]> git.proxmox.com Git - mirror_qemu.git/log
mirror_qemu.git
5 years agomonitor: report entirety of hmp command on error
Collin Walling [Mon, 7 May 2018 14:30:54 +0000 (10:30 -0400)]
monitor: report entirety of hmp command on error

When a user incorrectly provides an hmp command, an error response will be
printed that prompts the user to try "help <command name>". However, when
the command contains multiple parts e.g. "info uuid xyz", only the last
whitespace delimited string will be reported (in this example "info" will
be dropped and the message will read "Try "help uuid" for more information",
which is incorrect).

Let's correct this by capturing the entirety of the command from the command
line -- excluding any extraneous characters.

Reported-by: Mikhail Fokin <fokin@de.ibm.com>
Signed-off-by: Collin Walling <walling@linux.ibm.com>
Message-Id: <ee680f5e-ac9a-479d-f65e-9f8ae9cfe5d4@linux.ibm.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
5 years agoMerge remote-tracking branch 'remotes/cohuck/tags/s390x-20180619' into staging
Peter Maydell [Wed, 20 Jun 2018 08:51:30 +0000 (09:51 +0100)]
Merge remote-tracking branch 'remotes/cohuck/tags/s390x-20180619' into staging

- cleanup in virtio-ccw
- accommodate guests using vfio-ccw without specifying unlimited
  prefetch, but actually working fine
- add cpu model for the z14 Model ZR1
- add support for pxelinux.cfg-style network booting to the s390x
  firmware

# gpg: Signature made Tue 19 Jun 2018 10:33:06 BST
# gpg:                using RSA key DECF6B93C6F02FAF
# gpg: Good signature from "Cornelia Huck <conny@cornelia-huck.de>"
# gpg:                 aka "Cornelia Huck <huckc@linux.vnet.ibm.com>"
# gpg:                 aka "Cornelia Huck <cornelia.huck@de.ibm.com>"
# gpg:                 aka "Cornelia Huck <cohuck@kernel.org>"
# gpg:                 aka "Cornelia Huck <cohuck@redhat.com>"
# Primary key fingerprint: C3D0 D66D C362 4FF6 A8C0  18CE DECF 6B93 C6F0 2FAF

* remotes/cohuck/tags/s390x-20180619:
  pc-bios/s390-ccw: Update the s390-netboot.img binary
  pc-bios/s390-ccw: Optimize the s390-netboot.img for size
  pc-bios/s390-ccw/net: Try to load pxelinux.cfg file accoring to the UUID
  pc-bios/s390-ccw/net: Add support for pxelinux-style config files
  pc-bios/s390-ccw/net: Update code for the latest changes in SLOF
  roms: Update SLOF submodule to current status
  pc-bios/s390-ccw: define loadparm length
  s390x/cpumodels: add z14 Model ZR1
  s390x/ipl: Try to detect Linux vs non Linux for initial IPL PSW
  vfio-ccw: remove orb.c64 (64 bit data addresses) check
  vfio-ccw: add force unlimited prefetch property
  virtio-ccw: clean up notify

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
5 years agoMerge remote-tracking branch 'remotes/mcayland/tags/qemu-openbios-20180618' into...
Peter Maydell [Tue, 19 Jun 2018 17:29:16 +0000 (18:29 +0100)]
Merge remote-tracking branch 'remotes/mcayland/tags/qemu-openbios-20180618' into staging

qemu-openbios queue

# gpg: Signature made Mon 18 Jun 2018 19:28:08 BST
# gpg:                using RSA key 5BC2C56FAE0F321F
# gpg: Good signature from "Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>"
# Primary key fingerprint: CC62 1AB9 8E82 200D 915C  C9C4 5BC2 C56F AE0F 321F

* remotes/mcayland/tags/qemu-openbios-20180618:
  Update OpenBIOS images to 8fe6f5f96f built from submodule.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
5 years agoMerge remote-tracking branch 'remotes/mcayland/tags/qemu-sparc-20180618' into staging
Peter Maydell [Tue, 19 Jun 2018 16:42:50 +0000 (17:42 +0100)]
Merge remote-tracking branch 'remotes/mcayland/tags/qemu-sparc-20180618' into staging

qemu-sparc queue

# gpg: Signature made Mon 18 Jun 2018 18:43:24 BST
# gpg:                using RSA key 5BC2C56FAE0F321F
# gpg: Good signature from "Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>"
# Primary key fingerprint: CC62 1AB9 8E82 200D 915C  C9C4 5BC2 C56F AE0F 321F

* remotes/mcayland/tags/qemu-sparc-20180618:
  SPARC64: add icount support
  hw/sparc/sun4m: Fix problems with device introspection
  hw/sparc64/sun4u: Fix introspection by converting prom instance_init to realize

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
5 years agoMerge remote-tracking branch 'remotes/rth/tags/pull-axp-20180618' into staging
Peter Maydell [Tue, 19 Jun 2018 15:57:43 +0000 (16:57 +0100)]
Merge remote-tracking branch 'remotes/rth/tags/pull-axp-20180618' into staging

Place parallel device properly, fixing vga

# gpg: Signature made Mon 18 Jun 2018 17:45:50 BST
# gpg:                using RSA key 64DF38E8AF7E215F
# gpg: Good signature from "Richard Henderson <richard.henderson@linaro.org>"
# Primary key fingerprint: 7A48 1E78 868B 4DB6 A85A  05C0 64DF 38E8 AF7E 215F

* remotes/rth/tags/pull-axp-20180618:
  hw/isa/smc37c669: Change the parallel I/O base to 378H

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
5 years agoMerge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging
Peter Maydell [Tue, 19 Jun 2018 15:04:43 +0000 (16:04 +0100)]
Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging

Block layer patches:

- Active mirror (blockdev-mirror copy-mode=write-blocking)
- bdrv_drain_*() fixes and test cases
- Fix crash with scsi-hd and drive_del

# gpg: Signature made Mon 18 Jun 2018 17:44:10 BST
# gpg:                using RSA key 7F09B272C88F2FD6
# gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>"
# Primary key fingerprint: DC3D EB15 9A9A F95D 3D74  56FE 7F09 B272 C88F 2FD6

* remotes/kevin/tags/for-upstream: (35 commits)
  iotests: Add test for active mirroring
  block/mirror: Add copy mode QAPI interface
  block/mirror: Add active mirroring
  job: Add job_progress_increase_remaining()
  block/mirror: Add MirrorBDSOpaque
  block/dirty-bitmap: Add bdrv_dirty_iter_next_area
  test-hbitmap: Add non-advancing iter_next tests
  hbitmap: Add @advance param to hbitmap_iter_next()
  block: Generalize should_update_child() rule
  block/mirror: Use source as a BdrvChild
  block/mirror: Wait for in-flight op conflicts
  block/mirror: Use CoQueue to wait on in-flight ops
  block/mirror: Convert to coroutines
  block/mirror: Pull out mirror_perform()
  block: fix QEMU crash with scsi-hd and drive_del
  test-bdrv-drain: Test graph changes in drain_all section
  block: Allow graph changes in bdrv_drain_all_begin/end sections
  block: ignore_bds_parents parameter for drain functions
  block: Move bdrv_drain_all_begin() out of coroutine context
  block: Allow AIO_WAIT_WHILE with NULL ctx
  ...

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
5 years agoMerge remote-tracking branch 'remotes/armbru/tags/pull-monitor-2018-06-18' into staging
Peter Maydell [Tue, 19 Jun 2018 14:19:07 +0000 (15:19 +0100)]
Merge remote-tracking branch 'remotes/armbru/tags/pull-monitor-2018-06-18' into staging

Monitor patches for 2018-06-18

# gpg: Signature made Mon 18 Jun 2018 14:50:29 BST
# gpg:                using RSA key 3870B400EB918653
# gpg: Good signature from "Markus Armbruster <armbru@redhat.com>"
# gpg:                 aka "Markus Armbruster <armbru@pond.sub.org>"
# Primary key fingerprint: 354B C8B3 D7EB 2A6B 6867  4E5F 3870 B400 EB91 8653

* remotes/armbru/tags/pull-monitor-2018-06-18:
  monitor: add lock to protect mon_fdsets
  monitor: move init global earlier
  monitor: remove event_clock_type
  monitor: fix comment for monitor_lock
  monitor: more comments on lock-free elements
  monitor: protect mon->fds with mon_lock
  monitor: rename out_lock to mon_lock

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
5 years agoMerge remote-tracking branch 'remotes/kraxel/tags/input-20180618-pull-request' into...
Peter Maydell [Tue, 19 Jun 2018 13:34:06 +0000 (14:34 +0100)]
Merge remote-tracking branch 'remotes/kraxel/tags/input-20180618-pull-request' into staging

input: ps2 post_load fix.

# gpg: Signature made Mon 18 Jun 2018 11:18:30 BST
# gpg:                using RSA key 4CB6D8EED3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
# gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
# gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"
# Primary key fingerprint: A032 8CFF B93A 17A7 9901  FE7D 4CB6 D8EE D3E8 7138

* remotes/kraxel/tags/input-20180618-pull-request:
  ps2: check PS2Queue wptr pointer in post_load routine

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
5 years agoMerge remote-tracking branch 'remotes/kraxel/tags/vga-20180618-pull-request' into...
Peter Maydell [Tue, 19 Jun 2018 12:43:35 +0000 (13:43 +0100)]
Merge remote-tracking branch 'remotes/kraxel/tags/vga-20180618-pull-request' into staging

vga: add ramfb, print virglrenderer version

# gpg: Signature made Mon 18 Jun 2018 10:57:38 BST
# gpg:                using RSA key 4CB6D8EED3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
# gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
# gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"
# Primary key fingerprint: A032 8CFF B93A 17A7 9901  FE7D 4CB6 D8EE D3E8 7138

* remotes/kraxel/tags/vga-20180618-pull-request:
  Add ramfb MAINTAINERS entry
  hw/display: add standalone ramfb device
  hw/display: add ramfb, a simple boot framebuffer living in guest ram
  configure: print virglrenderer version

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
5 years agoMerge remote-tracking branch 'remotes/kraxel/tags/usb-20180618-pull-request' into...
Peter Maydell [Tue, 19 Jun 2018 11:58:06 +0000 (12:58 +0100)]
Merge remote-tracking branch 'remotes/kraxel/tags/usb-20180618-pull-request' into staging

usb: revert ccid / qom patches.

# gpg: Signature made Mon 18 Jun 2018 10:21:11 BST
# gpg:                using RSA key 4CB6D8EED3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
# gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
# gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"
# Primary key fingerprint: A032 8CFF B93A 17A7 9901  FE7D 4CB6 D8EE D3E8 7138

* remotes/kraxel/tags/usb-20180618-pull-request:
  Revert "bus: do not unref the added child bus on realize"
  Revert "usb: release the created buses"
  Revert "usb-ccid: fix bus leak"

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
5 years agoMerge remote-tracking branch 'remotes/dgibson/tags/ppc-for-3.0-20180618' into staging
Peter Maydell [Tue, 19 Jun 2018 10:15:27 +0000 (11:15 +0100)]
Merge remote-tracking branch 'remotes/dgibson/tags/ppc-for-3.0-20180618' into staging

ppc patch queue 2018-06-18

Next batch of ppc and spapr related patches for the 3.0 release.
    * Improved handling of Spectre/Meltdown mitigations for POWER8
    * Numerous Mac machine type cleanups and improvements
    * Cleanup to cpu realize/unrealize path for spapr
    * Create a place for machine-specific per-cpu information, and
      start moving some things to it
    * Assorted bugfixes

# gpg: Signature made Mon 18 Jun 2018 04:52:37 BST
# gpg:                using RSA key 6C38CACA20D9B392
# gpg: Good signature from "David Gibson <david@gibson.dropbear.id.au>"
# gpg:                 aka "David Gibson (Red Hat) <dgibson@redhat.com>"
# gpg:                 aka "David Gibson (ozlabs.org) <dgibson@ozlabs.org>"
# gpg:                 aka "David Gibson (kernel.org) <dwg@kernel.org>"
# Primary key fingerprint: 75F4 6586 AE61 A66C C44E  87DC 6C38 CACA 20D9 B392

* remotes/dgibson/tags/ppc-for-3.0-20180618: (28 commits)
  spapr: fix xics_system_init() error path
  target/ppc, spapr: Move VPA information to machine_data
  ppc/pnv: introduce a pnv_chip_core_realize() routine
  spapr_cpu_core: introduce spapr_create_vcpu()
  spapr_cpu_core: add missing rollback on realization path
  spapr_cpu_core: fix potential leak in spapr_cpu_core_realize()
  spapr_cpu_core: convert last snprintf() to g_strdup_printf()
  pnv: Add cpu unrealize path
  pnv: Clean up cpu realize path
  pnv_core: Allocate cpu thread objects individually
  pnv: Fix some error handling cpu realize()
  spapr: Clean up cpu realize/unrealize paths
  sm501: Do not clear read only bits when writing registers
  mos6522: expose mos6522_update_irq() through MOS6522DeviceClass
  mos6522: remove additional interrupt flag filter from mos6522_update_irq()
  mos6522: only clear the shift register interrupt upon write
  xics_kvm: fix a build break
  mac_newworld: add PMU device
  adb: add property to disable direct reg 3 writes
  adb: fix read reg 3 byte ordering
  ...

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
5 years agoMerge remote-tracking branch 'remotes/ehabkost/tags/python-next-pull-request' into...
Peter Maydell [Tue, 19 Jun 2018 09:10:40 +0000 (10:10 +0100)]
Merge remote-tracking branch 'remotes/ehabkost/tags/python-next-pull-request' into staging

Python queue, 2018-06-15

* Add avocado_qemu: functional/acceptance test infrastructure

# gpg: Signature made Fri 15 Jun 2018 20:12:20 BST
# gpg:                using RSA key 2807936F984DC5A6
# gpg: Good signature from "Eduardo Habkost <ehabkost@redhat.com>"
# Primary key fingerprint: 5A32 2FD5 ABC4 D3DB ACCF  D1AA 2807 936F 984D C5A6

* remotes/ehabkost/tags/python-next-pull-request:
  configure: Enable out-of-tree acceptance tests
  Acceptance tests: add Linux kernel boot and console checking test
  scripts/qemu.py: introduce set_console() method
  Acceptance tests: add quick VNC tests
  scripts/qemu.py: allow adding to the list of extra arguments
  Add functional/acceptance tests infrastructure
  Remove COPYING.PYTHON

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
5 years agoUpdate OpenBIOS images to 8fe6f5f96f built from submodule.
Mark Cave-Ayland [Mon, 18 Jun 2018 18:21:43 +0000 (19:21 +0100)]
Update OpenBIOS images to 8fe6f5f96f built from submodule.

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
5 years agoMerge remote-tracking branch 'mreitz/tags/pull-block-2018-06-18' into queue-block
Kevin Wolf [Mon, 18 Jun 2018 15:20:41 +0000 (17:20 +0200)]
Merge remote-tracking branch 'mreitz/tags/pull-block-2018-06-18' into queue-block

Block patches:
- Active mirror (blockdev-mirror copy-mode=write-blocking)

# gpg: Signature made Mon Jun 18 17:08:19 2018 CEST
# gpg:                using RSA key F407DB0061D5CF40
# gpg: Good signature from "Max Reitz <mreitz@redhat.com>"
# Primary key fingerprint: 91BE B60A 30DB 3E88 57D1  1829 F407 DB00 61D5 CF40

* mreitz/tags/pull-block-2018-06-18:
  iotests: Add test for active mirroring
  block/mirror: Add copy mode QAPI interface
  block/mirror: Add active mirroring
  job: Add job_progress_increase_remaining()
  block/mirror: Add MirrorBDSOpaque
  block/dirty-bitmap: Add bdrv_dirty_iter_next_area
  test-hbitmap: Add non-advancing iter_next tests
  hbitmap: Add @advance param to hbitmap_iter_next()
  block: Generalize should_update_child() rule
  block/mirror: Use source as a BdrvChild
  block/mirror: Wait for in-flight op conflicts
  block/mirror: Use CoQueue to wait on in-flight ops
  block/mirror: Convert to coroutines
  block/mirror: Pull out mirror_perform()

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
5 years agoMerge tag 'tags/s390x-2018-06-18' into staging
Cornelia Huck [Mon, 18 Jun 2018 15:05:27 +0000 (17:05 +0200)]
Merge tag 'tags/s390x-2018-06-18' into staging

Add support for pxelinux.cfg-style network booting to the s390x firmware

# gpg: Signature made Mon 18 Jun 2018 03:59:06 PM CEST
# gpg:                using RSA key 2ED9D774FE702DB5
# gpg: Good signature from "Thomas Huth <th.huth@gmx.de>" [full]
# gpg:                 aka "Thomas Huth <thuth@redhat.com>" [undefined]
# gpg:                 aka "Thomas Huth <huth@tuxfamily.org>" [undefined]
# gpg:                 aka "Thomas Huth <th.huth@posteo.de>" [unknown]

* tag 'tags/s390x-2018-06-18':
  pc-bios/s390-ccw: Update the s390-netboot.img binary
  pc-bios/s390-ccw: Optimize the s390-netboot.img for size
  pc-bios/s390-ccw/net: Try to load pxelinux.cfg file accoring to the UUID
  pc-bios/s390-ccw/net: Add support for pxelinux-style config files
  pc-bios/s390-ccw/net: Update code for the latest changes in SLOF
  roms: Update SLOF submodule to current status
  pc-bios/s390-ccw: define loadparm length

Signed-off-by: Cornelia Huck <cohuck@redhat.com>
5 years agoiotests: Add test for active mirroring
Max Reitz [Wed, 13 Jun 2018 18:18:23 +0000 (20:18 +0200)]
iotests: Add test for active mirroring

Signed-off-by: Max Reitz <mreitz@redhat.com>
Reviewed-by: Fam Zheng <famz@redhat.com>
Reviewed-by: Alberto Garcia <berto@igalia.com>
Message-id: 20180613181823.13618-15-mreitz@redhat.com
Signed-off-by: Max Reitz <mreitz@redhat.com>
5 years agoblock/mirror: Add copy mode QAPI interface
Max Reitz [Wed, 13 Jun 2018 18:18:22 +0000 (20:18 +0200)]
block/mirror: Add copy mode QAPI interface

This patch allows the user to specify whether to use active or only
background mode for mirror block jobs.  Currently, this setting will
remain constant for the duration of the entire block job.

Signed-off-by: Max Reitz <mreitz@redhat.com>
Reviewed-by: Alberto Garcia <berto@igalia.com>
Message-id: 20180613181823.13618-14-mreitz@redhat.com
Signed-off-by: Max Reitz <mreitz@redhat.com>
5 years agoblock/mirror: Add active mirroring
Max Reitz [Wed, 13 Jun 2018 18:18:21 +0000 (20:18 +0200)]
block/mirror: Add active mirroring

This patch implements active synchronous mirroring.  In active mode, the
passive mechanism will still be in place and is used to copy all
initially dirty clusters off the source disk; but every write request
will write data both to the source and the target disk, so the source
cannot be dirtied faster than data is mirrored to the target.  Also,
once the block job has converged (BLOCK_JOB_READY sent), source and
target are guaranteed to stay in sync (unless an error occurs).

Active mode is completely optional and currently disabled at runtime.  A
later patch will add a way for users to enable it.

Signed-off-by: Max Reitz <mreitz@redhat.com>
Reviewed-by: Fam Zheng <famz@redhat.com>
Message-id: 20180613181823.13618-13-mreitz@redhat.com
Signed-off-by: Max Reitz <mreitz@redhat.com>
5 years agojob: Add job_progress_increase_remaining()
Max Reitz [Wed, 13 Jun 2018 18:18:20 +0000 (20:18 +0200)]
job: Add job_progress_increase_remaining()

Signed-off-by: Max Reitz <mreitz@redhat.com>
Message-id: 20180613181823.13618-12-mreitz@redhat.com
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Max Reitz <mreitz@redhat.com>
5 years agoblock/mirror: Add MirrorBDSOpaque
Max Reitz [Wed, 13 Jun 2018 18:18:19 +0000 (20:18 +0200)]
block/mirror: Add MirrorBDSOpaque

This will allow us to access the block job data when the mirror block
driver becomes more complex.

Signed-off-by: Max Reitz <mreitz@redhat.com>
Reviewed-by: Fam Zheng <famz@redhat.com>
Message-id: 20180613181823.13618-11-mreitz@redhat.com
Signed-off-by: Max Reitz <mreitz@redhat.com>
5 years agoblock/dirty-bitmap: Add bdrv_dirty_iter_next_area
Max Reitz [Wed, 13 Jun 2018 18:18:18 +0000 (20:18 +0200)]
block/dirty-bitmap: Add bdrv_dirty_iter_next_area

This new function allows to look for a consecutively dirty area in a
dirty bitmap.

Signed-off-by: Max Reitz <mreitz@redhat.com>
Reviewed-by: Fam Zheng <famz@redhat.com>
Reviewed-by: John Snow <jsnow@redhat.com>
Message-id: 20180613181823.13618-10-mreitz@redhat.com
Signed-off-by: Max Reitz <mreitz@redhat.com>
5 years agotest-hbitmap: Add non-advancing iter_next tests
Max Reitz [Wed, 13 Jun 2018 18:18:17 +0000 (20:18 +0200)]
test-hbitmap: Add non-advancing iter_next tests

Add a function that wraps hbitmap_iter_next() and always calls it in
non-advancing mode first, and in advancing mode next.  The result should
always be the same.

By using this function everywhere we called hbitmap_iter_next() before,
we should get good test coverage for non-advancing hbitmap_iter_next().

Signed-off-by: Max Reitz <mreitz@redhat.com>
Reviewed-by: Fam Zheng <famz@redhat.com>
Reviewed-by: John Snow <jsnow@redhat.com>
Message-id: 20180613181823.13618-9-mreitz@redhat.com
Signed-off-by: Max Reitz <mreitz@redhat.com>
5 years agohbitmap: Add @advance param to hbitmap_iter_next()
Max Reitz [Wed, 13 Jun 2018 18:18:16 +0000 (20:18 +0200)]
hbitmap: Add @advance param to hbitmap_iter_next()

This new parameter allows the caller to just query the next dirty
position without moving the iterator.

Signed-off-by: Max Reitz <mreitz@redhat.com>
Reviewed-by: Fam Zheng <famz@redhat.com>
Reviewed-by: John Snow <jsnow@redhat.com>
Message-id: 20180613181823.13618-8-mreitz@redhat.com
Signed-off-by: Max Reitz <mreitz@redhat.com>
5 years agoblock: Generalize should_update_child() rule
Max Reitz [Wed, 13 Jun 2018 18:18:15 +0000 (20:18 +0200)]
block: Generalize should_update_child() rule

Currently, bdrv_replace_node() refuses to create loops from one BDS to
itself if the BDS to be replaced is the backing node of the BDS to
replace it: Say there is a node A and a node B.  Replacing B by A means
making all references to B point to A.  If B is a child of A (i.e. A has
a reference to B), that would mean we would have to make this reference
point to A itself -- so we'd create a loop.

bdrv_replace_node() (through should_update_child()) refuses to do so if
B is the backing node of A.  There is no reason why we should create
loops if B is not the backing node of A, though.  The BDS graph should
never contain loops, so we should always refuse to create them.

If B is a child of A and B is to be replaced by A, we should simply
leave B in place there because it is the most sensible choice.

A more specific argument would be: Putting filter drivers into the BDS
graph is basically the same as appending an overlay to a backing chain.
But the main child BDS of a filter driver is not "backing" but "file",
so restricting the no-loop rule to backing nodes would fail here.

Signed-off-by: Max Reitz <mreitz@redhat.com>
Reviewed-by: Fam Zheng <famz@redhat.com>
Reviewed-by: Alberto Garcia <berto@igalia.com>
Message-id: 20180613181823.13618-7-mreitz@redhat.com
Signed-off-by: Max Reitz <mreitz@redhat.com>
5 years agoblock/mirror: Use source as a BdrvChild
Max Reitz [Wed, 13 Jun 2018 18:18:14 +0000 (20:18 +0200)]
block/mirror: Use source as a BdrvChild

With this, the mirror_top_bs is no longer just a technically required
node in the BDS graph but actually represents the block job operation.

Also, drop MirrorBlockJob.source, as we can reach it through
mirror_top_bs->backing.

Signed-off-by: Max Reitz <mreitz@redhat.com>
Reviewed-by: Fam Zheng <famz@redhat.com>
Reviewed-by: Alberto Garcia <berto@igalia.com>
Message-id: 20180613181823.13618-6-mreitz@redhat.com
Signed-off-by: Max Reitz <mreitz@redhat.com>
5 years agoblock/mirror: Wait for in-flight op conflicts
Max Reitz [Wed, 13 Jun 2018 18:18:13 +0000 (20:18 +0200)]
block/mirror: Wait for in-flight op conflicts

This patch makes the mirror code differentiate between simply waiting
for any operation to complete (mirror_wait_for_free_in_flight_slot())
and specifically waiting for all operations touching a certain range of
the virtual disk to complete (mirror_wait_on_conflicts()).

Signed-off-by: Max Reitz <mreitz@redhat.com>
Reviewed-by: Fam Zheng <famz@redhat.com>
Message-id: 20180613181823.13618-5-mreitz@redhat.com
Signed-off-by: Max Reitz <mreitz@redhat.com>
5 years agoblock/mirror: Use CoQueue to wait on in-flight ops
Max Reitz [Wed, 13 Jun 2018 18:18:12 +0000 (20:18 +0200)]
block/mirror: Use CoQueue to wait on in-flight ops

Attach a CoQueue to each in-flight operation so if we need to wait for
any we can use it to wait instead of just blindly yielding and hoping
for some operation to wake us.

A later patch will use this infrastructure to allow requests accessing
the same area of the virtual disk to specifically wait for each other.

Signed-off-by: Max Reitz <mreitz@redhat.com>
Reviewed-by: Fam Zheng <famz@redhat.com>
Message-id: 20180613181823.13618-4-mreitz@redhat.com
Signed-off-by: Max Reitz <mreitz@redhat.com>
5 years agoblock/mirror: Convert to coroutines
Max Reitz [Wed, 13 Jun 2018 18:18:11 +0000 (20:18 +0200)]
block/mirror: Convert to coroutines

In order to talk to the source BDS (and maybe in the future to the
target BDS as well) directly, we need to convert our existing AIO
requests into coroutine I/O requests.

Signed-off-by: Max Reitz <mreitz@redhat.com>
Reviewed-by: Fam Zheng <famz@redhat.com>
Message-id: 20180613181823.13618-3-mreitz@redhat.com
Signed-off-by: Max Reitz <mreitz@redhat.com>
5 years agoblock/mirror: Pull out mirror_perform()
Max Reitz [Wed, 13 Jun 2018 18:18:10 +0000 (20:18 +0200)]
block/mirror: Pull out mirror_perform()

When converting mirror's I/O to coroutines, we are going to need a point
where these coroutines are created.  mirror_perform() is going to be
that point.

Signed-off-by: Max Reitz <mreitz@redhat.com>
Reviewed-by: Fam Zheng <famz@redhat.com>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Jeff Cody <jcody@redhat.com>
Reviewed-by: Alberto Garcia <berto@igalia.com>
Message-id: 20180613181823.13618-2-mreitz@redhat.com
Signed-off-by: Max Reitz <mreitz@redhat.com>
5 years agomonitor: add lock to protect mon_fdsets
Peter Xu [Fri, 8 Jun 2018 03:55:11 +0000 (11:55 +0800)]
monitor: add lock to protect mon_fdsets

Introduce a new global big lock for mon_fdsets.  Take it where needed.

The monitor_fdset_get_fd() handling is a bit tricky: now we need to call
qemu_mutex_unlock() which might pollute errno, so we need to make sure
the correct errno be passed up to the callers.  To make things simpler,
we let monitor_fdset_get_fd() return the -errno directly when error
happens, then in qemu_open() we move it back into errno.

Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Peter Xu <peterx@redhat.com>
Message-Id: <20180608035511.7439-8-peterx@redhat.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
5 years agomonitor: move init global earlier
Peter Xu [Fri, 8 Jun 2018 03:55:10 +0000 (11:55 +0800)]
monitor: move init global earlier

Before this patch, monitor fd helpers might be called even earlier than
monitor_init_globals().  This can be problematic.

After previous work, now monitor_init_globals() does not depend on
accelerator initialization any more.  Call it earlier (before CLI
parsing; that's where the monitor APIs might be called) to make sure it
is called before any of the monitor APIs.

Suggested-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Peter Xu <peterx@redhat.com>
Message-Id: <20180608035511.7439-7-peterx@redhat.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
5 years agomonitor: remove event_clock_type
Peter Xu [Fri, 8 Jun 2018 03:55:09 +0000 (11:55 +0800)]
monitor: remove event_clock_type

Instead, use a dynamic function to detect which clock we'll use.  The
problem is that the old code will let monitor initialization depend on
configure_accelerator() (that's where qtest_enabled() start to take
effect).  After this change, we don't have such a dependency any more.
We just need to make sure configure_accelerator() is called when we
start to use it.  Now it's only used in monitor_qapi_event_queue() and
monitor_qapi_event_handler(), so we're good.

Suggested-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Peter Xu <peterx@redhat.com>
Message-Id: <20180608035511.7439-6-peterx@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
[monitor_get_event_clock() name and comment tweaked]
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
5 years agomonitor: fix comment for monitor_lock
Peter Xu [Fri, 8 Jun 2018 03:55:08 +0000 (11:55 +0800)]
monitor: fix comment for monitor_lock

Fix typo in d622cb5879c.  Meanwhile move these variables close to each
other.  monitor_qapi_event_state can be declared static, add that.

Reported-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Peter Xu <peterx@redhat.com>
Message-Id: <20180608035511.7439-5-peterx@redhat.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
5 years agomonitor: more comments on lock-free elements
Peter Xu [Fri, 8 Jun 2018 03:55:07 +0000 (11:55 +0800)]
monitor: more comments on lock-free elements

Add some explicit comments for both Readline and cpu_set/cpu_get helpers
that they do not need the mon_lock protection.

Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Peter Xu <peterx@redhat.com>
Message-Id: <20180608035511.7439-4-peterx@redhat.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
5 years agomonitor: protect mon->fds with mon_lock
Peter Xu [Fri, 8 Jun 2018 03:55:06 +0000 (11:55 +0800)]
monitor: protect mon->fds with mon_lock

mon->fds were protected by BQL.  Now protect it by mon_lock so that it
can even be used in monitor iothread.

Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Peter Xu <peterx@redhat.com>
Message-Id: <20180608035511.7439-3-peterx@redhat.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
5 years agomonitor: rename out_lock to mon_lock
Peter Xu [Fri, 8 Jun 2018 03:55:05 +0000 (11:55 +0800)]
monitor: rename out_lock to mon_lock

The out_lock is protecting a few Monitor fields.  In the future the
monitor code will start to run in multiple threads.  We are going to
turn it into a bigger lock to protect not only the out buffer but also
most of the rest.

Since at it, rearrange the Monitor struct a bit.

Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Peter Xu <peterx@redhat.com>
Message-Id: <20180608035511.7439-2-peterx@redhat.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
5 years agopc-bios/s390-ccw: Update the s390-netboot.img binary
Thomas Huth [Mon, 18 Jun 2018 13:24:44 +0000 (15:24 +0200)]
pc-bios/s390-ccw: Update the s390-netboot.img binary

This binary now contains the support for pxelinux.cfg-style network
booting.

Signed-off-by: Thomas Huth <thuth@redhat.com>
5 years agopc-bios/s390-ccw: Optimize the s390-netboot.img for size
Thomas Huth [Thu, 14 Jun 2018 08:38:22 +0000 (10:38 +0200)]
pc-bios/s390-ccw: Optimize the s390-netboot.img for size

The -O2 optimization flag is passed via CFLAGS to the firmware Makefile,
but in netbook.mak, we've got some rules that only use QEMU_CFLAGS for
compiling the libc and libnet from SLOF, so these files get compiled
without optimization so far. Use CFLAGS here, too, to create faster
and smaller code.

We can additionally save some more bytes in the firmware images by compi-
ling the code with -fno-asynchronous-unwind-tables. This will omit some
ELF sections (used for stack unwinding for example) from the image that
we do not need in the firmware.

Acked-by: Christian Borntraeger <borntraeger@de.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
5 years agopc-bios/s390-ccw/net: Try to load pxelinux.cfg file accoring to the UUID
Thomas Huth [Tue, 22 May 2018 09:53:51 +0000 (11:53 +0200)]
pc-bios/s390-ccw/net: Try to load pxelinux.cfg file accoring to the UUID

With the STSI instruction, we can get the UUID of the current VM instance,
so we can support loading pxelinux config files via UUID in the file name,
too.

Acked-by: Christian Borntraeger <borntraeger@de.ibm.com>
Tested-by: Viktor Mihajlovski <mihajlov@linux.vnet.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
5 years agopc-bios/s390-ccw/net: Add support for pxelinux-style config files
Thomas Huth [Tue, 22 May 2018 09:37:29 +0000 (11:37 +0200)]
pc-bios/s390-ccw/net: Add support for pxelinux-style config files

Since it is quite cumbersome to manually create a combined kernel with
initrd image for network booting, we now support loading via pxelinux
configuration files, too. In these files, the kernel, initrd and command
line parameters can be specified seperately, and the firmware then takes
care of glueing everything together in memory after the files have been
downloaded. See this URL for details about the config file layout:
https://www.syslinux.org/wiki/index.php?title=PXELINUX

The user can either specify a config file directly as bootfile via DHCP
(but in this case, the file has to start either with "default" or a "#"
comment so we can distinguish it from binary kernels), or a folder (i.e.
the bootfile name must end with "/") where the firmware should look for
the typical pxelinux.cfg file names, e.g. based on MAC or IP address.
We also support the pxelinux.cfg DHCP options 209 and 210 from RFC 5071.

Acked-by: Christian Borntraeger <borntraeger@de.ibm.com>
Tested-by: Viktor Mihajlovski <mihajlov@linux.vnet.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
5 years agopc-bios/s390-ccw/net: Update code for the latest changes in SLOF
Thomas Huth [Fri, 18 May 2018 09:31:27 +0000 (11:31 +0200)]
pc-bios/s390-ccw/net: Update code for the latest changes in SLOF

The ip_version information now has to be stored in the filename_ip_t
structure, and there is now a common function called tftp_get_error_info()
which can be used to get the error string for a TFTP error code.
We can also get rid of some superfluous "(char *)" casts now.

Acked-by: Christian Borntraeger <borntraeger@de.ibm.com>
Tested-by: Viktor Mihajlovski <mihajlov@linux.vnet.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
5 years agoroms: Update SLOF submodule to current status
Thomas Huth [Tue, 5 Jun 2018 10:41:49 +0000 (12:41 +0200)]
roms: Update SLOF submodule to current status

We need the latest version of SLOF's libnet for adding pxelinux.cfg
support in the s390-ccw bios, too.

Signed-off-by: Thomas Huth <thuth@redhat.com>
5 years agopc-bios/s390-ccw: define loadparm length
Collin Walling [Tue, 29 May 2018 04:40:09 +0000 (00:40 -0400)]
pc-bios/s390-ccw: define loadparm length

Loadparm is defined by the s390 architecture to be 8 bytes
in length. Let's define this size in the s390-ccw bios.

Suggested-by: Laszlo Ersek <lersek@redhat.com>
Signed-off-by: Collin Walling <walling@linux.ibm.com>
Reviewed-by: Laszlo Ersek <lersek@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
5 years agoblock: fix QEMU crash with scsi-hd and drive_del
Greg Kurz [Mon, 28 May 2018 12:03:59 +0000 (14:03 +0200)]
block: fix QEMU crash with scsi-hd and drive_del

Removing a drive with drive_del while it is being used to run an I/O
intensive workload can cause QEMU to crash.

An AIO flush can yield at some point:

blk_aio_flush_entry()
 blk_co_flush(blk)
  bdrv_co_flush(blk->root->bs)
   ...
    qemu_coroutine_yield()

and let the HMP command to run, free blk->root and give control
back to the AIO flush:

    hmp_drive_del()
     blk_remove_bs()
      bdrv_root_unref_child(blk->root)
       child_bs = blk->root->bs
       bdrv_detach_child(blk->root)
        bdrv_replace_child(blk->root, NULL)
         blk->root->bs = NULL
        g_free(blk->root) <============== blk->root becomes stale
       bdrv_unref(child_bs)
        bdrv_delete(child_bs)
         bdrv_close()
          bdrv_drained_begin()
           bdrv_do_drained_begin()
            bdrv_drain_recurse()
             aio_poll()
              ...
              qemu_coroutine_switch()

and the AIO flush completion ends up dereferencing blk->root:

  blk_aio_complete()
   scsi_aio_complete()
    blk_get_aio_context(blk)
     bs = blk_bs(blk)
 ie, bs = blk->root ? blk->root->bs : NULL
            ^^^^^
            stale

The problem is that we should avoid making block driver graph
changes while we have in-flight requests. Let's drain all I/O
for this BB before calling bdrv_root_unref_child().

Signed-off-by: Greg Kurz <groug@kaod.org>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
5 years agotest-bdrv-drain: Test graph changes in drain_all section
Kevin Wolf [Wed, 28 Mar 2018 16:29:06 +0000 (18:29 +0200)]
test-bdrv-drain: Test graph changes in drain_all section

This tests both adding and remove a node between bdrv_drain_all_begin()
and bdrv_drain_all_end(), and enabled the existing detach test for
drain_all.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
5 years agoblock: Allow graph changes in bdrv_drain_all_begin/end sections
Kevin Wolf [Wed, 28 Mar 2018 16:29:18 +0000 (18:29 +0200)]
block: Allow graph changes in bdrv_drain_all_begin/end sections

bdrv_drain_all_*() used bdrv_next() to iterate over all root nodes and
did a subtree drain for each of them. This works fine as long as the
graph is static, but sadly, reality looks different.

If the graph changes so that root nodes are added or removed, we would
have to compensate for this. bdrv_next() returns each root node only
once even if it's the root node for multiple BlockBackends or for a
monitor-owned block driver tree, which would only complicate things.

The much easier and more obviously correct way is to fundamentally
change the way the functions work: Iterate over all BlockDriverStates,
no matter who owns them, and drain them individually. Compensation is
only necessary when a new BDS is created inside a drain_all section.
Removal of a BDS doesn't require any action because it's gone afterwards
anyway.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
5 years agoblock: ignore_bds_parents parameter for drain functions
Kevin Wolf [Tue, 29 May 2018 15:17:45 +0000 (17:17 +0200)]
block: ignore_bds_parents parameter for drain functions

In the future, bdrv_drained_all_begin/end() will drain all invidiual
nodes separately rather than whole subtrees. This means that we don't
want to propagate the drain to all parents any more: If the parent is a
BDS, it will already be drained separately. Recursing to all parents is
unnecessary work and would make it an O(n²) operation.

Prepare the drain function for the changed drain_all by adding an
ignore_bds_parents parameter to the internal implementation that
prevents the propagation of the drain to BDS parents. We still (have to)
propagate it to non-BDS parents like BlockBackends or Jobs because those
are not drained separately.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
5 years agoblock: Move bdrv_drain_all_begin() out of coroutine context
Kevin Wolf [Tue, 10 Apr 2018 14:07:55 +0000 (16:07 +0200)]
block: Move bdrv_drain_all_begin() out of coroutine context

Before we can introduce a single polling loop for all nodes in
bdrv_drain_all_begin(), we must make sure to run it outside of coroutine
context like we already do for bdrv_do_drained_begin().

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
5 years agoblock: Allow AIO_WAIT_WHILE with NULL ctx
Kevin Wolf [Tue, 10 Apr 2018 13:51:52 +0000 (15:51 +0200)]
block: Allow AIO_WAIT_WHILE with NULL ctx

bdrv_drain_all() wants to have a single polling loop for draining the
in-flight requests of all nodes. This means that the AIO_WAIT_WHILE()
condition relies on activity in multiple AioContexts, which is polled
from the mainloop context. We must therefore call AIO_WAIT_WHILE() from
the mainloop thread and use the AioWait notification mechanism.

Just randomly picking the AioContext of any non-mainloop thread would
work, but instead of bothering to find such a context in the caller, we
can just as well accept NULL for ctx.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
5 years agotest-bdrv-drain: Test that bdrv_drain_invoke() doesn't poll
Kevin Wolf [Fri, 23 Mar 2018 19:10:52 +0000 (20:10 +0100)]
test-bdrv-drain: Test that bdrv_drain_invoke() doesn't poll

This adds a test case that goes wrong if bdrv_drain_invoke() calls
aio_poll().

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
5 years agoblock: Defer .bdrv_drain_begin callback to polling phase
Kevin Wolf [Fri, 23 Mar 2018 19:29:24 +0000 (20:29 +0100)]
block: Defer .bdrv_drain_begin callback to polling phase

We cannot allow aio_poll() in bdrv_drain_invoke(begin=true) until we're
done with propagating the drain through the graph and are doing the
single final BDRV_POLL_WHILE().

Just schedule the coroutine with the callback and increase bs->in_flight
to make sure that the polling phase will wait for it.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
5 years agotest-bdrv-drain: Graph change through parent callback
Kevin Wolf [Fri, 23 Mar 2018 17:48:39 +0000 (18:48 +0100)]
test-bdrv-drain: Graph change through parent callback

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
5 years agoblock: Don't poll in parent drain callbacks
Kevin Wolf [Fri, 23 Mar 2018 14:57:20 +0000 (15:57 +0100)]
block: Don't poll in parent drain callbacks

bdrv_do_drained_begin() is only safe if we have a single
BDRV_POLL_WHILE() after quiescing all affected nodes. We cannot allow
that parent callbacks introduce a nested polling loop that could cause
graph changes while we're traversing the graph.

Split off bdrv_do_drained_begin_quiesce(), which only quiesces a single
node without waiting for its requests to complete. These requests will
be waited for in the BDRV_POLL_WHILE() call down the call chain.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
5 years agotest-bdrv-drain: Test node deletion in subtree recursion
Kevin Wolf [Fri, 23 Mar 2018 11:40:21 +0000 (12:40 +0100)]
test-bdrv-drain: Test node deletion in subtree recursion

If bdrv_do_drained_begin() polls during its subtree recursion, the graph
can change and mess up the bs->children iteration. Test that this
doesn't happen.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
5 years agoblock: Drain recursively with a single BDRV_POLL_WHILE()
Kevin Wolf [Fri, 23 Mar 2018 11:40:41 +0000 (12:40 +0100)]
block: Drain recursively with a single BDRV_POLL_WHILE()

Anything can happen inside BDRV_POLL_WHILE(), including graph
changes that may interfere with its callers (e.g. child list iteration
in recursive callers of bdrv_do_drained_begin).

Switch to a single BDRV_POLL_WHILE() call for the whole subtree at the
end of bdrv_do_drained_begin() to avoid such effects. The recursion
happens now inside the loop condition. As the graph can only change
between bdrv_drain_poll() calls, but not inside of it, doing the
recursion here is safe.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
5 years agotest-bdrv-drain: Add test for node deletion
Max Reitz [Wed, 28 Feb 2018 18:04:54 +0000 (19:04 +0100)]
test-bdrv-drain: Add test for node deletion

This patch adds two bdrv-drain tests for what happens if some BDS goes
away during the drainage.

The basic idea is that you have a parent BDS with some child nodes.
Then, you drain one of the children.  Because of that, the party who
actually owns the parent decides to (A) delete it, or (B) detach all its
children from it -- both while the child is still being drained.

A real-world case where this can happen is the mirror block job, which
may exit if you drain one of its children.

Signed-off-by: Max Reitz <mreitz@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
5 years agoblock: Remove bdrv_drain_recurse()
Kevin Wolf [Thu, 22 Mar 2018 13:35:58 +0000 (14:35 +0100)]
block: Remove bdrv_drain_recurse()

For bdrv_drain(), recursively waiting for child node requests is
pointless because we didn't quiesce their parents, so new requests could
come in anyway. Letting the function work only on a single node makes it
more consistent.

For subtree drains and drain_all, we already have the recursion in
bdrv_do_drained_begin(), so the extra recursion doesn't add anything
either.

Remove the useless code.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
5 years agoblock: Really pause block jobs on drain
Kevin Wolf [Thu, 22 Mar 2018 13:11:20 +0000 (14:11 +0100)]
block: Really pause block jobs on drain

We already requested that block jobs be paused in .bdrv_drained_begin,
but no guarantee was made that the job was actually inactive at the
point where bdrv_drained_begin() returned.

This introduces a new callback BdrvChildRole.bdrv_drained_poll() and
uses it to make bdrv_drain_poll() consider block jobs using the node to
be drained.

For the test case to work as expected, we have to switch from
block_job_sleep_ns() to qemu_co_sleep_ns() so that the test job is even
considered active and must be waited for when draining the node.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
5 years agoblock: Avoid unnecessary aio_poll() in AIO_WAIT_WHILE()
Kevin Wolf [Thu, 22 Mar 2018 09:57:14 +0000 (10:57 +0100)]
block: Avoid unnecessary aio_poll() in AIO_WAIT_WHILE()

Commit 91af091f923 added an additional aio_poll() to BDRV_POLL_WHILE()
in order to make sure that all pending BHs are executed on drain. This
was the wrong place to make the fix, as it is useless overhead for all
other users of the macro and unnecessarily complicates the mechanism.

This patch effectively reverts said commit (the context has changed a
bit and the code has moved to AIO_WAIT_WHILE()) and instead polls in the
loop condition for drain.

The effect is probably hard to measure in any real-world use case
because actual I/O will dominate, but if I run only the initialisation
part of 'qemu-img convert' where it calls bdrv_block_status() for the
whole image to find out how much data there is copy, this phase actually
needs only roughly half the time after this patch.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
5 years agotests/test-bdrv-drain: bdrv_drain_all() works in coroutines now
Kevin Wolf [Wed, 4 Apr 2018 11:26:16 +0000 (13:26 +0200)]
tests/test-bdrv-drain: bdrv_drain_all() works in coroutines now

Since we use bdrv_do_drained_begin/end() for bdrv_drain_all_begin/end(),
coroutine context is automatically left with a BH, preventing the
deadlocks that made bdrv_drain_all*() unsafe in coroutine context. Now
that we even removed the old polling code as dead code, it's obvious
that it's compatible now.

Enable the coroutine test cases for bdrv_drain_all().

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
5 years agoblock: Don't manually poll in bdrv_drain_all()
Kevin Wolf [Thu, 14 Dec 2017 10:25:16 +0000 (11:25 +0100)]
block: Don't manually poll in bdrv_drain_all()

All involved nodes are already idle, we called bdrv_do_drain_begin() on
them.

The comment in the code suggested that this was not correct because the
completion of a request on one node could spawn a new request on a
different node (which might have been drained before, so we wouldn't
drain the new request). In reality, new requests to different nodes
aren't spawned out of nothing, but only in the context of a parent
request, and they aren't submitted to random nodes, but only to child
nodes. As long as we still poll for the completion of the parent request
(which we do), draining each root node separately is good enough.

Remove the additional polling code from bdrv_drain_all_begin() and
replace it with an assertion that all nodes are already idle after we
drained them separately.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
5 years agoblock: Remove 'recursive' parameter from bdrv_drain_invoke()
Kevin Wolf [Thu, 14 Dec 2017 09:40:20 +0000 (10:40 +0100)]
block: Remove 'recursive' parameter from bdrv_drain_invoke()

All callers pass false for the 'recursive' parameter now. Remove it.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
5 years agoblock: Use bdrv_do_drain_begin/end in bdrv_drain_all()
Kevin Wolf [Thu, 14 Dec 2017 09:27:23 +0000 (10:27 +0100)]
block: Use bdrv_do_drain_begin/end in bdrv_drain_all()

bdrv_do_drain_begin/end() implement already everything that
bdrv_drain_all_begin/end() need and currently still do manually: Disable
external events, call parent drain callbacks, call block driver
callbacks.

It also does two more things:

The first is incrementing bs->quiesce_counter. bdrv_drain_all() already
stood out in the test case by behaving different from the other drain
variants. Adding this is not only safe, but in fact a bug fix.

The second is calling bdrv_drain_recurse(). We already do that later in
the same function in a loop, so basically doing an early first iteration
doesn't hurt.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
5 years agotest-bdrv-drain: bdrv_drain() works with cross-AioContext events
Kevin Wolf [Sat, 9 Dec 2017 23:11:13 +0000 (00:11 +0100)]
test-bdrv-drain: bdrv_drain() works with cross-AioContext events

As long as nobody keeps the other I/O thread from working, there is no
reason why bdrv_drain() wouldn't work with cross-AioContext events. The
key is that the root request we're waiting for is in the AioContext
we're polling (which it always is for bdrv_drain()) so that aio_poll()
is woken up in the end.

Add a test case that shows that it works. Remove the comment in
bdrv_drain() that claims otherwise.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
5 years agops2: check PS2Queue wptr pointer in post_load routine
liujunjie [Thu, 7 Jun 2018 08:02:37 +0000 (16:02 +0800)]
ps2: check PS2Queue wptr pointer in post_load routine

In commit 802cbcb7300, most issues have been fixed when qemu guest
migration. But the queue size still need to check whether is equal to
PS2_QUEUE_SIZE. If yes, the wptr should set as 0. Or, wptr would larger
than PS2_QUEUE_SIZE and never come back when ps2_queue_noirq is called.
This could lead to OOB access, add check to avoid it.

Signed-off-by: liujunjie <liujunjie23@huawei.com>
Reviewed-by: Gonglei <arei.gonglei@huawei.com>
Message-id: 20180607080237.12360-1-liujunjie23@huawei.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
5 years agoAdd ramfb MAINTAINERS entry
Gerd Hoffmann [Wed, 13 Jun 2018 12:29:48 +0000 (14:29 +0200)]
Add ramfb MAINTAINERS entry

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Laszlo Ersek <lersek@redhat.com>
Message-id: 20180613122948.18149-5-kraxel@redhat.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
5 years agohw/display: add standalone ramfb device
Gerd Hoffmann [Wed, 13 Jun 2018 12:29:46 +0000 (14:29 +0200)]
hw/display: add standalone ramfb device

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Tested-by: Laszlo Ersek <lersek@redhat.com>
Message-id: 20180613122948.18149-3-kraxel@redhat.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
5 years agohw/display: add ramfb, a simple boot framebuffer living in guest ram
Gerd Hoffmann [Wed, 13 Jun 2018 12:29:45 +0000 (14:29 +0200)]
hw/display: add ramfb, a simple boot framebuffer living in guest ram

The boot framebuffer is expected to be configured by the firmware, so it
uses fw_cfg as interface.  Initialization goes as follows:

  (1) Check whenever etc/ramfb is present.
  (2) Allocate framebuffer from RAM.
  (3) Fill struct RAMFBCfg, write it to etc/ramfb.

Done.  You can write stuff to the framebuffer now, and it should appear
automagically on the screen.

Note that this isn't very efficient because it does a full display
update on each refresh.  No dirty tracking.  Dirty tracking would have
to be active for the whole ram slot, so that wouldn't be very efficient
either.  For a boot display which is active for a short time only this
isn't a big deal.  As permanent guest display something better should be
used (if possible).

This is the ramfb core code.  Some windup is needed for display devices
which want have a ramfb boot display.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Tested-by: Laszlo Ersek <lersek@redhat.com>
Message-id: 20180613122948.18149-2-kraxel@redhat.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
5 years agos390x/cpumodels: add z14 Model ZR1
Christian Borntraeger [Wed, 13 Jun 2018 08:18:19 +0000 (10:18 +0200)]
s390x/cpumodels: add z14 Model ZR1

Introduce the new z14 Model ZR1 cpu model. Mostly identical to z14, only
the cpu type differs (3906 vs. 3907)

Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
Message-Id: <20180613081819.147178-1-borntraeger@de.ibm.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Signed-off-by: Cornelia Huck <cohuck@redhat.com>
5 years agos390x/ipl: Try to detect Linux vs non Linux for initial IPL PSW
Christian Borntraeger [Tue, 12 Jun 2018 12:59:33 +0000 (14:59 +0200)]
s390x/ipl: Try to detect Linux vs non Linux for initial IPL PSW

Right now the IPL device always starts from address 0x10000 (the usual
Linux entry point). To run other guests (e.g. test programs) it is
useful to use the IPL PSW from address 0. We can use the Linux magic
at 0x10008 to decide.

Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
Message-Id: <20180612125933.262679-1-borntraeger@de.ibm.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Cornelia Huck <cohuck@redhat.com>
5 years agovfio-ccw: remove orb.c64 (64 bit data addresses) check
Halil Pasic [Thu, 24 May 2018 17:58:28 +0000 (19:58 +0200)]
vfio-ccw: remove orb.c64 (64 bit data addresses) check

The vfio-ccw module does the check too, and there is actually no
technical obstacle for supporting fmt 1 idaws. Let us be ready for the
beautiful day when fmt 1 idaws become supported by the vfio-ccw kernel
module. QEMU does not have to do a thing for that, except not insisting
on this check.

Signed-off-by: Halil Pasic <pasic@linux.ibm.com>
Acked-by: Jason J. Herne <jjherne@linux.ibm.com>
Tested-by: Jason J. Herne <jjherne@linux.ibm.com>
Message-Id: <20180524175828.3143-3-pasic@linux.ibm.com>
Signed-off-by: Cornelia Huck <cohuck@redhat.com>
5 years agovfio-ccw: add force unlimited prefetch property
Halil Pasic [Thu, 24 May 2018 17:58:27 +0000 (19:58 +0200)]
vfio-ccw: add force unlimited prefetch property

There is at least one guest (OS) such that although it does not rely on
the guarantees provided by ORB 1 word 9 bit (aka unlimited prefetch, aka
P bit) not being set, it fails to tell this to the machine.

Usually this ain't a big deal, as the original purpose of the P bit is to
allow for performance optimizations. vfio-ccw however can not provide the
guarantees required if the bit is not set.

It is not possible to implement support for the P bit not set without
transitioning to lower level protocols for vfio-ccw.  So let's give the
user the opportunity to force setting the P bit, if the user knows this
is safe.  For self modifying channel programs forcing the P bit is not
safe.  If the P bit is forced for a self modifying channel program things
are expected to break in strange ways.

Let's also avoid warning multiple about P bit not set in the ORB in case
P bit is not told to be forced, and designate the affected vfio-ccw
device.

Signed-off-by: Halil Pasic <pasic@linux.ibm.com>
Suggested-by: Dong Jia Shi <bjsdjshi@linux.ibm.com>
Acked-by: Jason J. Herne <jjherne@linux.ibm.com>
Tested-by: Jason J. Herne <jjherne@linux.ibm.com>
Message-Id: <20180524175828.3143-2-pasic@linux.ibm.com>
Signed-off-by: Cornelia Huck <cohuck@redhat.com>
5 years agovirtio-ccw: clean up notify
Halil Pasic [Wed, 16 May 2018 13:27:57 +0000 (15:27 +0200)]
virtio-ccw: clean up notify

Coverity recently started complaining about virtio_ccw_notify().  Turns
out, there is a couple of things that can be cleaned up.  Let's clean!

Reported-by: Peter Maydell <peter.maydell@linaro.org>
Fixes: CID 1390619
Signed-off-by: Halil Pasic <pasic@linux.ibm.com>
Message-Id: <20180516132757.68558-1-pasic@linux.ibm.com>
Signed-off-by: Cornelia Huck <cohuck@redhat.com>
5 years agoRevert "bus: do not unref the added child bus on realize"
Marc-André Lureau [Wed, 13 Jun 2018 17:28:15 +0000 (19:28 +0200)]
Revert "bus: do not unref the added child bus on realize"

This is wrong.  object_finalize_child_property()'s unref balances the
ref in object_property_add_child().  qbus_realize's unref balances the
ref that was initially placed by object_new/object_initialize.

This reverts commit f3d58385a6d3d82f65db602c5506e2d3d8c82394.

Reported-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-id: 20180613172815.32738-4-marcandre.lureau@redhat.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
5 years agoconfigure: print virglrenderer version
Marc-André Lureau [Fri, 25 May 2018 15:36:09 +0000 (17:36 +0200)]
configure: print virglrenderer version

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
Message-id: 20180525153609.13187-1-marcandre.lureau@redhat.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
5 years agoRevert "usb: release the created buses"
Marc-André Lureau [Wed, 13 Jun 2018 17:28:14 +0000 (19:28 +0200)]
Revert "usb: release the created buses"

The USB device don't hold the bus. There is no ASAN related reports
anymore.

This reverts commit cd7bc87868d534f95e928cad98e2a52df7695771.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-id: 20180613172815.32738-3-marcandre.lureau@redhat.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
5 years agoRevert "usb-ccid: fix bus leak"
Marc-André Lureau [Wed, 13 Jun 2018 17:28:13 +0000 (19:28 +0200)]
Revert "usb-ccid: fix bus leak"

The bus is not owned by the device.

This reverts commit 410a096adf991ce437d4d7dabc59b6557e6d488d.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-id: 20180613172815.32738-2-marcandre.lureau@redhat.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
5 years agospapr: fix xics_system_init() error path
Greg Kurz [Fri, 15 Jun 2018 16:58:00 +0000 (18:58 +0200)]
spapr: fix xics_system_init() error path

Commit 3d85885a1b1f3 tried to fix error handling, but it actually
went into the wrong direction by dropping the local Error *.

In the default KVM case, the rationale is to try the in-kernel XICS first,
and if not possible, to fallback to userland XICS. Passing errp everywhere
makes this fallback impossible if errp is &error_fatal (which happens to
be the case). And anyway, if the caller would pass a regular &local_err,
things would be worse: we could possibly pass an already set *errp to
error_setg() and crash, or return an error even in case of success.

So we definitely need a local Error * and only propagate it when we're
done with the fallback logic. This is what this patch does.

Signed-off-by: Greg Kurz <groug@kaod.org>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
5 years agoSPARC64: add icount support
Mark Cave-Ayland [Fri, 15 Jun 2018 07:33:03 +0000 (08:33 +0100)]
SPARC64: add icount support

This patch adds gen_io_start()/gen_io_end() to various instructions as required
in order to boot my OpenBIOS test images on qemu-system-sparc64 with icount
enabled.

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
5 years agohw/sparc/sun4m: Fix problems with device introspection
Thomas Huth [Thu, 5 Apr 2018 10:43:03 +0000 (12:43 +0200)]
hw/sparc/sun4m: Fix problems with device introspection

Several devices of the sun4m machines are using &error_fatal in
their instance_init function and thus can cause QEMU to abort
unexpectedly:

$ echo "{'execute':'qmp_capabilities'}"\
       "{'execute':'device-list-properties',"\
       " 'arguments':{'typename':'openprom'}}" \
       | sparc-softmmu/qemu-system-sparc -M SS-10 -S -qmp stdio
{"QMP": {"version": {"qemu": {"micro": 91, "minor": 11, "major": 2},
 "package": "build-all"}, "capabilities": []}}
{"return": {}}
RAMBlock "sun4m.prom" already registered, abort!
Aborted (core dumped)

$ echo "{'execute':'qmp_capabilities'}"\
       "{'execute':'device-list-properties',"\
       " 'arguments':{'typename':'macio_idreg'}}" \
       | sparc-softmmu/qemu-system-sparc -M SS-10 -S -qmp stdio
{"QMP": {"version": {"qemu": {"micro": 91, "minor": 11, "major": 2},
 "package": "build-all"}, "capabilities": []}}
{"return": {}}
RAMBlock "sun4m.idreg" already registered, abort!
Aborted (core dumped)

$ echo "{'execute':'qmp_capabilities'}"\
       "{'execute':'device-list-properties',"\
       " 'arguments':{'typename':'tcx_afx'}}" \
       | sparc-softmmu/qemu-system-sparc -M SS-5 -S -qmp stdio
{"QMP": {"version": {"qemu": {"micro": 91, "minor": 11, "major": 2},
 "package": "build-all"}, "capabilities": []}}
{"return": {}}
RAMBlock "sun4m.afx" already registered, abort!
Aborted (core dumped)

Fix the issues by converting the instance_init functions into realize()
functions instead, which are allowed to fail (and not called during
device introspection).

Signed-off-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
5 years agohw/sparc64/sun4u: Fix introspection by converting prom instance_init to realize
Thomas Huth [Thu, 5 Apr 2018 09:32:30 +0000 (11:32 +0200)]
hw/sparc64/sun4u: Fix introspection by converting prom instance_init to realize

The instance_init function of devices should always succeed to be able
to introspect the device. However, the instance_init function of the
"openprom" device can currently fail, for example like this:

$ echo "{'execute':'qmp_capabilities'}"\
       "{'execute':'device-list-properties',"\
       " 'arguments':{'typename':'openprom'}}" \
       | sparc64-softmmu/qemu-system-sparc64 -M sun4v,accel=qtest -qmp stdio
{"QMP": {"version": {"qemu": {"micro": 91, "minor": 11, "major": 2},
 "package": "build-all"}, "capabilities": []}}
{"return": {}}
RAMBlock "sun4u.prom" already registered, abort!
Aborted (core dumped)

This should not happen. Fix this problem by moving the affected code from
instance_init into a realize function instead.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
5 years agohw/isa/smc37c669: Change the parallel I/O base to 378H
Philippe Mathieu-Daudé [Thu, 14 Jun 2018 23:39:35 +0000 (20:39 -0300)]
hw/isa/smc37c669: Change the parallel I/O base to 378H

On the Alpha DP264 machine, the Cirrus VGA is I/O mapped
in the 3C0H-3CFH range, thus I/O base used by the parallel
device clashes, and since a4cb773928e the VGA is not
working:

(qemu) info mtree
address-space: memory
  0000000000000000-ffffffffffffffff (prio 0, i/o): system
    00000801fc000000-00000801fdffffff (prio 0, i/o): pci0-io
      ...
      00000801fc0003b4-00000801fc0003b5 (prio 0, i/o): vga
      00000801fc0003ba-00000801fc0003ba (prio 0, i/o): vga
      00000801fc0003bc-00000801fc0003c3 (prio 0, i/o): parallel
                                    ^^^                ^^^^^^^^
      00000801fc0003c0-00000801fc0003cf (prio 0, i/o): vga
                   ^^^
      00000801fc0003d4-00000801fc0003d5 (prio 0, i/o): vga
      00000801fc0003da-00000801fc0003da (prio 0, i/o): vga
      ...

As there is no particular reason to use this base address
(introduced in 7bea0dd434e), change to 378H which is the
default on PC machines.

Reported-by: Emilio G. Cota <cota@braap.org>
Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
Tested-by: Emilio G. Cota <cota@braap.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-Id: <20180614233935.26585-1-f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
5 years agotarget/ppc, spapr: Move VPA information to machine_data
David Gibson [Wed, 13 Jun 2018 06:22:18 +0000 (16:22 +1000)]
target/ppc, spapr: Move VPA information to machine_data

CPUPPCState currently contains a number of fields containing the state of
the VPA.  The VPA is a PAPR specific concept covering several guest/host
shared memory areas used to communicate some information with the
hypervisor.

As a PAPR concept this is really machine specific information, although it
is per-cpu, so it doesn't really belong in the core CPU state structure.

There's also other information that's per-cpu, but platform/machine
specific.  So create a (void *)machine_data in PowerPCCPU which can be
used by the machine to locate per-cpu data.  Intialization, lifetime and
cleanup of machine_data is entirely up to the machine type.

Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Reviewed-by: Greg Kurz <groug@kaod.org>
Tested-by: Greg Kurz <groug@kaod.org>
5 years agoppc/pnv: introduce a pnv_chip_core_realize() routine
Cédric Le Goater [Thu, 14 Jun 2018 14:00:41 +0000 (16:00 +0200)]
ppc/pnv: introduce a pnv_chip_core_realize() routine

This extracts from the PvChip realize routine the part creating the
cores. On Power9, we will need to create the cores after the Xive
interrupt controller is created.

Signed-off-by: Cédric Le Goater <clg@kaod.org>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
5 years agospapr_cpu_core: introduce spapr_create_vcpu()
Greg Kurz [Thu, 14 Jun 2018 21:50:57 +0000 (23:50 +0200)]
spapr_cpu_core: introduce spapr_create_vcpu()

This moves some code out from spapr_cpu_core_realize() for clarity. No
functional change.

Signed-off-by: Greg Kurz <groug@kaod.org>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
5 years agospapr_cpu_core: add missing rollback on realization path
Greg Kurz [Thu, 14 Jun 2018 21:50:42 +0000 (23:50 +0200)]
spapr_cpu_core: add missing rollback on realization path

The spapr_realize_vcpu() function doesn't rollback in case of error.
This isn't a problem with coldplugged CPUs because the machine won't
start and QEMU will exit. Hotplug is a different story though: the
CPU thread is started under object_property_set_bool() and it assumes
it can access the CPU object.

If icp_create() fails, we return an error without unregistering the
reset handler for this CPU, and we let the underlying QEMU thread for
this CPU alive. Since spapr_cpu_core_realize() doesn't care to unrealize
already realized CPUs either, but happily frees all of them anyway, the
CPU thread crashes instantly:

(qemu) device_add host-spapr-cpu-core,core-id=1,id=gku
GKU: failing icp_create (cpu 0x11497fd0)
                             ^^^^^^^^^^
Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fffee3feaa0 (LWP 24725)]
0x00000000104c8374 in object_dynamic_cast_assert (obj=0x11497fd0,
                                                  ^^^^^^^^^^^^^^
                                             pointer to the CPU object
623         trace_object_dynamic_cast_assert(obj ? obj->class->type->name
(gdb) p obj->class->type
$1 = (Type) 0x0
(gdb) p * obj
$2 = {class = 0x10ea9c10, free = 0x11244620,
                                 ^^^^^^^^^^
                              should be g_free
(gdb) p g_free
$3 = {<text variable, no debug info>} 0x7ffff282bef0 <g_free>

obj is a dangling pointer to the CPU that was just destroyed in
spapr_cpu_core_realize().

This patch adds proper rollback to both spapr_realize_vcpu() and
spapr_cpu_core_realize().

Signed-off-by: Greg Kurz <groug@kaod.org>
[dwg: Fixed a conflict due to a change in my tree]
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
5 years agospapr_cpu_core: fix potential leak in spapr_cpu_core_realize()
Greg Kurz [Thu, 14 Jun 2018 21:50:27 +0000 (23:50 +0200)]
spapr_cpu_core: fix potential leak in spapr_cpu_core_realize()

Commit 94ad93bd97684 (QEMU 2.12) switched to instantiate CPUs separately
but it missed to adapt the error path accordingly. If something fails in
the CPU creation loop, then the CPU object that was just created is leaked.

The error paths in this function are a bit obfuscated, and adding
yet another label to free this CPU object makes it worse. We should
move the block of the loop to a separate function, with a proper
rollback path, but this is a bigger cleanup.

For now, let's just fix the bug by adding the missing calls to
object_unref(). This will allow easier backport to older QEMU
versions.

Signed-off-by: Greg Kurz <groug@kaod.org>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
5 years agospapr_cpu_core: convert last snprintf() to g_strdup_printf()
Greg Kurz [Thu, 14 Jun 2018 21:50:11 +0000 (23:50 +0200)]
spapr_cpu_core: convert last snprintf() to g_strdup_printf()

Because this is the preferred practice in QEMU.

Signed-off-by: Greg Kurz <groug@kaod.org>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
5 years agopnv: Add cpu unrealize path
David Gibson [Wed, 13 Jun 2018 02:08:42 +0000 (12:08 +1000)]
pnv: Add cpu unrealize path

Currently we don't have any unrealize path for pnv cpu cores.  We get away
with this because we don't yet support cpu hotplug for pnv.

However, we're going to want it eventually, and in the meantime, it makes
it non-obvious why there are a bunch of allocations on the realize() path
that don't have matching frees.

So, implement the missing unrealize path.

Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: Greg Kurz <groug@kaod.org>
5 years agopnv: Clean up cpu realize path
David Gibson [Wed, 13 Jun 2018 03:34:36 +0000 (13:34 +1000)]
pnv: Clean up cpu realize path

pnv_cpu_init() is only called from the the pnv cpu core realize path, and
really only can be called from there.  So fold it into its caller, which
we also rename for brevity.

Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: Greg Kurz <groug@kaod.org>
5 years agopnv_core: Allocate cpu thread objects individually
David Gibson [Wed, 13 Jun 2018 01:57:37 +0000 (11:57 +1000)]
pnv_core: Allocate cpu thread objects individually

Currently, we allocate space for all the cpu objects within a single core
in one big block.  This was copied from an older version of the spapr code
and requires some ugly pointer manipulation to extract the individual
objects.

This design was due to a misunderstanding of qemu lifetime conventions and
has already been changed in spapr (in 94ad93bd "spapr_cpu_core: instantiate
CPUs separately".

Make an equivalent change in pnv_core to get rid of the nasty pointer
arithmetic.

Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: Greg Kurz <groug@kaod.org>
5 years agopnv: Fix some error handling cpu realize()
David Gibson [Wed, 13 Jun 2018 01:55:31 +0000 (11:55 +1000)]
pnv: Fix some error handling cpu realize()

In pnv_core_realize() we call two functions with an Error * parameter in
succession, which will go badly if they both cause errors.  In fact, a
failure in either of them indicates a qemu internal error, so we can just
use &error_abort in both cases.

Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: Greg Kurz <groug@kaod.org>
5 years agospapr: Clean up cpu realize/unrealize paths
David Gibson [Wed, 13 Jun 2018 01:48:26 +0000 (11:48 +1000)]
spapr: Clean up cpu realize/unrealize paths

spapr_cpu_init() and spapr_cpu_destroy() are only called from the spapr
cpu core realize/unrealize paths, and really can only be called from there.

Those are all short functions, so fold the pairs together for simplicity.
While we're there rename some functions and change some parameter types
for brevity and clarity.

Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: Greg Kurz <groug@kaod.org>
5 years agosm501: Do not clear read only bits when writing registers
BALATON Zoltan [Thu, 14 Jun 2018 00:17:00 +0000 (02:17 +0200)]
sm501: Do not clear read only bits when writing registers

When writing registers that have read only bits we have to avoid
changing these bits as they may have non zero values. Make sure we use
the correct masks to mask out read only and reserved bits when
changing registers.

Also remove extra spaces from dram_control and arbitration_control
assignments.

Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
5 years agomos6522: expose mos6522_update_irq() through MOS6522DeviceClass
Mark Cave-Ayland [Wed, 13 Jun 2018 08:30:15 +0000 (09:30 +0100)]
mos6522: expose mos6522_update_irq() through MOS6522DeviceClass

In the case where we have an interrupt generated externally from inputs to
bits 1 and 2 of port A and/or port B, it is necessary to expose
mos6522_update_irq() so it can be called by the interrupt source.

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
5 years agomos6522: remove additional interrupt flag filter from mos6522_update_irq()
Mark Cave-Ayland [Wed, 13 Jun 2018 08:30:14 +0000 (09:30 +0100)]
mos6522: remove additional interrupt flag filter from mos6522_update_irq()

The datasheet indicates that the interrupt is generated by ANDing the
interrupt flags register (IFR) with the interrupt enable register (IER)
but currently there is an extra filter for the SR and timer interrupts.

Remove this extra filter to allow interrupts to be generated by external
inputs on bits 1 and 2 of ports A and B.

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
5 years agomos6522: only clear the shift register interrupt upon write
Mark Cave-Ayland [Wed, 13 Jun 2018 08:30:13 +0000 (09:30 +0100)]
mos6522: only clear the shift register interrupt upon write

According to the 6522 datasheet the shift register (SR) interrupt flag is
cleared upon write with no mention of any other interrupt flags.

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
5 years agoxics_kvm: fix a build break
Cédric Le Goater [Tue, 12 Jun 2018 10:11:35 +0000 (12:11 +0200)]
xics_kvm: fix a build break

On CentOS 7.5, gcc-4.8.5-28.el7_5.1.ppc64le fails to build QEMU due to :

  hw/intc/xics_kvm.c: In function ‘ics_set_kvm_state’:
  hw/intc/xics_kvm.c:281:13: error: ‘ret’ may be used uninitialized in this
    function [-Werror=maybe-uninitialized]
             return ret;

Fix the breakage and also remove the extra error reporting as
kvm_device_access() already provides a substantial error message.

Signed-off-by: Cédric Le Goater <clg@kaod.org>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
5 years agomac_newworld: add PMU device
Mark Cave-Ayland [Tue, 12 Jun 2018 16:44:02 +0000 (17:44 +0100)]
mac_newworld: add PMU device

The PMU device supercedes the CUDA device found on older New World Macs and
is supported by a larger number of guest OSs from OS 9 to OS X 10.5.

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
5 years agoadb: add property to disable direct reg 3 writes
Mark Cave-Ayland [Tue, 12 Jun 2018 16:44:01 +0000 (17:44 +0100)]
adb: add property to disable direct reg 3 writes

MacOS 9 has a bug in its PMU driver whereby after configuring the ADB bus
devices it sends another write to reg 3 on both devices resetting them
both back to the same address.

Add a new disable_direct_reg3_writes property to ADBDevice to disable these
direct writes which can enabled just for the upcoming pmu-adb support.

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>