Using a 16-byte aligned structure achieves best results, both for code
cleanliness and compiled code size. However, this means that we can't
use the trick of encoding the slot number into the low 2 bits.
Thankfully, we only ever use slot2, so make that explicit in the names
of the relocation functions, and drop the code for other slots.
To be defined by the tcg backend based on the elemental unit of the ISA.
During the transition, allow TCG_TARGET_INSN_UNIT_SIZE to be undefined,
which allows us to default tcg_insn_unit to the current uint8_t.
Peter Maydell [Fri, 28 Mar 2014 15:29:48 +0000 (15:29 +0000)]
tcg: Avoid undefined behaviour patching code at unaligned addresses
To avoid C undefined behaviour when patching generated code,
provide wrappers tcg_patch8/16/32/64 which use the usual memcpy
trick, and use them in the i386 backend.
Peter Maydell [Fri, 28 Mar 2014 15:29:47 +0000 (15:29 +0000)]
tcg: Avoid stores to unaligned addresses
Avoid stores to unaligned addresses in TCG code generation, by using the
usual memcpy() approach. (Using bswap.h would drag a lot of QEMU baggage
into TCG, so it's simpler just to do direct memcpy() here.)
Peter Maydell [Fri, 28 Mar 2014 15:29:46 +0000 (15:29 +0000)]
exec-all.h: Use stl_p to avoid undefined behaviour patching x86 jumps
The code which patches x86 jump instructions assumes it can do an
unaligned write of a uint32_t. This is actually safe on x86, but it's
still undefined behaviour. We have infrastructure for doing efficient
unaligned accesses which doesn't engage in undefined behaviour, so
use it.
This is technically fractionally less efficient, at least with gcc 4.6;
instead of one instruction:
7b2: 89 3e mov %edi,(%rsi)
we get an extra spurious store to the stack slot:
7b2: 89 7c 24 64 mov %edi,0x64(%rsp)
7b6: 89 3e mov %edi,(%rsi)
Peter Maydell [Fri, 9 May 2014 14:46:34 +0000 (15:46 +0100)]
Merge remote-tracking branch 'remotes/qmp-unstable/queue/qmp' into staging
* remotes/qmp-unstable/queue/qmp: (38 commits)
Revert "qapi: Clean up superfluous null check in qapi_dealloc_type_str()"
qapi: Document optional arguments' backwards compatibility
qmp: use valid JSON in transaction example
qmp: Don't use error_is_set() to suppress additional errors
dump: Drop pointless error_is_set(), DumpState member errp
qemu-option: Clean up fragile use of error_is_set()
qga: Drop superfluous error_is_set()
qga: Clean up fragile use of error_is_set()
qapi: Clean up fragile use of error_is_set()
tests/qapi-schema: Drop superfluous error_is_set()
qapi: Drop redundant, unclean error_is_set()
hmp: Guard against misuse of hmp_handle_error()
qga: Use return values instead of error_is_set(errp)
error: Consistently name Error ** objects errp, and not err
qmp: Consistently name Error ** objects errp, and not err
qga: Consistently name Error ** objects errp, and not err
qmp hmp: Consistently name Error * objects err, and not errp
pci-assign: assigned_initfn(): set monitor error in common error handler
pci-assign: propagate errors from assign_intx()
pci-assign: propagate errors from assign_device()
...
qmp: Don't use error_is_set() to suppress additional errors
Using error_is_set(errp) that way can sweep programming errors under
the carpet when we get called incorrectly with an error set.
encrypted_bdrv_it() does it, because there's no way to make
bdrv_iterate() break its loop. Actually safe, because qmp_cont()
clears the error before the loop. Clean it up anyway: replace
bdrv_iterate() by bdrv_next(), break the loop on error.
dump: Drop pointless error_is_set(), DumpState member errp
In qmp_dump_guest_memory(), the error must be clear on entry, and we
always bail out after setting it, directly or via dump_init().
Therefore, both error_is_set() are always false. Drop them.
DumpState member errp is now write-only. Drop it, too.
qemu-option: Clean up fragile use of error_is_set()
Using error_is_set(ERRP) to find out whether to bail out due to
previous error is either wrong, fragile, or unnecessarily opaque.
It's wrong when ERRP may be null, because errors go undetected when it
is. It's fragile when proving ERRP non-null involves a non-local
argument. Else, it's unnecessarily opaque (see commit 84d18f0).
The error_is_set(state->errp) in qemu_opts_from_qdict_1() is merely
fragile, because the callers never pass state argument with null
state->errp.
Make the code more robust and more obviously correct: test
*state->errp directly.
acquire_privilege(), execute_async() and check_suspend_mode() do
nothing when called with an error set. Callers shouldn't do that, and
no caller does. Drop the superfluous tests.
Using error_is_set(ERRP) to find out whether a function failed is
either wrong, fragile, or unnecessarily opaque. It's wrong when ERRP
may be null, because errors go undetected when it is. It's fragile
when proving ERRP non-null involves a non-local argument. Else, it's
unnecessarily opaque (see commit 84d18f0).
The error_is_set(errp) in the guest agent command handler functions
are merely fragile, because all chall chains (do_qmp_dispatch() via
the generated marshalling functions) pass a non-null errp argument.
Make the code more robust and more obviously correct: receive the
error in a local variable, then propagate it through the parameter.
Using error_is_set(ERRP) to find out whether a function failed is
either wrong, fragile, or unnecessarily opaque. It's wrong when ERRP
may be null, because errors go undetected when it is. It's fragile
when proving ERRP non-null involves a non-local argument. Else, it's
unnecessarily opaque (see commit 84d18f0).
The error_is_set(errp) in do_qmp_dispatch() is merely fragile, because
the caller never passes a null errp argument.
Make the code more robust and more obviously correct: receive the
error in a local variable, then propagate it through the parameter.
do_qmp_dispatch()'s test for qmp_dispatch_check_obj() failure examines
both the return value and the error object. The latter part is
unclean; it works only when do_qmp_dispatch()'s caller passes a
non-null errp argument. That's the case, but it's not locally
obvious. Unclean.
Cleanup would be easy enough, but since the unclean code is also
redundant, let's just drop it.
qga: Use return values instead of error_is_set(errp)
Using error_is_set(errp) to check whether a function call failed is
fragile: it breaks when errp is null. ga_get_fd_handle() and
guest_file_handle_add() don't return a useful value when they fail,
but that's just stupid. Fix that, and check them instead. As far
as I can tell, errp can't be null there, but this is more robust and
more obviously correct.
Among the callers, only assigned_initfn() should set the monitor's stored
error. Other callers may run in contexts where the monitor's stored error
makes no sense. For example:
Also, change the return type to "void"; the function is static (with a
sole caller) and the negative errno values are not distinguished from each
other.
pci-assign: propagate errors from assigned_dev_register_msix_mmio()
The return type is also changed from "int" to "void", because it was used
in a success vs. failure sense only (the caller didn't distinguish error
codes from each other, and even assigned_dev_register_msix_mmio() masked
mmap()'s errno values with a common -EFAULT).
pci-assign: accept Error from pci_add_capability2()
Propagate any errors while adding PCI capabilities to
assigned_device_pci_cap_init(). We'll continue the propagation upwards
when assigned_device_pci_cap_init() becomes a leaf itself (when none of
its callees will report errors internally any longer when detecting and
returning them).
pci-assign: propagate Error from check_irqchip_in_kernel()
Rename check_irqchip_in_kernel() to verify_irqchip_in_kernel(), so that
the name reflects our expectation better. Rather than returning a bool,
make it do nothing or set an Error.
get_real_id() has two thin wrappers (and no other callers),
get_real_vendor_id() and get_real_device_id(); it's easiest to convert
them in one fell swoop.
pci-assign: accept Error from monitor_handle_fd_param2()
Propagate any errors in monitor fd handling up to get_real_device(), and
report them there. We'll continue the propagation upwards when
get_real_device() becomes a leaf itself (when none of its callees will
report errors internally any longer when detecting and returning an
error).
and rebase monitor_handle_fd_param() to it. (Note that this will slightly
change the behavior when the qemu_parse_fd() branch is selected and it
fails: we now report (and in case of QMP, set) the error immediately,
rather than allowing the caller to set its own error message (if any)).
qemu_parse_fd() used to handle at least the following strings incorrectly:
o "-2": simply let through
o "2147483648": returned as LONG_MAX==INT_MAX on ILP32 (with ERANGE
ignored); implementation-defined behavior on LP64
Amos Kong [Mon, 28 Apr 2014 05:53:49 +0000 (13:53 +0800)]
qapi: treat all negative return of strtosz_suffix() as error
strtosz_suffix() might return negative error, this patch fixes
the error handling.
This patch also changes to handle error in the if statement
rather than handle success specially, this will make this use
of strtosz_suffix consistent with all other uses.
Peter Maydell [Thu, 8 May 2014 11:38:01 +0000 (12:38 +0100)]
Merge remote-tracking branch 'remotes/stefanha/tags/tracing-pull-request' into staging
Tracing pull request
# gpg: Signature made Wed 07 May 2014 18:14:02 BST using RSA key ID 81AB73C8
# gpg: Good signature from "Stefan Hajnoczi <[email protected]>"
# gpg: aka "Stefan Hajnoczi <[email protected]>"
* remotes/stefanha/tags/tracing-pull-request:
configure: Show trace output file conditionally
trace: [tracetool] Minimize the amount of per-backend code
trace: [simple] Bump up log version number
trace: [tracetool] Change format docs to point to the generated file
trace: [tracetool] Show list of frontends and backends sorted by name
trace: [tracetool] Cosmetic changes
trace: [tracetool] Spacing changes
trace: [tracetool] Add methods 'Event.copy' and 'Arguments.copy'
trace: [tracetool] Add method 'Event.api' to build event names
Only notify spice-server about migration events in case we got
target host information beforehand. So we kick the seamless spice
client migration only in case a actual live migration happens, not
when libvirt uses live-migration-to-file for snapshotting.
In case no listening address was specified, "info spice" reports
"0.0.0.0" as address. Which is incorrect in case spice is listening
on ipv6. Replace it by a wildcard "*" to indicate it is not limited
to a specific address.
Note: Being more specific is not possible without extending the
spice-server api. The socket is handled by spice-server not
qemu, so qemu can't easily figure the actual socket address.
Peter Maydell [Wed, 7 May 2014 17:38:39 +0000 (18:38 +0100)]
Merge remote-tracking branch 'remotes/mjt/tags/trivial-patches-2014-05-07' into staging
trivial patches for 2014-05-07
# gpg: Signature made Wed 07 May 2014 18:01:15 BST using RSA key ID A4C3D7DB
# gpg: Good signature from "Michael Tokarev <[email protected]>"
# gpg: aka "Michael Tokarev <[email protected]>"
# gpg: aka "Michael Tokarev <[email protected]>"
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 6EE1 95D1 886E 8FFB 810D 4324 457C E0A0 8044 65C5
# Subkey fingerprint: 6F67 E18E 7C91 C5B1 5514 66A7 BEE5 9D74 A4C3 D7DB
* remotes/mjt/tags/trivial-patches-2014-05-07: (21 commits)
libcacard: remove unnecessary EOL from debug prints
docs/memory.txt: Fix document on MMIO operations
readline: Sort completions before printing them.
readline: use g_strndup instead of open-coding it
qmp: report path ambiguity error
libcacard: replace pstrcpy() with memcpy()
glib: move g_poll() replacement into glib-compat.h
do not call g_thread_init() for glib >= 2.31
hw/9pfs: Add include file for exported symbol
xen: remove unused global, xen_xcg
hw: Add missing 'static' attributes
qemu-timer: Add missing 'static' attribute
ui: Add missing 'static' attribute
monitor: Add missing 'static' attribute
hw/s390x: Add missing 'static' attribute
hw/mips: Add missing 'static' and 'const' attributes
hw/9pfs: Add missing 'static' attributes
arch_init: Be sure of only one exit entry with DPRINTF() for ram_load()
tests/tcg: Fix compilation of test_path
qga: Fix typo (plural) in comment
...
Peter Maydell [Wed, 7 May 2014 17:12:14 +0000 (18:12 +0100)]
Merge remote-tracking branch 'remotes/sstabellini/xen-140507-2' into staging
* remotes/sstabellini/xen-140507-2:
xen_disk: add discard support
pass an inclusive address range to xc_domain_pin_memory_cacheattr
xen: factor out common functions
xen: move Xen HVM files under hw/i386/xen
xen: move Xen PV machine files to hw/xenpv
qemu-xen: free all the pirqs for msi/msix when driver unload
exec: Limit translation limiting in address_space_translate to xen
Michael Tokarev [Fri, 2 May 2014 14:35:59 +0000 (18:35 +0400)]
libcacard: replace pstrcpy() with memcpy()
Commit 2e679780ae86c6ca8 replaced strncpy() with pstrcpy()
in one place in libcacard. This is a qemu-specific function,
while libcacard is a stand-alone library (or tries to be).
But since we know the exact length of the string to copy,
and know that it definitely will fit in the destination
buffer, use memcpy() instead, and null-terminate the string
after that.
An alternative is to use g_strlcpy() or strncpy(), but memcpy()
is more than adequate in this place.
Michael Tokarev [Fri, 2 May 2014 14:35:55 +0000 (18:35 +0400)]
do not call g_thread_init() for glib >= 2.31
glib >= 2.31 always enables thread support and g_thread_supported()
is #defined to 1, there's no need to call g_thread_init() anymore,
and it definitely does not need to report error which never happens.
Keep code for old < 2.31 glibc anyway for now, just #ifdef it
differently.
Chen Gang [Thu, 1 May 2014 13:28:11 +0000 (21:28 +0800)]
arch_init: Be sure of only one exit entry with DPRINTF() for ram_load()
When DPRINTF() has effect, the original author wants to print all
ram_load() calling results. So need use 'goto' instead of 'return'
within ram_load(), just like other areas have done.
Peter Maydell [Tue, 29 Apr 2014 11:09:24 +0000 (12:09 +0100)]
tests/tcg: Fix compilation of test_path
The test_path binary is (unlike the other test binaries in tests/tcg)
actually intended to be compiled with the same compiler used to build
the main QEMU executables. It actually #includes a number of the
QEMU source files in an attempt to unit-test the util/path.c functions,
and so if it is not compiled with the same compiler used by configure
to set CONFIG_ settings then it is liable to fail to build.
Fix the makefile to build it with the default C compiler rules, not
CC_I386, and fix the test itself not to include a lot of unnecessary
trace related source files which cause the build to fail if the trace
backend is anything other than 'simple'.
Michael Tokarev [Fri, 2 May 2014 11:36:39 +0000 (15:36 +0400)]
configure: remove bashism
Commit e26110cfc67d48 added a check for shacmd to create a hash
for modules. This check in configure is using bash construct &>
to redirect both stdout and stderr, which does fun things on some
shells. Get rid of it, use standard redirection instead.
Olaf Hering [Wed, 7 May 2014 13:40:04 +0000 (13:40 +0000)]
xen_disk: add discard support
Implement discard support for xen_disk. It makes use of the existing
discard code in qemu.
The discard support is enabled unconditionally. The tool stack may
provide a property "discard-enable" in the backend node to optionally
disable discard support. This is helpful in case the backing file was
intentionally created non-sparse to avoid fragmentation.
Peter Maydell [Wed, 7 May 2014 16:16:03 +0000 (17:16 +0100)]
Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into staging
pc,net,MAINTAINERS,build updates
MAINTAINERS updated with link to the security process documentation
apic version modified to make more guests happy
On top of that, bugfixes all over the place
Signed-off-by: Michael S. Tsirkin <[email protected]>
# gpg: Signature made Wed 07 May 2014 17:15:29 BST using RSA key ID D28D5469
# gpg: Good signature from "Michael S. Tsirkin <[email protected]>"
# gpg: aka "Michael S. Tsirkin <[email protected]>"
* remotes/mst/tags/for_upstream:
configure: make source tree build more robust
MAINTAINERS: addresses for responsible disclosure
pm_smbus: correctly report unclaimed cycles
smbus: return -1 if nothing found at the given address
smbus: allow returning an error from reads
apic: use emulated lapic version 0x14 on pc machines >= 2.1
pc: add compat_props placeholder for 2.0 machine type
i8259: don't abort when trying to use level sensitive irqs
acpi: fix tables for no-hpet configuration
acpi-build: properly decrement objects' reference counters
acpi/pcihp.c: Rewrite acpi_pcihp_get_bsel using object_property_get_int
When source directory can be arrived at by two paths,
configure might misdetect an out of tree build.
The simplest way to trigger the problem is running
configure using a full path. E.g. (<firstpath> refers to qemu source
tree):
ln -s <firstpath> <secondpath>
cd <firstpath>
<secondpath>/configure
A more practical way is when make runs configure automatically:
1. cd <firstpath>/; ./configure
SRC_PATH=<firstpath>/ is written into config_host.mak
2. cd <secondpath>/; touch configure; make
make now runs <firstpath>/configure, so configure
assumes it's an out of tree build
When this happens configure overwrites parts of
the current tree with symlinks.
Make the test more robust: look for configure
in the current directory.
If there - we know it's a source build!
Adding addresses to MAINTAINERS, as agreed on the last conference call:
http://wiki.qemu.org/SecurityProcess
People sometimes detect security issues in upstream
QEMU and don't know where to report them in a non-public way.
Of course whoever just wants full disclosure can just go public,
but there's nothing specified for non-public - until recently Anthony
was doing this informally.
As I started doing this recently anyway, I can handle this on the QEMU side
in a more formal way.
Adding a secalert mailing list as well - they are the ones who is actually
opening CVEs, communicating issues to all downstreams etc,
and they are already handling this for upstream, not just Red Hat.
Keeping Anthony's address around in case he wants to be informed.
Peter Maydell said that he prefers not to be on this contact list at
this point.
A public mailing list has been created - not listing it here yet -
until we know how to set it up in a secure fashion and
until there are more people so manually copying everyone
becomes unwieldy for reporters.
projects / qemu.git / log