Peter Maydell [Tue, 14 Jul 2020 20:21:58 +0000 (21:21 +0100)]
Merge remote-tracking branch 'remotes/mdroth/tags/qga-pull-2020-07-13-tag' into staging
qemu-ga patch queue for hard-freeze
* fix erroneously reporting stale hostname in guest-get-host-name
* fix regression where guest-shutdown asserts when called
* fix race condition with guest-fs-freeze/thaw on w32
* remotes/vivier2/tags/linux-user-for-5.1-pull-request:
linux-user: fix print_syscall_err() when syscall returned value is negative
linux-user: fix the errno value in print_syscall_err()
linux-user: add netlink RTM_SETLINK command
linux-user: add new netlink types
linux-user: Fix Coverity CID 1430271 / CID 1430272
linux-user: refactor ipc syscall and support of semtimedop syscall
linux-user: Use EPROTONOSUPPORT for unimplemented netlink protocols
* remotes/kevin/tags/for-upstream:
block: Avoid stale pointer dereference in blk_get_aio_context()
qemu-img: Deprecate use of -b without -F
block: Add support to warn on backing file change without format
iotests: Specify explicit backing format where sensible
qcow2: Deprecate use of qemu-img amend to change backing file
block: Error if backing file fails during creation without -u
qcow: Tolerate backing_fmt=
vmdk: Add trivial backing_fmt support
sheepdog: Add trivial backing_fmt support
block: Finish deprecation of 'qemu-img convert -n -o'
qemu-img: Flush stdout before before potential stderr messages
file-posix: Mitigate file fragmentation with extent size hints
iotests/059: Filter out disk size with more standard filter
qemu-img map: Don't limit block status request size
iotests: Simplify _filter_img_create() a bit
Peter Maydell [Tue, 14 Jul 2020 16:58:00 +0000 (17:58 +0100)]
Merge remote-tracking branch 'remotes/alistair/tags/pull-riscv-to-apply-20200713' into staging
This is a colection of bug fixes and small imrprovements for RISC-V.
This includes some vector extensions fixes, a PMP bug fix, OpenTitan
UART bug fix and support for OpenSBI dynamic firmware.
# gpg: Signature made Tue 14 Jul 2020 01:29:44 BST
# gpg: using RSA key F6C4AC46D4934868D3B8CE8F21E10D29DF977054
# gpg: Good signature from "Alistair Francis <[email protected]>" [full]
# Primary key fingerprint: F6C4 AC46 D493 4868 D3B8 CE8F 21E1 0D29 DF97 7054
* remotes/alistair/tags/pull-riscv-to-apply-20200713:
target/riscv: Fix pmp NA4 implementation
tcg/riscv: Remove superfluous breaks
hw/char: Convert the Ibex UART to use the registerfields API
hw/char: Convert the Ibex UART to use the qdev Clock model
target/riscv: fix vill bit index in vtype register
target/riscv: fix return value of do_opivx_widen()
target/riscv: correct the gvec IR called in gen_vec_rsub16_i64()
target/riscv: fix rsub gvec tcg_assert_listed_vecop assertion
hw/riscv: Modify MROM size to end at 0x10000
RISC-V: Support 64 bit start address
riscv: Add opensbi firmware dynamic support
RISC-V: Copy the fdt in dram instead of ROM
riscv: Unify Qemu's reset vector code path
hw/riscv: virt: Sort the SoC memmap table entries
MAINTAINERS: Add an entry for OpenSBI firmware
Greg Kurz [Thu, 9 Jul 2020 13:50:45 +0000 (15:50 +0200)]
block: Avoid stale pointer dereference in blk_get_aio_context()
It is possible for blk_remove_bs() to race with blk_drain_all(), causing
the latter to dereference a stale blk->root pointer:
blk_remove_bs(blk)
bdrv_root_unref_child(blk->root)
child_bs = blk->root->bs
bdrv_detach_child(blk->root)
...
g_free(blk->root) <============== blk->root becomes stale
bdrv_unref(child_bs) <============ yield at some point
A blk_drain_all() can be triggered by some guest action in the
meantime, eg. on POWER, SLOF might disable bus mastering on
a virtio-scsi-pci device:
Then, depending on one's luck, QEMU either crashes with SEGV or
hits the assertion in blk_get_aio_context().
blk->root is set by blk_insert_bs() which calls bdrv_root_attach_child()
first. The blk_remove_bs() function should rollback the changes made
by blk_insert_bs() in the opposite order (or it should be documented
somewhere why this isn't the case). Clear blk->root before calling
bdrv_root_unref_child() in blk_remove_bs().
Eric Blake [Mon, 6 Jul 2020 20:39:54 +0000 (15:39 -0500)]
qemu-img: Deprecate use of -b without -F
Creating an image that requires format probing of the backing image is
potentially unsafe (we've had several CVEs over the years based on
probes leaking information to the guest on a subsequent boot, although
these days tools like libvirt are aware of the issue enough to prevent
the worst effects). For example, if our probing algorithm ever
changes, or if other tools like libvirt determine a different probe
result than we do, then subsequent use of that backing file under a
different format will present corrupted data to the guest.
Fortunately, the worst effects occur only when the backing image is
originally raw, and we at least prevent commit into a probed raw
backing file that would change its probed type.
Still, it is worth starting a deprecation clock so that future
qemu-img can refuse to create backing chains that would rely on
probing, to encourage clients to avoid unsafe practices. Most
warnings are intentionally emitted from bdrv_img_create() in the block
layer, but qemu-img convert uses bdrv_create() which cannot emit its
own warning without causing spurious warnings on other code paths. In
the end, all command-line image creation or backing file rewriting now
performs a check.
Furthermore, if we probe a backing file as non-raw, then it is safe to
explicitly record that result (rather than relying on future probes);
only where we probe a raw image do we care about further warnings to
the user when using such an image (for example, commits into a
probed-raw backing file are prevented), to help them improve their
tooling. But whether or not we make the probe results explicit, we
still warn the user to remind them to upgrade their workflow to supply
-F always.
iotest 114 specifically wants to create an unsafe image for later
amendment rather than defaulting to our new default of recording a
probed format, so it needs an update. While touching it, expand it to
cover all of the various warnings enabled by this patch. iotest 301
also shows a change to qcow messages.
Eric Blake [Mon, 6 Jul 2020 20:39:53 +0000 (15:39 -0500)]
block: Add support to warn on backing file change without format
For now, this is a mechanical addition; all callers pass false. But
the next patch will use it to improve 'qemu-img rebase -u' when
selecting a backing file with no format.
Eric Blake [Mon, 6 Jul 2020 20:39:52 +0000 (15:39 -0500)]
iotests: Specify explicit backing format where sensible
There are many existing qcow2 images that specify a backing file but
no format. This has been the source of CVEs in the past, but has
become more prominent of a problem now that libvirt has switched to
-blockdev. With older -drive, at least the probing was always done by
qemu (so the only risk of a changed format between successive boots of
a guest was if qemu was upgraded and probed differently). But with
newer -blockdev, libvirt must specify a format; if libvirt guesses raw
where the image was formatted, this results in data corruption visible
to the guest; conversely, if libvirt guesses qcow2 where qemu was
using raw, this can result in potential security holes, so modern
libvirt instead refuses to use images without explicit backing format.
The change in libvirt to reject images without explicit backing format
has pointed out that a number of tools have been far too reliant on
probing in the past. It's time to set a better example in our own
iotests of properly setting this parameter.
iotest calls to create, rebase, and convert are all impacted to some
degree. It's a bit annoying that we are inconsistent on command line
- while all of those accept -o backing_file=...,backing_fmt=..., the
shortcuts are different: create and rebase have -b and -F, while
convert has -B but no -F. (amend has no shortcuts, but the previous
patch just deprecated the use of amend to change backing chains).
Eric Blake [Mon, 6 Jul 2020 20:39:51 +0000 (15:39 -0500)]
qcow2: Deprecate use of qemu-img amend to change backing file
The use of 'qemu-img amend' to change qcow2 backing files is not
tested very well. In particular, our implementation has a bug where
if a new backing file is provided without a format, then the prior
format is blindly reused, even if this results in data corruption, but
this is not caught by iotests.
There are also situations where amending other options needs access to
the original backing file (for example, on a downgrade to a v2 image,
knowing whether a v3 zero cluster must be allocated or may be left
unallocated depends on knowing whether the backing file already reads
as zero), but the command line does not have a nice way to tell us
both the backing file to use for opening the image as well as the
backing file to install after the operation is complete.
Even if we do allow changing the backing file, it is redundant with
the existing ability to change backing files via 'qemu-img rebase -u'.
It is time to deprecate this support (leaving the existing behavior
intact, even if it is buggy), and at a point in the future, require
the use of only 'qemu-img rebase' for adjusting backing chain
relations, saving 'qemu-img amend' for changes unrelated to the
backing chain.
Eric Blake [Mon, 6 Jul 2020 20:39:50 +0000 (15:39 -0500)]
block: Error if backing file fails during creation without -u
Back in commit 6e6e55f5 (Jul 2017, v2.10), we tweaked the code to warn
if the backing file could not be opened but the user gave a size,
unless the user also passes the -u option to bypass the open of the
backing file. As one common reason for failure to open the backing
file is when there is mismatch in the requested backing format in
relation to what the backing file actually contains, we actually want
to open the backing file and ensure that it has the right format in as
many cases as possible. iotest 301 for qcow demonstrates how
detecting explicit format mismatch is useful to prevent the creation
of an image that would probe differently than the user requested. Now
is the time to finally turn the warning an error, as promised.
Note that the original warning was added prior to our documentation of
an official deprecation policy (eb22aeca, also Jul 2017), and because
the warning didn't mention the word "deprecated", we never actually
remembered to document it as such. But the warning has been around
long enough that I don't see prolonging it another two releases.
Eric Blake [Mon, 6 Jul 2020 20:39:49 +0000 (15:39 -0500)]
qcow: Tolerate backing_fmt=
qcow has no space in the metadata to store a backing format, and there
are existing qcow images backed both by raw or by other formats
(usually qcow) images, reliant on probing to tell the difference. On
the bright side, because we probe every time, raw files are marked as
probed and we thus forbid a commit action into the backing file where
guest-controlled contents could change the result of the probe next
time around (the iotest added here proves that).
Still, allowing the user to specify the backing format during
creation, even if we can't record it, is a good thing. This patch
blindly allows any value that resolves to a known driver, even if the
user's request is a mismatch from what probing finds; then the next
patch will further enhance things to verify that the user's request
matches what we actually probe. With this and the next patch in
place, we will finally be ready to deprecate the creation of images
where a backing format was not explicitly specified by the user.
Note that this is only for QemuOpts usage; there is no change to the
QAPI to allow a format through -blockdev.
Add a new iotest 301 just for qcow, to demonstrate the latest
behavior, and to make it easier to show the improvements made in the
next patch.
Eric Blake [Mon, 6 Jul 2020 20:39:48 +0000 (15:39 -0500)]
vmdk: Add trivial backing_fmt support
vmdk already requires that if backing_file is present, that it be
another vmdk image (see vmdk_co_do_create). Meanwhile, we want to
move towards always being explicit about the backing format for other
drivers where it matters. So for convenience, make qemu-img create -F
vmdk work, while rejecting all other explicit formats (note that this
is only for QemuOpts usage; there is no change to the QAPI to allow a
format through -blockdev).
Eric Blake [Mon, 6 Jul 2020 20:39:47 +0000 (15:39 -0500)]
sheepdog: Add trivial backing_fmt support
Sheepdog already requires that if backing_file is present, that it be
another sheepdog image (see sd_co_create). Meanwhile, we want to move
towards always being explicit about the backing format for other
drivers where it matters. So for convenience, make qemu-img create -F
sheepdog work, while rejecting all other explicit formats (note that
this is only for QemuOpts usage; there is no change to the QAPI to
allow a format through -blockdev).
Eric Blake [Mon, 6 Jul 2020 20:39:45 +0000 (15:39 -0500)]
qemu-img: Flush stdout before before potential stderr messages
During 'qemu-img create ... 2>&1', if --quiet is not in force, we can
end up with buffered I/O in stdout that was produced before failure,
but which appears in output after failure. This is confusing; the fix
is to flush stdout prior to attempting anything that might produce an
error message. Several iotests demonstrate the resulting ordering
change now that the merged outputs now reflect chronology. (An even
better fix would be to avoid printf from within block.c altogether,
but that's much more invasive...)
Kevin Wolf [Tue, 7 Jul 2020 14:23:29 +0000 (16:23 +0200)]
file-posix: Mitigate file fragmentation with extent size hints
Especially when O_DIRECT is used with image files so that the page cache
indirection can't cause a merge of allocating requests, the file will
fragment on the file system layer, with a potentially very small
fragment size (this depends on the requests the guest sent).
On Linux, fragmentation can be reduced by setting an extent size hint
when creating the file (at least on XFS, it can't be set any more after
the first extent has been allocated), basically giving raw files a
"cluster size" for allocation.
This adds a create option to set the extent size hint, and changes the
default from not setting a hint to setting it to 1 MB. The main reason
why qcow2 defaults to smaller cluster sizes is that COW becomes more
expensive, which is not an issue with raw files, so we can choose a
larger size. The tradeoff here is only potentially wasted disk space.
For qcow2 (or other image formats) over file-posix, the advantage should
even be greater because they grow sequentially without leaving holes, so
there won't be wasted space. Setting even larger extent size hints for
such images may make sense. This can be done with the new option, but
let's keep the default conservative for now.
The effect is very visible with a test that intentionally creates a
badly fragmented file with qemu-img bench (the time difference while
creating the file is already remarkable) and then looks at the number of
extents and the time a simple "qemu-img map" takes.
Without an extent size hint:
$ ./qemu-img create -f raw -o extent_size_hint=0 ~/tmp/test.raw 10G
Formatting '/home/kwolf/tmp/test.raw', fmt=raw size=10737418240 extent_size_hint=0
$ ./qemu-img bench -f raw -t none -n -w ~/tmp/test.raw -c 1000000 -S 8192 -o 0
Sending 1000000 write requests, 4096 bytes each, 64 in parallel (starting at offset 0, step size 8192)
Run completed in 25.848 seconds.
$ ./qemu-img bench -f raw -t none -n -w ~/tmp/test.raw -c 1000000 -S 8192 -o 4096
Sending 1000000 write requests, 4096 bytes each, 64 in parallel (starting at offset 4096, step size 8192)
Run completed in 19.616 seconds.
$ filefrag ~/tmp/test.raw
/home/kwolf/tmp/test.raw: 2000000 extents found
$ time ./qemu-img map ~/tmp/test.raw
Offset Length Mapped to File
0 0x1e8480000 0 /home/kwolf/tmp/test.raw
real 0m1,279s
user 0m0,043s
sys 0m1,226s
With the new default extent size hint of 1 MB:
$ ./qemu-img create -f raw -o extent_size_hint=1M ~/tmp/test.raw 10G
Formatting '/home/kwolf/tmp/test.raw', fmt=raw size=10737418240 extent_size_hint=1048576
$ ./qemu-img bench -f raw -t none -n -w ~/tmp/test.raw -c 1000000 -S 8192 -o 0
Sending 1000000 write requests, 4096 bytes each, 64 in parallel (starting at offset 0, step size 8192)
Run completed in 11.833 seconds.
$ ./qemu-img bench -f raw -t none -n -w ~/tmp/test.raw -c 1000000 -S 8192 -o 4096
Sending 1000000 write requests, 4096 bytes each, 64 in parallel (starting at offset 4096, step size 8192)
Run completed in 10.155 seconds.
$ filefrag ~/tmp/test.raw
/home/kwolf/tmp/test.raw: 178 extents found
$ time ./qemu-img map ~/tmp/test.raw
Offset Length Mapped to File
0 0x1e8480000 0 /home/kwolf/tmp/test.raw
Kevin Wolf [Mon, 13 Jul 2020 13:45:37 +0000 (15:45 +0200)]
iotests/059: Filter out disk size with more standard filter
The actual disk space used by an image can vary between filesystems and
depending on other settings like an extent size hint. Replace the one
call of "$QEMU_IMG info" and the associated one-off sed filter with the
more standard "_img_info" and the standard filter from common.filter.
Apart from turning "vmdk" into "IMGFMT" and changing the placeholder for
cid fields, this only removes the "disk size" line.
Kevin Wolf [Tue, 7 Jul 2020 14:46:29 +0000 (16:46 +0200)]
qemu-img map: Don't limit block status request size
Limiting each loop iteration of qemu-img map to 1 GB was arbitrary from
the beginning, though it only cut the maximum in half then because the
interface was a signed 32 bit byte count. These days, bdrv_block_status
supports a 64 bit byte count, so the arbitrary limit is even worse.
On file-posix, bdrv_block_status() eventually maps to SEEK_HOLE and
SEEK_DATA, which don't support a limit, but always do all of the work
necessary to find the start of the next hole/data. Much of this work may
be repeated if we don't use this information fully, but query with an
only slightly larger offset in the next loop iteration. Therefore, if
bdrv_block_status() is called in a loop, it should always pass the
full number of bytes that the whole loop is interested in.
This removes the arbitrary limit and speeds up 'qemu-img map'
significantly on heavily fragmented images.
Max Reitz [Thu, 9 Jul 2020 11:02:05 +0000 (13:02 +0200)]
iotests: Simplify _filter_img_create() a bit
Not only is it a bit stupid to try to filter multi-line "Formatting"
output (because we only need it for a single test, which can easily be
amended to no longer need it), it is also problematic when there can be
output after a "Formatting" line that we do not want to filter as if it
were part of it.
So rename _filter_img_create to _do_filter_img_create, let it filter
only a single line, and let _filter_img_create loop over all input
lines, calling _do_filter_img_create only on those that match
/^Formatting/ (basically, what _filter_img_create_in_qmp did already).
(And fix 020 to work with that.)
* remotes/ericb/tags/pull-nbd-2020-07-13:
iotests.py: filter_testfiles(): filter SOCK_DIR too
iotests.py: QemuIoInteractive: print output on failure
iotests: QemuIoInteractive: use qemu_io_args_no_fmt
hax: Fix setting of FD_CLOEXEC
nbd: Avoid off-by-one in long export name truncation
linux-user: fix the errno value in print_syscall_err()
errno of the target is returned as a negative value by the syscall,
not in the host errno variable.
The emulation of the target syscall can return an error while the
host doesn't set an errno value. Target errnos and host errnos can
also differ in some cases.
Bin Meng [Thu, 9 Jul 2020 10:05:43 +0000 (03:05 -0700)]
hw/riscv: Modify MROM size to end at 0x10000
At present the size of Mask ROM for sifive_u / spike / virt machines
is set to 0x11000, which ends at an unusual address. This changes the
size to 0xf000 so that it ends at 0x10000.
OpenSBI is the default firmware in Qemu and has various firmware loading
options. Currently, qemu loader uses fw_jump which has a compile time
pre-defined address where fdt & kernel image must reside. This puts a
constraint on image size of the Linux kernel depending on the fdt location
and available memory. However, fw_dynamic allows the loader to specify
the next stage location (i.e. Linux kernel/U-Boot) in memory and other
configurable boot options available in OpenSBI.
Add support for OpenSBI dynamic firmware loading support. This doesn't
break existing setup and fw_jump will continue to work as it is. Any
other firmware will continue to work without any issues as long as it
doesn't expect anything specific from loader in "a2" register.
Currently, the fdt is copied to the ROM after the reset vector. The firmware
has to copy it to DRAM. Instead of this, directly copy the device tree to a
pre-computed dram address. The device tree load address should be as far as
possible from kernel and initrd images. That's why it is kept at the end of
the DRAM or 4GB whichever is lesser.
Currently, all riscv machines except sifive_u have identical reset vector
code implementations with memory addresses being different for all machines.
They can be easily combined into a single function in common code.
Move it to common function and let all the machines use the common function.
Michal Privoznik [Mon, 22 Jun 2020 18:19:36 +0000 (20:19 +0200)]
qga: Use qemu_get_host_name() instead of g_get_host_name()
Problem with g_get_host_name() is that on the first call it saves
the hostname into a global variable and from then on, every
subsequent call returns the saved hostname. Even if the hostname
changes. This doesn't play nicely with guest agent, because if
the hostname is acquired before the guest is set up (e.g. on the
first boot, or before DHCP) we will report old, invalid hostname.
Since commit 781f2b3d1e ("qga: process_event() simplification"),
send_response() is called unconditionally, but will assert when "rsp" is
NULL. This may happen with QCO_NO_SUCCESS_RESP commands, such as
"guest-shutdown".
qga-win: Fix QGA VSS Provider service stop failure
On one hand "guest-fsfreeze-freeze" command, "COM+ System Application service" is
stopped, on the other hand "guest-fsfreeze-thaw" stops QGA VSS Provider service from
"COM+ Application Admin Catalog".
Invoking a series of freeze and thaw commands may result in QGA failing to stop
VSS Provider service as "COM+ System Application service" is stopped, which can
cause some delay in qga response.
In this commit StopService function was changed and VSS Provider service is now
stopped using Winsvc library API.
This command is needed to be able to boot systemd in a container.
$ sudo systemd-nspawn -D /chroot/armhf/sid/ -b
Spawning container sid on /chroot/armhf/sid.
Press ^] three times within 1s to kill container.
systemd 245.6-2 running in system mode.
Detected virtualization systemd-nspawn.
Detected architecture arm.
Welcome to Debian GNU/Linux bullseye/sid!
Set hostname to <virt-arm>.
Failed to enqueue loopback interface start request: Operation not supported
Caught <SEGV>, dumped core as pid 3.
Exiting PID 1...
Container sid failed with error code 255.
Only implement IFLA_PERM_ADDRESS to fix the following error:
Unknown host QEMU_IFLA type: 54
The couple of other ones, IFLA_PROP_LIST and IFLA_ALT_IFNAME, have
been introduced to be used with RTM_NEWLINKPROP, RTM_DELLINKPROP and
RTM_GETLINKPROP that are not implemented by QEMU.
In new functions print_ioctl() and print_syscall_ret_ioctl(), we don't
check if lock_user() returns NULL and this would cause a segfault in
thunk_print().
If lock_user() returns NULL don't call thunk_print() but prints only the
value of the (invalid) pointer.
Matus Kysel [Fri, 26 Jun 2020 12:46:11 +0000 (14:46 +0200)]
linux-user: refactor ipc syscall and support of semtimedop syscall
Refactoring ipc syscall for s390x and SPARC, so it matches glibc implementation
We should add support of semtimedop syscall as new version of glibc
2.31 uses semop based on semtimedop
(commit: https://gitlab.com/freedesktop-sdk/mirrors/sourceware/glibc/-/commit/765cdd0bffd77960ae852104fc4ea5edcdb8aed3 ).
linux-user: Use EPROTONOSUPPORT for unimplemented netlink protocols
Linux uses the EPROTONOSUPPORT error code[1] if the users requests a
netlink socket with an unsupported netlink protocol. This change
switches linux-user to use the same code as Linux, instead of
EPFNOSUPPORT (which AFAIK is just an anachronistic version of
EAFNOSUPPORT).
Tested by compiling all linux-user targets on x86.
migration/savevm: respect qemu_fclose() error code in save_snapshot()
qemu_fclose() could return error, f.e. if bdrv_co_flush() will return
the error.
This validation will become more important once we will start waiting of
asynchronous IO operations, started from bdrv_write_vmstate(), which are
coming soon.
migration: fix memory leak in qmp_migrate_set_parameters
"tmp.tls_hostname" and "tmp.tls_creds" allocated by migrate_params_test_apply()
is forgot to free at the end of qmp_migrate_set_parameters(). Fix that.
The leak stack:
Direct leak of 2 byte(s) in 2 object(s) allocated from:
#0 0xffffb597c20b in __interceptor_malloc (/usr/lib64/libasan.so.4+0xd320b)
#1 0xffffb52dcb1b in g_malloc (/usr/lib64/libglib-2.0.so.0+0x58b1b)
#2 0xffffb52f8143 in g_strdup (/usr/lib64/libglib-2.0.so.0+0x74143)
#3 0xaaaac52447fb in migrate_params_test_apply (/usr/src/debug/qemu-4.1.0/migration/migration.c:1377)
#4 0xaaaac52fdca7 in qmp_migrate_set_parameters (/usr/src/debug/qemu-4.1.0/qapi/qapi-commands-migration.c:192)
#5 0xaaaac551d543 in qmp_dispatch (/usr/src/debug/qemu-4.1.0/qapi/qmp-dispatch.c:165)
#6 0xaaaac52a0a8f in qmp_dispatch (/usr/src/debug/qemu-4.1.0/monitor/qmp.c:125)
#7 0xaaaac52a1c7f in monitor_qmp_dispatch (/usr/src/debug/qemu-4.1.0/monitor/qmp.c:214)
#8 0xaaaac55cb0cf in aio_bh_call (/usr/src/debug/qemu-4.1.0/util/async.c:117)
#9 0xaaaac55d4543 in aio_bh_poll (/usr/src/debug/qemu-4.1.0/util/aio-posix.c:459)
#10 0xaaaac55cae0f in aio_dispatch (/usr/src/debug/qemu-4.1.0/util/async.c:268)
#11 0xffffb52d6a7b in g_main_context_dispatch (/usr/lib64/libglib-2.0.so.0+0x52a7b)
#12 0xaaaac55d1e3b(/usr/bin/qemu-kvm-4.1.0+0x1622e3b)
#13 0xaaaac4e314bb(/usr/bin/qemu-kvm-4.1.0+0xe824bb)
#14 0xaaaac47f45ef(/usr/bin/qemu-kvm-4.1.0+0x8455ef)
#15 0xffffb4bfef3f in __libc_start_main (/usr/lib64/libc.so.6+0x23f3f)
#16 0xaaaac47ffacb(/usr/bin/qemu-kvm-4.1.0+0x850acb)
Direct leak of 2 byte(s) in 2 object(s) allocated from:
#0 0xffffb597c20b in __interceptor_malloc (/usr/lib64/libasan.so.4+0xd320b)
#1 0xffffb52dcb1b in g_malloc (/usr/lib64/libglib-2.0.so.0+0x58b1b)
#2 0xffffb52f8143 in g_strdup (/usr/lib64/libglib-2.0.so.0+0x74143)
#3 0xaaaac5244893 in migrate_params_test_apply (/usr/src/debug/qemu-4.1.0/migration/migration.c:1382)
#4 0xaaaac52fdca7 in qmp_migrate_set_parameters (/usr/src/debug/qemu-4.1.0/qapi/qapi-commands-migration.c:192)
#5 0xaaaac551d543 in qmp_dispatch (/usr/src/debug/qemu-4.1.0/qapi/qmp-dispatch.c)
#6 0xaaaac52a0a8f in qmp_dispatch (/usr/src/debug/qemu-4.1.0/monitor/qmp.c:125)
#7 0xaaaac52a1c7f in monitor_qmp_dispatch (/usr/src/debug/qemu-4.1.0/monitor/qmp.c:214)
#8 0xaaaac55cb0cf in aio_bh_call (/usr/src/debug/qemu-4.1.0/util/async.c:117)
#9 0xaaaac55d4543 in aio_bh_poll (/usr/src/debug/qemu-4.1.0/util/aio-posix.c:459)
#10 0xaaaac55cae0f in in aio_dispatch (/usr/src/debug/qemu-4.1.0/util/async.c:268)
#11 0xffffb52d6a7b in g_main_context_dispatch (/usr/lib64/libglib-2.0.so.0+0x52a7b)
#12 0xaaaac55d1e3b(/usr/bin/qemu-kvm-4.1.0+0x1622e3b)
#13 0xaaaac4e314bb(/usr/bin/qemu-kvm-4.1.0+0xe824bb)
#14 0xaaaac47f45ef (/usr/bin/qemu-kvm-4.1.0+0x8455ef)
#15 0xffffb4bfef3f in __libc_start_main (/usr/lib64/libc.so.6+0x23f3f)
#16 0xaaaac47ffacb(/usr/bin/qemu-kvm-4.1.0+0x850acb)
* remotes/kraxel/tags/fixes-20200713-pull-request:
usb: fix usb-host build on windows.
ui: fix vc_chr_write call in text_console_do_init
docs/qdev-device-use: Clean up the sentences related to -usbdevice
ossaudio: fix out of bounds write
Peter Maydell [Mon, 13 Jul 2020 14:14:48 +0000 (15:14 +0100)]
Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20200713' into staging
target-arm queue:
* hw/arm/bcm2836: Remove unused 'cpu_type' field
* target/arm: Fix mtedesc for do_mem_zpz
* Add the ability to change the FEC PHY MDIO device number on i.MX25/i.MX6/i.MX7
* target/arm: Don't do raw writes for PMINTENCLR
* virtio-iommu: Fix coverity issue in virtio_iommu_handle_command()
* build: Fix various issues with building on Haiku
* target/nios2: fix wrctl behaviour when using icount
* hw/arm/tosa: Encapsulate misc GPIO handling in a device
* hw/arm/palm.c: Encapsulate misc GPIO handling in a device
* hw/arm/aspeed: Do not create and attach empty SD cards by default
* remotes/pmaydell/tags/pull-target-arm-20200713: (25 commits)
hw/arm/aspeed: Do not create and attach empty SD cards by default
hw/arm/palm.c: Encapsulate misc GPIO handling in a device
hw/arm/palm.c: Detabify
hw/arm/tosa: Encapsulate misc GPIO handling in a device
hw/arm/tosa.c: Detabify
hw/nios2: exit to main CPU loop only when unmasking interrupts
target/nios2: Use gen_io_start around wrctl instruction
target/nios2: in line the semantics of DISAS_UPDATE with other targets
target/nios2: add DISAS_NORETURN case for nothing more to generate
util/drm: make portable by avoiding struct dirent d_type
util/oslib-posix.c: Implement qemu_init_exec_dir() for Haiku
util/compatfd.c: Only include <sys/syscall.h> if CONFIG_SIGNALFD
bswap.h: Include <endian.h> on Haiku for bswap operations
osdep.h: For Haiku, define SIGIO as equivalent to SIGPOLL
osdep.h: Always include <sys/signal.h> if it exists
build: Check that mlockall() exists
util/qemu-openpty.c: Don't assume pty.h is glibc-only
build: Enable BSD symbols for Haiku
virtio-iommu: Fix coverity issue in virtio_iommu_handle_command()
target/arm: Don't do raw writes for PMINTENCLR
...
iotests: QemuIoInteractive: use qemu_io_args_no_fmt
The only user (iotest 205) of QemuIoInteractive provides -f argument,
so it's a bit inefficient to use qemu_io_args, which contains -f too.
And we are going to add one more test, which wants to specify -f by
hand. Let's use qemu_io_args_no_fmt.
Eric Blake [Mon, 20 Apr 2020 17:53:07 +0000 (12:53 -0500)]
hax: Fix setting of FD_CLOEXEC
Blindly setting FD_CLOEXEC without a read-modify-write will
inadvertently clear any other intentionally-set bits, such as a
proposed new bit for designating a fd that must behave in 32-bit mode.
Use our wrapper function instead of an incorrect hand-rolled version.
Eric Blake [Mon, 22 Jun 2020 21:03:55 +0000 (16:03 -0500)]
nbd: Avoid off-by-one in long export name truncation
When snprintf returns the same value as the buffer size, the final
byte was truncated to ensure a NUL terminator. Fortunately, such long
export names are unusual enough, with no real impact other than what
is displayed to the user.
hw/arm/aspeed: Do not create and attach empty SD cards by default
Since added in commit 2bea128c3d, each SDHCI is wired with a SD
card, using empty card when no block drive provided. This is not
the desired behavior. The SDHCI exposes a SD bus to plug cards
on, if no card available, it is fine to have an unplugged bus.
Avoid creating unnecessary SD card device when no block drive
provided.
Peter Maydell [Mon, 13 Jul 2020 13:36:11 +0000 (14:36 +0100)]
hw/arm/tosa: Encapsulate misc GPIO handling in a device
Currently we have a free-floating set of IRQs and a function
tosa_out_switch() which handle the GPIO lines on the tosa board which
connect to LEDs, and another free-floating IRQ and tosa_reset()
function to handle the GPIO line that resets the system. Encapsulate
this behaviour in a simple QOM device.
This commit fixes Coverity issue CID 1421929 (which pointed out that
the 'outsignals' in tosa_gpio_setup() were leaked), because it
removes the use of the qemu_allocate_irqs() API from this code
entirely.
Peter Maydell [Mon, 13 Jul 2020 13:36:11 +0000 (14:36 +0100)]
hw/arm/tosa.c: Detabify
Remove the hardcoded tabs from hw/arm/tosa.c. There aren't
many, but since they're all in constant #defines they're not
going to go away with our usual "only when we touch a function"
policy on reformatting.
hw/nios2: exit to main CPU loop only when unmasking interrupts
Only when guest code is unmasking interrupts, terminate the excution
of translated code and exit to the main CPU loop to handle previous
pended interrupts because of the interrupts mask by guest code.
target/nios2: Use gen_io_start around wrctl instruction
wrctl instruction on nios2 target will cause checking cpu
interrupt but tcg_handle_interrupt() will call cpu_abort()
if the CPU gets an interrupt while it's not in 'can do IO'
state, so add gen_io_start around wrctl instruction. Also
at the same time, end the onging TB with DISAS_UPDATE.
target/nios2: in line the semantics of DISAS_UPDATE with other targets
In line the semantics of DISAS_UPDATE on nios2 target with other targets
which is to explicitly write the PC back into the cpu state before doing
a tcg_gen_exit_tb().
target/nios2: add DISAS_NORETURN case for nothing more to generate
Add DISAS_NORETURN case for nothing more to generate because at runtime
execution will never return from some helper call. And at the same time
replace DISAS_UPDATE in t_gen_helper_raise_exception and gen_exception
with the newly added DISAS_NORETURN.
David CARLIER [Mon, 13 Jul 2020 13:36:10 +0000 (14:36 +0100)]
util/compatfd.c: Only include <sys/syscall.h> if CONFIG_SIGNALFD
util/compatfd.c includes <sys/syscall.h> so that the CONFIG_SIGNALFD
code can use SYS_signalfd. Guard the #include with CONFIG_SIGNALFD
to avoid portability issues on hosts like Haiku which do not
provide that header file.
David CARLIER [Mon, 13 Jul 2020 13:36:09 +0000 (14:36 +0100)]
osdep.h: Always include <sys/signal.h> if it exists
Regularize our handling of <sys/signal.h>: currently we include it in
osdep.h, but only for OpenBSD, and we include it without an ifdef
guard in a couple of C files. This causes problems for Haiku, which
doesn't have that header.
Instead, check in configure whether sys/signal.h exists, and if it
does then always include it from osdep.h.
David CARLIER [Mon, 13 Jul 2020 13:36:09 +0000 (14:36 +0100)]
build: Check that mlockall() exists
Instead of assuming that all POSIX platforms provide mlockall(),
test for it in configure. If the host doesn't provide this platform
then os_mlock() will fail -ENOSYS, as it does already on Windows.
This is necessary for Haiku, which does not have mlockall().
David CARLIER [Mon, 13 Jul 2020 13:36:09 +0000 (14:36 +0100)]
util/qemu-openpty.c: Don't assume pty.h is glibc-only
Instead of using an OS-specific ifdef test to select the "openpty()
is in pty.h" codepath, make configure check for the existence of
the header and use the new CONFIG_PTY instead.
This is necessary to build on Haiku, which also provides openpty()
via pty.h.
Eric Auger [Mon, 13 Jul 2020 13:36:08 +0000 (14:36 +0100)]
virtio-iommu: Fix coverity issue in virtio_iommu_handle_command()
Coverity points out (CID 1430180) that the new case is missing
break or a /* fallthrough */ comment. Break is the right thing to
do as in that case, tail is not used.
Raw writes to this register when in KVM mode can cause interrupts to be
raised (even when the PMU is disabled). Because the underlying state is
already aliased to PMINTENSET (which already provides raw write
functions), we can safely disable raw accesses to PMINTENCLR entirely.
In case the string doesn't fit into the buffer snprintf returns the size
it would need, so len can be larger than the buffer. Fix this by simply
using g_strdup_printf() instead of a static buffer.
Thomas Huth [Thu, 9 Jul 2020 16:00:39 +0000 (18:00 +0200)]
docs/system/s390x: Improve the 3270 documentation
There is some additional information about the 3270 support in our Wiki
at https://wiki.qemu.org/Features/3270 - so let's include this information
into the main documentation now to have one single source of information
(the Wiki page could later be removed).
While at it, I also shortened the lines of the first example a little bit.
Otherwise they showed up with a horizontal scrollbar in my Firefox browser.
This script is intended to be used right after a push to a branch.
By default, it will look for the pipeline associated with the commit
that is the HEAD of the *local* staging branch. It can be used as a
one time check, or with the `--wait` option to wait until the pipeline
completes.
If the pipeline is successful, then a merge of the staging branch into
the master branch should be the next step.
Thomas Huth [Tue, 30 Jun 2020 05:03:44 +0000 (07:03 +0200)]
disas/sh4: Add missing fallthrough annotations
Add fallthrough annotations to be able to compile the code without
warnings with -Wimplicit-fallthrough. Looking at the code, it seems
like the fallthrough is indeed intended here, so the comments should
be appropriate.
Thomas Huth [Wed, 8 Jul 2020 18:19:44 +0000 (20:19 +0200)]
Remove the CONFIG_PRAGMA_DIAGNOSTIC_AVAILABLE switch
GCC supports "#pragma GCC diagnostic" since version 4.6, and
Clang seems to support it, too, since its early versions 3.x.
That means that our minimum required compiler versions all support
this pragma already and we can remove the test from configure and
all the related #ifdefs in the code.
Thomas Huth [Thu, 9 Jul 2020 08:40:59 +0000 (10:40 +0200)]
docs/devel/fuzzing: Fix bugs in documentation
Fix typo - the option is called "--fuzz-target" and not "--fuzz_taget".
Also use a different fuzzer in the example, since "virtio-net-fork-fuzz"
does not seem to be a valid fuzzer target (anymore?).
In 45222b9a90, I fixed a broken check for rcu_enable_atfork introduced
in d6919e4cb6. I added a call to rcu_enable_atfork after the
call to qemu_init in fuzz.c, but forgot to include the corresponding
header, breaking --enable-fuzzing --enable-werror builds.
configure: do not clobber CFLAGS with --enable-fuzzing
When configuring with --enable-fuzzing, we overwrote the CFLAGS
added by all the preceding checks. Instead of overwriting CFLAGS, append
the ones we need.
In function oss_read() a read error currently does not exit the
read loop. With no data to read the variable pos will quickly
underflow and a subsequent successful read overwrites memory
outside the buffer. This patch adds the missing break statement
to the error path of the function.
To reproduce start qemu with -audiodev oss,id=audio0 and in the
guest start audio recording. After some time this will trigger
an exception.
* remotes/elmarco/tags/chardev-pull-request:
chardev: Extract system emulation specific code
chardev: Reduce "char-mux.h" scope, rename it "chardev-internal.h"
chardev: Restrict msmouse / wctablet / testdev to system emulation
tests/test-char: Remove unused "chardev/char-mux.h" include
monitor/misc: Remove unused "chardev/char-mux.h" include
char: fix use-after-free with dup chardev & reconnect
chardev: don't abort on attempt to add duplicated chardev
char-socket: initialize reconnect timer only when the timer doesn't start
projects / qemu.git / log