Commit graph

12013 commits

Author SHA1 Message Date
Peter Crosthwaite 401cf7fdc4 loader: Abstract away ref to memory region names
Use the function provided rather than spying on the struct.

Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-08-18 12:06:21 +02:00
Paolo Bonzini c54779f962 tpm_tis: remove instance_finalize callback
It is never used, since ISA device are not hot-unpluggable.

Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-08-18 12:06:21 +02:00
Paolo Bonzini 469b046ead memory: remove memory_region_destroy
The function is empty after the previous patch, so remove it.

Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-08-18 12:06:21 +02:00
Paolo Bonzini d8d9581460 memory: convert memory_region_destroy to object_unparent
Explicitly call object_unparent in the few places where we
will re-create the memory region.  If the memory region is
simply being destroyed as part of device teardown, let QOM
handle it.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-08-18 12:06:20 +02:00
Paolo Bonzini eed7930950 nic: do not destroy memory regions in cleanup functions
The memory regions should be destroyed in the unrealize function;
since these NICs are not even qdev-ified, they cannot be unplugged
and they do not have to do anything to destroy their memory regions.

Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-08-17 23:25:24 +02:00
Paolo Bonzini ad37168cbd vga: do not dynamically allocate chain4_alias
Instead, add a boolean variable to indicate the presence of the region.
This avoids a repeated malloc/free (later we can also avoid the
add_child/unparent by changing the offset/size of the alias).

Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-08-17 23:25:24 +02:00
Paolo Bonzini 1dd79a237e sysbus: remove unused function sysbus_del_io
Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-08-17 23:25:24 +02:00
Paolo Bonzini 33cbb2c546 virtio-scsi: implement parse_cdb
Enable passthrough of vendor-specific commands.

Reviewed-by: Fam Zheng <famz@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-07-29 17:36:38 +02:00
Paolo Bonzini 3e7e180ab3 scsi-block, scsi-generic: implement parse_cdb
The callback lets the bus provide the direction and transfer count
for passthrough commands, enabling passthrough of vendor-specific
commands.

Reviewed-by: Fam Zheng <famz@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-07-29 17:36:33 +02:00
Paolo Bonzini 592c3b289f scsi-block: extract scsi_block_is_passthrough
This will be used for both scsi_block_new_request and the scsi-block
implementation of parse_cdb.

Reviewed-by: Fam Zheng <famz@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-07-29 17:36:29 +02:00
Paolo Bonzini ff34c32ccc scsi-bus: introduce parse_cdb in SCSIDeviceClass and SCSIBusInfo
These callbacks will let devices do their own request parsing, or
defer it to the bus.  If the bus does not provide an implementation,
in turn, fall back to the default parsing routine.

Swap the first two arguments to scsi_req_parse, and rename it to
scsi_req_parse_cdb, for consistency.

Reviewed-by: Fam Zheng <famz@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-07-29 17:36:25 +02:00
Paolo Bonzini 769998a1db scsi-bus: prepare scsi_req_new for introduction of parse_cdb
The per-SCSIDevice parse_cdb callback must not be called if the
request will go through special SCSIReqOps, so detect the special
cases early enough.

Reviewed-by: Fam Zheng <famz@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-07-29 17:36:09 +02:00
Peter Maydell 146ae00192 Patch queue for ppc - 2014-07-15
Some more bug fixes during the RC phase:
 
   - Fix huge page mapping regressions
   - Fix Book3S thread number enumeration
   - Fix Book3S VFIO permission issue
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2.0.19 (GNU/Linux)
 
 iQIcBAABAgAGBQJTxTciAAoJECszeR4D/txgfisQAIOmsTsc0dL5DCu+blE1paMV
 VB4kJP3HbKwP2NKsT/JrzZ+0x2kzAa4g70SqhaskEFr3NnABW3dIQttfY/3I1hPY
 AS6Ph3JZy2O23v2RLKgKIi3THrasiP4UtyNdNqVcNBrgp6HxmEcpxdy/6o7smPwQ
 lkBp/oUXaUeleCUZnBao1aH0pZlPamyRhd/9xQaWNHMFpNQhhmebUR+TQbOoxogS
 H8pLRGERyeLRfmDFfjZ7VHerHWZ0O9Z+fDm+z6YTtH5VYVev4nHNIZM8O/qE+lHF
 U7Pr70WIj/8QCuLDjv/+c++pF0o469hdrGYvqeJD+LJNfEBve0TMnefYu7n7r/yk
 zkyvlQ/vsRGQLFiFg3klLAPAC2j+gtsxinisfZohDjrCfs04NhKjZtDzphEWAopL
 K7IC70l0cfJYLt6r3+JsNhPKnYy3JnmP/4hkAfL66RHizLVEvzVjCBU0y/FBxaqV
 DtCkRqKa4MWwer1A+8T0UChJY0zs8Q5KMfmPKoKbrmJYIphh26m6O9EUpqx2dw/d
 SrNqgtZrILbnYZh12O/wsWY9apIPBhE3Pe4yZFgpNwbKb2gEiqxVIGz8lLIkqbzg
 t/703p95kO3xeqSrSKfAZcJoZbds5DNtoljB2brEsslisIxmyeDbw/61TgNWtGGJ
 N8WNGvE0IdOZBDsx3Nn0
 =5fAV
 -----END PGP SIGNATURE-----

Merge remote-tracking branch 'remotes/agraf/tags/signed-ppc-for-upstream' into staging

Patch queue for ppc - 2014-07-15

Some more bug fixes during the RC phase:

  - Fix huge page mapping regressions
  - Fix Book3S thread number enumeration
  - Fix Book3S VFIO permission issue

# gpg: Signature made Tue 15 Jul 2014 15:13:54 BST using RSA key ID 03FEDC60
# gpg: Can't check signature: public key not found

* remotes/agraf/tags/signed-ppc-for-upstream:
  sPAPR/IOMMU: Fix TCE entry permission
  spapr: Enable use of huge pages
  spapr: Move RMA memory region registration code
  ppc: memory: Replace memory_region_init_ram with memory_region_allocate_system_memory
  target-ppc: Fix number of threads per core limit

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-07-15 15:51:12 +01:00
Gavin Shan 27e27782f7 sPAPR/IOMMU: Fix TCE entry permission
The permission of TCE entry should exclude physical base address.
Otherwise, unmapping TCE entry can be interpreted to mapping TCE
entry wrongly for VFIO devices.

Signed-off-by: Gavin Shan <gwshan@linux.vnet.ibm.com>
Acked-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Alexander Graf <agraf@suse.de>
2014-07-15 16:11:59 +02:00
Alexey Kardashevskiy f92f5da108 spapr: Enable use of huge pages
0b183fc87 "memory: move mem_path handling to
memory_region_allocate_system_memory" disabled -mempath use for all
machines that do not use memory_region_allocate_system_memory() to
register RAM. Since SPAPR uses memory_region_init_ram(), the huge pages
support was disabled for it.

This replaces memory_region_init_ram()+vmstate_register_ram_global() with
memory_region_allocate_system_memory() to get huge pages back.

This changes RAM size from (ram_limit - rma_alloc_size) to ram_limit as
the previous patch moved RMA memory region allocation after RAM allocation
and therefore this change does not have immediate effect but simplifies
the code.

Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
Signed-off-by: Alexander Graf <agraf@suse.de>
2014-07-15 16:11:59 +02:00
Alexey Kardashevskiy 658fa66b81 spapr: Move RMA memory region registration code
PPC970 does not support VRMA (virtual RMA) so real memory required
for SLOF to execute must be allocated by the KVM_ALLOCATE_RMA ioctl.
Later this memory is used as a part of the guest RAM area.
The RMA allocating code also registers a memory region for this piece
of RAM.

We are going to simplify memory regions layout: RMA memory region
will be a subregion in the RAM memory region, both starting from zero.
This way we will not have to take care of start address alignment for
the piece of RAM next to the RMA.

This moves memory region business closer to the RAM memory region
creation/allocation code.

As this is a mechanical patch, no change in behaviour is expected.

Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
[agraf: fix compilation on non-kvm systems]
Signed-off-by: Alexander Graf <agraf@suse.de>
2014-07-15 16:11:59 +02:00
Shreyas B. Prabhu e938ba0c35 ppc: memory: Replace memory_region_init_ram with memory_region_allocate_system_memory
Commit 0b183fc871:"memory: move mem_path handling to
memory_region_allocate_system_memory" split memory_region_init_ram and
memory_region_init_ram_from_file. Also it moved mem-path handling a step
up from memory_region_init_ram to memory_region_allocate_system_memory.

Therefore for any board that uses memory_region_init_ram directly,
-mem-path is not supported.

Fix this by replacing memory_region_init_ram with
memory_region_allocate_system_memory.

Signed-off-by: Shreyas B. Prabhu <shreyas@linux.vnet.ibm.com>
Signed-off-by: Alexander Graf <agraf@suse.de>
2014-07-15 16:11:58 +02:00
Peter Maydell 2c65ebe646 Block pull request
-----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQEcBAABAgAGBQJTxTFNAAoJEJykq7OBq3PIti0IALlbGEfEjysUSmKbmnhJg5pH
 MoEkGJ8FZ7nIaaLfKPfVIzc5oeZVTWrtyckJLuLdxGOA1BYGXMQ/41Qs64UyT6NA
 TIFE9nZX6h5hQrLXt9u0O6smpkq7wt7M9a3RhVxUZ27Rujf8q+8V2KmgdEy8tchq
 vesyeDXBBx/G6tDGQey7WoRq1s6NafdNm9V0V8pkhonQ3uVErqhz5ZAaTV0zDZIr
 7CreUitr0XPsMx+FIAwEsRcFxw1uD5c5LQVWzBtNJUTMIjcmhauXH8YkreDYCJVY
 4Q555XvMGbEe/4OTqfhq5LI065uTpwYC1cvM16rVksa7KN25salupUn2MBVTbOI=
 =dnaT
 -----END PGP SIGNATURE-----

Merge remote-tracking branch 'remotes/stefanha/tags/block-pull-request' into staging

Block pull request

# gpg: Signature made Tue 15 Jul 2014 14:49:01 BST using RSA key ID 81AB73C8
# gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>"
# gpg:                 aka "Stefan Hajnoczi <stefanha@gmail.com>"

* remotes/stefanha/tags/block-pull-request:
  virtio-blk: dataplane: notify guest as a batch
  virtio-blk: data-plane: fix save/set .complete_request in start
  linux-aio: Fix laio resource leak

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-07-15 15:06:17 +01:00
Ming Lei 5b2ffbe4d9 virtio-blk: dataplane: notify guest as a batch
Now requests are submitted as a batch, so it is natural
to notify guest as a batch too.

This may suppress interrupt notification to VM a lot:

        - in my test, decreased by ~13K/sec

Signed-off-by: Ming Lei <ming.lei@canonical.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-07-15 15:34:13 +02:00
Ming Lei e926d9b8c5 virtio-blk: data-plane: fix save/set .complete_request in start
The callback has to be saved and reset in virtio_blk_data_plane_start(),
otherwise dataplane's requests will be completed in qemu aio context.

Reviewed-by: Fam Zheng <famz@redhat.com>
Signed-off-by: Ming Lei <ming.lei@canonical.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-07-15 15:34:13 +02:00
Peter Maydell 0a9934eef1 Misc 2.1 fixes regarding character/serial devices and SCSI.
-----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2
 
 iQIcBAABAgAGBQJTw/aQAAoJEBvWZb6bTYbyQFkQAJ1/P6aG5EOd8dBQ2rNZ72Zp
 tWLnCQNZFIRLu1PGwiiqKihRk3N+YSMh0xERe1H8ZPwv1xIpia5zfcZ+fwEizyb2
 62zaTSSbUssWvt/p/mnb8K4H3HhBnEfEcQsFJi9GiML8G7rFwq5pUYTPfu0DQkq0
 +j1sk/sfzaKfdzDuxpz1cxPkFw7BjDTPDJPsKJCSok25sS7EhfN00auc33r8427k
 k5p/1xz7K/edUhZ86XhCIOs5bHIGxEnpK4bjV5F4MXCMC5vgp1VFFrK8GRG7rncO
 rB0rYCzpgxLA8DYpSGOIl6VNfZfHfvtrAdPbQwPfh1FzEya2PL/WorfwFcibKU3V
 3aa07rVOunIxVsCET49Q36RnSCX9COKww9BJxcsLu7C/G8id4tu67OS0/FMI/EaJ
 1oy7miUJuWhZEA115zyBfWBrv88PgNdlYVP8NtekBoHaL5m+Tk6ZAVmmxz5AxDZs
 zXrzUgotQ+cQZdeHJ/UVvjk4J1RUsolOEIwASgxBFph4fwAT/kRtlkZCpX/2xfDA
 VSTxKqoiQkdepQzBcNBOJvhQ38kU5qQ3AZb871T+y4WwP6jKj8kqZ7yiFf6yYz4a
 AqzSpichWVan99HuTLfiexHyq4r2D75To6ZQFVduYhQg8YX5byDcjtiQRFyy1uKv
 FwkEa/mpZdB1p0fSc7i3
 =8zIe
 -----END PGP SIGNATURE-----

Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into staging

Misc 2.1 fixes regarding character/serial devices and SCSI.

# gpg: Signature made Mon 14 Jul 2014 16:26:08 BST using RSA key ID 9B4D86F2
# gpg: Can't check signature: public key not found

* remotes/bonzini/tags/for-upstream:
  serial-pci: remove memory regions from BAR before destroying them
  virtio-scsi: fix with -M pc-i440fx-2.0
  serial: change retry logic to avoid concurrency
  qemu-char: fix deadlock with "-monitor pty"
  scsi: Report error when lun number is in use

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-07-14 17:01:45 +01:00
Paolo Bonzini 7497bce6c2 serial-pci: remove memory regions from BAR before destroying them
Otherwise, hot-unplug of pci-serial-2x trips the assertion
in memory_region_destroy:

    (qemu) device_del gg
    (qemu) qemu-system-x86_64: /work/armbru/tmp/qemu/memory.c:1021: memory_region_destroy: Assertion `((&mr->subregions)->tqh_first == ((void *)0))' failed.
    Aborted (core dumped)

Reported-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-07-14 16:14:15 +02:00
Kirill Batuzov f702e62a19 serial: change retry logic to avoid concurrency
Whenever serial_xmit fails to transmit a byte it adds a watch that would
call it again when the "line" becomes ready. This results in a retry
chain:
  serial_xmit -> add_watch -> serial_xmit
Each chain is able to transmit one character, and for every character
passed to serial by the guest driver a new chain is spawned.

The problem lays with the fact that a new chain is spawned even when
there is one already waiting on the watch. So there can be several retry
chains waiting concurrently on one "line". Every chain tries to transmit
current character, so character order is not messed up. But also every
chain increases retry counter (tsr_retry). If there are enough
concurrent chains this counter will hit MAX_XMIT_RETRY value and
the character will be dropped.

To reproduce this bug you need to feed serial output to some program
consuming it slowly enough. A python script from bug #1335444
description is an example of such program.

This commit changes retry logic in the following way to avoid
concurrency: instead of spawning a new chain for each character being
transmitted spawn only one and make it transmit characters until FIFO is
empty.

The change consists of two parts:
 - add a do {} while () loop in serial_xmit (diff is a bit erratic
   for this part, diff -w will show actual change),
 - do not call serial_xmit from serial_ioport_write if there is one
   waiting on the watch already.

This should fix another issue causing bug #1335444.

Signed-off-by: Kirill Batuzov <batuzovk@ispras.ru>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-07-14 16:14:14 +02:00
Peter Maydell 7a6d04e73f Block patches for 2.1.0-rc2 (v2)
-----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2.0.22 (GNU/Linux)
 
 iQIcBAABAgAGBQJTw6scAAoJEH8JsnLIjy/WWk8QAMmThVQhJqajBbriVJWfB5w4
 A4ZaRpk+NsDUZhzbsVBJ06ZdlQSX76JOT17V1hDFe7wcu1Aq8XL2b0PzV4iDNRgJ
 QPjW7vKAfFq/ANziGfgfAhpeQkq8o5+R8OepmdqJXzIDCjg+nDtJVdsc7G8DIWOx
 1ssEqW8zaRuZMck61mo3hpdCCA+m+3HTHhcDEf/lzS69XHi2+BZ6ATVh3zShJqxy
 +68hDHdPNMTWESkN5MBQAo82flbdmNjqpD5SYYuJsoCOV+Tb5jLUGbED/VM1LqCf
 8ukXlu4TO0u3ZmO+3XeQJiNsBSQEGOp9/9gOYj8J7AaZcZzC4cON3RmiYLZLgapj
 zdKIvgCxuFzyFheJYPCwpr3483w6/mh4uMzasZ+jHETqieAyvy1L860FNdWQaXoX
 K96m/1yIaQ2NOogcWrxZZ4Jt/diKh+NWynBFm8MZON6MK46FLiCcma2ZedoX6dNc
 R+Ul0qiYMo5B9fX05uhf15dU8cmVQuVFRo2ftIIqxZDY9IPjJjrJPw9EjHajGIJb
 MpU25NRHCdf0BscgYufuf1W9llasl0fbAd3SIA4FccTFdAeDwu5SQXHTodhu64hh
 7gf23N7Let/Gnucxx7gOTi1Jz3uR8V7MbIYRgBBvyRqhNRRRjYDwpg2c8guCzM2F
 VObGeTRdNa9QhTXqBPdQ
 =YxHy
 -----END PGP SIGNATURE-----

Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging

Block patches for 2.1.0-rc2 (v2)

# gpg: Signature made Mon 14 Jul 2014 11:04:12 BST using RSA key ID C88F2FD6
# gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>"

* remotes/kevin/tags/for-upstream: (22 commits)
  ide: Treat read/write beyond end as invalid
  virtio-blk: Treat read/write beyond end as invalid
  virtio-blk: Bypass error action and I/O accounting on invalid r/w
  virtio-blk: Factor common checks out of virtio_blk_handle_read/write()
  dma-helpers: Fix too long qiov
  qtest: fix vhost-user-test compilation with old GLib
  tests: Fix unterminated string output visitor enum human string
  AioContext: do not rely on aio_poll(ctx, true) result to end a loop
  virtio-blk: embed VirtQueueElement in VirtIOBlockReq
  virtio-blk: avoid g_slice_new0() for VirtIOBlockReq and VirtQueueElement
  dataplane: do not free VirtQueueElement in vring_push()
  virtio-blk: avoid dataplane VirtIOBlockReq early free
  block: Assert qiov length matches request length
  qed: Make qiov match request size until backing file EOF
  qcow2: Make qiov match request size until backing file EOF
  block: Make qiov match the request size until EOF
  AioContext: speed up aio_notify
  test-aio: fix GSource-based timer test
  block: drop aio functions that operate on the main AioContext
  block: prefer aio_poll to qemu_aio_wait
  ...

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-07-14 13:09:29 +01:00
Markus Armbruster 58ac321135 ide: Treat read/write beyond end as invalid
The block layer fails such reads and writes just fine.  However, they
then get treated like valid operations that fail: the error action
gets executed.  Unwanted; reporting the error to the guest is the only
sensible action.

Reject them before passing them to the block layer.  This bypasses the
error action and I/O accounting.  Not quite correct for DMA, because
DMA can fail after some success, and when that happens, the part that
succeeded isn't counted.  Tolerable, because I/O accounting is an
inconsistent mess anyway.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2014-07-14 12:03:21 +02:00
Markus Armbruster 3c2daac0b9 virtio-blk: Treat read/write beyond end as invalid
The block layer fails such reads and writes just fine.  However, they
then get treated like valid operations that fail: the error action
gets executed.  Unwanted; reporting the error to the guest is the only
sensible action.

Reject them before passing them to the block layer.  This bypasses the
error action and I/O accounting.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Fam Zheng <famz@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2014-07-14 12:03:21 +02:00
Markus Armbruster 42e38c1fd0 virtio-blk: Bypass error action and I/O accounting on invalid r/w
When a device model's I/O operation fails, we execute the error
action.  This lets layers above QEMU implement thin provisioning, or
attempt to correct errors before they reach the guest.  But when the
I/O operation fails because it's invalid, reporting the error to the
guest is the only sensible action.

If the guest's read or write asks for an invalid sector range, fail
the request right away, without considering the error action.  No
change with error action BDRV_ACTION_REPORT.

Furthermore, bypass I/O accounting, because we want to track only I/O
that actually reaches the block layer.

The next commit will extend "invalid sector range" to cover attempts
to read/write beyond the end of the medium.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2014-07-14 12:03:21 +02:00
Markus Armbruster d0e14376ee virtio-blk: Factor common checks out of virtio_blk_handle_read/write()
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Fam Zheng <famz@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2014-07-14 12:03:21 +02:00
Stefan Hajnoczi f897bf751f virtio-blk: embed VirtQueueElement in VirtIOBlockReq
The memory allocation between hw/block/virtio-blk.c,
hw/block/dataplane/virtio-blk.c, and hw/virtio/dataplane/vring.c is
messy.  Structs are allocated in different files than they are freed in.
This is risky and makes memory leaks easier.

Embed VirtQueueElement in VirtIOBlockReq to reduce the amount of memory
allocation we need to juggle.  This also makes vring.c and virtio.c
slightly more similar.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2014-07-14 12:03:20 +02:00
Stefan Hajnoczi 869d66af53 virtio-blk: avoid g_slice_new0() for VirtIOBlockReq and VirtQueueElement
In commit de6c8042ec ("virtio-blk: Avoid
zeroing every request structure") we avoided the 40 KB memset when
allocating VirtIOBlockReq.

The memset was reintroduced in commit
671ec3f056 ("virtio-blk: Convert
VirtIOBlockReq.elem to pointer").

It must be fixed again to avoid a performance regression.

Cc: Fam Zheng <famz@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2014-07-14 12:03:20 +02:00
Stefan Hajnoczi abd764250f dataplane: do not free VirtQueueElement in vring_push()
VirtQueueElement is allocated in vring_pop() so it seems to make sense
that vring_push() should free it.  Alas, virtio-blk frees
VirtQueueElement itself in virtio_blk_free_request().

This patch solves a double-free assertion in glib's g_slice_free().

Rename vring_free_element() to vring_unmap_element() since it no longer
frees the VirtQueueElement.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Tested-by: Christian Borntraeger <borntraeger@de.ibm.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2014-07-14 12:03:20 +02:00
Stefan Hajnoczi 0a21ea3289 virtio-blk: avoid dataplane VirtIOBlockReq early free
VirtIOBlockReq is freed later by virtio_blk_free_request() in
hw/block/virtio-blk.c.  Remove this extraneous g_slice_free().

This patch fixes the following segfault:

  0x00005555556373af in virtio_blk_rw_complete (opaque=0x5555565ff5e0, ret=0) at hw/block/virtio-blk.c:99
  99          bdrv_acct_done(req->dev->bs, &req->acct);
  (gdb) print req
  $1 = (VirtIOBlockReq *) 0x5555565ff5e0
  (gdb) print req->dev
  $2 = (VirtIOBlock *) 0x0
  (gdb) bt
  #0  0x00005555556373af in virtio_blk_rw_complete (opaque=0x5555565ff5e0, ret=0) at hw/block/virtio-blk.c:99
  #1  0x0000555555840ebe in bdrv_co_em_bh (opaque=0x5555566152d0) at block.c:4675
  #2  0x000055555583de77 in aio_bh_poll (ctx=ctx@entry=0x5555563a8150) at async.c:81
  #3  0x000055555584b7a7 in aio_poll (ctx=0x5555563a8150, blocking=blocking@entry=true) at aio-posix.c:188
  #4  0x00005555556e520e in iothread_run (opaque=0x5555563a7fd8) at iothread.c:41
  #5  0x00007ffff42ba124 in start_thread () from /usr/lib/libpthread.so.0
  #6  0x00007ffff16d14bd in clone () from /usr/lib/libc.so.6

Reported-by: Max Reitz <mreitz@redhat.com>
Cc: Fam Zheng <famz@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Tested-by: Christian Borntraeger <borntraeger@de.ibm.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2014-07-14 12:03:20 +02:00
Fam Zheng 2039511b8f scsi: Report error when lun number is in use
In the case that the lun number is taken by another scsi device, don't
release the existing device siliently, but report an error to user.

Signed-off-by: Fam Zheng <famz@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-07-14 11:54:57 +02:00
Peter Maydell ab6d3749c4 vga: some cirrus fixes.
-----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2.0.22 (GNU/Linux)
 
 iQIcBAABAgAGBQJTv7CYAAoJEEy22O7T6HE4yC0QALjHJKFT3Y3Fw9JguQdVJvsm
 Dam6p0OhaYLQn11Uh2KvR5vGUGDCZ0z0Y4PGTfWT2PpmRhR8Vxj7RG7FL3cVmcva
 unq88nKcUWK45rInZ1buzDTSZrL5YZXy00wfiBmQ/pGQ4yQ69drkhV0T1QQSCs5g
 +LAENT6DqJgk/6s9T0CmeN7itTMm9O6iOqqw/d13ziHWoHtT2+pAMM3btlyQLaIE
 qRhzOwaBi7+jPZp53xH6GI09aDQrlE71f//R47yKFCbhEsRYMAxwm/uD3rewb+vi
 x/U2tpg77xqelYchHgtb50r5gj4Mur74mqZAKTjqwM49GRhQoJTEMRt8WaZEHFzd
 NeldDea619M5BmuH7XjLvEfNC+bS2EaO80LGBmvkBpP0gZbcIRX2BUZND49+z5Ys
 rSA6KzNJQj+wo52xfteoxIvOSeItuuTt32BeflRNvUVpJXU4FBr7zTq+vlP+Z3dW
 NaM8QDKa8ikWFtzLHRywTrYY97z0FldN0scnsUZObmEzBrN2amEnEgHf2w/pkyd6
 gS1zq6OL8iOZb4T3LWXItbgflqJscuD2eHW9ZH6BRXS6Ejlp5xPAb1Vtvw9Iyo7A
 O1dzDOcyFypCQZrud4kd6/pPiCPp8xDoZN9P+g3sPqQfRDHiPU6fGAftDTPKd2A5
 8gkOX+K9g5RD5jlFxlm6
 =gpXl
 -----END PGP SIGNATURE-----

Merge remote-tracking branch 'remotes/kraxel/tags/pull-vga-20140711-1' into staging

vga: some cirrus fixes.

# gpg: Signature made Fri 11 Jul 2014 10:38:32 BST using RSA key ID D3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
# gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
# gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

* remotes/kraxel/tags/pull-vga-20140711-1:
  cirrus: Fix host CPU blits
  cirrus: Fix build of debug code
  cirrus_vga: adding sanity check for vram size

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-07-11 17:50:38 +01:00
Peter Maydell aee230d707 mtp: linux guest detection fix
-----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2.0.22 (GNU/Linux)
 
 iQIcBAABAgAGBQJTv700AAoJEEy22O7T6HE4q5MQANaXoHxzlCv5j5YHsdMcK/zU
 MHyvY92tzYFlw7B0SojqOegqkrFXmlKIXwBEK2hGuMczeD8f4mjwWrcBy8n+ZVi/
 uu8j2ageKppU1ucaGmlEYNE+wNZFZFTI6koGfRlBi8Aca9ixCPJGjLelxmxWzwRk
 abMk93Wt/e99FP2TQN1WH/B2dtKKlUFxd1YJIPLlB3sYxs9I4cVgAZ5YVzOxPUOU
 ESdSpfgQDZvL0jycaS4MXkJQNrvdhtscSfhUy/gp6MdHrrP8zIJbOdLb4+XMOipH
 FtclTrH3xZxJQg4ESsQv/sFTf5JgDSCr4xsd1yCWT2bFPeq24iJIgEArQM3RDgPY
 UJa+pzp2ioZ7gLCVpXxUolUoxvEGPwway000AqxhwRGvM4TCiYyQ/W31Pn4zMJc5
 W1UyE9n4hq6sr3FTa/kgzosBYdDHgQnz9kGSLEmzPCvpUQkmLjSPzVPS8id7ZCgn
 fz+0unJgHRM4xVVf6GMptSgG4nbaVU4WeQ7NwM5Kn0xrUd/VVzbqllq8PodpaRXT
 nYx+dVFFwoiDXRhBNTn3Z65vKN49sdMv9nCkTSqCIWxKRbqxfltoooHTSwBV5OL1
 v6VXTb5ZZOZweHK/qdli5InND1KF8aJa1w2IDt6xyIKtDfPuC1MqLzfXJuvGsfHz
 qU9KgU8XSx2kc0OuZ+fX
 =YT+T
 -----END PGP SIGNATURE-----

Merge remote-tracking branch 'remotes/kraxel/tags/pull-usb-20140711-1' into staging

mtp: linux guest detection fix

# gpg: Signature made Fri 11 Jul 2014 11:32:20 BST using RSA key ID D3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
# gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
# gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

* remotes/kraxel/tags/pull-usb-20140711-1:
  mtp: linux guest detection fix.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-07-11 16:01:38 +01:00
Gerd Hoffmann 13d54125a3 mtp: linux guest detection fix.
Attach a name to the MTP interface (android phones have this too).

With this patch recent linux guests such as fedora 20 happily detect and
use the device.  It shows up in nautilus file manager automatically, and
simple-mtpfs can mount it.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-07-11 12:31:41 +02:00
Benjamin Herrenschmidt d16136d22a cirrus: Fix host CPU blits
Commit b2eb849d4b
"CVE-2007-1320 - Cirrus LGD-54XX "bitblt" heap overflow" broke
cpu to video blits.

When the ROP function is called from cirrus_bitblt_cputovideo_next(),
we pass 0 for the pitch but only operate on one line at a time. The
added test was tripping because after the initial substraction, the
pitch becomes negative. Make the test only trip when the height is
larger than one (ie. the pitch is actually used).

This fixes HW cursor support in Windows NT4.0 (which otherwise was
a white rectangle) and general display of icons in that OS when using
8bpp mode.

Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-07-11 10:17:02 +02:00
Benjamin Herrenschmidt e8ee4b68be cirrus: Fix build of debug code
Use PRIu64 to print uint64_t

Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-07-11 10:17:01 +02:00
Gonglei f61d82c2df cirrus_vga: adding sanity check for vram size
when configure a invalid vram size for cirrus card, such as less
2 MB, which will crash qemu. Follow the real hardware, the cirrus
card has 4 MB video memory. Also for backward compatibility, accept
8 MB and 16 MB vram size.

Signed-off-by: Gonglei <arei.gonglei@huawei.com>
Reviewed-by: Andreas Färber <afaerber@suse.de>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-07-11 10:17:01 +02:00
Peter Maydell 74aeb37de0 Merge remote-tracking branch 'remotes/kvm/uq/master' into staging
* remotes/kvm/uq/master:
  qtest: fix vhost-user-test compilation with old GLib
  mc146818rtc: register the clock reset notifier on the right clock
  oslib-posix: Fix new compiler error with -Wclobbered
  target-i386: Add "kvmclock-stable-bit" feature bit name
  Enforce stack protector usage
  watchdog: fix deadlock with -watchdog-action pause
  mips_malta: Catch kernels linked at wrong address
  mips_malta: Remove incorrect KVM T&E references
  mips/kvm: Disable FPU on reset with KVM
  mips/kvm: Init EBase to correct KSEG0

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-07-10 17:37:16 +01:00
Paolo Bonzini 13c0cbaec5 mc146818rtc: register the clock reset notifier on the right clock
Commit 884f17c (aio / timers: Convert rtc_clock to be a QEMUClockType,
2013-08-21) erroneously changed an occurrence of rtc_clock to
QEMU_CLOCK_REALTIME, which broke the RTC reset notifier in
mc146818rtc.  Fix this.

I redid the patch myself since the original reporter did not sign
off on his.

Cc: qemu-stable@nongnu.org
Reported-by: Lb peace <peaceustc@gmail.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-07-10 17:06:33 +02:00
Paolo Bonzini 30e5210a70 watchdog: fix deadlock with -watchdog-action pause
qemu_clock_enable says:

/* Disabling the clock will wait for related timerlists to stop
 * executing qemu_run_timers.  Thus, this functions should not
 * be used from the callback of a timer that is based on @clock.
 * Doing so would cause a deadlock.
 */

and it indeed does: vm_stop uses qemu_clock_enable on QEMU_CLOCK_VIRTUAL
and watchdogs are based on QEMU_CLOCK_VIRTUAL, and we get a deadlock.

Use qemu_system_vmstop_request_prepare()/qemu_system_vmstop_request()
instead; yet another alternative could be a BH.

I checked other occurrences of vm_stop and they should not have this
problem.  RUN_STATE_IO_ERROR could in principle (it depends on the
code in the drivers) but it has been fixed by commit 2bd3bce, "block:
asynchronously stop the VM on I/O errors", 2014-06-05.

Tested-by: Luiz Capitulino <lcapitulino@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-07-09 18:17:08 +02:00
James Hogan f7f152458e mips_malta: Catch kernels linked at wrong address
Add error reporting if the wrong type of kernel is provided for the
current mode of acceleration.

Currently a KVM kernel linked at 0x40000000 can't be used with TCG, and
a normal kernel linked at 0x80000000 can't be used with KVM.

Cc: Aurelien Jarno <aurelien@aurel32.net>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: James Hogan <james.hogan@imgtec.com>
Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-07-09 18:17:08 +02:00
James Hogan fbdb1d9555 mips_malta: Remove incorrect KVM T&E references
Fix the error message and code comments relating to KVM not supporting
booting from the flash mapping when no kernel is provided. The issue is
a general MIPS KVM issue and isn't specific to the Trap & Emulate
version of MIPS KVM.

Cc: Aurelien Jarno <aurelien@aurel32.net>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Reported-by: Andreas Färber <afaerber@suse.de>
Signed-off-by: James Hogan <james.hogan@imgtec.com>
Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-07-09 18:17:08 +02:00
Peter Maydell b653282ecc hw/ppc/spapr_hcall.c: Add ULL suffix to 64 bit constant
Add ULL suffix to 64 bit constant to prevent compiler warnings
on some 32 bit platforms.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-07-08 16:03:19 +01:00
Peter Maydell d614cb68da Bugfixes for s390x: set subsystem id in the lowcore when booting from the
s390-ccw bios, and set the channel-program address after I/O completion,
 when applicable.
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1.4.11 (GNU/Linux)
 
 iQIcBAABAgAGBQJTu++cAAoJEN7Pa5PG8C+vGUQP/3oxPbmoTKxLHM50bODFgt/Y
 4hOrq6VkMk5hGl6bUw+XUg0S6rschk6CjlE2jE03uRvPEgazqfcvXOPnQodeewIn
 smk4L5zBKZyzWdAVElw52f6eB1cWCEVwj+VBXlYarUi09vJHO5zVs3Og5HE4Yj2C
 s0JVxJJR2N7lzspGaNvRxr5opKIEr/NLNiO3qEpOrPxd2M/FvGd9GP1nmnixatDh
 eyvesblhDffFu/3yEd5uM7E/Z7KH3SdpAuUH7Zr6lG5Rc8TjhfLoeP95KnHC7QCA
 vVjKccbaJFfaqlBP6LpJx0rcOJOd+gVnlwnbt6UZAP2DhgsJU4jYBY5VyVLv+RBg
 SsXFSq27JuPAEvnQ8EmJz+5VMmRuRbd4dAe1+FCPIR9rsbpF643n96HngYMytavX
 qjB9nLVrBY1bgUm/wS9WDJxwBgi1lUy0QUcU8X7pQiWHma7V+ul2hETw/yhuRSi8
 X9gGhOGb0GW8Lzo2o9HsxvGRvCa2bG+BBPZtMljxQ6MtCMZA4SUKqnzuSS+FoL/K
 I9CsEFO1ax9UQ4NpU9534U0DQlQoRFqh3hT6S6mMHrEmPuokI/jP+LNRXAxPpzb2
 VkIbvIelwuRglBOcODciF6HAx96a1OQxEZASZ2QEH/AF1d08RnBOwNfUHbq5aRaO
 xcq6aTAihXOhQ3vioIrz
 =BVvp
 -----END PGP SIGNATURE-----

Merge remote-tracking branch 'remotes/cohuck/tags/s390x-20140708' into staging

Bugfixes for s390x: set subsystem id in the lowcore when booting from the
s390-ccw bios, and set the channel-program address after I/O completion,
when applicable.

# gpg: Signature made Tue 08 Jul 2014 14:18:20 BST using RSA key ID C6F02FAF
# gpg: Can't check signature: public key not found

* remotes/cohuck/tags/s390x-20140708:
  s390x/css: reflect cpa in scsw
  pc-bios/s390-ccw: update binary
  pc-bios/s390-ccw: store proper subsystem information word

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-07-08 15:10:42 +01:00
Cornelia Huck 2ed982b6a9 s390x/css: reflect cpa in scsw
We neglected to update the the channel-program-address field of the scsw
after completion of the start or the halt function: Fortunately, Linux
didn't miss it so far. Let's update it for the cases where the cpa is
expected to be valid; in some cases, the cpa is 'unpredictable', so we
leave it untouched.

Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
2014-07-08 15:08:03 +02:00
Peter Maydell 6ec1588e09 hw/arm/vexpress: Alias NOR flash at 0 for vexpress-a9
Make the vexpress-a9 board alias the first NOR flash region at
address zero, like vexpress-a15. This makes "-bios" actually usable
on this board.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 1404310070-3561-1-git-send-email-peter.maydell@linaro.org
Reviewed-by: Greg Bellows <greg.bellows@linaro.org>
2014-07-08 13:05:10 +01:00
Laurent Dufour 4bce526ec4 target-ppc: KVMPPC_H_CAS fix cpu-version endianess
During KVMPPC_H_CAS processing, the cpu-version updated value is stored
without taking care of the current endianess. As a consequence, the guest
may not switch to the right CPU model, leading to unexpected results.

If needed, the value is now converted.

Fixes: 6d9412ea81 ("target-ppc: Implement "compat" CPU option")
Signed-off-by: Laurent Dufour <ldufour@linux.vnet.ibm.com>
Reviewed-by: Greg Kurz <gkurz@linux.vnet.ibm.com>
Signed-off-by: Alexander Graf <agraf@suse.de>
2014-07-08 12:10:36 +02:00
Peter Maydell 128f0e6614 PowerPC Reference Platform (PReP)
* Update OpenHack'Ware firmware to replace QEMU-side workarounds
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2.0.22 (GNU/Linux)
 
 iQIcBAABAgAGBQJTurOGAAoJEPou0S0+fgE/ZIcP/RfsK7KBF7Zu6RH2VRnmNUGZ
 gvlHv/IMW70fp4EUuAakyWsUWdDlCoYlgVtr00wsHr5BTyzUZcqjHsU+r6oa5Bw+
 ic+8IQ7vSAqghU0K47xoTcPOJ+TPRlP8VW+CF3nsX3TF2my5C/ntXq8xtcxm5KxV
 43Cd7ewwJxHabqhcdFPPmUs0y/IhpIebusdl1lnS/OMCjldNR+aCQ0OeuLBHP51C
 m31Try/LmwsuGJAcPCgmlqrRn4wCQdPpGnyGKtD5nVZFbbcLnp2L3McJS5wu0eCn
 8H0EeCw3lAoaDUldMsCny1cbCK/lOeQMFWiU4YtF55U6BcLz8pEnxC6/xMLD3MLq
 xsq8MjDs+tfBV36gtWRHmS7DhlL+fNNKb+iRhQfCGq0bRFuL2mg80YO78V7bEWQy
 D46EJqM2y5B0HIxJOKABTfKa1Im6auffiK+YPC1w/t4me4z4nlfn9V3VJwObqhpC
 Ebt+0Wm9XOhMX8ML/dfjQODknvlMq2xAp3YcXiC6W+WE14uh/KYOo2PksMLTxQXG
 /KOkXBkFZCWTRXzCUaK+DGMya2Sw51diJkozM37baPDOsWlNpSTZtM7Qn/+ZfkPA
 av2bxqHRS1eJqCQ220KKQ5z53alS3FCtKFNW9pnPPB+7bxIyzIwo1A4VMUNLd9IG
 aIeA+tpPztFBuzAfyQCr
 =E0WH
 -----END PGP SIGNATURE-----

Merge remote-tracking branch 'remotes/afaerber/tags/prep-for-2.1' into staging

PowerPC Reference Platform (PReP)

* Update OpenHack'Ware firmware to replace QEMU-side workarounds

# gpg: Signature made Mon 07 Jul 2014 15:49:42 BST using RSA key ID 3E7E013F
# gpg: Good signature from "Andreas Färber <afaerber@suse.de>"
# gpg:                 aka "Andreas Färber <afaerber@suse.com>"

* remotes/afaerber/tags/prep-for-2.1:
  prep: Update ppc_rom.bin
  prep: Remove CPU reset entry point hack related to OpenHack'Ware
  prep: Remove PCI memory hack related to OpenHack'Ware

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-07-07 19:06:55 +01:00