]> git.proxmox.com Git - mirror_qemu.git/log
mirror_qemu.git
8 years agoseccomp: adding sysinfo system call to whitelist
Miroslav Rezanina [Mon, 7 Mar 2016 09:34:46 +0000 (10:34 +0100)]
seccomp: adding sysinfo system call to whitelist

Newer version of nss-softokn libraries (> 3.16.2.3) use sysinfo call
so qemu using rbd image hang after start when run in sandbox mode.

To allow using rbd images in sandbox mode we have to whitelist it.

Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
Acked-by: Eduardo Otubo <eduardo.otubo@profitbricks.com>
8 years agoseccomp: Whitelist cacheflush since 2.2.0 not 2.2.3
James Hogan [Fri, 8 Apr 2016 13:16:33 +0000 (14:16 +0100)]
seccomp: Whitelist cacheflush since 2.2.0 not 2.2.3

The cacheflush system call (found on MIPS and ARM) has been included in
the libseccomp header since 2.2.0, so include it back to that version.
Previously it was only enabled since 2.2.3 since that is when it was
enabled properly for ARM.

This will allow seccomp support to be enabled for MIPS back to
libseccomp 2.2.0.

Signed-off-by: James Hogan <james.hogan@imgtec.com>
Reviewed-By: Andrew Jones <drjones@redhat.com>
Acked-by: Eduardo Otubo <eduardo.otubo@profitbricks.com>
8 years agoconfigure: Enable seccomp sandbox for MIPS
James Hogan [Fri, 8 Apr 2016 13:16:34 +0000 (14:16 +0100)]
configure: Enable seccomp sandbox for MIPS

Enable seccomp on MIPS since libseccomp version 2.2.0 when MIPS support
was first added.

Signed-off-by: James Hogan <james.hogan@imgtec.com>
Reviewed-by: Andrew Jones <drjones@redhat.com>
Acked-by: Eduardo Otubo <eduardo.otubo@profitbricks.com>
8 years agoMerge remote-tracking branch 'remotes/armbru/tags/pull-backends-2016-04-15' into...
Peter Maydell [Fri, 15 Apr 2016 16:43:34 +0000 (17:43 +0100)]
Merge remote-tracking branch 'remotes/armbru/tags/pull-backends-2016-04-15' into staging

hostmem-file: plug a small leak

# gpg: Signature made Fri 15 Apr 2016 17:30:42 BST using RSA key ID EB918653
# gpg: Good signature from "Markus Armbruster <armbru@redhat.com>"
# gpg:                 aka "Markus Armbruster <armbru@pond.sub.org>"

* remotes/armbru/tags/pull-backends-2016-04-15:
  hostmem-file: plug a small leak

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
8 years agohostmem-file: plug a small leak
Marc-André Lureau [Wed, 13 Apr 2016 16:57:40 +0000 (18:57 +0200)]
hostmem-file: plug a small leak

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-Id: <1460566660-19241-1-git-send-email-marcandre.lureau@redhat.com>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
8 years agoMerge remote-tracking branch 'remotes/mcayland/tags/qemu-sparc-signed' into staging
Peter Maydell [Fri, 15 Apr 2016 09:49:04 +0000 (10:49 +0100)]
Merge remote-tracking branch 'remotes/mcayland/tags/qemu-sparc-signed' into staging

qemu-sparc update

# gpg: Signature made Fri 15 Apr 2016 09:30:58 BST using RSA key ID AE0F321F
# gpg: Good signature from "Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>"

* remotes/mcayland/tags/qemu-sparc-signed:
  target-sparc: fix Trap Based Address Register behavior for sparc64
  target-sparc: fix Nucleus quad LDD 128 bit access for windowed registers

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
8 years agotarget-sparc: fix Trap Based Address Register behavior for sparc64
Artyom Tarasenko [Thu, 14 Apr 2016 19:14:32 +0000 (21:14 +0200)]
target-sparc: fix Trap Based Address Register behavior for sparc64

Accoding the chapter 7.6 Trap Processing of the SPARC Architecture Manual v9,
the Trap Based Address Register is not modified as a trap is taken.

This fix allows booting FreeBSD-10.3-RELEASE-sparc64.

Signed-off-by: Artyom Tarasenko <atar4qemu@gmail.com>
Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
8 years agotarget-sparc: fix Nucleus quad LDD 128 bit access for windowed registers
Artyom Tarasenko [Thu, 14 Apr 2016 19:14:31 +0000 (21:14 +0200)]
target-sparc: fix Nucleus quad LDD 128 bit access for windowed registers

Fix register offset calculation when regwptr is used.

Signed-off-by: Artyom Tarasenko <atar4qemu@gmail.com>
Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
8 years agoUpdate version for v2.6.0-rc2 release
Peter Maydell [Thu, 14 Apr 2016 16:30:28 +0000 (17:30 +0100)]
Update version for v2.6.0-rc2 release

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
8 years agoMerge remote-tracking branch 'remotes/mst/tags/for_upstream' into staging
Peter Maydell [Thu, 14 Apr 2016 13:55:24 +0000 (14:55 +0100)]
Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into staging

tpm, vhost, virtio: fixes for 2.6

Minor fixes all over the place.

Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
# gpg: Signature made Thu 14 Apr 2016 14:45:55 BST using RSA key ID D28D5469
# gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>"
# gpg:                 aka "Michael S. Tsirkin <mst@redhat.com>"

* remotes/mst/tags/for_upstream:
  hw/virtio/balloon: Replace TARGET_PAGE_SIZE with BALLOON_PAGE_SIZE
  tpm: Fix write to file descriptor function
  tpm: acpi: remove IRQ from TPM's CRS to make Windows not see conflict
  pc: acpi: tpm: add missing MMIO resource to PCI0._CRS
  specs/vhost-user: spelling fix
  specs/vhost-user: improve VHOST_SET_VRING_NUM documentation

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
8 years agohw/virtio/balloon: Replace TARGET_PAGE_SIZE with BALLOON_PAGE_SIZE
Thomas Huth [Thu, 14 Apr 2016 08:50:07 +0000 (10:50 +0200)]
hw/virtio/balloon: Replace TARGET_PAGE_SIZE with BALLOON_PAGE_SIZE

The balloon code currently calls madvise() with TARGET_PAGE_SIZE as
length parameter. Since the virtio-balloon protocol is always based
on 4k pages, no matter what the host and guest are using as page size,
this could cause problems: If TARGET_PAGE_SIZE is bigger than 4k, the
madvise call also destroys the 4k areas after the current one - which
might be wrong since the guest did not want free that area yet (in
case the guest used as smaller MMU page size than the hard-coded
TARGET_PAGE_SIZE). So to fix this issue, introduce a proper define
called BALLOON_PAGE_SIZE (which is 4096) to use this as the size
parameter for the madvise() call instead.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
8 years agoMerge remote-tracking branch 'remotes/kraxel/tags/pull-input-20160413-1' into staging
Peter Maydell [Wed, 13 Apr 2016 19:35:23 +0000 (20:35 +0100)]
Merge remote-tracking branch 'remotes/kraxel/tags/pull-input-20160413-1' into staging

virtio-input; live migration support, various bugfixes.

# gpg: Signature made Wed 13 Apr 2016 16:41:27 BST using RSA key ID D3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
# gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
# gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

* remotes/kraxel/tags/pull-input-20160413-1:
  virtio-input: support absolute axis config in pass-through
  input-linux: refine mouse detection
  virtio-input: fix emulated tablet axis ranges
  virtio-input: add live migration support
  virtio-input: implement pass-through evdev writes
  virtio-input: retrieve EV_LED host config bits
  virtio-input: add missing key mappings
  move const_le{16, 23} to qemu/bswap.h, add comment
  virtio-input: add parenthesis to const_le{16, 32}

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
8 years agoMerge remote-tracking branch 'remotes/elmarco/tags/ivshmem-fix-pull-request' into...
Peter Maydell [Wed, 13 Apr 2016 17:48:28 +0000 (18:48 +0100)]
Merge remote-tracking branch 'remotes/elmarco/tags/ivshmem-fix-pull-request' into staging

# gpg: Signature made Wed 13 Apr 2016 11:04:51 BST using RSA key ID 75969CE5
# gpg: Good signature from "Marc-André Lureau <marcandre.lureau@redhat.com>"
# gpg:                 aka "Marc-André Lureau <marcandre.lureau@gmail.com>"
# gpg: WARNING: This key is not certified with sufficiently trusted signatures!
# gpg:          It is not certain that the signature belongs to the owner.
# Primary key fingerprint: 87A9 BD93 3F87 C606 D276  F62D DAE8 E109 7596 9CE5

* remotes/elmarco/tags/ivshmem-fix-pull-request:
  ivshmem: fix ivshmem-{plain,doorbell} crash without arg

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
8 years agotpm: Fix write to file descriptor function
Stefan Berger [Wed, 6 Apr 2016 00:21:50 +0000 (20:21 -0400)]
tpm: Fix write to file descriptor function

Fix a bug introduced in commit 46f296c while moving send_all to the
tpm_passthrough code. Fix the name of the variable used in the loop.

Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
8 years agotpm: acpi: remove IRQ from TPM's CRS to make Windows not see conflict
Igor Mammedov [Fri, 8 Apr 2016 11:23:14 +0000 (13:23 +0200)]
tpm: acpi: remove IRQ from TPM's CRS to make Windows not see conflict

IRQ 5 used by TPM conflicts with PNP0C0F IRQs,
as result Windows fails driver initialization with reason
  'device cannot find enough free resources'
But if TPM._CRS.IRQ entry is commented out, Windows
seems to initialize driver without errors as it doesn't
notice possible conflict and it seems to work
probably due to a link with IRQ 5 being unused/disabled.

So temporary comment out TPM._CRS.IRQ to 'fix'
regression in TPM, with intent to fix it correctly
later i.e.:
  1. pick unused IRQ as default one for TPM
  2. fetch IRQ value from device model so that user
     could override default one if it conflicts with
     some other device.

Signed-off-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
8 years agopc: acpi: tpm: add missing MMIO resource to PCI0._CRS
Igor Mammedov [Fri, 8 Apr 2016 11:23:13 +0000 (13:23 +0200)]
pc: acpi: tpm: add missing MMIO resource to PCI0._CRS

Windows will fail initialize TMP driver with the reason:
  'device cannot find enough free resources'
That happens because parent BUS doesn't describe
MMIO resources used by TPM child device.
Fix it by describing it in top-most parent bus scope PCI0.

It was 'regressed' by commit
  5cb18b3d TPM2 ACPI table support
with following fixup
  9e472263 acpi: add missing ssdt
which did the right thing by moving TPM to BUS
it belongs to but lacked a proper resource declaration.

Signed-off-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
8 years agospecs/vhost-user: spelling fix
Marc-André Lureau [Sat, 9 Apr 2016 13:50:36 +0000 (15:50 +0200)]
specs/vhost-user: spelling fix

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
8 years agospecs/vhost-user: improve VHOST_SET_VRING_NUM documentation
Marc-André Lureau [Sat, 9 Apr 2016 13:50:35 +0000 (15:50 +0200)]
specs/vhost-user: improve VHOST_SET_VRING_NUM documentation

"number of vrings" doesn't help me understand the purpose of this
message. My understanding is that it is rather the size of the queue (in
modern terms).

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
8 years agoMerge remote-tracking branch 'remotes/jnsnow/tags/ide-pull-request' into staging
Peter Maydell [Wed, 13 Apr 2016 15:32:28 +0000 (16:32 +0100)]
Merge remote-tracking branch 'remotes/jnsnow/tags/ide-pull-request' into staging

# gpg: Signature made Wed 13 Apr 2016 00:32:22 BST using RSA key ID AAFC390E
# gpg: Good signature from "John Snow (John Huston) <jsnow@redhat.com>"

* remotes/jnsnow/tags/ide-pull-request:
  ide: really restart pending and in-flight atapi dma
  ide: restart atapi dma by re-evaluating command packet
  ide: don't lose pending dma state
  xen: Fix IDE unplug

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
8 years agovirtio-input: support absolute axis config in pass-through
Ladi Prosek [Wed, 13 Apr 2016 14:43:23 +0000 (16:43 +0200)]
virtio-input: support absolute axis config in pass-through

VIRTIO_INPUT_CFG_ABS_INFO was not implemented for pass-through input
devices. This patch follows the existing design and pre-fetches the
config for all absolute axes using EVIOCGABS at realize time.

Signed-off-by: Ladi Prosek <lprosek@redhat.com>
Message-id: 1460558603-18331-1-git-send-email-lprosek@redhat.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
8 years agoinput-linux: refine mouse detection
Gerd Hoffmann [Tue, 12 Apr 2016 09:21:43 +0000 (11:21 +0200)]
input-linux: refine mouse detection

Read absolute and relative axis information, only classify
devices as mouse/tablet in case the x axis is present.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
8 years agovirtio-input: fix emulated tablet axis ranges
Ladi Prosek [Fri, 8 Apr 2016 15:21:33 +0000 (17:21 +0200)]
virtio-input: fix emulated tablet axis ranges

The reported maximum was wrong. The X and Y coordinates are 0-based
so if size is 8000 maximum must be 7FFF.

Signed-off-by: Ladi Prosek <lprosek@redhat.com>
Message-id: 1460128893-10244-1-git-send-email-lprosek@redhat.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
8 years agovirtio-input: add live migration support
Gerd Hoffmann [Tue, 5 Apr 2016 12:31:41 +0000 (14:31 +0200)]
virtio-input: add live migration support

virtio-input is simple enough that it doesn't need to xfer any state.
Still we have to wire up savevm manually, so the generic pci and virtio
are saved correctly.

Additionally we need to do some post-load processing to figure whenever
the guest uses the device or not, so we can give input routing hints to
the qemu input layer using qemu_input_handler_{activate,deactivate}.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Message-id: 1459859501-16965-1-git-send-email-kraxel@redhat.com

8 years agovirtio-input: implement pass-through evdev writes
Ladi Prosek [Fri, 1 Apr 2016 11:45:46 +0000 (13:45 +0200)]
virtio-input: implement pass-through evdev writes

The write path for pass-through devices, commonly used for controlling
keyboard LEDs via EV_LED, was not implemented. This commit adds the
necessary plumbing to connect the status virtio queue to the host evdev
file descriptor.

Signed-off-by: Ladi Prosek <lprosek@redhat.com>
Message-id: 1459511146-12060-1-git-send-email-lprosek@redhat.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
8 years agovirtio-input: retrieve EV_LED host config bits
Ladi Prosek [Thu, 31 Mar 2016 09:53:48 +0000 (11:53 +0200)]
virtio-input: retrieve EV_LED host config bits

VIRTIO_INPUT_CFG_EV_BITS with subsel of EV_LED was always
returning an empty bitmap for pass-through input devices.

Signed-off-by: Ladi Prosek <lprosek@redhat.com>
Message-id: 1459418028-7473-1-git-send-email-lprosek@redhat.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
8 years agovirtio-input: add missing key mappings
Ladi Prosek [Wed, 30 Mar 2016 13:07:20 +0000 (15:07 +0200)]
virtio-input: add missing key mappings

KEY_PAUSE is flat out missing. KEY_SYSRQ already has a keycode
assigned but it's not what I'm seeing on my system. The mapping
doesn't appear to have to be unique so both keycodes now map to
KEY_SYSRQ which is what the "Keyboard PrintScreen", HID usage ID
0x46, translates to.

Signed-off-by: Ladi Prosek <lprosek@redhat.com>
Message-id: 1459343240-19483-1-git-send-email-lprosek@redhat.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
8 years agomove const_le{16, 23} to qemu/bswap.h, add comment
Gerd Hoffmann [Tue, 12 Apr 2016 06:07:19 +0000 (08:07 +0200)]
move const_le{16, 23} to qemu/bswap.h, add comment

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Message-id: 1460441239-867-1-git-send-email-kraxel@redhat.com

8 years agovirtio-input: add parenthesis to const_le{16, 32}
Gerd Hoffmann [Tue, 12 Apr 2016 05:51:39 +0000 (07:51 +0200)]
virtio-input: add parenthesis to const_le{16, 32}

"_x" must be "(_x)" otherwise things fail if you pass in expressions.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Message-id: 1460440299-26654-1-git-send-email-kraxel@redhat.com

8 years agoivshmem: fix ivshmem-{plain,doorbell} crash without arg
Marc-André Lureau [Tue, 12 Apr 2016 13:33:10 +0000 (15:33 +0200)]
ivshmem: fix ivshmem-{plain,doorbell} crash without arg

"qemu -device ivshmem-{plain,doorbell}" will crash, because the device
doesn't check that the required argument is provided. (screwed up in
commit 5400c02)

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
8 years agoide: really restart pending and in-flight atapi dma
Pavel Butsykin [Tue, 12 Apr 2016 22:48:15 +0000 (18:48 -0400)]
ide: really restart pending and in-flight atapi dma

Restart of ATAPI DMA used to be unreachable, because the request to do
so wasn't indicated in bus->error_status due to the lack of spare bits, and
ide_restart_bh() would return early doing nothing.

This patch makes use of the observation that not all bit combinations were
possible in ->error_status. In particular, IDE_RETRY_READ only made sense
together with IDE_RETRY_DMA or IDE_RETRY_PIO. This allows to re-use
IDE_RETRY_READ alone as an indicator of ATAPI DMA restart request.

To makes things more uniform, ATAPI DMA gets its own value for ->dma_cmd.
As a means against confusion, macros are added to test the state of
->error_status.

The patch fixes the restart of both in-flight and pending ATAPI DMA,
following the scheme similar to that of IDE DMA.

[Including a fixup patch:
Message-id: 1460465594-15777-1-git-send-email-pbutsykin@virtuozzo.com
--js]

Signed-off-by: Pavel Butsykin <pbutsykin@virtuozzo.com>
Signed-off-by: Denis V. Lunev <den@openvz.org>
Reviewed-by: Roman Kagan <rkagan@virtuozzo.com>
Reviewed-by: John Snow <jsnow@redhat.com>
Message-id: 1459924806-306-4-git-send-email-den@openvz.org
Signed-off-by: John Snow <jsnow@redhat.com>
8 years agoide: restart atapi dma by re-evaluating command packet
Pavel Butsykin [Tue, 12 Apr 2016 20:47:52 +0000 (16:47 -0400)]
ide: restart atapi dma by re-evaluating command packet

ide_atapi_dma_restart() used to just complete the DMA with an error,
under the assumption that there isn't enough information to restart it.

However, as the contents of the ->io_buffer is preserved, it looks safe to
just re-evaluate it and dispatch the ATAPI command again.

Signed-off-by: Pavel Butsykin <pbutsykin@virtuozzo.com>
Reviewed-by: Roman Kagan <rkagan@virtuozzo.com>
Signed-off-by: Denis V. Lunev <den@openvz.org>
Reviewed-by: John Snow <jsnow@redhat.com>
Message-id: 1459924806-306-3-git-send-email-den@openvz.org
Signed-off-by: John Snow <jsnow@redhat.com>
8 years agoide: don't lose pending dma state
Pavel Butsykin [Tue, 12 Apr 2016 20:47:52 +0000 (16:47 -0400)]
ide: don't lose pending dma state

If the migration occurs after the IDE DMA has been set up but before it
has been initiated, the state gets lost upon save/restore. Specifically,
->dma_cb callback gets cleared, so, when the guest eventually starts bus
mastering, the DMA never completes, causing the guest to time out the
operation.

OTOH all the infrastructure is already in place to restart the DMA if
the migration happens while the DMA is in progress.

So reuse that infrastructure, by setting bus->error_status based on
->dma_cmd in pre_save if ->dma_cb callback is already set but DMAING is
clear. This will indicate the need for restart and make sure ->dma_cb
is restored in ide_restart_bh(); howeover since DMAING is clear the state
upon restore will be exactly "ready for DMA" as before the save.

Signed-off-by: Pavel Butsykin <pbutsykin@virtuozzo.com>
Reviewed-by: Roman Kagan <rkagan@virtuozzo.com>
Signed-off-by: Denis V. Lunev <den@openvz.org>
Reviewed-by: John Snow <jsnow@redhat.com>
Message-id: 1459924806-306-2-git-send-email-den@openvz.org
Signed-off-by: John Snow <jsnow@redhat.com>
8 years agoxen: Fix IDE unplug
Anthony PERARD [Tue, 12 Apr 2016 20:47:52 +0000 (16:47 -0400)]
xen: Fix IDE unplug

After commit e5e7855 (blockdev: Separate BB name management), starting a
guest with PVHVM support result in this assert:
qemu-system-i386: block/block-backend.c:173: blk_delete: Assertion `!blk->name' failed.

A backtrace show that a caller is pci_piix3_xen_ide_unplug().

This patch fix it.

Signed-off-by: Anthony PERARD <anthony.perard@citrix.com>
Message-id: 1460382666-29885-1-git-send-email-anthony.perard@citrix.com
Signed-off-by: John Snow <jsnow@redhat.com>
8 years agoMerge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging
Peter Maydell [Tue, 12 Apr 2016 16:47:15 +0000 (17:47 +0100)]
Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging

Block layer patches for 2.6

# gpg: Signature made Tue 12 Apr 2016 17:10:29 BST using RSA key ID C88F2FD6
# gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>"

* remotes/kevin/tags/for-upstream:
  qemu-iotests: iotests.py: get rid of __all__
  qemu-iotests: 068: don't require KVM
  qemu-iotests: 148: properly skip test if quorum support is missing
  qemu-iotests: iotests.VM: remove qtest socket on error
  qemu-iotests: fix 051 on non-PC architectures
  qemu-iotests: check: don't place files with predictable names in /tmp
  MAINTAINERS: Block layer core, qcow2 and blkdebug
  qcow2: Prevent backing file names longer than 1023
  vpc: fix return value check for blk_pwrite
  iotests: Make 150 use qemu-img map instead of du
  block: initialize qcrypto API at startup
  qemu-img: fix formatting of error message
  iotests: fix the broken 026.nocache output

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
8 years agoMerge remote-tracking branch 'mreitz/tags/pull-block-for-kevin-2016-04-12' into queue...
Kevin Wolf [Tue, 12 Apr 2016 16:09:16 +0000 (18:09 +0200)]
Merge remote-tracking branch 'mreitz/tags/pull-block-for-kevin-2016-04-12' into queue-block

Block patches for 2.6-rc2.

# gpg: Signature made Tue Apr 12 18:08:20 2016 CEST using RSA key ID E838ACAD
# gpg: Good signature from "Max Reitz <mreitz@redhat.com>"

* mreitz/tags/pull-block-for-kevin-2016-04-12:
  qemu-iotests: iotests.py: get rid of __all__
  qemu-iotests: 068: don't require KVM
  qemu-iotests: 148: properly skip test if quorum support is missing
  qemu-iotests: iotests.VM: remove qtest socket on error
  qemu-iotests: fix 051 on non-PC architectures
  qemu-iotests: check: don't place files with predictable names in /tmp

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
8 years agoqemu-iotests: iotests.py: get rid of __all__
Sascha Silbe [Tue, 5 Apr 2016 09:21:49 +0000 (11:21 +0200)]
qemu-iotests: iotests.py: get rid of __all__

The __all__ list contained a typo for as long as the iotests module
existed. That typo prevented "from iotests import *" (which is the
only case where iotests.__all__ is used at all) from ever working.

The names used by iotests are highly prone to name collisions, so
importing them all unconditionally is a bad idea anyway. Since __all__
is not adding any value, let's just get rid of it.

Fixes: f345cfd0 ("qemu-iotests: add iotests Python module")
Signed-off-by: Sascha Silbe <silbe@linux.vnet.ibm.com>
Reviewed-by: Bo Tu <tubo@linux.vnet.ibm.com>
Message-id: 1459848109-29756-8-git-send-email-silbe@linux.vnet.ibm.com
Reviewed-by: Max Reitz <mreitz@redhat.com>
Signed-off-by: Max Reitz <mreitz@redhat.com>
8 years agoqemu-iotests: 068: don't require KVM
Sascha Silbe [Tue, 5 Apr 2016 09:21:47 +0000 (11:21 +0200)]
qemu-iotests: 068: don't require KVM

None of the other test cases explicitly enable KVM and there's no
obvious reason for 068 to require it. Drop this so all test cases can be
executed in environments where KVM is not available (e.g. because the
user doesn't have sufficient permissions to access /dev/kvm).

Signed-off-by: Sascha Silbe <silbe@linux.vnet.ibm.com>
Reviewed-by: Bo Tu <tubo@linux.vnet.ibm.com>
Message-id: 1459848109-29756-6-git-send-email-silbe@linux.vnet.ibm.com
Signed-off-by: Max Reitz <mreitz@redhat.com>
8 years agoqemu-iotests: 148: properly skip test if quorum support is missing
Sascha Silbe [Tue, 5 Apr 2016 09:21:46 +0000 (11:21 +0200)]
qemu-iotests: 148: properly skip test if quorum support is missing

qemu-iotests test case 148 already had some code for skipping the test
if quorum support is missing, but it didn't work in all
cases. TestQuorumEvents.setUp() gets run before the actual test class
(which contains the skipping code) and tries to start qemu with a drive
using the quorum driver. For some reason this works fine when using
qcow2, but fails for raw.

As the entire test case requires quorum, just check for availability
before even starting the test suite. Introduce a verify_quorum()
function in iotests.py for this purpose so future test cases can make
use of it.

Signed-off-by: Sascha Silbe <silbe@linux.vnet.ibm.com>
Reviewed-by: Bo Tu <tubo@linux.vnet.ibm.com>
Message-id: 1459848109-29756-5-git-send-email-silbe@linux.vnet.ibm.com
Reviewed-by: Max Reitz <mreitz@redhat.com>
Signed-off-by: Max Reitz <mreitz@redhat.com>
8 years agoqemu-iotests: iotests.VM: remove qtest socket on error
Sascha Silbe [Tue, 5 Apr 2016 09:21:45 +0000 (11:21 +0200)]
qemu-iotests: iotests.VM: remove qtest socket on error

On error, VM.launch() cleaned up the monitor unix socket, but left the
qtest unix socket behind. This caused the remaining sub-tests to fail
with EADDRINUSE:

+======================================================================
+ERROR: testQuorum (__main__.TestFifoQuorumEvents)
+----------------------------------------------------------------------
+Traceback (most recent call last):
+  File "148", line 63, in setUp
+    self.vm.launch()
+  File "/home6/silbe/qemu/tests/qemu-iotests/iotests.py", line 247, in launch
+    self._qmp.accept()
+  File "/home6/silbe/qemu/tests/qemu-iotests/../../scripts/qmp/qmp.py", line 141, in accept
+    return self.__negotiate_capabilities()
+  File "/home6/silbe/qemu/tests/qemu-iotests/../../scripts/qmp/qmp.py", line 57, in __negotiate_capabilities
+    raise QMPConnectError
+QMPConnectError
+
+======================================================================
+ERROR: testQuorum (__main__.TestQuorumEvents)
+----------------------------------------------------------------------
+Traceback (most recent call last):
+  File "148", line 63, in setUp
+    self.vm.launch()
+  File "/home6/silbe/qemu/tests/qemu-iotests/iotests.py", line 244, in launch
+    self._qtest = qtest.QEMUQtestProtocol(self._qtest_path, server=True)
+  File "/home6/silbe/qemu/tests/qemu-iotests/../../scripts/qtest.py", line 33, in __init__
+    self._sock.bind(self._address)
+  File "/usr/lib64/python2.7/socket.py", line 224, in meth
+    return getattr(self._sock,name)(*args)
+error: [Errno 98] Address already in use

Fix this by cleaning up both the monitor socket and the qtest socket iff
they exist.

Signed-off-by: Sascha Silbe <silbe@linux.vnet.ibm.com>
Reviewed-by: Bo Tu <tubo@linux.vnet.ibm.com>
Message-id: 1459848109-29756-4-git-send-email-silbe@linux.vnet.ibm.com
Reviewed-by: Max Reitz <mreitz@redhat.com>
Signed-off-by: Max Reitz <mreitz@redhat.com>
8 years agoqemu-iotests: fix 051 on non-PC architectures
Sascha Silbe [Tue, 5 Apr 2016 09:21:44 +0000 (11:21 +0200)]
qemu-iotests: fix 051 on non-PC architectures

Commit 61de4c68 [block: Remove BDRV_O_CACHE_WB] updated the reference
output for PCs, but neglected to do the same for the generic reference
output file. Fix 051 on all non-PC architectures by applying the same
change to the generic output file.

Fixes: 61de4c68 ("block: Remove BDRV_O_CACHE_WB")
Signed-off-by: Sascha Silbe <silbe@linux.vnet.ibm.com>
Reviewed-by: Bo Tu <tubo@linux.vnet.ibm.com>
Message-id: 1459848109-29756-3-git-send-email-silbe@linux.vnet.ibm.com
Reviewed-by: Max Reitz <mreitz@redhat.com>
Signed-off-by: Max Reitz <mreitz@redhat.com>
8 years agoqemu-iotests: check: don't place files with predictable names in /tmp
Sascha Silbe [Tue, 5 Apr 2016 09:21:43 +0000 (11:21 +0200)]
qemu-iotests: check: don't place files with predictable names in /tmp

Placing files with predictable or even hard-coded names in /tmp is a
security risk and can prevent or disturb operation on a multi-user
machine. Place them inside the "scratch" directory instead, as we
already do for most other test-related files.

Signed-off-by: Sascha Silbe <silbe@linux.vnet.ibm.com>
Reviewed-by: Bo Tu <tubo@linux.vnet.ibm.com>
Message-id: 1459848109-29756-2-git-send-email-silbe@linux.vnet.ibm.com
Reviewed-by: Max Reitz <mreitz@redhat.com>
Signed-off-by: Max Reitz <mreitz@redhat.com>
8 years agoMAINTAINERS: Block layer core, qcow2 and blkdebug
Max Reitz [Fri, 8 Apr 2016 17:29:01 +0000 (19:29 +0200)]
MAINTAINERS: Block layer core, qcow2 and blkdebug

As agreed with Kevin and already practiced for a while, I am adding
myself as co-maintainer of the block layer core, qcow2 and blkdebug.

Signed-off-by: Max Reitz <mreitz@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
8 years agoqcow2: Prevent backing file names longer than 1023
Max Reitz [Wed, 6 Apr 2016 16:32:48 +0000 (18:32 +0200)]
qcow2: Prevent backing file names longer than 1023

We reject backing file names with a length of more than 1023 characters
when opening a qcow2 file, so we should not produce such files
ourselves.

Cc: qemu-stable@nongnu.org
Signed-off-by: Max Reitz <mreitz@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
8 years agovpc: fix return value check for blk_pwrite
Paolo Bonzini [Thu, 7 Apr 2016 14:52:34 +0000 (16:52 +0200)]
vpc: fix return value check for blk_pwrite

bdrv_pwrite_sync used to return zero or negative error, while blk_pwrite returns
the number of written bytes when successful.  This caused VPC image creation
to fail spectacularly: it wrote the first 512 bytes, and then exited immediately
because of the non-zero answer from blk_pwrite.  But the truly spectacular part
is that it returns a positive value (the 512 that blk_pwrite returned) causing
everyone to believe that it succeeded.

This fixes qemu-iotests with vpc format.

Fixes: b8f45cdf7827e39f9a1e6cc446f5972cc6144237
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
8 years agoiotests: Make 150 use qemu-img map instead of du
Max Reitz [Tue, 29 Mar 2016 16:24:17 +0000 (18:24 +0200)]
iotests: Make 150 use qemu-img map instead of du

The actual on-disk size of a file does not only depend on factors qemu
can control. Thus, we should not depend on this to determine whether a
file has indeed been fully allocated. Instead, use qemu-img map and hope
that if an area is referenced, it is indeed allocated, too.

Also, limit the supported image formats to raw and qcow2 because the
actual qemu-img map output may depend on the image format.

Signed-off-by: Max Reitz <mreitz@redhat.com>
Tested-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
8 years agoblock: initialize qcrypto API at startup
Daniel P. Berrange [Wed, 6 Apr 2016 11:12:06 +0000 (12:12 +0100)]
block: initialize qcrypto API at startup

Any programs which call the qcrypto APIs should ensure that
qcrypto_init() has been called before anything else which
can use crypto. Essentially this means right at the start
of the main method before initializing anything else.

This is important because some versions of gnutls/gcrypt
require explicit initialization before use.

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
Reviewed-by: Alex Bligh <alex@alex.org.uk>
Tested-by: Alex Bligh <alex@alex.org.uk>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
8 years agoqemu-img: fix formatting of error message
Daniel P. Berrange [Wed, 6 Apr 2016 09:16:18 +0000 (10:16 +0100)]
qemu-img: fix formatting of error message

The error_reportf_err() will not automatically append a
': ' before adding its suffix, so we must include that
in the message we pass it, otherwise we get a badly
formatted message lacking whitespace:

qemu-img: Could not open 'driver=nbd,host=127.0.0.1,port=6666,tls-creds=tls0'Failed to connect socket: Connection refused

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
8 years agoiotests: fix the broken 026.nocache output
Pavel Butsykin [Wed, 6 Apr 2016 06:08:32 +0000 (09:08 +0300)]
iotests: fix the broken 026.nocache output

This patch fixes longstanding issue with 026 iotest. Unfortunately,
this test contains 2 versions of the correct output, one for cached
writes and one for non-cached ones. People tends to fix only one
version of output of the test and thus noncached version becomes
broken. Unfortunately, it is default in tests/check-block.sh

The following problematic commits were made:
    commit 3b5e14c76a6bb142bf250ddf99e24a0ac8c7bc12
    Author: Max Reitz <mreitz@redhat.com>
    Date:   Tue Dec 2 18:32:51 2014 +0100
    qcow2: Flushing the caches in qcow2_close may fail

    commit a069e2f1372a0a823ab506fc019852a2a652aa54
    Author: John Snow <jsnow@redhat.com>
    Date:   Fri Feb 6 16:26:17 2015 -0500
    blkdebug: fix "once" rule

    commit b106ad9185f35fc4ad669555ad0e79e276083bd7
    Author: Kevin Wolf <kwolf@redhat.com>
    Date:   Fri Mar 28 18:06:31 2014 +0100
    qcow2: Don't rely on free_cluster_index in alloc_refcount_block()

Signed-off-by: Pavel Butsykin <pbutsykin@virtuozzo.com>
Signed-off-by: Denis V. Lunev <den@openvz.org>
CC: Max Reitz <mreitz@redhat.com>
CC: John Snow <jsnow@redhat.com>
CC: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
8 years agoMerge remote-tracking branch 'remotes/stefanha/tags/block-pull-request' into staging
Peter Maydell [Tue, 12 Apr 2016 08:34:52 +0000 (09:34 +0100)]
Merge remote-tracking branch 'remotes/stefanha/tags/block-pull-request' into staging

# gpg: Signature made Tue 12 Apr 2016 09:29:54 BST using RSA key ID 81AB73C8
# gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>"
# gpg:                 aka "Stefan Hajnoczi <stefanha@gmail.com>"

* remotes/stefanha/tags/block-pull-request:
  MAINTAINERS: Add Fam Zheng as a co-maintainer of block I/O path
  mirror: Replace bdrv_drain(bs) with bdrv_co_drain(bs)
  block: Fix bdrv_drain in coroutine

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
8 years agoMAINTAINERS: Add Fam Zheng as a co-maintainer of block I/O path
Fam Zheng [Tue, 5 Apr 2016 09:38:25 +0000 (17:38 +0800)]
MAINTAINERS: Add Fam Zheng as a co-maintainer of block I/O path

As agreed with Stefan, I'm listing myself a co-maintainer of block I/O
path and assist with the maintainership.

Signed-off-by: Fam Zheng <famz@redhat.com>
Message-id: 1459849105-7767-1-git-send-email-famz@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
8 years agomirror: Replace bdrv_drain(bs) with bdrv_co_drain(bs)
Fam Zheng [Tue, 5 Apr 2016 11:20:53 +0000 (19:20 +0800)]
mirror: Replace bdrv_drain(bs) with bdrv_co_drain(bs)

Suggested-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Fam Zheng <famz@redhat.com>
Message-id: 1459855253-5378-3-git-send-email-famz@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
8 years agoblock: Fix bdrv_drain in coroutine
Fam Zheng [Tue, 5 Apr 2016 11:20:52 +0000 (19:20 +0800)]
block: Fix bdrv_drain in coroutine

Using the nested aio_poll() in coroutine is a bad idea. This patch
replaces the aio_poll loop in bdrv_drain with a BH, if called in
coroutine.

For example, the bdrv_drain() in mirror.c can hang when a guest issued
request is pending on it in qemu_co_mutex_lock().

Mirror coroutine in this case has just finished a request, and the block
job is about to complete. It calls bdrv_drain() which waits for the
other coroutine to complete. The other coroutine is a scsi-disk request.
The deadlock happens when the latter is in turn pending on the former to
yield/terminate, in qemu_co_mutex_lock(). The state flow is as below
(assuming a qcow2 image):

  mirror coroutine               scsi-disk coroutine
  -------------------------------------------------------------
  do last write

    qcow2:qemu_co_mutex_lock()
    ...
                                 scsi disk read

                                   tracked request begin

                                   qcow2:qemu_co_mutex_lock.enter

    qcow2:qemu_co_mutex_unlock()

  bdrv_drain
    while (has tracked request)
      aio_poll()

In the scsi-disk coroutine, the qemu_co_mutex_lock() will never return
because the mirror coroutine is blocked in the aio_poll(blocking=true).

With this patch, the added qemu_coroutine_yield() allows the scsi-disk
coroutine to make progress as expected:

  mirror coroutine               scsi-disk coroutine
  -------------------------------------------------------------
  do last write

    qcow2:qemu_co_mutex_lock()
    ...
                                 scsi disk read

                                   tracked request begin

                                   qcow2:qemu_co_mutex_lock.enter

    qcow2:qemu_co_mutex_unlock()

  bdrv_drain.enter
>   schedule BH
>   qemu_coroutine_yield()
>                                  qcow2:qemu_co_mutex_lock.return
>                                  ...
                                   tracked request end
    ...
    (resumed from BH callback)
  bdrv_drain.return
  ...

Reported-by: Laurent Vivier <lvivier@redhat.com>
Signed-off-by: Fam Zheng <famz@redhat.com>
Message-id: 1459855253-5378-2-git-send-email-famz@redhat.com
Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Fam Zheng <famz@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
8 years agoMerge remote-tracking branch 'remotes/mcayland/tags/qemu-sparc-signed' into staging
Peter Maydell [Mon, 11 Apr 2016 15:46:37 +0000 (16:46 +0100)]
Merge remote-tracking branch 'remotes/mcayland/tags/qemu-sparc-signed' into staging

qemu-sparc update

# gpg: Signature made Mon 11 Apr 2016 16:30:02 BST using RSA key ID AE0F321F
# gpg: Good signature from "Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>"

* remotes/mcayland/tags/qemu-sparc-signed:
  target-sparc: fix ldstub sign-extension bug

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
8 years agotarget-sparc: fix ldstub sign-extension bug
Mark Cave-Ayland [Sat, 9 Apr 2016 11:25:12 +0000 (12:25 +0100)]
target-sparc: fix ldstub sign-extension bug

ldstub [addr], reg incorrectly reads a signed byte from memory which causes
problems in the 32-bit Solaris mutex code. Here the byte value being read is
0xff which is incorrectly sign-extended to 0xffffffff before being written back
to the target register causing lock detection to behave incorrectly.

This fixes the intermittent hangs and MUTEX_HELD warnings issued to the
console when running 32-bit Solaris images under qemu-system-sparc.

With thanks to Joseph Dery for providing a condensed test image to consistently
reproduce the problem on demand, and Martin Husemann for allowing me access to
real hardware for comparison.

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-By: Artyom Tarasenko <atar4qemu@gmail.com>
Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
8 years agoMerge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20160411' into...
Peter Maydell [Mon, 11 Apr 2016 13:37:53 +0000 (14:37 +0100)]
Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20160411' into staging

target-arm queue:
 * stellaris_enet: don't overrun buffer if fed oversize packet

# gpg: Signature made Mon 11 Apr 2016 14:36:27 BST using RSA key ID 14360CDE
# gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>"
# gpg:                 aka "Peter Maydell <pmaydell@gmail.com>"
# gpg:                 aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>"

* remotes/pmaydell/tags/pull-target-arm-20160411:
  net: stellaris_enet: check packet length against receive buffer

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
8 years agonet: stellaris_enet: check packet length against receive buffer
Prasad J Pandit [Fri, 8 Apr 2016 06:03:48 +0000 (11:33 +0530)]
net: stellaris_enet: check packet length against receive buffer

When receiving packets over Stellaris ethernet controller, it
uses receive buffer of size 2048 bytes. In case the controller
accepts large(MTU) packets, it could lead to memory corruption.
Add check to avoid it.

Reported-by: Oleksandr Bazhaniuk <oleksandr.bazhaniuk@intel.com>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Message-id: 1460095428-22698-1-git-send-email-ppandit@redhat.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
8 years agoMerge remote-tracking branch 'remotes/kraxel/tags/pull-vga-20160411-1' into staging
Peter Maydell [Mon, 11 Apr 2016 12:32:50 +0000 (13:32 +0100)]
Merge remote-tracking branch 'remotes/kraxel/tags/pull-vga-20160411-1' into staging

virtio-gpu: pixman surface fix, block live migration

# gpg: Signature made Mon 11 Apr 2016 11:45:18 BST using RSA key ID D3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
# gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
# gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

* remotes/kraxel/tags/pull-vga-20160411-1:
  virtio-gpu: block live migration
  ui/virtio-gpu: add and use qemu_create_displaysurface_pixman

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
8 years agovirtio-gpu: block live migration
Gerd Hoffmann [Mon, 11 Apr 2016 10:36:34 +0000 (12:36 +0200)]
virtio-gpu: block live migration

Feeling a bit nervous putting the full live migration support
patch (https://patchwork.ozlabs.org/patch/606902/) in that
late in the 2.6 devel cycle as it carries some non-trivial
changes.  So disable migration in case virtio-gpu is present
for now.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
8 years agoui/virtio-gpu: add and use qemu_create_displaysurface_pixman
Gerd Hoffmann [Fri, 1 Apr 2016 08:27:20 +0000 (10:27 +0200)]
ui/virtio-gpu: add and use qemu_create_displaysurface_pixman

Add a the new qemu_create_displaysurface_pixman function, to create
a DisplaySurface backed by an existing pixman image.  In that case
there is no need to create a new pixman image pointing to the same
backing storage.  We can just use the existing image directly.

This does not only simplify things a bit, but most importantly it
gets the reference counting right, so the backing storage for the
pixman image wouldn't be released underneath us.

Use new function in virtio-gpu, where using it actually fixes
use-after-free crashes.

Cc: qemu-stable@nongnu.org
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Message-id: 1459499240-742-1-git-send-email-kraxel@redhat.com

8 years agoMerge remote-tracking branch 'remotes/lalrae/tags/mips-20160408' into staging
Peter Maydell [Fri, 8 Apr 2016 12:45:52 +0000 (13:45 +0100)]
Merge remote-tracking branch 'remotes/lalrae/tags/mips-20160408' into staging

MIPS patches 2016-04-08

Changes:
* fix off-by-one error in ITU

# gpg: Signature made Fri 08 Apr 2016 10:43:16 BST using RSA key ID 0B29DA6B
# gpg: Good signature from "Leon Alrae <leon.alrae@imgtec.com>"

* remotes/lalrae/tags/mips-20160408:
  hw/mips_itu: fix off-by-one reported by Coverity

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
8 years agoMerge remote-tracking branch 'remotes/mst/tags/for_upstream' into staging
Peter Maydell [Fri, 8 Apr 2016 11:45:53 +0000 (12:45 +0100)]
Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into staging

pci, virtio, acpi: fixes for 2.6

Fixes all over the place. Most notably, fixes migration
for systems with pci express bridges, and random crashes
observed with virtio blk and scsi dataplane.

Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
# gpg: Signature made Fri 08 Apr 2016 08:53:46 BST using RSA key ID D28D5469
# gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>"
# gpg:                 aka "Michael S. Tsirkin <mst@redhat.com>"

* remotes/mst/tags/for_upstream:
  hw/pci-bridge: Add missing unref in case register-bus fails
  virtio: merge virtio_queue_aio_set_host_notifier_handler with virtio_queue_set_aio
  virtio-scsi: use aio handler for data plane
  virtio-blk: use aio handler for data plane
  virtio: add aio handler
  virtio-scsi: fix disabled mode
  virtio-blk: fix disabled mode
  virtio: make virtio_queue_notify_vq static
  tests/bios-tables-test: fix assert
  virtio-balloon: reset the statistic timer to load device
  Migration: Add i82801b11 migration data
  Sort the fw_cfg file list
  xen: piix reuse pci generic class init function
  pci-testdev: fast mmio support
  acpi: Add missing GCC_FMT_ATTR

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
8 years agoMerge remote-tracking branch 'remotes/dgibson/tags/ppc-for-2.6-20160408' into staging
Peter Maydell [Fri, 8 Apr 2016 10:54:18 +0000 (11:54 +0100)]
Merge remote-tracking branch 'remotes/dgibson/tags/ppc-for-2.6-20160408' into staging

ppc patch queue for 2016-04-08

Just a single bugfix for spapr in this batch, but I want to make sure
it gets in for 2.6.

# gpg: Signature made Fri 08 Apr 2016 06:02:45 BST using RSA key ID 20D9B392
# gpg: Good signature from "David Gibson <david@gibson.dropbear.id.au>"
# gpg:                 aka "David Gibson (Red Hat) <dgibson@redhat.com>"
# gpg:                 aka "David Gibson (ozlabs.org) <dgibson@ozlabs.org>"
# gpg: WARNING: This key is not certified with sufficiently trusted signatures!
# gpg:          It is not certain that the signature belongs to the owner.
# Primary key fingerprint: 75F4 6586 AE61 A66C C44E  87DC 6C38 CACA 20D9 B392

* remotes/dgibson/tags/ppc-for-2.6-20160408:
  spapr: Fix ibm,lrdr-capacity

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
8 years agoMerge remote-tracking branch 'remotes/xtensa/tags/20160408-xtensa' into staging
Peter Maydell [Fri, 8 Apr 2016 10:28:49 +0000 (11:28 +0100)]
Merge remote-tracking branch 'remotes/xtensa/tags/20160408-xtensa' into staging

Xtensa-related fixes:

- fix networking on xtfpga platform in linux v4.5 by indicating
  autonegotiation completion in opencores_eth MII BMSR.

# gpg: Signature made Thu 07 Apr 2016 23:33:59 BST using RSA key ID F83FA044
# gpg: Good signature from "Max Filippov <max.filippov@cogentembedded.com>"
# gpg:                 aka "Max Filippov <jcmvbkbc@gmail.com>"

* remotes/xtensa/tags/20160408-xtensa:
  opencores_eth: indicate autonegotiation completion

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
8 years agoMerge remote-tracking branch 'remotes/weil/tags/pull-tci-20160407' into staging
Peter Maydell [Fri, 8 Apr 2016 09:51:45 +0000 (10:51 +0100)]
Merge remote-tracking branch 'remotes/weil/tags/pull-tci-20160407' into staging

tci patch queue

# gpg: Signature made Thu 07 Apr 2016 18:01:55 BST using RSA key ID 677450AD
# gpg: Good signature from "Stefan Weil <sw@weilnetz.de>"
# gpg:                 aka "Stefan Weil <stefan.weil@weilnetz.de>"
# gpg:                 aka "Stefan Weil <stefan.weil@bib.uni-mannheim.de>"
# gpg: WARNING: This key is not certified with sufficiently trusted signatures!
# gpg:          It is not certain that the signature belongs to the owner.
# Primary key fingerprint: 4923 6FEA 75C9 5D69 8EC2  B78A E08C 21D5 6774 50AD

* remotes/weil/tags/pull-tci-20160407:
  tci: Fix build regression

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
8 years agoMerge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into staging
Peter Maydell [Fri, 8 Apr 2016 09:25:22 +0000 (10:25 +0100)]
Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into staging

* NBD fixes from Alex and Eric
* Debug code bitrot from Emilio
* HPET fix from Bill
* ps2kbd fix from Hervé
* PKU fix from myself
* Coverity fixes from Gonglei
* More memory.txt update from Jiangang
* .gitignore maintenance from Changlong

# gpg: Signature made Thu 07 Apr 2016 23:08:12 BST using RSA key ID 78C7AE83
# gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>"
# gpg:                 aka "Paolo Bonzini <pbonzini@redhat.com>"

* remotes/bonzini/tags/for-upstream:
  target-i386: check for PKU even for non-writable pages
  tests: ignore test-logging
  translate-all: add missing fold of tb_ctx into tcg_ctx
  hostmem-file: fix memory leak
  spapr: fix possible Negative array index read
  nbd: do not hang nbd_wr_syncv if outside a coroutine and no available data
  nbd: Don't kill server when client requests unknown option
  nbd: Fix NBD unsupported options
  qemu-nbd: Document -x option
  nbd: Improve debug traces on little-endian
  nbd: Avoid bitrot in TRACE() usage
  nbd: Return correct error for write to read-only export
  docs: fix typo in memory.txt
  hw/timer: Revert "hpet: inverse polarity when pin above ISA_NUM_IRQS"
  ps2kbd: default to scancode_set 2, as with KBD_CMD_RESET

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
8 years agohw/mips_itu: fix off-by-one reported by Coverity
Leon Alrae [Mon, 4 Apr 2016 08:59:00 +0000 (09:59 +0100)]
hw/mips_itu: fix off-by-one reported by Coverity

Fix off-by-one error in ITC Tag read.

Remove the switch as we just want to check if index is in valid range
rather than test against list of values.

Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
8 years agospapr: Fix ibm,lrdr-capacity
Bharata B Rao [Wed, 6 Apr 2016 05:06:06 +0000 (10:36 +0530)]
spapr: Fix ibm,lrdr-capacity

ibm,lrdr-capacity has a field to describe the maximum address in bytes
and therefore, the most memory that can be allocated to this guest. We
are using maxmem for this field, but instead should use the actual RAM
address corresponding to the end of hotplug region.

Signed-off-by: Bharata B Rao <bharata@linux.vnet.ibm.com>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
8 years agotarget-i386: check for PKU even for non-writable pages
Paolo Bonzini [Wed, 6 Apr 2016 07:45:42 +0000 (09:45 +0200)]
target-i386: check for PKU even for non-writable pages

Xiao Guangrong ran kvm-unit-tests on an actual machine with PKU and
found that it fails:

test pte.p pte.user pde.p pde.user pde.a pde.pse pkru.wd pkey=1 user write efer.nx cr4.pke: FAIL: error code 27 expected 7
Dump mapping: address: 0x123400000000
------L4: 2ebe007
------L3: 2ebf007
------L2: 8000000020000a5

(All failures are combinations of "pde.user pde.p pkru.wd pkey=1",
plus either "pde.pse" or "pte.p pte.user", plus one of "user cr0.wp",
"cr0.wp" or "user", plus unimportant bits such as accessed/dirty or
efer.nx).

So PFEC.PKEY is set even if the ordinary check failed (which it did
because pde.w is zero).  Adjust QEMU to match behavior of silicon.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
8 years agotests: ignore test-logging
Changlong Xie [Wed, 6 Apr 2016 00:49:16 +0000 (08:49 +0800)]
tests: ignore test-logging

Commit 3514552e added a new test, but did not mark it for
exclusion in .gitignore.

Signed-off-by: Changlong Xie <xiecl.fnst@cn.fujitsu.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Message-Id: <1459903756-30672-1-git-send-email-xiecl.fnst@cn.fujitsu.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
8 years agotranslate-all: add missing fold of tb_ctx into tcg_ctx
Emilio G. Cota [Tue, 5 Apr 2016 05:30:44 +0000 (01:30 -0400)]
translate-all: add missing fold of tb_ctx into tcg_ctx

Since 5e5f07e08 "TCG: Move translation block variables
to new context inside tcg_ctx: tb_ctx" on Feb 1 2013, compilation
of usermode + TB_DEBUG_CHECK has been broken. Fix it.

Signed-off-by: Emilio G. Cota <cota@braap.org>
Message-Id: <1459834253-8291-2-git-send-email-cota@braap.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
8 years agohostmem-file: fix memory leak
Gonglei [Thu, 3 Mar 2016 09:43:41 +0000 (17:43 +0800)]
hostmem-file: fix memory leak

Signed-off-by: Gonglei <arei.gonglei@huawei.com>
Message-Id: <1456998223-12356-5-git-send-email-arei.gonglei@huawei.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
8 years agospapr: fix possible Negative array index read
Gonglei [Thu, 3 Mar 2016 09:43:42 +0000 (17:43 +0800)]
spapr: fix possible Negative array index read

fix CID 1351391.

Signed-off-by: Gonglei <arei.gonglei@huawei.com>
Message-Id: <1456998223-12356-6-git-send-email-arei.gonglei@huawei.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
8 years agonbd: do not hang nbd_wr_syncv if outside a coroutine and no available data
Paolo Bonzini [Thu, 7 Apr 2016 11:25:08 +0000 (13:25 +0200)]
nbd: do not hang nbd_wr_syncv if outside a coroutine and no available data

Until commit 1c778ef7 ("nbd: convert to using I/O channels for actual
socket I/O", 2016-02-16), nbd_wr_sync returned -EAGAIN this scenario.
nbd_reply_ready required these semantics because it has two conflicting
requirements:

1) if a reply can be received on the socket, nbd_reply_ready needs
to read the header outside coroutine context to identify _which_
coroutine to enter to process the rest of the reply

2) on the other hand, nbd_reply_ready can find a false positive if
another thread (e.g. a VCPU thread running aio_poll) sneaks in and
calls nbd_reply_ready too.  In this case nbd_reply_ready does nothing
and expects nbd_wr_syncv to return -EAGAIN.

Currently, the solution to the first requirement is to wait in the very
rare case of a read() that doesn't retrieve the reply header in its
entirety; this is what nbd_wr_syncv does by calling qio_channel_wait().
However, the unconditional call to qio_channel_wait() breaks the second
requirement.  To fix this, the patch makes nbd_wr_syncv return -EAGAIN
if done is zero, similar to the code before commit 1c778ef7.

This is okay because NBD client-side negotiation is the only other case
that calls nbd_wr_syncv outside a coroutine, and it places the socket
in blocking mode.  On the other hand, it is a bit unpleasant to put
this in nbd_wr_syncv(), because the function is used by both client
and server.

The full fix would be to add a counter to NbdClientSession for how
many bytes have been filled in s->reply.  Then a reply can be filled
by multiple separate invocations of nbd_reply_ready and the
qio_channel_wait() call can be removed completely.  Something to
consider for 2.7...

Reported-by: Changlong Xie <xiecl.fnst@cn.fujitsu.com>
Reviewed-by: Daniel P. Berrange <berrange@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
8 years agonbd: Don't kill server when client requests unknown option
Eric Blake [Wed, 6 Apr 2016 22:48:38 +0000 (16:48 -0600)]
nbd: Don't kill server when client requests unknown option

nbd-server.c currently fails to handle unsupported options properly.
If during option haggling the client sends an unknown request, the
server kills the connection instead of letting the client try to
fall back to something older.  This is precisely what advertising
NBD_FLAG_FIXED_NEWSTYLE was supposed to fix.

Signed-off-by: Eric Blake <eblake@redhat.com>
Message-Id: <1459982918-32229-1-git-send-email-eblake@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
8 years agonbd: Fix NBD unsupported options
Alex Bligh [Wed, 6 Apr 2016 16:59:22 +0000 (10:59 -0600)]
nbd: Fix NBD unsupported options

nbd-client.c currently fails to handle unsupported options properly.
If during option haggling the server finds an option that is
unsupported, it returns an NBD_REP_ERR_UNSUP reply.

According to nbd's proto.md, the format for such a reply
should be:

  S: 64 bits, 0x3e889045565a9 (magic number for replies)
  S: 32 bits, the option as sent by the client to which this is a reply
  S: 32 bits, reply type (e.g., NBD_REP_ACK for successful completion,
     or NBD_REP_ERR_UNSUP to mark use of an option not known by this server
  S: 32 bits, length of the reply. This may be zero for some replies,
     in which case the next field is not sent
  S: any data as required by the reply (e.g., an export name in the case
     of NBD_REP_SERVER, or optional UTF-8 message for NBD_REP_ERR_*)

However, in nbd-client.c, the reply type was being read, and if it
contained an error, it was bailing out and issuing the next option
request without first reading the length. This meant that the
next option / handshake read had an extra 4 or more bytes of data in it.
In practice, this makes Qemu incompatible with servers that do not
support NBD_OPT_LIST.

To verify this isn't an error in the specification or my reading of
it, replies are sent by the reference implementation here:
 https://github.com/yoe/nbd/blob/66dfb35/nbd-server.c#L1232
and as is evident it always sends a 'datasize' (aka length) 32 bit
word. Unsupported elements are replied to here:
 https://github.com/yoe/nbd/blob/66dfb35/nbd-server.c#L1371

Signed-off-by: Alex Bligh <alex@alex.org.uk>
Message-Id: <1459882500-24316-1-git-send-email-alex@alex.org.uk>
[rework to ALWAYS consume an optional UTF-8 message from the server]
Signed-off-by: Eric Blake <eblake@redhat.com>
Message-Id: <1459961962-18771-1-git-send-email-eblake@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
8 years agoqemu-nbd: Document -x option
Eric Blake [Wed, 6 Apr 2016 02:02:08 +0000 (20:02 -0600)]
qemu-nbd: Document -x option

Commit 3d4b2f9c added -x to force qemu-nbd to use new-style
negotiation, but while it documented it in the man page, it
omitted docs in the --help output.

Signed-off-by: Eric Blake <eblake@redhat.com>
Message-Id: <1459908128-11925-1-git-send-email-eblake@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
8 years agonbd: Improve debug traces on little-endian
Eric Blake [Wed, 6 Apr 2016 03:35:04 +0000 (21:35 -0600)]
nbd: Improve debug traces on little-endian

Print debug tracing messages while data is still in native
ordering, rather than after we've potentially swapped it into
network order for transmission.  Also, it's nice if the server
mentions what it is replying, to correlate it to with what the
client says it is receiving.

Signed-off-by: Eric Blake <eblake@redhat.com>
Message-Id: <1459913704-19949-4-git-send-email-eblake@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
8 years agonbd: Avoid bitrot in TRACE() usage
Eric Blake [Wed, 6 Apr 2016 03:35:03 +0000 (21:35 -0600)]
nbd: Avoid bitrot in TRACE() usage

The compiler is smart enough to optimize out 'if (0)', but won't
type-check our printfs if they are hidden behind #if.

Signed-off-by: Eric Blake <eblake@redhat.com>
Message-Id: <1459913704-19949-3-git-send-email-eblake@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
8 years agonbd: Return correct error for write to read-only export
Eric Blake [Wed, 6 Apr 2016 03:35:02 +0000 (21:35 -0600)]
nbd: Return correct error for write to read-only export

The NBD Protocol requires that servers should send EPERM for
attempts to write (or trim) a read-only export.  We were
correct for TRIM (blk_co_discard() gave EPERM); but were
manually setting EROFS which then got mapped to EINVAL over
the wire on writes.

Signed-off-by: Eric Blake <eblake@redhat.com>
Message-Id: <1459913704-19949-2-git-send-email-eblake@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
8 years agodocs: fix typo in memory.txt
Wei Jiangang [Tue, 22 Mar 2016 09:45:54 +0000 (17:45 +0800)]
docs: fix typo in memory.txt

The space between 7000 and 8000 is too wide by 1 character.
Also correct the range of vga-window example 0xa0000-0xbffff.

Signed-off-by: Wei Jiangang <weijg.fnst@cn.fujitsu.com>
Message-Id: <1458639954-9980-1-git-send-email-weijg.fnst@cn.fujitsu.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
8 years agohw/timer: Revert "hpet: inverse polarity when pin above ISA_NUM_IRQS"
Bill Paul [Tue, 5 Apr 2016 22:58:19 +0000 (15:58 -0700)]
hw/timer: Revert "hpet: inverse polarity when pin above ISA_NUM_IRQS"

This reverts commit 0d63b2dd31464cfccc80bbeedc24e3863fe4c895.

This change was originally intended to correct the HPET behavior
in conjunction with Linux, however the behavior that it actually creates
is not compatible with the ioapic.c implementation; it used to be
compatible with KVM's own IOAPIC but it is not anymore.

Signed-off-by: Bill Paul <wpaul@windriver.com>
CC: Paolo Bonzini <pbonzini@redhat.com>
CC: Richard Henderson <rth@twiddle.net>
CC: Eduardo Habkost <ehabkost@redhat.com>
Message-Id: <201604051558.20070.wpaul@windriver.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
8 years agops2kbd: default to scancode_set 2, as with KBD_CMD_RESET
Hervé Poussineau [Wed, 23 Mar 2016 06:21:40 +0000 (07:21 +0100)]
ps2kbd: default to scancode_set 2, as with KBD_CMD_RESET

This line has been added in commit ef74679a810fe6858f625b9d52b68cc3fc61eb3d with
other initializations. However, scancode set 0 doesn't exist (only 1, 2, 3).
This works well as long as operating system is resetting keyboard, or overwriting
the current scancode set with the one it wants.

This fixes IBM 40p firmware, which doesn't bother sending KBD_CMD_RESET or KBD_CMD_SCANCODE.

Signed-off-by: Hervé Poussineau <hpoussin@reactos.org>
Message-Id: <1458714100-28885-1-git-send-email-hpoussin@reactos.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
8 years agoMerge remote-tracking branch 'remotes/mdroth/tags/qga-pull-2016-04-07-tag' into staging
Peter Maydell [Thu, 7 Apr 2016 17:06:14 +0000 (18:06 +0100)]
Merge remote-tracking branch 'remotes/mdroth/tags/qga-pull-2016-04-07-tag' into staging

qemu-ga patch queue for 2.6

* fix w32 bug where output from guest-exec is not properly captured
* fix w32 bug where FDs are leaked after guest-exec is invoked

# gpg: Signature made Thu 07 Apr 2016 17:46:21 BST using RSA key ID F108B584
# gpg: Good signature from "Michael Roth <flukshun@gmail.com>"
# gpg:                 aka "Michael Roth <mdroth@utexas.edu>"
# gpg:                 aka "Michael Roth <mdroth@linux.vnet.ibm.com>"

* remotes/mdroth/tags/qga-pull-2016-04-07-tag:
  qga: Workaround for console redirection from non-interactive qemu-ga service
  qga: fix fd leak with guest-exec i/o channels

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
8 years agotci: Fix build regression
Stefan Weil [Tue, 5 Apr 2016 20:24:51 +0000 (22:24 +0200)]
tci: Fix build regression

Commit d38ea87ac54af64ef611de434d07c12dc0399216 cleaned the include
statements which resulted in a wrong order of assert.h and the definition
of NDEBUG in tci.c. Normally NDEBUG modifies the definition of the assert
macro, but here this definition comes too late which results in a failing
build.

To fix this, a new macro tci_assert which depends on CONFIG_DEBUG_TCG
is introduced. Only builds with CONFIG_DEBUG_TCG will use assertions.
Even in this case, it is still possible to disable assertions by
defining NDEBUG via compiler settings.

Tested-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Signed-off-by: Stefan Weil <sw@weilnetz.de>
8 years agohw/pci-bridge: Add missing unref in case register-bus fails
Wei Jiangang [Wed, 23 Mar 2016 07:26:19 +0000 (15:26 +0800)]
hw/pci-bridge: Add missing unref in case register-bus fails

The error paths after a successful qdev_create/pci_bus_new
should contain a object_unref/object_unparent.
pxb_dev_init_common() did not yet, so add it.

Signed-off-by: Wei Jiangang <weijg.fnst@cn.fujitsu.com>
Signed-off-by: Cao jin <caoj.fnst@cn.fujitsu.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Marcel Apfelbaum <marcel@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
8 years agovirtio: merge virtio_queue_aio_set_host_notifier_handler with virtio_queue_set_aio
Paolo Bonzini [Wed, 6 Apr 2016 10:16:28 +0000 (12:16 +0200)]
virtio: merge virtio_queue_aio_set_host_notifier_handler with virtio_queue_set_aio

Eliminating the reentrancy is actually a nice thing that we can do
with the API that Michael proposed, so let's make it first class.
This also hides the complex assign/set_handler conventions from
callers of virtio_queue_aio_set_host_notifier_handler, which in
fact was always called with assign=true.

Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
8 years agovirtio-scsi: use aio handler for data plane
Paolo Bonzini [Wed, 6 Apr 2016 10:16:27 +0000 (12:16 +0200)]
virtio-scsi: use aio handler for data plane

In addition to handling IO in vcpu thread and in io thread, dataplane
introduces yet another mode: handling it by AioContext.

This reuses the same handler as previous modes, which triggers races as
these were not designed to be reentrant.  Use a separate handler just
for aio, and disable regular handlers when dataplane is active.

Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
8 years agovirtio-blk: use aio handler for data plane
Michael S. Tsirkin [Wed, 6 Apr 2016 10:16:26 +0000 (12:16 +0200)]
virtio-blk: use aio handler for data plane

In addition to handling IO in vcpu thread and in io thread, dataplane
introduces yet another mode: handling it by AioContext.

This reuses the same handler as previous modes, which triggers races as
these were not designed to be reentrant.  Use a separate handler just
for aio, and disable regular handlers when dataplane is active.

Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
8 years agovirtio: add aio handler
Michael S. Tsirkin [Wed, 6 Apr 2016 10:16:25 +0000 (12:16 +0200)]
virtio: add aio handler

In addition to handling IO in vcpu thread and in io thread, blk dataplane
introduces yet another mode: handling it by AioContext.

Currently, this reuses the same handler as previous modes,
which triggers races as these were not designed to be reentrant.
Add instead a separate handler just for aio; this will make
it possible to disable regular handlers when dataplane is active.

Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
8 years agovirtio-scsi: fix disabled mode
Paolo Bonzini [Wed, 6 Apr 2016 10:16:24 +0000 (12:16 +0200)]
virtio-scsi: fix disabled mode

Add two missing checks for s->dataplane_fenced.  In one case, QEMU
would skip injecting an IRQ due to a write to an uninitialized
EventNotifier's file descriptor.

In the second case, the dataplane_disabled field was used by mistake;
in fact after fixing this occurrence it is completely unused.

Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
8 years agovirtio-blk: fix disabled mode
Paolo Bonzini [Wed, 6 Apr 2016 10:16:23 +0000 (12:16 +0200)]
virtio-blk: fix disabled mode

We must not call virtio_blk_data_plane_notify if dataplane is
disabled: we would hit a segmentation fault in notify_guest_bh as
s->guest_notifier has not been setup and is NULL.

Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
8 years agovirtio: make virtio_queue_notify_vq static
Paolo Bonzini [Wed, 6 Apr 2016 10:16:22 +0000 (12:16 +0200)]
virtio: make virtio_queue_notify_vq static

Acked-by: Cornelia Huck <cornelia.huck@de.ibm.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
8 years agotests/bios-tables-test: fix assert
Marcel Apfelbaum [Mon, 4 Apr 2016 17:00:57 +0000 (20:00 +0300)]
tests/bios-tables-test: fix assert

Newer iasl does not add the aml file name to the Definition Block.
See acpica tools commit  1ecbb3d5:
  "Emit the AMLFilename as a zero-length string. Allows the compiler to create
   the name later -- making it easier to rename the parent ASL (DSL) file."

That causes an assert in acpi tests:
   tests/bios-tables-test.c:455:normalize_asl: assertion failed: (block_name)

Fix it by striping the start of the definition block line until the first comma.
The block name is always the first parameter and
the grammar does not allow comma in between, so it is safe.

Reported-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Signed-off-by: Marcel Apfelbaum <marcel@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
8 years agovirtio-balloon: reset the statistic timer to load device
Pavel Butsykin [Tue, 29 Mar 2016 14:00:49 +0000 (17:00 +0300)]
virtio-balloon: reset the statistic timer to load device

If before loading snapshot we had set the timer of statistics, then after
applying snapshot the expiry time would be irrelevant for the restored
state of the virtual clocks. A simple fix is just to restart the timer
after loading snapshot.

For the user it may look like a long delay of statistics update after switch
to the snapshot.

Signed-off-by: Pavel Butsykin <pbutsykin@virtuozzo.com>
Reviewed-by: Roman Kagan <rkagan@virtuozzo.com>
Signed-off-by: Denis V. Lunev <den@openvz.org>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
8 years agoMigration: Add i82801b11 migration data
Dr. David Alan Gilbert [Mon, 4 Apr 2016 15:54:41 +0000 (16:54 +0100)]
Migration: Add i82801b11 migration data

The i82801b11 bridge didn't have a vmsd and thus didn't send
any migration data, including that of its parent PCIBridge object.
The symptom being if the guest used any devices behind the bridge
the guest crashed (mostly with various interrupt related issues).

Note: This will cause migration from old qemus that used this device to
explicitly fail during migration as opposed to the guest crashing.

Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Suggested-by: Marcel Apfelbaum <marcel@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
8 years agoSort the fw_cfg file list
Gerd Hoffmann [Thu, 7 Apr 2016 14:12:58 +0000 (09:12 -0500)]
Sort the fw_cfg file list

Entries are inserted in filename order instead of being
appended to the end in case sorting is enabled.

This will avoid any future issues of moving the file creation
around, it doesn't matter what order they are created now,
the will always be in filename order.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Added machine type handling for compatibility.  This was
a fairly complex change, this will preserve the order of fw_cfg
for older versions no matter what order the firmware files
actually come in.  A list is kept of the correct legacy order
and the entries will be inserted based upon their order in
the list.  Except that some entries are ordered (in a specific
area of the list) based upon what order they appear on the
command line.  Special handling is added for those entries.

Signed-off-by: Corey Minyard <cminyard@mvista.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
8 years agoxen: piix reuse pci generic class init function
Michael S. Tsirkin [Sun, 6 Mar 2016 18:44:30 +0000 (20:44 +0200)]
xen: piix reuse pci generic class init function

piix3_ide_xen_class_init is identical to piix3_ide_class_init
except it's buggy as it does not set exit and does not disable
hotplug properly.

Switch to the generic one.

Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
8 years agopci-testdev: fast mmio support
Michael S. Tsirkin [Thu, 24 Mar 2016 13:07:59 +0000 (15:07 +0200)]
pci-testdev: fast mmio support

Teach PCI testdev to use fast MMIO when kvm makes it available.

Before:
    mmio-wildcard-eventfd:pci-mem 2271
After:
    mmio-wildcard-eventfd:pci-mem 1218

Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
8 years agoacpi: Add missing GCC_FMT_ATTR
Stefan Weil [Wed, 16 Mar 2016 19:43:37 +0000 (20:43 +0100)]
acpi: Add missing GCC_FMT_ATTR

This fixes a compiler warning when compiling with -Wextra.

Signed-off-by: Stefan Weil <sw@weilnetz.de>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
8 years agoqga: Workaround for console redirection from non-interactive qemu-ga service
Yuri Pudgorodskiy [Wed, 6 Apr 2016 05:43:31 +0000 (08:43 +0300)]
qga: Workaround for console redirection from non-interactive qemu-ga service

mingw-glib uses helper process to assist gspawn() api. There are two
versions of helpers, one with main() and another with WinMain() startup
routines.

Whenever gspawn() detects consoleless environment (and qemu-ga is running
in such environment as Win32 service), it chooses helper with main()
instead of WinMain. It is done by name, e.g.
gspawn-win32-helper-console.exe vs gspawn-win32-helper.exe

Running console-aware application like any win32 console apps from main()
crt initalized process results in redirection of stdout to console created
in crt startup instead of parent-provided handle connected to subprocess
pipe. Thus, stdout/stderr redirection do not work correctly.

The patch makes WinMain()'s version of helper be used as the only helper
shipped with qemu-ga package. Using only win32 helper ensures console
is created before any redirection and fixes stdout/stderr redirection
issue.

Signed-off-by: Yuri Pudgorodskiy <yur@virtuozzo.com>
Signed-off-by: Denis V. Lunev <den@openvz.org>
CC: Michael Roth <mdroth@linux.vnet.ibm.com>
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>