[Qemu-commits] [qemu/qemu] 1d5b12: hw/iommu: Fix problems reported by Co

qemu-commits
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-commits] [qemu/qemu] 1d5b12: hw/iommu: Fix problems reported by Co

From:	GitHub
Subject:	[Qemu-commits] [qemu/qemu] 1d5b12: hw/iommu: Fix problems reported by Coverity scan
Date:	Mon, 10 Oct 2016 04:00:07 -0700
  Branch: refs/heads/master
  Home:   https://github.com/qemu/qemu
  Commit: 1d5b128cbeeab638f772e88674f22e36b1b024e5
      
https://github.com/qemu/qemu/commit/1d5b128cbeeab638f772e88674f22e36b1b024e5
  Author: David Kiarie <address@hidden>
  Date:   2016-10-04 (Tue, 04 Oct 2016)

  Changed paths:
    M hw/i386/amd_iommu.c

  Log Message:
  -----------
  hw/iommu: Fix problems reported by Coverity scan

Signed-off-by: David Kiarie <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: 3cf294eebc98da6e2ff7976fcdf6a9b41984840e
      
https://github.com/qemu/qemu/commit/3cf294eebc98da6e2ff7976fcdf6a9b41984840e
  Author: Junlian Bell <address@hidden>
  Date:   2016-10-04 (Tue, 04 Oct 2016)

  Changed paths:
    M hw/timer/mc146818rtc.c

  Log Message:
  -----------
  MC146818 RTC: coordinate guest clock base to destination host after migration

qemu tracks guest time based on vector [base_rtc, last_update], in which
last_update stands for a monotonic tick which is actually uptime of the
host.
according to rtc implementation codes of recent releases and upstream,
after
migration, the time base vector [base_rtc, last_update] isn't updated to
coordinate with the destionation host, ie. qemu doesnt update last_update
to
uptime of the destination host.
what problem have we got because of this bug? after migration, guest time
may
jump back to several days ago, that will make some critical business
applications,
such as lotus notes, malfunction.
this patch is trying to fix the problem. first, when vmsave in progress,
we
rtc_update_time to refresh time stamp in cmos array, then during
vmrestore,
we rtc_set_time to update qemu base_rtc and last_update variable according
to time
stamp in cmos array.

Signed-off-by: Junlian Bell <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: eabb5782f70b4a10975b24ccd7129929a05ac932
      
https://github.com/qemu/qemu/commit/eabb5782f70b4a10975b24ccd7129929a05ac932
  Author: Peter Xu <address@hidden>
  Date:   2016-10-04 (Tue, 04 Oct 2016)

  Changed paths:
    M docs/specs/edu.txt
    M hw/misc/edu.c

  Log Message:
  -----------
  hw/misc/edu: support MSI interrupt

So now edu device can support both line or msi interrupt, depending on
how user configures it.

Signed-off-by: Peter Xu <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: 120e512b7f753f2e2978b47344f329c2595284de
      
https://github.com/qemu/qemu/commit/120e512b7f753f2e2978b47344f329c2595284de
  Author: Hervé Poussineau <address@hidden>
  Date:   2016-10-04 (Tue, 04 Oct 2016)

  Changed paths:
    M hw/intc/Makefile.objs
    A hw/intc/intc.c
    A include/hw/intc/intc.h

  Log Message:
  -----------
  intc: add an interface to gather statistics/informations on interrupt 
controllers

This interface will be used by HMP commands 'info irq' and 'info pic'.

Signed-off-by: Hervé Poussineau <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: 4f2e39e10360380862ae388424c129ce56ec8ae9
      
https://github.com/qemu/qemu/commit/4f2e39e10360380862ae388424c129ce56ec8ae9
  Author: Hervé Poussineau <address@hidden>
  Date:   2016-10-04 (Tue, 04 Oct 2016)

  Changed paths:
    M hw/intc/i8259.c

  Log Message:
  -----------
  intc/i8259: implement InterruptStatsProvider interface

Signed-off-by: Hervé Poussineau <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: 148fbe950454a7faf9ffae1763a3a185fcc7233e
      
https://github.com/qemu/qemu/commit/148fbe950454a7faf9ffae1763a3a185fcc7233e
  Author: Hervé Poussineau <address@hidden>
  Date:   2016-10-04 (Tue, 04 Oct 2016)

  Changed paths:
    M hw/intc/slavio_intctl.c

  Log Message:
  -----------
  intc/slavio_intctl: implement InterruptStatsProvider interface

Acked-by: Artyom Tarasenko <address@hidden>
Signed-off-by: Hervé Poussineau <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: 7c468ec54cf1b077022f870e211c41966bf58a2f
      
https://github.com/qemu/qemu/commit/7c468ec54cf1b077022f870e211c41966bf58a2f
  Author: Hervé Poussineau <address@hidden>
  Date:   2016-10-04 (Tue, 04 Oct 2016)

  Changed paths:
    M hw/intc/lm32_pic.c

  Log Message:
  -----------
  intc/lm32_pic: implement InterruptStatsProvider interface

We have to change the vmstate version due to changes in statistics counters.

Signed-off-by: Hervé Poussineau <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: 61b97833b38122e22c7af08685277681c6b79653
      
https://github.com/qemu/qemu/commit/61b97833b38122e22c7af08685277681c6b79653
  Author: Hervé Poussineau <address@hidden>
  Date:   2016-10-04 (Tue, 04 Oct 2016)

  Changed paths:
    M hmp-commands-info.hx
    M hmp.c
    M hmp.h
    M hw/intc/i8259.c
    M hw/intc/lm32_pic.c
    M hw/intc/slavio_intctl.c
    M hw/sparc/sun4m.c
    M include/hw/i386/pc.h
    M include/hw/lm32/lm32_pic.h
    M include/hw/sparc/sun4m.h
    M monitor.c

  Log Message:
  -----------
  intc: make HMP 'info irq' and 'info pic' commands use InterruptStatsProvider 
interface

Signed-off-by: Hervé Poussineau <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: 254316fa1f3f9c9ee9bf530278359146f97e309e
      
https://github.com/qemu/qemu/commit/254316fa1f3f9c9ee9bf530278359146f97e309e
  Author: Hervé Poussineau <address@hidden>
  Date:   2016-10-04 (Tue, 04 Oct 2016)

  Changed paths:
    M hmp-commands-info.hx

  Log Message:
  -----------
  intc: make HMP 'info irq' and 'info pic' commands available on all targets

Signed-off-by: Hervé Poussineau <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: 23ea7f57949f2f5934f4d5bbc29fe321b3a7067b
      
https://github.com/qemu/qemu/commit/23ea7f57949f2f5934f4d5bbc29fe321b3a7067b
  Author: Alex Bennée <address@hidden>
  Date:   2016-10-04 (Tue, 04 Oct 2016)

  Changed paths:
    M include/qemu/atomic.h

  Log Message:
  -----------
  atomic.h: fix __SANITIZE_THREAD__ build

Only very modern GCC's actually set this define when building with the
ThreadSanitizer so this little typo slipped though.

Signed-off-by: Alex Bennée <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: e653bc6b0ff645c25b8a2eb607c18a5c98b59db6
      
https://github.com/qemu/qemu/commit/e653bc6b0ff645c25b8a2eb607c18a5c98b59db6
  Author: Alex Bennée <address@hidden>
  Date:   2016-10-04 (Tue, 04 Oct 2016)

  Changed paths:
    M include/qemu/atomic.h

  Log Message:
  -----------
  atomic.h: comment on use of atomic_read/set

Add some notes on the use of the relaxed atomic access helpers and their
importance for defined behaviour in C11's multi-threaded memory model.

Signed-off-by: Alex Bennée <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: 550276ae0a88851edda2cb7fcdd64256dbb8e314
      
https://github.com/qemu/qemu/commit/550276ae0a88851edda2cb7fcdd64256dbb8e314
  Author: Alex Bennée <address@hidden>
  Date:   2016-10-04 (Tue, 04 Oct 2016)

  Changed paths:
    M tcg/optimize.c

  Log Message:
  -----------
  tcg/optimize: move default return out of if statement

This is to appease sanitizer builds which complain that:

  "error: control reaches end of non-void function"

Signed-off-by: Alex Bennée <address@hidden>
Reviewed-by: Marc-André Lureau <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: f96a8cc3c633b25d9269337408ae2417ebbbad8e
      
https://github.com/qemu/qemu/commit/f96a8cc3c633b25d9269337408ae2417ebbbad8e
  Author: Paolo Bonzini <address@hidden>
  Date:   2016-10-04 (Tue, 04 Oct 2016)

  Changed paths:
    M include/qemu/seqlock.h

  Log Message:
  -----------
  seqlock: use atomic writes for the sequence

There is a data race if the sequence is written concurrently to the
read.  In C11 this has undefined behavior.  Use atomic_set; the
read side is already using atomic_read.

Reported-by: Alex Bennée <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>
Signed-off-by: Alex Bennée <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: b6b3ccfda015dcd5ab50f70c189ee5cc6c622e91
      
https://github.com/qemu/qemu/commit/b6b3ccfda015dcd5ab50f70c189ee5cc6c622e91
  Author: Alex Bennée <address@hidden>
  Date:   2016-10-04 (Tue, 04 Oct 2016)

  Changed paths:
    M qom/object.c

  Log Message:
  -----------
  qom/object: update class cache atomically

The idiom CPU_GET_CLASS(cpu) is fairly extensively used in various
threads and trips of ThreadSanitizer due to the fact it updates
obj->class->object_cast_cache behind the scenes. As this is just a
fast-path cache there is no need to lock updates.

However to ensure defined C11 behaviour across threads we need to use
the plain atomic_read/set primitives and keep the sanitizer happy.

Signed-off-by: Alex Bennée <address@hidden>
Reviewed-by: Marc-André Lureau <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: ce7cf6a973f4b614162b9518954d441fa5e32fc6
      
https://github.com/qemu/qemu/commit/ce7cf6a973f4b614162b9518954d441fa5e32fc6
  Author: Alex Bennée <address@hidden>
  Date:   2016-10-04 (Tue, 04 Oct 2016)

  Changed paths:
    M qom/cpu.c

  Log Message:
  -----------
  qom/cpu: atomically clear the tb_jmp_cache

The ThreadSanitizer rightly complains that something initialised with a
normal access is later updated and read atomically.

Signed-off-by: Alex Bennée <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: 027d9a7d2911e993cdcbd21c7c35d1dd058f05bb
      
https://github.com/qemu/qemu/commit/027d9a7d2911e993cdcbd21c7c35d1dd058f05bb
  Author: Alex Bennée <address@hidden>
  Date:   2016-10-04 (Tue, 04 Oct 2016)

  Changed paths:
    M cpu-exec.c
    M qom/cpu.c

  Log Message:
  -----------
  cpu: atomically modify cpu->exit_request

ThreadSanitizer picks up potential races although we already use
barriers to ensure things are in the correct order when processing exit
requests. For true C11 defined behaviour across threads we need to use
relaxed atomic_set/atomic_read semantics to reassure tsan.

Signed-off-by: Alex Bennée <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: a890643958f03aaa344290700093b280cb606c28
      
https://github.com/qemu/qemu/commit/a890643958f03aaa344290700093b280cb606c28
  Author: Alex Bennée <address@hidden>
  Date:   2016-10-04 (Tue, 04 Oct 2016)

  Changed paths:
    M util/qht.c

  Log Message:
  -----------
  util/qht: atomically set b->hashes

ThreadSanitizer detects a possible race between reading/writing the
hashes. The ordering semantics are already documented for QHT however
for true C11 compliance we should use relaxed atomic primitives for
accesses that are done across threads. On x86 this slightly changes to
the code to not do a load/compare in a single instruction leading to a
slight performance degradation.

Running 'taskset -c 0 tests/qht-bench -n 1 -d 10' (i.e. all lookups) 10
times, we get:

before the patch:
 $ ./mean.pl 34.04 34.24 34.38 34.25 34.18 34.51 34.46 34.44 34.29 34.08
 34.287 +- 0.160072900059109
after:
 $ ./mean.pl 33.94 34.00 33.52 33.46 33.55 33.71 34.27 34.06 34.28 34.58
 33.937 +- 0.374731014640279

Signed-off-by: Alex Bennée <address@hidden>
Reviewed-by: Emilio G. Cota <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: dd1f63493adbbb06fa16ed15f8fc16584f55ee81
      
https://github.com/qemu/qemu/commit/dd1f63493adbbb06fa16ed15f8fc16584f55ee81
  Author: Alex Bennée <address@hidden>
  Date:   2016-10-04 (Tue, 04 Oct 2016)

  Changed paths:
    M linux-user/syscall.c

  Log Message:
  -----------
  linux-user/syscall: extend lock around cpu-list

There is a potential race if several threads exit at once. To serialise
the exits extend the lock above the initial checking of the CPU list.

Signed-off-by: Alex Bennée <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: a31393e7a594e45f2ed0ae17e1b7987e94f30fcf
      
https://github.com/qemu/qemu/commit/a31393e7a594e45f2ed0ae17e1b7987e94f30fcf
  Author: Alex Bennée <address@hidden>
  Date:   2016-10-04 (Tue, 04 Oct 2016)

  Changed paths:
    M qga/commands.c

  Log Message:
  -----------
  qga/command: use QEMU atomic primitives

The guest client's use of the glib's g_atomic primitives causes newer
GCC's to barf when built on Travis. As QEMU has its own primitives with
well understood semantics we might as well use them.

The use of atomics was a little inconsistent so I've also ensure the
values are correctly set with atomic primitives at the same time.

I also made the usage of bool consistent while I was at it.

Signed-off-by: Alex Bennée <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: 32265288a9b207dcd3f8da516643f81e1d2c5a1e
      
https://github.com/qemu/qemu/commit/32265288a9b207dcd3f8da516643f81e1d2c5a1e
  Author: Alex Bennée <address@hidden>
  Date:   2016-10-04 (Tue, 04 Oct 2016)

  Changed paths:
    M .travis.yml

  Log Message:
  -----------
  .travis.yml: add gcc sanitizer build

As it seems easy to break the ThreadSanitizer build we should defend it to
ensure that fixes get applied when it breaks. We use the Ubuntu GCC PPA
to get the latest GCC goodness.

As we need to use the -fuse-ld=gold work around we have to disable the
linux-user targets as these trip up the linker.

The make check run is also disabled for Travis but this can be
re-enabled once the check targets have been fixed.

Signed-off-by: Alex Bennée <address@hidden>

Message-Id: <address@hidden>


  Commit: 25a8535943b456954eeb82eb7d1f53d2b4f168e6
      
https://github.com/qemu/qemu/commit/25a8535943b456954eeb82eb7d1f53d2b4f168e6
  Author: Hervé Poussineau <address@hidden>
  Date:   2016-10-04 (Tue, 04 Oct 2016)

  Changed paths:
    M hw/intc/i8259_common.c

  Log Message:
  -----------
  i8259: give ISA device when registering ISA ioports

Signed-off-by: Hervé Poussineau <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: 949055a2549afc4cde06b7972072c7288bb43722
      
https://github.com/qemu/qemu/commit/949055a2549afc4cde06b7972072c7288bb43722
  Author: Marc-André Lureau <address@hidden>
  Date:   2016-10-04 (Tue, 04 Oct 2016)

  Changed paths:
    M include/sysemu/char.h
    M qemu-char.c

  Log Message:
  -----------
  char: use a fixed idx for child muxed chr

mux_chr_update_read_handler() is adding a new mux_cnt each time
mux_chr_update_read_handler() is called, it's not possible to actually
update the "child" chr callbacks that were set previously. This may lead
to crashes if the "child" chr is destroyed:

valgrind x86_64-softmmu/qemu-system-x86_64 -chardev
stdio,mux=on,id=char0 -mon chardev=char0,mode=control,default

when quitting:

==4306== Invalid read of size 8
==4306==    at 0x8061D3: json_lexer_destroy (json-lexer.c:385)
==4306==    by 0x7E39F8: json_message_parser_destroy (json-streamer.c:134)
==4306==    by 0x3447F6: monitor_qmp_event (monitor.c:3908)
==4306==    by 0x480153: mux_chr_send_event (qemu-char.c:630)
==4306==    by 0x480694: mux_chr_event (qemu-char.c:734)
==4306==    by 0x47F1E9: qemu_chr_be_event (qemu-char.c:205)
==4306==    by 0x481207: fd_chr_close (qemu-char.c:1114)
==4306==    by 0x481659: qemu_chr_close_stdio (qemu-char.c:1221)
==4306==    by 0x486F07: qemu_chr_free (qemu-char.c:4146)
==4306==    by 0x486F97: qemu_chr_delete (qemu-char.c:4154)
==4306==    by 0x487E66: qemu_chr_cleanup (qemu-char.c:4678)
==4306==    by 0x495A98: main (vl.c:4675)
==4306==  Address 0x28439e90 is 112 bytes inside a block of size 240 free'd
==4306==    at 0x4C2CD5A: free (vg_replace_malloc.c:530)
==4306==    by 0x1E4CBF2D: g_free (in /usr/lib64/libglib-2.0.so.0.4800.2)
==4306==    by 0x344DE9: monitor_cleanup (monitor.c:4058)
==4306==    by 0x495A93: main (vl.c:4674)
==4306==  Block was alloc'd at
==4306==    at 0x4C2BBAD: malloc (vg_replace_malloc.c:299)
==4306==    by 0x1E4CBE18: g_malloc (in /usr/lib64/libglib-2.0.so.0.4800.2)
==4306==    by 0x344BF8: monitor_init (monitor.c:4021)
==4306==    by 0x49063C: mon_init_func (vl.c:2417)
==4306==    by 0x7FC6DE: qemu_opts_foreach (qemu-option.c:1116)
==4306==    by 0x4954E0: main (vl.c:4473)

Instead, keep the "child" chr associated with a particular idx so its
handlers can be updated and removed to avoid the crash.

Signed-off-by: Marc-André Lureau <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: 6a7b2b21008f271e7a91e937e521e22f94579bb9
      
https://github.com/qemu/qemu/commit/6a7b2b21008f271e7a91e937e521e22f94579bb9
  Author: Marc-André Lureau <address@hidden>
  Date:   2016-10-04 (Tue, 04 Oct 2016)

  Changed paths:
    M qemu-char.c

  Log Message:
  -----------
  char: update read handler in all cases

In commit ac1b84dd1 (rhbz#1027181), a check was added to only update the
"read handler" when the front-end is opened, because the read callbacks
were not restored when a device is plugged. However, this seems not
correct, the handler is correctly set back on hotplug (in
virtconsole_realize) and the bug can no longer be reproduced.

Calling chr_update_read_handler() allows to fix the mux driver to stop
calling the child handlers (which may be going to be destroyed).

Signed-off-by: Marc-André Lureau <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: 7dc9ae4339faa97e89daadb2e1098147ab4aadc8
      
https://github.com/qemu/qemu/commit/7dc9ae4339faa97e89daadb2e1098147ab4aadc8
  Author: Michal Privoznik <address@hidden>
  Date:   2016-10-04 (Tue, 04 Oct 2016)

  Changed paths:
    M include/qemu/osdep.h
    M util/oslib-posix.c
    M util/oslib-win32.c

  Log Message:
  -----------
  util: Introduce qemu_get_pid_name

This is a small helper that tries to fetch binary name for given
PID.

Signed-off-by: Michal Privoznik <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: fbe7e3327a8cfa1b08664c2cda7a0a341cf0530a
      
https://github.com/qemu/qemu/commit/fbe7e3327a8cfa1b08664c2cda7a0a341cf0530a
  Author: Michal Privoznik <address@hidden>
  Date:   2016-10-04 (Tue, 04 Oct 2016)

  Changed paths:
    M vl.c

  Log Message:
  -----------
  qemu_kill_report: Report PID name too

When qemu is being killed, its last words are:

2016-08-31T11:48:15.293587Z qemu-system-x86_64: terminating on signal 15 from 
pid 11180

That's nice, but what process is 11180? What if I told you we can
do better:

2016-08-31T11:48:15.293587Z qemu-system-x86_64: terminating on signal 15 from 
pid 11180 (/usr/sbin/libvirtd)

And that's exactly what this patch does.

Signed-off-by: Michal Privoznik <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: e424b6550f486b2a9ab32b13c3824021199bac54
      
https://github.com/qemu/qemu/commit/e424b6550f486b2a9ab32b13c3824021199bac54
  Author: Tomáš Golembiovský <address@hidden>
  Date:   2016-10-06 (Thu, 06 Oct 2016)

  Changed paths:
    M qemu-nbd.c

  Log Message:
  -----------
  qemu-nbd: Shrink image size by specified offset

When --offset is set the apparent device size has to be adjusted
accordingly. Otherwise client may request read/write beyond the file end
which would fail.

Signed-off-by: Tomáš Golembiovský <address@hidden>
Message-Id: <address@hidden>
Reviewed-by: Eric Blake <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: f555a9d0b3c785b698f32e6879e97d0a4b387314
      
https://github.com/qemu/qemu/commit/f555a9d0b3c785b698f32e6879e97d0a4b387314
  Author: Emilio G. Cota <address@hidden>
  Date:   2016-10-06 (Thu, 06 Oct 2016)

  Changed paths:
    M util/qht.c

  Log Message:
  -----------
  qht: simplify qht_reset_size

Sometimes gcc doesn't pick up the fact that 'new' is properly
set if 'resize == true', which may generate an unnecessary
build warning.

Fix it by removing 'resize' and directly checking that 'new'
is non-NULL.

Signed-off-by: Emilio G. Cota <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: 76b553b308dc8671eb672b889b38889b1231cf1e
      
https://github.com/qemu/qemu/commit/76b553b308dc8671eb672b889b38889b1231cf1e
  Author: Emilio G. Cota <address@hidden>
  Date:   2016-10-06 (Thu, 06 Oct 2016)

  Changed paths:
    M util/qht.c

  Log Message:
  -----------
  qht: fix unlock-after-free segfault upon resizing

The old map's bucket locks are being unlocked *after*
that same old map has been passed to RCU for destruction.
This is a bug that can cause a segfault, since there's
no guarantee that the deletion will be deferred (e.g.
there may be no concurrent readers).

The segfault is easily triggered in RHEL6/CentOS6 with qht-test,
particularly on a single-core system or by pinning qht-test
to a single core.

Fix it by unlocking the map's bucket locks right after having
published the new map, and (crucially) before marking the map
for deletion via call_rcu().

While at it, expand qht_do_resize() to atomically do (1) a reset,
(2) a resize, or (3) a reset+resize. This simplifies the calling
code, since the new function (qht_do_resize_reset()) acquires
and releases the buckets' locks.

Note that no qht_do_reset inline is provided, since it would have
no users--qht_reset() already performs a reset without taking
ht->lock.

Reported-by: Peter Maydell <address@hidden>
Reported-by: Daniel P. Berrange <address@hidden>
Signed-off-by: Emilio G. Cota <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: 9c7d64eb2a47033c9697fb4a5a540af1aa3915ab
      
https://github.com/qemu/qemu/commit/9c7d64eb2a47033c9697fb4a5a540af1aa3915ab
  Author: Emilio G. Cota <address@hidden>
  Date:   2016-10-06 (Thu, 06 Oct 2016)

  Changed paths:
    M tests/test-qht.c

  Log Message:
  -----------
  test-qht: perform lookups under rcu_read_lock

qht_lookup is meant to be called from an RCU read-critical
section. Make sure we're in such a section in test-qht
when performing lookups, despite the fact that no races
in qht can be triggered by test-qht since it is single-threaded.

Note that rcu_register_thread is already called by the
rcu_after_fork hook, and therefore duplicating it here would
be a bug.

Signed-off-by: Emilio G. Cota <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: f91c7e5235357d3bc0db02d6459238b901384bff
      
https://github.com/qemu/qemu/commit/f91c7e5235357d3bc0db02d6459238b901384bff
  Author: Paolo Bonzini <address@hidden>
  Date:   2016-10-07 (Fri, 07 Oct 2016)

  Changed paths:
    M qemu-tech.texi

  Log Message:
  -----------
  qemu-tech: drop index

Reviewed-by: Emilio G. Cota <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: 1f3e7e41bb0ca09e322e95aab98e2593e1f6ff55
      
https://github.com/qemu/qemu/commit/1f3e7e41bb0ca09e322e95aab98e2593e1f6ff55
  Author: Paolo Bonzini <address@hidden>
  Date:   2016-10-07 (Fri, 07 Oct 2016)

  Changed paths:
    M qemu-doc.texi
    M qemu-tech.texi

  Log Message:
  -----------
  qemu-doc: replace introduction with the one from the internals manual

The user manual has an obsolete introduction, and the one in
the internals manual lists QEMU's features quite nicely.
Drop the obsolete content and remove generic user-level
documentation from qemu-tech.

Reviewed-by: Emilio G. Cota <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: 81f265a8a4f56e49aca3ecca83fce48821c01618
      
https://github.com/qemu/qemu/commit/81f265a8a4f56e49aca3ecca83fce48821c01618
  Author: Paolo Bonzini <address@hidden>
  Date:   2016-10-07 (Fri, 07 Oct 2016)

  Changed paths:
    M README
    M qemu-doc.texi

  Log Message:
  -----------
  qemu-doc: drop installation and compilation notes

These are in README or obsolete, and the detailed version can be on a
website instead.

Reviewed-by: Emilio G. Cota <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: bf28a69eeb53e9e45166fbdda032454e7b1e3f29
      
https://github.com/qemu/qemu/commit/bf28a69eeb53e9e45166fbdda032454e7b1e3f29
  Author: Paolo Bonzini <address@hidden>
  Date:   2016-10-07 (Fri, 07 Oct 2016)

  Changed paths:
    M qemu-tech.texi
    M tcg/README

  Log Message:
  -----------
  qemu-tech: move text from qemu-tech to tcg/README

Reviewed-by: Emilio G. Cota <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: c3ce5a235741cb027b1328288ddec06470254813
      
https://github.com/qemu/qemu/commit/c3ce5a235741cb027b1328288ddec06470254813
  Author: Paolo Bonzini <address@hidden>
  Date:   2016-10-07 (Fri, 07 Oct 2016)

  Changed paths:
    M qemu-tech.texi
    M target-cris/cpu.h
    M target-i386/cpu.h
    M target-m68k/cpu.h
    M target-s390x/cpu.h
    M target-sparc/cpu.h

  Log Message:
  -----------
  qemu-tech: document lazy condition code evaluation in cpu.h

Unlike the other sections, they are pretty specific to a particular CPU.

Reviewed-by: Emilio G. Cota <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: 0722cc42d472c64edb28cfdee04be815a3c1c7fa
      
https://github.com/qemu/qemu/commit/0722cc42d472c64edb28cfdee04be815a3c1c7fa
  Author: Paolo Bonzini <address@hidden>
  Date:   2016-10-07 (Fri, 07 Oct 2016)

  Changed paths:
    M qemu-doc.texi
    M qemu-tech.texi

  Log Message:
  -----------
  qemu-tech: move user mode emulation features from qemu-tech

These are interesting for users too, since nowadays most
qemu-user users are going to be somewhat technical rather than
just people that want to run Wine.  Some detail is lost, on
the other hand some of the information I removed (e.g. basic
block unchaining) was obsolete.

Reviewed-by: Emilio G. Cota <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: 72bd94c578a4459924e415115b43c21b8ad6cdbd
      
https://github.com/qemu/qemu/commit/72bd94c578a4459924e415115b43c21b8ad6cdbd
  Author: Paolo Bonzini <address@hidden>
  Date:   2016-10-07 (Fri, 07 Oct 2016)

  Changed paths:
    M qemu-tech.texi
    A tests/tcg/README

  Log Message:
  -----------
  qemu-tech: move TCG test documentation to tests/tcg/README

Reviewed-by: Emilio G. Cota <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: 77d47e16929b063570a78a264746dc0e8adb85e7
      
https://github.com/qemu/qemu/commit/77d47e16929b063570a78a264746dc0e8adb85e7
  Author: Paolo Bonzini <address@hidden>
  Date:   2016-10-07 (Fri, 07 Oct 2016)

  Changed paths:
    M qemu-tech.texi

  Log Message:
  -----------
  qemu-tech: reorganize content

Split more parts into separate chapters, place comparison last,
rename "Introduction" to "CPU emulation".

Reviewed-by: Emilio G. Cota <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: 36e4970e9d658143cc53e409a94e32ece2a36626
      
https://github.com/qemu/qemu/commit/36e4970e9d658143cc53e409a94e32ece2a36626
  Author: Paolo Bonzini <address@hidden>
  Date:   2016-10-07 (Fri, 07 Oct 2016)

  Changed paths:
    M qemu-tech.texi

  Log Message:
  -----------
  qemu-tech: rewrite some parts

Drop most the device emulation part and merge the rest into the description
of the MMU.  Make some bits more up-to-date.

Reviewed-by: Emilio G. Cota <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: 78e87797ba0b6612fc1c95216a0b81c744fb85b0
      
https://github.com/qemu/qemu/commit/78e87797ba0b6612fc1c95216a0b81c744fb85b0
  Author: Paolo Bonzini <address@hidden>
  Date:   2016-10-07 (Fri, 07 Oct 2016)

  Changed paths:
    M .gitignore
    M Makefile
    M qemu-doc.texi
    M qemu-tech.texi
    M qemu.nsi
    M ui/cocoa.m

  Log Message:
  -----------
  qemu-doc: merge qemu-tech and qemu-doc

Merge what is left of qemu-tech into the main manual as an appendix.
Ultimately we should have a new internals manual built from docs/, and
then the "Translator Internals" parts of qemu-tech could move to docs/
as well.  The bits on limitation and features of CPU emulation should
remain in qemu-doc.

Reviewed-by: Emilio G. Cota <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>


  Commit: 86e121ae75d10d0aa4ef76150e94a2e83bdac3e9
      
https://github.com/qemu/qemu/commit/86e121ae75d10d0aa4ef76150e94a2e83bdac3e9
  Author: Peter Maydell <address@hidden>
  Date:   2016-10-10 (Mon, 10 Oct 2016)

  Changed paths:
    M .gitignore
    M .travis.yml
    M Makefile
    M README
    M cpu-exec.c
    M docs/specs/edu.txt
    M hmp-commands-info.hx
    M hmp.c
    M hmp.h
    M hw/i386/amd_iommu.c
    M hw/intc/Makefile.objs
    M hw/intc/i8259.c
    M hw/intc/i8259_common.c
    A hw/intc/intc.c
    M hw/intc/lm32_pic.c
    M hw/intc/slavio_intctl.c
    M hw/misc/edu.c
    M hw/sparc/sun4m.c
    M hw/timer/mc146818rtc.c
    M include/hw/i386/pc.h
    A include/hw/intc/intc.h
    M include/hw/lm32/lm32_pic.h
    M include/hw/sparc/sun4m.h
    M include/qemu/atomic.h
    M include/qemu/osdep.h
    M include/qemu/seqlock.h
    M include/sysemu/char.h
    M linux-user/syscall.c
    M monitor.c
    M qemu-char.c
    M qemu-doc.texi
    M qemu-nbd.c
    M qemu-tech.texi
    M qemu.nsi
    M qga/commands.c
    M qom/cpu.c
    M qom/object.c
    M target-cris/cpu.h
    M target-i386/cpu.h
    M target-m68k/cpu.h
    M target-s390x/cpu.h
    M target-sparc/cpu.h
    M tcg/README
    M tcg/optimize.c
    A tests/tcg/README
    M tests/test-qht.c
    M ui/cocoa.m
    M util/oslib-posix.c
    M util/oslib-win32.c
    M util/qht.c
    M vl.c

  Log Message:
  -----------
  Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into staging

* Thread Sanitizer fixes (Alex)
* Coverity fixes (David)
* test-qht fixes (Emilio)
* QOM interface for info irq/info pic (Hervé)
* -rtc clock=rt fix (Junlian)
* mux chardev fixes (Marc-André)
* nicer report on death by signal (Michal)
* qemu-tech TLC (Paolo)
* MSI support for edu device (Peter)
* qemu-nbd --offset fix (Tomáš)

# gpg: Signature made Fri 07 Oct 2016 17:25:10 BST
# gpg:                using RSA key 0xBFFBD25F78C7AE83
# gpg: Good signature from "Paolo Bonzini <address@hidden>"
# gpg:                 aka "Paolo Bonzini <address@hidden>"
# Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4  E2F7 7E15 100C CD36 69B1
#      Subkey fingerprint: F133 3857 4B66 2389 866C  7682 BFFB D25F 78C7 AE83

* remotes/bonzini/tags/for-upstream: (39 commits)
  qemu-doc: merge qemu-tech and qemu-doc
  qemu-tech: rewrite some parts
  qemu-tech: reorganize content
  qemu-tech: move TCG test documentation to tests/tcg/README
  qemu-tech: move user mode emulation features from qemu-tech
  qemu-tech: document lazy condition code evaluation in cpu.h
  qemu-tech: move text from qemu-tech to tcg/README
  qemu-doc: drop installation and compilation notes
  qemu-doc: replace introduction with the one from the internals manual
  qemu-tech: drop index
  test-qht: perform lookups under rcu_read_lock
  qht: fix unlock-after-free segfault upon resizing
  qht: simplify qht_reset_size
  qemu-nbd: Shrink image size by specified offset
  qemu_kill_report: Report PID name too
  util: Introduce qemu_get_pid_name
  char: update read handler in all cases
  char: use a fixed idx for child muxed chr
  i8259: give ISA device when registering ISA ioports
  .travis.yml: add gcc sanitizer build
  ...

Signed-off-by: Peter Maydell <address@hidden>


Compare: https://github.com/qemu/qemu/compare/48f592118ab4...86e121ae75d1
[Prev in Thread]
Current Thread
[Next in Thread]
[Qemu-commits] [qemu/qemu] 1d5b12: hw/iommu: Fix problems reported by Coverity scan, GitHub <=
Prev by Date: [Qemu-commits] [qemu/qemu] 48f592: bsd-user: fix FreeBSD build after d148d90e
Next by Date: [Qemu-commits] [qemu/qemu] e64c75: qmp: fix object-add assert() without props
Previous by thread: [Qemu-commits] [qemu/qemu] 48f592: bsd-user: fix FreeBSD build after d148d90e
Next by thread: [Qemu-commits] [qemu/qemu] e64c75: qmp: fix object-add assert() without props
Index(es):
- Date
- Thread