aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2020-07-02migration/rdma: Plug memory leaks in qemu_rdma_registration_stop()Markus Armbruster1-10/+9
qemu_rdma_registration_stop() uses the ERROR() macro to create, report to stderr, and store an Error object. The stored Error object is never used, and its memory is leaked. Even where ERROR() doesn't leak, it is ill-advised. The whole point of passing an Error to the caller is letting the caller handle the error. Error handling may report to stderr, to somewhere else, or not at all. Also reporting in the callee mixes up concerns that should be kept separate. Since I don't know what reporting to stderr is supposed to accomplish, I'm not touching it. Commit 2a1bc8bde7 "migration/rdma: rdma_accept_incoming_migration fix error handling" plugged the same leak in rdma_accept_incoming_migration(). Plug the memory leak the same way: keep the report part, delete the store part. The report part uses fprintf(). If it's truly an error, it should use error_report() instead. But I don't know, so I leave it alone, just like commit 2a1bc8bde7 did. Fixes: 2da776db4846eadcb808598a5d3484d149773c05 Cc: Dr. David Alan Gilbert <dgilbert@redhat.com> Cc: Juan Quintela <quintela@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20200630090351.1247703-27-armbru@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2020-07-02arm/{bcm2835,fsl-imx25,fsl-imx6}: Fix realize error API violationsMarkus Armbruster3-22/+14
The Error ** argument must be NULL, &error_abort, &error_fatal, or a pointer to a variable containing NULL. Passing an argument of the latter kind twice without clearing it in between is wrong: if the first call sets an error, it no longer points to NULL for the second call. bcm2835_peripherals_realize(), fsl_imx25_realize() and fsl_imx6_realize() are wrong that way: they pass &err to object_property_set_uint() and object_property_set_bool() without checking it, and then to sysbus_realize(). Harmless, because the former can't actually fail here. Fix by passing &error_abort instead. Cc: Peter Maydell <peter.maydell@linaro.org> Cc: Andrew Baumann <Andrew.Baumann@microsoft.com> Cc: "Philippe Mathieu-Daudé" <philmd@redhat.com> Cc: Jean-Christophe Dubois <jcd@tribudubois.net> Cc: qemu-arm@nongnu.org Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20200630090351.1247703-26-armbru@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
2020-07-02hw/arm/armsse: Fix armsse_realize() error API violationMarkus Armbruster1-4/+4
The Error ** argument must be NULL, &error_abort, &error_fatal, or a pointer to a variable containing NULL. Passing an argument of the latter kind twice without clearing it in between is wrong: if the first call sets an error, it no longer points to NULL for the second call. armsse_realize() is wrong that way: it passes &err to object_property_set_int() multiple times without checking it, and then to sysbus_realize(). Harmless, because the former can't actually fail here. Fix by passing &error_abort instead. Cc: Peter Maydell <peter.maydell@linaro.org> Cc: qemu-arm@nongnu.org Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20200630090351.1247703-25-armbru@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
2020-07-02aspeed: Fix realize error API violationMarkus Armbruster2-4/+6
The Error ** argument must be NULL, &error_abort, &error_fatal, or a pointer to a variable containing NULL. Passing an argument of the latter kind twice without clearing it in between is wrong: if the first call sets an error, it no longer points to NULL for the second call. aspeed_soc_ast2600_realize() and aspeed_soc_realize() are wrong that way: they pass &err to object_property_set_int() and object_property_set_bool() without checking it, and then to sysbus_realize(). Harmless, because the former can't actually fail here. Fix by passing &error_abort instead. Cc: "Cédric Le Goater" <clg@kaod.org> Cc: Peter Maydell <peter.maydell@linaro.org> Cc: Andrew Jeffery <andrew@aj.id.au> Cc: Joel Stanley <joel@jms.id.au> Cc: qemu-arm@nongnu.org Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20200630090351.1247703-24-armbru@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
2020-07-02arm/stm32f205 arm/stm32f405: Fix realize error API violationMarkus Armbruster2-2/+2
The Error ** argument must be NULL, &error_abort, &error_fatal, or a pointer to a variable containing NULL. Passing an argument of the latter kind twice without clearing it in between is wrong: if the first call sets an error, it no longer points to NULL for the second call. stm32f205_soc_realize() and stm32f405_soc_realize() are wrong that way: they pass &err to object_property_set_int() without checking it, and then to qdev_realize(). Harmless, because the former can't actually fail here. Fix by passing &error_abort instead. Cc: Alistair Francis <alistair@alistair23.me> Cc: Peter Maydell <peter.maydell@linaro.org> Cc: qemu-arm@nongnu.org Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-Id: <20200630090351.1247703-23-armbru@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
2020-07-02amd_iommu: Fix amdvi_realize() error API violationMarkus Armbruster1-2/+4
The Error ** argument must be NULL, &error_abort, &error_fatal, or a pointer to a variable containing NULL. Passing an argument of the latter kind twice without clearing it in between is wrong: if the first call sets an error, it no longer points to NULL for the second call. amdvi_realize() is wrong that way: it passes @errp to qdev_realize(), object_property_get_int(), and msi_init() without checking it. I can't tell offhand whether qdev_realize() can fail here. Fix by checking it for failure. object_property_get_int() can't. Fix by passing &error_abort instead. Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: Richard Henderson <rth@twiddle.net> Cc: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20200630090351.1247703-22-armbru@redhat.com>
2020-07-02x86: Fix x86_cpu_new() error handlingMarkus Armbruster1-3/+5
The Error ** argument must be NULL, &error_abort, &error_fatal, or a pointer to a variable containing NULL. Passing an argument of the latter kind twice without clearing it in between is wrong: if the first call sets an error, it no longer points to NULL for the second call. x86_cpu_new() is wrong that way: it passes &local_err to object_property_set_uint() without checking it, and then to qdev_realize(). If both fail, we'll trip error_setv()'s assertion. To assess the bug's impact, we'd need to figure out how to make both calls fail. Too much work for ignorant me, sorry. Fix by checking for failure right away. Cc: Igor Mammedov <imammedo@redhat.com> Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: Richard Henderson <rth@twiddle.net> Cc: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20200630090351.1247703-21-armbru@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
2020-07-02mips/cps: Fix mips_cps_realize() error API violationsMarkus Armbruster1-10/+19
The Error ** argument must be NULL, &error_abort, &error_fatal, or a pointer to a variable containing NULL. Passing an argument of the latter kind twice without clearing it in between is wrong: if the first call sets an error, it no longer points to NULL for the second call. mips_cps_realize() is wrong that way: it passes &err to multiple object_property_set_FOO() without checking for failure, and then to sysbus_realize(). Harmless, because the object_property_set_FOO() can't actually fail here. Fix by passing &error_abort instead. Cc: Aleksandar Markovic <aleksandar.qemu.devel@gmail.com> Cc: Aurelien Jarno <aurelien@aurel32.net> Cc: Aleksandar Rikalo <aleksandar.rikalo@syrmia.com> Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20200630090351.1247703-20-armbru@redhat.com>
2020-07-02riscv_hart: Fix riscv_harts_realize() error API violationsMarkus Armbruster1-9/+5
The Error ** argument must be NULL, &error_abort, &error_fatal, or a pointer to a variable containing NULL. Passing an argument of the latter kind twice without clearing it in between is wrong: if the first call sets an error, it no longer points to NULL for the second call. riscv_harts_realize() is wrong that way: it passes @errp to riscv_hart_realize() in a loop. I can't tell offhand whether this can fail. Fix by checking for failure in each iteration. Cc: Palmer Dabbelt <palmer@dabbelt.com> Cc: Alistair Francis <Alistair.Francis@wdc.com> Cc: Sagar Karandikar <sagark@eecs.berkeley.edu> Cc: Bastian Koppelmann <kbastian@mail.uni-paderborn.de> Cc: Bin Meng <bmeng.cn@gmail.com> Cc: qemu-riscv@nongnu.org Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-Id: <20200630090351.1247703-19-armbru@redhat.com>
2020-07-02riscv/sifive_u: Fix sifive_u_soc_realize() error API violationsMarkus Armbruster1-3/+9
The Error ** argument must be NULL, &error_abort, &error_fatal, or a pointer to a variable containing NULL. Passing an argument of the latter kind twice without clearing it in between is wrong: if the first call sets an error, it no longer points to NULL for the second call. sifive_u_soc_realize() is wrong that way: it passes &err to sysbus_realize() four times before checking it. Harmless, because the first three can't actually fail (I think). Fix by checking for failure right away. Cc: Palmer Dabbelt <palmer@dabbelt.com> Cc: Alistair Francis <Alistair.Francis@wdc.com> Cc: Sagar Karandikar <sagark@eecs.berkeley.edu> Cc: Bastian Koppelmann <kbastian@mail.uni-paderborn.de> Cc: Bin Meng <bmeng.cn@gmail.com> Cc: qemu-riscv@nongnu.org Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-Id: <20200630090351.1247703-18-armbru@redhat.com>
2020-07-02hw/arm: Drop useless object_property_set_link() error handlingMarkus Armbruster5-76/+24
object_property_set_link() fails when the property doesn't exist, is not settable, or its .check() method fails. These are all programming errors here, so passing it &error_abort is appropriate. Cc: Peter Maydell <peter.maydell@linaro.org> Cc: "Cédric Le Goater" <clg@kaod.org> Cc: Andrew Jeffery <andrew@aj.id.au> Cc: Joel Stanley <joel@jms.id.au> Cc: qemu-arm@nongnu.org Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Cédric Le Goater <clg@kaod.org> Message-Id: <20200630090351.1247703-17-armbru@redhat.com>
2020-07-02hw: Fix error API violation around object_property_set_link()Markus Armbruster8-29/+16
The Error ** argument must be NULL, &error_abort, &error_fatal, or a pointer to a variable containing NULL. Passing an argument of the latter kind twice without clearing it in between is wrong: if the first call sets an error, it no longer points to NULL for the second call. virtio_gpu_pci_base_realize(), virtio_vga_base_realize(), sparc32_ledma_device_realize(), sparc32_dma_realize(), sparc32_dma_realize() xilinx_axidma_realize(), mips_cps_realize(), macio_realize_ide(), xilinx_enet_realize(), and virtio_iommu_pci_realize() are wrong that way: they reuse the argument they pass to object_property_set_link() for another call. Harmless, because object_property_set_link() can't actually fail for them: it fails when the property doesn't exist, is not settable, or its .check() method fails. Fix by passing &error_abort instead. Cc: Gerd Hoffmann <kraxel@redhat.com> Cc: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Cc: "Edgar E. Iglesias" <edgar.iglesias@gmail.com> Cc: Alistair Francis <alistair@alistair23.me> Cc: Peter Maydell <peter.maydell@linaro.org> Cc: qemu-arm@nongnu.org Cc: Aleksandar Markovic <aleksandar.qemu.devel@gmail.com> Cc: Aurelien Jarno <aurelien@aurel32.net> Cc: Aleksandar Rikalo <aleksandar.rikalo@syrmia.com> Cc: Eric Auger <eric.auger@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Eric Auger <eric.auger@redhat.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-Id: <20200630090351.1247703-16-armbru@redhat.com> Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
2020-07-02qdev: Drop qbus_set_hotplug_handler() parameter @errpMarkus Armbruster15-33/+22
qbus_set_hotplug_handler() is a simple wrapper around object_property_set_link(). object_property_set_link() fails when the property doesn't exist, is not settable, or its .check() method fails. These are all programming errors here, so passing &error_abort to qbus_set_hotplug_handler() is appropriate. Most of its callers do. Exceptions: * pcie_cap_slot_init(), shpc_init(), spapr_phb_realize() pass NULL, i.e. they ignore errors. * spapr_machine_init() passes &error_fatal. * s390_pcihost_realize(), virtio_serial_device_realize(), s390_pcihost_plug() pass the error to their callers. The latter two keep going after the error, which looks wrong. Drop the @errp parameter, and instead pass &error_abort to object_property_set_link(). Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: "Daniel P. Berrangé" <berrange@redhat.com> Cc: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20200630090351.1247703-15-armbru@redhat.com>
2020-07-02qdev: Drop qbus_set_bus_hotplug_handler() parameter @errpMarkus Armbruster6-7/+7
All callers pass &error_abort. Drop the parameter. Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: "Daniel P. Berrangé" <berrange@redhat.com> Cc: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20200630090351.1247703-14-armbru@redhat.com>
2020-07-02aspeed: Clean up roundabout error propagationMarkus Armbruster2-12/+8
Replace sysbus_realize(SYS_BUS_DEVICE(&s->spi[i]), &local_err); error_propagate(&err, local_err); if (err) { error_propagate(errp, err); return; } by sysbus_realize(SYS_BUS_DEVICE(&s->spi[i]), &err); if (err) { error_propagate(errp, err); return; } Cc: Cédric Le Goater <clg@kaod.org> Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Cédric Le Goater <clg@kaod.org> Message-Id: <20200630090351.1247703-13-armbru@redhat.com>
2020-07-02vnc: Plug minor memory leak in vnc_display_open()Markus Armbruster1-2/+1
vnc_display_print_local_addr() leaks the Error object when qio_channel_socket_get_local_address() fails. Seems unlikely. Called when we create a VNC display with vnc_display_open(). Plug the leak by passing NULL to ignore the error. Cc: Daniel P. Berrange <berrange@redhat.com> Cc: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20200630090351.1247703-12-armbru@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2020-07-02test-util-filemonitor: Plug unlikely memory leakMarkus Armbruster1-0/+1
test_file_monitor_events() leaks an Error object when qemu_file_monitor_add_watch() fails, which seems unlikely. Plug it. Cc: Daniel P. Berrangé <berrange@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20200630090351.1247703-11-armbru@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2020-07-02sd/milkymist-memcard: Plug minor memory leak in realizeMarkus Armbruster1-3/+2
milkymist_memcard_realize() leaks an Error object when realization of its "sd-card" device fails. Quite harmless, since we only ever realize this once, in milkymist_init() via milkymist_memcard_create(). Plug the leak. Fixes: 3d0369ba499866cc6a839f71212d97876500762d Cc: Philippe Mathieu-Daudé <philmd@redhat.com> Cc: Michael Walle <michael@walle.cc> Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20200630090351.1247703-10-armbru@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
2020-07-02qga: Plug unlikely memory leak in guest-set-memory-blocksMarkus Armbruster1-0/+1
transfer_memory_block() leaks an Error object when reading file /sys/devices/system/memory/memory<INDEX>/state fails with errno other than ENOENT, and @sys2memblk is false, i.e. when the state file exists but cannot be read (seems quite unlikely), and this is guest-set-memory-blocks, not guest-get-memory-blocks. Plug the leak. Fixes: bd240fca42d5f072fb758a71720d9de9990ac553 Cc: Michael Roth <mdroth@linux.vnet.ibm.com> Cc: Hailiang Zhang <zhang.zhanghailiang@huawei.com> Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: zhanghailiang <zhang.zhanghailiang@huawei.com> Message-Id: <20200630090351.1247703-9-armbru@redhat.com>
2020-07-02spapr: Plug minor memory leak in spapr_machine_init()Markus Armbruster1-0/+1
spapr_machine_init() leaks an Error object when kvmppc_check_papr_resize_hpt() fails and spapr->resize_hpt is SPAPR_RESIZE_HPT_DISABLED, i.e. when the host doesn't support hash page table resizing, and the user didn't ask for it. As harmless as memory leaks can possibly be. Plug it. Fixes: 30f4b05bd090564181554d0890605eb2c143e4ea Cc: David Gibson <dgibson@redhat.com> Cc: qemu-ppc@nongnu.org Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Greg Kurz <groug@kaod.org> Acked-by: David Gibson <david@gibson.dropbear.id.au> Message-Id: <20200630090351.1247703-8-armbru@redhat.com>
2020-07-02usb/dev-mtp: Fix Error double free after inotify failureMarkus Armbruster1-2/+0
error_report_err() frees its first argument. Freeing it again is wrong. Don't. Fixes: 47287c27d0c367a89f7b2851e23a7f8b2d499dd6 Cc: Gerd Hoffmann <kraxel@redhat.com> Cc: Daniel P. Berrangé <berrange@redhat.com> Cc: qemu-stable@nongnu.org Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20200630090351.1247703-7-armbru@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2020-07-02tests: Use error_free_or_abort() where appropriateMarkus Armbruster7-39/+14
Replace g_assert(err != NULL); error_free(err); err = NULL; and variations thereof by error_free_or_abort(&err); Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Message-Id: <20200630090351.1247703-6-armbru@redhat.com>
2020-07-02tests: Use &error_abort where appropriateMarkus Armbruster7-145/+59
Receiving the error in a local variable only to assert there is none is less clear than passing &error_abort. Clean up. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Message-Id: <20200630090351.1247703-5-armbru@redhat.com>
2020-07-02Clean up some calls to ignore Error objects the right wayMarkus Armbruster5-16/+7
Receiving the error in a local variable only to free it is less clear (and also less efficient) than passing NULL. Clean up. Cc: Daniel P. Berrange <berrange@redhat.com> Cc: Jerome Forissier <jerome@forissier.org> CC: Greg Kurz <groug@kaod.org> Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Greg Kurz <groug@kaod.org> Message-Id: <20200630090351.1247703-4-armbru@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2020-07-02pci: Delete useless error_propagate()Markus Armbruster1-3/+0
Cc: Jens Freimann <jfreimann@redhat.com> Cc: Michael S. Tsirkin <mst@redhat.com> Cc: Marcel Apfelbaum <marcel.apfelbaum@gmail.com> Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Jens Freimann <jfreimann@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Message-Id: <20200630090351.1247703-3-armbru@redhat.com>
2020-07-02net/virtio: Fix failover_replug_primary() return value regressionMarkus Armbruster1-1/+1
Commit 150ab54aa6 "net/virtio: fix re-plugging of primary device" fixed failover_replug_primary() to return false on failure. Commit 5a0948d36c "net/virtio: Fix failover error handling crash bugs" broke it again for hotplug_handler_plug() failure. Unbreak it. Commit 5a0948d36c4cbc1c5534afac6fee99de55245d12 Fixes: 5a0948d36c4cbc1c5534afac6fee99de55245d12 Cc: Jens Freimann <jfreimann@redhat.com> Cc: Michael S. Tsirkin <mst@redhat.com> Cc: qemu-stable@nongnu.org Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Jens Freimann <jfreimann@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Message-Id: <20200630090351.1247703-2-armbru@redhat.com>
2020-07-02hw/virtio/virtio-iommu-pci.c: Fix typo in error messagePeter Maydell1-1/+1
Fix a typo in an error message in virtio_iommu_pci_realize(): "Check you machine" should be "Check your machine". Reported-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-Id: <20200625100811.12690-1-peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Eric Auger <eric.auger@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com>
2020-07-02chardev/tcp: Fix error message double free errorlichun1-1/+2
Errors are already freed by error_report_err, so we only need to call error_free when that function is not called. Cc: qemu-stable@nongnu.org Signed-off-by: lichun <lichun@ruijie.com.cn> Message-Id: <20200621213017.17978-1-lichun@ruijie.com.cn> Reviewed-by: Markus Armbruster <armbru@redhat.com> [Commit message improved, cc: qemu-stable] Signed-off-by: Markus Armbruster <armbru@redhat.com>
2020-06-29hw/misc/pca9552: Add missing TypeInfo::class_size fieldPhilippe Mathieu-Daudé1-0/+1
When adding the generic PCA955xClass in commit 736132e455, we forgot to set the class_size field. Fill it now to avoid: (gdb) run -machine mcimx6ul-evk -m 128M -display none -serial stdio -kernel ./OS.elf Starting program: ../../qemu/qemu/arm-softmmu/qemu-system-arm -machine mcimx6ul-evk -m 128M -display none -serial stdio -kernel ./OS.elf double free or corruption (!prev) Thread 1 "qemu-system-arm" received signal SIGABRT, Aborted. __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50 (gdb) where #0 __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50 #1 0x00007ffff75d8859 in __GI_abort () at abort.c:79 #2 0x00007ffff76433ee in __libc_message (action=action@entry=do_abort, fmt=fmt@entry=0x7ffff776d285 "%s\n") at ../sysdeps/posix/libc_fatal.c:155 #3 0x00007ffff764b47c in malloc_printerr (str=str@entry=0x7ffff776f690 "double free or corruption (!prev)") at malloc.c:5347 #4 0x00007ffff764d12c in _int_free (av=0x7ffff779eb80 <main_arena>, p=0x5555567a3990, have_lock=<optimized out>) at malloc.c:4317 #5 0x0000555555c906c3 in type_initialize_interface (ti=ti@entry=0x5555565b8f40, interface_type=0x555556597ad0, parent_type=0x55555662ca10) at qom/object.c:259 #6 0x0000555555c902da in type_initialize (ti=ti@entry=0x5555565b8f40) at qom/object.c:323 #7 0x0000555555c90d20 in type_initialize (ti=0x5555565b8f40) at qom/object.c:1028 $ valgrind --track-origins=yes qemu-system-arm -M mcimx6ul-evk -m 128M -display none -serial stdio -kernel ./OS.elf ==77479== Memcheck, a memory error detector ==77479== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al. ==77479== Using Valgrind-3.15.0 and LibVEX; rerun with -h for copyright info ==77479== Command: qemu-system-arm -M mcimx6ul-evk -m 128M -display none -serial stdio -kernel ./OS.elf ==77479== ==77479== Invalid write of size 2 ==77479== at 0x6D8322: pca9552_class_init (pca9552.c:424) ==77479== by 0x844D1F: type_initialize (object.c:1029) ==77479== by 0x844D1F: object_class_foreach_tramp (object.c:1016) ==77479== by 0x4AE1057: g_hash_table_foreach (in /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0.6400.2) ==77479== by 0x8453A4: object_class_foreach (object.c:1038) ==77479== by 0x8453A4: object_class_get_list (object.c:1095) ==77479== by 0x556194: select_machine (vl.c:2416) ==77479== by 0x556194: qemu_init (vl.c:3828) ==77479== by 0x40AF9C: main (main.c:48) ==77479== Address 0x583f108 is 0 bytes after a block of size 200 alloc'd ==77479== at 0x483DD99: calloc (in /usr/lib/x86_64-linux-gnu/valgrind/vgpreload_memcheck-amd64-linux.so) ==77479== by 0x4AF8D30: g_malloc0 (in /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0.6400.2) ==77479== by 0x844258: type_initialize.part.0 (object.c:306) ==77479== by 0x844D1F: type_initialize (object.c:1029) ==77479== by 0x844D1F: object_class_foreach_tramp (object.c:1016) ==77479== by 0x4AE1057: g_hash_table_foreach (in /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0.6400.2) ==77479== by 0x8453A4: object_class_foreach (object.c:1038) ==77479== by 0x8453A4: object_class_get_list (object.c:1095) ==77479== by 0x556194: select_machine (vl.c:2416) ==77479== by 0x556194: qemu_init (vl.c:3828) ==77479== by 0x40AF9C: main (main.c:48) Fixes: 736132e455 ("hw/misc/pca9552: Add generic PCA955xClass") Reported-by: Jean-Christophe DUBOIS <jcd@tribudubois.net> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Tested-by: Jean-Christophe DUBOIS <jcd@tribudubois.net> Message-id: 20200629074704.23028-1-f4bug@amsat.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-06-27Merge remote-tracking branch ↵Peter Maydell8-0/+585
'remotes/amarkovic/tags/mips-gsoc-queue-jun-27-2020' into staging MIPS + TCG Continuous Benchmarking queue for June 27th, 2020 # gpg: Signature made Sat 27 Jun 2020 20:30:48 BST # gpg: using RSA key D4972A8967F75A65 # gpg: Good signature from "Aleksandar Markovic <amarkovic@wavecomp.com>" [full] # Primary key fingerprint: 8526 FBF1 5DA3 811F 4A01 DD75 D497 2A89 67F7 5A65 * remotes/amarkovic/tags/mips-gsoc-queue-jun-27-2020: MAINTAINERS: Add 'Performance Tools and Tests' subsection scripts/performance: Add topN_callgrind.py script scripts/performance: Add topN_perf.py script MAINTAINERS: Add Loongson-3 maintainer and reviewer hw/intc: Add Loongson LIOINTC support hw/mips: Implement the kvm_type() hook in MachineClass Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-06-27MAINTAINERS: Add 'Performance Tools and Tests' subsectionAleksandar Markovic1-2/+8
This commit creates a new 'Miscellaneous' section which hosts a new 'Performance Tools and Tests' subsection. This subsection will contain the the performance scripts and benchmarks written as a part of the 'TCG Continuous Benchmarking' project. Also, it will be a placeholder for follow-ups to this project, if any. Signed-off-by: Ahmed Karaman <ahmedkhaledkaraman@gmail.com> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Aleksandar Markovic <aleksandar.qemu.devel@gmail.com> Signed-off-by: Aleksandar Markovic <aleksandar.qemu.devel@gmail.com> Message-Id: <20200626164546.22102-4-ahmedkhaledkaraman@gmail.com>
2020-06-27scripts/performance: Add topN_callgrind.py scriptAhmed Karaman1-0/+140
Python script that prints the top N most executed functions in QEMU using callgrind. Syntax: topN_callgrind.py [-h] [-n] <number of displayed top functions> -- \ <qemu executable> [<qemu executable options>] \ <target executable> [<target execurable options>] [-h] - Print the script arguments help message. [-n] - Specify the number of top functions to print. - If this flag is not specified, the tool defaults to 25. Example of usage: topN_callgrind.py -n 20 -- qemu-arm coulomb_double-arm Example Output: No. Percentage Function Name Source File ---- --------- ------------------ ------------------------------ 1 24.577% 0x00000000082db000 ??? 2 20.467% float64_mul <qemu>/fpu/softfloat.c 3 14.720% float64_sub <qemu>/fpu/softfloat.c 4 13.864% float64_add <qemu>/fpu/softfloat.c 5 4.876% helper_mulsd <qemu>/target/i386/ops_sse.h 6 3.767% helper_subsd <qemu>/target/i386/ops_sse.h 7 3.549% helper_addsd <qemu>/target/i386/ops_sse.h 8 2.185% helper_ucomisd <qemu>/target/i386/ops_sse.h 9 1.667% helper_lookup_tb_ptr <qemu>/include/exec/tb-lookup.h 10 1.662% f64_compare <qemu>/fpu/softfloat.c 11 1.509% helper_lookup_tb_ptr <qemu>/accel/tcg/tcg-runtime.c 12 0.635% helper_lookup_tb_ptr <qemu>/include/exec/exec-all.h 13 0.616% float64_div <qemu>/fpu/softfloat.c 14 0.502% helper_pand_xmm <qemu>/target/i386/ops_sse.h 15 0.502% float64_mul <qemu>/include/fpu/softfloat.h 16 0.476% helper_lookup_tb_ptr <qemu>/target/i386/cpu.h 17 0.437% float64_compare_quiet <qemu>/fpu/softfloat.c 18 0.414% helper_pxor_xmm <qemu>/target/i386/ops_sse.h 19 0.353% round_to_int <qemu>/fpu/softfloat.c 20 0.347% helper_cc_compute_all <qemu>/target/i386/cc_helper.c Signed-off-by: Ahmed Karaman <ahmedkhaledkaraman@gmail.com> Signed-off-by: Aleksandar Markovic <aleksandar.qemu.devel@gmail.com> Reviewed-by: Aleksandar Markovic <aleksandar.qemu.devel@gmail.com> Message-Id: <20200626164546.22102-3-ahmedkhaledkaraman@gmail.com>
2020-06-27scripts/performance: Add topN_perf.py scriptAhmed Karaman1-0/+149
Syntax: topN_perf.py [-h] [-n] <number of displayed top functions> -- \ <qemu executable> [<qemu executable options>] \ <target executable> [<target execurable options>] [-h] - Print the script arguments help message. [-n] - Specify the number of top functions to print. - If this flag is not specified, the tool defaults to 25. Example of usage: topN_perf.py -n 20 -- qemu-arm coulomb_double-arm Example Output: No. Percentage Name Invoked by ---- ---------- ------------------------- ------------------------- 1 16.25% float64_mul qemu-x86_64 2 12.01% float64_sub qemu-x86_64 3 11.99% float64_add qemu-x86_64 4 5.69% helper_mulsd qemu-x86_64 5 4.68% helper_addsd qemu-x86_64 6 4.43% helper_lookup_tb_ptr qemu-x86_64 7 4.28% helper_subsd qemu-x86_64 8 2.71% f64_compare qemu-x86_64 9 2.71% helper_ucomisd qemu-x86_64 10 1.04% helper_pand_xmm qemu-x86_64 11 0.71% float64_div qemu-x86_64 12 0.63% helper_pxor_xmm qemu-x86_64 13 0.50% 0x00007f7b7004ef95 [JIT] tid 491 14 0.50% 0x00007f7b70044e83 [JIT] tid 491 15 0.36% helper_por_xmm qemu-x86_64 16 0.32% helper_cc_compute_all qemu-x86_64 17 0.30% 0x00007f7b700433f0 [JIT] tid 491 18 0.30% float64_compare_quiet qemu-x86_64 19 0.27% soft_f64_addsub qemu-x86_64 20 0.26% round_to_int qemu-x86_64 Signed-off-by: Ahmed Karaman <ahmedkhaledkaraman@gmail.com> Signed-off-by: Aleksandar Markovic <aleksandar.qemu.devel@gmail.com> Reviewed-by: Aleksandar Markovic <aleksandar.qemu.devel@gmail.com> Message-Id: <20200626164546.22102-2-ahmedkhaledkaraman@gmail.com>
2020-06-27MAINTAINERS: Add Loongson-3 maintainer and reviewerHuacai Chen1-0/+7
Add myself as the maintainer for Loongson-3 virtual platforms, and also add Jiaxun Yang as the reviewer. Signed-off-by: Huacai Chen <chenhc@lemote.com> Co-developed-by: Jiaxun Yang <jiaxun.yang@flygoat.com> Reviewed-by: Aleksandar Markovic <aleksandar.qemu.devel@gmail.com> Signed-off-by: Aleksandar Markovic <aleksandar.qemu.devel@gmail.com> Message-Id: <1592995531-32600-5-git-send-email-chenhc@lemote.com>
2020-06-27hw/intc: Add Loongson LIOINTC supportHuacai Chen3-0/+246
Loongson-3 has an integrated liointc (Local I/O Interrupt Controller). It is similar to Goldfish interrupt controller, but more powerful (e.g., it can route external interrupt to multi-cores). Documents about Loongson-3's liointc: 1, https://wiki.godson.ac.cn/ip_block:liointc; 2, The "I/O中断" section of Loongson-3's user mannual, part 1. Signed-off-by: Huacai Chen <chenhc@lemote.com> Signed-off-by: Jiaxun Yang <jiaxun.yang@flygoat.com> Signed-off-by: Aleksandar Markovic <aleksandar.qemu.devel@gmail.com> Reviewed-by: Aleksandar Markovic <aleksandar.qemu.devel@gmail.com> Message-Id: <1592995531-32600-3-git-send-email-chenhc@lemote.com>
2020-06-27hw/mips: Implement the kvm_type() hook in MachineClassHuacai Chen2-0/+37
MIPS has two types of KVM: TE & VZ, and TE is the default type. Now we can't create a VZ guest in QEMU because it lacks the kvm_type() hook in MachineClass. This patch add the the kvm_type() hook to support both of the two types. [AM: Added "if defined" guards.] Reviewed-by: Aleksandar Markovic <aleksandar.qemu.devel@gmail.com> Signed-off-by: Aleksandar Markovic <aleksandar.qemu.devel@gmail.com> Signed-off-by: Huacai Chen <chenhc@lemote.com> Co-developed-by: Jiaxun Yang <jiaxun.yang@flygoat.com> Message-Id: <1592995531-32600-2-git-send-email-chenhc@lemote.com>
2020-06-26Merge remote-tracking branch ↵Peter Maydell29-950/+4417
'remotes/pmaydell/tags/pull-target-arm-20200626' into staging target-arm queue: * hw/arm/aspeed: improve QOM usage * hw/misc/pca9552: trace GPIO change events * target/arm: Implement ARMv8.5-MemTag for system emulation # gpg: Signature made Fri 26 Jun 2020 16:13:27 BST # gpg: using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE # gpg: issuer "peter.maydell@linaro.org" # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [ultimate] # gpg: aka "Peter Maydell <pmaydell@gmail.com>" [ultimate] # gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" [ultimate] # Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83 15CF 3C25 25ED 1436 0CDE * remotes/pmaydell/tags/pull-target-arm-20200626: (57 commits) target/arm: Enable MTE target/arm: Add allocation tag storage for system mode target/arm: Create tagged ram when MTE is enabled target/arm: Cache the Tagged bit for a page in MemTxAttrs target/arm: Always pass cacheattr to get_phys_addr target/arm: Set PSTATE.TCO on exception entry target/arm: Implement data cache set allocation tags target/arm: Complete TBI clearing for user-only for SVE target/arm: Add mte helpers for sve scatter/gather memory ops target/arm: Handle TBI for sve scalar + int memory ops target/arm: Add mte helpers for sve scalar + int ff/nf loads target/arm: Add mte helpers for sve scalar + int stores target/arm: Add mte helpers for sve scalar + int loads target/arm: Add arm_tlb_bti_gp target/arm: Tidy trans_LD1R_zpri target/arm: Use mte_check1 for sve LD1R target/arm: Use mte_checkN for sve unpredicated stores target/arm: Use mte_checkN for sve unpredicated loads target/arm: Add helper_mte_check_zva target/arm: Implement helper_mte_checkN ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-06-26Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into stagingPeter Maydell47-370/+6211
* Various fixes * libdaxctl support to correctly align devdax character devices (Jingqi) * initial-all-set support for live migration (Jay) * forbid '-numa node, mem' for 5.1 and newer machine types (Igor) * x87 fixes (Joseph) * Tighten memory_region_access_valid (Michael) and fix fallout (myself) * Replay fixes (Pavel) # gpg: Signature made Fri 26 Jun 2020 14:42:17 BST # gpg: using RSA key F13338574B662389866C7682BFFBD25F78C7AE83 # gpg: issuer "pbonzini@redhat.com" # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" [full] # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" [full] # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * remotes/bonzini/tags/for-upstream: (31 commits) i386: Mask SVM features if nested SVM is disabled ibex_uart: fix XOR-as-pow vmport: move compat properties to hw_compat_5_0 hyperv: vmbus: Remove the 2nd IRQ kvm: i386: allow TSC to differ by NTP correction bounds without TSC scaling numa: forbid '-numa node, mem' for 5.1 and newer machine types osdep: Make MIN/MAX evaluate arguments only once target/i386: Add notes for versioned CPU models target/i386: reimplement fpatan using floatx80 operations target/i386: reimplement fyl2x using floatx80 operations target/i386: reimplement fyl2xp1 using floatx80 operations target/i386: reimplement fprem, fprem1 using floatx80 operations softfloat: return low bits of quotient from floatx80_modrem softfloat: do not set denominator high bit for floatx80 remainder softfloat: do not return pseudo-denormal from floatx80 remainder softfloat: fix floatx80 remainder pseudo-denormal check for zero softfloat: merge floatx80_mod and floatx80_rem target/i386: reimplement f2xm1 using floatx80 operations xen: Actually fix build without passthrough Makefile: Install qemu-[qmp/ga]-ref.* into the directory "interop" ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-06-26i386: Mask SVM features if nested SVM is disabledEduardo Habkost2-2/+6
QEMU incorrectly validates FEAT_SVM feature flags against GET_SUPPORTED_CPUID even if SVM features are being masked out by cpu_x86_cpuid(). This can make QEMU print warnings on most AMD CPU models, even when SVM nesting is disabled (which is the default). This bug was never detected before because of a Linux KVM bug: until Linux v5.6, KVM was not filtering out SVM features in GET_SUPPORTED_CPUID when nested was disabled. This KVM bug was fixed in Linux v5.7-rc1, on Linux commit a50718cc3f43 ("KVM: nSVM: Expose SVM features to L1 iff nested is enabled"). Fix the problem by adding a CPUID_EXT3_SVM dependency to all FEAT_SVM feature flags in the feature_dependencies table. Reported-by: Yanan Fu <yfu@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Message-Id: <20200623230116.277409-1-ehabkost@redhat.com> [Fix testcase. - Paolo] Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2020-06-26ibex_uart: fix XOR-as-powPaolo Bonzini1-1/+1
The xor-as-pow warning in clang actually detected a genuine bug. Fix it. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2020-06-26vmport: move compat properties to hw_compat_5_0Paolo Bonzini1-4/+4
The patches that introduced the properties were submitted when QEMU 5.0 had not been released yet, so they got merged under the wrong heading. Move them to hw_compat_5_0 so that 5.0 machine types get the pre-patch behavior. Fixes: b889212973da ("hw/i386/vmport: Propagate IOPort read to vCPU EAX register") Fixes: 0342ee761ef2 ("hw/i386/vmport: Set EAX to -1 on failed and unsupported commands") Fixes: f8bdc550370f ("hw/i386/vmport: Report vmware-vmx-type in CMD_GETVERSION") Fixes: aaacf1c15a22 ("hw/i386/vmport: Add support for CMD_GETBIOSUUID") Reported-by: Laurent Vivier <lvivier@redhat.com> Cc: Liran Alon <liran.alon@oracle.com> Reviewed-by: Laurent Vivier <lvivier@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2020-06-26hyperv: vmbus: Remove the 2nd IRQJon Doron3-7/+3
It seems like Windows does not really require 2 IRQs to have a functioning VMBus. Signed-off-by: Jon Doron <arilou@gmail.com> Message-Id: <20200617160904.681845-2-arilou@gmail.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2020-06-26kvm: i386: allow TSC to differ by NTP correction bounds without TSC scalingMarcelo Tosatti1-5/+41
The Linux TSC calibration procedure is subject to small variations (its common to see +-1 kHz difference between reboots on a given CPU, for example). So migrating a guest between two hosts with identical processor can fail, in case of a small variation in calibrated TSC between them. Allow a conservative 250ppm error between host TSC and VM TSC frequencies, rather than requiring an exact match. NTP daemon in the guest can correct this difference. Also change migration to accept this bound. KVM_SET_TSC_KHZ depends on a kernel interface change. Without this change, the behaviour remains the same: in case of a different frequency between host and VM, KVM_SET_TSC_KHZ will fail and QEMU will exit. Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com> Message-Id: <20200616165805.GA324612@fuller.cnet> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2020-06-26numa: forbid '-numa node, mem' for 5.1 and newer machine typesIgor Mammedov8-24/+36
Deprecation period is run out and it's a time to flip the switch introduced by cd5ff8333a. Disable legacy option for new machine types (since 5.1) and amend documentation. '-numa node,memdev' shall be used instead of disabled option with new machine types. Signed-off-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: Michal Privoznik <mprivozn@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Greg Kurz <groug@kaod.org> Message-Id: <20200609135635.761587-1-imammedo@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2020-06-26osdep: Make MIN/MAX evaluate arguments only onceEric Blake7-23/+63
I'm not aware of any immediate bugs in qemu where a second runtime evaluation of the arguments to MIN() or MAX() causes a problem, but proactively preventing such abuse is easier than falling prey to an unintended case down the road. At any rate, here's the conversation that sparked the current patch: https://lists.gnu.org/archive/html/qemu-devel/2018-12/msg05718.html Update the MIN/MAX macros to only evaluate their argument once at runtime; this uses typeof(1 ? (a) : (b)) to ensure that we are promoting the temporaries to the same type as the final comparison (we have to trigger type promotion, as typeof(bitfield) won't compile; and we can't use typeof((a) + (b)) or even typeof((a) + 0), as some of our uses of MAX are on void* pointers where such addition is undefined). However, we are unable to work around gcc refusing to compile ({}) in a constant context (such as the array length of a static variable), even when only used in the dead branch of a __builtin_choose_expr(), so we have to provide a second macro pair MIN_CONST and MAX_CONST for use when both arguments are known to be compile-time constants and where the result must also be usable as a constant; this second form evaluates arguments multiple times but that doesn't matter for constants. By using a void expression as the expansion if a non-constant is presented to this second form, we can enlist the compiler to ensure the double evaluation is not attempted on non-constants. Alas, as both macros now rely on compiler intrinsics, they are no longer usable in preprocessor #if conditions; those will just have to be open-coded or the logic rewritten into #define or runtime 'if' conditions (but where the compiler dead-code-elimination will probably still apply). I tested that both gcc 10.1.1 and clang 10.0.0 produce errors for all forms of macro mis-use. As the errors can sometimes be cryptic, I'm demonstrating the gcc output: Use of MIN when MIN_CONST is needed: In file included from /home/eblake/qemu/qemu-img.c:25: /home/eblake/qemu/include/qemu/osdep.h:249:5: error: braced-group within expression allowed only inside a function 249 | ({ \ | ^ /home/eblake/qemu/qemu-img.c:92:12: note: in expansion of macro ‘MIN’ 92 | char array[MIN(1, 2)] = ""; | ^~~ Use of MIN_CONST when MIN is needed: /home/eblake/qemu/qemu-img.c: In function ‘is_allocated_sectors’: /home/eblake/qemu/qemu-img.c:1225:15: error: void value not ignored as it ought to be 1225 | i = MIN_CONST(i, n); | ^ Use of MIN in the preprocessor: In file included from /home/eblake/qemu/accel/tcg/translate-all.c:20: /home/eblake/qemu/accel/tcg/translate-all.c: In function ‘page_check_range’: /home/eblake/qemu/include/qemu/osdep.h:249:6: error: token "{" is not valid in preprocessor expressions 249 | ({ \ | ^ Fix the resulting callsites that used #if or computed a compile-time constant min or max to use the new macros. cpu-defs.h is interesting, as CPU_TLB_DYN_MAX_BITS is sometimes used as a constant and sometimes dynamic. It may be worth improving glib's MIN/MAX definitions to be saner, but that is a task for another day. Signed-off-by: Eric Blake <eblake@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20200625162602.700741-1-eblake@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2020-06-26target/i386: Add notes for versioned CPU modelsTao Xu1-0/+5
Add which features are added or removed in this version. Signed-off-by: Tao Xu <tao3.xu@intel.com> Message-Id: <20200324051034.30541-1-tao3.xu@intel.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2020-06-26target/i386: reimplement fpatan using floatx80 operationsJoseph Myers2-4/+1554
The x87 fpatan emulation is currently based around conversion to double. This is inherently unsuitable for a good emulation of any floatx80 operation. Reimplement using the soft-float operations, as for other such instructions. Signed-off-by: Joseph Myers <joseph@codesourcery.com> Message-Id: <alpine.DEB.2.21.2006230000340.24721@digraph.polyomino.org.uk> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2020-06-26target/i386: reimplement fyl2x using floatx80 operationsJoseph Myers2-111/+1423
The x87 fyl2x emulation is currently based around conversion to double. This is inherently unsuitable for a good emulation of any floatx80 operation. Reimplement using the soft-float operations, building on top of the reimplementation of fyl2xp1 and factoring out code to be shared between the two instructions. The included test assumes that the result in round-to-nearest mode should always be one of the two closest floating-point numbers to the mathematically exact result (including that it should be exact, in the exact cases which cover more cases than for fyl2xp1). Signed-off-by: Joseph Myers <joseph@codesourcery.com> Message-Id: <alpine.DEB.2.21.2006172321530.20587@digraph.polyomino.org.uk> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2020-06-26target/i386: reimplement fyl2xp1 using floatx80 operationsJoseph Myers2-9/+1358
The x87 fyl2xp1 emulation is currently based around conversion to double. This is inherently unsuitable for a good emulation of any floatx80 operation, even before considering that it is a particularly naive implementation using double (adding 1 then using log rather than attempting a better emulation using log1p). Reimplement using the soft-float operations, as was done for f2xm1; as in that case, m68k has related operations but not exactly this one and it seemed safest to implement directly rather than reusing the m68k code to avoid accumulation of errors. A test is included with many randomly generated inputs. The assumption of the test is that the result in round-to-nearest mode should always be one of the two closest floating-point numbers to the mathematical value of y * log2(x + 1); the implementation aims to do somewhat better than that (about 70 correct bits before rounding). I haven't investigated how accurate hardware is. Intel manuals describe a narrower range of valid arguments to this instruction than AMD manuals. The implementation accepts the wider range (it's needed anyway for the core code to be reusable in a subsequent patch reimplementing fyl2x), but the test only has inputs in the narrower range so that it's valid on hardware that may reject or produce poor results for inputs outside that range. Code in the previous implementation that sets C2 for some out-of-range arguments is not carried forward to the new implementation; C2 is undefined for this instruction and I suspect that code was just cut-and-pasted from the trigonometric instructions (fcos, fptan, fsin, fsincos) where C2 *is* defined to be set for out-of-range arguments. Signed-off-by: Joseph Myers <joseph@codesourcery.com> Message-Id: <alpine.DEB.2.21.2006172320190.20587@digraph.polyomino.org.uk> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2020-06-26target/i386: reimplement fprem, fprem1 using floatx80 operationsJoseph Myers1-108/+48
The x87 fprem and fprem1 emulation is currently based around conversion to double, which is inherently unsuitable for a good emulation of any floatx80 operation. Reimplement using the soft-float floatx80 remainder operations. Signed-off-by: Joseph Myers <joseph@codesourcery.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <alpine.DEB.2.21.2006081657200.23637@digraph.polyomino.org.uk> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
generated by cgit v1.1 at 2025-01-08 17:37:01 +0000