[Qemu-commits] [qemu/qemu] 73b498: userfaultfd: use 1ULL to build ioctl masks

[Peter Maydell]

  Branch: refs/heads/staging
  Home:   https://github.com/qemu/qemu
  Commit: 73b4987858cd2e0f5bd9ec626f2f95cce6cf84a1
      
https://github.com/qemu/qemu/commit/73b4987858cd2e0f5bd9ec626f2f95cce6cf84a1
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   2024-01-29 (Mon, 29 Jan 2024)

  Changed paths:
    M migration/postcopy-ram.c
    M subprojects/libvhost-user/libvhost-user.c
    M tests/qtest/migration-test.c

  Log Message:
  -----------
  userfaultfd: use 1ULL to build ioctl masks

There is no need to use the Linux-internal __u64 type, 1ULL is
guaranteed to be wide enough.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Link: https://lore.kernel.org/r/20240117160313.175609-1-pbonzini@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>


  Commit: 918f620d30a9b0095b7824b8d77a2d6059a439d9
      
https://github.com/qemu/qemu/commit/918f620d30a9b0095b7824b8d77a2d6059a439d9
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   2024-01-29 (Mon, 29 Jan 2024)

  Changed paths:
    M migration/migration-hmp-cmds.c

  Log Message:
  -----------
  migration: Plug memory leak on HMP migrate error path

hmp_migrate() leaks @caps when qmp_migrate() fails.  Plug the leak
with g_autoptr().

Fixes: 967f2de5c9ec (migration: Implement MigrateChannelList to hmp migration 
flow.) v8.2.0-rc0
Fixes: CID 1533125
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Link: https://lore.kernel.org/r/20240117140722.3979657-1-armbru@redhat.com
[peterx: fix CID number as reported by Peter Maydell]
Signed-off-by: Peter Xu <peterx@redhat.com>


  Commit: a8629e0c2f6778a96f161f15215060cfab5ef2a4
      
https://github.com/qemu/qemu/commit/a8629e0c2f6778a96f161f15215060cfab5ef2a4
  Author: Peter Xu <peterx@redhat.com>
  Date:   2024-01-29 (Mon, 29 Jan 2024)

  Changed paths:
    M migration/migration.h

  Log Message:
  -----------
  migration: Make threshold_size an uint64_t

It's always used to compare against another uint64_t.  Make it always clear
that it's never a negative.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/r/20240117075848.139045-2-peterx@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>


  Commit: b0504edd401dc77ddf09070bb0b22ad7573b4c77
      
https://github.com/qemu/qemu/commit/b0504edd401dc77ddf09070bb0b22ad7573b4c77
  Author: Peter Xu <peterx@redhat.com>
  Date:   2024-01-29 (Mon, 29 Jan 2024)

  Changed paths:
    M migration/ram.c

  Log Message:
  -----------
  migration: Drop unnecessary check in ram's pending_exact()

When the migration frameworks fetches the exact pending sizes, it means
this check:

  remaining_size < s->threshold_size

Must have been done already, actually at migration_iteration_run():

    if (must_precopy <= s->threshold_size) {
        qemu_savevm_state_pending_exact(&must_precopy, &can_postcopy);

That should be after one round of ram_state_pending_estimate().  It makes
the 2nd check meaningless and can be dropped.

To say it in another way, when reaching ->state_pending_exact(), we
unconditionally sync dirty bits for precopy.

Then we can drop migrate_get_current() there too.

Reviewed-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/r/20240117075848.139045-3-peterx@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>


  Commit: 434b8adcf34dd43f19a4ec851eab33c8722d4877
      
https://github.com/qemu/qemu/commit/434b8adcf34dd43f19a4ec851eab33c8722d4877
  Author: Peter Xu <peterx@redhat.com>
  Date:   2024-01-29 (Mon, 29 Jan 2024)

  Changed paths:
    M scripts/analyze-migration.py

  Log Message:
  -----------
  analyze-migration.py: Remove trick on parsing ramblocks

RAM_SAVE_FLAG_MEM_SIZE contains the total length of ramblock idstr to know
whether scanning of ramblocks is complete.  Drop the trick.

Reviewed-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/r/20240117075848.139045-4-peterx@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>


  Commit: 94766edb35946e36cd6c9a070ae013cc09e411f0
      
https://github.com/qemu/qemu/commit/94766edb35946e36cd6c9a070ae013cc09e411f0
  Author: Fabiano Rosas <farosas@suse.de>
  Date:   2024-01-29 (Mon, 29 Jan 2024)

  Changed paths:
    M .gitlab-ci.d/buildtest.yml

  Log Message:
  -----------
  ci: Add a migration compatibility test job

The migration tests have support for being passed two QEMU binaries to
test migration compatibility.

Add a CI job that builds the lastest release of QEMU and another job
that uses that version plus an already present build of the current
version and run the migration tests with the two, both as source and
destination. I.e.:

 old QEMU (n-1) -> current QEMU (development tree)
 current QEMU (development tree) -> old QEMU (n-1)

The purpose of this CI job is to ensure the code we're about to merge
will not cause a migration compatibility problem when migrating the
next release (which will contain that code) to/from the previous
release.

The version of migration-test used will be the one matching the older
QEMU. That way we can avoid special-casing new tests that wouldn't be
compatible with the older QEMU.

Note: for user forks, the version tags need to be pushed to gitlab
otherwise it won't be able to checkout a different version.

Signed-off-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/r/20240118164951.30350-3-farosas@suse.de
Signed-off-by: Peter Xu <peterx@redhat.com>


  Commit: 079687e4182242c65055c5ac438ce4f61c20553e
      
https://github.com/qemu/qemu/commit/079687e4182242c65055c5ac438ce4f61c20553e
  Author: Fabiano Rosas <farosas@suse.de>
  Date:   2024-01-29 (Mon, 29 Jan 2024)

  Changed paths:
    M .gitlab-ci.d/buildtest.yml

  Log Message:
  -----------
  ci: Disable migration compatibility tests for aarch64

Until 9.0 is out, we need to keep the aarch64 job disabled because the
tests always use the n-1 version of migration-test. That happens to be
broken for aarch64 in 8.2. Once 9.0 is out, it will become the n-1
version and it will bring the fixed tests.

We can revert this patch when 9.0 releases.

Signed-off-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/r/20240118164951.30350-4-farosas@suse.de
[peterx: use _SKIPPED rather than _OPTIONAL]
Signed-off-by: Peter Xu <peterx@redhat.com>


  Commit: 0a5d1108aba6308752a82201a441f957e5937211
      
https://github.com/qemu/qemu/commit/0a5d1108aba6308752a82201a441f957e5937211
  Author: Fabiano Rosas <farosas@suse.de>
  Date:   2024-01-29 (Mon, 29 Jan 2024)

  Changed paths:
    M migration/yank_functions.c

  Log Message:
  -----------
  migration/yank: Use channel features

Stop using outside knowledge about the io channels when registering
yank functions. Query for features instead.

The yank method for all channels used with migration code currently is
to call the qio_channel_shutdown() function, so query for
QIO_CHANNEL_FEATURE_SHUTDOWN. We could add a separate feature in the
future for indicating whether a channel supports yanking, but that
seems overkill at the moment.

Signed-off-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Peter Xu <peterx@redhat.com>
Link: https://lore.kernel.org/r/20230911171320.24372-9-farosas@suse.de
Signed-off-by: Peter Xu <peterx@redhat.com>


  Commit: 27eb8499edb2bc952c29ddae0bdac9fc959bf7b1
      
https://github.com/qemu/qemu/commit/27eb8499edb2bc952c29ddae0bdac9fc959bf7b1
  Author: Fabiano Rosas <farosas@suse.de>
  Date:   2024-01-29 (Mon, 29 Jan 2024)

  Changed paths:
    M migration/migration.c

  Log Message:
  -----------
  migration: Fix use-after-free of migration state object

We're currently allowing the process_incoming_migration_bh bottom-half
to run without holding a reference to the 'current_migration' object,
which leads to a segmentation fault if the BH is still live after
migration_shutdown() has dropped the last reference to
current_migration.

In my system the bug manifests as migrate_multifd() returning true
when it shouldn't and multifd_load_shutdown() calling
multifd_recv_terminate_threads() which crashes due to an uninitialized
multifd_recv_state.

Fix the issue by holding a reference to the object when scheduling the
BH and dropping it before returning from the BH. The same is already
done for the cleanup_bh at migrate_fd_cleanup_schedule().

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1969
Signed-off-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/r/20240119233922.32588-2-farosas@suse.de
Signed-off-by: Peter Xu <peterx@redhat.com>


  Commit: 59094cfa7aa3bcca85cf5ab2110431124da24d84
      
https://github.com/qemu/qemu/commit/59094cfa7aa3bcca85cf5ab2110431124da24d84
  Author: Fabiano Rosas <farosas@suse.de>
  Date:   2024-01-29 (Mon, 29 Jan 2024)

  Changed paths:
    M migration/migration.c

  Log Message:
  -----------
  migration: Take reference to migration state around bg_migration_vm_start_bh

We need to hold a reference to the current_migration object around
async calls to avoid it been freed while still in use.

Signed-off-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/r/20240119233922.32588-3-farosas@suse.de
Signed-off-by: Peter Xu <peterx@redhat.com>


  Commit: 9cf268965dba03b718c514adc06c2a5d444778e1
      
https://github.com/qemu/qemu/commit/9cf268965dba03b718c514adc06c2a5d444778e1
  Author: Fabiano Rosas <farosas@suse.de>
  Date:   2024-01-29 (Mon, 29 Jan 2024)

  Changed paths:
    M migration/savevm.c

  Log Message:
  -----------
  migration: Reference migration state around loadvm_postcopy_handle_run_bh

We need to hold a reference to the current_migration object around
async calls to avoid it been freed while still in use. Even on this
load-side function, we might still use the MigrationState, e.g to
check for capabilities.

Signed-off-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/r/20240119233922.32588-4-farosas@suse.de
Signed-off-by: Peter Xu <peterx@redhat.com>


  Commit: 699d9476a065881117004def5c052fbed21f862b
      
https://github.com/qemu/qemu/commit/699d9476a065881117004def5c052fbed21f862b
  Author: Fabiano Rosas <farosas@suse.de>
  Date:   2024-01-29 (Mon, 29 Jan 2024)

  Changed paths:
    M migration/migration.c

  Log Message:
  -----------
  migration: Add a wrapper to qemu_bh_schedule

Wrap qemu_bh_schedule() to ensure we always hold a reference to the
current_migration object.

Signed-off-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/r/20240119233922.32588-5-farosas@suse.de
Signed-off-by: Peter Xu <peterx@redhat.com>


  Commit: 44d0d456d7c40c2f8900b958c01c1a2ef6acf302
      
https://github.com/qemu/qemu/commit/44d0d456d7c40c2f8900b958c01c1a2ef6acf302
  Author: Fabiano Rosas <farosas@suse.de>
  Date:   2024-01-29 (Mon, 29 Jan 2024)

  Changed paths:
    M migration/migration.c
    M migration/migration.h
    M migration/savevm.c

  Log Message:
  -----------
  migration: Centralize BH creation and dispatch

Now that the migration state reference counting is correct, further
wrap the bottom half dispatch process to avoid future issues.

Move BH creation and scheduling together and wrap the dispatch with an
intermediary function that will ensure we always keep the ref/unref
balanced.

Also move the responsibility of deleting the BH into the wrapper and
remove the now unnecessary pointers.

Signed-off-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/r/20240119233922.32588-6-farosas@suse.de
Signed-off-by: Peter Xu <peterx@redhat.com>


  Commit: 57fd4b4e10756448acd6c90ce041ba8dc9313efc
      
https://github.com/qemu/qemu/commit/57fd4b4e10756448acd6c90ce041ba8dc9313efc
  Author: Het Gala <het.gala@nutanix.com>
  Date:   2024-01-29 (Mon, 29 Jan 2024)

  Changed paths:
    M qapi/migration.json

  Log Message:
  -----------
  Make 'uri' optional for migrate QAPI

'uri' argument should be optional, as 'uri' and 'channels'
arguments are mutally exclusive in nature.

Fixes: 074dbce5fcce (migration: New migrate and migrate-incoming argument 
'channels')
Signed-off-by: Het Gala <het.gala@nutanix.com>
Link: https://lore.kernel.org/r/20240123064219.40514-1-het.gala@nutanix.com
Signed-off-by: Peter Xu <peterx@redhat.com>


  Commit: 850051b94b4eac2e2eec985b313d840bd5eddb44
      
https://github.com/qemu/qemu/commit/850051b94b4eac2e2eec985b313d840bd5eddb44
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   2024-01-29 (Mon, 29 Jan 2024)

  Changed paths:
    M hw/vfio/common.c

  Log Message:
  -----------
  vfio: use matching sizeof type

Do not use uint64_t for the type of the declaration and __u64 when
computing the number of elements in the array.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>


  Commit: d2b668fca5652760b435ce812a743bba03d2f316
      
https://github.com/qemu/qemu/commit/d2b668fca5652760b435ce812a743bba03d2f316
  Author: Cédric Le Goater <clg@redhat.com>
  Date:   2024-01-29 (Mon, 29 Jan 2024)

  Changed paths:
    M hw/vfio/pci.c

  Log Message:
  -----------
  vfio/pci: Clear MSI-X IRQ index always

When doing device assignment of a physical device, MSI-X can be
enabled with no vectors enabled and this sets the IRQ index to
VFIO_PCI_MSIX_IRQ_INDEX. However, when MSI-X is disabled, the IRQ
index is left untouched if no vectors are in use. Then, when INTx
is enabled, the IRQ index value is considered incompatible (set to
MSI-X) and VFIO_DEVICE_SET_IRQS fails. QEMU complains with :

qemu-system-x86_64: vfio 0000:08:00.0: Failed to set up TRIGGER eventfd 
signaling for interrupt INTX-0: VFIO_DEVICE_SET_IRQS failure: Invalid argument

To avoid that, unconditionaly clear the IRQ index when MSI-X is
disabled.

Buglink: https://issues.redhat.com/browse/RHEL-21293
Fixes: 5ebffa4e87e7 ("vfio/pci: use an invalid fd to enable MSI-X")
Cc: Jing Liu <jing2.liu@intel.com>
Cc: Alex Williamson <alex.williamson@redhat.com>
Reviewed-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Cédric Le Goater <clg@redhat.com>


  Commit: e7390150e78364a80924accde8bc5b8cd8f26bc9
      
https://github.com/qemu/qemu/commit/e7390150e78364a80924accde8bc5b8cd8f26bc9
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   2024-01-29 (Mon, 29 Jan 2024)

  Changed paths:
    M .gitlab-ci.d/buildtest.yml
    M migration/migration-hmp-cmds.c
    M migration/migration.c
    M migration/migration.h
    M migration/postcopy-ram.c
    M migration/ram.c
    M migration/savevm.c
    M migration/yank_functions.c
    M qapi/migration.json
    M scripts/analyze-migration.py
    M subprojects/libvhost-user/libvhost-user.c
    M tests/qtest/migration-test.c

  Log Message:
  -----------
  Merge tag 'migration-20240126-pull-request' of https://gitlab.com/peterx/qemu 
into staging

Migration Pull

[dropped fabiano's patch on modifying cpu model for arm migration tests for
 now]

- Fabiano's patchset to fix migration state references in BHs
- Fabiano's new 'n-1' migration test for CI
- Het's fix on making "uri" optional in QMP migrate cmd
- Markus's HMP leak fix reported by Coverity
- Paolo's cleanup on uffd to replace u64 usage
- Peter's small migration cleanup series all over the places

# -----BEGIN PGP SIGNATURE-----
#
# iIgEABYKADAWIQS5GE3CDMRX2s990ak7X8zN86vXBgUCZbcVeBIccGV0ZXJ4QHJl
# ZGhhdC5jb20ACgkQO1/MzfOr1wYHjgD9F2Fnrf4EuPNC/gF3yUvHVz1mgHqevb/g
# pw/ThcJF31wBALuWmwuUaNWm+VNtRc10YH6bY7HZW8oa1RefRN6QZn0L
# =JGTX
# -----END PGP SIGNATURE-----
# gpg: Signature made Mon 29 Jan 2024 03:03:20 GMT
# gpg:                using EDDSA key B9184DC20CC457DACF7DD1A93B5FCCCDF3ABD706
# gpg:                issuer "peterx@redhat.com"
# gpg: Good signature from "Peter Xu <xzpeter@gmail.com>" [marginal]
# gpg:                 aka "Peter Xu <peterx@redhat.com>" [marginal]
# gpg: WARNING: This key is not certified with sufficiently trusted signatures!
# gpg:          It is not certain that the signature belongs to the owner.
# Primary key fingerprint: B918 4DC2 0CC4 57DA CF7D  D1A9 3B5F CCCD F3AB D706

* tag 'migration-20240126-pull-request' of https://gitlab.com/peterx/qemu:
  Make 'uri' optional for migrate QAPI
  migration: Centralize BH creation and dispatch
  migration: Add a wrapper to qemu_bh_schedule
  migration: Reference migration state around loadvm_postcopy_handle_run_bh
  migration: Take reference to migration state around bg_migration_vm_start_bh
  migration: Fix use-after-free of migration state object
  migration/yank: Use channel features
  ci: Disable migration compatibility tests for aarch64
  ci: Add a migration compatibility test job
  analyze-migration.py: Remove trick on parsing ramblocks
  migration: Drop unnecessary check in ram's pending_exact()
  migration: Make threshold_size an uint64_t
  migration: Plug memory leak on HMP migrate error path
  userfaultfd: use 1ULL to build ioctl masks

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>


  Commit: 11be70677c70fdccd452a3233653949b79e97908
      
https://github.com/qemu/qemu/commit/11be70677c70fdccd452a3233653949b79e97908
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   2024-01-29 (Mon, 29 Jan 2024)

  Changed paths:
    M hw/vfio/common.c
    M hw/vfio/pci.c

  Log Message:
  -----------
  Merge tag 'pull-vfio-20240129' of https://github.com/legoater/qemu into 
staging

vfio queue:

* Array type cleanup
* Fix for IRQ enablement

# -----BEGIN PGP SIGNATURE-----
#
# iQIzBAABCAAdFiEEoPZlSPBIlev+awtgUaNDx8/77KEFAmW3VcQACgkQUaNDx8/7
# 7KGmzBAAqjkIO1ABKnXMTmObXqRwUjWzHyrn99Tl14f3dXeSEbiTkP/eha0yq9UQ
# GrfJqxbLvz/umh+2el9yA1eF+B2SdozpSnIeqyg15307ujbCe6S01s8KOHQtu81v
# V8wOFzyx/2S5PPQLGyNK5jiHIHuzbNrngcJXVYMg7pV75znbUNNQUUFoJNsrjQrG
# vG99RVp+oY9U7f4BstUUL12n1VFD43y2cx5k/xVPCHh77vvdOhTXhm6G9qiiqROG
# DG+yaghHDxPP96f4WAQOaSU9bBYFCQAkMtLUU/UBbD7nAWTY9onWq6YHcShyAnXg
# LVcSoymwCCFo7n/NM+v4y6/cYOcttkgQhg4NYOTj6L8UeXIJppR047QwEcdIxMKY
# CDFZbbkvxRma38Gr6eK0VwtINuTSZzzpPebhqQk0R3MQsvlJcCvc6PhkhgYOMzfb
# POnqlrm+JAY4EMnlejkJhVJtpfrKwkThkFAS/hqponzJyNckyVnKiVkCp4i+YTtq
# WOGelLGocA/IdEJT0Ca+zRFPjrm5BUCSVnmVUXekRiQrZ4BiBNIWKI8ZgrGIF0F4
# AOCH/J8SBbfZg4NVRTm7vMEctX7ji/A9Wo8RQ4DpPmfNxLLHsmzghNCtIzj47fzj
# HwEWqgbDIBo7S8iB8lV6VKiznVnU67J4IZYjwwzU+AxJg3+O8wU=
# =zTyl
# -----END PGP SIGNATURE-----
# gpg: Signature made Mon 29 Jan 2024 07:37:40 GMT
# gpg:                using RSA key A0F66548F04895EBFE6B0B6051A343C7CFFBECA1
# gpg: Good signature from "Cédric Le Goater <clg@kaod.org>" [undefined]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg:          There is no indication that the signature belongs to the owner.
# Primary key fingerprint: A0F6 6548 F048 95EB FE6B  0B60 51A3 43C7 CFFB ECA1

* tag 'pull-vfio-20240129' of https://github.com/legoater/qemu:
  vfio/pci: Clear MSI-X IRQ index always
  vfio: use matching sizeof type

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>


Compare: https://github.com/qemu/qemu/compare/7a1dc45af581...11be70677c70