All of lore.kernel.org
 help / color / mirror / Atom feed
* [Qemu-devel] [PULL 00/11] virtio, acpi: fixes, cleanups
@ 2019-06-16 21:36 Michael S. Tsirkin
  2019-06-16 21:36 ` [Qemu-devel] [PULL 10/11] q35: update DSDT Michael S. Tsirkin
                   ` (2 more replies)
  0 siblings, 3 replies; 35+ messages in thread
From: Michael S. Tsirkin @ 2019-06-16 21:36 UTC (permalink / raw)
  To: qemu-devel; +Cc: Peter Maydell

The following changes since commit f3d0bec9f80e4ed7796fffa834ba0a53f2094f7f:

  Merge remote-tracking branch 'remotes/maxreitz/tags/pull-block-2019-06-14' into staging (2019-06-14 14:46:13 +0100)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/virt/kvm/mst/qemu.git tags/for_upstream

for you to fetch changes up to 5f6b3561bf58395fd6c906d7064a1a5693a2e426:

  tests/rebuild-expected-aml.sh: blow out difflist (2019-06-16 16:44:44 -0400)

----------------------------------------------------------------
virtio, acpi: fixes, cleanups

A bunch of minor fixes all over the place.

Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

----------------------------------------------------------------
Gerd Hoffmann (1):
      q35: fix mmconfig and PCI0._CRS

Li Hangjing (1):
      vhost: fix vhost_log size overflow during migration

Marc-André Lureau (6):
      vhost-user-gpu: do not send scanout update if no GPU socket
      vhost-user: check unix_listen() return value
      vhost-user: improve error report
      vhost-user-input: check ioctl(EVIOCGNAME) return value
      vhost-user-gpu: initialize msghdr & iov at declaration
      docs/vhost-user.json: some firmware.json copy leftovers

Michael S. Tsirkin (2):
      q35: update DSDT
      tests/rebuild-expected-aml.sh: blow out difflist

Wei Yang (1):
      hw/acpi: extract acpi_add_rom_blob()

 docs/interop/vhost-user.json            |   6 ++---
 include/hw/acpi/utils.h                 |   9 +++++++
 contrib/vhost-user-gpu/main.c           |  29 +++++++++++------------
 contrib/vhost-user-input/main.c         |  12 ++++++++--
 hw/acpi/utils.c                         |  35 ++++++++++++++++++++++++++++
 hw/arm/virt-acpi-build.c                |  26 ++++++++-------------
 hw/i386/acpi-build.c                    |  40 +++++++++++++++++++-------------
 hw/pci-host/q35.c                       |  31 +++++++------------------
 hw/virtio/vhost.c                       |  10 ++++++++
 hw/acpi/Makefile.objs                   |   2 +-
 tests/data/acpi/q35/DSDT                | Bin 7815 -> 7841 bytes
 tests/data/acpi/q35/DSDT.bridge         | Bin 7832 -> 7858 bytes
 tests/data/acpi/q35/DSDT.cphp           | Bin 8278 -> 8304 bytes
 tests/data/acpi/q35/DSDT.dimmpxm        | Bin 9468 -> 9494 bytes
 tests/data/acpi/q35/DSDT.ipmibt         | Bin 7890 -> 7916 bytes
 tests/data/acpi/q35/DSDT.memhp          | Bin 9174 -> 9200 bytes
 tests/data/acpi/q35/DSDT.mmio64         | Bin 8945 -> 8971 bytes
 tests/data/acpi/q35/DSDT.numamem        | Bin 7821 -> 7847 bytes
 tests/data/acpi/rebuild-expected-aml.sh |   3 +++
 19 files changed, 127 insertions(+), 76 deletions(-)
 create mode 100644 include/hw/acpi/utils.h
 create mode 100644 hw/acpi/utils.c



^ permalink raw reply	[flat|nested] 35+ messages in thread
* [Qemu-devel] [PATCH v7] hw/acpi: extract acpi_add_rom_blob()
@ 2019-06-16 21:36 ` Michael S. Tsirkin
  0 siblings, 0 replies; 35+ messages in thread
From: Wei Yang @ 2019-06-10  1:18 UTC (permalink / raw)
  To: qemu-devel, qemu-arm
  Cc: yang.zhong, peter.maydell, mst, shannon.zhaosl, Wei Yang, imammedo

arm and i386 has almost the same function acpi_add_rom_blob(), except
giving different FWCfgCallback function.

This patch moves acpi_add_rom_blob() to utils.c by passing
FWCfgCallback to it.

Signed-off-by: Wei Yang <richardw.yang@linux.intel.com>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>

v7:
  * rebase on top of current master because of conflict
v6:
  * change author from Igor to Michael
v5:
  * remove unnecessary header glib/gprintf.h
  * rearrange include header to make it more suitable
v4:
  * extract -> moves
  * adjust comment in source to make checkpatch happy
v3:
  * put acpi_add_rom_blob() to hw/acpi/utils.c
v2:
  * remove unused header in original source file
---
 hw/acpi/Makefile.objs    |  2 +-
 hw/acpi/utils.c          | 35 +++++++++++++++++++++++++++++++++++
 hw/arm/virt-acpi-build.c | 26 ++++++++++----------------
 hw/i386/acpi-build.c     | 26 ++++++++++----------------
 include/hw/acpi/utils.h  |  9 +++++++++
 5 files changed, 65 insertions(+), 33 deletions(-)
 create mode 100644 hw/acpi/utils.c
 create mode 100644 include/hw/acpi/utils.h

diff --git a/hw/acpi/Makefile.objs b/hw/acpi/Makefile.objs
index 661a9b8c2f..9bb2101e3b 100644
--- a/hw/acpi/Makefile.objs
+++ b/hw/acpi/Makefile.objs
@@ -10,7 +10,7 @@ common-obj-$(call lnot,$(CONFIG_ACPI_X86)) += acpi-stub.o
 
 common-obj-y += acpi_interface.o
 common-obj-y += bios-linker-loader.o
-common-obj-y += aml-build.o
+common-obj-y += aml-build.o utils.o
 common-obj-$(CONFIG_ACPI_PCI) += pci.o
 common-obj-$(CONFIG_TPM) += tpm.o
 
diff --git a/hw/acpi/utils.c b/hw/acpi/utils.c
new file mode 100644
index 0000000000..a134a4d554
--- /dev/null
+++ b/hw/acpi/utils.c
@@ -0,0 +1,35 @@
+/*
+ * Utilities for generating ACPI tables and passing them to Guests
+ *
+ * Copyright (C) 2019 Intel Corporation
+ * Copyright (C) 2019 Red Hat Inc
+ *
+ * Author: Wei Yang <richardw.yang@linux.intel.com>
+ * Author: Michael S. Tsirkin <mst@redhat.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "qemu/osdep.h"
+#include "hw/acpi/aml-build.h"
+#include "hw/acpi/utils.h"
+#include "hw/loader.h"
+
+MemoryRegion *acpi_add_rom_blob(FWCfgCallback update, void *opaque,
+                                GArray *blob, const char *name,
+                                uint64_t max_size)
+{
+    return rom_add_blob(name, blob->data, acpi_data_len(blob), max_size, -1,
+                        name, update, opaque, NULL, true);
+}
diff --git a/hw/arm/virt-acpi-build.c b/hw/arm/virt-acpi-build.c
index 4a64f9985c..e3353de9e4 100644
--- a/hw/arm/virt-acpi-build.c
+++ b/hw/arm/virt-acpi-build.c
@@ -37,9 +37,9 @@
 #include "hw/acpi/acpi.h"
 #include "hw/nvram/fw_cfg.h"
 #include "hw/acpi/bios-linker-loader.h"
-#include "hw/loader.h"
 #include "hw/hw.h"
 #include "hw/acpi/aml-build.h"
+#include "hw/acpi/utils.h"
 #include "hw/acpi/pci.h"
 #include "hw/pci/pcie_host.h"
 #include "hw/pci/pci.h"
@@ -866,14 +866,6 @@ static void virt_acpi_build_reset(void *build_opaque)
     build_state->patched = false;
 }
 
-static MemoryRegion *acpi_add_rom_blob(AcpiBuildState *build_state,
-                                       GArray *blob, const char *name,
-                                       uint64_t max_size)
-{
-    return rom_add_blob(name, blob->data, acpi_data_len(blob), max_size, -1,
-                        name, virt_acpi_build_update, build_state, NULL, true);
-}
-
 static const VMStateDescription vmstate_virt_acpi_build = {
     .name = "virt_acpi_build",
     .version_id = 1,
@@ -905,20 +897,22 @@ void virt_acpi_setup(VirtMachineState *vms)
     virt_acpi_build(vms, &tables);
 
     /* Now expose it all to Guest */
-    build_state->table_mr = acpi_add_rom_blob(build_state, tables.table_data,
-                                               ACPI_BUILD_TABLE_FILE,
-                                               ACPI_BUILD_TABLE_MAX_SIZE);
+    build_state->table_mr = acpi_add_rom_blob(virt_acpi_build_update,
+                                              build_state, tables.table_data,
+                                              ACPI_BUILD_TABLE_FILE,
+                                              ACPI_BUILD_TABLE_MAX_SIZE);
     assert(build_state->table_mr != NULL);
 
     build_state->linker_mr =
-        acpi_add_rom_blob(build_state, tables.linker->cmd_blob,
-                          "etc/table-loader", 0);
+        acpi_add_rom_blob(virt_acpi_build_update, build_state,
+                          tables.linker->cmd_blob, "etc/table-loader", 0);
 
     fw_cfg_add_file(vms->fw_cfg, ACPI_BUILD_TPMLOG_FILE, tables.tcpalog->data,
                     acpi_data_len(tables.tcpalog));
 
-    build_state->rsdp_mr = acpi_add_rom_blob(build_state, tables.rsdp,
-                                              ACPI_BUILD_RSDP_FILE, 0);
+    build_state->rsdp_mr = acpi_add_rom_blob(virt_acpi_build_update,
+                                             build_state, tables.rsdp,
+                                             ACPI_BUILD_RSDP_FILE, 0);
 
     qemu_register_reset(virt_acpi_build_reset, build_state);
     virt_acpi_build_reset(build_state);
diff --git a/hw/i386/acpi-build.c b/hw/i386/acpi-build.c
index 85dc1640bc..5fdf7e2da7 100644
--- a/hw/i386/acpi-build.c
+++ b/hw/i386/acpi-build.c
@@ -38,7 +38,6 @@
 #include "hw/acpi/piix4.h"
 #include "hw/nvram/fw_cfg.h"
 #include "hw/acpi/bios-linker-loader.h"
-#include "hw/loader.h"
 #include "hw/isa/isa.h"
 #include "hw/block/fdc.h"
 #include "hw/acpi/memory_hotplug.h"
@@ -59,6 +58,7 @@
 #include "hw/i386/x86-iommu.h"
 
 #include "hw/acpi/aml-build.h"
+#include "hw/acpi/utils.h"
 #include "hw/acpi/pci.h"
 
 #include "qom/qom-qobject.h"
@@ -2824,14 +2824,6 @@ static void acpi_build_reset(void *build_opaque)
     build_state->patched = 0;
 }
 
-static MemoryRegion *acpi_add_rom_blob(AcpiBuildState *build_state,
-                                       GArray *blob, const char *name,
-                                       uint64_t max_size)
-{
-    return rom_add_blob(name, blob->data, acpi_data_len(blob), max_size, -1,
-                        name, acpi_build_update, build_state, NULL, true);
-}
-
 static const VMStateDescription vmstate_acpi_build = {
     .name = "acpi_build",
     .version_id = 1,
@@ -2873,14 +2865,15 @@ void acpi_setup(void)
     acpi_build(&tables, MACHINE(pcms));
 
     /* Now expose it all to Guest */
-    build_state->table_mr = acpi_add_rom_blob(build_state, tables.table_data,
-                                               ACPI_BUILD_TABLE_FILE,
-                                               ACPI_BUILD_TABLE_MAX_SIZE);
+    build_state->table_mr = acpi_add_rom_blob(acpi_build_update,
+                                              build_state, tables.table_data,
+                                              ACPI_BUILD_TABLE_FILE,
+                                              ACPI_BUILD_TABLE_MAX_SIZE);
     assert(build_state->table_mr != NULL);
 
     build_state->linker_mr =
-        acpi_add_rom_blob(build_state, tables.linker->cmd_blob,
-                          "etc/table-loader", 0);
+        acpi_add_rom_blob(acpi_build_update, build_state,
+                          tables.linker->cmd_blob, "etc/table-loader", 0);
 
     fw_cfg_add_file(pcms->fw_cfg, ACPI_BUILD_TPMLOG_FILE,
                     tables.tcpalog->data, acpi_data_len(tables.tcpalog));
@@ -2917,8 +2910,9 @@ void acpi_setup(void)
         build_state->rsdp_mr = NULL;
     } else {
         build_state->rsdp = NULL;
-        build_state->rsdp_mr = acpi_add_rom_blob(build_state, tables.rsdp,
-                                                  ACPI_BUILD_RSDP_FILE, 0);
+        build_state->rsdp_mr = acpi_add_rom_blob(acpi_build_update,
+                                                 build_state, tables.rsdp,
+                                                 ACPI_BUILD_RSDP_FILE, 0);
     }
 
     qemu_register_reset(acpi_build_reset, build_state);
diff --git a/include/hw/acpi/utils.h b/include/hw/acpi/utils.h
new file mode 100644
index 0000000000..140b4de603
--- /dev/null
+++ b/include/hw/acpi/utils.h
@@ -0,0 +1,9 @@
+#ifndef HW_ACPI_UTILS_H
+#define HW_ACPI_UTILS_H
+
+#include "hw/nvram/fw_cfg.h"
+
+MemoryRegion *acpi_add_rom_blob(FWCfgCallback update, void *opaque,
+                                GArray *blob, const char *name,
+                                uint64_t max_size);
+#endif
-- 
2.19.1



^ permalink raw reply related	[flat|nested] 35+ messages in thread
* [Qemu-devel] [PATCH v2] q35: fix mmconfig and PCI0._CRS
@ 2019-06-16 21:36 ` Michael S. Tsirkin
  0 siblings, 0 replies; 35+ messages in thread
From: Gerd Hoffmann @ 2019-06-07  7:34 UTC (permalink / raw)
  To: Michael S. Tsirkin
  Cc: Eduardo Habkost, open list:All patches CC here, Gerd Hoffmann,
	Paolo Bonzini, Igor Mammedov, László Érsek,
	Richard Henderson

This patch changes the handling of the mmconfig area.  Thanks to the
pci(e) expander devices we already have the logic to exclude address
ranges from PCI0._CRS.  We can simply add the mmconfig address range
to the list get it excluded as well.

With that in place we can go with a fixed pci hole which covers the
whole area from the end of (low) ram to the ioapic.

This will make the whole logic alot less fragile.  No matter where the
firmware places the mmconfig xbar, things should work correctly.  The
guest also gets a bit more PCI address space (seabios boot):

    # cat /proc/iomem
    [ ... ]
    7ffdd000-7fffffff : reserved
    80000000-afffffff : PCI Bus 0000:00            <<-- this is new
    b0000000-bfffffff : PCI MMCONFIG 0000 [bus 00-ff]
      b0000000-bfffffff : reserved
    c0000000-febfffff : PCI Bus 0000:00
      f8000000-fbffffff : 0000:00:01.0
    [ ... ]

So this is a guest visible change.

Cc: László Érsek <lersek@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
---
 tests/bios-tables-test-allowed-diff.h |  8 +++++++
 hw/i386/acpi-build.c                  | 14 ++++++++++++
 hw/pci-host/q35.c                     | 31 +++++++--------------------
 3 files changed, 30 insertions(+), 23 deletions(-)

diff --git a/tests/bios-tables-test-allowed-diff.h b/tests/bios-tables-test-allowed-diff.h
index dfb8523c8bf4..3bbd22c62a3b 100644
--- a/tests/bios-tables-test-allowed-diff.h
+++ b/tests/bios-tables-test-allowed-diff.h
@@ -1 +1,9 @@
 /* List of comma-separated changed AML files to ignore */
+"tests/data/acpi/q35/DSDT",
+"tests/data/acpi/q35/DSDT.bridge",
+"tests/data/acpi/q35/DSDT.mmio64",
+"tests/data/acpi/q35/DSDT.ipmibt",
+"tests/data/acpi/q35/DSDT.cphp",
+"tests/data/acpi/q35/DSDT.memhp",
+"tests/data/acpi/q35/DSDT.numamem",
+"tests/data/acpi/q35/DSDT.dimmpxm",
diff --git a/hw/i386/acpi-build.c b/hw/i386/acpi-build.c
index 85dc1640bc67..8e4f26977619 100644
--- a/hw/i386/acpi-build.c
+++ b/hw/i386/acpi-build.c
@@ -122,6 +122,8 @@ typedef struct FwCfgTPMConfig {
     uint8_t tpmppi_version;
 } QEMU_PACKED FwCfgTPMConfig;
 
+static bool acpi_get_mcfg(AcpiMcfgInfo *mcfg);
+
 static void init_common_fadt_data(Object *o, AcpiFadtData *data)
 {
     uint32_t io = object_property_get_uint(o, ACPI_PM_PROP_PM_IO_BASE, NULL);
@@ -1807,6 +1809,7 @@ build_dsdt(GArray *table_data, BIOSLinker *linker,
     CrsRangeSet crs_range_set;
     PCMachineState *pcms = PC_MACHINE(machine);
     PCMachineClass *pcmc = PC_MACHINE_GET_CLASS(machine);
+    AcpiMcfgInfo mcfg;
     uint32_t nr_mem = machine->ram_slots;
     int root_bus_limit = 0xFF;
     PCIBus *bus = NULL;
@@ -1921,6 +1924,17 @@ build_dsdt(GArray *table_data, BIOSLinker *linker,
         }
     }
 
+    /*
+     * At this point crs_range_set has all the ranges used by pci
+     * busses *other* than PCI0.  These ranges will be excluded from
+     * the PCI0._CRS.  Add mmconfig to the set so it will be excluded
+     * too.
+     */
+    if (acpi_get_mcfg(&mcfg)) {
+        crs_range_insert(crs_range_set.mem_ranges,
+                         mcfg.base, mcfg.base + mcfg.size - 1);
+    }
+
     scope = aml_scope("\\_SB.PCI0");
     /* build PCI0._CRS */
     crs = aml_resource_template();
diff --git a/hw/pci-host/q35.c b/hw/pci-host/q35.c
index 960939f5ed3e..72093320befe 100644
--- a/hw/pci-host/q35.c
+++ b/hw/pci-host/q35.c
@@ -258,15 +258,6 @@ static void q35_host_initfn(Object *obj)
     object_property_add_link(obj, MCH_HOST_PROP_IO_MEM, TYPE_MEMORY_REGION,
                              (Object **) &s->mch.address_space_io,
                              qdev_prop_allow_set_link_before_realize, 0, NULL);
-
-    /* Leave enough space for the biggest MCFG BAR */
-    /* TODO: this matches current bios behaviour, but
-     * it's not a power of two, which means an MTRR
-     * can't cover it exactly.
-     */
-    range_set_bounds(&s->mch.pci_hole,
-            MCH_HOST_BRIDGE_PCIEXBAR_DEFAULT + MCH_HOST_BRIDGE_PCIEXBAR_MAX,
-            IO_APIC_DEFAULT_ADDRESS - 1);
 }
 
 static const TypeInfo q35_host_info = {
@@ -338,20 +329,6 @@ static void mch_update_pciexbar(MCHPCIState *mch)
     }
     addr = pciexbar & addr_mask;
     pcie_host_mmcfg_update(pehb, enable, addr, length);
-    /* Leave enough space for the MCFG BAR */
-    /*
-     * TODO: this matches current bios behaviour, but it's not a power of two,
-     * which means an MTRR can't cover it exactly.
-     */
-    if (enable) {
-        range_set_bounds(&mch->pci_hole,
-                         addr + length,
-                         IO_APIC_DEFAULT_ADDRESS - 1);
-    } else {
-        range_set_bounds(&mch->pci_hole,
-                         MCH_HOST_BRIDGE_PCIEXBAR_DEFAULT,
-                         IO_APIC_DEFAULT_ADDRESS - 1);
-    }
 }
 
 /* PAM */
@@ -484,6 +461,14 @@ static void mch_update(MCHPCIState *mch)
     mch_update_pam(mch);
     mch_update_smram(mch);
     mch_update_ext_tseg_mbytes(mch);
+
+    /*
+     * pci hole goes from end-of-low-ram to io-apic.
+     * mmconfig will be excluded by the dsdt builder.
+     */
+    range_set_bounds(&mch->pci_hole,
+                     mch->below_4g_mem_size,
+                     IO_APIC_DEFAULT_ADDRESS - 1);
 }
 
 static int mch_post_load(void *opaque, int version_id)
-- 
2.18.1



^ permalink raw reply related	[flat|nested] 35+ messages in thread
* [Qemu-devel] [PATCH 0/5] Misc vhost-user fixes
@ 2019-06-05 14:58 Marc-André Lureau
  2019-06-16 21:36   ` [Qemu-devel] [PULL 01/11] " Michael S. Tsirkin
                   ` (4 more replies)
  0 siblings, 5 replies; 35+ messages in thread
From: Marc-André Lureau @ 2019-06-05 14:58 UTC (permalink / raw)
  To: qemu-devel; +Cc: Marc-André Lureau, Gerd Hoffmann, Michael S. Tsirkin

Hi,

Here is a few fixes spotted by Coverity in the recently landed
vhost-user-{input,gpu}.

Marc-André Lureau (5):
  vhost-user-gpu: do not send scanout update if no GPU socket
  vhost-user: check unix_listen() return value
  vhost-user: improve error report
  vhost-user-input: check ioctl(EVIOCGNAME) return value
  vhost-user-gpu: initialize msghdr & iov at declaration

 contrib/vhost-user-gpu/main.c   | 29 ++++++++++++++---------------
 contrib/vhost-user-input/main.c | 12 ++++++++++--
 2 files changed, 24 insertions(+), 17 deletions(-)

-- 
2.22.0.rc2.384.g1a9a72ea1d



^ permalink raw reply	[flat|nested] 35+ messages in thread
* [Qemu-devel] [PATCH] docs/vhost-user.json: some firmware.json copy leftovers
@ 2019-06-16 21:36 ` Michael S. Tsirkin
  0 siblings, 0 replies; 35+ messages in thread
From: Marc-André Lureau @ 2019-06-05 13:12 UTC (permalink / raw)
  To: qemu-devel; +Cc: qemu-trivial, Marc-André Lureau, mst

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
---
 docs/interop/vhost-user.json | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/docs/interop/vhost-user.json b/docs/interop/vhost-user.json
index ae88c03117..da6aaf51c8 100644
--- a/docs/interop/vhost-user.json
+++ b/docs/interop/vhost-user.json
@@ -178,11 +178,11 @@
 #
 #   - /usr/share/qemu/vhost-user/50-crosvm-gpu.json
 #
-# then the sysadmin can prevent the default QEMU being used at all with
+# then the sysadmin can prevent the default QEMU GPU being used at all with
 #
 #   $ touch /etc/qemu/vhost-user/50-qemu-gpu.json
 #
-# The sysadmin can replace/alter the distro default OVMF with
+# The sysadmin can replace/alter the distro default QEMU GPU with
 #
 #   $ vim /etc/qemu/vhost-user/50-qemu-gpu.json
 #
@@ -190,7 +190,7 @@
 #
 #   $ vim /etc/qemu/vhost-user/10-qemu-gpu.json
 #
-# or they can provide a parallel OVMF with lower priority
+# or they can provide a parallel QEMU GPU with lower priority
 #
 #   $ vim /etc/qemu/vhost-user/99-qemu-gpu.json
 #
-- 
2.22.0.rc2.384.g1a9a72ea1d



^ permalink raw reply related	[flat|nested] 35+ messages in thread
* [Qemu-devel] [PATCH] vhost: fix vhost_log size overflow during migration
@ 2019-06-16 21:36 ` Michael S. Tsirkin
  0 siblings, 0 replies; 35+ messages in thread
From: lihangjing @ 2019-06-03  6:15 UTC (permalink / raw)
  To: mst; +Cc: Li Hangjing, qemu-devel

From: Li Hangjing <lihangjing@baidu.com>

When a guest which doesn't support multiqueue is migrated with a multi queues
vhost-user-blk deivce, a crash will occur like:

0 qemu_memfd_alloc (name=<value optimized out>, size=562949953421312, seals=<value optimized out>, fd=0x7f87171fe8b4, errp=0x7f87171fe8a8) at util/memfd.c:153
1 0x00007f883559d7cf in vhost_log_alloc (size=70368744177664, share=true) at hw/virtio/vhost.c:186
2 0x00007f88355a0758 in vhost_log_get (listener=0x7f8838bd7940, enable=1) at qemu-2-12/hw/virtio/vhost.c:211
3 vhost_dev_log_resize (listener=0x7f8838bd7940, enable=1) at hw/virtio/vhost.c:263
4 vhost_migration_log (listener=0x7f8838bd7940, enable=1) at hw/virtio/vhost.c:787
5 0x00007f88355463d6 in memory_global_dirty_log_start () at memory.c:2503
6 0x00007f8835550577 in ram_init_bitmaps (f=0x7f88384ce600, opaque=0x7f8836024098) at migration/ram.c:2173
7 ram_init_all (f=0x7f88384ce600, opaque=0x7f8836024098) at migration/ram.c:2192
8 ram_save_setup (f=0x7f88384ce600, opaque=0x7f8836024098) at migration/ram.c:2219
9 0x00007f88357a419d in qemu_savevm_state_setup (f=0x7f88384ce600) at migration/savevm.c:1002
10 0x00007f883579fc3e in migration_thread (opaque=0x7f8837530400) at migration/migration.c:2382
11 0x00007f8832447893 in start_thread () from /lib64/libpthread.so.0
12 0x00007f8832178bfd in clone () from /lib64/libc.so.6

This is because vhost_get_log_size() returns a overflowed vhost-log size.
In this function, it uses the uninitialized variable vqs->used_phys and
vqs->used_size to get the vhost-log size.

Signed-off-by: Li Hangjing <lihangjing@baidu.com>
Reviewed-by: Xie Yongji <xieyongji@baidu.com>
Reviewed-by: Chai Wen <chaiwen@baidu.com>
---
 hw/virtio/vhost.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/hw/virtio/vhost.c b/hw/virtio/vhost.c
index 7f61018f2a..6d3a013f49 100644
--- a/hw/virtio/vhost.c
+++ b/hw/virtio/vhost.c
@@ -131,6 +131,11 @@ static int vhost_sync_dirty_bitmap(struct vhost_dev *dev,
     }
     for (i = 0; i < dev->nvqs; ++i) {
         struct vhost_virtqueue *vq = dev->vqs + i;
+
+        if (!vq->used_phys && !vq->used_size) {
+            continue;
+        }
+
         vhost_dev_sync_region(dev, section, start_addr, end_addr, vq->used_phys,
                               range_get_last(vq->used_phys, vq->used_size));
     }
@@ -168,6 +173,11 @@ static uint64_t vhost_get_log_size(struct vhost_dev *dev)
     }
     for (i = 0; i < dev->nvqs; ++i) {
         struct vhost_virtqueue *vq = dev->vqs + i;
+
+        if (!vq->used_phys && !vq->used_size) {
+            continue;
+        }
+
         uint64_t last = vq->used_phys + vq->used_size - 1;
         log_size = MAX(log_size, last / VHOST_LOG_CHUNK + 1);
     }
-- 
2.15.1.windows.2



^ permalink raw reply related	[flat|nested] 35+ messages in thread
end of thread, other threads:[~2019-06-26 19:39 UTC | newest]

Thread overview: 35+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-06-16 21:36 [Qemu-devel] [PULL 00/11] virtio, acpi: fixes, cleanups Michael S. Tsirkin
2019-06-16 21:36 ` [Qemu-devel] [PULL 10/11] q35: update DSDT Michael S. Tsirkin
2019-06-16 21:36 ` [Qemu-devel] [PULL 11/11] tests/rebuild-expected-aml.sh: blow out difflist Michael S. Tsirkin
2019-06-17 12:59 ` [Qemu-devel] [PULL 00/11] virtio, acpi: fixes, cleanups Peter Maydell
  -- strict thread matches above, loose matches on Subject: below --
2019-06-10  1:18 [Qemu-devel] [PATCH v7] hw/acpi: extract acpi_add_rom_blob() Wei Yang
2019-06-16 21:36 ` [Qemu-devel] [PULL 08/11] " Michael S. Tsirkin
2019-06-07  7:34 [Qemu-devel] [PATCH v2] q35: fix mmconfig and PCI0._CRS Gerd Hoffmann
2019-06-16 21:36 ` [Qemu-devel] [PULL 09/11] " Michael S. Tsirkin
2019-06-07  7:49 ` [Qemu-devel] [PATCH v2] " Laszlo Ersek
2019-06-11  8:15 ` Marcel Apfelbaum
2019-06-11 11:37 ` Paolo Bonzini
2019-06-11 12:06   ` Michael S. Tsirkin
2019-06-05 14:58 [Qemu-devel] [PATCH 0/5] Misc vhost-user fixes Marc-André Lureau
2019-06-05 14:58 ` [Qemu-devel] [PATCH 1/5] vhost-user-gpu: do not send scanout update if no GPU socket Marc-André Lureau
2019-06-16 21:36   ` [Qemu-devel] [PULL 01/11] " Michael S. Tsirkin
2019-06-05 14:58 ` [Qemu-devel] [PATCH 2/5] vhost-user: check unix_listen() return value Marc-André Lureau
2019-06-16 21:36   ` [Qemu-devel] [PULL 02/11] " Michael S. Tsirkin
2019-06-07  8:49   ` [Qemu-devel] [PATCH 2/5] " Peter Maydell
2019-06-26 17:55   ` [Qemu-devel] [PULL 02/11] " Eric Blake
2019-06-26 19:37     ` Marc-André Lureau
2019-06-05 14:58 ` [Qemu-devel] [PATCH 3/5] vhost-user: improve error report Marc-André Lureau
2019-06-16 21:36   ` [Qemu-devel] [PULL 03/11] " Michael S. Tsirkin
2019-06-05 14:58 ` [Qemu-devel] [PATCH 4/5] vhost-user-input: check ioctl(EVIOCGNAME) return value Marc-André Lureau
2019-06-16 21:36   ` [Qemu-devel] [PULL 04/11] " Michael S. Tsirkin
2019-06-07  8:50   ` [Qemu-devel] [PATCH 4/5] " Peter Maydell
2019-06-05 14:58 ` [Qemu-devel] [PATCH 5/5] vhost-user-gpu: initialize msghdr & iov at declaration Marc-André Lureau
2019-06-16 21:36   ` [Qemu-devel] [PULL 05/11] " Michael S. Tsirkin
2019-06-07  8:47   ` [Qemu-devel] [PATCH 5/5] " Peter Maydell
2019-06-05 13:12 [Qemu-devel] [PATCH] docs/vhost-user.json: some firmware.json copy leftovers Marc-André Lureau
2019-06-16 21:36 ` [Qemu-devel] [PULL 06/11] " Michael S. Tsirkin
2019-06-14  8:36 ` [Qemu-devel] [PATCH] " Stefan Hajnoczi
2019-06-26 16:24 ` [Qemu-devel] [Qemu-trivial] " Laurent Vivier
2019-06-26 16:28   ` Laurent Vivier
2019-06-03  6:15 [Qemu-devel] [PATCH] vhost: fix vhost_log size overflow during migration lihangjing
2019-06-16 21:36 ` [Qemu-devel] [PULL 07/11] " Michael S. Tsirkin

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.