qemu.git
5 years agoqdev: Move error printing to the end of qdev_device_help()
Eduardo Habkost [Sat, 1 Nov 2014 15:56:10 +0000 (13:56 -0200)] 
qdev: Move error printing to the end of qdev_device_help()

Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Signed-off-by: Andreas Färber <afaerber@suse.de>
5 years agoqdev: Create qdev_get_device_class() function
Eduardo Habkost [Sat, 1 Nov 2014 15:56:09 +0000 (13:56 -0200)] 
qdev: Create qdev_get_device_class() function

Extract the DeviceClass lookup from qdev_device_add() to a separate
function.

Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Signed-off-by: Andreas Färber <afaerber@suse.de>
5 years agoMerge remote-tracking branch 'remotes/kraxel/tags/pull-gtk-20141104-2' into staging
Peter Maydell [Tue, 4 Nov 2014 15:00:17 +0000 (15:00 +0000)] 
Merge remote-tracking branch 'remotes/kraxel/tags/pull-gtk-20141104-2' into staging

gtk: fix fullscreen with gtk3, fix build with older gtk2 versions.

# gpg: Signature made Tue 04 Nov 2014 13:42:09 GMT using RSA key ID D3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
# gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
# gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

* remotes/kraxel/tags/pull-gtk-20141104-2:
  gtk: add GDK_KEY_pause #define
  gtk: Hide the menubar when in fullscreen mode (lp 1294898)
  gtk: Install vc accelerators on parent window
  gtk: Install fullscreen accelerator on toplevel window
  gtk: Grab accel_group from GtkDisplayState

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
5 years agogtk: add GDK_KEY_pause #define
Gerd Hoffmann [Tue, 4 Nov 2014 07:32:26 +0000 (08:32 +0100)] 
gtk: add GDK_KEY_pause #define

Add pause key to the list of compatibility defines.
Fixes the build with older gtk versions.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
5 years agoMerge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20141104' into...
Peter Maydell [Tue, 4 Nov 2014 13:35:04 +0000 (13:35 +0000)] 
Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20141104' into staging

target-arm queue:
 * avoid passing CPU env pointer around in A32/T32 decoders
 * split M profile exception masking out from A/R profile

# gpg: Signature made Tue 04 Nov 2014 12:28:15 GMT using RSA key ID 14360CDE
# gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>"

* remotes/pmaydell/tags/pull-target-arm-20141104:
  target-arm: Correct condition for taking VIRQ and VFIQ
  target-arm: Separate out M profile cpu_exec_interrupt handling
  target-arm/translate.c: Don't pass CPUARMState * to disas_arm_insn()
  target-arm/translate.c: Don't pass CPUARMState around in the decoder
  target-arm/translate.c: Don't use IS_M()
  target-arm/translate.c: Use arm_dc_feature() rather than arm_feature()
  target-arm/translate.c: Use arm_dc_feature() in ENABLE_ARCH_ macros

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
5 years agoMerge remote-tracking branch 'remotes/mcayland/tags/qemu-openbios-signed' into staging
Peter Maydell [Tue, 4 Nov 2014 12:35:07 +0000 (12:35 +0000)] 
Merge remote-tracking branch 'remotes/mcayland/tags/qemu-openbios-signed' into staging

Update OpenBIOS images

# gpg: Signature made Tue 04 Nov 2014 00:24:41 GMT using RSA key ID AE0F321F
# gpg: Good signature from "Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>"

* remotes/mcayland/tags/qemu-openbios-signed:
  Update OpenBIOS images

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
5 years agotarget-arm: Correct condition for taking VIRQ and VFIQ
Peter Maydell [Thu, 30 Oct 2014 15:48:52 +0000 (15:48 +0000)] 
target-arm: Correct condition for taking VIRQ and VFIQ

The VIRQ and VFIQ exceptions are (as the comments say) only
taken if the CPU is in Non-secure state and the IMO/FMO bits
are set to enable virtualized interrupts. Correct the code
to actually implement this.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Message-id: 1414684132-23971-3-git-send-email-peter.maydell@linaro.org

5 years agotarget-arm: Separate out M profile cpu_exec_interrupt handling
Peter Maydell [Thu, 30 Oct 2014 15:48:51 +0000 (15:48 +0000)] 
target-arm: Separate out M profile cpu_exec_interrupt handling

The M profile cpu_exec_interrupt handling is fairly simple
but does include an M profile specific oddity (disabling
interrupts for certain PC values). A/R profile handling
on the other hand is getting rapidly more complicated
with the support for EL2 and EL3. Split the M profile
code out into its own implementation of cpu_exec_interrupt
to keep these two things out of each others' way.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Message-id: 1414684132-23971-2-git-send-email-peter.maydell@linaro.org

5 years agotarget-arm/translate.c: Don't pass CPUARMState * to disas_arm_insn()
Peter Maydell [Tue, 28 Oct 2014 19:24:04 +0000 (19:24 +0000)] 
target-arm/translate.c: Don't pass CPUARMState * to disas_arm_insn()

Refactor to avoid passing a CPUARMState * to disas_arm_insn(). To do this
we move the "read insn from memory" code to the callsite and pass the
insn to the function instead.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 1414524244-20316-6-git-send-email-peter.maydell@linaro.org
Reviewed-by: Claudio Fontana <claudio.fontana@huawei.com>
5 years agotarget-arm/translate.c: Don't pass CPUARMState around in the decoder
Peter Maydell [Tue, 28 Oct 2014 19:24:03 +0000 (19:24 +0000)] 
target-arm/translate.c: Don't pass CPUARMState around in the decoder

Passing the CPUARMState around in the decoder is a recipe for
bugs where we accidentally generate code that depends on CPU
state which isn't reflected in the TB flags. Stop doing this
and instead use DisasContext as a way to pass around those
bits of CPU state which are known to be safe to use.

This commit simply removes initial "CPUARMState *env" parameters
from various function definitions, and removes the initial "env"
argument from the places where those functions are called.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 1414524244-20316-5-git-send-email-peter.maydell@linaro.org
Reviewed-by: Claudio Fontana <claudio.fontana@huawei.com>
5 years agotarget-arm/translate.c: Don't use IS_M()
Peter Maydell [Tue, 28 Oct 2014 19:24:02 +0000 (19:24 +0000)] 
target-arm/translate.c: Don't use IS_M()

Instead of using IS_M(), use arm_dc_feature(s, ARM_FEATURE_M), so we
don't need to pass CPUARMState pointers around the decoder.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 1414524244-20316-4-git-send-email-peter.maydell@linaro.org
Reviewed-by: Claudio Fontana <claudio.fontana@huawei.com>
5 years agotarget-arm/translate.c: Use arm_dc_feature() rather than arm_feature()
Peter Maydell [Tue, 28 Oct 2014 19:24:01 +0000 (19:24 +0000)] 
target-arm/translate.c: Use arm_dc_feature() rather than arm_feature()

Use arm_dc_feature() rather than arm_feature() to avoid using
CPUARMState unnecessarily.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 1414524244-20316-3-git-send-email-peter.maydell@linaro.org
Reviewed-by: Claudio Fontana <claudio.fontana@huawei.com>
5 years agogtk: Hide the menubar when in fullscreen mode (lp 1294898)
Cole Robinson [Thu, 30 Oct 2014 19:34:35 +0000 (15:34 -0400)] 
gtk: Hide the menubar when in fullscreen mode (lp 1294898)

In fullscreen mode, we attempt to shrink the menubar to 1 pixel in height,
so it takes up as little room as possible while still allowing us to use
the keyboard shortcuts for its various operations.

However this shrinking is disregarded on gtk3, so the entire menu bar is
visible, which isn't very pleasant. This patch hides the menu bar instead.

The side effect is that the only keyboard shortcuts that will work in this
mode are the ones that we explicitly register on the top level window and
not the menu bar. The previous patches changed the fullscreen and vc
shortcuts to work like that, which I think are the only ones that really
matter in for the fullscreen case.

https://bugs.launchpad.net/qemu/+bug/1294898
Signed-off-by: Cole Robinson <crobinso@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
5 years agogtk: Install vc accelerators on parent window
Cole Robinson [Thu, 30 Oct 2014 19:34:34 +0000 (15:34 -0400)] 
gtk: Install vc accelerators on parent window

So they are usable when we hide the menubar in upcoming patches. This
has the accelerator text caveat as the fullscreen bit in the previous
patch.

Signed-off-by: Cole Robinson <crobinso@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
5 years agogtk: Install fullscreen accelerator on toplevel window
Cole Robinson [Thu, 30 Oct 2014 19:34:33 +0000 (15:34 -0400)] 
gtk: Install fullscreen accelerator on toplevel window

Instead of installing it on the menu. This will be needed to keep the
fullscreen keyboard shortcut working when we hide the menu (in future
patches).

On gtk < 3.8, this has the unfortunate side effect of no longer listing
the key combo in the UI. We could manually change the label in that case,
but it will look visually out of place, and I'm not sure if anyone really
cares.

Signed-off-by: Cole Robinson <crobinso@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
5 years agogtk: Grab accel_group from GtkDisplayState
Cole Robinson [Thu, 30 Oct 2014 19:34:32 +0000 (15:34 -0400)] 
gtk: Grab accel_group from GtkDisplayState

Rather than needlessly pass it around

Signed-off-by: Cole Robinson <crobinso@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
5 years agotarget-arm/translate.c: Use arm_dc_feature() in ENABLE_ARCH_ macros
Peter Maydell [Tue, 28 Oct 2014 19:24:00 +0000 (19:24 +0000)] 
target-arm/translate.c: Use arm_dc_feature() in ENABLE_ARCH_ macros

All the places where we use the ENABLE_ARCH_* and ARCH() macros have a
DisasContext* s, so switch them over to use arm_dc_feature() rather than
arm_feature() so we don't need to pass the CPUARMState* env around too.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 1414524244-20316-2-git-send-email-peter.maydell@linaro.org
Reviewed-by: Claudio Fontana <claudio.fontana@huawei.com>
5 years agoMerge remote-tracking branch 'remotes/lalrae/tags/mips-20141103' into staging
Peter Maydell [Tue, 4 Nov 2014 00:17:45 +0000 (00:17 +0000)] 
Merge remote-tracking branch 'remotes/lalrae/tags/mips-20141103' into staging

* remotes/lalrae/tags/mips-20141103: (34 commits)
  target-mips: add MSA support to mips32r5-generic
  disas/mips.c: disassemble MSA instructions
  target-mips: add MSA MI10 format instructions
  target-mips: add MSA 2RF format instructions
  target-mips: add MSA VEC/2R format instructions
  target-mips: add MSA 3RF format instructions
  target-mips: add MSA ELM format instructions
  target-mips: add MSA 3R format instructions
  target-mips: add MSA BIT format instructions
  target-mips: add MSA I5 format instruction
  target-mips: add MSA I8 format instructions
  target-mips: add MSA branch instructions
  target-mips: add msa_helper.c
  target-mips: add msa_reset(), global msa register
  target-mips: add MSA opcode enum
  target-mips: stop translation after ctc1
  target-mips: remove duplicated mips/ieee mapping function
  target-mips: add MSA exceptions
  target-mips: add MSA defines and data structure
  target-mips: enable features in MIPS64R6-generic CPU
  ...

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
5 years agoUpdate OpenBIOS images
Mark Cave-Ayland [Mon, 3 Nov 2014 20:20:19 +0000 (20:20 +0000)] 
Update OpenBIOS images

Update OpenBIOS images to SVN r1321 built from submodule.

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
5 years agoMerge remote-tracking branch 'remotes/mst/tags/for_upstream' into staging
Peter Maydell [Mon, 3 Nov 2014 22:51:07 +0000 (22:51 +0000)] 
Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into staging

pc, virtio, misc bugfixes

A bunch of minor bugfixes all over the place.

changes from v2:
    added cpu hotplug rework
    added default vga type switch
    more fixes
changes from v1:
    fix for test re-generation script
    add missing acks to two patches

Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
# gpg: Signature made Mon 03 Nov 2014 16:33:13 GMT using RSA key ID D28D5469
# gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>"
# gpg:                 aka "Michael S. Tsirkin <mst@redhat.com>"

* remotes/mst/tags/for_upstream: (28 commits)
  vga: flip qemu 2.2 pc machine types from cirrus to stdvga
  vga: add default display to machine class
  vhost-user: fix mmap offset calculation
  hw/i386/acpi-build.c: Fix memory leak in acpi_build_tables_cleanup()
  smbios: Encode UUID according to SMBIOS specification
  pc: Add pc_compat_2_1() function
  hw/virtio/vring/event_idx: fix the vring_avail_event error
  hw/pci: fixed hotplug crash when using rombar=0 with devices having romfile
  hw/pci: fixed error flow in pci_qdev_init
  -machine vmport=off: Allow disabling of VMWare ioport emulation
  acpi/cpu-hotplug: introduce helper function to keep bit setting in one place
  cpu-hotplug: rename function for better readability
  qom/cpu: remove the unused CPU hot-plug notifier
  pc: Update rtc_cmos in pc_cpu_plug
  pc: add cpu hotplug handler to PC_MACHINE
  acpi:piix4: convert cpu hotplug to hotplug_handler API
  acpi:ich9: convert cpu hotplug to hotplug_handler API
  acpi/cpu: add cpu hotplug callback function to match hotplug_handler API
  acpi: create separate file for TCPA log
  tests: fix rebuild-expected-aml.sh for acpi-test rename
  ...

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
5 years agoMerge remote-tracking branch 'remotes/riku/tags/pull-linux-user-20141101' into staging
Peter Maydell [Mon, 3 Nov 2014 20:23:15 +0000 (20:23 +0000)] 
Merge remote-tracking branch 'remotes/riku/tags/pull-linux-user-20141101' into staging

linux-user pull for 2.2

Two minor fixes and new a feature, addition of QEMU_RAND_SEED for
testing needs.

# gpg: Signature made Mon 03 Nov 2014 11:49:39 GMT using RSA key ID DE3C9BC0
# gpg: Good signature from "Riku Voipio <riku.voipio@iki.fi>"
# gpg:                 aka "Riku Voipio <riku.voipio@linaro.org>"

* remotes/riku/tags/pull-linux-user-20141101:
  elf: take phdr offset into account when calculating the program load address
  linux-user: Fix fault address truncation AArch64
  linux-user: Let user specify random seed

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
5 years agoMerge remote-tracking branch 'remotes/stefanha/tags/block-pull-request' into staging
Peter Maydell [Mon, 3 Nov 2014 18:34:08 +0000 (18:34 +0000)] 
Merge remote-tracking branch 'remotes/stefanha/tags/block-pull-request' into staging

# gpg: Signature made Mon 03 Nov 2014 11:50:53 GMT using RSA key ID 81AB73C8
# gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>"
# gpg:                 aka "Stefan Hajnoczi <stefanha@gmail.com>"

* remotes/stefanha/tags/block-pull-request: (53 commits)
  block: declare blockjobs and dataplane friends!
  block: let commit blockjob run in BDS AioContext
  block: let mirror blockjob run in BDS AioContext
  block: let stream blockjob run in BDS AioContext
  block: let backup blockjob run in BDS AioContext
  block: add bdrv_drain()
  blockjob: add block_job_defer_to_main_loop()
  blockdev: add note that block_job_cb() must be thread-safe
  blockdev: acquire AioContext in blockdev_mark_auto_del()
  blockdev: acquire AioContext in do_qmp_query_block_jobs_one()
  block: acquire AioContext in generic blockjob QMP commands
  iotests: Expand test 061
  block/qcow2: Simplify shared L2 handling in amend
  block/qcow2: Make get_refcount() global
  block/qcow2: Implement status CB for amend
  qemu-img: Fix insignificant memleak
  qemu-img: Add progress output for amend
  block: Add status callback to bdrv_amend_options()
  block: qemu-iotest 107 supports NFS
  iotests: Add test for qcow2's bdrv_make_empty
  ...

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
5 years agoMerge remote-tracking branch 'remotes/xtensa/tags/20141103-xtensa' into staging
Peter Maydell [Mon, 3 Nov 2014 16:43:32 +0000 (16:43 +0000)] 
Merge remote-tracking branch 'remotes/xtensa/tags/20141103-xtensa' into staging

Xtensa fixes and improvements 2014-11-03:
- build fixes for cores w/o windowed registers and with profiling
  interrupts;
- fix uImage load address for MMUv2 cores;
- add script for automatic core import from xtensa configuration overlay.

# gpg: Signature made Sun 02 Nov 2014 22:04:44 GMT using RSA key ID F83FA044
# gpg: Good signature from "Max Filippov <max.filippov@cogentembedded.com>"
# gpg:                 aka "Max Filippov <jcmvbkbc@gmail.com>"

* remotes/xtensa/tags/20141103-xtensa:
  MAINTAINERS: update xtensa boards
  target-xtensa: fix build for cores w/o windowed registers
  target-xtensa: add core importing script
  hw/xtensa/xtfpga: treat uImage load address as virtual
  hw/core/loader: implement address translation in uimage loader
  target-xtensa: avoid duplicate timer interrupt delivery
  target-xtensa: tests: pre-process tests linker script
  target-xtensa: add definition for XTHAL_INTTYPE_PROFILING

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
5 years agovga: flip qemu 2.2 pc machine types from cirrus to stdvga
Gerd Hoffmann [Tue, 28 Oct 2014 09:09:12 +0000 (10:09 +0100)] 
vga: flip qemu 2.2 pc machine types from cirrus to stdvga

This patch switches the default display from cirrus to vga
for the new (qemu 2.2+) machine types.  Old machines types
stay as-is for compatibility reasons.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
5 years agovga: add default display to machine class
Gerd Hoffmann [Tue, 28 Oct 2014 09:09:11 +0000 (10:09 +0100)] 
vga: add default display to machine class

This allows machine classes to specify which display device they want
as default.  If unspecified the current behavior (try cirrus, failing
that try stdvga, failing that use no display) will be used.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
5 years agovhost-user: fix mmap offset calculation
Michael S. Tsirkin [Sun, 2 Nov 2014 18:00:28 +0000 (20:00 +0200)] 
vhost-user: fix mmap offset calculation

qemu_get_ram_block_host_ptr should get ram_addr_t,
vhost-user passes in GPA.
That's very wrong.

Reported-by: Linhaifeng <haifeng.lin@huawei.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
5 years agoMerge remote-tracking branch 'remotes/mjt/tags/pull-trivial-patches-2014-11-02' into...
Peter Maydell [Mon, 3 Nov 2014 14:55:17 +0000 (14:55 +0000)] 
Merge remote-tracking branch 'remotes/mjt/tags/pull-trivial-patches-2014-11-02' into staging

trivial patches for 2014-11-02

# gpg: Signature made Sun 02 Nov 2014 11:54:43 GMT using RSA key ID A4C3D7DB
# gpg: Good signature from "Michael Tokarev <mjt@tls.msk.ru>"
# gpg:                 aka "Michael Tokarev <mjt@corpit.ru>"
# gpg:                 aka "Michael Tokarev <mjt@debian.org>"

* remotes/mjt/tags/pull-trivial-patches-2014-11-02: (23 commits)
  vdi: wrapped uuid_unparse() in #ifdef
  tap: fix possible fd leak in net_init_tap
  tap: do not close(fd) in net_init_tap_one
  target-i386: Remove unused model_features_t struct
  tap_int.h: remove repeating NETWORK_SCRIPT defines
  os-posix: reorder parent notification for -daemonize
  pidfile: stop making pidfile error a special case
  os-posix: replace goto again with a proper loop
  os-posix: use global daemon_pipe instead of cryptic fds[1]
  dump: Fix dump-guest-memory termination and use-after-close
  virtio-9p-proxy: improve error messages in connect_namedsocket()
  virtio-9p-proxy: fix error return in proxy_init()
  virtio-9p-proxy: Fix sockfd leak
  target-tricore: check return value before using it
  net/slirp: specify logbase for smbd
  Revert "os-posix: report error message when lock file failed"
  util: Improve os_mem_prealloc error message
  sparse: fix build
  target-arm: A64: remove redundant store
  target-xtensa: mark XtensaConfig structs as unused
  ...

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
5 years agoMerge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into staging
Peter Maydell [Mon, 3 Nov 2014 12:31:07 +0000 (12:31 +0000)] 
Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into staging

The last round of patches for soft freeze.  Includes ivshmem bugfixes,
megasas 2108 emulation, and other small patches here and there.

# gpg: Signature made Fri 31 Oct 2014 17:17:54 GMT using RSA key ID 78C7AE83
# gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>"
# gpg:                 aka "Paolo Bonzini <pbonzini@redhat.com>"
# gpg: WARNING: This key is not certified with sufficiently trusted signatures!
# gpg:          It is not certain that the signature belongs to the owner.
# Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4  E2F7 7E15 100C CD36 69B1
#      Subkey fingerprint: F133 3857 4B66 2389 866C  7682 BFFB D25F 78C7 AE83

* remotes/bonzini/tags/for-upstream: (35 commits)
  virtio-scsi: fix dataplane
  ivshmem: use error_report
  ivshmem: Fix fd leak on error
  ivshmem: Fix potential OOB r/w access
  ivshmem: validate incoming_posn value from server
  ivshmem: Check ivshmem_read() size argument
  i386: fix breakpoints handling in icount mode
  kvm_stat: Add powerpc support
  kvm_stat: Abstract ioctl numbers
  kvm_stat: Rework platform detection
  kvm_stat: Fix the non-x86 exit reasons
  kvm_stat: Only consider online cpus
  virtio-scsi: Fix num_queue input validation
  scsi: devirtualize unrealize of SCSI devices
  virtio-scsi: Fix memory leak when realize failed
  iscsi: Refuse to open as writable if the LUN is write protected
  kvmvapic: patch_instruction fix
  vl.c: Fix Coverity complaining for vmstate_dump_file
  Add skip_dump flag to ignore memory region during dump
  -machine vmport=off: Allow disabling of VMWare ioport emulation
  ...

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
5 years agotarget-mips: add MSA support to mips32r5-generic
Yongbok Kim [Sat, 1 Nov 2014 05:28:53 +0000 (05:28 +0000)] 
target-mips: add MSA support to mips32r5-generic

add MSA support to mips32r5-generic core definition

Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
5 years agodisas/mips.c: disassemble MSA instructions
Yongbok Kim [Sat, 1 Nov 2014 05:28:52 +0000 (05:28 +0000)] 
disas/mips.c: disassemble MSA instructions

disassemble MIPS SIMD Architecture instructions

Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
5 years agotarget-mips: add MSA MI10 format instructions
Yongbok Kim [Sat, 1 Nov 2014 05:28:51 +0000 (05:28 +0000)] 
target-mips: add MSA MI10 format instructions

add MSA MI10 format instructions
update LSA and DLSA for MSA

add 16, 64 bit load and store

Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
5 years agotarget-mips: add MSA 2RF format instructions
Yongbok Kim [Sat, 1 Nov 2014 05:28:50 +0000 (05:28 +0000)] 
target-mips: add MSA 2RF format instructions

add MSA 2RF format instructions

Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
5 years agotarget-mips: add MSA VEC/2R format instructions
Yongbok Kim [Sat, 1 Nov 2014 05:28:49 +0000 (05:28 +0000)] 
target-mips: add MSA VEC/2R format instructions

add MSA VEC/2R format instructions

Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
5 years agotarget-mips: add MSA 3RF format instructions
Yongbok Kim [Sat, 1 Nov 2014 05:28:48 +0000 (05:28 +0000)] 
target-mips: add MSA 3RF format instructions

add MSA 3RF format instructions

Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
5 years agotarget-mips: add MSA ELM format instructions
Yongbok Kim [Sat, 1 Nov 2014 05:28:47 +0000 (05:28 +0000)] 
target-mips: add MSA ELM format instructions

add MSA ELM format instructions

Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
5 years agotarget-mips: add MSA 3R format instructions
Yongbok Kim [Sat, 1 Nov 2014 05:28:46 +0000 (05:28 +0000)] 
target-mips: add MSA 3R format instructions

add MSA 3R format instructions

Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
5 years agotarget-mips: add MSA BIT format instructions
Yongbok Kim [Sat, 1 Nov 2014 05:28:45 +0000 (05:28 +0000)] 
target-mips: add MSA BIT format instructions

add MSA BIT format instructions

Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
5 years agotarget-mips: add MSA I5 format instruction
Yongbok Kim [Sat, 1 Nov 2014 05:28:44 +0000 (05:28 +0000)] 
target-mips: add MSA I5 format instruction

add MSA I5 format instructions

Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
5 years agotarget-mips: add MSA I8 format instructions
Yongbok Kim [Sat, 1 Nov 2014 05:28:43 +0000 (05:28 +0000)] 
target-mips: add MSA I8 format instructions

add MSA I8 format instructions

Reviewed-by: James Hogan <james.hogan@imgtec.com>
Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
5 years agotarget-mips: add MSA branch instructions
Yongbok Kim [Sat, 1 Nov 2014 05:28:42 +0000 (05:28 +0000)] 
target-mips: add MSA branch instructions

add MSA branch instructions

Reviewed-by: James Hogan <james.hogan@imgtec.com>
Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
5 years agotarget-mips: add msa_helper.c
Yongbok Kim [Sat, 1 Nov 2014 05:28:41 +0000 (05:28 +0000)] 
target-mips: add msa_helper.c

add msa_helper.c

Reviewed-by: James Hogan <james.hogan@imgtec.com>
Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
5 years agotarget-mips: add msa_reset(), global msa register
Yongbok Kim [Sat, 1 Nov 2014 05:28:40 +0000 (05:28 +0000)] 
target-mips: add msa_reset(), global msa register

add msa_reset() and global msa register (d type only)

Reviewed-by: James Hogan <james.hogan@imgtec.com>
Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
5 years agotarget-mips: add MSA opcode enum
Yongbok Kim [Sat, 1 Nov 2014 05:28:39 +0000 (05:28 +0000)] 
target-mips: add MSA opcode enum

add MSA opcode enum

Reviewed-by: James Hogan <james.hogan@imgtec.com>
Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
5 years agotarget-mips: stop translation after ctc1
Yongbok Kim [Sat, 1 Nov 2014 05:28:38 +0000 (05:28 +0000)] 
target-mips: stop translation after ctc1

stop translation as ctc1 instruction can change hflags

Reviewed-by: James Hogan <james.hogan@imgtec.com>
Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
5 years agotarget-mips: remove duplicated mips/ieee mapping function
Yongbok Kim [Sat, 1 Nov 2014 05:28:37 +0000 (05:28 +0000)] 
target-mips: remove duplicated mips/ieee mapping function

Remove the duplicated ieee_rm in gdbstub.c.
Make the other ieee_rm and ieee_ex_to_mips available to other files.

Reviewed-by: James Hogan <james.hogan@imgtec.com>
Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
5 years agotarget-mips: add MSA exceptions
Yongbok Kim [Sat, 1 Nov 2014 05:28:36 +0000 (05:28 +0000)] 
target-mips: add MSA exceptions

add MSA exceptions

Reviewed-by: James Hogan <james.hogan@imgtec.com>
Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
5 years agotarget-mips: add MSA defines and data structure
Yongbok Kim [Sat, 1 Nov 2014 05:28:35 +0000 (05:28 +0000)] 
target-mips: add MSA defines and data structure

add defines and data structure for MIPS SIMD Architecture

Reviewed-by: James Hogan <james.hogan@imgtec.com>
Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
5 years agotarget-mips: enable features in MIPS64R6-generic CPU
Leon Alrae [Fri, 11 Jul 2014 15:11:35 +0000 (16:11 +0100)] 
target-mips: enable features in MIPS64R6-generic CPU

Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
Reviewed-by: Yongbok Kim <yongbok.kim@imgtec.com>
5 years agotarget-mips: correctly handle access to unimplemented CP0 register
Leon Alrae [Fri, 11 Jul 2014 15:11:35 +0000 (16:11 +0100)] 
target-mips: correctly handle access to unimplemented CP0 register

Release 6 limits the number of cases where software can cause UNDEFINED or
UNPREDICTABLE behaviour. In this case, when accessing reserved / unimplemented
CP0 register, writes are ignored and reads return 0.

In pre-R6 the behaviour is not specified, but generating RI exception is not
what the real HW does.

Additionally, remove CP0 Random register as it became reserved in Release 6.

Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
Reviewed-by: Yongbok Kim <yongbok.kim@imgtec.com>
5 years agotarget-mips: add restrictions for possible values in registers
Leon Alrae [Fri, 11 Jul 2014 15:11:34 +0000 (16:11 +0100)] 
target-mips: add restrictions for possible values in registers

In Release 6 not all the values are allowed to be written to a register.
If the value is not valid or unsupported then it should stay unchanged.

For pre-R6 the existing behaviour has been changed only for CP0_Index register
as the current implementation does not seem to be correct - it looks like it
tries to limit the input value but the limit is higher than the actual
number of tlb entries.

Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
Reviewed-by: Yongbok Kim <yongbok.kim@imgtec.com>
5 years agotarget-mips: CP0_Status.CU0 no longer allows the user to access CP0
Leon Alrae [Fri, 11 Jul 2014 15:11:34 +0000 (16:11 +0100)] 
target-mips: CP0_Status.CU0 no longer allows the user to access CP0

Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
Reviewed-by: Yongbok Kim <yongbok.kim@imgtec.com>
5 years agotarget-mips: implement forbidden slot
Leon Alrae [Fri, 11 Jul 2014 15:11:33 +0000 (16:11 +0100)] 
target-mips: implement forbidden slot

When conditional compact branch is encountered decode one more instruction in
current translation block - that will be forbidden slot. Instruction in
forbidden slot will be executed only if conditional compact branch is not taken.

Any control transfer instruction (CTI) which are branches, jumps, ERET,
DERET, WAIT and PAUSE will generate RI exception if executed in forbidden or
delay slot.

Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
Reviewed-by: Yongbok Kim <yongbok.kim@imgtec.com>
5 years agotarget-mips: add Config5.SBRI
Leon Alrae [Fri, 11 Jul 2014 15:11:33 +0000 (16:11 +0100)] 
target-mips: add Config5.SBRI

SDBBP instruction Reserved Instruction control. The purpose of this field is
to restrict availability of SDBBP to kernel mode operation.

If the bit is set then SDBBP instruction can only be executed in kernel mode.
User execution of SDBBP will cause a Reserved Instruction exception.

Additionally add missing Config4 and Config5 cases for dm{f,t}c0.

Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
Reviewed-by: Yongbok Kim <yongbok.kim@imgtec.com>
5 years agotarget-mips: update cpu_save/cpu_load to support new registers
Leon Alrae [Mon, 7 Jul 2014 10:24:02 +0000 (11:24 +0100)] 
target-mips: update cpu_save/cpu_load to support new registers

Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
Reviewed-by: Yongbok Kim <yongbok.kim@imgtec.com>
5 years agotarget-mips: add BadInstr and BadInstrP support
Leon Alrae [Mon, 7 Jul 2014 10:24:01 +0000 (11:24 +0100)] 
target-mips: add BadInstr and BadInstrP support

BadInstr Register (CP0 Register 8, Select 1)
The BadInstr register is a read-only register that capture the most recent
instruction which caused an exception.

BadInstrP Register (CP0 Register 8, Select 2)
The BadInstrP register contains the prior branch instruction, when the
faulting instruction is in a branch delay slot.

Using error_code to indicate whether AdEL or TLBL was triggered during
instruction fetch, in this case BadInstr is not updated as valid instruction
word is not available.

Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
Reviewed-by: Yongbok Kim <yongbok.kim@imgtec.com>
5 years agotarget-mips: add TLBINV support
Leon Alrae [Mon, 7 Jul 2014 10:24:00 +0000 (11:24 +0100)] 
target-mips: add TLBINV support

For Standard TLB configuration (Config.MT=1):

TLBINV invalidates a set of TLB entries based on ASID. The virtual address is
ignored in the entry match. TLB entries which have their G bit set to 1 are not
modified.

TLBINVF causes all entries to be invalidated.

Single TLB entry can be marked as invalid on TLB entry write by having
EntryHi.EHINV set to 1.

Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
Reviewed-by: Yongbok Kim <yongbok.kim@imgtec.com>
5 years agotarget-mips: add new Read-Inhibit and Execute-Inhibit exceptions
Leon Alrae [Mon, 7 Jul 2014 10:23:59 +0000 (11:23 +0100)] 
target-mips: add new Read-Inhibit and Execute-Inhibit exceptions

An Execute-Inhibit exception occurs when the virtual address of an instruction
fetch matches a TLB entry whose XI bit is set. This exception type can only
occur if the XI bit is implemented within the TLB and is enabled, this is
denoted by the PageGrain XIE bit.

An Read-Inhibit exception occurs when the virtual address of a memory load
reference matches a TLB entry whose RI bit is set. This exception type can
only occur if the RI bit is implemented within the TLB and is enabled, this is
denoted by the PageGrain RIE bit.

Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
Reviewed-by: Yongbok Kim <yongbok.kim@imgtec.com>
5 years agotarget-mips: update PageGrain and m{t,f}c0 EntryLo{0,1}
Leon Alrae [Mon, 7 Jul 2014 10:23:59 +0000 (11:23 +0100)] 
target-mips: update PageGrain and m{t,f}c0 EntryLo{0,1}

PageGrain needs rw bitmask which differs between MIPS architectures.
In pre-R6 if RIXI is supported, PageGrain.XIE and PageGrain.RIE are writeable,
whereas in R6 they are read-only 1.

On MIPS64 mtc0 instruction left shifts bits 31:30 for MIPS32 backward
compatiblity, therefore there are separate mtc0 and dmtc0 helpers.

Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
Reviewed-by: Yongbok Kim <yongbok.kim@imgtec.com>
5 years agotarget-mips: add RI and XI fields to TLB entry
Leon Alrae [Mon, 7 Jul 2014 10:23:58 +0000 (11:23 +0100)] 
target-mips: add RI and XI fields to TLB entry

In Revision 3 of the architecture, the RI and XI bits were added to the TLB
to enable more secure access of memory pages. These bits (along with the Dirty
bit) allow the implementation of read-only, write-only, no-execute access
policies for mapped pages.

Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
Reviewed-by: Yongbok Kim <yongbok.kim@imgtec.com>
5 years agotarget-mips: distinguish between data load and instruction fetch
Leon Alrae [Mon, 7 Jul 2014 10:23:57 +0000 (11:23 +0100)] 
target-mips: distinguish between data load and instruction fetch

Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
Reviewed-by: Yongbok Kim <yongbok.kim@imgtec.com>
5 years agosoftmmu: provide softmmu access type enum
Leon Alrae [Mon, 7 Jul 2014 10:23:56 +0000 (11:23 +0100)] 
softmmu: provide softmmu access type enum

New MIPS features depend on the access type and enum is more convenient than
using the numbers directly.

Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
Reviewed-by: Thomas Huth <thuth@linux.vnet.ibm.com>
5 years agotarget-mips: add KScratch registers
Leon Alrae [Mon, 7 Jul 2014 10:23:55 +0000 (11:23 +0100)] 
target-mips: add KScratch registers

KScratch<n> Registers (CP0 Register 31, Selects 2 to 7)

The KScratch registers are read/write registers available for scratch pad
storage by kernel mode software. They are 32-bits in width for 32-bit
processors and 64-bits for 64-bit processors.

CP0Config4.KScrExist[2:7] bits indicate presence of CP0_KScratch1-6 registers.
For Release 6, all KScratch registers are required.

Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
Reviewed-by: Yongbok Kim <yongbok.kim@imgtec.com>
5 years agoblock: declare blockjobs and dataplane friends!
Stefan Hajnoczi [Tue, 21 Oct 2014 11:04:00 +0000 (12:04 +0100)] 
block: declare blockjobs and dataplane friends!

Now that blockjobs use AioContext they are safe for use with dataplane.
Unblock them!

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
Message-id: 1413889440-32577-12-git-send-email-stefanha@redhat.com

5 years agoblock: let commit blockjob run in BDS AioContext
Stefan Hajnoczi [Tue, 21 Oct 2014 11:03:59 +0000 (12:03 +0100)] 
block: let commit blockjob run in BDS AioContext

The commit block job must run in the BlockDriverState AioContext so that
it works with dataplane.

Acquire the AioContext in blockdev.c so starting the block job is safe.
One detail here is that the bdrv_drain_all() must be moved inside the
aio_context_acquire() region so requests cannot sneak in between the
drain and acquire.

The completion code in block/commit.c must perform backing chain
manipulation and bdrv_reopen() from the main loop.  Use
block_job_defer_to_main_loop() to achieve that.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
Message-id: 1413889440-32577-11-git-send-email-stefanha@redhat.com

5 years agoblock: let mirror blockjob run in BDS AioContext
Stefan Hajnoczi [Tue, 21 Oct 2014 11:03:58 +0000 (12:03 +0100)] 
block: let mirror blockjob run in BDS AioContext

The mirror block job must run in the BlockDriverState AioContext so that
it works with dataplane.

Acquire the AioContext in blockdev.c so starting the block job is safe.

Note that to_replace is treated separately from other BlockDriverStates
in that it does not need to be in the same AioContext.  Explicitly
acquire/release to_replace's AioContext when accessing it.

The completion code in block/mirror.c must perform BDS graph
manipulation and bdrv_reopen() from the main loop.  Use
block_job_defer_to_main_loop() to achieve that.

The bdrv_drain_all() call is not allowed outside the main loop since it
could lead to lock ordering problems.  Use bdrv_drain(bs) instead
because we have acquired the AioContext so nothing else can sneak in
I/O.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
Message-id: 1413889440-32577-10-git-send-email-stefanha@redhat.com

5 years agoblock: let stream blockjob run in BDS AioContext
Stefan Hajnoczi [Tue, 21 Oct 2014 11:03:57 +0000 (12:03 +0100)] 
block: let stream blockjob run in BDS AioContext

The stream block job must run in the BlockDriverState AioContext so that
it works with dataplane.

The basics of acquiring the AioContext are easy in blockdev.c.

The tricky part is the completion code which drops part of the backing
file chain.  This must be done in the main loop where bdrv_unref() and
bdrv_close() are safe to call.  Use block_job_defer_to_main_loop() to
achieve that.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
Message-id: 1413889440-32577-9-git-send-email-stefanha@redhat.com

5 years agoblock: let backup blockjob run in BDS AioContext
Stefan Hajnoczi [Tue, 21 Oct 2014 11:03:56 +0000 (12:03 +0100)] 
block: let backup blockjob run in BDS AioContext

The backup block job must run in the BlockDriverState AioContext so that
it works with dataplane.

The basics of acquiring the AioContext are easy in blockdev.c.

The completion code in block/backup.c must call bdrv_unref() from the
main loop.  Use block_job_defer_to_main_loop() to achieve that.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
Message-id: 1413889440-32577-8-git-send-email-stefanha@redhat.com

5 years agoblock: add bdrv_drain()
Stefan Hajnoczi [Tue, 21 Oct 2014 11:03:55 +0000 (12:03 +0100)] 
block: add bdrv_drain()

Now that op blockers are in use, we can ensure that no other sources are
generating I/O on a BlockDriverState.  Therefore it is possible to drain
requests for a single BDS.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
Message-id: 1413889440-32577-7-git-send-email-stefanha@redhat.com

5 years agoblockjob: add block_job_defer_to_main_loop()
Stefan Hajnoczi [Tue, 21 Oct 2014 11:03:54 +0000 (12:03 +0100)] 
blockjob: add block_job_defer_to_main_loop()

Block jobs will run in the BlockDriverState's AioContext, which may not
always be the QEMU main loop.

There are some block layer APIs that are either not thread-safe or risk
lock ordering problems.  This includes bdrv_unref(), bdrv_close(), and
anything that calls bdrv_drain_all().

The block_job_defer_to_main_loop() API allows a block job to schedule a
function to run in the main loop with the BlockDriverState AioContext
held.

This function will be used to perform cleanup and backing chain
manipulations in block jobs.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
Message-id: 1413889440-32577-6-git-send-email-stefanha@redhat.com

5 years agoblockdev: add note that block_job_cb() must be thread-safe
Stefan Hajnoczi [Tue, 21 Oct 2014 11:03:53 +0000 (12:03 +0100)] 
blockdev: add note that block_job_cb() must be thread-safe

This function is correct but we should document the constraint that
everything must be thread-safe.

Emitting QMP events and scheduling BHs are both thread-safe so nothing
needs to be done here.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
Message-id: 1413889440-32577-5-git-send-email-stefanha@redhat.com

5 years agoblockdev: acquire AioContext in blockdev_mark_auto_del()
Stefan Hajnoczi [Tue, 21 Oct 2014 11:03:52 +0000 (12:03 +0100)] 
blockdev: acquire AioContext in blockdev_mark_auto_del()

When an emulated storage controller is unrealized it will call
blockdev_mark_auto_del().  This will cancel any running block job (and
that eventually releases its reference to the BDS so it can be freed).

Since the block job may be executing in another AioContext we must
acquire/release to ensure thread safety.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
Message-id: 1413889440-32577-4-git-send-email-stefanha@redhat.com

5 years agoblockdev: acquire AioContext in do_qmp_query_block_jobs_one()
Stefan Hajnoczi [Tue, 21 Oct 2014 11:03:51 +0000 (12:03 +0100)] 
blockdev: acquire AioContext in do_qmp_query_block_jobs_one()

Make sure that query-block-jobs acquires the BlockDriverState
AioContext so that the blockjob isn't running in another thread while we
access its state.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
Message-id: 1413889440-32577-3-git-send-email-stefanha@redhat.com

5 years agoblock: acquire AioContext in generic blockjob QMP commands
Stefan Hajnoczi [Tue, 21 Oct 2014 11:03:50 +0000 (12:03 +0100)] 
block: acquire AioContext in generic blockjob QMP commands

block-job-set-speed, block-job-cancel, block-job-pause,
block-job-resume, and block-job-complete must acquire the
BlockDriverState AioContext so that it is safe to access bs.

At the moment bs->job is always NULL when dataplane is active because op
blockers prevent blockjobs from starting.  Once the rest of the blockjob
API has been made aware of AioContext we can drop the op blocker.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
Message-id: 1413889440-32577-2-git-send-email-stefanha@redhat.com

5 years agoiotests: Expand test 061
Max Reitz [Mon, 27 Oct 2014 10:12:56 +0000 (11:12 +0100)] 
iotests: Expand test 061

Add some tests for progress output to 061.

Signed-off-by: Max Reitz <mreitz@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Benoît Canet <benoit.canet@nodalink.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Benoit Canet <benoit@irqsave.net>
Message-id: 1414404776-4919-8-git-send-email-mreitz@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
5 years agoblock/qcow2: Simplify shared L2 handling in amend
Max Reitz [Mon, 27 Oct 2014 10:12:55 +0000 (11:12 +0100)] 
block/qcow2: Simplify shared L2 handling in amend

Currently, we have a bitmap for keeping track of which clusters have
been created during the zero cluster expansion process. This was
necessary because we need to properly increase the refcount for shared
L2 tables.

However, now we can simply take the L2 refcount and use it for the
cluster allocated for expansion. This will be the correct refcount and
therefore we don't have to remember that cluster having been allocated
any more.

Signed-off-by: Max Reitz <mreitz@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Benoît Canet <benoit.canet@nodalink.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Benoit Canet <benoit@irqsave.net>
Message-id: 1414404776-4919-7-git-send-email-mreitz@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
5 years agoblock/qcow2: Make get_refcount() global
Max Reitz [Mon, 27 Oct 2014 10:12:54 +0000 (11:12 +0100)] 
block/qcow2: Make get_refcount() global

Reading the refcount of a cluster is an operation which can be useful in
all of the qcow2 code, so make that function globally available.

While touching this function, amend the comment describing the "addend"
parameter: It is (no longer, if it ever was) necessary to have it set to
-1 or 1; any value is fine.

Signed-off-by: Max Reitz <mreitz@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Benoît Canet <benoit.canet@nodalink.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Benoit Canet <benoit@irqsave.net>
Message-id: 1414404776-4919-6-git-send-email-mreitz@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
5 years agoblock/qcow2: Implement status CB for amend
Max Reitz [Mon, 27 Oct 2014 10:12:53 +0000 (11:12 +0100)] 
block/qcow2: Implement status CB for amend

The only really time-consuming operation potentially performed by
qcow2_amend_options() is zero cluster expansion when downgrading qcow2
images from compat=1.1 to compat=0.10, so report status of that
operation and that operation only through the status CB.

For this, approximate the progress as the number of L1 entries visited
during the operation.

Signed-off-by: Max Reitz <mreitz@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Benoît Canet <benoit.canet@nodalink.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Benoit Canet <benoit@irqsave.net>
Message-id: 1414404776-4919-5-git-send-email-mreitz@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
5 years agoqemu-img: Fix insignificant memleak
Max Reitz [Mon, 27 Oct 2014 10:12:52 +0000 (11:12 +0100)] 
qemu-img: Fix insignificant memleak

As soon as options is set in img_amend(), it needs to be freed before
the function returns. This leak is rather insignificant, as qemu-img
will exit subsequently anyway, but there's no point in not fixing it.

Signed-off-by: Max Reitz <mreitz@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Benoit Canet <benoit@irqsave.net>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Benoît Canet <benoit.canet@nodalink.com>
Message-id: 1414404776-4919-4-git-send-email-mreitz@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
5 years agoqemu-img: Add progress output for amend
Max Reitz [Mon, 27 Oct 2014 10:12:51 +0000 (11:12 +0100)] 
qemu-img: Add progress output for amend

Now that bdrv_amend_options() supports a status callback, use it to
display a progress report.

Signed-off-by: Max Reitz <mreitz@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Benoît Canet <benoit.canet@nodalink.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Message-id: 1414404776-4919-3-git-send-email-mreitz@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
5 years agoblock: Add status callback to bdrv_amend_options()
Max Reitz [Mon, 27 Oct 2014 10:12:50 +0000 (11:12 +0100)] 
block: Add status callback to bdrv_amend_options()

Depending on the changed options and the image format,
bdrv_amend_options() may take a significant amount of time. In these
cases, a way to be informed about the operation's status is desirable.

Since the operation is rather complex and may fundamentally change the
image, implementing it as AIO or a coroutine does not seem feasible. On
the other hand, implementing it as a block job would be significantly
more difficult than a simple callback and would not add benefits other
than progress report to the amending operation, because it should not
actually be run as a block job at all.

A callback may not be very pretty, but it's very easy to implement and
perfectly fits its purpose here.

Signed-off-by: Max Reitz <mreitz@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Benoît Canet <benoit.canet@nodalink.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Message-id: 1414404776-4919-2-git-send-email-mreitz@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
5 years agoblock: qemu-iotest 107 supports NFS
Peter Lieven [Sat, 25 Oct 2014 15:05:37 +0000 (17:05 +0200)] 
block: qemu-iotest 107 supports NFS

As discussed during review a follow up for Max's fix.

Signed-off-by: Peter Lieven <pl@kamp.de>
Reviewed-by: Max Reitz <mreitz@redhat.com>
Message-id: 1414249537-29257-1-git-send-email-pl@kamp.de
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
5 years agoiotests: Add test for qcow2's bdrv_make_empty
Max Reitz [Fri, 24 Oct 2014 13:57:43 +0000 (15:57 +0200)] 
iotests: Add test for qcow2's bdrv_make_empty

Add a test for qcow2's fast bdrv_make_empty implementation on images
without internal snapshots.

Signed-off-by: Max Reitz <mreitz@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Message-id: 1414159063-25977-15-git-send-email-mreitz@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
5 years agoiotests: Add test for backing-chain commits
Max Reitz [Fri, 24 Oct 2014 13:57:42 +0000 (15:57 +0200)] 
iotests: Add test for backing-chain commits

Add a test for qemu-img commit on backing chains with more than two
images. This test also checks whether the top image is emptied (unless
this is prevented by specifying either -d or -b) and does therefore not
work for qed and vmdk which requires it to be separate from 020.

Signed-off-by: Max Reitz <mreitz@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Message-id: 1414159063-25977-14-git-send-email-mreitz@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
5 years agoiotests: Add _filter_qemu_img_map
Max Reitz [Fri, 24 Oct 2014 13:57:41 +0000 (15:57 +0200)] 
iotests: Add _filter_qemu_img_map

As different image formats most probably map guest addresses to
different host addresses, add a filter to filter the host addresses out;
also, the image filename should be filtered.

Signed-off-by: Max Reitz <mreitz@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Message-id: 1414159063-25977-13-git-send-email-mreitz@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
5 years agoqemu-img: Specify backing file for commit
Max Reitz [Fri, 24 Oct 2014 13:57:40 +0000 (15:57 +0200)] 
qemu-img: Specify backing file for commit

Introduce a new parameter for qemu-img commit which may be used to
explicitly specify the backing file into which an image should be
committed if the backing chain has more than a single layer.

[Applied Eric Blake's qemu-img.texi documentation rewording
--Stefan]

Signed-off-by: Max Reitz <mreitz@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Message-id: 1414159063-25977-12-git-send-email-mreitz@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
5 years agoqemu-img: Enable progress output for commit
Max Reitz [Fri, 24 Oct 2014 13:57:39 +0000 (15:57 +0200)] 
qemu-img: Enable progress output for commit

Implement progress output for the commit command by querying the
progress of the block job.

Signed-off-by: Max Reitz <mreitz@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Message-id: 1414159063-25977-11-git-send-email-mreitz@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
5 years agoqemu-img: Empty image after commit
Max Reitz [Fri, 24 Oct 2014 13:57:38 +0000 (15:57 +0200)] 
qemu-img: Empty image after commit

After the top image has been committed, it should be emptied unless
specified otherwise.

Signed-off-by: Max Reitz <mreitz@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Message-id: 1414159063-25977-10-git-send-email-mreitz@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
5 years agoqemu-img: Implement commit like QMP
Max Reitz [Fri, 24 Oct 2014 13:57:37 +0000 (15:57 +0200)] 
qemu-img: Implement commit like QMP

qemu-img should use QMP commands whenever possible in order to ensure
feature completeness of both online and offline image operations. As
qemu-img itself has no access to QMP (since this would basically require
just everything being linked into qemu-img), imitate QMP's
implementation of block-commit by using commit_active_start() and then
waiting for the block job to finish.

Signed-off-by: Max Reitz <mreitz@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Message-id: 1414159063-25977-9-git-send-email-mreitz@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
5 years agoblock/mirror: Improve progress report
Max Reitz [Fri, 24 Oct 2014 13:57:36 +0000 (15:57 +0200)] 
block/mirror: Improve progress report

Instead of taking the total length of the block device as the block
job's length, use the number of dirty sectors. The progress is now the
number of sectors mirrored to the target block device. Note that this
may result in the job's length increasing during operation, which is
however in fact desirable.

Signed-off-by: Max Reitz <mreitz@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Message-id: 1414159063-25977-8-git-send-email-mreitz@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
5 years agoiotests: Omit length/offset test in 040 and 041
Max Reitz [Fri, 24 Oct 2014 13:57:35 +0000 (15:57 +0200)] 
iotests: Omit length/offset test in 040 and 041

As of a follow-up patch to this one, the length of a mirror block job
will no longer directly depend on the size of the block device;
therefore, drop these checks from this test. Instead, just check whether
the final offset equals the block job length.

As 041 uses the wait_until_completed function from iotests.py, the same
applies there as well which in turn affects tests 030, 055 and 056. On
the other hand, a block job's length does not have to be related to the
length of the image file in the first place, so that check was
questionable anyway.

Signed-off-by: Max Reitz <mreitz@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Message-id: 1414159063-25977-7-git-send-email-mreitz@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
5 years agoblockjob: Add "ready" field
Max Reitz [Fri, 24 Oct 2014 13:57:34 +0000 (15:57 +0200)] 
blockjob: Add "ready" field

When a block job signals readiness, this is currently reported only
through QMP. If qemu wants to use block jobs for internal tasks, there
needs to be another way to correctly detect when a block job may be
completed.

For this reason, introduce a bool "ready" which is set when the block
job may be completed.

Signed-off-by: Max Reitz <mreitz@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Message-id: 1414159063-25977-6-git-send-email-mreitz@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
5 years agoblockjob: Introduce block_job_complete_sync()
Max Reitz [Fri, 24 Oct 2014 13:57:33 +0000 (15:57 +0200)] 
blockjob: Introduce block_job_complete_sync()

Implement block_job_complete_sync() by doing the exact same thing as
block_job_cancel_sync() does, only with calling block_job_complete()
instead of block_job_cancel().

Signed-off-by: Max Reitz <mreitz@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Message-id: 1414159063-25977-5-git-send-email-mreitz@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
5 years agoqcow2: Optimize bdrv_make_empty()
Max Reitz [Fri, 24 Oct 2014 13:57:32 +0000 (15:57 +0200)] 
qcow2: Optimize bdrv_make_empty()

bdrv_make_empty() is currently only called if the current image
represents an external snapshot that has been committed to its base
image; it is therefore unlikely to have internal snapshots. In this
case, bdrv_make_empty() can be greatly sped up by emptying the L1 and
refcount table (while having the dirty flag set, which only works for
compat=1.1) and creating a trivial refcount structure.

If there are snapshots or for compat=0.10, fall back to the simple
implementation (discard all clusters).

[Applied s/clusters/cluster/ typo fix suggested by Eric Blake
--Stefan]

Signed-off-by: Max Reitz <mreitz@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Message-id: 1414159063-25977-4-git-send-email-mreitz@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
5 years agoqcow2: Implement bdrv_make_empty()
Max Reitz [Fri, 24 Oct 2014 13:57:31 +0000 (15:57 +0200)] 
qcow2: Implement bdrv_make_empty()

Implement this function by making all clusters in the image file fall
through to the backing file (by using the recently extended discard).

Signed-off-by: Max Reitz <mreitz@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Message-id: 1414159063-25977-3-git-send-email-mreitz@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
5 years agoqcow2: Allow "full" discard
Max Reitz [Fri, 24 Oct 2014 13:57:30 +0000 (15:57 +0200)] 
qcow2: Allow "full" discard

Normally, discarded sectors should read back as zero. However, there are
cases in which a sector (or rather cluster) should be discarded as if
they were never written in the first place, that is, reading them should
fall through to the backing file again.

Signed-off-by: Max Reitz <mreitz@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Message-id: 1414159063-25977-2-git-send-email-mreitz@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
5 years agoiotests: Add test for external image truncation
Max Reitz [Fri, 24 Oct 2014 10:58:00 +0000 (12:58 +0200)] 
iotests: Add test for external image truncation

It should not be happening, but it is possible to truncate an image
outside of qemu while qemu is running (or any of the qemu tools using
the block layer. raw_co_get_block_status() should not break then.

While touching this test, replace the existing "truncate" invocation by
"$QEMU_IMG convert -f raw".

Signed-off-by: Max Reitz <mreitz@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Message-id: 1414148280-17949-4-git-send-email-mreitz@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
5 years agoraw-posix: raw_co_get_block_status() return value
Max Reitz [Fri, 24 Oct 2014 10:57:59 +0000 (12:57 +0200)] 
raw-posix: raw_co_get_block_status() return value

Instead of generating the full return value thrice in try_fiemap(),
try_seek_hole() and as a fall-back in raw_co_get_block_status() itself,
generate the value only in raw_co_get_block_status().

While at it, also remove the pnum parameter from try_fiemap() and
try_seek_hole().

Suggested-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Max Reitz <mreitz@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Message-id: 1414148280-17949-3-git-send-email-mreitz@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
5 years agoraw-posix: Fix raw_co_get_block_status() after EOF
Max Reitz [Fri, 24 Oct 2014 10:57:58 +0000 (12:57 +0200)] 
raw-posix: Fix raw_co_get_block_status() after EOF

As its comment states, raw_co_get_block_status() should unconditionally
return 0 and set *pnum to 0 for after EOF.

An assertion after lseek(..., SEEK_HOLE) tried to catch this case by
asserting that errno != -ENXIO (which would indicate a position after
the EOF); but it should be errno != ENXIO instead. Regardless of that,
there should be no such assertion at all. If bdrv_getlength() returned
an outdated value and the image has been resized outside of qemu,
lseek() will return with errno == ENXIO. Just return that value as an
error then.

Setting *pnum to 0 and returning 0 should not be done here, as in that
case we should update the device length as well. So, from qemu's
perspective, the file has not been resized; it's just that there was an
error querying sectors beyond a certain point (the actual file size).

Additionally, nb_sectors should be clamped against the image end. This
was probably not an issue if FIEMAP or SEEK_HOLE/SEEK_DATA worked, but
the fallback did not take this case into account.

Reported-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Max Reitz <mreitz@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Message-id: 1414148280-17949-2-git-send-email-mreitz@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
5 years agoblock/curl: Improve type safety of s->timeout.
Richard W.M. Jones [Sun, 26 Oct 2014 11:05:27 +0000 (11:05 +0000)] 
block/curl: Improve type safety of s->timeout.

qemu_opt_get_number returns a uint64_t, and curl_easy_setopt expects a
long (not an int).  There is no warning about the latter type error
because curl_easy_setopt uses a varargs argument.

Store the timeout (which is a positive number of seconds) as a
uint64_t.  Check that the number given by the user is reasonable.
Zero is permissible (meaning no timeout is enforced by cURL).

Cast it to long before calling curl_easy_setopt to fix the type error.

Example error message after this change has been applied:

$ ./qemu-img create -f qcow2 /tmp/test.qcow2 \
    -b 'json: { "file.driver":"https",
                "file.url":"https://foo/bar",
                "file.timeout":-1 }'
qemu-img: /tmp/test.qcow2: Could not open 'json: { "file.driver":"https", "file.url":"https://foo/bar", "file.timeout":-1 }': timeout parameter is too large or negative: Invalid argument

Signed-off-by: Richard W.M. Jones <rjones@redhat.com>
Reviewed-by: Laszlo Ersek <lersek@redhat.com>
Reviewed-by: Gonglei <arei.gonglei@huawei.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
5 years agosnapshot: add bdrv_drain_all() to bdrv_snapshot_delete() to avoid concurrency problem
Zhang Haoyu [Tue, 21 Oct 2014 08:38:01 +0000 (16:38 +0800)] 
snapshot: add bdrv_drain_all() to bdrv_snapshot_delete() to avoid concurrency problem

If there are still pending i/o while deleting snapshot,
because deleting snapshot is done in non-coroutine context, and
the pending i/o read/write (bdrv_co_do_rw) is done in coroutine context,
so it's possible to cause concurrency problem between above two operations.
Add bdrv_drain_all() to bdrv_snapshot_delete() to avoid this problem.

Signed-off-by: Zhang Haoyu <zhanghy@sangfor.com>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Message-id: 201410211637596311287@sangfor.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>