off-by: Eric Farman <farman@linux.vnet.ibm.com>
Message-Id: <20170814204450.24118-2-farman@linux.vnet.ibm.com>
Signed-off-by: Cornelia Huck <cohuck@redhat.com>
6 years agoxlnx-qspi: add a property for mmio-execution
KONRAD Frederic [Fri, 11 Aug 2017 07:54:12 +0000 (09:54 +0200)]
xlnx-qspi: add a property for mmio-execution

This adds mmio-exec property to workaround the migration bug.
When enabled the migration is blocked and will return an error.

Signed-off-by: KONRAD Frederic <frederic.konrad@adacore.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Message-id: 1502438052-5117-1-git-send-email-frederic.konrad@adacore.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
6 years agoMerge remote-tracking branch 'remotes/jasowang/tags/net-pull-request' into staging
Peter Maydell [Mon, 14 Aug 2017 12:35:33 +0000 (13:35 +0100)]
Merge remote-tracking branch 'remotes/jasowang/tags/net-pull-request' into staging

# gpg: Signature made Mon 14 Aug 2017 13:32:10 BST
# gpg:                using RSA key 0xEF04965B398D6211
# gpg: Good signature from "Jason Wang (Jason Wang on RedHat) <jasowang@redhat.com>"
# gpg: WARNING: This key is not certified with sufficiently trusted signatures!
# gpg:          It is not certain that the signature belongs to the owner.
# Primary key fingerprint: 215D 46F4 8246 689E C77F  3562 EF04 965B 398D 6211

* remotes/jasowang/tags/net-pull-request:
  qemu-doc: Mention host_net_add/-remove in the deprecation chapter

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
6 years agoqemu-doc: Mention host_net_add/-remove in the deprecation chapter
Thomas Huth [Thu, 10 Aug 2017 08:00:17 +0000 (10:00 +0200)]
qemu-doc: Mention host_net_add/-remove in the deprecation chapter

The two HMP commands host_net_add and -remove have recently been
marked as deprecated, too, so we should now mention them in the
chapter of deprecated features.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
6 years agoMerge remote-tracking branch 'remotes/mjt/tags/trivial-patches-fetch' into staging
Peter Maydell [Mon, 14 Aug 2017 11:43:07 +0000 (12:43 +0100)]
Merge remote-tracking branch 'remotes/mjt/tags/trivial-patches-fetch' into staging

trivial patches for 2017-08-14

# gpg: Signature made Mon 14 Aug 2017 12:07:03 BST
# gpg:                using RSA key 0x701B4F6B1A693E59
# gpg: Good signature from "Michael Tokarev <mjt@tls.msk.ru>"
# gpg:                 aka "Michael Tokarev <mjt@corpit.ru>"
# gpg:                 aka "Michael Tokarev <mjt@debian.org>"
# Primary key fingerprint: 6EE1 95D1 886E 8FFB 810D  4324 457C E0A0 8044 65C5
#      Subkey fingerprint: 7B73 BAD6 8BE7 A2C2 8931  4B22 701B 4F6B 1A69 3E59

* remotes/mjt/tags/trivial-patches-fetch:
  hw/misc/mmio_interface: Return after error_setg() to avoid crash
  qemu-iotests: remove comment about root privileges requirement
  qemu-iotests: remove commented out variables
  qemu-iotests: get rid of _full_imgproto_details()
  qemu-doc: Fix "-net van" typo
  libqtest: Fix typo in comments
  unicore32: abort when entering "x 0" on the monitor

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
6 years agoMerge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into staging
Peter Maydell [Mon, 14 Aug 2017 10:41:24 +0000 (11:41 +0100)]
Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into staging

* Lone typo fix (Thomas)

# gpg: Signature made Mon 14 Aug 2017 09:41:52 BST
# gpg:                using RSA key 0xBFFBD25F78C7AE83
# gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>"
# gpg:                 aka "Paolo Bonzini <pbonzini@redhat.com>"
# Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4  E2F7 7E15 100C CD36 69B1
#      Subkey fingerprint: F133 3857 4B66 2389 866C  7682 BFFB D25F 78C7 AE83

* remotes/bonzini/tags/for-upstream:
  qemu-doc: Fix "-net van" typo

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
6 years agohw/misc/mmio_interface: Return after error_setg() to avoid crash
Thomas Huth [Mon, 14 Aug 2017 06:10:29 +0000 (08:10 +0200)]
hw/misc/mmio_interface: Return after error_setg() to avoid crash

QEMU currently abort()s if the user tries to specify the mmio_interface
device without parameters:

x86_64-softmmu/qemu-system-x86_64 -nographic -device mmio_interface
qemu-system-x86_64: /home/thuth/devel/qemu/util/error.c:57: error_setv:
 Assertion `*errp == ((void *)0)' failed.
Aborted (core dumped)

This happens because the realize function is trying to set the errp
twice in this case. After setting an error, the realize function
should immediately return instead.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
6 years agoqemu-iotests: remove comment about root privileges requirement
Cleber Rosa [Thu, 27 Jul 2017 12:02:09 +0000 (08:02 -0400)]
qemu-iotests: remove comment about root privileges requirement

The check script contains a commented out root user requirement,
probably because of its xfstests heritage.  This requirement doesn't
apply to qemu-iotests, so it better be gone.

Signed-off-by: Cleber Rosa <crosa@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
6 years agoqemu-iotests: remove commented out variables
Cleber Rosa [Thu, 27 Jul 2017 12:02:08 +0000 (08:02 -0400)]
qemu-iotests: remove commented out variables

The variables FULL_MKFS_OPTIONS and FULL_MOUNT_OPTIONS are commented
out, never used, and even refer to functions that do exist.  The last
time these were touched was around 8 years ago, so I guess it's safe
to assume outputting such information on test execution is still on the
radar.

Signed-off-by: Cleber Rosa <crosa@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
6 years agoqemu-iotests: get rid of _full_imgproto_details()
Cleber Rosa [Thu, 27 Jul 2017 12:02:07 +0000 (08:02 -0400)]
qemu-iotests: get rid of _full_imgproto_details()

Although this function is used, its implementation does nothing
besides echoing a variable name.  There's no need to wrap this
functionality in a function, and based on the one usage it has, it's
not even required to adhere to a convention or code style.

Signed-off-by: Cleber Rosa <crosa@redhat.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
6 years agoqemu-doc: Fix "-net van" typo
Thomas Huth [Thu, 10 Aug 2017 11:44:26 +0000 (13:44 +0200)]
qemu-doc: Fix "-net van" typo

While Andrew S. Tanenbaum has a point by saying "Never underestimate the
bandwidth of a station wagon full of tapes hurtling down the highway",
we don't support that way of transportation in QEMU yet, so replace the
typo with the correct word "vlan".

Signed-off-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Laurent Vivier <lvivier@redhat.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
6 years agolibqtest: Fix typo in comments
Eric Blake [Thu, 3 Aug 2017 01:08:33 +0000 (20:08 -0500)]
libqtest: Fix typo in comments

s/continuosly/continuously/

Signed-off-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Jeff Cody <jcody@redhat.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
6 years agounicore32: abort when entering "x 0" on the monitor
Eduardo Otubo [Fri, 28 Jul 2017 11:51:31 +0000 (13:51 +0200)]
unicore32: abort when entering "x 0" on the monitor

Starting Qemu with "qemu-system-unicore32 -M puv3,accel=qtest -S -nographic"
and entering "x 0 " at the monitor prompt leads to abort():

  $ ./unicore32-softmmu/qemu-system-unicore32 -M puv3,accel=qtest -S -nographic
  QEMU 2.9.90 monitor - type 'help' for more information
  (qemu) x 0
  qemu: fatal: uc32_cpu_get_phys_page_debug not supported yet

  R00=00000000 R01=00000000 R02=00000000 R03=00000000
  R04=00000000 R05=00000000 R06=00000000 R07=00000000
  R08=00000000 R09=00000000 R10=00000000 R11=00000000
  R12=00000000 R13=00000000 R14=00000000 R15=00000000
  R16=00000000 R17=00000000 R18=00000000 R19=00000000
  R20=00000000 R21=00000000 R22=00000000 R23=00000000
  R24=00000000 R25=00000000 R26=00000000 R27=00000000
  R28=00000000 R29=00000000 R30=00000000 R31=03000000
  PSR=40000013 -Z-- PRIV
  Aborted (core dumped)

This happens because uc32_cpu_get_phys_page_debug() is not implemented
yet, this is a temporary workaround to avoid the crash.

Signed-off-by: Eduardo Otubo <otubo@redhat.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
6 years agoMerge remote-tracking branch 'remotes/cohuck/tags/boot-serial-no-tcg-20170811' into...
Peter Maydell [Mon, 14 Aug 2017 08:48:44 +0000 (09:48 +0100)]
Merge remote-tracking branch 'remotes/cohuck/tags/boot-serial-no-tcg-20170811' into staging

Fix the boot-serial test to work with the new --disable-tcg.

# gpg: Signature made Fri 11 Aug 2017 14:55:15 BST
# gpg:                using RSA key 0xDECF6B93C6F02FAF
# gpg: Good signature from "Cornelia Huck <conny@cornelia-huck.de>"
# gpg:                 aka "Cornelia Huck <huckc@linux.vnet.ibm.com>"
# gpg:                 aka "Cornelia Huck <cornelia.huck@de.ibm.com>"
# gpg:                 aka "Cornelia Huck <cohuck@kernel.org>"
# gpg:                 aka "Cornelia Huck <cohuck@redhat.com>"
# Primary key fingerprint: C3D0 D66D C362 4FF6 A8C0  18CE DECF 6B93 C6F0 2FAF

* remotes/cohuck/tags/boot-serial-no-tcg-20170811:
  boot-serial-test: fallback to kvm accelerator

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
6 years agoqemu-doc: Fix "-net van" typo
Thomas Huth [Thu, 10 Aug 2017 11:44:26 +0000 (13:44 +0200)]
qemu-doc: Fix "-net van" typo

While Andrew S. Tanenbaum has a point by saying "Never underestimate the
bandwidth of a station wagon full of tapes hurtling down the highway",
we don't support that way of transportation in QEMU yet, so replace the
typo with the correct word "vlan".

Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-Id: <1502365466-19432-1-git-send-email-thuth@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
6 years agoMerge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging
Peter Maydell [Fri, 11 Aug 2017 14:11:50 +0000 (15:11 +0100)]
Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging

Block layer patches for 2.10.0-rc3

# gpg: Signature made Fri 11 Aug 2017 15:02:58 BST
# gpg:                using RSA key 0x7F09B272C88F2FD6
# gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>"
# Primary key fingerprint: DC3D EB15 9A9A F95D 3D74  56FE 7F09 B272 C88F 2FD6

* remotes/kevin/tags/for-upstream:
  qemu-iotests: fix 185
  file-posix: Do runtime check for ofd lock API
  osdep: Add runtime OFD lock detection
  qcow2: Check failure of bdrv_getlength()
  qcow2: Drop debugging dump_refcounts()
  vpc: Check failure of bdrv_getlength()
  tests/multiboot: Fix whitespace failure

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
6 years agoboot-serial-test: fallback to kvm accelerator
Cornelia Huck [Fri, 11 Aug 2017 11:03:31 +0000 (13:03 +0200)]
boot-serial-test: fallback to kvm accelerator

Currently, at least x86_64 and s390x support building with --disable-tcg.
Instead of forcing tcg (which causes the test to fail on such builds),
allow to use kvm as well.

Reviewed-by: Daniel P. Berrange <berrange@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Cornelia Huck <cohuck@redhat.com>
6 years agoqemu-iotests: fix 185
Vladimir Sementsov-Ogievskiy [Wed, 9 Aug 2017 15:17:57 +0000 (18:17 +0300)]
qemu-iotests: fix 185

185 can sometimes produce wrong output like this:

    185 2s ... - output mismatch (see 185.out.bad)
    --- /work/src/qemu/master/tests/qemu-iotests/185.out    2017-07-14 \
        15:14:29.520343805 +0300
    +++ 185.out.bad 2017-08-07 16:51:02.231922900 +0300
    @@ -37,7 +37,7 @@
     {"return": {}}
     {"return": {}}
     {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, \
         "event": "SHUTDOWN", "data": {"guest": false}}
    -{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, \
        "event": "BLOCK_JOB_CANCELLED", "data": {"device": "disk", \
            "len": 4194304, "offset": 4194304, "speed": 65536, "type": \
                "mirror"}}
    +{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, \
        "event": "BLOCK_JOB_CANCELLED", "data": {"device": "disk", \
            "len": 0, "offset": 0, "speed": 65536, "type": "mirror"}}

     === Start backup job and exit qemu ===

    Failures: 185
    Failed 1 of 1 tests

This is because, under heavy load, the quit can happen before the first
iteration of the mirror request has occurred.  To make sure we've had
time to iterate, let's just add a sleep for 0.5 seconds before quitting.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
6 years agofile-posix: Do runtime check for ofd lock API
Fam Zheng [Fri, 11 Aug 2017 11:44:47 +0000 (19:44 +0800)]
file-posix: Do runtime check for ofd lock API

It is reported that on Windows Subsystem for Linux, ofd operations fail
with -EINVAL. In other words, QEMU binary built with system headers that
exports F_OFD_SETLK doesn't necessarily run in an environment that
actually supports it:

$ qemu-system-aarch64 ... -drive file=test.vhdx,if=none,id=hd0 \
    -device virtio-blk-pci,drive=hd0
qemu-system-aarch64: -drive file=test.vhdx,if=none,id=hd0: Failed to unlock byte 100
qemu-system-aarch64: -drive file=test.vhdx,if=none,id=hd0: Failed to unlock byte 100
qemu-system-aarch64: -drive file=test.vhdx,if=none,id=hd0: Failed to lock byte 100

As a matter of fact this is not WSL specific. It can happen when running
a QEMU compiled against a newer glibc on an older kernel, such as in
a containerized environment.

Let's do a runtime check to cope with that.

Reported-by: Andrew Baumann <Andrew.Baumann@microsoft.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Fam Zheng <famz@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
6 years agoosdep: Add runtime OFD lock detection
Fam Zheng [Fri, 11 Aug 2017 11:44:46 +0000 (19:44 +0800)]
osdep: Add runtime OFD lock detection

Build time check of OFD lock is not sufficient and can cause image open
errors when the runtime environment doesn't support it.

Add a helper function to probe it at runtime, additionally. Also provide
a qemu_has_ofd_lock() for callers to check the status.

Signed-off-by: Fam Zheng <famz@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
6 years agoqcow2: Check failure of bdrv_getlength()
Eric Blake [Wed, 9 Aug 2017 20:38:08 +0000 (15:38 -0500)]
qcow2: Check failure of bdrv_getlength()

qcow2_co_pwritev_compressed() should not call bdrv_truncate()
if determining the size failed.

Reported-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Jeff Cody <jcody@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: John Snow <jsnow@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
6 years agoqcow2: Drop debugging dump_refcounts()
Eric Blake [Wed, 9 Aug 2017 20:38:07 +0000 (15:38 -0500)]
qcow2: Drop debugging dump_refcounts()

It's been #if 0'd since its introduction in 2006, commit 585f8587.
We can revive dead code if we need it, but in the meantime, it has
bit-rotted (for example, not checking for failure in bdrv_getlength()).

Signed-off-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Jeff Cody <jcody@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: John Snow <jsnow@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
6 years agovpc: Check failure of bdrv_getlength()
Eric Blake [Wed, 9 Aug 2017 20:38:04 +0000 (15:38 -0500)]
vpc: Check failure of bdrv_getlength()

vpc_open() was checking for bdrv_getlength() failure in one, but
not the other, location.

Reported-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Jeff Cody <jcody@redhat.com>
Reviewed-by: John Snow <jsnow@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
6 years agotests/multiboot: Fix whitespace failure
Eric Blake [Tue, 8 Aug 2017 14:34:16 +0000 (09:34 -0500)]
tests/multiboot: Fix whitespace failure

Commit b43671f8 accidentally broke run_test.sh within tests/multiboot;
due to a subtle change in whitespace.

These two commands produce theh same output (at least, for sane $IFS
of space-tab-newline):

echo -e "...$@..."
echo -e "...$*..."

But that's only because echo inserts spaces between multiple arguments
(the $@ case), while the $* form gives a single argument to echo with
the spaces already present.

But when converting to printf %b, there are no automatic spaces between
multiple arguments, so we HAVE to use $*.

It doesn't help that run_test.sh isn't part of 'make check'.

Signed-off-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
6 years agoMerge remote-tracking branch 'remotes/stefanha/tags/block-pull-request' into staging
Peter Maydell [Thu, 10 Aug 2017 17:53:39 +0000 (18:53 +0100)]
Merge remote-tracking branch 'remotes/stefanha/tags/block-pull-request' into staging

# gpg: Signature made Thu 10 Aug 2017 18:48:13 BST
# gpg:                using RSA key 0x9CA4ABB381AB73C8
# gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>"
# gpg:                 aka "Stefan Hajnoczi <stefanha@gmail.com>"
# Primary key fingerprint: 8695 A8BF D3F9 7CDA AC35  775A 9CA4 ABB3 81AB 73C8

* remotes/stefanha/tags/block-pull-request:
  virtio-blk: handle blk_getlength() errors
  IDE: test flush on empty CDROM
  IDE: Do not flush empty CDROM drives

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
6 years agoMerge remote-tracking branch 'remotes/gkurz/tags/for-upstream' into staging
Peter Maydell [Thu, 10 Aug 2017 16:50:55 +0000 (17:50 +0100)]
Merge remote-tracking branch 'remotes/gkurz/tags/for-upstream' into staging

Just a single fix for an annoying regression introduced in 2.9 when fixing
CVE-2016-9602.

# gpg: Signature made Thu 10 Aug 2017 13:40:28 BST
# gpg:                using DSA key 0x02FC3AEB0101DBC2
# gpg: Good signature from "Greg Kurz <groug@kaod.org>"
# gpg:                 aka "Greg Kurz <groug@free.fr>"
# gpg:                 aka "Greg Kurz <gkurz@linux.vnet.ibm.com>"
# gpg:                 aka "Gregory Kurz (Groug) <groug@free.fr>"
# gpg:                 aka "[jpeg image of size 3330]"
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg:          There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 2BD4 3B44 535E C0A7 9894  DBA2 02FC 3AEB 0101 DBC2

* remotes/gkurz/tags/for-upstream:
  9pfs: local: fix fchmodat_nofollow() limitations

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
6 years agovirtio-blk: handle blk_getlength() errors
Stefan Hajnoczi [Tue, 8 Aug 2017 12:22:51 +0000 (13:22 +0100)]
virtio-blk: handle blk_getlength() errors

If blk_getlength() fails in virtio_blk_update_config() consider the disk
image length to be 0 bytes.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Fam Zheng <famz@redhat.com>
Message-id: 20170808122251.29815-1-stefanha@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
6 years agoIDE: test flush on empty CDROM
Kevin Wolf [Wed, 9 Aug 2017 16:02:12 +0000 (17:02 +0100)]
IDE: test flush on empty CDROM

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: John Snow <jsnow@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 20170809160212.29976-3-stefanha@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
6 years agoIDE: Do not flush empty CDROM drives
Stefan Hajnoczi [Wed, 9 Aug 2017 16:02:11 +0000 (17:02 +0100)]
IDE: Do not flush empty CDROM drives

The block backend changed in a way that flushing empty CDROM drives now
crashes.  Amend IDE to avoid doing so until the root problem can be
addressed for 2.11.

Original patch by John Snow <jsnow@redhat.com>.

Reported-by: Kieron Shorrock <kshorrock@paloaltonetworks.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Message-id: 20170809160212.29976-2-stefanha@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
6 years ago9pfs: local: fix fchmodat_nofollow() limitations
Greg Kurz [Thu, 10 Aug 2017 12:21:04 +0000 (14:21 +0200)]
9pfs: local: fix fchmodat_nofollow() limitations

This function has to ensure it doesn't follow a symlink that could be used
to escape the virtfs directory. This could be easily achieved if fchmodat()
on linux honored the AT_SYMLINK_NOFOLLOW flag as described in POSIX, but
it doesn't. There was a tentative to implement a new fchmodat2() syscall
with the correct semantics:

https://patchwork.kernel.org/patch/9596301/

but it didn't gain much momentum. Also it was suggested to look at an O_PATH
based solution in the first place.

The current implementation covers most use-cases, but it notably fails if:
- the target path has access rights equal to 0000 (openat() returns EPERM),
  => once you've done chmod(0000) on a file, you can never chmod() again
- the target path is UNIX domain socket (openat() returns ENXIO)
  => bind() of UNIX domain sockets fails if the file is on 9pfs

The solution is to use O_PATH: openat() now succeeds in both cases, and we
can ensure the path isn't a symlink with fstat(). The associated entry in
"/proc/self/fd" can hence be safely passed to the regular chmod() syscall.

The previous behavior is kept for older systems that don't have O_PATH.

Signed-off-by: Greg Kurz <groug@kaod.org>
Reviewed-by: Eric Blake <eblake@redhat.com>
Tested-by: Zhi Yong Wu <zhiyong.wu@ucloud.cn>
Acked-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
6 years agoMerge remote-tracking branch 'remotes/dgibson/tags/ppc-for-2.10-20170809' into staging
Peter Maydell [Thu, 10 Aug 2017 10:12:36 +0000 (11:12 +0100)]
Merge remote-tracking branch 'remotes/dgibson/tags/ppc-for-2.10-20170809' into staging

ppc patch queue 2017-08-09

This series contains a number of bugfixes for ppc and related
machines, for the qemu-2.10.release.  Some are true regressions,
others are serious enough and non-invasive enough to fix that it's
worth putting in 2.10 this late.

# gpg: Signature made Wed 09 Aug 2017 07:31:33 BST
# gpg:                using RSA key 0x6C38CACA20D9B392
# gpg: Good signature from "David Gibson <david@gibson.dropbear.id.au>"
# gpg:                 aka "David Gibson (Red Hat) <dgibson@redhat.com>"
# gpg:                 aka "David Gibson (ozlabs.org) <dgibson@ozlabs.org>"
# gpg:                 aka "David Gibson (kernel.org) <dwg@kernel.org>"
# Primary key fingerprint: 75F4 6586 AE61 A66C C44E  87DC 6C38 CACA 20D9 B392

* remotes/dgibson/tags/ppc-for-2.10-20170809:
  spapr: Fix bug in h_signal_sys_reset()
  spapr_drc: abort if object_property_add_child() fails
  target/ppc: Add stub implementation of the PSSCR
  target/ppc: Implement TIDR
  ppc: fix double-free in cpu_post_load()
  booke206: fix MAS update on tlb miss

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
6 years agoMerge remote-tracking branch 'remotes/mst/tags/for_upstream' into staging
Peter Maydell [Thu, 10 Aug 2017 09:05:29 +0000 (10:05 +0100)]
Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into staging

pc, vhost: fixes for rc3

Fix up bugs and warnings in tests. Revert an experimental commit that I
put in by mistake: harmless but useless.

Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
# gpg: Signature made Wed 09 Aug 2017 02:23:17 BST
# gpg:                using RSA key 0x281F0DB8D28D5469
# gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>"
# gpg:                 aka "Michael S. Tsirkin <mst@redhat.com>"
# Primary key fingerprint: 0270 606B 6F3C DF3D 0B17  0970 C350 3912 AFBE 8E67
#      Subkey fingerprint: 5D09 FD08 71C8 F85B 94CA  8A0D 281F 0DB8 D28D 5469

* remotes/mst/tags/for_upstream:
  libqtest: always set up signal handler for SIGABRT
  libvhost-user: quit when no more data received
  net: fix -netdev socket,fd= for UDP sockets
  Revert "cpu: add APIs to allocate/free CPU environment"
  acpi-test: update expected DSDT files

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
6 years agospapr: Fix bug in h_signal_sys_reset()
Sam Bobroff [Thu, 3 Aug 2017 06:28:27 +0000 (16:28 +1000)]
spapr: Fix bug in h_signal_sys_reset()

The unicast case in h_signal_sys_reset() seems to be broken:
rather than selecting the target CPU, it looks like it will pick
either the first CPU or fail to find one at all.

Fix it by using the search function rather than open coding the
search.

This was found by inspection; the code appears to be unused because
the Linux kernel only uses the broadcast target.

Signed-off-by: Sam Bobroff <sam.bobroff@au1.ibm.com>
Reviewed-by: Greg Kurz <groug@kaod.org>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
6 years agospapr_drc: abort if object_property_add_child() fails
Greg Kurz [Mon, 7 Aug 2017 17:24:39 +0000 (19:24 +0200)]
spapr_drc: abort if object_property_add_child() fails

object_property_add_child() can only fail in two cases:
- the child already has a parent, which shouldn't happen since the DRC was
  allocated a few lines above
- the parent already has a child with the same name, which would mean the
  caller tries to create a DRC that already exists

In both case, this is a QEMU bug and we should abort.

Signed-off-by: Greg Kurz <groug@kaod.org>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
6 years agotarget/ppc: Add stub implementation of the PSSCR
David Gibson [Tue, 8 Aug 2017 05:09:35 +0000 (15:09 +1000)]
target/ppc: Add stub implementation of the PSSCR

The PSSCR register added in POWER9 controls certain power saving mode
behaviours.  Mostly, it's not relevant to TCG, however because qemu
doesn't know about it yet, it doesn't synchronize the state with KVM,
and thus it doesn't get migrated.

To fix that, this adds a minimal stub implementation of the register.
This isn't complete, even to the extent that an implementation is
possible in TCG, just enough to get migration working.  We need to
come back later and at least properly filter the various fields in the
register based on privilege level.

Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: Greg Kurz <groug@kaod.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
6 years agotarget/ppc: Implement TIDR
David Gibson [Tue, 8 Aug 2017 03:42:53 +0000 (13:42 +1000)]
target/ppc: Implement TIDR

This adds a trivial implementation of the TIDR register added in
POWER9.  This isn't particularly important to qemu directly - it's
used by accelerator modules that we don't emulate.

However, since qemu isn't aware of it, its state is not synchronized
with KVM and therefore not migrated, which can be a problem.

Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: Greg Kurz <groug@kaod.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
6 years agoppc: fix double-free in cpu_post_load()
Greg Kurz [Wed, 2 Aug 2017 17:34:16 +0000 (19:34 +0200)]
ppc: fix double-free in cpu_post_load()

When running nested with KVM PR, ppc_set_compat() fails and QEMU crashes
because of "double free or corruption (!prev)". The crash happens because
error_report_err() has already called error_free().

Signed-off-by: Greg Kurz <groug@kaod.org>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
6 years agobooke206: fix MAS update on tlb miss
KONRAD Frederic [Tue, 1 Aug 2017 08:44:57 +0000 (10:44 +0200)]
booke206: fix MAS update on tlb miss

When a tlb instruction miss happen, rw is set to 0 at the bottom
of cpu_ppc_handle_mmu_fault which cause the MAS update function to miss
the SAS and TS bit in MAS6, MAS1 in booke206_update_mas_tlb_miss.

Just calling booke206_update_mas_tlb_miss with rw = 2 solve the issue.

Signed-off-by: KONRAD Frederic <frederic.konrad@adacore.com>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
6 years agolibqtest: always set up signal handler for SIGABRT
Jens Freimann [Tue, 8 Aug 2017 20:38:59 +0000 (22:38 +0200)]
libqtest: always set up signal handler for SIGABRT

Currently abort handlers only work for the first test function
in a testcase, because the list of abort handlers is not properly
cleared when qtest_quit() is called.

qtest_quit() only deletes the kill_qemu_hook but doesn't completely
clear the abrt_hooks list.  The effect is that abrt_hooks.is_setup is
never set to false and in a following test the abrt_hooks list is not
initialized and setup_sigabrt_handler() is not called.

One way to solve this is to clear the list in qtest_quit(), but
that means only asserts between qtest_start and qtest_quit will
be catched by the abort handler.

We can make abort handlers work in all cases if we always setup the
signal handler for SIGABRT in qtest_init.

Signed-off-by: Jens Freimann <jfreimann@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
6 years agolibvhost-user: quit when no more data received
Jens Freimann [Tue, 8 Aug 2017 20:38:58 +0000 (22:38 +0200)]
libvhost-user: quit when no more data received

End processing of messages when VHOST_USER_NONE
is received.

Without this we run into a vubr_panic() call and get
"PANIC: Unhandled request: 0"

Signed-off-by: Jens Freimann <jfreiman@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
6 years agonet: fix -netdev socket,fd= for UDP sockets
Jens Freimann [Tue, 8 Aug 2017 20:38:57 +0000 (22:38 +0200)]
net: fix -netdev socket,fd= for UDP sockets

This patch fixes -netdev socket,fd= for UDP sockets
Currently -netdev socket,fd=<...> results in

  qemu: error: specified mcastaddr "127.0.0.1" (0x7f000001) does not
    contain a multicast address
  qemu-system-x86_64: -netdev
    socket,id=n1,fd=3: Device 'socket' could not be initialized

To fix these we need to allow specifying multicast and fd arguments
for the same netdev. With this the user can specify "-netdev
fd=3,mcast=<IP:port>"

Cc: Jason Wang <jasowang@redhat.com>
Fixes: 3d830459b1eccdb61b75e2712fd364012ce5a115
Signed-off-by: Jens Freimann <jfreimann@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
6 years agoRevert "cpu: add APIs to allocate/free CPU environment"
Michael S. Tsirkin [Fri, 23 Jun 2017 19:25:03 +0000 (22:25 +0300)]
Revert "cpu: add APIs to allocate/free CPU environment"

This reverts commit e2a7f28693aea7e194ec1435697ec4feb24f8a6f.

This was not supposed to go upstream yet. Reverting.

Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
6 years agoacpi-test: update expected DSDT files
Michael S. Tsirkin [Tue, 8 Aug 2017 16:01:56 +0000 (19:01 +0300)]
acpi-test: update expected DSDT files

Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
6 years agoUpdate version for v2.10.0-rc2 release
Peter Maydell [Tue, 8 Aug 2017 18:07:46 +0000 (19:07 +0100)]
Update version for v2.10.0-rc2 release

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
6 years agoMerge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into staging
Peter Maydell [Tue, 8 Aug 2017 15:32:54 +0000 (16:32 +0100)]
Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into staging

* --help/--version improvements (Eric)
* GCC 7 workaround (Greg)
* Small SCSI fix (Hannes)
* SSE 4.1 fix (Joseph)
* RCU deadlock fix (myself)

# gpg: Signature made Tue 08 Aug 2017 16:28:56 BST
# gpg:                using RSA key 0xBFFBD25F78C7AE83
# gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>"
# gpg:                 aka "Paolo Bonzini <pbonzini@redhat.com>"
# Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4  E2F7 7E15 100C CD36 69B1
#      Subkey fingerprint: F133 3857 4B66 2389 866C  7682 BFFB D25F 78C7 AE83

* remotes/bonzini/tags/for-upstream:
  maint: Include bug-reporting info in --help output
  qga: Give more --version information
  qemu-io: Give more --version information
  qemu-img: Sort sub-command names in --help
  target/i386: set rip_offset for some SSE4.1 instructions
  scsi: clarify sense codes for LUN0 emulation
  kvm: workaround build break on gcc-7.1.1 / fedora26
  Revert "rcu: do not create thread in pthread_atfork callback"
  rcu: completely disable pthread_atfork callbacks as soon as possible

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
6 years agomaint: Include bug-reporting info in --help output
Eric Blake [Thu, 3 Aug 2017 16:33:53 +0000 (11:33 -0500)]
maint: Include bug-reporting info in --help output

These days, many programs are including a bug-reporting address,
or better yet, a link to the project web site, at the tail of
their --help output.  However, we were not very consistent at
doing so: only qemu-nbd and qemu-qa mentioned anything, with the
latter pointing to an individual person instead of the project.

Add a new #define that sets up a uniform string, mentioning both
bug reporting instructions and overall project details, and which
a downstream vendor could tweak if they want bugs to go to a
downstream database.  Then use it in all of our binaries which
have --help output.

The canned text intentionally references http:// instead of https://
because our https website currently causes certificate errors in
some browsers.  That can be tweaked later once we have resolved the
web site issued.

Signed-off-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Daniel P. Berrange <berrange@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-Id: <20170803163353.19558-5-eblake@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>