qemu.git
7 years agoAioContext: optimize clearing the EventNotifier
Paolo Bonzini [Tue, 21 Jul 2015 14:07:53 +0000 (16:07 +0200)] 
AioContext: optimize clearing the EventNotifier

It is pretty rare for aio_notify to actually set the EventNotifier.  It
can happen with worker threads such as thread-pool.c's, but otherwise it
should never be set thanks to the ctx->notify_me optimization.  The
previous patch, unfortunately, added an unconditional call to
event_notifier_test_and_clear; now add a userspace fast path that
avoids the call.

Note that it is not possible to do the same with event_notifier_set;
it would break, as proved (again) by the included formal model.

This patch survived over 3000 reboots on aarch64 KVM.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Fam Zheng <famz@redhat.com>
Tested-by: Richard W.M. Jones <rjones@redhat.com>
Message-id: 1437487673-23740-7-git-send-email-pbonzini@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
7 years agoAioContext: fix broken placement of event_notifier_test_and_clear
Paolo Bonzini [Tue, 21 Jul 2015 14:07:52 +0000 (16:07 +0200)] 
AioContext: fix broken placement of event_notifier_test_and_clear

event_notifier_test_and_clear must be called before processing events.
Otherwise, an aio_poll could "eat" the notification before the main
I/O thread invokes ppoll().  The main I/O thread then never wakes up.
This is an example of what could happen:

   i/o thread       vcpu thread                     worker thread
   ---------------------------------------------------------------------
   lock_iothread
   notify_me = 1
   ...
   unlock_iothread
                                                     bh->scheduled = 1
                                                     event_notifier_set
                    lock_iothread
                    notify_me = 3
                    ppoll
                    notify_me = 1
                    aio_dispatch
                     aio_bh_poll
                      thread_pool_completion_bh
                                                     bh->scheduled = 1
                                                     event_notifier_set
                     node->io_read(node->opaque)
                      event_notifier_test_and_clear
   ppoll
   *** hang ***

"Tracing" with qemu_clock_get_ns shows pretty much the same behavior as
in the previous bug, so there are no new tricks here---just stare more
at the code until it is apparent.

One could also use a formal model, of course.  The included one shows
this with three processes: notifier corresponds to a QEMU thread pool
worker, temporary_waiter to a VCPU thread that invokes aio_poll(),
waiter to the main I/O thread.  I would be happy to say that the
formal model found the bug for me, but actually I wrote it after the
fact.

This patch is a bit of a big hammer.  The next one optimizes it,
with help (this time for real rather than a posteriori :)) from
another, similar formal model.

Reported-by: Richard W. M. Jones <rjones@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Fam Zheng <famz@redhat.com>
Tested-by: Richard W.M. Jones <rjones@redhat.com>
Message-id: 1437487673-23740-6-git-send-email-pbonzini@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
7 years agoAioContext: fix broken ctx->dispatching optimization
Paolo Bonzini [Tue, 21 Jul 2015 14:07:51 +0000 (16:07 +0200)] 
AioContext: fix broken ctx->dispatching optimization

This patch rewrites the ctx->dispatching optimization, which was the cause
of some mysterious hangs that could be reproduced on aarch64 KVM only.
The hangs were indirectly caused by aio_poll() and in particular by
flash memory updates's call to blk_write(), which invokes aio_poll().
Fun stuff: they had an extremely short race window, so much that
adding all kind of tracing to either the kernel or QEMU made it
go away (a single printf made it half as reproducible).

On the plus side, the failure mode (a hang until the next keypress)
made it very easy to examine the state of the process with a debugger.
And there was a very nice reproducer from Laszlo, which failed pretty
often (more than half of the time) on any version of QEMU with a non-debug
kernel; it also failed fast, while still in the firmware.  So, it could
have been worse.

For some unknown reason they happened only with virtio-scsi, but
that's not important.  It's more interesting that they disappeared with
io=native, making thread-pool.c a likely suspect for where the bug arose.
thread-pool.c is also one of the few places which use bottom halves
across threads, by the way.

I hope that no other similar bugs exist, but just in case :) I am
going to describe how the successful debugging went...  Since the
likely culprit was the ctx->dispatching optimization, which mostly
affects bottom halves, the first observation was that there are two
qemu_bh_schedule() invocations in the thread pool: the one in the aio
worker and the one in thread_pool_completion_bh.  The latter always
causes the optimization to trigger, the former may or may not.  In
order to restrict the possibilities, I introduced new functions
qemu_bh_schedule_slow() and qemu_bh_schedule_fast():

     /* qemu_bh_schedule_slow: */
     ctx = bh->ctx;
     bh->idle = 0;
     if (atomic_xchg(&bh->scheduled, 1) == 0) {
         event_notifier_set(&ctx->notifier);
     }

     /* qemu_bh_schedule_fast: */
     ctx = bh->ctx;
     bh->idle = 0;
     assert(ctx->dispatching);
     atomic_xchg(&bh->scheduled, 1);

Notice how the atomic_xchg is still in qemu_bh_schedule_slow().  This
was already debated a few months ago, so I assumed it to be correct.
In retrospect this was a very good idea, as you'll see later.

Changing thread_pool_completion_bh() to qemu_bh_schedule_fast() didn't
trigger the assertion (as expected).  Changing the worker's invocation
to qemu_bh_schedule_slow() didn't hide the bug (another assumption
which luckily held).  This already limited heavily the amount of
interaction between the threads, hinting that the problematic events
must have triggered around thread_pool_completion_bh().

As mentioned early, invoking a debugger to examine the state of a
hung process was pretty easy; the iothread was always waiting on a
poll(..., -1) system call.  Infinite timeouts are much rarer on x86,
and this could be the reason why the bug was never observed there.
With the buggy sequence more or less resolved to an interaction between
thread_pool_completion_bh() and poll(..., -1), my "tracing" strategy was
to just add a few qemu_clock_get_ns(QEMU_CLOCK_REALTIME) calls, hoping
that the ordering of aio_ctx_prepare(), aio_ctx_dispatch, poll() and
qemu_bh_schedule_fast() would provide some hint.  The output was:

    (gdb) p last_prepare
    $3 = 103885451
    (gdb) p last_dispatch
    $4 = 103876492
    (gdb) p last_poll
    $5 = 115909333
    (gdb) p last_schedule
    $6 = 115925212

Notice how the last call to qemu_poll_ns() came after aio_ctx_dispatch().
This makes little sense unless there is an aio_poll() call involved,
and indeed with a slightly different instrumentation you can see that
there is one:

    (gdb) p last_prepare
    $3 = 107569679
    (gdb) p last_dispatch
    $4 = 107561600
    (gdb) p last_aio_poll
    $5 = 110671400
    (gdb) p last_schedule
    $6 = 110698917

So the scenario becomes clearer:

   iothread                   VCPU thread
--------------------------------------------------------------------------
   aio_ctx_prepare
   aio_ctx_check
   qemu_poll_ns(timeout=-1)
                              aio_poll
                                aio_dispatch
                                  thread_pool_completion_bh
                                    qemu_bh_schedule()

At this point bh->scheduled = 1 and the iothread has not been woken up.
The solution must be close, but this alone should not be a problem,
because the bottom half is only rescheduled to account for rare situations
(see commit 3c80ca1, thread-pool: avoid deadlock in nested aio_poll()
calls, 2014-07-15).

Introducing a third thread---a thread pool worker thread, which
also does qemu_bh_schedule()---does bring out the problematic case.
The third thread must be awakened *after* the callback is complete and
thread_pool_completion_bh has redone the whole loop, explaining the
short race window.  And then this is what happens:

                                                      thread pool worker
--------------------------------------------------------------------------
                                                      <I/O completes>
                                                      qemu_bh_schedule()

Tada, bh->scheduled is already 1, so qemu_bh_schedule() does nothing
and the iothread is never woken up.  This is where the bh->scheduled
optimization comes into play---it is correct, but removing it would
have masked the bug.

So, what is the bug?

Well, the question asked by the ctx->dispatching optimization ("is any
active aio_poll dispatching?") was wrong.  The right question to ask
instead is "is any active aio_poll *not* dispatching", i.e. in the prepare
or poll phases?  In that case, the aio_poll is sleeping or might go to
sleep anytime soon, and the EventNotifier must be invoked to wake
it up.

In any other case (including if there is *no* active aio_poll at all!)
we can just wait for the next prepare phase to pick up the event (e.g. a
bottom half); the prepare phase will avoid the blocking and service the
bottom half.

Expressing the invariant with a logic formula, the broken one looked like:

   !(exists(thread): in_dispatching(thread)) => !optimize

or equivalently:

   !(exists(thread):
          in_aio_poll(thread) && in_dispatching(thread)) => !optimize

In the correct one, the negation is in a slightly different place:

   (exists(thread):
         in_aio_poll(thread) && !in_dispatching(thread)) => !optimize

or equivalently:

   (exists(thread): in_prepare_or_poll(thread)) => !optimize

Even if the difference boils down to moving an exclamation mark :)
the implementation is quite different.  However, I think the new
one is simpler to understand.

In the old implementation, the "exists" was implemented with a boolean
value.  This didn't really support well the case of multiple concurrent
event loops, but I thought that this was okay: aio_poll holds the
AioContext lock so there cannot be concurrent aio_poll invocations, and
I was just considering nested event loops.  However, aio_poll _could_
indeed be concurrent with the GSource.  This is why I came up with the
wrong invariant.

In the new implementation, "exists" is computed simply by counting how many
threads are in the prepare or poll phases.  There are some interesting
points to consider, but the gist of the idea remains:

1) AioContext can be used through GSource as well; as mentioned in the
patch, bit 0 of the counter is reserved for the GSource.

2) the counter need not be updated for a non-blocking aio_poll, because
it won't sleep forever anyway.  This is just a matter of checking
the "blocking" variable.  This requires some changes to the win32
implementation, but is otherwise not too complicated.

3) as mentioned above, the new implementation will not call aio_notify
when there is *no* active aio_poll at all.  The tests have to be
adjusted for this change.  The calls to aio_notify in async.c are fine;
they only want to kick aio_poll out of a blocking wait, but need not
do anything if aio_poll is not running.

4) nested aio_poll: these just work with the new implementation; when
a nested event loop is invoked, the outer event loop is never in the
prepare or poll phases.  The outer event loop thus has already decremented
the counter.

Reported-by: Richard W. M. Jones <rjones@redhat.com>
Reported-by: Laszlo Ersek <lersek@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Fam Zheng <famz@redhat.com>
Tested-by: Richard W.M. Jones <rjones@redhat.com>
Message-id: 1437487673-23740-5-git-send-email-pbonzini@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
7 years agoaio-win32: reorganize polling loop
Paolo Bonzini [Tue, 21 Jul 2015 14:07:50 +0000 (16:07 +0200)] 
aio-win32: reorganize polling loop

Preparatory bugfixes and tweaks to the loop before the next patch:

- disable dispatch optimization during aio_prepare.  This fixes a bug.

- do not modify "blocking" until after the first WaitForMultipleObjects
call.  This is needed in the next patch.

- change the loop to do...while.  This makes it obvious that the loop
is always entered at least once.  In the next patch this is important
because the first iteration undoes the ctx->notify_me increment that
happened before entering the loop.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Fam Zheng <famz@redhat.com>
Tested-by: Richard W.M. Jones <rjones@redhat.com>
Message-id: 1437487673-23740-4-git-send-email-pbonzini@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
7 years agotests: remove irrelevant assertions from test-aio
Paolo Bonzini [Tue, 21 Jul 2015 14:07:49 +0000 (16:07 +0200)] 
tests: remove irrelevant assertions from test-aio

In these tests, the purpose of the initial calls to aio_poll and
g_main_context_iteration is simply to put the AioContext in a
known state; the return value of the function does not really
matter.  The next patch will change those return values; change
the assertions to a while loop which expresses the intention
better.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Fam Zheng <famz@redhat.com>
Tested-by: Richard W.M. Jones <rjones@redhat.com>
Message-id: 1437487673-23740-3-git-send-email-pbonzini@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
7 years agoqemu-timer: initialize "timers_done_ev" to set
Paolo Bonzini [Tue, 21 Jul 2015 14:07:48 +0000 (16:07 +0200)] 
qemu-timer: initialize "timers_done_ev" to set

The normal value for the event is to be set.  If we do not do
this, pause_all_vcpus (through qemu_clock_enable) hangs unless
timerlist_run_timers has been run at least once for the timerlist.
This can happen with the following patches, that make aio_notify do
nothing most of the time.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Fam Zheng <famz@redhat.com>
Tested-by: Richard W.M. Jones <rjones@redhat.com>
Message-id: 1437487673-23740-2-git-send-email-pbonzini@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
7 years agomirror: Speed up bitmap initial scanning
Fam Zheng [Thu, 9 Jul 2015 03:47:58 +0000 (11:47 +0800)] 
mirror: Speed up bitmap initial scanning

Limiting to sectors_per_chunk for each bdrv_is_allocated_above is slow,
because the underlying protocol driver would issue much more queries
than necessary. We should coalesce the query.

Signed-off-by: Fam Zheng <famz@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: <1436413678-7114-4-git-send-email-famz@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
7 years agoMerge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20150721' into...
Peter Maydell [Tue, 21 Jul 2015 11:21:08 +0000 (12:21 +0100)] 
Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20150721' into staging

target-arm queue:
 * don't sync CNTVCT with kernel all the time (fixes VM time weirdnesses)
 * fix a warning compiling disas/arm-a64 with -Wextra

# gpg: Signature made Tue Jul 21 12:15:33 2015 BST using RSA key ID 14360CDE
# gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>"

* remotes/pmaydell/tags/pull-target-arm-20150721:
  disas/arm-a64: Add missing compiler attribute GCC_FMT_ATTR
  target-arm: kvm: Differentiate registers based on write-back levels

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
7 years agodisas/arm-a64: Add missing compiler attribute GCC_FMT_ATTR
Stefan Weil [Tue, 21 Jul 2015 10:18:45 +0000 (11:18 +0100)] 
disas/arm-a64: Add missing compiler attribute GCC_FMT_ATTR

Type fprintf_function which fits here was defined with this attribute.

Signed-off-by: Stefan Weil <sw@weilnetz.de>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 1437208027-14584-1-git-send-email-sw@weilnetz.de
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
7 years agotarget-arm: kvm: Differentiate registers based on write-back levels
Christoffer Dall [Tue, 21 Jul 2015 10:18:45 +0000 (11:18 +0100)] 
target-arm: kvm: Differentiate registers based on write-back levels

Some registers like the CNTVCT register should only be written to the
kernel as part of machine initialization or on vmload operations, but
never during runtime, as this can potentially make time go backwards or
create inconsistent time observations between VCPUs.

Introduce a list of registers that should not be written back at runtime
and check this list on syncing the register state to the KVM state.

Signed-off-by: Christoffer Dall <christoffer.dall@linaro.org>
Message-id: 1437046488-10773-1-git-send-email-christoffer.dall@linaro.org
[PMM: tweaked a few comments, added the new argument to the stub
 write_list_to_kvmstate() in target-arm/kvm-stub.c]
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
7 years agoMerge remote-tracking branch 'remotes/jnsnow/tags/ide-pull-request' into staging
Peter Maydell [Tue, 21 Jul 2015 09:04:32 +0000 (10:04 +0100)] 
Merge remote-tracking branch 'remotes/jnsnow/tags/ide-pull-request' into staging

# gpg: Signature made Mon Jul 20 19:27:04 2015 BST using RSA key ID AAFC390E
# gpg: Good signature from "John Snow (John Huston) <jsnow@redhat.com>"
# gpg: WARNING: This key is not certified with sufficiently trusted signatures!
# gpg:          It is not certain that the signature belongs to the owner.
# Primary key fingerprint: FAEB 9711 A12C F475 812F  18F2 88A9 064D 1835 61EB
#      Subkey fingerprint: F9B7 ABDB BCAC DF95 BE76  CBD0 7DEF 8106 AAFC 390E

* remotes/jnsnow/tags/ide-pull-request:
  tests: Fix broken targets check-report-qtest-*
  ahci: Force ICC bits in PxCMD to zero
  qtest/ide: add another short PRDT test flavor

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
7 years agotests: Fix broken targets check-report-qtest-*
Stefan Weil [Mon, 20 Jul 2015 16:21:18 +0000 (12:21 -0400)] 
tests: Fix broken targets check-report-qtest-*

They need QTEST_QEMU_IMG. Without it, the tests raise an assertion:

$ make -C bin check-report-qtest-i386.xml
make: Entering directory 'bin'
GTESTER check-report-qtest-i386.xml
blkdebug: Suspended request 'A'
blkdebug: Resuming request 'A'
ahci-test: tests/libqos/libqos.c:162:
 mkimg: Assertion `qemu_img_path' failed.
main-loop: WARNING: I/O thread spun for 1000 iterations

Signed-off-by: Stefan Weil <sw@weilnetz.de>
Reviewed-by: John Snow <jsnow@redhat.com>
Message-id: 1437231284-17455-1-git-send-email-sw@weilnetz.de
Signed-off-by: John Snow <jsnow@redhat.com>
7 years agoMerge remote-tracking branch 'remotes/stefanha/tags/net-pull-request' into staging
Peter Maydell [Mon, 20 Jul 2015 17:26:53 +0000 (18:26 +0100)] 
Merge remote-tracking branch 'remotes/stefanha/tags/net-pull-request' into staging

# gpg: Signature made Mon Jul 20 18:25:14 2015 BST using RSA key ID 81AB73C8
# gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>"
# gpg:                 aka "Stefan Hajnoczi <stefanha@gmail.com>"

* remotes/stefanha/tags/net-pull-request:
  net: Flush queued packets when guest resumes
  lan9118: Drop lan9118_can_receive
  etraxfs_eth: Drop eth_can_receive
  musicpal: Drop eth_can_receive
  net/vmxnet3: Fix RX TCP/UDP checksum on partially summed packets
  net/vmxnet3: Refactor 'vmxnet_rx_pkt_attach_data'
  socket: pass correct size in net_socket_send()

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
7 years agonet: Flush queued packets when guest resumes
Fam Zheng [Tue, 7 Jul 2015 01:21:07 +0000 (09:21 +0800)] 
net: Flush queued packets when guest resumes

Since commit 6e99c63 "net/socket: Drop net_socket_can_send" and friends,
net queues need to be explicitly flushed after qemu_can_send_packet()
returns false, because the netdev side will disable the polling of fd.

This fixes the case of "cont" after "stop" (or migration).

Signed-off-by: Fam Zheng <famz@redhat.com>
Message-id: 1436232067-29144-1-git-send-email-famz@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
7 years agolan9118: Drop lan9118_can_receive
Fam Zheng [Wed, 1 Jul 2015 07:10:47 +0000 (15:10 +0800)] 
lan9118: Drop lan9118_can_receive

True is the default.

Signed-off-by: Fam Zheng <famz@redhat.com>
Reviewed-by: Jason Wang <jasowang@redhat.com>
Message-id: 1435734647-8371-4-git-send-email-famz@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
7 years agoetraxfs_eth: Drop eth_can_receive
Fam Zheng [Wed, 1 Jul 2015 07:10:46 +0000 (15:10 +0800)] 
etraxfs_eth: Drop eth_can_receive

True is the default.

Signed-off-by: Fam Zheng <famz@redhat.com>
Reviewed-by: Jason Wang <jasowang@redhat.com>
Message-id: 1435734647-8371-3-git-send-email-famz@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
7 years agomusicpal: Drop eth_can_receive
Fam Zheng [Wed, 1 Jul 2015 07:10:45 +0000 (15:10 +0800)] 
musicpal: Drop eth_can_receive

True is the default.

Signed-off-by: Fam Zheng <famz@redhat.com>
Reviewed-by: Jason Wang <jasowang@redhat.com>
Message-id: 1435734647-8371-2-git-send-email-famz@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
7 years agonet/vmxnet3: Fix RX TCP/UDP checksum on partially summed packets
Dana Rubin [Tue, 14 Jul 2015 08:55:16 +0000 (11:55 +0300)] 
net/vmxnet3: Fix RX TCP/UDP checksum on partially summed packets

Convert partially summed packets to be fully checksummed.

In case csum offloaded packet, vmxnet3 implementation always passes an
RxCompDesc with the "Checksum calculated and found correct" notification
to the OS. This emulates the observed ESXi behavior.

Therefore, if packet has the NEEDS_CSUM bit set, we must calculate and
place a fully computed checksum into the tcp/udp header. Otherwise, the
OS driver will receive a checksum-correct indication but with the actual
tcp/udp checksum field having just the pseudo header csum value.

If host OS performs forwarding, it will forward an incorrectly
checksummed packet.

Signed-off-by: Dana Rubin <dana.rubin@ravellosystems.com>
Signed-off-by: Shmulik Ladkani <shmulik.ladkani@ravellosystems.com>
Message-id: 1436864116-19154-3-git-send-email-shmulik.ladkani@ravellosystems.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
7 years agonet/vmxnet3: Refactor 'vmxnet_rx_pkt_attach_data'
Shmulik Ladkani [Tue, 14 Jul 2015 08:55:15 +0000 (11:55 +0300)] 
net/vmxnet3: Refactor 'vmxnet_rx_pkt_attach_data'

Separate RX packet protocol parsing out of 'vmxnet_rx_pkt_attach_data'.

Signed-off-by: Shmulik Ladkani <shmulik.ladkani@ravellosystems.com>
Message-id: 1436864116-19154-2-git-send-email-shmulik.ladkani@ravellosystems.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
7 years agosocket: pass correct size in net_socket_send()
Jason Wang [Tue, 7 Jul 2015 09:00:56 +0000 (17:00 +0800)] 
socket: pass correct size in net_socket_send()

We should pass the size of packet instead of the remaining to
qemu_send_packet_async().

Fixes: 6e99c631f116221d169ea53953d91b8aa74d297a
       ("net/socket: Drop net_socket_can_send")

Signed-off-by: Jason Wang <jasowang@redhat.com>
Reviewed-by: Fam Zheng <famz@redhat.com>
Message-id: 1436259656-24263-1-git-send-email-jasowang@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
7 years agoahci: Force ICC bits in PxCMD to zero
Stefan Fritsch [Mon, 20 Jul 2015 16:21:18 +0000 (12:21 -0400)] 
ahci: Force ICC bits in PxCMD to zero

The AHCI spec requires that the HBA sets the ICC bits to zero after the
ICC change is done. Since we don't do any ICC change, force the bits to
zero all the time.

This fixes delays with some OSs (e.g. OpenBSD) waiting for the ICC bits
to change to 0.

Signed-off-by: Stefan Fritsch <sf@sfritsch.de>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: John Snow <jsnow@redhat.com>
Message-id: E1ZFpg7-00027N-HW@eru.sfritsch.de
Signed-off-by: John Snow <jsnow@redhat.com>
7 years agoqtest/ide: add another short PRDT test flavor
Stefan Hajnoczi [Mon, 20 Jul 2015 16:21:18 +0000 (12:21 -0400)] 
qtest/ide: add another short PRDT test flavor

The existing short PRDT test case does not transfer any data because the
first PRD is less than 1 sector.

This patch adds another short PRDT test case where the first sector can
be read but the PRDT is still smaller than the requested number of
sectors.  This exercises a different code path in ide_dma_cb().

Cc: John Snow <jsnow@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: John Snow <jsnow@redhat.com>
Message-id: 1435770571-9906-1-git-send-email-stefanha@redhat.com
Signed-off-by: John Snow <jsnow@redhat.com>
7 years agotimer: rename NSEC_PER_SEC due to Mac OS X header clash
Stefan Hajnoczi [Wed, 8 Jul 2015 14:10:09 +0000 (15:10 +0100)] 
timer: rename NSEC_PER_SEC due to Mac OS X header clash

Commit e0cf11f31c24cfb17f44ed46c254d84c78e7f6e9 ("timer: Use a single
definition of NSEC_PER_SEC for the whole codebase") renamed
NANOSECONDS_PER_SECOND to NSEC_PER_SEC.

On Mac OS X there is a <dispatch/time.h> system header which also
defines NSEC_PER_SEC.  This causes compiler warnings.

Let's use the old name instead.  It's longer but it doesn't clash.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 1436364609-7929-1-git-send-email-stefanha@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
7 years agoMerge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging
Peter Maydell [Mon, 20 Jul 2015 15:01:31 +0000 (16:01 +0100)] 
Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging

Block layer patches for 2.4.0-rc2

# gpg: Signature made Mon Jul 20 15:48:56 2015 BST using RSA key ID C88F2FD6
# gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>"

* remotes/kevin/tags/for-upstream:
  crypto: Fix aes_decrypt_wrapper()

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
7 years agoMerge remote-tracking branch 'remotes/mst/tags/for_upstream' into staging
Peter Maydell [Mon, 20 Jul 2015 12:25:28 +0000 (13:25 +0100)] 
Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into staging

virtio, vhost, pc fixes for 2.4

The only notable thing here is vhost-user multiqueue
revert. We'll work on making it stable in 2.5,
reverting now means we won't have to maintain
bug for bug compability forever.

Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
# gpg: Signature made Mon Jul 20 12:24:00 2015 BST using RSA key ID D28D5469
# gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>"
# gpg:                 aka "Michael S. Tsirkin <mst@redhat.com>"

* remotes/mst/tags/for_upstream:
  virtio-net: remove virtio queues if the guest doesn't support multiqueue
  virtio-net: Flush incoming queues when DRIVER_OK is being set
  pci_add_capability: remove duplicate comments
  virtio-net: unbreak any layout
  Revert "vhost-user: add multi queue support"
  ich9: fix skipped vmstate_memhp_state subsection

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
7 years agocrypto: Fix aes_decrypt_wrapper()
Kevin Wolf [Fri, 17 Jul 2015 17:44:10 +0000 (19:44 +0200)] 
crypto: Fix aes_decrypt_wrapper()

Commit d3462e3 broke qcow2's encryption functionality by using encrypt
instead of decrypt in the wrapper function it introduces. This was found
by qemu-iotests case 134.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Daniel P. Berrange <berrange@redhat.com>
7 years agovirtio-net: remove virtio queues if the guest doesn't support multiqueue
Wen Congyang [Wed, 15 Jul 2015 09:20:59 +0000 (17:20 +0800)] 
virtio-net: remove virtio queues if the guest doesn't support multiqueue

commit da51a335 adds all queues in .realize(). But if the
guest doesn't support multiqueue, we forget to remove them. And
we cannot handle the ctrl vq corretly. The guest will hang.

Signed-off-by: Wen Congyang <wency@cn.fujitsu.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Acked-by: Jason Wang <jasowang@redhat.com>
7 years agovirtio-net: Flush incoming queues when DRIVER_OK is being set
Fam Zheng [Wed, 15 Jul 2015 03:02:27 +0000 (11:02 +0800)] 
virtio-net: Flush incoming queues when DRIVER_OK is being set

This patch fixes network hang after "stop" then "cont", while network
packets keep arriving.

Tested both manually (tap, host pinging guest) and with Jason's qtest
series (plus his "[PATCH 2.4] socket: pass correct size in
net_socket_send()" fix).

As virtio_net_set_status is called when guest driver is setting status
byte and when vm state is changing, it is a good opportunity to flush
queued packets.

This is necessary because during vm stop the backend (e.g. tap) would
stop rx processing after .can_receive returns false, until the queue is
explicitly flushed or purged.

The other interesting condition in .can_receive, virtio_queue_ready(),
is handled by virtio_net_handle_rx() when guest kicks; the 3rd condition
is invalid queue index which doesn't need flushing.

Signed-off-by: Fam Zheng <famz@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
7 years agopci_add_capability: remove duplicate comments
Chen Hanxiao [Tue, 14 Jul 2015 08:16:11 +0000 (16:16 +0800)] 
pci_add_capability: remove duplicate comments

Signed-off-by: Chen Hanxiao <chenhanxiao@cn.fujitsu.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
7 years agovirtio-net: unbreak any layout
Jason Wang [Fri, 17 Jul 2015 07:19:18 +0000 (15:19 +0800)] 
virtio-net: unbreak any layout

Commit 032a74a1c0fcdd5fd1c69e56126b4c857ee36611
("virtio-net: byteswap virtio-net header") breaks any layout by
requiring out_sg[0].iov_len >= n->guest_hdr_len. Fixing this by
copying header to temporary buffer if swap is needed, and then use
this buffer as part of out_sg.

Fixes 032a74a1c0fcdd5fd1c69e56126b4c857ee36611
("virtio-net: byteswap virtio-net header")
Cc: qemu-stable@nongnu.org
Cc: clg@fr.ibm.com
Signed-off-by: Jason Wang <jasowang@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
7 years agoRevert "vhost-user: add multi queue support"
Michael S. Tsirkin [Wed, 15 Jul 2015 10:47:31 +0000 (13:47 +0300)] 
Revert "vhost-user: add multi queue support"

This reverts commit 830d70db692e374b55555f4407f96a1ceefdcc97.

The interface isn't fully backwards-compatible, which is bad.
Let's redo this properly after 2.4.

Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
7 years agoich9: fix skipped vmstate_memhp_state subsection
Paulo Alcantara [Mon, 13 Jul 2015 20:45:42 +0000 (17:45 -0300)] 
ich9: fix skipped vmstate_memhp_state subsection

By declaring another .subsections array for vmstate_tco_io_state made
vmstate_memhp_state not registered anymore. There must be only one
.subsections array for all subsections.

Cc: Michael S. Tsirkin <mst@redhat.com>
Cc: Amit Shah <amit.shah@redhat.com>
Reported-by: Amit Shah <amit.shah@redhat.com>
Signed-off-by: Paulo Alcantara <pcacjr@zytor.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Amit Shah <amit.shah@redhat.com>
7 years agoMerge remote-tracking branch 'remotes/amit-virtio-rng/tags/vrng-2.4' into staging
Peter Maydell [Fri, 17 Jul 2015 14:22:45 +0000 (15:22 +0100)] 
Merge remote-tracking branch 'remotes/amit-virtio-rng/tags/vrng-2.4' into staging

Fire timer only when required.  Brings down wakeups by a big number.

# gpg: Signature made Fri Jul 17 14:41:40 2015 BST using RSA key ID 854083B6
# gpg: Good signature from "Amit Shah <amit@amitshah.net>"
# gpg:                 aka "Amit Shah <amit@kernel.org>"
# gpg:                 aka "Amit Shah <amitshah@gmx.net>"

* remotes/amit-virtio-rng/tags/vrng-2.4:
  virtio-rng: trigger timer only when guest requests for entropy

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
7 years agovirtio-rng: trigger timer only when guest requests for entropy
Pankaj Gupta [Wed, 15 Jul 2015 12:16:47 +0000 (17:46 +0530)] 
virtio-rng: trigger timer only when guest requests for entropy

This patch triggers timer only when guest requests for
entropy. As soon as first request from guest for entropy
comes we set the timer. Timer bumps up the quota value
when it gets triggered.

Signed-off-by: Pankaj Gupta <pagupta@redhat.com>
Reviewed-by: Amit Shah <amit.shah@redhat.com>
Message-Id: <1436962608-9961-2-git-send-email-pagupta@redhat.com>

[Re-worded patch subject, removed extra whitespace -- Amit]

Signed-off-by: Amit Shah <amit.shah@redhat.com>
7 years agoMerge remote-tracking branch 'remotes/kraxel/tags/pull-usb-20150717-1' into staging
Peter Maydell [Fri, 17 Jul 2015 11:39:12 +0000 (12:39 +0100)] 
Merge remote-tracking branch 'remotes/kraxel/tags/pull-usb-20150717-1' into staging

usb: fixes for 2.4 (ccid, xhci and usb-host)

# gpg: Signature made Fri Jul 17 12:21:42 2015 BST using RSA key ID D3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
# gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
# gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

* remotes/kraxel/tags/pull-usb-20150717-1:
  Revert "xhci: set timer to retry xfers"
  usb-ccid: add missing wakeup calls
  usb-ccid: fix 61b4887b41b270bc837ead57bc502d904af023bb
  Re-attach usb device to kernel while usb_host_open fails

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
7 years agoRevert "xhci: set timer to retry xfers"
Gerd Hoffmann [Fri, 17 Jul 2015 08:12:55 +0000 (10:12 +0200)] 
Revert "xhci: set timer to retry xfers"

This reverts commit 4e8cfbe1143d8384387595b500212d7a7f11aeae.

We should not poll via timer, and with ccid being fixed
to properly notify us about pending transfers we don't have to.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
7 years agousb-ccid: add missing wakeup calls
Gerd Hoffmann [Thu, 16 Jul 2015 14:33:07 +0000 (16:33 +0200)] 
usb-ccid: add missing wakeup calls

Properly notify the host adapter that we have
data pending, so it doesn't has to poll us.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
7 years agousb-ccid: fix 61b4887b41b270bc837ead57bc502d904af023bb
Gerd Hoffmann [Fri, 17 Jul 2015 09:34:11 +0000 (11:34 +0200)] 
usb-ccid: fix 61b4887b41b270bc837ead57bc502d904af023bb

QOMification dropped the parent device lookup, fix it.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
7 years agoMerge remote-tracking branch 'remotes/kraxel/tags/pull-input-20150717-1' into staging
Peter Maydell [Fri, 17 Jul 2015 09:52:12 +0000 (10:52 +0100)] 
Merge remote-tracking branch 'remotes/kraxel/tags/pull-input-20150717-1' into staging

input: fixes for 2.4

# gpg: Signature made Fri Jul 17 07:45:17 2015 BST using RSA key ID D3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
# gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
# gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

* remotes/kraxel/tags/pull-input-20150717-1:
  hid: clarify hid_keyboard_process_keycode
  virtio-input: move sys/ioctl.h include
  virtio-input: fix segfault in virtio_input_hid_properties

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
7 years agohid: clarify hid_keyboard_process_keycode
Paolo Bonzini [Tue, 14 Jul 2015 09:18:06 +0000 (11:18 +0200)] 
hid: clarify hid_keyboard_process_keycode

Coverity thinks the fallthroughs are smelly.  They are correct, but
everything else in this function is like "wut?".

Refer explicitly to bits 8 and 9 of hs->kbd.modifiers instead of
shifting right first and using (1 << 7).  Document what the scancode
is when hid_code is 0xe0.  And add plenty of comments.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
7 years agoUpdate version for v2.4.0-rc1 release v2.4.0-rc1
Peter Maydell [Thu, 16 Jul 2015 19:32:20 +0000 (20:32 +0100)] 
Update version for v2.4.0-rc1 release

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
7 years agoMerge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into staging
Peter Maydell [Thu, 16 Jul 2015 18:18:15 +0000 (19:18 +0100)] 
Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into staging

* MIPS-KVM fixes.
* Coverity fixes.
* Nettle function prototype fixes.
* Memory API refcount fix.

# gpg: Signature made Thu Jul 16 19:01:27 2015 BST using RSA key ID 78C7AE83
# gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>"
# gpg:                 aka "Paolo Bonzini <pbonzini@redhat.com>"
# gpg: WARNING: This key is not certified with sufficiently trusted signatures!
# gpg:          It is not certain that the signature belongs to the owner.
# Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4  E2F7 7E15 100C CD36 69B1
#      Subkey fingerprint: F133 3857 4B66 2389 866C  7682 BFFB D25F 78C7 AE83

* remotes/bonzini/tags/for-upstream:
  crypto: avoid undefined behavior in nettle calls
  crypto: fix build with nettle >= 3.0.0
  memory: fix refcount leak in memory_region_present
  RDMA: Fix error exits
  arm/xlnx-zynqmp: fix memory leak
  ppc/spapr_drc: fix memory leak
  mips/kvm: Sign extend registers written to KVM
  mips/kvm: Fix Big endian 32-bit register access

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
7 years agocrypto: avoid undefined behavior in nettle calls
Radim Krčmář [Fri, 10 Jul 2015 17:18:01 +0000 (19:18 +0200)] 
crypto: avoid undefined behavior in nettle calls

Calling a function pointer that was cast from an incompatible function
results in undefined behavior.  'void *' isn't compatible with 'struct
XXX *', so we can't cast to nettle_cipher_func, but have to provide a
wrapper.  (Conversion from 'void *' to 'struct XXX *' might require
computation, which won't be done if we drop argument's true type, and
pointers can have different sizes so passing arguments on stack would
bug.)

Having two different prototypes based on nettle version doesn't make
this solution any nicer.

Reported-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Radim Krčmář <rkrcmar@redhat.com>
Message-Id: <1437062641-12684-3-git-send-email-rkrcmar@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
7 years agocrypto: fix build with nettle >= 3.0.0
Radim Krčmář [Fri, 10 Jul 2015 17:18:00 +0000 (19:18 +0200)] 
crypto: fix build with nettle >= 3.0.0

In nettle 3, cbc_encrypt() accepts 'nettle_cipher_func' instead of
'nettle_crypt_func' and these two differ in 'const' qualifier of the
first argument.  The build fails with:

  In file included from crypto/cipher.c:71:0:
  ./crypto/cipher-nettle.c: In function ‘qcrypto_cipher_encrypt’:
  ./crypto/cipher-nettle.c:154:38: error: passing argument 2 of
  ‘nettle_cbc_encrypt’ from incompatible pointer type
           cbc_encrypt(ctx->ctx_encrypt, ctx->alg_encrypt,
                                               ^
  In file included from ./crypto/cipher-nettle.c:24:0,
                   from crypto/cipher.c:71:
  /usr/include/nettle/cbc.h:48:1: note: expected
  ‘void (*)(const void *, size_t, uint8_t *, const uint8_t *)
  but argument is of type
  ‘void (*)(      void *, size_t, uint8_t *, const uint8_t *)

To allow both versions, we switch to the new definition and #if typedef
it for old versions.

Signed-off-by: Radim Krčmář <rkrcmar@redhat.com>
Message-Id: <1436548682-9315-2-git-send-email-rkrcmar@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
7 years agomemory: fix refcount leak in memory_region_present
Paolo Bonzini [Tue, 14 Jul 2015 11:45:34 +0000 (13:45 +0200)] 
memory: fix refcount leak in memory_region_present

memory_region_present() leaks a reference to a MemoryRegion in the
case "mr == container".  While fixing it, avoid reference counting
altogether for memory_region_present(), by using RCU only.

The return value could in principle be already invalid immediately
after memory_region_present returns, but presumably the caller knows
that and it's using memory_region_present to probe for devices that
are unpluggable, or something like that.  The RCU critical section
is needed anyway, because it protects as->current_map.

Reported-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
7 years agoRDMA: Fix error exits
Dr. David Alan Gilbert [Fri, 10 Jul 2015 19:08:52 +0000 (20:08 +0100)] 
RDMA: Fix error exits

The error checks I added used 'break' after the error, but I'm
in a switch inside the while loop, so they need to be 'goto out'.

Spotted by coverity; entries 1311368 and 1311369

Fixes: afcddefd

Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Message-Id: <1436555332-19076-1-git-send-email-dgilbert@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
7 years agoarm/xlnx-zynqmp: fix memory leak
Gonglei [Fri, 10 Jul 2015 00:51:29 +0000 (08:51 +0800)] 
arm/xlnx-zynqmp: fix memory leak

fix CID 1311372.

Signed-off-by: Gonglei <arei.gonglei@huawei.com>
Message-Id: <1436489490-236-4-git-send-email-arei.gonglei@huawei.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
7 years agoppc/spapr_drc: fix memory leak
Gonglei [Fri, 10 Jul 2015 00:51:28 +0000 (08:51 +0800)] 
ppc/spapr_drc: fix memory leak

fix CID 1311373.

Signed-off-by: Gonglei <arei.gonglei@huawei.com>
Message-Id: <1436489490-236-3-git-send-email-arei.gonglei@huawei.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
7 years agomips/kvm: Sign extend registers written to KVM
James Hogan [Fri, 24 Apr 2015 10:26:53 +0000 (11:26 +0100)] 
mips/kvm: Sign extend registers written to KVM

In case we're running on a 64-bit host, be sure to sign extend the
general purpose registers and hi/lo/pc before writing them to KVM, so as
to take advantage of MIPS32/MIPS64 compatibility.

Signed-off-by: James Hogan <james.hogan@imgtec.com>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Leon Alrae <leon.alrae@imgtec.com>
Cc: Aurelien Jarno <aurelien@aurel32.net>
Cc: kvm@vger.kernel.org
Cc: qemu-stable@nongnu.org
Message-Id: <1429871214-23514-3-git-send-email-james.hogan@imgtec.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
7 years agomips/kvm: Fix Big endian 32-bit register access
James Hogan [Fri, 24 Apr 2015 10:26:52 +0000 (11:26 +0100)] 
mips/kvm: Fix Big endian 32-bit register access

Fix access to 32-bit registers on big endian targets. The pointer passed
to the kernel must be for the actual 32-bit value, not a temporary
64-bit value, otherwise on big endian systems the kernel will only
interpret the upper half.

Signed-off-by: James Hogan <james.hogan@imgtec.com>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Leon Alrae <leon.alrae@imgtec.com>
Cc: Aurelien Jarno <aurelien@aurel32.net>
Cc: kvm@vger.kernel.org
Cc: qemu-stable@nongnu.org
Message-Id: <1429871214-23514-2-git-send-email-james.hogan@imgtec.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
7 years agoMerge remote-tracking branch 'remotes/spice/tags/pull-spice-20150716-1' into staging
Peter Maydell [Thu, 16 Jul 2015 15:55:00 +0000 (16:55 +0100)] 
Merge remote-tracking branch 'remotes/spice/tags/pull-spice-20150716-1' into staging

qxl: allow to specify head limit to qxl driver

# gpg: Signature made Thu Jul 16 16:31:40 2015 BST using RSA key ID D3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
# gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
# gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

* remotes/spice/tags/pull-spice-20150716-1:
  qxl: allow to specify head limit to qxl driver

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
7 years agoRe-attach usb device to kernel while usb_host_open fails
Lin Ma [Wed, 24 Jun 2015 05:40:11 +0000 (13:40 +0800)] 
Re-attach usb device to kernel while usb_host_open fails

Signed-off-by: Lin Ma <lma@suse.com>
Reviewed-by: Gonglei <arei.gonglei@huawei.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
7 years agovirtio-input: move sys/ioctl.h include
Gerd Hoffmann [Tue, 14 Jul 2015 11:44:12 +0000 (13:44 +0200)] 
virtio-input: move sys/ioctl.h include

Drop from include/standard-headers/linux/input.h
Add to hw/input/virtio-input-host.c instead.

That allows to build virtio-input (except pass-through) on windows.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
7 years agovirtio-input: fix segfault in virtio_input_hid_properties
Lin Ma [Tue, 14 Jul 2015 11:27:30 +0000 (19:27 +0800)] 
virtio-input: fix segfault in virtio_input_hid_properties

commit 5cce173 introduced virtio-input segfault, This patch fixes it.

Signed-off-by: Lin Ma <lma@suse.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
7 years agoqxl: allow to specify head limit to qxl driver
Frediano Ziglio [Mon, 6 Jul 2015 06:56:38 +0000 (07:56 +0100)] 
qxl: allow to specify head limit to qxl driver

This patch allow to limit number of heads using qxl driver. By default
qxl driver is not limited on any kind on head use so can decide to use
as much heads.

libvirt has this as a video card parameter (actually set to 1 but not
used). This parameter will allow to limit setting a use can do (which
could be confusing).

Signed-off-by: Frediano Ziglio <fziglio@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
7 years agoMerge remote-tracking branch 'remotes/lalrae/tags/mips-20150716' into staging
Peter Maydell [Thu, 16 Jul 2015 09:40:22 +0000 (10:40 +0100)] 
Merge remote-tracking branch 'remotes/lalrae/tags/mips-20150716' into staging

MIPS patches 2015-07-16

Changes:
* bug fixes

# gpg: Signature made Thu Jul 16 09:04:56 2015 BST using RSA key ID 0B29DA6B
# gpg: Good signature from "Leon Alrae <leon.alrae@imgtec.com>"
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg:          There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 8DD3 2F98 5495 9D66 35D4  4FC0 5211 8E3C 0B29 DA6B

* remotes/lalrae/tags/mips-20150716:
  target-mips: fix page fault address for LWL/LWR/LDL/LDR
  linux-user: Fix MIPS N64 trap and break instruction bug
  target-mips: fix resource leak reported by Coverity
  target-mips: fix logically dead code reported by Coverity
  target-mips: correct DERET instruction
  target-mips: fix ASID synchronisation for MIPS MT
  disas/mips: fix disassembling R6 instructions
  target-mips: fix to clear MSACSR.Cause
  target-mips: fix MIPS64R6-generic configuration

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
7 years agoMerge remote-tracking branch 'remotes/ehabkost/tags/x86-pull-request' into staging
Peter Maydell [Wed, 15 Jul 2015 21:05:13 +0000 (22:05 +0100)] 
Merge remote-tracking branch 'remotes/ehabkost/tags/x86-pull-request' into staging

X86 queue, 2015-07-15

Two bug fixes:
* Memory leak due to extra g_strdup() when registering X86CPU alias properties
* Fix CPUID levels so that W10 insider can run as guest OS

# gpg: Signature made Wed Jul 15 21:26:59 2015 BST using RSA key ID 984DC5A6
# gpg: Good signature from "Eduardo Habkost <ehabkost@redhat.com>"
# gpg: WARNING: This key is not certified with sufficiently trusted signatures!
# gpg:          It is not certain that the signature belongs to the owner.
# Primary key fingerprint: 5A32 2FD5 ABC4 D3DB ACCF  D1AA 2807 936F 984D C5A6

* remotes/ehabkost/tags/x86-pull-request:
  target-i386: emulate CPUID level of real hardware
  target-i386: Don't strdup() alias property name

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
7 years agoMerge remote-tracking branch 'remotes/ehabkost/tags/numa-pull-request' into staging
Peter Maydell [Wed, 15 Jul 2015 20:06:54 +0000 (21:06 +0100)] 
Merge remote-tracking branch 'remotes/ehabkost/tags/numa-pull-request' into staging

NUMA queue, 2015-07-15

# gpg: Signature made Wed Jul 15 21:01:37 2015 BST using RSA key ID 984DC5A6
# gpg: Good signature from "Eduardo Habkost <ehabkost@redhat.com>"
# gpg: WARNING: This key is not certified with sufficiently trusted signatures!
# gpg:          It is not certain that the signature belongs to the owner.
# Primary key fingerprint: 5A32 2FD5 ABC4 D3DB ACCF  D1AA 2807 936F 984D C5A6

* remotes/ehabkost/tags/numa-pull-request:
  numa: Fix memory leak in numa_set_mem_node_id()

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
7 years agotarget-i386: emulate CPUID level of real hardware
Radim Krčmář [Thu, 9 Jul 2015 19:07:39 +0000 (21:07 +0200)] 
target-i386: emulate CPUID level of real hardware

W10 insider has a bug where it ignores CPUID level and interprets
CPUID.(EAX=07H, ECX=0H) incorrectly, because CPUID in fact returned
CPUID.(EAX=04H, ECX=0H);  this resulted in execution of unsupported
instructions.

While it's a Windows bug, there is no reason to emulate incorrect level.

I used http://instlatx64.atw.hu/ as a source of CPUID and checked that
it matches Penryn Xeon X5472, Westmere Xeon W3520, SandyBridge i5-2540M,
and Haswell i5-4670T.

kvm64 and qemu64 were bumped to 0xD to allow all available features for
them (and to avoid the same Windows bug).

Signed-off-by: Radim Krčmář <rkrcmar@redhat.com>
Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
7 years agotarget-i386: Don't strdup() alias property name
Eduardo Habkost [Thu, 9 Jul 2015 15:24:43 +0000 (12:24 -0300)] 
target-i386: Don't strdup() alias property name

Now object_property_add_alias() calls g_strdup() on the target property
name, so we don't need to call g_strdup() ourselves.

Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
7 years agonuma: Fix memory leak in numa_set_mem_node_id()
Bharata B Rao [Thu, 9 Jul 2015 15:27:36 +0000 (20:57 +0530)] 
numa: Fix memory leak in numa_set_mem_node_id()

Fix a memory leak in numa_set_mem_node_id().

Signed-off-by: Bharata B Rao <bharata@linux.vnet.com>
Reported-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
7 years agoMerge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20150715' into...
Peter Maydell [Wed, 15 Jul 2015 16:28:59 +0000 (17:28 +0100)] 
Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20150715' into staging

target arm queue:
 * handle broken AArch64 kernels which assume DTB won't cross a 2MB boundary
 * correct broken SCTLR_EL3 reset value

# gpg: Signature made Wed Jul 15 17:24:24 2015 BST using RSA key ID 14360CDE
# gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>"

* remotes/pmaydell/tags/pull-target-arm-20150715:
  hw/arm/boot: Increase fdt alignment
  target-arm: Fix broken SCTLR_EL3 reset

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
7 years agohw/arm/boot: Increase fdt alignment
Alexander Graf [Wed, 15 Jul 2015 16:16:26 +0000 (17:16 +0100)] 
hw/arm/boot: Increase fdt alignment

The Linux kernel on aarch64 creates a page table entry at early bootup
that spans the 2MB range on memory spanning the fdt start address:

  [ ALIGN_DOWN(fdt, 2MB) ... ALIGN_DOWN(fdt, 2MB) + 2MB ]

This means that when our current 4k alignment happens to fall at the end
of the aligned region, Linux tries to access memory that is not mapped.

The easy fix is to instead increase the alignment to 2MB, making Linux's
logic always succeed.

We leave the existing 4k alignment for 32bit kernels to not cause any
regressions due to space constraints.

Reported-by: Andreas Schwab <schwab@suse.de>
Signed-off-by: Alexander Graf <agraf@suse.de>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
7 years agotarget-arm: Fix broken SCTLR_EL3 reset
Peter Maydell [Wed, 15 Jul 2015 16:16:26 +0000 (17:16 +0100)] 
target-arm: Fix broken SCTLR_EL3 reset

The SCTLR_EL3 cpreg definition was implicitly resetting the
register state to 0, which is both wrong and clashes with
the reset done via the SCTLR definition (since sctlr[3]
is unioned with sctlr_s). This went unnoticed until recently,
when an unrelated change (commit a903c449b41f105aa) happened to
perturb the order of enumeration through the cpregs hashtable for
reset such that the erroneous reset happened after the correct one
rather than before it. Fix this by marking SCTLR_EL3 as an alias,
so its reset is left up to the AArch32 view.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
7 years agoMerge remote-tracking branch 'remotes/cody/tags/jtc-for-upstream-pull-request' into...
Peter Maydell [Wed, 15 Jul 2015 13:23:58 +0000 (14:23 +0100)] 
Merge remote-tracking branch 'remotes/cody/tags/jtc-for-upstream-pull-request' into staging

# gpg: Signature made Wed Jul 15 03:25:16 2015 BST using RSA key ID C0DE3057
# gpg: Good signature from "Jeffrey Cody <jcody@redhat.com>"
# gpg:                 aka "Jeffrey Cody <jeff@codyprime.org>"
# gpg:                 aka "Jeffrey Cody <codyprime@gmail.com>"
# gpg: WARNING: This key is not certified with sufficiently trusted signatures!
# gpg:          It is not certain that the signature belongs to the owner.
# Primary key fingerprint: 9957 4B4D 3474 90E7 9D98  D624 BDBE 7B27 C0DE 3057

* remotes/cody/tags/jtc-for-upstream-pull-request:
  block/curl: Don't lose original error when a connection fails.
  mirror: correct buf_size
  block: keep bitmap if incremental backup job is cancelled
  blockdev: no need to drain in qmp_block_commit
  block/mirror: Sleep periodically during bitmap scanning

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
7 years agotarget-mips: fix page fault address for LWL/LWR/LDL/LDR
Aurelien Jarno [Tue, 14 Jul 2015 15:45:16 +0000 (17:45 +0200)] 
target-mips: fix page fault address for LWL/LWR/LDL/LDR

When a LWL, LWR, LDL or LDR instruction triggers a page fault, QEMU
currently reports the aligned address in CP0 BadVAddr, while the Windows
NT kernel expects the unaligned address.

This patch adds a byte access with the unaligned address at the
beginning of the LWL/LWR/LDL/LDR instructions to possibly trigger a page
fault and fill the QEMU TLB.

Cc: Leon Alrae <leon.alrae@imgtec.com>
Reported-by: Hervé Poussineau <hpoussin@reactos.org>
Tested-by: Hervé Poussineau <hpoussin@reactos.org>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
7 years agolinux-user: Fix MIPS N64 trap and break instruction bug
Andrew Bennett [Mon, 29 Jun 2015 10:20:07 +0000 (10:20 +0000)] 
linux-user: Fix MIPS N64 trap and break instruction bug

For the MIPS N64 ABI when QEMU reads the break/trap instruction so that
it can inspect the break/trap code it reads 8 rather than 4 bytes
which means it finds the code field from the instruction after the
break/trap instruction.  This then causes the break/trap handling
code to fail because it does not understand the code number.

The fix forces QEMU to always read 4 bytes of instruction data rather
than deciding how much to read based on the ABI.

Signed-off-by: Andrew Bennett <andrew.bennett@imgtec.com>
Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
7 years agotarget-mips: fix resource leak reported by Coverity
Leon Alrae [Tue, 14 Jul 2015 10:08:15 +0000 (11:08 +0100)] 
target-mips: fix resource leak reported by Coverity

UHI assert and link operations call lock_user_string() twice to obtain two
strings pointed by gpr[4] and gpr[5]. If the second lock_user_string()
fails, then the first one won't get freed. Fix this by introducing another
macro responsible for obtaining two strings and handling allocation
failure.

Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
7 years agotarget-mips: fix logically dead code reported by Coverity
Leon Alrae [Tue, 14 Jul 2015 10:08:14 +0000 (11:08 +0100)] 
target-mips: fix logically dead code reported by Coverity

Make use of CMPOP in floating-point compare instructions.

Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
7 years agotarget-mips: correct DERET instruction
Leon Alrae [Tue, 14 Jul 2015 10:08:13 +0000 (11:08 +0100)] 
target-mips: correct DERET instruction

Fix Debug Mode flag clearing, and when DERET is placed between LL and SC
do not make SC fail.

Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
7 years agotarget-mips: fix ASID synchronisation for MIPS MT
Aurelien Jarno [Wed, 1 Jul 2015 13:59:13 +0000 (15:59 +0200)] 
target-mips: fix ASID synchronisation for MIPS MT

When syncing the task ASID with EntryHi, correctly or the value instead
of assigning it.

Reported-by: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
Cc: Leon Alrae <leon.alrae@imgtec.com>
Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
7 years agodisas/mips: fix disassembling R6 instructions
Yongbok Kim [Tue, 30 Jun 2015 15:33:15 +0000 (16:33 +0100)] 
disas/mips: fix disassembling R6 instructions

In the Release 6 of the MIPS Architecture, LL, SC, LLD, SCD, PREF
and CACHE instructions have 9 bits offsets.

Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
7 years agotarget-mips: fix to clear MSACSR.Cause
Yongbok Kim [Tue, 30 Jun 2015 14:44:28 +0000 (15:44 +0100)] 
target-mips: fix to clear MSACSR.Cause

MSACSR.Cause bits are needed to be cleared before a vector floating-point
instructions.
FEXDO.df, FEXUPL.df and FEXUPR.df were missed out.

Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
7 years agotarget-mips: fix MIPS64R6-generic configuration
Yongbok Kim [Mon, 29 Jun 2015 09:11:23 +0000 (10:11 +0100)] 
target-mips: fix MIPS64R6-generic configuration

Fix core configuration for MIPS64R6-generic to make it as close as
I6400.
I6400 core has 48-bit of Virtual Address available (SEGBITS).
MIPS SIMD Architecture is available.
Rearrange order of bits to match the specification.

Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
7 years agoMerge remote-tracking branch 'remotes/juanquintela/tags/migration/20150715-1' into...
Peter Maydell [Wed, 15 Jul 2015 11:22:31 +0000 (12:22 +0100)] 
Merge remote-tracking branch 'remotes/juanquintela/tags/migration/20150715-1' into staging

migration/next for 20150715

# gpg: Signature made Wed Jul 15 11:23:33 2015 BST using RSA key ID 5872D723
# gpg: Good signature from "Juan Quintela <quintela@redhat.com>"
# gpg:                 aka "Juan Quintela <quintela@trasno.org>"

* remotes/juanquintela/tags/migration/20150715-1:
  migration: We also want to store the global state for savevm
  migration: reduce the count of strlen call
  migration: Register global state section before loadvm
  migration: Write documetation for events capabilites
  migration: Trace event and migration event are different things
  migration: Only change state after migration has finished

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
7 years agomigration: We also want to store the global state for savevm
Juan Quintela [Wed, 15 Jul 2015 07:53:46 +0000 (09:53 +0200)] 
migration: We also want to store the global state for savevm

Commit df4b1024526cae3479da3492d6371fd4a7324a03 introduced global_state
section.  But it only filled the state while doing migration.  While
doing a savevm, we stored an empty string as state.  So when we did a
loadvm, it complained that state was invalid.

Fedora 21, 4.1.1, qemu 2.4.0-rc0
> ../../configure --target-list="x86_64-softmmu"

068 2s ... - output mismatch (see 068.out.bad)
--- /home/bos/jhuston/src/qemu/tests/qemu-iotests/068.out 2015-07-08
17:56:18.588164979 -0400
+++ 068.out.bad 2015-07-09 17:39:58.636651317 -0400
@@ -6,6 +6,8 @@
 QEMU X.Y.Z monitor - type 'help' for more information
 (qemu) savevm 0
 (qemu) quit
+qemu-system-x86_64: Unknown savevm section or instance 'globalstate' 0
+qemu-system-x86_64: Error -22 while loading VM state
 QEMU X.Y.Z monitor - type 'help' for more information
 (qemu) quit
 *** done
Failures: 068
Failed 1 of 1 tests

Actually, there were two problems here:
- we registered global_state too late for load_vm (fixed on another
  patch on the list)
- we didn't store a valid state for savevm (fixed by this patch).

Reported-by: John Snow <jsnow@redhat.com>
Signed-off-by: Juan Quintela <quintela@redhat.com>
Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Reviewed-by: Amit Shah <amit.shah@redhat.com>
Tested-by: Christian Borntraeger <borntraeger@de.ibm.com>
7 years agomigration: reduce the count of strlen call
Liang Li [Mon, 13 Jul 2015 09:34:10 +0000 (17:34 +0800)] 
migration: reduce the count of strlen call

'strlen' is called three times in 'save_page_header', it's
inefficient.

Signed-off-by: Liang Li <liang.z.li@intel.com>
Reviewed-by: Juan Quintela <quintela@redhat.com>
Reviewed-by: Amit Shah <amit.shah@redhat.com>
Signed-off-by: Juan Quintela <quintela@redhat.com>
7 years agomigration: Register global state section before loadvm
Juan Quintela [Fri, 10 Jul 2015 12:51:58 +0000 (14:51 +0200)] 
migration: Register global state section before loadvm

Otherwise, it is not found

Signed-off-by: Juan Quintela <quintela@redhat.com>
7 years agomigration: Write documetation for events capabilites
Juan Quintela [Wed, 8 Jul 2015 12:13:10 +0000 (14:13 +0200)] 
migration: Write documetation for events capabilites

Reported-by: Jiri Denemark <jdenemar@redhat.com>
Signed-off-by: Juan Quintela <quintela@redhat.com>
7 years agomigration: Trace event and migration event are different things
Juan Quintela [Wed, 8 Jul 2015 11:58:27 +0000 (13:58 +0200)] 
migration: Trace event and migration event are different things

We can want the trace event even without migration events enabled.

Reported-by: Wen Congyang <ghostwcy@gmail.com>
Signed-off-by: Juan Quintela <quintela@redhat.com>
Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
7 years agomigration: Only change state after migration has finished
Juan Quintela [Wed, 8 Jul 2015 11:56:26 +0000 (13:56 +0200)] 
migration: Only change state after migration has finished

On previous change, we changed state at post load time if it was not
running, special casing the "running" change.  Now, we change any states
at the end of the migration.

Signed-off-by: Juan Quintela <quintela@redhat.com>
Tested-by: Christian Borntraeger <borntraeger@de.ibm.com>
7 years agoblock/curl: Don't lose original error when a connection fails.
Richard W.M. Jones [Wed, 8 Jul 2015 13:37:48 +0000 (14:37 +0100)] 
block/curl: Don't lose original error when a connection fails.

Currently if qemu is connected to a curl source (eg. web server), and
the web server fails / times out / dies, you always see a bogus EIO
"Input/output error".

For example, choose a large file located on any local webserver which
you control:

  $ qemu-img convert -p http://example.com/large.iso /tmp/test

Once it starts copying the file, stop the webserver and you will see
qemu-img fail with:

  qemu-img: error while reading sector 61440: Input/output error

This patch does two things: Firstly print the actual error from curl
so it doesn't get lost.  Secondly, change EIO to EPROTO.  EPROTO is a
POSIX.1 compatible errno which more accurately reflects that there was
a protocol error, rather than some kind of hardware failure.

After this patch is applied, the error changes to:

  $ qemu-img convert -p http://example.com/large.iso /tmp/test
  qemu-img: curl: transfer closed with 469989 bytes remaining to read
  qemu-img: error while reading sector 16384: Protocol error

Signed-off-by: Richard W.M. Jones <rjones@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Jeff Cody <jcody@redhat.com>
7 years agomirror: correct buf_size
Wen Congyang [Fri, 15 May 2015 07:51:36 +0000 (15:51 +0800)] 
mirror: correct buf_size

If bus_size is less than 0, the command fails.
If buf_size is 0, use DEFAULT_MIRROR_BUF_SIZE.
If buf_size % granularity is not 0, mirror_free_init() will
do dangerous things.

Signed-off-by: Wen Congyang <wency@cn.fujitsu.com>
Reviewed-by: Fam Zheng <famz@redhat.com>
Message-id: 5555A588.3080907@cn.fujitsu.com
Signed-off-by: Jeff Cody <jcody@redhat.com>
7 years agoblock: keep bitmap if incremental backup job is cancelled
Stefan Hajnoczi [Mon, 15 Jun 2015 15:02:14 +0000 (16:02 +0100)] 
block: keep bitmap if incremental backup job is cancelled

Reclaim the dirty bitmap if an incremental backup block job is
cancelled.  The ret variable may be 0 when the job is cancelled so it's
not enough to check ret < 0.

Reviewed-by: John Snow <jsnow@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 1434380534-7680-1-git-send-email-stefanha@redhat.com
Signed-off-by: Jeff Cody <jcody@redhat.com>
7 years agoblockdev: no need to drain in qmp_block_commit
Paolo Bonzini [Thu, 28 May 2015 14:21:43 +0000 (16:21 +0200)] 
blockdev: no need to drain in qmp_block_commit

Draining is not necessary, I/O can happen as soon as the
commit coroutine yields.  Draining can be necessary before
reopening the file for read/write, or while modifying the
backing file chain, but that is done separately in
bdrv_reopen_multiple or bdrv_close; this particular
bdrv_drain_all does nothing for that.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Fam Zheng <famz@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 1432822903-25821-1-git-send-email-pbonzini@redhat.com
Signed-off-by: Jeff Cody <jcody@redhat.com>
7 years agoblock/mirror: Sleep periodically during bitmap scanning
Fam Zheng [Wed, 13 May 2015 03:11:13 +0000 (11:11 +0800)] 
block/mirror: Sleep periodically during bitmap scanning

Before, we only yield after initializing dirty bitmap, where the QMP
command would return. That may take very long, and guest IO will be
blocked.

Add sleep points like the later mirror iterations.

Signed-off-by: Fam Zheng <famz@redhat.com>
Reviewed-by: Wen Congyang <wency@cn.fujitsu.com>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 1431486673-19280-1-git-send-email-famz@redhat.com
Signed-off-by: Jeff Cody <jcody@redhat.com>
7 years agoMerge remote-tracking branch 'remotes/cohuck/tags/s390x-20150714' into staging
Peter Maydell [Tue, 14 Jul 2015 17:50:16 +0000 (18:50 +0100)] 
Merge remote-tracking branch 'remotes/cohuck/tags/s390x-20150714' into staging

s390x fixes for 2.4:
- virtio migration regression
- missing diag288 watchdog resets

# gpg: Signature made Tue Jul 14 18:17:54 2015 BST using RSA key ID C6F02FAF
# gpg: Good signature from "Cornelia Huck <huckc@linux.vnet.ibm.com>"
# gpg:                 aka "Cornelia Huck <cornelia.huck@de.ibm.com>"

* remotes/cohuck/tags/s390x-20150714:
  s390/virtio-ccw: Fix migration
  watchdog/diag288: correctly register for system reset requests

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
7 years agos390/virtio-ccw: Fix migration
Christian Borntraeger [Tue, 7 Jul 2015 11:47:23 +0000 (13:47 +0200)] 
s390/virtio-ccw: Fix migration

commit 213941d73b ("virtio-ccw: migrate ->revision") broke
migration:
2015-07-07T11:22:55.570968Z qemu-system-s390x: VQ 39 address 0x0 inconsistent with Host index 0x100
2015-07-07T11:22:55.571008Z qemu-system-s390x: error while loading state for instance 0x0 of

If thinint support is active, the config_load function returns early.
Make sure to load the revision all the time.

Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
Fixes: 213941d73b ("virtio-ccw: migrate ->revision")
Message-Id: <1436269643-66303-1-git-send-email-borntraeger@de.ibm.com>
Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
7 years agowatchdog/diag288: correctly register for system reset requests
Xu Wang [Mon, 29 Jun 2015 06:21:10 +0000 (08:21 +0200)] 
watchdog/diag288: correctly register for system reset requests

The diag288 watchdog is no sysbus device, therefore it doesn't get
triggered on resets automatically using dc->reset.

Let's register the reset handler manually, so we get correctly notified
again when a system reset was requested. Also reset the watchdog on
subsystem resets that don't trigger a full system reset.

Signed-off-by: Xu Wang <gesaint@linux.vnet.ibm.com>
Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
Tested-by: Christian Borntraeger <borntraeger@de.ibm.com>
Reviewed-by: Andreas Färber <afaerber@suse.de>
7 years agoMerge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging
Peter Maydell [Tue, 14 Jul 2015 15:51:44 +0000 (16:51 +0100)] 
Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging

Block layer patches for 2.4.0-rc1

# gpg: Signature made Tue Jul 14 16:15:35 2015 BST using RSA key ID C88F2FD6
# gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>"

* remotes/kevin/tags/for-upstream:
  rbd: fix ceph settings precedence
  rbd: make qemu's cache setting override any ceph setting
  MAINTAINERS: update email address
  rbd: remove unused constants and fields
  block: Fix backing file child when modifying graph
  block: Reorder cleanups in bdrv_close()
  block: Introduce bdrv_unref_child()
  block: Introduce bdrv_open_child()
  block: Move bdrv_attach_child() calls up the call chain
  nvme: properly report volatile write caches
  nvme: implement the Flush command

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
7 years agorbd: fix ceph settings precedence
Josh Durgin [Thu, 11 Jun 2015 03:28:46 +0000 (20:28 -0700)] 
rbd: fix ceph settings precedence

Apply the ceph settings from a config file before any ceph settings
from the command line. Since the ceph config file location may be
specified on the command line, parse it once to read the config file,
and do a second pass to apply the rest of the command line ceph
options.

Signed-off-by: Josh Durgin <jdurgin@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
7 years agorbd: make qemu's cache setting override any ceph setting
Josh Durgin [Thu, 11 Jun 2015 03:28:45 +0000 (20:28 -0700)] 
rbd: make qemu's cache setting override any ceph setting

To be safe, when cache=none is used ceph settings should not be able
to override it to turn on caching. This was previously possible with
rbd_cache=true in the rbd device configuration or a ceph configuration
file. Similarly, rbd settings could have turned off caching when qemu
requested it, although this would just be a performance problem.

Fix this by changing rbd's cache setting to match qemu after all other
ceph settings have been applied.

Signed-off-by: Josh Durgin <jdurgin@redhat.com>
Reviewed-by: Jeff Cody <jcody@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
7 years agoMAINTAINERS: update email address
Josh Durgin [Thu, 11 Jun 2015 03:28:44 +0000 (20:28 -0700)] 
MAINTAINERS: update email address

The old one still works for now, but will not work indefinitely.

Signed-off-by: Josh Durgin <jdurgin@redhat.com>
Reviewed-by: Jeff Cody <jcody@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
7 years agorbd: remove unused constants and fields
Josh Durgin [Thu, 11 Jun 2015 03:28:43 +0000 (20:28 -0700)] 
rbd: remove unused constants and fields

RBDAIOCB.status was only used for cancel, which was removed in
7691e24dbebb46658e89b3f950fda6ec78bbb823.

RBDAIOCB.sector_num was never used.

RADOSCB.done and rcbid were never used.

RBD_FD* are obsolete since the pipe was removed in
e04fb07fd1676e9facd7f3f878c1bbe03bccd26b.

Signed-off-by: Josh Durgin <jdurgin@redhat.com>
Reviewed-by: Jeff Cody <jcody@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
7 years agoblock: Fix backing file child when modifying graph
Kevin Wolf [Wed, 17 Jun 2015 13:52:09 +0000 (15:52 +0200)] 
block: Fix backing file child when modifying graph

This patch moves bdrv_attach_child() from the individual places that add
a backing file to a BDS to bdrv_set_backing_hd(), which is called by all
of them. It also adds bdrv_detach_child() there.

For normal operation (starting with one backing file chain and not
changing it until the topmost image is closed) and live snapshots, this
constitutes no change in behaviour.

For all other cases, this is a fix for the bug that the old backing file
was still referenced as a child, and the new one wasn't referenced.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
7 years agoblock: Reorder cleanups in bdrv_close()
Kevin Wolf [Tue, 16 Jun 2015 08:58:20 +0000 (10:58 +0200)] 
block: Reorder cleanups in bdrv_close()

Block drivers may still want to access their child nodes in their
.bdrv_close handler. If they unref and/or detach a child by themselves,
this should not result in a double free.

There is additional code for backing files, which are just a special
case of child nodes. The same applies for them.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
7 years agoblock: Introduce bdrv_unref_child()
Kevin Wolf [Mon, 15 Jun 2015 11:51:04 +0000 (13:51 +0200)] 
block: Introduce bdrv_unref_child()

This is the counterpart for bdrv_open_child(). It decreases the
reference count of the child BDS and removes it from the list of
children of the given parent BDS.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
7 years agoblock: Introduce bdrv_open_child()
Kevin Wolf [Mon, 15 Jun 2015 11:24:19 +0000 (13:24 +0200)] 
block: Introduce bdrv_open_child()

It is the same as bdrv_open_image(), except that it doesn't only return
success or failure, but the newly created BdrvChild object for the new
child node.

As the BdrvChild object already contains a BlockDriverState pointer (and
this is supposed to become the only pointer so that bdrv_append() and
friends can just change a single pointer in BdrvChild), the pbs
parameter is removed for bdrv_open_child().

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
7 years agoblock: Move bdrv_attach_child() calls up the call chain
Kevin Wolf [Mon, 15 Jun 2015 09:53:47 +0000 (11:53 +0200)] 
block: Move bdrv_attach_child() calls up the call chain

Let the callers of bdrv_open_inherit() call bdrv_attach_child(). It
needs to be called in all cases where bdrv_open_inherit() succeeds (i.e.
returns 0) and a child_role is given.

bdrv_attach_child() is moved upwards to avoid a forward declaration.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
7 years agonvme: properly report volatile write caches
Christoph Hellwig [Thu, 11 Jun 2015 10:01:39 +0000 (12:01 +0200)] 
nvme: properly report volatile write caches

Implement support in Identify and Get/Set Features to properly report
and allow to change the Volatile Write Cache status reported by the
virtual NVMe device.

Signed-off-by: Christoph Hellwig <hch@lst.de>
Acked-by: Keith Busch <keith.busch@intel.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>