riscv/qemu - qemu - Gitea: Git with a cup of tea

Commit Graph

Author	SHA1	Message	Date
Thomas Huth	1ddc9b98c3	hw/intc/exynos4210_gic: Turn instance_init into realize function The instance_init function of the "exynos4210.gic" device creates a new "arm_gic" device and immediately realizes it with qdev_init_nofail(). This will leave a lot of object in the QOM tree during introspection of the "exynos4210.gic" device, e.g. reproducible by starting QEMU like this: qemu-system-aarch64 -M none -nodefaults -nographic -monitor stdio And then by running "info qom-tree" at the HMP monitor, followed by "device_add exynos4210.gic,help" and finally checking "info qom-tree" again. Also note that qdev_init_nofail() can exit QEMU in case of errors - and this must never happen during an instance_init function, otherwise QEMU could terminate unexpectedly during introspection of a device. Since most of the code that follows the qdev_init_nofail() depends on the realized "gicbusdev", the easiest solution to the problem is to turn the whole instance_init function into a realize function instead. Signed-off-by: Thomas Huth <thuth@redhat.com> Message-id: 1532337784-334-1-git-send-email-thuth@redhat.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>	8 years ago
Thomas Huth	07bc425ea3	hw/arm/spitz: Move problematic nand_init() code to realize function nand_init() does not only create the NAND device, it also realizes the device with qdev_init_nofail() already. So we must not call nand_init() from an instance_init function like sl_nand_init(), otherwise we get superfluous NAND devices in the QOM tree after introspecting the 'sl-nand' device. So move the nand_init() to the realize function of 'sl-nand' instead. Signed-off-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 1532006134-7701-1-git-send-email-thuth@redhat.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>	8 years ago
Peter Maydell	9d2b5a58f8	target/arm: Correctly handle overlapping small MPU regions To correctly handle small (less than TARGET_PAGE_SIZE) MPU regions, we must correctly handle the case where the address being looked up hits in an MPU region that is not small but the address is in the same page as a small region. For instance if MPU region 1 covers an entire page from 0x2000 to 0x2400 and MPU region 2 is small and covers only 0x2200 to 0x2280, then for an access to 0x2000 we must not return a result covering the full page even though we hit the page-sized region 1. Otherwise we will then cache that result in the TLB and accesses that should hit region 2 will incorrectly find the region 1 information. Check for the case where we miss an MPU region but it is still within the same page, and in that case narrow the size we will pass to tlb_set_page_with_attrs() for whatever the final outcome is of the MPU lookup. Reported-by: Adithya Baglody <adithya.nagaraj.baglody@intel.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20180716133302.25989-1-peter.maydell@linaro.org	8 years ago
Guenter Roeck	03a31776e8	hw/sd/bcm2835_sdhost: Fix PIO mode writes Writes in PIO mode have two requirements: - A data interrupt must be generated after a write command has been issued to indicate that the chip is ready to receive data. - A block interrupt must be generated after each block to indicate that the chip is ready to receive the next data block. Rearrange the code to make this happen. Tested on raspi3 (in PIO mode) and raspi2 (in DMA mode). Signed-off-by: Guenter Roeck <linux@roeck-us.net> Message-id: 1531779837-20557-1-git-send-email-linux@roeck-us.net Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>	8 years ago
Thomas Huth	7b6d7b84da	hw/microblaze/xlnx-zynqmp-pmu: Fix introspection problem in 'xlnx, zynqmp-pmu-soc' Valgrind complains: echo "{'execute':'qmp_capabilities'} {'execute':'device-list-properties'," \ "'arguments':{'typename':'xlnx,zynqmp-pmu-soc'}}" \ "{'execute': 'human-monitor-command', " \ "'arguments': {'command-line': 'info qtree'}}" \| \ valgrind -q microblazeel-softmmu/qemu-system-microblazeel -M none,accel=qtest -qmp stdio [...] ==13605== Invalid read of size 8 ==13605== at 0x2AC69A: qdev_print (qdev-monitor.c:686) ==13605== by 0x2AC69A: qbus_print (qdev-monitor.c:719) ==13605== by 0x2591E8: handle_hmp_command (monitor.c:3446) Use the new object_initialize_child() and sysbus_init_child_obj() to fix the issue. Signed-off-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Message-id: 1531839343-13828-1-git-send-email-thuth@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>	8 years ago
Peter Maydell	55b1f14cef	Some ppc/ppc64 fixes: - we can run now most of the targets on a ppc64 host with 64kB pages - add swapcontext syscall to run tests/test-coroutine in debian-powerpc-user-cross -----BEGIN PGP SIGNATURE----- iQIcBAABAgAGBQJbVdBdAAoJEPMMOL0/L748vuUP/2gxM37iTEKRs/tT46fWj1/u Lq+TQqsTJ0xKzrTJr47HgpHJfIbYdqx0Smd1/0bkDN99H402d+4n6m+Oj62YCaBK XxtO9CC7fuzLdd99g8NVVvactzhmXYpFKm8E8O+FLogV+ku1hEZHsnPo+l2bZmBv GSxoy2pvaogFK1BP4vIvcLxbzUCyg1V6GIzLJpTdfaGMoezTeg7WT+n5SdYXIbdR YB9RkMo0Qxjr4mM9g8B39oTGQwp8XHGk1E2QKzDNxP1ydG4MWyBbwGKW1hA/n1/F 6GcAtClsBy6lOFY2t/YR8VxXWuDHMRwoRWhEtMUhF8TsWdAtm3KfzuZ7PibuetMO cneSNzT6Nbyc4qrbqINlBLmbqT201fWRPXUAt9XiblmDG2c9A4w1uiHAQ4zOoCWx cPiDFXKrJe4OSLgHlBJdH1hox8kaSeb/ryZyOz98Zb95/ETYOQ0ZlF5zwEzp+R1N BRTy+0ryAeRQCg0zg/D1NS5cptK4oP328xsobaqPcWDAhUKbUpS1zjWBuFSzwKFQ SCSQAOKnq3XtwT4OZJw7gBdo9fyWBdb6MbV5uCuJXzX+Bv2/XeTWJFj3oeml5CkR 6+M+J3f82SYBLW6EuUyikbAOLdeKQqcIsDSHwC7mdt4pZrFTusGEWssAJVDFDZEH jdk4ZlUXuLj+oPMTs3ZL =DTRa -----END PGP SIGNATURE----- Merge remote-tracking branch 'remotes/vivier2/tags/linux-user-for-3.0-pull-request' into staging Some ppc/ppc64 fixes: - we can run now most of the targets on a ppc64 host with 64kB pages - add swapcontext syscall to run tests/test-coroutine in debian-powerpc-user-cross # gpg: Signature made Mon 23 Jul 2018 13:55:57 BST # gpg: using RSA key F30C38BD3F2FBE3C # gpg: Good signature from "Laurent Vivier <lvivier@redhat.com>" # gpg: aka "Laurent Vivier <laurent@vivier.eu>" # gpg: aka "Laurent Vivier (Red Hat) <lvivier@redhat.com>" # Primary key fingerprint: CD2F 75DD C8E3 A4DC 2E4F 5173 F30C 38BD 3F2F BE3C * remotes/vivier2/tags/linux-user-for-3.0-pull-request: linux-user/ppc: Implement swapcontext syscall linux-user: fix ELF load alignment error Signed-off-by: Peter Maydell <peter.maydell@linaro.org>	8 years ago
Stefan Weil	6598f0cdad	po: Don't include comments with location Those comments change often when ui/gtk.c is changed and are not really useful. Signed-off-by: Stefan Weil <sw@weilnetz.de> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Thomas Huth <thuth@redhat.com> Message-id: 20180720212509.18339-1-sw@weilnetz.de Signed-off-by: Peter Maydell <peter.maydell@linaro.org>	8 years ago
Richard Henderson	fa97e38eed	linux-user/ppc: Implement swapcontext syscall This allows the tests generated by debian-powerpc-user-cross to function properly, especially tests/test-coroutine. Technically this syscall is available to both ppc32 and ppc64, but only ppc32 glibc actually uses it. Thus the ppc64 path is untested. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Tested-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <20180718200648.22529-1-richard.henderson@linaro.org>	8 years ago
Laurent Vivier	33143c446e	linux-user: fix ELF load alignment error When we try to use some targets on ppc64, it can happen the target doesn't support the host page size to align ELF load sections and fails with: ELF load command alignment not page-aligned Since commit `a70daba377` ("linux-user: Tell guest about big host page sizes") the host page size is used to align ELF sections, but this doesn't work if the alignment required by the load section is smaller than the host one. For these cases, we continue to use the TARGET_PAGE_SIZE instead of the host one. I have tested this change on ppc64, and it fixes qemu linux-user for: s390x, m68k, i386, arm, aarch64, hppa and I have tested it doesn't break the following targets: x86_64, mips64el, sh4 mips and mipsel abort, but I think for another reason. Signed-off-by: Laurent Vivier <laurent@vivier.eu> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> [lv: fixed "info->alignment = 0"] Message-Id: <20180716195349.29959-1-laurent@vivier.eu>	8 years ago
Peter Maydell	5b3ecd3d94	Fix aarch64 host vector mul -----BEGIN PGP SIGNATURE----- iQEcBAABAgAGBQJbUV3oAAoJEGTfOOivfiFfrYoH/R3M+BLFwS2CRfEc3Du1fSdy So35c4X9SwyMf9uPGkmWEpQtqcSy88ONbqeecsJC+YkJUpCkueF3206+eOO3uFIh Sz5niIUzd3rDKU/pmgj1NyUopfBuqfx81zEpccRjRIEN5Df7BV2xk96f6Cs1r50a GybmxgNLgc39NGDVXuoZvSKdiMMTcD/HwQU2Lt0NY0c9ZLkxa+nkpHveUgwfX/2v csa4rmyo+1+bSs2Ylmj04arI7NUyJjaFqnhgKDJl6xej7m9acvcZzw6z8WAYwUqj gi3uPFec9BU8ePKD1kl/0CdjwAnGOc8Izk94Wzfcnsp1oWD5X3tHe2lBTeCrDSA= =SP/k -----END PGP SIGNATURE----- Merge remote-tracking branch 'remotes/rth/tags/pull-tcg-20180719' into staging Fix aarch64 host vector mul # gpg: Signature made Fri 20 Jul 2018 04:58:32 BST # gpg: using RSA key 64DF38E8AF7E215F # gpg: Good signature from "Richard Henderson <richard.henderson@linaro.org>" # Primary key fingerprint: 7A48 1E78 868B 4DB6 A85A 05C0 64DF 38E8 AF7E 215F * remotes/rth/tags/pull-tcg-20180719: tcg/aarch64: limit mul_vec size Signed-off-by: Peter Maydell <peter.maydell@linaro.org>	8 years ago
Peter Maydell	9d5d247e32	-----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQEcBAABAgAGBQJbUS+LAAoJEO8Ells5jWIRaM0H+wZMfW4SDf+CaR3e4LZVRvyS 88km4y4EZFbAnVmI89fUzn9FhDizT659vgTxNwrFd1S/p/x51OzrEJtiGm/OfkRc y/fU2DQt8eIx2WDp7HzvHyMYXd08WQiItyJbpCLUukqXAzX2v4OATnz9ZoAxPHof z0fzejOokEo0fKqe+LgOB3upQDRsXGPOYiSo7wUHy1tk9P+ndym5kZcdU44EPtON Q/6COv3claUmEmDtQbpOhPZ2HPFL5nJoSL9rIKfUEweJj1+OHp7b1+lrw1W7sPRP INUdmX5+bnk6oieR2dsSFp8IealZH6BwZ4jkc8sME/HeCSBTy1mWyeFa+TDA2lI= =3U4O -----END PGP SIGNATURE----- Merge remote-tracking branch 'remotes/jasowang/tags/net-pull-request' into staging # gpg: Signature made Fri 20 Jul 2018 01:40:43 BST # gpg: using RSA key EF04965B398D6211 # gpg: Good signature from "Jason Wang (Jason Wang on RedHat) <jasowang@redhat.com>" # gpg: WARNING: This key is not certified with sufficiently trusted signatures! # gpg: It is not certain that the signature belongs to the owner. # Primary key fingerprint: 215D 46F4 8246 689E C77F 3562 EF04 965B 398D 6211 * remotes/jasowang/tags/net-pull-request: tap: fix memory leak on success to create a tap device e1000e: Prevent MSI/MSI-X storms Signed-off-by: Peter Maydell <peter.maydell@linaro.org>	8 years ago
Yunjian Wang	323e7c1177	tap: fix memory leak on success to create a tap device The memory leak on success to create a tap device. And the nfds and nvhosts may not be the same and need to be processed separately. Fixes: 07825977 ("tap: fix memory leak on failure to create a multiqueue tap device") Fixes: `264986e2` ("tap: multiqueue support") Cc: qemu-stable@nongnu.org Signed-off-by: Yunjian Wang <wangyunjian@huawei.com> Signed-off-by: Jason Wang <jasowang@redhat.com>	8 years ago
Jan Kiszka	4712c158c5	e1000e: Prevent MSI/MSI-X storms Only signal MSI/MSI-X events on rising edges. So far we re-triggered the interrupt sources even if the guest did no consumed the pending one, easily causing interrupt storms. Issue was observable with Linux 4.16 e1000e driver when MSI-X was used. Vector 2 was causing interrupt storms after the driver activated the device. Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com> Signed-off-by: Jason Wang <jasowang@redhat.com>	8 years ago
Peter Maydell	0b46a3f005	Pull request Contains a fix to use double-dash consistently with tracing command-line options in documentation and output. -----BEGIN PGP SIGNATURE----- iQEcBAABAgAGBQJbULtTAAoJEJykq7OBq3PIJFUH/iuk6OMzhBcC//yOkCswN8te 7LIOnfQHyN5nz9PUfYO2yOhlQNUbub6oNA4UFV6EfOJ1rmteYA8EOw2sqUp8h7Gw FoSeo/CA6cAKuyiEHPhn+e59h1R7zP+xc2aW8heoeR2VRQ5YRRA89MocDDLaVAVC 9h6jmaE9wR5kv9Dsf2eZezXItISnLiJS5OpsMMCOahyVlprl9L56bfAWBhuQqbhB IAQpdVBB2FTBMeOKlHX8vFSMppfV3PvjF6ynPmdGZeUY6rm9dlkgd/sNr1gCaxZP YH2tbTwE+LHA2Fs/zYTXPWBMXuknvYHelbNpCdshbIXE20/VXP82kjnQfopBo98= =/8Hl -----END PGP SIGNATURE----- Merge remote-tracking branch 'remotes/stefanha/tags/tracing-pull-request' into staging Pull request Contains a fix to use double-dash consistently with tracing command-line options in documentation and output. # gpg: Signature made Thu 19 Jul 2018 17:24:51 BST # gpg: using RSA key 9CA4ABB381AB73C8 # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>" # gpg: aka "Stefan Hajnoczi <stefanha@gmail.com>" # Primary key fingerprint: 8695 A8BF D3F9 7CDA AC35 775A 9CA4 ABB3 81AB 73C8 * remotes/stefanha/tags/tracing-pull-request: tracing: Use double-dash spelling for trace option Signed-off-by: Peter Maydell <peter.maydell@linaro.org>	8 years ago
Peter Maydell	9f2b67e1ca	riscv: Fix introspection problems This is based on Thomas's work fixing introspection problems [1] and applied to the RISC-V port. 1: https://lists.gnu.org/archive/html/qemu-devel/2018-07/msg03261.html -----BEGIN PGP SIGNATURE----- iQEzBAABCgAdFiEE9sSsRtSTSGjTuM6PIeENKd+XcFQFAltQtu8ACgkQIeENKd+X cFTCvAf+MNkMDcOJOlb2AsCwmYcnDj1YwiaobkDpPbKCl4u2q6j6kOhbBGpaROE0 RBwIYOMIuWiyevnlDSytFGgc+TSnriFNmwMrfMKlD8haRbc+mbYulRICAYIRWCOo mk8Z+GYn3fw8tYiIudEj2jmObA7ushMjhKvo8/RmWk+Gz866KS8BpqR8LiTm6E66 ejiar28IDId+XUbl3OJhh4RzUCyttEMfmUKE5s8Bi4gPN6J578FexdcLIlvkqPqN UUMz/8GgogjvFS/jkR5fRIcdqV6flKNtwnzZByTu76HtyvF7kXMr5PHe52kgVAQ2 0RYea4XxQWMG+9MeZ/CsXYyiJRi/Lg== =EVRY -----END PGP SIGNATURE----- Merge remote-tracking branch 'remotes/alistair/tags/pull-riscv-pull-20180719' into staging riscv: Fix introspection problems This is based on Thomas's work fixing introspection problems [1] and applied to the RISC-V port. 1: https://lists.gnu.org/archive/html/qemu-devel/2018-07/msg03261.html # gpg: Signature made Thu 19 Jul 2018 17:06:07 BST # gpg: using RSA key 21E10D29DF977054 # gpg: Good signature from "Alistair Francis <alistair@alistair23.me>" # gpg: WARNING: This key is not certified with sufficiently trusted signatures! # gpg: It is not certain that the signature belongs to the owner. # Primary key fingerprint: F6C4 AC46 D493 4868 D3B8 CE8F 21E1 0D29 DF97 7054 * remotes/alistair/tags/pull-riscv-pull-20180719: spike: Fix crash when introspecting the device riscv_hart: Fix crash when introspecting the device virt: Fix crash when introspecting the device sifive_u: Fix crash when introspecting the device sifive_e: Fix crash when introspecting the device Signed-off-by: Peter Maydell <peter.maydell@linaro.org>	8 years ago
Alex Bennée	e65a5f227d	tcg/aarch64: limit mul_vec size In AdvSIMD we can only do 32x32 integer multiples although SVE is capable of larger 64 bit multiples. As a result we can end up generating invalid opcodes. Fix this by only reprting we can emit mul vector ops if the size is small enough. Fixes a crash on: sve-all-short-v8.3+sve@vq3/insn_mul_z_zi___INC.risu.bin When running on AArch64 hardware. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20180719154248.29669-1-alex.bennee@linaro.org> [rth: Removed the tcg_debug_assert -- there are plenty of other cases that we do not diagnose within the insn encoding helpers.] Signed-off-by: Richard Henderson <richard.henderson@linaro.org>	8 years ago
Alistair Francis	8ff62f6aa0	spike: Fix crash when introspecting the device Use the new object_initialize_child() and sysbus_init_child_obj() to fix the issue. Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Suggested-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Michael Clark <mjc@sifive.com> Reviewed-by: Thomas Huth <thuth@redhat.com>	8 years ago
Alistair Francis	5657c3f53c	riscv_hart: Fix crash when introspecting the device Use the new object_initialize_child() and sysbus_init_child_obj() to fix the issue. Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Suggested-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Michael Clark <mjc@sifive.com> Reviewed-by: Thomas Huth <thuth@redhat.com>	8 years ago
Alistair Francis	a993cb150f	virt: Fix crash when introspecting the device Use the new object_initialize_child() and sysbus_init_child_obj() to fix the issue. Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Suggested-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Michael Clark <mjc@sifive.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>	8 years ago
Alistair Francis	4eea9d7deb	sifive_u: Fix crash when introspecting the device Use the new object_initialize_child() and sysbus_init_child_obj() to fix the issue. Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Suggested-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Michael Clark <mjc@sifive.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>	8 years ago
Alistair Francis	54f3141a58	sifive_e: Fix crash when introspecting the device Use the new object_initialize_child() and sysbus_init_child_obj() to fix the issue. Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Suggested-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Michael Clark <mjc@sifive.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>	8 years ago
Peter Maydell	e1ea55668f	Pull request This fix prevents hangs when a drive leaves a throttling group. -----BEGIN PGP SIGNATURE----- iQEcBAABAgAGBQJbUKAVAAoJEJykq7OBq3PIrTwH+wUjn5FCz1DFeGtEGof/CzMN vzGC+LPm1zcvgHf62afeCwYPAJbAYpX4xj4uqF4RT87QBXgb737d6y7JW+4eH6DA Ibf6aC9H/0KtMl5x3MYWGkXAe5RedY+01Yiy8idWHs3/AkZ0K18AvOUn7RMNFH1a wogHpqpb6nRSpetHuWi650TJCoy+tKAESLFxJ478sWcSM2eTHWMen9tFFCtq9ptR eF4z8Tz4zWsYJTMorIbe1V6Qe89IEKtLPDWspvX83uUNzMjicr4SlLpI5KgDxfco BarpwDxPG71hHzQqqbmoDmZzUdkl4mlTtl8QAepgJpw/bs6JCabL22RWL7evz0k= =Pi5y -----END PGP SIGNATURE----- Merge remote-tracking branch 'remotes/stefanha/tags/block-pull-request' into staging Pull request This fix prevents hangs when a drive leaves a throttling group. # gpg: Signature made Thu 19 Jul 2018 15:28:37 BST # gpg: using RSA key 9CA4ABB381AB73C8 # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>" # gpg: aka "Stefan Hajnoczi <stefanha@gmail.com>" # Primary key fingerprint: 8695 A8BF D3F9 7CDA AC35 775A 9CA4 ABB3 81AB 73C8 * remotes/stefanha/tags/block-pull-request: throttle-groups: fix hang when group member leaves Signed-off-by: Peter Maydell <peter.maydell@linaro.org>	8 years ago
Peter Maydell	771eab9349	don't segfault when trying to baseline an odd cpu model -----BEGIN PGP SIGNATURE----- iQJGBAABCAAwFiEEw9DWbcNiT/aowBjO3s9rk8bwL68FAltQeFkSHGNvaHVja0By ZWRoYXQuY29tAAoJEN7Pa5PG8C+vAekP/ivXO2fiBv9nP1/xPTReSXC1mMFHS+e3 TZY6xA5GWbZ/M+s6OMpi40IToCN6OQVYxQQm1W+MiZq5lrM1/M+F/qA0rUZciaQW qK4UxTC/wTfL5N5Q47g7c7IeHlAONGGGFxZfu8rmrU2Dxe7+5g1aDmCzZ+fknlPG 4AZSmc/GMacTYqL0Dno0GtHeneygruPsbssozLh87IEYUF3DRlQBBHvgUlx0IJ3T xI5xnS425u+DeF/DNEVhzKGkAcN5WkGgWargCS1kICBKHFIIiQh4CBS7Gv1ae8+i 1B8OLbJz5jcLcw0bz4PyKQ5VyCgTwn5kTDAvEPSMrMUk0eFGN2W+eoDQEqu2TyKK V2dYqUOG+S5WnzbmkkIlBhHyBocoBf+yg0wRFajZRG0sMDb/lEIa5e4cJrBbTP8h TbD/TUHEhXThHw3Pn7IiGkGxHuGebrPtzEJbcz3MoUnuTBqdngr23LFm3yhPQ5rU LHm16foWAoHBPaIinWrhY83W88wPVsWONJn3JMGI9bk2APBAVOyI4q0xhQFGnXas zfG7eI+ae8TWUGZh1VMOICE8Qk0zbtTcCPXKpPMVuFQYwElFwgDv6v6qY4rbymON 4xuknuGJLsjmCdF3Fy3qsSZd5lrKSfXNYyciGS469qhINr3LRrZV6d8/zXfHn4JP 1h3rQ9W3DNrE =ZpxU -----END PGP SIGNATURE----- Merge remote-tracking branch 'remotes/cohuck/tags/s390x-20180719' into staging don't segfault when trying to baseline an odd cpu model # gpg: Signature made Thu 19 Jul 2018 12:39:05 BST # gpg: using RSA key DECF6B93C6F02FAF # gpg: Good signature from "Cornelia Huck <conny@cornelia-huck.de>" # gpg: aka "Cornelia Huck <huckc@linux.vnet.ibm.com>" # gpg: aka "Cornelia Huck <cornelia.huck@de.ibm.com>" # gpg: aka "Cornelia Huck <cohuck@kernel.org>" # gpg: aka "Cornelia Huck <cohuck@redhat.com>" # Primary key fingerprint: C3D0 D66D C362 4FF6 A8C0 18CE DECF 6B93 C6F0 2FAF * remotes/cohuck/tags/s390x-20180719: s390x/cpumodel: fix segmentation fault when baselining models Signed-off-by: Peter Maydell <peter.maydell@linaro.org>	8 years ago
Yaowei Bai	db817b8c50	tracing: Use double-dash spelling for trace option The '-trace' and '--trace' spellings are only both supported in qemu binary, while for qemu-nbd or qemu-img only '--trace' spelling is supported. So for the consistency of trace option invocation, we should use double-dash spelling in our documentation. This's also mentioned in https://wiki.qemu.org/BiteSizedTasks#Consistent_option_usage_in_documentation . Signed-off-by: Yaowei Bai <baiyaowei@cmss.chinamobile.com> Reviewed-by: Eric Blake <eblake@redhat.com> Message-id: 1530674247-31200-1-git-send-email-baiyaowei@cmss.chinamobile.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>	8 years ago
Stefan Hajnoczi	6fccbb475b	throttle-groups: fix hang when group member leaves Throttle groups consist of members sharing one throttling state (including bps/iops limits). Round-robin scheduling is used to ensure fairness. If a group member already has a timer pending then other groups members do not schedule their own timers. The next group member will have its turn when the existing timer expires. A hang may occur when a group member leaves while it had a timer scheduled. Although the code carefully removes the group member from the round-robin list, it does not schedule the next member. Therefore remaining members continue to wait for the removed member's timer to expire. This patch schedules the next request if a timer is pending. Unfortunately the actual bug is a race condition that I've been unable to capture in a test case. Sometimes drive2 hangs when drive1 is removed from the throttling group: $ qemu ... -drive if=none,id=drive1,cache=none,format=qcow2,file=data1.qcow2,iops=100,group=foo \ -device virtio-blk-pci,id=virtio-blk-pci0,drive=drive1 \ -drive if=none,id=drive2,cache=none,format=qcow2,file=data2.qcow2,iops=10,group=foo \ -device virtio-blk-pci,id=virtio-blk-pci1,drive=drive2 (guest-console1)# fio -filename /dev/vda 4k-seq-read.job (guest-console2)# fio -filename /dev/vdb 4k-seq-read.job (qmp) {"execute": "block_set_io_throttle", "arguments": {"device": "drive1","bps": 0,"bps_rd": 0,"bps_wr": 0,"iops": 0,"iops_rd": 0,"iops_wr": 0}} Reported-by: Nini Gu <ngu@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Message-id: 20180704145410.794-1-stefanha@redhat.com RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=1535914 Cc: Alberto Garcia <berto@igalia.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>	8 years ago
David Hildenbrand	677ff32db1	s390x/cpumodel: fix segmentation fault when baselining models Usually, when baselining two CPU models, whereby one of them has base CPU features disabled (e.g. z14-base,msa=off), we fallback to an older model that did not have these features in the base model. We always try to create a "sane" CPU model (as far as possible), and one part of it is that removing base features is no good and to be avoided. Now, if we disable base features that were part of a z900, we're out of luck. We won't find a CPU model and QEMU will segfault. This is a scenario that should never happen in real life, but it can be used to crash QEMU. So let's properly report an error if we baseline e.g.: { "execute": "query-cpu-model-baseline", "arguments" : { "modela": { "name": "z14-base", "props": {"esan3" : false}}, "modelb": { "name": "z14"}} } Instead of segfaulting. Signed-off-by: David Hildenbrand <david@redhat.com> Message-Id: <20180718092330.19465-1-david@redhat.com> Acked-by: Christian Borntraeger <borntraeger@de.ibm.com> Signed-off-by: Cornelia Huck <cohuck@redhat.com>	8 years ago
Peter Maydell	ea6abffa8a	Update version for v3.0.0-rc1 release Signed-off-by: Peter Maydell <peter.maydell@linaro.org>	8 years ago
Peter Maydell	59b5552f02	Bug fixes. -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (GNU/Linux) iQEcBAABAgAGBQJbTgXfAAoJEL/70l94x66DTbYH/3NutBAkNZKX7EImj/d0I1O8 nERMVH1R70KBcugdsjhaBfTRoATDXdrBng4MBqloIK9dEMT3g6D4TFZJLU+WAjOc 8sItx0BrUR7Sl8SnAvWNFoqVtvVancFiLnu11DsFGM0l8mJHRlZSkQZ0Fd0FL2W/ OPnW7t6F7B2bc1VlPfSs093FVCoD3S+lJmbj64dwNrn8+fOX918V6gSaYQe92aIY pSbJjkRDx2iULmzMY8QH4OQiHgnd/Pijj+D628DMrUc0iW1Rsw5V2Yq7SMY6zoa8 MoI/YDwX6eRMU2mq74BrKlULZrpmQn+6ZCdZTvXzLwc2zpKD4puO4FuMBOA7yx4= =GcxI -----END PGP SIGNATURE----- Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into staging Bug fixes. # gpg: Signature made Tue 17 Jul 2018 16:06:07 BST # gpg: using RSA key BFFBD25F78C7AE83 # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * remotes/bonzini/tags/for-upstream: Document command line options with single dash opts: remove redundant check for NULL parameter i386: only parse the initrd_filename once for multiboot modules i386: fix regression parsing multiboot initrd modules virtio-scsi: fix hotplug ->reset() vs event race qdev: add HotplugHandler->post_plug() callback hw/char/serial: retry write if EAGAIN PC Chipset: Improve serial divisor calculation vhost-user-test: added proper TestServer *dest initialization in test_migrate() hyperv: ensure VP index equal to QEMU cpu_index hyperv: rename vcpu_id to vp_index accel: Fix typo and grammar in comment dump: add kernel_gs_base to QEMU CPU state Signed-off-by: Peter Maydell <peter.maydell@linaro.org>	8 years ago
BALATON Zoltan	dfaa7d50b0	Document command line options with single dash QEMU options have a single dash (but also work as double dash for convenience and compatibility). Most options are listed with single dash in command line help but some were listed with two dashes. Normalize these to have the same format as the others. Left --preconfig as that is mentioned as double dash everywhere so I assume that is the preferred form for that. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Acked-by: Thomas Huth <thuth@redhat.com> Message-Id: <20180716193312.A5BA17456B9@zero.eik.bme.hu> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>	8 years ago
Daniel P. Berrangé	0c2f6e7ee9	opts: remove redundant check for NULL parameter No callers of get_opt_value() pass in a NULL for the "value" parameter, so the check is redundant. Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> Message-Id: <20180514171913.17664-4-berrange@redhat.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Tested-by: Roman Kagan <rkagan@virtuozzo.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>	8 years ago
Daniel P. Berrangé	f8da93a0ff	i386: only parse the initrd_filename once for multiboot modules The multiboot code parses the initrd_filename twice, first to count how many entries there are, and second to process each entry. This changes the first loop to store the parse module names in a list, and the second loop can now use these names. This avoids having to pass NULL to the get_opt_value() method which means it can safely assume a non-NULL param. Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> Message-Id: <20180514171913.17664-3-berrange@redhat.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Tested-by: Roman Kagan <rkagan@virtuozzo.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>	8 years ago
Daniel P. Berrangé	6e3ad3f0e3	i386: fix regression parsing multiboot initrd modules The logic for parsing the multiboot initrd modules was messed up in commit `950c4e6c94` Author: Daniel P. Berrangé <berrange@redhat.com> Date: Mon Apr 16 12:17:43 2018 +0100 opts: don't silently truncate long option values Causing the length to be undercounter, and the number of modules over counted. It also passes NULL to get_opt_value() which was not robust at accepting a NULL value. Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> Message-Id: <20180514171913.17664-2-berrange@redhat.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Tested-by: Roman Kagan <rkagan@virtuozzo.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>	8 years ago
Thomas Huth	ccf02d73d1	hw/arm/xlnx-zynqmp: Fix crash when introspecting the "xlnx, zynqmp" device QEMU currently crashes when e.g. doing something like this: echo "{'execute':'qmp_capabilities'} {'execute':'device-list-properties'," \ "'arguments':{'typename':'xlnx,zynqmp'}}" \ "{'execute': 'human-monitor-command', " \ "'arguments': {'command-line': 'info qtree'}}" \ \| aarch64-softmmu/qemu-system-aarch64 -M none,accel=qtest -qmp stdio Use the new object_initialize_child() and sysbus_init_child_obj() functions to get the refernce counting of the child objects right, so that they are properly cleaned up when the parent gets destroyed. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 1531745974-17187-18-git-send-email-thuth@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>	8 years ago
Paolo Bonzini	fe04f0b4a1	hw/display/xlnx_dp: Move problematic code from instance_init to realize aux_create_slave() calls qdev_init_nofail() which in turn "realizes" the corresponding object. This is unlike qdev_create(), and it is wrong because qdev_init_nofail() must not be called from an instance_init function. Move qdev_init_nofail() and the subsequent aux_map_slave into the caller's realize function. There are two more bugs that needs to be fixed here, too, where the objects are created but not added as children. Therefore when you call object_unparent on them, nothing happens. In particular dpcd and edid give you an infinite loop in bus_unparent, because device_unparent is not called and does not remove them from the list of devices on the bus. Reported-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Signed-off-by: Thomas Huth <thuth@redhat.com> Message-id: 1531745974-17187-17-git-send-email-thuth@redhat.com [thuth: Added Paolo's fixup for the dpcd and edid unparenting] Signed-off-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>	8 years ago
Thomas Huth	a39ae81637	hw/arm/stm32f205_soc: Fix introspection problem with 'stm32f205-soc' device Valgrind complains: echo "{'execute':'qmp_capabilities'} {'execute':'device-list-properties'," \ "'arguments':{'typename':'stm32f205-soc'}}" \ "{'execute': 'human-monitor-command', " \ "'arguments': {'command-line': 'info qtree'}}" \| \ valgrind -q aarch64-softmmu/qemu-system-aarch64 -M none,accel=qtest -qmp stdio [...] ==28531== Invalid read of size 8 ==28531== at 0x6185BA: qdev_print (qdev-monitor.c:686) ==28531== by 0x6185BA: qbus_print (qdev-monitor.c:719) ==28531== by 0x452B38: handle_hmp_command (monitor.c:3446) [...] Fix it with the new sysbus_init_child_obj() function. Signed-off-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 1531745974-17187-16-git-send-email-thuth@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>	8 years ago
Thomas Huth	cf3fccfa8c	hw/arm/allwinner-a10: Fix introspection problem with 'allwinner-a10' Valgrind complains: echo "{'execute':'qmp_capabilities'} {'execute':'device-list-properties'," \ "'arguments':{'typename':'allwinner-a10'}}" \ "{'execute': 'human-monitor-command', " \ "'arguments': {'command-line': 'info qtree'}}" \| \ valgrind -q aarch64-softmmu/qemu-system-aarch64 -M none,accel=qtest -qmp stdio [...] ==32519== Invalid read of size 8 ==32519== at 0x61869A: qdev_print (qdev-monitor.c:686) ==32519== by 0x61869A: qbus_print (qdev-monitor.c:719) ==32519== by 0x452B38: handle_hmp_command (monitor.c:3446) [...] Use object_initialize_child() and sysbus_init_child_obj() to fix the issue. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com> Message-id: 1531745974-17187-15-git-send-email-thuth@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>	8 years ago
Thomas Huth	32db1b58ca	hw/*/realview: Fix introspection problem with 'realview_mpcore' & 'realview_gic' echo "{'execute':'qmp_capabilities'} {'execute':'device-list-properties'," \ "'arguments':{'typename':'realview_mpcore'}}" \ "{'execute': 'human-monitor-command', " \ "'arguments': {'command-line': 'info qtree'}}" \| \ valgrind -q aarch64-softmmu/qemu-system-aarch64 -M none,accel=qtest -qmp stdio [...] ==2654== Invalid read of size 8 ==2654== at 0x61878A: qdev_print (qdev-monitor.c:686) ==2654== by 0x61878A: qbus_print (qdev-monitor.c:719) ==2654== by 0x452B38: handle_hmp_command (monitor.c:3446) ==2654== by 0x452D70: qmp_human_monitor_command (monitor.c:821) [...] Use sysbus_init_child_obj() to fix it. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com> Message-id: 1531745974-17187-14-git-send-email-thuth@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>	8 years ago
Thomas Huth	b2bc349822	hw/cpu/arm11mpcore: Fix introspection problem with 'arm11mpcore_priv' Valgrind reports an error here: echo "{'execute':'qmp_capabilities'} {'execute':'device-list-properties'," \ "'arguments':{'typename':'arm11mpcore_priv'}}" \ "{'execute': 'human-monitor-command', " \ "'arguments': {'command-line': 'info qtree'}}" \| \ valgrind -q aarch64-softmmu/qemu-system-aarch64 -M none,accel=qtest -qmp stdio [...] ==3145== Invalid read of size 8 ==3145== at 0x61873A: qdev_print (qdev-monitor.c:686) ==3145== by 0x61873A: qbus_print (qdev-monitor.c:719) [...] Use sysbus_init_child_obj() to fix it. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 1531745974-17187-13-git-send-email-thuth@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>	8 years ago
Thomas Huth	aac409c9b0	hw/arm/fsl-imx31: Fix introspection problem with the "fsl, imx31" device Running QEMU with valgrind indicates a problem here: echo "{'execute':'qmp_capabilities'} {'execute':'device-list-properties'," \ "'arguments':{'typename':'fsl,imx31'}}" \ "{'execute': 'human-monitor-command', " \ "'arguments': {'command-line': 'info qtree'}}" \| \ valgrind -q aarch64-softmmu/qemu-system-aarch64 -M none,accel=qtest -qmp stdio [...] ==26172== Invalid read of size 8 ==26172== at 0x6191FA: qdev_print (qdev-monitor.c:686) ==26172== by 0x6191FA: qbus_print (qdev-monitor.c:719) [...] Use the new sysbus_init_child_obj() to make sure that the objects are cleaned up correctly when the parent gets destroyed. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com> Message-id: 1531745974-17187-12-git-send-email-thuth@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>	8 years ago
Thomas Huth	51dd12ac0e	hw/arm/fsl-imx25: Fix introspection problem with the "fsl, imx25" device Running QEMU with valgrind indicates a problem here: echo "{'execute':'qmp_capabilities'} {'execute':'device-list-properties'," \ "'arguments':{'typename':'fsl,imx25'}}" \ "{'execute': 'human-monitor-command', " \ "'arguments': {'command-line': 'info qtree'}}" \| \ valgrind -q aarch64-softmmu/qemu-system-aarch64 -M none,accel=qtest -qmp stdio [...] ==26724== Invalid read of size 8 ==26724== at 0x6190DA: qdev_print (qdev-monitor.c:686) ==26724== by 0x6190DA: qbus_print (qdev-monitor.c:719) [...] Use the new sysbus_init_child_obj() to make sure that the objects are cleaned up correctly when the parent gets destroyed. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com> Message-id: 1531745974-17187-11-git-send-email-thuth@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>	8 years ago
Thomas Huth	f8bf4b6d38	hw/arm/fsl-imx7: Fix introspection problems with the "fsl, imx7" device Running QEMU with valgrind indicates a problem here: echo "{'execute':'qmp_capabilities'} {'execute':'device-list-properties'," \ "'arguments':{'typename':'fsl,imx7'}}" \ "{'execute': 'human-monitor-command', " \ "'arguments': {'command-line': 'info qtree'}}" \| \ valgrind -q aarch64-softmmu/qemu-system-aarch64 -M none,accel=qtest -qmp stdio [...] ==27284== Invalid read of size 8 ==27284== at 0x618F7A: qdev_print (qdev-monitor.c:686) ==27284== by 0x618F7A: qbus_print (qdev-monitor.c:719) ==27284== by 0x452B38: handle_hmp_command (monitor.c:3446) [...] Use the new sysbus_init_child_obj() and object_initialize_child() to make sure that the objects are removed correctly when the parent gets destroyed. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com> Message-id: 1531745974-17187-10-git-send-email-thuth@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>	8 years ago
Thomas Huth	e9e4d4d3e1	hw/arm/fsl-imx6: Fix introspection problems with the "fsl, imx6" device Running QEMU with valgrind indicates a problem here: echo "{'execute':'qmp_capabilities'} {'execute':'device-list-properties'," \ "'arguments':{'typename':'fsl,imx6'}}" \ "{'execute': 'human-monitor-command', " \ "'arguments': {'command-line': 'info qtree'}}" \| \ valgrind -q aarch64-softmmu/qemu-system-aarch64 -M none,accel=qtest -qmp stdio [...] ==32417== Invalid read of size 8 ==32417== at 0x618A7A: qdev_print (qdev-monitor.c:686) ==32417== by 0x618A7A: qbus_print (qdev-monitor.c:719) ==32417== by 0x452B38: handle_hmp_command (monitor.c:3446) [...] Use the new sysbus_init_child_obj() and object_initialize_child() to make sure that the objects are removed correctly when the parent gets destroyed. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com> Message-id: 1531745974-17187-9-git-send-email-thuth@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>	8 years ago
Thomas Huth	2ba486e7db	hw/cpu/a9mpcore: Fix introspection problems with the "a9mpcore_priv" device Running QEMU with valgrind indicates a problem here: echo "{'execute':'qmp_capabilities'} {'execute':'device-list-properties'," \ "'arguments':{'typename':'a9mpcore_priv'}}" \ "{'execute': 'human-monitor-command', " \ "'arguments': {'command-line': 'info qtree'}}" \| \ valgrind -q aarch64-softmmu/qemu-system-aarch64 -M none,accel=qtest -qmp stdio [...] ==30996== Invalid read of size 8 ==30996== at 0x6185DA: qdev_print (qdev-monitor.c:686) ==30996== by 0x6185DA: qbus_print (qdev-monitor.c:719) ==30996== by 0x452B38: handle_hmp_command (monitor.c:3446) [...] Use the new sysbus_init_child_obj() function to make sure that the objects are cleaned up correctly when the parent gets destroyed. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 1531745974-17187-8-git-send-email-thuth@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>	8 years ago
Thomas Huth	d473a0309c	hw/arm/msf2-soc: Fix introspection problem with the "msf2-soc" device Valgrind currently reports a problem when running QEMU like this: echo "{'execute':'qmp_capabilities'} {'execute':'device-list-properties'," \ "'arguments':{'typename':'msf2-soc'}}" \ "{'execute': 'human-monitor-command', " \ "'arguments': {'command-line': 'info qtree'}}" \| \ valgrind -q aarch64-softmmu/qemu-system-aarch64 -M none,accel=qtest -qmp stdio [...] ==23097== Invalid read of size 8 ==23097== at 0x6192AA: qdev_print (qdev-monitor.c:686) ==23097== by 0x6192AA: qbus_print (qdev-monitor.c:719) [...] Use the new sysbus_init_child_obj() function to make sure that the child objects are cleaned up correctly when the parent gets destroyed. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com> Message-id: 1531745974-17187-7-git-send-email-thuth@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>	8 years ago
Thomas Huth	fd31701214	hw/cpu/a15mpcore: Fix introspection problem with the a15mpcore_priv device There is a memory management problem when introspecting the a15mpcore_priv device. It can be seen with valgrind when running QEMU like this: echo "{'execute':'qmp_capabilities'} {'execute':'device-list-properties'," \ "'arguments':{'typename':'a15mpcore_priv'}}"\ "{'execute': 'human-monitor-command', " \ "'arguments': {'command-line': 'info qtree'}}" \| \ valgrind -q aarch64-softmmu/qemu-system-aarch64 -M none,accel=qtest -qmp stdio {"QMP": {"version": {"qemu": {"micro": 50, "minor": 12, "major": 2}, "package": "build-all"}, "capabilities": []}} {"return": {}} {"return": [{"name": "num-cpu", "type": "uint32"}, {"name": "num-irq", "type": "uint32"}, {"name": "a15mp-priv-container[0]", "type": "child<qemu:memory-region>"}]} ==24978== Invalid read of size 8 ==24978== at 0x618EBA: qdev_print (qdev-monitor.c:686) ==24978== by 0x618EBA: qbus_print (qdev-monitor.c:719) [...] Use the new sysbus_init_child_obj() function to make sure that we get the reference counting of the child objects right. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 1531745974-17187-6-git-send-email-thuth@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>	8 years ago
Thomas Huth	955cbc6b17	hw/arm/armv7: Fix crash when introspecting the "iotkit" device QEMU currently crashes when introspecting the "iotkit" device and runnint "info qtree" afterwards, e.g. when running QEMU like this: echo "{'execute':'qmp_capabilities'} {'execute':'device-list-properties'," \ "'arguments':{'typename':'iotkit'}}" "{'execute': 'human-monitor-command', " \ "'arguments': {'command-line': 'info qtree'}}" \| \ aarch64-softmmu/qemu-system-aarch64 -M none,accel=qtest -qmp stdio Use the new functions object_initialize_child() and sysbus_init_child_obj() to make sure that all objects get cleaned up correctly when the instances are destroyed. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 1531745974-17187-5-git-send-email-thuth@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>	8 years ago
Thomas Huth	14c520e335	hw/arm/bcm2836: Fix crash with device_add bcm2837 on unsupported machines When trying to "device_add bcm2837" on a machine that is not suitable for this device, you can quickly crash QEMU afterwards, e.g. with "info qtree": echo "{'execute':'qmp_capabilities'} {'execute':'device_add', " \ "'arguments':{'driver':'bcm2837'}} {'execute': 'human-monitor-command', " \ "'arguments': {'command-line': 'info qtree'}}" \| \ aarch64-softmmu/qemu-system-aarch64 -M integratorcp,accel=qtest -S -qmp stdio {"QMP": {"version": {"qemu": {"micro": 50, "minor": 12, "major": 2}, "package": "build-all"}, "capabilities": []}} {"return": {}} {"error": {"class": "GenericError", "desc": "Device 'bcm2837' can not be hotplugged on this machine"}} Segmentation fault (core dumped) The qdev_set_parent_bus() from instance_init adds a link to the child devices which is not valid anymore after the bcm2837 instance has been destroyed. Unfortunately, the child devices do not get destroyed / unlinked correctly because both object_initialize() and object_property_add_child() increase the reference count of the child objects by one, but only one reference is dropped when the parent gets removed. So let's use the new functions object_initialize_child() and sysbus_init_child_obj() instead to create the objects, which will take care of creating the child objects with the correct reference count of one. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com> Message-id: 1531745974-17187-4-git-send-email-thuth@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>	8 years ago
Thomas Huth	046f370fb4	hw/core/sysbus: Add a function for creating and attaching an object A lot of functions are initializing an object and attach it immediately afterwards to the system bus. Provide a common function for this, which also uses object_initialize_child() to make sure that the reference counter is correctly initialized to 1 afterwards. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 1531745974-17187-3-git-send-email-thuth@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>	8 years ago
Thomas Huth	0210b39d0e	qom/object: Add a new function object_initialize_child() A lot of code is using the object_initialize() function followed by a call to object_property_add_child() to add the newly initialized object as a child of the current object. Both functions increase the reference counter of the new object, but many spots that call these two functions then forget to drop one of the superfluous references. So the newly created object is often not cleaned up correctly when the parent is destroyed. In the worst case, this can cause crashes, e.g. because device objects are not correctly removed from their parent_bus. Since this is a common pattern between many code spots, let's introduce a new function that takes care of calling all three required initialization functions, first object_initialize(), then object_property_add_child() and finally object_unref(). And since the function does a similar job like object_new_with_props(), also allow to set additional properties via varargs, and use user_creatable_complete() to make sure that the functions can be used similarly. And while we're at object.h, also fix some copy-n-paste errors in the comments there ("to store the area" --> "to store the error"). Signed-off-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Message-id: 1531745974-17187-2-git-send-email-thuth@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>	8 years ago
Peter Maydell	3e86907c82	qemu-ga patch queue for hard-freeze * fix file descriptor leak in suspend command * fix leak in guest-get-fsinfo -----BEGIN PGP SIGNATURE----- iQE3BAABCAAhBQJbTREVGhxtZHJvdGhAbGludXgudm5ldC5pYm0uY29tAAoJEDNT yc7xCLWEg4AH+wcZd8dreTUt0wIINAMABhAHNdoQtjx7hbPGvwyx+B1f67tyQt1h i1jfJlEexS6N382NOK64su8gk5P9ZCMUr7d7hzymhKkZcYpqdje3IUHHRwIjdNgE 2IoV0JZUShnoVSz/KXy+esHF+rfOIBAeC2DlZpm1nLTF5NDVPBKt5MyrWzn4tM3H 0IXgtzozEs11Fx9XIR3RRR4X+MGqQGYPoGypHkBtW2u6BBQwItS7S1Slcx2Rd3sI Uvs0sotaIm6e/dZRhsYHS2iPtrp7w2aGmX41EfisEy8zt2AbXclHw0WAfSoGAyiY taST+3Fae3FzLwMRq7vS6YDiWpfWJyQfFN4= =7t16 -----END PGP SIGNATURE----- Merge remote-tracking branch 'remotes/mdroth/tags/qga-pull-2018-07-16-tag' into staging qemu-ga patch queue for hard-freeze * fix file descriptor leak in suspend command * fix leak in guest-get-fsinfo # gpg: Signature made Mon 16 Jul 2018 22:41:41 BST # gpg: using RSA key 3353C9CEF108B584 # gpg: Good signature from "Michael Roth <flukshun@gmail.com>" # gpg: aka "Michael Roth <mdroth@utexas.edu>" # gpg: aka "Michael Roth <mdroth@linux.vnet.ibm.com>" # Primary key fingerprint: CEAC C9E1 5534 EBAB B82D 3FA0 3353 C9CE F108 B584 * remotes/mdroth/tags/qga-pull-2018-07-16-tag: qga: fix file descriptor leak qga: fix 'driver' leak in guest-get-fsinfo Signed-off-by: Peter Maydell <peter.maydell@linaro.org>	8 years ago

1 2 3 4 5 ...

62964 Commits (1ddc9b98c3cb89fe23a55ba924000fd645253e87) All Branches Search

62964 Commits (1ddc9b98c3cb89fe23a55ba924000fd645253e87)

All Branches