aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2019-05-17virtfs: Fix documentation of -fsdev and -virtfsGreg Kurz1-27/+66
This fixes several things: - add "id" description to -virtfs documentation - split the description into several lines in both usage and documentation for accurateness and clarity - add documentation and usage of the synth fsdriver - add "throttling.*" description to -fsdev local - add some missing periods - add proper reference to the virtfs-proxy-helper(1) manual page - document that the virtio device may be either virtio-9p-pci, virtio-9p-ccw or virtio-9p-device, depending on the machine type Buglink: https://bugs.launchpad.net/qemu/+bug/1581976 Signed-off-by: Greg Kurz <groug@kaod.org> Acked-by: Thomas Huth <thuth@redhat.com>
2019-05-17vl: Deprecate -virtfs_synthGreg Kurz3-1/+11
The synth fsdriver never got used for anything else but the QTest testcase for VirtIO 9P. And even there, QTest uses -fsdev synth and -device virtio-9p-... directly. Signed-off-by: Greg Kurz <groug@kaod.org> Reviewed-by: Thomas Huth <thuth@redhat.com>
2019-05-17fsdev: Error out when unsupported option is passedGreg Kurz1-3/+71
Each fsdriver only supports a subset of the options that can be passed to -fsdev. Unsupported options are simply ignored. This could cause the user to erroneously think QEMU has a bug. Enforce strict checking of supported options for all fsdrivers. This shouldn't impact libvirt, since it doesn't know about the synth and proxy fsdrivers. Signed-off-by: Greg Kurz <groug@kaod.org> Reviewed-by: Eric Blake <eblake@redhat.com>
2019-05-17fsdev: Move some types definition to qemu-fsdev.cGreg Kurz2-24/+23
It would make sense for these types to be defined in a header file if we had an API for fsdrivers to register themselves. In practice, we only have three of them and it is very unlikely we add new ones since the future of file sharing between host and guest is the upcoming virtio-fs. Move the types to qemu-fsdev.c instead since they are only used there. Signed-off-by: Greg Kurz <groug@kaod.org> Reviewed-by: Thomas Huth <thuth@redhat.com>
2019-05-17fsdev: Drop unused opaque fieldGreg Kurz1-1/+0
This was introduced along with -fsdev but it never got used. Signed-off-by: Greg Kurz <groug@kaod.org> Reviewed-by: Thomas Huth <thuth@redhat.com>
2019-05-17fsdev: Drop unused extern declarationGreg Kurz1-1/+0
This is a leftover of the handle backend, removed in QEMU 4.0. Signed-off-by: Greg Kurz <groug@kaod.org> Reviewed-by: Thomas Huth <thuth@redhat.com>
2019-05-17Merge remote-tracking branch 'remotes/mcayland/tags/qemu-sparc-20190517' ↵Peter Maydell10-97/+490
into staging qemu-sparc queue # gpg: Signature made Fri 17 May 2019 10:30:54 BST # gpg: using RSA key CC621AB98E82200D915CC9C45BC2C56FAE0F321F # gpg: issuer "mark.cave-ayland@ilande.co.uk" # gpg: Good signature from "Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>" [full] # Primary key fingerprint: CC62 1AB9 8E82 200D 915C C9C4 5BC2 C56F AE0F 321F * remotes/mcayland/tags/qemu-sparc-20190517: MAINTAINERS: add myself for leon3 leon3: introduce the plug and play mechanism leon3: add a little bootloader grlib, apbuart: get rid of the old-style create function grlib, gptimer: get rid of the old-style create function grlib, irqmp: get rid of the old-style create function leon3: fix the error message when no bios are provided hw/char/escc: Lower irq when transmit buffer is filled Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2019-05-17Merge remote-tracking branch 'remotes/jasowang/tags/net-pull-request' into ↵Peter Maydell6-4/+19
staging # gpg: Signature made Fri 17 May 2019 10:01:18 BST # gpg: using RSA key EF04965B398D6211 # gpg: Good signature from "Jason Wang (Jason Wang on RedHat) <jasowang@redhat.com>" [marginal] # gpg: WARNING: This key is not certified with sufficiently trusted signatures! # gpg: It is not certain that the signature belongs to the owner. # Primary key fingerprint: 215D 46F4 8246 689E C77F 3562 EF04 965B 398D 6211 * remotes/jasowang/tags/net-pull-request: net/colo-compare.c: Fix a crash in COLO Primary. net/slirp: fix the IPv6 prefix length error message e1000: Never increment the RX undersize count register vhost_net: don't set backend for the uninitialized virtqueue Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2019-05-17Merge remote-tracking branch 'remotes/vivier/tags/m68k-staging-pull-request' ↵Peter Maydell5-38/+84
into staging code cleanup, switch to transaction_failed hook # gpg: Signature made Thu 16 May 2019 23:33:00 BST # gpg: using RSA key F30C38BD3F2FBE3C # gpg: Good signature from "Laurent Vivier <lvivier@redhat.com>" [full] # gpg: aka "Laurent Vivier <laurent@vivier.eu>" [full] # gpg: aka "Laurent Vivier (Red Hat) <lvivier@redhat.com>" [full] # Primary key fingerprint: CD2F 75DD C8E3 A4DC 2E4F 5173 F30C 38BD 3F2F BE3C * remotes/vivier/tags/m68k-staging-pull-request: target/m68k: Optimize rotate_x() using extract_i32() target/m68k: Fix a tcg_temp leak target/m68k: Reduce the l1 TCGLabel scope target/m68k: Switch to transaction_failed hook target/m68k: In get_physical_address() check for memory access failures target/m68k: In dump_address_map() check for memory access failures Signed-off-by: Peter Maydell <peter.maydell@linaro.org> # Conflicts: # target/m68k/cpu.h
2019-05-17net/colo-compare.c: Fix a crash in COLO Primary.Lukas Straub1-2/+1
Because event_unhandled_count may be accessed concurrently, it needs to be protected by taking the lock. However the assert is outside the lock, probably causing it to read garbage and aborting Qemu erroneously. The Bug only happens when running Qemu in COLO mode. This Patch fixes the following bug: https://bugs.launchpad.net/qemu/+bug/1824622 Signed-off-by: Lukas Straub <lukasstraub2@web.de> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Zhang Chen <chen.zhang@intel.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2019-05-17net/slirp: fix the IPv6 prefix length error messageStefano Garzarella1-1/+2
Reword and add a missing parentheses at the end of the error message. Signed-off-by: Stefano Garzarella <sgarzare@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2019-05-17e1000: Never increment the RX undersize count registerChris Kenna1-1/+0
In situations where e1000 receives an undersized Ethernet frame, QEMU increments the emulated "Receive Undersize Count (RUC)" register when padding the frame. This is incorrect because this an expected scenario (e.g. with VLAN tag stripping) and not an error. As such, QEMU should not increment the emulated RUC. Fixes: 3b2743017749 ("e1000: Implementing various counters") Reviewed-by: Mark Kanda <mark.kanda@oracle.com> Reviewed-by: Bhavesh Davda <bhavesh.davda@oracle.com> Reviewed-by: Stefano Garzarella <sgarzare@redhat.com> Signed-off-by: Chris Kenna <chris.kenna@oracle.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2019-05-17vhost_net: don't set backend for the uninitialized virtqueueJason Wang3-0/+16
We used to set backend unconditionally, this won't work for some guests (e.g windows driver) who may not initialize all virtqueues. For kernel backend, this will fail since it may try to validate the rings during setting backend. Fixing this by simply skipping the backend set when we find desc is not ready. Reviewed-by: Michael S. Tsirkin<mst@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2019-05-17MAINTAINERS: add myself for leon3KONRAD Frederic1-0/+1
Reviewed-by: Fabien Chouteau <chouteau@adacore.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Signed-off-by: KONRAD Frederic <frederic.konrad@adacore.com> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
2019-05-17leon3: introduce the plug and play mechanismKONRAD Frederic5-1/+362
This adds the AHB and APB plug and play devices. They are scanned during the linux boot to discover the various peripheral. Reviewed-by: Fabien Chouteau <chouteau@adacore.com> Signed-off-by: KONRAD Frederic <frederic.konrad@adacore.com> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
2019-05-17leon3: add a little bootloaderKONRAD Frederic1-8/+71
This adds a little bootloader to the leon3_machine when a ram image is given through the kernel parameter and no bios are provided: * The UART transmiter is enabled. * The TIMER is initialized. Reviewed-by: Fabien Chouteau <chouteau@adacore.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: KONRAD Frederic <frederic.konrad@adacore.com> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
2019-05-17grlib, apbuart: get rid of the old-style create functionKONRAD Frederic3-22/+11
Suggested-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Signed-off-by: KONRAD Frederic <frederic.konrad@adacore.com> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
2019-05-17grlib, gptimer: get rid of the old-style create functionKONRAD Frederic3-29/+19
Suggested-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Signed-off-by: KONRAD Frederic <frederic.konrad@adacore.com> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
2019-05-17grlib, irqmp: get rid of the old-style create functionKONRAD Frederic3-33/+13
Suggested-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Signed-off-by: KONRAD Frederic <frederic.konrad@adacore.com> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
2019-05-17leon3: fix the error message when no bios are providedKONRAD Frederic1-4/+6
The leon3 board is looking for u-boot.bin by default (LEON3_PROM_FILENAME).. But in the case this file is not found and no other file are given on the command line we get the following error: $ ./qemu-system-sparc -M leon3_generic qemu-system-sparc: Can't read bios image (null) So use LEON3_PROM_FILENAME instead of filename in case it is NULL to get a less cryptic message: $ ./qemu-system-sparc -M leon3_generic qemu-system-sparc: Can't read bios image 'u-boot.bin' Suggested-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Signed-off-by: KONRAD Frederic <frederic.konrad@adacore.com> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
2019-05-17hw/char/escc: Lower irq when transmit buffer is filledStephen Checkoway1-0/+7
The SCC/ESCC will briefly stop asserting an interrupt when the transmit FIFO is filled. This code doesn't model the transmit FIFO/shift register so the pending transmit interrupt is never deasserted which means that an edge-triggered interrupt controller will never see the low-to-high transition it needs to raise another interrupt. The practical consequence of this is that guest firmware with an interrupt service routine for the ESCC that does not send all of the data it has immediately will stop sending data if the following sequence of events occurs: 1. Disable processor interrupts 2. Write a character to the ESCC 3. Add additional characters to a buffer which is drained by the ISR 4. Enable processor interrupts In this case, the first character will be sent, the interrupt will fire and the ISR will output the second character. Since the pending transmit interrupt remains asserted, no additional interrupts will ever fire. This behavior was triggered by firmware for an embedded system with a Z85C30 which necessitated this patch. This patch fixes that situation by explicitly lowering the IRQ when a character is written to the buffer and no other interrupts are currently pending. Signed-off-by: Stephen Checkoway <stephen.checkoway@oberlin.edu> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
2019-05-17target/m68k: Optimize rotate_x() using extract_i32()Philippe Mathieu-Daudé1-3/+2
Optimize rotate_x() using tcg_gen_extract_i32(). We can now free the 'sz' tcg_temp earlier. Since it is allocated with tcg_const_i32(), free it with tcg_temp_free_i32(). Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20190310003428.11723-6-f4bug@amsat.org> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2019-05-17target/m68k: Fix a tcg_temp leakPhilippe Mathieu-Daudé1-0/+1
The function gen_get_ccr() returns a tcg_temp created with tcg_temp_new(). Free it with tcg_temp_free(). Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20190310003428.11723-4-f4bug@amsat.org> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2019-05-17target/m68k: Reduce the l1 TCGLabel scopePhilippe Mathieu-Daudé1-2/+1
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20190310003428.11723-2-f4bug@amsat.org> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2019-05-16target/m68k: Switch to transaction_failed hookPeter Maydell3-16/+13
Switch the m68k target from the old unassigned_access hook to the transaction_failed hook. The notable difference is that rather than it being called for all physical memory accesses which fail (including those made by DMA devices or by the gdbstub), it is only called for those made by the CPU via its MMU. (In previous commits we put in explicit checks for the direct physical loads made by the target/m68k code which will no longer be handled by calling the unassigned_access hook.) Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-Id: <20181210165636.28366-4-peter.maydell@linaro.org> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2019-05-16target/m68k: In get_physical_address() check for memory access failuresPeter Maydell1-10/+52
In get_physical_address(), use address_space_ldl() and address_space_stl() instead of ldl_phys() and stl_phys(). This allows us to check whether the memory access failed. For the moment, we simply return -1 in this case; add a TODO comment that we should ideally generate the appropriate kind of fault. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-Id: <20181210165636.28366-3-peter.maydell@linaro.org> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2019-05-16target/m68k: In dump_address_map() check for memory access failuresPeter Maydell1-7/+15
In dump_address_map(), use address_space_ldl() instead of ldl_phys(). This allows us to check whether the memory access failed. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-Id: <20181210165636.28366-2-peter.maydell@linaro.org> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2019-05-16Merge remote-tracking branch 'remotes/rth/tags/pull-tcg-20190510' into stagingPeter Maydell83-1129/+866
Add CPUClass::tlb_fill. Improve tlb_vaddr_to_host for use by ARM SVE no-fault loads. # gpg: Signature made Fri 10 May 2019 19:48:37 BST # gpg: using RSA key 7A481E78868B4DB6A85A05C064DF38E8AF7E215F # gpg: issuer "richard.henderson@linaro.org" # gpg: Good signature from "Richard Henderson <richard.henderson@linaro.org>" [full] # Primary key fingerprint: 7A48 1E78 868B 4DB6 A85A 05C0 64DF 38E8 AF7E 215F * remotes/rth/tags/pull-tcg-20190510: (27 commits) tcg: Use tlb_fill probe from tlb_vaddr_to_host tcg: Remove CPUClass::handle_mmu_fault tcg: Use CPUClass::tlb_fill in cputlb.c target/xtensa: Convert to CPUClass::tlb_fill target/unicore32: Convert to CPUClass::tlb_fill target/tricore: Convert to CPUClass::tlb_fill target/tilegx: Convert to CPUClass::tlb_fill target/sparc: Convert to CPUClass::tlb_fill target/sh4: Convert to CPUClass::tlb_fill target/s390x: Convert to CPUClass::tlb_fill target/riscv: Convert to CPUClass::tlb_fill target/ppc: Convert to CPUClass::tlb_fill target/openrisc: Convert to CPUClass::tlb_fill target/nios2: Convert to CPUClass::tlb_fill target/moxie: Convert to CPUClass::tlb_fill target/mips: Convert to CPUClass::tlb_fill target/mips: Tidy control flow in mips_cpu_handle_mmu_fault target/mips: Pass a valid error to raise_mmu_exception for user-only target/microblaze: Convert to CPUClass::tlb_fill target/m68k: Convert to CPUClass::tlb_fill ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2019-05-16Merge remote-tracking branch ↵Peter Maydell11-75/+105
'remotes/dgilbert/tags/pull-migration-20190514b' into staging Migration pull 2019-05-14 Small fixes/cleanups One HMP/monitor fix # gpg: Signature made Tue 14 May 2019 19:03:53 BST # gpg: using RSA key 45F5C71B4A0CB7FB977A9FA90516331EBC5BFDE7 # gpg: Good signature from "Dr. David Alan Gilbert (RH2) <dgilbert@redhat.com>" [full] # Primary key fingerprint: 45F5 C71B 4A0C B7FB 977A 9FA9 0516 331E BC5B FDE7 * remotes/dgilbert/tags/pull-migration-20190514b: monitor: Call mon_get_cpu() only once at hmp_gva2gpa() migration/ram.c: fix typos in comments migration: Fix use-after-free during process exit migration/savevm: wrap into qemu_loadvm_state_header() migration/savevm: load_header before load_setup migration/savevm: remove duplicate check of migration_is_blocked migration: update comments of migration bitmap migration/ram.c: start of migration_bitmap_sync_range is always 0 qemu-option.hx: Update missed parameter for colo-compare migration/colo.h: Remove obsolete codes migration/colo.c: Remove redundant input parameter migration: savevm: fix error code with migration blockers vmstate: check subsection_found is enough migration: remove not used field xfer_limit migration: not necessary to check ops again migration: comment VMSTATE_UNUSED*() properly Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2019-05-14monitor: Call mon_get_cpu() only once at hmp_gva2gpa()Eduardo Habkost1-2/+1
hmp_gva2gpa() calls mon_get_cpu() twice, which is unnecessary. Not an actual bug, but this is reported as a defect by Coverity Scan (CID 1401346). Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Message-Id: <20190510185620.15757-1-ehabkost@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2019-05-14migration/ram.c: fix typos in commentsWei Yang1-5/+5
Signed-off-by: Wei Yang <richardw.yang@linux.intel.com> Message-Id: <20190510233729.15554-1-richardw.yang@linux.intel.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2019-05-14migration: Fix use-after-free during process exitYury Kotov1-5/+20
It fixes heap-use-after-free which was found by clang's ASAN. Control flow of this use-after-free: main_thread: * Got SIGTERM and completes main loop * Calls migration_shutdown - migrate_fd_cancel (so, migration_thread begins to complete) - object_unref(OBJECT(current_migration)); migration_thread: * migration_iteration_finish -> schedule cleanup bh * object_unref(OBJECT(s)); (Now, current_migration is freed) * exits main_thread: * Calls vm_shutdown -> drain bdrvs -> main loop -> cleanup_bh -> use after free If you want to reproduce, these couple of sleeps will help: vl.c:4613: migration_shutdown(); + sleep(2); migration.c:3269: + sleep(1); trace_migration_thread_after_loop(); migration_iteration_finish(s); Original output: qemu-system-x86_64: terminating on signal 15 from pid 31980 (<unknown process>) ================================================================= ==31958==ERROR: AddressSanitizer: heap-use-after-free on address 0x61900001d210 at pc 0x555558a535ca bp 0x7fffffffb190 sp 0x7fffffffb188 READ of size 8 at 0x61900001d210 thread T0 (qemu-vm-0) #0 0x555558a535c9 in migrate_fd_cleanup migration/migration.c:1502:23 #1 0x5555594fde0a in aio_bh_call util/async.c:90:5 #2 0x5555594fe522 in aio_bh_poll util/async.c:118:13 #3 0x555559524783 in aio_poll util/aio-posix.c:725:17 #4 0x555559504fb3 in aio_wait_bh_oneshot util/aio-wait.c:71:5 #5 0x5555573bddf6 in virtio_blk_data_plane_stop hw/block/dataplane/virtio-blk.c:282:5 #6 0x5555589d5c09 in virtio_bus_stop_ioeventfd hw/virtio/virtio-bus.c:246:9 #7 0x5555589e9917 in virtio_pci_stop_ioeventfd hw/virtio/virtio-pci.c:287:5 #8 0x5555589e22bf in virtio_pci_vmstate_change hw/virtio/virtio-pci.c:1072:9 #9 0x555557628931 in virtio_vmstate_change hw/virtio/virtio.c:2257:9 #10 0x555557c36713 in vm_state_notify vl.c:1605:9 #11 0x55555716ef53 in do_vm_stop cpus.c:1074:9 #12 0x55555716eeff in vm_shutdown cpus.c:1092:12 #13 0x555557c4283e in main vl.c:4617:5 #14 0x7fffdfdb482f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) #15 0x555556ecb118 in _start (x86_64-softmmu/qemu-system-x86_64+0x1977118) 0x61900001d210 is located 144 bytes inside of 952-byte region [0x61900001d180,0x61900001d538) freed by thread T6 (live_migration) here: #0 0x555556f76782 in __interceptor_free /tmp/final/llvm.src/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:124:3 #1 0x555558d5fa94 in object_finalize qom/object.c:618:9 #2 0x555558d57651 in object_unref qom/object.c:1068:9 #3 0x555558a55588 in migration_thread migration/migration.c:3272:5 #4 0x5555595393f2 in qemu_thread_start util/qemu-thread-posix.c:502:9 #5 0x7fffe057f6b9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9) previously allocated by thread T0 (qemu-vm-0) here: #0 0x555556f76b03 in __interceptor_malloc /tmp/final/llvm.src/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:146:3 #1 0x7ffff6ee37b8 in g_malloc (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x4f7b8) #2 0x555558d58031 in object_new qom/object.c:640:12 #3 0x555558a31f21 in migration_object_init migration/migration.c:139:25 #4 0x555557c41398 in main vl.c:4320:5 #5 0x7fffdfdb482f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) Thread T6 (live_migration) created by T0 (qemu-vm-0) here: #0 0x555556f5f0dd in pthread_create /tmp/final/llvm.src/projects/compiler-rt/lib/asan/asan_interceptors.cc:210:3 #1 0x555559538cf9 in qemu_thread_create util/qemu-thread-posix.c:539:11 #2 0x555558a53304 in migrate_fd_connect migration/migration.c:3332:5 #3 0x555558a72bd8 in migration_channel_connect migration/channel.c:92:5 #4 0x555558a6ef87 in exec_start_outgoing_migration migration/exec.c:42:5 #5 0x555558a4f3c2 in qmp_migrate migration/migration.c:1922:9 #6 0x555558bb4f6a in qmp_marshal_migrate qapi/qapi-commands-migration.c:607:5 #7 0x555559363738 in do_qmp_dispatch qapi/qmp-dispatch.c:131:5 #8 0x555559362a15 in qmp_dispatch qapi/qmp-dispatch.c:174:11 #9 0x5555571bac15 in monitor_qmp_dispatch monitor.c:4124:11 #10 0x55555719a22d in monitor_qmp_bh_dispatcher monitor.c:4207:9 #11 0x5555594fde0a in aio_bh_call util/async.c:90:5 #12 0x5555594fe522 in aio_bh_poll util/async.c:118:13 #13 0x5555595201e0 in aio_dispatch util/aio-posix.c:460:5 #14 0x555559503553 in aio_ctx_dispatch util/async.c:261:5 #15 0x7ffff6ede196 in g_main_context_dispatch (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x4a196) SUMMARY: AddressSanitizer: heap-use-after-free migration/migration.c:1502:23 in migrate_fd_cleanup Shadow bytes around the buggy address: 0x0c327fffb9f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c327fffba00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c327fffba10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c327fffba20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c327fffba30: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd =>0x0c327fffba40: fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c327fffba50: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c327fffba60: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c327fffba70: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c327fffba80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c327fffba90: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb Shadow gap: cc ==31958==ABORTING Signed-off-by: Yury Kotov <yury-kotov@yandex-team.ru> Message-Id: <20190408113343.2370-1-yury-kotov@yandex-team.ru> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Fixed up comment formatting
2019-05-14migration/savevm: wrap into qemu_loadvm_state_header()Wei Yang1-29/+40
On source side, we have qemu_savevm_state_header() to send related data, while on the receiving side those steps are scattered in qemu_loadvm_state(). This patch wrap those related steps into qemu_loadvm_state_header() to make it friendly to read. Signed-off-by: Wei Yang <richardw.yang@linux.intel.com> Message-Id: <20190424004700.12766-5-richardw.yang@linux.intel.com> Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2019-05-14migration/savevm: load_header before load_setupWei Yang1-4/+4
In migration_thread() and qemu_savevm_state(), we savevm_state in following sequence: qemu_savevm_state_header(f); qemu_savevm_state_setup(f); Then it would be more proper to loadvm_state in the save sequence. Signed-off-by: Wei Yang <richardw.yang@linux.intel.com> Message-Id: <20190424004700.12766-4-richardw.yang@linux.intel.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2019-05-14migration/savevm: remove duplicate check of migration_is_blockedWei Yang1-4/+0
Current call flow of save_snapshot is: save_snapshot migration_is_blocked qemu_savevm_state migration_is_blocked Since qemu_savevm_state is only called in save_snapshot, this means migration_is_blocked has been already checked. Signed-off-by: Wei Yang <richardw.yang@linux.intel.com> Message-Id: <20190424004700.12766-2-richardw.yang@linux.intel.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2019-05-14migration: update comments of migration bitmapYi Wang1-3/+1
Since the ram bitmap and the unsent bitmap are split by RAMBlock in commit 6b6712e, it's better to update the comments about them. Signed-off-by: Yi Wang <wang.yi59@zte.com.cn> Message-Id: <1555311089-18610-1-git-send-email-wang.yi59@zte.com.cn> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2019-05-14migration/ram.c: start of migration_bitmap_sync_range is always 0Wei Yang1-4/+4
We can eliminate to pass 0. Signed-off-by: Wei Yang <richardw.yang@linux.intel.com> Message-Id: <20190430034412.12935-2-richardw.yang@linux.intel.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2019-05-14qemu-option.hx: Update missed parameter for colo-compareZhang Chen1-3/+6
We missed the iothread related args in this file. This patch is used to fix this issue. Signed-off-by: Zhang Chen <chen.zhang@intel.com> Message-Id: <20190426090730.2691-4-chen.zhang@intel.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2019-05-14migration/colo.h: Remove obsolete codesZhang Chen1-2/+0
Signed-off-by: Zhang Chen <chen.zhang@intel.com> Message-Id: <20190426090730.2691-3-chen.zhang@intel.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2019-05-14migration/colo.c: Remove redundant input parameterZhang Chen3-3/+3
The colo_do_failover no need the input parameter. Signed-off-by: Zhang Chen <chen.zhang@intel.com> Message-Id: <20190426090730.2691-2-chen.zhang@intel.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2019-05-14migration: savevm: fix error code with migration blockersCole Robinson1-1/+1
The only caller that checks the error code is looking for != 0, so returning false is incorrect. Fixes: 5aaac467938 "migration: savevm: consult migration blockers" Signed-off-by: Cole Robinson <crobinso@redhat.com> Message-Id: <b991a4d0e6c4253bc08b2794c6084be55fc72e1d.1554851834.git.crobinso@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: Juan Quintela <quintela@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2019-05-14vmstate: check subsection_found is enoughWei Yang1-4/+4
subsection_found is true implies vmdesc is not NULL. This patch remove the additional check on vmdesc and rename subsection_found to vmdesc_has_subsections to make it more self-explain. Signed-off-by: Wei Yang <richardw.yang@linux.intel.com> Message-Id: <20190403011016.12549-1-richardw.yang@linux.intel.com> Acked-by: Stefano Garzarella <sgarzare@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2019-05-14migration: remove not used field xfer_limitWei Yang2-2/+0
MigrationState->xfer_limit is only set to 0 in migrate_init(). Remove this unnecessary field. Signed-off-by: Wei Yang <richardw.yang@linux.intel.com> Message-Id: <20190326055726.10539-1-richardw.yang@linux.intel.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2019-05-14migration: not necessary to check ops againWei Yang1-8/+6
During each iteration, se->ops is checked before each loop. So it is not necessary to check it again and simplify the following check a little. Signed-off-by: Wei Yang <richardw.yang@linux.intel.com> Message-Id: <20190327013130.26259-1-richardw.yang@linux.intel.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2019-05-14migration: comment VMSTATE_UNUSED*() properlyPeter Xu1-0/+14
It is error prone to use VMSTATE_UNUSED*() sometimes especially when the size of the migration stream of the field is not the same as the size of the structure (boolean is one example). Comment it well so people will be aware of this when people want to use it. Signed-off-by: Peter Xu <peterx@redhat.com> Message-Id: <20190329095713.14177-1-peterx@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2019-05-14Merge remote-tracking branch 'remotes/rth/tags/pull-tcg-20190513' into stagingPeter Maydell36-473/+2020
Improve code generation for vector duplication. Add vector expansions for shifts by non-constant scalar. Add vector expansions for shifts by vector. Add integer and vector expansions for absolute value. Several patches in preparation for Altivec. Bug fix for tcg/aarch64 vs min/max. # gpg: Signature made Tue 14 May 2019 00:58:02 BST # gpg: using RSA key 7A481E78868B4DB6A85A05C064DF38E8AF7E215F # gpg: issuer "richard.henderson@linaro.org" # gpg: Good signature from "Richard Henderson <richard.henderson@linaro.org>" [full] # Primary key fingerprint: 7A48 1E78 868B 4DB6 A85A 05C0 64DF 38E8 AF7E 215F * remotes/rth/tags/pull-tcg-20190513: (31 commits) tcg/aarch64: Do not advertise minmax for MO_64 target/xtensa: Use tcg_gen_abs_i32 target/tricore: Use tcg_gen_abs_tl target/s390x: Use tcg_gen_abs_i64 target/ppc: Use tcg_gen_abs_tl target/ppc: Use tcg_gen_abs_i32 target/cris: Use tcg_gen_abs_tl target/arm: Use tcg_gen_abs_i64 and tcg_gen_gvec_abs tcg/aarch64: Support vector absolute value tcg/i386: Support vector absolute value tcg: Add support for vector absolute value tcg: Add support for integer absolute value tcg/i386: Support vector scalar shift opcodes tcg: Add gvec expanders for vector shift by scalar tcg/aarch64: Support vector variable shift opcodes tcg/i386: Support vector variable shift opcodes tcg: Add gvec expanders for variable shift tcg: Add INDEX_op_dupm_vec tcg/aarch64: Implement tcg_out_dupm_vec tcg/i386: Implement tcg_out_dupm_vec ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2019-05-13tcg/aarch64: Do not advertise minmax for MO_64Richard Henderson1-4/+4
The min/max instructions are not available for 64-bit elements. Fixes: 93f332a50371 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2019-05-13target/xtensa: Use tcg_gen_abs_i32Richard Henderson1-8/+1
Acked-by: Max Filippov <jcmvbkbc@gmail.com> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2019-05-13target/tricore: Use tcg_gen_abs_tlPhilippe Mathieu-Daudé1-22/+5
Reviewed-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20190423102145.14812-3-f4bug@amsat.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2019-05-13target/s390x: Use tcg_gen_abs_i64Richard Henderson1-7/+1
Reviewed-by: David Hildenbrand <david@redhat.com> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
generated by cgit v1.1 at 2025-02-23 19:39:13 +0000