Stefan Weil [Mon, 19 Mar 2012 12:20:47 +0000 (13:20 +0100)]
configure: Fix creation of symbolic links for MinGW toolchain
The MinGW toolchain on w32/w64 hosts does not create symbolic links,
but implements 'ln -s' similar to 'cp -r'.
In incremental out of tree builds, this resulted in files which
were not updated when their counterparts in the QEMU source tree
changed. Especially for Makefile* this happened very often.
With this patch, the 'symlinked' files are now always updated for
out of tree builds. Similar code was already used for the symbolic
link of libcacard/Makefile.
The symlink macro always removes the target before it is created
again, therefore the rm command for libcacard/Makefile was redundant
and is removed now.
Macro symlink is also used with directories. To remove them on w32
hosts, a recursive rm is needed.
v2:
Quote arguments in shell function symlink, and also quote any argument
which is passed to symlink and which contains macros. This should reduce
the chance of accidents caused by rm -rf.
Signed-off-by: Stefan Weil <sw@weilnetz.de> Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
Andreas Färber [Thu, 26 Apr 2012 09:57:39 +0000 (11:57 +0200)]
configure: Don't build bsd-user on Mac OS X by default
Fixes the build when combined with the drop of darwin-user.
Enthusiasts can still try building it using --enable-bsd-user.
Signed-off-by: Andreas Färber <andreas.faerber@web.de> Cc: Bernhard Walle <bernhard@bwalle.de> Tested-by: Bernhard Walle <bernhard@bwalle.de> [Mac OS 10.7.3] Acked-by: Bernhard Walle <bernhard@bwalle.de> Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
Signed-off-by: Andreas Färber <afaerber@suse.de> Cc: malc <av1474@comtv.ru> Cc: Ben Taylor <bentaylor.solx86@gmail.com> Tested-by: Bernhard Walle <bernhard@bwalle.de> Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
Fixes the build of the Cocoa frontend on Mac OS X and avoids a
workaround for AIX.
For pre-10 Solaris include osdep.h.
Reported-by: Pavel Borzenkov <pavel.borzenkov@gmail.com> Reported-by: Rui Carmo <rui.carmo@gmail.com> Signed-off-by: Andreas Färber <afaerber@suse.de> Cc: Juan Pineda <juan@logician.com> Cc: malc <av1474@comtv.ru> Cc: Ben Taylor <bentaylor.solx86@gmail.com> Tested-by: Bernhard Walle <bernhard@bwalle.de> Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
Andreas Färber [Wed, 25 Apr 2012 22:15:54 +0000 (00:15 +0200)]
target-mips: Move definition of uint_fast{8, 16}_t to osdep.h
osdep.h is included via qemu-common.h.
Prepares for use of [u]int_fast*_t types in softfloat code.
Signed-off-by: Andreas Färber <afaerber@suse.de> Cc: Ben Taylor <bentaylor.solx86@gmail.com> Cc: Aurélien Jarno <aurelien@aurel32.net> Cc: Peter Maydell <peter.maydell@linaro.org> Tested-by: Bernhard Walle <bernhard@bwalle.de> Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
Andreas Färber [Wed, 25 Apr 2012 22:15:53 +0000 (00:15 +0200)]
softfloat: Fix mixups of int and int16
normalizeFloat{32,64}Subnormal() expect the exponent as int16, not int.
This went unnoticed since int16 and uint16 were both typedef'ed to int.
Signed-off-by: Andreas Färber <afaerber@suse.de> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Tested-by: Bernhard Walle <bernhard@bwalle.de> Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
Blue Swirl [Sat, 28 Apr 2012 08:57:56 +0000 (08:57 +0000)]
Merge branch 'target-arm.for-upstream' of git://git.linaro.org/people/pmaydell/qemu-arm
* 'target-arm.for-upstream' of git://git.linaro.org/people/pmaydell/qemu-arm:
target-arm: Make SETEND respect bswap_code (BE8) setting
target-arm: Move A9 config_base_address reset value to ARMCPU
target-arm: Change cpu_arm_init() return type to ARMCPU
Blue Swirl [Sat, 28 Apr 2012 08:19:50 +0000 (08:19 +0000)]
Merge branch 'timer' of git://qemu.weilnetz.de/qemu
* 'timer' of git://qemu.weilnetz.de/qemu:
qemu-timer: Optimize data structures
qemu-timer: Remove function alarm_has_dynticks
qemu-timer: Use bool, false, true for boolean values
qemu-timer: Remove unused function qemu_alarm_pending
qemu-timer: Remove redundant include statements
Anthony Liguori [Fri, 27 Apr 2012 17:00:06 +0000 (12:00 -0500)]
Merge remote-tracking branch 'qmp/queue/qmp' into staging
* qmp/queue/qmp:
qapi: fix qmp_balloon() conversion
qemu-iotests: add block-stream speed value test case
block: add 'speed' optional parameter to block-stream
block: change block-job-set-speed argument from 'value' to 'speed'
block: use Error mechanism instead of -errno for block_job_set_speed()
block: use Error mechanism instead of -errno for block_job_create()
Stefan Hajnoczi [Wed, 25 Apr 2012 15:51:04 +0000 (16:51 +0100)]
qemu-iotests: add block-stream speed value test case
Add tests to exercise the InvalidParameter 'speed' error code path, as
well as the regular success case for setting the speed. The
block-stream 'speed' parameter allows the speed limit of the job to be
applied immediately when the job starts instead of issuing a separate
block-job-set-speed command later. If the parameter has an invalid
value we expect to get an error and the job is not created.
It turns out that cancelling a block job is a common operation in these
test cases, let's extract a cancel_and_wait() function instead of
duplicating the QMP commands.
Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com> Acked-by: Kevin Wolf <kwolf@redhat.com> Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>
Stefan Hajnoczi [Wed, 25 Apr 2012 15:51:03 +0000 (16:51 +0100)]
block: add 'speed' optional parameter to block-stream
Allow streaming operations to be started with an initial speed limit.
This eliminates the window of time between starting streaming and
issuing block-job-set-speed. Users should use the new optional 'speed'
parameter instead so that speed limits are in effect immediately when
the job starts.
Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com> Acked-by: Kevin Wolf <kwolf@redhat.com> Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>
Stefan Hajnoczi [Wed, 25 Apr 2012 15:51:02 +0000 (16:51 +0100)]
block: change block-job-set-speed argument from 'value' to 'speed'
Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com> Acked-by: Kevin Wolf <kwolf@redhat.com> Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>
Stefan Hajnoczi [Wed, 25 Apr 2012 15:51:01 +0000 (16:51 +0100)]
block: use Error mechanism instead of -errno for block_job_set_speed()
There are at least two different errors that can occur in
block_job_set_speed(): the job might not support setting speeds or the
value might be invalid.
Use the Error mechanism to report the error where it occurs.
Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com> Acked-by: Kevin Wolf <kwolf@redhat.com> Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>
Stefan Hajnoczi [Wed, 25 Apr 2012 15:51:00 +0000 (16:51 +0100)]
block: use Error mechanism instead of -errno for block_job_create()
The block job API uses -errno return values internally and we convert
these to Error in the QMP functions. This is ugly because the Error
should be created at the point where we still have all the relevant
information. More importantly, it is hard to add new error cases to
this case since we quickly run out of -errno values without losing
information.
Go ahead and use Error directly and don't convert later.
Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com> Acked-by: Kevin Wolf <kwolf@redhat.com> Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>
Peter Maydell [Tue, 24 Apr 2012 18:05:05 +0000 (18:05 +0000)]
target-arm: Make SETEND respect bswap_code (BE8) setting
Make the SETEND instruction respect the setting of bswap_code,
so that in BE8 mode we UNDEF for attempts to switch into
little-endian mode and nop for attempts to stay in big-endian
mode. (This is the inverse of the existing handling of SETEND
in the more common little-endian setup, which we use since
we don't implement the architecturally-mandated dynamic
endianness switching.)
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Peter Maydell [Fri, 20 Apr 2012 07:39:15 +0000 (07:39 +0000)]
target-arm: Move A9 config_base_address reset value to ARMCPU
Move the A9 config_base_address cp15 register reset value to
ARMCPU. This should become a QOM property so that the Highbank
board can set it without having to pull in cpu-qom.h, but at
least this avoids the implicit dependency on reset ordering
that the previous workaround had.
Cc: Mark Langsdorf <mark.langsdorf@calxeda.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Andreas Färber <afaerber@suse.de>
Andreas Färber [Fri, 20 Apr 2012 07:39:14 +0000 (07:39 +0000)]
target-arm: Change cpu_arm_init() return type to ARMCPU
Make cpu_arm_init() return a QOM ARMCPU, so that we don't need to
obtain an ARMCPU through arm_env_get_cpu() in machine init code.
This requires to adjust the inclusion site of cpu-qom.h and in turn,
forward-looking, to homogenize its include order.
cpu_init() must still return a CPUARMState for backwards and
cross-target compatibility, so adjust the cpu_init macro.
Signed-off-by: Andreas Färber <afaerber@suse.de> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Stefan Weil [Fri, 20 Apr 2012 09:27:24 +0000 (11:27 +0200)]
qemu-timer: Remove function alarm_has_dynticks
Some time ago, the last time which did not have dynticks was removed,
so now all timers have dynticks.
I also removed a misleading error message for the dynticks timer.
If timer_create fails, there is already an error message, and
QEMU will use the unix timer which also provides dynamic ticks,
therefore dynamic ticks are not disabled.
v2:
Remove two if statements because they were always true
(thanks to Paolo Bonzini for this correction).
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Stefan Weil <sw@weilnetz.de>
Anthony Liguori [Thu, 26 Apr 2012 20:21:52 +0000 (15:21 -0500)]
Merge remote-tracking branch 'kraxel/usb.49' into staging
* kraxel/usb.49:
usb-uhci: update irq line on reset
usb: add serial number generator
usb-redir: Not finding an async urb id is not an error
usb-redir: Reset device address and speed on disconnect
usb-redir: An interface count of 0 is a valid value
usb-xhci: fix bit test
usb-xhci: Use PCI DMA helper functions
usb-host: fix zero-length packets
usb-host: don't dereference invalid iovecs
usb-storage: fix request canceling
usb-ehci: Ensure frindex writes leave a valid frindex value
usb-ehci: add missing usb_packet_init() call
usb-ehci: remove hack
Anthony Liguori [Thu, 26 Apr 2012 20:20:33 +0000 (15:20 -0500)]
Merge remote-tracking branch 'mst/tags/for_anthony' into staging
* mst/tags/for_anthony:
e1000: set E1000_ICR_INT_ASSERTED only for 8257x
e1000: link auto-negotiation emulation
e1000: introduce bit for debugging PHY emulation
e1000: introduce helpers to manipulate link status
e1000: PHY loopback mode support
e1000: conditionally raise irq at the end of MDI cycle
e1000: introduce bits of PHY control register
eepro100: Fix multicast regression
virtio: order index/descriptor reads
virtio: add missing mb() on enable notification
virtio: add missing mb() on notification
e1000: move reset function earlier in file
Anthony Liguori [Thu, 26 Apr 2012 20:18:06 +0000 (15:18 -0500)]
Merge remote-tracking branch 'afaerber/qom-cpu-x86-prop.v3' into staging
* afaerber/qom-cpu-x86-prop.v3:
target-i386: Introduce "tsc-frequency" property for X86CPU
target-i386: Prepare "vendor" property for X86CPU
target-i386: Introduce "xlevel" property for X86CPU
target-i386: Introduce "level" property for X86CPU
target-i386: Add property getter for CPU model-id
target-i386: Add property getter for CPU stepping
target-i386: Add property getter for CPU model
target-i386: Add property getter for CPU family
target-i386: Add "model-id" property to X86CPU
target-i386: Add "stepping" property to X86CPU
target-i386: Add "model" property to X86CPU
target-i386: Add "family" property to X86CPU
target-i386: Add range check for -cpu ,family=x
target-i386: Pass X86CPU to cpu_x86_register()
target-i386: Fix x86_cpuid_set_model_id()
timers: the rearm function should be able to handle delta = INT64_MAX
Fix win32_rearm_timer and mm_rearm_timer: they should be able to handle
INT64_MAX as a delta parameter without overflowing.
Also, the next deadline in ms should be calculated rounding down rather
than up (see unix_rearm_timer and dynticks_rearm_timer).
Finally ChangeTimerQueueTimer takes an unsigned long and timeSetEvent
takes an unsigned int as delta, so cast the ms delta to the appropriate
unsigned integer.
Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
Stefan Weil [Fri, 13 Apr 2012 20:24:42 +0000 (22:24 +0200)]
sdl: Add QEMU mascot icon for use with SDL
This is a bitmap file (32x32x4) derived from the official QEMU mascot
(which was designed by Benoît Canet). I stripped the text from the SVG
to get a nearly square image and converted the result to BMP without
any manual optimization.
The bitmap is currently used by QEMU's SDL interface and replaces the
default X icon.
v2: Add qemu-icon.bmp to Makefile.
Signed-off-by: Stefan Weil <sw@weilnetz.de> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
Anthony Liguori [Wed, 18 Apr 2012 22:33:15 +0000 (17:33 -0500)]
pc-sysfw: make sure to call qdev_init
We're not actually calling qdev_init for the pc-sysfw device. Since we create
the canonical path during realize, this was causing an assert to trigger when
attempting to read a link pointing to pc-sysfw.
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
This patch adds a function which creates unique serial numbers for usb
devices and puts it into use. Windows guests tend to become unhappy if
they find two identical usb devices in the system. Effects range from
non-functional devices (with yellow exclamation mark in device manager)
to BSODs. Handing out unique serial numbers to devices fixes this.
With this patch applied almost all emulated devices get a generated,
unique serial number. There are two exceptions:
* usb-storage devices will prefer a user-specified serial number
and will only get a generated number in case the serial property
is unset.
* usb-hid devices keep the fixed serial number "42" as it is used
to signal "remote wakeup actually works".
See commit 7b074a22dab4bdda9864b933f1bc811a3db42845
Hans de Goede [Sat, 31 Mar 2012 15:14:23 +0000 (17:14 +0200)]
usb-redir: Not finding an async urb id is not an error
We clear our pending async urb list on device disconnect and we may still
receive "packet complete" packets from our peer after this, which will then
refer to packet ids no longer in our list.
Signed-off-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Hans de Goede [Sat, 31 Mar 2012 15:14:21 +0000 (17:14 +0200)]
usb-redir: An interface count of 0 is a valid value
An interface-count of 0 happens when a device is in unconfigured state when
it gets redirected. So we should not use 0 to detect not having received
interface info from our peer.
Signed-off-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
David Gibson [Wed, 4 Apr 2012 00:15:58 +0000 (10:15 +1000)]
usb-xhci: Use PCI DMA helper functions
Shortly before 1.0, we added helper functions / wrappers for doing PCI DMA
from individual devices. This makes what's going on clearer and means that
when we add IOMMU support somewhere in the future, only the general PCI
code will have to change, not every device that uses PCI DMA.
However, usb-xhci is not using these wrappers, despite being a PCI only
device. This patch remedies the situation, using the pci dma functions
instead of direct calls to cpu_physical_memory_{read,write}(). Likewise
address parameters for DMA are changed to dma_addr_t instead of
target_phys_addr_t.
[ kraxel: removed #ifdefs ]
Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
usb-host optimizes away zero-length packets by not entering the
processing loop at all. Which isn't correct, we should submit a
zero-length urb to the host devicein that case. This patch makes
sure we run the processing loop at least once.
Little fix for usb packet handling on i/o cancelation. The
usb packet pointer (s->packet) is cleared at the wrong place:
The scsi request cancel handler does it. When a usb packet
is canceled the usb-storage emulation canceles the scsi request
if present. In most cases there is one, so usually s->packet
is cleared as needed even with the code sitting at the wrong
place.
If there is no scsi request in flight s->packet is not cleared
though. The usb-storage emulation will then try to complete an
usb packet which is not in flight any more and thereby trigger
an assert() in the usb core.
Fix this by clearing s->packet at the correct place, which is
the usb packet cancel header.
Hans de Goede [Tue, 3 Apr 2012 12:21:47 +0000 (14:21 +0200)]
usb-ehci: Ensure frindex writes leave a valid frindex value
frindex is a 14 bits counter, so bits 31-14 should always be 0, and
after the commit titled "usb-ehci: frindex always is a 14 bits counter"
we rely on frindex always being a multiple of 8. I've not seen this in
practice, but theoretically a guest can write a value >= 0x4000 or a value
which is not a multiple of 8 value to frindex, this patch ensures that
things will still work when that happens.
Signed-off-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
To answer the question in the comment removed by this patch: I think
this was needed because several places in the ehci emulation did not
check the T bit of link entries correctly and thus might have followed
invalid references. See commit 2a5ff735dc1074171a0cbb1dc228d6d6e907f571
It's identical to the hda-duplex codec, except that it advertises the
input as microphone instead of line-in and the output as speaker instead
of line-out. Some guest apps (microsoft netmeeting being one) are picky
when it comes to selecting the recording source and don't accept
line-in, so give them what they expect.
Amit Shah [Tue, 24 Apr 2012 14:03:59 +0000 (19:33 +0530)]
virtio-serial-bus: Unset guest_connected at reset and driver reset
When a guest driver resets the virtio status to not ready, or when qemu
is reset, reset all ports' guest_connected bit and let port users know
of this event if they have the guest_close() callback registered.
Reviewed-by: Alon Levy <alevy@redhat.com> Signed-off-by: Amit Shah <amit.shah@redhat.com>
Alon Levy [Mon, 23 Apr 2012 15:23:10 +0000 (18:23 +0300)]
virtio-serial-bus: fix guest_connected init before driver init
guest_connected should be false before guest driver initialization, and
true after, both for multiport aware and non multiport aware drivers.
Don't set it before the guest_features are available; instead use
set_status which is called by io to VIRTIO_PCI_STATUS with
VIRTIO_CONFIG_S_DRIVER_OK by even older non multiport drivers.
[Amit: Add comment, tweak summary, only set guest_connected and not
reset it as a side-effect.]
Signed-off-by: Alon Levy <alevy@redhat.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Amit Shah <amit.shah@redhat.com>
Andreas Färber [Tue, 17 Apr 2012 17:22:58 +0000 (19:22 +0200)]
target-i386: Prepare "vendor" property for X86CPU
Using it now would incur converting the three x86_def_t vendor words
into a string for object_property_set_str(), then back to three words
in the "vendor" setter.
The built-in CPU definitions use numeric preprocessor defines to
initialize the three words in a charset-safe way, so do not change the
fields to char[12] just to use the setter.
Signed-off-by: Andreas Färber <afaerber@suse.de> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Andreas Färber [Tue, 17 Apr 2012 12:48:14 +0000 (14:48 +0200)]
target-i386: Add property getter for CPU model
Signed-off-by: Andreas Färber <afaerber@suse.de> Reviewed-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Andreas Färber [Tue, 17 Apr 2012 10:10:29 +0000 (12:10 +0200)]
target-i386: Add "family" property to X86CPU
Add the property early in the initfn so that it can be used in helpers
such as mce_init().
Signed-off-by: Andreas Färber <afaerber@suse.de> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
[AF: Add an error_free(), spotted by Michael Roth] Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Andreas Färber [Tue, 17 Apr 2012 14:15:15 +0000 (16:15 +0200)]
target-i386: Add range check for -cpu ,family=x
A family field value of 0xf and extended family field value of 0xff is
the maximum representable unsigned family number.
All other CPUID property values are bounds-checked, so add a check here
for symmetry before we adopt it in a property setter.
Signed-off-by: Andreas Färber <afaerber@suse.de> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Andreas Färber [Tue, 17 Apr 2012 16:21:52 +0000 (18:21 +0200)]
target-i386: Fix x86_cpuid_set_model_id()
Don't assume zeroed cpuid_model[] fields.
This didn't break anything yet but QOM properties should be able to set
the value to something else without setting an intermediate zero string.
Reviewed-by: Eduardo Habhost <ehabkost@redhat.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com>
[AF: Use memset() instead of for loop, suggested by Igor] Signed-off-by: Andreas Färber <afaerber@suse.de>
Jason Wang [Thu, 22 Mar 2012 10:02:24 +0000 (18:02 +0800)]
e1000: link auto-negotiation emulation
Indeed, there's nothing else except for the time spent on the
negotiation needs to be emulated. This is needed for resuming windows
guest from hibernation, as without a proper delay, qemu would send the
packet too early ( guest even does not have a proper intr handler),
which could lead windows guest hang.
This patch first introduces an array of function pointers to make it
possible to emulate per-register write behavior. Then traps the
PHY_CTRL register write and when guest want to restart the link auto
negotiation, we would down the link and mark the auto negotiation in
progress in PHY_STATUS register. After time, a timer with 500 ms (
which is the minimum timeout of auto-negotation specified in 802.3
spec). The link would be up when timer expired.
Test with resuming windows guest plus flood ping and linux ethtool
linkstatus test.
Signed-off-by: Jason Wang <jasowang@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Jason Wang [Thu, 22 Mar 2012 10:02:07 +0000 (18:02 +0800)]
e1000: introduce helpers to manipulate link status
This patch introduces helpers to change link status bit for phy/mac
register. This would help to reduce code duplication and would be used
by following patches.
Signed-off-by: Jason Wang <jasowang@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Stefan Weil [Tue, 10 Apr 2012 18:48:54 +0000 (20:48 +0200)]
eepro100: Fix multicast regression
Commit 7fc8d918b9674c3e9233d6d25da2457345d414a0 removed code from
eepro100.c and replaced it by different code: the code in net.c
returns bits 31...26, but eepro100 needs bits 7...2.
if (vq->last_avail_index != vring_avail_idx(vq)) {
read descriptor head at vq->last_avail_index;
}
In theory, processor can reorder descriptor head
read to happen speculatively before the index read.
this would trigger the following race:
host descriptor head read <- reads invalid head from ring
guest writes valid descriptor head
guest writes avail index
host avail index read <- observes valid index
as a result host will use an invalid head value.
This was not observed in the field by me but after
the experience with the previous two races
I think it is prudent to address this theoretical race condition.
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
This fixes an issue dual to the one fixed by
patch 'virtio: add missing mb() on notification'
and applies on top.
In this case, to enable vq kick to exit to host,
qemu writes out used flag then reads the
avail index. if these are reordered we get a race:
host avail index read: ring is empty
guest avail index write
guest flag read: exit disabled
host used flag write: enable exit
which results in a lost exit: host will never be notified about the
avail index update. Again, happens in the field but only seems to
trigger on some specific hardware.
Insert an smp_mb barrier operation to ensure the correct ordering.
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
During normal operation, virtio first writes a used index
and then checks whether it should interrupt the guest
by reading guest avail index/flag values.
Guest does the reverse: writes the index/flag,
then checks the used ring.
The ordering is important: if host avail flag read bypasses the used
index write, we could in effect get this timing:
host avail flag read
guest enable interrupts: avail flag write
guest check used ring: ring is empty
host used index write
which results in a lost interrupt: guest will never be notified
about the used ring update.
This actually can happen when using kvm with an io thread,
such that the guest vcpu and qemu run on different host cpus,
and this has actually been observed in the field
(but only seems to trigger on very specific processor types)
with userspace virtio: vhost has the necessary smp_mb()
in place to prevent the regordering, so the same workload stalls
forever waiting for an interrupt with vhost=off but works
fine with vhost=on.
Insert an smp_mb barrier operation in userspace virtio to
ensure the correct ordering.
Applying this patch fixed the race condition we have observed.
Tested on x86_64. I checked the code generated by the new macro
for i386 and ppc but didn't run virtio.
Note: mb could in theory be implemented by __sync_synchronize, but this
would make us hit old GCC bugs. Besides old GCC
not implementing __sync_synchronize at all, there were bugs
http://gcc.gnu.org/bugzilla/show_bug.cgi?id=36793
in this functionality as recently as in 4.3.
As we need asm for rmb,wmb anyway, it's just as well to
use it for mb.
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Peter Chubb [Fri, 20 Apr 2012 05:32:30 +0000 (15:32 +1000)]
Limit ptimer rate to something achievable
If a guest sets very short timeouts, and asks for a timer to be reloaded on
timeout, QEMU can go to 100%CPU utilisation and become unresponsive,
as it is spending all its time generating timeout interrupts. On real
hardware this doesn't matter, as the interrupts are just coalesced,
and the effect is to have the interrupt asserted all the time.
This patch is a band-aid, that prevents timeouts less than 10
microseconds from being set. 10 microseconds is a limit that was
determined empirically on a variety of machines as the shortest that
allowed QEMU to pick up a control-a c sequence to get at the monitor.
Reported-by: Anna Lyons <anna.lyons@nicta.com.au> Signed-off-by: Peter Chubb <peter.chubb@nicta.com.au> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
Andreas Färber [Thu, 5 Apr 2012 11:21:46 +0000 (13:21 +0200)]
qom: Refine container_get() to allow using a custom root
Specify the root to search from as argument. This avoids hardcoding
"/machine" in some places and makes it more flexible.
Signed-off-by: Andreas Färber <afaerber@suse.de> Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: Anthony Liguori <anthony@codemonkey.ws> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
Sparc Debian 5.0.8 does not define __suseconds_t as long,
but FMT_timeval expects %ld.
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Richard Henderson <rth@twiddle.net> Cc: Anthony Liguori <aliguori@us.ibm.com> Cc: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
Stefan Weil [Thu, 19 Apr 2012 20:27:14 +0000 (22:27 +0200)]
qemu-char: Fix crash when switching consoles
qemu-system-arm (and other system emulations) crashes with SDL when
the user switches consoles (Alt-Ctrl-F4).
We already check for NULL pointers in qemu_chr_fe_ioctl,
qemu_chr_be_can_write and other functions, so do this also
for s->chr_read in qemu_chr_be_write. This fixes the crash.
Signed-off-by: Stefan Weil <sw@weilnetz.de> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
configure: change meaning of --datadir to Autoconf convention
Autoconf uses --datadir for the /usr/share directory, not the
program-specific subdirectory inside /usr/share. This changes configure
to match autoconf behavior.
Note that this will break compatibility with existing build scripts.
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
As now that block handles only the prefix variable, the code can be much
simpler. This also removes the CONFIG_QEMU_PREFIX define as it is not
used by any C code.
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
This one will be kept because it is set directly by ./configure:
- CONFIG_QEMU_HELPERDIR
This patch keeps the 'prefix=*' (CONFIG_QEMU_PREFIX) pattern because
other variables may use $prefix on their config-host.mak definitions.
The remaining code will be simplified on a further patch.
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
projects / qemu.git / log