[Qemu-devel] [PULL 00/46] First batch of misc patches for QEMU 2.12

Paolo Bonzini posted 46 patches 6 years, 4 months ago
Patches applied successfully (tree, apply log)
git fetch https://github.com/patchew-project/qemu tags/patchew/1513790098-9815-1-git-send-email-pbonzini@redhat.com
Test checkpatch failed
Test docker failed
Test ppc passed
Test s390x passed
There is a newer version of this series
MAINTAINERS                              |   2 +
accel/tcg/cpu-exec.c                     |  12 +--
block/iscsi.c                            |  51 +++++++---
blockdev-nbd.c                           |  50 +++-------
chardev/baum.c                           |   8 +-
chardev/char-mux.c                       |   8 ++
chardev/char-socket.c                    |  72 ++++++--------
chardev/char.c                           |  18 ++--
configure                                |  37 ++++++-
contrib/systemd/qemu-guest-agent.service |  11 +++
contrib/systemd/qemu-pr-helper.service   |  15 +++
contrib/systemd/qemu-pr-helper.socket    |   9 ++
cpus.c                                   |  37 +++----
exec.c                                   |  44 ++++++++-
hw/i386/kvm/i8259.c                      |   1 +
hw/i386/trace-events                     |   4 +
hw/i386/vmport.c                         |  14 +--
hw/intc/i8259.c                          |  86 +++-------------
hw/intc/i8259_common.c                   |  49 ++++++++++
hw/intc/trace-events                     |   7 ++
hw/mips/boston.c                         |  14 +--
hw/moxie/moxiesim.c                      |  12 ++-
hw/scsi/scsi-bus.c                       |  16 +--
hw/scsi/scsi-disk.c                      |   1 +
include/chardev/char.h                   |   1 +
include/exec/exec-all.h                  |   6 +-
include/hw/isa/i8259_internal.h          |   7 +-
include/qemu/sockets.h                   |   2 +-
include/scsi/utils.h                     |   9 +-
qemu-doc.texi                            |   5 -
qemu-nbd.c                               |  61 +++++-------
qemu-options.hx                          |   3 -
qga/channel-posix.c                      |   2 +-
scripts/checkpatch.pl                    |   7 +-
scsi/qemu-pr-helper.c                    |  30 +++++-
scsi/utils.c                             | 163 ++++++++++++++++---------------
target/arm/cpu.c                         |  13 +--
target/i386/cpu.c                        |  16 +--
target/i386/cpu.h                        |  12 ++-
target/i386/kvm.c                        |  44 +++++----
target/i386/translate.c                  |   9 +-
tests/Makefile.include                   |   7 ++
tests/boot-serial-test.c                 | 106 +++++++++++++++++---
tests/docker/test-full                   |  79 +--------------
tests/test-char.c                        |  17 ++++
util/memfd.c                             |   4 +-
util/qemu-sockets.c                      |  31 +-----
util/qemu-thread-posix.c                 |  59 +++++++----
util/rcu.c                               |   6 ++
vl.c                                     |   4 -
50 files changed, 719 insertions(+), 562 deletions(-)
create mode 100644 contrib/systemd/qemu-guest-agent.service
create mode 100644 contrib/systemd/qemu-pr-helper.service
create mode 100644 contrib/systemd/qemu-pr-helper.socket
[Qemu-devel] [PULL 00/46] First batch of misc patches for QEMU 2.12
Posted by Paolo Bonzini 6 years, 4 months ago
The following changes since commit 200780a3a3ed067dfb2e0d2210b0ed09e748ba26:

  Merge remote-tracking branch 'remotes/armbru/tags/pull-cmdline-2017-12-18-v2' into staging (2017-12-20 13:20:48 +0000)

are available in the git repository at:


  git://github.com/bonzini/qemu.git tags/for-upstream

for you to fetch changes up to d01ce16cd827831145cf6a5b4a81ce3a47b537cd:

  chardev: convert the socket server to QIONetListener (2017-12-20 17:18:19 +0100)

----------------------------------------------------------------
* NBD and chardev conversion to QIONetListener (Daniel)
* MTTCG fixes (David)
* Hyper-V fixes (Roman, Evgeny)
* share-rw option (Fam)
* Mux chardev event bugfix (Marc-André)
* Add systemd unit files in contrib/ (me)
* SCSI and block/iscsi.c bugfixes (me, Peter L.)
* unassigned_mem_ops fixes (Peter M.)
* VEX decoding fix (Peter M.)
* "info pic" and "info irq" improvements (Peter Xu)
* vmport trace events (Philippe)
* Braille chardev bugfix (Samuel)
* Compiler warnings fix (Stefan)
* boot-serial-test aka TCG smoke test (Thomas)
* New CPU features (Yang)
* Reduce startup memory usage (Yang)
* QemuThread race fix (linhecheng)

----------------------------------------------------------------
Daniel P. Berrange (4):
      sockets: remove obsolete code that updated listen address
      blockdev: convert internal NBD server to QIONetListener
      blockdev: convert qemu-nbd server to QIONetListener
      chardev: convert the socket server to QIONetListener

David Hildenbrand (2):
      cpus: make pause_all_cpus() play with SMP on single threaded TCG
      cpu-exec: fix missed CPU kick during interrupt injection

Evgeny Yakovlev (1):
      hyperv: set partition-wide MSRs only on first vcpu

Fam Zheng (3):
      Revert "docker: Enable features explicitly in test-full"
      scsi-block: Add share-rw option
      MAITAINERS: List Fam Zheng as reviewer for SCSI patches

Marc-André Lureau (3):
      checkpatch: volatile with a comment or sig_atomic_t is okay
      chardev: fix backend events regression with mux chardev
      test: add some chardev mux event tests

Paolo Bonzini (5):
      memfd: fix configure test
      qemu-pr-helper: miscellaneous fixes
      contrib: add systemd unit files
      scsi: provide general-purpose functions to manage sense data
      scsi: replace hex constants with #defines

Peter Lieven (2):
      block/iscsi: dont leave allocmap in an invalid state on UNMAP failure
      block/iscsi: only report an iSCSI Failure if we don't handle it gracefully

Peter Maydell (3):
      target/i386: Fix handling of VEX prefixes
      exec: Don't reuse unassigned_mem_ops for io_mem_rom
      hw/mips/boston: Remove workaround for writes to ROM aborting

Peter Xu (7):
      cpu: refactor cpu_address_space_init()
      cpu: suffix cpu address spaces with cpu index
      i8259: convert DPRINTFs into trace
      i8259: use DEBUG_IRQ_COUNT always
      i8259: generalize statistics into common code
      kvm-i8259: support "info pic" and "info irq"
      i8259: move TYPE_INTERRUPT_STATS_PROVIDER upper

Philippe Mathieu-Daudé (1):
      hw/i386/vmport: replace fprintf() by trace events or LOG_UNIMP

Roman Kagan (2):
      hyperv: ensure SINTx msrs are reset properly
      hyperv: make SynIC version msr constant

Samuel Thibault (1):
      baum: Truncate braille device size to 84x1

Stefan Weil (1):
      target/i386: Fix compiler warnings

Thomas Huth (8):
      tests/boot-serial-test: Make sure that we check the timeout regularly
      tests/boot-serial-test: Add code to allow to specify our own kernel or bios
      tests/boot-serial-test: Add support for the mcf5208evb board
      tests/boot-serial-test: Add tests for microblaze boards
      hw/moxie/moxiesim: Add support for loading a BIOS on moxiesim
      tests/boot-serial-test: Add a test for the moxiesim machine
      tests/boot-serial-test: Add support for the raspi2 machine
      Remove legacy -no-kvm-pit option

Yang Zhong (2):
      x86/cpu: Enable new SSE/AVX/AVX512 cpu features
      rcu: reduce more than 7MB heap memory by malloc_trim()

linzhecheng (1):
      qemu-thread: fix races on threads that exit very quickly

 MAINTAINERS                              |   2 +
 accel/tcg/cpu-exec.c                     |  12 +--
 block/iscsi.c                            |  51 +++++++---
 blockdev-nbd.c                           |  50 +++-------
 chardev/baum.c                           |   8 +-
 chardev/char-mux.c                       |   8 ++
 chardev/char-socket.c                    |  72 ++++++--------
 chardev/char.c                           |  18 ++--
 configure                                |  37 ++++++-
 contrib/systemd/qemu-guest-agent.service |  11 +++
 contrib/systemd/qemu-pr-helper.service   |  15 +++
 contrib/systemd/qemu-pr-helper.socket    |   9 ++
 cpus.c                                   |  37 +++----
 exec.c                                   |  44 ++++++++-
 hw/i386/kvm/i8259.c                      |   1 +
 hw/i386/trace-events                     |   4 +
 hw/i386/vmport.c                         |  14 +--
 hw/intc/i8259.c                          |  86 +++-------------
 hw/intc/i8259_common.c                   |  49 ++++++++++
 hw/intc/trace-events                     |   7 ++
 hw/mips/boston.c                         |  14 +--
 hw/moxie/moxiesim.c                      |  12 ++-
 hw/scsi/scsi-bus.c                       |  16 +--
 hw/scsi/scsi-disk.c                      |   1 +
 include/chardev/char.h                   |   1 +
 include/exec/exec-all.h                  |   6 +-
 include/hw/isa/i8259_internal.h          |   7 +-
 include/qemu/sockets.h                   |   2 +-
 include/scsi/utils.h                     |   9 +-
 qemu-doc.texi                            |   5 -
 qemu-nbd.c                               |  61 +++++-------
 qemu-options.hx                          |   3 -
 qga/channel-posix.c                      |   2 +-
 scripts/checkpatch.pl                    |   7 +-
 scsi/qemu-pr-helper.c                    |  30 +++++-
 scsi/utils.c                             | 163 ++++++++++++++++---------------
 target/arm/cpu.c                         |  13 +--
 target/i386/cpu.c                        |  16 +--
 target/i386/cpu.h                        |  12 ++-
 target/i386/kvm.c                        |  44 +++++----
 target/i386/translate.c                  |   9 +-
 tests/Makefile.include                   |   7 ++
 tests/boot-serial-test.c                 | 106 +++++++++++++++++---
 tests/docker/test-full                   |  79 +--------------
 tests/test-char.c                        |  17 ++++
 util/memfd.c                             |   4 +-
 util/qemu-sockets.c                      |  31 +-----
 util/qemu-thread-posix.c                 |  59 +++++++----
 util/rcu.c                               |   6 ++
 vl.c                                     |   4 -
 50 files changed, 719 insertions(+), 562 deletions(-)
 create mode 100644 contrib/systemd/qemu-guest-agent.service
 create mode 100644 contrib/systemd/qemu-pr-helper.service
 create mode 100644 contrib/systemd/qemu-pr-helper.socket
-- 
1.8.3.1


Re: [Qemu-devel] [PULL 00/46] First batch of misc patches for QEMU 2.12
Posted by Peter Maydell 6 years, 4 months ago
On 20 December 2017 at 17:14, Paolo Bonzini <pbonzini@redhat.com> wrote:
> The following changes since commit 200780a3a3ed067dfb2e0d2210b0ed09e748ba26:
>
>   Merge remote-tracking branch 'remotes/armbru/tags/pull-cmdline-2017-12-18-v2' into staging (2017-12-20 13:20:48 +0000)
>
> are available in the git repository at:
>
>
>   git://github.com/bonzini/qemu.git tags/for-upstream
>
> for you to fetch changes up to d01ce16cd827831145cf6a5b4a81ce3a47b537cd:
>
>   chardev: convert the socket server to QIONetListener (2017-12-20 17:18:19 +0100)
>
> ----------------------------------------------------------------
> * NBD and chardev conversion to QIONetListener (Daniel)
> * MTTCG fixes (David)
> * Hyper-V fixes (Roman, Evgeny)
> * share-rw option (Fam)
> * Mux chardev event bugfix (Marc-André)
> * Add systemd unit files in contrib/ (me)
> * SCSI and block/iscsi.c bugfixes (me, Peter L.)
> * unassigned_mem_ops fixes (Peter M.)
> * VEX decoding fix (Peter M.)
> * "info pic" and "info irq" improvements (Peter Xu)
> * vmport trace events (Philippe)
> * Braille chardev bugfix (Samuel)
> * Compiler warnings fix (Stefan)
> * boot-serial-test aka TCG smoke test (Thomas)
> * New CPU features (Yang)
> * Reduce startup memory usage (Yang)
> * QemuThread race fix (linhecheng)

Build failures, I'm afraid:

NetBSD, FreeBSD, OpenBSD, OSX:

  CC      util/qemu-thread-posix.o
/root/qemu/util/qemu-thread-posix.c: In function 'qemu_thread_create':
/root/qemu/util/qemu-thread-posix.c:513:5: error: unknown type name
'QemuThreadArgs'
     QemuThreadArgs *qemu_thread_args;
     ^
/root/qemu/util/qemu-thread-posix.c:513:21: warning: unused variable
'qemu_thread_args' [-Wunused-variable]
     QemuThreadArgs *qemu_thread_args;
                     ^

On the x86/sanitizer build, new runtime errors:
  GTESTER tests/test-char
/home/petmay01/linaro/qemu-for-merges/chardev/char-mux.c:119:23:
runtime error: index -1 out of bounds for type 'CharBackend *[4]'

  GTESTER check-qtest-m68k
/home/petmay01/linaro/qemu-for-merges/target/m68k/translate.c:230:12:
runtime error: index -1 out of bounds for type 'const uint8_t [11]'

and a bunch of test-hmp failures on SPARC host:

TEST: tests/test-hmp... (pid=112458)
  /or1k/hmp/none:                                                      OK
  /or1k/hmp/or1k-sim:
Broken pipe
FAIL
GTester: last random seed: R02S910131160952686f50f8817feb7ffa43
(pid=112640)
  /or1k/hmp/none+2MB:                                                  OK
FAIL: tests/test-hmp


TEST: tests/test-hmp... (pid=112535)
  /lm32/hmp/lm32-evr:                                                  OK
  /lm32/hmp/none:                                                      OK
  /lm32/hmp/milkymist:                                                 OK
  /lm32/hmp/lm32-uclinux:
Broken pipe
FAIL
GTester: last random seed: R02S8117b2f6f2c32eedeb45726a96bd3248
(pid=112826)
  /lm32/hmp/none+2MB:                                                  OK
FAIL: tests/test-hmp

...and similar fails on one or two boards on most of the other
guest architectures.

I think sparc is the only test box I run 'make check' with -j32,
so that might be the cause there. Running the test case by
hand passes, but -j32 reliably fails.

thanks
-- PMM

Re: [Qemu-devel] [PULL 00/46] First batch of misc patches for QEMU 2.12
Posted by Paolo Bonzini 6 years, 4 months ago
On 20/12/2017 20:20, Peter Maydell wrote:
> On the x86/sanitizer build, new runtime errors:
>   GTESTER check-qtest-m68k
> /home/petmay01/linaro/qemu-for-merges/target/m68k/translate.c:230:12:
> runtime error: index -1 out of bounds for type 'const uint8_t [11]'
>
> ...and similar fails on one or two boards on most of the other
> guest architectures.

These are preexisting bugs, now exposed by the boot-serial-test.
Thomas, can you identify the architectures that have a problem and
notify the maintainers?  In the meanwhile I'll keep the boot-serial-test
enhancements queued locally, and remove them from the pull request.

Paolo

Re: [Qemu-devel] out of bounds in set_cc_op() (was: [PULL 00/46] First batch of misc patches for QEMU 2.12)
Posted by Thomas Huth 6 years, 4 months ago
On 20.12.2017 22:56, Paolo Bonzini wrote:
> On 20/12/2017 20:20, Peter Maydell wrote:
>> On the x86/sanitizer build, new runtime errors:
>>   GTESTER check-qtest-m68k
>> /home/petmay01/linaro/qemu-for-merges/target/m68k/translate.c:230:12:
>> runtime error: index -1 out of bounds for type 'const uint8_t [11]'
>>
>> ...and similar fails on one or two boards on most of the other
>> guest architectures.
> 
> These are preexisting bugs, now exposed by the boot-serial-test.
> Thomas, can you identify the architectures that have a problem and
> notify the maintainers?  In the meanwhile I'll keep the boot-serial-test
> enhancements queued locally, and remove them from the pull request.

 Laurent, Richard,

looks like old_op is -1 when set_cc_op() is called here for the first
time. The problem can be reproduced by running the mini-kernel directly.
Just get http://people.redhat.com/~thuth/m68k-uart.bin and run QEMU like
this:

 qemu-system-m68k -nographic -kernel  ~/tmp/m68k-uart.bin -serial none

That kernel only contains these few instructions:

  0x41, 0xf9, 0xfc, 0x06, 0x00, 0x00,     /* lea 0xfc060000,%a0 */
  0x10, 0x3c, 0x00, 0x54,                 /* move.b #'T',%d0 */
  0x11, 0x7c, 0x00, 0x04, 0x00, 0x08,     /* move.b #4,8(%a0) */
  0x11, 0x40, 0x00, 0x0c,                 /* move.b %d0,12(%a0) */
  0x60, 0xfa                              /* bra.s  loop */

The problem occurs during the second instruction (i.e. the first move.b).

Do you have any ideas where this -1 in s->cc_op could come from?

 Thomas

Re: [Qemu-devel] out of bounds in set_cc_op()
Posted by Laurent Vivier 6 years, 4 months ago
Le 21/12/2017 à 13:49, Thomas Huth a écrit :
> On 20.12.2017 22:56, Paolo Bonzini wrote:
>> On 20/12/2017 20:20, Peter Maydell wrote:
>>> On the x86/sanitizer build, new runtime errors:
>>>   GTESTER check-qtest-m68k
>>> /home/petmay01/linaro/qemu-for-merges/target/m68k/translate.c:230:12:
>>> runtime error: index -1 out of bounds for type 'const uint8_t [11]'
>>>
>>> ...and similar fails on one or two boards on most of the other
>>> guest architectures.
>>
>> These are preexisting bugs, now exposed by the boot-serial-test.
>> Thomas, can you identify the architectures that have a problem and
>> notify the maintainers?  In the meanwhile I'll keep the boot-serial-test
>> enhancements queued locally, and remove them from the pull request.
> 
>  Laurent, Richard,
> 
> looks like old_op is -1 when set_cc_op() is called here for the first
> time. The problem can be reproduced by running the mini-kernel directly.
> Just get http://people.redhat.com/~thuth/m68k-uart.bin and run QEMU like
> this:
> 
>  qemu-system-m68k -nographic -kernel  ~/tmp/m68k-uart.bin -serial none
> 
> That kernel only contains these few instructions:
> 
>   0x41, 0xf9, 0xfc, 0x06, 0x00, 0x00,     /* lea 0xfc060000,%a0 */
>   0x10, 0x3c, 0x00, 0x54,                 /* move.b #'T',%d0 */
>   0x11, 0x7c, 0x00, 0x04, 0x00, 0x08,     /* move.b #4,8(%a0) */
>   0x11, 0x40, 0x00, 0x0c,                 /* move.b %d0,12(%a0) */
>   0x60, 0xfa                              /* bra.s  loop */
> 
> The problem occurs during the second instruction (i.e. the first move.b).
> 
> Do you have any ideas where this -1 in s->cc_op could come from?

I think it comes from CCOp: it's the value of CC_OP_DYNAMIC.

We should not use it to access cc_op_live[].

I try to find a fix, but I think Richard knows this better than me.

Thanks,
Laurent


Re: [Qemu-devel] out of bounds in set_cc_op()
Posted by Laurent Vivier 6 years, 4 months ago
Le 21/12/2017 à 14:07, Laurent Vivier a écrit :
> Le 21/12/2017 à 13:49, Thomas Huth a écrit :
>> On 20.12.2017 22:56, Paolo Bonzini wrote:
>>> On 20/12/2017 20:20, Peter Maydell wrote:
>>>> On the x86/sanitizer build, new runtime errors:
>>>>   GTESTER check-qtest-m68k
>>>> /home/petmay01/linaro/qemu-for-merges/target/m68k/translate.c:230:12:
>>>> runtime error: index -1 out of bounds for type 'const uint8_t [11]'
>>>>
>>>> ...and similar fails on one or two boards on most of the other
>>>> guest architectures.
>>>
>>> These are preexisting bugs, now exposed by the boot-serial-test.
>>> Thomas, can you identify the architectures that have a problem and
>>> notify the maintainers?  In the meanwhile I'll keep the boot-serial-test
>>> enhancements queued locally, and remove them from the pull request.
>>
>>  Laurent, Richard,
>>
>> looks like old_op is -1 when set_cc_op() is called here for the first
>> time. The problem can be reproduced by running the mini-kernel directly.
>> Just get http://people.redhat.com/~thuth/m68k-uart.bin and run QEMU like
>> this:
>>
>>  qemu-system-m68k -nographic -kernel  ~/tmp/m68k-uart.bin -serial none
>>
>> That kernel only contains these few instructions:
>>
>>   0x41, 0xf9, 0xfc, 0x06, 0x00, 0x00,     /* lea 0xfc060000,%a0 */
>>   0x10, 0x3c, 0x00, 0x54,                 /* move.b #'T',%d0 */
>>   0x11, 0x7c, 0x00, 0x04, 0x00, 0x08,     /* move.b #4,8(%a0) */
>>   0x11, 0x40, 0x00, 0x0c,                 /* move.b %d0,12(%a0) */
>>   0x60, 0xfa                              /* bra.s  loop */
>>
>> The problem occurs during the second instruction (i.e. the first move.b).
>>
>> Do you have any ideas where this -1 in s->cc_op could come from?
> 
> I think it comes from CCOp: it's the value of CC_OP_DYNAMIC.
> 
> We should not use it to access cc_op_live[].
> 
> I try to find a fix, but I think Richard knows this better than me.

This should fix the problem, but I'd like Richard checks it...

diff --git a/target/m68k/translate.c b/target/m68k/translate.c
index b60909222c..721b5801da 100644
--- a/target/m68k/translate.c
+++ b/target/m68k/translate.c
@@ -225,6 +225,11 @@ static void set_cc_op(DisasContext *s, CCOp op)
     s->cc_op = op;
     s->cc_op_synced = 0;

+    if (old_op == CC_OP_DYNAMIC) {
+        tcg_gen_discard_i32(QREG_CC_OP);
+        return;
+    }
+
     /* Discard CC computation that will no longer be used.
        Note that X and N are never dead.  */
     dead = cc_op_live[old_op] & ~cc_op_live[op];


Thanks,
Laurent

Re: [Qemu-devel] out of bounds in set_cc_op()
Posted by Paolo Bonzini 6 years, 4 months ago
On 21/12/2017 14:32, Laurent Vivier wrote:
> Le 21/12/2017 à 14:07, Laurent Vivier a écrit :
>> Le 21/12/2017 à 13:49, Thomas Huth a écrit :
>>> On 20.12.2017 22:56, Paolo Bonzini wrote:
>>>> On 20/12/2017 20:20, Peter Maydell wrote:
>>>>> On the x86/sanitizer build, new runtime errors:
>>>>>   GTESTER check-qtest-m68k
>>>>> /home/petmay01/linaro/qemu-for-merges/target/m68k/translate.c:230:12:
>>>>> runtime error: index -1 out of bounds for type 'const uint8_t [11]'
>>>>>
>>>>> ...and similar fails on one or two boards on most of the other
>>>>> guest architectures.
>>>>
>>>> These are preexisting bugs, now exposed by the boot-serial-test.
>>>> Thomas, can you identify the architectures that have a problem and
>>>> notify the maintainers?  In the meanwhile I'll keep the boot-serial-test
>>>> enhancements queued locally, and remove them from the pull request.
>>>
>>>  Laurent, Richard,
>>>
>>> looks like old_op is -1 when set_cc_op() is called here for the first
>>> time. The problem can be reproduced by running the mini-kernel directly.
>>> Just get http://people.redhat.com/~thuth/m68k-uart.bin and run QEMU like
>>> this:
>>>
>>>  qemu-system-m68k -nographic -kernel  ~/tmp/m68k-uart.bin -serial none
>>>
>>> That kernel only contains these few instructions:
>>>
>>>   0x41, 0xf9, 0xfc, 0x06, 0x00, 0x00,     /* lea 0xfc060000,%a0 */
>>>   0x10, 0x3c, 0x00, 0x54,                 /* move.b #'T',%d0 */
>>>   0x11, 0x7c, 0x00, 0x04, 0x00, 0x08,     /* move.b #4,8(%a0) */
>>>   0x11, 0x40, 0x00, 0x0c,                 /* move.b %d0,12(%a0) */
>>>   0x60, 0xfa                              /* bra.s  loop */
>>>
>>> The problem occurs during the second instruction (i.e. the first move.b).
>>>
>>> Do you have any ideas where this -1 in s->cc_op could come from?
>>
>> I think it comes from CCOp: it's the value of CC_OP_DYNAMIC.
>>
>> We should not use it to access cc_op_live[].
>>
>> I try to find a fix, but I think Richard knows this better than me.
> 
> This should fix the problem, but I'd like Richard checks it...
> 
> diff --git a/target/m68k/translate.c b/target/m68k/translate.c
> index b60909222c..721b5801da 100644
> --- a/target/m68k/translate.c
> +++ b/target/m68k/translate.c
> @@ -225,6 +225,11 @@ static void set_cc_op(DisasContext *s, CCOp op)
>      s->cc_op = op;
>      s->cc_op_synced = 0;
> 
> +    if (old_op == CC_OP_DYNAMIC) {
> +        tcg_gen_discard_i32(QREG_CC_OP);
> +        return;
> +    }

This tcg_gen_discard_i32 is correct, but all flags were potentially live
and can be discarded if the new op uses it(*).  So I'd replace "return"
with "old_op = CC_OP_FLAGS".

Paolo

	(*) in fact it's always true that all flags can be discarded.
	    Only discarding some is an optimization to limit the number
	    of generated ops.

>      /* Discard CC computation that will no longer be used.
>         Note that X and N are never dead.  */
>      dead = cc_op_live[old_op] & ~cc_op_live[op];
> 
> 
> Thanks,
> Laurent
> 


Re: [Qemu-devel] out of bounds in set_cc_op()
Posted by Laurent Vivier 6 years, 4 months ago
Le 21/12/2017 à 15:10, Paolo Bonzini a écrit :
> On 21/12/2017 14:32, Laurent Vivier wrote:
>> Le 21/12/2017 à 14:07, Laurent Vivier a écrit :
>>> Le 21/12/2017 à 13:49, Thomas Huth a écrit :
>>>> On 20.12.2017 22:56, Paolo Bonzini wrote:
>>>>> On 20/12/2017 20:20, Peter Maydell wrote:
>>>>>> On the x86/sanitizer build, new runtime errors:
>>>>>>   GTESTER check-qtest-m68k
>>>>>> /home/petmay01/linaro/qemu-for-merges/target/m68k/translate.c:230:12:
>>>>>> runtime error: index -1 out of bounds for type 'const uint8_t [11]'
>>>>>>
>>>>>> ...and similar fails on one or two boards on most of the other
>>>>>> guest architectures.
>>>>>
>>>>> These are preexisting bugs, now exposed by the boot-serial-test.
>>>>> Thomas, can you identify the architectures that have a problem and
>>>>> notify the maintainers?  In the meanwhile I'll keep the boot-serial-test
>>>>> enhancements queued locally, and remove them from the pull request.
>>>>
>>>>  Laurent, Richard,
>>>>
>>>> looks like old_op is -1 when set_cc_op() is called here for the first
>>>> time. The problem can be reproduced by running the mini-kernel directly.
>>>> Just get http://people.redhat.com/~thuth/m68k-uart.bin and run QEMU like
>>>> this:
>>>>
>>>>  qemu-system-m68k -nographic -kernel  ~/tmp/m68k-uart.bin -serial none
>>>>
>>>> That kernel only contains these few instructions:
>>>>
>>>>   0x41, 0xf9, 0xfc, 0x06, 0x00, 0x00,     /* lea 0xfc060000,%a0 */
>>>>   0x10, 0x3c, 0x00, 0x54,                 /* move.b #'T',%d0 */
>>>>   0x11, 0x7c, 0x00, 0x04, 0x00, 0x08,     /* move.b #4,8(%a0) */
>>>>   0x11, 0x40, 0x00, 0x0c,                 /* move.b %d0,12(%a0) */
>>>>   0x60, 0xfa                              /* bra.s  loop */
>>>>
>>>> The problem occurs during the second instruction (i.e. the first move.b).
>>>>
>>>> Do you have any ideas where this -1 in s->cc_op could come from?
>>>
>>> I think it comes from CCOp: it's the value of CC_OP_DYNAMIC.
>>>
>>> We should not use it to access cc_op_live[].
>>>
>>> I try to find a fix, but I think Richard knows this better than me.
>>
>> This should fix the problem, but I'd like Richard checks it...
>>
>> diff --git a/target/m68k/translate.c b/target/m68k/translate.c
>> index b60909222c..721b5801da 100644
>> --- a/target/m68k/translate.c
>> +++ b/target/m68k/translate.c
>> @@ -225,6 +225,11 @@ static void set_cc_op(DisasContext *s, CCOp op)
>>      s->cc_op = op;
>>      s->cc_op_synced = 0;
>>
>> +    if (old_op == CC_OP_DYNAMIC) {
>> +        tcg_gen_discard_i32(QREG_CC_OP);
>> +        return;
>> +    }
> 
> This tcg_gen_discard_i32 is correct, but all flags were potentially live
> and can be discarded if the new op uses it(*).  So I'd replace "return"
> with "old_op = CC_OP_FLAGS".

Yes, I agree, we can also have:

iff --git a/target/m68k/cpu.h b/target/m68k/cpu.h
index afae5f68ac..5d03764eab 100644
--- a/target/m68k/cpu.h
+++ b/target/m68k/cpu.h
@@ -182,7 +182,7 @@ void cpu_m68k_set_fpcr(CPUM68KState *env, uint32_t val);
  */
 typedef enum {
     /* Translator only -- use env->cc_op.  */
-    CC_OP_DYNAMIC = -1,
+    CC_OP_DYNAMIC,

     /* Each flag bit computed into cc_[xcnvz].  */
     CC_OP_FLAGS,
diff --git a/target/m68k/translate.c b/target/m68k/translate.c
index b60909222c..61ac1a8e83 100644
--- a/target/m68k/translate.c
+++ b/target/m68k/translate.c
@@ -207,6 +207,7 @@ typedef void (*disas_proc)(CPUM68KState *env,
DisasContext *s, uint16_t insn);
 #endif

 static const uint8_t cc_op_live[CC_OP_NB] = {
+    [CC_OP_DYNAMIC] = CCF_C | CCF_V | CCF_Z | CCF_N | CCF_X,
     [CC_OP_FLAGS] = CCF_C | CCF_V | CCF_Z | CCF_N | CCF_X,
     [CC_OP_ADDB ... CC_OP_ADDL] = CCF_X | CCF_N | CCF_V,
     [CC_OP_SUBB ... CC_OP_SUBL] = CCF_X | CCF_N | CCF_V,
@@ -237,6 +238,11 @@ static void set_cc_op(DisasContext *s, CCOp op)
     if (dead & CCF_V) {
         tcg_gen_discard_i32(QREG_CC_V);
     }
+
+    /* Discard any computed CC_OP value */
+    if (old_op == CC_OP_DYNAMIC) {
+        tcg_gen_discard_i32(QREG_CC_OP);
+    }
 }

 /* Update the CPU env CC_OP state.  */



Re: [Qemu-devel] out of bounds in set_cc_op()
Posted by Paolo Bonzini 6 years, 4 months ago
On 21/12/2017 15:13, Laurent Vivier wrote:
> Le 21/12/2017 à 15:10, Paolo Bonzini a écrit :
>> On 21/12/2017 14:32, Laurent Vivier wrote:
>>> Le 21/12/2017 à 14:07, Laurent Vivier a écrit :
>>>> Le 21/12/2017 à 13:49, Thomas Huth a écrit :
>>>>> On 20.12.2017 22:56, Paolo Bonzini wrote:
>>>>>> On 20/12/2017 20:20, Peter Maydell wrote:
>>>>>>> On the x86/sanitizer build, new runtime errors:
>>>>>>>   GTESTER check-qtest-m68k
>>>>>>> /home/petmay01/linaro/qemu-for-merges/target/m68k/translate.c:230:12:
>>>>>>> runtime error: index -1 out of bounds for type 'const uint8_t [11]'
>>>>>>>
>>>>>>> ...and similar fails on one or two boards on most of the other
>>>>>>> guest architectures.
>>>>>>
>>>>>> These are preexisting bugs, now exposed by the boot-serial-test.
>>>>>> Thomas, can you identify the architectures that have a problem and
>>>>>> notify the maintainers?  In the meanwhile I'll keep the boot-serial-test
>>>>>> enhancements queued locally, and remove them from the pull request.
>>>>>
>>>>>  Laurent, Richard,
>>>>>
>>>>> looks like old_op is -1 when set_cc_op() is called here for the first
>>>>> time. The problem can be reproduced by running the mini-kernel directly.
>>>>> Just get http://people.redhat.com/~thuth/m68k-uart.bin and run QEMU like
>>>>> this:
>>>>>
>>>>>  qemu-system-m68k -nographic -kernel  ~/tmp/m68k-uart.bin -serial none
>>>>>
>>>>> That kernel only contains these few instructions:
>>>>>
>>>>>   0x41, 0xf9, 0xfc, 0x06, 0x00, 0x00,     /* lea 0xfc060000,%a0 */
>>>>>   0x10, 0x3c, 0x00, 0x54,                 /* move.b #'T',%d0 */
>>>>>   0x11, 0x7c, 0x00, 0x04, 0x00, 0x08,     /* move.b #4,8(%a0) */
>>>>>   0x11, 0x40, 0x00, 0x0c,                 /* move.b %d0,12(%a0) */
>>>>>   0x60, 0xfa                              /* bra.s  loop */
>>>>>
>>>>> The problem occurs during the second instruction (i.e. the first move.b).
>>>>>
>>>>> Do you have any ideas where this -1 in s->cc_op could come from?
>>>>
>>>> I think it comes from CCOp: it's the value of CC_OP_DYNAMIC.
>>>>
>>>> We should not use it to access cc_op_live[].
>>>>
>>>> I try to find a fix, but I think Richard knows this better than me.
>>>
>>> This should fix the problem, but I'd like Richard checks it...
>>>
>>> diff --git a/target/m68k/translate.c b/target/m68k/translate.c
>>> index b60909222c..721b5801da 100644
>>> --- a/target/m68k/translate.c
>>> +++ b/target/m68k/translate.c
>>> @@ -225,6 +225,11 @@ static void set_cc_op(DisasContext *s, CCOp op)
>>>      s->cc_op = op;
>>>      s->cc_op_synced = 0;
>>>
>>> +    if (old_op == CC_OP_DYNAMIC) {
>>> +        tcg_gen_discard_i32(QREG_CC_OP);
>>> +        return;
>>> +    }
>>
>> This tcg_gen_discard_i32 is correct, but all flags were potentially live
>> and can be discarded if the new op uses it(*).  So I'd replace "return"
>> with "old_op = CC_OP_FLAGS".
> 
> Yes, I agree, we can also have:
> 
> iff --git a/target/m68k/cpu.h b/target/m68k/cpu.h
> index afae5f68ac..5d03764eab 100644
> --- a/target/m68k/cpu.h
> +++ b/target/m68k/cpu.h
> @@ -182,7 +182,7 @@ void cpu_m68k_set_fpcr(CPUM68KState *env, uint32_t val);
>   */
>  typedef enum {
>      /* Translator only -- use env->cc_op.  */
> -    CC_OP_DYNAMIC = -1,
> +    CC_OP_DYNAMIC,
> 
>      /* Each flag bit computed into cc_[xcnvz].  */
>      CC_OP_FLAGS,
> diff --git a/target/m68k/translate.c b/target/m68k/translate.c
> index b60909222c..61ac1a8e83 100644
> --- a/target/m68k/translate.c
> +++ b/target/m68k/translate.c
> @@ -207,6 +207,7 @@ typedef void (*disas_proc)(CPUM68KState *env,
> DisasContext *s, uint16_t insn);
>  #endif
> 
>  static const uint8_t cc_op_live[CC_OP_NB] = {
> +    [CC_OP_DYNAMIC] = CCF_C | CCF_V | CCF_Z | CCF_N | CCF_X,
>      [CC_OP_FLAGS] = CCF_C | CCF_V | CCF_Z | CCF_N | CCF_X,
>      [CC_OP_ADDB ... CC_OP_ADDL] = CCF_X | CCF_N | CCF_V,
>      [CC_OP_SUBB ... CC_OP_SUBL] = CCF_X | CCF_N | CCF_V,
> @@ -237,6 +238,11 @@ static void set_cc_op(DisasContext *s, CCOp op)
>      if (dead & CCF_V) {
>          tcg_gen_discard_i32(QREG_CC_V);
>      }
> +
> +    /* Discard any computed CC_OP value */
> +    if (old_op == CC_OP_DYNAMIC) {
> +        tcg_gen_discard_i32(QREG_CC_OP);
> +    }
>  }
> 
>  /* Update the CPU env CC_OP state.  */
> 
> 

Yes, this is good too.  After my pull request is in, feel free to take
Thomas's m68k boot-serial-test patch in your tree.

Paolo

Re: [Qemu-devel] out of bounds in set_cc_op()
Posted by Laurent Vivier 6 years, 4 months ago
Le 21/12/2017 à 15:14, Paolo Bonzini a écrit :
> On 21/12/2017 15:13, Laurent Vivier wrote:
>> Le 21/12/2017 à 15:10, Paolo Bonzini a écrit :
>>> On 21/12/2017 14:32, Laurent Vivier wrote:
>>>> Le 21/12/2017 à 14:07, Laurent Vivier a écrit :
>>>>> Le 21/12/2017 à 13:49, Thomas Huth a écrit :
>>>>>> On 20.12.2017 22:56, Paolo Bonzini wrote:
>>>>>>> On 20/12/2017 20:20, Peter Maydell wrote:
>>>>>>>> On the x86/sanitizer build, new runtime errors:
>>>>>>>>   GTESTER check-qtest-m68k
>>>>>>>> /home/petmay01/linaro/qemu-for-merges/target/m68k/translate.c:230:12:
>>>>>>>> runtime error: index -1 out of bounds for type 'const uint8_t [11]'
>>>>>>>>
>>>>>>>> ...and similar fails on one or two boards on most of the other
>>>>>>>> guest architectures.
>>>>>>>
>>>>>>> These are preexisting bugs, now exposed by the boot-serial-test.
>>>>>>> Thomas, can you identify the architectures that have a problem and
>>>>>>> notify the maintainers?  In the meanwhile I'll keep the boot-serial-test
>>>>>>> enhancements queued locally, and remove them from the pull request.
>>>>>>
>>>>>>  Laurent, Richard,
>>>>>>
>>>>>> looks like old_op is -1 when set_cc_op() is called here for the first
>>>>>> time. The problem can be reproduced by running the mini-kernel directly.
>>>>>> Just get http://people.redhat.com/~thuth/m68k-uart.bin and run QEMU like
>>>>>> this:
>>>>>>
>>>>>>  qemu-system-m68k -nographic -kernel  ~/tmp/m68k-uart.bin -serial none
>>>>>>
>>>>>> That kernel only contains these few instructions:
>>>>>>
>>>>>>   0x41, 0xf9, 0xfc, 0x06, 0x00, 0x00,     /* lea 0xfc060000,%a0 */
>>>>>>   0x10, 0x3c, 0x00, 0x54,                 /* move.b #'T',%d0 */
>>>>>>   0x11, 0x7c, 0x00, 0x04, 0x00, 0x08,     /* move.b #4,8(%a0) */
>>>>>>   0x11, 0x40, 0x00, 0x0c,                 /* move.b %d0,12(%a0) */
>>>>>>   0x60, 0xfa                              /* bra.s  loop */
>>>>>>
>>>>>> The problem occurs during the second instruction (i.e. the first move.b).
>>>>>>
>>>>>> Do you have any ideas where this -1 in s->cc_op could come from?
>>>>>
>>>>> I think it comes from CCOp: it's the value of CC_OP_DYNAMIC.
>>>>>
>>>>> We should not use it to access cc_op_live[].
>>>>>
>>>>> I try to find a fix, but I think Richard knows this better than me.
>>>>
>>>> This should fix the problem, but I'd like Richard checks it...
>>>>
>>>> diff --git a/target/m68k/translate.c b/target/m68k/translate.c
>>>> index b60909222c..721b5801da 100644
>>>> --- a/target/m68k/translate.c
>>>> +++ b/target/m68k/translate.c
>>>> @@ -225,6 +225,11 @@ static void set_cc_op(DisasContext *s, CCOp op)
>>>>      s->cc_op = op;
>>>>      s->cc_op_synced = 0;
>>>>
>>>> +    if (old_op == CC_OP_DYNAMIC) {
>>>> +        tcg_gen_discard_i32(QREG_CC_OP);
>>>> +        return;
>>>> +    }
>>>
>>> This tcg_gen_discard_i32 is correct, but all flags were potentially live
>>> and can be discarded if the new op uses it(*).  So I'd replace "return"
>>> with "old_op = CC_OP_FLAGS".
>>
>> Yes, I agree, we can also have:
>>
>> iff --git a/target/m68k/cpu.h b/target/m68k/cpu.h
>> index afae5f68ac..5d03764eab 100644
>> --- a/target/m68k/cpu.h
>> +++ b/target/m68k/cpu.h
>> @@ -182,7 +182,7 @@ void cpu_m68k_set_fpcr(CPUM68KState *env, uint32_t val);
>>   */
>>  typedef enum {
>>      /* Translator only -- use env->cc_op.  */
>> -    CC_OP_DYNAMIC = -1,
>> +    CC_OP_DYNAMIC,
>>
>>      /* Each flag bit computed into cc_[xcnvz].  */
>>      CC_OP_FLAGS,
>> diff --git a/target/m68k/translate.c b/target/m68k/translate.c
>> index b60909222c..61ac1a8e83 100644
>> --- a/target/m68k/translate.c
>> +++ b/target/m68k/translate.c
>> @@ -207,6 +207,7 @@ typedef void (*disas_proc)(CPUM68KState *env,
>> DisasContext *s, uint16_t insn);
>>  #endif
>>
>>  static const uint8_t cc_op_live[CC_OP_NB] = {
>> +    [CC_OP_DYNAMIC] = CCF_C | CCF_V | CCF_Z | CCF_N | CCF_X,
>>      [CC_OP_FLAGS] = CCF_C | CCF_V | CCF_Z | CCF_N | CCF_X,
>>      [CC_OP_ADDB ... CC_OP_ADDL] = CCF_X | CCF_N | CCF_V,
>>      [CC_OP_SUBB ... CC_OP_SUBL] = CCF_X | CCF_N | CCF_V,
>> @@ -237,6 +238,11 @@ static void set_cc_op(DisasContext *s, CCOp op)
>>      if (dead & CCF_V) {
>>          tcg_gen_discard_i32(QREG_CC_V);
>>      }
>> +
>> +    /* Discard any computed CC_OP value */
>> +    if (old_op == CC_OP_DYNAMIC) {
>> +        tcg_gen_discard_i32(QREG_CC_OP);
>> +    }
>>  }
>>
>>  /* Update the CPU env CC_OP state.  */
>>
>>
> 
> Yes, this is good too.  After my pull request is in, feel free to take
> Thomas's m68k boot-serial-test patch in your tree.

I will. I plan a PULL request before the end of the week.

Thanks,
Laurent


Re: [Qemu-devel] out of bounds in set_cc_op()
Posted by Laurent Vivier 6 years, 4 months ago
Le 21/12/2017 à 15:36, Laurent Vivier a écrit :
> Le 21/12/2017 à 15:14, Paolo Bonzini a écrit :
>> On 21/12/2017 15:13, Laurent Vivier wrote:
>>> Le 21/12/2017 à 15:10, Paolo Bonzini a écrit :
>>>> On 21/12/2017 14:32, Laurent Vivier wrote:
>>>>> Le 21/12/2017 à 14:07, Laurent Vivier a écrit :
>>>>>> Le 21/12/2017 à 13:49, Thomas Huth a écrit :
>>>>>>> On 20.12.2017 22:56, Paolo Bonzini wrote:
>>>>>>>> On 20/12/2017 20:20, Peter Maydell wrote:
>>>>>>>>> On the x86/sanitizer build, new runtime errors:
>>>>>>>>>   GTESTER check-qtest-m68k
>>>>>>>>> /home/petmay01/linaro/qemu-for-merges/target/m68k/translate.c:230:12:
>>>>>>>>> runtime error: index -1 out of bounds for type 'const uint8_t [11]'
>>>>>>>>>
>>>>>>>>> ...and similar fails on one or two boards on most of the other
>>>>>>>>> guest architectures.
>>>>>>>>
>>>>>>>> These are preexisting bugs, now exposed by the boot-serial-test.
>>>>>>>> Thomas, can you identify the architectures that have a problem and
>>>>>>>> notify the maintainers?  In the meanwhile I'll keep the boot-serial-test
>>>>>>>> enhancements queued locally, and remove them from the pull request.
>>>>>>>
>>>>>>>  Laurent, Richard,
>>>>>>>
>>>>>>> looks like old_op is -1 when set_cc_op() is called here for the first
>>>>>>> time. The problem can be reproduced by running the mini-kernel directly.
>>>>>>> Just get http://people.redhat.com/~thuth/m68k-uart.bin and run QEMU like
>>>>>>> this:
>>>>>>>
>>>>>>>  qemu-system-m68k -nographic -kernel  ~/tmp/m68k-uart.bin -serial none
>>>>>>>
>>>>>>> That kernel only contains these few instructions:
>>>>>>>
>>>>>>>   0x41, 0xf9, 0xfc, 0x06, 0x00, 0x00,     /* lea 0xfc060000,%a0 */
>>>>>>>   0x10, 0x3c, 0x00, 0x54,                 /* move.b #'T',%d0 */
>>>>>>>   0x11, 0x7c, 0x00, 0x04, 0x00, 0x08,     /* move.b #4,8(%a0) */
>>>>>>>   0x11, 0x40, 0x00, 0x0c,                 /* move.b %d0,12(%a0) */
>>>>>>>   0x60, 0xfa                              /* bra.s  loop */
>>>>>>>
>>>>>>> The problem occurs during the second instruction (i.e. the first move.b).
>>>>>>>
>>>>>>> Do you have any ideas where this -1 in s->cc_op could come from?
>>>>>>
>>>>>> I think it comes from CCOp: it's the value of CC_OP_DYNAMIC.
>>>>>>
>>>>>> We should not use it to access cc_op_live[].
>>>>>>
>>>>>> I try to find a fix, but I think Richard knows this better than me.
>>>>>
>>>>> This should fix the problem, but I'd like Richard checks it...
>>>>>
>>>>> diff --git a/target/m68k/translate.c b/target/m68k/translate.c
>>>>> index b60909222c..721b5801da 100644
>>>>> --- a/target/m68k/translate.c
>>>>> +++ b/target/m68k/translate.c
>>>>> @@ -225,6 +225,11 @@ static void set_cc_op(DisasContext *s, CCOp op)
>>>>>      s->cc_op = op;
>>>>>      s->cc_op_synced = 0;
>>>>>
>>>>> +    if (old_op == CC_OP_DYNAMIC) {
>>>>> +        tcg_gen_discard_i32(QREG_CC_OP);
>>>>> +        return;
>>>>> +    }
>>>>
>>>> This tcg_gen_discard_i32 is correct, but all flags were potentially live
>>>> and can be discarded if the new op uses it(*).  So I'd replace "return"
>>>> with "old_op = CC_OP_FLAGS".
>>>
>>> Yes, I agree, we can also have:
>>>
>>> iff --git a/target/m68k/cpu.h b/target/m68k/cpu.h
>>> index afae5f68ac..5d03764eab 100644
>>> --- a/target/m68k/cpu.h
>>> +++ b/target/m68k/cpu.h
>>> @@ -182,7 +182,7 @@ void cpu_m68k_set_fpcr(CPUM68KState *env, uint32_t val);
>>>   */
>>>  typedef enum {
>>>      /* Translator only -- use env->cc_op.  */
>>> -    CC_OP_DYNAMIC = -1,
>>> +    CC_OP_DYNAMIC,
>>>
>>>      /* Each flag bit computed into cc_[xcnvz].  */
>>>      CC_OP_FLAGS,
>>> diff --git a/target/m68k/translate.c b/target/m68k/translate.c
>>> index b60909222c..61ac1a8e83 100644
>>> --- a/target/m68k/translate.c
>>> +++ b/target/m68k/translate.c
>>> @@ -207,6 +207,7 @@ typedef void (*disas_proc)(CPUM68KState *env,
>>> DisasContext *s, uint16_t insn);
>>>  #endif
>>>
>>>  static const uint8_t cc_op_live[CC_OP_NB] = {
>>> +    [CC_OP_DYNAMIC] = CCF_C | CCF_V | CCF_Z | CCF_N | CCF_X,
>>>      [CC_OP_FLAGS] = CCF_C | CCF_V | CCF_Z | CCF_N | CCF_X,
>>>      [CC_OP_ADDB ... CC_OP_ADDL] = CCF_X | CCF_N | CCF_V,
>>>      [CC_OP_SUBB ... CC_OP_SUBL] = CCF_X | CCF_N | CCF_V,
>>> @@ -237,6 +238,11 @@ static void set_cc_op(DisasContext *s, CCOp op)
>>>      if (dead & CCF_V) {
>>>          tcg_gen_discard_i32(QREG_CC_V);
>>>      }
>>> +
>>> +    /* Discard any computed CC_OP value */
>>> +    if (old_op == CC_OP_DYNAMIC) {
>>> +        tcg_gen_discard_i32(QREG_CC_OP);
>>> +    }
>>>  }
>>>
>>>  /* Update the CPU env CC_OP state.  */
>>>
>>>
>>
>> Yes, this is good too.  After my pull request is in, feel free to take
>> Thomas's m68k boot-serial-test patch in your tree.

And what about:

      tests/boot-serial-test: Add tests for microblaze boards
      tests/boot-serial-test: Add a test for the moxiesim machine
      tests/boot-serial-test: Add support for the raspi2 machine

?

Thanks,
Laurent


Re: [Qemu-devel] out of bounds in set_cc_op()
Posted by Paolo Bonzini 6 years, 4 months ago
On 21/12/2017 20:20, Laurent Vivier wrote:
>>> Yes, this is good too.  After my pull request is in, feel free to take
>>> Thomas's m68k boot-serial-test patch in your tree.
> And what about:
> 
>       tests/boot-serial-test: Add tests for microblaze boards
>       tests/boot-serial-test: Add a test for the moxiesim machine
>       tests/boot-serial-test: Add support for the raspi2 machine

I didn't want to hold the whole pull request close to the Christmas
holidays; once either Thomas or I will test them with the sanitizers,
they will go in.

Paolo

Re: [Qemu-devel] out of bounds in set_cc_op()
Posted by Thomas Huth 6 years, 3 months ago
On 21.12.2017 20:30, Paolo Bonzini wrote:
> On 21/12/2017 20:20, Laurent Vivier wrote:
>>>> Yes, this is good too.  After my pull request is in, feel free to take
>>>> Thomas's m68k boot-serial-test patch in your tree.
>> And what about:
>>
>>       tests/boot-serial-test: Add tests for microblaze boards
>>       tests/boot-serial-test: Add a test for the moxiesim machine
>>       tests/boot-serial-test: Add support for the raspi2 machine
> 
> I didn't want to hold the whole pull request close to the Christmas
> holidays; once either Thomas or I will test them with the sanitizers,
> they will go in.

I've now checked them with '-fsanitize=undefined -fno-sanitize=shift'
(using clang) and I do not get any further errors with the three
remaining patches, so I think they should be fine for the next PULL request.

 Thomas

Re: [Qemu-devel] [PULL 00/46] First batch of misc patches for QEMU 2.12
Posted by no-reply@patchew.org 6 years, 4 months ago
Hi,

This series seems to have some coding style problems. See output below for
more information:

Type: series
Message-id: 1513790098-9815-1-git-send-email-pbonzini@redhat.com
Subject: [Qemu-devel] [PULL 00/46] First batch of misc patches for QEMU 2.12

=== TEST SCRIPT BEGIN ===
#!/bin/bash

BASE=base
n=1
total=$(git log --oneline $BASE.. | wc -l)
failed=0

git config --local diff.renamelimit 0
git config --local diff.renames True

commits="$(git log --format=%H --reverse $BASE..)"
for c in $commits; do
    echo "Checking PATCH $n/$total: $(git log -n 1 --format=%s $c)..."
    if ! git show $c --format=email | ./scripts/checkpatch.pl --mailback -; then
        failed=1
        echo
    fi
    n=$((n+1))
done

exit $failed
=== TEST SCRIPT END ===

Updating 3c8cf5a9c21ff8782164d1def7f44bd888713384
Switched to a new branch 'test'
784f1d412c chardev: convert the socket server to QIONetListener
913bc4b43c blockdev: convert qemu-nbd server to QIONetListener
c5312f02ce blockdev: convert internal NBD server to QIONetListener
8ea4a652ea test: add some chardev mux event tests
d08cc74e88 chardev: fix backend events regression with mux chardev
d2b264495b rcu: reduce more than 7MB heap memory by malloc_trim()
fcef1c98fa checkpatch: volatile with a comment or sig_atomic_t is okay
1db2303fc0 i8259: move TYPE_INTERRUPT_STATS_PROVIDER upper
30e06e33bf kvm-i8259: support "info pic" and "info irq"
57a7117c3a i8259: generalize statistics into common code
22e865ea7e i8259: use DEBUG_IRQ_COUNT always
cb30f9bb23 i8259: convert DPRINTFs into trace
de0e3bc778 Remove legacy -no-kvm-pit option
c88841bd2d scsi: replace hex constants with #defines
1e1c54f23f scsi: provide general-purpose functions to manage sense data
3c107012a2 hw/i386/vmport: replace fprintf() by trace events or LOG_UNIMP
24c0e08084 hw/mips/boston: Remove workaround for writes to ROM aborting
5209850f2c exec: Don't reuse unassigned_mem_ops for io_mem_rom
1deadef1c3 block/iscsi: only report an iSCSI Failure if we don't handle it gracefully
400e06269d block/iscsi: dont leave allocmap in an invalid state on UNMAP failure
a1303221a4 cpu: suffix cpu address spaces with cpu index
0628ef1b41 cpu: refactor cpu_address_space_init()
d1c1216812 tests/boot-serial-test: Add support for the raspi2 machine
cf3a5ef594 tests/boot-serial-test: Add a test for the moxiesim machine
5d14a211cb hw/moxie/moxiesim: Add support for loading a BIOS on moxiesim
731d666321 tests/boot-serial-test: Add tests for microblaze boards
6877647e58 tests/boot-serial-test: Add support for the mcf5208evb board
78e93db470 tests/boot-serial-test: Add code to allow to specify our own kernel or bios
d07f10209a tests/boot-serial-test: Make sure that we check the timeout regularly
fbbc2322b9 target/i386: Fix handling of VEX prefixes
2885eac109 sockets: remove obsolete code that updated listen address
6549fd19a9 baum: Truncate braille device size to 84x1
9a9c369e13 target/i386: Fix compiler warnings
c8783cefce cpu-exec: fix missed CPU kick during interrupt injection
9d3f7299bc cpus: make pause_all_cpus() play with SMP on single threaded TCG
2e77bcf01f hyperv: make SynIC version msr constant
1ffad6d1f7 hyperv: ensure SINTx msrs are reset properly
930f81a089 hyperv: set partition-wide MSRs only on first vcpu
c948257a80 x86/cpu: Enable new SSE/AVX/AVX512 cpu features
6b2ad070e1 MAITAINERS: List Fam Zheng as reviewer for SCSI patches
96948f407b scsi-block: Add share-rw option
ea0dc097e6 Revert "docker: Enable features explicitly in test-full"
d3dbc385ac contrib: add systemd unit files
fa1ad0e290 qemu-pr-helper: miscellaneous fixes
0d358f6451 qemu-thread: fix races on threads that exit very quickly
d7c8a0c55d memfd: fix configure test

=== OUTPUT BEGIN ===
Checking PATCH 1/46: memfd: fix configure test...
Checking PATCH 2/46: qemu-thread: fix races on threads that exit very quickly...
ERROR: braces {} are necessary for all arms of this statement
#131: FILE: util/qemu-thread-posix.c:544:
+    if (err)
[...]

total: 1 errors, 0 warnings, 86 lines checked

Your patch has style problems, please review.  If any of these errors
are false positives report them to the maintainer, see
CHECKPATCH in MAINTAINERS.

Checking PATCH 3/46: qemu-pr-helper: miscellaneous fixes...
Checking PATCH 4/46: contrib: add systemd unit files...
Checking PATCH 5/46: Revert "docker: Enable features explicitly in test-full"...
Checking PATCH 6/46: scsi-block: Add share-rw option...
Checking PATCH 7/46: MAITAINERS: List Fam Zheng as reviewer for SCSI patches...
Checking PATCH 8/46: x86/cpu: Enable new SSE/AVX/AVX512 cpu features...
Checking PATCH 9/46: hyperv: set partition-wide MSRs only on first vcpu...
Checking PATCH 10/46: hyperv: ensure SINTx msrs are reset properly...
Checking PATCH 11/46: hyperv: make SynIC version msr constant...
Checking PATCH 12/46: cpus: make pause_all_cpus() play with SMP on single threaded TCG...
Checking PATCH 13/46: cpu-exec: fix missed CPU kick during interrupt injection...
Checking PATCH 14/46: target/i386: Fix compiler warnings...
Checking PATCH 15/46: baum: Truncate braille device size to 84x1...
Checking PATCH 16/46: sockets: remove obsolete code that updated listen address...
Checking PATCH 17/46: target/i386: Fix handling of VEX prefixes...
Checking PATCH 18/46: tests/boot-serial-test: Make sure that we check the timeout regularly...
Checking PATCH 19/46: tests/boot-serial-test: Add code to allow to specify our own kernel or bios...
Checking PATCH 20/46: tests/boot-serial-test: Add support for the mcf5208evb board...
Checking PATCH 21/46: tests/boot-serial-test: Add tests for microblaze boards...
Checking PATCH 22/46: hw/moxie/moxiesim: Add support for loading a BIOS on moxiesim...
Checking PATCH 23/46: tests/boot-serial-test: Add a test for the moxiesim machine...
Checking PATCH 24/46: tests/boot-serial-test: Add support for the raspi2 machine...
Checking PATCH 25/46: cpu: refactor cpu_address_space_init()...
Checking PATCH 26/46: cpu: suffix cpu address spaces with cpu index...
Checking PATCH 27/46: block/iscsi: dont leave allocmap in an invalid state on UNMAP failure...
Checking PATCH 28/46: block/iscsi: only report an iSCSI Failure if we don't handle it gracefully...
Checking PATCH 29/46: exec: Don't reuse unassigned_mem_ops for io_mem_rom...
Checking PATCH 30/46: hw/mips/boston: Remove workaround for writes to ROM aborting...
Checking PATCH 31/46: hw/i386/vmport: replace fprintf() by trace events or LOG_UNIMP...
Checking PATCH 32/46: scsi: provide general-purpose functions to manage sense data...
Checking PATCH 33/46: scsi: replace hex constants with #defines...
Checking PATCH 34/46: Remove legacy -no-kvm-pit option...
Checking PATCH 35/46: i8259: convert DPRINTFs into trace...
Checking PATCH 36/46: i8259: use DEBUG_IRQ_COUNT always...
Checking PATCH 37/46: i8259: generalize statistics into common code...
Checking PATCH 38/46: kvm-i8259: support "info pic" and "info irq"...
Checking PATCH 39/46: i8259: move TYPE_INTERRUPT_STATS_PROVIDER upper...
Checking PATCH 40/46: checkpatch: volatile with a comment or sig_atomic_t is okay...
ERROR: line over 90 characters
#35: FILE: scripts/checkpatch.pl:2481:
+			my $msg = "Use of volatile is usually wrong, please add a comment\n" . $herecurr;

total: 1 errors, 0 warnings, 13 lines checked

Your patch has style problems, please review.  If any of these errors
are false positives report them to the maintainer, see
CHECKPATCH in MAINTAINERS.

Checking PATCH 41/46: rcu: reduce more than 7MB heap memory by malloc_trim()...
Checking PATCH 42/46: chardev: fix backend events regression with mux chardev...
Checking PATCH 43/46: test: add some chardev mux event tests...
Checking PATCH 44/46: blockdev: convert internal NBD server to QIONetListener...
Checking PATCH 45/46: blockdev: convert qemu-nbd server to QIONetListener...
Checking PATCH 46/46: chardev: convert the socket server to QIONetListener...
=== OUTPUT END ===

Test command exited with code: 1


---
Email generated automatically by Patchew [http://patchew.org/].
Please send your feedback to patchew-devel@freelists.org