aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2018-07-22linux-user/ppc: Implement swapcontext syscallRichard Henderson
This allows the tests generated by debian-powerpc-user-cross to function properly, especially tests/test-coroutine. Technically this syscall is available to both ppc32 and ppc64, but only ppc32 glibc actually uses it. Thus the ppc64 path is untested. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Tested-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <20180718200648.22529-1-richard.henderson@linaro.org>
2018-07-22linux-user: fix ELF load alignment errorLaurent Vivier
When we try to use some targets on ppc64, it can happen the target doesn't support the host page size to align ELF load sections and fails with: ELF load command alignment not page-aligned Since commit a70daba3771 ("linux-user: Tell guest about big host page sizes") the host page size is used to align ELF sections, but this doesn't work if the alignment required by the load section is smaller than the host one. For these cases, we continue to use the TARGET_PAGE_SIZE instead of the host one. I have tested this change on ppc64, and it fixes qemu linux-user for: s390x, m68k, i386, arm, aarch64, hppa and I have tested it doesn't break the following targets: x86_64, mips64el, sh4 mips and mipsel abort, but I think for another reason. Signed-off-by: Laurent Vivier <laurent@vivier.eu> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> [lv: fixed "info->alignment = 0"] Message-Id: <20180716195349.29959-1-laurent@vivier.eu>
2018-07-20Merge remote-tracking branch 'remotes/rth/tags/pull-tcg-20180719' into stagingPeter Maydell
Fix aarch64 host vector mul # gpg: Signature made Fri 20 Jul 2018 04:58:32 BST # gpg: using RSA key 64DF38E8AF7E215F # gpg: Good signature from "Richard Henderson <richard.henderson@linaro.org>" # Primary key fingerprint: 7A48 1E78 868B 4DB6 A85A 05C0 64DF 38E8 AF7E 215F * remotes/rth/tags/pull-tcg-20180719: tcg/aarch64: limit mul_vec size Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-07-20Merge remote-tracking branch 'remotes/jasowang/tags/net-pull-request' into ↵Peter Maydell
staging # gpg: Signature made Fri 20 Jul 2018 01:40:43 BST # gpg: using RSA key EF04965B398D6211 # gpg: Good signature from "Jason Wang (Jason Wang on RedHat) <jasowang@redhat.com>" # gpg: WARNING: This key is not certified with sufficiently trusted signatures! # gpg: It is not certain that the signature belongs to the owner. # Primary key fingerprint: 215D 46F4 8246 689E C77F 3562 EF04 965B 398D 6211 * remotes/jasowang/tags/net-pull-request: tap: fix memory leak on success to create a tap device e1000e: Prevent MSI/MSI-X storms Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-07-20tap: fix memory leak on success to create a tap deviceYunjian Wang
The memory leak on success to create a tap device. And the nfds and nvhosts may not be the same and need to be processed separately. Fixes: 07825977 ("tap: fix memory leak on failure to create a multiqueue tap device") Fixes: 264986e2 ("tap: multiqueue support") Cc: qemu-stable@nongnu.org Signed-off-by: Yunjian Wang <wangyunjian@huawei.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2018-07-20e1000e: Prevent MSI/MSI-X stormsJan Kiszka
Only signal MSI/MSI-X events on rising edges. So far we re-triggered the interrupt sources even if the guest did no consumed the pending one, easily causing interrupt storms. Issue was observable with Linux 4.16 e1000e driver when MSI-X was used. Vector 2 was causing interrupt storms after the driver activated the device. Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2018-07-19Merge remote-tracking branch 'remotes/stefanha/tags/tracing-pull-request' ↵Peter Maydell
into staging Pull request Contains a fix to use double-dash consistently with tracing command-line options in documentation and output. # gpg: Signature made Thu 19 Jul 2018 17:24:51 BST # gpg: using RSA key 9CA4ABB381AB73C8 # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>" # gpg: aka "Stefan Hajnoczi <stefanha@gmail.com>" # Primary key fingerprint: 8695 A8BF D3F9 7CDA AC35 775A 9CA4 ABB3 81AB 73C8 * remotes/stefanha/tags/tracing-pull-request: tracing: Use double-dash spelling for trace option Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-07-19Merge remote-tracking branch ↵Peter Maydell
'remotes/alistair/tags/pull-riscv-pull-20180719' into staging riscv: Fix introspection problems This is based on Thomas's work fixing introspection problems [1] and applied to the RISC-V port. 1: https://lists.gnu.org/archive/html/qemu-devel/2018-07/msg03261.html # gpg: Signature made Thu 19 Jul 2018 17:06:07 BST # gpg: using RSA key 21E10D29DF977054 # gpg: Good signature from "Alistair Francis <alistair@alistair23.me>" # gpg: WARNING: This key is not certified with sufficiently trusted signatures! # gpg: It is not certain that the signature belongs to the owner. # Primary key fingerprint: F6C4 AC46 D493 4868 D3B8 CE8F 21E1 0D29 DF97 7054 * remotes/alistair/tags/pull-riscv-pull-20180719: spike: Fix crash when introspecting the device riscv_hart: Fix crash when introspecting the device virt: Fix crash when introspecting the device sifive_u: Fix crash when introspecting the device sifive_e: Fix crash when introspecting the device Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-07-19tcg/aarch64: limit mul_vec sizeAlex Bennée
In AdvSIMD we can only do 32x32 integer multiples although SVE is capable of larger 64 bit multiples. As a result we can end up generating invalid opcodes. Fix this by only reprting we can emit mul vector ops if the size is small enough. Fixes a crash on: sve-all-short-v8.3+sve@vq3/insn_mul_z_zi___INC.risu.bin When running on AArch64 hardware. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20180719154248.29669-1-alex.bennee@linaro.org> [rth: Removed the tcg_debug_assert -- there are plenty of other cases that we do not diagnose within the insn encoding helpers.] Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2018-07-19spike: Fix crash when introspecting the deviceAlistair Francis
Use the new object_initialize_child() and sysbus_init_child_obj() to fix the issue. Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Suggested-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Michael Clark <mjc@sifive.com> Reviewed-by: Thomas Huth <thuth@redhat.com>
2018-07-19riscv_hart: Fix crash when introspecting the deviceAlistair Francis
Use the new object_initialize_child() and sysbus_init_child_obj() to fix the issue. Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Suggested-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Michael Clark <mjc@sifive.com> Reviewed-by: Thomas Huth <thuth@redhat.com>
2018-07-19virt: Fix crash when introspecting the deviceAlistair Francis
Use the new object_initialize_child() and sysbus_init_child_obj() to fix the issue. Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Suggested-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Michael Clark <mjc@sifive.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
2018-07-19sifive_u: Fix crash when introspecting the deviceAlistair Francis
Use the new object_initialize_child() and sysbus_init_child_obj() to fix the issue. Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Suggested-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Michael Clark <mjc@sifive.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
2018-07-19sifive_e: Fix crash when introspecting the deviceAlistair Francis
Use the new object_initialize_child() and sysbus_init_child_obj() to fix the issue. Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Suggested-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Michael Clark <mjc@sifive.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
2018-07-19Merge remote-tracking branch 'remotes/stefanha/tags/block-pull-request' into ↵Peter Maydell
staging Pull request This fix prevents hangs when a drive leaves a throttling group. # gpg: Signature made Thu 19 Jul 2018 15:28:37 BST # gpg: using RSA key 9CA4ABB381AB73C8 # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>" # gpg: aka "Stefan Hajnoczi <stefanha@gmail.com>" # Primary key fingerprint: 8695 A8BF D3F9 7CDA AC35 775A 9CA4 ABB3 81AB 73C8 * remotes/stefanha/tags/block-pull-request: throttle-groups: fix hang when group member leaves Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-07-19Merge remote-tracking branch 'remotes/cohuck/tags/s390x-20180719' into stagingPeter Maydell
don't segfault when trying to baseline an odd cpu model # gpg: Signature made Thu 19 Jul 2018 12:39:05 BST # gpg: using RSA key DECF6B93C6F02FAF # gpg: Good signature from "Cornelia Huck <conny@cornelia-huck.de>" # gpg: aka "Cornelia Huck <huckc@linux.vnet.ibm.com>" # gpg: aka "Cornelia Huck <cornelia.huck@de.ibm.com>" # gpg: aka "Cornelia Huck <cohuck@kernel.org>" # gpg: aka "Cornelia Huck <cohuck@redhat.com>" # Primary key fingerprint: C3D0 D66D C362 4FF6 A8C0 18CE DECF 6B93 C6F0 2FAF * remotes/cohuck/tags/s390x-20180719: s390x/cpumodel: fix segmentation fault when baselining models Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-07-19tracing: Use double-dash spelling for trace optionYaowei Bai
The '-trace' and '--trace' spellings are only both supported in qemu binary, while for qemu-nbd or qemu-img only '--trace' spelling is supported. So for the consistency of trace option invocation, we should use double-dash spelling in our documentation. This's also mentioned in https://wiki.qemu.org/BiteSizedTasks#Consistent_option_usage_in_documentation . Signed-off-by: Yaowei Bai <baiyaowei@cmss.chinamobile.com> Reviewed-by: Eric Blake <eblake@redhat.com> Message-id: 1530674247-31200-1-git-send-email-baiyaowei@cmss.chinamobile.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2018-07-19throttle-groups: fix hang when group member leavesStefan Hajnoczi
Throttle groups consist of members sharing one throttling state (including bps/iops limits). Round-robin scheduling is used to ensure fairness. If a group member already has a timer pending then other groups members do not schedule their own timers. The next group member will have its turn when the existing timer expires. A hang may occur when a group member leaves while it had a timer scheduled. Although the code carefully removes the group member from the round-robin list, it does not schedule the next member. Therefore remaining members continue to wait for the removed member's timer to expire. This patch schedules the next request if a timer is pending. Unfortunately the actual bug is a race condition that I've been unable to capture in a test case. Sometimes drive2 hangs when drive1 is removed from the throttling group: $ qemu ... -drive if=none,id=drive1,cache=none,format=qcow2,file=data1.qcow2,iops=100,group=foo \ -device virtio-blk-pci,id=virtio-blk-pci0,drive=drive1 \ -drive if=none,id=drive2,cache=none,format=qcow2,file=data2.qcow2,iops=10,group=foo \ -device virtio-blk-pci,id=virtio-blk-pci1,drive=drive2 (guest-console1)# fio -filename /dev/vda 4k-seq-read.job (guest-console2)# fio -filename /dev/vdb 4k-seq-read.job (qmp) {"execute": "block_set_io_throttle", "arguments": {"device": "drive1","bps": 0,"bps_rd": 0,"bps_wr": 0,"iops": 0,"iops_rd": 0,"iops_wr": 0}} Reported-by: Nini Gu <ngu@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Message-id: 20180704145410.794-1-stefanha@redhat.com RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=1535914 Cc: Alberto Garcia <berto@igalia.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2018-07-18s390x/cpumodel: fix segmentation fault when baselining modelsDavid Hildenbrand
Usually, when baselining two CPU models, whereby one of them has base CPU features disabled (e.g. z14-base,msa=off), we fallback to an older model that did not have these features in the base model. We always try to create a "sane" CPU model (as far as possible), and one part of it is that removing base features is no good and to be avoided. Now, if we disable base features that were part of a z900, we're out of luck. We won't find a CPU model and QEMU will segfault. This is a scenario that should never happen in real life, but it can be used to crash QEMU. So let's properly report an error if we baseline e.g.: { "execute": "query-cpu-model-baseline", "arguments" : { "modela": { "name": "z14-base", "props": {"esan3" : false}}, "modelb": { "name": "z14"}} } Instead of segfaulting. Signed-off-by: David Hildenbrand <david@redhat.com> Message-Id: <20180718092330.19465-1-david@redhat.com> Acked-by: Christian Borntraeger <borntraeger@de.ibm.com> Signed-off-by: Cornelia Huck <cohuck@redhat.com>
2018-07-17Update version for v3.0.0-rc1 releasev3.0.0-rc1Peter Maydell
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-07-17Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into stagingPeter Maydell
Bug fixes. # gpg: Signature made Tue 17 Jul 2018 16:06:07 BST # gpg: using RSA key BFFBD25F78C7AE83 # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * remotes/bonzini/tags/for-upstream: Document command line options with single dash opts: remove redundant check for NULL parameter i386: only parse the initrd_filename once for multiboot modules i386: fix regression parsing multiboot initrd modules virtio-scsi: fix hotplug ->reset() vs event race qdev: add HotplugHandler->post_plug() callback hw/char/serial: retry write if EAGAIN PC Chipset: Improve serial divisor calculation vhost-user-test: added proper TestServer *dest initialization in test_migrate() hyperv: ensure VP index equal to QEMU cpu_index hyperv: rename vcpu_id to vp_index accel: Fix typo and grammar in comment dump: add kernel_gs_base to QEMU CPU state Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-07-17Document command line options with single dashBALATON Zoltan
QEMU options have a single dash (but also work as double dash for convenience and compatibility). Most options are listed with single dash in command line help but some were listed with two dashes. Normalize these to have the same format as the others. Left --preconfig as that is mentioned as double dash everywhere so I assume that is the preferred form for that. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Acked-by: Thomas Huth <thuth@redhat.com> Message-Id: <20180716193312.A5BA17456B9@zero.eik.bme.hu> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-07-17opts: remove redundant check for NULL parameterDaniel P. Berrangé
No callers of get_opt_value() pass in a NULL for the "value" parameter, so the check is redundant. Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> Message-Id: <20180514171913.17664-4-berrange@redhat.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Tested-by: Roman Kagan <rkagan@virtuozzo.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-07-17i386: only parse the initrd_filename once for multiboot modulesDaniel P. Berrangé
The multiboot code parses the initrd_filename twice, first to count how many entries there are, and second to process each entry. This changes the first loop to store the parse module names in a list, and the second loop can now use these names. This avoids having to pass NULL to the get_opt_value() method which means it can safely assume a non-NULL param. Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> Message-Id: <20180514171913.17664-3-berrange@redhat.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Tested-by: Roman Kagan <rkagan@virtuozzo.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-07-17i386: fix regression parsing multiboot initrd modulesDaniel P. Berrangé
The logic for parsing the multiboot initrd modules was messed up in commit 950c4e6c94b15cd0d8b63891dddd7a8dbf458e6a Author: Daniel P. Berrangé <berrange@redhat.com> Date: Mon Apr 16 12:17:43 2018 +0100 opts: don't silently truncate long option values Causing the length to be undercounter, and the number of modules over counted. It also passes NULL to get_opt_value() which was not robust at accepting a NULL value. Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> Message-Id: <20180514171913.17664-2-berrange@redhat.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Tested-by: Roman Kagan <rkagan@virtuozzo.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-07-17hw/arm/xlnx-zynqmp: Fix crash when introspecting the "xlnx, zynqmp" deviceThomas Huth
QEMU currently crashes when e.g. doing something like this: echo "{'execute':'qmp_capabilities'} {'execute':'device-list-properties'," \ "'arguments':{'typename':'xlnx,zynqmp'}}" \ "{'execute': 'human-monitor-command', " \ "'arguments': {'command-line': 'info qtree'}}" \ | aarch64-softmmu/qemu-system-aarch64 -M none,accel=qtest -qmp stdio Use the new object_initialize_child() and sysbus_init_child_obj() functions to get the refernce counting of the child objects right, so that they are properly cleaned up when the parent gets destroyed. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 1531745974-17187-18-git-send-email-thuth@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-07-17hw/display/xlnx_dp: Move problematic code from instance_init to realizePaolo Bonzini
aux_create_slave() calls qdev_init_nofail() which in turn "realizes" the corresponding object. This is unlike qdev_create(), and it is wrong because qdev_init_nofail() must not be called from an instance_init function. Move qdev_init_nofail() and the subsequent aux_map_slave into the caller's realize function. There are two more bugs that needs to be fixed here, too, where the objects are created but not added as children. Therefore when you call object_unparent on them, nothing happens. In particular dpcd and edid give you an infinite loop in bus_unparent, because device_unparent is not called and does not remove them from the list of devices on the bus. Reported-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Signed-off-by: Thomas Huth <thuth@redhat.com> Message-id: 1531745974-17187-17-git-send-email-thuth@redhat.com [thuth: Added Paolo's fixup for the dpcd and edid unparenting] Signed-off-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-07-17hw/arm/stm32f205_soc: Fix introspection problem with 'stm32f205-soc' deviceThomas Huth
Valgrind complains: echo "{'execute':'qmp_capabilities'} {'execute':'device-list-properties'," \ "'arguments':{'typename':'stm32f205-soc'}}" \ "{'execute': 'human-monitor-command', " \ "'arguments': {'command-line': 'info qtree'}}" | \ valgrind -q aarch64-softmmu/qemu-system-aarch64 -M none,accel=qtest -qmp stdio [...] ==28531== Invalid read of size 8 ==28531== at 0x6185BA: qdev_print (qdev-monitor.c:686) ==28531== by 0x6185BA: qbus_print (qdev-monitor.c:719) ==28531== by 0x452B38: handle_hmp_command (monitor.c:3446) [...] Fix it with the new sysbus_init_child_obj() function. Signed-off-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 1531745974-17187-16-git-send-email-thuth@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-07-17hw/arm/allwinner-a10: Fix introspection problem with 'allwinner-a10'Thomas Huth
Valgrind complains: echo "{'execute':'qmp_capabilities'} {'execute':'device-list-properties'," \ "'arguments':{'typename':'allwinner-a10'}}" \ "{'execute': 'human-monitor-command', " \ "'arguments': {'command-line': 'info qtree'}}" | \ valgrind -q aarch64-softmmu/qemu-system-aarch64 -M none,accel=qtest -qmp stdio [...] ==32519== Invalid read of size 8 ==32519== at 0x61869A: qdev_print (qdev-monitor.c:686) ==32519== by 0x61869A: qbus_print (qdev-monitor.c:719) ==32519== by 0x452B38: handle_hmp_command (monitor.c:3446) [...] Use object_initialize_child() and sysbus_init_child_obj() to fix the issue. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com> Message-id: 1531745974-17187-15-git-send-email-thuth@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-07-17hw/*/realview: Fix introspection problem with 'realview_mpcore' & 'realview_gic'Thomas Huth
echo "{'execute':'qmp_capabilities'} {'execute':'device-list-properties'," \ "'arguments':{'typename':'realview_mpcore'}}" \ "{'execute': 'human-monitor-command', " \ "'arguments': {'command-line': 'info qtree'}}" | \ valgrind -q aarch64-softmmu/qemu-system-aarch64 -M none,accel=qtest -qmp stdio [...] ==2654== Invalid read of size 8 ==2654== at 0x61878A: qdev_print (qdev-monitor.c:686) ==2654== by 0x61878A: qbus_print (qdev-monitor.c:719) ==2654== by 0x452B38: handle_hmp_command (monitor.c:3446) ==2654== by 0x452D70: qmp_human_monitor_command (monitor.c:821) [...] Use sysbus_init_child_obj() to fix it. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com> Message-id: 1531745974-17187-14-git-send-email-thuth@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-07-17hw/cpu/arm11mpcore: Fix introspection problem with 'arm11mpcore_priv'Thomas Huth
Valgrind reports an error here: echo "{'execute':'qmp_capabilities'} {'execute':'device-list-properties'," \ "'arguments':{'typename':'arm11mpcore_priv'}}" \ "{'execute': 'human-monitor-command', " \ "'arguments': {'command-line': 'info qtree'}}" | \ valgrind -q aarch64-softmmu/qemu-system-aarch64 -M none,accel=qtest -qmp stdio [...] ==3145== Invalid read of size 8 ==3145== at 0x61873A: qdev_print (qdev-monitor.c:686) ==3145== by 0x61873A: qbus_print (qdev-monitor.c:719) [...] Use sysbus_init_child_obj() to fix it. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 1531745974-17187-13-git-send-email-thuth@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-07-17hw/arm/fsl-imx31: Fix introspection problem with the "fsl, imx31" deviceThomas Huth
Running QEMU with valgrind indicates a problem here: echo "{'execute':'qmp_capabilities'} {'execute':'device-list-properties'," \ "'arguments':{'typename':'fsl,imx31'}}" \ "{'execute': 'human-monitor-command', " \ "'arguments': {'command-line': 'info qtree'}}" | \ valgrind -q aarch64-softmmu/qemu-system-aarch64 -M none,accel=qtest -qmp stdio [...] ==26172== Invalid read of size 8 ==26172== at 0x6191FA: qdev_print (qdev-monitor.c:686) ==26172== by 0x6191FA: qbus_print (qdev-monitor.c:719) [...] Use the new sysbus_init_child_obj() to make sure that the objects are cleaned up correctly when the parent gets destroyed. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com> Message-id: 1531745974-17187-12-git-send-email-thuth@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-07-17hw/arm/fsl-imx25: Fix introspection problem with the "fsl, imx25" deviceThomas Huth
Running QEMU with valgrind indicates a problem here: echo "{'execute':'qmp_capabilities'} {'execute':'device-list-properties'," \ "'arguments':{'typename':'fsl,imx25'}}" \ "{'execute': 'human-monitor-command', " \ "'arguments': {'command-line': 'info qtree'}}" | \ valgrind -q aarch64-softmmu/qemu-system-aarch64 -M none,accel=qtest -qmp stdio [...] ==26724== Invalid read of size 8 ==26724== at 0x6190DA: qdev_print (qdev-monitor.c:686) ==26724== by 0x6190DA: qbus_print (qdev-monitor.c:719) [...] Use the new sysbus_init_child_obj() to make sure that the objects are cleaned up correctly when the parent gets destroyed. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com> Message-id: 1531745974-17187-11-git-send-email-thuth@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-07-17hw/arm/fsl-imx7: Fix introspection problems with the "fsl, imx7" deviceThomas Huth
Running QEMU with valgrind indicates a problem here: echo "{'execute':'qmp_capabilities'} {'execute':'device-list-properties'," \ "'arguments':{'typename':'fsl,imx7'}}" \ "{'execute': 'human-monitor-command', " \ "'arguments': {'command-line': 'info qtree'}}" | \ valgrind -q aarch64-softmmu/qemu-system-aarch64 -M none,accel=qtest -qmp stdio [...] ==27284== Invalid read of size 8 ==27284== at 0x618F7A: qdev_print (qdev-monitor.c:686) ==27284== by 0x618F7A: qbus_print (qdev-monitor.c:719) ==27284== by 0x452B38: handle_hmp_command (monitor.c:3446) [...] Use the new sysbus_init_child_obj() and object_initialize_child() to make sure that the objects are removed correctly when the parent gets destroyed. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com> Message-id: 1531745974-17187-10-git-send-email-thuth@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-07-17hw/arm/fsl-imx6: Fix introspection problems with the "fsl, imx6" deviceThomas Huth
Running QEMU with valgrind indicates a problem here: echo "{'execute':'qmp_capabilities'} {'execute':'device-list-properties'," \ "'arguments':{'typename':'fsl,imx6'}}" \ "{'execute': 'human-monitor-command', " \ "'arguments': {'command-line': 'info qtree'}}" | \ valgrind -q aarch64-softmmu/qemu-system-aarch64 -M none,accel=qtest -qmp stdio [...] ==32417== Invalid read of size 8 ==32417== at 0x618A7A: qdev_print (qdev-monitor.c:686) ==32417== by 0x618A7A: qbus_print (qdev-monitor.c:719) ==32417== by 0x452B38: handle_hmp_command (monitor.c:3446) [...] Use the new sysbus_init_child_obj() and object_initialize_child() to make sure that the objects are removed correctly when the parent gets destroyed. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com> Message-id: 1531745974-17187-9-git-send-email-thuth@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-07-17hw/cpu/a9mpcore: Fix introspection problems with the "a9mpcore_priv" deviceThomas Huth
Running QEMU with valgrind indicates a problem here: echo "{'execute':'qmp_capabilities'} {'execute':'device-list-properties'," \ "'arguments':{'typename':'a9mpcore_priv'}}" \ "{'execute': 'human-monitor-command', " \ "'arguments': {'command-line': 'info qtree'}}" | \ valgrind -q aarch64-softmmu/qemu-system-aarch64 -M none,accel=qtest -qmp stdio [...] ==30996== Invalid read of size 8 ==30996== at 0x6185DA: qdev_print (qdev-monitor.c:686) ==30996== by 0x6185DA: qbus_print (qdev-monitor.c:719) ==30996== by 0x452B38: handle_hmp_command (monitor.c:3446) [...] Use the new sysbus_init_child_obj() function to make sure that the objects are cleaned up correctly when the parent gets destroyed. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 1531745974-17187-8-git-send-email-thuth@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-07-17hw/arm/msf2-soc: Fix introspection problem with the "msf2-soc" deviceThomas Huth
Valgrind currently reports a problem when running QEMU like this: echo "{'execute':'qmp_capabilities'} {'execute':'device-list-properties'," \ "'arguments':{'typename':'msf2-soc'}}" \ "{'execute': 'human-monitor-command', " \ "'arguments': {'command-line': 'info qtree'}}" | \ valgrind -q aarch64-softmmu/qemu-system-aarch64 -M none,accel=qtest -qmp stdio [...] ==23097== Invalid read of size 8 ==23097== at 0x6192AA: qdev_print (qdev-monitor.c:686) ==23097== by 0x6192AA: qbus_print (qdev-monitor.c:719) [...] Use the new sysbus_init_child_obj() function to make sure that the child objects are cleaned up correctly when the parent gets destroyed. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com> Message-id: 1531745974-17187-7-git-send-email-thuth@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-07-17hw/cpu/a15mpcore: Fix introspection problem with the a15mpcore_priv deviceThomas Huth
There is a memory management problem when introspecting the a15mpcore_priv device. It can be seen with valgrind when running QEMU like this: echo "{'execute':'qmp_capabilities'} {'execute':'device-list-properties'," \ "'arguments':{'typename':'a15mpcore_priv'}}"\ "{'execute': 'human-monitor-command', " \ "'arguments': {'command-line': 'info qtree'}}" | \ valgrind -q aarch64-softmmu/qemu-system-aarch64 -M none,accel=qtest -qmp stdio {"QMP": {"version": {"qemu": {"micro": 50, "minor": 12, "major": 2}, "package": "build-all"}, "capabilities": []}} {"return": {}} {"return": [{"name": "num-cpu", "type": "uint32"}, {"name": "num-irq", "type": "uint32"}, {"name": "a15mp-priv-container[0]", "type": "child<qemu:memory-region>"}]} ==24978== Invalid read of size 8 ==24978== at 0x618EBA: qdev_print (qdev-monitor.c:686) ==24978== by 0x618EBA: qbus_print (qdev-monitor.c:719) [...] Use the new sysbus_init_child_obj() function to make sure that we get the reference counting of the child objects right. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 1531745974-17187-6-git-send-email-thuth@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-07-17hw/arm/armv7: Fix crash when introspecting the "iotkit" deviceThomas Huth
QEMU currently crashes when introspecting the "iotkit" device and runnint "info qtree" afterwards, e.g. when running QEMU like this: echo "{'execute':'qmp_capabilities'} {'execute':'device-list-properties'," \ "'arguments':{'typename':'iotkit'}}" "{'execute': 'human-monitor-command', " \ "'arguments': {'command-line': 'info qtree'}}" | \ aarch64-softmmu/qemu-system-aarch64 -M none,accel=qtest -qmp stdio Use the new functions object_initialize_child() and sysbus_init_child_obj() to make sure that all objects get cleaned up correctly when the instances are destroyed. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 1531745974-17187-5-git-send-email-thuth@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-07-17hw/arm/bcm2836: Fix crash with device_add bcm2837 on unsupported machinesThomas Huth
When trying to "device_add bcm2837" on a machine that is not suitable for this device, you can quickly crash QEMU afterwards, e.g. with "info qtree": echo "{'execute':'qmp_capabilities'} {'execute':'device_add', " \ "'arguments':{'driver':'bcm2837'}} {'execute': 'human-monitor-command', " \ "'arguments': {'command-line': 'info qtree'}}" | \ aarch64-softmmu/qemu-system-aarch64 -M integratorcp,accel=qtest -S -qmp stdio {"QMP": {"version": {"qemu": {"micro": 50, "minor": 12, "major": 2}, "package": "build-all"}, "capabilities": []}} {"return": {}} {"error": {"class": "GenericError", "desc": "Device 'bcm2837' can not be hotplugged on this machine"}} Segmentation fault (core dumped) The qdev_set_parent_bus() from instance_init adds a link to the child devices which is not valid anymore after the bcm2837 instance has been destroyed. Unfortunately, the child devices do not get destroyed / unlinked correctly because both object_initialize() and object_property_add_child() increase the reference count of the child objects by one, but only one reference is dropped when the parent gets removed. So let's use the new functions object_initialize_child() and sysbus_init_child_obj() instead to create the objects, which will take care of creating the child objects with the correct reference count of one. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com> Message-id: 1531745974-17187-4-git-send-email-thuth@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-07-17hw/core/sysbus: Add a function for creating and attaching an objectThomas Huth
A lot of functions are initializing an object and attach it immediately afterwards to the system bus. Provide a common function for this, which also uses object_initialize_child() to make sure that the reference counter is correctly initialized to 1 afterwards. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 1531745974-17187-3-git-send-email-thuth@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-07-17qom/object: Add a new function object_initialize_child()Thomas Huth
A lot of code is using the object_initialize() function followed by a call to object_property_add_child() to add the newly initialized object as a child of the current object. Both functions increase the reference counter of the new object, but many spots that call these two functions then forget to drop one of the superfluous references. So the newly created object is often not cleaned up correctly when the parent is destroyed. In the worst case, this can cause crashes, e.g. because device objects are not correctly removed from their parent_bus. Since this is a common pattern between many code spots, let's introduce a new function that takes care of calling all three required initialization functions, first object_initialize(), then object_property_add_child() and finally object_unref(). And since the function does a similar job like object_new_with_props(), also allow to set additional properties via varargs, and use user_creatable_complete() to make sure that the functions can be used similarly. And while we're at object.h, also fix some copy-n-paste errors in the comments there ("to store the area" --> "to store the error"). Signed-off-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Message-id: 1531745974-17187-2-git-send-email-thuth@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-07-17Merge remote-tracking branch 'remotes/mdroth/tags/qga-pull-2018-07-16-tag' ↵Peter Maydell
into staging qemu-ga patch queue for hard-freeze * fix file descriptor leak in suspend command * fix leak in guest-get-fsinfo # gpg: Signature made Mon 16 Jul 2018 22:41:41 BST # gpg: using RSA key 3353C9CEF108B584 # gpg: Good signature from "Michael Roth <flukshun@gmail.com>" # gpg: aka "Michael Roth <mdroth@utexas.edu>" # gpg: aka "Michael Roth <mdroth@linux.vnet.ibm.com>" # Primary key fingerprint: CEAC C9E1 5534 EBAB B82D 3FA0 3353 C9CE F108 B584 * remotes/mdroth/tags/qga-pull-2018-07-16-tag: qga: fix file descriptor leak qga: fix 'driver' leak in guest-get-fsinfo Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-07-16qga: fix file descriptor leakPaolo Bonzini
The file descriptor for /sys/power/state was never closed. Reported by Coverity. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2018-07-16qga: fix 'driver' leak in guest-get-fsinfoMarc-André Lureau
'driver' is leaked when the loop is not broken. Leak introduced by commit 743c71d03c20d64f2bae5fba6f26cdf5e4b1bda6, spotted by ASAN. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com> Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2018-07-16Merge remote-tracking branch ↵Peter Maydell
'remotes/pmaydell/tags/pull-target-arm-20180716' into staging target-arm queue: * accel/tcg: Use correct test when looking in victim TLB for code * bcm2835_aux: Swap RX and TX interrupt assignments * hw/arm/bcm2836: Mark the bcm2836 / bcm2837 devices with user_creatable = false * hw/intc/arm_gic: Fix handling of GICD_ITARGETSR * hw/intc/arm_gic: Check interrupt number in gic_deactivate_irq() * aspeed: Implement write-1-{set, clear} for AST2500 strapping * target/arm: Fix LD1W and LDFF1W (scalar plus vector) # gpg: Signature made Mon 16 Jul 2018 17:38:36 BST # gpg: using RSA key 3C2525ED14360CDE # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" # gpg: aka "Peter Maydell <pmaydell@gmail.com>" # gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" # Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83 15CF 3C25 25ED 1436 0CDE * remotes/pmaydell/tags/pull-target-arm-20180716: accel/tcg: Assert that tlb fill gave us a valid TLB entry accel/tcg: Use correct test when looking in victim TLB for code bcm2835_aux: Swap RX and TX interrupt assignments hw/arm/bcm2836: Mark the bcm2836 / bcm2837 devices with user_creatable = false hw/intc/arm_gic: Fix handling of GICD_ITARGETSR hw/intc/arm_gic: Check interrupt number in gic_deactivate_irq() aspeed: Implement write-1-{set, clear} for AST2500 strapping target/arm: Fix LD1W and LDFF1W (scalar plus vector) Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-07-16accel/tcg: Assert that tlb fill gave us a valid TLB entryPeter Maydell
In commit 4b1a3e1e34ad97 we added a check for whether the TLB entry we had following a tlb_fill had the INVALID bit set. This could happen in some circumstances because a stale or wrong TLB entry was pulled out of the victim cache. However, after commit 68fea038553039e (which prevents stale entries being in the victim cache) and the previous commit (which ensures we don't incorrectly hit in the victim cache)) this should never be possible. Drop the check on TLB_INVALID_MASK from the "is this a TLB_RECHECK?" condition, and instead assert that the tlb fill procedure has given us a valid TLB entry (or longjumped out with a guest exception). Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20180713141636.18665-3-peter.maydell@linaro.org
2018-07-16accel/tcg: Use correct test when looking in victim TLB for codePeter Maydell
In get_page_addr_code(), we were incorrectly looking in the victim TLB for an entry which matched the target address for reads, not for code accesses. This meant that we could hit on a victim TLB entry that indicated that the address was readable but not executable, and incorrectly bypass the call to tlb_fill() which should generate the guest MMU exception. Fix this bug. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20180713141636.18665-2-peter.maydell@linaro.org
2018-07-16bcm2835_aux: Swap RX and TX interrupt assignmentsGuenter Roeck
RX and TX interrupt bits were reversed, resulting in an endless sequence of serial interupts in the emulated system and the following repeated error message when booting Linux. serial8250: too much work for irq61 This results in a boot failure most of the time. Qemu command line used to reproduce the problem: qemu-system-aarch64 -M raspi3 -m 1024 \ -kernel arch/arm64/boot/Image \ --append "rdinit=/sbin/init console=ttyS1,115200" -initrd rootfs.cpio \ -dtb arch/arm64/boot/dts/broadcom/bcm2837-rpi-3-b.dtb \ -nographic -monitor null -serial null -serial stdio This is with arm64:defconfig. The root file system was generated using buildroot. NB that this error likely arises from an erratum in the BCM2835 datasheet where the TX and RX bits were swapped in the AU_MU_IER_REG description (but correct for IIR): https://elinux.org/BCM2835_datasheet_errata#p12 Signed-off-by: Guenter Roeck <linux@roeck-us.net> Message-id: 1529355846-25102-1-git-send-email-linux@roeck-us.net Reviewed-by: Peter Maydell <peter.maydell@linaro.org> [PMM: added NB about datasheet] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-07-16hw/arm/bcm2836: Mark the bcm2836 / bcm2837 devices with user_creatable = falseThomas Huth
These devices are currently causing some problems when a user is trying to hot-plug or introspect them during runtime. Since these devices can not be instantiated by the user at all (they need to be wired up in code instead), we should mark them with user_creatable = false anyway, then we avoid at least the crashes with the hot-plugging. The introspection problem will be handled by a separate patch. Signed-off-by: Thomas Huth <thuth@redhat.com> Message-id: 1531415537-26037-1-git-send-email-thuth@redhat.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>