date:20130117

On Wed, Jan 16, 2013 at 07:53:35PM +0100, Stefan Weil wrote:
 Am 15.12.2012 15:09, schrieb Stefan Weil:
 These patches improve the error report if the file format was
 specified explicitly (example: -drive file=myfile,format=qcow2)
 and the given format does not match the real format.
 
 This fixes those bugs:
 
 https://bugzilla.redhat.com/show_bug.cgi?id=556482
 https://bugs.launchpad.net/qemu/+bug/1090600
 
 [PATCH 1/4] block: Add special error code for wrong format
 [PATCH 2/4] block: Improve error report for wrong format
 [PATCH 3/4] block: Use new error code for wrong format in selected
 [PATCH 4/4] block/vdi: Improved return values from vdi_open and
 
 Hi Stefan und Kevin,
 
 these patches are still in my local queue.
 
 Do you plan to add them to the block queue, or would
 you prefer another solution for the open bug reports?

Looks okay to me.  I'm not thrilled about introducing a non-system error
code, would have rather have used EINVAL or ENOTTY.  But that's not a
killer and I see the reason you chose to do that.

Kevin: Any comments before I merge this?

Stefan

Re: [Qemu-devel] [Qemu-stable] [PATCH 1/2] win32-aio: Fix vectored reads


17.01.2013 00:19, Kevin Wolf пишет:

Copying data in the right direction really helps a lot!

Cc: qemu-sta...@nongnu.org
Signed-off-by: Kevin Wolf kw...@redhat.com
---
  block/win32-aio.c |2 +-
  1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/block/win32-aio.c b/block/win32-aio.c
index 46a5db7..53b82e6 100644
--- a/block/win32-aio.c
+++ b/block/win32-aio.c
@@ -84,7 +84,7 @@ static void win32_aio_process_completion(QEMUWin32AIOState *s,
  int i;

  for (i = 0; i  qiov-niov; ++i) {
-memcpy(p, qiov-iov[i].iov_base, qiov-iov[i].iov_len);
+memcpy(qiov-iov[i].iov_base, p, qiov-iov[i].iov_len);
  p += qiov-iov[i].iov_len;
  }
  g_free(waiocb-buf);


Actually this is just

   iov_from_buf(qiov-iov, qiov-niov, 0, waiocb-buf, -1);

Or is it iov_to_buf() ? :)

Thanks,

/mjt

Re: [Qemu-devel] [RFC] Add serial number to usbdevice when passthrough to VM

2013-01-17 Thread Gerd Hoffmann

  Hi,

 But as the backinfo's request, should we extented the usbdevice parameter
 like:
 
 --usbdevice host:vendor id[:product id[:serial number]?

-usbdevice is legacy syntax and isn't going to be extended.

Adding an serial property to usb-host is an option though.
Patches are welcome.

cheers,
  Gerd

Re: [Qemu-devel] [QEMU PATCH v2] virtio-net: introduce a new macaddr control

2013-01-17 Thread Amos Kong

On Thu, Jan 17, 2013 at 01:45:11PM +0800, Amos Kong wrote:
 On Thu, Jan 17, 2013 at 11:49:20AM +1030, Rusty Russell wrote:
  ak...@redhat.com writes:
   @@ -349,6 +351,14 @@ static int virtio_net_handle_mac(VirtIONet *n, 
   uint8_t cmd,
{
struct virtio_net_ctrl_mac mac_data;

   +if (cmd == VIRTIO_NET_CTRL_MAC_ADDR_SET  elem-out_num == 2 
   +elem-out_sg[1].iov_len == ETH_ALEN) {
   +/* Set MAC address */
   +memcpy(n-mac, elem-out_sg[1].iov_base, 
   elem-out_sg[1].iov_len);
   +qemu_format_nic_info_str(n-nic-nc, n-mac);
   +return VIRTIO_NET_OK;
   +}
  
  Does the rest of the net device still rely on the layout of descriptors?
 
 No, only info string of net client relies on n-mac

I misunderstood. There is no clear limitation of how much descriptor are
used for each vq command, but many commands rely on the layout of
descriptiors. eg:

virtio-net:
   VIRTIO_NET_CTRL_RX_PROMISC
   VIRTIO_NET_CTRL_RX_ALLMULTI
   VIRTIO_NET_CTRL_MAC_TABLE_SET
   etc
 
  If so, OK, we'll fix them all together.  If not, this introduces a new
  one.
  
  Cheers,
  Rusty.

Re: [Qemu-devel] [QEMU PATCH v2] virtio-net: introduce a new macaddr control

On Thu, Jan 17, 2013 at 01:45:11PM +0800, Amos Kong wrote:
 On Thu, Jan 17, 2013 at 11:49:20AM +1030, Rusty Russell wrote:
  ak...@redhat.com writes:
   @@ -349,6 +351,14 @@ static int virtio_net_handle_mac(VirtIONet *n, 
   uint8_t cmd,
{
struct virtio_net_ctrl_mac mac_data;

   +if (cmd == VIRTIO_NET_CTRL_MAC_ADDR_SET  elem-out_num == 2 
   +elem-out_sg[1].iov_len == ETH_ALEN) {
   +/* Set MAC address */
   +memcpy(n-mac, elem-out_sg[1].iov_base, 
   elem-out_sg[1].iov_len);
   +qemu_format_nic_info_str(n-nic-nc, n-mac);
   +return VIRTIO_NET_OK;
   +}
  
  Does the rest of the net device still rely on the layout of descriptors?
 
 No, only info string of net client relies on n-mac

I think the question is whether the hw/virtio-net.c code makes
assumptions about virtqueue descriptor layout (e.g. sg[0] is the header,
sg[1] is the data buffer).

The answer is yes, the control virtqueue function directly accesses
iov[n].

Additional patches would be required to convert the existing
hw/virtio-net.c code to make no assumptions about virtqueue descriptor
layout.  It's outside the scope of this series.

Stefan

[Qemu-devel] [PATCH V4 06/13] qemu-img: switch image retrieving function

2013-01-17 Thread Wenchao Xia

  Now qemu-img call block layer function to get image info and check
if error happens.

Signed-off-by: Wenchao Xia xiaw...@linux.vnet.ibm.com
Reviewed-by: Eric Blake ebl...@redhat.com
---
 qemu-img.c |   90 
 1 files changed, 6 insertions(+), 84 deletions(-)

diff --git a/qemu-img.c b/qemu-img.c
index 9dab48f..90f4bf4 100644
--- a/qemu-img.c
+++ b/qemu-img.c
@@ -1134,39 +1134,6 @@ static void dump_json_image_info_list(ImageInfoList 
*list)
 QDECREF(str);
 }
 
-static void collect_snapshots(BlockDriverState *bs , ImageInfo *info)
-{
-int i, sn_count;
-QEMUSnapshotInfo *sn_tab = NULL;
-SnapshotInfoList *info_list, *cur_item = NULL;
-sn_count = bdrv_snapshot_list(bs, sn_tab);
-
-for (i = 0; i  sn_count; i++) {
-info-has_snapshots = true;
-info_list = g_new0(SnapshotInfoList, 1);
-
-info_list-value= g_new0(SnapshotInfo, 1);
-info_list-value-id= g_strdup(sn_tab[i].id_str);
-info_list-value-name  = g_strdup(sn_tab[i].name);
-info_list-value-vm_state_size = sn_tab[i].vm_state_size;
-info_list-value-date_sec  = sn_tab[i].date_sec;
-info_list-value-date_nsec = sn_tab[i].date_nsec;
-info_list-value-vm_clock_sec  = sn_tab[i].vm_clock_nsec / 10;
-info_list-value-vm_clock_nsec = sn_tab[i].vm_clock_nsec % 10;
-
-/* XXX: waiting for the qapi to support qemu-queue.h types */
-if (!cur_item) {
-info-snapshots = cur_item = info_list;
-} else {
-cur_item-next = info_list;
-cur_item = info_list;
-}
-
-}
-
-g_free(sn_tab);
-}
-
 static void dump_json_image_info(ImageInfo *info)
 {
 Error *errp = NULL;
@@ -1184,54 +1151,6 @@ static void dump_json_image_info(ImageInfo *info)
 QDECREF(str);
 }
 
-static void collect_image_info(BlockDriverState *bs,
-   ImageInfo *info,
-   const char *filename)
-{
-uint64_t total_sectors;
-char backing_filename[1024];
-char backing_filename2[1024];
-BlockDriverInfo bdi;
-
-bdrv_get_geometry(bs, total_sectors);
-
-info-filename= g_strdup(filename);
-info-format  = g_strdup(bdrv_get_format_name(bs));
-info-virtual_size= total_sectors * 512;
-info-actual_size = bdrv_get_allocated_file_size(bs);
-info-has_actual_size = info-actual_size = 0;
-if (bdrv_is_encrypted(bs)) {
-info-encrypted = true;
-info-has_encrypted = true;
-}
-if (bdrv_get_info(bs, bdi) = 0) {
-if (bdi.cluster_size != 0) {
-info-cluster_size = bdi.cluster_size;
-info-has_cluster_size = true;
-}
-info-dirty_flag = bdi.is_dirty;
-info-has_dirty_flag = true;
-}
-bdrv_get_backing_filename(bs, backing_filename, sizeof(backing_filename));
-if (backing_filename[0] != '\0') {
-info-backing_filename = g_strdup(backing_filename);
-info-has_backing_filename = true;
-bdrv_get_full_backing_filename(bs, backing_filename2,
-   sizeof(backing_filename2));
-
-if (strcmp(backing_filename, backing_filename2) != 0) {
-info-full_backing_filename =
-g_strdup(backing_filename2);
-info-has_full_backing_filename = true;
-}
-
-if (bs-backing_format[0]) {
-info-backing_filename_format = g_strdup(bs-backing_format);
-info-has_backing_filename_format = true;
-}
-}
-}
-
 static void dump_human_image_info(ImageInfo *info)
 {
 char size_buf[128], dsize_buf[128];
@@ -1338,6 +1257,7 @@ static ImageInfoList *collect_image_info_list(const char 
*filename,
 ImageInfoList *head = NULL;
 ImageInfoList **last = head;
 GHashTable *filenames;
+Error *err = NULL;
 
 filenames = g_hash_table_new_full(g_str_hash, str_equal_func, NULL, NULL);
 
@@ -1359,9 +1279,11 @@ static ImageInfoList *collect_image_info_list(const char 
*filename,
 goto err;
 }
 
-info = g_new0(ImageInfo, 1);
-collect_image_info(bs, info, filename);
-collect_snapshots(bs, info);
+info = bdrv_query_image_info(bs, err);
+if (error_is_set(err)) {
+bdrv_delete(bs);
+goto err;
+}
 
 elem = g_new0(ImageInfoList, 1);
 elem-value = info;
-- 
1.7.1

Re: [Qemu-devel] [Qemu-stable] [PATCH 1/2] win32-aio: Fix vectored reads

Am 17.01.2013 09:33, schrieb Michael Tokarev:
 17.01.2013 00:19, Kevin Wolf пишет:
 Copying data in the right direction really helps a lot!

 Cc: qemu-sta...@nongnu.org
 Signed-off-by: Kevin Wolf kw...@redhat.com
 ---
   block/win32-aio.c |2 +-
   1 files changed, 1 insertions(+), 1 deletions(-)

 diff --git a/block/win32-aio.c b/block/win32-aio.c
 index 46a5db7..53b82e6 100644
 --- a/block/win32-aio.c
 +++ b/block/win32-aio.c
 @@ -84,7 +84,7 @@ static void win32_aio_process_completion(QEMUWin32AIOState 
 *s,
   int i;

   for (i = 0; i  qiov-niov; ++i) {
 -memcpy(p, qiov-iov[i].iov_base, qiov-iov[i].iov_len);
 +memcpy(qiov-iov[i].iov_base, p, qiov-iov[i].iov_len);
   p += qiov-iov[i].iov_len;
   }
   g_free(waiocb-buf);
 
 Actually this is just
 
 iov_from_buf(qiov-iov, qiov-niov, 0, waiocb-buf, -1);

True. Let's keep fix and cleanup separate, though. Feel free to send a
cleanup patch on top of this.

By the way, I think qiov-size instead of -1 would be nicer.

 Or is it iov_to_buf() ? :)

The corrected version is from.

Kevin

[Qemu-devel] buildbot failure in qemu on s390-next_x86_64_debian_6_0

2013-01-17 Thread qemu

The Buildbot has detected a new failure on builder s390-next_x86_64_debian_6_0 
while building qemu.
Full details are available at:
 
http://buildbot.b1-systems.de/qemu/builders/s390-next_x86_64_debian_6_0/builds/516

Buildbot URL: http://buildbot.b1-systems.de/qemu/

Buildslave for this Build: yuzuki

Build Reason: The Nightly scheduler named 'nightly_s390-next' triggered this 
build
Build Source Stamp: [branch s390-next] HEAD
Blamelist: 

BUILD FAILED: failed compile

sincerely,
 -The Buildbot

[Qemu-devel] [PATCH] win32-aio: use iov utility functions instead of open-coding them

We have iov_from_buf() and iov_to_buf(), use them instead of
open-coding these in block/win32-aio.c

Signed-Off-By: Michael Tokarev m...@tls.msk.ru
---
 block/win32-aio.c |   18 +++---
 1 file changed, 3 insertions(+), 15 deletions(-)

diff --git a/block/win32-aio.c b/block/win32-aio.c
index 0383370..773d3f4 100644
--- a/block/win32-aio.c
+++ b/block/win32-aio.c
@@ -79,14 +79,8 @@ static void win32_aio_process_completion(QEMUWin32AIOState 
*s,
 
 if (!waiocb-is_linear) {
 if (ret == 0  waiocb-is_read) {
-QEMUIOVector *qiov = waiocb-qiov;
-char *p = waiocb-buf;
-int i;
-
-for (i = 0; i  qiov-niov; ++i) {
-memcpy(p, qiov-iov[i].iov_base, qiov-iov[i].iov_len);
-p += qiov-iov[i].iov_len;
-}
+iov_from_buf(waiocb-qiov.iov, waiocb-qiov.niov,
+ 0, waiocb-buf, waiocb-qiov.size);
 qemu_vfree(waiocb-buf);
 }
 }
@@ -153,13 +147,7 @@ BlockDriverAIOCB *win32_aio_submit(BlockDriverState *bs,
 if (qiov-niov  1) {
 waiocb-buf = qemu_blockalign(bs, qiov-size);
 if (type  QEMU_AIO_WRITE) {
-char *p = waiocb-buf;
-int i;
-
-for (i = 0; i  qiov-niov; ++i) {
-memcpy(p, qiov-iov[i].iov_base, qiov-iov[i].iov_len);
-p += qiov-iov[i].iov_len;
-}
+iov_to_buf(qiov-iov, qiov-niov, 0, waiocb-buf, qiov-size);
 }
 waiocb-is_linear = false;
 } else {
-- 
1.7.10.4

Re: [Qemu-devel] [PATCH] win32-aio: use iov utility functions instead of open-coding them

Am 17.01.2013 09:48, schrieb Michael Tokarev:
 We have iov_from_buf() and iov_to_buf(), use them instead of
 open-coding these in block/win32-aio.c
 
 Signed-Off-By: Michael Tokarev m...@tls.msk.ru
 ---
  block/win32-aio.c |   18 +++---
  1 file changed, 3 insertions(+), 15 deletions(-)
 
 diff --git a/block/win32-aio.c b/block/win32-aio.c
 index 0383370..773d3f4 100644
 --- a/block/win32-aio.c
 +++ b/block/win32-aio.c
 @@ -79,14 +79,8 @@ static void win32_aio_process_completion(QEMUWin32AIOState 
 *s,
  
  if (!waiocb-is_linear) {
  if (ret == 0  waiocb-is_read) {
 -QEMUIOVector *qiov = waiocb-qiov;
 -char *p = waiocb-buf;
 -int i;
 -
 -for (i = 0; i  qiov-niov; ++i) {
 -memcpy(p, qiov-iov[i].iov_base, qiov-iov[i].iov_len);

I said on top of my patch for a reason: Now this looks like an innocent
refactoring patch, while in fact it is a hidden bug fix. Even the commit
message doesn't mention this.

Though I guess Stefan can apply my patch first and resolve the conflict
with this patch, then the result should be right.

Kevin

Re: [Qemu-devel] [PATCH] win32-aio: use iov utility functions instead of open-coding them


17.01.2013 12:57, Kevin Wolf wrote:


I said on top of my patch for a reason: Now this looks like an innocent


Kevin, that wasn't intentional.  I'm sorry.  Somehow I thought your
bugfix is already applied to master, and these reverse memcpy args
are difficult to spot (gah, that's why the bug is here to start with).
I resend it based on your patch.

/mjt

[Qemu-devel] buildbot failure in qemu on s390-next_i386_debian_6_0

2013-01-17 Thread qemu

The Buildbot has detected a new failure on builder s390-next_i386_debian_6_0 
while building qemu.
Full details are available at:
 
http://buildbot.b1-systems.de/qemu/builders/s390-next_i386_debian_6_0/builds/517

Buildbot URL: http://buildbot.b1-systems.de/qemu/

Buildslave for this Build: yuzuki

Build Reason: The Nightly scheduler named 'nightly_s390-next' triggered this 
build
Build Source Stamp: [branch s390-next] HEAD
Blamelist: 

BUILD FAILED: failed compile

sincerely,
 -The Buildbot

Re: [Qemu-devel] [PATCH v2] aio-posix: Fix return value of aio_poll()

On Wed, Jan 16, 2013 at 07:25:51PM +0100, Kevin Wolf wrote:
 aio_poll() must return true if any work is still pending, even if it
 didn't make progress, so that bdrv_drain_all() doesn't stop waiting too
 early. The possibility of stopping early occasionally lead to a failed
 assertion in bdrv_drain_all(), when some in-flight request was missed
 and the function didn't really drain all requests.
 
 In order to make that change, the return value as specified in the
 function comment must change for blocking = false; fortunately, the
 return value of blocking = false callers is only used in test cases, so
 this change shouldn't cause any trouble.
 
 Cc: qemu-sta...@nongnu.org
 Signed-off-by: Kevin Wolf kw...@redhat.com
 ---
  aio-posix.c |3 ++-
  aio-win32.c |3 ++-
  include/block/aio.h |6 ++
  tests/test-aio.c|4 ++--
  4 files changed, 8 insertions(+), 8 deletions(-)

Changed aio-posix to aio in commit message.

Thanks, applied to my block tree:
https://github.com/stefanha/qemu/commits/block

Stefan

Re: [Qemu-devel] [PATCH] v6 revamp acpitable parsing and allow to specify complete (headerful) table

2013-01-17 Thread TeLeMan

On Thu, May 12, 2011 at 10:44 PM, Michael Tokarev m...@tls.msk.ru wrote:
 This patch almost rewrites acpi_table_add() function
 (but still leaves it using old get_param_value() interface).
 The result is that it's now possible to specify whole table
 (together with a header) in an external file, instead of just
 data portion, with a new file= parameter, but at the same time
 it's still possible to specify header fields as before.

 Now with the checkpatch.pl formatting fixes, thanks to
 Stefan Hajnoczi for suggestions, with changes from
 Isaku Yamahata, and with my further refinements.

 v5: rediffed against current qemu/master.
 v6: fix one } else { coding style defect

 Signed-off-by: Michael Tokarev m...@tls.msk.ru
 ---
  hw/acpi.c   |  291 
 ---
  qemu-options.hx |7 +-
  2 files changed, 174 insertions(+), 124 deletions(-)

 diff --git a/hw/acpi.c b/hw/acpi.c
 index ad40fb4..b8cd866 100644
 --- a/hw/acpi.c
 +++ b/hw/acpi.c
 @@ -22,17 +22,29 @@

  struct acpi_table_header
  {
 -char signature [4];/* ACPI signature (4 ASCII characters) */
 +uint16_t _length; /* our length, not actual part of the hdr */
 +  /* XXX why we have 2 length fields here? */
 +char sig[4];  /* ACPI signature (4 ASCII characters) */
  uint32_t length;  /* Length of table, in bytes, including header 
 */
  uint8_t revision; /* ACPI Specification minor version # */
  uint8_t checksum; /* To make sum of entire table == 0 */
 -char oem_id [6];   /* OEM identification */
 -char oem_table_id [8]; /* OEM table identification */
 +char oem_id[6];   /* OEM identification */
 +char oem_table_id[8]; /* OEM table identification */
  uint32_t oem_revision;/* OEM revision number */
 -char asl_compiler_id [4]; /* ASL compiler vendor ID */
 +char asl_compiler_id[4];  /* ASL compiler vendor ID */
  uint32_t asl_compiler_revision; /* ASL compiler revision number */
  } __attribute__((packed));

 +#define ACPI_TABLE_HDR_SIZE sizeof(struct acpi_table_header)
 +#define ACPI_TABLE_PFX_SIZE sizeof(uint16_t)  /* size of the extra prefix */
 +
 +static const char dfl_hdr[ACPI_TABLE_HDR_SIZE] =
 +\0\0   /* fake _length (2) */
 +QEMU\0\0\0\0\1\0   /* sig (4), len(4), revno (1), csum (1) */
 +QEMUQEQEMUQEMU\1\0\0\0 /* OEM id (6), table (8), revno (4) */
 +QEMU\1\0\0\0   /* ASL compiler ID (4), version (4) */
 +;
 +
  char *acpi_tables;
  size_t acpi_tables_len;

 @@ -45,158 +57,191 @@ static int acpi_checksum(const uint8_t *data, int len)
  return (-sum)  0xff;
  }

 +/* like strncpy() but zero-fills the tail of destination */
 +static void strzcpy(char *dst, const char *src, size_t size)
 +{
 +size_t len = strlen(src);
 +if (len = size) {
 +len = size;
 +} else {
 +  memset(dst + len, 0, size - len);
 +}
 +memcpy(dst, src, len);
 +}
 +
 +/* XXX fixme: this function uses obsolete argument parsing interface */
  int acpi_table_add(const char *t)
  {
 -static const char *dfl_id = QEMUQEMU;
  char buf[1024], *p, *f;
 -struct acpi_table_header acpi_hdr;
  unsigned long val;
 -uint32_t length;
 -struct acpi_table_header *acpi_hdr_p;
 -size_t off;
 +size_t len, start, allen;
 +bool has_header;
 +int changed;
 +int r;
 +struct acpi_table_header hdr;
 +
 +r = 0;
 +r |= get_param_value(buf, sizeof(buf), data, t) ? 1 : 0;
 +r |= get_param_value(buf, sizeof(buf), file, t) ? 2 : 0;
 +switch (r) {
 +case 0:
 +buf[0] = '\0';
 +case 1:
 +has_header = false;
 +break;
 +case 2:
 +has_header = true;
 +break;
 +default:
 +fprintf(stderr, acpitable: both data and file are specified\n);
 +return -1;
 +}

 -memset(acpi_hdr, 0, sizeof(acpi_hdr));
 -
 -if (get_param_value(buf, sizeof(buf), sig, t)) {
 -strncpy(acpi_hdr.signature, buf, 4);
 +if (!acpi_tables) {
 +allen = sizeof(uint16_t);
 +acpi_tables = qemu_mallocz(allen);
  } else {
 -strncpy(acpi_hdr.signature, dfl_id, 4);
 +allen = acpi_tables_len;
 +}
 +
 +start = allen;
 +acpi_tables = qemu_realloc(acpi_tables, start + ACPI_TABLE_HDR_SIZE);
 +allen += has_header ? ACPI_TABLE_PFX_SIZE : ACPI_TABLE_HDR_SIZE;
 +
 +/* now read in the data files, reallocating buffer as needed */
 +
 +for (f = strtok(buf, :); f; f = strtok(NULL, :)) {
 +int fd = open(f, O_RDONLY);

The acpi table is the binary file, so it should be opened by O_RDONLY
| O_BINARY.

 +
 +if (fd  0) {
 +fprintf(stderr, can't open file %s: %s\n, f, strerror(errno));
 +return -1;
 +}
 +
 +for (;;) {
 +char data[8192];
 +r = read(fd, data, sizeof(data));
 +if (r == 0) {
 +

Re: [Qemu-devel] [PATCH 0/2] win32-aio fixes

On Wed, Jan 16, 2013 at 09:19:58PM +0100, Kevin Wolf wrote:
 Paolo, especially the first one is worrying with respect to the test status of
 this code. We should probably give it some additional testing.
 
 Kevin Wolf (2):
   win32-aio: Fix vectored reads
   win32-aio: Fix memory leak
 
  block/win32-aio.c |4 ++--
  1 files changed, 2 insertions(+), 2 deletions(-)
 
 -- 
 1.7.6.5
 

Thanks, applied to my block tree:
https://github.com/stefanha/qemu/commits/block

Stefan

[Qemu-devel] [PATCH v4 0/3] AHCI migration

Let's get Jason's patches merged while they still apply. I addressed the review
comments (mostly my own) that came up during the v3 review, otherwise this is
unchanged.

Please note that in my tests it didn't work entirely reliably and I saw guest
lockups and kernel crashes in like one of ten cases. I confirmed that the same
kind of bugs occurs with v3 of the series, so my changes are likely innocent.
Someone will have to debug this some more, but what I did took about the time
that I'm willing to spend on it right now.

Jason Baron (2):
  ahci: Remove unused AHCIDevice fields
  ahci: Add migration support

Kevin Wolf (1):
  ahci: Change data types in preparation for migration

 hw/ide/ahci.c |   97 ++--
 hw/ide/ahci.h |   20 ---
 hw/ide/ich.c  |   13 +--
 3 files changed, 109 insertions(+), 21 deletions(-)

-- 
1.7.6.5

[Qemu-devel] [PATCH v4 1/3] ahci: Remove unused AHCIDevice fields

From: Jason Baron jba...@redhat.com

'dma_status' and 'dma_cb' are written to, but never read.
Remove these fields in preparation for AHCI migration bits.

Signed-off-by: Jason Baron jba...@redhat.com
Reviewed-by: Juan Quintela quint...@redhat.com
Signed-off-by: Kevin Wolf kw...@redhat.com
---
 hw/ide/ahci.c |8 ++--
 hw/ide/ahci.h |2 --
 2 files changed, 2 insertions(+), 8 deletions(-)

diff --git a/hw/ide/ahci.c b/hw/ide/ahci.c
index 21f50ea..2d185cb 100644
--- a/hw/ide/ahci.c
+++ b/hw/ide/ahci.c
@@ -1035,11 +1035,10 @@ out:
 static void ahci_start_dma(IDEDMA *dma, IDEState *s,
BlockDriverCompletionFunc *dma_cb)
 {
+#ifdef DEBUG_AHCI
 AHCIDevice *ad = DO_UPCAST(AHCIDevice, dma, dma);
-
+#endif
 DPRINTF(ad-port_no, \n);
-ad-dma_cb = dma_cb;
-ad-dma_status |= BM_STATUS_DMAING;
 s-io_buffer_offset = 0;
 dma_cb(s, 0);
 }
@@ -1095,7 +1094,6 @@ static int ahci_dma_set_unit(IDEDMA *dma, int unit)
 static int ahci_dma_add_status(IDEDMA *dma, int status)
 {
 AHCIDevice *ad = DO_UPCAST(AHCIDevice, dma, dma);
-ad-dma_status |= status;
 DPRINTF(ad-port_no, set status: %x\n, status);
 
 if (status  BM_STATUS_INT) {
@@ -1114,8 +1112,6 @@ static int ahci_dma_set_inactive(IDEDMA *dma)
 /* update d2h status */
 ahci_write_fis_d2h(ad, NULL);
 
-ad-dma_cb = NULL;
-
 if (!ad-check_bh) {
 /* maybe we still have something to process, check later */
 ad-check_bh = qemu_bh_new(ahci_check_cmd_bh, ad);
diff --git a/hw/ide/ahci.h b/hw/ide/ahci.h
index 1200a56..735b379 100644
--- a/hw/ide/ahci.h
+++ b/hw/ide/ahci.h
@@ -281,11 +281,9 @@ struct AHCIDevice {
 QEMUBH *check_bh;
 uint8_t *lst;
 uint8_t *res_fis;
-int dma_status;
 int done_atapi_packet;
 int busy_slot;
 int init_d2h_sent;
-BlockDriverCompletionFunc *dma_cb;
 AHCICmdHdr *cur_cmd;
 NCQTransferState ncq_tfs[AHCI_MAX_CMDS];
 };
-- 
1.7.6.5

[Qemu-devel] [PATCH v4 2/3] ahci: Change data types in preparation for migration

The size of an int depends on the host, so in order to be able to
migrate these fields, make them either int32_t or bool, depending on the
use.

Signed-off-by: Kevin Wolf kw...@redhat.com
---
 hw/ide/ahci.c |8 
 hw/ide/ahci.h |8 
 2 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/hw/ide/ahci.c b/hw/ide/ahci.c
index 2d185cb..f91cff2 100644
--- a/hw/ide/ahci.c
+++ b/hw/ide/ahci.c
@@ -241,7 +241,7 @@ static void  ahci_port_write(AHCIState *s, int port, int 
offset, uint32_t val)
 if ((pr-cmd  PORT_CMD_FIS_ON) 
 !s-dev[port].init_d2h_sent) {
 ahci_init_d2h(s-dev[port]);
-s-dev[port].init_d2h_sent = 1;
+s-dev[port].init_d2h_sent = true;
 }
 
 check_cmd(s, port);
@@ -494,7 +494,7 @@ static void ahci_reset_port(AHCIState *s, int port)
 pr-scr_err = 0;
 pr-scr_act = 0;
 d-busy_slot = -1;
-d-init_d2h_sent = 0;
+d-init_d2h_sent = false;
 
 ide_state = s-dev[port].port.ifs[0];
 if (!ide_state-bs) {
@@ -946,7 +946,7 @@ static int handle_cmd(AHCIState *s, int port, int slot)
 ide_state-hcyl = 0xeb;
 debug_print_fis(ide_state-io_buffer, 0x10);
 ide_state-feature = IDE_FEATURE_DMA;
-s-dev[port].done_atapi_packet = 0;
+s-dev[port].done_atapi_packet = false;
 /* XXX send PIO setup FIS */
 }
 
@@ -991,7 +991,7 @@ static int ahci_start_transfer(IDEDMA *dma)
 
 if (is_atapi  !ad-done_atapi_packet) {
 /* already prepopulated iobuffer */
-ad-done_atapi_packet = 1;
+ad-done_atapi_packet = true;
 goto out;
 }
 
diff --git a/hw/ide/ahci.h b/hw/ide/ahci.h
index 735b379..70d3b57 100644
--- a/hw/ide/ahci.h
+++ b/hw/ide/ahci.h
@@ -281,9 +281,9 @@ struct AHCIDevice {
 QEMUBH *check_bh;
 uint8_t *lst;
 uint8_t *res_fis;
-int done_atapi_packet;
-int busy_slot;
-int init_d2h_sent;
+bool done_atapi_packet;
+int32_t busy_slot;
+bool init_d2h_sent;
 AHCICmdHdr *cur_cmd;
 NCQTransferState ncq_tfs[AHCI_MAX_CMDS];
 };
@@ -295,7 +295,7 @@ typedef struct AHCIState {
 MemoryRegion idp;   /* Index-Data Pair I/O port space */
 unsigned idp_offset;/* Offset of index in I/O port space */
 uint32_t idp_index; /* Current IDP index */
-int ports;
+int32_t ports;
 qemu_irq irq;
 DMAContext *dma;
 } AHCIState;
-- 
1.7.6.5

[Qemu-devel] [PATCH v4 3/3] ahci: Add migration support

From: Jason Baron jba...@redhat.com

Jason tested these patches by migrating Windows 7 and Fedora 17 guests
(while under I/O) on both piix with ahci attached and on q35 (which has
a built-in AHCI controller).

Signed-off-by: Andreas Färber afaer...@suse.de
Signed-off-by: Jason Baron jba...@redhat.com
Signed-off-by: Kevin Wolf kw...@redhat.com
---
Changes from v3:
- Update the types of some fields (VMSTATE_INT32 - VMSTATE_BOOL)
- post_load: Check that BUSY_STAT and DRQ_STAT aren't set before
  clearing busy_port
- Change vmstate_ich9_ahci.name from ahci to ich9_ahci

Changes from v2:
 -migrate all relevant ahci fields
 -flush any pending i/o in 'post_load'

Changes from v1:
 -extend Andreas Färber's patch
---
 hw/ide/ahci.c |   81 -
 hw/ide/ahci.h |   10 +++
 hw/ide/ich.c  |   13 ++---
 3 files changed, 99 insertions(+), 5 deletions(-)

diff --git a/hw/ide/ahci.c b/hw/ide/ahci.c
index f91cff2..a645e22 100644
--- a/hw/ide/ahci.c
+++ b/hw/ide/ahci.c
@@ -1199,6 +1199,82 @@ void ahci_reset(AHCIState *s)
 }
 }
 
+static const VMStateDescription vmstate_ahci_device = {
+.name = ahci port,
+.version_id = 1,
+.fields = (VMStateField []) {
+VMSTATE_IDE_BUS(port, AHCIDevice),
+VMSTATE_UINT32(port_state, AHCIDevice),
+VMSTATE_UINT32(finished, AHCIDevice),
+VMSTATE_UINT32(port_regs.lst_addr, AHCIDevice),
+VMSTATE_UINT32(port_regs.lst_addr_hi, AHCIDevice),
+VMSTATE_UINT32(port_regs.fis_addr, AHCIDevice),
+VMSTATE_UINT32(port_regs.fis_addr_hi, AHCIDevice),
+VMSTATE_UINT32(port_regs.irq_stat, AHCIDevice),
+VMSTATE_UINT32(port_regs.irq_mask, AHCIDevice),
+VMSTATE_UINT32(port_regs.cmd, AHCIDevice),
+VMSTATE_UINT32(port_regs.tfdata, AHCIDevice),
+VMSTATE_UINT32(port_regs.sig, AHCIDevice),
+VMSTATE_UINT32(port_regs.scr_stat, AHCIDevice),
+VMSTATE_UINT32(port_regs.scr_ctl, AHCIDevice),
+VMSTATE_UINT32(port_regs.scr_err, AHCIDevice),
+VMSTATE_UINT32(port_regs.scr_act, AHCIDevice),
+VMSTATE_UINT32(port_regs.cmd_issue, AHCIDevice),
+VMSTATE_BOOL(done_atapi_packet, AHCIDevice),
+VMSTATE_INT32(busy_slot, AHCIDevice),
+VMSTATE_BOOL(init_d2h_sent, AHCIDevice),
+VMSTATE_END_OF_LIST()
+},
+};
+
+static int ahci_state_post_load(void *opaque, int version_id)
+{
+int i;
+struct AHCIDevice *ad;
+AHCIState *s = opaque;
+
+for (i = 0; i  s-ports; i++) {
+ad = s-dev[i];
+AHCIPortRegs *pr = ad-port_regs;
+
+map_page(ad-lst,
+ ((uint64_t)pr-lst_addr_hi  32) | pr-lst_addr, 1024);
+map_page(ad-res_fis,
+ ((uint64_t)pr-fis_addr_hi  32) | pr-fis_addr, 256);
+/*
+ * All pending i/o should be flushed out on a migrate. However,
+ * we might not have cleared the busy_slot since this is done
+ * in a bh. Also, issue i/o against any slots that are pending.
+ */
+if ((ad-busy_slot != -1) 
+!(ad-port.ifs[0].status  (BUSY_STAT|DRQ_STAT))) {
+pr-cmd_issue = ~(1  ad-busy_slot);
+ad-busy_slot = -1;
+}
+check_cmd(s, i);
+}
+
+return 0;
+}
+
+const VMStateDescription vmstate_ahci = {
+.name = ahci,
+.version_id = 1,
+.post_load = ahci_state_post_load,
+.fields = (VMStateField []) {
+VMSTATE_STRUCT_VARRAY_POINTER_INT32(dev, AHCIState, ports,
+ vmstate_ahci_device, AHCIDevice),
+VMSTATE_UINT32(control_regs.cap, AHCIState),
+VMSTATE_UINT32(control_regs.ghc, AHCIState),
+VMSTATE_UINT32(control_regs.irqstatus, AHCIState),
+VMSTATE_UINT32(control_regs.impl, AHCIState),
+VMSTATE_UINT32(control_regs.version, AHCIState),
+VMSTATE_UINT32(idp_index, AHCIState),
+VMSTATE_INT32(ports, AHCIState),
+VMSTATE_END_OF_LIST()
+},
+};
+
 typedef struct SysbusAHCIState {
 SysBusDevice busdev;
 AHCIState ahci;
@@ -1207,7 +1283,10 @@ typedef struct SysbusAHCIState {
 
 static const VMStateDescription vmstate_sysbus_ahci = {
 .name = sysbus-ahci,
-.unmigratable = 1,
+.fields = (VMStateField []) {
+VMSTATE_AHCI(ahci, AHCIPCIState),
+VMSTATE_END_OF_LIST()
+},
 };
 
 static void sysbus_ahci_reset(DeviceState *dev)
diff --git a/hw/ide/ahci.h b/hw/ide/ahci.h
index 70d3b57..85f37fe 100644
--- a/hw/ide/ahci.h
+++ b/hw/ide/ahci.h
@@ -305,6 +305,16 @@ typedef struct AHCIPCIState {
 AHCIState ahci;
 } AHCIPCIState;
 
+extern const VMStateDescription vmstate_ahci;
+
+#define VMSTATE_AHCI(_field, _state) {   \
+.name   = (stringify(_field)),   \
+.size   = sizeof(AHCIState), \
+.vmsd   = vmstate_ahci, \
+.flags  = VMS_STRUCT,

Re: [Qemu-devel] [QEMU PATCH v2] virtio-net: introduce a new macaddr control

On Thu, Jan 17, 2013 at 09:39:54AM +0100, Stefan Hajnoczi wrote:
 On Thu, Jan 17, 2013 at 01:45:11PM +0800, Amos Kong wrote:
  On Thu, Jan 17, 2013 at 11:49:20AM +1030, Rusty Russell wrote:
   ak...@redhat.com writes:
@@ -349,6 +351,14 @@ static int virtio_net_handle_mac(VirtIONet *n, 
uint8_t cmd,
 {
 struct virtio_net_ctrl_mac mac_data;
 
+if (cmd == VIRTIO_NET_CTRL_MAC_ADDR_SET  elem-out_num == 2 
+elem-out_sg[1].iov_len == ETH_ALEN) {
+/* Set MAC address */
+memcpy(n-mac, elem-out_sg[1].iov_base, 
elem-out_sg[1].iov_len);
+qemu_format_nic_info_str(n-nic-nc, n-mac);
+return VIRTIO_NET_OK;
+}
   
   Does the rest of the net device still rely on the layout of descriptors?
  
  No, only info string of net client relies on n-mac
 
 I think the question is whether the hw/virtio-net.c code makes
 assumptions about virtqueue descriptor layout (e.g. sg[0] is the header,
 sg[1] is the data buffer).
 
 The answer is yes, the control virtqueue function directly accesses
 iov[n].
 
 Additional patches would be required to convert the existing
 hw/virtio-net.c code to make no assumptions about virtqueue descriptor
 layout.  It's outside the scope of this series.
 
 Stefan

It's not hard at all though - the harder part is data path
processing, this has been done already. Will send a
patch shortly.

Re: [Qemu-devel] [PATCH] fix unbounded qemu NetQueue

On Thu, Jan 17, 2013 at 07:07:11AM +0100, Luigi Rizzo wrote:
 The comment at the beginning of net/queue.c says that packets that
 cannot be sent by qemu_net_queue_send() should not be enqueued
 unless a callback is set.
 
 This patch implements this behaviour, that prevents a queue to grow
 unbounded (e.g. when a network backend is not connected).
 
 Also for good measure the patch implements bounded size queues
 (though it should not be necessary now because each source can only have
 one packet queued). When a packet is dropped because excessive
 queue size the callback is not supposed to be called.

Although I appreciate the semantics that the comment tries to establish,
the code doesn't behave like this today and we cannot drop packets in
cases where we relied on queuing them.

More changes will be required to make the hub, USB, pcap scenario I
described previously work.

Stefan

[Qemu-devel] [PATCH] PPC: e500: Change in-memory order of load blobs

2013-01-17 Thread Alexander Graf

Today, we load

  kernel initrd dtb

into memory in that order. However, Linux has a bug where it can only
handle the dtb if it's within the first 64MB of where kernel starts.

So instead, let's change the order to

  kernel dtb initrd

making Linux happy.

Signed-off-by: Alexander Graf ag...@suse.de
---
 hw/ppc/e500.c |7 ++-
 1 files changed, 6 insertions(+), 1 deletions(-)

diff --git a/hw/ppc/e500.c b/hw/ppc/e500.c
index 1861695..c7560bd 100644
--- a/hw/ppc/e500.c
+++ b/hw/ppc/e500.c
@@ -41,6 +41,7 @@
 #define UIMAGE_LOAD_BASE   0
 #define DTC_LOAD_PAD   0x180
 #define DTC_PAD_MASK   0xF
+#define DTB_MAX_SIZE   (8 * 1024 * 1024)
 #define INITRD_LOAD_PAD0x200
 #define INITRD_PAD_MASK0xFF
 
@@ -624,6 +625,10 @@ void ppce500_init(PPCE500Params *params)
 }
 
 cur_base = loadaddr + kernel_size;
+
+/* Reserve space for dtb */
+dt_base = (cur_base + DTC_LOAD_PAD)  ~DTC_PAD_MASK;
+cur_base += DTB_MAX_SIZE;
 }
 
 /* Load initrd. */
@@ -646,13 +651,13 @@ void ppce500_init(PPCE500Params *params)
 struct boot_info *boot_info;
 int dt_size;
 
-dt_base = (cur_base + DTC_LOAD_PAD)  ~DTC_PAD_MASK;
 dt_size = ppce500_load_device_tree(env, params, dt_base, initrd_base,
initrd_size);
 if (dt_size  0) {
 fprintf(stderr, couldn't load device tree\n);
 exit(1);
 }
+assert(dt_size  DTB_MAX_SIZE);
 
 boot_info = env-load_info;
 boot_info-entry = entry;
-- 
1.6.0.2

Re: [Qemu-devel] [PATCH v9 4/5] Adding packet abstraction for VMWARE network devices

On Wed, Jan 16, 2013 at 04:33:48PM +0100, Paolo Bonzini wrote:
 Il 16/01/2013 15:48, Stefan Hajnoczi ha scritto:
hw/vmxnet_rx_pkt.c | 187 ++
hw/vmxnet_rx_pkt.h | 173 
hw/vmxnet_tx_pkt.c | 567 
   +
hw/vmxnet_tx_pkt.h | 148 ++
4 files changed, 1075 insertions(+)
create mode 100644 hw/vmxnet_rx_pkt.c
create mode 100644 hw/vmxnet_rx_pkt.h
create mode 100644 hw/vmxnet_tx_pkt.c
create mode 100644 hw/vmxnet_tx_pkt.h
  There are other VMware-specific hw/ files.  Please create hw/vmware/ and
  put source files in there without the prefix.  Check hw/pci/ or other
  subdirectories for how to setup Makefile.objs, it's pretty simple.
 
 I don't think we have enough plans for hw/ structure to create
 directories yet.  What we have so far is basically hw/arch and
 hw/bus, so the logic would be to have hw/net (also mimicking Linux's
 drivers/net directory).  It's premature to create hw/vmware, we risk
 getting a spaghetti directory structure.

Okay, let's leave the hw/ sub-directory for a future hw/-wide cleanup
series that moves all device emulation code.

 eth.c/eth.h sound more interesting.  Could they be used by host-side
 code (e.g. SLIRP or a TAP backend)?  If so, they belong in net/ and
 include/net.  If not, they belong in hw/ (waiting for hw/net to be created).

Yes, they can be used by host (backend) code.

Stefan

Re: [Qemu-devel] [PATCH 4/4] Makefile: fix make clean on libcacard

On Tue, Jan 15, 2013 at 06:36:50PM +0200, Michael S. Tsirkin wrote:
 libcacard lacks a clean target. Need to fix it,
 meanwhile mark this target phony so it does not
 stop parallel make clean.
 
 Signed-off-by: Michael S. Tsirkin m...@redhat.com
 ---
  libcacard/Makefile | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/libcacard/Makefile b/libcacard/Makefile
 index 47827a0..a3518c1 100644
 --- a/libcacard/Makefile
 +++ b/libcacard/Makefile
 @@ -35,7 +35,7 @@ libcacard.pc: $(SRC_PATH)/libcacard/libcacard.pc.in
   -e 's|@PREFIX@|$(prefix)|' $  libcacard.pc,\
 GEN   $@)
  
 -.PHONY: install-libcacard
 +.PHONY: install-libcacard clean

libcacard/Makefile is not supposed to have a clean target since
992aeb8eb53e5846a957cf333f2e1ec8cb6e0c04 (libcacard: rewrite Makefile
in non-recursive style).

I have a patch on qemu-devel to remove libcacard from the make clean
loop since its objects are already handled by the global clean now that
the file is sourced rather than invoked recursively.

Stefan

Re: [Qemu-devel] [PATCH 4/4] Makefile: fix make clean on libcacard

On Thu, Jan 17, 2013 at 11:33:03AM +0100, Stefan Hajnoczi wrote:
 On Tue, Jan 15, 2013 at 06:36:50PM +0200, Michael S. Tsirkin wrote:
  libcacard lacks a clean target. Need to fix it,
  meanwhile mark this target phony so it does not
  stop parallel make clean.
  
  Signed-off-by: Michael S. Tsirkin m...@redhat.com
  ---
   libcacard/Makefile | 2 +-
   1 file changed, 1 insertion(+), 1 deletion(-)
  
  diff --git a/libcacard/Makefile b/libcacard/Makefile
  index 47827a0..a3518c1 100644
  --- a/libcacard/Makefile
  +++ b/libcacard/Makefile
  @@ -35,7 +35,7 @@ libcacard.pc: $(SRC_PATH)/libcacard/libcacard.pc.in
  -e 's|@PREFIX@|$(prefix)|' $  libcacard.pc,\
GEN   $@)
   
  -.PHONY: install-libcacard
  +.PHONY: install-libcacard clean
 
 libcacard/Makefile is not supposed to have a clean target since
 992aeb8eb53e5846a957cf333f2e1ec8cb6e0c04 (libcacard: rewrite Makefile
 in non-recursive style).
 
 I have a patch on qemu-devel to remove libcacard from the make clean
 loop since its objects are already handled by the global clean now that
 the file is sourced rather than invoked recursively.
 
 Stefan

That will help too. Can you give me the msg id? Maybe I'll just
put it on my tree.

-- 
MST

Re: [Qemu-devel] [RFC V1 12/14] qcow2: Add qcow2_dedup_update_metrics to compute dedup RAM usage.

2013-01-17 Thread Benoît Canet

Le Wednesday 16 Jan 2013 à 13:10:12 (-0700), Eric Blake a écrit :
 On 01/16/2013 09:25 AM, Benoît Canet wrote:
  ---
   block/qcow2-dedup.c |   13 +
   block/qcow2.h   |1 +
   2 files changed, 14 insertions(+)
  
  diff --git a/block/qcow2-dedup.c b/block/qcow2-dedup.c
  index db23b71..4305746 100644
  --- a/block/qcow2-dedup.c
  +++ b/block/qcow2-dedup.c
  @@ -1311,3 +1311,16 @@ void qcow2_dedup_close(BlockDriverState *bs)
   {
   qcow2_dedup_free(bs);
   }
  +
  +#define GTREE_NODE_SIZE sizeof(int) * 5
 
 Improperly parenthesized.  Also, this feels like a magic number, is
 there an actual sizeof(struct) you could use instead of hand-computing
 how much is used per node?

No the glib implementation totally hide it's structures.

Re: [Qemu-devel] [RFC V1 11/12] qmp: Add block-pause-dedup.

2013-01-17 Thread Benoît Canet

  +#
  +# @device:   the name of the device to pause the deduplication on
  +#
  +# Returns: nothing on success
  +#  If @device is not a valid block device, DeviceNotFound
  +#  If @device is not deduplicated, DeviceNotDeduplicated
 
 I don't think you need this second error.  A generic error is good
 enough unless we can prove that having a dedicated error class makes
 algorithmic sense for a given client, and I can't come up with such a
 scenario off the top of my head for libvirt.

Ok i'll remove it.

 
  +SQMP
  +block-pause-dedup
  +
  +
  +Pause the deduplication on a device that support it.
 
 s/support/supports/
 
 I notice that between this and patch 12, you are adding two very similar
 commands (block-pause-dedup, block-resume-dedup); would it be any
 simpler to add a single command instead:
 
 { 'command': 'block-dedup-control',
   'data': { 'device': 'str', 'enable': 'bool' } }
 
 where the user calls:
 
 { execute: block-dedup-control,
   arguments: { device: ide0-hd0, enable: false } }
 
 to pause, and enable:true to resume?

Ok I'll merge these.

Regards

Benoît

Re: [Qemu-devel] [PATCH v2 03/11] hw/9pfs: Fix unchecked strdup() by converting to g_strdup()

On Wed, Jan 16, 2013 at 06:32:12PM +0100, Markus Armbruster wrote:
 diff --git a/hw/9pfs/virtio-9p-device.c b/hw/9pfs/virtio-9p-device.c
 index 6eab7f7..74155fb 100644
 --- a/hw/9pfs/virtio-9p-device.c
 +++ b/hw/9pfs/virtio-9p-device.c
 @@ -94,7 +94,7 @@ VirtIODevice *virtio_9p_init(DeviceState *dev, V9fsConf 
 *conf)
  exit(1);
  }
  
 -s-tag = strdup(conf-tag);
 +s-tag = g_strdup(conf-tag);
  s-ctx.uid = -1;
  
  s-ops = fse-ops;

s-tag is leaked.  Want to send a follow-up patch to g_free() it?

[Qemu-devel] [Trivial PATCH] acpitable: open the data file in binary mode

-acpitable {file|data}=file reads the content of file, but it is
in binary form, so the file should be opened usin O_BINARY flag.
On *nix it is a no-op, but on windows and other weird platform
it is really needed.

Signed-off-by: Michael Tokarev m...@tls.msk.ru
---
 hw/acpi.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/acpi.c b/hw/acpi.c
index 5d521e5..49510be 100644
--- a/hw/acpi.c
+++ b/hw/acpi.c
@@ -115,7 +115,7 @@ int acpi_table_add(const char *t)
 /* now read in the data files, reallocating buffer as needed */
 
 for (f = strtok(buf, :); f; f = strtok(NULL, :)) {
-int fd = open(f, O_RDONLY);
+int fd = open(f, O_RDONLY | O_BINARY);
 
 if (fd  0) {
 fprintf(stderr, can't open file %s: %s\n, f, strerror(errno));
-- 
1.7.10.4

Re: [Qemu-devel] [Qemu-trivial] [PATCH v2 06/11] virtfs-proxy-helper: Fix unchecked strdup() by conv. to g_strdup()

On Wed, Jan 16, 2013 at 06:32:15PM +0100, Markus Armbruster wrote:
 Signed-off-by: Markus Armbruster arm...@redhat.com
 Reviewed-by: Eric Blake ebl...@redhat.com
 ---
  fsdev/virtfs-proxy-helper.c | 4 ++--
  1 file changed, 2 insertions(+), 2 deletions(-)
 
 diff --git a/fsdev/virtfs-proxy-helper.c b/fsdev/virtfs-proxy-helper.c
 index 6b9afd3..36f6616 100644
 --- a/fsdev/virtfs-proxy-helper.c
 +++ b/fsdev/virtfs-proxy-helper.c
 @@ -1039,7 +1039,7 @@ int main(int argc, char **argv)
  }
  switch (c) {
  case 'p':
 -rpath = strdup(optarg);
 +rpath = g_strdup(optarg);
  break;
  case 'n':
  is_daemon = false;
 @@ -1048,7 +1048,7 @@ int main(int argc, char **argv)
  sock = atoi(optarg);
  break;
  case 's':
 -sock_name = strdup(optarg);
 +sock_name = g_strdup(optarg);

rpath and sock_name are leaked.  Not important though because they are
in main().

Stefan

Re: [Qemu-devel] Qemu s390x emulation

2013-01-17 Thread Jens Freimann

On Tue, Jan 15, 2013 at 10:04:57AM -0600, Rob Landley wrote:
On 01/15/2013 05:45:44 AM, Alexander Graf wrote:
On 15.01.2013, at 12:39, Suzuki K. Poulose wrote:
On 01/15/2013 04:39 PM, Alexander Graf wrote:
On 15.01.2013, at 12:05, Suzuki K. Poulose wrote:

Does this one work for you?

http://ftp.nl.debian.org/debian/dists/stable/main/installer-s390/current/images/generic/kernel.debian

I tried grabbing that and grabbing the initrd image in the same
directory, booting them with:

qemu-system-s390x -kernel kernel.debian -nographic -m 1024 -initrd
initrd.debian \
-append rdinit=/bin/ash

And it booted to a shell prompt... with a broken console. When I did
ls -l at the resulting prompt it echoed back an ANSI escape
sequence, one character at a time, which looks like the response to
the ansi screen size probe busybox does (to query the display size
of an xterm across a virtual serial console).

I get the same result with this combination of kernel and initrd. However,
with a more simple ramdisk (built by myself) that only has busybox in it
I could boot into a shell that worked just fine. It seems to me that something
in initrd.debian is not working well with qemu/virtio_console but I haven't
debugged it further.

Jens

I.E. qemu is getting deeply confused that what comes from stdin and
what you type on the keyboard aren't quite the same thing. Some kind
of strange ncurses hackage, looks like?

I tried sticking cat | in front of the above qemu pipeline and it
got REALLY confused.

Rob

Re: [Qemu-devel] [PATCH 3/4] rules/mak: make clean should blow away timestamp files

On Tue, Jan 15, 2013 at 06:57:34PM +0200, Michael S. Tsirkin wrote:
 Using a global pattern makes it easier to clean out
 old generated files.
 
 Signed-off-by: Michael S. Tsirkin m...@redhat.com
 ---
  rules.mak | 5 +
  1 file changed, 5 insertions(+)
 
 diff --git a/rules.mak b/rules.mak
 index d11a5b4..edc2552 100644
 --- a/rules.mak
 +++ b/rules.mak
 @@ -88,6 +88,11 @@ config-%.h: config-%.h-timestamp
  config-%.h-timestamp: config-%.mak
   $(call quiet-command, sh $(SRC_PATH)/scripts/create_config  $  $@,  
  GEN   $(TARGET_DIR)config-$*.h)
  
 +.PHONY: clean-timestamp
 +clean-timestamp:
 + rm -f *.timestamp

Timestamp files also live in subdirectories and I think we're slowly
moving away from recursive make, so this may not clean all timestamp
files.

Stefan

Re: [Qemu-devel] [Qemu-trivial] [PATCH v2 08/11] qemu-log: Plug trivial memory leak in cpu_set_log_filename()

On Wed, Jan 16, 2013 at 06:32:17PM +0100, Markus Armbruster wrote:
 diff --git a/qemu-log.c b/qemu-log.c
 index 64a1b88..30c8b01 100644
 --- a/qemu-log.c
 +++ b/qemu-log.c
 @@ -21,10 +21,12 @@
  #include qemu/log.h
  
  #ifdef WIN32
 -static const char *logfilename = qemu.log;
 +#define DEFAULT_LOGFILENAME qemu.log
  #else
 -static const char *logfilename = /tmp/qemu.log;
 +#define DEFAULT_LOGFILENAME /tmp/qemu.log
  #endif
 +
 +static const char *logfilename;
[...]
 @@ -84,6 +88,7 @@ void qemu_set_log(int log_flags, bool use_own_buffers)
  
  void cpu_set_log_filename(const char *filename)
  {
 +g_free((void *)logfilename);

Might as well drop the const from the variable declaration to indicate
that we allocate/free this string.

Stefan

Re: [Qemu-devel] [PATCH 0/2] win32-aio fixes

Am 17.01.2013 11:53, schrieb Paolo Bonzini:
 Il 16/01/2013 21:19, Kevin Wolf ha scritto:
 Paolo, especially the first one is worrying with respect to the test status 
 of
 this code. We should probably give it some additional testing.

 Kevin Wolf (2):
   win32-aio: Fix vectored reads
   win32-aio: Fix memory leak

  block/win32-aio.c |4 ++--
  1 files changed, 2 insertions(+), 2 deletions(-)

 
 Yes, the worrying part is especially that IIUC qtest does not support
 Windows.  There's no way to get good coverage without qtest.

Why that? If block drivers aren't testable from qemu-iotests with only
qemu-img and qemu-io, then there's something we did wrong. This specific
code would have been easily covered with qemu-io -k -n -c 'readv ...'
(which is how I found the bug and tested the fix).

Hm, or actually, is cache=none even needed for aio=native on Windows? In
any case I think some documentation needs to be updated.

qemu-iotests under Wine may need some polishing, though, and of course
needs someone to run it regularly with the right parameters. (In fact,
it seems we don't even run the tests with Linux AIO)

Kevin

Re: [Qemu-devel] [PATCH 0/2] win32-aio fixes

Il 17/01/2013 12:35, Kevin Wolf ha scritto:
 Am 17.01.2013 11:53, schrieb Paolo Bonzini:
 Il 16/01/2013 21:19, Kevin Wolf ha scritto:
 Paolo, especially the first one is worrying with respect to the test status 
 of
 this code. We should probably give it some additional testing.

 Kevin Wolf (2):
   win32-aio: Fix vectored reads
   win32-aio: Fix memory leak

  block/win32-aio.c |4 ++--
  1 files changed, 2 insertions(+), 2 deletions(-)


 Yes, the worrying part is especially that IIUC qtest does not support
 Windows.  There's no way to get good coverage without qtest.
 
 Why that? If block drivers aren't testable from qemu-iotests with only
 qemu-img and qemu-io, then there's something we did wrong. This specific
 code would have been easily covered with qemu-io -k -n -c 'readv ...'
 (which is how I found the bug and tested the fix).

Doh, that was really stupid.

/me unsuccessfully tries to blame flu

 Hm, or actually, is cache=none even needed for aio=native on Windows? In
 any case I think some documentation needs to be updated.

Honestly I have no idea.  However, I don't think so.

Paolo

 qemu-iotests under Wine may need some polishing, though, and of course
 needs someone to run it regularly with the right parameters. (In fact,
 it seems we don't even run the tests with Linux AIO)

Re: [Qemu-devel] [PATCH] block: do_commit() does not pass along error messages for all errors

2013-01-17 Thread Luiz Capitulino

On Thu, 17 Jan 2013 08:49:38 +0100
Markus Armbruster arm...@redhat.com wrote:

 [Cc: Luiz for error stuff]
 
 Jeff Cody jc...@redhat.com writes:
 
  The non-live bdrv_commit() function may return one of the following
  errors: -ENOTSUP, -EBUSY, -EACCES, -EIO.  The only error that is
  checked in the HMP handler is -EBUSY, so the monitor command 'commit'
  silently fails for all error cases other than 'Device is in use'.
 
  This patch adds the appropriate error messages for the errors
  explicitely returned by bdrv_commit().
 
  Signed-off-by: Jeff Cody jc...@redhat.com
  ---
   blockdev.c | 14 ++
   1 file changed, 14 insertions(+)
 
  diff --git a/blockdev.c b/blockdev.c
  index d724e2d..7db7d8e 100644
  --- a/blockdev.c
  +++ b/blockdev.c
  @@ -657,6 +657,20 @@ void do_commit(Monitor *mon, const QDict *qdict)
   qerror_report(QERR_DEVICE_IN_USE, device);
   return;
   }
  +if (ret == -EACCES) {
  +qerror_report(QERR_DEVICE_IS_READ_ONLY, device);
  +return;
  +}
  +if (ret == -EIO) {
  +qerror_report(QERR_IO_ERROR);
  +return;
  +}
  +if (ret == -ENOTSUP) {
  +const char *format = bdrv_get_format_name(bs);
  +qerror_report(QERR_BLOCK_FORMAT_FEATURE_NOT_SUPPORTED,
  +  format ? format : NULL, device, commit);
  +
  +}
   }
   }
 
 A switch could be more obvious than the if cascade.  Matter of taste.
 
 We're trying to avoid QERR_ in new code.  This case isn't bad, because
 it doesn't add new QERR_ defines.  Should we convert the function to
 error_setg() instead?  Perhaps a few cases could be collapsed into a
 single error_setg_errno() then.

I'd suggest to convert do_commit() to the qapi. However, we already
have block-commit in QMP. So I'm not sure this is a good idea.

If it isn't, then maybe we could drop all qerro_report() calls and
use monitor_printf() instead (building the error message with
strerror()), as do_commit() seems to be used only from HMP.

Re: [Qemu-devel] [PATCH 1/4] block: Add special error code for wrong format

Am 15.12.2012 15:09, schrieb Stefan Weil:
 The block drivers normally return -errno for typical errors.
 There is no appropriate error code for wrong format, so
 use a special error code which does not conflict with system
 error codes.
 
 Signed-off-by: Stefan Weil s...@weilnetz.de
 ---
  block.h |7 +++
  1 file changed, 7 insertions(+)
 
 diff --git a/block.h b/block.h
 index 893448a..829e18b 100644
 --- a/block.h
 +++ b/block.h
 @@ -90,6 +90,13 @@ typedef struct BlockDevOps {
  #define BDRV_SECTOR_SIZE   (1ULL  BDRV_SECTOR_BITS)
  #define BDRV_SECTOR_MASK   ~(BDRV_SECTOR_SIZE - 1)
  
 +/* The block drivers normally return -errno for typical errors.
 + * There is no appropriate error code for wrong format, so
 + * use a special error code which does not conflict with system
 + * error codes.
 + */
 +#define BDRV_WRONG_FORMAT  INT_MIN

I think it would be better to use the E* format and a positive number so
that it's obvious that it's meant to be used in -errno returns.

Also, I would consider moving it to qemu-common.h where other errno
values are defined that may be missing on some systems, so that
everything stays in one place and we won't define overlapping codes:

#if !defined(ENOTSUP)
#define ENOTSUP 4096
#endif
#if !defined(ECANCELED)
#define ECANCELED 4097
#endif

This sounds like a good addition in the same place would be:

#define EBDRV_WRONG_FORMAT 4098

Or just use EINVAL or ENOTTY like Stefan suggested.

Kevin

[Qemu-devel] [PATCH v2] win32-aio: use iov utility functions instead of open-coding them

We have iov_from_buf() and iov_to_buf(), use them instead of
open-coding these in block/win32-aio.c
---
 block/win32-aio.c |   16 ++--
 1 file changed, 2 insertions(+), 14 deletions(-)

diff --git a/block/win32-aio.c b/block/win32-aio.c
index b9236ea..b10a0c0 100644
--- a/block/win32-aio.c
+++ b/block/win32-aio.c
@@ -80,13 +80,7 @@ static void win32_aio_process_completion(QEMUWin32AIOState 
*s,
 if (!waiocb-is_linear) {
 if (ret == 0  waiocb-is_read) {
 QEMUIOVector *qiov = waiocb-qiov;
-char *p = waiocb-buf;
-int i;
-
-for (i = 0; i  qiov-niov; ++i) {
-memcpy(qiov-iov[i].iov_base, p, qiov-iov[i].iov_len);
-p += qiov-iov[i].iov_len;
-}
+iov_from_buf(qiov-iov, qiov-niov, 0, waiocb-buf, qiov-size);
 }
 qemu_vfree(waiocb-buf);
 }
@@ -153,13 +147,7 @@ BlockDriverAIOCB *win32_aio_submit(BlockDriverState *bs,
 if (qiov-niov  1) {
 waiocb-buf = qemu_blockalign(bs, qiov-size);
 if (type  QEMU_AIO_WRITE) {
-char *p = waiocb-buf;
-int i;
-
-for (i = 0; i  qiov-niov; ++i) {
-memcpy(p, qiov-iov[i].iov_base, qiov-iov[i].iov_len);
-p += qiov-iov[i].iov_len;
-}
+iov_to_buf(qiov-iov, qiov-niov, 0, waiocb-buf, qiov-size);
 }
 waiocb-is_linear = false;
 } else {
-- 
1.7.10.4

[Qemu-devel] [PATCH] scsi: Drop useless null test in scsi_unit_attention()

req was created by scsi_req_alloc(), which initializes req-dev to a
value it dereferences.  req-dev isn't changed anywhere else.
Therefore, req-dev can't be null.

Drop the useless null test; it spooks Coverity.

Signed-off-by: Markus Armbruster arm...@redhat.com
---
 hw/scsi-bus.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/scsi-bus.c b/hw/scsi-bus.c
index 267a942..a97f1cd 100644
--- a/hw/scsi-bus.c
+++ b/hw/scsi-bus.c
@@ -282,7 +282,7 @@ static const struct SCSIReqOps reqops_invalid_opcode = {
 
 static int32_t scsi_unit_attention(SCSIRequest *req, uint8_t *buf)
 {
-if (req-dev  req-dev-unit_attention.key == UNIT_ATTENTION) {
+if (req-dev-unit_attention.key == UNIT_ATTENTION) {
 scsi_req_build_sense(req, req-dev-unit_attention);
 } else if (req-bus-unit_attention.key == UNIT_ATTENTION) {
 scsi_req_build_sense(req, req-bus-unit_attention);
-- 
1.7.11.7

Re: [Qemu-devel] [PATCH 4/4] block/vdi: Improved return values from vdi_open and other small fixes

Am 15.12.2012 15:09, schrieb Stefan Weil:
 vdi_open returned -1 in case of any error, but it should return an
 error code (negative value of errno or BDRV_WRONG_FORMAT).
 
 vdi_open did not check for a bad signature. This check was only in vdi_probe.
 
 The signature is a 32 bit value and needs up to 8 hex digits for printing.
 
 Signed-off-by: Stefan Weil s...@weilnetz.de

Sounds like three independent changes and should be three patches therefore.

Kevin

Re: [Qemu-devel] [QEMU PATCH v2] virtio-net: introduce a new macaddr control

On Thu, Jan 17, 2013 at 11:49:20AM +1030, Rusty Russell wrote:
 ak...@redhat.com writes:
  @@ -349,6 +351,14 @@ static int virtio_net_handle_mac(VirtIONet *n, uint8_t 
  cmd,
   {
   struct virtio_net_ctrl_mac mac_data;
   
  +if (cmd == VIRTIO_NET_CTRL_MAC_ADDR_SET  elem-out_num == 2 
  +elem-out_sg[1].iov_len == ETH_ALEN) {
  +/* Set MAC address */
  +memcpy(n-mac, elem-out_sg[1].iov_base, elem-out_sg[1].iov_len);
  +qemu_format_nic_info_str(n-nic-nc, n-mac);
  +return VIRTIO_NET_OK;
  +}
 
 Does the rest of the net device still rely on the layout of descriptors?
 If so, OK, we'll fix them all together.  If not, this introduces a new
 one.
 
 Cheers,
 Rusty.

The following fixes all existing users.
Got to deal with some urgent stuff so did not test yet -
Amos, would you like to include this in your patchset
and build on it, test it all together?
If not I'll get to it next week.

---

virtio-net: remove layout assumptions for ctrl vq

Signed-off-by: Michael S. Tsirkin m...@redhat.com

---

diff --git a/hw/virtio-net.c b/hw/virtio-net.c
index 4d80a25..5d1e084 100644
--- a/hw/virtio-net.c
+++ b/hw/virtio-net.c
@@ -316,44 +316,44 @@ static void virtio_net_set_features(VirtIODevice *vdev, 
uint32_t features)
 }
 
 static int virtio_net_handle_rx_mode(VirtIONet *n, uint8_t cmd,
- VirtQueueElement *elem)
+ struct iovec *iov, unsigned int iov_cnt)
 {
 uint8_t on;
+size_t s;
 
-if (elem-out_num != 2 || elem-out_sg[1].iov_len != sizeof(on)) {
-error_report(virtio-net ctrl invalid rx mode command);
-exit(1);
+s = iov_to_buf(iov, iov_cnt, 0, on, sizeof on);
+if (s != sizeof on) {
+return VIRTIO_NET_ERR;
 }
 
-on = ldub_p(elem-out_sg[1].iov_base);
-
-if (cmd == VIRTIO_NET_CTRL_RX_MODE_PROMISC)
+if (cmd == VIRTIO_NET_CTRL_RX_MODE_PROMISC) {
 n-promisc = on;
-else if (cmd == VIRTIO_NET_CTRL_RX_MODE_ALLMULTI)
+} else if (cmd == VIRTIO_NET_CTRL_RX_MODE_ALLMULTI) {
 n-allmulti = on;
-else if (cmd == VIRTIO_NET_CTRL_RX_MODE_ALLUNI)
+} else if (cmd == VIRTIO_NET_CTRL_RX_MODE_ALLUNI) {
 n-alluni = on;
-else if (cmd == VIRTIO_NET_CTRL_RX_MODE_NOMULTI)
+} else if (cmd == VIRTIO_NET_CTRL_RX_MODE_NOMULTI) {
 n-nomulti = on;
-else if (cmd == VIRTIO_NET_CTRL_RX_MODE_NOUNI)
+} else if (cmd == VIRTIO_NET_CTRL_RX_MODE_NOUNI) {
 n-nouni = on;
-else if (cmd == VIRTIO_NET_CTRL_RX_MODE_NOBCAST)
+} else if (cmd == VIRTIO_NET_CTRL_RX_MODE_NOBCAST) {
 n-nobcast = on;
-else
+} else {
 return VIRTIO_NET_ERR;
+}
 
 return VIRTIO_NET_OK;
 }
 
 static int virtio_net_handle_mac(VirtIONet *n, uint8_t cmd,
- VirtQueueElement *elem)
+ struct iovec *iov, unsigned int iov_cnt)
 {
 struct virtio_net_ctrl_mac mac_data;
+size_t s;
 
-if (cmd != VIRTIO_NET_CTRL_MAC_TABLE_SET || elem-out_num != 3 ||
-elem-out_sg[1].iov_len  sizeof(mac_data) ||
-elem-out_sg[2].iov_len  sizeof(mac_data))
+if (cmd != VIRTIO_NET_CTRL_MAC_TABLE_SET) {
 return VIRTIO_NET_ERR;
+}
 
 n-mac_table.in_use = 0;
 n-mac_table.first_multi = 0;
@@ -361,54 +361,64 @@ static int virtio_net_handle_mac(VirtIONet *n, uint8_t 
cmd,
 n-mac_table.multi_overflow = 0;
 memset(n-mac_table.macs, 0, MAC_TABLE_ENTRIES * ETH_ALEN);
 
-mac_data.entries = ldl_p(elem-out_sg[1].iov_base);
+s = iov_to_buf(iov, iov_cnt, 0, mac_data.entries, sizeof 
mac_data.entries);
+if (s != sizeof mac_data.entries) {
+return VIRTIO_NET_ERR;
+}
+
+iov_discard_front(iov, iov_cnt, s);
+assert(s == sizeof mac_data.entries);
 
-if (sizeof(mac_data.entries) +
-(mac_data.entries * ETH_ALEN)  elem-out_sg[1].iov_len)
+if (mac_data.entries * ETH_ALEN  iov_size(iov, iov_cnt)) {
 return VIRTIO_NET_ERR;
+}
 
 if (mac_data.entries = MAC_TABLE_ENTRIES) {
-memcpy(n-mac_table.macs, elem-out_sg[1].iov_base + sizeof(mac_data),
-   mac_data.entries * ETH_ALEN);
+s = iov_to_buf(iov, iov_cnt, 0, n-mac_table.macs,
+   mac_data.entries * ETH_ALEN);
 n-mac_table.in_use += mac_data.entries;
 } else {
 n-mac_table.uni_overflow = 1;
 }
 
+iov_discard_front(iov, iov_cnt, mac_data.entries * ETH_ALEN);
+
 n-mac_table.first_multi = n-mac_table.in_use;
 
-mac_data.entries = ldl_p(elem-out_sg[2].iov_base);
+s = iov_to_buf(iov, iov_cnt, 0, mac_data.entries, sizeof 
mac_data.entries);
+if (s != sizeof mac_data.entries) {
+return VIRTIO_NET_ERR;
+}
+
+iov_discard_front(iov, iov_cnt, s);
+assert(s == sizeof mac_data.entries);
 
-if (sizeof(mac_data.entries) +
-(mac_data.entries * ETH_ALEN)  elem-out_sg[2].iov_len)
+if (mac_data.entries * ETH_ALEN

Re: [Qemu-devel] [PATCH 00/14] migration queue

Il 16/01/2013 19:14, Anthony Liguori ha scritto:
 Juan Quintela quint...@redhat.com writes:
 
 Hi

 This is the intersect of the paolo  me patches for migration thread,
 please consided for inclusion.

 The following changes since commit cf7c3f0cb5a7129f57fa9e69d410d6a05031988c:

   virtio-9p: fix compilation error. (2013-01-14 18:52:39 -0600)

 are available in the git repository at:

   git://repo.or.cz/qemu/quintela.git thread.next

 for you to fetch changes up to 869342e49d89763f7590ebc52eaecd9ce9f7baa1:

   Rename buffered_ to migration_ (2013-01-15 12:14:40 +0100)
 
 If this a PULL request, you should put 'PULL' in the subject.

It shouldn't be, because the patches have never been posted before.
That said, I'm okay with pulling all patches except the last one.

Paolo

Re: [Qemu-devel] [PATCH 0/4] block: Fix error report for wrong file format

Am 17.01.2013 09:33, schrieb Stefan Hajnoczi:
 On Wed, Jan 16, 2013 at 07:53:35PM +0100, Stefan Weil wrote:
 Am 15.12.2012 15:09, schrieb Stefan Weil:
 These patches improve the error report if the file format was
 specified explicitly (example: -drive file=myfile,format=qcow2)
 and the given format does not match the real format.

 This fixes those bugs:

 https://bugzilla.redhat.com/show_bug.cgi?id=556482
 https://bugs.launchpad.net/qemu/+bug/1090600

 [PATCH 1/4] block: Add special error code for wrong format
 [PATCH 2/4] block: Improve error report for wrong format
 [PATCH 3/4] block: Use new error code for wrong format in selected
 [PATCH 4/4] block/vdi: Improved return values from vdi_open and

 Hi Stefan und Kevin,

 these patches are still in my local queue.

 Do you plan to add them to the block queue, or would
 you prefer another solution for the open bug reports?
 
 Looks okay to me.  I'm not thrilled about introducing a non-system error
 code, would have rather have used EINVAL or ENOTTY.  But that's not a
 killer and I see the reason you chose to do that.
 
 Kevin: Any comments before I merge this?

Yes, I commented on the patches. I think the minimum that should change
is moving the error code definition to where other error codes are
defined in order to avoid future collisions.

Ideally we'd convert bdrv_open to Error and avoid all this error code
stuff, but I'm not requesting this now.

Kevin

Re: [Qemu-devel] [RFC V1 10/14] qapi: Add support for deduplication infos in qapi-schema.json.

2013-01-17 Thread Benoît Canet

 +# @running:   True if deduplication is running

Internally QCOW2 deduplication state switch between STOPPED, STARTING, RUNNING
and STOPPING.

Should the running field be a status field reflecting all theses states in a
string for example ?
Or is the boolean ok ?

Regards

Benoît

Re: [Qemu-devel] [PATCH 0/2] win32-aio fixes

Il 16/01/2013 21:19, Kevin Wolf ha scritto:
 Paolo, especially the first one is worrying with respect to the test status of
 this code. We should probably give it some additional testing.
 
 Kevin Wolf (2):
   win32-aio: Fix vectored reads
   win32-aio: Fix memory leak
 
  block/win32-aio.c |4 ++--
  1 files changed, 2 insertions(+), 2 deletions(-)
 

Yes, the worrying part is especially that IIUC qtest does not support
Windows.  There's no way to get good coverage without qtest.

Paolo

Re: [Qemu-devel] [QEMU PATCH v3] virtio-net: introduce a new macaddr control

On Thu, Jan 17, 2013 at 06:30:46PM +0800, ak...@redhat.com wrote:
 From: Amos Kong ak...@redhat.com
 
 In virtio-net guest driver, currently we write MAC address to
 pci config space byte by byte, this means that we have an
 intermediate step where mac is wrong. This patch introduced
 a new control command to set MAC address, it's atomic.
 
 VIRTIO_NET_F_CTRL_MAC_ADDR is a new feature bit for compatibility.
 
 mac field will be set to read-only when VIRTIO_NET_F_CTRL_MAC_ADDR
 is acked.
 
 Signed-off-by: Amos Kong ak...@redhat.com
 ---
 V2: check guest's iov_len
 V3: fix of migration compatibility
 make mac field in config space read-only when new feature is acked
 ---
  hw/pc_piix.c|  4 
  hw/virtio-net.c | 10 +-
  hw/virtio-net.h | 12 ++--
  3 files changed, 23 insertions(+), 3 deletions(-)

Reviewed-by: Stefan Hajnoczi stefa...@redhat.com

Re: [Qemu-devel] [PATCH 00/14] migration queue

Paolo Bonzini pbonz...@redhat.com wrote:
 Il 16/01/2013 19:14, Anthony Liguori ha scritto:
 Juan Quintela quint...@redhat.com writes:
 
 Hi

 This is the intersect of the paolo  me patches for migration thread,
 please consided for inclusion.

 The following changes since commit cf7c3f0cb5a7129f57fa9e69d410d6a05031988c:

   virtio-9p: fix compilation error. (2013-01-14 18:52:39 -0600)

 are available in the git repository at:

   git://repo.or.cz/qemu/quintela.git thread.next

 for you to fetch changes up to 869342e49d89763f7590ebc52eaecd9ce9f7baa1:

   Rename buffered_ to migration_ (2013-01-15 12:14:40 +0100)
 
 If this a PULL request, you should put 'PULL' in the subject.

 It shouldn't be, because the patches have never been posted before.
 That said, I'm okay with pulling all patches except the last one.

I will add that as reviewed by? O:-)

Sending all less the last one with proper PULL request.

Later, Juan.

[Qemu-devel] [Bug 1087114] Re: assertion QLIST_EMPTY(bs-tracked_requests) failed

2013-01-17 Thread Brad Smith

The other question I have is if you look at the commit I mentioned as
causing the crash (at least on OpenBSD) and revert that change from
either 1.3.0 or HEAD branch and build QEMU on OS X does the crashing
you're experiencing go away?

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1087114

Title:
  assertion QLIST_EMPTY(bs-tracked_requests) failed

Status in QEMU:
  New

Bug description:
  QEMU 1.3.0 on OpenBSD now crashes with an error as shown below and the
  command line params do not seem to matter.

  assertion QLIST_EMPTY(bs-tracked_requests) failed: file block.c,
  line 1220, function bdrv_drain_all

  #1  0x030d1bce24aa in abort () at /usr/src/lib/libc/stdlib/abort.c:70
  p = (struct atexit *) 0x30d11897000
  mask = 4294967263
  cleanup_called = 1
  #2  0x030d1bc5ff44 in __assert2 (file=Variable file is not available.
  ) at /usr/src/lib/libc/gen/assert.c:52
  No locals.
  #3  0x030b0d383a03 in bdrv_drain_all () at block.c:1220
  bs = (BlockDriverState *) 0x30d13f3b630
  busy = false
  __func__ = bdrv_drain_all
  #4  0x030b0d43acfc in bmdma_cmd_writeb (bm=0x30d0f5f56a8, val=8) at 
hw/ide/pci.c:312
  __func__ = bmdma_cmd_writeb
  #5  0x030b0d43b450 in bmdma_write (opaque=0x30d0f5f56a8, addr=0, val=8, 
size=1) at hw/ide/piix.c:76
  bm = (BMDMAState *) 0x30d0f5f56a8
  #6  0x030b0d5c2ce6 in memory_region_write_accessor (opaque=0x30d0f5f57d0, 
addr=0, value=0x30d18c288f0, size=1, shift=0, mask=255)
  at /home/ports/pobj/qemu-1.3.0-debug/qemu-1.3.0/memory.c:334
  mr = (MemoryRegion *) 0x30d0f5f57d0
  tmp = 8
  #7  0x030b0d5c2dc5 in access_with_adjusted_size (addr=0, 
value=0x30d18c288f0, size=1, access_size_min=1, access_size_max=4, 
  access=0x30b0d5c2c6b memory_region_write_accessor, 
opaque=0x30d0f5f57d0) at 
/home/ports/pobj/qemu-1.3.0-debug/qemu-1.3.0/memory.c:364
  access_mask = 255
  access_size = 1
  i = 0
  #8  0x030b0d5c3222 in memory_region_iorange_write (iorange=0x30d1d5e7400, 
offset=0, width=1, data=8)
  at /home/ports/pobj/qemu-1.3.0-debug/qemu-1.3.0/memory.c:439
  mrio = (MemoryRegionIORange *) 0x30d1d5e7400
  mr = (MemoryRegion *) 0x30d0f5f57d0
  __func__ = memory_region_iorange_write
  #9  0x030b0d5c019a in ioport_writeb_thunk (opaque=0x30d1d5e7400, 
addr=49216, data=8) at /home/ports/pobj/qemu-1.3.0-debug/qemu-1.3.0/ioport.c:212
  ioport = (IORange *) 0x30d1d5e7400
  #10 0x030b0d5bfb65 in ioport_write (index=0, address=49216, data=8) at 
/home/ports/pobj/qemu-1.3.0-debug/qemu-1.3.0/ioport.c:83
  func = (IOPortWriteFunc *) 0x30b0d5c0148 ioport_writeb_thunk
  default_func = {0x30b0d5bfbbc default_ioport_writeb, 0x30b0d5bfc61 
default_ioport_writew, 0x30b0d5bfd0c default_ioport_writel}
  #11 0x030b0d5c0704 in cpu_outb (addr=49216, val=8 '\b') at 
/home/ports/pobj/qemu-1.3.0-debug/qemu-1.3.0/ioport.c:289
  No locals.
  #12 0x030b0d6067dd in helper_outb (port=49216, data=8) at 
/home/ports/pobj/qemu-1.3.0-debug/qemu-1.3.0/target-i386/misc_helper.c:72
  No locals.

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1087114/+subscriptions

[Qemu-devel] [Bug 1087114] Re: assertion QLIST_EMPTY(bs-tracked_requests) failed

2013-01-17 Thread Brad Smith

Before the patch in question was commited running QEMU 1.3.0 hosted on
OpenBSD I was able to cause QEMU to crash reproducibly by just booting
OpenBSD within QEMU and upon the kernel accessing the virtual disk to
read the disklabel or during an install writing the disklabel. After the
patch was applied I was not able to cause any crashes and went through a
handful of installs without any issues.

Are you able to build QEMU with debug symbols and get a backtrace once
it has crashed on your OS X system?

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1087114

Title:
  assertion QLIST_EMPTY(bs-tracked_requests) failed

Status in QEMU:
  New

Bug description:
  QEMU 1.3.0 on OpenBSD now crashes with an error as shown below and the
  command line params do not seem to matter.

  assertion QLIST_EMPTY(bs-tracked_requests) failed: file block.c,
  line 1220, function bdrv_drain_all

  #1  0x030d1bce24aa in abort () at /usr/src/lib/libc/stdlib/abort.c:70
  p = (struct atexit *) 0x30d11897000
  mask = 4294967263
  cleanup_called = 1
  #2  0x030d1bc5ff44 in __assert2 (file=Variable file is not available.
  ) at /usr/src/lib/libc/gen/assert.c:52
  No locals.
  #3  0x030b0d383a03 in bdrv_drain_all () at block.c:1220
  bs = (BlockDriverState *) 0x30d13f3b630
  busy = false
  __func__ = bdrv_drain_all
  #4  0x030b0d43acfc in bmdma_cmd_writeb (bm=0x30d0f5f56a8, val=8) at 
hw/ide/pci.c:312
  __func__ = bmdma_cmd_writeb
  #5  0x030b0d43b450 in bmdma_write (opaque=0x30d0f5f56a8, addr=0, val=8, 
size=1) at hw/ide/piix.c:76
  bm = (BMDMAState *) 0x30d0f5f56a8
  #6  0x030b0d5c2ce6 in memory_region_write_accessor (opaque=0x30d0f5f57d0, 
addr=0, value=0x30d18c288f0, size=1, shift=0, mask=255)
  at /home/ports/pobj/qemu-1.3.0-debug/qemu-1.3.0/memory.c:334
  mr = (MemoryRegion *) 0x30d0f5f57d0
  tmp = 8
  #7  0x030b0d5c2dc5 in access_with_adjusted_size (addr=0, 
value=0x30d18c288f0, size=1, access_size_min=1, access_size_max=4, 
  access=0x30b0d5c2c6b memory_region_write_accessor, 
opaque=0x30d0f5f57d0) at 
/home/ports/pobj/qemu-1.3.0-debug/qemu-1.3.0/memory.c:364
  access_mask = 255
  access_size = 1
  i = 0
  #8  0x030b0d5c3222 in memory_region_iorange_write (iorange=0x30d1d5e7400, 
offset=0, width=1, data=8)
  at /home/ports/pobj/qemu-1.3.0-debug/qemu-1.3.0/memory.c:439
  mrio = (MemoryRegionIORange *) 0x30d1d5e7400
  mr = (MemoryRegion *) 0x30d0f5f57d0
  __func__ = memory_region_iorange_write
  #9  0x030b0d5c019a in ioport_writeb_thunk (opaque=0x30d1d5e7400, 
addr=49216, data=8) at /home/ports/pobj/qemu-1.3.0-debug/qemu-1.3.0/ioport.c:212
  ioport = (IORange *) 0x30d1d5e7400
  #10 0x030b0d5bfb65 in ioport_write (index=0, address=49216, data=8) at 
/home/ports/pobj/qemu-1.3.0-debug/qemu-1.3.0/ioport.c:83
  func = (IOPortWriteFunc *) 0x30b0d5c0148 ioport_writeb_thunk
  default_func = {0x30b0d5bfbbc default_ioport_writeb, 0x30b0d5bfc61 
default_ioport_writew, 0x30b0d5bfd0c default_ioport_writel}
  #11 0x030b0d5c0704 in cpu_outb (addr=49216, val=8 '\b') at 
/home/ports/pobj/qemu-1.3.0-debug/qemu-1.3.0/ioport.c:289
  No locals.
  #12 0x030b0d6067dd in helper_outb (port=49216, data=8) at 
/home/ports/pobj/qemu-1.3.0-debug/qemu-1.3.0/target-i386/misc_helper.c:72
  No locals.

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1087114/+subscriptions

Re: [Qemu-devel] [RFC qom-cpu 03/15] target-i386: Update CPU to QOM realizefn

2013-01-17 Thread Eduardo Habkost

On Thu, Jan 17, 2013 at 09:03:59AM +0100, Andreas Färber wrote:
[...]
  I mentioned in the cover letter that this needs to be changed once a
  CPUClass-level realizefn is introduced. I could introduce a no-op
  realizefn there and do the regular store+call.
  
  That was the semantics I was expecting: base classes would safely
  introduce realize functions without worrying if subclasses would
  override it incorrectly and break it.
 
 We could do that if we fix up the respective DeviceClass::init,
 SysBusDeviceClass::init etc. code. Question is (just as with some x86
 CPU code) whether it's worth cleaning up when we know that it is to be
 refactored later.

Actually I am not sure it would be nice to require every single class to
save/call the parent realize function. I am starting to like the more
relaxed requirement.  :-)


 
  Anyway, saving the parent function in every subclass is so cumbersome
  that simply documenting it as CPUClass subclasses must call
  qemu_init_vcpu() sounds easier than CPUClass subclasses must save the
  parent's realize() and call it.
 [snip]
 
 Actually that particular piece of code is unrelated to this discussion
 since qemu_init_vcpu() still operates on CPUArchState and thus cannot be
 moved into CPUClass yet. The reason is that
 cpus.c:qemu_kvm_cpu_thread_fn sets cpu_single_env, and I do not see a
 solution for that - suggestions or patches welcome.

I used qemu_init_vcpu() as an example because it's something called by
the realize function for all targets, and one day could be called by a
common CPUClass realize function. I didn't check if it was possible to
convert it today, already.

My point is: if you need to save the pointer and call the parent realize
function only if documented and required by the parent class, the parent
could as well simply document it as subclasses of TYPE_FOO should
manually call foo_realize() if they override the realize function
instead of subclasses of TYPE_FOO should save and call the parent
realize function if they override de realize function. Won't it be
easier and simpler?

 
 However, I see that kvm-all.c:kvm_on_sigbus_vcpu() can be switched to
 CPUState now, so that cpus.c:qemu_kvm_eat_signals() can be changed to
 CPUState, used from cpus.c:qemu_kvm_wait_io_event().
 But cpus.c:cpu_thread_is_idle() still uses env-halted, which is blocked
 by the search for an acceptable solution to flush the TLB at CPUState
 level (exec.c:cpu_common_post_load()).
 
 Andreas
 
 -- 
 SUSE LINUX Products GmbH, Maxfeldstr. 5, 90409 Nürnberg, Germany
 GF: Jeff Hawn, Jennifer Guild, Felix Imendörffer; HRB 16746 AG Nürnberg

-- 
Eduardo

Re: [Qemu-devel] [PATCH v2 0/2] fix two revision related errors

2013-01-17 Thread Gerd Hoffmann

On 01/16/13 18:59, Alon Levy wrote:
 Regarding orientation setting in windows 7 64 guest:
 Desktop, right click-Screen resolution
  - You can choose Orientation: Landscape, Portrait, Landscape (flipped), 
 Portrait (flipped)
  - You can choose Resolution
  - You can click Advanced Settings, then List All Modes at the bottom, 
 you get all the modes (i.e. four of each resolution, one for each orientation)

Ah, ok.  The driver seems to handle portrait and swap x+y when creating
a displaysurface.  At least I get a 600x800 display upright.

I can't see a difference between Landscape + Landscape (flipped).
Likewise Portrait + Portrait (flipped).  Is there any?

 There are two changes after applying the change rom size to 8192 patch:
  - there is no longer an Orientation option
  - the modes listed under List All Modes reduce as expected

Ok, so we loose the Portrait mode.

 Changes to the second patch:
  - no orientations except the normal

Keeping orientation 0+1 (and dropping the flipped 2+3 versions) should
make the mode list small enougth that it fits while maintaining support
for the portrait mode.

I think it would also be good to fix the driver to ignore everything with or

How about that?

  - hard code 8192 bytes rom size
  - assert if the required size is larger

Good.

cheers,
  Gerd

Re: [Qemu-devel] [PATCH] Makefile: drop recursive libcacard clean

On Tue, Jan 15, 2013 at 08:47:26AM +0100, Stefan Hajnoczi wrote:
 Commit eb8eb53e5846a957cf333f2e1ec8cb6e0c04 (libcacard: rewrite
 Makefile in non-recursive style) refactored libcacard/Makefile so it
 can be included by the top-level Makefile.
 
 The top-level clean target still loops over subdirectories, including
 libcacard/, to invoke recursive clean.  Remove libcacard from the
 recursive clean since its files are already included at the top level.
 
 Signed-off-by: Stefan Hajnoczi stefa...@redhat.com
 ---
  Makefile | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/Makefile b/Makefile
 index 7622a4c..0ecfcda 100644
 --- a/Makefile
 +++ b/Makefile
 @@ -226,7 +226,7 @@ clean:
   rm -rf qapi-generated
   rm -rf qga/qapi-generated
   $(MAKE) -C tests/tcg clean
 - for d in $(ALL_SUBDIRS) libcacard; do \
 + for d in $(ALL_SUBDIRS); do \
   if test -d $$d; then $(MAKE) -C $$d $@ || exit 1; fi; \
   rm -f $$d/qemu-options.def; \
  done

Ping.  Please apply so that make clean succeeds.

Stefan

Re: [Qemu-devel] [PATCH v2] win32-aio: use iov utility functions instead of open-coding them

On Thu, Jan 17, 2013 at 02:44:41PM +0400, Michael Tokarev wrote:
 We have iov_from_buf() and iov_to_buf(), use them instead of
 open-coding these in block/win32-aio.c

Please use qemu_iovec_from_buf() and qemu_iovec_to_buf() since we're
operating on a QEMUIOVector.

Stefan

Re: [Qemu-devel] [Qemu-trivial] [PATCH v2 06/11] virtfs-proxy-helper: Fix unchecked strdup() by conv. to g_strdup()

Stefan Hajnoczi stefa...@gmail.com writes:

 On Wed, Jan 16, 2013 at 06:32:15PM +0100, Markus Armbruster wrote:
 Signed-off-by: Markus Armbruster arm...@redhat.com
 Reviewed-by: Eric Blake ebl...@redhat.com
 ---
  fsdev/virtfs-proxy-helper.c | 4 ++--
  1 file changed, 2 insertions(+), 2 deletions(-)
 
 diff --git a/fsdev/virtfs-proxy-helper.c b/fsdev/virtfs-proxy-helper.c
 index 6b9afd3..36f6616 100644
 --- a/fsdev/virtfs-proxy-helper.c
 +++ b/fsdev/virtfs-proxy-helper.c
 @@ -1039,7 +1039,7 @@ int main(int argc, char **argv)
  }
  switch (c) {
  case 'p':
 -rpath = strdup(optarg);
 +rpath = g_strdup(optarg);
  break;
  case 'n':
  is_daemon = false;
 @@ -1048,7 +1048,7 @@ int main(int argc, char **argv)
  sock = atoi(optarg);
  break;
  case 's':
 -sock_name = strdup(optarg);
 +sock_name = g_strdup(optarg);

 rpath and sock_name are leaked.  Not important though because they are
 in main().

Yup.  Freeing stuff before main returns isn't worth your while or mine
:)

Re: [Qemu-devel] [PATCH 0/8] Fixes and cleanups around fw_cfg

2013-01-17 Thread Gleb Natapov

On Wed, Jan 16, 2013 at 02:50:21PM +0100, Markus Armbruster wrote:
 Markus Armbruster (8):
   fw_cfg: Replace debug prints by tracepoints
   fw_cfg: Dumb down fw_cfg_add_*() not to return success / failure
   fw_cfg: New fw_cfg_add_string()
   pc: Fix unchecked strdup() by switching to fw_cfg_add_string()
   sun4: Fix unchecked strdup() by switching to fw_cfg_add_string()
   pc: Clean up bochs_bios_init()'s (non-)use of sizeof
   fw_cfg: Use void *, size_t instead of uint8_t *, uint32_t for blobs
   vl: Use size_t for sizes in get_boot_devices_list()
 
Reviewed-by: Gleb Natapov g...@redhat.com

  hw/fw_cfg.c | 86 
 -
  hw/fw_cfg.h | 17 +-
  hw/pc.c | 21 ++--
  hw/sun4m.c  | 12 ++-
  hw/sun4u.c  |  4 +--
  include/sysemu/sysemu.h |  2 +-
  trace-events|  7 
  vl.c|  6 ++--
  8 files changed, 68 insertions(+), 87 deletions(-)
 
 -- 
 1.7.11.7

--
Gleb.

Re: [Qemu-devel] [Qemu-trivial] [PATCH v2 08/11] qemu-log: Plug trivial memory leak in cpu_set_log_filename()

Stefan Hajnoczi stefa...@gmail.com writes:

 On Wed, Jan 16, 2013 at 06:32:17PM +0100, Markus Armbruster wrote:
 diff --git a/qemu-log.c b/qemu-log.c
 index 64a1b88..30c8b01 100644
 --- a/qemu-log.c
 +++ b/qemu-log.c
 @@ -21,10 +21,12 @@
  #include qemu/log.h
  
  #ifdef WIN32
 -static const char *logfilename = qemu.log;
 +#define DEFAULT_LOGFILENAME qemu.log
  #else
 -static const char *logfilename = /tmp/qemu.log;
 +#define DEFAULT_LOGFILENAME /tmp/qemu.log
  #endif
 +
 +static const char *logfilename;
 [...]
 @@ -84,6 +88,7 @@ void qemu_set_log(int log_flags, bool use_own_buffers)
  
  void cpu_set_log_filename(const char *filename)
  {
 +g_free((void *)logfilename);

 Might as well drop the const from the variable declaration to indicate
 that we allocate/free this string.

Never thought of const that way.  Dropping const from logfilename is
fine with me.

I wish free()'s parameter was const void *.  Can't be changed now.  Sad
that glib didn't get it right either.

Re: [Qemu-devel] [PATCH v2 03/11] hw/9pfs: Fix unchecked strdup() by converting to g_strdup()

Stefan Hajnoczi stefa...@gmail.com writes:

 On Wed, Jan 16, 2013 at 06:32:12PM +0100, Markus Armbruster wrote:
 diff --git a/hw/9pfs/virtio-9p-device.c b/hw/9pfs/virtio-9p-device.c
 index 6eab7f7..74155fb 100644
 --- a/hw/9pfs/virtio-9p-device.c
 +++ b/hw/9pfs/virtio-9p-device.c
 @@ -94,7 +94,7 @@ VirtIODevice *virtio_9p_init(DeviceState *dev, V9fsConf 
 *conf)
  exit(1);
  }
  
 -s-tag = strdup(conf-tag);
 +s-tag = g_strdup(conf-tag);
  s-ctx.uid = -1;
  
  s-ops = fse-ops;

 s-tag is leaked.  Want to send a follow-up patch to g_free() it?

I'll give it a try.

Re: [Qemu-devel] [PATCH v2 0/2] fix two revision related errors

2013-01-17 Thread Alon Levy



- Original Message -
 On 01/16/13 18:59, Alon Levy wrote:
  Regarding orientation setting in windows 7 64 guest:
  Desktop, right click-Screen resolution
   - You can choose Orientation: Landscape, Portrait, Landscape
   (flipped), Portrait (flipped)
   - You can choose Resolution
   - You can click Advanced Settings, then List All Modes at the
   bottom, you get all the modes (i.e. four of each resolution, one
   for each orientation)
 
 Ah, ok.  The driver seems to handle portrait and swap x+y when
 creating
 a displaysurface.  At least I get a 600x800 display upright.
 
 I can't see a difference between Landscape + Landscape (flipped).
 Likewise Portrait + Portrait (flipped).  Is there any?
 
  There are two changes after applying the change rom size to 8192
  patch:
   - there is no longer an Orientation option
   - the modes listed under List All Modes reduce as expected
 
 Ok, so we loose the Portrait mode.
 
  Changes to the second patch:
   - no orientations except the normal
 
 Keeping orientation 0+1 (and dropping the flipped 2+3 versions)
 should
 make the mode list small enougth that it fits while maintaining
 support
 for the portrait mode.

I'll test if this changes anything for a windows guest  linux guest.

 
 I think it would also be good to fix the driver to ignore everything
 with or

... what was the end of that sentence?

 
 How about that?
 
   - hard code 8192 bytes rom size
   - assert if the required size is larger
 
 Good.
 
 cheers,
   Gerd

[Qemu-devel] [PATCH 07/13] qemu-file: Only set last_error if it is not already set

Signed-off-by: Juan Quintela quint...@redhat.com

Reviewed-by: Reviewed-by: Eric Blake ebl...@redhat.com
Reviewed-by: Paolo Bonzini pbonz...@redhat.com
---
 savevm.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/savevm.c b/savevm.c
index 4e970ca..611e997 100644
--- a/savevm.c
+++ b/savevm.c
@@ -419,7 +419,9 @@ int qemu_file_get_error(QEMUFile *f)

 static void qemu_file_set_error(QEMUFile *f, int ret)
 {
-f-last_error = ret;
+if (f-last_error == 0) {
+f-last_error = ret;
+}
 }

 /** Flushes QEMUFile buffer
-- 
1.8.1

Re: [Qemu-devel] [PATCH v2 0/2] fix two revision related errors

2013-01-17 Thread Gerd Hoffmann

  Hi,

 I think it would also be good to fix the driver to ignore everything
 with or

 ... what was the end of that sentence?

.. orientation != 0, then registers every mode with the orientations it
wants, so orientation becomes unused with newer drivers (and we keep
orientation=0,1 for old driver compatibility).

But maybe this isn't worth the trouble.

cheers,
  Gerd

Re: [Qemu-devel] [PATCH] target-arm: Fix TCG temp leaks for WI and UNDEF VFP sysreg writes

2013-01-17 Thread Peter Maydell

On 11 December 2012 16:11, Peter Maydell peter.mayd...@linaro.org wrote:
 Fix a leak of a TCG temporary in code paths for VFP system register
 writes for cases which UNDEF or are write-ignored.

 Signed-off-by: Peter Maydell peter.mayd...@linaro.org

Rats, I forgot to put this into the last target-arm pullreq...

-- PMM

Re: [Qemu-devel] [PATCH v2] win32-aio: use iov utility functions instead of open-coding them


17.01.2013 17:06, Stefan Hajnoczi wrote:

On Thu, Jan 17, 2013 at 02:44:41PM +0400, Michael Tokarev wrote:

We have iov_from_buf() and iov_to_buf(), use them instead of
open-coding these in block/win32-aio.c


Please use qemu_iovec_from_buf() and qemu_iovec_to_buf() since we're
operating on a QEMUIOVector.


I'd remove qemu_iovec_{from,to}_buf() completely at this point
due to their trivialness and almost no gain in usage as polluting
the namespace (having too many trivial utility functions isn't
good).  Right now these are only used in one place - in
hw/dataplane/virtio-blk.c .

If not, we can at least inline them.

Thanks,

/mjt

[Qemu-devel] [QEMU PATCH v3] virtio-net: introduce a new macaddr control

2013-01-17 Thread akong

From: Amos Kong ak...@redhat.com

In virtio-net guest driver, currently we write MAC address to
pci config space byte by byte, this means that we have an
intermediate step where mac is wrong. This patch introduced
a new control command to set MAC address, it's atomic.

VIRTIO_NET_F_CTRL_MAC_ADDR is a new feature bit for compatibility.

mac field will be set to read-only when VIRTIO_NET_F_CTRL_MAC_ADDR
is acked.

Signed-off-by: Amos Kong ak...@redhat.com
---
V2: check guest's iov_len
V3: fix of migration compatibility
make mac field in config space read-only when new feature is acked
---
 hw/pc_piix.c|  4 
 hw/virtio-net.c | 10 +-
 hw/virtio-net.h | 12 ++--
 3 files changed, 23 insertions(+), 3 deletions(-)

diff --git a/hw/pc_piix.c b/hw/pc_piix.c
index 7268dcd..66606b9 100644
--- a/hw/pc_piix.c
+++ b/hw/pc_piix.c
@@ -295,6 +295,10 @@ static QEMUMachine pc_machine_v1_4 = {
 .driver   = usb-tablet,\
 .property = usb_version,\
 .value= stringify(1),\
+},{\
+.driver   = virtio-net-pci,\
+.property = ctrl_mac_addr,\
+.value= off,  \
 }
 
 static QEMUMachine pc_machine_v1_3 = {
diff --git a/hw/virtio-net.c b/hw/virtio-net.c
index dc7c6d6..941d782 100644
--- a/hw/virtio-net.c
+++ b/hw/virtio-net.c
@@ -93,7 +93,8 @@ static void virtio_net_set_config(VirtIODevice *vdev, const 
uint8_t *config)
 
 memcpy(netcfg, config, sizeof(netcfg));
 
-if (memcmp(netcfg.mac, n-mac, ETH_ALEN)) {
+if (!(n-vdev.guest_features  VIRTIO_NET_F_CTRL_MAC_ADDR  1) 
+memcmp(netcfg.mac, n-mac, ETH_ALEN)) {
 memcpy(n-mac, netcfg.mac, ETH_ALEN);
 qemu_format_nic_info_str(n-nic-nc, n-mac);
 }
@@ -349,6 +350,13 @@ static int virtio_net_handle_mac(VirtIONet *n, uint8_t cmd,
 {
 struct virtio_net_ctrl_mac mac_data;
 
+if (cmd == VIRTIO_NET_CTRL_MAC_ADDR_SET  elem-out_num == 2 
+elem-out_sg[1].iov_len == ETH_ALEN) {
+memcpy(n-mac, elem-out_sg[1].iov_base, elem-out_sg[1].iov_len);
+qemu_format_nic_info_str(n-nic-nc, n-mac);
+return VIRTIO_NET_OK;
+}
+
 if (cmd != VIRTIO_NET_CTRL_MAC_TABLE_SET || elem-out_num != 3 ||
 elem-out_sg[1].iov_len  sizeof(mac_data) ||
 elem-out_sg[2].iov_len  sizeof(mac_data))
diff --git a/hw/virtio-net.h b/hw/virtio-net.h
index d46fb98..1ec632f 100644
--- a/hw/virtio-net.h
+++ b/hw/virtio-net.h
@@ -44,6 +44,8 @@
 #define VIRTIO_NET_F_CTRL_VLAN  19  /* Control channel VLAN filtering */
 #define VIRTIO_NET_F_CTRL_RX_EXTRA 20   /* Extra RX mode control support */
 
+#define VIRTIO_NET_F_CTRL_MAC_ADDR   23 /* Set MAC address */
+
 #define VIRTIO_NET_S_LINK_UP1   /* Link is up */
 
 #define TX_TIMER_INTERVAL 15 /* 150 us */
@@ -106,7 +108,7 @@ typedef uint8_t virtio_net_ctrl_ack;
  #define VIRTIO_NET_CTRL_RX_MODE_NOBCAST  5
 
 /*
- * Control the MAC filter table.
+ * Control the MAC
  *
  * The MAC filter table is managed by the hypervisor, the guest should
  * assume the size is infinite.  Filtering should be considered
@@ -119,6 +121,10 @@ typedef uint8_t virtio_net_ctrl_ack;
  * first sg list contains unicast addresses, the second is for multicast.
  * This functionality is present if the VIRTIO_NET_F_CTRL_RX feature
  * is available.
+ *
+ * The ADDR_SET command requests one out scatterlist, it contains a
+ * 6 bytes MAC address. This functionality is present if the
+ * VIRTIO_NET_F_CTRL_MAC_ADDR feature is available.
  */
 struct virtio_net_ctrl_mac {
 uint32_t entries;
@@ -126,6 +132,7 @@ struct virtio_net_ctrl_mac {
 };
 #define VIRTIO_NET_CTRL_MAC1
  #define VIRTIO_NET_CTRL_MAC_TABLE_SET0
+ #define VIRTIO_NET_CTRL_MAC_ADDR_SET 1
 
 /*
  * Control VLAN filtering
@@ -158,5 +165,6 @@ struct virtio_net_ctrl_mac {
 DEFINE_PROP_BIT(ctrl_vq, _state, _field, VIRTIO_NET_F_CTRL_VQ, 
true), \
 DEFINE_PROP_BIT(ctrl_rx, _state, _field, VIRTIO_NET_F_CTRL_RX, 
true), \
 DEFINE_PROP_BIT(ctrl_vlan, _state, _field, VIRTIO_NET_F_CTRL_VLAN, 
true), \
-DEFINE_PROP_BIT(ctrl_rx_extra, _state, _field, 
VIRTIO_NET_F_CTRL_RX_EXTRA, true)
+DEFINE_PROP_BIT(ctrl_rx_extra, _state, _field, 
VIRTIO_NET_F_CTRL_RX_EXTRA, true), \
+DEFINE_PROP_BIT(ctrl_mac_addr, _state, _field, 
VIRTIO_NET_F_CTRL_MAC_ADDR, true)
 #endif
-- 
1.7.11.7

[Qemu-devel] [PATCH 05/13] migration: remove double call to migrate_fd_close

From: Paolo Bonzini pbonz...@redhat.com

The call in buffered_close is enough, because buffered_close is called
already by migrate_fd_cleanup.

Signed-off-by: Paolo Bonzini pbonz...@redhat.com
Signed-off-by: Juan Quintela quint...@redhat.com

Reviewed-by: Reviewed-by: Eric Blake ebl...@redhat.com
---
 migration.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/migration.c b/migration.c
index 1f4c6ee..5513dde 100644
--- a/migration.c
+++ b/migration.c
@@ -605,7 +605,6 @@ static int buffered_close(void *opaque)
 if (ret = 0) {
 ret = ret2;
 }
-ret = migrate_fd_close(s);
 s-complete = true;
 return ret;
 }
-- 
1.8.1

[Qemu-devel] [PATCH 08/13] migration: move beginning stage to the migration thread

Signed-off-by: Juan Quintela quint...@redhat.com

Reviewed-by: Reviewed-by: Eric Blake ebl...@redhat.com
Reviewed-by: Paolo Bonzini pbonz...@redhat.com
---
 include/migration/migration.h |  1 -
 migration.c   | 28 +++-
 2 files changed, 15 insertions(+), 14 deletions(-)

diff --git a/include/migration/migration.h b/include/migration/migration.h
index 95261c1..a8c9639 100644
--- a/include/migration/migration.h
+++ b/include/migration/migration.h
@@ -54,7 +54,6 @@ struct MigrationState
 bool enabled_capabilities[MIGRATION_CAPABILITY_MAX];
 int64_t xbzrle_cache_size;
 bool complete;
-bool first_time;
 };

 void process_incoming_migration(QEMUFile *f);
diff --git a/migration.c b/migration.c
index 380f3cb..7ae1d93 100644
--- a/migration.c
+++ b/migration.c
@@ -674,17 +674,6 @@ static bool migrate_fd_put_ready(MigrationState *s, 
uint64_t max_size)
 qemu_mutex_unlock_iothread();
 return false;
 }
-if (s-first_time) {
-s-first_time = false;
-DPRINTF(beginning savevm\n);
-ret = qemu_savevm_state_begin(s-file, s-params);
-if (ret  0) {
-DPRINTF(failed, %d\n, ret);
-migrate_fd_error(s);
-qemu_mutex_unlock_iothread();
-return false;
-}
-}

 DPRINTF(iterate\n);
 pending_size = qemu_savevm_state_pending(s-file, max_size);
@@ -733,6 +722,17 @@ static void *buffered_file_thread(void *opaque)
 int64_t initial_time = qemu_get_clock_ms(rt_clock);
 int64_t max_size = 0;
 bool last_round = false;
+int ret;
+
+qemu_mutex_lock_iothread();
+DPRINTF(beginning savevm\n);
+ret = qemu_savevm_state_begin(s-file, s-params);
+if (ret  0) {
+DPRINTF(failed, %d\n, ret);
+qemu_mutex_unlock_iothread();
+goto out;
+}
+qemu_mutex_unlock_iothread();

 while (true) {
 int64_t current_time = qemu_get_clock_ms(rt_clock);
@@ -768,6 +768,10 @@ static void *buffered_file_thread(void *opaque)
 }
 }

+out:
+if (ret  0) {
+migrate_fd_error(s);
+}
 g_free(s-buffer);
 return NULL;
 }
@@ -789,8 +793,6 @@ void migrate_fd_connect(MigrationState *s)
 s-buffer_size = 0;
 s-buffer_capacity = 0;

-s-first_time = true;
-
 s-xfer_limit = s-bandwidth_limit / XFER_LIMIT_RATIO;
 s-complete = false;

-- 
1.8.1

[Qemu-devel] [Bug 1087114] Re: assertion QLIST_EMPTY(bs-tracked_requests) failed

2013-01-17 Thread Aaron Jackson

On line 216 of qemu-thread-posix.c I have commented out the
++sem-count; which seems to be the only change made in that commit.
Unfortunately it still crashes with that error.

I have compiled with --enable-debug but not sure how to get a backtrace
or even a log of what goes wrong.

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1087114

Title:
  assertion QLIST_EMPTY(bs-tracked_requests) failed

Status in QEMU:
  New

Bug description:
  QEMU 1.3.0 on OpenBSD now crashes with an error as shown below and the
  command line params do not seem to matter.

  assertion QLIST_EMPTY(bs-tracked_requests) failed: file block.c,
  line 1220, function bdrv_drain_all

  #1  0x030d1bce24aa in abort () at /usr/src/lib/libc/stdlib/abort.c:70
  p = (struct atexit *) 0x30d11897000
  mask = 4294967263
  cleanup_called = 1
  #2  0x030d1bc5ff44 in __assert2 (file=Variable file is not available.
  ) at /usr/src/lib/libc/gen/assert.c:52
  No locals.
  #3  0x030b0d383a03 in bdrv_drain_all () at block.c:1220
  bs = (BlockDriverState *) 0x30d13f3b630
  busy = false
  __func__ = bdrv_drain_all
  #4  0x030b0d43acfc in bmdma_cmd_writeb (bm=0x30d0f5f56a8, val=8) at 
hw/ide/pci.c:312
  __func__ = bmdma_cmd_writeb
  #5  0x030b0d43b450 in bmdma_write (opaque=0x30d0f5f56a8, addr=0, val=8, 
size=1) at hw/ide/piix.c:76
  bm = (BMDMAState *) 0x30d0f5f56a8
  #6  0x030b0d5c2ce6 in memory_region_write_accessor (opaque=0x30d0f5f57d0, 
addr=0, value=0x30d18c288f0, size=1, shift=0, mask=255)
  at /home/ports/pobj/qemu-1.3.0-debug/qemu-1.3.0/memory.c:334
  mr = (MemoryRegion *) 0x30d0f5f57d0
  tmp = 8
  #7  0x030b0d5c2dc5 in access_with_adjusted_size (addr=0, 
value=0x30d18c288f0, size=1, access_size_min=1, access_size_max=4, 
  access=0x30b0d5c2c6b memory_region_write_accessor, 
opaque=0x30d0f5f57d0) at 
/home/ports/pobj/qemu-1.3.0-debug/qemu-1.3.0/memory.c:364
  access_mask = 255
  access_size = 1
  i = 0
  #8  0x030b0d5c3222 in memory_region_iorange_write (iorange=0x30d1d5e7400, 
offset=0, width=1, data=8)
  at /home/ports/pobj/qemu-1.3.0-debug/qemu-1.3.0/memory.c:439
  mrio = (MemoryRegionIORange *) 0x30d1d5e7400
  mr = (MemoryRegion *) 0x30d0f5f57d0
  __func__ = memory_region_iorange_write
  #9  0x030b0d5c019a in ioport_writeb_thunk (opaque=0x30d1d5e7400, 
addr=49216, data=8) at /home/ports/pobj/qemu-1.3.0-debug/qemu-1.3.0/ioport.c:212
  ioport = (IORange *) 0x30d1d5e7400
  #10 0x030b0d5bfb65 in ioport_write (index=0, address=49216, data=8) at 
/home/ports/pobj/qemu-1.3.0-debug/qemu-1.3.0/ioport.c:83
  func = (IOPortWriteFunc *) 0x30b0d5c0148 ioport_writeb_thunk
  default_func = {0x30b0d5bfbbc default_ioport_writeb, 0x30b0d5bfc61 
default_ioport_writew, 0x30b0d5bfd0c default_ioport_writel}
  #11 0x030b0d5c0704 in cpu_outb (addr=49216, val=8 '\b') at 
/home/ports/pobj/qemu-1.3.0-debug/qemu-1.3.0/ioport.c:289
  No locals.
  #12 0x030b0d6067dd in helper_outb (port=49216, data=8) at 
/home/ports/pobj/qemu-1.3.0-debug/qemu-1.3.0/target-i386/misc_helper.c:72
  No locals.

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1087114/+subscriptions

[Qemu-devel] [PATCH 02/13] Protect migration_bitmap_sync() with the ramlist lock

From: Paolo Bonzini pbonz...@redhat.com

Signed-off-by: Paolo Bonzini pbonz...@redhat.com
Signed-off-by: Juan Quintela quint...@redhat.com

Reviewed-by: Reviewed-by: Eric Blake ebl...@redhat.com
---
 arch_init.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/arch_init.c b/arch_init.c
index 8c833b6..dada6de 100644
--- a/arch_init.c
+++ b/arch_init.c
@@ -658,9 +658,8 @@ static int ram_save_iterate(QEMUFile *f, void *opaque)

 static int ram_save_complete(QEMUFile *f, void *opaque)
 {
-migration_bitmap_sync();
-
 qemu_mutex_lock_ramlist();
+migration_bitmap_sync();

 /* try transferring iterative blocks of memory */

-- 
1.8.1

[Qemu-devel] [PATCH 03/13] use XFER_LIMIT_RATIO consistently

From: Paolo Bonzini pbonz...@redhat.com

commit 5b4e1eb769eee892b44d3f6b2369b05196442f59

missed this use.

Signed-off-by: Paolo Bonzini pbonz...@redhat.com
Signed-off-by: Juan Quintela quint...@redhat.com

Reviewed-by: Reviewed-by: Eric Blake ebl...@redhat.com
---
 migration.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/migration.c b/migration.c
index c69e864..d6ec3e8 100644
--- a/migration.c
+++ b/migration.c
@@ -650,7 +650,7 @@ static int64_t buffered_set_rate_limit(void *opaque, 
int64_t new_rate)
 new_rate = SIZE_MAX;
 }

-s-xfer_limit = new_rate / 10;
+s-xfer_limit = new_rate / XFER_LIMIT_RATIO;

 out:
 return s-xfer_limit;
-- 
1.8.1

[Qemu-devel] [PATCH 12/13] migration: Only go to the iterate stage if there is anything to send

Signed-off-by: Orit Wasserman owass...@redhat.com
Signed-off-by: Juan Quintela quint...@redhat.com

Reviewed-by: Reviewed-by: Eric Blake ebl...@redhat.com
Reviewed-by: Paolo Bonzini pbonz...@redhat.com
---
 migration.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/migration.c b/migration.c
index 6d3aeed..fe1a103 100644
--- a/migration.c
+++ b/migration.c
@@ -698,7 +698,7 @@ static void *buffered_file_thread(void *opaque)
 DPRINTF(iterate\n);
 pending_size = qemu_savevm_state_pending(s-file, max_size);
 DPRINTF(pending size %lu max %lu\n, pending_size, max_size);
-if (pending_size = max_size) {
+if (pending_size  pending_size = max_size) {
 ret = qemu_savevm_state_iterate(s-file);
 if (ret  0) {
 qemu_mutex_unlock_iothread();
-- 
1.8.1

[Qemu-devel] [PATCH 13/13] migration: remove argument to qemu_savevm_state_cancel

Signed-off-by: Juan Quintela quint...@redhat.com

Reviewed-by: Reviewed-by: Eric Blake ebl...@redhat.com
Reviewed-by: Paolo Bonzini pbonz...@redhat.com
---
 include/sysemu/sysemu.h | 2 +-
 migration.c | 2 +-
 savevm.c| 8 
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/include/sysemu/sysemu.h b/include/sysemu/sysemu.h
index c07d4ee..d65a9f1 100644
--- a/include/sysemu/sysemu.h
+++ b/include/sysemu/sysemu.h
@@ -77,7 +77,7 @@ int qemu_savevm_state_begin(QEMUFile *f,
 const MigrationParams *params);
 int qemu_savevm_state_iterate(QEMUFile *f);
 int qemu_savevm_state_complete(QEMUFile *f);
-void qemu_savevm_state_cancel(QEMUFile *f);
+void qemu_savevm_state_cancel(void);
 uint64_t qemu_savevm_state_pending(QEMUFile *f, uint64_t max_size);
 int qemu_loadvm_state(QEMUFile *f);

diff --git a/migration.c b/migration.c
index fe1a103..77c1971 100644
--- a/migration.c
+++ b/migration.c
@@ -330,7 +330,7 @@ static void migrate_fd_cancel(MigrationState *s)

 s-state = MIG_STATE_CANCELLED;
 notifier_list_notify(migration_state_notifiers, s);
-qemu_savevm_state_cancel(s-file);
+qemu_savevm_state_cancel();

 migrate_fd_cleanup(s);
 }
diff --git a/savevm.c b/savevm.c
index 611e997..913a623 100644
--- a/savevm.c
+++ b/savevm.c
@@ -1590,13 +1590,13 @@ int qemu_savevm_state_begin(QEMUFile *f,

 ret = se-ops-save_live_setup(f, se-opaque);
 if (ret  0) {
-qemu_savevm_state_cancel(f);
+qemu_savevm_state_cancel();
 return ret;
 }
 }
 ret = qemu_file_get_error(f);
 if (ret != 0) {
-qemu_savevm_state_cancel(f);
+qemu_savevm_state_cancel();
 }

 return ret;
@@ -1647,7 +1647,7 @@ int qemu_savevm_state_iterate(QEMUFile *f)
 }
 ret = qemu_file_get_error(f);
 if (ret != 0) {
-qemu_savevm_state_cancel(f);
+qemu_savevm_state_cancel();
 }
 return ret;
 }
@@ -1727,7 +1727,7 @@ uint64_t qemu_savevm_state_pending(QEMUFile *f, uint64_t 
max_size)
 return ret;
 }

-void qemu_savevm_state_cancel(QEMUFile *f)
+void qemu_savevm_state_cancel(void)
 {
 SaveStateEntry *se;

-- 
1.8.1

[Qemu-devel] [PATCH 10/13] migration: move exit condition to migration thread

Signed-off-by: Juan Quintela quint...@redhat.com

Reviewed-by: Reviewed-by: Eric Blake ebl...@redhat.com
Reviewed-by: Paolo Bonzini pbonz...@redhat.com
---
 migration.c | 14 --
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/migration.c b/migration.c
index 17eb27d..651edd5 100644
--- a/migration.c
+++ b/migration.c
@@ -669,12 +669,6 @@ static bool migrate_fd_put_ready(MigrationState *s, 
uint64_t max_size)
 bool last_round = false;

 qemu_mutex_lock_iothread();
-if (s-state != MIG_STATE_ACTIVE) {
-DPRINTF(put_ready returning because of non-active state\n);
-qemu_mutex_unlock_iothread();
-return false;
-}
-
 DPRINTF(iterate\n);
 pending_size = qemu_savevm_state_pending(s-file, max_size);
 DPRINTF(pending size %lu max %lu\n, pending_size, max_size);
@@ -737,9 +731,17 @@ static void *buffered_file_thread(void *opaque)
 while (true) {
 int64_t current_time = qemu_get_clock_ms(rt_clock);

+qemu_mutex_lock_iothread();
+if (s-state != MIG_STATE_ACTIVE) {
+DPRINTF(put_ready returning because of non-active state\n);
+qemu_mutex_unlock_iothread();
+break;
+}
 if (s-complete) {
+qemu_mutex_unlock_iothread();
 break;
 }
+qemu_mutex_unlock_iothread();
 if (current_time = initial_time + BUFFER_DELAY) {
 uint64_t transferred_bytes = s-bytes_xfer;
 uint64_t time_spent = current_time - initial_time;
-- 
1.8.1

[Qemu-devel] [PATCH 04/13] migration: make function static

From: Paolo Bonzini pbonz...@redhat.com

Signed-off-by: Paolo Bonzini pbonz...@redhat.com
Signed-off-by: Juan Quintela quint...@redhat.com

Reviewed-by: Reviewed-by: Eric Blake ebl...@redhat.com
---
 include/migration/migration.h | 2 --
 migration.c   | 4 ++--
 2 files changed, 2 insertions(+), 4 deletions(-)

diff --git a/include/migration/migration.h b/include/migration/migration.h
index 2d5b630..95261c1 100644
--- a/include/migration/migration.h
+++ b/include/migration/migration.h
@@ -87,8 +87,6 @@ void migrate_fd_error(MigrationState *s);

 void migrate_fd_connect(MigrationState *s);

-ssize_t migrate_fd_put_buffer(MigrationState *s, const void *data,
-  size_t size);
 int migrate_fd_close(MigrationState *s);

 void add_migration_state_change_notifier(Notifier *notify);
diff --git a/migration.c b/migration.c
index d6ec3e8..1f4c6ee 100644
--- a/migration.c
+++ b/migration.c
@@ -302,8 +302,8 @@ static void migrate_fd_completed(MigrationState *s)
 notifier_list_notify(migration_state_notifiers, s);
 }

-ssize_t migrate_fd_put_buffer(MigrationState *s, const void *data,
-  size_t size)
+static ssize_t migrate_fd_put_buffer(MigrationState *s, const void *data,
+ size_t size)
 {
 ssize_t ret;

-- 
1.8.1

[Qemu-devel] [PATCH v5 00/12] s390: channel I/O support in qemu.

Hi,

here's the latest incarnation of my channel I/O and virtio-ccw
patchset for qemu, containing various changes over the last one.

(Note that s390: Add a hypercall registration interface. has
already been posted: http://marc.info/?l=qemu-develm=135834160607372w=2)

Changes include:
- Add various defines for magic constants.
- Introduce helpers for various mapping stuff and use them.
- Adapt virtio-ccw to QOM conventions.
- Move the new s390-ccw-virtio machine into an extra file (and an
  extra patch).
- Improve cpu handling during machine init (don't pass around env).

Cornelia Huck (12):
  s390: Add a hypercall registration interface.
  s390: Lowcore mapping helper.
  s390: Add mapping helper functions.
  Update linux headers.
  s390: Channel I/O basic defintions.
  s390: I/O interrupt and machine check injection.
  s390: Add channel I/O instructions.
  s390: Virtual channel subsystem support.
  s390: Wire up channel I/O in kvm.
  s390: Add new channel I/O based virtio transport.
  s390-virtio: Factor out some initialization code.
  s390: Add s390-ccw-virtio machine.

 hw/s390-virtio.c |  240 
 hw/s390-virtio.h |   28 +
 hw/s390x/Makefile.objs   |4 +
 hw/s390x/css.c   | 1131 ++
 hw/s390x/css.h   |   92 +++
 hw/s390x/s390-virtio-ccw.c   |  141 +
 hw/s390x/s390-virtio-hcall.c |   36 ++
 hw/s390x/virtio-ccw.c|  906 +++
 hw/s390x/virtio-ccw.h|   79 +++
 linux-headers/asm-generic/kvm_para.h |4 +
 linux-headers/asm-powerpc/kvm_para.h |2 +-
 linux-headers/linux/kvm.h|   21 +
 target-s390x/Makefile.objs   |2 +-
 target-s390x/cpu.h   |  257 +++-
 target-s390x/helper.c|  200 +-
 target-s390x/ioinst.c|  709 +
 target-s390x/ioinst.h|  223 +++
 target-s390x/kvm.c   |  254 +++-
 target-s390x/misc_helper.c   |2 +-
 trace-events |   18 +
 20 files changed, 4215 insertions(+), 134 deletions(-)
 create mode 100644 hw/s390-virtio.h
 create mode 100644 hw/s390x/css.c
 create mode 100644 hw/s390x/css.h
 create mode 100644 hw/s390x/s390-virtio-ccw.c
 create mode 100644 hw/s390x/s390-virtio-hcall.c
 create mode 100644 hw/s390x/virtio-ccw.c
 create mode 100644 hw/s390x/virtio-ccw.h
 create mode 100644 linux-headers/asm-generic/kvm_para.h
 create mode 100644 target-s390x/ioinst.c
 create mode 100644 target-s390x/ioinst.h

-- 
1.7.12.4

[Qemu-devel] [PATCH 01/13] Unlock ramlist lock also in error case

From: Paolo Bonzini pbonz...@redhat.com

Signed-off-by: Paolo Bonzini pbonz...@redhat.com
Signed-off-by: Juan Quintela quint...@redhat.com

Reviewed-by: Reviewed-by: Eric Blake ebl...@redhat.com
---
 arch_init.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/arch_init.c b/arch_init.c
index 86f8544..8c833b6 100644
--- a/arch_init.c
+++ b/arch_init.c
@@ -642,12 +642,13 @@ static int ram_save_iterate(QEMUFile *f, void *opaque)
 i++;
 }

+qemu_mutex_unlock_ramlist();
+
 if (ret  0) {
 bytes_transferred += total_sent;
 return ret;
 }

-qemu_mutex_unlock_ramlist();
 qemu_put_be64(f, RAM_SAVE_FLAG_EOS);
 total_sent += 8;
 bytes_transferred += total_sent;
-- 
1.8.1

[Qemu-devel] [PATCH 12/12] s390: Add s390-ccw-virtio machine.

Add a new machine type, s390-ccw-virtio, making use of the
virtio-ccw transport to present virtio devices as channel
devices and make it the default on s390.

Signed-off-by: Cornelia Huck cornelia.h...@de.ibm.com
---
 hw/s390-virtio.c   |   1 -
 hw/s390-virtio.h   |   1 +
 hw/s390x/Makefile.objs |   1 +
 hw/s390x/s390-virtio-ccw.c | 141 +
 4 files changed, 143 insertions(+), 1 deletion(-)
 create mode 100644 hw/s390x/s390-virtio-ccw.c

diff --git a/hw/s390-virtio.c b/hw/s390-virtio.c
index 603f6b0..3e58bc2 100644
--- a/hw/s390-virtio.c
+++ b/hw/s390-virtio.c
@@ -353,7 +353,6 @@ static QEMUMachine s390_machine = {
 .no_sdcard = 1,
 .use_virtcon = 1,
 .max_cpus = 255,
-.is_default = 1,
 DEFAULT_MACHINE_OPTIONS,
 };
 
diff --git a/hw/s390-virtio.h b/hw/s390-virtio.h
index aefc99d..a2cad40 100644
--- a/hw/s390-virtio.h
+++ b/hw/s390-virtio.h
@@ -15,6 +15,7 @@
 #define KVM_S390_VIRTIO_NOTIFY  0
 #define KVM_S390_VIRTIO_RESET   1
 #define KVM_S390_VIRTIO_SET_STATUS  2
+#define KVM_S390_VIRTIO_CCW_NOTIFY  3
 
 typedef int (*s390_virtio_fn)(const uint64_t *args);
 void s390_register_virtio_hypercall(uint64_t code, s390_virtio_fn fn);
diff --git a/hw/s390x/Makefile.objs b/hw/s390x/Makefile.objs
index 71ad255..54688b4 100644
--- a/hw/s390x/Makefile.objs
+++ b/hw/s390x/Makefile.objs
@@ -6,4 +6,5 @@ obj-y += sclp.o
 obj-y += event-facility.o
 obj-y += sclpquiesce.o sclpconsole.o
 obj-y += css.o
+obj-y += s390-virtio-ccw.o
 obj-y += virtio-ccw.o
diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
new file mode 100644
index 000..98552d3
--- /dev/null
+++ b/hw/s390x/s390-virtio-ccw.c
@@ -0,0 +1,141 @@
+/*
+ * virtio ccw machine
+ *
+ * Copyright 2012 IBM Corp.
+ * Author(s): Cornelia Huck cornelia.h...@de.ibm.com
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or (at
+ * your option) any later version. See the COPYING file in the top-level
+ * directory.
+ */
+
+#include hw/boards.h
+#include exec/address-spaces.h
+#include hw/s390-virtio.h
+#include hw/s390x/sclp.h
+#include ioinst.h
+#include css.h
+#include virtio-ccw.h
+
+static VirtioCcwBus *ccw_bus;
+
+static int virtio_ccw_hcall_notify(const uint64_t *args)
+{
+uint64_t subch_id = args[0];
+uint64_t queue = args[1];
+SubchDev *sch;
+int cssid, ssid, schid, m;
+
+if (ioinst_disassemble_sch_ident(subch_id, m, cssid, ssid, schid)) {
+return -EINVAL;
+}
+sch = css_find_subch(m, cssid, ssid, schid);
+if (!sch || !css_subch_visible(sch)) {
+return -EINVAL;
+}
+virtio_queue_notify(virtio_ccw_get_vdev(sch), queue);
+return 0;
+
+}
+
+static int virtio_ccw_hcall_early_printk(const uint64_t *args)
+{
+uint64_t mem = args[0];
+
+if (mem  ram_size) {
+/* Early printk */
+return 0;
+}
+return -EINVAL;
+}
+
+static void virtio_ccw_register_hcalls(void)
+{
+s390_register_virtio_hypercall(KVM_S390_VIRTIO_CCW_NOTIFY,
+   virtio_ccw_hcall_notify);
+/* Tolerate early printk. */
+s390_register_virtio_hypercall(KVM_S390_VIRTIO_NOTIFY,
+   virtio_ccw_hcall_early_printk);
+}
+
+static void ccw_init(QEMUMachineInitArgs *args)
+{
+ram_addr_t my_ram_size = args-ram_size;
+const char *cpu_model = args-cpu_model;
+const char *kernel_filename = args-kernel_filename;
+const char *kernel_cmdline = args-kernel_cmdline;
+const char *initrd_filename = args-initrd_filename;
+MemoryRegion *sysmem = get_system_memory();
+MemoryRegion *ram = g_new(MemoryRegion, 1);
+int shift = 0;
+uint8_t *storage_keys;
+int ret;
+
+/* s390x ram size detection needs a 16bit multiplier + an increment. So
+   guests  64GB can be specified in 2MB steps etc. */
+while ((my_ram_size  (20 + shift))  65535) {
+shift++;
+}
+my_ram_size = my_ram_size  (20 + shift)  (20 + shift);
+
+/* lets propagate the changed ram size into the global variable. */
+ram_size = my_ram_size;
+
+/* get a BUS */
+ccw_bus = virtio_ccw_bus_init();
+s390_sclp_init();
+
+/* register hypercalls */
+virtio_ccw_register_hcalls();
+
+/* allocate RAM */
+memory_region_init_ram(ram, s390.ram, my_ram_size);
+vmstate_register_ram_global(ram);
+memory_region_add_subregion(sysmem, 0, ram);
+
+/* allocate storage keys */
+storage_keys = g_malloc0(my_ram_size / TARGET_PAGE_SIZE);
+
+/* init CPUs */
+s390_init_cpus(cpu_model, storage_keys);
+
+kvm_s390_enable_css_support(s390_cpu_addr2state(0));
+
+/*
+ * Create virtual css and set it as default so that non mcss-e
+ * enabled guests only see virtio devices.
+ */
+ret = css_create_css_image(VIRTUAL_CSSID, true);
+assert(ret == 0);
+
+
+s390_set_up_kernel(kernel_filename, kernel_cmdline, initrd_filename);
+
+/* Create VirtIO network

[Qemu-devel] [PATCH 04/12] Update linux headers.

Base is kvm-next as of 2013/01/16.

Signed-off-by: Cornelia Huck cornelia.h...@de.ibm.com
---
 linux-headers/asm-generic/kvm_para.h |  4 
 linux-headers/asm-powerpc/kvm_para.h |  2 +-
 linux-headers/linux/kvm.h| 21 +
 3 files changed, 26 insertions(+), 1 deletion(-)
 create mode 100644 linux-headers/asm-generic/kvm_para.h

diff --git a/linux-headers/asm-generic/kvm_para.h 
b/linux-headers/asm-generic/kvm_para.h
new file mode 100644
index 000..486f0af
--- /dev/null
+++ b/linux-headers/asm-generic/kvm_para.h
@@ -0,0 +1,4 @@
+/*
+ * There isn't anything here, but the file must not be empty or patch
+ * will delete it.
+ */
diff --git a/linux-headers/asm-powerpc/kvm_para.h 
b/linux-headers/asm-powerpc/kvm_para.h
index 7e64f57..484bcaa 100644
--- a/linux-headers/asm-powerpc/kvm_para.h
+++ b/linux-headers/asm-powerpc/kvm_para.h
@@ -78,7 +78,7 @@ struct kvm_vcpu_arch_shared {
 
 #define KVM_HCALL_TOKEN(num) _EV_HCALL_TOKEN(EV_KVM_VENDOR_ID, num)
 
-#include asm/epapr_hcalls.h
+#include uapi/asm/epapr_hcalls.h
 
 #define KVM_FEATURE_MAGIC_PAGE 1
 
diff --git a/linux-headers/linux/kvm.h b/linux-headers/linux/kvm.h
index bfdbf4d..2602437 100644
--- a/linux-headers/linux/kvm.h
+++ b/linux-headers/linux/kvm.h
@@ -168,6 +168,7 @@ struct kvm_pit_config {
 #define KVM_EXIT_PAPR_HCALL  19
 #define KVM_EXIT_S390_UCONTROL   20
 #define KVM_EXIT_WATCHDOG 21
+#define KVM_EXIT_S390_TSCH22
 
 /* For KVM_EXIT_INTERNAL_ERROR */
 /* Emulate instruction failed. */
@@ -285,6 +286,15 @@ struct kvm_run {
__u64 ret;
__u64 args[9];
} papr_hcall;
+   /* KVM_EXIT_S390_TSCH */
+   struct {
+   __u16 subchannel_id;
+   __u16 subchannel_nr;
+   __u32 io_int_parm;
+   __u32 io_int_word;
+   __u32 ipb;
+   __u8 dequeued;
+   } s390_tsch;
/* Fix the size of the union. */
char padding[256];
};
@@ -397,10 +407,20 @@ struct kvm_s390_psw {
 #define KVM_S390_PROGRAM_INT   0xfffe0001u
 #define KVM_S390_SIGP_SET_PREFIX   0xfffe0002u
 #define KVM_S390_RESTART   0xfffe0003u
+#define KVM_S390_MCHK  0xfffe1000u
 #define KVM_S390_INT_VIRTIO0x2603u
 #define KVM_S390_INT_SERVICE   0x2401u
 #define KVM_S390_INT_EMERGENCY 0x1201u
 #define KVM_S390_INT_EXTERNAL_CALL 0x1202u
+/* Anything below 0xfffeu is taken by INT_IO */
+#define KVM_S390_INT_IO(ai,cssid,ssid,schid)   \
+   (((schid)) |   \
+((ssid)  16) |  \
+((cssid)  18) | \
+((ai)  26))
+#define KVM_S390_INT_IO_MIN0xu
+#define KVM_S390_INT_IO_MAX0xfffdu
+
 
 struct kvm_s390_interrupt {
__u32 type;
@@ -635,6 +655,7 @@ struct kvm_ppc_smmu_info {
 #define KVM_CAP_IRQFD_RESAMPLE 82
 #define KVM_CAP_PPC_BOOKE_WATCHDOG 83
 #define KVM_CAP_PPC_HTAB_FD 84
+#define KVM_CAP_S390_CSS_SUPPORT 85
 
 #ifdef KVM_CAP_IRQ_ROUTING
 
-- 
1.7.12.4

[Qemu-devel] [PATCH 05/12] s390: Channel I/O basic defintions.

Basic channel I/O structures and helper function.

Signed-off-by: Cornelia Huck cornelia.h...@de.ibm.com
---
 target-s390x/Makefile.objs |   2 +-
 target-s390x/cpu.h |   5 ++
 target-s390x/ioinst.c  |  36 
 target-s390x/ioinst.h  | 207 +
 4 files changed, 249 insertions(+), 1 deletion(-)
 create mode 100644 target-s390x/ioinst.c
 create mode 100644 target-s390x/ioinst.h

diff --git a/target-s390x/Makefile.objs b/target-s390x/Makefile.objs
index e728abf..3afb0b7 100644
--- a/target-s390x/Makefile.objs
+++ b/target-s390x/Makefile.objs
@@ -1,4 +1,4 @@
 obj-y += translate.o helper.o cpu.o interrupt.o
 obj-y += int_helper.o fpu_helper.o cc_helper.o mem_helper.o misc_helper.o
-obj-$(CONFIG_SOFTMMU) += machine.o
+obj-$(CONFIG_SOFTMMU) += machine.o ioinst.o
 obj-$(CONFIG_KVM) += kvm.o
diff --git a/target-s390x/cpu.h b/target-s390x/cpu.h
index cd729d3..931ed4d 100644
--- a/target-s390x/cpu.h
+++ b/target-s390x/cpu.h
@@ -352,6 +352,11 @@ static inline unsigned s390_del_running_cpu(CPUS390XState 
*env)
 void cpu_lock(void);
 void cpu_unlock(void);
 
+typedef struct SCHIB SCHIB;
+typedef struct ORB ORB;
+typedef struct IRB IRB;
+typedef struct CRW CRW;
+
 static inline void cpu_set_tls(CPUS390XState *env, target_ulong newtls)
 {
 env-aregs[0] = newtls  32;
diff --git a/target-s390x/ioinst.c b/target-s390x/ioinst.c
new file mode 100644
index 000..06a16ee
--- /dev/null
+++ b/target-s390x/ioinst.c
@@ -0,0 +1,36 @@
+/*
+ * I/O instructions for S/390
+ *
+ * Copyright 2012 IBM Corp.
+ * Author(s): Cornelia Huck cornelia.h...@de.ibm.com
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or (at
+ * your option) any later version. See the COPYING file in the top-level
+ * directory.
+ */
+
+#include sys/types.h
+
+#include cpu.h
+#include ioinst.h
+
+int ioinst_disassemble_sch_ident(uint32_t value, int *m, int *cssid, int *ssid,
+ int *schid)
+{
+if (!IOINST_SCHID_ONE(value)) {
+return -EINVAL;
+}
+if (!IOINST_SCHID_M(value)) {
+if (IOINST_SCHID_CSSID(value)) {
+return -EINVAL;
+}
+*cssid = 0;
+*m = 0;
+} else {
+*cssid = IOINST_SCHID_CSSID(value);
+*m = 1;
+}
+*ssid = IOINST_SCHID_SSID(value);
+*schid = IOINST_SCHID_NR(value);
+return 0;
+}
diff --git a/target-s390x/ioinst.h b/target-s390x/ioinst.h
new file mode 100644
index 000..5580d91
--- /dev/null
+++ b/target-s390x/ioinst.h
@@ -0,0 +1,207 @@
+/*
+ * S/390 channel I/O instructions
+ *
+ * Copyright 2012 IBM Corp.
+ * Author(s): Cornelia Huck cornelia.h...@de.ibm.com
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or (at
+ * your option) any later version. See the COPYING file in the top-level
+ * directory.
+*/
+
+#ifndef IOINST_S390X_H
+#define IOINST_S390X_H
+/*
+ * Channel I/O related definitions, as defined in the Principles
+ * Of Operation (and taken from the Linux implementation).
+ */
+
+/* subchannel status word (command mode only) */
+typedef struct SCSW {
+uint16_t flags;
+uint16_t ctrl;
+uint32_t cpa;
+uint8_t dstat;
+uint8_t cstat;
+uint16_t count;
+} QEMU_PACKED SCSW;
+
+#define SCSW_FLAGS_MASK_KEY 0xf000
+#define SCSW_FLAGS_MASK_SCTL 0x0800
+#define SCSW_FLAGS_MASK_ESWF 0x0400
+#define SCSW_FLAGS_MASK_CC 0x0300
+#define SCSW_FLAGS_MASK_FMT 0x0080
+#define SCSW_FLAGS_MASK_PFCH 0x0040
+#define SCSW_FLAGS_MASK_ISIC 0x0020
+#define SCSW_FLAGS_MASK_ALCC 0x0010
+#define SCSW_FLAGS_MASK_SSI 0x0008
+#define SCSW_FLAGS_MASK_ZCC 0x0004
+#define SCSW_FLAGS_MASK_ECTL 0x0002
+#define SCSW_FLAGS_MASK_PNO 0x0001
+
+#define SCSW_CTRL_MASK_FCTL 0x7000
+#define SCSW_CTRL_MASK_ACTL 0x0fe0
+#define SCSW_CTRL_MASK_STCTL 0x001f
+
+#define SCSW_FCTL_CLEAR_FUNC 0x1000
+#define SCSW_FCTL_HALT_FUNC 0x2000
+#define SCSW_FCTL_START_FUNC 0x4000
+
+#define SCSW_ACTL_SUSP 0x0020
+#define SCSW_ACTL_DEVICE_ACTIVE 0x0040
+#define SCSW_ACTL_SUBCH_ACTIVE 0x0080
+#define SCSW_ACTL_CLEAR_PEND 0x0100
+#define SCSW_ACTL_HALT_PEND  0x0200
+#define SCSW_ACTL_START_PEND 0x0400
+#define SCSW_ACTL_RESUME_PEND 0x0800
+
+#define SCSW_STCTL_STATUS_PEND 0x0001
+#define SCSW_STCTL_SECONDARY 0x0002
+#define SCSW_STCTL_PRIMARY 0x0004
+#define SCSW_STCTL_INTERMEDIATE 0x0008
+#define SCSW_STCTL_ALERT 0x0010
+
+#define SCSW_DSTAT_ATTENTION 0x80
+#define SCSW_DSTAT_STAT_MOD  0x40
+#define SCSW_DSTAT_CU_END0x20
+#define SCSW_DSTAT_BUSY  0x10
+#define SCSW_DSTAT_CHANNEL_END   0x08
+#define SCSW_DSTAT_DEVICE_END0x04
+#define SCSW_DSTAT_UNIT_CHECK0x02
+#define SCSW_DSTAT_UNIT_EXCEP0x01
+
+#define SCSW_CSTAT_PCI   0x80
+#define SCSW_CSTAT_INCORR_LEN0x40
+#define SCSW_CSTAT_PROG_CHECK0x20
+#define SCSW_CSTAT_PROT_CHECK0x10
+#define SCSW_CSTAT_DATA_CHECK0x08
+#define SCSW_CSTAT_CHN_CTRL_CHK  0x04
+#define SCSW_CSTAT_INTF_CTRL_CHK 0x02
+#define SCSW_CSTAT_CHAIN_CHECK   0x01
+
+/*

[Qemu-devel] [PATCH 07/12] s390: Add channel I/O instructions.

Provide handlers for (most) channel I/O instructions.

Signed-off-by: Cornelia Huck cornelia.h...@de.ibm.com
---
 target-s390x/cpu.h| 101 
 target-s390x/ioinst.c | 673 ++
 target-s390x/ioinst.h |  16 ++
 trace-events  |   6 +
 4 files changed, 796 insertions(+)

diff --git a/target-s390x/cpu.h b/target-s390x/cpu.h
index 97f70f3..cf5334e 100644
--- a/target-s390x/cpu.h
+++ b/target-s390x/cpu.h
@@ -130,6 +130,8 @@ typedef struct CPUS390XState {
 QEMUTimer *tod_timer;
 
 QEMUTimer *cpu_timer;
+
+uint8_t chsc_page[TARGET_PAGE_SIZE];
 } CPUS390XState;
 
 #include cpu-qom.h
@@ -144,6 +146,9 @@ static inline void cpu_clone_regs(CPUS390XState *env, 
target_ulong newsp)
 }
 #endif
 
+/* distinguish between 24 bit and 31 bit addressing */
+#define HIGH_ORDER_BIT 0x8000
+
 /* Interrupt Codes */
 /* Program Interrupts */
 #define PGM_OPERATION   0x0001
@@ -327,6 +332,20 @@ void *s390_cpu_physical_memory_map(CPUS390XState *env, 
hwaddr addr, hwaddr len,
int is_write);
 void s390_cpu_physical_memory_unmap(CPUS390XState *env, void *addr, hwaddr len,
 int is_write);
+static inline hwaddr decode_basedisp_s(CPUS390XState *env, uint32_t ipb)
+{
+hwaddr addr = 0;
+uint8_t reg;
+
+reg = ipb  28;
+if (reg  0) {
+addr = env-regs[reg];
+}
+addr += (ipb  16)  0xfff;
+
+return addr;
+}
+
 void s390x_tod_timer(void *opaque);
 void s390x_cpu_timer(void *opaque);
 
@@ -376,11 +395,93 @@ static inline unsigned s390_del_running_cpu(CPUS390XState 
*env)
 void cpu_lock(void);
 void cpu_unlock(void);
 
+typedef struct SubchDev SubchDev;
 typedef struct SCHIB SCHIB;
 typedef struct ORB ORB;
 typedef struct IRB IRB;
 typedef struct CRW CRW;
 
+static inline SubchDev *css_find_subch(uint8_t m, uint8_t cssid, uint8_t ssid,
+   uint16_t schid)
+{
+return NULL;
+}
+static inline bool css_subch_visible(SubchDev *sch)
+{
+return false;
+}
+static inline void css_conditional_io_interrupt(SubchDev *sch)
+{
+}
+static inline int css_do_stsch(SubchDev *sch, SCHIB *schib)
+{
+return -ENODEV;
+}
+static inline bool css_schid_final(uint8_t cssid, uint8_t ssid, uint16_t schid)
+{
+return true;
+}
+static inline int css_do_msch(SubchDev *sch, SCHIB *schib)
+{
+return -ENODEV;
+}
+static inline int css_do_xsch(SubchDev *sch)
+{
+return -ENODEV;
+}
+static inline int css_do_csch(SubchDev *sch)
+{
+return -ENODEV;
+}
+static inline int css_do_hsch(SubchDev *sch)
+{
+return -ENODEV;
+}
+static inline int css_do_ssch(SubchDev *sch, ORB *orb)
+{
+return -ENODEV;
+}
+static inline int css_do_tsch(SubchDev *sch, IRB *irb)
+{
+return -ENODEV;
+}
+static inline int css_do_stcrw(CRW *crw)
+{
+return 1;
+}
+static inline int css_do_tpi(uint64_t addr, int lowcore)
+{
+return 0;
+}
+static inline int css_collect_chp_desc(int m, uint8_t cssid, uint8_t f_chpid,
+   int rfmt, uint8_t l_chpid, void *buf)
+{
+return 0;
+}
+static inline void css_do_schm(uint8_t mbk, int update, int dct, uint64_t mbo)
+{
+}
+static inline int css_enable_mss(void)
+{
+return -EINVAL;
+}
+static inline int css_enable_mcsse(void)
+{
+return -EINVAL;
+}
+static inline int css_do_rsch(SubchDev *sch)
+{
+return -ENODEV;
+}
+static inline int css_do_rchp(uint8_t cssid, uint8_t chpid)
+{
+return -ENODEV;
+}
+static inline bool css_present(uint8_t cssid)
+{
+return false;
+}
+
 static inline void cpu_set_tls(CPUS390XState *env, target_ulong newtls)
 {
 env-aregs[0] = newtls  32;
diff --git a/target-s390x/ioinst.c b/target-s390x/ioinst.c
index 06a16ee..0cb9569 100644
--- a/target-s390x/ioinst.c
+++ b/target-s390x/ioinst.c
@@ -13,6 +13,7 @@
 
 #include cpu.h
 #include ioinst.h
+#include trace.h
 
 int ioinst_disassemble_sch_ident(uint32_t value, int *m, int *cssid, int *ssid,
  int *schid)
@@ -34,3 +35,675 @@ int ioinst_disassemble_sch_ident(uint32_t value, int *m, 
int *cssid, int *ssid,
 *schid = IOINST_SCHID_NR(value);
 return 0;
 }
+
+int ioinst_handle_xsch(CPUS390XState *env, uint64_t reg1)
+{
+int cssid, ssid, schid, m;
+SubchDev *sch;
+int ret = -ENODEV;
+int cc;
+
+if (ioinst_disassemble_sch_ident(reg1, m, cssid, ssid, schid)) {
+program_interrupt(env, PGM_OPERAND, 2);
+return -EIO;
+}
+trace_ioinst_sch_id(xsch, cssid, ssid, schid);
+sch = css_find_subch(m, cssid, ssid, schid);
+if (sch  css_subch_visible(sch)) {
+ret = css_do_xsch(sch);
+}
+switch (ret) {
+case -ENODEV:
+cc = 3;
+break;
+case -EBUSY:
+cc = 2;
+break;
+case 0:
+cc = 0;
+break;
+default:
+cc = 1;
+break;
+}
+
+return cc;
+}
+
+int ioinst_handle_csch(CPUS390XState *env, uint64_t reg1)
+{

[Qemu-devel] [PATCH 01/12] s390: Add a hypercall registration interface.

Allow virtio machines to register for different diag500 function
codes and convert s390-virtio to use it.

Signed-off-by: Cornelia Huck cornelia.h...@de.ibm.com
---
 hw/s390-virtio.c | 90 +++-
 hw/s390-virtio.h | 22 +++
 hw/s390x/Makefile.objs   |  1 +
 hw/s390x/s390-virtio-hcall.c | 36 ++
 target-s390x/cpu.h   |  2 +-
 target-s390x/kvm.c   |  2 +-
 target-s390x/misc_helper.c   |  2 +-
 7 files changed, 110 insertions(+), 45 deletions(-)
 create mode 100644 hw/s390-virtio.h
 create mode 100644 hw/s390x/s390-virtio-hcall.c

diff --git a/hw/s390-virtio.c b/hw/s390-virtio.c
index 0e93cc3..bded30b 100644
--- a/hw/s390-virtio.c
+++ b/hw/s390-virtio.c
@@ -33,6 +33,7 @@
 
 #include hw/s390-virtio-bus.h
 #include hw/s390x/sclp.h
+#include hw/s390-virtio.h
 
 //#define DEBUG_S390
 
@@ -44,10 +45,6 @@
 do { } while (0)
 #endif
 
-#define KVM_S390_VIRTIO_NOTIFY  0
-#define KVM_S390_VIRTIO_RESET   1
-#define KVM_S390_VIRTIO_SET_STATUS  2
-
 #define KERN_IMAGE_START0x01UL
 #define KERN_PARM_AREA  0x010480UL
 #define INITRD_START0x80UL
@@ -73,56 +70,63 @@ S390CPU *s390_cpu_addr2state(uint16_t cpu_addr)
 return ipi_states[cpu_addr];
 }
 
-int s390_virtio_hypercall(CPUS390XState *env, uint64_t mem, uint64_t hypercall)
+static int s390_virtio_hcall_notify(const uint64_t *args)
 {
+uint64_t mem = args[0];
 int r = 0, i;
 
-dprintf(KVM hypercall: %ld\n, hypercall);
-switch (hypercall) {
-case KVM_S390_VIRTIO_NOTIFY:
-if (mem  ram_size) {
-VirtIOS390Device *dev = s390_virtio_bus_find_vring(s390_bus,
-   mem, i);
-if (dev) {
-virtio_queue_notify(dev-vdev, i);
-} else {
-r = -EINVAL;
-}
-} else {
-/* Early printk */
-}
-break;
-case KVM_S390_VIRTIO_RESET:
-{
-VirtIOS390Device *dev;
-
-dev = s390_virtio_bus_find_mem(s390_bus, mem);
-virtio_reset(dev-vdev);
-stb_phys(dev-dev_offs + VIRTIO_DEV_OFFS_STATUS, 0);
-s390_virtio_device_sync(dev);
-s390_virtio_reset_idx(dev);
-break;
-}
-case KVM_S390_VIRTIO_SET_STATUS:
-{
-VirtIOS390Device *dev;
-
-dev = s390_virtio_bus_find_mem(s390_bus, mem);
+if (mem  ram_size) {
+VirtIOS390Device *dev = s390_virtio_bus_find_vring(s390_bus, mem, i);
 if (dev) {
-s390_virtio_device_update_status(dev);
+virtio_queue_notify(dev-vdev, i);
 } else {
 r = -EINVAL;
 }
-break;
+} else {
+/* Early printk */
 }
-default:
+return r;
+}
+
+static int s390_virtio_hcall_reset(const uint64_t *args)
+{
+uint64_t mem = args[0];
+VirtIOS390Device *dev;
+
+dev = s390_virtio_bus_find_mem(s390_bus, mem);
+virtio_reset(dev-vdev);
+stb_phys(dev-dev_offs + VIRTIO_DEV_OFFS_STATUS, 0);
+s390_virtio_device_sync(dev);
+s390_virtio_reset_idx(dev);
+
+return 0;
+}
+
+static int s390_virtio_hcall_set_status(const uint64_t *args)
+{
+uint64_t mem = args[0];
+int r = 0;
+VirtIOS390Device *dev;
+
+dev = s390_virtio_bus_find_mem(s390_bus, mem);
+if (dev) {
+s390_virtio_device_update_status(dev);
+} else {
 r = -EINVAL;
-break;
 }
-
 return r;
 }
 
+static void s390_virtio_register_hcalls(void)
+{
+s390_register_virtio_hypercall(KVM_S390_VIRTIO_NOTIFY,
+   s390_virtio_hcall_notify);
+s390_register_virtio_hypercall(KVM_S390_VIRTIO_RESET,
+   s390_virtio_hcall_reset);
+s390_register_virtio_hypercall(KVM_S390_VIRTIO_SET_STATUS,
+   s390_virtio_hcall_set_status);
+}
+
 /*
  * The number of running CPUs. On s390 a shutdown is the state of all CPUs
  * being either stopped or disabled (for interrupts) waiting. We have to
@@ -186,6 +190,9 @@ static void s390_init(QEMUMachineInitArgs *args)
 s390_bus = s390_virtio_bus_init(my_ram_size);
 s390_sclp_init();
 
+/* register hypercalls */
+s390_virtio_register_hcalls();
+
 /* allocate RAM */
 memory_region_init_ram(ram, s390.ram, my_ram_size);
 vmstate_register_ram_global(ram);
@@ -339,4 +346,3 @@ static void s390_machine_init(void)
 }
 
 machine_init(s390_machine_init);
-
diff --git a/hw/s390-virtio.h b/hw/s390-virtio.h
new file mode 100644
index 000..25bb610
--- /dev/null
+++ b/hw/s390-virtio.h
@@ -0,0 +1,22 @@
+/*
+ * Virtio interfaces for s390
+ *
+ * Copyright 2012 IBM Corp.
+ * Author(s): Cornelia Huck cornelia.h...@de.ibm.com
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or (at
+ * your option) any later version. See the COPYING file in the top-level
+ *

[Qemu-devel] [PATCH 11/12] s390-virtio: Factor out some initialization code.

Some of the machine initialization for s390-virtio will be reused
by virtio-ccw.

Signed-off-by: Cornelia Huck cornelia.h...@de.ibm.com
---
 hw/s390-virtio.c | 155 ++-
 hw/s390-virtio.h |   5 ++
 2 files changed, 91 insertions(+), 69 deletions(-)

diff --git a/hw/s390-virtio.c b/hw/s390-virtio.c
index bded30b..603f6b0 100644
--- a/hw/s390-virtio.c
+++ b/hw/s390-virtio.c
@@ -155,62 +155,10 @@ unsigned s390_del_running_cpu(CPUS390XState *env)
 return s390_running_cpus;
 }
 
-/* PC hardware initialisation */
-static void s390_init(QEMUMachineInitArgs *args)
+void s390_init_cpus(const char *cpu_model, uint8_t *storage_keys)
 {
-ram_addr_t my_ram_size = args-ram_size;
-const char *cpu_model = args-cpu_model;
-const char *kernel_filename = args-kernel_filename;
-const char *kernel_cmdline = args-kernel_cmdline;
-const char *initrd_filename = args-initrd_filename;
-CPUS390XState *env = NULL;
-MemoryRegion *sysmem = get_system_memory();
-MemoryRegion *ram = g_new(MemoryRegion, 1);
-ram_addr_t kernel_size = 0;
-ram_addr_t initrd_offset;
-ram_addr_t initrd_size = 0;
-int shift = 0;
-uint8_t *storage_keys;
-void *virtio_region;
-hwaddr virtio_region_len;
-hwaddr virtio_region_start;
 int i;
 
-/* s390x ram size detection needs a 16bit multiplier + an increment. So
-   guests  64GB can be specified in 2MB steps etc. */
-while ((my_ram_size  (20 + shift))  65535) {
-shift++;
-}
-my_ram_size = my_ram_size  (20 + shift)  (20 + shift);
-
-/* lets propagate the changed ram size into the global variable. */
-ram_size = my_ram_size;
-
-/* get a BUS */
-s390_bus = s390_virtio_bus_init(my_ram_size);
-s390_sclp_init();
-
-/* register hypercalls */
-s390_virtio_register_hcalls();
-
-/* allocate RAM */
-memory_region_init_ram(ram, s390.ram, my_ram_size);
-vmstate_register_ram_global(ram);
-memory_region_add_subregion(sysmem, 0, ram);
-
-/* clear virtio region */
-virtio_region_len = my_ram_size - ram_size;
-virtio_region_start = ram_size;
-virtio_region = cpu_physical_memory_map(virtio_region_start,
-virtio_region_len, true);
-memset(virtio_region, 0, virtio_region_len);
-cpu_physical_memory_unmap(virtio_region, virtio_region_len, 1,
-  virtio_region_len);
-
-/* allocate storage keys */
-storage_keys = g_malloc0(my_ram_size / TARGET_PAGE_SIZE);
-
-/* init CPUs */
 if (cpu_model == NULL) {
 cpu_model = host;
 }
@@ -219,21 +167,27 @@ static void s390_init(QEMUMachineInitArgs *args)
 
 for (i = 0; i  smp_cpus; i++) {
 S390CPU *cpu;
-CPUS390XState *tmp_env;
 
 cpu = cpu_s390x_init(cpu_model);
-tmp_env = cpu-env;
-if (!env) {
-env = tmp_env;
-}
+
 ipi_states[i] = cpu;
-tmp_env-halted = 1;
-tmp_env-exception_index = EXCP_HLT;
-tmp_env-storage_keys = storage_keys;
+cpu-env.halted = 1;
+cpu-env.exception_index = EXCP_HLT;
+cpu-env.storage_keys = storage_keys;
 }
+}
+
+void s390_set_up_kernel(const char *kernel_filename,
+const char *kernel_cmdline,
+const char *initrd_filename)
+{
+ram_addr_t kernel_size = 0;
+ram_addr_t initrd_offset;
+ram_addr_t initrd_size = 0;
+S390CPU *cpu = s390_cpu_addr2state(0);
 
 /* One CPU has to run */
-s390_add_running_cpu(env);
+s390_add_running_cpu(cpu-env);
 
 if (kernel_filename) {
 
@@ -252,8 +206,8 @@ static void s390_init(QEMUMachineInitArgs *args)
  * value was 0x800 (the SALIPL loader) and it wont work. For
  * all (Linux) cases 0x1 (KERN_IMAGE_START) should be fine.
  */
-env-psw.addr = KERN_IMAGE_START;
-env-psw.mask = 0x00018000ULL;
+cpu-env.psw.addr = KERN_IMAGE_START;
+cpu-env.psw.mask = 0x00018000ULL;
 } else {
 ram_addr_t bios_size = 0;
 char *bios_filename;
@@ -275,8 +229,8 @@ static void s390_init(QEMUMachineInitArgs *args)
 hw_error(stage1 bootloader is  4k\n);
 }
 
-env-psw.addr = ZIPL_START;
-env-psw.mask = 0x00018000ULL;
+cpu-env.psw.addr = ZIPL_START;
+cpu-env.psw.mask = 0x00018000ULL;
 }
 
 if (initrd_filename) {
@@ -302,9 +256,13 @@ static void s390_init(QEMUMachineInitArgs *args)
 memcpy(rom_ptr(KERN_PARM_AREA), kernel_cmdline,
strlen(kernel_cmdline) + 1);
 }
+}
 
-/* Create VirtIO network adapters */
-for(i = 0; i  nb_nics; i++) {
+void s390_create_virtio_net(BusState *bus, const char *name)
+{
+int i;
+
+for (i = 0; i  nb_nics; i++) {
 NICInfo *nd = nd_table[i];
 DeviceState *dev;
 
@@ -317,12 +275,71 @@ static void

[Qemu-devel] [PATCH 10/12] s390: Add new channel I/O based virtio transport.

Add a new virtio transport that uses channel commands to perform
virtio operations.

Signed-off-by: Cornelia Huck cornelia.h...@de.ibm.com
---
 hw/s390x/Makefile.objs |   1 +
 hw/s390x/virtio-ccw.c  | 906 +
 hw/s390x/virtio-ccw.h  |  79 +
 trace-events   |   4 +
 4 files changed, 990 insertions(+)
 create mode 100644 hw/s390x/virtio-ccw.c
 create mode 100644 hw/s390x/virtio-ccw.h

diff --git a/hw/s390x/Makefile.objs b/hw/s390x/Makefile.objs
index 029a0b2..71ad255 100644
--- a/hw/s390x/Makefile.objs
+++ b/hw/s390x/Makefile.objs
@@ -6,3 +6,4 @@ obj-y += sclp.o
 obj-y += event-facility.o
 obj-y += sclpquiesce.o sclpconsole.o
 obj-y += css.o
+obj-y += virtio-ccw.o
diff --git a/hw/s390x/virtio-ccw.c b/hw/s390x/virtio-ccw.c
new file mode 100644
index 000..cb15965
--- /dev/null
+++ b/hw/s390x/virtio-ccw.c
@@ -0,0 +1,906 @@
+/*
+ * virtio ccw target implementation
+ *
+ * Copyright 2012 IBM Corp.
+ * Author(s): Cornelia Huck cornelia.h...@de.ibm.com
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or (at
+ * your option) any later version. See the COPYING file in the top-level
+ * directory.
+ */
+
+#include hw/hw.h
+#include block/block.h
+#include sysemu/blockdev.h
+#include sysemu/sysemu.h
+#include net/net.h
+#include monitor/monitor.h
+#include hw/virtio.h
+#include hw/virtio-serial.h
+#include hw/virtio-net.h
+#include hw/sysbus.h
+#include qemu/bitops.h
+
+#include ioinst.h
+#include css.h
+#include virtio-ccw.h
+#include trace.h
+
+static const TypeInfo virtio_ccw_bus_info = {
+.name = TYPE_VIRTIO_CCW_BUS,
+.parent = TYPE_BUS,
+.instance_size = sizeof(VirtioCcwBus),
+};
+
+static const VirtIOBindings virtio_ccw_bindings;
+
+VirtIODevice *virtio_ccw_get_vdev(SubchDev *sch)
+{
+VirtIODevice *vdev = NULL;
+
+if (sch-driver_data) {
+vdev = ((VirtioCcwData *)sch-driver_data)-vdev;
+}
+return vdev;
+}
+
+static void virtio_ccw_reset_subchannels(void *opaque)
+{
+VirtioCcwBus *bus = opaque;
+BusChild *kid;
+VirtioCcwData *data;
+BusState *parent = BUS(bus);
+
+QTAILQ_FOREACH(kid, parent-children, sibling) {
+data = (VirtioCcwData *)kid-child;
+virtio_reset(data-vdev);
+css_reset_sch(data-sch);
+}
+css_reset();
+}
+
+VirtioCcwBus *virtio_ccw_bus_init(void)
+{
+VirtioCcwBus *cbus;
+BusState *bus;
+DeviceState *dev;
+
+/* Create bridge device */
+dev = qdev_create(NULL, virtio-ccw-bridge);
+qdev_init_nofail(dev);
+
+/* Create bus on bridge device */
+bus = qbus_create(TYPE_VIRTIO_CCW_BUS, dev, virtio-ccw);
+cbus = VIRTIO_CCW_BUS(bus);
+
+/* Enable hotplugging */
+bus-allow_hotplug = 1;
+
+qemu_register_reset(virtio_ccw_reset_subchannels, cbus);
+return cbus;
+}
+
+/* Communication blocks used by several channel commands. */
+typedef struct VqInfoBlock {
+uint64_t queue;
+uint32_t align;
+uint16_t index;
+uint16_t num;
+} QEMU_PACKED VqInfoBlock;
+
+typedef struct VqConfigBlock {
+uint16_t index;
+uint16_t num_max;
+} QEMU_PACKED VqConfigBlock;
+
+typedef struct VirtioFeatDesc {
+uint32_t features;
+uint8_t index;
+} QEMU_PACKED VirtioFeatDesc;
+
+/* Specify where the virtqueues for the subchannel are in guest memory. */
+static int virtio_ccw_set_vqs(SubchDev *sch, uint64_t addr, uint32_t align,
+  uint16_t index, uint16_t num)
+{
+VirtioCcwData *data = sch-driver_data;
+
+if (index  VIRTIO_PCI_QUEUE_MAX) {
+return -EINVAL;
+}
+
+/* Current code in virtio.c relies on 4K alignment. */
+if (addr  (align != 4096)) {
+return -EINVAL;
+}
+
+if (!data) {
+return -EINVAL;
+}
+
+virtio_queue_set_addr(data-vdev, index, addr);
+if (!addr) {
+virtio_queue_set_vector(data-vdev, index, 0);
+} else {
+/* Fail if we don't have a big enough queue. */
+/* TODO: Add interface to handle vring.num changing */
+if (virtio_queue_get_num(data-vdev, index)  num) {
+return -EINVAL;
+}
+virtio_queue_set_vector(data-vdev, index, index);
+}
+/* tell notify handler in case of config change */
+data-vdev-config_vector = VIRTIO_PCI_QUEUE_MAX;
+return 0;
+}
+
+static int virtio_ccw_cb(SubchDev *sch, CCW1 *ccw)
+{
+int ret;
+VqInfoBlock info;
+uint8_t status;
+VirtioFeatDesc features;
+void *config;
+hwaddr indicators;
+VqConfigBlock vq_config;
+VirtioCcwData *data = sch-driver_data;
+bool check_len;
+int len;
+
+if (!ccw) {
+return -EIO;
+}
+
+if (!data) {
+return -EINVAL;
+}
+
+trace_virtio_ccw_interpret_ccw(sch-cssid, sch-ssid, sch-schid,
+   ccw-cmd_code);
+check_len = !((ccw-flags  CCW_FLAG_SLI)  !(ccw-flags  CCW_FLAG_DC));
+
+/* Look at the command. */
+switch (ccw-cmd_code) {
+case

[Qemu-devel] [PATCH 08/12] s390: Virtual channel subsystem support.

Provide a mechanism for qemu to provide fully virtual subchannels to
the guest.

Signed-off-by: Cornelia Huck cornelia.h...@de.ibm.com
---
 hw/s390x/Makefile.objs |1 +
 hw/s390x/css.c | 1131 
 hw/s390x/css.h |   92 
 target-s390x/cpu.h |   65 +++
 trace-events   |8 +
 5 files changed, 1297 insertions(+)
 create mode 100644 hw/s390x/css.c
 create mode 100644 hw/s390x/css.h

diff --git a/hw/s390x/Makefile.objs b/hw/s390x/Makefile.objs
index ae87a12..029a0b2 100644
--- a/hw/s390x/Makefile.objs
+++ b/hw/s390x/Makefile.objs
@@ -5,3 +5,4 @@ obj-y += s390-virtio-hcall.o
 obj-y += sclp.o
 obj-y += event-facility.o
 obj-y += sclpquiesce.o sclpconsole.o
+obj-y += css.o
diff --git a/hw/s390x/css.c b/hw/s390x/css.c
new file mode 100644
index 000..60372f1
--- /dev/null
+++ b/hw/s390x/css.c
@@ -0,0 +1,1131 @@
+/*
+ * Channel subsystem base support.
+ *
+ * Copyright 2012 IBM Corp.
+ * Author(s): Cornelia Huck cornelia.h...@de.ibm.com
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or (at
+ * your option) any later version. See the COPYING file in the top-level
+ * directory.
+ */
+
+#include hw/qdev.h
+#include qemu/bitops.h
+#include linux/kvm.h
+#include cpu.h
+#include ioinst.h
+#include css.h
+#include trace.h
+
+typedef struct CrwContainer {
+CRW crw;
+QTAILQ_ENTRY(CrwContainer) sibling;
+} CrwContainer;
+
+typedef struct ChpInfo {
+uint8_t in_use;
+uint8_t type;
+uint8_t is_virtual;
+} ChpInfo;
+
+typedef struct SubchSet {
+SubchDev *sch[MAX_SCHID + 1];
+unsigned long schids_used[BITS_TO_LONGS(MAX_SCHID + 1)];
+unsigned long devnos_used[BITS_TO_LONGS(MAX_SCHID + 1)];
+} SubchSet;
+
+typedef struct CssImage {
+SubchSet *sch_set[MAX_SSID + 1];
+ChpInfo chpids[MAX_CHPID + 1];
+} CssImage;
+
+typedef struct ChannelSubSys {
+QTAILQ_HEAD(, CrwContainer) pending_crws;
+bool do_crw_mchk;
+bool crws_lost;
+uint8_t max_cssid;
+uint8_t max_ssid;
+bool chnmon_active;
+uint64_t chnmon_area;
+CssImage *css[MAX_CSSID + 1];
+uint8_t default_cssid;
+} ChannelSubSys;
+
+static ChannelSubSys *channel_subsys;
+
+int css_create_css_image(uint8_t cssid, bool default_image)
+{
+trace_css_new_image(cssid, default_image ? (default) : );
+if (cssid  MAX_CSSID) {
+return -EINVAL;
+}
+if (channel_subsys-css[cssid]) {
+return -EBUSY;
+}
+channel_subsys-css[cssid] = g_try_malloc0(sizeof(CssImage));
+if (!channel_subsys-css[cssid]) {
+return -ENOMEM;
+}
+if (default_image) {
+channel_subsys-default_cssid = cssid;
+}
+return 0;
+}
+
+static void css_inject_io_interrupt(SubchDev *sch)
+{
+S390CPU *cpu = s390_cpu_addr2state(0);
+uint8_t isc = (sch-curr_status.pmcw.flags  PMCW_FLAGS_MASK_ISC)  11;
+
+trace_css_io_interrupt(sch-cssid, sch-ssid, sch-schid,
+   sch-curr_status.pmcw.intparm, isc, );
+s390_io_interrupt(cpu,
+  channel_subsys-max_cssid  0 ?
+  (sch-cssid  8) | (1  3) | (sch-ssid  1) | 1 :
+  (sch-ssid  1) | 1,
+  sch-schid,
+  sch-curr_status.pmcw.intparm,
+  (0x80  isc)  24);
+}
+
+void css_conditional_io_interrupt(SubchDev *sch)
+{
+/*
+ * If the subchannel is not currently status pending, make it pending
+ * with alert status.
+ */
+if (sch  !(sch-curr_status.scsw.ctrl  SCSW_STCTL_STATUS_PEND)) {
+S390CPU *cpu = s390_cpu_addr2state(0);
+uint8_t isc = (sch-curr_status.pmcw.flags  PMCW_FLAGS_MASK_ISC)  
11;
+
+trace_css_io_interrupt(sch-cssid, sch-ssid, sch-schid,
+   sch-curr_status.pmcw.intparm, isc,
+   (unsolicited));
+sch-curr_status.scsw.ctrl = ~SCSW_CTRL_MASK_STCTL;
+sch-curr_status.scsw.ctrl |=
+SCSW_STCTL_ALERT | SCSW_STCTL_STATUS_PEND;
+/* Inject an I/O interrupt. */
+s390_io_interrupt(cpu,
+  channel_subsys-max_cssid  0 ?
+  (sch-cssid  8) | (1  3) | (sch-ssid  1) | 1 :
+  (sch-ssid  1) | 1,
+  sch-schid,
+  sch-curr_status.pmcw.intparm,
+  (0x80  isc)  24);
+}
+}
+
+static void sch_handle_clear_func(SubchDev *sch)
+{
+PMCW *p = sch-curr_status.pmcw;
+SCSW *s = sch-curr_status.scsw;
+int path;
+
+/* Path management: In our simple css, we always choose the only path. */
+path = 0x80;
+
+/* Reset values prior to 'issueing the clear signal'. */
+p-lpum = 0;
+p-pom = 0xff;
+s-flags = ~SCSW_FLAGS_MASK_PNO;
+
+/* We always 'attempt to issue the clear signal', and we always succeed. */
+sch-orb = NULL;
+sch-channel_prog = NULL;
+sch-last_cmd = NULL;
+s-ctrl =

Re: [Qemu-devel] [PATCH 00/12] Multiqueue virtio-net

On Wed, Jan 16, 2013 at 10:14:33AM -0600, Anthony Liguori wrote:
 Michael S. Tsirkin m...@redhat.com writes:
 
  On Wed, Jan 16, 2013 at 09:09:49AM -0600, Anthony Liguori wrote:
  Jason Wang jasow...@redhat.com writes:
  
   On 01/15/2013 03:44 AM, Anthony Liguori wrote:
   Jason Wang jasow...@redhat.com writes:
  
   Hello all:
  
   This seires is an update of last version of multiqueue virtio-net 
   support.
  
   Recently, linux tap gets multiqueue support. This series implements 
   basic
   support for multiqueue tap, nic and vhost. Then use it as an 
   infrastructure to
   enable the multiqueue support for virtio-net.
  
   Both vhost and userspace multiqueue were implemented for virtio-net, 
   but
   userspace could be get much benefits since dataplane like parallized 
   mechanism
   were not implemented.
  
   User could start a multiqueue virtio-net card through adding a queues
   parameter to tap.
  
   ./qemu -netdev tap,id=hn0,queues=2,vhost=on -device 
   virtio-net-pci,netdev=hn0
  
   Management tools such as libvirt can pass multiple pre-created fds 
   through
  
   ./qemu -netdev tap,id=hn0,queues=2,fd=X,fd=Y -device
   virtio-net-pci,netdev=hn0
   I'm confused/frightened that this syntax works.  You shouldn't be
   allowed to have two values for the same property.  Better to have a
   syntax like fd[0]=X,fd[1]=Y or something along those lines.
  
   Yes, but this what current a StringList type works for command line.
   Some other parameters such as dnssearch, hostfwd and guestfwd have
   already worked in this way. Looks like your suggestions need some
   extension on QemuOps visitor, maybe we can do this on top.
  
  It's a silly syntax and breaks compatibility.  This is valid syntax:
  
  -net tap,fd=3,fd=4
  
  In this case, it means 'fd=4' because the last fd overwrites the first
  one.
  
  Now you've changed it to mean something else.  Having one thing mean
  something in one context, but something else in another context is
  terrible interface design.
  
  Regards,
  
  Anthony Liguori
 
  Aha so just renaming the field 'fds' would address this issue?
 
 No, you still have the problem of different meanings.
 
 -netdev tap,fd=X,fd=Y
 
 -netdev tap,fds=X,fds=Y
 
 Would have wildly different behavior.

I think even caring about -net tap,fd=1,fd=2 is a bit silly.  If this
resulted in fd=2 by mistake, I don't think it was ever intentionally
legal.
As Jason points out we have list support and for better or worse
it is currently using repeated options, e.g. with dnssearch, hostfwd and
guestfwd.
Isn't it better to be consistent?

 Just do:
 
 -netdev tap,fds=X:Y
 
 And then we're staying consistent wrt the interpretation of multiple
 properties of the same name.
 
 Regards,
 
 Anthony Liguori

This introduces : as a special character. However fds can
be fd names passed in with getfd, where : is a legal character.

-- 
MST

[Qemu-devel] [PATCH 11/13] migration: unfold rest of migrate_fd_put_ready() into thread

This will allow us finer control in next patches.

Signed-off-by: Juan Quintela quint...@redhat.com

Reviewed-by: Reviewed-by: Eric Blake ebl...@redhat.com
Reviewed-by: Paolo Bonzini pbonz...@redhat.com
---
 migration.c | 95 ++---
 1 file changed, 41 insertions(+), 54 deletions(-)

diff --git a/migration.c b/migration.c
index 651edd5..6d3aeed 100644
--- a/migration.c
+++ b/migration.c
@@ -662,54 +662,6 @@ static int64_t buffered_get_rate_limit(void *opaque)
 return s-xfer_limit;
 }

-static bool migrate_fd_put_ready(MigrationState *s, uint64_t max_size)
-{
-int ret;
-uint64_t pending_size;
-bool last_round = false;
-
-qemu_mutex_lock_iothread();
-DPRINTF(iterate\n);
-pending_size = qemu_savevm_state_pending(s-file, max_size);
-DPRINTF(pending size %lu max %lu\n, pending_size, max_size);
-if (pending_size = max_size) {
-ret = qemu_savevm_state_iterate(s-file);
-if (ret  0) {
-migrate_fd_error(s);
-}
-} else {
-int old_vm_running = runstate_is_running();
-int64_t start_time, end_time;
-
-DPRINTF(done iterating\n);
-start_time = qemu_get_clock_ms(rt_clock);
-qemu_system_wakeup_request(QEMU_WAKEUP_REASON_OTHER);
-if (old_vm_running) {
-vm_stop(RUN_STATE_FINISH_MIGRATE);
-} else {
-vm_stop_force_state(RUN_STATE_FINISH_MIGRATE);
-}
-
-if (qemu_savevm_state_complete(s-file)  0) {
-migrate_fd_error(s);
-} else {
-migrate_fd_completed(s);
-}
-end_time = qemu_get_clock_ms(rt_clock);
-s-total_time = end_time - s-total_time;
-s-downtime = end_time - start_time;
-if (s-state != MIG_STATE_COMPLETED) {
-if (old_vm_running) {
-vm_start();
-}
-}
-last_round = true;
-}
-qemu_mutex_unlock_iothread();
-
-return last_round;
-}
-
 static void *buffered_file_thread(void *opaque)
 {
 MigrationState *s = opaque;
@@ -730,6 +682,7 @@ static void *buffered_file_thread(void *opaque)

 while (true) {
 int64_t current_time = qemu_get_clock_ms(rt_clock);
+uint64_t pending_size;

 qemu_mutex_lock_iothread();
 if (s-state != MIG_STATE_ACTIVE) {
@@ -741,6 +694,46 @@ static void *buffered_file_thread(void *opaque)
 qemu_mutex_unlock_iothread();
 break;
 }
+if (s-bytes_xfer  s-xfer_limit) {
+DPRINTF(iterate\n);
+pending_size = qemu_savevm_state_pending(s-file, max_size);
+DPRINTF(pending size %lu max %lu\n, pending_size, max_size);
+if (pending_size = max_size) {
+ret = qemu_savevm_state_iterate(s-file);
+if (ret  0) {
+qemu_mutex_unlock_iothread();
+break;
+}
+} else {
+int old_vm_running = runstate_is_running();
+int64_t start_time, end_time;
+
+DPRINTF(done iterating\n);
+start_time = qemu_get_clock_ms(rt_clock);
+qemu_system_wakeup_request(QEMU_WAKEUP_REASON_OTHER);
+if (old_vm_running) {
+vm_stop(RUN_STATE_FINISH_MIGRATE);
+} else {
+vm_stop_force_state(RUN_STATE_FINISH_MIGRATE);
+}
+ret = qemu_savevm_state_complete(s-file);
+if (ret  0) {
+qemu_mutex_unlock_iothread();
+break;
+} else {
+migrate_fd_completed(s);
+}
+end_time = qemu_get_clock_ms(rt_clock);
+s-total_time = end_time - s-total_time;
+s-downtime = end_time - start_time;
+if (s-state != MIG_STATE_COMPLETED) {
+if (old_vm_running) {
+vm_start();
+}
+}
+last_round = true;
+}
+}
 qemu_mutex_unlock_iothread();
 if (current_time = initial_time + BUFFER_DELAY) {
 uint64_t transferred_bytes = s-bytes_xfer;
@@ -763,12 +756,6 @@ static void *buffered_file_thread(void *opaque)
 if (ret  0) {
 break;
 }
-
-DPRINTF(file is ready\n);
-if (s-bytes_xfer  s-xfer_limit) {
-DPRINTF(notifying client\n);
-last_round = migrate_fd_put_ready(s, max_size);
-}
 }

 out:
-- 
1.8.1

[Qemu-devel] [PATCH 09/13] migration: Add buffered_flush error handling

Now that we have error handling we can do proper handling of
buffered_flush().

Signed-off-by: Juan Quintela quint...@redhat.com

Reviewed-by: Reviewed-by: Eric Blake ebl...@redhat.com
Reviewed-by: Paolo Bonzini pbonz...@redhat.com
---
 migration.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/migration.c b/migration.c
index 7ae1d93..17eb27d 100644
--- a/migration.c
+++ b/migration.c
@@ -757,7 +757,8 @@ static void *buffered_file_thread(void *opaque)
 /* usleep expects microseconds */
 g_usleep((initial_time + BUFFER_DELAY - current_time)*1000);
 }
-if (buffered_flush(s)  0) {
+ret = buffered_flush(s);
+if (ret  0) {
 break;
 }

-- 
1.8.1

[Qemu-devel] [Bug 1087114] Re: assertion QLIST_EMPTY(bs-tracked_requests) failed

2013-01-17 Thread Rainer Müller

Aaron, this added line in qemu-thread-posix.c is the fix, qemu is
expected to crash once this is removed.

I guess Brad meant to revert c166cb72f1676855816340666c3b618beef4b976
which introduced the fallback code. However, reverting this commit alone
will not work on Mac OS X as sem_timedwait() is not available (and the
reason why the fallback code was added at all).

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1087114

Title:
  assertion QLIST_EMPTY(bs-tracked_requests) failed

Status in QEMU:
  New

Bug description:
  QEMU 1.3.0 on OpenBSD now crashes with an error as shown below and the
  command line params do not seem to matter.

  assertion QLIST_EMPTY(bs-tracked_requests) failed: file block.c,
  line 1220, function bdrv_drain_all

  #1  0x030d1bce24aa in abort () at /usr/src/lib/libc/stdlib/abort.c:70
  p = (struct atexit *) 0x30d11897000
  mask = 4294967263
  cleanup_called = 1
  #2  0x030d1bc5ff44 in __assert2 (file=Variable file is not available.
  ) at /usr/src/lib/libc/gen/assert.c:52
  No locals.
  #3  0x030b0d383a03 in bdrv_drain_all () at block.c:1220
  bs = (BlockDriverState *) 0x30d13f3b630
  busy = false
  __func__ = bdrv_drain_all
  #4  0x030b0d43acfc in bmdma_cmd_writeb (bm=0x30d0f5f56a8, val=8) at 
hw/ide/pci.c:312
  __func__ = bmdma_cmd_writeb
  #5  0x030b0d43b450 in bmdma_write (opaque=0x30d0f5f56a8, addr=0, val=8, 
size=1) at hw/ide/piix.c:76
  bm = (BMDMAState *) 0x30d0f5f56a8
  #6  0x030b0d5c2ce6 in memory_region_write_accessor (opaque=0x30d0f5f57d0, 
addr=0, value=0x30d18c288f0, size=1, shift=0, mask=255)
  at /home/ports/pobj/qemu-1.3.0-debug/qemu-1.3.0/memory.c:334
  mr = (MemoryRegion *) 0x30d0f5f57d0
  tmp = 8
  #7  0x030b0d5c2dc5 in access_with_adjusted_size (addr=0, 
value=0x30d18c288f0, size=1, access_size_min=1, access_size_max=4, 
  access=0x30b0d5c2c6b memory_region_write_accessor, 
opaque=0x30d0f5f57d0) at 
/home/ports/pobj/qemu-1.3.0-debug/qemu-1.3.0/memory.c:364
  access_mask = 255
  access_size = 1
  i = 0
  #8  0x030b0d5c3222 in memory_region_iorange_write (iorange=0x30d1d5e7400, 
offset=0, width=1, data=8)
  at /home/ports/pobj/qemu-1.3.0-debug/qemu-1.3.0/memory.c:439
  mrio = (MemoryRegionIORange *) 0x30d1d5e7400
  mr = (MemoryRegion *) 0x30d0f5f57d0
  __func__ = memory_region_iorange_write
  #9  0x030b0d5c019a in ioport_writeb_thunk (opaque=0x30d1d5e7400, 
addr=49216, data=8) at /home/ports/pobj/qemu-1.3.0-debug/qemu-1.3.0/ioport.c:212
  ioport = (IORange *) 0x30d1d5e7400
  #10 0x030b0d5bfb65 in ioport_write (index=0, address=49216, data=8) at 
/home/ports/pobj/qemu-1.3.0-debug/qemu-1.3.0/ioport.c:83
  func = (IOPortWriteFunc *) 0x30b0d5c0148 ioport_writeb_thunk
  default_func = {0x30b0d5bfbbc default_ioport_writeb, 0x30b0d5bfc61 
default_ioport_writew, 0x30b0d5bfd0c default_ioport_writel}
  #11 0x030b0d5c0704 in cpu_outb (addr=49216, val=8 '\b') at 
/home/ports/pobj/qemu-1.3.0-debug/qemu-1.3.0/ioport.c:289
  No locals.
  #12 0x030b0d6067dd in helper_outb (port=49216, data=8) at 
/home/ports/pobj/qemu-1.3.0-debug/qemu-1.3.0/target-i386/misc_helper.c:72
  No locals.

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1087114/+subscriptions

[Qemu-devel] [PATCH 02/12] s390: Lowcore mapping helper.

Create a lowcore mapping helper that includes a check for sufficient
length.

Signed-off-by: Cornelia Huck cornelia.h...@de.ibm.com
---
 target-s390x/helper.c | 31 +--
 1 file changed, 25 insertions(+), 6 deletions(-)

diff --git a/target-s390x/helper.c b/target-s390x/helper.c
index 9a132e6..bf2b4d3 100644
--- a/target-s390x/helper.c
+++ b/target-s390x/helper.c
@@ -471,13 +471,32 @@ static uint64_t get_psw_mask(CPUS390XState *env)
 return r;
 }
 
+static LowCore *cpu_map_lowcore(CPUS390XState *env, hwaddr *len)
+{
+LowCore *lowcore;
+
+if (*len  sizeof(LowCore)) {
+cpu_abort(env, Insufficient length %d for mapping lowcore\n,
+  (int) *len);
+}
+
+lowcore = cpu_physical_memory_map(env-psa, len, 1);
+
+return lowcore;
+}
+
+static void cpu_unmap_lowcore(LowCore *lowcore, hwaddr len)
+{
+cpu_physical_memory_unmap(lowcore, len, 1, len);
+}
+
 static void do_svc_interrupt(CPUS390XState *env)
 {
 uint64_t mask, addr;
 LowCore *lowcore;
 hwaddr len = TARGET_PAGE_SIZE;
 
-lowcore = cpu_physical_memory_map(env-psa, len, 1);
+lowcore = cpu_map_lowcore(env, len);
 
 lowcore-svc_code = cpu_to_be16(env-int_svc_code);
 lowcore-svc_ilen = cpu_to_be16(env-int_svc_ilen);
@@ -486,7 +505,7 @@ static void do_svc_interrupt(CPUS390XState *env)
 mask = be64_to_cpu(lowcore-svc_new_psw.mask);
 addr = be64_to_cpu(lowcore-svc_new_psw.addr);
 
-cpu_physical_memory_unmap(lowcore, len, 1, len);
+cpu_unmap_lowcore(lowcore, len);
 
 load_psw(env, mask, addr);
 }
@@ -513,7 +532,7 @@ static void do_program_interrupt(CPUS390XState *env)
 qemu_log_mask(CPU_LOG_INT, %s: code=0x%x ilen=%d\n,
   __func__, env-int_pgm_code, ilen);
 
-lowcore = cpu_physical_memory_map(env-psa, len, 1);
+lowcore = cpu_map_lowcore(env, len);
 
 lowcore-pgm_ilen = cpu_to_be16(ilen);
 lowcore-pgm_code = cpu_to_be16(env-int_pgm_code);
@@ -522,7 +541,7 @@ static void do_program_interrupt(CPUS390XState *env)
 mask = be64_to_cpu(lowcore-program_new_psw.mask);
 addr = be64_to_cpu(lowcore-program_new_psw.addr);
 
-cpu_physical_memory_unmap(lowcore, len, 1, len);
+cpu_unmap_lowcore(lowcore, len);
 
 DPRINTF(%s: %x %x % PRIx64  % PRIx64 \n, __func__,
 env-int_pgm_code, ilen, env-psw.mask,
@@ -549,7 +568,7 @@ static void do_ext_interrupt(CPUS390XState *env)
 }
 
 q = env-ext_queue[env-ext_index];
-lowcore = cpu_physical_memory_map(env-psa, len, 1);
+lowcore = cpu_map_lowcore(env, len);
 
 lowcore-ext_int_code = cpu_to_be16(q-code);
 lowcore-ext_params = cpu_to_be32(q-param);
@@ -560,7 +579,7 @@ static void do_ext_interrupt(CPUS390XState *env)
 mask = be64_to_cpu(lowcore-external_new_psw.mask);
 addr = be64_to_cpu(lowcore-external_new_psw.addr);
 
-cpu_physical_memory_unmap(lowcore, len, 1, len);
+cpu_unmap_lowcore(lowcore, len);
 
 env-ext_index--;
 if (env-ext_index == -1) {
-- 
1.7.12.4

Re: [Qemu-devel] [PATCH] v6 revamp acpitable parsing and allow to specify complete (headerful) table


Wow you're replying to an old post... ;)

17.01.2013 13:50, TeLeMan wrote:

On Thu, May 12, 2011 at 10:44 PM, Michael Tokarev m...@tls.msk.ru wrote:

This patch almost rewrites acpi_table_add() function

[]

+
+/* now read in the data files, reallocating buffer as needed */
+
+for (f = strtok(buf, :); f; f = strtok(NULL, :)) {
+int fd = open(f, O_RDONLY);


The acpi table is the binary file, so it should be opened by O_RDONLY
| O_BINARY.


On Unix, O_BINARY is defined as 0, it has no effect whatsoever.
But yes it is a bug on other platforms.  I'll fix that in a moment.

Thanks,

/mnt

[Qemu-devel] [PATCH v3] win32-aio: use iov utility functions instead of open-coding them

We have iov_from_buf() and iov_to_buf(), use them instead of
open-coding these in block/win32-aio.c
---
v3: added the forgotten #include (compile-tested on mingw32)
v2: rebase on top of the fix from bonzini@

 block/win32-aio.c |   17 +++--
 1 file changed, 3 insertions(+), 14 deletions(-)

diff --git a/block/win32-aio.c b/block/win32-aio.c
index b9236ea..5d0fbbf 100644
--- a/block/win32-aio.c
+++ b/block/win32-aio.c
@@ -29,6 +29,7 @@
 #include block/aio.h
 #include raw-aio.h
 #include qemu/event_notifier.h
+#include qemu/iov.h
 #include windows.h
 #include winioctl.h
 
@@ -80,13 +81,7 @@ static void win32_aio_process_completion(QEMUWin32AIOState 
*s,
 if (!waiocb-is_linear) {
 if (ret == 0  waiocb-is_read) {
 QEMUIOVector *qiov = waiocb-qiov;
-char *p = waiocb-buf;
-int i;
-
-for (i = 0; i  qiov-niov; ++i) {
-memcpy(qiov-iov[i].iov_base, p, qiov-iov[i].iov_len);
-p += qiov-iov[i].iov_len;
-}
+iov_from_buf(qiov-iov, qiov-niov, 0, waiocb-buf, qiov-size);
 }
 qemu_vfree(waiocb-buf);
 }
@@ -153,13 +148,7 @@ BlockDriverAIOCB *win32_aio_submit(BlockDriverState *bs,
 if (qiov-niov  1) {
 waiocb-buf = qemu_blockalign(bs, qiov-size);
 if (type  QEMU_AIO_WRITE) {
-char *p = waiocb-buf;
-int i;
-
-for (i = 0; i  qiov-niov; ++i) {
-memcpy(p, qiov-iov[i].iov_base, qiov-iov[i].iov_len);
-p += qiov-iov[i].iov_len;
-}
+iov_to_buf(qiov-iov, qiov-niov, 0, waiocb-buf, qiov-size);
 }
 waiocb-is_linear = false;
 } else {
-- 
1.7.10.4

[Qemu-devel] [PATCH 03/12] s390: Add mapping helper functions.

Add s390_cpu_physical_memory_{map,unmap} with special handling
for the lowcore.

Signed-off-by: Cornelia Huck cornelia.h...@de.ibm.com
---
 target-s390x/cpu.h|  4 
 target-s390x/helper.c | 26 ++
 2 files changed, 30 insertions(+)

diff --git a/target-s390x/cpu.h b/target-s390x/cpu.h
index 6700fe9..cd729d3 100644
--- a/target-s390x/cpu.h
+++ b/target-s390x/cpu.h
@@ -299,6 +299,10 @@ int cpu_s390x_handle_mmu_fault (CPUS390XState *env, 
target_ulong address, int rw
 
 
 #ifndef CONFIG_USER_ONLY
+void *s390_cpu_physical_memory_map(CPUS390XState *env, hwaddr addr, hwaddr len,
+   int is_write);
+void s390_cpu_physical_memory_unmap(CPUS390XState *env, void *addr, hwaddr len,
+int is_write);
 void s390x_tod_timer(void *opaque);
 void s390x_cpu_timer(void *opaque);
 
diff --git a/target-s390x/helper.c b/target-s390x/helper.c
index bf2b4d3..d350f28 100644
--- a/target-s390x/helper.c
+++ b/target-s390x/helper.c
@@ -490,6 +490,32 @@ static void cpu_unmap_lowcore(LowCore *lowcore, hwaddr len)
 cpu_physical_memory_unmap(lowcore, len, 1, len);
 }
 
+void *s390_cpu_physical_memory_map(CPUS390XState *env, hwaddr addr, hwaddr len,
+   int is_write)
+{
+hwaddr start = addr;
+
+/* Mind the prefix area. */
+if (addr  8192) {
+start += env-psa;
+} else if ((env-psa = addr)  (addr  env-psa + 8192)) {
+start -= env-psa;
+}
+
+if ((addr + len = env-psa) || (addr = env-psa + 8192)) {
+return cpu_physical_memory_map(start, len, is_write);
+}
+
+DPRINTF(mapping across lowcore boundaries not yet supported\n);
+return NULL;
+}
+
+void s390_cpu_physical_memory_unmap(CPUS390XState *env, void *addr, hwaddr len,
+int is_write)
+{
+cpu_physical_memory_unmap(addr, len, is_write, len);
+}
+
 static void do_svc_interrupt(CPUS390XState *env)
 {
 uint64_t mask, addr;
-- 
1.7.12.4

[Qemu-devel] [PATCH 2/2 v6] target-i386: Replace cpuid_*features fields with a feature word array

2013-01-17 Thread Eduardo Habkost

This replaces the feature-bit fields on both X86CPU and x86_def_t
structs with an array.

With this, we will be able to simplify code that simply does the same
operation on all feature words (e.g. kvm_check_features_against_host(),
filter_features_for_kvm(), add_flagname_to_bitmaps(), and CPU
feature-bit property lookup/registration).

This should also help avoid bugs like the ones introduced when we added
cpuid_7_0_ebx_features. Today, adding a new feature word to the code
requires chaning 5 or 6 different places in the code, and it's very easy
to miss a problem when we forget to update one of those parts. See, for
example:

 * The bug solved by commit ffa8c11f0bbf47e1b7a3a62f97bc1da591c6734a;
 * The fact that check_features_against_host() still doesn't check all
   feature words as it is supposed to.

Signed-off-by: Eduardo Habkost ehabk...@redhat.com
---
This patch was created solely using a sed script and no manual changes,
to try to avoid mistakes while converting the code, and make it easier
to rebase if necessary. The sed script can be seen at:
  https://gist.github.com/4271991

Changes v6:
 - Break the lines on builtin_x86_defs just after the =.
   This way the feature lists stay on separate lines, this patch gets
   easier to review, and future patches that touches the code around
   builtin_x86_defs will be even easier to review (as they won't need
   to touch the lines containing the fature lists again)
---
 bsd-user/elfload.c|   2 +-
 bsd-user/main.c   |   4 +-
 hw/kvm/clock.c|   2 +-
 linux-user/elfload.c  |   2 +-
 linux-user/main.c |   4 +-
 target-i386/cpu.c | 405 +++---
 target-i386/cpu.h |  15 +-
 target-i386/helper.c  |   4 +-
 target-i386/kvm.c |   5 +-
 target-i386/misc_helper.c |  14 +-
 target-i386/translate.c   |  10 +-
 11 files changed, 269 insertions(+), 198 deletions(-)

diff --git a/bsd-user/elfload.c b/bsd-user/elfload.c
index a6cd3ab..44e1568 100644
--- a/bsd-user/elfload.c
+++ b/bsd-user/elfload.c
@@ -110,7 +110,7 @@ static const char *get_elf_platform(void)
 
 static uint32_t get_elf_hwcap(void)
 {
-  return thread_env-cpuid_features;
+  return thread_env-features[FEAT_1_EDX];
 }
 
 #ifdef TARGET_X86_64
diff --git a/bsd-user/main.c b/bsd-user/main.c
index 1dc0330..8b8b1f1 100644
--- a/bsd-user/main.c
+++ b/bsd-user/main.c
@@ -1010,13 +1010,13 @@ int main(int argc, char **argv)
 
 env-cr[0] = CR0_PG_MASK | CR0_WP_MASK | CR0_PE_MASK;
 env-hflags |= HF_PE_MASK;
-if (env-cpuid_features  CPUID_SSE) {
+if (env-features[FEAT_1_EDX]  CPUID_SSE) {
 env-cr[4] |= CR4_OSFXSR_MASK;
 env-hflags |= HF_OSFXSR_MASK;
 }
 #ifndef TARGET_ABI32
 /* enable 64 bit mode if possible */
-if (!(env-cpuid_ext2_features  CPUID_EXT2_LM)) {
+if (!(env-features[FEAT_8000_0001_EDX]  CPUID_EXT2_LM)) {
 fprintf(stderr, The selected x86 CPU does not support 64 bit mode\n);
 exit(1);
 }
diff --git a/hw/kvm/clock.c b/hw/kvm/clock.c
index fa40e28..87d4d0f 100644
--- a/hw/kvm/clock.c
+++ b/hw/kvm/clock.c
@@ -129,7 +129,7 @@ static const TypeInfo kvmclock_info = {
 void kvmclock_create(void)
 {
 if (kvm_enabled() 
-first_cpu-cpuid_kvm_features  ((1ULL  KVM_FEATURE_CLOCKSOURCE) |
+first_cpu-features[FEAT_KVM]  ((1ULL  KVM_FEATURE_CLOCKSOURCE) |
  (1ULL  KVM_FEATURE_CLOCKSOURCE2))) {
 sysbus_create_simple(kvmclock, -1, NULL);
 }
diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 89db49c..04755de 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -130,7 +130,7 @@ static const char *get_elf_platform(void)
 
 static uint32_t get_elf_hwcap(void)
 {
-return thread_env-cpuid_features;
+return thread_env-features[FEAT_1_EDX];
 }
 
 #ifdef TARGET_X86_64
diff --git a/linux-user/main.c b/linux-user/main.c
index 0181bc2..c9e4e69 100644
--- a/linux-user/main.c
+++ b/linux-user/main.c
@@ -3674,13 +3674,13 @@ int main(int argc, char **argv, char **envp)
 
 env-cr[0] = CR0_PG_MASK | CR0_WP_MASK | CR0_PE_MASK;
 env-hflags |= HF_PE_MASK;
-if (env-cpuid_features  CPUID_SSE) {
+if (env-features[FEAT_1_EDX]  CPUID_SSE) {
 env-cr[4] |= CR4_OSFXSR_MASK;
 env-hflags |= HF_OSFXSR_MASK;
 }
 #ifndef TARGET_ABI32
 /* enable 64 bit mode if possible */
-if (!(env-cpuid_ext2_features  CPUID_EXT2_LM)) {
+if (!(env-features[FEAT_8000_0001_EDX]  CPUID_EXT2_LM)) {
 fprintf(stderr, The selected x86 CPU does not support 64 bit mode\n);
 exit(1);
 }
diff --git a/target-i386/cpu.c b/target-i386/cpu.c
index fb10ffd..56e072c 100644
--- a/target-i386/cpu.c
+++ b/target-i386/cpu.c
@@ -340,22 +340,15 @@ static void add_flagname_to_bitmaps(const char *flagname,
 typedef struct x86_def_t {
 struct x86_def_t *next;
 const char *name;
-uint32_t level;
+uint32_t level, xlevel, xlevel2;
+

[Qemu-devel] [PATCH 06/12] s390: I/O interrupt and machine check injection.

I/O interrupts are queued per isc. Only crw pending machine checks
are supported.

Signed-off-by: Cornelia Huck cornelia.h...@de.ibm.com
---
 target-s390x/cpu.h|  69 +++-
 target-s390x/helper.c | 143 ++
 2 files changed, 211 insertions(+), 1 deletion(-)

diff --git a/target-s390x/cpu.h b/target-s390x/cpu.h
index 931ed4d..97f70f3 100644
--- a/target-s390x/cpu.h
+++ b/target-s390x/cpu.h
@@ -47,6 +47,11 @@
 #define MMU_USER_IDX 1
 
 #define MAX_EXT_QUEUE 16
+#define MAX_IO_QUEUE 16
+#define MAX_MCHK_QUEUE 16
+
+#define PSW_MCHK_MASK 0x0004
+#define PSW_IO_MASK 0x0200
 
 typedef struct PSW {
 uint64_t mask;
@@ -59,6 +64,17 @@ typedef struct ExtQueue {
 uint32_t param64;
 } ExtQueue;
 
+typedef struct IOIntQueue {
+uint16_t id;
+uint16_t nr;
+uint32_t parm;
+uint32_t word;
+} IOIntQueue;
+
+typedef struct MchkQueue {
+uint16_t type;
+} MchkQueue;
+
 typedef struct CPUS390XState {
 uint64_t regs[16]; /* GP registers */
 CPU_DoubleU fregs[16]; /* FP registers */
@@ -90,9 +106,17 @@ typedef struct CPUS390XState {
 uint64_t cregs[16]; /* control registers */
 
 ExtQueue ext_queue[MAX_EXT_QUEUE];
-int pending_int;
+IOIntQueue io_queue[MAX_IO_QUEUE][8];
+MchkQueue mchk_queue[MAX_MCHK_QUEUE];
 
+int pending_int;
 int ext_index;
+int io_index[8];
+int mchk_index;
+
+uint64_t ckc;
+uint64_t cputm;
+uint32_t todpr;
 
 CPU_COMMON
 
@@ -373,10 +397,14 @@ static inline void cpu_set_tls(CPUS390XState *env, 
target_ulong newtls)
 #define EXCP_EXT 1 /* external interrupt */
 #define EXCP_SVC 2 /* supervisor call (syscall) */
 #define EXCP_PGM 3 /* program interruption */
+#define EXCP_IO  7 /* I/O interrupt */
+#define EXCP_MCHK 8 /* machine check */
 
 #define INTERRUPT_EXT(1  0)
 #define INTERRUPT_TOD(1  1)
 #define INTERRUPT_CPUTIMER   (1  2)
+#define INTERRUPT_IO (1  3)
+#define INTERRUPT_MCHK   (1  4)
 
 /* Program Status Word.  */
 #define S390_PSWM_REGNUM 0
@@ -920,6 +948,45 @@ static inline void cpu_inject_ext(CPUS390XState *env, 
uint32_t code, uint32_t pa
 cpu_interrupt(env, CPU_INTERRUPT_HARD);
 }
 
+static inline void cpu_inject_io(CPUS390XState *env, uint16_t subchannel_id,
+ uint16_t subchannel_number,
+ uint32_t io_int_parm, uint32_t io_int_word)
+{
+int isc = ffs(io_int_word  2) - 1;
+
+if (env-io_index[isc] == MAX_IO_QUEUE - 1) {
+/* ugh - can't queue anymore. Let's drop. */
+return;
+}
+
+env-io_index[isc]++;
+assert(env-io_index[isc]  MAX_IO_QUEUE);
+
+env-io_queue[env-io_index[isc]][isc].id = subchannel_id;
+env-io_queue[env-io_index[isc]][isc].nr = subchannel_number;
+env-io_queue[env-io_index[isc]][isc].parm = io_int_parm;
+env-io_queue[env-io_index[isc]][isc].word = io_int_word;
+
+env-pending_int |= INTERRUPT_IO;
+cpu_interrupt(env, CPU_INTERRUPT_HARD);
+}
+
+static inline void cpu_inject_crw_mchk(CPUS390XState *env)
+{
+if (env-mchk_index == MAX_MCHK_QUEUE - 1) {
+/* ugh - can't queue anymore. Let's drop. */
+return;
+}
+
+env-mchk_index++;
+assert(env-mchk_index  MAX_MCHK_QUEUE);
+
+env-mchk_queue[env-mchk_index].type = 1;
+
+env-pending_int |= INTERRUPT_MCHK;
+cpu_interrupt(env, CPU_INTERRUPT_HARD);
+}
+
 static inline bool cpu_has_work(CPUState *cpu)
 {
 CPUS390XState *env = S390_CPU(cpu)-env;
diff --git a/target-s390x/helper.c b/target-s390x/helper.c
index d350f28..6e0a2d2 100644
--- a/target-s390x/helper.c
+++ b/target-s390x/helper.c
@@ -618,12 +618,142 @@ static void do_ext_interrupt(CPUS390XState *env)
 load_psw(env, mask, addr);
 }
 
+static void do_io_interrupt(CPUS390XState *env)
+{
+uint64_t mask, addr;
+LowCore *lowcore;
+hwaddr len = TARGET_PAGE_SIZE;
+IOIntQueue *q;
+uint8_t isc;
+int disable = 1;
+int found = 0;
+
+if (!(env-psw.mask  PSW_MASK_IO)) {
+cpu_abort(env, I/O int w/o I/O mask\n);
+}
+
+for (isc = 0; isc  8; isc++) {
+if (env-io_index[isc]  0) {
+continue;
+}
+if (env-io_index[isc]  MAX_IO_QUEUE) {
+cpu_abort(env, I/O queue overrun for isc %d: %d\n,
+  isc, env-io_index[isc]);
+}
+
+q = env-io_queue[env-io_index[isc]][isc];
+if (!(env-cregs[6]  q-word)) {
+disable = 0;
+continue;
+}
+found = 1;
+lowcore = cpu_map_lowcore(env, len);
+
+lowcore-subchannel_id = cpu_to_be16(q-id);
+lowcore-subchannel_nr = cpu_to_be16(q-nr);
+lowcore-io_int_parm = cpu_to_be32(q-parm);
+lowcore-io_int_word = cpu_to_be32(q-word);
+lowcore-io_old_psw.mask = cpu_to_be64(get_psw_mask(env));
+lowcore-io_old_psw.addr = cpu_to_be64(env-psw.addr);
+mask =

Re: [Qemu-devel] [PATCH 04/12] Update linux headers.

2013-01-17 Thread Peter Maydell

On 17 January 2013 14:23, Cornelia Huck cornelia.h...@de.ibm.com wrote:
 Base is kvm-next as of 2013/01/16.

 --- a/linux-headers/asm-powerpc/kvm_para.h
 +++ b/linux-headers/asm-powerpc/kvm_para.h
 @@ -78,7 +78,7 @@ struct kvm_vcpu_arch_shared {

  #define KVM_HCALL_TOKEN(num) _EV_HCALL_TOKEN(EV_KVM_VENDOR_ID, num)

 -#include asm/epapr_hcalls.h
 +#include uapi/asm/epapr_hcalls.h

This is reintroducing a bug, isn't it? cf
http://lists.gnu.org/archive/html/qemu-devel/2012-12/msg02807.html

(maybe this just means the sync needs to be against some
different set of kernel headers?)

-- PMM

Re: [Qemu-devel] [PATCH 00/14] migration queue

Il 17/01/2013 13:46, Juan Quintela ha scritto:
 
  It shouldn't be, because the patches have never been posted before.
  That said, I'm okay with pulling all patches except the last one.
 I will add that as reviewed by? O:-)

Yes.

Paolo

[Qemu-devel] [PATCH 09/12] s390: Wire up channel I/O in kvm.