Commit Graph

34396 Commits

Author SHA1 Message Date
Stefano Stabellini
4aba9eb138 xen_backend: introduce xenstore_read_uint64 and xenstore_read_fe_uint64
Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
2014-07-07 10:37:40 +00:00
Stefan Hajnoczi
f4eb32b590 qmp: show QOM properties in device-list-properties
Devices can use a mix of qdev and QOM properties.  Currently only the
qdev properties are displayed by device-list-properties.

This patch extends the property enumeration algorithm to also display
QOM properties (excluding the implicit "type", "realized",
"hotpluggable", and "parent_bus" properties).

When a qdev property exists, use the qdev type name to preserve
backwards compatibility.  QOM type names can be different for bool (qdev
on/off) and str (used by qdev pointers).

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-07-07 11:10:05 +02:00
Ming Lei
dd67c1d7e7 dataplane: submit I/O as a batch
Before commit 580b6b2aa2(dataplane: use the QEMU block
layer for I/O), dataplane for virtio-blk submits block
I/O as a batch.

This commit 580b6b2aa2 replaces the custom linux AIO
implementation(including submit I/O as a batch) with QEMU
block layer, but this commit causes ~40% throughput regression
on virtio-blk performance, and removing submitting I/O
as a batch is one of the causes.

This patch applies the newly introduced bdrv_io_plug() and
bdrv_io_unplug() interfaces to support submitting I/O
at batch for Qemu block layer, and in my test, the change
can improve throughput by ~30% with 'aio=native'.

Following my fio test script:

	[global]
	direct=1
	size=4G
	bsrange=4k-4k
	timeout=40
	numjobs=4
	ioengine=libaio
	iodepth=64
	filename=/dev/vdc
	group_reporting=1

	[f]
	rw=randread

Result on one of my small machine(host: x86_64, 2cores, 4thread, guest: 4cores):
	- qemu master: 65K IOPS
	- qemu master with these patches: 92K IOPS
	- 2.0.0 release(dataplane using custom linux aio): 104K IOPS

Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Ming Lei <ming.lei@canonical.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-07-07 11:05:17 +02:00
Ming Lei
1b3abdcccf linux-aio: implement io plug, unplug and flush io queue
This patch implements .bdrv_io_plug, .bdrv_io_unplug and
.bdrv_flush_io_queue callbacks for linux-aio Block Drivers,
so that submitting I/O as a batch can be supported on linux-aio.

[Unprocessed requests are completed with -EIO instead of a bogus ret
value.
--Stefan]

Signed-off-by: Ming Lei <ming.lei@canonical.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-07-07 11:05:17 +02:00
Ming Lei
448ad91db4 block: block: introduce APIs for submitting IO as a batch
This patch introduces three APIs so that following
patches can support queuing I/O requests and submitting them
as a batch for improving I/O performance.

Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Ming Lei <ming.lei@canonical.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-07-07 11:05:17 +02:00
Le Tan
5a18e67dfd ahci: map memory via device's address space instead of address_space_memory
In map_page() in hw/ide/ahci.c, replace cpu_physical_memory_map() and
cpu_physical_memory_unmap() with dma_memory_map() and dma_memory_unmap(),
because ahci devices should not access memory directly but via their address
space. Add an AddressSpace parameter to map_page(). In order to call
map_page(), we should pass the AHCIState.as as the AddressSpace argument.

Signed-off-by: Le Tan <tamlokveer@gmail.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-07-07 10:22:43 +02:00
Markus Armbruster
aa729704f4 raw-posix: Fix raw_getlength() to always return -errno on error
We got a merry mix of -1 and -errno here.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Benoit Canet <benoit@irqsave.net>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-07-07 09:41:29 +02:00
Benoît Canet
a42a1facb7 qemu-iotests: Disable Quorum testing in 041 when Quorum is not builtin
This avoid breaking tests on RHEL6 where gnutls is too old for quorum to be
built by default.

Signed-off-by: Benoit Canet <benoit@irqsave.net>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-07-07 09:15:29 +02:00
Reza Jelveh
d02f8adc6d ahci.c: mask unused flags when reading size PRDT DBC
The data byte count(DBC) read from the description information is defined for
bits 21:00. Bits 30:22 are reserved and bit 31 is the Interrupt on Completion
(I) flag.

Completion interrupts are triggered after every transaction instead of on
I-flag in QEMU. tbl_entry_size is a signed integer and improperly reading the
DBC leads to a negative offset that causes sglist allocation to fail.

Signed-off-by: Reza Jelveh <reza.jelveh@tuhh.de>
Reviewed-by: Alexander Graf <agraf@suse.de>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: John Snow <jsnow@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-07-07 09:15:29 +02:00
Stefan Hajnoczi
37253e1ec8 MAINTAINERS: add Stefan Hajnoczi to IDE maintainers
Make Stefan officially co-maintain hw/ide/ with Kevin.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Acked-by: Kevin Wolf <kwolf@redhat.com>
2014-07-07 09:15:29 +02:00
Kevin Wolf
5a0f6fd5c8 mirror: Fix qiov size for short requests
When mirroring an image of a size that is not a multiple of the
mirror job granularity, the last request would have the right nb_sectors
argument, but a qiov that is rounded up to the next multiple of the
granularity. Don't do this.

This fixes a segfault that is caused by raw-posix being confused by this
and allocating a buffer with request length, but operating on it with
qiov length.

[s/Driver/Drive/ in qemu-iotests 041 as suggested by Eric
--Stefan]

Reported-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Tested-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-07-07 09:15:29 +02:00
Chunyan Liu
bc3a7f90ff Fix nocow typos in manpage
Signed-off-by: Chunyan Liu <cyliu@suse.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-07-07 09:15:29 +02:00
Kirill Batuzov
3f0838ab85 qemu-char: add chr_add_watch support in mux chardev
Forward chr_add_watch call from mux chardev to underlying
implementation.

This should fix bug #1335444

Signed-off-by: Kirill Batuzov <batuzovk@ispras.ru>
Acked-by: Paolo Bonzini <pbonzini@redhat.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2014-07-06 09:13:54 +03:00
Paolo Bonzini
8b81bb3b06 virtio-pci: fix MSI memory region use after free
After memory region QOMification QEMU is stricter in detecting
wrong usage of the memory region API.  Here it detected a
memory_region_destroy done before the corresponding
memory_region_del_subregion; the memory_region_destroy is
done by msix_uninit_exclusive_bar, the memory_region_del_subregion
is done by the PCI core's pci_unregister_io_regions before
pc->exit is called.

The problem was introduced by
commit 06a1307379
    virtio-pci: add device_unplugged callback
As noted in that commit log, virtio device kick callbacks need to be
stopped before generic virtio is cleaned up. This is because these are
notifications from pci proxy to the generic virtio device so they need
to be stopped in the unplug call before the virtio device is unrealized.
However interrupts are notifications from the virtio device to
the pci proxy so they need to stay around while the device
is realized.

The memory API misuse caused an assertion when hot-unplugging virtio
devices.  Using the API correctly fixes the assertion.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2014-07-06 09:13:54 +03:00
Eduardo Habkost
dd98b71f48 qdev: Fix crash when using non-device class name on -global
This fixes the following crash:

    $ qemu-system-x86_64 -global container.xxx=y
    hw/core/qdev-properties-system.c:399:qdev_add_one_global: Object 0x7f7eff234100 is not an instance of type device
    Aborted (core dumped)

New behavior will be to just warn, just like when non-existing clas
names are used:

    $ qemu-system-x86_64 -global container.xxx=y
    qemu-system-x86_64: Warning: "-global container.xxx=y" not used

Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Tested-by: Don Slutz <dslutz@verizon.com>
2014-07-06 09:13:54 +03:00
Eduardo Habkost
319627006a qdev: Don't abort() in case globals can't be set
It would be much better if we didn't terminate QEMU inside
device_post_init(), but at least exiting cleanly is better than aborting
and dumping core.

Before this patch:

    $ qemu-system-x86_64 -global cpu.xxx=y
    qemu-system-x86_64: Property '.xxx' not found
    Aborted (core dumped)

After this patch:

    $ qemu-system-x86_64 -global cpu.xxx=y
    qemu-system-x86_64: Property '.xxx' not found

Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-By: Igor Mammedov <imammedo@redhat.com>
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2014-07-06 09:13:54 +03:00
Ming Lei
b7c9285b8d hw/virtio: enable common virtio feature for mmio device
Both 'indirect_desc' and 'event_idx' are bus independent features,
and they should be enabled for mmio devices too.

On arm64 quad core VM(qemu-kvm), the patch can increase block I/O
performance a lot with latest linux tree:
        - without the patch: 14K IOPS
        - with the patch: 34K IOPS

fio script:
        [global]
        direct=1
        bsrange=4k-4k
        timeout=10
        numjobs=4
        ioengine=libaio
        iodepth=64

        filename=/dev/vdc
        group_reporting=1

        [f1]
        rw=randread

Cc: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Ming Lei <ming.lei@canonical.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2014-07-06 09:13:54 +03:00
Igor Mammedov
22dc50d758 acpi: fix typo in memory hotplug MMIO region name
Reported-by: Sergey Fionov <fionov@gmail.com>
Signed-off-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
2014-07-06 09:13:54 +03:00
Le Tan
efc8188e93 pci: assign devfn to pci_dev before calling pci_device_iommu_address_space()
In function do_pci_register_device() in file hw/pci/pci.c, move the assignment
of pci_dev->devfn to the position before the call to
pci_device_iommu_address_space(pci_dev) which will use the value of
pci_dev->devfn.

Fixes: 9eda7d373e
    pci: Introduce helper to retrieve a PCI device's DMA address space

Cc: qemu-stable@nongnu.org
Signed-off-by: Le Tan <tamlokveer@gmail.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2014-07-06 09:13:54 +03:00
Kirill Batuzov
812c1057f6 Handle G_IO_HUP in tcp_chr_read for tcp chardev
Since commit cdaa86a54b
("Add G_IO_HUP handler for socket chardev")
GLib limitation results in a bug on Windows host. Steps to reproduce:

Start qemu: qemu-system-i386 -qmp tcp:127.0.0.1:4444:server:nowait
Connect with telnet: telnet 127.0.0.1 4444
Try sending some data from telnet.
Expected result: answers from QEMU.
Observed result: no answers (actually tcp_chr_read is not called at all).

Due to GLib limitations it is not possible to create several watches on one
channel on Windows hosts. See bug #338943 in GNOME bugzilla for details:
https://bugzilla.gnome.org/show_bug.cgi?id=338943

This reimplements commit cdaa86a54b
("Add G_IO_HUP handler for socket chardev") using a single watch:

Handle G_IO_HUP in tcp_chr_read instead. It is already watched by a
corresponding watch.  Remove the second watch with its handler.

Cc: Antonios Motakis <a.motakis@virtualopensystems.com>
Cc: Nikolay Nikolaev <n.nikolaev@virtualopensystems.com>
Cc: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Kirill Batuzov <batuzovk@ispras.ru>
Signed-off-by: Nikita Belov <zodiac@ispras.ru>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2014-07-06 09:13:54 +03:00
Ming Lei
85d1277e66 virtio: move common virtio properties to bus class device
The two common virtio features can be defined per bus, so move all
into bus class device to make code more clean.

As discussed with cornelia, s390-virtio-blk doesn't support
the two features at all, so keep s390-virtio as it.

Acked-by: Cornelia Huck <cornelia.huck@de.ibm.com> #for s390 ccw
Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Ming Lei <ming.lei@canonical.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

MST: rebase and resolve conflicts
2014-07-06 09:13:54 +03:00
Igor Mammedov
9b79a76cdb pc-dimm: error out if memory hotplug is not enabled
fixes QEMU abort in case it's started without memory
hotplug enabled.

as result of fix it will print following messages:
"
-device pc-dimm,id=d1,memdev=m1: memory hotplug is not enabled, enable it on startup
-device pc-dimm,id=d1,memdev=m1: Device 'pc-dimm' could not be initialized
"

Also fixup assert condition to detect hotplug address
space overflow.

Signed-off-by: Igor Mammedov <imammedo@redhat.com>
Reported-by:  Hu Tao <hutao@cn.fujitsu.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2014-07-06 09:13:54 +03:00
Hu Tao
0462faee67 numa: check for busy memory backend
Specifying the same memory backend twice leads to an assert:

./x86_64-softmmu/qemu-system-x86_64 -m 512M -enable-kvm -object
memory-backend-ram,size=256M,id=ram0 -numa node,nodeid=0,memdev=ram0
-numa node,nodeid=1,memdev=ram0
qemu-system-x86_64: /scm/qemu/memory.c:1506:
memory_region_add_subregion_common: Assertion `!subregion->container'
failed.
Aborted (core dumped)

Detect and exit with an error message instead.

Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Signed-off-by: Hu Tao <hutao@cn.fujitsu.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2014-07-06 09:13:53 +03:00
Nikolay Nikolaev
e06cbc376e qtest: enable vhost-user-test
Use qtest-obj-y to get the right library order. CONFIG_POSIX ensures
mingw compilation won't break.

Signed-off-by: Nikolay Nikolaev <n.nikolaev@virtualopensystems.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

MST: whitespace tweak
2014-07-06 09:13:53 +03:00
James Hogan
0a2672b7ea mips/kvm: Init EBase to correct KSEG0
The EBase CP0 register is initialised to 0x80000000, however with KVM
the guest's KSEG0 is at 0x40000000. The incorrect value doesn't get
passed to KVM yet as KVM doesn't implement the EBase register, however
we should set it correctly now so as not to break migration/loadvm to a
future version of QEMU that does support EBase.

Cc: Aurelien Jarno <aurelien@aurel32.net>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: James Hogan <james.hogan@imgtec.com>
Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-07-05 11:53:07 +02:00
Eduardo Otubo
9d9de254c2 MAINTAINERS: seccomp: change email contact for Eduardo Otubo
Signed-off-by: Eduardo Otubo <eduardo.otubo@profitbricks.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-07-03 12:36:15 +01:00
Peter Maydell
92259b7f43 Update version for v2.1.0-rc0 release
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-07-01 18:48:01 +01:00
Gonglei
015a33bd05 net: add mmsghdr struct check for L2TPV3
The mmsghdr struct is only introduced in Linux 2.6.32; add a
configure check for it and disable L2TPV3 on hosts which are
too old to provide it, rather than simply failing to compile.

Reported-by: chenliang <chenliang88@huawei.com>
Signed-off-by: Gonglei <arei.gonglei@huawei.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 1404219488-11196-1-git-send-email-arei.gonglei@huawei.com
[PMM: cleaned up commit message and corrected kernel version number]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-07-01 17:42:23 +01:00
Peter Maydell
596742db33 usb bugfixes.
-----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2.0.22 (GNU/Linux)
 
 iQIcBAABAgAGBQJTsrzXAAoJEEy22O7T6HE4XLkP/33KnbGclkNTHot1hwdYeVEJ
 dgzqi5r+cJ7MPJdZ0D8G07ifOrUjQJ6PBAIEWLcePsjeiM1OqBf61XekncEW4oTR
 0Xh4PtRUZPlIBH06E+HEOzuaePxN3Yk5JhCk13HTParoxk8ZvhcVqXog16jl2geR
 NJP18YEYKy0i7zidm62BUWL5uCSqhnzJbLDm6iFcmpSDwrHb3ZGf3zqYw0EVHNrH
 2h17LeOJWrxbe1qjAKOQf8w0D5H+0Xw1Hx2vfj+/gfIndQnfqZLwfu9azCnDcRJg
 V/EFPRLRx3ytl3EfJDAu24jR5lS6A3ePLDGQDNb7k97JGu11MZ7OoDp7ssmvur6T
 YyvWY82YP3GDGwFrjwv8JKT+1KRgHRkyv/s1QYlDFFVmKPLKA+15VVhIxz59m/Mm
 C3IstLp+fEpA6/JP3lqa2rcj6xOsTXfU6Bo01dFkoQuJ3w39vk0w0V1x1aungYMU
 FpJJwybBeb8iJz4imtQ8R29687jxl3A5lqjj/mMMPyXn7D5ry4MnGFeJpHACCxT9
 Edx/JzN+vgeHbaXHMUHiEV9SaKQlqtabWhu4uutjhVPoLYinnUL3aZ0Acl8kFF/a
 EGfVPFNDodp3SBfLFPI7rV23QYsJSRQU9wewoMXshAvueqRxOWZLb1hrjCwEIXVy
 QaHF4E+lS5k7iIPjDz9v
 =Ssmc
 -----END PGP SIGNATURE-----

Merge remote-tracking branch 'remotes/kraxel/tags/pull-usb-20140701-1' into staging

usb bugfixes.

# gpg: Signature made Tue 01 Jul 2014 14:51:19 BST using RSA key ID D3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
# gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
# gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

* remotes/kraxel/tags/pull-usb-20140701-1:
  ccid-card-emulated: use EventNotifier
  usb: initialize libusb_device to avoid crash
  usb: Fix usb-bt-dongle initialization.
  input: fix jumpy mouse cursor with USB mouse emulation

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-07-01 16:16:19 +01:00
Peter Maydell
f9119a2572 vnc: two bugfixes (by Peter Lieven).
-----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2.0.22 (GNU/Linux)
 
 iQIcBAABAgAGBQJTspxDAAoJEEy22O7T6HE4OpMQAKiCe8mUPJWQvNKOHBMOe1Fu
 8jEj9zaH65e+XoFKQsI86VgWSUPM8Iout/YcBJOslUjI5agIUwkAdd8w7wxUUBU9
 OI0cBn0CzB3F0nAZc/CS8ZyqD0LZnx9ByVgM0XnbemNtg/bi3TvM4S0G0xBEMxtm
 eEv7eQ4PCAfipthz3gyAcBu2BZmokk8kbQwHWKZataBeV6Q2HRKjymxRc8D+eEBw
 zU001HYcpJmJ0yh+rVzx5o2yDscvCLjaFotSGZiDB6UqRhTS369EgF09PlN28m80
 1/y7Q7Utqg6EboYIFSgRBWjaKW4A/TEugwZYlUM04zdvIfKkAuWDmxZCB/X/jH8d
 UVvPR2ANG59bZAV/00zE1cT8VBXzLXp5OudZ1/Ao8iSGKlm7t6SY8juUV7uYz89+
 bQ4FqyMJNNcmn2UoxwdZhA7fF9RqGNcnPiDP2zvJu1AT8j4mf7ivnjuIfg3q0Z5m
 fs+nP6IOjChILsNSkVT0IOJamUraoE2hMqWKcKu5jz5ytJvlPniimQgil3U33fTZ
 d0BA3WbmIgcEGGzSIH/ZvZo20dEAc9FPhq0h1LdGiWMqRrRejcDH1MivkMpmxZCB
 umrg5qgYZbZnKfgzrc/BUN8ZEaLdmdVjoY5gW9Mpkw/QKQhnWZTb7U3+2CtkAanx
 uZzknIf/7736zdlHvzDt
 =ueTm
 -----END PGP SIGNATURE-----

Merge remote-tracking branch 'remotes/kraxel/tags/pull-vnc-20140701-1' into staging

vnc: two bugfixes (by Peter Lieven).

# gpg: Signature made Tue 01 Jul 2014 12:32:19 BST using RSA key ID D3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
# gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
# gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

* remotes/kraxel/tags/pull-vnc-20140701-1:
  ui/vnc: fix potential memory corruption issues
  ui/vnc: limit client_cut_text msg payload size

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-07-01 15:12:05 +01:00
Paolo Bonzini
c1129f6bff ccid-card-emulated: use EventNotifier
Shut up Coverity's complaint about unchecked fcntl return values,
and especially make the code simpler and more efficient.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-07-01 15:49:51 +02:00
Peter Maydell
1aa85f46b3 Tracing pull request
-----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQEcBAABAgAGBQJTsne7AAoJEJykq7OBq3PIUPQIAMITYb4Vki1zBSj8W4gJQtns
 y4kgINhCln20hQNiW2ytk6BLJJUpJRYQC4+GKA6fScaAIQsK5nI+4eqb9iSWilhg
 ECNPcV3oX54XnTBGzPN+5mJPwZU3JmRa5bpF1X5l+SdPXA2QDDq6dWiuxB+capty
 x2BiMLAsQodCWbEg5vx6jYj9CYScL3ZsIxtob+P1xwdeADjEGyDPNFG+Spiyzgf/
 XTzmopp3Mlp3sgt4xIYzBY5Xx8ieEkfHJI8TGx9DhpcJOgV1O9sKj97xl02ko3av
 WW+oH+INWExVLaHjplaB5XfrIMWihjr1OBEDUNJ13x9ikmkbeU+Ic2SDqpdNtuk=
 =j1BY
 -----END PGP SIGNATURE-----

Merge remote-tracking branch 'remotes/stefanha/tags/tracing-pull-request' into staging

Tracing pull request

# gpg: Signature made Tue 01 Jul 2014 09:56:27 BST using RSA key ID 81AB73C8
# gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>"
# gpg:                 aka "Stefan Hajnoczi <stefanha@gmail.com>"

* remotes/stefanha/tags/tracing-pull-request:
  trace: add qemu_system_powerdown_request and qemu_system_shutdown_request trace events

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-07-01 14:21:50 +01:00
Peter Maydell
8593efa4fb Block pull request
-----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQEcBAABAgAGBQJTsnWTAAoJEJykq7OBq3PIKXMH/0+fWDs4ZnAl32AVmHTYFNZS
 AJHkzdRCWAsq2E7jqoPficjZSy7oZMvgWN7t30SxljlhRVfilr+KXNHl0sxXFRAn
 rnjWIPBATcVYpHaPcjP85YTsJitjj08eUYVD2HgbtIarQyyUdhEG5l1voAI8oxkY
 7T92X+olbyI+NqdDUMvQUt0gdoptZPEnieCI5rScQQiwXKRv9uEJBYBSlTFJ5BTb
 6XOszj62Yk25W3Sq74yfvvecFhNIXAOlzXqD03DSKHos0pLIJhMxEeYZrKIacBqP
 HspYKFwOjRAflp3Pcv29m+6IjnL33IJJK6dou9Aou4UqsLRReDeeeiU1aX9ym2Q=
 =txun
 -----END PGP SIGNATURE-----

Merge remote-tracking branch 'remotes/stefanha/tags/block-pull-request' into staging

Block pull request

# gpg: Signature made Tue 01 Jul 2014 09:47:15 BST using RSA key ID 81AB73C8
# gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>"
# gpg:                 aka "Stefan Hajnoczi <stefanha@gmail.com>"

* remotes/stefanha/tags/block-pull-request: (23 commits)
  block: add backing-file option to block-stream
  block: extend block-commit to accept a string for the backing file
  block: add helper function to determine if a BDS is in a chain
  block: add QAPI command to allow live backing file change
  qapi: Change back sector-count to sectors-count in quorum QAPI events.
  block/cow: Avoid use of uninitialized cow_bs in error path
  block: simplify bdrv_find_base() and bdrv_find_overlay()
  block: make 'top' argument to block-commit optional
  iotests: Add more tests to quick group
  iotests: Add qemu tests to quick group
  iotests: Simplify qemu-iotests-quick.sh
  qemu-img create: add 'nocow' option
  virtio-blk: remove need for explicit x-data-plane=on option
  qdev: drop iothread property type
  virtio-blk: replace x-iothread with iothread link property
  virtio-blk: move qdev properties into virtio-blk.c
  virtio: fix virtio-blk child refcount in transports
  virtio-blk: drop virtio_blk_set_conf()
  virtio-blk: use aliases instead of duplicate qdev properties
  qdev: add qdev_alias_all_properties()
  ...

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-07-01 13:13:04 +01:00
Peter Lieven
bea60dd767 ui/vnc: fix potential memory corruption issues
this patch makes the VNC server work correctly if the
server surface and the guest surface have different sizes.

Basically the server surface is adjusted to not exceed VNC_MAX_WIDTH
x VNC_MAX_HEIGHT and additionally the width is rounded up to multiple of
VNC_DIRTY_PIXELS_PER_BIT.

If we have a resolution whose width is not dividable by VNC_DIRTY_PIXELS_PER_BIT
we now get a small black bar on the right of the screen.

If the surface is too big to fit the limits only the upper left area is shown.

On top of that this fixes 2 memory corruption issues:

The first was actually discovered during playing
around with a Windows 7 vServer. During resolution
change in Windows 7 it happens sometimes that Windows
changes to an intermediate resolution where
server_stride % cmp_bytes != 0 (in vnc_refresh_server_surface).
This happens only if width % VNC_DIRTY_PIXELS_PER_BIT != 0.

The second is a theoretical issue, but is maybe exploitable
by the guest. If for some reason the guest surface size is bigger
than VNC_MAX_WIDTH x VNC_MAX_HEIGHT we end up in severe corruption since
this limit is nowhere enforced.

Signed-off-by: Peter Lieven <pl@kamp.de>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-07-01 13:26:40 +02:00
Peter Lieven
f9a70e7939 ui/vnc: limit client_cut_text msg payload size
currently a malicious client could define a payload
size of 2^32 - 1 bytes and send up to that size of
data to the vnc server. The server would allocated
that amount of memory which could easily create an
out of memory condition.

This patch limits the payload size to 1MB max.

Please note that client_cut_text messages are currently
silently ignored.

Signed-off-by: Peter Lieven <pl@kamp.de>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-07-01 13:26:40 +02:00
Jincheng Miao
3ce2144538 usb: initialize libusb_device to avoid crash
If libusb_get_device_list() fails, the uninitialized local variable
libusb_device would be passed to libusb_free_device_list(), that
will cause a crash, like:
(gdb) bt
 #0  0x00007fbbb4bafc10 in pthread_mutex_lock () from /lib64/libpthread.so.0
 #1  0x00007fbbb233e653 in libusb_unref_device (dev=0x6275682d627375)
     at core.c:902
 #2  0x00007fbbb233e739 in libusb_free_device_list (list=0x7fbbb6e8436e,
     unref_devices=<optimized out>) at core.c:653
 #3  0x00007fbbb6cd80a4 in usb_host_auto_check (unused=unused@entry=0x0)
     at hw/usb/host-libusb.c:1446
 #4  0x00007fbbb6cd8525 in usb_host_initfn (udev=0x7fbbbd3c5670)
     at hw/usb/host-libusb.c:912
 #5  0x00007fbbb6cc123b in usb_device_init (dev=0x7fbbbd3c5670)
     at hw/usb/bus.c:106
 ...

So initialize libusb_device at the begin time.

Signed-off-by: Jincheng Miao <jmiao@redhat.com>
Reviewed-by: Gonglei <arei.gonglei@huawei.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-07-01 13:26:37 +02:00
Hani Benhabiles
c340a284f3 usb: Fix usb-bt-dongle initialization.
Due to an incomplete initialization, adding a usb-bt-dongle device through HMP
or QMP will cause a segmentation fault.

Signed-off-by: Hani Benhabiles <hani@linux.com>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-07-01 13:26:37 +02:00
Christian Burger
35e83d10f2 input: fix jumpy mouse cursor with USB mouse emulation
Guest mouse pointer was jumpy, when moving host mouse in the vertical direction (see bug #1327800).

Signed-off-by: Christian Burger <christian@krikkel.de>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-07-01 13:26:37 +02:00
Peter Maydell
c26f3a0a6d Merge remote-tracking branch 'remotes/bonzini/memory' into staging
* remotes/bonzini/memory:
  qdev: correctly send DEVICE_DELETED for recursively-deleted devices
  memory: do not give a name to the internal exec.c regions
  memory: MemoryRegion: Add size property
  memory: MemoryRegion: Add may-overlap and priority props
  memory: MemoryRegion: Add container and addr props
  memory: MemoryRegion: replace owner field with QOM parent
  memory: MemoryRegion: QOMify
  memory: MemoryRegion: use /machine as default owner
  libqtest: escape strings in QMP commands, fix leak
  qom: object: Ignore refs/unrefs of NULL
  qom: object: remove parent pointer when unparenting
  mc146818rtc: add "rtc-time" link to "/machine/rtc"
  qom: allow creating an alias of a child<> property
  qom: add a generic mechanism to resolve paths
  qom: add object_property_add_alias()

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-07-01 11:55:49 +01:00
Peter Maydell
b3959efdbb QOM and device refactorings
* QOM unparenting cleanup
 * IRQ conversion to QOM
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2.0.22 (GNU/Linux)
 
 iQIcBAABAgAGBQJTsiT7AAoJEPou0S0+fgE/bqAP/3PpG90lQQ39wWHfWRXKmwiY
 b8PnIFsZKnc6Gt3qX1jk41VurnuMjPSpkxsmkTqHPACInSBU5B7hEUPlUaSAJurN
 ooso2cmvMCNbtS8HFjlGYqr5+Q7ZyI2sIqSN3yegZu9jICMKnseQWaNoSepgc9wn
 uDukiza2ciYqQoNNj1NpoJoRKRcTWYNxhwT8dFeu6Zs60iUtVMCMfiwWUNjx4JMd
 p4hUr6MEx6KujBsiRMQpnXmQi3pQRfEQcVjVsJhEf1tqmeMQsIBxzfGczJheUjf8
 tnubrfUlnv0k8rFUm/MW5fvluvq7B6Y9p8tXpEFeaXfc2kn7luynvO8yeRTmw0ud
 3BKLDoOvQlmA+GQSAzNPF1rhrrHV6mDAhwZ5sl0Pkofl0AQEne4NchFrtpyoUAuX
 IzfWP4/rrWc9HWFo6fe4I195A7jW9wPie84ykE/PNXPVLTlypVidriWHU/4RAkMz
 6DxDcgAVYprtg9Ya6qqWo7MAELeeAqBHy0/iQ/m/CWMM8FFQBjxxHSpUybiOuV31
 DVodMHn39P12FzIgGs8u5JK/cmwALQOq+sZu6h2++D6Nk6S+7KB3AhxwMhWfi91g
 cS5qIjfTqgeWcXqLoc5JtrOvri94WJo/J1fOac5/XKjXubvvXQLuO5LylR+n+kcN
 YzF5Jx5kz8Q9KahkJoOB
 =KXR0
 -----END PGP SIGNATURE-----

Merge remote-tracking branch 'remotes/afaerber/tags/qom-devices-for-2.1' into staging

QOM and device refactorings

* QOM unparenting cleanup
* IRQ conversion to QOM

# gpg: Signature made Tue 01 Jul 2014 04:03:23 BST using RSA key ID 3E7E013F
# gpg: Good signature from "Andreas Färber <afaerber@suse.de>"
# gpg:                 aka "Andreas Färber <afaerber@suse.com>"

* remotes/afaerber/tags/qom-devices-for-2.1:
  irq: Slim conversion of qemu_irq to QOM
  irq: Allocate IRQs individually
  hw: Fix qemu_allocate_irqs() leaks
  sdhci: Fix misuse of qemu_free_irqs()
  qom: Remove parent pointer when unparenting

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-07-01 11:00:53 +01:00
Peter Maydell
d94a658712 Merge remote-tracking branch 'remotes/bonzini/scsi-next' into staging
* remotes/bonzini/scsi-next:
  configure: Fix -lm test, so that tools can be compiled on hosts that require -lm
  virtio-scsi: scsi events must be converted to target endianness
  virtio-scsi: virtio_scsi_push_event() lacks VirtIOSCSIReq parsing

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-07-01 10:28:52 +01:00
Yang Zhiyong
bc78cff975 trace: add qemu_system_powerdown_request and qemu_system_shutdown_request trace events
We have the experience that the guest doesn't stop successfully
though it was instructed to shut down.

The root cause may be not in QEMU mostly.  However, QEMU is often
suspected at the beginning just because the issue occurred in
virtualization environment.

Therefore, we need to affirm that QEMU received the shutdown
request and raised ACPI irq from "virsh shutdown" command,
virt-manger or stopping QEMU process to the VM .
So that we can affirm the problems was belonged to the Guset OS
rather than the QEMU itself.

When we stop guests by "virsh shutdown" command or virt-manger,
or stopping QEMU process, qemu_system_powerdown_request() or
qemu_system_shutdown_request() is called. Then the below functions
in main_loop_should_exit() of Vl.c are called roughly in the
following order.

	if (qemu_powerdown_requested())
		qemu_system_powerdown()
			monitor_protocol_event(QEVENT_POWERDOWN, NULL)

	OR

	if(qemu_shutdown_requested()}
		monitor_protocol_event(QEVENT_SHUTDOWN, NULL);

The tracepoint of monitor_protocol_event() already exists, but no
tracepoints are defined for qemu_system_powerdown_request() and
qemu_system_shutdown_request(). So this patch adds two tracepoints for
the two functions. We believe that it will become much easier to
isolate the problem mentioned above by these tracepoints.

Signed-off-by: Yang Zhiyong <yangzy.fnst@cn.fujitsu.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-07-01 10:56:13 +02:00
Jeff Cody
13d8cc515d block: add backing-file option to block-stream
On some image chains, QEMU may not always be able to resolve the
filenames properly, when updating the backing file of an image
after a block job.

For instance, certain relative pathnames may fail, or drives may
have been specified originally by file descriptor (e.g. /dev/fd/???),
or a relative protocol pathname may have been used.

In these instances, QEMU may lack the information to be able to make
the correct choice, but the user or management layer most likely does
have that knowledge.

With this extension to the block-stream api, the user is able to change
the backing file of the active layer as part of the block-stream
operation.

This allows the change to be 'safe', in the sense that if the attempt
to write the active image metadata fails, then the block-stream
operation returns failure, without disrupting the guest.

If a backing file string is not specified in the command, the backing
file string to use is determined in the same manner as it was
previously.

Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Jeff Cody <jcody@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-07-01 10:47:01 +02:00
Jeff Cody
54e2690090 block: extend block-commit to accept a string for the backing file
On some image chains, QEMU may not always be able to resolve the
filenames properly, when updating the backing file of an image
after a block commit.

For instance, certain relative pathnames may fail, or drives may
have been specified originally by file descriptor (e.g. /dev/fd/???),
or a relative protocol pathname may have been used.

In these instances, QEMU may lack the information to be able to make
the correct choice, but the user or management layer most likely does
have that knowledge.

With this extension to the block-commit api, the user is able to change
the backing file of the overlay image as part of the block-commit
operation.

This allows the change to be 'safe', in the sense that if the attempt
to write the overlay image metadata fails, then the block-commit
operation returns failure, without disrupting the guest.

If the commit top is the active layer, then specifying the backing
file string will be treated as an error (there is no overlay image
to modify in that case).

If a backing file string is not specified in the command, the backing
file string to use is determined in the same manner as it was
previously.

Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Jeff Cody <jcody@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-07-01 10:47:01 +02:00
Jeff Cody
5a6684d2b9 block: add helper function to determine if a BDS is in a chain
This is a small helper function, to determine if 'base' is in the
chain of BlockDriverState 'top'.  It returns true if it is in the chain,
and false otherwise.

If either argument is NULL, it will also return false.

Reviewed-by: Benoit Canet <benoit@irqsave.net>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Jeff Cody <jcody@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-07-01 10:47:01 +02:00
Jeff Cody
fa40e65622 block: add QAPI command to allow live backing file change
This allows a user to make a live change to the backing file recorded in
an open image.

The image file to modify can be specified 2 ways:

1) image filename
2) image node-name

Note: this does not cause the backing file itself to be reopened; it
merely changes the backing filename in the image file structure, and
in internal BDS structures.

It is the responsibility of the user to pass a filename string that
can be resolved when the image chain is reopened, and the filename
string is not validated.

A good analogy for this command is that it is a live version of
'qemu-img rebase -u', with respect to changing the backing file string.

[Jeff is offline so I respun this patch in his absence.  Dropped image
filename since using node-name is preferred and this is a new command.
No need to introduce the limitations of finding images by filename.
--Stefan]

Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Jeff Cody <jcody@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-07-01 10:46:38 +02:00
Alexey Kardashevskiy
f80ea9862f configure: Fix -lm test, so that tools can be compiled on hosts that require -lm
The existing test whether "-lm" needs to be included or not is
insufficient as it reports false negative on Fedora20/ppc64.
This happens because sin(0.0) is a constant value which compiler
can safely throw away and therefore there is no need to add "-lm".
As the result, qemu-nbd/qemu-io/qemu-img tools cannot compile.

This adds a global variable and uses it in the test to prevent
from optimization.

Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
[Use Peter's improvement on the test to fool LTO, and remove the
 now useless -lm addition in Makefile.target. - Paolo]
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-07-01 10:36:28 +02:00
Paolo Bonzini
352e8da743 qdev: correctly send DEVICE_DELETED for recursively-deleted devices
When a device is unparented (i.e. made completely hidden from management)
we want to send a DEVICE_DELETED event only if the device actually was
realized.  This avoids raising DEVICE_DELETED events when device_add
fails.

However, this does not work right for recursively-deleted
devices: the whole tree is _first_ unrealized, _then_ unparented.
Then device_unparent sees realized==false and fails to trigger
the event.  The solution is simply to move have_realized into
the DeviceState struct.  If device_add fails, we never set the
new field to true and DEVICE_DELETED is not sent.

Fixes qemu-iotests testcase 067 (broken by commit 5942a19, though that
commit in turn fixed a possible segfault in the same test).

Reported-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-07-01 10:20:42 +02:00
Paolo Bonzini
1f6245e5ab memory: do not give a name to the internal exec.c regions
There is no need to have them visible under /machine.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-07-01 10:20:41 +02:00
Peter Crosthwaite
52aef7bba7 memory: MemoryRegion: Add size property
To allow devices to dynamically resize the device. The motivation is
to allow devices with variable size to init their memory_region
without size early and then correctly populate size at realize() time.

Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-07-01 10:20:41 +02:00