Michael Roth [Thu, 18 Sep 2014 20:36:42 +0000 (15:36 -0500)]
tests: add QMP input visitor test for unions with no discriminator
This is more of an exercise of the dealloc visitor, where it may
erroneously use an uninitialized discriminator field as indication
that union fields corresponding to that discriminator field/type are
present, which can lead to attempts to free random chunks of heap
memory.
Michael Roth [Thu, 18 Sep 2014 20:36:40 +0000 (15:36 -0500)]
qapi: add visit_start_union and visit_end_union
In some cases an input visitor might bail out on filling out a
struct for various reasons, such as missing fields when running
in strict mode. In the case of a QAPI Union type, this may lead
to cases where the .kind field which encodes the union type
is uninitialized. Subsequently, other visitors, such as the
dealloc visitor, may use this .kind value as if it were
initialized, leading to assumptions about the union type which
in this case may lead to segfaults. For example, freeing an
integer value.
However, we can generally rely on the fact that the always-present
.data void * field that we generate for these union types will
always be NULL in cases where .kind is uninitialized (at least,
there shouldn't be a reason where we'd do this purposefully).
So pass this information on to Visitor implementation via these
optional start_union/end_union interfaces so this information
can be used to guard against the situation above. We will make
use of this information in a subsequent patch for the dealloc
visitor.
virtio-balloon: fix integer overflow in memory stats feature
When a QMP client changes the polling interval time by setting
the guest-stats-polling-interval property, the interval value
is stored and manipulated as an int64_t variable.
However, the balloon_stats_change_timer() function, which is
used to set the actual timer with the interval value, takes
an int instead, causing an overflow for big interval values.
This commit fix this bug by changing balloon_stats_change_timer()
to take an int64_t and also it limits the polling interval value
to UINT_MAX to avoid other kinds of overflow.
Commit cdaa86a54 ("Add G_IO_HUP handler for socket chardev") exposed a bug in
the way the HMP monitor handles its command buffer. When a client closes the
connection to the monitor, tcp_chr_read() will detect the G_IO_HUP condition
and call tcp_chr_disconnect() to close the server-side connection too. Due to
the fact that monitor reads 1 byte at a time (for each tcp_chr_read()), the
monitor readline state / buffers might contain junk (i.e. a half-finished
command). Thus, without calling readline_restart() on mon->rs in
CHR_EVENT_OPEN, future HMP commands will fail.
Peter Maydell [Fri, 26 Sep 2014 14:41:50 +0000 (15:41 +0100)]
Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into staging
Usual mix of patches, the most important being Alex and Marcelo's
kvmclock fix. This was reverted last minute for 2.1, but it is now back
with the problematic case fixed.
Note: I will soon switch to a subkey for signing purposes. To verify
future signed pull requests from me, please update my key with
"gpg --recv-keys 9B4D86F2". You should see 3 new subkeys---the
one for signing will be a 2048-bit RSA key, 4E6B09D7.
# gpg: Signature made Fri 26 Sep 2014 15:34:44 BST using RSA key ID 9B4D86F2
# gpg: Good signature from "Paolo Bonzini <[email protected]>"
# gpg: aka "Paolo Bonzini <[email protected]>"
* remotes/bonzini/tags/for-upstream:
kvm/valgrind: don't mark memory as initialized
po: fix conflict with %.mo rule in rules.mak
kvmvapic: fix migration when VM paused and when not running Windows
serial: check if backed by a physical serial port at realize time
serial: reset state at startup
target-i386: update fp status fix
hw/dma/i8257: Silence phony error message
kvmclock: Ensure time in migration never goes backward
kvmclock: Ensure proper env->tsc value for kvmclock_current_nsec calculation
Introduce cpu_clean_all_dirty
pit: fix pit interrupt can't inject into vm after migration
since commit 7dda5dc82a77 ("migration: initialize RAM to zero") the
guest memory is defined zero. No need to call valgrind on guest memory.
This reverts commit 62fe83318d2f ("qemu: Use valgrind annotations to
mark kvm guest memory as defined") thus speeding up kvm start if
<includedir>/valgrind/valgrind.h is available.
Paolo Bonzini [Mon, 22 Sep 2014 14:19:05 +0000 (16:19 +0200)]
po: fix conflict with %.mo rule in rules.mak
po/Makefile includes rules.mak to use the nice quiet-command macro.
However, this also brings in a %.mo rule that breaks "make build".
Put our own rule before the include, so that it has precedence.
Pavel Dovgalyuk [Mon, 22 Sep 2014 12:14:24 +0000 (16:14 +0400)]
kvmvapic: fix migration when VM paused and when not running Windows
This patch fixes migration by extending do_vapic_enable function. This function
called vapic_enable which read cpu number from the guest memory. When cpu
number could not be read, vapic was not enabled while loading the VM state.
This patch adds required code for cpu_number=0 to do_vapic_enable function,
because it is called only when cpu_number=0.
Peter Maydell [Fri, 26 Sep 2014 11:26:07 +0000 (12:26 +0100)]
Merge remote-tracking branch 'remotes/stefanha/tags/tracing-pull-request' into staging
# gpg: Signature made Fri 26 Sep 2014 11:59:34 BST using RSA key ID 81AB73C8
# gpg: Good signature from "Stefan Hajnoczi <[email protected]>"
# gpg: aka "Stefan Hajnoczi <[email protected]>"
* remotes/stefanha/tags/tracing-pull-request:
ohci: drop computed flags from trace events
ohci: Split long traces to smaller ones
scripts/tracetool: don't barf on formats with precision
trace: install trace-events file
trace-events: Fix comments pointing to source files
trace-events: Drop orphaned monitor trace event
trace-events: Drop unused megasas trace event
cleanup-trace-events.pl: Tighten search for trace event call
trace: tighten up trace-events regex to fix bad parse
trace-events: drop orphan iscsi trace events
trace-events: drop orphan usb_mtp_data_out
trace-events: drop orphan virtio_blk_data_plane_complete_request
trace: [hmp] Reimplement "trace-event" and "info trace-events" using QMP
trace: [qmp] Add commands to query and control event tracing state
trace: docs: add trace file description
trace: [ust] Fix format string computation in tcg-enabled events
Peter Maydell [Thu, 25 Sep 2014 15:51:09 +0000 (16:51 +0100)]
main-loop.c: Handle SIGINT, SIGHUP and SIGTERM synchronously
Add the termination signals SIGINT, SIGHUP and SIGTERM to the
list of signals which we handle synchronously via a signalfd.
This avoids a race condition where if we took the SIGTERM
in the middle of qemu_shutdown_requested:
int r = shutdown_requested;
[SIGTERM here...]
shutdown_requested = 0;
then the setting of the shutdown_requested flag by
termsig_handler() would be lost and QEMU would fail to
shut down. This was causing 'make check' to hang occasionally.
Alex Bennée [Thu, 25 Sep 2014 09:38:44 +0000 (10:38 +0100)]
ohci: drop computed flags from trace events
This exceeded the trace argument limit for LTTNG UST and wasn't really
needed as the flags value is stored anyway. Dropping this fixes the
compile failure for UST. It can probably be merged with the previous
trace shortening patch.
Recent traces rework introduced 2 tracepoints with 13 and 20
arguments. When dtrace backend is selected
(--enable-trace-backend=dtrace), compile fails as
sys/sdt.h defines DTRACE_PROBE up to DTRACE_PROBE12 only.
Stefan Hajnoczi [Tue, 23 Sep 2014 15:29:35 +0000 (16:29 +0100)]
trace: install trace-events file
Install the ./trace-events file into the data directory. This file
contains the list of trace events that were built into QEMU at
compile-time.
The file is a handy reference for the set of trace events that the QEMU
binary was built with. It is also needed by the simpletrace.py tool
that parses binary trace data either emitted from QEMU when built with
--enable-trace-backend=simple or by the SystemTap simpletrace script
that QEMU provides.
cleanup-trace-events.pl: Tighten search for trace event call
The script can get fooled too easily. For instance, it finds
trace_megasas_io_read_start when looking for trace_megasas_io_read,
and incorrectly concludes that event megasas_io_read is used.
Stefan Hajnoczi [Tue, 23 Sep 2014 10:37:06 +0000 (11:37 +0100)]
trace: tighten up trace-events regex to fix bad parse
Use \w for properties and trace event names since they are both drawn
from [a-zA-Z0-9_] character sets.
The .* for matching properties was too aggressive and caused the
following failure with foo(int rc) "(this is a test)":
Traceback (most recent call last):
File "scripts/tracetool.py", line 139, in <module>
main(sys.argv)
File "scripts/tracetool.py", line 134, in main
binary=binary, probe_prefix=probe_prefix)
File "scripts/tracetool/__init__.py", line 334, in generate
events = _read_events(fevents)
File "scripts/tracetool/__init__.py", line 262, in _read_events
res.append(Event.build(line))
File "scripts/tracetool/__init__.py", line 225, in build
return Event(name, props, fmt, args, arg_fmts)
File "scripts/tracetool/__init__.py", line 185, in __init__
% ", ".join(unknown_props))
ValueError: Unknown properties: foo(int, rc)
Stefan Hajnoczi [Mon, 22 Sep 2014 14:03:15 +0000 (15:03 +0100)]
trace-events: drop orphan iscsi trace events
iscsi_aio_write16_cb, iscsi_aio_writev, iscsi_aio_read16_cb, and
iscsi_aio_readv have not not been in use since commit 063c3378a9e3c25cc0afac3c72e4823d0621e352 ("block/iscsi: introduce
bdrv_co_{readv, writev, flush_to_disk}").
These were the only trace events in block/iscsi.c so drop the the
trace.h include.
Chen Fan [Fri, 11 Jul 2014 03:24:37 +0000 (11:24 +0800)]
trace: docs: add trace file description
When user used the trace print command from docs/tracing.txt:
./scripts/simpletrace.py trace-events trace-*
the user maybe be misled by the "trace-*", because if user
directly copy the comand line to run, there alway print the
bored message:
"usage: ./scripts/simpletrace.py <trace-events> <trace-file>"
then we should describe that the "trace-*" represented.
The signal is currently checked by 10 targets, but only actually
raised by Sparc and ARM. For the sake of one test-and-branch,
we can handle this generic bit generically.
Note that the code that was within the "exit" ifdef block
was identical to the cpu_compute_eflags inline, so make that
simplification at the same time.
Around the cpu_exec_enter/exit hooks contain many empty
ifdef blocks. Delete all of these to highlight those
targets for which we actually need to do work.
Peter Maydell [Thu, 25 Sep 2014 15:58:04 +0000 (16:58 +0100)]
Merge remote-tracking branch 'remotes/mcayland/tags/qemu-openbios-signed' into staging
Update OpenBIOS images
# gpg: Signature made Thu 25 Sep 2014 13:35:55 BST using RSA key ID AE0F321F
# gpg: Good signature from "Mark Cave-Ayland <[email protected]>"
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: CC62 1AB9 8E82 200D 915C C9C4 5BC2 C56F AE0F 321F
Petr Matousek [Thu, 18 Sep 2014 06:35:37 +0000 (08:35 +0200)]
slirp: udp: fix NULL pointer dereference because of uninitialized socket
When guest sends udp packet with source port and source addr 0,
uninitialized socket is picked up when looking for matching and already
created udp sockets, and later passed to sosendto() where NULL pointer
dereference is hit during so->slirp->vnetwork_mask.s_addr access.
Fix this by checking that the socket is not just a socket stub.
Peter Maydell [Tue, 23 Sep 2014 13:43:47 +0000 (14:43 +0100)]
Merge remote-tracking branch 'remotes/kraxel/tags/pull-usb-20140923-1' into staging
usb: enable hotplug, switch to realize, ohci tracing, misc fixes.
# gpg: Signature made Tue 23 Sep 2014 12:42:29 BST using RSA key ID D3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <[email protected]>"
# gpg: aka "Gerd Hoffmann <[email protected]>"
# gpg: aka "Gerd Hoffmann (private) <[email protected]>"
* remotes/kraxel/tags/pull-usb-20140923-1: (26 commits)
usb: tag standalone ehci as hotpluggable
usb: tag standalone uhci as hotpluggable
usb: tag xhci as hotpluggable
usb-serial: only check speed once at realize time
usb-bus: introduce a wrapper function to check speed
usb-bus: remove "init" from USBDeviceClass struct
usb-mtp: convert init to realize
usb-redir: convert init to realize
usb-audio: convert init to realize
dev-wacom: convert init to realize
dev-hid: convert init to realize
usb-ccid: convert init to realize
dev-serial: convert init to realize
dev-bluetooth: convert init to realize
dev-uas: using error_report instead of fprintf
dev-uas: convert init to realize
dev-storage: usring error_report instead of fprintf/printf
dev-storage: convert init to realize
usb-hub: convert init to realize
libusb: using error_report instead of fprintf
...
Add support for format-0 ccws in channel programs. As a format-1 ccw
contains the same information as format-0 ccws, only supporting larger
addresses, simply convert every ccw to format-1 as we walk the chain.
Peter Maydell [Tue, 23 Sep 2014 11:08:55 +0000 (12:08 +0100)]
Merge remote-tracking branch 'remotes/stefanha/tags/block-pull-request' into staging
# gpg: Signature made Mon 22 Sep 2014 12:41:59 BST using RSA key ID 81AB73C8
# gpg: Good signature from "Stefan Hajnoczi <[email protected]>"
# gpg: aka "Stefan Hajnoczi <[email protected]>"
* remotes/stefanha/tags/block-pull-request: (59 commits)
block: Always compile virtio-blk dataplane
vring: Better error handling if num is too large
virtio: Import virtio_vring.h
async: aio_context_new(): Handle event_notifier_init failure
block: vhdx - fix reading beyond pointer during image creation
block: delete cow block driver
block/archipelago: Fix typo in qemu_archipelago_truncate()
ahci: Add test_identify case to ahci-test.
ahci: Add test_hba_enable to ahci-test.
ahci: Add test_hba_spec to ahci-test.
ahci: properly shadow the TFD register
ahci: add test_pci_enable to ahci-test.
ahci: Add test_pci_spec to ahci-test.
ahci: MSI capability should be at 0x80, not 0x50.
ahci: Adding basic functionality qtest.
layout: Add generators for refcount table and blocks
fuzz: Add fuzzing functions for entries of refcount table and blocks
docs: List all image elements currently supported by the fuzzer
qapi/block-core: Add "new" qcow2 options
qcow2: Add overlap-check.template option
...
Gerd Hoffmann [Fri, 29 Aug 2014 12:40:08 +0000 (14:40 +0200)]
usb: tag standalone ehci as hotpluggable
Add a flag to EHCIPCIInfo saying whenever the controller supports
companions or not. Make sure we only allow registering companions for
ehci versions supporting that. Enable pci hotplug for the ehci
variants not supporting companions.
Gerd Hoffmann [Fri, 29 Aug 2014 12:13:11 +0000 (14:13 +0200)]
usb: tag standalone uhci as hotpluggable
uhci hostadapters in companion setups can't be hotplugged. So leave
hotplug disabled for all ich9 variants (which are already tagged with
unplug = true in the info struct). For the other variants we'll enable
hotplug and remove the companion setup properties.
Whatever the chardev is open or not, we should assure
the speed is matched each other. So, call usb_check_attach()
check speed. And then pass &error_abort at all calls to
usb_device_attach().
Add "realize/unrealize" in USBDeviceClass, which has errp
as a parameter. So all the implementations now use
error_setg instead of error_report for reporting error.
Note: this patch still keep "init" in USBDeviceClass, and
call kclass->init in usb_device_realize(), avoid breaking
git bisect. After realize all usb devices, will be removed.
Peter Maydell [Tue, 23 Sep 2014 10:00:07 +0000 (11:00 +0100)]
Merge remote-tracking branch 'remotes/mjt/tags/trivial-patches-2014-09-22' into staging
trivial patches for 2014-09-22
# gpg: Signature made Mon 22 Sep 2014 09:10:03 BST using RSA key ID A4C3D7DB
# gpg: Good signature from "Michael Tokarev <[email protected]>"
# gpg: aka "Michael Tokarev <[email protected]>"
# gpg: aka "Michael Tokarev <[email protected]>"
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 6EE1 95D1 886E 8FFB 810D 4324 457C E0A0 8044 65C5
# Subkey fingerprint: 6F67 E18E 7C91 C5B1 5514 66A7 BEE5 9D74 A4C3 D7DB
* remotes/mjt/tags/trivial-patches-2014-09-22:
arch_init: Setting QEMU_ARCH enum straight
pc: Add missing 'static' attribute
block: allow creation of fixed vhdx images
vl: Print maxmem in hex format for error message
configure: trivial fixes
xen-hvm.c: Always return -1 when failure occurs in xen_hvm_init()
rdma: Fix incorrect description in comments
Fix typos and misspellings in comments
qemu-char: Permit only a single "stdio" character device
All memory regions used by VFIO are LITTLE_ENDIAN and they
already take care of endiannes when accessing real device BARs
except ROM - it was broken on BE hosts.
This fixes endiannes for ROM BARs the same way as it is done
for other BARs.
This has been tested on PPC64 BE/LE host/guest in all possible
combinations including TCG.
This header has no further dependencies. It only has some stable data
types and primitive functions, so we can copy it to include/hw/virtio in
order to allow vring code (and its user virtio-blk dataplane) to be
built unconditionally, even for cross compiling.
On a system with a low limit of open files the initialization
of the event notifier could fail and QEMU exits without printing any
error information to the user.
The problem can be easily reproduced by enforcing a low limit of open
files and start QEMU with enough I/O threads to hit this limit.
The same problem raises, without the creation of I/O threads, while
QEMU initializes the main event loop by enforcing an even lower limit of
open files.
This commit adds an error message on failure:
# qemu [...] -object iothread,id=iothread0 -object iothread,id=iothread1
qemu: Failed to initialize event notifier: Too many open files in system
Jeff Cody [Tue, 16 Sep 2014 19:12:06 +0000 (15:12 -0400)]
block: vhdx - fix reading beyond pointer during image creation
In vhdx_create_metadata(), we allocate 40 bytes to entry_buffer for
the various metadata table entries. However, we write out 64kB from
that buffer into the new file. Only write out the correct 40 bytes.
Stefan Hajnoczi [Tue, 16 Sep 2014 14:24:24 +0000 (15:24 +0100)]
block: delete cow block driver
This patch removes support for the cow file format.
Normally we do not break backwards compatibility but in this case there
is no impact and it is the most logical option. Extraordinary claims
require extraordinary evidence so I will show why removing the cow block
driver is the right thing to do.
The cow file format is the disk image format for Usermode Linux, a way
of running a Linux system in userspace. The performance of UML was
never great and it was hacky, but it enjoyed some popularity before
hardware virtualization support became mainstream.
QEMU's block/cow.c is supposed to read this image file format.
Unfortunately the file format was underspecified:
1. Earlier Linux versions used the MAXPATHLEN constant for the backing
filename field. The value of MAXPATHLEN can change, so Linux
switched to a 4096 literal but QEMU has a 1024 literal.
2. Padding was not used on the header struct (both in the Linux kernel
and in QEMU) so the struct layout varied across architectures. In
particular, i386 and x86_64 were different due to int64_t alignment
differences. Linux now uses __attribute__((packed)), QEMU does not.
Therefore:
1. QEMU cow images do not conform to the Linux cow image file format.
2. cow images cannot be shared between different host architectures.
This means QEMU cow images are useless and QEMU has not had bug reports
from users actually hitting these issues.
Let's get rid of this thing, it serves no purpose and no one will be
affected.
John Snow [Thu, 21 Aug 2014 17:44:39 +0000 (13:44 -0400)]
ahci: Add test_identify case to ahci-test.
Utilizing all of the bring-up code in pci_enable and hba_enable,
this test issues a simple IDENTIFY command via the HBA and retrieves
the response via the PIO receive mechanisms of the HBA.
Bugs: The DPS interrupt (Descriptor Processed Status) does not
currently get set. This will need to be adjusted in a future
patch series when the AHCI DMA pathways are reworked to allow
the feature, which may be utilized by OSX guests.
projects / qemu.git / log