diff options
Diffstat (limited to '')
| -rw-r--r-- | results/classifier/118/none/163 | 31 | ||||
| -rw-r--r-- | results/classifier/118/none/1631625 | 51 | ||||
| -rw-r--r-- | results/classifier/118/none/1633 | 98 | ||||
| -rw-r--r-- | results/classifier/118/none/1634069 | 50 | ||||
| -rw-r--r-- | results/classifier/118/none/1635339 | 843 | ||||
| -rw-r--r-- | results/classifier/118/none/1639 | 31 |
6 files changed, 1104 insertions, 0 deletions
diff --git a/results/classifier/118/none/163 b/results/classifier/118/none/163 new file mode 100644 index 00000000..76d6b2e5 --- /dev/null +++ b/results/classifier/118/none/163 @@ -0,0 +1,31 @@ +semantic: 0.508 +device: 0.469 +mistranslation: 0.382 +socket: 0.378 +register: 0.378 +network: 0.369 +debug: 0.345 +risc-v: 0.305 +arm: 0.254 +boot: 0.253 +performance: 0.241 +i386: 0.239 +virtual: 0.213 +vnc: 0.191 +PID: 0.187 +user-level: 0.163 +ppc: 0.144 +x86: 0.129 +graphic: 0.126 +architecture: 0.116 +VMM: 0.077 +peripherals: 0.076 +hypervisor: 0.066 +TCG: 0.060 +kernel: 0.058 +assembly: 0.051 +files: 0.049 +permissions: 0.038 +KVM: 0.009 + +SPICE session's connection_id's are not unique diff --git a/results/classifier/118/none/1631625 b/results/classifier/118/none/1631625 new file mode 100644 index 00000000..f879634e --- /dev/null +++ b/results/classifier/118/none/1631625 @@ -0,0 +1,51 @@ +device: 0.614 +mistranslation: 0.456 +graphic: 0.376 +semantic: 0.312 +VMM: 0.249 +x86: 0.242 +peripherals: 0.238 +i386: 0.201 +assembly: 0.183 +user-level: 0.181 +hypervisor: 0.175 +performance: 0.153 +ppc: 0.124 +socket: 0.119 +PID: 0.101 +virtual: 0.100 +architecture: 0.091 +register: 0.089 +network: 0.081 +KVM: 0.077 +debug: 0.064 +files: 0.038 +vnc: 0.038 +risc-v: 0.036 +TCG: 0.035 +arm: 0.033 +boot: 0.031 +kernel: 0.028 +permissions: 0.018 + +target-mips/dsp_helper.c: two possible bad shifts + +target-mips/dsp_helper.c:3480:1: error: V629 Consider inspecting the '0x01 << (size + 1)' expression. Bit shifting of the 32-bit value with a subsequent expansion to the 64-bit type. + +Source code is + + temp = temp & ((0x01 << (size + 1)) - 1); + +If size >= 32, then better code might be + + temp = temp & ((0x01UL << (size + 1)) - 1); + +target-mips/dsp_helper.c:3509:1: error: V629 Consider inspecting the '0x01 << (size + 1)' expression. Bit shifting of the 32-bit value with a subsequent expansion to the 64-bit type. + +Duplicate + +Fix has been committed: +http://git.qemu.org/?p=qemu.git;a=commitdiff;h=e6e2784cacd4cfec149 + +Released with version 2.8 + diff --git a/results/classifier/118/none/1633 b/results/classifier/118/none/1633 new file mode 100644 index 00000000..b6084272 --- /dev/null +++ b/results/classifier/118/none/1633 @@ -0,0 +1,98 @@ +virtual: 0.758 +device: 0.745 +graphic: 0.724 +peripherals: 0.723 +assembly: 0.715 +architecture: 0.714 +register: 0.710 +risc-v: 0.709 +permissions: 0.705 +semantic: 0.701 +boot: 0.699 +mistranslation: 0.695 +hypervisor: 0.689 +performance: 0.689 +PID: 0.689 +arm: 0.687 +debug: 0.660 +user-level: 0.651 +vnc: 0.645 +KVM: 0.644 +kernel: 0.639 +ppc: 0.635 +TCG: 0.617 +VMM: 0.612 +socket: 0.603 +network: 0.599 +files: 0.551 +x86: 0.505 +i386: 0.397 + +[8.0.0] Broken icount support on RISC-V +Description of problem: +After https://gitlab.com/qemu-project/qemu/-/commit/5a4ae64cac49564354cd6f17598840e4af70e4f5 was merged, RISC-V VMs no longer run with -icount 1 specified in the QEMU arguments. Reverting this commit resolves the issue. +Steps to reproduce: +1. Download preinstalled Ubuntu 22.04.2 image from [here](https://cdimage.ubuntu.com/releases/22.04.2/release/ubuntu-22.04.2-preinstalled-server-riscv64+unmatched.img.xz) +2. Download uboot from [here](http://security.ubuntu.com/ubuntu/pool/main/u/u-boot/u-boot-qemu_2022.01+dfsg-2ubuntu2.3_all.deb) +3. Extract both. +4. Run with the command-line specified above. +Additional information: +Reading Ubuntu wiki describing how to run RISC-V VMs can help: https://wiki.ubuntu.com/RISC-V/QEMU + +Full output: + +``` +% qemu-system-riscv64 \ +-machine virt -nographic -m 2048 -smp 4 \ +-kernel u-boot/qemu-riscv64_smode/uboot.elf \ +-device virtio-net-device,netdev=eth0 -netdev user,id=eth0 \ +-drive file=ubuntu-22.04.2-preinstalled-server-riscv64+unmatched.img,format=raw,if=virtio -icount 1 + +OpenSBI v1.2 + ____ _____ ____ _____ + / __ \ / ____| _ \_ _| + | | | |_ __ ___ _ __ | (___ | |_) || | + | | | | '_ \ / _ \ '_ \ \___ \| _ < | | + | |__| | |_) | __/ | | |____) | |_) || |_ + \____/| .__/ \___|_| |_|_____/|____/_____| + | | + |_| + +Platform Name : riscv-virtio,qemu +Platform Features : medeleg +Platform HART Count : 4 +Platform IPI Device : aclint-mswi +Platform Timer Device : aclint-mtimer @ 10000000Hz +Platform Console Device : uart8250 +Platform HSM Device : --- +Platform PMU Device : --- +Platform Reboot Device : sifive_test +Platform Shutdown Device : sifive_test +Firmware Base : 0x80000000 +Firmware Size : 236 KB +Runtime SBI Version : 1.0 + +Domain0 Name : root +Domain0 Boot HART : 0 +Domain0 HARTs : 0*,1*,2*,3* +Domain0 Region00 : 0x0000000002000000-0x000000000200ffff (I) +Domain0 Region01 : 0x0000000080000000-0x000000008003ffff () +Domain0 Region02 : 0x0000000000000000-0xffffffffffffffff (R,W,X) +Domain0 Next Address : 0x0000000080200000 +Domain0 Next Arg1 : 0x00000000bfe00000 +Domain0 Next Mode : S-mode +Domain0 SysReset : yes + +Boot HART ID : 0 +Boot HART Domain : root +Boot HART Priv Version : v1.12 +Boot HART Base ISA : rv64imafdch +Boot HART ISA Extensions : time,sstc +Boot HART PMP Count : 16 +Boot HART PMP Granularity : 4 +Boot HART PMP Address Bits: 54 +Boot HART MHPM Count : 16 +Boot HART MIDELEG : 0x0000000000001666 +Boot HART MEDELEG : 0x0000000000f0b509 +qemu-system-riscv64: Bad icount read +``` diff --git a/results/classifier/118/none/1634069 b/results/classifier/118/none/1634069 new file mode 100644 index 00000000..0ccde186 --- /dev/null +++ b/results/classifier/118/none/1634069 @@ -0,0 +1,50 @@ +device: 0.575 +graphic: 0.554 +architecture: 0.434 +semantic: 0.426 +PID: 0.412 +register: 0.410 +performance: 0.396 +ppc: 0.388 +network: 0.380 +VMM: 0.371 +user-level: 0.370 +permissions: 0.358 +hypervisor: 0.355 +peripherals: 0.342 +risc-v: 0.332 +i386: 0.332 +vnc: 0.330 +files: 0.329 +mistranslation: 0.321 +KVM: 0.319 +socket: 0.318 +debug: 0.309 +assembly: 0.292 +x86: 0.283 +kernel: 0.251 +TCG: 0.251 +boot: 0.221 +virtual: 0.217 +arm: 0.206 + +Exclude keys from grab + +Feature request: pressing every time a shortcut to release grab for switching windows/desktops is pretty annoying, especially for users of tiling WMs. + +QEMU have to have a way to specify keys or shortcuts (possibly something like "everything with the specified modifier key"), which would not be intercepted. + +Alternatively/additionally it would be nice to be able to disable keys grabbing at all. + +The QEMU project is currently considering to move its bug tracking to another system. For this we need to know which bugs are still valid and which could be closed already. Thus we are setting older bugs to "Incomplete" now. +If you still think this bug report here is valid, then please switch the state back to "New" within the next 60 days, otherwise this report will be marked as "Expired". Or mark it as "Fix Released" if the problem has been solved with a newer version of QEMU already. Thank you and sorry for the inconvenience. + + + +This is an automated cleanup. This bug report has been moved to QEMU's +new bug tracker on gitlab.com and thus gets marked as 'expired' now. +Please continue with the discussion here: + + https://gitlab.com/qemu-project/qemu/-/issues/138 + + diff --git a/results/classifier/118/none/1635339 b/results/classifier/118/none/1635339 new file mode 100644 index 00000000..62db196d --- /dev/null +++ b/results/classifier/118/none/1635339 @@ -0,0 +1,843 @@ +user-level: 0.635 +hypervisor: 0.601 +KVM: 0.588 +VMM: 0.577 +x86: 0.558 +peripherals: 0.547 +TCG: 0.529 +i386: 0.522 +vnc: 0.506 +ppc: 0.504 +risc-v: 0.503 +mistranslation: 0.486 +virtual: 0.464 +register: 0.382 +boot: 0.380 +device: 0.378 +debug: 0.357 +performance: 0.350 +permissions: 0.334 +arm: 0.328 +network: 0.314 +assembly: 0.311 +semantic: 0.302 +architecture: 0.294 +socket: 0.287 +graphic: 0.282 +PID: 0.279 +files: 0.269 +kernel: 0.267 + +qxl_pre_save assertion failure on vm "save" + +When I try and save my Windows 10 VM, I see an assertion failure, and the machine is shut down. + +I see the following in the log: + +main_channel_handle_parsed: agent start +qemu-system-x86_64: /build/qemu-Zwynhi/qemu-2.5+dfsg/hw/display/qxl.c:2101: qxl_pre_save: Assertion `d->last_release_offset < d->vga.vram_size' failed. +2016-10-20 11:52:42.713+0000: shutting down + +Please let me know what other information would be relevant! + +Hmm docmax on #qemu just complained about a similar error; although they were on win2016, and using qemu-2.7 and the latest git versions, and that assert has been in there for years. + +Can you please add the full qemu command line you're using, and the version of the spice/qxl drivers you're using inside the windows VM. + + +QXL driver version is 17.54.59.923 + +Commandline (git compiled today) is: + +/usr/sbin/qemu-system-x86_64 -name guest=dc,debug-threads=on -S -object secret,id=masterKey0,format=raw,file=/var/lib/libvirt/qemu/domain-1-dc/master-key.aes -machine pc-i440fx-2.7,accel=kvm,usb=off,vmport=off,dump-guest-core=off -cpu Haswell-noTSX,+vme,+ds,+acpi,+ss,+ht,+tm,+pbe,+dtes64,+monitor,+ds_cpl,+vmx,+est,+tm2,+xtpr,+pdcm,+osxsave,+f16c,+rdrand,+arat,+tsc_adjust,+xsaveopt,+pdpe1gb,+abm -drive file=/usr/share/ovmf/x64/ovmf_code_x64.bin,if=pflash,format=raw,unit=0,readonly=on -drive file=/var/lib/libvirt/qemu/nvram/dc_VARS.fd,if=pflash,format=raw,unit=1 -m 2048 -realtime mlock=off -smp 4,sockets=1,cores=4,threads=1 -uuid 647fd6b2-9a88-4219-af46-052f68a539a5 -no-user-config -nodefaults -chardev socket,id=charmonitor,path=/var/lib/libvirt/qemu/domain-1-dc/monitor.sock,server,nowait -mon chardev=charmonitor,id=monitor,mode=control -rtc base=utc,driftfix=slew -global kvm-pit.lost_tick_policy=discard -no-hpet -no-shutdown -global PIIX4_PM.disable_s3=1 -global PIIX4_PM.disable_s4=1 -boot strict=on -device ich9-usb-ehci1,id=usb,bus=pci.0,addr=0x6.0x7 -device ich9-usb-uhci1,masterbus=usb.0,firstport=0,bus=pci.0,multifunction=on,addr=0x6 -device ich9-usb-uhci2,masterbus=usb.0,firstport=2,bus=pci.0,addr=0x6.0x1 -device ich9-usb-uhci3,masterbus=usb.0,firstport=4,bus=pci.0,addr=0x6.0x2 -device virtio-serial-pci,id=virtio-serial0,bus=pci.0,addr=0x5 -drive file=/mnt/shared/server/root/var/lib/libvirt/images/hdd/dc.qcow2,format=qcow2,if=none,id=drive-virtio-disk0 -device virtio-blk-pci,scsi=off,bus=pci.0,addr=0x7,drive=drive-virtio-disk0,id=virtio-disk0,bootindex=1 -netdev tap,fd=27,id=hostnet0,vhost=on,vhostfd=29 -device virtio-net-pci,netdev=hostnet0,id=net0,mac=52:54:00:58:ce:4e,bus=pci.0,addr=0x3 -chardev pty,id=charserial0 -device isa-serial,chardev=charserial0,id=serial0 -chardev spicevmc,id=charchannel0,name=vdagent -device virtserialport,bus=virtio-serial0.0,nr=1,chardev=charchannel0,id=channel0,name=com.redhat.spice.0 -spice port=5900,addr=127.0.0.1,disable-ticketing,image-compression=off,seamless-migration=on -device qxl-vga,id=video0,ram_size=67108864,vram_size=67108864,vram64_size_mb=0,vgamem_mb=16,max_outputs=1,bus=pci.0,addr=0x2 -device intel-hda,id=sound0,bus=pci.0,addr=0x4 -device hda-duplex,id=sound0-codec0,bus=sound0.0,cad=0 -chardev spicevmc,id=charredir0,name=usbredir -device usb-redir,chardev=charredir0,id=redir0,bus=usb.0,port=1 -chardev spicevmc,id=charredir1,name=usbredir -device usb-redir,chardev=charredir1,id=redir1,bus=usb.0,port=2 -device virtio-balloon-pci,id=balloon0,bus=pci.0,addr=0x8 -msg timestamp=on + +I tried other QXL drivers: 22.33.46.473. +These work (but have a older date: 2015-07-28. + +17.54.59.923 have the date 2016-04-21. +I got them from this package: + +http://depot.flexvdi.com/guest-tools/flexvdi-guest-tools-2.2.11.iso + +Those provide something, which lets my window resize freely. + +I'm running into this issue as well: +Arch Linux +Qemu 2.8.0 +spice guest tools: 0.132 +QXL driver version (as reported by Windows Device Manager): 10.0.0.15000 + +Everything else works great. It would save me a lot of rebooting if this could get fixed. +If there is anything I can do or try, I'll be glad to help. + +Relevant log of VM boot and crash on selecting suspend action in virt-manager: + +2017-04-06 16:59:24.681+0000: starting up libvirt version: 3.1.0, qemu version: 2.8.0, hostname: arch-vaio.localdomain +LC_ALL=C PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin QEMU_AUDIO_DRV=spice /usr/bin/qemu-system-x86_64 -name guest=Windows,debug-threads=on -S -object secret,id=masterKey0,format=raw,file=/var/lib/libvirt/qemu/domain-9-Windows/master-key.aes -machine pc-i440fx-2.7,accel=kvm,usb=off,vmport=off,dump-guest-core=off -cpu core2duo,hv_time,hv_relaxed,hv_vapic,hv_spinlocks=0x1fff -m 2048 -realtime mlock=off -smp 2,sockets=1,cores=2,threads=1 -uuid f14684d3-5f81-4743-8512-e516d85ca2c9 -no-user-config -nodefaults -chardev socket,id=charmonitor,path=/var/lib/libvirt/qemu/domain-9-Windows/monitor.sock,server,nowait -mon chardev=charmonitor,id=monitor,mode=control -rtc base=localtime,driftfix=slew -global kvm-pit.lost_tick_policy=delay -no-hpet -no-shutdown -global PIIX4_PM.disable_s3=1 -global PIIX4_PM.disable_s4=1 -boot strict=on -device ich9-usb-ehci1,id=usb,bus=pci.0,addr=0x6.0x7 -device ich9-usb-uhci1,masterbus=usb.0,firstport=0,bus=pci.0,multifunction=on,addr=0x6 -device ich9-usb-uhci2,masterbus=usb.0,firstport=2,bus=pci.0,addr=0x6.0x1 -device ich9-usb-uhci3,masterbus=usb.0,firstport=4,bus=pci.0,addr=0x6.0x2 -device virtio-serial-pci,id=virtio-serial0,bus=pci.0,addr=0x5 -drive file=/mnt/media/Qemu/windows10.qcow2,format=qcow2,if=none,id=drive-virtio-disk0 -device virtio-blk-pci,scsi=off,bus=pci.0,addr=0x7,drive=drive-virtio-disk0,id=virtio-disk0,bootindex=1 -drive file=/usr/share/spice-guest-tools/spice-guest-tools.iso,format=raw,if=none,id=drive-ide0-0-1,readonly=on -device ide-cd,bus=ide.0,unit=1,drive=drive-ide0-0-1,id=ide0-0-1 -netdev user,id=hostnet0 -device rtl8139,netdev=hostnet0,id=net0,mac=52:54:00:44:08:31,bus=pci.0,addr=0x3 -chardev pty,id=charserial0 -device isa-serial,chardev=charserial0,id=serial0 -chardev spicevmc,id=charchannel0,name=vdagent -device virtserialport,bus=virtio-serial0.0,nr=1,chardev=charchannel0,id=channel0,name=com.redhat.spice.0 -device usb-tablet,id=input2,bus=usb.0,port=3 -spice port=5900,addr=127.0.0.1,disable-ticketing,image-compression=off,seamless-migration=on -device qxl-vga,id=video0,ram_size=67108864,vram_size=67108864,vram64_size_mb=0,vgamem_mb=16,max_outputs=1,bus=pci.0,addr=0x2 -device intel-hda,id=sound0,bus=pci.0,addr=0x4 -device hda-duplex,id=sound0-codec0,bus=sound0.0,cad=0 -chardev spicevmc,id=charredir0,name=usbredir -device usb-redir,chardev=charredir0,id=redir0,bus=usb.0,port=1 -chardev spicevmc,id=charredir1,name=usbredir -device usb-redir,chardev=charredir1,id=redir1,bus=usb.0,port=2 -device virtio-balloon-pci,id=balloon0,bus=pci.0,addr=0x8 -msg timestamp=on +char device redirected to /dev/pts/6 (label charserial0) +main_channel_link: add main channel client +red_dispatcher_set_cursor_peer: +inputs_connect: inputs channel client create +main_channel_handle_parsed: agent start +ehci warning: guest updated active QH +qemu-system-x86_64: /build/qemu/src/qemu-2.8.0/hw/display/qxl.c:2173: qxl_pre_save: Assertion `d->last_release_offset < d->vga.vram_size' failed. +2017-04-06 17:00:32.819+0000: shutting down, reason=crashed + +I can see a bunch of similar looking failures in Fedora's automatic backtrace stats system + +I put my money on that one: + +https://cgit.freedesktop.org/spice/win32/qxl-wddm-dod/commit/?id=f6e099db39e7d0787f294d5fd0dce328b5210faa + +commit f6e099db39e7d0787f294d5fd0dce328b5210faa +Author: Sameeh Jubran <email address hidden> +Date: Sun Sep 11 16:05:24 2016 +0300 + + Use the second bar (VRAM) for qxl command buffer. + + Based on a patch by Sandy Stutsman <email address hidden> + + Signed-off-by: Sameeh Jubran <email address hidden> + Acked-by: Frediano Ziglio <email address hidden> + + + +Crash reproduced immediately after setting up a win10 VM with qxl driver 10.0.0.15000. + +Gerd, are you looking into fixing it? Is it acceptable to crash qemu if the driver is faulty? + +damn launchpad, wrong bug and I can't change it back. Please someone move it back to New/Confirmed + +Well. qxl commands are expected to live in bar 0 (same bar where the rings are too). vram bar was added as surface storage. + +Now the windows drivers started to us vram for qxl commands. Problem is we simply can't live-migrate such a guest. At least not without changing the vmstate format. Which isn't something I would attempt just a few days before release. + +We can't throw an error in qxl_pre_save either (and fail migration instead of aborting). + +I don't see an easy way out for 2.9. + +Long term options are (a) revert the driver change, and probably add some checks to qxl to make sure guests don't use vram for commands, or (b) extend qxl vmstate so we can handle that case. + +An untested hack that might fail cleaner might be: + + error_report("Broken driver ..... migration failed"); + qemu_file_set_error(migrate_get_current()->to_dst_file, -EINVAL); + +(untested, probably needs checking it works with savevm). + +I must go around and add a return value to pre_save(). + +We probably also need to make sure some migration testing gets added to the driver dev + +Not sure we want a failure mode for pre_save(). + +If we go for option (a) (from comment 9), I'd add a check when reading the commands from the ring, not at migration time, so we don't run enter a state where pre_save() can fail in the first place. Because that will break the windows drivers we might add a warning only for 2.9, then for 2.10 raise an error irq. Something like this: + +--- a/hw/display/qxl.c ++++ b/hw/display/qxl.c +@@ -639,6 +639,24 @@ static int interface_get_command(QXLInstance *sin, struct QXLCommandExt *ext) + qxl->guest_primary.commands++; + qxl_track_command(qxl, ext); + qxl_log_command(qxl, "cmd", ext); ++ { ++ void *msg = qxl_phys2virt(qxl, ext->cmd.data, ext->group_id); ++ if (msg < (void *)qxl->vga.vram_ptr || ++ msg > ((void *)qxl->vga.vram_ptr + qxl->vga.vram_size)) { ++#if 1 ++ /* temporary, for 2.9 */ ++ static int once; ++ if (!once) { ++ fprintf(stderr, "qxl: guest bug: command not in ram bar, " ++ "guest not migratable\n"); ++ once = true; ++ } ++#else ++ qxl_set_guest_bug(qxl, "command not in ram bar"); ++ return false; ++#endif ++ } ++ } + trace_qxl_ring_command_get(qxl->id, qxl_mode_to_string(qxl->mode)); + return true; + default: + + +Your approach works ok Gerd with a migration blocker. Are you going to send a patch? + +I am afraid we would have to make this code permanent though, since there has been several releases of this driver already, and it's much nicer to block migration than to crash a VM. + +I have reached out to wddm driver about the bug. + +Cc: <email address hidden> +Signed-off-by: Gerd Hoffmann <email address hidden> +--- + hw/display/qxl.h | 1 + + hw/display/qxl.c | 22 ++++++++++++++++++++++ + 2 files changed, 23 insertions(+) + +diff --git a/hw/display/qxl.h b/hw/display/qxl.h +index d2d49dd..77e5a36 100644 +--- a/hw/display/qxl.h ++++ b/hw/display/qxl.h +@@ -40,6 +40,7 @@ typedef struct PCIQXLDevice { + uint32_t cmdlog; + + uint32_t guest_bug; ++ Error *migration_blocker; + + enum qxl_mode mode; + uint32_t cmdflags; +diff --git a/hw/display/qxl.c b/hw/display/qxl.c +index c31b293..74ebeb9 100644 +--- a/hw/display/qxl.c ++++ b/hw/display/qxl.c +@@ -26,6 +26,7 @@ + #include "qemu/queue.h" + #include "qemu/atomic.h" + #include "sysemu/sysemu.h" ++#include "migration/migration.h" + #include "trace.h" + + #include "qxl.h" +@@ -639,6 +640,27 @@ static int interface_get_command(QXLInstance *sin, struct QXLCommandExt *ext) + qxl->guest_primary.commands++; + qxl_track_command(qxl, ext); + qxl_log_command(qxl, "cmd", ext); ++ { ++ /* ++ * Windows 8 drivers place qxl commands in the vram ++ * (instead of the ram) bar. We can't live migrate such a ++ * guest, so add a migration blocker in case we detect ++ * this, to avoid triggering the assert in pre_save(). ++ * ++ * https://cgit.freedesktop.org/spice/win32/qxl-wddm-dod/commit/?id=f6e099db39e7d0787f294d5fd0dce328b5210faa ++ */ ++ void *msg = qxl_phys2virt(qxl, ext->cmd.data, ext->group_id); ++ if (msg != NULL && ( ++ msg < (void *)qxl->vga.vram_ptr || ++ msg > ((void *)qxl->vga.vram_ptr + qxl->vga.vram_size))) { ++ if (!qxl->migration_blocker) { ++ Error *local_err = NULL; ++ error_setg(&qxl->migration_blocker, ++ "qxl: guest bug: command not in ram bar"); ++ migrate_add_blocker(qxl->migration_blocker, &local_err); ++ } ++ } ++ } + trace_qxl_ring_command_get(qxl->id, qxl_mode_to_string(qxl->mode)); + return true; + default: +-- +2.9.3 + + + +Hi + +On Mon, Apr 10, 2017 at 8:58 AM Gerd Hoffmann <email address hidden> wrote: + +> Cc: <email address hidden> +> Signed-off-by: Gerd Hoffmann <email address hidden> +> --- +> hw/display/qxl.h | 1 + +> hw/display/qxl.c | 22 ++++++++++++++++++++++ +> 2 files changed, 23 insertions(+) +> +> diff --git a/hw/display/qxl.h b/hw/display/qxl.h +> index d2d49dd..77e5a36 100644 +> --- a/hw/display/qxl.h +> +++ b/hw/display/qxl.h +> @@ -40,6 +40,7 @@ typedef struct PCIQXLDevice { +> uint32_t cmdlog; +> +> uint32_t guest_bug; +> + Error *migration_blocker; +> +> enum qxl_mode mode; +> uint32_t cmdflags; +> diff --git a/hw/display/qxl.c b/hw/display/qxl.c +> index c31b293..74ebeb9 100644 +> --- a/hw/display/qxl.c +> +++ b/hw/display/qxl.c +> @@ -26,6 +26,7 @@ +> #include "qemu/queue.h" +> #include "qemu/atomic.h" +> #include "sysemu/sysemu.h" +> +#include "migration/migration.h" +> #include "trace.h" +> +> #include "qxl.h" +> @@ -639,6 +640,27 @@ static int interface_get_command(QXLInstance *sin, +> struct QXLCommandExt *ext) +> qxl->guest_primary.commands++; +> qxl_track_command(qxl, ext); +> qxl_log_command(qxl, "cmd", ext); +> + { +> + /* +> + * Windows 8 drivers place qxl commands in the vram +> ++ * (instead of the ram) bar. We can't live migrate such a +> + * guest, so add a migration blocker in case we detect +> + * this, to avoid triggering the assert in pre_save(). +> + * +> + * +> https://cgit.freedesktop.org/spice/win32/qxl-wddm-dod/commit/?id=f6e099db39e7d0787f294d5fd0dce328b5210faa +> + */ +> + void *msg = qxl_phys2virt(qxl, ext->cmd.data, ext->group_id); +> + if (msg != NULL && ( +> + msg < (void *)qxl->vga.vram_ptr || +> + msg > ((void *)qxl->vga.vram_ptr + +> qxl->vga.vram_size))) { +> + if (!qxl->migration_blocker) { +> + Error *local_err = NULL; +> + error_setg(&qxl->migration_blocker, +> + "qxl: guest bug: command not in ram bar"); +> + migrate_add_blocker(qxl->migration_blocker, +> &local_err); +> + } +> + +Should the blocker be removed on reset? + +Looks and works ok otherwise + + +> + } +> + } +> trace_qxl_ring_command_get(qxl->id, +> qxl_mode_to_string(qxl->mode)); +> return true; +> default: +> -- +> 2.9.3 +> +> -- +Marc-André Lureau + + +Cc: <email address hidden> +Signed-off-by: Gerd Hoffmann <email address hidden> +--- + hw/display/qxl.h | 1 + + hw/display/qxl.c | 28 ++++++++++++++++++++++++++++ + 2 files changed, 29 insertions(+) + +diff --git a/hw/display/qxl.h b/hw/display/qxl.h +index d2d49dd..77e5a36 100644 +--- a/hw/display/qxl.h ++++ b/hw/display/qxl.h +@@ -40,6 +40,7 @@ typedef struct PCIQXLDevice { + uint32_t cmdlog; + + uint32_t guest_bug; ++ Error *migration_blocker; + + enum qxl_mode mode; + uint32_t cmdflags; +diff --git a/hw/display/qxl.c b/hw/display/qxl.c +index c31b293..c1f830c 100644 +--- a/hw/display/qxl.c ++++ b/hw/display/qxl.c +@@ -26,6 +26,7 @@ + #include "qemu/queue.h" + #include "qemu/atomic.h" + #include "sysemu/sysemu.h" ++#include "migration/migration.h" + #include "trace.h" + + #include "qxl.h" +@@ -639,6 +640,27 @@ static int interface_get_command(QXLInstance *sin, struct QXLCommandExt *ext) + qxl->guest_primary.commands++; + qxl_track_command(qxl, ext); + qxl_log_command(qxl, "cmd", ext); ++ { ++ /* ++ * Windows 8 drivers place qxl commands in the vram ++ * (instead of the ram) bar. We can't live migrate such a ++ * guest, so add a migration blocker in case we detect ++ * this, to avoid triggering the assert in pre_save(). ++ * ++ * https://cgit.freedesktop.org/spice/win32/qxl-wddm-dod/commit/?id=f6e099db39e7d0787f294d5fd0dce328b5210faa ++ */ ++ void *msg = qxl_phys2virt(qxl, ext->cmd.data, ext->group_id); ++ if (msg != NULL && ( ++ msg < (void *)qxl->vga.vram_ptr || ++ msg > ((void *)qxl->vga.vram_ptr + qxl->vga.vram_size))) { ++ if (!qxl->migration_blocker) { ++ Error *local_err = NULL; ++ error_setg(&qxl->migration_blocker, ++ "qxl: guest bug: command not in ram bar"); ++ migrate_add_blocker(qxl->migration_blocker, &local_err); ++ } ++ } ++ } + trace_qxl_ring_command_get(qxl->id, qxl_mode_to_string(qxl->mode)); + return true; + default: +@@ -1236,6 +1258,12 @@ static void qxl_hard_reset(PCIQXLDevice *d, int loadvm) + qemu_spice_create_host_memslot(&d->ssd); + qxl_soft_reset(d); + ++ if (d->migration_blocker) { ++ migrate_del_blocker(d->migration_blocker); ++ error_free(d->migration_blocker); ++ d->migration_blocker = NULL; ++ } ++ + if (startstop) { + qemu_spice_display_start(); + } +-- +2.9.3 + + + +Hi + +On Mon, Apr 10, 2017 at 12:27 PM Gerd Hoffmann <email address hidden> wrote: + +> Cc: <email address hidden> +> Signed-off-by: Gerd Hoffmann <email address hidden> +> +--- +> hw/display/qxl.h | 1 + +> hw/display/qxl.c | 28 ++++++++++++++++++++++++++++ +> 2 files changed, 29 insertions(+) +> +> diff --git a/hw/display/qxl.h b/hw/display/qxl.h +> index d2d49dd..77e5a36 100644 +> --- a/hw/display/qxl.h +> +++ b/hw/display/qxl.h +> @@ -40,6 +40,7 @@ typedef struct PCIQXLDevice { +> uint32_t cmdlog; +> +> uint32_t guest_bug; +> + Error *migration_blocker; +> +> enum qxl_mode mode; +> uint32_t cmdflags; +> diff --git a/hw/display/qxl.c b/hw/display/qxl.c +> index c31b293..c1f830c 100644 +> --- a/hw/display/qxl.c +> +++ b/hw/display/qxl.c +> @@ -26,6 +26,7 @@ +> #include "qemu/queue.h" +> #include "qemu/atomic.h" +> #include "sysemu/sysemu.h" +> +#include "migration/migration.h" +> #include "trace.h" +> +> #include "qxl.h" +> @@ -639,6 +640,27 @@ static int interface_get_command(QXLInstance *sin, +> struct QXLCommandExt *ext) +> qxl->guest_primary.commands++; +> qxl_track_command(qxl, ext); +> qxl_log_command(qxl, "cmd", ext); +> + { +> + /* +> + * Windows 8 drivers place qxl commands in the vram +> + * (instead of the ram) bar. We can't live migrate such a +> + * guest, so add a migration blocker in case we detect +> + * this, to avoid triggering the assert in pre_save(). +> + * +> + * +> https://cgit.freedesktop.org/spice/win32/qxl-wddm-dod/commit/?id=f6e099db39e7d0787f294d5fd0dce328b5210faa +> + */ +> + void *msg = qxl_phys2virt(qxl, ext->cmd.data, ext->group_id); +> + if (msg != NULL && ( +> + msg < (void *)qxl->vga.vram_ptr || +> + msg > ((void *)qxl->vga.vram_ptr + +> qxl->vga.vram_size))) { +> + if (!qxl->migration_blocker) { +> + Error *local_err = NULL; +> + error_setg(&qxl->migration_blocker, +> + "qxl: guest bug: command not in ram bar"); +> + migrate_add_blocker(qxl->migration_blocker, +> &local_err); +> + +What do you do with the local_err? error_report_err() perhaps ? + + +> + } +> + } +> + } +> trace_qxl_ring_command_get(qxl->id, +> qxl_mode_to_string(qxl->mode)); +> return true; +> default: +> @@ -1236,6 +1258,12 @@ static void qxl_hard_reset(PCIQXLDevice *d, int +> loadvm) +> qemu_spice_create_host_memslot(&d->ssd); +> qxl_soft_reset(d); +> +> + if (d->migration_blocker) { +> + migrate_del_blocker(d->migration_blocker); +> + error_free(d->migration_blocker); +> + d->migration_blocker = NULL; +> + } +> + +> if (startstop) { +> qemu_spice_display_start(); +> } +> -- +> 2.9.3 +> +> -- +Marc-André Lureau + + + Hi, + +> > + if (!qxl->migration_blocker) { +> > + Error *local_err = NULL; +> > + error_setg(&qxl->migration_blocker, +> > + "qxl: guest bug: command not in ram bar"); +> > + migrate_add_blocker(qxl->migration_blocker, +> > &local_err); +> > +> +> What do you do with the local_err? error_report_err() perhaps ? + +We can't error out at that point, unlike most migration blockers this +isn't added at device initialization time. + +So, yes, we could error_report it, but the message would end up in the +logfile unnoticed, so I'm not sure how useful that is ... + +cheers, + Gerd + + + +Hi + +On Mon, Apr 10, 2017 at 12:51 PM Gerd Hoffmann <email address hidden> wrote: + +> Hi, +> +> > > + if (!qxl->migration_blocker) { +> > > + Error *local_err = NULL; +> > > + error_setg(&qxl->migration_blocker, +> > > + "qxl: guest bug: command not in ram +> bar"); +> > > + migrate_add_blocker(qxl->migration_blocker, +> > > &local_err); +> > > +> > +> > What do you do with the local_err? error_report_err() perhaps ? +> +> We can't error out at that point, unlike most migration blockers this +> isn't added at device initialization time. +> +> So, yes, we could error_report it, but the message would end up in the +> logfile unnoticed, so I'm not sure how useful that is ... +> + +Well, it may eventually be read if something breaks. Otherwise, you may +just pass a NULL pointer, no? + +thanks +-- +Marc-André Lureau + + +Cc: <email address hidden> +Signed-off-by: Gerd Hoffmann <email address hidden> +--- + hw/display/qxl.h | 1 + + hw/display/qxl.c | 31 +++++++++++++++++++++++++++++++ + 2 files changed, 32 insertions(+) + +diff --git a/hw/display/qxl.h b/hw/display/qxl.h +index d2d49dd..77e5a36 100644 +--- a/hw/display/qxl.h ++++ b/hw/display/qxl.h +@@ -40,6 +40,7 @@ typedef struct PCIQXLDevice { + uint32_t cmdlog; + + uint32_t guest_bug; ++ Error *migration_blocker; + + enum qxl_mode mode; + uint32_t cmdflags; +diff --git a/hw/display/qxl.c b/hw/display/qxl.c +index c31b293..9feae78 100644 +--- a/hw/display/qxl.c ++++ b/hw/display/qxl.c +@@ -26,6 +26,7 @@ + #include "qemu/queue.h" + #include "qemu/atomic.h" + #include "sysemu/sysemu.h" ++#include "migration/migration.h" + #include "trace.h" + + #include "qxl.h" +@@ -639,6 +640,30 @@ static int interface_get_command(QXLInstance *sin, struct QXLCommandExt *ext) + qxl->guest_primary.commands++; + qxl_track_command(qxl, ext); + qxl_log_command(qxl, "cmd", ext); ++ { ++ /* ++ * Windows 8 drivers place qxl commands in the vram ++ * (instead of the ram) bar. We can't live migrate such a ++ * guest, so add a migration blocker in case we detect ++ * this, to avoid triggering the assert in pre_save(). ++ * ++ * https://cgit.freedesktop.org/spice/win32/qxl-wddm-dod/commit/?id=f6e099db39e7d0787f294d5fd0dce328b5210faa ++ */ ++ void *msg = qxl_phys2virt(qxl, ext->cmd.data, ext->group_id); ++ if (msg != NULL && ( ++ msg < (void *)qxl->vga.vram_ptr || ++ msg > ((void *)qxl->vga.vram_ptr + qxl->vga.vram_size))) { ++ if (!qxl->migration_blocker) { ++ Error *local_err = NULL; ++ error_setg(&qxl->migration_blocker, ++ "qxl: guest bug: command not in ram bar"); ++ migrate_add_blocker(qxl->migration_blocker, &local_err); ++ if (local_err) { ++ error_report_err(local_err); ++ } ++ } ++ } ++ } + trace_qxl_ring_command_get(qxl->id, qxl_mode_to_string(qxl->mode)); + return true; + default: +@@ -1236,6 +1261,12 @@ static void qxl_hard_reset(PCIQXLDevice *d, int loadvm) + qemu_spice_create_host_memslot(&d->ssd); + qxl_soft_reset(d); + ++ if (d->migration_blocker) { ++ migrate_del_blocker(d->migration_blocker); ++ error_free(d->migration_blocker); ++ d->migration_blocker = NULL; ++ } ++ + if (startstop) { + qemu_spice_display_start(); + } +-- +2.9.3 + + + +Is this problem limited to commands or also to data attached to the commands? +To me looks like a limitation Qemu should remove on the long run. + +Hi + +On Mon, Apr 10, 2017 at 1:31 PM Gerd Hoffmann <email address hidden> wrote: + +> Cc: <email address hidden> +> Signed-off-by: Gerd Hoffmann <email address hidden> +> + + +Reviewed-by: Marc-André Lureau <email address hidden> + + + +> --- +> hw/display/qxl.h | 1 + +> hw/display/qxl.c | 31 +++++++++++++++++++++++++++++++ +> 2 files changed, 32 insertions(+) +> +> diff --git a/hw/display/qxl.h b/hw/display/qxl.h +> index d2d49dd..77e5a36 100644 +> --- a/hw/display/qxl.h +> +++ b/hw/display/qxl.h +> @@ -40,6 +40,7 @@ typedef struct PCIQXLDevice { +> uint32_t cmdlog; +> +> uint32_t guest_bug; +> + Error *migration_blocker; +> +> enum qxl_mode mode; +> uint32_t cmdflags; +> diff --git a/hw/display/qxl.c b/hw/display/qxl.c +> index c31b293..9feae78 100644 +> --- a/hw/display/qxl.c +> +++ b/hw/display/qxl.c +> @@ -26,6 +26,7 @@ +> #include "qemu/queue.h" +> #include "qemu/atomic.h" +> #include "sysemu/sysemu.h" +> +#include "migration/migration.h" +> #include "trace.h" +> +> #include "qxl.h" +> @@ -639,6 +640,30 @@ static int interface_get_command(QXLInstance *sin, +> struct QXLCommandExt *ext) +> qxl->guest_primary.commands++; +> qxl_track_command(qxl, ext); +> qxl_log_command(qxl, "cmd", ext); +> + { +> + /* +> + * Windows 8 drivers place qxl commands in the vram +> + * (instead of the ram) bar. We can't live migrate such a +> + * guest, so add a migration blocker in case we detect +> + * this, to avoid triggering the assert in pre_save(). +> + * +> + * +> https://cgit.freedesktop.org/spice/win32/qxl-wddm-dod/commit/?id=f6e099db39e7d0787f294d5fd0dce328b5210faa +> + */ +> + void *msg = qxl_phys2virt(qxl, ext->cmd.data, ext->group_id); +> + if (msg != NULL && ( +> + msg < (void *)qxl->vga.vram_ptr || +> + msg > ((void *)qxl->vga.vram_ptr + +> qxl->vga.vram_size))) { +> + if (!qxl->migration_blocker) { +> + Error *local_err = NULL; +> + error_setg(&qxl->migration_blocker, +> + "qxl: guest bug: command not in ram bar"); +> + migrate_add_blocker(qxl->migration_blocker, +> &local_err); +> + if (local_err) { +> + error_report_err(local_err); +> + } +> + } +> + } +> + } +> trace_qxl_ring_command_get(qxl->id, +> qxl_mode_to_string(qxl->mode)); +> return true; +> default: +> @@ -1236,6 +1261,12 @@ static void qxl_hard_reset(PCIQXLDevice *d, int +> loadvm) +> qemu_spice_create_host_memslot(&d->ssd); +> qxl_soft_reset(d); +> +> + if (d->migration_blocker) { +> + migrate_del_blocker(d->migration_blocker); +> + error_free(d->migration_blocker); +> + d->migration_blocker = NULL; +> + } +> + +> if (startstop) { +> qemu_spice_display_start(); +> } +> -- +> 2.9.3 +> +> -- +Marc-André Lureau + + +On Mo, 2017-04-10 at 11:56 +0000, Frediano Ziglio wrote: +> Is this problem limited to commands or also to data attached to the commands? + +Everything which contains QXLReleaseInfo and is released via release +ring. + +> To me looks like a limitation Qemu should remove on the long run. + +That is an option, but it is tricky backward-compatibility wise. +What was the reason to move the commands to bar1? + +cheers, + Gerd + + + +Cc: <email address hidden> +Signed-off-by: Gerd Hoffmann <email address hidden> +Reviewed-by: Marc-André Lureau <email address hidden> +Message-id: <email address hidden> +--- + hw/display/qxl.h | 1 + + hw/display/qxl.c | 31 +++++++++++++++++++++++++++++++ + 2 files changed, 32 insertions(+) + +diff --git a/hw/display/qxl.h b/hw/display/qxl.h +index d2d49dd..77e5a36 100644 +--- a/hw/display/qxl.h ++++ b/hw/display/qxl.h +@@ -40,6 +40,7 @@ typedef struct PCIQXLDevice { + uint32_t cmdlog; + + uint32_t guest_bug; ++ Error *migration_blocker; + + enum qxl_mode mode; + uint32_t cmdflags; +diff --git a/hw/display/qxl.c b/hw/display/qxl.c +index c31b293..9feae78 100644 +--- a/hw/display/qxl.c ++++ b/hw/display/qxl.c +@@ -26,6 +26,7 @@ + #include "qemu/queue.h" + #include "qemu/atomic.h" + #include "sysemu/sysemu.h" ++#include "migration/migration.h" + #include "trace.h" + + #include "qxl.h" +@@ -639,6 +640,30 @@ static int interface_get_command(QXLInstance *sin, struct QXLCommandExt *ext) + qxl->guest_primary.commands++; + qxl_track_command(qxl, ext); + qxl_log_command(qxl, "cmd", ext); ++ { ++ /* ++ * Windows 8 drivers place qxl commands in the vram ++ * (instead of the ram) bar. We can't live migrate such a ++ * guest, so add a migration blocker in case we detect ++ * this, to avoid triggering the assert in pre_save(). ++ * ++ * https://cgit.freedesktop.org/spice/win32/qxl-wddm-dod/commit/?id=f6e099db39e7d0787f294d5fd0dce328b5210faa ++ */ ++ void *msg = qxl_phys2virt(qxl, ext->cmd.data, ext->group_id); ++ if (msg != NULL && ( ++ msg < (void *)qxl->vga.vram_ptr || ++ msg > ((void *)qxl->vga.vram_ptr + qxl->vga.vram_size))) { ++ if (!qxl->migration_blocker) { ++ Error *local_err = NULL; ++ error_setg(&qxl->migration_blocker, ++ "qxl: guest bug: command not in ram bar"); ++ migrate_add_blocker(qxl->migration_blocker, &local_err); ++ if (local_err) { ++ error_report_err(local_err); ++ } ++ } ++ } ++ } + trace_qxl_ring_command_get(qxl->id, qxl_mode_to_string(qxl->mode)); + return true; + default: +@@ -1236,6 +1261,12 @@ static void qxl_hard_reset(PCIQXLDevice *d, int loadvm) + qemu_spice_create_host_memslot(&d->ssd); + qxl_soft_reset(d); + ++ if (d->migration_blocker) { ++ migrate_del_blocker(d->migration_blocker); ++ error_free(d->migration_blocker); ++ d->migration_blocker = NULL; ++ } ++ + if (startstop) { + qemu_spice_display_start(); + } +-- +2.9.3 + + + +Did I miss something or this is a bug in the windows qxl driver and should be fixed there? + +Will be fixed in the windows driver, yes. + +But throwing core dumps isn't exactly nice, even in case the guest is buggy, thats why the qemu workaround, so we simply refuse to live-migrate instead of crashing. + +Next version of the driver will solve the problem (already fixed in master). + +Similar issue, seems not caused by save/restore/migration but is still detecting offset problems with resource deallocation. +See https://lists.freedesktop.org/archives/spice-devel/2017-April/037248.html. + +Still working on some updates for the driver. + +wddm dod 0.17 version released which fixes the issue guest side. + +Patch had been merged here: +https://git.qemu.org/?p=qemu.git;a=commitdiff;h=86dbcdd9c7590d06db89ca +... thus closing this ticket now. + diff --git a/results/classifier/118/none/1639 b/results/classifier/118/none/1639 new file mode 100644 index 00000000..be8bcdfb --- /dev/null +++ b/results/classifier/118/none/1639 @@ -0,0 +1,31 @@ +device: 0.797 +performance: 0.716 +architecture: 0.648 +user-level: 0.568 +network: 0.500 +graphic: 0.496 +mistranslation: 0.388 +virtual: 0.331 +peripherals: 0.329 +semantic: 0.319 +permissions: 0.297 +debug: 0.226 +register: 0.201 +files: 0.197 +assembly: 0.155 +ppc: 0.127 +hypervisor: 0.115 +PID: 0.114 +socket: 0.090 +TCG: 0.088 +boot: 0.067 +VMM: 0.050 +vnc: 0.048 +risc-v: 0.036 +arm: 0.034 +x86: 0.030 +KVM: 0.025 +kernel: 0.023 +i386: 0.016 + +No supported machine for loongson-3A4000 mips64el |