[Qemu-commits] [qemu/qemu] 089ada: ps2kbd: default to scancode_set 2, as with KBD_CMD...

[GitHub]

  Branch: refs/heads/master
  Home:   https://github.com/qemu/qemu
  Commit: 089adafdc6be4ea2a25593ce92cb5d66b3c90559
      
https://github.com/qemu/qemu/commit/089adafdc6be4ea2a25593ce92cb5d66b3c90559
  Author: Hervé Poussineau <address@hidden>
  Date:   2016-04-08 (Fri, 08 Apr 2016)

  Changed paths:
    M hw/input/ps2.c

  Log Message:
  -----------
  ps2kbd: default to scancode_set 2, as with KBD_CMD_RESET

This line has been added in commit ef74679a810fe6858f625b9d52b68cc3fc61eb3d with
other initializations. However, scancode set 0 doesn't exist (only 1, 2, 3).
This works well as long as operating system is resetting keyboard, or 
overwriting
the current scancode set with the one it wants.

This fixes IBM 40p firmware, which doesn't bother sending KBD_CMD_RESET or 
KBD_CMD_SCANCODE.

Signed-off-by: Hervé Poussineau <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: ecba19935a3df2db3262834a0f0527a2c7a6b4fc
      
https://github.com/qemu/qemu/commit/ecba19935a3df2db3262834a0f0527a2c7a6b4fc
  Author: Bill Paul <address@hidden>
  Date:   2016-04-08 (Fri, 08 Apr 2016)

  Changed paths:
    M hw/timer/hpet.c

  Log Message:
  -----------
  hw/timer: Revert "hpet: inverse polarity when pin above ISA_NUM_IRQS"

This reverts commit 0d63b2dd31464cfccc80bbeedc24e3863fe4c895.

This change was originally intended to correct the HPET behavior
in conjunction with Linux, however the behavior that it actually creates
is not compatible with the ioapic.c implementation; it used to be
compatible with KVM's own IOAPIC but it is not anymore.

Signed-off-by: Bill Paul <address@hidden>
CC: Paolo Bonzini <address@hidden>
CC: Richard Henderson <address@hidden>
CC: Eduardo Habkost <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: b3f3fdeb956a1fb866939ee1b2d8392b8f536a79
      
https://github.com/qemu/qemu/commit/b3f3fdeb956a1fb866939ee1b2d8392b8f536a79
  Author: Wei Jiangang <address@hidden>
  Date:   2016-04-08 (Fri, 08 Apr 2016)

  Changed paths:
    M docs/memory.txt

  Log Message:
  -----------
  docs: fix typo in memory.txt

The space between 7000 and 8000 is too wide by 1 character.
Also correct the range of vga-window example 0xa0000-0xbffff.

Signed-off-by: Wei Jiangang <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: c0301fcc811432a587f6f94fee08d7965c1671d0
      
https://github.com/qemu/qemu/commit/c0301fcc811432a587f6f94fee08d7965c1671d0
  Author: Eric Blake <address@hidden>
  Date:   2016-04-08 (Fri, 08 Apr 2016)

  Changed paths:
    M nbd/server.c

  Log Message:
  -----------
  nbd: Return correct error for write to read-only export

The NBD Protocol requires that servers should send EPERM for
attempts to write (or trim) a read-only export.  We were
correct for TRIM (blk_co_discard() gave EPERM); but were
manually setting EROFS which then got mapped to EINVAL over
the wire on writes.

Signed-off-by: Eric Blake <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: 8c6597123af4abdd632d79ba5a40856d77a11505
      
https://github.com/qemu/qemu/commit/8c6597123af4abdd632d79ba5a40856d77a11505
  Author: Eric Blake <address@hidden>
  Date:   2016-04-08 (Fri, 08 Apr 2016)

  Changed paths:
    M nbd/nbd-internal.h

  Log Message:
  -----------
  nbd: Avoid bitrot in TRACE() usage

The compiler is smart enough to optimize out 'if (0)', but won't
type-check our printfs if they are hidden behind #if.

Signed-off-by: Eric Blake <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: 7548fe311609cb054c35f2ff3abf49a0aecae3c4
      
https://github.com/qemu/qemu/commit/7548fe311609cb054c35f2ff3abf49a0aecae3c4
  Author: Eric Blake <address@hidden>
  Date:   2016-04-08 (Fri, 08 Apr 2016)

  Changed paths:
    M nbd/client.c
    M nbd/server.c

  Log Message:
  -----------
  nbd: Improve debug traces on little-endian

Print debug tracing messages while data is still in native
ordering, rather than after we've potentially swapped it into
network order for transmission.  Also, it's nice if the server
mentions what it is replying, to correlate it to with what the
client says it is receiving.

Signed-off-by: Eric Blake <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: 332a254b66b7c801ef9a387c23e92dde81bba51a
      
https://github.com/qemu/qemu/commit/332a254b66b7c801ef9a387c23e92dde81bba51a
  Author: Eric Blake <address@hidden>
  Date:   2016-04-08 (Fri, 08 Apr 2016)

  Changed paths:
    M qemu-nbd.c

  Log Message:
  -----------
  qemu-nbd: Document -x option

Commit 3d4b2f9c added -x to force qemu-nbd to use new-style
negotiation, but while it documented it in the man page, it
omitted docs in the --help output.

Signed-off-by: Eric Blake <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: 6ff5816478940c76d3412593e503f644af531d49
      
https://github.com/qemu/qemu/commit/6ff5816478940c76d3412593e503f644af531d49
  Author: Alex Bligh <address@hidden>
  Date:   2016-04-08 (Fri, 08 Apr 2016)

  Changed paths:
    M nbd/client.c

  Log Message:
  -----------
  nbd: Fix NBD unsupported options

nbd-client.c currently fails to handle unsupported options properly.
If during option haggling the server finds an option that is
unsupported, it returns an NBD_REP_ERR_UNSUP reply.

According to nbd's proto.md, the format for such a reply
should be:

  S: 64 bits, 0x3e889045565a9 (magic number for replies)
  S: 32 bits, the option as sent by the client to which this is a reply
  S: 32 bits, reply type (e.g., NBD_REP_ACK for successful completion,
     or NBD_REP_ERR_UNSUP to mark use of an option not known by this server
  S: 32 bits, length of the reply. This may be zero for some replies,
     in which case the next field is not sent
  S: any data as required by the reply (e.g., an export name in the case
     of NBD_REP_SERVER, or optional UTF-8 message for NBD_REP_ERR_*)

However, in nbd-client.c, the reply type was being read, and if it
contained an error, it was bailing out and issuing the next option
request without first reading the length. This meant that the
next option / handshake read had an extra 4 or more bytes of data in it.
In practice, this makes Qemu incompatible with servers that do not
support NBD_OPT_LIST.

To verify this isn't an error in the specification or my reading of
it, replies are sent by the reference implementation here:
 https://github.com/yoe/nbd/blob/66dfb35/nbd-server.c#L1232
and as is evident it always sends a 'datasize' (aka length) 32 bit
word. Unsupported elements are replied to here:
 https://github.com/yoe/nbd/blob/66dfb35/nbd-server.c#L1371

Signed-off-by: Alex Bligh <address@hidden>
Message-Id: <address@hidden>
[rework to ALWAYS consume an optional UTF-8 message from the server]
Signed-off-by: Eric Blake <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: 156f6a10c21c3501aa3938badf5c3f1339c509a2
      
https://github.com/qemu/qemu/commit/156f6a10c21c3501aa3938badf5c3f1339c509a2
  Author: Eric Blake <address@hidden>
  Date:   2016-04-08 (Fri, 08 Apr 2016)

  Changed paths:
    M nbd/server.c

  Log Message:
  -----------
  nbd: Don't kill server when client requests unknown option

nbd-server.c currently fails to handle unsupported options properly.
If during option haggling the client sends an unknown request, the
server kills the connection instead of letting the client try to
fall back to something older.  This is precisely what advertising
NBD_FLAG_FIXED_NEWSTYLE was supposed to fix.

Signed-off-by: Eric Blake <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: dacca04c8dca785ebb02e492b40d7742baeacbb3
      
https://github.com/qemu/qemu/commit/dacca04c8dca785ebb02e492b40d7742baeacbb3
  Author: Paolo Bonzini <address@hidden>
  Date:   2016-04-08 (Fri, 08 Apr 2016)

  Changed paths:
    M nbd/common.c

  Log Message:
  -----------
  nbd: do not hang nbd_wr_syncv if outside a coroutine and no available data

Until commit 1c778ef7 ("nbd: convert to using I/O channels for actual
socket I/O", 2016-02-16), nbd_wr_sync returned -EAGAIN this scenario.
nbd_reply_ready required these semantics because it has two conflicting
requirements:

1) if a reply can be received on the socket, nbd_reply_ready needs
to read the header outside coroutine context to identify _which_
coroutine to enter to process the rest of the reply

2) on the other hand, nbd_reply_ready can find a false positive if
another thread (e.g. a VCPU thread running aio_poll) sneaks in and
calls nbd_reply_ready too.  In this case nbd_reply_ready does nothing
and expects nbd_wr_syncv to return -EAGAIN.

Currently, the solution to the first requirement is to wait in the very
rare case of a read() that doesn't retrieve the reply header in its
entirety; this is what nbd_wr_syncv does by calling qio_channel_wait().
However, the unconditional call to qio_channel_wait() breaks the second
requirement.  To fix this, the patch makes nbd_wr_syncv return -EAGAIN
if done is zero, similar to the code before commit 1c778ef7.

This is okay because NBD client-side negotiation is the only other case
that calls nbd_wr_syncv outside a coroutine, and it places the socket
in blocking mode.  On the other hand, it is a bit unpleasant to put
this in nbd_wr_syncv(), because the function is used by both client
and server.

The full fix would be to add a counter to NbdClientSession for how
many bytes have been filled in s->reply.  Then a reply can be filled
by multiple separate invocations of nbd_reply_ready and the
qio_channel_wait() call can be removed completely.  Something to
consider for 2.7...

Reported-by: Changlong Xie <address@hidden>
Reviewed-by: Daniel P. Berrange <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: 1a5512bb7ef73036a406727397fb58c640074321
      
https://github.com/qemu/qemu/commit/1a5512bb7ef73036a406727397fb58c640074321
  Author: Gonglei <address@hidden>
  Date:   2016-04-08 (Fri, 08 Apr 2016)

  Changed paths:
    M hw/ppc/spapr.c

  Log Message:
  -----------
  spapr: fix possible Negative array index read

fix CID 1351391.

Signed-off-by: Gonglei <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: 696b55017d90b3237ca9d656aa4904d6b5c46c7a
      
https://github.com/qemu/qemu/commit/696b55017d90b3237ca9d656aa4904d6b5c46c7a
  Author: Gonglei <address@hidden>
  Date:   2016-04-08 (Fri, 08 Apr 2016)

  Changed paths:
    M backends/hostmem-file.c

  Log Message:
  -----------
  hostmem-file: fix memory leak

Signed-off-by: Gonglei <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: 7e6bd36d61129feb7f667cb09ffec1b7b54b971c
      
https://github.com/qemu/qemu/commit/7e6bd36d61129feb7f667cb09ffec1b7b54b971c
  Author: Emilio G. Cota <address@hidden>
  Date:   2016-04-08 (Fri, 08 Apr 2016)

  Changed paths:
    M translate-all.c

  Log Message:
  -----------
  translate-all: add missing fold of tb_ctx into tcg_ctx

Since 5e5f07e08 "TCG: Move translation block variables
to new context inside tcg_ctx: tb_ctx" on Feb 1 2013, compilation
of usermode + TB_DEBUG_CHECK has been broken. Fix it.

Signed-off-by: Emilio G. Cota <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: 57a6c059a632587f152c5bf0f5019c23a3fa3a8c
      
https://github.com/qemu/qemu/commit/57a6c059a632587f152c5bf0f5019c23a3fa3a8c
  Author: Changlong Xie <address@hidden>
  Date:   2016-04-08 (Fri, 08 Apr 2016)

  Changed paths:
    M tests/.gitignore

  Log Message:
  -----------
  tests: ignore test-logging

Commit 3514552e added a new test, but did not mark it for
exclusion in .gitignore.

Signed-off-by: Changlong Xie <address@hidden>
Reviewed-by: Eric Blake <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: 44d066a2f770ee9d61fd1c2a609bdf2a994dfdf7
      
https://github.com/qemu/qemu/commit/44d066a2f770ee9d61fd1c2a609bdf2a994dfdf7
  Author: Paolo Bonzini <address@hidden>
  Date:   2016-04-08 (Fri, 08 Apr 2016)

  Changed paths:
    M target-i386/helper.c

  Log Message:
  -----------
  target-i386: check for PKU even for non-writable pages

Xiao Guangrong ran kvm-unit-tests on an actual machine with PKU and
found that it fails:

test pte.p pte.user pde.p pde.user pde.a pde.pse pkru.wd pkey=1 user write 
efer.nx cr4.pke: FAIL: error code 27 expected 7
Dump mapping: address: 0x123400000000
------L4: 2ebe007
------L3: 2ebf007
------L2: 8000000020000a5

(All failures are combinations of "pde.user pde.p pkru.wd pkey=1",
plus either "pde.pse" or "pte.p pte.user", plus one of "user cr0.wp",
"cr0.wp" or "user", plus unimportant bits such as accessed/dirty or
efer.nx).

So PFEC.PKEY is set even if the ordinary check failed (which it did
because pde.w is zero).  Adjust QEMU to match behavior of silicon.

Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: 28ee01269e910c68fb75ff780c9d84e0c34e0d66
      
https://github.com/qemu/qemu/commit/28ee01269e910c68fb75ff780c9d84e0c34e0d66
  Author: Peter Maydell <address@hidden>
  Date:   2016-04-08 (Fri, 08 Apr 2016)

  Changed paths:
    M backends/hostmem-file.c
    M docs/memory.txt
    M hw/input/ps2.c
    M hw/ppc/spapr.c
    M hw/timer/hpet.c
    M nbd/client.c
    M nbd/common.c
    M nbd/nbd-internal.h
    M nbd/server.c
    M qemu-nbd.c
    M target-i386/helper.c
    M tests/.gitignore
    M translate-all.c

  Log Message:
  -----------
  Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into staging

* NBD fixes from Alex and Eric
* Debug code bitrot from Emilio
* HPET fix from Bill
* ps2kbd fix from Hervé
* PKU fix from myself
* Coverity fixes from Gonglei
* More memory.txt update from Jiangang
* .gitignore maintenance from Changlong

# gpg: Signature made Thu 07 Apr 2016 23:08:12 BST using RSA key ID 78C7AE83
# gpg: Good signature from "Paolo Bonzini <address@hidden>"
# gpg:                 aka "Paolo Bonzini <address@hidden>"

* remotes/bonzini/tags/for-upstream:
  target-i386: check for PKU even for non-writable pages
  tests: ignore test-logging
  translate-all: add missing fold of tb_ctx into tcg_ctx
  hostmem-file: fix memory leak
  spapr: fix possible Negative array index read
  nbd: do not hang nbd_wr_syncv if outside a coroutine and no available data
  nbd: Don't kill server when client requests unknown option
  nbd: Fix NBD unsupported options
  qemu-nbd: Document -x option
  nbd: Improve debug traces on little-endian
  nbd: Avoid bitrot in TRACE() usage
  nbd: Return correct error for write to read-only export
  docs: fix typo in memory.txt
  hw/timer: Revert "hpet: inverse polarity when pin above ISA_NUM_IRQS"
  ps2kbd: default to scancode_set 2, as with KBD_CMD_RESET

Signed-off-by: Peter Maydell <address@hidden>


Compare: https://github.com/qemu/qemu/compare/ead5268f2166...28ee01269e91