Commit Graph

65197 Commits

Author SHA1 Message Date
Peter Maydell
9225cd127d nbd patches for 2018-12-03
Improve x-dirty-bitmap handling for experimenting with pull mode
 incremental backups.
 
 - Eric Blake: 0/3 NBD dirty bitmap cleanups
 -----BEGIN PGP SIGNATURE-----
 Comment: Public key at http://people.redhat.com/eblake/eblake.gpg
 
 iQEcBAABCAAGBQJcBVInAAoJEKeha0olJ0Nq+68H/RoRtXAycWm1bNidVNC9J8pO
 hkXsZwe39V/6Hl5eXch5J6K9V+443A4+WJSpvfISnB7jKEIHQ2GVMiuXPjmeyap+
 BIbAlHt+frQYz+x1E6fKrLE67mxQViRCQrfx8ijDRUJTUlDxq+yPDjwmGk25DRDt
 zlFqpkCr1NhEREm6JDNmM/WJqBaueSAXY5Fi7MqeHTyRKlZ5RclZaZ5bw4YpB+ip
 kwsWPHsz9uoe9caMxcdU0Y8PqB7KwvwJ+4RjtGpFgp0Auqe2FvaRyiqYE4n5EU2S
 5kvbvKgGK1XUe4RyBLVg1cqcB/LoHLbNohJUJ03pdU1anxcjKIDEv/Oh801OPmE=
 =w1HF
 -----END PGP SIGNATURE-----

Merge remote-tracking branch 'remotes/ericb/tags/pull-nbd-2018-12-03' into staging

nbd patches for 2018-12-03

Improve x-dirty-bitmap handling for experimenting with pull mode
incremental backups.

- Eric Blake: 0/3 NBD dirty bitmap cleanups

# gpg: Signature made Mon 03 Dec 2018 15:56:23 GMT
# gpg:                using RSA key A7A16B4A2527436A
# gpg: Good signature from "Eric Blake <eblake@redhat.com>"
# gpg:                 aka "Eric Blake (Free Software Programmer) <ebb9@byu.net>"
# gpg:                 aka "[jpeg image of size 6874]"
# Primary key fingerprint: 71C2 CC22 B1C4 6029 27D2  F3AA A7A1 6B4A 2527 436A

* remotes/ericb/tags/pull-nbd-2018-12-03:
  nbd/client: Send NBD_CMD_DISC if open fails after connect
  nbd/client: Make x-dirty-bitmap more reliable
  nbd/server: Advertise all contexts in response to bare LIST

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-12-03 17:43:20 +00:00
Peter Maydell
3af8c4be90 Block layer patches:
- mirror: Fix deadlock
 -----BEGIN PGP SIGNATURE-----
 
 iQIcBAABAgAGBQJcBWB9AAoJEH8JsnLIjy/WeIcP/3YpX7Q+Dfdt/Bw2epOtjNAO
 vLh3nuu8utgQ7+zrjrN/qRO2xEuJvnM2OYJxXJFpyPwCExEOoczCZLWmqqT/h3HK
 7yiA16Xob0WS9rlT7gfAZ03KiyxfL1H8P1LWENqtC5n5kEDhIGljxwLL2Ohe29Pj
 GnCWpcyzw45y/yW7+YRt7d3KA3LtnaF1Cuh4Z5kBIxDgydhBWdAST00JMfOVQCFN
 u8+9SzqXk8wBfh+s71xwZDNvRuo7DC09AUHR50uAgMkH7Ufd8S/6tQZQdifX6TJd
 e1A8q1g+b92aHyYzVAx6SSJH4OOvCyEX7VLYRdjCKzerMwW2UNeWqqu+u17KRZlg
 I9ika3ZgN8LyONMStiJYXEyP0QizAEbCGq6acLinB8gg4LDahYAPa6wzekEltNGx
 MmjBt7lr83mnUqliZNR3YkK8DnUKrKoaIWiCfSCKyQuiATn0c42AKmk1i2yQtZyF
 otbXNV9sZav8VMXrijG8OjrwyQQ7OU+Uo3k+pROt0iKaJF3VvYYjYY2nznuuV4/Y
 IxdG0AnpyAtRgXJ+KJX90f0aSi5zyeTqmukOQgCuo8mhWtFW4rwcDQop2dkOZRJF
 q62ramCtr89LCRHgrLQbsXYL+CXH0hADzS7qiqF3ToZ8nbK7GnZOeEk+Cfecd3mO
 3KlQnig6qhM8vAGo6haX
 =r093
 -----END PGP SIGNATURE-----

Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging

Block layer patches:

- mirror: Fix deadlock

# gpg: Signature made Mon 03 Dec 2018 16:57:33 GMT
# gpg:                using RSA key 7F09B272C88F2FD6
# gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>"
# Primary key fingerprint: DC3D EB15 9A9A F95D 3D74  56FE 7F09 B272 C88F 2FD6

* remotes/kevin/tags/for-upstream:
  iotests: simple mirror test with kvm on 1G image
  mirror: fix dead-lock

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-12-03 17:12:48 +00:00
Vladimir Sementsov-Ogievskiy
db5e8210ad iotests: simple mirror test with kvm on 1G image
This test is broken without previous commit fixing dead-lock in mirror.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Signed-off-by: Max Reitz <mreitz@redhat.com>
Acked-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2018-12-03 16:51:53 +01:00
Vladimir Sementsov-Ogievskiy
d12ade5732 mirror: fix dead-lock
Let start from the beginning:

Commit b9e413dd37 (in 2.9)
"block: explicitly acquire aiocontext in aio callbacks that need it"
added pairs of aio_context_acquire/release to mirror_write_complete and
mirror_read_complete, when they were aio callbacks for blk_aio_* calls.

Then, commit 2e1990b26e (in 3.0) "block/mirror: Convert to coroutines"
dropped these blk_aio_* calls, than mirror_write_complete and
mirror_read_complete are not callbacks more, and don't need additional
aiocontext acquiring. Furthermore, mirror_read_complete calls
blk_co_pwritev inside these pair of aio_context_acquire/release, which
leads to the following dead-lock with mirror:

 (gdb) info thr
   Id   Target Id         Frame
   3    Thread (LWP 145412) "qemu-system-x86" syscall ()
   2    Thread (LWP 145416) "qemu-system-x86" __lll_lock_wait ()
 * 1    Thread (LWP 145411) "qemu-system-x86" __lll_lock_wait ()

 (gdb) bt
 #0  __lll_lock_wait ()
 #1  _L_lock_812 ()
 #2  __GI___pthread_mutex_lock
 #3  qemu_mutex_lock_impl (mutex=0x561032dce420 <qemu_global_mutex>,
     file=0x5610327d8654 "util/main-loop.c", line=236) at
     util/qemu-thread-posix.c:66
 #4  qemu_mutex_lock_iothread_impl
 #5  os_host_main_loop_wait (timeout=480116000) at util/main-loop.c:236
 #6  main_loop_wait (nonblocking=0) at util/main-loop.c:497
 #7  main_loop () at vl.c:1892
 #8  main

Printing contents of qemu_global_mutex, I see that "__owner = 145416",
so, thr1 is main loop, and now it wants BQL, which is owned by thr2.

 (gdb) thr 2
 (gdb) bt
 #0  __lll_lock_wait ()
 #1  _L_lock_870 ()
 #2  __GI___pthread_mutex_lock
 #3  qemu_mutex_lock_impl (mutex=0x561034d25dc0, ...
 #4  aio_context_acquire (ctx=0x561034d25d60)
 #5  dma_blk_cb
 #6  dma_blk_io
 #7  dma_blk_read
 #8  ide_dma_cb
 #9  bmdma_cmd_writeb
 #10 bmdma_write
 #11 memory_region_write_accessor
 #12 access_with_adjusted_size
 #15 flatview_write
 #16 address_space_write
 #17 address_space_rw
 #18 kvm_handle_io
 #19 kvm_cpu_exec
 #20 qemu_kvm_cpu_thread_fn
 #21 qemu_thread_start
 #22 start_thread
 #23 clone ()

Printing mutex in fr 2, I see "__owner = 145411", so thr2 wants aio
context mutex, which is owned by thr1. Classic dead-lock.

Then, let's check that aio context is hold by mirror coroutine: just
print coroutine stack of first tracked request in mirror job target:

 (gdb) [...]
 (gdb) qemu coroutine 0x561035dd0860
 #0  qemu_coroutine_switch
 #1  qemu_coroutine_yield
 #2  qemu_co_mutex_lock_slowpath
 #3  qemu_co_mutex_lock
 #4  qcow2_co_pwritev
 #5  bdrv_driver_pwritev
 #6  bdrv_aligned_pwritev
 #7  bdrv_co_pwritev
 #8  blk_co_pwritev
 #9  mirror_read_complete () at block/mirror.c:232
 #10 mirror_co_read () at block/mirror.c:370
 #11 coroutine_trampoline
 #12 __start_context

Yes it is mirror_read_complete calling blk_co_pwritev after acquiring
aio context.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2018-12-03 16:50:58 +01:00
Roman Bolshakov
83ea23cd20 i386: hvf: Fix overrun of _decode_tbl1
Single opcode instructions in ff group were incorrectly processed
because an overrun of _decode_tbl1[0xff] resulted in access of
_decode_tbl2[0x0]. Thus, decode_sldtgroup was called instead of
decode_ffgroup:
  7d71: decode_sldtgroup: 1
  Unimplemented handler (7d71) for 108 (ff 0)

While at it correct maximum length for _decode_tbl2 and _decode_tbl3.

Signed-off-by: Roman Bolshakov <r.bolshakov@yadro.com>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-12-03 15:09:55 +00:00
Corey Minyard
629457a130 i2c: Add a length check to the SMBus write handling
Avoid an overflow.

Signed-off-by: Corey Minyard <cminyard@mvista.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Cc: QEMU Stable <qemu-stable@nongnu.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-12-03 13:00:38 +00:00
Eric Blake
c688e6ca7b nbd/client: Send NBD_CMD_DISC if open fails after connect
If nbd_client_init() fails after we are already connected,
then the server will spam logs with:

Disconnect client, due to: Unexpected end-of-file before all bytes were read

unless we gracefully disconnect before closing the connection.

Ways to trigger this:

$ opts=driver=nbd,export=foo,server.type=inet,server.host=localhost,server.port=10809
$  qemu-img map --output=json --image-opts $opts,read-only=off
$  qemu-img map --output=json --image-opts $opts,x-dirty-bitmap=nosuch:

Signed-off-by: Eric Blake <eblake@redhat.com>
Message-Id: <20181130023232.3079982-4-eblake@redhat.com>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
2018-11-30 14:13:37 -06:00
Eric Blake
47829c4079 nbd/client: Make x-dirty-bitmap more reliable
The implementation of x-dirty-bitmap in qemu 3.0 (commit 216ee365)
silently falls back to treating the server as not supporting
NBD_CMD_BLOCK_STATUS if a requested meta_context name was not
negotiated, which in turn means treating the _entire_ image as
data. Since our hack relied on using 'qemu-img map' to view
which portions of the image were dirty by seeing what the
redirected bdrv_block_status() treats as holes, this means
that our fallback treats the entire image as clean.  Better
would have been to treat the entire image as dirty, or to fail
to connect because the user's request for a specific context
could not be honored. This patch goes with the latter.

Signed-off-by: Eric Blake <eblake@redhat.com>
Message-Id: <20181130023232.3079982-3-eblake@redhat.com>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
2018-11-30 14:11:20 -06:00
Eric Blake
e31d802479 nbd/server: Advertise all contexts in response to bare LIST
The NBD spec, and even our code comment, says that if the client
asks for NBD_OPT_LIST_META_CONTEXT with 0 queries, then we should
reply with (a possibly-compressed representation of) ALL contexts
that we are willing to let them try.  But commit 3d068aff forgot
to advertise qemu:dirty-bitmap:FOO.

Signed-off-by: Eric Blake <eblake@redhat.com>
Message-Id: <20181130023232.3079982-2-eblake@redhat.com>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
2018-11-30 13:55:18 -06:00
Peter Maydell
4750e1a888 Update version for v3.1.0-rc3 release
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-28 17:37:34 +00:00
Thomas Huth
3f2f3b33db target/arm/sve_helper: Fix compilation with clang 3.4
Clang 3.4 does not know the "flatten" attribute yet. We've already
introduced the QEMU_FLATTEN macro for this in commit 97ff87c0ed,
so use this macro now here, too, to fix this issue.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-id: 1543399094-2260-1-git-send-email-thuth@redhat.com
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-28 15:31:15 +00:00
Thomas Huth
ea066d39ac hw/arm/aspeed: Fix build issue with clang 3.4
When using clang 3.4.2, compilation of QEMU fails like this:

  CC      aarch64-softmmu/hw/arm/aspeed.o
hw/arm/aspeed.c:36:3: error: redefinition of typedef 'AspeedBoardState' is a C11
      feature [-Werror,-Wtypedef-redefinition]
} AspeedBoardState;
  ^
include/hw/arm/aspeed.h:14:33: note: previous definition is here
typedef struct AspeedBoardState AspeedBoardState;
                                ^
1 error generated.
make[1]: *** [hw/arm/aspeed.o] Error 1
make: *** [subdir-aarch64-softmmu] Error 2

Remove the duplicated typedef to fix this issue.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Message-id: 1543397736-8198-1-git-send-email-thuth@redhat.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-28 13:51:41 +00:00
Peter Maydell
c56606684a * lsi HBA reselection fix (George)
* Small cleanups (Li Qiang)
 * bugfixes for vhost-user-bridge and hostmem (Marc-André)
 * single-thread TCG fix (me)
 * VMX migration blocker (me)
 * target/i386 fix for LOCK (Richard)
 * MAINTAINERS update (Philippe, Thomas)
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2.0.22 (GNU/Linux)
 
 iQEcBAABAgAGBQJb/nM4AAoJEL/70l94x66DzyAH/A3/r56O6NVGID1ellB7WFI0
 oLznck2k8En23VWd6i1T/F9t+bAhnkUz60+RM0HhswXRQbkxFV4BqLt247AjiYBx
 SBoqvFkgH2N8dNY8jbtMHePQwir9ovZxH2G0O8KUXeEiVv5ecrnay+j5XESJvylF
 Gqs2UjubyWc8ihklmxCfzwIdD/H6ZRTulzHlMRZnHs31m6yrlzKDuZcNORLYOkbq
 FuEmeLYyE6bampIkaUSR3S8yaMK807cCvKZ3u0+eojbBxyf6OGK6wHWazRHnUtyx
 uZmAcGJ45mijiOskLxo5Y7/9iagADG/EpYB3Hg6jx9phTNsro6E6WuXMPDbE5Wc=
 =fXOF
 -----END PGP SIGNATURE-----

Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into staging

* lsi HBA reselection fix (George)
* Small cleanups (Li Qiang)
* bugfixes for vhost-user-bridge and hostmem (Marc-André)
* single-thread TCG fix (me)
* VMX migration blocker (me)
* target/i386 fix for LOCK (Richard)
* MAINTAINERS update (Philippe, Thomas)

# gpg: Signature made Wed 28 Nov 2018 10:51:36 GMT
# gpg:                using RSA key BFFBD25F78C7AE83
# gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>"
# gpg:                 aka "Paolo Bonzini <pbonzini@redhat.com>"
# Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4  E2F7 7E15 100C CD36 69B1
#      Subkey fingerprint: F133 3857 4B66 2389 866C  7682 BFFB D25F 78C7 AE83

* remotes/bonzini/tags/for-upstream:
  hostmem: no need to check for host_memory_backend_mr_inited() in alloc()
  hostmem-memfd: honour share=on/off property
  MAINTAINERS: Add an entry for the Firmware Configuration (fw_cfg) device
  MAINTAINERS: Add some missing entries related to accelerators
  target/i386: Generate #UD when applying LOCK to a register destination
  checkpatch: g_test_message does not need a trailing newline
  vl.c: remove outdated comment
  vhost-user-bridge: fix recvmsg iovlen
  vl: Improve error message when we can't load fw_cfg from file
  vmstate: constify VMStateField
  migration: savevm: consult migration blockers
  lsi: Reselection needed to remove pending commands from queue
  cpus: run work items for all vCPUs if single-threaded
  target/i386: kvm: add VMX migration blocker

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-28 11:32:33 +00:00
Marc-André Lureau
86100290cb hostmem: no need to check for host_memory_backend_mr_inited() in alloc()
memfd_backend_memory_alloc/file_backend_memory_alloc both needlessly
are are calling host_memory_backend_mr_inited() which creates an
illusion that alloc could be called multiple times but it isn't, it's
called once from UserCreatable complete().

Suggested-by: Igor Mammedov <imammedo@redhat.com>
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-11-28 11:51:24 +01:00
John Snow
039d4e3df0 scsi: Address spurious clang warning
Some versions of Clang prior to 6.0 (and some builds of clang after,
such as 6.0.1-2.fc28) fail to recognize { 0 } as a valid initializer
for a struct with subobjects when -Wmissing-braces is enabled.

https://bugs.llvm.org/show_bug.cgi?id=21689 and
https://reviews.llvm.org/rL314499 suggests this should be fixed in 6.0,
but it might not be the case for older versions or downstream versions.

For now, follow the precedent of ebf2a499 and replace the standard { 0 }
with the accepted { } to silence this warning and allow the build to
work under clang 6.0.1-2.fc28, and builds prior to 6.0.

Signed-off-by: John Snow <jsnow@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Message-id: 20181127184929.20065-1-jsnow@redhat.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-27 23:56:12 +00:00
Markus Armbruster
549b50a31d vfio-helpers: Fix qemu_vfio_open_pci() crash
qemu_vfio_open_common() initializes s->lock only after passing s to
qemu_vfio_dma_map() via qemu_vfio_init_ramblock().
qemu_vfio_dma_map() tries to lock the uninitialized lock and crashes.

Fix by initializing s->lock first.

RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=1645840
Fixes: 418026ca43
Cc: qemu-stable@nongnu.org
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Cornelia Huck <cohuck@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 20181127084143.1113-1-armbru@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-27 18:39:32 +00:00
Marc-André Lureau
36ea397956 hostmem-memfd: honour share=on/off property
The share=on/off property is used to modified mmap() MAP_SHARED
setting. Make it on by default for convenience and compatibility
reasons.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-11-27 19:36:22 +01:00
Philippe Mathieu-Daudé
15ffb43cbf MAINTAINERS: Add an entry for the Firmware Configuration (fw_cfg) device
Step in to maintain it, with Laszlo (EDK2) and Gerd (SeaBIOS)
as designated reviewers.

Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-Id: <20181122021139.1486-1-philmd@redhat.com>
Acked-by: Eduardo Habkost <ehabkost@redhat.com>
Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-11-27 15:35:19 +01:00
Thomas Huth
9681ad3e2b MAINTAINERS: Add some missing entries related to accelerators
Add some files from accel/stubs/, include/hw/kvm/ and scripts/kvm/
to the MAINTAINERS file.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-Id: <1542891438-13329-1-git-send-email-thuth@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-11-27 15:35:19 +01:00
Richard Henderson
e84fcd7f66 target/i386: Generate #UD when applying LOCK to a register destination
Fixes a TCG crash due to attempting the atomic operation without
having set up the address first.  This does not attempt to fix
all of the other missing checks for LOCK.

Fixes: a7cee522f3
Fixes: https://bugs.launchpad.net/qemu/+bug/1803160
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20181113193510.24862-1-richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-11-27 15:35:19 +01:00
Paolo Bonzini
f1e35acf78 checkpatch: g_test_message does not need a trailing newline
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-11-27 15:35:19 +01:00
Li Qiang
d4c7e7e7e0 vl.c: remove outdated comment
Cc: qemu-trivial@nongnu.org

Signed-off-by: Li Qiang <liq3ea@gmail.com>
Message-Id: <1542276385-7638-1-git-send-email-liq3ea@gmail.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-11-27 15:35:19 +01:00
Marc-André Lureau
8f1d22d970 vhost-user-bridge: fix recvmsg iovlen
After iov_discard_front(), the iov may be smaller than its initial
size. Fixes the heap-buffer-overflow spotted by ASAN:

==9036==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6060000001e0 at pc 0x7fe632eca3f0 bp 0x7ffddc4a05a0 sp 0x7ffddc49fd48
WRITE of size 32 at 0x6060000001e0 thread T0
    #0 0x7fe632eca3ef  (/lib64/libasan.so.5+0x773ef)
    #1 0x7fe632ecad23 in __interceptor_recvmsg (/lib64/libasan.so.5+0x77d23)
    #2 0x561e7491936b in vubr_backend_recv_cb /home/elmarco/src/qemu/tests/vhost-user-bridge.c:333
    #3 0x561e74917711 in dispatcher_wait /home/elmarco/src/qemu/tests/vhost-user-bridge.c:160
    #4 0x561e7491c3b5 in vubr_run /home/elmarco/src/qemu/tests/vhost-user-bridge.c:725
    #5 0x561e7491c85c in main /home/elmarco/src/qemu/tests/vhost-user-bridge.c:806
    #6 0x7fe631a6c412 in __libc_start_main (/lib64/libc.so.6+0x24412)
    #7 0x561e7491667d in _start (/home/elmarco/src/qemu/build/tests/vhost-user-bridge+0x3967d)

0x6060000001e0 is located 0 bytes to the right of 64-byte region [0x6060000001a0,0x6060000001e0)
allocated by thread T0 here:
    #0 0x7fe632f42848 in __interceptor_malloc (/lib64/libasan.so.5+0xef848)
    #1 0x561e7493acd8 in virtqueue_alloc_element /home/elmarco/src/qemu/contrib/libvhost-user/libvhost-user.c:1848
    #2 0x561e7493c2a8 in vu_queue_pop /home/elmarco/src/qemu/contrib/libvhost-user/libvhost-user.c:1954
    #3 0x561e749189bf in vubr_backend_recv_cb /home/elmarco/src/qemu/tests/vhost-user-bridge.c:297
    #4 0x561e74917711 in dispatcher_wait /home/elmarco/src/qemu/tests/vhost-user-bridge.c:160
    #5 0x561e7491c3b5 in vubr_run /home/elmarco/src/qemu/tests/vhost-user-bridge.c:725
    #6 0x561e7491c85c in main /home/elmarco/src/qemu/tests/vhost-user-bridge.c:806
    #7 0x7fe631a6c412 in __libc_start_main (/lib64/libc.so.6+0x24412)

SUMMARY: AddressSanitizer: heap-buffer-overflow (/lib64/libasan.so.5+0x773ef)
Shadow bytes around the buggy address:
  0x0c0c7fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c0c7fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c0c7fff8000: fa fa fa fa 00 00 00 00 00 00 05 fa fa fa fa fa
  0x0c0c7fff8010: 00 00 00 00 00 00 00 00 fa fa fa fa fd fd fd fd
  0x0c0c7fff8020: fd fd fd fd fa fa fa fa fd fd fd fd fd fd fd fd
=>0x0c0c7fff8030: fa fa fa fa 00 00 00 00 00 00 00 00[fa]fa fa fa
  0x0c0c7fff8040: fd fd fd fd fd fd fd fd fa fa fa fa fd fd fd fd
  0x0c0c7fff8050: fd fd fd fd fa fa fa fa fd fd fd fd fd fd fd fd
  0x0c0c7fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0c7fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0c7fff8080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-Id: <20181109173028.3372-1-marcandre.lureau@redhat.com>
Signed-off-by: Paolo BOnzini <pbonzini@redhat.com>
2018-11-27 15:35:18 +01:00
Li Qiang
353c7d58b9 vl: Improve error message when we can't load fw_cfg from file
parse_fw_cfg() reports "can't load" without further details.  Get
the details from g_file_get_contents(), and include them in the
error message.

Signed-off-by: Li Qiang <liq3ea@gmail.com>
Message-Id: <1541051971-28584-1-git-send-email-liq3ea@gmail.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-11-27 15:35:18 +01:00
Marc-André Lureau
03fee66fde vmstate: constify VMStateField
Because they are supposed to remain const.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-Id: <20181114132931.22624-1-marcandre.lureau@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-11-27 15:35:15 +01:00
Peter Maydell
59ed3fe8d3 Block layer patches:
- block: Fix crash on migration with explicit child nodes
 - nvme: Fix spurious interrupts
 -----BEGIN PGP SIGNATURE-----
 
 iQIcBAABAgAGBQJb/TGsAAoJEH8JsnLIjy/WJyQP/AuPSMSEoaVuKB6sFyI/9DU3
 9hJCuClGKniJcfTD/NR7k+/ezJr9THyHf8yc2IurU96oJrR+nAbQH4TrnBND3uY2
 XCEMVeKycXRYxwdrH74v/xCM/Ff+XtLiZ4SlE1vSUFYvvdZHjxd7se00K/IE5kG3
 zjU/rBCD6NxC1d+USW7T8rifVvvFpma5KbNUpY9EFv0G7kaIc+tvm+f7t4KWfDEl
 5kZc5FPiILognZXawL2QJktu9gm67DdtJBYIJR7uRQhGnM+lBG2lx/GMyFSQPXJt
 NVfCPUNczK/dKqQJuk5n3ruXqEdGgav8KrCkPo6Gc7fZfcfa2U2gu/W5LXmJmw4U
 MQ+jIwCRcafKPD+z/hCE/S5xLNYgiD9nfA8By1YUQUZlyRe/kAf03EARSPk0Zosu
 Zw35NxDgohgvEOdAz6NgRwOne65Ni+8NLEDcC8ZMLbXLH4k/AVd03iBP8gxU3VAR
 +MZXz9M0fMZHpvzjLYY/QObkG5kgL+labyS/lCefOvCeBJ6fv+xMpUtbtzGyOs4M
 Cap/jM2qcHP1/fn7yilfs/YwWpkUYUci7T3D2K9IDVOclpEjF+pF+Mf79bAn395J
 8W0qMMI7mwngxl8fcpFJj61II5l4GJXrs8xJHVIPtXZOZZUbJl9L7IBgy3SwoZ09
 XoxUxk8wz5mgWa08tppz
 =/UhO
 -----END PGP SIGNATURE-----

Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging

Block layer patches:

- block: Fix crash on migration with explicit child nodes
- nvme: Fix spurious interrupts

# gpg: Signature made Tue 27 Nov 2018 11:59:40 GMT
# gpg:                using RSA key 7F09B272C88F2FD6
# gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>"
# Primary key fingerprint: DC3D EB15 9A9A F95D 3D74  56FE 7F09 B272 C88F 2FD6

* remotes/kevin/tags/for-upstream:
  nvme: Fix spurious interrupts
  iotests: Test migration with -blockdev
  block: Don't inactivate children before parents

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-27 14:35:11 +00:00
Paolo Bonzini
5aaac46793 migration: savevm: consult migration blockers
There is really no difference between live migration and savevm, except
that savevm does not require bdrv_invalidate_cache to be implemented
by all disks.  However, it is unlikely that savevm is used with anything
except qcow2 disks, so the penalty is small and worth the improvement
in catching bad usage of savevm.

Only one place was taking care of savevm when adding a migration blocker,
and it can be removed.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-11-27 15:06:14 +01:00
George Kennedy
56333e69ee lsi: Reselection needed to remove pending commands from queue
Under heavy IO (e.g. fio) the queue is not checked frequently enough for
pending commands. As a result some pending commands are timed out by the
linux sym53c8xx driver, which sends SCSI Abort messages for the timed out
commands. The SCSI Abort messages result in linux errors, which show up
on the console and in /var/log/messages.

e.g.
sd 0:0:3:0: [sdd] tag#33 ABORT operation started
scsi target0:0:3: control msgout:
80 20 47 d
sd 0:0:3:0: ABORT operation complete.
scsi target0:0:4: message d sent on bad reselection

Now following a WAIT DISCONNECT Script instruction, and if there is no
current command, check for a pending command on the queue and if one
exists call lsi_reselect().

Signed-off-by: George Kennedy <george.kennedy@oracle.com>
Message-Id: <1541776692-12271-1-git-send-email-george.kennedy@oracle.com>
[For safety, add a s->current check in lsi_update_irq - Paolo]
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-11-27 15:06:14 +01:00
Paolo Bonzini
a8efa60633 cpus: run work items for all vCPUs if single-threaded
This avoids the following I/O thread deadlock:

1) the I/O thread calls run_on_cpu for CPU 3 from a timer.  single_tcg_halt_cond
is signaled

2) CPU 1 is running and exits.  It finds no work item and enters CPU 2

3) because the I/O thread is stuck in run_on_cpu, the round-robin kick
timer never triggers, and CPU 3 never runs the work item

4) run_on_cpu never completes

Reviewed-by: Emilio G. Cota <cota@braap.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-11-27 15:06:14 +01:00
Paolo Bonzini
d98f26073b target/i386: kvm: add VMX migration blocker
Nested VMX does not support live migration yet.  Add a blocker
until that is worked out.

Nested SVM only does not support it, but unfortunately it is
enabled by default for -cpu host so we cannot really disable it.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-11-27 15:06:14 +01:00
ZhiPeng Lu
2264faa55f hw/virt/arm: Add support for Cortex-A72 in virt
Signed-off-by: ZhiPeng Lu <luzhipeng@uniudc.com>
Message-id: 1543316565-1101590-1-git-send-email-luzhipeng@uniudc.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-27 14:03:06 +00:00
Keith Busch
6da021815e nvme: Fix spurious interrupts
The code had asserted an interrupt every time it was requested to check
for new completion queue entries.This can result in spurious interrupts
seen by the guest OS.

Fix this by asserting an interrupt only if there are un-acknowledged
completion queue entries available.

Reported-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Keith Busch <keith.busch@intel.com>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2018-11-27 12:59:00 +01:00
Kevin Wolf
330ca111ea iotests: Test migration with -blockdev
Check that block node activation and inactivation works with a block
graph that is built with individually created nodes.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
2018-11-27 12:59:00 +01:00
Kevin Wolf
9e37271f50 block: Don't inactivate children before parents
bdrv_child_cb_inactivate() asserts that parents are already inactive
when children get inactivated. This precondition is necessary because
parents could still issue requests in their inactivation code.

When block nodes are created individually with -blockdev, all of them
are monitor owned and will be returned by bdrv_next() in an undefined
order (in practice, in the order of their creation, which is usually
children before parents), which obviously fails the assertion:

qemu: block.c:899: bdrv_child_cb_inactivate: Assertion `bs->open_flags & BDRV_O_INACTIVE' failed.

This patch fixes the ordering by skipping nodes with still active
parents in bdrv_inactivate_recurse() because we know that they will be
covered by recursion when the last active parent becomes inactive.

With the correct parents-before-children ordering, we also got rid of
the reason why commit aad0b7a0bf introduced two passes, so we can go
back to a single-pass recursion. This is necessary so we can rely on the
BDRV_O_INACTIVE flag to skip nodes with active parents (the flag used
to be set only in pass 2, so we would always skip non-root nodes in
pass 1 because all parents would still be considered active; setting the
flag in pass 1 would mean, that we never skip anything in pass 2 because
all parents are already considered inactive).

Because of the change to single pass, this patch is best reviewed with
whitespace changes ignored.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
2018-11-27 12:59:00 +01:00
Peter Maydell
4822f1ee9e various bugfixes for 3.1: fmops, ps2, cirrus, hda, usb-host, qapi
-----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2.0.22 (GNU/Linux)
 
 iQIcBAABAgAGBQJb/OjpAAoJEEy22O7T6HE44jYQAM3G/VpOnlfHjRP9FUNyW9rW
 tIKnRzabMirgGIR91Z9zgVA/WprI+v5XMZ6MzYasxF20c87I3apAwwh6ihFmaw2A
 h+X2379194VAcBBFdhKbkXm32M1b6eeIsUCp1atVbCxNmshbMTIcAt4E7/IkI+zr
 0V9lES3XEd7bvFyYmZtlQJj0ugaBa2H/GvPc9X6oIVxKQJbJ2z/Po3hGUTRFp6hN
 kWxWV/TcVXlQ0qhj9slVMUPr6dI9iZ6jlxNJ1OBbD8TMTIwVpyITvsuvUT+qEYuE
 kAg6J15ChtV2AnNLu1TfyCVvr+x2ExPvIJEgFvsKvaQCEMMRSB9xYd5whEQusnHY
 F39mSbOLNcrHDlyjm6AySH5FDrzhJun1ZmfRsvHe9xsojE0X1R+Ygkvch9vldTxO
 XEGqacaz6jdzHy19PSTlypsJG+yIzZXYntEwLCsI+xd/JzLwQXAkMSiu01WWr+hM
 iHOOdbYLUfv4iTIrOjBZB8l/2M0nSlP2LZz8UmWcmLxMkPTYh+fowgp7PqZWj7ws
 ayDAC8t4Qy0dEv96/zpsgpl7/GSCTSTSs2GY+2Ft9FFLHHDKlF6rgWKbfMyM2dCD
 zPlFl99ZdtvMBlwG+kt5J3UaS2JB0u6h1I6bgliIUz1i+Jf79Y1diMA8SPmf+PJ0
 U9xx4tiXzCGCbZIUdqGX
 =RmNv
 -----END PGP SIGNATURE-----

Merge remote-tracking branch 'remotes/kraxel/tags/fixes-31-20181127-pull-request' into staging

various bugfixes for 3.1: fmops, ps2, cirrus, hda, usb-host, qapi

# gpg: Signature made Tue 27 Nov 2018 06:49:13 GMT
# gpg:                using RSA key 4CB6D8EED3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
# gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
# gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"
# Primary key fingerprint: A032 8CFF B93A 17A7 9901  FE7D 4CB6 D8EE D3E8 7138

* remotes/kraxel/tags/fixes-31-20181127-pull-request:
  qapi: add query-display-options command
  usb-host: set ifs.detached as true if kernel driver is not active
  audio/hda: fix guest triggerable assert
  cirrus_vga/migration: update the bank offset before use
  ps2kbd: default to scan enabled after reset
  fmops: fix off-by-one in AR_TABLE and DR_TABLE array size

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-27 11:21:38 +00:00
Peter Maydell
d5d31c9a8a x86 fixes for -rc3
* Fix SynIC crash
 * Fix x86 crash on MSR code on AMD hosts
 -----BEGIN PGP SIGNATURE-----
 
 iQIcBAABCAAGBQJb/F56AAoJECgHk2+YTcWmhTAP/1R0EPlFqfS4U3VIb43ac+dQ
 Q3lJg3ye23Jp9Cws32pZXTFZyCa76H8rSY0ky+2g4GL5JvAg/LRM3dGF8VceJY4O
 NgMps1hozxuqRfSqjn56uzqok/ewSql/WHQedUKAk34wImZkv0m/6rAgTK86xuW3
 hEnrfOFqowMIrbVw5D0E6b0dT7FshCsvP9cxWxczOdONcV3TZHut7vyTWmlwidlB
 OpfR4aURoNuOc8gOOeOwh763rqS4wVNLI80kbkrti4C9crrNmsRxq839M7G6l993
 7yFGYooVQvAGd1FDfTfAyqloDGpBjuGh+2apOjByFjaY3+CRMAk2pAgriTTiuPbU
 0yy8eyRue0CtIikS9S3/rkbwG2H82kFditx0WVVOceut3/NLljmRTS/YmL5bq4GK
 c2KLDbukflghTIsdpWeLVn9AbKPw80MOia/aTG93e3E/Q7AqKnXbq8nRY6lhayXq
 1sSrneEqiA1UNjR/shbCV/pHSZCoWWCfYO56jsrlkVsL19GlPljolj0Nct29FTAW
 J4So91K21Xcablzchn8rg9Q2aq9px9RRBVmdK/SJFZuLVAOxjSXKbGDNM+/YZ0Wa
 /vvXBrM1Xgf/8reWnFPEfRP6rHFlVVhA40Ho5oqNpI8+mrvqYnASTWcnVZ+V+gnW
 2prdaJ8h3bKseouxly85
 =ZzdR
 -----END PGP SIGNATURE-----

Merge remote-tracking branch 'remotes/ehabkost/tags/x86-for-3.1-pull-request' into staging

x86 fixes for -rc3

* Fix SynIC crash
* Fix x86 crash on MSR code on AMD hosts

# gpg: Signature made Mon 26 Nov 2018 20:58:34 GMT
# gpg:                using RSA key 2807936F984DC5A6
# gpg: Good signature from "Eduardo Habkost <ehabkost@redhat.com>"
# Primary key fingerprint: 5A32 2FD5 ABC4 D3DB ACCF  D1AA 2807 936F 984D C5A6

* remotes/ehabkost/tags/x86-for-3.1-pull-request:
  hw/hyperv: fix NULL dereference with pure-kvm SynIC
  kvm: Use KVM_GET_MSR_INDEX_LIST for MSR_IA32_ARCH_CAPABILITIES support

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-27 09:55:05 +00:00
Gerd Hoffmann
e1ca8f7e19 qapi: add query-display-options command
Add query-display-options command, which allows querying the qemu
display configuration.  This isn't particularly useful, except it
exposes QAPI type DisplayOptions in query-qmp-schema, so that libvirt
can discover recently added -display parameter rendernode (commit
d4dc4ab133).  Works around lack of sufficiently powerful command line
introspection.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Tested-by: Eric Blake <eblake@redhat.com>
Tested-by: Erik Skultety <eskultet@redhat.com>
Message-id: 20181122071613.2889-1-kraxel@redhat.com

[ kraxel: reworded commit message as suggested by armbru ]
2018-11-27 07:47:57 +01:00
linzhecheng
933d2d4bf2 usb-host: set ifs.detached as true if kernel driver is not active
If no kernel driver is active, we can already claim and perform I/O on
it without detaching it.

Signed-off-by: linzhecheng <linzhecheng@huawei.com>
Message-id: 20181120083419.17716-1-linzhecheng@huawei.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2018-11-27 07:47:57 +01:00
Gerd Hoffmann
7ec9106759 audio/hda: fix guest triggerable assert
Guest writes to a readonly register trigger the assert in
intel_hda_reg_write().  Add a check and just ignore them.

Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=1628433
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20181123063957.9515-1-kraxel@redhat.com
2018-11-27 07:47:57 +01:00
Wang Xin
b7ee9e4970 cirrus_vga/migration: update the bank offset before use
The cirrus bank0/1 offset should be updated before we update the vram's alias
offset.

Signed-off-by: Wang Xin <wangxinxin.wang@huawei.com>
Message-id: 20181123064646.23036-1-linzhecheng@huawei.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2018-11-27 07:47:57 +01:00
Hervé Poussineau
d2e550a828 ps2kbd: default to scan enabled after reset
A check for scan_enabled has been added to ps2_keyboard_event in commit
143c04c7e0 to prevent stream corruption.
This works well as long as operating system is resetting keyboard, or enabling it.

This fixes IBM 40p firmware, which doesn't bother sending KBD_CMD_RESET,
KBD_CMD_ENABLE or KBD_CMD_RESET_ENABLE before trying to use the keyboard.

Signed-off-by: Hervé Poussineau <hpoussin@reactos.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20181021190721.2148-1-hpoussin@reactos.org
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2018-11-27 07:47:50 +01:00
Roman Kagan
30a759b61a hw/hyperv: fix NULL dereference with pure-kvm SynIC
When started in compat configuration of SynIC, e.g.

qemu-system-x86_64 -machine pc-i440fx-2.10,accel=kvm \
 -cpu host,-vmx,hv-relaxed,hv_spinlocks=0x1fff,hv-vpindex,hv-synic

or explicitly

qemu-system-x86_64 -enable-kvm -cpu host,hv-synic,x-hv-synic-kvm-only=on

QEMU crashes in hyperv_synic_reset() trying to access the non-present
qobject for SynIC.

Add the missing check for NULL.

Reported-by: Vitaly Kuznetsov <vkuznets@redhat.com>
Reported-by: Igor Mammedov <imammedo@redhat.com>
Fixes: 9b4cf107b0
Fixes: 4a93722f9c
Signed-off-by: Roman Kagan <rkagan@virtuozzo.com>
Message-Id: <20181126152836.25379-1-rkagan@virtuozzo.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2018-11-26 14:14:38 -02:00
Bandan Das
aec5e9c3a9 kvm: Use KVM_GET_MSR_INDEX_LIST for MSR_IA32_ARCH_CAPABILITIES support
When writing to guest's MSR_IA32_ARCH_CAPABILITIES, check whether it's
supported in the guest using the KVM_GET_MSR_INDEX_LIST ioctl.

Fixes: d86f963694
Suggested-by: Eduardo Habkost <ehabkost@redhat.com>
Tested-by: balducci@units.it
Signed-off-by: Bandan Das <bsd@redhat.com>
Message-Id: <jpg4lc4iiav.fsf_-_@linux.bootlegged.copy>
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2018-11-26 13:00:38 -02:00
Peter Maydell
d522fba244 target-arm queue:
* some updates to MAINTAINERS file entries
  * cadence_gem: Remove an incorrect assert()
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQIcBAABCAAGBQJb+/vOAAoJEDwlJe0UNgze5w8QAKdMMpkJYMyGDAmAcFnFpr7N
 nIZWTL6B8krJ9CBNlSbW8rsi3yqyNw+lmH//jSB8KJYYk/UGYkT5v7BdOZdm5W9J
 hsuW6LdVgWTPHiLvGEmBTFX4vSE6uuE4nrgEFG+EEf+SV7RZ7B9auYnCzOHTJDBv
 2Pc/pOJPttJ5nXnkIe7kzEYg3xBsKSIlGnHs6nCKllGh9kwgaTQ5MEqcP3C2OSY2
 W361UCkYogqslJ+rQXY5QBS9webGpUcumog9TnYF/wjf8VF9pFDE+OrbFTYzifsq
 lfGdgEL5NAws0M+9m/95u+SRdW7RtQaUNXqNK+jg6y7cKg6pRqw+lftbqgNnt10D
 FvQ4oyRLHhafMxJY04d8Q+OAxsWBE/8gXRfczsfqoOiDh9KFQG1x92U+vRGlHg6p
 /GXBf+CHgpLa/0lW2CEveTYWXmdifzQtD4EVnHsbmvphHQ4tn7L9EIGI1Ak96MR2
 L2r/mgtC6Uke3VWtKhhN3SUlj0mqlG+67tz7LUFWZa9BcIg/vWng9gRLC/VkZlyK
 jhYmia84gkwEP0vSNN1pC/4oYwXFc1NGIW87LNleTKgZJHdXZIa7m/92QOyZgfg7
 G10FLVCBJsi1VGgr9RYhE+XeLq02duWN7SNg1k9LWgbwfEW1hvZYUmi6SFStL4gR
 GgMUXYf1wvbNqLF7kCmY
 =fZXf
 -----END PGP SIGNATURE-----

Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20181126' into staging

target-arm queue:
 * some updates to MAINTAINERS file entries
 * cadence_gem: Remove an incorrect assert()

# gpg: Signature made Mon 26 Nov 2018 13:57:34 GMT
# gpg:                using RSA key 3C2525ED14360CDE
# gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>"
# gpg:                 aka "Peter Maydell <pmaydell@gmail.com>"
# gpg:                 aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>"
# Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83  15CF 3C25 25ED 1436 0CDE

* remotes/pmaydell/tags/pull-target-arm-20181126:
  net: cadence_gem: Remove incorrect assert()
  MAINTAINERS: Add an ARM SMMU section
  MAINTAINERS: Assign some more files in the hw/arm/ directory

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-26 13:58:46 +00:00
Edgar E. Iglesias
58102ce7fb net: cadence_gem: Remove incorrect assert()
Don't assert on RX descriptor settings when the receiver is
disabled. This fixes an issue with incoming packets on an
unused GEM.

Reported-by: mbilal <muhammad_bilal@mentor.com>
Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20181123135450.24829-2-edgar.iglesias@gmail.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-26 13:41:42 +00:00
Eric Auger
49154ea0bf MAINTAINERS: Add an ARM SMMU section
Add a new ARM SMMU section and set Eric Auger as the maintainer
for ARM SMMU emulation sources.

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Message-id: 20181122180143.14237-1-eric.auger@redhat.com
Suggested-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-26 13:40:48 +00:00
Thomas Huth
123a069ae6 MAINTAINERS: Assign some more files in the hw/arm/ directory
I apparently missed some more files and even a complete machine (the
"imx25-pdk") in my previous patch... but now we should hopefully have
a completely coverage for all available ARM boards.

Fixes: 95a5db3ae5
Signed-off-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 1542782568-20059-1-git-send-email-thuth@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-26 13:39:23 +00:00
Peter Maydell
72138f9bf5 Fixes a QEMU crash triggerable by guest userspace (CVE-2018-19489).
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEtIKLr5QxQM7yo0kQcdTV5YIvc9YFAlv7n80ACgkQcdTV5YIv
 c9bfvQ//a2cmpKL5DxuhtZ8Z8HvK0LkhXz/Q12mnSRR2gwQzy5C2xY1ARTXqEUyu
 cASTvARljTJSWO/86+5S0oxS1rG8LBhfF5mCrGmn/kd6ntYpRTiGVREAarMPDU69
 hPXPNjPynnUXMiyxyssm4Xb73l9fW9HuKjlgpW/tFrLPCAY1CFy+cfS/5gSinhAh
 GRfxVhFVHA00AgFp5QCcfeAtjEaf1Xgqc/L4GF7BWi7cc9sPSD6M5YctkLzt75uH
 acaiQBWTV9gNmYyfek/kpssVbGma+H8APgeXeCw5uRcO6EYlomVaIIsX6hSdCt5x
 9LyIqob0xWOorRFx0U0KDmqu+rjsdXYJWVaTm/7KBxqiUNEHnliCQ7UH34pi4tsp
 q4vOpviiGz/VwWE3VdLgmO7pOegf16ofQ/RFM/flKFP712VwIKCUAT2CS+jqEY5p
 o3N1wNelUvQLp8qEAIIdqc29RDeJyqeiQUkxGNvyV3E2cyxwTLouBe78AhmOQ5iw
 oMwG2FPseOTPkrYmV5cMZQiKhZ0BD2ngoVtN7TVAmxRHkmKE91soi+WpJ2xA9ohm
 +E8yYFyqAt6CR+YMi39f+WUdya79PL7YbFDZq/IMHFDoujPdjBJWq4gUxMNS2FI5
 FWBfRWmYulEBriZvL8xVwJSbbHpubMvTSSz58OFu01fxKw9qF9o=
 =63qs
 -----END PGP SIGNATURE-----

Merge remote-tracking branch 'remotes/gkurz/tags/for-upstream' into staging

Fixes a QEMU crash triggerable by guest userspace (CVE-2018-19489).

# gpg: Signature made Mon 26 Nov 2018 07:25:01 GMT
# gpg:                using RSA key 71D4D5E5822F73D6
# gpg: Good signature from "Greg Kurz <groug@kaod.org>"
# gpg:                 aka "Gregory Kurz <gregory.kurz@free.fr>"
# gpg:                 aka "[jpeg image of size 3330]"
# Primary key fingerprint: B482 8BAF 9431 40CE F2A3  4910 71D4 D5E5 822F 73D6

* remotes/gkurz/tags/for-upstream:
  9p: fix QEMU crash when renaming files

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-26 11:46:04 +00:00
Peter Maydell
b05730a876 xtensa fixes for 3.1:
- fix register counting logic for linux-user gdbserver;
 - provide default memory sizes for XTFPGA boards;
 - add missing xtensa patterns to MAINTAINTERS.
 -----BEGIN PGP SIGNATURE-----
 
 iQJHBAABCAAxFiEEK2eFS5jlMn3N6xfYUfnMkfg/oEQFAlv7K0oTHGpjbXZia2Jj
 QGdtYWlsLmNvbQAKCRBR+cyR+D+gRDWrD/4yPoHniOxe/1tnldviJVChJsE7YjGD
 S1J/JOIxSqH/fdHm7t3n4lQU8VvdKu7O8XEgscFRa2tnSKnERrlOsjJJCQMVPk7x
 gkSBgdmfxJtfVVK3uktU+nNVuecx6jPEOZhNgWPFv5WZKUUvmdaAJ4DRHQx1PjoO
 PGPjqcDJ0nQMteqDDdrnL3Q/Hu0lMDSXU4fBdaVw4fWTETOwQdf6nMma9iGP2/Eq
 ZqTigrHX617JspqVXvTLwJ5C4hg2UEKpS8QG8p5t91cD2QBT3j5Curylku2MWeLS
 eFKKZs/9sxskydlLs3RJM1xslWihYz1UDg2Gz7o3MbceacYuVAH7wcWeXx0GiNQ6
 enU3IVG8lOBy6LNZZVSwwFtUdbaFMG1ZzGOh5yAdH15SyKsxHqxyV4iy2MxfU7a8
 Ipc+AjgPHaOLwpRe/19MdOULRkMAyUWhd6nfK+D3VaLX3paB+FKNhXMpR9g5wr+8
 q6jwCuz0ncS4gHKTekCaYceJJ5XV3ie6oDQrr0SLRZZpddEjiWybHS/5w+EZzeUE
 xankg3zqpLTPQrIPusOlmtRPYHKcYQuU3lzcRt7emvIKj5ofTxw0hFfX7X3a+UPp
 ENO89RNBA473XV6ovl6OzK84rKeGSVOVIdBouRxWROV55OcWPHamFgaT2BuSXr7z
 tZwM6v6xMsTAyw==
 =P9x7
 -----END PGP SIGNATURE-----

Merge remote-tracking branch 'remotes/xtensa/tags/20181125-xtensa' into staging

xtensa fixes for 3.1:

- fix register counting logic for linux-user gdbserver;
- provide default memory sizes for XTFPGA boards;
- add missing xtensa patterns to MAINTAINTERS.

# gpg: Signature made Sun 25 Nov 2018 23:07:54 GMT
# gpg:                using RSA key 51F9CC91F83FA044
# gpg: Good signature from "Max Filippov <filippov@cadence.com>"
# gpg:                 aka "Max Filippov <max.filippov@cogentembedded.com>"
# gpg:                 aka "Max Filippov <jcmvbkbc@gmail.com>"
# Primary key fingerprint: 2B67 854B 98E5 327D CDEB  17D8 51F9 CC91 F83F A044

* remotes/xtensa/tags/20181125-xtensa:
  MAINTAINERS: add missing xtensa patterns
  target/xtensa: xtfpga: provide default memory sizes
  target/xtensa: drop num_[core_]regs from dc232b/dc233c configs
  target/xtensa: gdbstub fix register counting

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-11-26 11:07:35 +00:00
Gerd Hoffmann
57ac4a7a28 fmops: fix off-by-one in AR_TABLE and DR_TABLE array size
Cc: P J P <ppandit@redhat.com>
Reported-by: Wangjunqing <wangjunqing@huawei.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Message-id: 20181030082340.17170-1-kraxel@redhat.com
Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2018-11-26 11:15:32 +01:00