summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* cputlb: Remove static tlb sizingRichard Henderson2019-01-2812-90/+0Star
| | | | | | | | Now that all tcg backends support TCG_TARGET_IMPLEMENTS_DYN_TLB, remove the define and the old code. Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
* tcg/tci: enable dynamic TLB sizingRichard Henderson2019-01-281-1/+1
| | | | | | This is automatic due to TCI using the other softtlb macros. Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
* tcg/mips: enable dynamic TLB sizingRichard Henderson2019-01-282-32/+64
| | | | Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
* tcg/mips: Fix tcg_out_qemu_ld_slow_pathRichard Henderson2019-01-281-1/+2
| | | | | | | Patch the branch after it has been emitted rather than before it exists. Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
* tcg/arm: enable dynamic TLB sizingRichard Henderson2019-01-282-71/+70Star
| | | | Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
* tcg/riscv: enable dynamic TLB sizingRichard Henderson2019-01-282-71/+55Star
| | | | | Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
* tcg/s390: enable dynamic TLB sizingRichard Henderson2019-01-282-27/+20Star
| | | | Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
* tcg/sparc: enable dynamic TLB sizingRichard Henderson2019-01-282-33/+51
| | | | Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
* tcg/ppc: enable dynamic TLB sizingRichard Henderson2019-01-282-44/+55
| | | | Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
* tcg/aarch64: enable dynamic TLB sizingRichard Henderson2019-01-282-42/+60
| | | | | | Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Tested-by: Alex Bennée <alex.bennee@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
* tcg/i386: enable dynamic TLB sizingEmilio G. Cota2019-01-282-15/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | As the following experiments show, this series is a net perf gain, particularly for memory-heavy workloads. Experiments are run on an Intel(R) Xeon(R) Gold 6142 CPU @ 2.60GHz. 1. System boot + shudown, debian aarch64: - Before (v3.1.0): Performance counter stats for './die.sh v3.1.0' (10 runs): 9019.797015 task-clock (msec) # 0.993 CPUs utilized ( +- 0.23% ) 29,910,312,379 cycles # 3.316 GHz ( +- 0.14% ) 54,699,252,014 instructions # 1.83 insn per cycle ( +- 0.08% ) 10,061,951,686 branches # 1115.541 M/sec ( +- 0.08% ) 172,966,530 branch-misses # 1.72% of all branches ( +- 0.07% ) 9.084039051 seconds time elapsed ( +- 0.23% ) - After: Performance counter stats for './die.sh tlb-dyn-v5' (10 runs): 8624.084842 task-clock (msec) # 0.993 CPUs utilized ( +- 0.23% ) 28,556,123,404 cycles # 3.311 GHz ( +- 0.13% ) 51,755,089,512 instructions # 1.81 insn per cycle ( +- 0.05% ) 9,526,513,946 branches # 1104.641 M/sec ( +- 0.05% ) 166,578,509 branch-misses # 1.75% of all branches ( +- 0.19% ) 8.680540350 seconds time elapsed ( +- 0.24% ) That is, a 4.4% perf increase. 2. System boot + shutdown, ubuntu 18.04 x86_64: - Before (v3.1.0): 56100.574751 task-clock (msec) # 1.016 CPUs utilized ( +- 4.81% ) 200,745,466,128 cycles # 3.578 GHz ( +- 5.24% ) 431,949,100,608 instructions # 2.15 insn per cycle ( +- 5.65% ) 77,502,383,330 branches # 1381.490 M/sec ( +- 6.18% ) 844,681,191 branch-misses # 1.09% of all branches ( +- 3.82% ) 55.221556378 seconds time elapsed ( +- 5.01% ) - After: 56603.419540 task-clock (msec) # 1.019 CPUs utilized ( +- 10.19% ) 202,217,930,479 cycles # 3.573 GHz ( +- 10.69% ) 439,336,291,626 instructions # 2.17 insn per cycle ( +- 14.14% ) 80,538,357,447 branches # 1422.853 M/sec ( +- 16.09% ) 776,321,622 branch-misses # 0.96% of all branches ( +- 3.77% ) 55.549661409 seconds time elapsed ( +- 10.44% ) No improvement (within noise range). Note that for this workload, increasing the time window too much can lead to perf degradation, since it flushes the TLB *very* frequently. 3. x86_64 SPEC06int: x86_64-softmmu speedup vs. v3.1.0 for SPEC06int (test set) Host: Intel(R) Xeon(R) Gold 6142 CPU @ 2.60GHz (Skylake) 5.5 +------------------------------------------------------------------------+ | +-+ | 5 |-+.................+-+...............................tlb-dyn-v5.......+-| | * * | 4.5 |-+.................*.*................................................+-| | * * | 4 |-+.................*.*................................................+-| | * * | 3.5 |-+.................*.*................................................+-| | * * | 3 |-+......+-+*.......*.*................................................+-| | * * * * | 2.5 |-+......*..*.......*.*.................................+-+*...........+-| | * * * * * * | 2 |-+......*..*.......*.*.................................*..*...........+-| | * * * * * * +-+ | 1.5 |-+......*..*.......*.*.................................*..*.*+-+.*+-+.+-| | * * *+-+ * * +-+ *+-+ +-+ +-+ * * * * * * | 1 |++++-+*+*++*+*++*++*+*++*+*+++-+*+*+-++*+-++++-++++-+++*++*+*++*+*++*+++| | * * * * * * * * * * * * * * * * * * * * * * * * * * | 0.5 +------------------------------------------------------------------------+ 400.perlb401.bzip403.g429445.g456.hm462.libq464.h471.omn47483.xalancbgeomean png: https://imgur.com/YRF90f7 That is, a 1.51x average speedup over the baseline, with a max speedup of 5.17x. Here's a different look at the SPEC06int results, using KVM as the baseline: x86_64-softmmu slowdown vs. KVM for SPEC06int (test set) Host: Intel(R) Xeon(R) Gold 6142 CPU @ 2.60GHz (Skylake) 25 +---------------------------------------------------------------------------+ | +-+ +-+ | | * * +-+ v3.1.0 | | * * +-+ tlb-dyn-v5 | | * * * * +-+ | 20 |-+.................*.*.............................*.+-+......*.*........+-| | * * * # # * * | | +-+ * * * # # * * | | * * * * * # # * * | 15 |-+......*.*........*.*.............................*.#.#......*.+-+......+-| | * * * * * # # * #|# | | * * * * +-+ * # # * +-+ | | * * +-+ * * ++-+ +-+ * # # * # # +-+ | | * * +-+ * * * ## *| +-+ * # # * # # +-+ | 10 |-+......*.*..*.+-+.*.*........*.##.......++-+.*.+-+*.#.#......*.#.#.*.*..+-| | * * * +-+ * * * ## +-+ *# # * # #* # # +-+ * # # * * | | * * * # # * * +-+ * ## * +-+ *# # * # #* # # * * * # # *+-+ | | * * * # # * * * +-+ * ## * # # *# # * # #* # # * * * # # * ## | 5 |-+......*.+-+*.#.#.*.*..*.#.#.*.##.*.#.#.*#.#.*.#.#*.#.#.*.*..*.#.#.*.##.+-| | * # #* # # * +-+* # # * ## * # # *# # * # #* # # * * * # # * ## | | * # #* # # * # #* # # * ## * # # *# # * # #* # # * +-+* # # * ## | | ++-+ * # #* # # * # #* # # * ## * # # *# # * # #* # # * # #* # # * ## | |+++*#+#+*+#+#*+#+#+*+#+#*+#+#+*+##+*+#+#+*#+#+*+#+#*+#+#+*+#+#*+#+#+*+##+++| 0 +---------------------------------------------------------------------------+ 400.perlbe401.bzi403.gc429445.go456.h462.libqu464.h471.omne4483.xalancbmgeomean png: https://imgur.com/YzAMNEV After this series, we bring down the average SPEC06int slowdown vs KVM from 11.47x to 7.58x. Tested-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Signed-off-by: Emilio G. Cota <cota@braap.org> Message-Id: <20190116170114.26802-4-cota@braap.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
* tcg: introduce dynamic TLB sizingEmilio G. Cota2019-01-2812-7/+282
| | | | | | | | | | Disabled in all TCG backends for now. Tested-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Signed-off-by: Emilio G. Cota <cota@braap.org> Message-Id: <20190116170114.26802-3-cota@braap.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
* cputlb: do not evict empty entries to the vtlbEmilio G. Cota2019-01-281-1/+10
| | | | | | | | | | | | | | | | | Currently we evict an entry to the victim TLB when it doesn't match the current address. But it could be that there's no match because the current entry is empty (i.e. all -1's, for instance via tlb_flush). Do not evict the entry to the vtlb in that case. This change will help us keep track of the TLB's use rate, which we'll use to implement a policy for dynamic TLB sizing. Tested-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Emilio G. Cota <cota@braap.org> Message-Id: <20190116170114.26802-2-cota@braap.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
* tcg/aarch64: Implement vector minmax arithmeticRichard Henderson2019-01-282-1/+25
| | | | Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
* tcg/aarch64: Implement vector saturating arithmeticRichard Henderson2019-01-282-1/+25
| | | | Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
* tcg/i386: Implement vector minmax arithmeticRichard Henderson2019-01-282-1/+82
| | | | | | | The avx instruction set does not directly provide MO_64. We can still implement 64-bit with comparison and vpblendvb. Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
* tcg/i386: Implement vector saturating arithmeticRichard Henderson2019-01-282-1/+43
| | | | | | | Only MO_8 and MO_16 are implemented, since that's all the instruction set provides. Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
* tcg/i386: Split subroutines out of tcg_expand_vec_opRichard Henderson2019-01-281-219/+224
| | | | | | This routine was becoming too large. Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
* tcg: Add opcodes for vector minmax arithmeticRichard Henderson2019-01-2812-0/+408
| | | | Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
* tcg: Add opcodes for vector saturated arithmeticRichard Henderson2019-01-289-24/+119
| | | | Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
* tcg: Add write_aofs to GVecGen4Richard Henderson2019-01-282-8/+21
| | | | | | This allows writing 2 output, 3 input operations. Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
* tcg: Add gvec expanders for nand, nor, eqvRichard Henderson2019-01-286-0/+117
| | | | | Reviewed-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
* tcg: Add logical simplifications during gvec expandRichard Henderson2019-01-281-5/+30
| | | | | | | | We handle many of these during integer expansion, and the rest of them during integer optimization. Reviewed-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
* Merge remote-tracking branch ↵Peter Maydell2019-01-252-2/+3
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 'remotes/ehabkost/tags/python-next-pull-request' into staging Python 3 compatibility fixes # gpg: Signature made Fri 25 Jan 2019 14:04:56 GMT # gpg: using RSA key 2807936F984DC5A6 # gpg: Good signature from "Eduardo Habkost <ehabkost@redhat.com>" [full] # Primary key fingerprint: 5A32 2FD5 ABC4 D3DB ACCF D1AA 2807 936F 984D C5A6 * remotes/ehabkost/tags/python-next-pull-request: decodetree: re.fullmatch was added in 3.4 device-crash-test: Python 3 compatibility fix Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * decodetree: re.fullmatch was added in 3.4Paolo Bonzini2019-01-251-1/+1
| | | | | | | | | | | | | | | | | | | | Python 3 versions earlier than 3.4 do not have it, use the same workaround that is in place for 3.0. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <1548410602-16008-1-git-send-email-pbonzini@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
| * device-crash-test: Python 3 compatibility fixNisarg Shah2019-01-251-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | Restrict whitelist entry stats in debug mode to be sorted only by "count", since Python 3 does not implicitly support comparing dictionaries. Signed-off-by: Nisarg Shah <nshah@disroot.org> Message-Id: <20190116183358.30287-1-nshah@disroot.org> [ehabkost: removed 2 unnecessary hunks from patch] [ehabkost: edited commit message] Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
* | Merge remote-tracking branch ↵Peter Maydell2019-01-25503-13770/+531Star
|\ \ | |/ |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 'remotes/amarkovic/tags/mips-queue-january-25-2019' into staging MIPS queue for January 25, 2019 # gpg: Signature made Fri 25 Jan 2019 13:25:57 GMT # gpg: using RSA key D4972A8967F75A65 # gpg: Good signature from "Aleksandar Markovic <amarkovic@wavecomp.com>" [unknown] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 8526 FBF1 5DA3 811F 4A01 DD75 D497 2A89 67F7 5A65 * remotes/amarkovic/tags/mips-queue-january-25-2019: docs/qemu-cpu-models: Add MIPS/nanoMIPS QEMU supported CPU models qemu-doc: Add nanoMIPS ISA information tests: tcg: mips: Remove old directories tests: tcg: mips: Add two new Makefiles tests: tcg: mips: Move source files to new locations MAINTAINERS: Update MIPS sections target/mips: Add I6500 core configuration target/mips: nanoMIPS: Fix branch handling disas: nanoMIPS: Amend DSP instructions related comments target/mips: Extend gen_scwp() functionality to support EVA target/mips: Correct the second argument type of cpu_supports_isa() target/mips: nanoMIPS: Rename macros for extracting 3-bit-coded GPR numbers target/mips: nanoMIPS: Remove an unused macro target/mips: nanoMIPS: Remove duplicate macro definitions Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * docs/qemu-cpu-models: Add MIPS/nanoMIPS QEMU supported CPU modelsStefan Markovic2019-01-241-2/+161
| | | | | | | | | | | | | | | | | | Add list of supported and preferred CPU models for MIPS32, MIPS64 and nanoMIPS hosts. Signed-off-by: Aleksandar Markovic <amarkovic@wavecomp.com> Signed-off-by: Stefan Markovic <smarkovic@wavecomp.com> Signed-off-by: Aleksandar Markovic <amarkovic@wavecomp.com>
| * qemu-doc: Add nanoMIPS ISA informationStefan Markovic2019-01-241-0/+29
| | | | | | | | | | | | | | | | | | Add nanoMIPS information in qemu-doc.texi. An example of usage is included. Reviewed-by: Aleksandar Markovic <amarkovic@wavecomp.com> Signed-off-by: Stefan Markovic <smarkovic@wavecomp.com> Signed-off-by: Aleksandar Markovic <amarkovic@wavecomp.com>
| * tests: tcg: mips: Remove old directoriesAleksandar Markovic2019-01-24327-13708/+0Star
| | | | | | | | | | | | | | Remove old test directories. Reviewed-by: Aleksandar Rikalo <arikalo@wavecomp.com> Signed-off-by: Aleksandar Markovic <amarkovic@wavecomp.com>
| * tests: tcg: mips: Add two new MakefilesAleksandar Markovic2019-01-242-0/+216
| | | | | | | | | | | | | | Add Makefiles for two new direcitories. Reviewed-by: Aleksandar Rikalo <arikalo@wavecomp.com> Signed-off-by: Aleksandar Markovic <amarkovic@wavecomp.com>
| * tests: tcg: mips: Move source files to new locationsAleksandar Markovic2019-01-24168-0/+0
| | | | | | | | | | | | | | MIPS TCG test will be organized by ISAs and ASEs in future. Reviewed-by: Aleksandar Rikalo <arikalo@wavecomp.com> Signed-off-by: Aleksandar Markovic <amarkovic@wavecomp.com>
| * MAINTAINERS: Update MIPS sectionsAleksandar Markovic2019-01-241-9/+0Star
| | | | | | | | | | | | | | | | | | Remove Stefan Markovic as a reviewer for MIPS directories and files, as he left Wave Computing. Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Aleksandar Markovic <amarkovic@wavecomp.com>
| * target/mips: Add I6500 core configurationYongbok Kim2019-01-241-0/+40
| | | | | | | | | | | | | | | | | | | | Add I6500 core configuration. Note that this configuration is supported only on best-effort basis due to the lack of certain features in QEMU. Reviewed-by: Aleksandar Rikalo <arikalo@wavecomp.com> Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com> Signed-off-by: Aleksandar Markovic <amarkovic@wavecomp.com>
| * target/mips: nanoMIPS: Fix branch handlingStefan Markovic2019-01-241-0/+12
| | | | | | | | | | | | | | | | Fix nanoMIPS branch handling. Reviewed-by: Aleksandar Rikalo <arikalo@wavecomp.com> Signed-off-by: Stefan Markovic <smarkovic@wavecomp.com> Signed-off-by: Aleksandar Markovic <amarkovic@wavecomp.com>
| * disas: nanoMIPS: Amend DSP instructions related commentsAleksandar Markovic2019-01-241-44/+75
| | | | | | | | | | | | | | Amend some DSP instructions related comments. Reviewed-by: Aleksandar Rikalo <arikalo@wavecomp.com> Signed-off-by: Aleksandar Markovic <amarkovic@wavecomp.com>
| * target/mips: Extend gen_scwp() functionality to support EVAAleksandar Markovic2019-01-241-4/+6
| | | | | | | | | | | | | | | | | | Extend gen_scwp() functionality to support EVA by adding an additional argument, modify internals of the function to handle new functionality, and accordingly change its invocations. Reviewed-by: Aleksandar Rikalo <arikalo@wavecomp.com> Signed-off-by: Aleksandar Markovic <amarkovic@wavecomp.com>
| * target/mips: Correct the second argument type of cpu_supports_isa()Aleksandar Markovic2019-01-242-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | "insn_flags" bitfield was expanded from 32-bit to 64-bit in commit f9c9cd63e3. However, this was not reflected on the second argument of the function cpu_supports_isa(). By chance, this did not create some wrong behavior, since the left-most halves of all instances of the second argument are currently all zeros. However, this is still a bug waiting to happen. Correct this by changing the type of the second argument to be always 64-bit. Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Aleksandar Markovic <amarkovic@wavecomp.com>
| * target/mips: nanoMIPS: Rename macros for extracting 3-bit-coded GPR numbersAleksandar Markovic2019-01-241-13/+13
| | | | | | | | | | | | | | | | Rename macros for extracting 3-bit-coded GPR numbers, to achieve better consistency with the nanoMIPS documentation. Reviewed-by: Aleksandar Rikalo <arikalo@wavecomp.com> Signed-off-by: Aleksandar Markovic <amarkovic@wavecomp.com>
| * target/mips: nanoMIPS: Remove an unused macroAleksandar Markovic2019-01-241-1/+0Star
| | | | | | | | | | | | | | Remove a macro that is never used. Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Aleksandar Markovic <amarkovic@wavecomp.com>
| * target/mips: nanoMIPS: Remove duplicate macro definitionsAleksandar Markovic2019-01-241-10/+0Star
| | | | | | | | | | | | | | | | | | | | | | | | Several macros were defined twice, with identical values, so remove duplicates. Previously added in 80845edf37b. This reverts commit 6bfa9f4c9cf24d6cfaaa227722e9cdcca1ad6fe9. Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Aleksandar Markovic <amarkovic@wavecomp.com>
* | Merge remote-tracking branch 'remotes/armbru/tags/pull-qapi-2019-01-24' into ↵Peter Maydell2019-01-2511-51/+73
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | staging QAPI patches for 2019-01-24 # gpg: Signature made Thu 24 Jan 2019 14:25:19 GMT # gpg: using RSA key 3870B400EB918653 # gpg: Good signature from "Markus Armbruster <armbru@redhat.com>" # gpg: aka "Markus Armbruster <armbru@pond.sub.org>" # Primary key fingerprint: 354B C8B3 D7EB 2A6B 6867 4E5F 3870 B400 EB91 8653 * remotes/armbru/tags/pull-qapi-2019-01-24: json: Fix % handling when not interpolating qmp: Add examples to qom list, get, and set commands qapi: Eliminate indirection through qmp_event_get_func_emit() qapi: Belatedly update docs for commit 9c2f56e9f9d Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | json: Fix % handling when not interpolatingChristophe Fergeau2019-01-242-4/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commit 8bca4613 added support for %% in json strings when interpolating, but in doing so broke handling of % when not interpolating. When parse_string() is fed a string token containing '%', it skips the '%' regardless of ctxt->ap, i.e. even it's not interpolating. If the '%' is the string's last character, it fails an assertion. Else, it "merely" swallows the '%'. Fix parse_string() to handle '%' specially only when interpolating. To gauge the bug's impact, let's review non-interpolating users of this parser, i.e. code passing NULL context to json_message_parser_init(): * tests/check-qjson.c, tests/test-qobject-input-visitor.c, tests/test-visitor-serialization.c Plenty of tests, but we still failed to cover the buggy case. * monitor.c: QMP input * qga/main.c: QGA input * qobject_from_json(): - qobject-input-visitor.c: JSON command line option arguments of -display and -blockdev Reproducer: -blockdev '{"%"}' - block.c: JSON pseudo-filenames starting with "json:" Reproducer: https://bugzilla.redhat.com/show_bug.cgi?id=1668244#c3 - block/rbd.c: JSON key pairs Pseudo-filenames starting with "rbd:". Command line, QMP and QGA input are trusted. Filenames are trusted when they come from command line, QMP or HMP. They are untrusted when they come from from image file headers. Example: QCOW2 backing file name. Note that this is *not* the security boundary between host and guest. It's the boundary between host and an image file from an untrusted source. Neither failing an assertion nor skipping a character in a filename of your choice looks exploitable. Note that we don't support compiling with NDEBUG. Fixes: 8bca4613e6cddd948895b8db3def05950463495b Cc: qemu-stable@nongnu.org Signed-off-by: Christophe Fergeau <cfergeau@redhat.com> Message-Id: <20190102140535.11512-1-cfergeau@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Tested-by: Richard W.M. Jones <rjones@redhat.com> [Commit message extended to discuss impact] Signed-off-by: Markus Armbruster <armbru@redhat.com>
| * | qmp: Add examples to qom list, get, and set commandsWainer dos Santos Moschetta2019-01-241-0/+36
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Added examples for the qom-list, qom-get, and qom-set commands in qapi misc JSON file. Signed-off-by: Wainer dos Santos Moschetta <wainersm@redhat.com> Message-Id: <20181228194442.3506-1-wainersm@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com>
| * | qapi: Eliminate indirection through qmp_event_get_func_emit()Markus Armbruster2019-01-248-45/+24Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The qapi_event_send_FOO() functions emit events like this: QMPEventFuncEmit emit; emit = qmp_event_get_func_emit(); if (!emit) { return; } qmp = qmp_event_build_dict("FOO"); [put event arguments into @qmp...] emit(QAPI_EVENT_FOO, qmp); The value of qmp_event_get_func_emit() depends only on the program: * In qemu-system-FOO, it's always monitor_qapi_event_queue. * In tests/test-qmp-event, it's always event_test_emit. * In all other programs, it's always null. This is exactly the kind of dependence the linker is supposed to resolve; we don't actually need an indirection. Note that things would fall apart if we linked more than one QAPI schema into a single program: each set of qapi_event_send_FOO() uses its own event enumeration, yet they share a single emit function. Which takes the event enumeration as an argument. Which one if there's more than one? More seriously: how does this work even now? qemu-system-FOO wants QAPIEvent, and passes a function taking that to qmp_event_set_func_emit(). test-qmp-event wants test_QAPIEvent, and passes a function taking that to qmp_event_set_func_emit(). It works by type trickery, of course: typedef void (*QMPEventFuncEmit)(unsigned event, QDict *dict); void qmp_event_set_func_emit(QMPEventFuncEmit emit); QMPEventFuncEmit qmp_event_get_func_emit(void); We use unsigned instead of the enumeration type. Relies on both enumerations boiling down to unsigned, which happens to be true for the compilers we use. Clean this up as follows: * Generate qapi_event_send_FOO() that call PREFIX_qapi_event_emit() instead of the value of qmp_event_set_func_emit(). * Generate a prototype for PREFIX_qapi_event_emit() into qapi-events.h. * PREFIX_ is empty for qapi/qapi-schema.json, and test_ for tests/qapi-schema/qapi-schema-test.json. It's qga_ for qga/qapi-schema.json, and doc-good- for tests/qapi-schema/doc-good.json, but those don't define any events. * Rename monitor_qapi_event_queue() to qapi_event_emit() instead of passing it to qmp_event_set_func_emit(). This takes care of qemu-system-FOO. * Rename event_test_emit() to test_qapi_event_emit() instead of passing it to qmp_event_set_func_emit(). This takes care of tests/test-qmp-event. * Add a qapi_event_emit() that does nothing to stubs/monitor.c. This takes care of all other programs that link code emitting QMP events. * Drop qmp_event_set_func_emit(), qmp_event_get_func_emit(). Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20181218182234.28876-3-armbru@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> [Commit message typos fixed]
| * | qapi: Belatedly update docs for commit 9c2f56e9f9dMarkus Armbruster2019-01-241-2/+2
| | | | | | | | | | | | | | | | | | Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20181218182234.28876-2-armbru@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
* | | Merge remote-tracking branch ↵Peter Maydell2019-01-254-61/+82
|\ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 'remotes/kraxel/tags/audio-20190124-pull-request' into staging audio: pc speaker init fix, rework driver probing # gpg: Signature made Thu 24 Jan 2019 13:19:52 GMT # gpg: using RSA key 4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * remotes/kraxel/tags/audio-20190124-pull-request: audio: probe audio drivers by default audio: error message tweak audio: check for pulseaudio daemon pidfile audio: use try-sdl for openbsd audio: allow optional audio drivers. audio: use pkg-config audio: fix pc speaker init Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | | audio: probe audio drivers by defaultGerd Hoffmann2019-01-241-7/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add the drivers listed in audio_possible_drivers to audio_drv_list, using the try-* variants. That way the probable drivers are compiled by default if possible. Additioal tweaks: linux: reorder to: pa alsa sdl oss. *bsd: drop pa. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 20190124112055.547-7-kraxel@redhat.com
| * | | audio: error message tweakGerd Hoffmann2019-01-241-5/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Only print a message about the failed driver initialization in case it was the driver explicitly requested by the user via QEMU_AUDIO_DRV=$drv. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20190124112055.547-6-kraxel@redhat.com
| * | | audio: check for pulseaudio daemon pidfileGerd Hoffmann2019-01-241-0/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Check whenever the pulseaudio daemon pidfile is present before trying to initialize the pulseaudio backend. Just return NULL if that is not the case, so qemu will check the next backend in line. In case the user explicitly configured a non-default pulseaudio server skip the check. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 20190124112055.547-5-kraxel@redhat.com
generated by cgit v1.2.3-55-g7522 (git 2.39.0) at 2025-04-28 20:47:28 +0200