Stefan Weil [Thu, 14 Apr 2011 17:19:00 +0000 (19:19 +0200)]
sparc: Fix assertion caused by empty memory slot with 0 byte
If the memory size given on the command line is equal to the
maximum size of memory defined by the hardware, there is no
"empty slot" after physical memory.
The following command
qemu-system-sparc -m 256
raised an assertion:
exec.c:2614: cpu_register_physical_memory_offset: Assertion `size' failed
This can be fixed either at the caller side (don't call empty_slot_init)
or in empty_slot_init (do nothing) when size == 0. The second solution
was choosen here because it is more robust.
Paolo Bonzini [Wed, 13 Apr 2011 08:03:44 +0000 (10:03 +0200)]
enable vm_clock to "warp" in the iothread+icount case
The previous patch however is not enough, because if the virtual CPU
goes to sleep waiting for a future timer interrupt to wake it up, qemu
deadlocks. The timer interrupt never comes because time is driven by
icount, but the vCPU doesn't run any insns.
You could say that VCPUs should never go to sleep in icount
mode if there is a pending vm_clock timer; rather time should
just warp to the next vm_clock event with no sleep ever taking place.
Even better, you can sleep for some time related to the
time left until the next event, to avoid that the warps are too visible
externally; for example, you could be sending network packets continously
instead of every 100ms.
This is what this patch implements. qemu_clock_warp is called: 1)
whenever a vm_clock timer is adjusted, to ensure the warp_timer is
synchronized; 2) at strategic points in the CPU thread, to make sure
the insn counter is synchronized before the CPU starts running.
In any case, the warp_timer is disabled while the CPU is running,
because the insn counter will then be making progress on its own.
Paolo Bonzini [Wed, 13 Apr 2011 08:03:43 +0000 (10:03 +0200)]
really fix -icount in the iothread case
The correct fix for -icount is to consider the biggest difference
between iothread and non-iothread modes. In the traditional model,
CPUs run _before_ the iothread calls select (or WaitForMultipleObjects
for Win32). In the iothread model, CPUs run while the iothread
isn't holding the mutex, i.e. _during_ those same calls.
So, the iothread should always block as long as possible to let
the CPUs run smoothly---the timeout might as well be infinite---and
either the OS or the CPU thread itself will let the iothread know
when something happens. At this point, the iothread wakes up and
interrupts the CPU.
This is exactly the approach that this patch takes: when cpu_exec_all
returns in -icount mode, and it is because a vm_clock deadline has
been met, it wakes up the iothread to process the timers. This is
really the "bulk" of fixing icount.
Peter Maydell [Thu, 14 Apr 2011 13:11:56 +0000 (14:11 +0100)]
tests/test-mmap.c: Check mmap() return value before using it
Correct the position of a "stop if MAP_FAILED" check in the mmap()
tests, so that if mmap() does fail we print a failure message
rather than segfaulting inside memcpy().
Peter Maydell [Mon, 11 Apr 2011 15:32:08 +0000 (16:32 +0100)]
target-arm: Don't overflow when calculating value for signed VABAL
In the VABAL instruction we take the absolute difference of two
values of size x and store it in a result of size 2x. This means
we have to be careful to calculate the absolute difference using
a wide enough type that we don't accidentally overflow.
Amit Shah [Tue, 12 Apr 2011 16:06:07 +0000 (21:36 +0530)]
atapi: GESN: implement 'media' subcommand
Implement the 'media' sub-command of the GET_EVENT_STATUS_NOTIFICATION
command. This helps us report tray open, tray closed, no media, media
present states to the guest.
Newer Linux kernels (2.6.38+) rely on this command to revalidate discs
after media change.
This patch also sends out tray open/closed status to the guest driver
when requested e.g. via the CDROM_DRIVE_STATUS ioctl (thanks Markus).
Without such notification, the guest and qemu's tray open/close status
was frequently out of sync, causing installers like Anaconda detecting
no disc instead of tray open, confusing them terribly.
Amit Shah [Tue, 12 Apr 2011 16:06:06 +0000 (21:36 +0530)]
atapi: GESN: Standardise event response handling for future additions
Handle GET_EVENT_STATUS_NOTIFICATION's No Event Available response in a
generic way so that future additions to the code to handle other
response types is easier.
Amit Shah [Tue, 12 Apr 2011 16:06:03 +0000 (21:36 +0530)]
atapi: Allow GET_EVENT_STATUS_NOTIFICATION after media change
After a media change, the only commands allowed from the guest were
REQUEST_SENSE and INQUIRY. The guest may also issue
GET_EVENT_STATUS_NOTIFICATION commands to get media
changed notification.
Amit Shah [Sat, 9 Apr 2011 10:24:39 +0000 (15:54 +0530)]
atapi: Report correct errors on guest eject request
Table 629 of the MMC-5 spec mentions two different error conditions when
a CDROM eject is requested: a) while a disc is inserted and b) while a
disc is not inserted.
Ensure we return the appropriate error for the present condition of the
drive and disc status.
Anthony Liguori [Fri, 17 Dec 2010 15:58:22 +0000 (15:58 +0000)]
qed: Add support for zero clusters
Zero clusters are similar to unallocated clusters except instead of reading
their value from a backing file when one is available, the cluster is always
read as zero.
This implements read support only. At this stage, QED will never write a
zero cluster.
Peter Maydell [Mon, 11 Apr 2011 15:26:21 +0000 (16:26 +0100)]
target-arm: Handle UNDEF cases for Neon 2 register misc forms
Add missing UNDEF checks for Neon "two register miscellaneous" forms:
* all instructions except VMOVN,VQMOVN must UNDEF
if Q==1 && (Vd<0> == 1 || Vm<0> == 1)
* VMOVN,VQMOVN,VCVT.F16.F32 UNDEF if Q == 1 || Vm<0> == 1
* VSHLL,VCVT.F32.F16 UNDEF if Q == 1 || Vd<0> == 1
(The only other UNDEF case is VZIP,VUZP if Q == 0 && size == 10,
which we already handle.)
Peter Maydell [Mon, 11 Apr 2011 15:26:20 +0000 (16:26 +0100)]
target-arm: Simplify checking of size field in Neon 2reg-misc forms
Many of the Neon "2 register misc" instruction forms require invalid
size fields to cause the instruction to UNDEF. Pull this information
out into an array; this simplifies the code and also means we can do
the check early and avoid the problem of leaking TCG temporaries in
the illegal_op case.
Peter Maydell [Mon, 11 Apr 2011 15:26:16 +0000 (16:26 +0100)]
target-arm: Handle UNDEF cases for Neon invalid modified-immediates
For Neon "one register and a modified immediate value" forms, the
combination op=1 cmode=1111 is unallocated and should UNDEF.
All instructions of this form also UNDEF if Q == 1 and Vd<0> == 1.
We also add a comment on the only UNPREDICTABLE in this space.
Peter Maydell [Mon, 11 Apr 2011 15:26:15 +0000 (16:26 +0100)]
target-arm: Collapse VSRI case into VSHL, VSLI
Collapse some switch cases for VSRI into those for VSHL, VSLI,
since the bodies are the same. (This is not completely obvious
for the size < 3 case, but since for VSRI we know U=1 the
GEN_NEON_INTEGER_OP() expansion is equivalent to the open-coded
VSHL/VSLI case.)
Peter Maydell [Mon, 11 Apr 2011 15:26:14 +0000 (16:26 +0100)]
target-arm: Handle UNDEF cases for Neon "2 regs and shift" insns
Correctly handle all the UNDEF cases for Neon instructions of the
"2 registers and shift" form, and make sure that we check for these
cases early enough not to leak TCG temporaries.
Juha Riihimäki [Mon, 11 Apr 2011 15:26:13 +0000 (16:26 +0100)]
target-arm: Simplify three-register pairwise code
Since we know that the case of (pairwise && q) has been caught
earlier, we can simplify the register setup code for each pass
in the three-register-same-size Neon loop.
Peter Maydell [Mon, 11 Apr 2011 15:26:12 +0000 (16:26 +0100)]
target-arm: Handle UNDEF cases for Neon 3-regs-same insns
Correct the handling of UNDEF cases for the NEON "3 registers same
size" forms, by adding missing checks and rationalising some others
so they are done early enough to avoid leaking TCG temporaries.
Peter Maydell [Mon, 11 Apr 2011 15:26:11 +0000 (16:26 +0100)]
target-arm: Use lookup table for size check on Neon 3-reg-same insns
Simplify the checks for invalid size values for the Neon "three registers
of the same size" instruction forms (and add them where they were missing)
by using a lookup table.
This includes adding symbolic constants for the op values in this space,
since we now use them in multiple places.
Stefan Weil [Sun, 10 Apr 2011 16:23:39 +0000 (18:23 +0200)]
Replace cpu_physical_memory_rw were possible
Using cpu_physical_memory_read, cpu_physical_memory_write and ldub_phys
improves readability and allows removing some type casts.
lduw_phys and ldl_phys were not used because both require aligned
addresses. Therefore it is not possible to simply replace existing
calls by one of these functions.
Now that PPC defaults to softfloat which always provides float128
support, there is no need to keep two version of the code, depending if
float128 support is available or not. Suggested by Peter Maydell.
SH4 is always using softfloat, so it's possible to have helpers directly
taking float32 or float64 value. This allow to get rid of conversions
through CPU_{Float,Double}U.
Blue Swirl [Sat, 9 Apr 2011 14:25:25 +0000 (14:25 +0000)]
ppc: remove a write-only variable
Remove a write-only variable, spotted by GCC 4.6.0:
/src/qemu/hw/ppc.c: In function 'power7_set_irq':
/src/qemu/hw/ppc.c:255:9: error: variable 'cur_level' set but not used [-Werror=unused-but-set-variable]
Alexander Graf [Mon, 4 Apr 2011 14:32:11 +0000 (16:32 +0200)]
s390x: set alignment for long to 8
The alignment for longs on s390x is 8. That's the only place where it differs
from the default alignments found in configure already. The example alignment
program from Laurent printed the following on a real s390x:
All instructions that are "v5TE and later" are also bound to just v5, as
that's how it was before.
This patch doesn _not_ include disabling of cp15 access and base-updated
data abort model (that will be required to emulate chips based on a
ARM7TDMI), because:
* no ARM7TDMI chips are currently emulated (or planned)
* those features aren't strictly necessary for my purposes (SA-1 core
emulation).
All v5 models are handled as they are v5T. Internally we still have a
check if the model is a v5(T) or v5TE, but as all emulated cores are
v5TE, those two cases are simply aliased (for now).
Stefan Weil [Sat, 2 Apr 2011 11:36:31 +0000 (13:36 +0200)]
Fix conversions from pointer to tcg_target_long
tcg_gen_exit_tb takes a parameter of type tcg_target_long,
so the type casts of pointer to long should be replaced by
type casts of pointer to tcg_target_long (suggested by Blue Swirl).
These changes are needed for build environments where
sizeof(long) != sizeof(void *), especially for w64.
Michael Tokarev [Mon, 21 Mar 2011 08:34:35 +0000 (09:34 +0100)]
vnc: tight: Fix crash after 2GB of output
fix 2Gb integer overflow in in VNC tight and zlib encodings
As found by Roland Dreier <[email protected]> (excellent
catch!), when amount of VNC compressed data produced by zlib
and sent to client exceeds 2Gb, integer overflow occurs because
currently, we calculate amount of data produced at each step by
comparing saved total_out with new total_out, and total_out is
something which grows without bounds. Compare it with previous
avail_out instead of total_out, and leave total_out alone.
The same code is used in vnc-enc-tight.c and vnc-enc-zlib.c,
so fix both cases.
There, there's no actual need to save previous_out value, since
capacity-offset (which is how that value is calculated) stays
the same so it can be recalculated again after call to deflate(),
but whole thing becomes less readable this way.
On Mon, 4 Apr 2011 20:15:30 +0200, Aurelien Jarno <[email protected]> wrote:
> Is it really safe ignoring write to this register? If yes, it's probably
> a good idea to explain why in a comment. In any case, if supporting this
> register is easy to do, it would be the best option.
I think it is safe. Please see an updated comment below.
And though implementing this register might be possible, I suppose it
is not worth to supporting FrameTooLong detection, for now at least.
Since linux 2.6.38, smsc911x driver writes to VLAN1 registger.
Since this register only affects FrameTooLong detection, ignoring
write to this register should be safe.
Isaku Yamahata [Fri, 25 Mar 2011 10:54:38 +0000 (19:54 +0900)]
acpi, acpi_piix, vt82c686: factor out PM_TMR logic
factor out PM_TMR logic. Later This will be used by ich9 acpi.
Also fixes the same bug in vt82c686.c that was fixed by the following
commits.
> commit 055479feab63607b8042bb8ebb2e0523f17cbc4e
> Author: aliguori <aliguori@c046a42c-6fe2-441c-8c8c-71466251a162>
> Date: Wed Jan 21 16:31:20 2009 +0000
>
> Always return latest pmsts instead of the old one (Xiantao Zhang)
>
> It may lead to the issue when booting windows guests with acpi=1
> if return the old pmsts.
>
> Signed-off-by: Xiantao Zhang <[email protected]>
> Signed-off-by: Anthony Liguori <[email protected]>
Jordan Justen [Sun, 3 Apr 2011 20:16:26 +0000 (13:16 -0700)]
hw/pflash_cfi02: Fix lazy reset of ROMD mode
When checking pfl->rom_mode for when to lazily reenter ROMD mode,
the value was check was the opposite of what it should have been.
This prevent the part from returning to ROMD mode after a write
was made to the CFI rom region.
David Gibson [Fri, 8 Apr 2011 10:08:25 +0000 (20:08 +1000)]
ppce500_mpc8544ds: Fix compile with --enable-debug and --disable-kvm
When configured with --enable-debug, we compile without optimization.
This means that the function mpc8544_copy_soc_cell() in ppce500_mpc8544ds.c
is not optimized out, even though it is never called without kvm. That in
turn causes a link failure, because it calls the function
kvmppc_read_host_property() which is in kvm_ppc.o and therefore not
included in a --disable-kvm build.
This patch fixes the problem by providing a dummy stub for
kvmppc_read_host_property() in kvm_ppc.h when !CONFIG_KVM.
David Gibson [Tue, 5 Apr 2011 05:12:11 +0000 (15:12 +1000)]
Use existing helper function to implement popcntd instruction
The recent patches adding partial support for POWER7 cpu emulation included
implementing the popcntd instruction. The support for this was open coded,
but host-utils.h already included a function implementing an equivalent
population count function, which uses a gcc builtin (which can use special
host instructions) if available.
This patch makes the popcntd implementation use the existing, potentially
faster, implementation.
David Gibson [Tue, 5 Apr 2011 05:12:10 +0000 (15:12 +1000)]
Delay creation of pseries device tree until reset
At present, the 'pseries' machine creates a flattened device tree in the
machine->init function to pass to either the guest kernel or to firmware.
However, the machine->init function runs before processing of -device
command line options, which means that the device tree so created will
be (incorrectly) missing devices specified that way.
Supplying a correct device tree is, in any case, part of the required
platform entry conditions. Therefore, this patch moves the creation and
loading of the device tree from machine->init to a reset callback. The
setup of entry point address and initial register state moves with it,
which leads to a slight cleanup.
This is not, alas, quite enough to make a fully working reset for pseries.
For that we would need to reload the firmware images, which on this
machine are loaded into RAM. It's a step in the right direction, though.
David Gibson [Tue, 5 Apr 2011 05:12:09 +0000 (15:12 +1000)]
pseries: Abolish envs array
Currently the pseries machine init code builds up an array, envs, of
CPUState pointers for all the cpus in the system. This is kind of
pointless, given the generic code already has a perfectly good linked list
of the cpus.
In addition, there are a number of places which assume that the cpu's
cpu_index field is equal to its index in this array. This is true in
practice, because cpu_index values are just assigned sequentially, but
it's conceptually incorrect and may not always be true.
Therefore, this patch abolishes the envs array, and explicitly uses the
generic cpu linked list and cpu_index values throughout.
Like all block drivers virtio-blk should not allow small than block size
granularity access. But given that the protocol specifies a
byte unit length field we currently accept such requests, which cause
qemu to abort() in lower layers. Add checks to the main read and
write handlers to catch them early.
virtio-balloon: fixed endianness bug in the config space
The specification for the virtio balloon device requres that the values
in the config space be encoded little-endian. This differs from most
virtio things, where guest-native endian is the norm.
Currently, the qemu virtio-balloon code correctly makes the conversion
on get_config(), but doesn't on set_config for the 'actual' field. The
kernel driver, on the other hand, correctly converts when setting the
actual field, but does not convert when reading the config space. The
upshot is that virtio-balloon will only work correctly if both host and
guest are LE, making all the conversions nops.
This patch corrects the qemu side, correctly doing host-native <-> LE
conversions when accessing the config space. This won't break any setups
that aren't already broken, and fixes the case of BE host, LE guest.
Fixing the BE guest case will require kernel fixes as well.
virtio-9p: fixed LE-to-host conversion bug when QEMU is called from guest
The 9p code already contains an attempt at the necessary endian
conversions, but it's broken.
The code which does conversion from host to guest does it correctly
and this code was copied to the function which does guest to host
conversion. However the copied code hasn't been correctly updated, so
it first endian converts some garbage on the stack and then overwrites
it with a field from incoming packet without conversion.
Michael Tokarev [Wed, 6 Apr 2011 13:51:59 +0000 (17:51 +0400)]
qdev: Fix comment around qdev_init_nofail()
In previous life qdev_init_nofail() used to call hw_error() which
did register dump and other scary things. Now it calls
error_report() and does a regular exit(1). Fix the comment
to match reality.
Fix integer overflow in block migration bandwidth calculation
block_mig_state.reads is an int, and multiplying by BLOCK_SIZE yielded a
negative number, resulting in a negative bandwidth (running on a 32-bit
machine). Change order to avoid.
Jason Wang [Wed, 6 Apr 2011 10:34:31 +0000 (18:34 +0800)]
floppy: save and restore DIR register
We need to keep DIR register unchanged across migration, but currently it
depends on the media_changed flags from block layer. Since we do not
save/restore it and the bdrv_open() called in dest node may set the
media_changed flag when trying to open floppy image, guest driver may think the
floppy have changed after migration. To fix this, a new filed media_changed in
FDrive strcutre was introduced in order to save and restore the it from block
layer through pre_save/post_load callbacks.
Nick Thomas [Tue, 22 Feb 2011 15:44:53 +0000 (15:44 +0000)]
NBD: Use qemu_socket functions to open TCP and UNIX sockets
This commit has the side-effect of making the qemu-nbd binary
capable of binding to IPv6 addresses. ("-b ::1", for instance).
block/nbd.c fails to parse IPv6 IP addresses correctly at this
point, but will work over IPv6 when given a hostname. It still
works over IPv4 as before.
We move the qemu-sockets object from the 'common' to the 'block'
list in the Makefile. The common list includes the block list,
so this is effectively a no-op for the rest of the code.
We also add 32-bit 'magic' attributes to nbd_(request|reply) to
facilitate calculating maximum request/response sizes later.
Michael Tokarev [Wed, 30 Mar 2011 12:31:05 +0000 (16:31 +0400)]
exit if -drive specified is invalid instead of ignoring the "wrong" -drive
This fixes the problem when qemu continues even if -drive specification
is somehow invalid, resulting in a mess. Applicable for both current
master and for stable-0.14 (and the same issue exist 0.13 and 0.12 too).
The prob can actually be seriuos: when you start guest with two drives
and make an error in the specification of one of them, and the guest
has something like a raid array on the two drives, guest may start failing
that array or kick "missing" drives which may result in a mess - this is
what actually happened to me, I did't want a resync at all, and a resync
resulted in re-writing (and allocating) a 4TB virtual drive I used for
testing, which in turn resulted in my filesystem filling up and whole
thing failing badly. Yes it was just testing VM, I experimented with
larger raid arrays, but the end result was quite, well, unexpected.
Jes Sorensen [Wed, 30 Mar 2011 12:16:25 +0000 (14:16 +0200)]
qemu-img: Initial progress printing support
This adds the basic infrastructure for supporting progress output
on the command line, as well as progress support for qemu-img commands
'rebase' and 'convert'.
Stefan Hajnoczi [Tue, 29 Mar 2011 19:04:41 +0000 (20:04 +0100)]
block: Do not cache device size for removable media
The block layer caches the device size to avoid doing lseek(fd, 0,
SEEK_END) every time this value is needed. For removable media the
device size becomes stale if a new medium is inserted. This patch
simply prevents device size caching for removable media.
A smarter solution is to update the cached device size when a new medium
is inserted. Given that there are currently bugs with CD-ROM media
change I do not want to implement that approach until we've gotten
things correct first.
Ryan Harper [Wed, 30 Mar 2011 01:51:47 +0000 (20:51 -0500)]
Do not delete BlockDriverState when deleting the drive
When removing a drive from the host-side via drive_del we currently have
the following path:
drive_del
qemu_aio_flush()
bdrv_close() // zaps bs->drv, which makes any subsequent I/O get
// dropped. Works as designed
drive_uninit()
bdrv_delete() // frees the bs. Since the device is still connected to
// bs, any subsequent I/O is a use-after-free.
The value of bs->drv becomes unpredictable on free. As long as it
remains null, I/O still gets dropped, however it could become non-null
at any point after the free resulting SEGVs or other QEMU state
corruption.
To resolve this issue as simply as possible, we can chose to not
actually delete the BlockDriverState pointer. Since bdrv_close()
handles setting the drv pointer to NULL, we just need to remove the
BlockDriverState from the QLIST that is used to enumerate the block
devices. This is currently handled within bdrv_delete, so move this
into its own function, bdrv_make_anon().
The result is that we can now invoke drive_del, this closes the file
descriptors and sets BlockDriverState->drv to NULL which prevents futher
IO to the device, and since we do not free BlockDriverState, we don't
have to worry about the copy retained in the block devices.
We also don't attempt to remove the qdev property since we are no longer
deleting the BlockDriverState on drives with associated drives. This
also allows for removing Drives with no devices associated either.
Feiran Zheng [Tue, 29 Mar 2011 01:00:15 +0000 (09:00 +0800)]
hw/xen_disk: ioreq not finished on error
Bug fix: routines 'ioreq_runio_qemu_sync' and 'ioreq_runio_qemu_aio'
won't call 'ioreq_unmap' or 'ioreq_finish' on errors, leaving ioreq in
the blkdev->inflight list and a leak.
Mike Frysinger [Thu, 7 Apr 2011 05:12:28 +0000 (01:12 -0400)]
configure: add --version flag
Standard autoconf scripts include a --version flag so people can easily
query things. Add this to qemu's configure so it too can integrate with
build systems that have standard autotool helpers.
Peter Maydell [Mon, 4 Apr 2011 11:09:22 +0000 (12:09 +0100)]
cpu-all.h: Remove unnecessary target-specific ifdef for CPU_QuadU
CPU_QuadU isn't used on all targets, but there's no harm in defining the
typedef anyway. It only needs to be guarded by CONFIG_SOFTFLOAT, because
softfloat-native doesn't have a float128 type. This avoids the need for
every new target which uses CPU_QuadU to add itself to an #ifdef in
what ought to be target-agnostic code.
projects / qemu.git / log