]> git.proxmox.com Git - mirror_qemu.git/log
mirror_qemu.git
5 years agoi386: do not migrate MSR_SMI_COUNT on machine types <2.12
Paolo Bonzini [Tue, 24 Jul 2018 11:59:21 +0000 (13:59 +0200)]
i386: do not migrate MSR_SMI_COUNT on machine types <2.12

MSR_SMI_COUNT started being migrated in QEMU 2.12.  Do not migrate it
on older machine types, or the subsection causes a load failure for
guests that use SMM.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
5 years agoMerge remote-tracking branch 'remotes/armbru/tags/pull-qobject-2018-07-27-v2' into...
Peter Maydell [Mon, 30 Jul 2018 08:55:47 +0000 (09:55 +0100)]
Merge remote-tracking branch 'remotes/armbru/tags/pull-qobject-2018-07-27-v2' into staging

QObject patches for 2018-07-27 (3.0.0-rc3)

# gpg: Signature made Sat 28 Jul 2018 08:10:39 BST
# gpg:                using RSA key 3870B400EB918653
# gpg: Good signature from "Markus Armbruster <armbru@redhat.com>"
# gpg:                 aka "Markus Armbruster <armbru@pond.sub.org>"
# Primary key fingerprint: 354B C8B3 D7EB 2A6B 6867  4E5F 3870 B400 EB91 8653

* remotes/armbru/tags/pull-qobject-2018-07-27-v2:
  qstring: Move qstring_from_substr()'s @end one to the right
  qstring: Assert size calculations don't overflow
  qstring: Fix qstring_from_substr() not to provoke int overflow

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
5 years agoqstring: Move qstring_from_substr()'s @end one to the right
Markus Armbruster [Fri, 27 Jul 2018 06:22:04 +0000 (08:22 +0200)]
qstring: Move qstring_from_substr()'s @end one to the right

qstring_from_substr() takes the index of the substring's first and
last character.  qstring_from_substr(s, 0, SIZE_MAX) denotes an empty
substring.  Awkward.

Shift the end index one to the right.  This simplifies both
qstring_from_substr() and its callers.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Message-Id: <20180727062204.10401-3-armbru@redhat.com>

5 years agoqstring: Assert size calculations don't overflow
Markus Armbruster [Fri, 27 Jul 2018 06:22:03 +0000 (08:22 +0200)]
qstring: Assert size calculations don't overflow

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-Id: <20180727062204.10401-2-armbru@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
5 years agoqstring: Fix qstring_from_substr() not to provoke int overflow
liujunjie [Tue, 24 Jul 2018 13:43:39 +0000 (21:43 +0800)]
qstring: Fix qstring_from_substr() not to provoke int overflow

qstring_from_substr() parameters @start and @end are of type int.
blkdebug_parse_filename(), blkverify_parse_filename(), nbd_parse_uri(),
and qstring_from_str() pass @end values of type size_t or ptrdiff_t.
Values exceeding INT_MAX get truncated, with possibly disastrous
results.

Such huge substrings seem unlikely, but we found one in a core dump,
where "info tlb" executed via QMP's human-monitor-command apparently
produced 35 GiB of output.

Fix by changing the parameters size_t.

Signed-off-by: liujunjie <liujunjie23@huawei.com>
Message-Id: <20180724134339.17832-1-liujunjie23@huawei.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
5 years agoUpdate version for v3.0.0-rc2 release
Peter Maydell [Tue, 24 Jul 2018 21:06:31 +0000 (22:06 +0100)]
Update version for v3.0.0-rc2 release

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
5 years agoMerge remote-tracking branch 'remotes/dgilbert/tags/pull-migration-20180724a' into...
Peter Maydell [Tue, 24 Jul 2018 19:16:31 +0000 (20:16 +0100)]
Merge remote-tracking branch 'remotes/dgilbert/tags/pull-migration-20180724a' into staging

Migration pull for 3.0

Fixes only

# gpg: Signature made Tue 24 Jul 2018 19:31:39 BST
# gpg:                using RSA key 0516331EBC5BFDE7
# gpg: Good signature from "Dr. David Alan Gilbert (RH2) <dgilbert@redhat.com>"
# Primary key fingerprint: 45F5 C71B 4A0C B7FB 977A  9FA9 0516 331E BC5B FDE7

* remotes/dgilbert/tags/pull-migration-20180724a:
  migration: fix duplicate initialization for expected_downtime and cleanup_bh
  tests: only update last_byte when at the edge
  migration: disallow recovery for release-ram
  migration: update recv bitmap only on dest vm
  audio/hda: Fix migration
  migrate: Fix cancelling state warning
  migration: fix potential overflow in multifd send

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
5 years agoMerge remote-tracking branch 'remotes/berrange/tags/qcrypto-next-pull-request' into...
Peter Maydell [Tue, 24 Jul 2018 16:51:36 +0000 (17:51 +0100)]
Merge remote-tracking branch 'remotes/berrange/tags/qcrypto-next-pull-request' into staging

Fix unit test compatibility with TLS 1.3

# gpg: Signature made Tue 24 Jul 2018 17:44:14 BST
# gpg:                using RSA key BE86EBB415104FDF
# gpg: Good signature from "Daniel P. Berrange <dan@berrange.com>"
# gpg:                 aka "Daniel P. Berrange <berrange@redhat.com>"
# Primary key fingerprint: DAF3 A6FD B26B 6291 2D0E  8E3F BE86 EBB4 1510 4FDF

* remotes/berrange/tags/qcrypto-next-pull-request:
  tests: fix TLS handshake failure with TLS 1.3
  tests: use error_abort in places expecting errors
  tests: don't silence error reporting for all tests
  tests: call qcrypto_init instead of gnutls_global_init

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
5 years agotests: fix TLS handshake failure with TLS 1.3
Daniel P. Berrangé [Wed, 18 Jul 2018 09:24:59 +0000 (10:24 +0100)]
tests: fix TLS handshake failure with TLS 1.3

When gnutls negotiates TLS 1.3 instead of 1.2, the order of messages
sent by the handshake changes. This exposed a logic bug in the test
suite which caused us to wait for the server to see handshake
completion, but not wait for the client to see completion. The result
was the client didn't receive the certificate for verification and the
test failed.

This is exposed in Fedora 29 rawhide which has just enabled TLS 1.3 in
its GNUTLS builds.

Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
5 years agotests: use error_abort in places expecting errors
Daniel P. Berrangé [Wed, 18 Jul 2018 09:06:43 +0000 (10:06 +0100)]
tests: use error_abort in places expecting errors

Most of the TLS related tests are passing an in a "Error" object to
methods that are expected to fail, but then ignoring any error that is
set and instead asserting on a return value. This means that when an
error is unexpectedly raised, no information about it is printed out,
making failures hard to diagnose. Changing these tests to pass in
&error_abort will make unexpected failures print messages to stderr.

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
5 years agotests: don't silence error reporting for all tests
Daniel P. Berrangé [Wed, 18 Jul 2018 08:34:47 +0000 (09:34 +0100)]
tests: don't silence error reporting for all tests

The test-vmstate test is a bit chatty because it triggers various
expected failure scenarios and the code in question uses error_report
instead of accepting 'Error **errp' parameters. To silence this test the
stubs for error_vprintf() were changed to send errors via
g_test_message() instead of stderr:

  commit 28017e010ddf6849cfa830e898da3e44e6610952
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Oct 24 18:31:03 2016 +0200

    tests: send error_report to test log

    Implement error_vprintf to send the output of error_report to
    the test log.  This silences test-vmstate.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
    Message-Id: <1477326663-67817-3-git-send-email-pbonzini@redhat.com>

Unfortunately this change has global impact across the entire test suite
and means that when tests fail for unexpected reasons, the message is
not displayed on stderr. eg when using &error_abort in a call the test
merely prints

  Unexpected error in qcrypto_tls_session_check_certificate() at crypto/tlssession.c:280:

and the actual error message is hidden, making it impossible to diagnose
the failure. This is especially problematic in CI or build systems where
it isn't possible to easily pass the --debug-log flag to tests and
re-run with the test log visible.

This change makes the previous big hammer much more nuanced, providing a
flag in the stub error_vprintf() that can used on a per-test basis to
silence the errors. Only the test-vmstate silences errors initially.

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
5 years agotests: call qcrypto_init instead of gnutls_global_init
Daniel P. Berrangé [Tue, 17 Jul 2018 16:54:17 +0000 (17:54 +0100)]
tests: call qcrypto_init instead of gnutls_global_init

Calling qcrypto_init ensures that all relevant initialization is
done. In particular this honours the debugging settings and thread
settings.

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
5 years agomigration: fix duplicate initialization for expected_downtime and cleanup_bh
Lidong Chen [Tue, 24 Jul 2018 12:16:25 +0000 (20:16 +0800)]
migration: fix duplicate initialization for expected_downtime and cleanup_bh

migrate_fd_connect duplicate initialize expected_downtime and cleanup_bh.

Signed-off-by: Lidong Chen <lidongchen@tencent.com>
Message-Id: <1532434585-14732-2-git-send-email-lidongchen@tencent.com>
Reviewed-by: Juan Quintela <quintela@redhat.com>
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
5 years agotests: only update last_byte when at the edge
Peter Xu [Mon, 23 Jul 2018 12:33:04 +0000 (20:33 +0800)]
tests: only update last_byte when at the edge

The only possible change of last_byte is when it reaches the edge.
Setting it every time might let last_byte contain an invalid data when
memory corruption is detected, then the check of the next byte will be
incorrect.  For example, a single page corruption at address 0x14ad000
will also lead to a "fake" corruption at 0x14ae000:

  Memory content inconsistency at 14ad000 first_byte = 44 last_byte = 44 current = ef hit_edge = 0
  Memory content inconsistency at 14ae000 first_byte = 44 last_byte = ef current = 44 hit_edge = 0

After the patch, it'll only report the corrputed page:

  Memory content inconsistency at 14ad000 first_byte = 44 last_byte = 44 current = ef hit_edge = 0

Signed-off-by: Peter Xu <peterx@redhat.com>
Message-Id: <20180723123305.24792-4-peterx@redhat.com>
Reviewed-by: Juan Quintela <quintela@redhat.com>
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
5 years agomigration: disallow recovery for release-ram
Peter Xu [Mon, 23 Jul 2018 12:33:03 +0000 (20:33 +0800)]
migration: disallow recovery for release-ram

Postcopy recovery won't work well with release-ram capability since
release-ram will drop the page buffer as long as the page is put into
the send buffer.  So if there is a network failure happened, any page
buffers that have not yet reached the destination VM but have already
been sent from the source VM will be lost forever.  Let's refuse the
client from resuming such a postcopy migration.  Luckily release-ram was
designed to only be used when src and destination VMs are on the same
host, so it should be fine.

Signed-off-by: Peter Xu <peterx@redhat.com>
Message-Id: <20180723123305.24792-3-peterx@redhat.com>
Reviewed-by: Juan Quintela <quintela@redhat.com>
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
5 years agomigration: update recv bitmap only on dest vm
Peter Xu [Mon, 23 Jul 2018 12:33:02 +0000 (20:33 +0800)]
migration: update recv bitmap only on dest vm

We shouldn't update the received bitmap if we're the source VM.  This
fixes a breakage when release-ram is enabled on postcopy.

Signed-off-by: Peter Xu <peterx@redhat.com>
Message-Id: <20180723123305.24792-2-peterx@redhat.com>
Reviewed-by: Juan Quintela <quintela@redhat.com>
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
5 years agoaudio/hda: Fix migration
Dr. David Alan Gilbert [Tue, 24 Jul 2018 10:22:15 +0000 (11:22 +0100)]
audio/hda: Fix migration

Fix outgoing migration which was crashing in
vmstate_hda_audio_stream_buf_needed, I think the problem
is that we have room for upto 4 streams in the array but only
use 2, when we come to try and save the state of the unused
streams we hit st->state == NULL.

Fixes: 280c1e1cdb24d80ecdfc
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Message-Id: <20180724102215.31866-1-dgilbert@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Juan Quintela <quintela@redhat.com>
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
5 years agomigrate: Fix cancelling state warning
Dr. David Alan Gilbert [Thu, 19 Jul 2018 09:22:57 +0000 (10:22 +0100)]
migrate: Fix cancelling state warning

We've been getting the warning:

migration_iteration_finish: Unknown ending state 2

on a cancel.

I think that's originally due to 39b9e17905c;  although
I've only seen the warning, I think that in some cases
that we could find the VM stays paused after a cancel where
it should restart.

Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Message-Id: <20180719092257.12703-1-dgilbert@redhat.com>
Reviewed-by: Peter Xu <peterx@redhat.com>
Reviewed-by: Juan Quintela <quintela@redhat.com>
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
5 years agomigration: fix potential overflow in multifd send
Peter Xu [Fri, 20 Jul 2018 03:47:13 +0000 (11:47 +0800)]
migration: fix potential overflow in multifd send

I would guess it won't happen normally, but this should ease Coverity.

>>>     CID 1394385:  Integer handling issues  (OVERFLOW_BEFORE_WIDEN)
>>>     Potentially overflowing expression "pages->used * 8192U" with type "unsigned int" (32 bits, unsigned) is evaluated using 32-bit arithmetic, and then used in a context that expects an expression of type "uint64_t" (64 bits, unsigned).
854         transferred = pages->used * TARGET_PAGE_SIZE + p->packet_len;

Fixes: CID 1394385
CC: Juan Quintela <quintela@redhat.com>
Signed-off-by: Peter Xu <peterx@redhat.com>
Message-Id: <20180720034713.11711-1-peterx@redhat.com>
Reviewed-by: Juan Quintela <quintela@redhat.com>
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
5 years agoMerge remote-tracking branch 'remotes/stefanha/tags/block-pull-request' into staging
Peter Maydell [Tue, 24 Jul 2018 14:26:01 +0000 (15:26 +0100)]
Merge remote-tracking branch 'remotes/stefanha/tags/block-pull-request' into staging

Pull request

Regression fix for host block devices with the file-posix driver when aio=native is in use.

# gpg: Signature made Tue 24 Jul 2018 15:22:49 BST
# gpg:                using RSA key 9CA4ABB381AB73C8
# gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>"
# gpg:                 aka "Stefan Hajnoczi <stefanha@gmail.com>"
# Primary key fingerprint: 8695 A8BF D3F9 7CDA AC35  775A 9CA4 ABB3 81AB 73C8

* remotes/stefanha/tags/block-pull-request:
  block/file-posix: add bdrv_attach_aio_context callback for host dev and cdrom

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
5 years agoblock/file-posix: add bdrv_attach_aio_context callback for host dev and cdrom
Nishanth Aravamudan [Wed, 18 Jul 2018 21:12:56 +0000 (14:12 -0700)]
block/file-posix: add bdrv_attach_aio_context callback for host dev and cdrom

In ed6e2161 ("linux-aio: properly bubble up errors from initialzation"),
I only added a bdrv_attach_aio_context callback for the bdrv_file
driver. There are several other drivers that use the shared
aio_plug callback, though, and they will trip the assertion added to
aio_get_linux_aio because they did not call aio_setup_linux_aio first.
Add the appropriate callback definition to the affected driver
definitions.

Fixes: ed6e2161 ("linux-aio: properly bubble up errors from initialization")
Reported-by: Farhan Ali <alifm@linux.ibm.com>
Signed-off-by: Nishanth Aravamudan <naravamudan@digitalocean.com>
Reviewed-by: John Snow <jsnow@redhat.com>
Message-id: 20180718211256.29774-1-naravamudan@digitalocean.com
Cc: Eric Blake <eblake@redhat.com>
Cc: Kevin Wolf <kwolf@redhat.com>
Cc: John Snow <jsnow@redhat.com>
Cc: Max Reitz <mreitz@redhat.com>
Cc: Stefan Hajnoczi <stefanha@redhat.com>
Cc: Fam Zheng <famz@redhat.com>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: qemu-block@nongnu.org
Cc: qemu-devel@nongnu.org
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
5 years agoMerge remote-tracking branch 'remotes/stsquad/tags/pull-docker-fixes-for-3.0-240718...
Peter Maydell [Tue, 24 Jul 2018 12:30:12 +0000 (13:30 +0100)]
Merge remote-tracking branch 'remotes/stsquad/tags/pull-docker-fixes-for-3.0-240718-1' into staging

docker fixes & tcg test tweak

  - graceful handling of testing under cross-compile
  - fixes for debootstrap handling
  - more helpful errors (binfmt_misc/EXECUTABLE missing)
  - drop runcom TCG test

# gpg: Signature made Tue 24 Jul 2018 11:48:32 BST
# gpg:                using RSA key FBD0DB095A9E2A44
# gpg: Good signature from "Alex Bennée (Master Work Key) <alex.bennee@linaro.org>"
# Primary key fingerprint: 6685 AE99 E751 67BC AFC8  DF35 FBD0 DB09 5A9E 2A44

* remotes/stsquad/tags/pull-docker-fixes-for-3.0-240718-1:
  tests/tcg: remove runcom test
  docker: perform basic binfmt_misc validation in docker.py
  docker: ignore distro versioning of debootstrap
  docker: add commentary to debian-bootstrap.docker
  docker: Update debootstrap script after Debian migration from Alioth to Salsa
  docker: report hint when docker.py check fails
  docker: drop QEMU_TARGET check, fallback in EXECUTABLE not set
  docker: add expansion for docker-test-FOO to Makefile.include
  docker: add test-unit runner
  docker: Makefile.include don't include partial images
  docker: gracefully skip check_qemu
  docker: move make check into check_qemu helper
  docker: split configure_qemu from build_qemu
  docker: fail more gracefully on docker.py check
  docker: par down QEMU_CONFIGURE_OPTS in debian-tricore-cross
  docker: base debian-tricore on qemu:debian9
  tests/.gitignore: don't ignore docker tests

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
5 years agoMerge remote-tracking branch 'remotes/mdroth/tags/qga-pull-2018-07-23-tag' into staging
Peter Maydell [Tue, 24 Jul 2018 11:40:11 +0000 (12:40 +0100)]
Merge remote-tracking branch 'remotes/mdroth/tags/qga-pull-2018-07-23-tag' into staging

qemu-ga patch queue for hard-freeze

* fix leak in qga main loop error path
* better error reporting when Windows version doesn't support fstrim

# gpg: Signature made Tue 24 Jul 2018 00:58:29 BST
# gpg:                using RSA key 3353C9CEF108B584
# gpg: Good signature from "Michael Roth <flukshun@gmail.com>"
# gpg:                 aka "Michael Roth <mdroth@utexas.edu>"
# gpg:                 aka "Michael Roth <mdroth@linux.vnet.ibm.com>"
# Primary key fingerprint: CEAC C9E1 5534 EBAB B82D  3FA0 3353 C9CE F108 B584

* remotes/mdroth/tags/qga-pull-2018-07-23-tag:
  qga: process_event() simplification and leak fix
  qga-win: Handle fstrim for OSes lower than Win8

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
5 years agotests/tcg: remove runcom test
Alex Bennée [Tue, 17 Jul 2018 16:17:53 +0000 (17:17 +0100)]
tests/tcg: remove runcom test

The combination of being rather esoteric and needing to support mmap @
0 means this only ever worked under translation. It has now regressed
even further and is no longer useful. Kill it.

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
5 years agodocker: perform basic binfmt_misc validation in docker.py
Alex Bennée [Tue, 17 Jul 2018 16:11:26 +0000 (17:11 +0100)]
docker: perform basic binfmt_misc validation in docker.py

Setting up binfmt_misc is outside of the scope of the docker.py script
but we can at least validate it with any given executable so we have a
more useful error message than the sed line of deboostrap failing
cryptically.

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reported-by: Richard Henderson <richard.henderson@linaro.org>
5 years agodocker: ignore distro versioning of debootstrap
Alex Bennée [Fri, 13 Jul 2018 11:23:14 +0000 (12:23 +0100)]
docker: ignore distro versioning of debootstrap

We do a minimum version check for the debootstrap but if the distro
has added their own minor version tick it would fail and fall-back to
the SCM version. This is sub-optimal as the latest/greatest version
may be broken at any one particular time. We fix that with a little
sed magic on the version string before passing to our ugly shell
versioning check.

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
5 years agodocker: add commentary to debian-bootstrap.docker
Alex Bennée [Fri, 13 Jul 2018 10:56:49 +0000 (11:56 +0100)]
docker: add commentary to debian-bootstrap.docker

This is just a note that later versions of debootstrap don't
technically need this hack.

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
5 years agodocker: Update debootstrap script after Debian migration from Alioth to Salsa
Philippe Mathieu-Daudé [Tue, 3 Jul 2018 15:35:30 +0000 (12:35 -0300)]
docker: Update debootstrap script after Debian migration from Alioth to Salsa

This silents the following warning:

  Cloning into './debootstrap.git'...
  warning: redirecting to https://salsa.debian.org/installer-team/debootstrap.git/

See https://lists.debian.org/debian-devel-announce/2018/01/msg00004.html

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
5 years agodocker: report hint when docker.py check fails
Alex Bennée [Thu, 12 Jul 2018 13:36:18 +0000 (14:36 +0100)]
docker: report hint when docker.py check fails

When a check fails we currently just report why we failed. This is not
totally helpful to people who want to boot-strap a new image. Report a
hint as to why it failed.

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Suggested-by: Fam Zheng <famz@redhat.com>
5 years agodocker: drop QEMU_TARGET check, fallback in EXECUTABLE not set
Alex Bennée [Thu, 12 Jul 2018 09:35:54 +0000 (10:35 +0100)]
docker: drop QEMU_TARGET check, fallback in EXECUTABLE not set

The addition of QEMU_TARGET was intended to ensure we fall back to
checking for the existence of an image if the build system was not
currently configured to build it. However this breaks the direct use
of the rule for building custom binfmt_misc images. We already check
for EXECUTABLE so let us just use that as a proxy for deciding if we
are just going to check the image exits.

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
5 years agodocker: add expansion for docker-test-FOO to Makefile.include
Alex Bennée [Mon, 9 Jul 2018 12:24:52 +0000 (13:24 +0100)]
docker: add expansion for docker-test-FOO to Makefile.include

This allows us to run a particular test on all docker images. For
example:

  make docker-test-unit

Will run the unit tests on every supported image. At the same time
rename docker-test to docker-all-tests to be clearer.

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
5 years agodocker: add test-unit runner
Alex Bennée [Mon, 9 Jul 2018 09:55:34 +0000 (10:55 +0100)]
docker: add test-unit runner

This test doesn't even build QEMU, it just builds and runs all the
unit tests. Intended to make checking unit tests on all docker images
easier.

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
5 years agodocker: Makefile.include don't include partial images
Alex Bennée [Mon, 9 Jul 2018 10:51:57 +0000 (11:51 +0100)]
docker: Makefile.include don't include partial images

Rename DOCKER_INTERMEDIATE_IMAGES to DOCKER_PARTIAL_IMAGES and add the
incomplete cross compiler images that can build tests but can't build
QEMU itself. We also add debian, debian-bootstrap and the tricode
images to the list.

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
5 years agodocker: gracefully skip check_qemu
Alex Bennée [Mon, 9 Jul 2018 13:27:47 +0000 (14:27 +0100)]
docker: gracefully skip check_qemu

Not all our images are able to run the tests. Rather than use features
we can just check for the existence and run-ability of gtester. If the
image has been setup for binfmt_misc it will be able to run anyway.

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
5 years agodocker: move make check into check_qemu helper
Alex Bennée [Mon, 9 Jul 2018 12:27:54 +0000 (13:27 +0100)]
docker: move make check into check_qemu helper

Not all docker images can run the check step. Let's move everything
into a common helper so we don't need to replicate checks in the
future.

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
5 years agodocker: split configure_qemu from build_qemu
Alex Bennée [Mon, 9 Jul 2018 09:58:34 +0000 (10:58 +0100)]
docker: split configure_qemu from build_qemu

This allows some tests that just want to configure QEMU's source tree
to do so.

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
5 years agodocker: fail more gracefully on docker.py check
Alex Bennée [Mon, 9 Jul 2018 13:08:25 +0000 (14:08 +0100)]
docker: fail more gracefully on docker.py check

As this is called directly from the Makefile while determining
dependencies and it is possible the user was configured in one window
but not have credentials in the other. Let's catch the Exceptions and
deal with it quietly.

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reported-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
5 years agodocker: par down QEMU_CONFIGURE_OPTS in debian-tricore-cross
Alex Bennée [Fri, 13 Jul 2018 15:02:31 +0000 (16:02 +0100)]
docker: par down QEMU_CONFIGURE_OPTS in debian-tricore-cross

This image isn't going to build anything significant as it is just
intended for building test cases. In case it does end up getting
inadvertently included in a build lets aim for the minimal possible
product.

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
5 years agodocker: base debian-tricore on qemu:debian9
Alex Bennée [Mon, 9 Jul 2018 11:20:19 +0000 (12:20 +0100)]
docker: base debian-tricore on qemu:debian9

We need both git and a working compiler to build the tools. Although
the qemu:debian9 image also has a bunch of extra dependencies it would
be fairly unusual for a user not to already have this layer available
for one of our many other docker images so lets not complicate things.

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
5 years agotests/.gitignore: don't ignore docker tests
Alex Bennée [Mon, 9 Jul 2018 09:54:16 +0000 (10:54 +0100)]
tests/.gitignore: don't ignore docker tests

The .gitignore was being a little over enthusiastic hiding files.

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
5 years agotarget/arm: Escalate to correct HardFault when AIRCR.BFHFNMINS is set
Peter Maydell [Mon, 23 Jul 2018 12:34:57 +0000 (13:34 +0100)]
target/arm: Escalate to correct HardFault when AIRCR.BFHFNMINS is set

When we escalate a v8M exception to HardFault, if AIRCR.BFHFNMINNS is
set then we need to decide whether it should become a secure HardFault
or a nonsecure HardFault. We should always escalate to the same
target security state as the original exception. The current code
tries to test this using the 'secure' bool, which is not right because
that flag indicates whether the target security state only for
banked exceptions; the effect was that we were incorrectly escalating
always-secure exceptions like SecureFault to a nonsecure HardFault.

Fix this by defining, logging and using a new 'targets_secure' bool
which tracks the condition we actually want.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180723123457.2038-1-peter.maydell@linaro.org

5 years agohw/intc/arm_gicv3: Check correct HCR_EL2 bit when routing IRQ
Peter Maydell [Mon, 23 Jul 2018 18:03:37 +0000 (19:03 +0100)]
hw/intc/arm_gicv3: Check correct HCR_EL2 bit when routing IRQ

In icc_dir_write() we were incorrectly checking HCR_EL2.FMO
when determining whether IRQ should be routed to EL2; this should
be HCR_EL2.IMO (compare the GICv3 pseudocode ICC_DIR_EL1[]).
Use the correct mask.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180723180337.17378-1-peter.maydell@linaro.org

5 years agoui/cocoa.m: prevent stuck command key when going into full screen mode
John Arbuckle [Tue, 3 Jul 2018 02:00:17 +0000 (22:00 -0400)]
ui/cocoa.m: prevent stuck command key when going into full screen mode

When the user pushes Command-F in QEMU while the mouse is ungrabbed, QEMU
goes into full screen mode. When the user finally releases the command key,
it is sent to the guest as an event. The makes the guest operating system
think the command key is down when it is really up. To prevent this situation
from happening, we simply drop the first command key event after the user has
gone into full screen mode using Command-F.

Signed-off-by: John Arbuckle <programmingkidx@gmail.com>
Message-id: 20180703020017.1032-1-programmingkidx@gmail.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
5 years agoMerge remote-tracking branch 'remotes/ehabkost/tags/x86-next-pull-request' into staging
Peter Maydell [Tue, 24 Jul 2018 09:37:52 +0000 (10:37 +0100)]
Merge remote-tracking branch 'remotes/ehabkost/tags/x86-next-pull-request' into staging

Fix for -rc2

* Fix build failure on mips host

# gpg: Signature made Mon 23 Jul 2018 20:44:47 BST
# gpg:                using RSA key 2807936F984DC5A6
# gpg: Good signature from "Eduardo Habkost <ehabkost@redhat.com>"
# Primary key fingerprint: 5A32 2FD5 ABC4 D3DB ACCF  D1AA 2807 936F 984D C5A6

* remotes/ehabkost/tags/x86-next-pull-request:
  i386: Rename enum CacheType members

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
5 years agoqga: process_event() simplification and leak fix
Marc-André Lureau [Thu, 19 Jul 2018 18:40:59 +0000 (20:40 +0200)]
qga: process_event() simplification and leak fix

json_parser_parse_err() may return something else than a QDict, in
which case we loose the object. Let's keep track of the original
object to avoid leaks.

When an error occurs, "qdict" contains the response, but we still
check the "execute" key there. Untangle a bit this code, by having a
clear error path.

CC: Michael Roth <mdroth@linux.vnet.ibm.com>
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Cc: qemu-stable@nongnu.org
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
5 years agoqga-win: Handle fstrim for OSes lower than Win8
Sameeh Jubran [Sun, 24 Jun 2018 12:45:40 +0000 (15:45 +0300)]
qga-win: Handle fstrim for OSes lower than Win8

The defrag.exe tool which is used for executing the fstrim command
on Windows doesn't support retrim for OSes lower than Win8. This
commit handles this case and returns a suitable error.

Output of fstrim before this commit:
{"execute":"guest-fstrim"}
{"return": {"paths": [{"path": "C:\\", "error": "An invalid command line option
was specified. (0x89000008)"}, {"path": "F:\\", "error": "An invalid command
line option was specified. (0x89000008)"}, {"path": "S:\\", "error": "An
invalid command line option was specified. (0x89000008)"}]}}

Reported on:
https://bugzilla.redhat.com/show_bug.cgi?id=1594113

Signed-off-by: Sameeh Jubran <sjubran@redhat.com>
* use alternative version query code proposed by Sameeh
* fix up version check logic
* avoid CamelCase variable names when possible
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
5 years agoMerge remote-tracking branch 'remotes/rth/tags/pull-tcg-20180723' into staging
Peter Maydell [Mon, 23 Jul 2018 18:24:05 +0000 (19:24 +0100)]
Merge remote-tracking branch 'remotes/rth/tags/pull-tcg-20180723' into staging

Mark xmm registers call-clobbered.

# gpg: Signature made Mon 23 Jul 2018 18:20:03 BST
# gpg:                using RSA key 64DF38E8AF7E215F
# gpg: Good signature from "Richard Henderson <richard.henderson@linaro.org>"
# Primary key fingerprint: 7A48 1E78 868B 4DB6 A85A  05C0 64DF 38E8 AF7E 215F

* remotes/rth/tags/pull-tcg-20180723:
  tcg/i386: Mark xmm registers call-clobbered

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
5 years agoMerge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging
Peter Maydell [Mon, 23 Jul 2018 17:37:39 +0000 (18:37 +0100)]
Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging

Block layer patches:

- vvfat: Disable debug message by default
- qemu-iotests fixes
- Fix typos in comments

# gpg: Signature made Mon 23 Jul 2018 17:44:40 BST
# gpg:                using RSA key 7F09B272C88F2FD6
# gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>"
# Primary key fingerprint: DC3D EB15 9A9A F95D 3D74  56FE 7F09 B272 C88F 2FD6

* remotes/kevin/tags/for-upstream:
  block/vvfat: Disable debug message by default
  iotests: Disallow compat=0.10 in 223
  iotest: Fix filtering order in 226
  iotests: remove LUKS support from test 226
  qemu-img: avoid overflow of min_sparse parameter
  block: Fix typos in comments (found by codespell)
  qemu-iotests: Use host_device instead of file in 149

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
5 years agotcg/i386: Mark xmm registers call-clobbered
Richard Henderson [Sun, 22 Jul 2018 22:28:02 +0000 (15:28 -0700)]
tcg/i386: Mark xmm registers call-clobbered

When host vector registers and operations were introduced, I failed
to mark the registers call clobbered as required by the ABI.

Fixes: 770c2fc7bb7
Cc: qemu-stable@nongnu.org
Reported-by: Jason A. Donenfeld <Jason@zx2c4.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
5 years agoi386: Rename enum CacheType members
Eduardo Habkost [Tue, 17 Jul 2018 19:40:10 +0000 (16:40 -0300)]
i386: Rename enum CacheType members

Rename DCACHE to DATA_CACHE and ICACHE to INSTRUCTION_CACHE.
This avoids conflict with Linux asm/cachectl.h macros and fixes
build failure on mips hosts.

Reported-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Message-Id: <20180717194010.30096-1-ehabkost@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Acked-by: Aleksandar Markovic <amarkovic@wavecomp.com>
Reviewed-by: Babu Moger <babu.moger@amd.com>
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
5 years agoMerge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20180723' into...
Peter Maydell [Mon, 23 Jul 2018 15:15:24 +0000 (16:15 +0100)]
Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20180723' into staging

target-arm queue:
 * spitz, exynos: fix bugs when introspecting some devices
 * hw/microblaze/xlnx-zynqmp-pmu: Fix introspection problem in 'xlnx, zynqmp-pmu-soc'
 * target/arm: Correctly handle overlapping small MPU regions
 * hw/sd/bcm2835_sdhost: Fix PIO mode writes

# gpg: Signature made Mon 23 Jul 2018 15:40:09 BST
# gpg:                using RSA key 3C2525ED14360CDE
# gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>"
# gpg:                 aka "Peter Maydell <pmaydell@gmail.com>"
# gpg:                 aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>"
# Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83  15CF 3C25 25ED 1436 0CDE

* remotes/pmaydell/tags/pull-target-arm-20180723:
  hw/intc/exynos4210_gic: Turn instance_init into realize function
  hw/arm/spitz: Move problematic nand_init() code to realize function
  target/arm: Correctly handle overlapping small MPU regions
  hw/sd/bcm2835_sdhost: Fix PIO mode writes
  hw/microblaze/xlnx-zynqmp-pmu: Fix introspection problem in 'xlnx, zynqmp-pmu-soc'

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
5 years agoblock/vvfat: Disable debug message by default
Thomas Huth [Wed, 18 Jul 2018 15:08:29 +0000 (17:08 +0200)]
block/vvfat: Disable debug message by default

It's annoying to see this debug message every time you use vvfat.
Disable it with the DLOG() macro by default, as it is done with the
other debug messages in this file.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: John Snow <jsnow@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
5 years agoiotests: Disallow compat=0.10 in 223
Max Reitz [Fri, 13 Jul 2018 19:15:06 +0000 (21:15 +0200)]
iotests: Disallow compat=0.10 in 223

223 tests persistent dirty bitmaps which are not supported in
compat=0.10, so that option is unsupported for this test.

Signed-off-by: Max Reitz <mreitz@redhat.com>
Tested-by: John Snow <jsnow@redhat.com>
Reviewed-by: John Snow <jsnow@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
5 years agoiotest: Fix filtering order in 226
Max Reitz [Fri, 13 Jul 2018 19:41:00 +0000 (21:41 +0200)]
iotest: Fix filtering order in 226

The test directory should be filtered before the image format, otherwise
the test will fail if the image format is part of the test directory,
like so:

[...]
-can't open: Could not open 'TEST_DIR/t.IMGFMT': Is a directory
+can't open: Could not open '/tmp/test-IMGFMT/t.IMGFMT': Is a directory
[...]

Signed-off-by: Max Reitz <mreitz@redhat.com>
Reviewed-by: John Snow <jsnow@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
5 years agoiotests: remove LUKS support from test 226
John Snow [Fri, 13 Jul 2018 17:37:21 +0000 (13:37 -0400)]
iotests: remove LUKS support from test 226

This test doesn't actually care about the format anyway, it just
supports "all formats" as a convenience. LUKS however does not use a
simple image filename which confuses this iotest.

We can simply skip the test for formats that use IMGOPTSSYNTAX for
their filenames without missing much coverage.

Signed-off-by: John Snow <jsnow@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
5 years agoqemu-img: avoid overflow of min_sparse parameter
Peter Lieven [Fri, 13 Jul 2018 07:15:39 +0000 (09:15 +0200)]
qemu-img: avoid overflow of min_sparse parameter

the min_sparse convert parameter can overflow (e.g. -S 1024G)
in the conversion from int64_t to int resulting in a negative
min_sparse parameter. Avoid this by limiting the valid parameters
to sane values. In fact anything exceeding the convert buffer size
is also pointless. While at it also forbid values that are non
multiple of 512 to avoid undesired behaviour. For instance, values
between 1 and 511 were legal, but resulted in full allocation.

Cc: qemu-stable@nongnu.org
Signed-off-by: Peter Lieven <pl@kamp.de>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
5 years agoblock: Fix typos in comments (found by codespell)
Stefan Weil [Thu, 12 Jul 2018 19:51:20 +0000 (21:51 +0200)]
block: Fix typos in comments (found by codespell)

Signed-off-by: Stefan Weil <sw@weilnetz.de>
Reviewed-by: John Snow <jsnow@redhat.com>
Reviewed-by: Jeff Cody <jcody@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
5 years agoqemu-iotests: Use host_device instead of file in 149
Kevin Wolf [Fri, 13 Jul 2018 07:05:39 +0000 (09:05 +0200)]
qemu-iotests: Use host_device instead of file in 149

The test case uses block devices with driver=file, which causes the test
to fail after commit 230ff73904 added a deprecation warning for this.
Fix the test case to use driver=host_device and update the reference
output accordingly.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
5 years agohw/intc/exynos4210_gic: Turn instance_init into realize function
Thomas Huth [Mon, 23 Jul 2018 14:21:27 +0000 (15:21 +0100)]
hw/intc/exynos4210_gic: Turn instance_init into realize function

The instance_init function of the "exynos4210.gic" device creates a
new "arm_gic" device and immediately realizes it with qdev_init_nofail().
This will leave a lot of object in the QOM tree during introspection of
the "exynos4210.gic" device, e.g. reproducible by starting QEMU like this:

qemu-system-aarch64 -M none -nodefaults -nographic -monitor stdio

And then by running "info qom-tree" at the HMP monitor, followed by
"device_add exynos4210.gic,help" and finally checking "info qom-tree"
again.

Also note that qdev_init_nofail() can exit QEMU in case of errors - and
this must never happen during an instance_init function, otherwise QEMU
could terminate unexpectedly during introspection of a device.

Since most of the code that follows the qdev_init_nofail() depends on
the realized "gicbusdev", the easiest solution to the problem is to
turn the whole instance_init function into a realize function instead.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-id: 1532337784-334-1-git-send-email-thuth@redhat.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
5 years agohw/arm/spitz: Move problematic nand_init() code to realize function
Thomas Huth [Mon, 23 Jul 2018 14:21:26 +0000 (15:21 +0100)]
hw/arm/spitz: Move problematic nand_init() code to realize function

nand_init() does not only create the NAND device, it also realizes
the device with qdev_init_nofail() already. So we must not call
nand_init() from an instance_init function like sl_nand_init(),
otherwise we get superfluous NAND devices in the QOM tree after
introspecting the 'sl-nand' device. So move the nand_init() to the
realize function of 'sl-nand' instead.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 1532006134-7701-1-git-send-email-thuth@redhat.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
5 years agotarget/arm: Correctly handle overlapping small MPU regions
Peter Maydell [Mon, 23 Jul 2018 14:21:26 +0000 (15:21 +0100)]
target/arm: Correctly handle overlapping small MPU regions

To correctly handle small (less than TARGET_PAGE_SIZE) MPU regions,
we must correctly handle the case where the address being looked
up hits in an MPU region that is not small but the address is
in the same page as a small region. For instance if MPU region
1 covers an entire page from 0x2000 to 0x2400 and MPU region
2 is small and covers only 0x2200 to 0x2280, then for an access
to 0x2000 we must not return a result covering the full page
even though we hit the page-sized region 1. Otherwise we will
then cache that result in the TLB and accesses that should
hit region 2 will incorrectly find the region 1 information.

Check for the case where we miss an MPU region but it is still
within the same page, and in that case narrow the size we will
pass to tlb_set_page_with_attrs() for whatever the final
outcome is of the MPU lookup.

Reported-by: Adithya Baglody <adithya.nagaraj.baglody@intel.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180716133302.25989-1-peter.maydell@linaro.org

5 years agohw/sd/bcm2835_sdhost: Fix PIO mode writes
Guenter Roeck [Mon, 23 Jul 2018 14:21:26 +0000 (15:21 +0100)]
hw/sd/bcm2835_sdhost: Fix PIO mode writes

Writes in PIO mode have two requirements:

- A data interrupt must be generated after a write command has been
  issued to indicate that the chip is ready to receive data.
- A block interrupt must be generated after each block to indicate
  that the chip is ready to receive the next data block.

Rearrange the code to make this happen. Tested on raspi3 (in PIO mode)
and raspi2 (in DMA mode).

Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Message-id: 1531779837-20557-1-git-send-email-linux@roeck-us.net
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
5 years agohw/microblaze/xlnx-zynqmp-pmu: Fix introspection problem in 'xlnx, zynqmp-pmu-soc'
Thomas Huth [Mon, 23 Jul 2018 14:21:25 +0000 (15:21 +0100)]
hw/microblaze/xlnx-zynqmp-pmu: Fix introspection problem in 'xlnx, zynqmp-pmu-soc'

Valgrind complains:

echo "{'execute':'qmp_capabilities'} {'execute':'device-list-properties'," \
 "'arguments':{'typename':'xlnx,zynqmp-pmu-soc'}}" \
 "{'execute': 'human-monitor-command', " \
 "'arguments': {'command-line': 'info qtree'}}" | \
 valgrind -q microblazeel-softmmu/qemu-system-microblazeel -M none,accel=qtest -qmp stdio
[...]
==13605== Invalid read of size 8
==13605==    at 0x2AC69A: qdev_print (qdev-monitor.c:686)
==13605==    by 0x2AC69A: qbus_print (qdev-monitor.c:719)
==13605==    by 0x2591E8: handle_hmp_command (monitor.c:3446)

Use the new object_initialize_child() and sysbus_init_child_obj() to
fix the issue.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Message-id: 1531839343-13828-1-git-send-email-thuth@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
5 years agoMerge remote-tracking branch 'remotes/armbru/tags/pull-qapi-2018-07-23' into staging
Peter Maydell [Mon, 23 Jul 2018 14:15:46 +0000 (15:15 +0100)]
Merge remote-tracking branch 'remotes/armbru/tags/pull-qapi-2018-07-23' into staging

QAPI and monitor patches for 2018-07-23 (3.0.0-rc2)

# gpg: Signature made Mon 23 Jul 2018 14:08:37 BST
# gpg:                using RSA key 3870B400EB918653
# gpg: Good signature from "Markus Armbruster <armbru@redhat.com>"
# gpg:                 aka "Markus Armbruster <armbru@pond.sub.org>"
# Primary key fingerprint: 354B C8B3 D7EB 2A6B 6867  4E5F 3870 B400 EB91 8653

* remotes/armbru/tags/pull-qapi-2018-07-23:
  monitor: Fix unsafe sharing of @cur_mon among threads
  qapi: Make 'allow-oob' optional in SchemaInfoCommand

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
5 years agoMerge remote-tracking branch 'remotes/vivier2/tags/linux-user-for-3.0-pull-request...
Peter Maydell [Mon, 23 Jul 2018 13:03:14 +0000 (14:03 +0100)]
Merge remote-tracking branch 'remotes/vivier2/tags/linux-user-for-3.0-pull-request' into staging

Some ppc/ppc64 fixes:
- we can run now most of the targets on a ppc64 host with 64kB pages
- add swapcontext syscall to run tests/test-coroutine in
  debian-powerpc-user-cross

# gpg: Signature made Mon 23 Jul 2018 13:55:57 BST
# gpg:                using RSA key F30C38BD3F2FBE3C
# gpg: Good signature from "Laurent Vivier <lvivier@redhat.com>"
# gpg:                 aka "Laurent Vivier <laurent@vivier.eu>"
# gpg:                 aka "Laurent Vivier (Red Hat) <lvivier@redhat.com>"
# Primary key fingerprint: CD2F 75DD C8E3 A4DC 2E4F  5173 F30C 38BD 3F2F BE3C

* remotes/vivier2/tags/linux-user-for-3.0-pull-request:
  linux-user/ppc: Implement swapcontext syscall
  linux-user: fix ELF load alignment error

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
5 years agomonitor: Fix unsafe sharing of @cur_mon among threads
Peter Xu [Fri, 20 Jul 2018 03:34:51 +0000 (11:34 +0800)]
monitor: Fix unsafe sharing of @cur_mon among threads

@cur_mon is null unless the main thread is running monitor code, either
HMP code within monitor_read(), or QMP code within
monitor_qmp_dispatch().

Use of @cur_mon outside the main thread is therefore unsafe.

Most of its uses are in monitor command handlers.  These run in the main
thread.

However, there are also uses hiding elsewhere, such as in
error_vprintf(), and thus error_report(), making these functions unsafe
outside the main thread.  No such unsafe uses are known at this time.
Regardless, this is an unnecessary trap.  It's an ancient trap, though.

More recently, commit cf869d53172 "qmp: support out-of-band (oob)
execution" spiced things up: the monitor I/O thread assigns to @cur_mon
when executing commands out-of-band.  Having two threads save, set and
restore @cur_mon without synchronization is definitely unsafe.  We can
end up with @cur_mon null while the main thread runs monitor code, or
non-null while it runs non-monitor code.

We could fix this by making the I/O thread not mess with @cur_mon, but
that would leave the trap armed and ready.

Instead, make @cur_mon thread-local.  It's now reliably null unless the
thread is running monitor code.

Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
[peterx: update subject and commit message written by Markus]
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Peter Xu <peterx@redhat.com>
Message-Id: <20180720033451.32710-1-peterx@redhat.com>

5 years agoqapi: Make 'allow-oob' optional in SchemaInfoCommand
Markus Armbruster [Wed, 18 Jul 2018 09:05:57 +0000 (11:05 +0200)]
qapi: Make 'allow-oob' optional in SchemaInfoCommand

Making 'allow-oob' optional in SchemaInfoCommand permits omitting it
in the common case.  Shrinks query-qmp-schema's output from 122.1KiB
to 118.6KiB for me.

Note that out-of-band execution is still experimental (you have to
configure the monitor with x-oob=on to use it).

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-Id: <20180718090557.17248-1-armbru@redhat.com>
Reviewed-by: Peter Xu <peterx@redhat.com>
5 years agopo: Don't include comments with location
Stefan Weil [Fri, 20 Jul 2018 21:25:09 +0000 (23:25 +0200)]
po: Don't include comments with location

Those comments change often when ui/gtk.c is changed and are not
really useful.

Signed-off-by: Stefan Weil <sw@weilnetz.de>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-id: 20180720212509.18339-1-sw@weilnetz.de
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
5 years agolinux-user/ppc: Implement swapcontext syscall
Richard Henderson [Wed, 18 Jul 2018 20:06:48 +0000 (13:06 -0700)]
linux-user/ppc: Implement swapcontext syscall

This allows the tests generated by debian-powerpc-user-cross
to function properly, especially tests/test-coroutine.

Technically this syscall is available to both ppc32 and ppc64,
but only ppc32 glibc actually uses it.  Thus the ppc64 path is
untested.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Message-Id: <20180718200648.22529-1-richard.henderson@linaro.org>

5 years agolinux-user: fix ELF load alignment error
Laurent Vivier [Mon, 16 Jul 2018 19:53:49 +0000 (21:53 +0200)]
linux-user: fix ELF load alignment error

When we try to use some targets on ppc64, it can happen the target
doesn't support the host page size to align ELF load sections and
fails with:

  ELF load command alignment not page-aligned

Since commit a70daba3771 ("linux-user: Tell guest about big host
page sizes") the host page size is used to align ELF sections, but
this doesn't work if the alignment required by the load section is
smaller than the host one.  For these cases, we continue to use the
TARGET_PAGE_SIZE instead of the host one.

I have tested this change on ppc64, and it fixes qemu linux-user for:
  s390x, m68k, i386, arm, aarch64, hppa
and I have tested it doesn't break the following targets:
  x86_64, mips64el, sh4
mips and mipsel abort, but I think for another reason.

Signed-off-by: Laurent Vivier <laurent@vivier.eu>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
[lv: fixed "info->alignment = 0"]
Message-Id: <20180716195349.29959-1-laurent@vivier.eu>

5 years agoMerge remote-tracking branch 'remotes/rth/tags/pull-tcg-20180719' into staging
Peter Maydell [Fri, 20 Jul 2018 10:08:33 +0000 (11:08 +0100)]
Merge remote-tracking branch 'remotes/rth/tags/pull-tcg-20180719' into staging

Fix aarch64 host vector mul

# gpg: Signature made Fri 20 Jul 2018 04:58:32 BST
# gpg:                using RSA key 64DF38E8AF7E215F
# gpg: Good signature from "Richard Henderson <richard.henderson@linaro.org>"
# Primary key fingerprint: 7A48 1E78 868B 4DB6 A85A  05C0 64DF 38E8 AF7E 215F

* remotes/rth/tags/pull-tcg-20180719:
  tcg/aarch64: limit mul_vec size

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
5 years agoMerge remote-tracking branch 'remotes/jasowang/tags/net-pull-request' into staging
Peter Maydell [Fri, 20 Jul 2018 09:00:08 +0000 (10:00 +0100)]
Merge remote-tracking branch 'remotes/jasowang/tags/net-pull-request' into staging

# gpg: Signature made Fri 20 Jul 2018 01:40:43 BST
# gpg:                using RSA key EF04965B398D6211
# gpg: Good signature from "Jason Wang (Jason Wang on RedHat) <jasowang@redhat.com>"
# gpg: WARNING: This key is not certified with sufficiently trusted signatures!
# gpg:          It is not certain that the signature belongs to the owner.
# Primary key fingerprint: 215D 46F4 8246 689E C77F  3562 EF04 965B 398D 6211

* remotes/jasowang/tags/net-pull-request:
  tap: fix memory leak on success to create a tap device
  e1000e: Prevent MSI/MSI-X storms

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
5 years agotap: fix memory leak on success to create a tap device
Yunjian Wang [Thu, 31 May 2018 07:28:22 +0000 (15:28 +0800)]
tap: fix memory leak on success to create a tap device

The memory leak on success to create a tap device. And the nfds and
nvhosts may not be the same and need to be processed separately.

Fixes: 07825977 ("tap: fix memory leak on failure to create a multiqueue tap device")
Fixes: 264986e2 ("tap: multiqueue support")
Cc: qemu-stable@nongnu.org
Signed-off-by: Yunjian Wang <wangyunjian@huawei.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
5 years agoe1000e: Prevent MSI/MSI-X storms
Jan Kiszka [Thu, 5 Apr 2018 17:41:47 +0000 (19:41 +0200)]
e1000e: Prevent MSI/MSI-X storms

Only signal MSI/MSI-X events on rising edges. So far we re-triggered the
interrupt sources even if the guest did no consumed the pending one,
easily causing interrupt storms.

Issue was observable with Linux 4.16 e1000e driver when MSI-X was used.
Vector 2 was causing interrupt storms after the driver activated the
device.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
5 years agoMerge remote-tracking branch 'remotes/stefanha/tags/tracing-pull-request' into staging
Peter Maydell [Thu, 19 Jul 2018 17:25:53 +0000 (18:25 +0100)]
Merge remote-tracking branch 'remotes/stefanha/tags/tracing-pull-request' into staging

Pull request

Contains a fix to use double-dash consistently with tracing command-line
options in documentation and output.

# gpg: Signature made Thu 19 Jul 2018 17:24:51 BST
# gpg:                using RSA key 9CA4ABB381AB73C8
# gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>"
# gpg:                 aka "Stefan Hajnoczi <stefanha@gmail.com>"
# Primary key fingerprint: 8695 A8BF D3F9 7CDA AC35  775A 9CA4 ABB3 81AB 73C8

* remotes/stefanha/tags/tracing-pull-request:
  tracing: Use double-dash spelling for trace option

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
5 years agoMerge remote-tracking branch 'remotes/alistair/tags/pull-riscv-pull-20180719' into...
Peter Maydell [Thu, 19 Jul 2018 16:21:43 +0000 (17:21 +0100)]
Merge remote-tracking branch 'remotes/alistair/tags/pull-riscv-pull-20180719' into staging

riscv: Fix introspection problems

This is based on Thomas's work fixing introspection problems [1] and
applied to the RISC-V port.

1: https://lists.gnu.org/archive/html/qemu-devel/2018-07/msg03261.html

# gpg: Signature made Thu 19 Jul 2018 17:06:07 BST
# gpg:                using RSA key 21E10D29DF977054
# gpg: Good signature from "Alistair Francis <alistair@alistair23.me>"
# gpg: WARNING: This key is not certified with sufficiently trusted signatures!
# gpg:          It is not certain that the signature belongs to the owner.
# Primary key fingerprint: F6C4 AC46 D493 4868 D3B8  CE8F 21E1 0D29 DF97 7054

* remotes/alistair/tags/pull-riscv-pull-20180719:
  spike: Fix crash when introspecting the device
  riscv_hart: Fix crash when introspecting the device
  virt: Fix crash when introspecting the device
  sifive_u: Fix crash when introspecting the device
  sifive_e: Fix crash when introspecting the device

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
5 years agotcg/aarch64: limit mul_vec size
Alex Bennée [Thu, 19 Jul 2018 15:42:48 +0000 (16:42 +0100)]
tcg/aarch64: limit mul_vec size

In AdvSIMD we can only do 32x32 integer multiples although SVE is
capable of larger 64 bit multiples. As a result we can end up
generating invalid opcodes. Fix this by only reprting we can emit
mul vector ops if the size is small enough.

Fixes a crash on:

  sve-all-short-v8.3+sve@vq3/insn_mul_z_zi___INC.risu.bin

When running on AArch64 hardware.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20180719154248.29669-1-alex.bennee@linaro.org>
[rth: Removed the tcg_debug_assert -- there are plenty of other
cases that we do not diagnose within the insn encoding helpers.]
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
5 years agospike: Fix crash when introspecting the device
Alistair Francis [Tue, 17 Jul 2018 18:06:47 +0000 (11:06 -0700)]
spike: Fix crash when introspecting the device

Use the new object_initialize_child() and sysbus_init_child_obj() to
fix the issue.

Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Suggested-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Michael Clark <mjc@sifive.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
5 years agoriscv_hart: Fix crash when introspecting the device
Alistair Francis [Tue, 17 Jul 2018 18:03:05 +0000 (11:03 -0700)]
riscv_hart: Fix crash when introspecting the device

Use the new object_initialize_child() and sysbus_init_child_obj() to
fix the issue.

Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Suggested-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Michael Clark <mjc@sifive.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
5 years agovirt: Fix crash when introspecting the device
Alistair Francis [Mon, 16 Jul 2018 22:30:47 +0000 (15:30 -0700)]
virt: Fix crash when introspecting the device

Use the new object_initialize_child() and sysbus_init_child_obj() to
fix the issue.

Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Suggested-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Michael Clark <mjc@sifive.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
5 years agosifive_u: Fix crash when introspecting the device
Alistair Francis [Mon, 16 Jul 2018 22:30:32 +0000 (15:30 -0700)]
sifive_u: Fix crash when introspecting the device

Use the new object_initialize_child() and sysbus_init_child_obj() to
fix the issue.

Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Suggested-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Michael Clark <mjc@sifive.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
5 years agosifive_e: Fix crash when introspecting the device
Alistair Francis [Mon, 16 Jul 2018 22:29:01 +0000 (15:29 -0700)]
sifive_e: Fix crash when introspecting the device

Use the new object_initialize_child() and sysbus_init_child_obj() to
fix the issue.

Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Suggested-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Michael Clark <mjc@sifive.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
5 years agoMerge remote-tracking branch 'remotes/stefanha/tags/block-pull-request' into staging
Peter Maydell [Thu, 19 Jul 2018 14:38:06 +0000 (15:38 +0100)]
Merge remote-tracking branch 'remotes/stefanha/tags/block-pull-request' into staging

Pull request

This fix prevents hangs when a drive leaves a throttling group.

# gpg: Signature made Thu 19 Jul 2018 15:28:37 BST
# gpg:                using RSA key 9CA4ABB381AB73C8
# gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>"
# gpg:                 aka "Stefan Hajnoczi <stefanha@gmail.com>"
# Primary key fingerprint: 8695 A8BF D3F9 7CDA AC35  775A 9CA4 ABB3 81AB 73C8

* remotes/stefanha/tags/block-pull-request:
  throttle-groups: fix hang when group member leaves

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
5 years agoMerge remote-tracking branch 'remotes/cohuck/tags/s390x-20180719' into staging
Peter Maydell [Thu, 19 Jul 2018 12:12:47 +0000 (13:12 +0100)]
Merge remote-tracking branch 'remotes/cohuck/tags/s390x-20180719' into staging

don't segfault when trying to baseline an odd cpu model

# gpg: Signature made Thu 19 Jul 2018 12:39:05 BST
# gpg:                using RSA key DECF6B93C6F02FAF
# gpg: Good signature from "Cornelia Huck <conny@cornelia-huck.de>"
# gpg:                 aka "Cornelia Huck <huckc@linux.vnet.ibm.com>"
# gpg:                 aka "Cornelia Huck <cornelia.huck@de.ibm.com>"
# gpg:                 aka "Cornelia Huck <cohuck@kernel.org>"
# gpg:                 aka "Cornelia Huck <cohuck@redhat.com>"
# Primary key fingerprint: C3D0 D66D C362 4FF6 A8C0  18CE DECF 6B93 C6F0 2FAF

* remotes/cohuck/tags/s390x-20180719:
  s390x/cpumodel: fix segmentation fault when baselining models

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
5 years agotracing: Use double-dash spelling for trace option
Yaowei Bai [Wed, 4 Jul 2018 03:17:27 +0000 (11:17 +0800)]
tracing: Use double-dash spelling for trace option

The '-trace' and '--trace' spellings are only both supported in qemu
binary, while for qemu-nbd or qemu-img only '--trace' spelling is
supported. So for the consistency of trace option invocation, we
should use double-dash spelling in our documentation.

This's also mentioned in
https://wiki.qemu.org/BiteSizedTasks#Consistent_option_usage_in_documentation
.

Signed-off-by: Yaowei Bai <baiyaowei@cmss.chinamobile.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Message-id: 1530674247-31200-1-git-send-email-baiyaowei@cmss.chinamobile.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
5 years agothrottle-groups: fix hang when group member leaves
Stefan Hajnoczi [Wed, 4 Jul 2018 14:54:10 +0000 (15:54 +0100)]
throttle-groups: fix hang when group member leaves

Throttle groups consist of members sharing one throttling state
(including bps/iops limits).  Round-robin scheduling is used to ensure
fairness.  If a group member already has a timer pending then other
groups members do not schedule their own timers.  The next group member
will have its turn when the existing timer expires.

A hang may occur when a group member leaves while it had a timer
scheduled.  Although the code carefully removes the group member from
the round-robin list, it does not schedule the next member.  Therefore
remaining members continue to wait for the removed member's timer to
expire.

This patch schedules the next request if a timer is pending.
Unfortunately the actual bug is a race condition that I've been unable
to capture in a test case.

Sometimes drive2 hangs when drive1 is removed from the throttling group:

  $ qemu ... -drive if=none,id=drive1,cache=none,format=qcow2,file=data1.qcow2,iops=100,group=foo \
             -device virtio-blk-pci,id=virtio-blk-pci0,drive=drive1 \
             -drive if=none,id=drive2,cache=none,format=qcow2,file=data2.qcow2,iops=10,group=foo \
             -device virtio-blk-pci,id=virtio-blk-pci1,drive=drive2
  (guest-console1)# fio -filename /dev/vda 4k-seq-read.job
  (guest-console2)# fio -filename /dev/vdb 4k-seq-read.job
  (qmp) {"execute": "block_set_io_throttle", "arguments": {"device": "drive1","bps": 0,"bps_rd": 0,"bps_wr": 0,"iops": 0,"iops_rd": 0,"iops_wr": 0}}

Reported-by: Nini Gu <ngu@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 20180704145410.794-1-stefanha@redhat.com
RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=1535914
Cc: Alberto Garcia <berto@igalia.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
5 years agos390x/cpumodel: fix segmentation fault when baselining models
David Hildenbrand [Wed, 18 Jul 2018 09:23:30 +0000 (11:23 +0200)]
s390x/cpumodel: fix segmentation fault when baselining models

Usually, when baselining two CPU models, whereby one of them has base
CPU features disabled (e.g. z14-base,msa=off), we fallback to an older
model that did not have these features in the base model. We always try to
create a "sane" CPU model (as far as possible), and one part of it is that
removing base features is no good and to be avoided.

Now, if we disable base features that were part of a z900, we're out of
luck. We won't find a CPU model and QEMU will segfault. This is a
scenario that should never happen in real life, but it can be used to
crash QEMU.

So let's properly report an error if we baseline e.g.:

{ "execute": "query-cpu-model-baseline",
  "arguments" : { "modela": { "name": "z14-base", "props": {"esan3" : false}},
                  "modelb": { "name": "z14"}} }

Instead of segfaulting.

Signed-off-by: David Hildenbrand <david@redhat.com>
Message-Id: <20180718092330.19465-1-david@redhat.com>
Acked-by: Christian Borntraeger <borntraeger@de.ibm.com>
Signed-off-by: Cornelia Huck <cohuck@redhat.com>
5 years agoUpdate version for v3.0.0-rc1 release
Peter Maydell [Tue, 17 Jul 2018 17:15:19 +0000 (18:15 +0100)]
Update version for v3.0.0-rc1 release

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
5 years agoMerge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into staging
Peter Maydell [Tue, 17 Jul 2018 16:06:32 +0000 (17:06 +0100)]
Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into staging

Bug fixes.

# gpg: Signature made Tue 17 Jul 2018 16:06:07 BST
# gpg:                using RSA key BFFBD25F78C7AE83
# gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>"
# gpg:                 aka "Paolo Bonzini <pbonzini@redhat.com>"
# Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4  E2F7 7E15 100C CD36 69B1
#      Subkey fingerprint: F133 3857 4B66 2389 866C  7682 BFFB D25F 78C7 AE83

* remotes/bonzini/tags/for-upstream:
  Document command line options with single dash
  opts: remove redundant check for NULL parameter
  i386: only parse the initrd_filename once for multiboot modules
  i386: fix regression parsing multiboot initrd modules
  virtio-scsi: fix hotplug ->reset() vs event race
  qdev: add HotplugHandler->post_plug() callback
  hw/char/serial: retry write if EAGAIN
  PC Chipset: Improve serial divisor calculation
  vhost-user-test: added proper TestServer *dest initialization in test_migrate()
  hyperv: ensure VP index equal to QEMU cpu_index
  hyperv: rename vcpu_id to vp_index
  accel: Fix typo and grammar in comment
  dump: add kernel_gs_base to QEMU CPU state

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
5 years agoDocument command line options with single dash
BALATON Zoltan [Mon, 16 Jul 2018 19:12:08 +0000 (21:12 +0200)]
Document command line options with single dash

QEMU options have a single dash (but also work as double dash for
convenience and compatibility). Most options are listed with single
dash in command line help but some were listed with two dashes.
Normalize these to have the same format as the others.

Left --preconfig as that is mentioned as double dash everywhere so I
assume that is the preferred form for that.

Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
Acked-by: Thomas Huth <thuth@redhat.com>
Message-Id: <20180716193312.A5BA17456B9@zero.eik.bme.hu>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
5 years agoopts: remove redundant check for NULL parameter
Daniel P. Berrangé [Mon, 14 May 2018 17:19:13 +0000 (18:19 +0100)]
opts: remove redundant check for NULL parameter

No callers of get_opt_value() pass in a NULL for the "value" parameter,
so the check is redundant.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Message-Id: <20180514171913.17664-4-berrange@redhat.com>
Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
Tested-by: Roman Kagan <rkagan@virtuozzo.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
5 years agoi386: only parse the initrd_filename once for multiboot modules
Daniel P. Berrangé [Mon, 14 May 2018 17:19:12 +0000 (18:19 +0100)]
i386: only parse the initrd_filename once for multiboot modules

The multiboot code parses the initrd_filename twice, first to count how
many entries there are, and second to process each entry. This changes
the first loop to store the parse module names in a list, and the second
loop can now use these names. This avoids having to pass NULL to the
get_opt_value() method which means it can safely assume a non-NULL param.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Message-Id: <20180514171913.17664-3-berrange@redhat.com>
Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
Tested-by: Roman Kagan <rkagan@virtuozzo.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
5 years agoi386: fix regression parsing multiboot initrd modules
Daniel P. Berrangé [Mon, 14 May 2018 17:19:11 +0000 (18:19 +0100)]
i386: fix regression parsing multiboot initrd modules

The logic for parsing the multiboot initrd modules was messed up in

  commit 950c4e6c94b15cd0d8b63891dddd7a8dbf458e6a
  Author: Daniel P. Berrangé <berrange@redhat.com>
  Date:   Mon Apr 16 12:17:43 2018 +0100

    opts: don't silently truncate long option values

Causing the length to be undercounter, and the number of modules over
counted. It also passes NULL to get_opt_value() which was not robust
at accepting a NULL value.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Message-Id: <20180514171913.17664-2-berrange@redhat.com>
Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
Tested-by: Roman Kagan <rkagan@virtuozzo.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
5 years agohw/arm/xlnx-zynqmp: Fix crash when introspecting the "xlnx, zynqmp" device
Thomas Huth [Mon, 16 Jul 2018 12:59:34 +0000 (14:59 +0200)]
hw/arm/xlnx-zynqmp: Fix crash when introspecting the "xlnx, zynqmp" device

QEMU currently crashes when e.g. doing something like this:

echo "{'execute':'qmp_capabilities'} {'execute':'device-list-properties'," \
 "'arguments':{'typename':'xlnx,zynqmp'}}" \
 "{'execute': 'human-monitor-command', " \
 "'arguments': {'command-line': 'info qtree'}}" \
 |  aarch64-softmmu/qemu-system-aarch64 -M none,accel=qtest -qmp stdio

Use the new object_initialize_child() and sysbus_init_child_obj()
functions to get the refernce counting of the child objects right, so
that they are properly cleaned up when the parent gets destroyed.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 1531745974-17187-18-git-send-email-thuth@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
5 years agohw/display/xlnx_dp: Move problematic code from instance_init to realize
Paolo Bonzini [Mon, 16 Jul 2018 12:59:33 +0000 (14:59 +0200)]
hw/display/xlnx_dp: Move problematic code from instance_init to realize

aux_create_slave() calls qdev_init_nofail() which in turn "realizes"
the corresponding object. This is unlike qdev_create(), and it is wrong
because qdev_init_nofail() must not be called from an instance_init
function.  Move qdev_init_nofail() and the subsequent aux_map_slave into
the caller's realize function.

There are two more bugs that needs to be fixed here, too, where the
objects are created but not added as children.  Therefore when
you call object_unparent on them, nothing happens.

In particular dpcd and edid give you an infinite loop in bus_unparent,
because device_unparent is not called and does not remove them from
the list of devices on the bus.

Reported-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-id: 1531745974-17187-17-git-send-email-thuth@redhat.com
[thuth: Added Paolo's fixup for the dpcd and edid unparenting]
Signed-off-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
5 years agohw/arm/stm32f205_soc: Fix introspection problem with 'stm32f205-soc' device
Thomas Huth [Mon, 16 Jul 2018 12:59:32 +0000 (14:59 +0200)]
hw/arm/stm32f205_soc: Fix introspection problem with 'stm32f205-soc' device

Valgrind complains:

echo "{'execute':'qmp_capabilities'} {'execute':'device-list-properties'," \
 "'arguments':{'typename':'stm32f205-soc'}}" \
 "{'execute': 'human-monitor-command', " \
 "'arguments': {'command-line': 'info qtree'}}" | \
 valgrind -q aarch64-softmmu/qemu-system-aarch64 -M none,accel=qtest -qmp stdio
[...]
==28531== Invalid read of size 8
==28531==    at 0x6185BA: qdev_print (qdev-monitor.c:686)
==28531==    by 0x6185BA: qbus_print (qdev-monitor.c:719)
==28531==    by 0x452B38: handle_hmp_command (monitor.c:3446)
[...]

Fix it with the new sysbus_init_child_obj() function.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 1531745974-17187-16-git-send-email-thuth@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
5 years agohw/arm/allwinner-a10: Fix introspection problem with 'allwinner-a10'
Thomas Huth [Mon, 16 Jul 2018 12:59:31 +0000 (14:59 +0200)]
hw/arm/allwinner-a10: Fix introspection problem with 'allwinner-a10'

Valgrind complains:

echo "{'execute':'qmp_capabilities'} {'execute':'device-list-properties'," \
 "'arguments':{'typename':'allwinner-a10'}}" \
 "{'execute': 'human-monitor-command', " \
 "'arguments': {'command-line': 'info qtree'}}" | \
 valgrind -q aarch64-softmmu/qemu-system-aarch64 -M none,accel=qtest -qmp stdio
[...]
==32519== Invalid read of size 8
==32519==    at 0x61869A: qdev_print (qdev-monitor.c:686)
==32519==    by 0x61869A: qbus_print (qdev-monitor.c:719)
==32519==    by 0x452B38: handle_hmp_command (monitor.c:3446)
[...]

Use object_initialize_child() and sysbus_init_child_obj() to fix the issue.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-id: 1531745974-17187-15-git-send-email-thuth@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
5 years agohw/*/realview: Fix introspection problem with 'realview_mpcore' & 'realview_gic'
Thomas Huth [Mon, 16 Jul 2018 12:59:30 +0000 (14:59 +0200)]
hw/*/realview: Fix introspection problem with 'realview_mpcore' & 'realview_gic'

echo "{'execute':'qmp_capabilities'} {'execute':'device-list-properties'," \
 "'arguments':{'typename':'realview_mpcore'}}" \
 "{'execute': 'human-monitor-command', " \
 "'arguments': {'command-line': 'info qtree'}}" | \
 valgrind -q aarch64-softmmu/qemu-system-aarch64 -M none,accel=qtest -qmp stdio
[...]
==2654== Invalid read of size 8
==2654==    at 0x61878A: qdev_print (qdev-monitor.c:686)
==2654==    by 0x61878A: qbus_print (qdev-monitor.c:719)
==2654==    by 0x452B38: handle_hmp_command (monitor.c:3446)
==2654==    by 0x452D70: qmp_human_monitor_command (monitor.c:821)
[...]

Use sysbus_init_child_obj() to fix it.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-id: 1531745974-17187-14-git-send-email-thuth@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
5 years agohw/cpu/arm11mpcore: Fix introspection problem with 'arm11mpcore_priv'
Thomas Huth [Mon, 16 Jul 2018 12:59:29 +0000 (14:59 +0200)]
hw/cpu/arm11mpcore: Fix introspection problem with 'arm11mpcore_priv'

Valgrind reports an error here:

echo "{'execute':'qmp_capabilities'} {'execute':'device-list-properties'," \
 "'arguments':{'typename':'arm11mpcore_priv'}}" \
 "{'execute': 'human-monitor-command', " \
 "'arguments': {'command-line': 'info qtree'}}" | \
 valgrind -q aarch64-softmmu/qemu-system-aarch64 -M none,accel=qtest -qmp stdio
[...]
==3145== Invalid read of size 8
==3145==    at 0x61873A: qdev_print (qdev-monitor.c:686)
==3145==    by 0x61873A: qbus_print (qdev-monitor.c:719)
[...]

Use sysbus_init_child_obj() to fix it.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 1531745974-17187-13-git-send-email-thuth@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
5 years agohw/arm/fsl-imx31: Fix introspection problem with the "fsl, imx31" device
Thomas Huth [Mon, 16 Jul 2018 12:59:28 +0000 (14:59 +0200)]
hw/arm/fsl-imx31: Fix introspection problem with the "fsl, imx31" device

Running QEMU with valgrind indicates a problem here:

echo "{'execute':'qmp_capabilities'} {'execute':'device-list-properties'," \
 "'arguments':{'typename':'fsl,imx31'}}" \
 "{'execute': 'human-monitor-command', " \
 "'arguments': {'command-line': 'info qtree'}}" | \
 valgrind -q aarch64-softmmu/qemu-system-aarch64 -M none,accel=qtest -qmp stdio
[...]
==26172== Invalid read of size 8
==26172==    at 0x6191FA: qdev_print (qdev-monitor.c:686)
==26172==    by 0x6191FA: qbus_print (qdev-monitor.c:719)
[...]

Use the new sysbus_init_child_obj() to make sure that the objects are
cleaned up correctly when the parent gets destroyed.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-id: 1531745974-17187-12-git-send-email-thuth@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>