[Qemu-devel] [PATCH V4 RESEND 13/22] tap: support enabling or disabling a queue

[Jason Wang]

This patch introduce a new bit - enabled in TAPState which tracks whether a
specific queue/fd is enabled. The tap/fd is enabled during initialization and
could be enabled/disabled by tap_enalbe() and tap_disable() which calls platform
specific helpers to do the real work. Polling of a tap fd can only done when
the tap was enabled.

Signed-off-by: Jason Wang 
Signed-off-by: Michael S. Tsirkin 
---
 include/net/tap.h |2 ++
 net/tap-win32.c   |   10 ++
 net/tap.c |   43 ---
 3 files changed, 52 insertions(+), 3 deletions(-)

diff --git a/include/net/tap.h b/include/net/tap.h
index 883cebf..a994f20 100644
--- a/include/net/tap.h
+++ b/include/net/tap.h
@@ -35,6 +35,8 @@ int tap_has_vnet_hdr_len(NetClientState *nc, int len);
 void tap_using_vnet_hdr(NetClientState *nc, bool using_vnet_hdr);
 void tap_set_offload(NetClientState *nc, int csum, int tso4, int tso6, int 
ecn, int ufo);
 void tap_set_vnet_hdr_len(NetClientState *nc, int len);
+int tap_enable(NetClientState *nc);
+int tap_disable(NetClientState *nc);
 
 int tap_get_fd(NetClientState *nc);
 
diff --git a/net/tap-win32.c b/net/tap-win32.c
index 601437e..d0b89f6 100644
--- a/net/tap-win32.c
+++ b/net/tap-win32.c
@@ -764,3 +764,13 @@ void tap_set_vnet_hdr_len(NetClientState *nc, int len)
 {
 abort();
 }
+
+int tap_enable(NetClientState *nc)
+{
+return 0;
+}
+
+int tap_disable(NetClientState *nc)
+{
+abort();
+}
diff --git a/net/tap.c b/net/tap.c
index 23fb6e0..8610ba2 100644
--- a/net/tap.c
+++ b/net/tap.c
@@ -59,6 +59,7 @@ typedef struct TAPState {
 bool write_poll;
 bool using_vnet_hdr;
 bool has_ufo;
+bool enabled;
 VHostNetState *vhost_net;
 unsigned host_vnet_hdr_len;
 } TAPState;
@@ -72,9 +73,9 @@ static void tap_writable(void *opaque);
 static void tap_update_fd_handler(TAPState *s)
 {
 qemu_set_fd_handler2(s->fd,
- s->read_poll  ? tap_can_send : NULL,
- s->read_poll  ? tap_send : NULL,
- s->write_poll ? tap_writable : NULL,
+ s->read_poll && s->enabled ? tap_can_send : NULL,
+ s->read_poll && s->enabled ? tap_send : NULL,
+ s->write_poll && s->enabled ? tap_writable : NULL,
  s);
 }
 
@@ -337,6 +338,7 @@ static TAPState *net_tap_fd_init(NetClientState *peer,
 s->host_vnet_hdr_len = vnet_hdr ? sizeof(struct virtio_net_hdr) : 0;
 s->using_vnet_hdr = false;
 s->has_ufo = tap_probe_has_ufo(s->fd);
+s->enabled = true;
 tap_set_offload(&s->nc, 0, 0, 0, 0, 0);
 /*
  * Make sure host header length is set correctly in tap:
@@ -735,3 +737,38 @@ VHostNetState *tap_get_vhost_net(NetClientState *nc)
 assert(nc->info->type == NET_CLIENT_OPTIONS_KIND_TAP);
 return s->vhost_net;
 }
+
+int tap_enable(NetClientState *nc)
+{
+TAPState *s = DO_UPCAST(TAPState, nc, nc);
+int ret;
+
+if (s->enabled) {
+return 0;
+} else {
+ret = tap_fd_enable(s->fd);
+if (ret == 0) {
+s->enabled = true;
+tap_update_fd_handler(s);
+}
+return ret;
+}
+}
+
+int tap_disable(NetClientState *nc)
+{
+TAPState *s = DO_UPCAST(TAPState, nc, nc);
+int ret;
+
+if (s->enabled == 0) {
+return 0;
+} else {
+ret = tap_fd_disable(s->fd);
+if (ret == 0) {
+qemu_purge_queued_packets(nc);
+s->enabled = false;
+tap_update_fd_handler(s);
+}
+return ret;
+}
+}
-- 
1.7.1

[Qemu-devel] [PATCH V4 RESEND 21/22] virtio-net: migration support for multiqueue

[Jason Wang]

This patch add migration support for multiqueue virtio-net. Instead of bumping
the version, we conditionally send the info of multiqueue only when the device
support more than one queue to maintain the backward compatibility.

Signed-off-by: Jason Wang 
Signed-off-by: Michael S. Tsirkin 
---
 hw/virtio-net.c |   35 +--
 1 files changed, 29 insertions(+), 6 deletions(-)

diff --git a/hw/virtio-net.c b/hw/virtio-net.c
index 2067fa7..5699f5e 100644
--- a/hw/virtio-net.c
+++ b/hw/virtio-net.c
@@ -1093,8 +1093,8 @@ static void virtio_net_set_multiqueue(VirtIONet *n, int 
multiqueue, int ctrl)
 
 static void virtio_net_save(QEMUFile *f, void *opaque)
 {
+int i;
 VirtIONet *n = opaque;
-VirtIONetQueue *q = &n->vqs[0];
 
 /* At this point, backend must be stopped, otherwise
  * it might keep writing to memory. */
@@ -1102,7 +1102,7 @@ static void virtio_net_save(QEMUFile *f, void *opaque)
 virtio_save(&n->vdev, f);
 
 qemu_put_buffer(f, n->mac, ETH_ALEN);
-qemu_put_be32(f, q->tx_waiting);
+qemu_put_be32(f, n->vqs[0].tx_waiting);
 qemu_put_be32(f, n->mergeable_rx_bufs);
 qemu_put_be16(f, n->status);
 qemu_put_byte(f, n->promisc);
@@ -1118,13 +1118,19 @@ static void virtio_net_save(QEMUFile *f, void *opaque)
 qemu_put_byte(f, n->nouni);
 qemu_put_byte(f, n->nobcast);
 qemu_put_byte(f, n->has_ufo);
+if (n->max_queues > 1) {
+qemu_put_be16(f, n->max_queues);
+qemu_put_be16(f, n->curr_queues);
+for (i = 1; i < n->curr_queues; i++) {
+qemu_put_be32(f, n->vqs[i].tx_waiting);
+}
+}
 }
 
 static int virtio_net_load(QEMUFile *f, void *opaque, int version_id)
 {
 VirtIONet *n = opaque;
-VirtIONetQueue *q = &n->vqs[0];
-int ret, i;
+int ret, i, link_down;
 
 if (version_id < 2 || version_id > VIRTIO_NET_VM_VERSION)
 return -EINVAL;
@@ -1135,7 +1141,7 @@ static int virtio_net_load(QEMUFile *f, void *opaque, int 
version_id)
 }
 
 qemu_get_buffer(f, n->mac, ETH_ALEN);
-q->tx_waiting = qemu_get_be32(f);
+n->vqs[0].tx_waiting = qemu_get_be32(f);
 
 virtio_net_set_mrg_rx_bufs(n, qemu_get_be32(f));
 
@@ -1205,6 +1211,20 @@ static int virtio_net_load(QEMUFile *f, void *opaque, 
int version_id)
 }
 }
 
+if (n->max_queues > 1) {
+if (n->max_queues != qemu_get_be16(f)) {
+error_report("virtio-net: different max_queues ");
+return -1;
+}
+
+n->curr_queues = qemu_get_be16(f);
+for (i = 1; i < n->curr_queues; i++) {
+n->vqs[i].tx_waiting = qemu_get_be32(f);
+}
+}
+
+virtio_net_set_queues(n);
+
 /* Find the first multicast entry in the saved MAC filter */
 for (i = 0; i < n->mac_table.in_use; i++) {
 if (n->mac_table.macs[i * ETH_ALEN] & 1) {
@@ -1215,7 +1235,10 @@ static int virtio_net_load(QEMUFile *f, void *opaque, 
int version_id)
 
 /* nc.link_down can't be migrated, so infer link_down according
  * to link status bit in n->status */
-qemu_get_queue(n->nic)->link_down = (n->status & VIRTIO_NET_S_LINK_UP) == 
0;
+link_down = (n->status & VIRTIO_NET_S_LINK_UP) == 0;
+for (i = 0; i < n->max_queues; i++) {
+qemu_get_subqueue(n->nic, i)->link_down = link_down;
+}
 
 return 0;
 }
-- 
1.7.1

[Qemu-devel] [PATCH V4 RESEND 12/22] tap: add Linux multiqueue support

[Jason Wang]

This patch add basic multiqueue support for Linux. When multiqueue is needed, we
will first check whether kernel support multiqueue tap before creating more
queues. Two new functions tap_fd_enable() and tap_fd_disable() were introduced
to enable and disable a specific queue. Since the multiqueue is only supported
in Linux, return error on other platforms.

Signed-off-by: Jason Wang 
Signed-off-by: Michael S. Tsirkin 
---
 net/tap-aix.c |   10 ++
 net/tap-bsd.c |   10 ++
 net/tap-haiku.c   |   10 ++
 net/tap-linux.c   |   51 +++
 net/tap-solaris.c |   10 ++
 net/tap_int.h |2 ++
 6 files changed, 93 insertions(+), 0 deletions(-)

diff --git a/net/tap-aix.c b/net/tap-aix.c
index aff6c52..66e0574 100644
--- a/net/tap-aix.c
+++ b/net/tap-aix.c
@@ -59,3 +59,13 @@ void tap_fd_set_offload(int fd, int csum, int tso4,
 int tso6, int ecn, int ufo)
 {
 }
+
+int tap_fd_enable(int fd)
+{
+return -1;
+}
+
+int tap_fd_disable(int fd)
+{
+return -1;
+}
diff --git a/net/tap-bsd.c b/net/tap-bsd.c
index 01c705b..5ed2d16 100644
--- a/net/tap-bsd.c
+++ b/net/tap-bsd.c
@@ -145,3 +145,13 @@ void tap_fd_set_offload(int fd, int csum, int tso4,
 int tso6, int ecn, int ufo)
 {
 }
+
+int tap_fd_enable(int fd)
+{
+return -1;
+}
+
+int tap_fd_disable(int fd)
+{
+return -1;
+}
diff --git a/net/tap-haiku.c b/net/tap-haiku.c
index 08cc034..0f1b1fe 100644
--- a/net/tap-haiku.c
+++ b/net/tap-haiku.c
@@ -59,3 +59,13 @@ void tap_fd_set_offload(int fd, int csum, int tso4,
 int tso6, int ecn, int ufo)
 {
 }
+
+int tap_fd_enable(int fd)
+{
+return -1;
+}
+
+int tap_fd_disable(int fd)
+{
+return -1;
+}
diff --git a/net/tap-linux.c b/net/tap-linux.c
index 0a6acc7..42376cc 100644
--- a/net/tap-linux.c
+++ b/net/tap-linux.c
@@ -41,6 +41,7 @@ int tap_open(char *ifname, int ifname_size, int *vnet_hdr, 
int vnet_hdr_required
 struct ifreq ifr;
 int fd, ret;
 int len = sizeof(struct virtio_net_hdr);
+int mq_required = 0;
 
 TFR(fd = open(PATH_NET_TUN, O_RDWR));
 if (fd < 0) {
@@ -76,6 +77,20 @@ int tap_open(char *ifname, int ifname_size, int *vnet_hdr, 
int vnet_hdr_required
 ioctl(fd, TUNSETVNETHDRSZ, &len);
 }
 
+if (mq_required) {
+unsigned int features;
+
+if ((ioctl(fd, TUNGETFEATURES, &features) != 0) ||
+!(features & IFF_MULTI_QUEUE)) {
+error_report("multiqueue required, but no kernel "
+ "support for IFF_MULTI_QUEUE available");
+close(fd);
+return -1;
+} else {
+ifr.ifr_flags |= IFF_MULTI_QUEUE;
+}
+}
+
 if (ifname[0] != '\0')
 pstrcpy(ifr.ifr_name, IFNAMSIZ, ifname);
 else
@@ -209,3 +224,39 @@ void tap_fd_set_offload(int fd, int csum, int tso4,
 }
 }
 }
+
+/* Enable a specific queue of tap. */
+int tap_fd_enable(int fd)
+{
+struct ifreq ifr;
+int ret;
+
+memset(&ifr, 0, sizeof(ifr));
+
+ifr.ifr_flags = IFF_ATTACH_QUEUE;
+ret = ioctl(fd, TUNSETQUEUE, (void *) &ifr);
+
+if (ret != 0) {
+error_report("could not enable queue");
+}
+
+return ret;
+}
+
+/* Disable a specific queue of tap/ */
+int tap_fd_disable(int fd)
+{
+struct ifreq ifr;
+int ret;
+
+memset(&ifr, 0, sizeof(ifr));
+
+ifr.ifr_flags = IFF_DETACH_QUEUE;
+ret = ioctl(fd, TUNSETQUEUE, (void *) &ifr);
+
+if (ret != 0) {
+error_report("could not disable queue");
+}
+
+return ret;
+}
diff --git a/net/tap-solaris.c b/net/tap-solaris.c
index 486a7ea..cc08e9e 100644
--- a/net/tap-solaris.c
+++ b/net/tap-solaris.c
@@ -225,3 +225,13 @@ void tap_fd_set_offload(int fd, int csum, int tso4,
 int tso6, int ecn, int ufo)
 {
 }
+
+int tap_fd_enable(int fd)
+{
+return -1;
+}
+
+int tap_fd_disable(int fd)
+{
+return -1;
+}
diff --git a/net/tap_int.h b/net/tap_int.h
index 1dffe12..ca1c21b 100644
--- a/net/tap_int.h
+++ b/net/tap_int.h
@@ -42,5 +42,7 @@ int tap_probe_vnet_hdr_len(int fd, int len);
 int tap_probe_has_ufo(int fd);
 void tap_fd_set_offload(int fd, int csum, int tso4, int tso6, int ecn, int 
ufo);
 void tap_fd_set_vnet_hdr_len(int fd, int len);
+int tap_fd_enable(int fd);
+int tap_fd_disable(int fd);
 
 #endif /* QEMU_TAP_H */
-- 
1.7.1

[Qemu-devel] [PATCH V4 RESEND 22/22] virtio-net: compat multiqueue support

[Jason Wang]

Disable multiqueue support for pre 1.4.

Signed-off-by: Jason Wang 
Signed-off-by: Michael S. Tsirkin 
---
 hw/pc_piix.c |4 
 1 files changed, 4 insertions(+), 0 deletions(-)

diff --git a/hw/pc_piix.c b/hw/pc_piix.c
index ba09714..0af436c 100644
--- a/hw/pc_piix.c
+++ b/hw/pc_piix.c
@@ -313,6 +313,10 @@ static QEMUMachine pc_i440fx_machine_v1_4 = {
 .driver   = "virtio-net-pci",\
 .property = "ctrl_mac_addr",\
 .value= "off",  \
+},{ \
+.driver   = "virtio-net-pci", \
+.property = "mq", \
+.value= "off", \
 }
 
 static QEMUMachine pc_machine_v1_3 = {
-- 
1.7.1

[Qemu-devel] [PATCH V4 RESEND 09/22] net: multiqueue support

[Jason Wang]

This patch adds basic multiqueue support for qemu. The idea is simple, an array
of NetClientStates were introduced in NICState, parse_netdev() were extended to
find and match all NetClientStates belongs to the backend and place their
pointers in NICConf. Then qemu_new_nic can setup a N:N mapping between NICStates
that belongs to a nic and NICStates belongs to the netdev. And a queue_index
were introduced in NetClientState to track its index. After this, each peers of
a NICState were abstracted as a queue.

After this change, all NetClientState that belongs to the same backend/nic has
the same id. When use want to change the link status, all NetClientStates that
belongs to the same backend/nic will be also changed. When user want to delete
a device or netdev, all NetClientStates that belongs to the same backend/nic
will be deleted also. Changing or deleting an specific queue is not allowed.

Signed-off-by: Jason Wang 
Signed-off-by: Michael S. Tsirkin 
---
 hw/dp8393x.c|2 +-
 hw/mcf_fec.c|2 +-
 hw/qdev-properties-system.c |   46 +++---
 hw/qdev-properties.h|6 +-
 include/net/net.h   |   18 +--
 net/net.c   |  113 +++
 6 files changed, 139 insertions(+), 48 deletions(-)

diff --git a/hw/dp8393x.c b/hw/dp8393x.c
index 0273fad..808157b 100644
--- a/hw/dp8393x.c
+++ b/hw/dp8393x.c
@@ -900,7 +900,7 @@ void dp83932_init(NICInfo *nd, hwaddr base, int it_shift,
 s->regs[SONIC_SR] = 0x0004; /* only revision recognized by Linux */
 
 s->conf.macaddr = nd->macaddr;
-s->conf.peer = nd->netdev;
+s->conf.peers.ncs[0] = nd->netdev;
 
 s->nic = qemu_new_nic(&net_dp83932_info, &s->conf, nd->model, nd->name, s);
 
diff --git a/hw/mcf_fec.c b/hw/mcf_fec.c
index 909e32b..8e60f09 100644
--- a/hw/mcf_fec.c
+++ b/hw/mcf_fec.c
@@ -472,7 +472,7 @@ void mcf_fec_init(MemoryRegion *sysmem, NICInfo *nd,
 memory_region_add_subregion(sysmem, base, &s->iomem);
 
 s->conf.macaddr = nd->macaddr;
-s->conf.peer = nd->netdev;
+s->conf.peers.ncs[0] = nd->netdev;
 
 s->nic = qemu_new_nic(&net_mcf_fec_info, &s->conf, nd->model, nd->name, s);
 
diff --git a/hw/qdev-properties-system.c b/hw/qdev-properties-system.c
index ce0f793..ce3af22 100644
--- a/hw/qdev-properties-system.c
+++ b/hw/qdev-properties-system.c
@@ -173,16 +173,47 @@ PropertyInfo qdev_prop_chr = {
 
 static int parse_netdev(DeviceState *dev, const char *str, void **ptr)
 {
-NetClientState *netdev = qemu_find_netdev(str);
+NICPeers *peers_ptr = (NICPeers *)ptr;
+NICConf *conf = container_of(peers_ptr, NICConf, peers);
+NetClientState **ncs = peers_ptr->ncs;
+NetClientState *peers[MAX_QUEUE_NUM];
+int queues, i = 0;
+int ret;
 
-if (netdev == NULL) {
-return -ENOENT;
+queues = qemu_find_net_clients_except(str, peers,
+  NET_CLIENT_OPTIONS_KIND_NIC,
+  MAX_QUEUE_NUM);
+if (queues == 0) {
+ret = -ENOENT;
+goto err;
 }
-if (netdev->peer) {
-return -EEXIST;
+
+if (queues > MAX_QUEUE_NUM) {
+ret = -E2BIG;
+goto err;
+}
+
+for (i = 0; i < queues; i++) {
+if (peers[i] == NULL) {
+ret = -ENOENT;
+goto err;
+}
+
+if (peers[i]->peer) {
+ret = -EEXIST;
+goto err;
+}
+
+ncs[i] = peers[i];
+ncs[i]->queue_index = i;
 }
-*ptr = netdev;
+
+conf->queues = queues;
+
 return 0;
+
+err:
+return ret;
 }
 
 static const char *print_netdev(void *ptr)
@@ -249,7 +280,8 @@ static void set_vlan(Object *obj, Visitor *v, void *opaque,
 {
 DeviceState *dev = DEVICE(obj);
 Property *prop = opaque;
-NetClientState **ptr = qdev_get_prop_ptr(dev, prop);
+NICPeers *peers_ptr = qdev_get_prop_ptr(dev, prop);
+NetClientState **ptr = &peers_ptr->ncs[0];
 Error *local_err = NULL;
 int32_t id;
 NetClientState *hubport;
diff --git a/hw/qdev-properties.h b/hw/qdev-properties.h
index ddcf774..20c67f3 100644
--- a/hw/qdev-properties.h
+++ b/hw/qdev-properties.h
@@ -31,7 +31,7 @@ extern PropertyInfo qdev_prop_pci_host_devaddr;
 .name  = (_name),\
 .info  = &(_prop),   \
 .offset= offsetof(_state, _field)\
-+ type_check(_type,typeof_field(_state, _field)),\
++ type_check(_type, typeof_field(_state, _field)),   \
 }
 #define DEFINE_PROP_DEFAULT(_name, _state, _field, _defval, _prop, _type) { \
 .name  = (_name),   \
@@ -77,9 +77,9 @@ extern PropertyInfo qdev_prop_pci_host_devaddr;
 #define DEFINE_PROP_STRING(_n, _s, _f) \
 DEFINE_PROP(_n, _s, _f, qdev_prop_string, char*)
 #define DEFINE_PROP_NETDEV(_n, _s, _f)

[Qemu-devel] [PATCH V4 RESEND 06/22] net: introduce qemu_find_net_clients_except()

[Jason Wang]

In multiqueue, all NetClientState that belongs to the same netdev or nic has the
same id. So this patches introduces an helper qemu_find_net_clients_except()
which finds all NetClientState with the same id. This will be used by multiqueue
networking.

Signed-off-by: Jason Wang 
Signed-off-by: Michael S. Tsirkin 
---
 include/net/net.h |2 ++
 net/net.c |   21 +
 2 files changed, 23 insertions(+), 0 deletions(-)

diff --git a/include/net/net.h b/include/net/net.h
index f0d1aa2..995df5c 100644
--- a/include/net/net.h
+++ b/include/net/net.h
@@ -68,6 +68,8 @@ typedef struct NICState {
 } NICState;
 
 NetClientState *qemu_find_netdev(const char *id);
+int qemu_find_net_clients_except(const char *id, NetClientState **ncs,
+ NetClientOptionsKind type, int max);
 NetClientState *qemu_new_net_client(NetClientInfo *info,
 NetClientState *peer,
 const char *model,
diff --git a/net/net.c b/net/net.c
index 47d56e3..16dd327 100644
--- a/net/net.c
+++ b/net/net.c
@@ -508,6 +508,27 @@ NetClientState *qemu_find_netdev(const char *id)
 return NULL;
 }
 
+int qemu_find_net_clients_except(const char *id, NetClientState **ncs,
+ NetClientOptionsKind type, int max)
+{
+NetClientState *nc;
+int ret = 0;
+
+QTAILQ_FOREACH(nc, &net_clients, next) {
+if (nc->info->type == type) {
+continue;
+}
+if (!strcmp(nc->name, id)) {
+if (ret < max) {
+ncs[ret] = nc;
+}
+ret++;
+}
+}
+
+return ret;
+}
+
 static int nic_get_free_idx(void)
 {
 int index;
-- 
1.7.1

[Qemu-devel] [PULL 0/5] migration queue

[Juan Quintela]

Hi

This includes xbzrle fixes.  They are just:
- refactor xbzrle into its own file
- tests for xbzrle 
- fix documentanion
- bugfix
- fix error message

please pull

The following changes since commit 8a55ebf01507ab73cc458cfcd5b9cb856aba0b9e:

  Merge remote-tracking branch 'afaerber/qom-cpu' into staging (2013-01-31 
19:37:33 -0600)

are available in the git repository at:


  git://repo.or.cz/qemu/quintela.git migration.next

for you to fetch changes up to a31ca017aaf9074c1bb636b3ddaceb40f994375f:

  Fix error message in migrate_set_capability HMP command (2013-02-01 08:32:21 
+0100)


Orit Wasserman (5):
  Move XBZRLE encoding code to a separate file to allow testing
  Add XBZRLE testing
  Fix example for query-migrate-capabilities
  Allow XBZRLE decoding without enabling the capability
  Fix error message in migrate_set_capability HMP command

 Makefile.objs   |   2 +-
 arch_init.c |   3 -
 hmp.c   |   2 +-
 qmp-commands.hx |   6 +-
 savevm.c| 159 --
 tests/Makefile  |   3 +
 tests/test-xbzrle.c | 196 
 xbzrle.c| 173 ++
 8 files changed, 376 insertions(+), 168 deletions(-)
 create mode 100644 tests/test-xbzrle.c
 create mode 100644 xbzrle.c

[Qemu-devel] [PATCH V4 RESEND 05/22] net: intorduce qemu_del_nic()

[Jason Wang]

To support multiqueue nic, this patch separate the nic destructor from
qemu_del_net_client() to a new helper qemu_del_nic() since the mapping bettween
NiCState and NetClientState were not 1:1 in multiqueue. The following patches
would refactor this function to support multiqueue nic.

Signed-off-by: Jason Wang 
Signed-off-by: Michael S. Tsirkin 
---
 hw/e1000.c   |2 +-
 hw/eepro100.c|2 +-
 hw/ne2000.c  |2 +-
 hw/pcnet-pci.c   |2 +-
 hw/rtl8139.c |2 +-
 hw/usb/dev-network.c |2 +-
 hw/virtio-net.c  |2 +-
 hw/xen_nic.c |2 +-
 include/net/net.h|1 +
 net/net.c|   15 ++-
 10 files changed, 23 insertions(+), 9 deletions(-)

diff --git a/hw/e1000.c b/hw/e1000.c
index df6c693..7dd0455 100644
--- a/hw/e1000.c
+++ b/hw/e1000.c
@@ -1254,7 +1254,7 @@ pci_e1000_uninit(PCIDevice *dev)
 qemu_free_timer(d->autoneg_timer);
 memory_region_destroy(&d->mmio);
 memory_region_destroy(&d->io);
-qemu_del_net_client(qemu_get_queue(d->nic));
+qemu_del_nic(d->nic);
 }
 
 static NetClientInfo net_e1000_info = {
diff --git a/hw/eepro100.c b/hw/eepro100.c
index f9856ae..5d23796 100644
--- a/hw/eepro100.c
+++ b/hw/eepro100.c
@@ -1849,7 +1849,7 @@ static void pci_nic_uninit(PCIDevice *pci_dev)
 memory_region_destroy(&s->flash_bar);
 vmstate_unregister(&pci_dev->qdev, s->vmstate, s);
 eeprom93xx_free(&pci_dev->qdev, s->eeprom);
-qemu_del_net_client(qemu_get_queue(s->nic));
+qemu_del_nic(s->nic);
 }
 
 static NetClientInfo net_eepro100_info = {
diff --git a/hw/ne2000.c b/hw/ne2000.c
index c989190..3dd1c84 100644
--- a/hw/ne2000.c
+++ b/hw/ne2000.c
@@ -751,7 +751,7 @@ static void pci_ne2000_exit(PCIDevice *pci_dev)
 NE2000State *s = &d->ne2000;
 
 memory_region_destroy(&s->io);
-qemu_del_net_client(qemu_get_queue(s->nic));
+qemu_del_nic(s->nic);
 }
 
 static Property ne2000_properties[] = {
diff --git a/hw/pcnet-pci.c b/hw/pcnet-pci.c
index 26c90bf..df63b22 100644
--- a/hw/pcnet-pci.c
+++ b/hw/pcnet-pci.c
@@ -279,7 +279,7 @@ static void pci_pcnet_uninit(PCIDevice *dev)
 memory_region_destroy(&d->io_bar);
 qemu_del_timer(d->state.poll_timer);
 qemu_free_timer(d->state.poll_timer);
-qemu_del_net_client(qemu_get_queue(d->state.nic));
+qemu_del_nic(d->state.nic);
 }
 
 static NetClientInfo net_pci_pcnet_info = {
diff --git a/hw/rtl8139.c b/hw/rtl8139.c
index b825e83..d7716be 100644
--- a/hw/rtl8139.c
+++ b/hw/rtl8139.c
@@ -3446,7 +3446,7 @@ static void pci_rtl8139_uninit(PCIDevice *dev)
 }
 qemu_del_timer(s->timer);
 qemu_free_timer(s->timer);
-qemu_del_net_client(qemu_get_queue(s->nic));
+qemu_del_nic(s->nic);
 }
 
 static void rtl8139_set_link_status(NetClientState *nc)
diff --git a/hw/usb/dev-network.c b/hw/usb/dev-network.c
index abc6eac..a01a5e7 100644
--- a/hw/usb/dev-network.c
+++ b/hw/usb/dev-network.c
@@ -1330,7 +1330,7 @@ static void usb_net_handle_destroy(USBDevice *dev)
 
 /* TODO: remove the nd_table[] entry */
 rndis_clear_responsequeue(s);
-qemu_del_net_client(qemu_get_queue(s->nic));
+qemu_del_nic(s->nic);
 }
 
 static NetClientInfo net_usbnet_info = {
diff --git a/hw/virtio-net.c b/hw/virtio-net.c
index e69313b..a967006 100644
--- a/hw/virtio-net.c
+++ b/hw/virtio-net.c
@@ -1157,6 +1157,6 @@ void virtio_net_exit(VirtIODevice *vdev)
 qemu_bh_delete(n->tx_bh);
 }
 
-qemu_del_net_client(qemu_get_queue(n->nic));
+qemu_del_nic(n->nic);
 virtio_cleanup(&n->vdev);
 }
diff --git a/hw/xen_nic.c b/hw/xen_nic.c
index 55b7960..4be077d 100644
--- a/hw/xen_nic.c
+++ b/hw/xen_nic.c
@@ -408,7 +408,7 @@ static void net_disconnect(struct XenDevice *xendev)
 netdev->rxs = NULL;
 }
 if (netdev->nic) {
-qemu_del_net_client(qemu_get_queue(netdev->nic));
+qemu_del_nic(netdev->nic);
 netdev->nic = NULL;
 }
 }
diff --git a/include/net/net.h b/include/net/net.h
index 96e05c4..f0d1aa2 100644
--- a/include/net/net.h
+++ b/include/net/net.h
@@ -77,6 +77,7 @@ NICState *qemu_new_nic(NetClientInfo *info,
const char *model,
const char *name,
void *opaque);
+void qemu_del_nic(NICState *nic);
 NetClientState *qemu_get_queue(NICState *nic);
 NICState *qemu_get_nic(NetClientState *nc);
 void *qemu_get_nic_opaque(NetClientState *nc);
diff --git a/net/net.c b/net/net.c
index 606e860..47d56e3 100644
--- a/net/net.c
+++ b/net/net.c
@@ -291,6 +291,15 @@ void qemu_del_net_client(NetClientState *nc)
 return;
 }
 
+assert(nc->info->type != NET_CLIENT_OPTIONS_KIND_NIC);
+
+qemu_cleanup_net_client(nc);
+qemu_free_net_client(nc);
+}
+
+void qemu_del_nic(NICState *nic)
+{
+NetClientState *nc = qemu_get_queue(nic);
 /* If this is a peer NIC and peer has already been deleted, free it now. */
 if (nc->peer && nc->info->type == NET_CLIENT_OPTIONS_KIND_NIC) {
 NICState *nic = qemu_

Re: [Qemu-devel] Char flow control patches

[Amit Shah]

On (Wed) 30 Jan 2013 [08:38:50], Anthony Liguori wrote:
> Amit Shah  writes:
> 
> > Hi Anthony,
> >
> > I did some basic testing of the char flow control patches from your
> > char-flow.2 branch.  With the following patch applied, things seem to
> > be working fine.  I tested the isa-serial and virtio-serial devices.
> >
> > I haven't yet tested with virtio-serial flow control, but at least no
> > regressions as of now.
> 
> Awesome!
> 
> It's obviously too late for 1.4 but I'd like to submit a proper series
> during the hard freeze so we can take it early in 1.5.

Agreed, late for 1.4.

> Can you add a Signed-off-by and I'll include it in my queue.

Sure, but it's a small thing, and I'd prefer if you folded it in the
patch that introduces that hunk.

BTW I'm only sure of the first diff here, do the rest look OK?  I'm
not too familiar with the gio interface...

> > diff --git a/qemu-char.c b/qemu-char.c
> > index 2b714cf..5731d02 100644
> > --- a/qemu-char.c
> > +++ b/qemu-char.c
> > @@ -569,7 +569,7 @@ static gboolean io_watch_poll_prepare(GSource *source, 
> > gint *timeout_)
> >  
> >  iwp->max_size = iwp->fd_can_read(iwp->opaque);
> >  if (iwp->max_size == 0) {
> > -return TRUE;
> > +return FALSE;
> >  }
> >  
> >  return g_io_watch_funcs.prepare(source, timeout_);
> >
> >
> > In addition to this, we should also have the following, but the above
> > masks these:
> >
> > @@ -1067,7 +1067,7 @@ static gboolean pty_chr_read(GIOChannel *chan, 
> > GIOCondition cond, void *opaque)
> >  if (len > s->read_bytes)
> >  len = s->read_bytes;
> >  if (len == 0)
> > -return TRUE;
> > +return FALSE;
> >  status = g_io_channel_read_chars(s->fd, (gchar *)buf, len, &size, 
> > NULL);
> >  if (status != G_IO_STATUS_NORMAL) {
> >  pty_chr_state(chr, 0);
> > @@ -2237,7 +2237,7 @@ static gboolean udp_chr_read(GIOChannel *chan, 
> > GIOCondition cond, void *opaque)
> >  GIOStatus status;
> >  
> >  if (s->max_size == 0)
> > -return TRUE;
> > +return FALSE;
> >  status = g_io_channel_read_chars(s->chan, (gchar *)s->buf, 
> > sizeof(s->buf),
> >   &bytes_read, NULL);
> >  s->bufcnt = bytes_read;
> > @@ -2492,7 +2492,7 @@ static gboolean tcp_chr_read(GIOChannel *chan, 
> > GIOCondition cond, void *opaque)
> >  int len, size;
> >  
> >  if (!s->connected || s->max_size <= 0) {
> > -return TRUE;
> > +return FALSE;
> >  }
> >  len = sizeof(buf);
> >  if (len > s->max_size)

Amit

Re: [Qemu-devel] [PATCH V4 RESEND 00/22] Multiqueue virtio-net

[Jason Wang]

On 02/01/2013 03:39 PM, Jason Wang wrote:
> Hello all:
>
> This seires is an update of last version of multiqueue virtio-net support.

Hi Anthony:

This series is not applied cleanly on master, could you please pick
those for 1.4?

Thanks

Re: [Qemu-devel] [PULL 0/3] ppc patch queue 2013-02-01

[Andreas Färber]

Am 01.02.2013 01:53, schrieb Alexander Graf:
> Hi Blue / Aurelien,
> 
> This is my final pre-hard-freeze patch queue for ppc.  Please pull.

Hi Alex, was there something wrong with my format fix v2? Oversight?

Andreas

> 
> Alex
> 
> 
> The following changes since commit 6b2578d678497dbce44ed7999d269fc973ae6e8f:
>   Andreas FÀrber (1):
> ide/mmio: QOM'ify MMIO IDE for R2D
> 
> are available in the git repository at:
> 
>   git://repo.or.cz/qemu/agraf.git ppc-for-upstream
> 
> Alexander Graf (1):
>   PPC: Unify dcbzl code path
> 
> Andreas FÀrber (2):
>   target-ppc: Fix unused variable warning for FLUSH_ALL_TLBS
>   target-ppc: Fix build for PPC_DEBUG_DISAS
> 
>  target-ppc/cpu.h|6 ++
>  target-ppc/helper.h |3 +--
>  target-ppc/mem_helper.c |   21 -
>  target-ppc/mmu_helper.c |3 ++-
>  target-ppc/translate.c  |   35 +--
>  target-ppc/translate_init.c |   10 +-
>  6 files changed, 35 insertions(+), 43 deletions(-)
> 


-- 
SUSE LINUX Products GmbH, Maxfeldstr. 5, 90409 Nürnberg, Germany
GF: Jeff Hawn, Jennifer Guild, Felix Imendörffer; HRB 16746 AG Nürnberg

Re: [Qemu-devel] [PATCH for-1.4?] ppc405_uc: Pass PowerPCCPU to ppc40x_{core, chip, system}_reset()

[Andreas Färber]

Hi Alex,

Am 31.01.2013 00:29, schrieb Andreas Färber:
> Prepares for changing cpu_interrupt() argument to CPUState.
> 
> Signed-off-by: Andreas Färber 
> ---
>  Extracted from my qom-cpu-8 queue - could accompany my debug output fixes. :)
> 
>  hw/ppc.c   |   12 ++--
>  hw/ppc.h   |6 +++---
>  hw/ppc405_uc.c |   16 ++--
>  3 Dateien geändert, 19 Zeilen hinzugefügt(+), 15 Zeilen entfernt(-)

This patch didn't make it into your ppc pull. Seems you were not CC'ed.
Can you instead ack it so that I can put it into my qom-cpu-next queue
please?

Thanks,
Andreas

-- 
SUSE LINUX Products GmbH, Maxfeldstr. 5, 90409 Nürnberg, Germany
GF: Jeff Hawn, Jennifer Guild, Felix Imendörffer; HRB 16746 AG Nürnberg

Re: [Qemu-devel] [PATCH for-1.4?] ppc405_uc: Pass PowerPCCPU to ppc40x_{core, chip, system}_reset()

[Alexander Graf]

On 01.02.2013, at 09:41, Andreas Färber wrote:

> Hi Alex,
> 
> Am 31.01.2013 00:29, schrieb Andreas Färber:
>> Prepares for changing cpu_interrupt() argument to CPUState.
>> 
>> Signed-off-by: Andreas Färber 
>> ---
>> Extracted from my qom-cpu-8 queue - could accompany my debug output fixes. :)
>> 
>> hw/ppc.c   |   12 ++--
>> hw/ppc.h   |6 +++---
>> hw/ppc405_uc.c |   16 ++--
>> 3 Dateien geändert, 19 Zeilen hinzugefügt(+), 15 Zeilen entfernt(-)
> 
> This patch didn't make it into your ppc pull. Seems you were not CC'ed.
> Can you instead ack it so that I can put it into my qom-cpu-next queue
> please?

Acked-by: Alexander Graf 


Alex

Re: [Qemu-devel] [PULL 0/3] ppc patch queue 2013-02-01

[Alexander Graf]

On 01.02.2013, at 09:15, Andreas Färber wrote:

> Am 01.02.2013 01:53, schrieb Alexander Graf:
>> Hi Blue / Aurelien,
>> 
>> This is my final pre-hard-freeze patch queue for ppc.  Please pull.
> 
> Hi Alex, was there something wrong with my format fix v2? Oversight?

Let's fix it after rc0.


Alex

[Qemu-devel] [PATCH V4 RESEND 02/22] net: tap: use abort() instead of assert(0)

[Jason Wang]

Signed-off-by: Jason Wang 
Signed-off-by: Michael S. Tsirkin 
---
 net/tap-linux.c |4 ++--
 net/tap-win32.c |2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/net/tap-linux.c b/net/tap-linux.c
index 059f5f3..0a6acc7 100644
--- a/net/tap-linux.c
+++ b/net/tap-linux.c
@@ -164,7 +164,7 @@ int tap_probe_vnet_hdr_len(int fd, int len)
 if (ioctl(fd, TUNSETVNETHDRSZ, &orig) == -1) {
 fprintf(stderr, "TUNGETVNETHDRSZ ioctl() failed: %s. Exiting.\n",
 strerror(errno));
-assert(0);
+abort();
 return -errno;
 }
 return 1;
@@ -175,7 +175,7 @@ void tap_fd_set_vnet_hdr_len(int fd, int len)
 if (ioctl(fd, TUNSETVNETHDRSZ, &len) == -1) {
 fprintf(stderr, "TUNSETVNETHDRSZ ioctl() failed: %s. Exiting.\n",
 strerror(errno));
-assert(0);
+abort();
 }
 }
 
diff --git a/net/tap-win32.c b/net/tap-win32.c
index 3052bba..601437e 100644
--- a/net/tap-win32.c
+++ b/net/tap-win32.c
@@ -762,5 +762,5 @@ int tap_has_vnet_hdr_len(NetClientState *nc, int len)
 
 void tap_set_vnet_hdr_len(NetClientState *nc, int len)
 {
-assert(0);
+abort();
 }
-- 
1.7.1

[Qemu-devel] [PATCH V4 RESEND 01/22] net: tap: using bool instead of bitfield

[Jason Wang]

Signed-off-by: Jason Wang 
Signed-off-by: Michael S. Tsirkin 
---
 hw/virtio-net.c   |2 +-
 include/net/tap.h |4 ++--
 net/tap-win32.c   |6 +++---
 net/tap.c |   38 ++
 4 files changed, 24 insertions(+), 26 deletions(-)

diff --git a/hw/virtio-net.c b/hw/virtio-net.c
index dfb9687..b5579b4 100644
--- a/hw/virtio-net.c
+++ b/hw/virtio-net.c
@@ -1102,7 +1102,7 @@ VirtIODevice *virtio_net_init(DeviceState *dev, NICConf 
*conf,
 n->nic = qemu_new_nic(&net_virtio_info, conf, 
object_get_typename(OBJECT(dev)), dev->id, n);
 peer_test_vnet_hdr(n);
 if (peer_has_vnet_hdr(n)) {
-tap_using_vnet_hdr(n->nic->nc.peer, 1);
+tap_using_vnet_hdr(n->nic->nc.peer, true);
 n->host_hdr_len = sizeof(struct virtio_net_hdr);
 } else {
 n->host_hdr_len = 0;
diff --git a/include/net/tap.h b/include/net/tap.h
index bb7efb5..883cebf 100644
--- a/include/net/tap.h
+++ b/include/net/tap.h
@@ -29,10 +29,10 @@
 #include "qemu-common.h"
 #include "qapi-types.h"
 
-int tap_has_ufo(NetClientState *nc);
+bool tap_has_ufo(NetClientState *nc);
 int tap_has_vnet_hdr(NetClientState *nc);
 int tap_has_vnet_hdr_len(NetClientState *nc, int len);
-void tap_using_vnet_hdr(NetClientState *nc, int using_vnet_hdr);
+void tap_using_vnet_hdr(NetClientState *nc, bool using_vnet_hdr);
 void tap_set_offload(NetClientState *nc, int csum, int tso4, int tso6, int 
ecn, int ufo);
 void tap_set_vnet_hdr_len(NetClientState *nc, int len);
 
diff --git a/net/tap-win32.c b/net/tap-win32.c
index 265369c..3052bba 100644
--- a/net/tap-win32.c
+++ b/net/tap-win32.c
@@ -722,9 +722,9 @@ int net_init_tap(const NetClientOptions *opts, const char 
*name,
 return 0;
 }
 
-int tap_has_ufo(NetClientState *nc)
+bool tap_has_ufo(NetClientState *nc)
 {
-return 0;
+return false;
 }
 
 int tap_has_vnet_hdr(NetClientState *nc)
@@ -741,7 +741,7 @@ void tap_fd_set_vnet_hdr_len(int fd, int len)
 {
 }
 
-void tap_using_vnet_hdr(NetClientState *nc, int using_vnet_hdr)
+void tap_using_vnet_hdr(NetClientState *nc, bool using_vnet_hdr)
 {
 }
 
diff --git a/net/tap.c b/net/tap.c
index eb40c42..5542c98 100644
--- a/net/tap.c
+++ b/net/tap.c
@@ -55,10 +55,10 @@ typedef struct TAPState {
 char down_script[1024];
 char down_script_arg[128];
 uint8_t buf[TAP_BUFSIZE];
-unsigned int read_poll : 1;
-unsigned int write_poll : 1;
-unsigned int using_vnet_hdr : 1;
-unsigned int has_ufo: 1;
+bool read_poll;
+bool write_poll;
+bool using_vnet_hdr;
+bool has_ufo;
 VHostNetState *vhost_net;
 unsigned host_vnet_hdr_len;
 } TAPState;
@@ -78,15 +78,15 @@ static void tap_update_fd_handler(TAPState *s)
  s);
 }
 
-static void tap_read_poll(TAPState *s, int enable)
+static void tap_read_poll(TAPState *s, bool enable)
 {
-s->read_poll = !!enable;
+s->read_poll = enable;
 tap_update_fd_handler(s);
 }
 
-static void tap_write_poll(TAPState *s, int enable)
+static void tap_write_poll(TAPState *s, bool enable)
 {
-s->write_poll = !!enable;
+s->write_poll = enable;
 tap_update_fd_handler(s);
 }
 
@@ -94,7 +94,7 @@ static void tap_writable(void *opaque)
 {
 TAPState *s = opaque;
 
-tap_write_poll(s, 0);
+tap_write_poll(s, false);
 
 qemu_flush_queued_packets(&s->nc);
 }
@@ -108,7 +108,7 @@ static ssize_t tap_write_packet(TAPState *s, const struct 
iovec *iov, int iovcnt
 } while (len == -1 && errno == EINTR);
 
 if (len == -1 && errno == EAGAIN) {
-tap_write_poll(s, 1);
+tap_write_poll(s, true);
 return 0;
 }
 
@@ -186,7 +186,7 @@ ssize_t tap_read_packet(int tapfd, uint8_t *buf, int maxlen)
 static void tap_send_completed(NetClientState *nc, ssize_t len)
 {
 TAPState *s = DO_UPCAST(TAPState, nc, nc);
-tap_read_poll(s, 1);
+tap_read_poll(s, true);
 }
 
 static void tap_send(void *opaque)
@@ -209,12 +209,12 @@ static void tap_send(void *opaque)
 
 size = qemu_send_packet_async(&s->nc, buf, size, tap_send_completed);
 if (size == 0) {
-tap_read_poll(s, 0);
+tap_read_poll(s, false);
 }
 } while (size > 0 && qemu_can_send_packet(&s->nc));
 }
 
-int tap_has_ufo(NetClientState *nc)
+bool tap_has_ufo(NetClientState *nc)
 {
 TAPState *s = DO_UPCAST(TAPState, nc, nc);
 
@@ -253,12 +253,10 @@ void tap_set_vnet_hdr_len(NetClientState *nc, int len)
 s->host_vnet_hdr_len = len;
 }
 
-void tap_using_vnet_hdr(NetClientState *nc, int using_vnet_hdr)
+void tap_using_vnet_hdr(NetClientState *nc, bool using_vnet_hdr)
 {
 TAPState *s = DO_UPCAST(TAPState, nc, nc);
 
-using_vnet_hdr = using_vnet_hdr != 0;
-
 assert(nc->info->type == NET_CLIENT_OPTIONS_KIND_TAP);
 assert(!!s->host_vnet_hdr_len == using_vnet_hdr);
 
@@ -290,8 +288,8 @@ static void tap_cleanup(NetClientState *nc)
 if (s->down_script[0])
 launch_script(s->down_script, s->down_script_arg, s->fd);
 
-tap_read_poll(s

[Qemu-devel] [PATCH V4 RESEND 20/22] virtio-net: multiqueue support

[Jason Wang]

This patch implements both userspace and vhost support for multiple queue
virtio-net (VIRTIO_NET_F_MQ). This is done by introducing an array of
VirtIONetQueue to VirtIONet.

Signed-off-by: Jason Wang 
Signed-off-by: Michael S. Tsirkin 
---
 hw/virtio-net.c |  301 +++
 hw/virtio-net.h |   27 +-
 2 files changed, 261 insertions(+), 67 deletions(-)

diff --git a/hw/virtio-net.c b/hw/virtio-net.c
index 4b285c1..2067fa7 100644
--- a/hw/virtio-net.c
+++ b/hw/virtio-net.c
@@ -44,7 +44,7 @@ typedef struct VirtIONet
 VirtIODevice vdev;
 uint8_t mac[ETH_ALEN];
 uint16_t status;
-VirtIONetQueue vq;
+VirtIONetQueue vqs[MAX_QUEUE_NUM];
 VirtQueue *ctrl_vq;
 NICState *nic;
 uint32_t tx_timeout;
@@ -70,14 +70,23 @@ typedef struct VirtIONet
 } mac_table;
 uint32_t *vlans;
 DeviceState *qdev;
+int multiqueue;
+uint16_t max_queues;
+uint16_t curr_queues;
 } VirtIONet;
 
-static VirtIONetQueue *virtio_net_get_queue(NetClientState *nc)
+static VirtIONetQueue *virtio_net_get_subqueue(NetClientState *nc)
 {
 VirtIONet *n = qemu_get_nic_opaque(nc);
 
-return &n->vq;
+return &n->vqs[nc->queue_index];
 }
+
+static int vq2q(int queue_index)
+{
+return queue_index / 2;
+}
+
 /* TODO
  * - we could suppress RX interrupt if we were so inclined.
  */
@@ -93,6 +102,7 @@ static void virtio_net_get_config(VirtIODevice *vdev, 
uint8_t *config)
 struct virtio_net_config netcfg;
 
 stw_p(&netcfg.status, n->status);
+stw_p(&netcfg.max_virtqueue_pairs, n->max_queues);
 memcpy(netcfg.mac, n->mac, ETH_ALEN);
 memcpy(config, &netcfg, sizeof(netcfg));
 }
@@ -120,6 +130,7 @@ static bool virtio_net_started(VirtIONet *n, uint8_t status)
 static void virtio_net_vhost_status(VirtIONet *n, uint8_t status)
 {
 NetClientState *nc = qemu_get_queue(n->nic);
+int queues = n->multiqueue ? n->max_queues : 1;
 
 if (!nc->peer) {
 return;
@@ -131,6 +142,7 @@ static void virtio_net_vhost_status(VirtIONet *n, uint8_t 
status)
 if (!tap_get_vhost_net(nc->peer)) {
 return;
 }
+
 if (!!n->vhost_started == virtio_net_started(n, status) &&
   !nc->peer->link_down) {
 return;
@@ -141,16 +153,14 @@ static void virtio_net_vhost_status(VirtIONet *n, uint8_t 
status)
 return;
 }
 n->vhost_started = 1;
-r = vhost_net_start(&n->vdev, nc, 1);
+r = vhost_net_start(&n->vdev, n->nic->ncs, queues);
 if (r < 0) {
 error_report("unable to start vhost net: %d: "
  "falling back on userspace virtio", -r);
 n->vhost_started = 0;
-} else {
-n->vhost_started = 1;
 }
 } else {
-vhost_net_stop(&n->vdev, nc, 1);
+vhost_net_stop(&n->vdev, n->nic->ncs, queues);
 n->vhost_started = 0;
 }
 }
@@ -158,26 +168,38 @@ static void virtio_net_vhost_status(VirtIONet *n, uint8_t 
status)
 static void virtio_net_set_status(struct VirtIODevice *vdev, uint8_t status)
 {
 VirtIONet *n = to_virtio_net(vdev);
-VirtIONetQueue *q = &n->vq;
+VirtIONetQueue *q;
+int i;
+uint8_t queue_status;
 
 virtio_net_vhost_status(n, status);
 
-if (!q->tx_waiting) {
-return;
-}
+for (i = 0; i < n->max_queues; i++) {
+q = &n->vqs[i];
 
-if (virtio_net_started(n, status) && !n->vhost_started) {
-if (q->tx_timer) {
-qemu_mod_timer(q->tx_timer,
-   qemu_get_clock_ns(vm_clock) + n->tx_timeout);
+if ((!n->multiqueue && i != 0) || i >= n->curr_queues) {
+queue_status = 0;
 } else {
-qemu_bh_schedule(q->tx_bh);
+queue_status = status;
 }
-} else {
-if (q->tx_timer) {
-qemu_del_timer(q->tx_timer);
+
+if (!q->tx_waiting) {
+continue;
+}
+
+if (virtio_net_started(n, queue_status) && !n->vhost_started) {
+if (q->tx_timer) {
+qemu_mod_timer(q->tx_timer,
+   qemu_get_clock_ns(vm_clock) + n->tx_timeout);
+} else {
+qemu_bh_schedule(q->tx_bh);
+}
 } else {
-qemu_bh_cancel(q->tx_bh);
+if (q->tx_timer) {
+qemu_del_timer(q->tx_timer);
+} else {
+qemu_bh_cancel(q->tx_bh);
+}
 }
 }
 }
@@ -209,6 +231,8 @@ static void virtio_net_reset(VirtIODevice *vdev)
 n->nomulti = 0;
 n->nouni = 0;
 n->nobcast = 0;
+/* multiqueue is disabled by default */
+n->curr_queues = 1;
 
 /* Flush any MAC and VLAN filter table state */
 n->mac_table.in_use = 0;
@@ -251,18 +275,70 @@ static int peer_has_ufo(VirtIONet *n)
 
 static void virtio_net_set_mrg_rx_bufs(VirtIONet *n, int mergeable_rx_bufs)
 {
+int i;
+NetClientState *nc;
+
 n->mergeable_r

Re: [Qemu-devel] [PATCH for-1.4?] ppc405_uc: Pass PowerPCCPU to ppc40x_{core, chip, system}_reset()

[Andreas Färber]

Am 01.02.2013 09:42, schrieb Alexander Graf:
> 
> On 01.02.2013, at 09:41, Andreas Färber wrote:
> 
>> Am 31.01.2013 00:29, schrieb Andreas Färber:
>>> Prepares for changing cpu_interrupt() argument to CPUState.
>>>
>>> Signed-off-by: Andreas Färber 
>>> ---
>>> Extracted from my qom-cpu-8 queue - could accompany my debug output fixes. 
>>> :)
>>>
>>> hw/ppc.c   |   12 ++--
>>> hw/ppc.h   |6 +++---
>>> hw/ppc405_uc.c |   16 ++--
>>> 3 Dateien geändert, 19 Zeilen hinzugefügt(+), 15 Zeilen entfernt(-)
>>
>> This patch didn't make it into your ppc pull. Seems you were not CC'ed.
>> Can you instead ack it so that I can put it into my qom-cpu-next queue
>> please?
> 
> Acked-by: Alexander Graf 

Thanks, applied:
https://github.com/afaerber/qemu-cpu/commits/qom-cpu-next

Andreas

-- 
SUSE LINUX Products GmbH, Maxfeldstr. 5, 90409 Nürnberg, Germany
GF: Jeff Hawn, Jennifer Guild, Felix Imendörffer; HRB 16746 AG Nürnberg

Re: [Qemu-devel] [PATCH v2 01/20] arm: add Faraday a36x SoC platform support

[Kuo-Jung Su]

Hi Andreas:

Thanks for the information, and sorry for the mess I've done.
I'll one-by-one re-send all the patches.

However because most of my patches are new files,
should I send-out the patches with detail change log?

For example:

[PATCH] dumb timer
... [PATCH v2 0/2] dumb timer (Cover letter)
[PATCH v2 1/2] dumb timer (The one in Patch V1)
[PATCH v2 2/2] dumb timer: coding style update (Change log for V2)
.. [PATCH v3 0/2] dumb timer (Cover letter)
   [PATCH v3 1/2] dumb timer (The merged file in Patch V1 & v2)
   [PATCH v3 2/2] dumb timer: bug fix (Change log for V3)


Best Wishes
Dante

2013/2/1 Andreas Färber :
> Hi,
>
> Am 01.02.2013 02:39, schrieb Kuo-Jung Su:
>> 2013/2/1 Igor Mitsyanko 
>>>
>>> On 01/25/2013 12:19 PM, Kuo-Jung Su wrote:

 +/* Board init. */
 +static void
 +a360_device_init(a360_state *s)
 +{
 +qemu_irq *pic;
 +qemu_irq ack, req;
 +qemu_irq cs_line;
 +DeviceState *ds;
 +int i, done_nic = 0, nr_flash = 1;
 +SSIBus *spi;
 +DeviceState *fl;
 +
 +/* Interrupt Controller */
 +pic = ftintc020_init(0x9880, s->cpu);
>>>
>>>
>>>
>>> You haven't introduced this interrupt controller yet, patches should be 
>>> arranged in such an order that they at least wouldn't break a build.
>>> Same goes for ftintc020_init and ftgmac100_init.
>>
>>
>> I thought that's why patch set is designed for.
>> And I susposed to split up each component and send out patches one by one?
> [...]
 diff --git a/hw/arm/Makefile.objs b/hw/arm/Makefile.objs
 index 6d049e7..c7bb10e 100644
 --- a/hw/arm/Makefile.objs
 +++ b/hw/arm/Makefile.objs
 @@ -1,4 +1,10 @@
   obj-y = integratorcp.o versatilepb.o arm_pic.o
 +obj-y += a360.o a369.o \
 +   rom.o ftdmac020.o ftapbbrg020.o \
 +   ftintc020.o fttmr010.o ftpwmtmr010.o \
 +   ftspi020.o ftssp010.o fti2c010.o \
 +   ftrtc011.o ftwdt010.o ftmac110.o 
 ftgmac100.o ftlcdc200.o \
 +   fttsc010.o ftkbc010.o ftnandc021.o 
 ftsdc010.o
>>>
>>>
>>> No such files exist at this point, you should add them here one by one in a 
>>> corresponding patch.
>>> And tabs should be replaced with spaces.
>>
>> It looks like that I really have to split up each of one by one.
>> That's good to me, because I don't have any common sense about patch process,
>> Each component in one patch would be much more easier to me.
>>
   obj-y += arm_boot.o
   obj-y += xilinx_zynq.o zynq_slcr.o
   obj-y += xilinx_spips.o
 diff --git a/hw/faraday.h b/hw/faraday.h
 new file mode 100644
 index 000..f4fe0cc
 --- /dev/null
 +++ b/hw/faraday.h
>>>
>>>
>>>
>>> None of three function prototyped in this file exists at this point, I 
>>> think you should add this file later in the patch set.
>>
>> Same issue.
>> I'm studying patchwork now, because I don't want to [act] like a idiot,
>> I'll send out the new patch when I 'though' I'm ready.
>
> The criteria is that every patch must be compilable on its own, we say
> 'bisectable' because it allows to work with git-bisect command for error
> searching. Someone who is debugging an x86 problem might land on an arm
> a36x commit and otherwise not be able to compile.
>
> You can compare my Tegra patchset here (not polished yet):
> http://repo.or.cz/w/qemu/afaerber.git/shortlog/refs/heads/tegra
>
> You can add a stub version of your machine and step by step add devices
> to it until it is complete. My Tegra2 SoC modeling with a QOM object is
> not final yet but might serve as design inspiration. I.e., all A36x SoC
> devices should have their state structs either in their own header or in
> a SoC-specific header, so that they can be embedded as fields within a
> SoC state struct - be it within your patchset or as a later step.
>
> Regards,
> Andreas
>
> --
> SUSE LINUX Products GmbH, Maxfeldstr. 5, 90409 Nürnberg, Germany
> GF: Jeff Hawn, Jennifer Guild, Felix Imendörffer; HRB 16746 AG Nürnberg



-- 
Best wishes,
Kuo-Jung Su

Re: [Qemu-devel] [PATCH v2 01/20] arm: add Faraday a36x SoC platform support

[Andreas Färber]

Hi,

Am 01.02.2013 02:39, schrieb Kuo-Jung Su:
> 2013/2/1 Igor Mitsyanko 
>>
>> On 01/25/2013 12:19 PM, Kuo-Jung Su wrote:
>>>
>>> +/* Board init. */
>>> +static void
>>> +a360_device_init(a360_state *s)
>>> +{
>>> +qemu_irq *pic;
>>> +qemu_irq ack, req;
>>> +qemu_irq cs_line;
>>> +DeviceState *ds;
>>> +int i, done_nic = 0, nr_flash = 1;
>>> +SSIBus *spi;
>>> +DeviceState *fl;
>>> +
>>> +/* Interrupt Controller */
>>> +pic = ftintc020_init(0x9880, s->cpu);
>>
>>
>>
>> You haven't introduced this interrupt controller yet, patches should be 
>> arranged in such an order that they at least wouldn't break a build.
>> Same goes for ftintc020_init and ftgmac100_init.
> 
> 
> I thought that's why patch set is designed for.
> And I susposed to split up each component and send out patches one by one?
[...]
>>> diff --git a/hw/arm/Makefile.objs b/hw/arm/Makefile.objs
>>> index 6d049e7..c7bb10e 100644
>>> --- a/hw/arm/Makefile.objs
>>> +++ b/hw/arm/Makefile.objs
>>> @@ -1,4 +1,10 @@
>>>   obj-y = integratorcp.o versatilepb.o arm_pic.o
>>> +obj-y += a360.o a369.o \
>>> +   rom.o ftdmac020.o ftapbbrg020.o \
>>> +   ftintc020.o fttmr010.o ftpwmtmr010.o \
>>> +   ftspi020.o ftssp010.o fti2c010.o \
>>> +   ftrtc011.o ftwdt010.o ftmac110.o 
>>> ftgmac100.o ftlcdc200.o \
>>> +   fttsc010.o ftkbc010.o ftnandc021.o 
>>> ftsdc010.o
>>
>>
>> No such files exist at this point, you should add them here one by one in a 
>> corresponding patch.
>> And tabs should be replaced with spaces.
> 
> It looks like that I really have to split up each of one by one.
> That's good to me, because I don't have any common sense about patch process,
> Each component in one patch would be much more easier to me.
> 
>>>   obj-y += arm_boot.o
>>>   obj-y += xilinx_zynq.o zynq_slcr.o
>>>   obj-y += xilinx_spips.o
>>> diff --git a/hw/faraday.h b/hw/faraday.h
>>> new file mode 100644
>>> index 000..f4fe0cc
>>> --- /dev/null
>>> +++ b/hw/faraday.h
>>
>>
>>
>> None of three function prototyped in this file exists at this point, I think 
>> you should add this file later in the patch set.
> 
> Same issue.
> I'm studying patchwork now, because I don't want to [act] like a idiot,
> I'll send out the new patch when I 'though' I'm ready.

The criteria is that every patch must be compilable on its own, we say
'bisectable' because it allows to work with git-bisect command for error
searching. Someone who is debugging an x86 problem might land on an arm
a36x commit and otherwise not be able to compile.

You can compare my Tegra patchset here (not polished yet):
http://repo.or.cz/w/qemu/afaerber.git/shortlog/refs/heads/tegra

You can add a stub version of your machine and step by step add devices
to it until it is complete. My Tegra2 SoC modeling with a QOM object is
not final yet but might serve as design inspiration. I.e., all A36x SoC
devices should have their state structs either in their own header or in
a SoC-specific header, so that they can be embedded as fields within a
SoC state struct - be it within your patchset or as a later step.

Regards,
Andreas

-- 
SUSE LINUX Products GmbH, Maxfeldstr. 5, 90409 Nürnberg, Germany
GF: Jeff Hawn, Jennifer Guild, Felix Imendörffer; HRB 16746 AG Nürnberg

Re: [Qemu-devel] [PATCH for-1.4?] isa: QOM'ify isa_bus_from_device()

[Andreas Färber]

Am 20.01.2013 19:16, schrieb Andreas Färber:
> Am 20.01.2013 18:56, schrieb Andreas Färber:
>> DeviceState::parent_bus is document as private and should be accessed
> 
> "documented" - please fix when applying.
> 
>> through qdev_get_parent_bus(). Use a DEVICE() cast instead of accessing
>> ISADevice's qdev field directly. Use ISA_BUS() in place of DO_UPCAST().
>>
>> Signed-off-by: Andreas Färber 
>> Cc: Anthony Liguori 
>> ---
>>  hw/isa.h |2 +-
>>  1 Datei geändert, 1 Zeile hinzugefügt(+), 1 Zeile entfernt(-)

Ping? Not 1.4 material or an oversight? Should I resend due to typo?

Andreas

>> diff --git a/hw/isa.h b/hw/isa.h
>> index 62e89d3..7a8874a 100644
>> --- a/hw/isa.h
>> +++ b/hw/isa.h
>> @@ -82,7 +82,7 @@ void isa_register_portio_list(ISADevice *dev, uint16_t 
>> start,
>>  
>>  static inline ISABus *isa_bus_from_device(ISADevice *d)
>>  {
>> -return DO_UPCAST(ISABus, qbus, d->qdev.parent_bus);
>> +return ISA_BUS(qdev_get_parent_bus(DEVICE(d)));
>>  }
>>  
>>  extern hwaddr isa_mem_base;

-- 
SUSE LINUX Products GmbH, Maxfeldstr. 5, 90409 Nürnberg, Germany
GF: Jeff Hawn, Jennifer Guild, Felix Imendörffer; HRB 16746 AG Nürnberg

[Qemu-devel] [PATCH V4 RESEND 10/22] tap: import linux multiqueue constants

[Jason Wang]

Import multiqueue constants from if_tun.h from 3.8-rc3. A new ifr flag
IFF_MULTI_QUEUE were introduced to create a multiqueue backend by calling
TUNSETIFF with the this flag and with the same interface name many times.

A new ioctl TUNSETQUEUE were introduced. When doing this ioctl with
IFF_DETACH_QUEUE, the queue were disabled in the linux kernel. When doing this
ioctl with IFF_ATTACH_QUEUE, the queue were enabled in the linux kernel.

Signed-off-by: Jason Wang 
Signed-off-by: Michael S. Tsirkin 
---
 net/tap-linux.h |4 
 1 files changed, 4 insertions(+), 0 deletions(-)

diff --git a/net/tap-linux.h b/net/tap-linux.h
index cb2a6d4..65087e1 100644
--- a/net/tap-linux.h
+++ b/net/tap-linux.h
@@ -29,6 +29,7 @@
 #define TUNSETSNDBUF   _IOW('T', 212, int)
 #define TUNGETVNETHDRSZ _IOR('T', 215, int)
 #define TUNSETVNETHDRSZ _IOW('T', 216, int)
+#define TUNSETQUEUE  _IOW('T', 217, int)
 
 #endif
 
@@ -36,6 +37,9 @@
 #define IFF_TAP0x0002
 #define IFF_NO_PI  0x1000
 #define IFF_VNET_HDR   0x4000
+#define IFF_MULTI_QUEUE 0x0100
+#define IFF_ATTACH_QUEUE 0x0200
+#define IFF_DETACH_QUEUE 0x0400
 
 /* Features for GSO (TUNSETOFFLOAD). */
 #define TUN_F_CSUM 0x01/* You can hand me unchecksummed packets. */
-- 
1.7.1

[Qemu-devel] [PATCH V4 RESEND 11/22] tap: factor out common tap initialization

[Jason Wang]

This patch factors out the common initialization of tap into a new helper
net_init_tap_one(). This will be used by multiqueue tap patches.

Signed-off-by: Jason Wang 
Signed-off-by: Michael S. Tsirkin 
---
 net/tap.c |  130 ++---
 1 files changed, 73 insertions(+), 57 deletions(-)

diff --git a/net/tap.c b/net/tap.c
index 5542c98..23fb6e0 100644
--- a/net/tap.c
+++ b/net/tap.c
@@ -591,6 +591,73 @@ static int net_tap_init(const NetdevTapOptions *tap, int 
*vnet_hdr,
 return fd;
 }
 
+static int net_init_tap_one(const NetdevTapOptions *tap, NetClientState *peer,
+const char *model, const char *name,
+const char *ifname, const char *script,
+const char *downscript, const char *vhostfdname,
+int vnet_hdr, int fd)
+{
+TAPState *s;
+
+s = net_tap_fd_init(peer, model, name, fd, vnet_hdr);
+if (!s) {
+close(fd);
+return -1;
+}
+
+if (tap_set_sndbuf(s->fd, tap) < 0) {
+return -1;
+}
+
+if (tap->has_fd) {
+snprintf(s->nc.info_str, sizeof(s->nc.info_str), "fd=%d", fd);
+} else if (tap->has_helper) {
+snprintf(s->nc.info_str, sizeof(s->nc.info_str), "helper=%s",
+ tap->helper);
+} else {
+const char *downscript;
+
+downscript = tap->has_downscript ? tap->downscript :
+DEFAULT_NETWORK_DOWN_SCRIPT;
+
+snprintf(s->nc.info_str, sizeof(s->nc.info_str),
+ "ifname=%s,script=%s,downscript=%s", ifname, script,
+ downscript);
+
+if (strcmp(downscript, "no") != 0) {
+snprintf(s->down_script, sizeof(s->down_script), "%s", downscript);
+snprintf(s->down_script_arg, sizeof(s->down_script_arg),
+ "%s", ifname);
+}
+}
+
+if (tap->has_vhost ? tap->vhost :
+vhostfdname || (tap->has_vhostforce && tap->vhostforce)) {
+int vhostfd;
+
+if (tap->has_vhostfd) {
+vhostfd = monitor_handle_fd_param(cur_mon, vhostfdname);
+if (vhostfd == -1) {
+return -1;
+}
+} else {
+vhostfd = -1;
+}
+
+s->vhost_net = vhost_net_init(&s->nc, vhostfd,
+  tap->has_vhostforce && tap->vhostforce);
+if (!s->vhost_net) {
+error_report("vhost-net requested but could not be initialized");
+return -1;
+}
+} else if (tap->has_vhostfd) {
+error_report("vhostfd= is not valid without vhost");
+return -1;
+}
+
+return 0;
+}
+
 int net_init_tap(const NetClientOptions *opts, const char *name,
  NetClientState *peer)
 {
@@ -598,10 +665,10 @@ int net_init_tap(const NetClientOptions *opts, const char 
*name,
 
 int fd, vnet_hdr = 0;
 const char *model;
-TAPState *s;
 
 /* for the no-fd, no-helper case */
 const char *script = NULL; /* suppress wrong "uninit'd use" gcc warning */
+const char *downscript = NULL;
 char ifname[128];
 
 assert(opts->kind == NET_CLIENT_OPTIONS_KIND_TAP);
@@ -647,6 +714,8 @@ int net_init_tap(const NetClientOptions *opts, const char 
*name,
 
 } else {
 script = tap->has_script ? tap->script : DEFAULT_NETWORK_SCRIPT;
+downscript = tap->has_downscript ? tap->downscript :
+DEFAULT_NETWORK_DOWN_SCRIPT;
 fd = net_tap_init(tap, &vnet_hdr, script, ifname, sizeof ifname);
 if (fd == -1) {
 return -1;
@@ -655,62 +724,9 @@ int net_init_tap(const NetClientOptions *opts, const char 
*name,
 model = "tap";
 }
 
-s = net_tap_fd_init(peer, model, name, fd, vnet_hdr);
-if (!s) {
-close(fd);
-return -1;
-}
-
-if (tap_set_sndbuf(s->fd, tap) < 0) {
-return -1;
-}
-
-if (tap->has_fd) {
-snprintf(s->nc.info_str, sizeof(s->nc.info_str), "fd=%d", fd);
-} else if (tap->has_helper) {
-snprintf(s->nc.info_str, sizeof(s->nc.info_str), "helper=%s",
- tap->helper);
-} else {
-const char *downscript;
-
-downscript = tap->has_downscript ? tap->downscript :
-   DEFAULT_NETWORK_DOWN_SCRIPT;
-
-snprintf(s->nc.info_str, sizeof(s->nc.info_str),
- "ifname=%s,script=%s,downscript=%s", ifname, script,
- downscript);
-
-if (strcmp(downscript, "no") != 0) {
-snprintf(s->down_script, sizeof(s->down_script), "%s", downscript);
-snprintf(s->down_script_arg, sizeof(s->down_script_arg), "%s", 
ifname);
-}
-}
-
-if (tap->has_vhost ? tap->vhost :
-tap->has_vhostfd || (tap->has_vhostforce && tap->vhostforce)) {
-int vhostfd;
-
-if (tap->has_vhostfd) {
-vhostfd = monitor_handle_fd_param(cur_mon, tap->vhostfd);
-  

[Qemu-devel] [PATCH V4 RESEND 18/22] virtio: add a queue_index to VirtQueue

[Jason Wang]

Add a queue_index to VirtQueue and a helper to fetch it, this could be used by
multiqueue supported device.

Signed-off-by: Jason Wang 
Signed-off-by: Michael S. Tsirkin 
---
 hw/virtio.c |8 
 hw/virtio.h |1 +
 2 files changed, 9 insertions(+), 0 deletions(-)

diff --git a/hw/virtio.c b/hw/virtio.c
index d8c77b0..e259348 100644
--- a/hw/virtio.c
+++ b/hw/virtio.c
@@ -73,6 +73,8 @@ struct VirtQueue
 /* Notification enabled? */
 bool notification;
 
+uint16_t queue_index;
+
 int inuse;
 
 uint16_t vector;
@@ -931,6 +933,7 @@ void virtio_init(VirtIODevice *vdev, const char *name,
 for (i = 0; i < VIRTIO_PCI_QUEUE_MAX; i++) {
 vdev->vq[i].vector = VIRTIO_NO_VECTOR;
 vdev->vq[i].vdev = vdev;
+vdev->vq[i].queue_index = i;
 }
 
 vdev->name = name;
@@ -1018,6 +1021,11 @@ VirtQueue *virtio_get_queue(VirtIODevice *vdev, int n)
 return vdev->vq + n;
 }
 
+uint16_t virtio_get_queue_index(VirtQueue *vq)
+{
+return vq->queue_index;
+}
+
 static void virtio_queue_guest_notifier_read(EventNotifier *n)
 {
 VirtQueue *vq = container_of(n, VirtQueue, guest_notifier);
diff --git a/hw/virtio.h b/hw/virtio.h
index d3da1d2..a29a54d 100644
--- a/hw/virtio.h
+++ b/hw/virtio.h
@@ -280,6 +280,7 @@ hwaddr virtio_queue_get_ring_size(VirtIODevice *vdev, int 
n);
 uint16_t virtio_queue_get_last_avail_idx(VirtIODevice *vdev, int n);
 void virtio_queue_set_last_avail_idx(VirtIODevice *vdev, int n, uint16_t idx);
 VirtQueue *virtio_get_queue(VirtIODevice *vdev, int n);
+uint16_t virtio_get_queue_index(VirtQueue *vq);
 int virtio_queue_get_id(VirtQueue *vq);
 EventNotifier *virtio_queue_get_guest_notifier(VirtQueue *vq);
 void virtio_queue_set_guest_notifier_fd_handler(VirtQueue *vq, bool assign,
-- 
1.7.1

[Qemu-devel] [PATCH V4 RESEND 04/22] net: introduce qemu_get_nic()

[Jason Wang]

To support multiqueue, this patch introduces a helper qemu_get_nic() to get
NICState from a NetClientState. The following patches would refactor this helper
to support multiqueue.

Signed-off-by: Jason Wang 
Signed-off-by: Michael S. Tsirkin 
---
 hw/cadence_gem.c|8 
 hw/dp8393x.c|6 +++---
 hw/e1000.c  |8 
 hw/eepro100.c   |6 +++---
 hw/etraxfs_eth.c|6 +++---
 hw/lan9118.c|6 +++---
 hw/lance.c  |2 +-
 hw/mcf_fec.c|6 +++---
 hw/milkymist-minimac2.c |6 +++---
 hw/mipsnet.c|6 +++---
 hw/musicpal.c   |4 ++--
 hw/ne2000-isa.c |2 +-
 hw/ne2000.c |6 +++---
 hw/opencores_eth.c  |6 +++---
 hw/pcnet-pci.c  |2 +-
 hw/pcnet.c  |6 +++---
 hw/rtl8139.c|8 
 hw/smc91c111.c  |6 +++---
 hw/spapr_llan.c |4 ++--
 hw/stellaris_enet.c |6 +++---
 hw/usb/dev-network.c|6 +++---
 hw/virtio-net.c |   10 +-
 hw/xen_nic.c|4 ++--
 hw/xgmac.c  |6 +++---
 hw/xilinx_axienet.c |6 +++---
 hw/xilinx_ethlite.c |6 +++---
 include/net/net.h   |2 ++
 net/net.c   |   20 
 28 files changed, 92 insertions(+), 78 deletions(-)

diff --git a/hw/cadence_gem.c b/hw/cadence_gem.c
index b8071a4..ab86c17 100644
--- a/hw/cadence_gem.c
+++ b/hw/cadence_gem.c
@@ -409,7 +409,7 @@ static int gem_can_receive(NetClientState *nc)
 {
 GemState *s;
 
-s = DO_UPCAST(NICState, nc, nc)->opaque;
+s = qemu_get_nic_opaque(nc);
 
 DB_PRINT("\n");
 
@@ -612,7 +612,7 @@ static ssize_t gem_receive(NetClientState *nc, const 
uint8_t *buf, size_t size)
 uint8_trxbuf[2048];
 uint8_t   *rxbuf_ptr;
 
-s = DO_UPCAST(NICState, nc, nc)->opaque;
+s = qemu_get_nic_opaque(nc);
 
 /* Do nothing if receive is not enabled. */
 if (!(s->regs[GEM_NWCTRL] & GEM_NWCTRL_RXENA)) {
@@ -1152,7 +1152,7 @@ static const MemoryRegionOps gem_ops = {
 
 static void gem_cleanup(NetClientState *nc)
 {
-GemState *s = DO_UPCAST(NICState, nc, nc)->opaque;
+GemState *s = qemu_get_nic_opaque(nc);
 
 DB_PRINT("\n");
 s->nic = NULL;
@@ -1161,7 +1161,7 @@ static void gem_cleanup(NetClientState *nc)
 static void gem_set_link(NetClientState *nc)
 {
 DB_PRINT("\n");
-phy_update_link(DO_UPCAST(NICState, nc, nc)->opaque);
+phy_update_link(qemu_get_nic_opaque(nc));
 }
 
 static NetClientInfo net_gem_info = {
diff --git a/hw/dp8393x.c b/hw/dp8393x.c
index c2d0bc8..0273fad 100644
--- a/hw/dp8393x.c
+++ b/hw/dp8393x.c
@@ -676,7 +676,7 @@ static const MemoryRegionOps dp8393x_ops = {
 
 static int nic_can_receive(NetClientState *nc)
 {
-dp8393xState *s = DO_UPCAST(NICState, nc, nc)->opaque;
+dp8393xState *s = qemu_get_nic_opaque(nc);
 
 if (!(s->regs[SONIC_CR] & SONIC_CR_RXEN))
 return 0;
@@ -725,7 +725,7 @@ static int receive_filter(dp8393xState *s, const uint8_t * 
buf, int size)
 
 static ssize_t nic_receive(NetClientState *nc, const uint8_t * buf, size_t 
size)
 {
-dp8393xState *s = DO_UPCAST(NICState, nc, nc)->opaque;
+dp8393xState *s = qemu_get_nic_opaque(nc);
 uint16_t data[10];
 int packet_type;
 uint32_t available, address;
@@ -861,7 +861,7 @@ static void nic_reset(void *opaque)
 
 static void nic_cleanup(NetClientState *nc)
 {
-dp8393xState *s = DO_UPCAST(NICState, nc, nc)->opaque;
+dp8393xState *s = qemu_get_nic_opaque(nc);
 
 memory_region_del_subregion(s->address_space, &s->mmio);
 memory_region_destroy(&s->mmio);
diff --git a/hw/e1000.c b/hw/e1000.c
index 3622392..df6c693 100644
--- a/hw/e1000.c
+++ b/hw/e1000.c
@@ -753,7 +753,7 @@ receive_filter(E1000State *s, const uint8_t *buf, int size)
 static void
 e1000_set_link_status(NetClientState *nc)
 {
-E1000State *s = DO_UPCAST(NICState, nc, nc)->opaque;
+E1000State *s = qemu_get_nic_opaque(nc);
 uint32_t old_status = s->mac_reg[STATUS];
 
 if (nc->link_down) {
@@ -787,7 +787,7 @@ static bool e1000_has_rxbufs(E1000State *s, size_t 
total_size)
 static int
 e1000_can_receive(NetClientState *nc)
 {
-E1000State *s = DO_UPCAST(NICState, nc, nc)->opaque;
+E1000State *s = qemu_get_nic_opaque(nc);
 
 return (s->mac_reg[RCTL] & E1000_RCTL_EN) && e1000_has_rxbufs(s, 1);
 }
@@ -803,7 +803,7 @@ static uint64_t rx_desc_base(E1000State *s)
 static ssize_t
 e1000_receive(NetClientState *nc, const uint8_t *buf, size_t size)
 {
-E1000State *s = DO_UPCAST(NICState, nc, nc)->opaque;
+E1000State *s = qemu_get_nic_opaque(nc);
 struct e1000_rx_desc desc;
 dma_addr_t base;
 unsigned int n, rdt;
@@ -1240,7 +1240,7 @@ e1000_mmio_setup(E1000State *d)
 static void
 e1000_cleanup(NetClientState *nc)
 {
-E1000State *s = DO_UPCAST(NICState, nc, nc)->opaque;
+E1000State *s = qemu_get_nic_opaque(nc);
 
 s->nic = NULL;
 }

Re: [Qemu-devel] [PATCH for-1.4?] i2c: Drop I2C_SLAVE_FROM_QDEV() macro

[Andreas Färber]

Am 25.01.2013 09:12, schrieb Andreas Färber:
> It is not being used in hot paths and is obsoleted by I2C_SLAVE()
> QOM cast macro. Clean it up using a scripted conversion, so that it
> doesn't get used in new code.
> 
> Some of its callers were combining it with FROM_I2C_SLAVE() macro, which
> is equally obsolete but needs to be replaced in a type-specific way.
> 
> Signed-off-by: Andreas Färber 
> Cc: Kuo-Jung Su 
> ---
>  hw/ds1338.c  |2 +-
>  hw/i2c.c |4 ++--
>  hw/i2c.h |1 -
>  hw/lm832x.c  |2 +-
>  hw/max7310.c |2 +-
>  hw/pxa2xx.c  |2 +-
>  hw/wm8750.c  |2 +-
>  7 Dateien geändert, 7 Zeilen hinzugefügt(+), 8 Zeilen entfernt(-)

Ping. Not 1.4 material? A similar SysBus cleanup was applied earlier.

Andreas

> diff --git a/hw/ds1338.c b/hw/ds1338.c
> index 3792206..6f70538 100644
> --- a/hw/ds1338.c
> +++ b/hw/ds1338.c
> @@ -198,7 +198,7 @@ static int ds1338_init(I2CSlave *i2c)
>  
>  static void ds1338_reset(DeviceState *dev)
>  {
> -DS1338State *s = FROM_I2C_SLAVE(DS1338State, I2C_SLAVE_FROM_QDEV(dev));
> +DS1338State *s = FROM_I2C_SLAVE(DS1338State, I2C_SLAVE(dev));
>  
>  /* The clock is running and synchronized with the host */
>  s->offset = 0;
> diff --git a/hw/i2c.c b/hw/i2c.c
> index 119e96b..ec314a4 100644
> --- a/hw/i2c.c
> +++ b/hw/i2c.c
> @@ -92,7 +92,7 @@ int i2c_start_transfer(i2c_bus *bus, uint8_t address, int 
> recv)
>  
>  QTAILQ_FOREACH(kid, &bus->qbus.children, sibling) {
>  DeviceState *qdev = kid->child;
> -I2CSlave *candidate = I2C_SLAVE_FROM_QDEV(qdev);
> +I2CSlave *candidate = I2C_SLAVE(qdev);
>  if (candidate->address == address) {
>  slave = candidate;
>  break;
> @@ -204,7 +204,7 @@ const VMStateDescription vmstate_i2c_slave = {
>  
>  static int i2c_slave_qdev_init(DeviceState *dev)
>  {
> -I2CSlave *s = I2C_SLAVE_FROM_QDEV(dev);
> +I2CSlave *s = I2C_SLAVE(dev);
>  I2CSlaveClass *sc = I2C_SLAVE_GET_CLASS(s);
>  
>  return sc->init(s);
> diff --git a/hw/i2c.h b/hw/i2c.h
> index 883b5c5..0e80d5a 100644
> --- a/hw/i2c.h
> +++ b/hw/i2c.h
> @@ -59,7 +59,6 @@ void i2c_nack(i2c_bus *bus);
>  int i2c_send(i2c_bus *bus, uint8_t data);
>  int i2c_recv(i2c_bus *bus);
>  
> -#define I2C_SLAVE_FROM_QDEV(dev) DO_UPCAST(I2CSlave, qdev, dev)
>  #define FROM_I2C_SLAVE(type, dev) DO_UPCAST(type, i2c, dev)
>  
>  DeviceState *i2c_create_slave(i2c_bus *bus, const char *name, uint8_t addr);
> diff --git a/hw/lm832x.c b/hw/lm832x.c
> index af49dd6..94b8ae0 100644
> --- a/hw/lm832x.c
> +++ b/hw/lm832x.c
> @@ -476,7 +476,7 @@ static int lm8323_init(I2CSlave *i2c)
>  
>  void lm832x_key_event(DeviceState *dev, int key, int state)
>  {
> -LM823KbdState *s = FROM_I2C_SLAVE(LM823KbdState, 
> I2C_SLAVE_FROM_QDEV(dev));
> +LM823KbdState *s = FROM_I2C_SLAVE(LM823KbdState, I2C_SLAVE(dev));
>  
>  if ((s->status & INT_ERROR) && (s->error & ERR_FIFOOVR))
>  return;
> diff --git a/hw/max7310.c b/hw/max7310.c
> index de2221b..c2df0b4 100644
> --- a/hw/max7310.c
> +++ b/hw/max7310.c
> @@ -25,7 +25,7 @@ typedef struct {
>  
>  static void max7310_reset(DeviceState *dev)
>  {
> -MAX7310State *s = FROM_I2C_SLAVE(MAX7310State, I2C_SLAVE_FROM_QDEV(dev));
> +MAX7310State *s = FROM_I2C_SLAVE(MAX7310State, I2C_SLAVE(dev));
>  s->level &= s->direction;
>  s->direction = 0xff;
>  s->polarity = 0xf0;
> diff --git a/hw/pxa2xx.c b/hw/pxa2xx.c
> index 2367c6a..373d061 100644
> --- a/hw/pxa2xx.c
> +++ b/hw/pxa2xx.c
> @@ -1468,7 +1468,7 @@ PXA2xxI2CState *pxa2xx_i2c_init(hwaddr base,
>  s = FROM_SYSBUS(PXA2xxI2CState, i2c_dev);
>  /* FIXME: Should the slave device really be on a separate bus?  */
>  dev = i2c_create_slave(i2c_init_bus(NULL, "dummy"), "pxa2xx-i2c-slave", 
> 0);
> -s->slave = FROM_I2C_SLAVE(PXA2xxI2CSlaveState, I2C_SLAVE_FROM_QDEV(dev));
> +s->slave = FROM_I2C_SLAVE(PXA2xxI2CSlaveState, I2C_SLAVE(dev));
>  s->slave->host = s;
>  
>  return s;
> diff --git a/hw/wm8750.c b/hw/wm8750.c
> index bb85064..d3ea5ba 100644
> --- a/hw/wm8750.c
> +++ b/hw/wm8750.c
> @@ -632,7 +632,7 @@ static void wm8750_fini(I2CSlave *i2c)
>  void wm8750_data_req_set(DeviceState *dev,
>  void (*data_req)(void *, int, int), void *opaque)
>  {
> -WM8750State *s = FROM_I2C_SLAVE(WM8750State, I2C_SLAVE_FROM_QDEV(dev));
> +WM8750State *s = FROM_I2C_SLAVE(WM8750State, I2C_SLAVE(dev));
>  s->data_req = data_req;
>  s->opaque = opaque;
>  }

-- 
SUSE LINUX Products GmbH, Maxfeldstr. 5, 90409 Nürnberg, Germany
GF: Jeff Hawn, Jennifer Guild, Felix Imendörffer; HRB 16746 AG Nürnberg

Re: [Qemu-devel] [PATCH v2 01/20] arm: add Faraday a36x SoC platform support

[Andreas Färber]

嗨 國榮,

Am 01.02.2013 09:57, schrieb Kuo-Jung Su:
> Thanks for the information, and sorry for the mess I've done.

You don't need to apologize for every review comment you get. It's
meant for improvements of results, not personal. :)

> I'll one-by-one re-send all the patches.
> 
> However because most of my patches are new files,
> should I send-out the patches with detail change log?
> 
> For example:
> 
> [PATCH] dumb timer
> ... [PATCH v2 0/2] dumb timer (Cover letter)
> [PATCH v2 1/2] dumb timer (The one in Patch V1)
> [PATCH v2 2/2] dumb timer: coding style update (Change log for V2)
> .. [PATCH v3 0/2] dumb timer (Cover letter)
>[PATCH v3 1/2] dumb timer (The merged file in Patch V1 & v2)
>[PATCH v3 2/2] dumb timer: bug fix (Change log for V3)

No, no, no. What you should do is just something like:

[PATCH v3 0/x] Add Faraday A36x SoC platform support
[PATCH v3 1/x] arm: Add Faraday A360 and A369 machines
[PATCH v3 2/x] faraday_a36x: Add FT... timer
...

* v3 cover letter contains a change log going back to v1.
* v3 is not a reply to v2 (no --in-reply-to). This aids a threaded mail
display for reviewing and avoids an old version getting reviewed or applied.
* 1+/x are replies to 0/x (usually automatically by git-send-email).
That helps keep the patches together and in the right order.
* Bug fixes of your own code do not go separate (only if you were fixing
existing code from qemu.git). There's no need to introduce bugs and then
to fix them.
* Adding a stub machine in 1/x has the advantage that the patch is much
smaller and easier to review than first adding all devices and then
adding a machine that uses all of them. And each device being added in
(1+n)/x can be tested (system not fully working of course). I.e., the
machine will grow in functionality patch by patch.
* Maybe you can order EHCI last due to the refactoring work involved?

To aid with the requested reordering and squashing of bug fixes into
patches, `git rebase -i` and `git checkout -p` may be of help to you.

Regards,
Andreas

-- 
SUSE LINUX Products GmbH, Maxfeldstr. 5, 90409 Nürnberg, Germany
GF: Jeff Hawn, Jennifer Guild, Felix Imendörffer; HRB 16746 AG Nürnberg

Re: [Qemu-devel] [PATCH] configure: Undefine _FORTIFY_SOURCE prior using it

[Andreas Färber]

Am 31.01.2013 11:15, schrieb Michal Privoznik:
> Currently, we are enforcing the _FORTIFY_SOURCE=2 without any
> previous detection if the macro has been already defined, e.g.
> by environment, or is just enabled by compiler by default.
> 
> Signed-off-by: Michal Privoznik 
> ---
>  configure | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/configure b/configure
> index b7635e4..97070eb 100755
> --- a/configure
> +++ b/configure
> @@ -3159,7 +3159,7 @@ if test "$gcov" = "yes" ; then
>CFLAGS="-fprofile-arcs -ftest-coverage -g $CFLAGS"
>LDFLAGS="-fprofile-arcs -ftest-coverage $LDFLAGS"
>  elif test "$debug" = "no" ; then
> -  CFLAGS="-O2 -D_FORTIFY_SOURCE=2 $CFLAGS"
> +  CFLAGS="-O2 -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2 $CFLAGS"
>  fi
>  
>  

Should we maybe instead add a compile-test?

#ifdef _FORTIFY_SOURCE
#if _FORTIFY_SOURCE >= 2
#error Environment already has _FORTIFY_SOURCE
#endif
#endif

I admit I have no clue what the number means and whether there are more
fortified levels.

Cheers,
Andreas

-- 
SUSE LINUX Products GmbH, Maxfeldstr. 5, 90409 Nürnberg, Germany
GF: Jeff Hawn, Jennifer Guild, Felix Imendörffer; HRB 16746 AG Nürnberg

[Qemu-devel] scp during migration with vhost fails

[Jason Wang]

Hello all:

During testing, I find doing scp during migration with vhost fails with 
warnings in guest like:

Corrupted MAC on input.
Disconnecting: Packet corrupt.
lost connection

Here's the bisect result:

Commit a01672d3968cf91208666d371784110bfde9d4f8 kvm: convert to MemoryListener 
API is the last commit that works well.

With commit 04097f7c5957273c578f72b9bd603ba6b1d69e33 vhost: convert to 
MemoryListener API, guest network is unusable with warning of "bad gso type"

With commit d743c382861eaa1e13f503b05aba5a382a7e7f7c vhost: fix incorrect 
userspace address, guest network is available, but scp during migration may 
fail.

Looks like the issue is related to memory api, any thoughts?

Thanks

Re: [Qemu-devel] [PATCH v2 2/3] VFIO-AER: Vfio-pci driver changes for supporting AER

[Pandarathil, Vijaymohan R]

> -Original Message-
> From: Alex Williamson [mailto:alex.william...@redhat.com]
> Sent: Tuesday, January 29, 2013 5:25 AM
> To: Pandarathil, Vijaymohan R
> Cc: Gleb Natapov; Bjorn Helgaas; Blue Swirl; Ortiz, Lance E;
> k...@vger.kernel.org; qemu-devel@nongnu.org; linux-...@vger.kernel.org;
> linux-ker...@vger.kernel.org
> Subject: Re: [PATCH v2 2/3] VFIO-AER: Vfio-pci driver changes for
> supporting AER
> 
> On Mon, 2013-01-28 at 12:31 -0700, Alex Williamson wrote:
> > On Mon, 2013-01-28 at 09:54 +, Pandarathil, Vijaymohan R wrote:
> > >   - New VFIO_SET_IRQ ioctl option to pass the eventfd that is signalled
> when
> > >   an error occurs in the vfio_pci_device
> > >
> > >   - Register pci_error_handler for the vfio_pci driver
> > >
> > >   - When the device encounters an error, the error handler registered
> by
> > >   the vfio_pci driver gets invoked by the AER infrastructure
> > >
> > >   - In the error handler, signal the eventfd registered for the device.
> > >
> > >   - This results in the qemu eventfd handler getting invoked and
> > >   appropriate action taken for the guest.
> > >
> > > Signed-off-by: Vijay Mohan Pandarathil 
> > > ---
> > >  drivers/vfio/pci/vfio_pci.c | 44
> -
> > >  drivers/vfio/pci/vfio_pci_intrs.c   | 32 +++
> > >  drivers/vfio/pci/vfio_pci_private.h |  1 +
> > >  include/uapi/linux/vfio.h   |  3 +++
> > >  4 files changed, 79 insertions(+), 1 deletion(-)
> > >
> > > diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c
> > > index b28e66c..ff2a078 100644
> > > --- a/drivers/vfio/pci/vfio_pci.c
> > > +++ b/drivers/vfio/pci/vfio_pci.c
> > > @@ -196,7 +196,9 @@ static int vfio_pci_get_irq_count(struct
> vfio_pci_device *vdev, int irq_type)
> > >
> > >   return (flags & PCI_MSIX_FLAGS_QSIZE) + 1;
> > >   }
> > > - }
> > > + } else if (irq_type == VFIO_PCI_ERR_IRQ_INDEX)
> > > + if (pci_is_pcie(vdev->pdev))
> > > + return 1;
> > >
> > >   return 0;
> > >  }
> > > @@ -223,9 +225,18 @@ static long vfio_pci_ioctl(void *device_data,
> > >   if (vdev->reset_works)
> > >   info.flags |= VFIO_DEVICE_FLAGS_RESET;
> > >
> > > + if (pci_is_pcie(vdev->pdev)) {
> > > + info.flags |= VFIO_DEVICE_FLAGS_PCI_AER;
> > > + info.flags |= VFIO_DEVICE_FLAGS_PCI_AER_NOTIFY;
> >
> > Not sure this second flag should be AER specific or if it's even needed,
> > see below for more comments on this.
> >
> > > + }
> > > +
> > >   info.num_regions = VFIO_PCI_NUM_REGIONS;
> > >   info.num_irqs = VFIO_PCI_NUM_IRQS;
> > >
> > > + /* Expose only implemented IRQs */
> > > + if (!(info.flags & VFIO_DEVICE_FLAGS_PCI_AER_NOTIFY))
> > > + info.num_irqs--;
> >
> > I'm having second thoughts on this, see further below.
> >
> > > +
> > >   return copy_to_user((void __user *)arg, &info, minsz);
> > >
> > >   } else if (cmd == VFIO_DEVICE_GET_REGION_INFO) {
> > > @@ -302,6 +313,10 @@ static long vfio_pci_ioctl(void *device_data,
> > >   if (info.argsz < minsz || info.index >= VFIO_PCI_NUM_IRQS)
> > >   return -EINVAL;
> > >
> > > + if ((info.index == VFIO_PCI_ERR_IRQ_INDEX) &&
> > > +  !pci_is_pcie(vdev->pdev))
> > > + return -EINVAL;
> > > +
> >
> > Perhaps we could incorporate the index test above this too?
> >
> > switch (info.index) {
> > case VFIO_PCI_INTX_IRQ_INDEX: ... VFIO_PCI_MSIX_IRQ_INDEX:
> > break;
> > case VFIO_PCI_ERR_IRQ_INDEX:
> > if (pci_is_pcie(vdev->pdev))
> > break;
> > default:
> > return -EINVAL;
> > }
> >
> > This is more similar to how I've re-written the same for the proposed
> > VGA/legacy I/O support.
> >
> > >   info.flags = VFIO_IRQ_INFO_EVENTFD;
> > >
> > >   info.count = vfio_pci_get_irq_count(vdev, info.index);
> > > @@ -538,11 +553,38 @@ static void vfio_pci_remove(struct pci_dev *pdev)
> > >   kfree(vdev);
> > >  }
> > >
> > > +static pci_ers_result_t vfio_err_detected(struct pci_dev *pdev,
> > > + pci_channel_state_t state)
> >
> > This is actually AER specific, right?  So perhaps it should be
> > vfio_pci_aer_err_detected?
> >
> > Also, please follow existing whitespace usage throughout, tabs followed
> > by spaces to align function parameter wrap.
> >
> > > +{
> > > + struct vfio_pci_device *vpdev;
> > > + void *vdev;
> >
> > struct vfio_device *vdev;
> >
> > > +
> > > + vdev = vfio_device_get_from_dev(&pdev->dev);
> > > + if (vdev == NULL)
> > > + return PCI_ERS_RESULT_DISCONNECT;
> > > +
> > > + vpdev = vfio_device_data(vdev);
> > > + if (vpdev == NULL)
> > > + return PCI_ERS_RESULT_DISCONNECT;
> > > +
> > > + if (vpdev->err_trigger)
> > > + eventfd_signal(vpdev->err_trigger, 1);
> > > +
> > > + vfio_device_put_vdev(vdev);
> > > +
> > > 

[Qemu-devel] [PATCH 1/4] usb: fix endpoint descriptor ordering

[Gerd Hoffmann]

Fix the ordering of the endpoint descriptors for superspeed endpoints:
The superspeed companion must come first, possible additional
descriptors for the endpoint after that.

Signed-off-by: Gerd Hoffmann 
---
 hw/usb/desc.c |9 +
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/hw/usb/desc.c b/hw/usb/desc.c
index b7c3233..b389381 100644
--- a/hw/usb/desc.c
+++ b/hw/usb/desc.c
@@ -225,12 +225,9 @@ int usb_desc_endpoint(const USBDescEndpoint *ep, int flags,
 d->u.endpoint.bRefresh  = ep->bRefresh;
 d->u.endpoint.bSynchAddress = ep->bSynchAddress;
 }
-if (ep->extra) {
-memcpy(dest + bLength, ep->extra, extralen);
-}
 
 if (superlen) {
-USBDescriptor *d = (void *)(dest + bLength + extralen);
+USBDescriptor *d = (void *)(dest + bLength);
 
 d->bLength   = 0x06;
 d->bDescriptorType   = USB_DT_ENDPOINT_COMPANION;
@@ -243,6 +240,10 @@ int usb_desc_endpoint(const USBDescEndpoint *ep, int flags,
 usb_hi(ep->wBytesPerInterval);
 }
 
+if (ep->extra) {
+memcpy(dest + bLength + superlen, ep->extra, extralen);
+}
+
 return bLength + extralen + superlen;
 }
 
-- 
1.7.9.7

[Qemu-devel] [PATCH 0/4] sneak preview: usb3 streams

[Gerd Hoffmann]

  Hi,

Early patches to add support for usb3 streams to qemu.  Covered are
the subsystem core, xhci emulation and usb attached scsi emulation.

It's good enougth to trigger bugs in the linux xhci driver's stream
handling.

enjoy,
  Gerd

Gerd Hoffmann (4):
  usb: fix endpoint descriptor ordering
  [wip] core: usb3 streams
  [wip] xhci: usb3 streams
  [wip] uas: usb3 streams

 hw/usb.h  |   10 +-
 hw/usb/core.c |   10 +-
 hw/usb/desc.c |9 +-
 hw/usb/dev-bluetooth.c|2 +-
 hw/usb/dev-hid.c  |2 +-
 hw/usb/dev-hub.c  |   10 +-
 hw/usb/dev-network.c  |2 +-
 hw/usb/dev-smartcard-reader.c |2 +-
 hw/usb/dev-uas.c  |  247 +++---
 hw/usb/dev-wacom.c|4 +-
 hw/usb/hcd-ehci.c |7 +-
 hw/usb/hcd-musb.c |2 +-
 hw/usb/hcd-ohci.c |4 +-
 hw/usb/hcd-uhci.c |2 +-
 hw/usb/hcd-xhci.c |  266 +
 trace-events  |6 +-
 16 files changed, 461 insertions(+), 124 deletions(-)

-- 
1.7.9.7

[Qemu-devel] [PATCH 2/4] [wip] core: usb3 streams

[Gerd Hoffmann]

---
 hw/usb.h  |   10 ++
 hw/usb/core.c |   10 ++
 hw/usb/dev-bluetooth.c|2 +-
 hw/usb/dev-hid.c  |2 +-
 hw/usb/dev-hub.c  |   10 +-
 hw/usb/dev-network.c  |2 +-
 hw/usb/dev-smartcard-reader.c |2 +-
 hw/usb/dev-wacom.c|4 ++--
 hw/usb/hcd-ehci.c |7 ---
 hw/usb/hcd-musb.c |2 +-
 hw/usb/hcd-ohci.c |4 ++--
 hw/usb/hcd-uhci.c |2 +-
 12 files changed, 31 insertions(+), 26 deletions(-)

diff --git a/hw/usb.h b/hw/usb.h
index 0d09e02..382496c 100644
--- a/hw/usb.h
+++ b/hw/usb.h
@@ -361,6 +361,7 @@ struct USBPacket {
 int pid;
 uint64_t id;
 USBEndpoint *ep;
+unsigned int stream;
 QEMUIOVector iov;
 uint64_t parameter; /* control transfers */
 bool short_not_ok;
@@ -383,8 +384,9 @@ struct USBCombinedPacket {
 void usb_packet_init(USBPacket *p);
 void usb_packet_set_state(USBPacket *p, USBPacketState state);
 void usb_packet_check_state(USBPacket *p, USBPacketState expected);
-void usb_packet_setup(USBPacket *p, int pid, USBEndpoint *ep, uint64_t id,
-  bool short_not_ok, bool int_req);
+void usb_packet_setup(USBPacket *p, int pid,
+  USBEndpoint *ep, unsigned int stream,
+  uint64_t id, bool short_not_ok, bool int_req);
 void usb_packet_addbuf(USBPacket *p, void *ptr, size_t len);
 int usb_packet_map(USBPacket *p, QEMUSGList *sgl);
 void usb_packet_unmap(USBPacket *p, QEMUSGList *sgl);
@@ -430,7 +432,7 @@ void usb_attach(USBPort *port);
 void usb_detach(USBPort *port);
 void usb_port_reset(USBPort *port);
 void usb_device_reset(USBDevice *dev);
-void usb_wakeup(USBEndpoint *ep);
+void usb_wakeup(USBEndpoint *ep, unsigned int stream);
 void usb_generic_async_ctrl_complete(USBDevice *s, USBPacket *p);
 int set_usb_string(uint8_t *buf, const char *str);
 
@@ -489,7 +491,7 @@ struct USBBus {
 struct USBBusOps {
 int (*register_companion)(USBBus *bus, USBPort *ports[],
   uint32_t portcount, uint32_t firstport);
-void (*wakeup_endpoint)(USBBus *bus, USBEndpoint *ep);
+void (*wakeup_endpoint)(USBBus *bus, USBEndpoint *ep, unsigned int stream);
 };
 
 void usb_bus_new(USBBus *bus, USBBusOps *ops, DeviceState *host);
diff --git a/hw/usb/core.c b/hw/usb/core.c
index 674fef8..15a150a 100644
--- a/hw/usb/core.c
+++ b/hw/usb/core.c
@@ -71,7 +71,7 @@ void usb_device_reset(USBDevice *dev)
 usb_device_handle_reset(dev);
 }
 
-void usb_wakeup(USBEndpoint *ep)
+void usb_wakeup(USBEndpoint *ep, unsigned int stream)
 {
 USBDevice *dev = ep->dev;
 USBBus *bus = usb_bus_from_device(dev);
@@ -80,7 +80,7 @@ void usb_wakeup(USBEndpoint *ep)
 dev->port->ops->wakeup(dev->port);
 }
 if (bus->ops->wakeup_endpoint) {
-bus->ops->wakeup_endpoint(bus, ep);
+bus->ops->wakeup_endpoint(bus, ep, stream);
 }
 }
 
@@ -545,14 +545,16 @@ void usb_packet_set_state(USBPacket *p, USBPacketState 
state)
 p->state = state;
 }
 
-void usb_packet_setup(USBPacket *p, int pid, USBEndpoint *ep, uint64_t id,
-  bool short_not_ok, bool int_req)
+void usb_packet_setup(USBPacket *p, int pid,
+  USBEndpoint *ep, unsigned int stream,
+  uint64_t id, bool short_not_ok, bool int_req)
 {
 assert(!usb_packet_is_inflight(p));
 assert(p->iov.iov != NULL);
 p->id = id;
 p->pid = pid;
 p->ep = ep;
+p->stream = stream;
 p->status = USB_RET_SUCCESS;
 p->actual_length = 0;
 p->parameter = 0;
diff --git a/hw/usb/dev-bluetooth.c b/hw/usb/dev-bluetooth.c
index adbf9d4..0f8aa48 100644
--- a/hw/usb/dev-bluetooth.c
+++ b/hw/usb/dev-bluetooth.c
@@ -478,7 +478,7 @@ static void usb_bt_out_hci_packet_event(void *opaque,
 struct USBBtState *s = (struct USBBtState *) opaque;
 
 if (s->evt.len == 0) {
-usb_wakeup(s->intr);
+usb_wakeup(s->intr, 0);
 }
 usb_bt_fifo_enqueue(&s->evt, data, len);
 }
diff --git a/hw/usb/dev-hid.c b/hw/usb/dev-hid.c
index 29b6481..9701048 100644
--- a/hw/usb/dev-hid.c
+++ b/hw/usb/dev-hid.c
@@ -423,7 +423,7 @@ static void usb_hid_changed(HIDState *hs)
 {
 USBHIDState *us = container_of(hs, USBHIDState, hid);
 
-usb_wakeup(us->intr);
+usb_wakeup(us->intr, 0);
 }
 
 static void usb_hid_handle_reset(USBDevice *dev)
diff --git a/hw/usb/dev-hub.c b/hw/usb/dev-hub.c
index 79f2f46..504c98c 100644
--- a/hw/usb/dev-hub.c
+++ b/hw/usb/dev-hub.c
@@ -164,7 +164,7 @@ static void usb_hub_attach(USBPort *port1)
 } else {
 port->wPortStatus &= ~PORT_STAT_LOW_SPEED;
 }
-usb_wakeup(s->intr);
+usb_wakeup(s->intr, 0);
 }
 
 static void usb_hub_detach(USBPort *port1)
@@ -173,7 +173,7 @@ static void usb_hub_detach(USBPort *port1)
 USBHubPort *port = &s->ports[port1->index];
 
 trace_usb_hub_detach(s->dev.addr, port1->index + 1);
-usb_wakeup(s

[Qemu-devel] [PATCH 3/4] [wip] xhci: usb3 streams

[Gerd Hoffmann]

Signed-off-by: Gerd Hoffmann 
---
 hw/usb/hcd-xhci.c |  266 +++--
 trace-events  |6 +-
 2 files changed, 220 insertions(+), 52 deletions(-)

diff --git a/hw/usb/hcd-xhci.c b/hw/usb/hcd-xhci.c
index 5fb0c48..ce17e2a 100644
--- a/hw/usb/hcd-xhci.c
+++ b/hw/usb/hcd-xhci.c
@@ -34,8 +34,8 @@
 #else
 #define DPRINTF(...) do {} while (0)
 #endif
-#define FIXME() do { fprintf(stderr, "FIXME %s:%d\n", \
- __func__, __LINE__); abort(); } while (0)
+#define FIXME(_msg) do { fprintf(stderr, "FIXME %s:%d %s\n", \
+ __func__, __LINE__, _msg); abort(); } while 
(0)
 
 #define MAXPORTS_2 15
 #define MAXPORTS_3 15
@@ -301,6 +301,8 @@ typedef enum TRBCCode {
 #define SLOT_CONTEXT_ENTRIES_SHIFT 27
 
 typedef struct XHCIState XHCIState;
+typedef struct XHCIStreamContext XHCIStreamContext;
+typedef struct XHCIEPContext XHCIEPContext;
 
 #define get_field(data, field)  \
 (((data) >> field##_SHIFT) & field##_MASK)
@@ -351,6 +353,7 @@ typedef struct XHCITransfer {
 unsigned int iso_pkts;
 unsigned int slotid;
 unsigned int epid;
+unsigned int streamid;
 bool in_xfer;
 bool iso_xfer;
 
@@ -367,7 +370,14 @@ typedef struct XHCITransfer {
 uint64_t mfindex_kick;
 } XHCITransfer;
 
-typedef struct XHCIEPContext {
+struct XHCIStreamContext {
+dma_addr_t pctx;
+unsigned int sct;
+XHCIRing ring;
+XHCIStreamContext *sstreams;
+};
+
+struct XHCIEPContext {
 XHCIState *xhci;
 unsigned int slotid;
 unsigned int epid;
@@ -382,11 +392,17 @@ typedef struct XHCIEPContext {
 unsigned int max_psize;
 uint32_t state;
 
+/* streams */
+unsigned int max_pstreams;
+bool lsa;
+unsigned int nr_pstreams;
+XHCIStreamContext *pstreams;
+
 /* iso xfer scheduling */
 unsigned int interval;
 int64_t mfindex_last;
 QEMUTimer *kick_timer;
-} XHCIEPContext;
+};
 
 typedef struct XHCISlot {
 bool enabled;
@@ -482,7 +498,7 @@ enum xhci_flags {
 };
 
 static void xhci_kick_ep(XHCIState *xhci, unsigned int slotid,
- unsigned int epid);
+ unsigned int epid, unsigned int streamid);
 static TRBCCode xhci_disable_ep(XHCIState *xhci, unsigned int slotid,
 unsigned int epid);
 static void xhci_event(XHCIState *xhci, XHCIEvent *event, int v);
@@ -1068,18 +1084,112 @@ static void xhci_stop(XHCIState *xhci)
 xhci->crcr_low &= ~CRCR_CRR;
 }
 
+static XHCIStreamContext *xhci_alloc_stream_contexts(unsigned count,
+ dma_addr_t base)
+{
+XHCIStreamContext *stctx;
+unsigned int i;
+
+stctx = g_new0(XHCIStreamContext, count);
+for (i = 0; i < count; i++) {
+stctx[i].pctx = base + i * 16;
+stctx[i].sct = -1;
+}
+return stctx;
+}
+
+static void xhci_reset_streams(XHCIEPContext *epctx)
+{
+unsigned int i;
+
+for (i = 0; i < epctx->nr_pstreams; i++) {
+epctx->pstreams[i].sct = -1;
+g_free(epctx->pstreams[i].sstreams);
+}
+}
+
+static void xhci_alloc_streams(XHCIEPContext *epctx, dma_addr_t base)
+{
+assert(epctx->pstreams == NULL);
+epctx->nr_pstreams = 2 << epctx->max_pstreams;
+epctx->pstreams = xhci_alloc_stream_contexts(epctx->nr_pstreams, base);
+}
+
+static void xhci_free_streams(XHCIEPContext *epctx)
+{
+int i;
+
+assert(epctx->pstreams != NULL);
+
+if (!epctx->lsa) {
+for (i = 0; i < epctx->nr_pstreams; i++) {
+g_free(epctx->pstreams[i].sstreams);
+}
+}
+g_free(epctx->pstreams);
+epctx->pstreams = NULL;
+epctx->nr_pstreams = 0;
+}
+
+static XHCIStreamContext *xhci_find_stream(XHCIEPContext *epctx,
+   unsigned int streamid)
+{
+XHCIStreamContext *sctx;
+dma_addr_t base;
+uint32_t ctx[2];
+
+assert(streamid != 0);
+if (epctx->lsa) {
+if (streamid >= epctx->nr_pstreams) {
+return NULL;
+}
+sctx = epctx->pstreams + streamid;
+} else {
+FIXME("secondary streams not implemented yet");
+}
+
+if (sctx->sct == -1) {
+xhci_dma_read_u32s(epctx->xhci, sctx->pctx, ctx, sizeof(ctx));
+fprintf(stderr, "%s: init sctx #%d @ %lx: %08x %08x\n", __func__,
+streamid, sctx->pctx, ctx[0], ctx[1]);
+sctx->sct = (ctx[0] >> 1) & 0x07;
+if (sctx->sct != 1) {
+FIXME("must return error");
+}
+base = xhci_addr64(ctx[0] & ~0xf, ctx[1]);
+xhci_ring_init(epctx->xhci, &sctx->ring, base);
+}
+return sctx;
+}
+
 static void xhci_set_ep_state(XHCIState *xhci, XHCIEPContext *epctx,
-  uint32_t state)
+  XHCIStreamContext *sctx, uint32_t state)
 {
 uint32_t ctx[5];
+uint32_t ctx2[2];
 
+fprintf(stderr, "%s: epid %d, state %d\n",
+   

[Qemu-devel] [PATCH 4/4] [wip] uas: usb3 streams

[Gerd Hoffmann]

Signed-off-by: Gerd Hoffmann 
---
 hw/usb/dev-uas.c |  247 --
 1 file changed, 205 insertions(+), 42 deletions(-)

diff --git a/hw/usb/dev-uas.c b/hw/usb/dev-uas.c
index d904d1a..1ac5117 100644
--- a/hw/usb/dev-uas.c
+++ b/hw/usb/dev-uas.c
@@ -99,6 +99,9 @@ typedef struct {
 
 /* - */
 
+#define UAS_STREAM_BM_ATTR  4
+#define UAS_MAX_STREAMS (1 << UAS_STREAM_BM_ATTR)
+
 typedef struct UASDevice UASDevice;
 typedef struct UASRequest UASRequest;
 typedef struct UASStatus UASStatus;
@@ -106,12 +109,18 @@ typedef struct UASStatus UASStatus;
 struct UASDevice {
 USBDevice dev;
 SCSIBus   bus;
-UASRequest*datain;
-UASRequest*dataout;
-USBPacket *status;
 QEMUBH*status_bh;
 QTAILQ_HEAD(, UASStatus)  results;
 QTAILQ_HEAD(, UASRequest) requests;
+
+/* usb 2.0 only */
+USBPacket *status2;
+UASRequest*datain2;
+UASRequest*dataout2;
+
+/* usb 3.0 only */
+USBPacket *data3[UAS_MAX_STREAMS];
+USBPacket *status3[UAS_MAX_STREAMS];
 };
 
 struct UASRequest {
@@ -132,6 +141,7 @@ struct UASRequest {
 };
 
 struct UASStatus {
+uint32_t  stream;
 uas_uistatus;
 uint32_t  length;
 QTAILQ_ENTRY(UASStatus)   next;
@@ -144,6 +154,7 @@ enum {
 STR_PRODUCT,
 STR_SERIALNUMBER,
 STR_CONFIG_HIGH,
+STR_CONFIG_SUPER,
 };
 
 static const USBDescStrings desc_strings = {
@@ -151,6 +162,7 @@ static const USBDescStrings desc_strings = {
 [STR_PRODUCT]  = "USB Attached SCSI HBA",
 [STR_SERIALNUMBER] = "27842",
 [STR_CONFIG_HIGH]  = "High speed config (usb 2.0)",
+[STR_CONFIG_SUPER] = "Super speed config (usb 3.0)",
 };
 
 static const USBDescIface desc_iface_high = {
@@ -204,6 +216,64 @@ static const USBDescIface desc_iface_high = {
 }
 };
 
+static const USBDescIface desc_iface_super = {
+.bInterfaceNumber  = 0,
+.bNumEndpoints = 4,
+.bInterfaceClass   = USB_CLASS_MASS_STORAGE,
+.bInterfaceSubClass= 0x06, /* SCSI */
+.bInterfaceProtocol= 0x62, /* UAS  */
+.eps = (USBDescEndpoint[]) {
+{
+.bEndpointAddress  = USB_DIR_OUT | UAS_PIPE_ID_COMMAND,
+.bmAttributes  = USB_ENDPOINT_XFER_BULK,
+.wMaxPacketSize= 1024,
+.bMaxBurst = 15,
+.extra = (uint8_t[]) {
+0x04,  /*  u8  bLength */
+0x24,  /*  u8  bDescriptorType */
+UAS_PIPE_ID_COMMAND,
+0x00,  /*  u8  bReserved */
+},
+},{
+.bEndpointAddress  = USB_DIR_IN | UAS_PIPE_ID_STATUS,
+.bmAttributes  = USB_ENDPOINT_XFER_BULK,
+.wMaxPacketSize= 1024,
+.bMaxBurst = 15,
+.bmAttributes_super= UAS_STREAM_BM_ATTR,
+.extra = (uint8_t[]) {
+0x04,  /*  u8  bLength */
+0x24,  /*  u8  bDescriptorType */
+UAS_PIPE_ID_STATUS,
+0x00,  /*  u8  bReserved */
+},
+},{
+.bEndpointAddress  = USB_DIR_IN | UAS_PIPE_ID_DATA_IN,
+.bmAttributes  = USB_ENDPOINT_XFER_BULK,
+.wMaxPacketSize= 1024,
+.bMaxBurst = 15,
+.bmAttributes_super= UAS_STREAM_BM_ATTR,
+.extra = (uint8_t[]) {
+0x04,  /*  u8  bLength */
+0x24,  /*  u8  bDescriptorType */
+UAS_PIPE_ID_DATA_IN,
+0x00,  /*  u8  bReserved */
+},
+},{
+.bEndpointAddress  = USB_DIR_OUT | UAS_PIPE_ID_DATA_OUT,
+.bmAttributes  = USB_ENDPOINT_XFER_BULK,
+.wMaxPacketSize= 1024,
+.bMaxBurst = 15,
+.bmAttributes_super= UAS_STREAM_BM_ATTR,
+.extra = (uint8_t[]) {
+0x04,  /*  u8  bLength */
+0x24,  /*  u8  bDescriptorType */
+UAS_PIPE_ID_DATA_OUT,
+0x00,  /*  u8  bReserved */
+},
+},
+}
+};
+
 static const USBDescDevice desc_device_high = {
 .bcdUSB= 0x0200,
 .bMaxPacketSize0   = 64,
@@ -220,6 +290,22 @@ static const USBDescDevice desc_device_high = {
 },
 };
 
+static const USBDescDevice desc_device_super = {
+.bcdUSB= 0x0300,
+.bMaxPacketSize0   = 64,
+.bNumConfigurations= 1,
+.confs = (USBDescConfig[]) {
+{
+.bNumInterfaces= 1,
+.bConfigurati

Re: [Qemu-devel] [PATCH v3] tools/libxl: Improve videoram setting

[Fabio Fantoni]

Il 14/01/2013 19:21, Stefano Stabellini ha scritto:
I did a quick test and it seems that it should be possible to change 
the amount of videoram for stdvga too using the same command line 
option, however at the moment it just errors out. Therefore I am OK 
with this patch only taking care of Cirrus for the moment. 

I found details about stdvga on qemu upstream:
http://xenbits.xen.org/gitweb/?p=staging/qemu-upstream-unstable.git;a=blob_plain;f=docs/specs/standard-vga.txt;hb=HEAD

It seems that stdvga memory by default is 16 mb, while xen reserves only 
8 mb by default and doen't logs any error.
For cirrus, increasing memory seems to be correct and without error with 
my patch.
WIth both cirrus and stdvga under qemu upstream with xen the performance 
are really poor even if I increase video memory, respect to qemu-only 
and qemu-kvm (without xen).
Qxl is definitely not working under xen and conversely is ok on qemu-kvm 
and qemu-only.


It seem that xen need change and/or fix to have full working emulated 
vga on qemu upstream.
At the moment all emulated vgas have problems with xen that aren't 
present without xen.


The performance differences are noticeable (in some case very big) with 
xen and without xen using resolution > 1024x768.


Probably the first link explain the change/fix necessary in xen about 
vga (probably in hvmloader).
I tried to do that more times failing but unfortunately I do not have 
sufficient knowledge about this.

Can someone help me please?

I think this is important, years ago the minimal resolution used on 
desktop was 1024x768, and no problem with actual vga setting but now 
minimal resolution seems increased to up 1366x768 and many people are 
using even higher resolutions.

http://www.screenresolution.org/year-2013/



smime.p7s
Description: Firma crittografica S/MIME

[Qemu-devel] [PATCH 0/4] usb: make devices configurable

[Gerd Hoffmann]

  Hi,

This patch series makes usb devices configurable.

cheers,
  Gerd

Gerd Hoffmann (4):
  usb: Makefile cleanup
  fix scripts/make_device_config.sh
  make usb devices configurable
  allow disabling usb smartcard support

 default-configs/alpha-softmmu.mak|1 +
 default-configs/arm-softmmu.mak  |1 +
 default-configs/i386-softmmu.mak |1 +
 default-configs/m68k-softmmu.mak |1 +
 default-configs/mips-softmmu.mak |1 +
 default-configs/mips64-softmmu.mak   |1 +
 default-configs/mips64el-softmmu.mak |1 +
 default-configs/mipsel-softmmu.mak   |1 +
 default-configs/ppc-softmmu.mak  |1 +
 default-configs/ppc64-softmmu.mak|1 +
 default-configs/ppcemb-softmmu.mak   |1 +
 default-configs/sh4-softmmu.mak  |1 +
 default-configs/sh4eb-softmmu.mak|1 +
 default-configs/sparc64-softmmu.mak  |1 +
 default-configs/usb.mak  |8 
 default-configs/x86_64-softmmu.mak   |1 +
 hw/Makefile.objs |2 ++
 hw/usb/Makefile.objs |   31 ---
 scripts/make_device_config.sh|2 +-
 19 files changed, 50 insertions(+), 8 deletions(-)
 create mode 100644 default-configs/usb.mak

-- 
1.7.9.7

[Qemu-devel] [PATCH 1/4] usb: Makefile cleanup

[Gerd Hoffmann]

Group files, sprinkle in some comments.

Signed-off-by: Gerd Hoffmann 
---
 hw/usb/Makefile.objs |   27 ---
 1 file changed, 20 insertions(+), 7 deletions(-)

diff --git a/hw/usb/Makefile.objs b/hw/usb/Makefile.objs
index d1bbbc0..bfe5e5f 100644
--- a/hw/usb/Makefile.objs
+++ b/hw/usb/Makefile.objs
@@ -1,14 +1,27 @@
+# usb subsystem core
+common-obj-y += core.o combined-packet.o bus.o desc.o
+common-obj-y += libhw.o
+
+# usb host adapters
 common-obj-$(CONFIG_USB_UHCI) += hcd-uhci.o
 common-obj-$(CONFIG_USB_OHCI) += hcd-ohci.o
 common-obj-$(CONFIG_USB_EHCI) += hcd-ehci.o hcd-ehci-pci.o hcd-ehci-sysbus.o
 common-obj-$(CONFIG_USB_XHCI) += hcd-xhci.o
-common-obj-y += libhw.o
 
+# emulated usb devices
+common-obj-y += dev-hub.o
+common-obj-y += dev-hid.o
+common-obj-y += dev-wacom.o
+common-obj-y += dev-storage.o
+common-obj-y += dev-uas.o
+common-obj-y += dev-smartcard-reader.o
+common-obj-y += dev-audio.o
+common-obj-y += dev-serial.o
+common-obj-y += dev-network.o
+common-obj-y += dev-bluetooth.o
+
+# usb redirection
 common-obj-$(CONFIG_USB_REDIR) += redirect.o quirks.o
 
-common-obj-y += core.o combined-packet.o bus.o desc.o dev-hub.o
-common-obj-y += host-$(HOST_USB).o dev-bluetooth.o
-common-obj-y += dev-hid.o dev-storage.o dev-wacom.o
-common-obj-y += dev-serial.o dev-network.o dev-audio.o
-common-obj-y += dev-smartcard-reader.o
-common-obj-y += dev-uas.o
+# usb pass-through
+common-obj-y += host-$(HOST_USB).o
-- 
1.7.9.7

[Qemu-devel] [PATCH 3/4] make usb devices configurable

[Gerd Hoffmann]

Leave the core usb devices (usb hub, tablet, mouse, keyboard)
enabled unconditionally.  Make the other ones configurable.

Exceptions:
  - bluetooth: not qdevified yet, has a vl.c dependency because
of that, thus disabling isn't as easy as not linking the
object file.
  - smardcard: ccid-card-emulated depends on that one *and*
CONFIG_SMARTCARD_NSS.  I don't think we have an elegant
way to handle that.  RfC Makefile hack follows as separate
patch.

Signed-off-by: Gerd Hoffmann 
---
 default-configs/alpha-softmmu.mak|1 +
 default-configs/arm-softmmu.mak  |1 +
 default-configs/i386-softmmu.mak |1 +
 default-configs/m68k-softmmu.mak |1 +
 default-configs/mips-softmmu.mak |1 +
 default-configs/mips64-softmmu.mak   |1 +
 default-configs/mips64el-softmmu.mak |1 +
 default-configs/mipsel-softmmu.mak   |1 +
 default-configs/ppc-softmmu.mak  |1 +
 default-configs/ppc64-softmmu.mak|1 +
 default-configs/ppcemb-softmmu.mak   |1 +
 default-configs/sh4-softmmu.mak  |1 +
 default-configs/sh4eb-softmmu.mak|1 +
 default-configs/sparc64-softmmu.mak  |1 +
 default-configs/usb.mak  |8 
 default-configs/x86_64-softmmu.mak   |1 +
 hw/usb/Makefile.objs |   21 +
 17 files changed, 36 insertions(+), 8 deletions(-)
 create mode 100644 default-configs/usb.mak

diff --git a/default-configs/alpha-softmmu.mak 
b/default-configs/alpha-softmmu.mak
index 501dd41..2dbee94 100644
--- a/default-configs/alpha-softmmu.mak
+++ b/default-configs/alpha-softmmu.mak
@@ -1,6 +1,7 @@
 # Default configuration for alpha-softmmu
 
 include pci.mak
+include usb.mak
 CONFIG_SERIAL=y
 CONFIG_I8254=y
 CONFIG_PCKBD=y
diff --git a/default-configs/arm-softmmu.mak b/default-configs/arm-softmmu.mak
index 2f1a5c9..b40f7b0 100644
--- a/default-configs/arm-softmmu.mak
+++ b/default-configs/arm-softmmu.mak
@@ -1,6 +1,7 @@
 # Default configuration for arm-softmmu
 
 include pci.mak
+include usb.mak
 CONFIG_GDBSTUB_XML=y
 CONFIG_VGA=y
 CONFIG_ISA_MMIO=y
diff --git a/default-configs/i386-softmmu.mak b/default-configs/i386-softmmu.mak
index 2c78175..1b23025 100644
--- a/default-configs/i386-softmmu.mak
+++ b/default-configs/i386-softmmu.mak
@@ -1,6 +1,7 @@
 # Default configuration for i386-softmmu
 
 include pci.mak
+include usb.mak
 CONFIG_VGA=y
 CONFIG_VGA_PCI=y
 CONFIG_VGA_ISA=y
diff --git a/default-configs/m68k-softmmu.mak b/default-configs/m68k-softmmu.mak
index 3e2ec37..778ea82 100644
--- a/default-configs/m68k-softmmu.mak
+++ b/default-configs/m68k-softmmu.mak
@@ -1,5 +1,6 @@
 # Default configuration for m68k-softmmu
 
 include pci.mak
+include usb.mak
 CONFIG_GDBSTUB_XML=y
 CONFIG_PTIMER=y
diff --git a/default-configs/mips-softmmu.mak b/default-configs/mips-softmmu.mak
index a271b1c..4f04a33 100644
--- a/default-configs/mips-softmmu.mak
+++ b/default-configs/mips-softmmu.mak
@@ -1,6 +1,7 @@
 # Default configuration for mips-softmmu
 
 include pci.mak
+include usb.mak
 CONFIG_ISA_MMIO=y
 CONFIG_ESP=y
 CONFIG_VGA=y
diff --git a/default-configs/mips64-softmmu.mak 
b/default-configs/mips64-softmmu.mak
index 0510bb6..a5b6c3c 100644
--- a/default-configs/mips64-softmmu.mak
+++ b/default-configs/mips64-softmmu.mak
@@ -1,6 +1,7 @@
 # Default configuration for mips64-softmmu
 
 include pci.mak
+include usb.mak
 CONFIG_ISA_MMIO=y
 CONFIG_ESP=y
 CONFIG_VGA=y
diff --git a/default-configs/mips64el-softmmu.mak 
b/default-configs/mips64el-softmmu.mak
index ed3bed3..a0e6de8 100644
--- a/default-configs/mips64el-softmmu.mak
+++ b/default-configs/mips64el-softmmu.mak
@@ -1,6 +1,7 @@
 # Default configuration for mips64el-softmmu
 
 include pci.mak
+include usb.mak
 CONFIG_ISA_MMIO=y
 CONFIG_ESP=y
 CONFIG_VGA=y
diff --git a/default-configs/mipsel-softmmu.mak 
b/default-configs/mipsel-softmmu.mak
index fa3a2ca..753dd76 100644
--- a/default-configs/mipsel-softmmu.mak
+++ b/default-configs/mipsel-softmmu.mak
@@ -1,6 +1,7 @@
 # Default configuration for mipsel-softmmu
 
 include pci.mak
+include usb.mak
 CONFIG_ISA_MMIO=y
 CONFIG_ESP=y
 CONFIG_VGA=y
diff --git a/default-configs/ppc-softmmu.mak b/default-configs/ppc-softmmu.mak
index 1f4a1cf..f9f8a81 100644
--- a/default-configs/ppc-softmmu.mak
+++ b/default-configs/ppc-softmmu.mak
@@ -1,6 +1,7 @@
 # Default configuration for ppc-softmmu
 
 include pci.mak
+include usb.mak
 CONFIG_GDBSTUB_XML=y
 CONFIG_ISA_MMIO=y
 CONFIG_ESCC=y
diff --git a/default-configs/ppc64-softmmu.mak 
b/default-configs/ppc64-softmmu.mak
index 5ff406c..dc44294 100644
--- a/default-configs/ppc64-softmmu.mak
+++ b/default-configs/ppc64-softmmu.mak
@@ -1,6 +1,7 @@
 # Default configuration for ppc64-softmmu
 
 include pci.mak
+include usb.mak
 CONFIG_GDBSTUB_XML=y
 CONFIG_ISA_MMIO=y
 CONFIG_ESCC=y
diff --git a/default-configs/ppcemb-softmmu.mak 
b/default-configs/ppcemb-softmmu.mak
index aaa9cdc..1c6bcf9 100644
--- a/default-configs/ppcemb-softmmu.mak
+++ b/default-configs/ppcemb-softmmu.mak
@@ -

[Qemu-devel] [PATCH 2/4] fix scripts/make_device_config.sh

[Gerd Hoffmann]

Make it handle multiple include statements in a file.

Signed-off-by: Gerd Hoffmann 
---
 scripts/make_device_config.sh |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/make_device_config.sh b/scripts/make_device_config.sh
index 0778fe2..81fe942 100644
--- a/scripts/make_device_config.sh
+++ b/scripts/make_device_config.sh
@@ -18,7 +18,7 @@ process_includes () {
 
 f=$src
 while [ -n "$f" ] ; do
-  f=`tr -d '\r' < $f | awk '/^include / {printf "'$src_dir'/%s", $2}'`
+  f=`cat $f | tr -d '\r' | awk '/^include / {printf "'$src_dir'/%s ", $2}'`
   [ $? = 0 ] || exit 1
   all_includes="$all_includes $f"
 done
-- 
1.7.9.7

[Qemu-devel] [PATCH 4/4] allow disabling usb smartcard support

[Gerd Hoffmann]

Signed-off-by: Gerd Hoffmann 
---
 hw/Makefile.objs |2 ++
 hw/usb/Makefile.objs |1 -
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/hw/Makefile.objs b/hw/Makefile.objs
index 447e32a..a1f3a80 100644
--- a/hw/Makefile.objs
+++ b/hw/Makefile.objs
@@ -38,8 +38,10 @@ common-obj-$(CONFIG_DMA) += dma.o
 common-obj-$(CONFIG_I82374) += i82374.o
 common-obj-$(CONFIG_HPET) += hpet.o
 common-obj-$(CONFIG_APPLESMC) += applesmc.o
+ifeq ($(CONFIG_USB_SMARTCARD),y)
 common-obj-y += ccid-card-passthru.o
 common-obj-$(CONFIG_SMARTCARD_NSS) += ccid-card-emulated.o
+endif
 common-obj-$(CONFIG_I8259) += i8259_common.o i8259.o
 common-obj-y += fifo.o
 common-obj-y += pam.o
diff --git a/hw/usb/Makefile.objs b/hw/usb/Makefile.objs
index 3fb1396..be43366 100644
--- a/hw/usb/Makefile.objs
+++ b/hw/usb/Makefile.objs
@@ -20,7 +20,6 @@ common-obj-$(CONFIG_USB_NETWORK)  += dev-network.o
 
 # FIXME: make configurable too
 CONFIG_USB_BLUETOOTH := y
-CONFIG_USB_SMARTCARD := y
 common-obj-$(CONFIG_USB_BLUETOOTH)+= dev-bluetooth.o
 common-obj-$(CONFIG_USB_SMARTCARD)+= dev-smartcard-reader.o
 
-- 
1.7.9.7

Re: [Qemu-devel] [PATCH for-1.4] configure: Keep -Werror enabled for Release Candidates

[Andreas Färber]

Am 27.01.2013 16:20, schrieb Andreas Färber:
> Am 27.01.2013 16:16, schrieb Andreas Färber:
>> The automatic drop of -Werror during the RC phases has in the past led
>> to warnings creeping into submaintainer trees.
>>
>> Last QEMU Summit it was concluded that -Werror should stay on and
>> enabled only as part of the release process.
> 
> be disabled, obviously :)
> 
>> To relieve our release manager, instead of always enabling -Werror or
>> doing some number magic, let's enable it depending on whether a .git/
>> directory exists in the source tree.
>>
>> Signed-off-by: Andreas Färber 

Big PING for rc0!

Andreas

>> ---
>>  configure |2 +-
>>  1 Datei geändert, 1 Zeile hinzugefügt(+), 1 Zeile entfernt(-)
>>
>> diff --git a/configure b/configure
>> index b7635e4..0657b1a 100755
>> --- a/configure
>> +++ b/configure
>> @@ -1180,7 +1180,7 @@ fi
>>  z_version=`cut -f3 -d. $source_path/VERSION`
>>  
>>  if test -z "$werror" ; then
>> -if test "$z_version" = "50" -a \
>> +if test -d "$source_path/.git" -a \
>>  "$linux" = "yes" ; then
>>  werror="yes"
>>  else
> 


-- 
SUSE LINUX Products GmbH, Maxfeldstr. 5, 90409 Nürnberg, Germany
GF: Jeff Hawn, Jennifer Guild, Felix Imendörffer; HRB 16746 AG Nürnberg

[Qemu-devel] [PATCH qom-cpu-next 0/6] QOM CPUState, part 8: CPU_COMMON continued

[Andreas Färber]

Hello,

This series moves more fields from CPU_COMMON / CPU*State to CPUState,
allowing access from target-independent code.

The final patch in this series will help solve some issues (in particular
avoid a dependency on CPU_COMMON TLB refactoring for now) but opens a can
of worms: Since it is initialized in derived instance_init functions,
functions cannot randomly be changed to operate on CPUState and be called
from CPUState's instance_init or they will crash due to NULL env_ptr.

For those of you that may have been following the CPU refactorings closely,
I have now split off part of former qom-cpu-8 branch into qom-cpu-9.
This series thereby applies directly to qom-cpu-next,
whereas qom-cpu-9 depends on the pending s390x pull, my m68k cleanups and
may be changed for VMState changes cooking elsewhere to keep i386 v5 compat.

Available for testing at:
git://github.com/afaerber/qemu-cpu.git qom-cpu-8.v1
https://github.com/afaerber/qemu-cpu/commits/qom-cpu-8.v1

Regards,
Andreas

Changes from previews:
* Drop #ifdefs for user-only CPUState fields.
* Defer interrupt-related changes to part 9.

Andreas Färber (6):
  cpu: Move host_tid field to CPUState
  cpu: Move running field to CPUState
  cpu: Move exit_request field to CPUState
  cpu: Move current_tb field to CPUState
  cputlb: Pass CPUState to cpu_unlink_tb()
  cpu: Add CPUArchState pointer to CPUState

 cpu-exec.c  |   21 -
 cputlb.c|6 --
 dump.c  |8 ++--
 exec.c  |6 --
 gdbstub.c   |   14 +-
 hw/apic_common.c|2 +-
 hw/apic_internal.h  |2 +-
 hw/kvmvapic.c   |   13 -
 hw/spapr_hcall.c|5 +++--
 include/exec/cpu-defs.h |5 -
 include/exec/exec-all.h |4 +++-
 include/exec/gdbstub.h  |5 ++---
 include/qom/cpu.h   |   11 +++
 kvm-all.c   |6 +++---
 linux-user/main.c   |   37 ++---
 linux-user/syscall.c|4 +++-
 qom/cpu.c   |2 ++
 target-alpha/cpu.c  |2 ++
 target-arm/cpu.c|2 ++
 target-cris/cpu.c   |2 ++
 target-i386/cpu.c   |1 +
 target-i386/kvm.c   |4 ++--
 target-lm32/cpu.c   |2 ++
 target-m68k/cpu.c   |2 ++
 target-microblaze/cpu.c |2 ++
 target-mips/cpu.c   |2 ++
 target-openrisc/cpu.c   |2 ++
 target-ppc/translate_init.c |2 ++
 target-s390x/cpu.c  |2 ++
 target-sh4/cpu.c|2 ++
 target-sparc/cpu.c  |2 ++
 target-unicore32/cpu.c  |2 ++
 target-xtensa/cpu.c |2 ++
 translate-all.c |   36 +++-
 translate-all.h |2 +-
 35 Dateien geändert, 149 Zeilen hinzugefügt(+), 73 Zeilen entfernt(-)

-- 
1.7.10.4

[Qemu-devel] [PATCH qom-cpu-next 2/6] cpu: Move running field to CPUState

[Andreas Färber]

Pass CPUState to cpu_exec_{start,end}() functions.

Signed-off-by: Andreas Färber 
---
 include/exec/cpu-defs.h |1 -
 include/qom/cpu.h   |2 ++
 linux-user/main.c   |   37 ++---
 3 Dateien geändert, 24 Zeilen hinzugefügt(+), 16 Zeilen entfernt(-)

diff --git a/include/exec/cpu-defs.h b/include/exec/cpu-defs.h
index ae832a9..ba814ff 100644
--- a/include/exec/cpu-defs.h
+++ b/include/exec/cpu-defs.h
@@ -191,7 +191,6 @@ typedef struct CPUWatchpoint {
 int exception_index;\
 \
 CPUArchState *next_cpu; /* next CPU sharing TB cache */ \
-int running; /* Nonzero if cpu is currently running(usermode).  */  \
 /* user data */ \
 void *opaque;   \
 \
diff --git a/include/qom/cpu.h b/include/qom/cpu.h
index e371655..c465d88 100644
--- a/include/qom/cpu.h
+++ b/include/qom/cpu.h
@@ -66,6 +66,7 @@ struct kvm_run;
  * @nr_threads: Number of threads within this CPU.
  * @numa_node: NUMA node this CPU is belonging to.
  * @host_tid: Host thread ID.
+ * @running: #true if CPU is currently running (usermode).
  * @created: Indicates whether the CPU thread has been successfully created.
  * @stop: Indicates a pending stop request.
  * @stopped: Indicates the CPU has been artificially stopped.
@@ -88,6 +89,7 @@ struct CPUState {
 #endif
 int thread_id;
 uint32_t host_tid;
+bool running;
 struct QemuCond *halt_cond;
 struct qemu_work_item *queued_work_first, *queued_work_last;
 bool thread_kicked;
diff --git a/linux-user/main.c b/linux-user/main.c
index 3df8aa2..d97ff86 100644
--- a/linux-user/main.c
+++ b/linux-user/main.c
@@ -151,13 +151,16 @@ static inline void exclusive_idle(void)
 static inline void start_exclusive(void)
 {
 CPUArchState *other;
+CPUState *other_cpu;
+
 pthread_mutex_lock(&exclusive_lock);
 exclusive_idle();
 
 pending_cpus = 1;
 /* Make all other cpus stop executing.  */
 for (other = first_cpu; other; other = other->next_cpu) {
-if (other->running) {
+other_cpu = ENV_GET_CPU(other);
+if (other_cpu->running) {
 pending_cpus++;
 cpu_exit(other);
 }
@@ -176,19 +179,19 @@ static inline void end_exclusive(void)
 }
 
 /* Wait for exclusive ops to finish, and begin cpu execution.  */
-static inline void cpu_exec_start(CPUArchState *env)
+static inline void cpu_exec_start(CPUState *cpu)
 {
 pthread_mutex_lock(&exclusive_lock);
 exclusive_idle();
-env->running = 1;
+cpu->running = true;
 pthread_mutex_unlock(&exclusive_lock);
 }
 
 /* Mark cpu as not executing, and release pending exclusive ops.  */
-static inline void cpu_exec_end(CPUArchState *env)
+static inline void cpu_exec_end(CPUState *cpu)
 {
 pthread_mutex_lock(&exclusive_lock);
-env->running = 0;
+cpu->running = false;
 if (pending_cpus > 1) {
 pending_cpus--;
 if (pending_cpus == 1) {
@@ -210,11 +213,11 @@ void cpu_list_unlock(void)
 }
 #else /* if !CONFIG_USE_NPTL */
 /* These are no-ops because we are not threadsafe.  */
-static inline void cpu_exec_start(CPUArchState *env)
+static inline void cpu_exec_start(CPUState *cpu)
 {
 }
 
-static inline void cpu_exec_end(CPUArchState *env)
+static inline void cpu_exec_end(CPUState *cpu)
 {
 }
 
@@ -697,15 +700,16 @@ done:
 
 void cpu_loop(CPUARMState *env)
 {
+CPUState *cs = CPU(arm_env_get_cpu(env));
 int trapnr;
 unsigned int n, insn;
 target_siginfo_t info;
 uint32_t addr;
 
 for(;;) {
-cpu_exec_start(env);
+cpu_exec_start(cs);
 trapnr = cpu_arm_exec(env);
-cpu_exec_end(env);
+cpu_exec_end(cs);
 switch(trapnr) {
 case EXCP_UDEF:
 {
@@ -912,14 +916,15 @@ void cpu_loop(CPUARMState *env)
 
 void cpu_loop(CPUUniCore32State *env)
 {
+CPUState *cs = CPU(uc32_env_get_cpu(env));
 int trapnr;
 unsigned int n, insn;
 target_siginfo_t info;
 
 for (;;) {
-cpu_exec_start(env);
+cpu_exec_start(cs);
 trapnr = uc32_cpu_exec(env);
-cpu_exec_end(env);
+cpu_exec_end(cs);
 switch (trapnr) {
 case UC32_EXCP_PRIV:
 {
@@ -1367,14 +1372,15 @@ static int do_store_exclusive(CPUPPCState *env)
 
 void cpu_loop(CPUPPCState *env)
 {
+CPUState *cs = CPU(ppc_env_get_cpu(env));
 target_siginfo_t info;
 int trapnr;
 target_ulong ret;
 
 for(;;) {
-cpu_exec_start(env);
+cpu_exec_start(cs);
 trapnr = cpu_ppc_exec(env);
-cpu_exec_end(env);
+cpu_exec_end(cs);
 switch(trapnr) {
 case POWERPC_EXCP_NONE:
 /* Just go on */
@@ -2184,14 +2190,15 @@ stati

[Qemu-devel] [PATCH qom-cpu-next 5/6] cputlb: Pass CPUState to cpu_unlink_tb()

[Andreas Färber]

CPUArchState is no longer needed.

Signed-off-by: Andreas Färber 
---
 exec.c  |2 +-
 translate-all.c |9 +
 translate-all.h |2 +-
 3 Dateien geändert, 7 Zeilen hinzugefügt(+), 6 Zeilen entfernt(-)

diff --git a/exec.c b/exec.c
index dbb893a..a41bcb8 100644
--- a/exec.c
+++ b/exec.c
@@ -495,7 +495,7 @@ void cpu_exit(CPUArchState *env)
 CPUState *cpu = ENV_GET_CPU(env);
 
 cpu->exit_request = 1;
-cpu_unlink_tb(env);
+cpu_unlink_tb(cpu);
 }
 
 void cpu_abort(CPUArchState *env, const char *fmt, ...)
diff --git a/translate-all.c b/translate-all.c
index 0122fc5..19bc414 100644
--- a/translate-all.c
+++ b/translate-all.c
@@ -1425,13 +1425,12 @@ void tb_invalidate_phys_addr(hwaddr addr)
 }
 #endif /* TARGET_HAS_ICE && !defined(CONFIG_USER_ONLY) */
 
-void cpu_unlink_tb(CPUArchState *env)
+void cpu_unlink_tb(CPUState *cpu)
 {
 /* FIXME: TB unchaining isn't SMP safe.  For now just ignore the
problem and hope the cpu will stop of its own accord.  For userspace
emulation this often isn't actually as bad as it sounds.  Often
signals are used primarily to interrupt blocking syscalls.  */
-CPUState *cpu = ENV_GET_CPU(env);
 TranslationBlock *tb;
 static spinlock_t interrupt_lock = SPIN_LOCK_UNLOCKED;
 
@@ -1485,7 +1484,7 @@ static void tcg_handle_interrupt(CPUArchState *env, int 
mask)
 cpu_abort(env, "Raised interrupt while not in I/O function");
 }
 } else {
-cpu_unlink_tb(env);
+cpu_unlink_tb(cpu);
 }
 }
 
@@ -1625,8 +1624,10 @@ void dump_exec_info(FILE *f, fprintf_function 
cpu_fprintf)
 
 void cpu_interrupt(CPUArchState *env, int mask)
 {
+CPUState *cpu = ENV_GET_CPU(env);
+
 env->interrupt_request |= mask;
-cpu_unlink_tb(env);
+cpu_unlink_tb(cpu);
 }
 
 /*
diff --git a/translate-all.h b/translate-all.h
index b181fb4..5c38819 100644
--- a/translate-all.h
+++ b/translate-all.h
@@ -28,7 +28,7 @@
 
 /* translate-all.c */
 void tb_invalidate_phys_page_fast(tb_page_addr_t start, int len);
-void cpu_unlink_tb(CPUArchState *env);
+void cpu_unlink_tb(CPUState *cpu);
 void tb_check_watchpoint(CPUArchState *env);
 
 #endif /* TRANSLATE_ALL_H */
-- 
1.7.10.4

[Qemu-devel] [PATCH qom-cpu-next 3/6] cpu: Move exit_request field to CPUState

[Andreas Färber]

Since it was located before breakpoints field, it needs to be reset.

Signed-off-by: Andreas Färber 
---
 cpu-exec.c  |8 
 exec.c  |4 +++-
 hw/spapr_hcall.c|5 +++--
 include/exec/cpu-defs.h |2 --
 include/qom/cpu.h   |2 ++
 kvm-all.c   |6 +++---
 qom/cpu.c   |1 +
 target-i386/kvm.c   |4 ++--
 8 Dateien geändert, 18 Zeilen hinzugefügt(+), 14 Zeilen entfernt(-)

diff --git a/cpu-exec.c b/cpu-exec.c
index 19ebb4a..32f3559 100644
--- a/cpu-exec.c
+++ b/cpu-exec.c
@@ -198,7 +198,7 @@ int cpu_exec(CPUArchState *env)
 cpu_single_env = env;
 
 if (unlikely(exit_request)) {
-env->exit_request = 1;
+cpu->exit_request = 1;
 }
 
 #if defined(TARGET_I386)
@@ -539,8 +539,8 @@ int cpu_exec(CPUArchState *env)
 next_tb = 0;
 }
 }
-if (unlikely(env->exit_request)) {
-env->exit_request = 0;
+if (unlikely(cpu->exit_request)) {
+cpu->exit_request = 0;
 env->exception_index = EXCP_INTERRUPT;
 cpu_loop_exit(env);
 }
@@ -593,7 +593,7 @@ int cpu_exec(CPUArchState *env)
starting execution if there is a pending interrupt. */
 env->current_tb = tb;
 barrier();
-if (likely(!env->exit_request)) {
+if (likely(!cpu->exit_request)) {
 tc_ptr = tb->tc_ptr;
 /* execute the generated code */
 next_tb = tcg_qemu_tb_exec(env, tc_ptr);
diff --git a/exec.c b/exec.c
index b85508b..dbb893a 100644
--- a/exec.c
+++ b/exec.c
@@ -492,7 +492,9 @@ void cpu_reset_interrupt(CPUArchState *env, int mask)
 
 void cpu_exit(CPUArchState *env)
 {
-env->exit_request = 1;
+CPUState *cpu = ENV_GET_CPU(env);
+
+cpu->exit_request = 1;
 cpu_unlink_tb(env);
 }
 
diff --git a/hw/spapr_hcall.c b/hw/spapr_hcall.c
index 2889742..af1db6e 100644
--- a/hw/spapr_hcall.c
+++ b/hw/spapr_hcall.c
@@ -513,13 +513,14 @@ static target_ulong h_cede(PowerPCCPU *cpu, 
sPAPREnvironment *spapr,
target_ulong opcode, target_ulong *args)
 {
 CPUPPCState *env = &cpu->env;
+CPUState *cs = CPU(cpu);
 
 env->msr |= (1ULL << MSR_EE);
 hreg_compute_hflags(env);
-if (!cpu_has_work(CPU(cpu))) {
+if (!cpu_has_work(cs)) {
 env->halted = 1;
 env->exception_index = EXCP_HLT;
-env->exit_request = 1;
+cs->exit_request = 1;
 }
 return H_SUCCESS;
 }
diff --git a/include/exec/cpu-defs.h b/include/exec/cpu-defs.h
index ba814ff..ca39f05 100644
--- a/include/exec/cpu-defs.h
+++ b/include/exec/cpu-defs.h
@@ -26,7 +26,6 @@
 #include "config.h"
 #include 
 #include 
-#include 
 #include "qemu/osdep.h"
 #include "qemu/queue.h"
 #include "exec/hwaddr.h"
@@ -160,7 +159,6 @@ typedef struct CPUWatchpoint {
  memory was accessed */ \
 uint32_t halted; /* Nonzero if the CPU is in suspend state */   \
 uint32_t interrupt_request; \
-volatile sig_atomic_t exit_request; \
 CPU_COMMON_TLB  \
 struct TranslationBlock *tb_jmp_cache[TB_JMP_CACHE_SIZE];   \
 /* buffer for temporaries in the code generator */  \
diff --git a/include/qom/cpu.h b/include/qom/cpu.h
index c465d88..42f3f34 100644
--- a/include/qom/cpu.h
+++ b/include/qom/cpu.h
@@ -20,6 +20,7 @@
 #ifndef QEMU_CPU_H
 #define QEMU_CPU_H
 
+#include 
 #include "hw/qdev-core.h"
 #include "qemu/thread.h"
 
@@ -96,6 +97,7 @@ struct CPUState {
 bool created;
 bool stop;
 bool stopped;
+volatile sig_atomic_t exit_request;
 
 int kvm_fd;
 bool kvm_vcpu_dirty;
diff --git a/kvm-all.c b/kvm-all.c
index 04ec2d5..4decfdc 100644
--- a/kvm-all.c
+++ b/kvm-all.c
@@ -1537,7 +1537,7 @@ int kvm_cpu_exec(CPUArchState *env)
 DPRINTF("kvm_cpu_exec()\n");
 
 if (kvm_arch_process_async_events(cpu)) {
-env->exit_request = 0;
+cpu->exit_request = 0;
 return EXCP_HLT;
 }
 
@@ -1548,7 +1548,7 @@ int kvm_cpu_exec(CPUArchState *env)
 }
 
 kvm_arch_pre_run(cpu, run);
-if (env->exit_request) {
+if (cpu->exit_request) {
 DPRINTF("interrupt exit requested\n");
 /*
  * KVM requires us to reenter the kernel after IO exits to complete
@@ -1622,7 +1622,7 @@ int kvm_cpu_exec(CPUArchState *env)
 vm_stop(RUN_STATE_INTERNAL_ERROR);
 }
 
-env->exit_request = 0;
+cpu->exit_request = 0;
 return ret;
 }
 
diff --git a/qom/cpu.c b/qom/cpu.c
index 870e9ba..7d8c675 100644
--- a/qom/cpu.c
+++ b/qom/cpu.c
@@ -32,6 +32,7 @@ void cpu_reset(CPUState *cpu)
 
 static void cpu_common_reset(C

Re: [Qemu-devel] [RFC PATCH RDMA support v1: 5/5] send memory over RDMA as blocks are iterated

[Orit Wasserman]

On 01/31/2013 09:10 PM, Michael R. hines wrote:
> Sorry, I didn't go into enough detail about the problem I'm having in the 
> loop:
> 
> The loop that's not breaking is inside qemu_loadvm_state(), not 
> ram_save_block().
I understand now, ram_load always read the addr in the begining of the while 
loop.
You will need to change it if you have RDMA enabled and skip it, than you code 
will work.

You reminded me that RDMA requires both side to support it, for those kind of 
stuff
we introduced migration capabilities that the management (libvirt) or the user 
can verify
that both the source and destination can support it. See migrate_set_capability 
and info 
migrate_capabilities in the monitor for XBZRLE (compression).

Cheers,
Orit
> 
> This do-while loop is not exiting... is it necessary for me to maintain 
> this loop for RDMA purposes? Since there is explicit synchronization needed 
> at user-level to transmit an RDMA page?
> 
> Additionally: If I have to write a page into a new QEMUFileRDMA abstraction 
> for bandwidth accounting purposes, this would *significantly* slow down the 
> performance advantages of RDMA.
> 
> Is there a way to do the accounting without doing any additional memory 
> copies?
> 
> (If I'm understanding the abstraction properly)
> 
> - Michael
> 
> On 01/31/2013 01:56 PM, Orit Wasserman wrote:
>> On 01/31/2013 05:08 PM, Michael R. hines wrote:
>>> Yes, I was hoping for a comment about this in particular (before I send out 
>>> another patchest with the proper coverletter and so forth).
>>>
>>> So here's the problem I was experiencing inside savevm.c, 
>>> qemu_loadvm_state():
>>>
>>> I was having a little trouble serializing the client/server protocol in my 
>>> brain.
>>>
>>> When the server-side begins loading pages into ram, qemu_loadvm_state() 
>>> goes into a tight loop waiting for each memory page to be transmitted, 
>>> one-by-one.
>>>
>>> Now, for RDMA, this loop is not necessary, but the loop was stuck waiting 
>>> for TCP messages that did not need to be sent. So, the extra flag you saw 
>>> was a hack to break out of the loop
>>>
>>>  but according to you, I should bypass this loop entirely?
>>> Should I write a brand new function in savevm.c which skips this function?
>> no the pages are not sent one by one but actually are buffered 
>> (qemu_put_buffer writes them into a buffer).
>> This is done to ensure migration won't exceed it speed limit - i.e bandwidth 
>> capping.
>> You will need it also for RDMA, as the bandwidth of the RDMA is shared with 
>> guests, other migration processes and the host.
>>
>> You should not bypass the loop as you need to mark pages transferred as 
>> clean in the bitmap,
>> in order to exit the loop in ram_save_block just set bytes_sent to the page 
>> size which is what you are sending on the wire.
>> It is also uesd to calculated the amount of data sent during migration.
>>> Also, with the QEMUFileRDMA, I have a question: Since RDMA does not require 
>>> a file-like abstraction of any kind (meaning there is no explicit 
>>> handshaking during an RDMA transfer), should I really create one of these? 
>>> Unlike sockets and snapshot files that a typical migration would normally 
>>> need, an RDMA-based migration doesn't operate this way anymore.
>> Not sure I understand you question but you don't have to implement all the 
>> ops.
>>
>> Cheers,
>> Orit
>>> Thanks for all the comments ... keep them coming =)
>>>
>>> - Michael
>>>
>>>
>>> On 01/31/2013 06:04 AM, Orit Wasserman wrote:
 Hi Michael,
 I maybe missing something here but why do you need a RAM_SAVE_FLAG_RDMA 
 flag?
 You don't do any decoding in the destination.

 I would suggest creating a QEMUFileRDMA and moving the write/read code
 You can either add a new rdma_buffer QEMUFileOps or add the address to 
 put_buffer.

 you also have some white space damage in the beginning of savevm.c.

 Regards,
 Orit

 On 01/29/2013 12:01 AM, mrhi...@linux.vnet.ibm.com wrote
> From: "Michael R. Hines" 
>
>
> Signed-off-by: Michael R. Hines 
> ---
>arch_init.c   |  116 
> +++--
>include/migration/qemu-file.h |1 +
>savevm.c  |   90 +++-
>3 files changed, 189 insertions(+), 18 deletions(-)
>
> diff --git a/arch_init.c b/arch_init.c
> index dada6de..7633fa6 100644
> --- a/arch_init.c
> +++ b/arch_init.c
> @@ -42,6 +42,7 @@
>#include "migration/migration.h"
>#include "exec/gdbstub.h"
>#include "hw/smbios.h"
> +#include "qemu/rdma.h"
>#include "exec/address-spaces.h"
>#include "hw/pcspk.h"
>#include "migration/page_cache.h"
> @@ -113,6 +114,7 @@ const uint32_t arch_type = QEMU_ARCH;
>#define RAM_SAVE_FLAG_EOS  0x10
>#define RAM_SAVE_FLAG_CONTINUE 0x20
>#define R

[Qemu-devel] [PATCH qom-cpu-next 6/6] cpu: Add CPUArchState pointer to CPUState

[Andreas Färber]

The target-specific ENV_GET_CPU() macros have allowed us to navigate
from CPUArchState to CPUState. The reverse direction was not supported.
Avoid introducing CPU_GET_ENV() macros by initializing an untyped
pointer that is initialized in derived instance_init functions.

The field may not be called "env" due to it being poisoned.

Signed-off-by: Andreas Färber 
---
 include/qom/cpu.h   |2 ++
 target-alpha/cpu.c  |2 ++
 target-arm/cpu.c|2 ++
 target-cris/cpu.c   |2 ++
 target-i386/cpu.c   |1 +
 target-lm32/cpu.c   |2 ++
 target-m68k/cpu.c   |2 ++
 target-microblaze/cpu.c |2 ++
 target-mips/cpu.c   |2 ++
 target-openrisc/cpu.c   |2 ++
 target-ppc/translate_init.c |2 ++
 target-s390x/cpu.c  |2 ++
 target-sh4/cpu.c|2 ++
 target-sparc/cpu.c  |2 ++
 target-unicore32/cpu.c  |2 ++
 target-xtensa/cpu.c |2 ++
 16 Dateien geändert, 31 Zeilen hinzugefügt(+)

diff --git a/include/qom/cpu.h b/include/qom/cpu.h
index c25a997..ee1a7c8 100644
--- a/include/qom/cpu.h
+++ b/include/qom/cpu.h
@@ -71,6 +71,7 @@ struct kvm_run;
  * @created: Indicates whether the CPU thread has been successfully created.
  * @stop: Indicates a pending stop request.
  * @stopped: Indicates the CPU has been artificially stopped.
+ * @env_ptr: Pointer to subclass-specific CPUArchState field.
  * @current_tb: Currently executing TB.
  * @kvm_fd: vCPU file descriptor for KVM.
  *
@@ -100,6 +101,7 @@ struct CPUState {
 bool stopped;
 volatile sig_atomic_t exit_request;
 
+void *env_ptr; /* CPUArchState */
 struct TranslationBlock *current_tb;
 
 int kvm_fd;
diff --git a/target-alpha/cpu.c b/target-alpha/cpu.c
index 0cdae69..cec9989 100644
--- a/target-alpha/cpu.c
+++ b/target-alpha/cpu.c
@@ -233,9 +233,11 @@ static const TypeInfo ev68_cpu_type_info = {
 
 static void alpha_cpu_initfn(Object *obj)
 {
+CPUState *cs = CPU(obj);
 AlphaCPU *cpu = ALPHA_CPU(obj);
 CPUAlphaState *env = &cpu->env;
 
+cs->env_ptr = env;
 cpu_exec_init(env);
 tlb_flush(env, 1);
 
diff --git a/target-arm/cpu.c b/target-arm/cpu.c
index f54d200..5dfcb74 100644
--- a/target-arm/cpu.c
+++ b/target-arm/cpu.c
@@ -134,9 +134,11 @@ static inline void set_feature(CPUARMState *env, int 
feature)
 
 static void arm_cpu_initfn(Object *obj)
 {
+CPUState *cs = CPU(obj);
 ARMCPU *cpu = ARM_CPU(obj);
 static bool inited;
 
+cs->env_ptr = &cpu->env;
 cpu_exec_init(&cpu->env);
 cpu->cp_regs = g_hash_table_new_full(g_int_hash, g_int_equal,
  g_free, g_free);
diff --git a/target-cris/cpu.c b/target-cris/cpu.c
index fedf641..0bcc139 100644
--- a/target-cris/cpu.c
+++ b/target-cris/cpu.c
@@ -68,10 +68,12 @@ static void cris_cpu_realizefn(DeviceState *dev, Error 
**errp)
 
 static void cris_cpu_initfn(Object *obj)
 {
+CPUState *cs = CPU(obj);
 CRISCPU *cpu = CRIS_CPU(obj);
 CPUCRISState *env = &cpu->env;
 static bool tcg_initialized;
 
+cs->env_ptr = env;
 cpu_exec_init(env);
 
 if (tcg_enabled() && !tcg_initialized) {
diff --git a/target-i386/cpu.c b/target-i386/cpu.c
index ea0ce0b..8ad8f22 100644
--- a/target-i386/cpu.c
+++ b/target-i386/cpu.c
@@ -2164,6 +2164,7 @@ static void x86_cpu_initfn(Object *obj)
 CPUX86State *env = &cpu->env;
 static int inited;
 
+cs->env_ptr = env;
 cpu_exec_init(env);
 
 object_property_add(obj, "family", "int",
diff --git a/target-lm32/cpu.c b/target-lm32/cpu.c
index 5f16734..a2badb5 100644
--- a/target-lm32/cpu.c
+++ b/target-lm32/cpu.c
@@ -56,10 +56,12 @@ static void lm32_cpu_realizefn(DeviceState *dev, Error 
**errp)
 
 static void lm32_cpu_initfn(Object *obj)
 {
+CPUState *cs = CPU(obj);
 LM32CPU *cpu = LM32_CPU(obj);
 CPULM32State *env = &cpu->env;
 static bool tcg_initialized;
 
+cs->env_ptr = env;
 cpu_exec_init(env);
 
 env->flags = 0;
diff --git a/target-m68k/cpu.c b/target-m68k/cpu.c
index 42735db..f5a1098 100644
--- a/target-m68k/cpu.c
+++ b/target-m68k/cpu.c
@@ -154,10 +154,12 @@ static void m68k_cpu_realizefn(DeviceState *dev, Error 
**errp)
 
 static void m68k_cpu_initfn(Object *obj)
 {
+CPUState *cs = CPU(obj);
 M68kCPU *cpu = M68K_CPU(obj);
 CPUM68KState *env = &cpu->env;
 static bool inited;
 
+cs->env_ptr = env;
 cpu_exec_init(env);
 
 if (tcg_enabled() && !inited) {
diff --git a/target-microblaze/cpu.c b/target-microblaze/cpu.c
index 28b5a88..81359db 100644
--- a/target-microblaze/cpu.c
+++ b/target-microblaze/cpu.c
@@ -98,10 +98,12 @@ static void mb_cpu_realizefn(DeviceState *dev, Error **errp)
 
 static void mb_cpu_initfn(Object *obj)
 {
+CPUState *cs = CPU(obj);
 MicroBlazeCPU *cpu = MICROBLAZE_CPU(obj);
 CPUMBState *env = &cpu->env;
 static bool tcg_initialized;
 
+cs->env_ptr = env;
 cpu_exec_init(env);
 
 set_float_rounding_mode(flo

Re: [Qemu-devel] [PATCH v2] vmware_vga: fix out of bounds and invalid rects updating

[Michael Tokarev]

26.01.2013 19:09, Blue Swirl wrote:

Thanks, applied.


Now when I've comments from BALATON Zoltan, I asked Serge to try
out the current qemu in the environment where this buh was easy
to trigger (ubuntu guest with unity desktop) - and he says he
can't reproduce the issue anymore (this does not mean it does not
exist ofcourse).

So maybe this patch isn't really needed?  I dunno.

Thanks,

/mjt


On Fri, Jan 25, 2013 at 5:23 PM, Michael Tokarev  wrote:

This is a follow up for several attempts to fix this issue.

Previous incarnations:

1. http://thread.gmane.org/gmane.linux.ubuntu.bugs.general/3156089
https://bugs.launchpad.net/bugs/918791
"qemu-kvm dies when using vmvga driver and unity in the guest" bug.
Fix by Serge Hallyn:
  https://launchpadlibrarian.net/94916786/qemu-vmware.debdiff
This fix is incomplete, since it does not check width and height
for being negative.  Serge weren't sure if that's the right place
to fix it, maybe the fix should be up the stack somewhere.

2. http://thread.gmane.org/gmane.comp.emulators.qemu/166064
by Marek Vasut: "vmware_vga: Redraw only visible area"

This one adds the (incomplete) check to vmsvga_update_rect_delayed(),
the routine just queues the rect updating but does no interesting
stuff.  It is also incomplete in the same way as patch by Serge,
but also does not touch width&height at all after adjusting x&y,
which is wrong.

As far as I can see, when processing guest requests, the device
places them into a queue (vmsvga_update_rect_delayed()) and
processes this queue in different place/time, namely, in
vmsvga_update_rect().  Sometimes, vmsvga_update_rect() is
called directly, without placing the request to the gueue.
This is the place this patch changes, which is the last
(deepest) in the stack.  I'm not sure if this is the right
place still, since it is possible we have some queue optimization
(or may have in the future) which will be upset by negative/wrong
values here, so maybe we should check for validity of input
right when receiving request from the guest (and maybe even
use unsigned types there).  But I don't know the protocol
and implementation enough to have a definitive answer.

But since vmsvga_update_rect() has other sanity checks already,
I'm adding the missing ones there as well.

Cc'ing BALATON Zoltan and Andrzej Zaborowski who shows in `git blame'
output and may know something in this area.

If this patch is accepted, it should be applied to all active
stable branches (at least since 1.1, maybe even before), with
minor context change (ds_get_*(s->vga.ds) => s->*).  I'm not
Cc'ing -stable yet, will do it explicitly once the patch is
accepted.

BTW, these checks use fprintf(stderr) -- it should be converted
to something more appropriate, since stderr will most likely
disappear somewhere.

Cc: Marek Vasut 
CC: Serge Hallyn 
Cc: BALATON Zoltan 
Cc: Andrzej Zaborowski 
Signed-off-by: Michael Tokarev 
Reviewed-by: Marek Vasut 
Signed-off-by: Serge Hallyn 
---
  hw/vmware_vga.c |   18 ++
  1 file changed, 18 insertions(+)

diff --git a/hw/vmware_vga.c b/hw/vmware_vga.c
index 62771bb..cd15ee4 100644
--- a/hw/vmware_vga.c
+++ b/hw/vmware_vga.c
@@ -296,6 +296,15 @@ static inline void vmsvga_update_rect(struct 
vmsvga_state_s *s,
  uint8_t *src;
  uint8_t *dst;

+if (x < 0) {
+fprintf(stderr, "%s: update x was < 0 (%d)\n", __func__, x);
+w += x;
+x = 0;
+}
+if (w < 0) {
+fprintf(stderr, "%s: update w was < 0 (%d)\n", __func__, w);
+w = 0;
+}
  if (x + w > ds_get_width(s->vga.ds)) {
  fprintf(stderr, "%s: update width too large x: %d, w: %d\n",
  __func__, x, w);
@@ -303,6 +312,15 @@ static inline void vmsvga_update_rect(struct 
vmsvga_state_s *s,
  w = ds_get_width(s->vga.ds) - x;
  }

+if (y < 0) {
+fprintf(stderr, "%s: update y was < 0 (%d)\n",  __func__, y);
+h += y;
+y = 0;
+}
+if (h < 0) {
+fprintf(stderr, "%s: update h was < 0 (%d)\n",  __func__, h);
+h = 0;
+}
  if (y + h > ds_get_height(s->vga.ds)) {
  fprintf(stderr, "%s: update height too large y: %d, h: %d\n",
  __func__, y, h);
--
1.7.10.4

Re: [Qemu-devel] [PATCH v2] vmware_vga: fix out of bounds and invalid rects updating

[Marek Vasut]

Dear Michael Tokarev,

> 26.01.2013 19:09, Blue Swirl wrote:
> > Thanks, applied.
> 
> Now when I've comments from BALATON Zoltan, I asked Serge to try
> out the current qemu in the environment where this buh was easy
> to trigger (ubuntu guest with unity desktop) - and he says he
> can't reproduce the issue anymore (this does not mean it does not
> exist ofcourse).
> 
> So maybe this patch isn't really needed?  I dunno.

Or maybe the vmware driver was fixed on the host side. This doesn't mean there 
aren't buggy installations in the wild.

> Thanks,
> 
> /mjt
> 
> > On Fri, Jan 25, 2013 at 5:23 PM, Michael Tokarev  wrote:
> >> This is a follow up for several attempts to fix this issue.
> >> 
> >> Previous incarnations:
> >> 
> >> 1. http://thread.gmane.org/gmane.linux.ubuntu.bugs.general/3156089
> >> https://bugs.launchpad.net/bugs/918791
> >> "qemu-kvm dies when using vmvga driver and unity in the guest" bug.
> >> 
> >> Fix by Serge Hallyn:
> >>   https://launchpadlibrarian.net/94916786/qemu-vmware.debdiff
> >> 
> >> This fix is incomplete, since it does not check width and height
> >> for being negative.  Serge weren't sure if that's the right place
> >> to fix it, maybe the fix should be up the stack somewhere.
> >> 
> >> 2. http://thread.gmane.org/gmane.comp.emulators.qemu/166064
> >> by Marek Vasut: "vmware_vga: Redraw only visible area"
> >> 
> >> This one adds the (incomplete) check to vmsvga_update_rect_delayed(),
> >> the routine just queues the rect updating but does no interesting
> >> stuff.  It is also incomplete in the same way as patch by Serge,
> >> but also does not touch width&height at all after adjusting x&y,
> >> which is wrong.
> >> 
> >> As far as I can see, when processing guest requests, the device
> >> places them into a queue (vmsvga_update_rect_delayed()) and
> >> processes this queue in different place/time, namely, in
> >> vmsvga_update_rect().  Sometimes, vmsvga_update_rect() is
> >> called directly, without placing the request to the gueue.
> >> This is the place this patch changes, which is the last
> >> (deepest) in the stack.  I'm not sure if this is the right
> >> place still, since it is possible we have some queue optimization
> >> (or may have in the future) which will be upset by negative/wrong
> >> values here, so maybe we should check for validity of input
> >> right when receiving request from the guest (and maybe even
> >> use unsigned types there).  But I don't know the protocol
> >> and implementation enough to have a definitive answer.
> >> 
> >> But since vmsvga_update_rect() has other sanity checks already,
> >> I'm adding the missing ones there as well.
> >> 
> >> Cc'ing BALATON Zoltan and Andrzej Zaborowski who shows in `git blame'
> >> output and may know something in this area.
> >> 
> >> If this patch is accepted, it should be applied to all active
> >> stable branches (at least since 1.1, maybe even before), with
> >> minor context change (ds_get_*(s->vga.ds) => s->*).  I'm not
> >> Cc'ing -stable yet, will do it explicitly once the patch is
> >> accepted.
> >> 
> >> BTW, these checks use fprintf(stderr) -- it should be converted
> >> to something more appropriate, since stderr will most likely
> >> disappear somewhere.
> >> 
> >> Cc: Marek Vasut 
> >> CC: Serge Hallyn 
> >> Cc: BALATON Zoltan 
> >> Cc: Andrzej Zaborowski 
> >> Signed-off-by: Michael Tokarev 
> >> Reviewed-by: Marek Vasut 
> >> Signed-off-by: Serge Hallyn 
> >> ---
> >> 
> >>   hw/vmware_vga.c |   18 ++
> >>   1 file changed, 18 insertions(+)
> >> 
> >> diff --git a/hw/vmware_vga.c b/hw/vmware_vga.c
> >> index 62771bb..cd15ee4 100644
> >> --- a/hw/vmware_vga.c
> >> +++ b/hw/vmware_vga.c
> >> @@ -296,6 +296,15 @@ static inline void vmsvga_update_rect(struct
> >> vmsvga_state_s *s,
> >> 
> >>   uint8_t *src;
> >>   uint8_t *dst;
> >> 
> >> +if (x < 0) {
> >> +fprintf(stderr, "%s: update x was < 0 (%d)\n", __func__, x);
> >> +w += x;
> >> +x = 0;
> >> +}
> >> +if (w < 0) {
> >> +fprintf(stderr, "%s: update w was < 0 (%d)\n", __func__, w);
> >> +w = 0;
> >> +}
> >> 
> >>   if (x + w > ds_get_width(s->vga.ds)) {
> >>   
> >>   fprintf(stderr, "%s: update width too large x: %d, w: %d\n",
> >>   
> >>   __func__, x, w);
> >> 
> >> @@ -303,6 +312,15 @@ static inline void vmsvga_update_rect(struct
> >> vmsvga_state_s *s,
> >> 
> >>   w = ds_get_width(s->vga.ds) - x;
> >>   
> >>   }
> >> 
> >> +if (y < 0) {
> >> +fprintf(stderr, "%s: update y was < 0 (%d)\n",  __func__, y);
> >> +h += y;
> >> +y = 0;
> >> +}
> >> +if (h < 0) {
> >> +fprintf(stderr, "%s: update h was < 0 (%d)\n",  __func__, h);
> >> +h = 0;
> >> +}
> >> 
> >>   if (y + h > ds_get_height(s->vga.ds)) {
> >>   
> >>   fprintf(stderr, "%s: update height too large y: %d, h: %d\n",
> >>   
> >>   __func__,

[Qemu-devel] [PATCH 4/4] migration: calculate expected_downtime

[Juan Quintela]

We removed the calculation in commit e4ed1541ac9413eac494a03532e34beaf8a7d1c5

Now we add it back.  We need to create dirty_bytes_rate because we
can't include cpu-all.h from migration.c, and there is no other way to
include TARGET_PAGE_SIZE.

Signed-off-by: Juan Quintela 
---
 arch_init.c   | 1 +
 include/migration/migration.h | 1 +
 migration.c   | 5 +
 3 files changed, 7 insertions(+)

diff --git a/arch_init.c b/arch_init.c
index dada6de..634490a 100644
--- a/arch_init.c
+++ b/arch_init.c
@@ -414,6 +414,7 @@ static void migration_bitmap_sync(void)
 if (end_time > start_time + 1000) {
 s->dirty_pages_rate = num_dirty_pages_period * 1000
 / (end_time - start_time);
+s->dirty_bytes_rate = s->dirty_pages_rate * TARGET_PAGE_SIZE;
 start_time = end_time;
 num_dirty_pages_period = 0;
 }
diff --git a/include/migration/migration.h b/include/migration/migration.h
index a8c9639..d121409 100644
--- a/include/migration/migration.h
+++ b/include/migration/migration.h
@@ -51,6 +51,7 @@ struct MigrationState
 int64_t downtime;
 int64_t expected_downtime;
 int64_t dirty_pages_rate;
+int64_t dirty_bytes_rate;
 bool enabled_capabilities[MIGRATION_CAPABILITY_MAX];
 int64_t xbzrle_cache_size;
 bool complete;
diff --git a/migration.c b/migration.c
index 64e75ca..4eca42e 100644
--- a/migration.c
+++ b/migration.c
@@ -746,6 +746,11 @@ static void *buffered_file_thread(void *opaque)
 DPRINTF("transferred %" PRIu64 " time_spent %" PRIu64
 " bandwidth %g max_size %" PRId64 "\n",
 transferred_bytes, time_spent, bandwidth, max_size);
+/* if we haven't sent anything, we don't want to recalculate
+   1 is a small enough number for our purposes */
+if (s->dirty_bytes_rate && transferred_bytes > 1) {
+s->expected_downtime = s->dirty_bytes_rate / bandwidth;
+}

 s->bytes_xfer = 0;
 sleep_time = 0;
-- 
1.8.1

[Qemu-devel] [PATCH 2/4] migration: calculate end time after we have sent the data

[Juan Quintela]

Signed-off-by: Juan Quintela 
---
 migration.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/migration.c b/migration.c
index d86946e..67abd12 100644
--- a/migration.c
+++ b/migration.c
@@ -681,7 +681,7 @@ static void *buffered_file_thread(void *opaque)
 qemu_mutex_unlock_iothread();

 while (true) {
-int64_t current_time = qemu_get_clock_ms(rt_clock);
+int64_t current_time;
 uint64_t pending_size;

 qemu_mutex_lock_iothread();
@@ -735,6 +735,7 @@ static void *buffered_file_thread(void *opaque)
 }
 }
 qemu_mutex_unlock_iothread();
+current_time = qemu_get_clock_ms(rt_clock);
 if (current_time >= initial_time + BUFFER_DELAY) {
 uint64_t transferred_bytes = s->bytes_xfer;
 uint64_t time_spent = current_time - initial_time;
-- 
1.8.1

[Qemu-devel] [PATCH 3/4] migration: don't account sleep time for calculating bandwidth

[Juan Quintela]

While we are sleeping we are not sending, so we should not use that
time to estimate our bandwidth.

Signed-off-by: Juan Quintela 
---
 migration.c | 5 -
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/migration.c b/migration.c
index 67abd12..64e75ca 100644
--- a/migration.c
+++ b/migration.c
@@ -666,6 +666,7 @@ static void *buffered_file_thread(void *opaque)
 {
 MigrationState *s = opaque;
 int64_t initial_time = qemu_get_clock_ms(rt_clock);
+int64_t sleep_time = 0;
 int64_t max_size = 0;
 bool last_round = false;
 int ret;
@@ -738,7 +739,7 @@ static void *buffered_file_thread(void *opaque)
 current_time = qemu_get_clock_ms(rt_clock);
 if (current_time >= initial_time + BUFFER_DELAY) {
 uint64_t transferred_bytes = s->bytes_xfer;
-uint64_t time_spent = current_time - initial_time;
+uint64_t time_spent = current_time - initial_time - sleep_time;
 double bandwidth = transferred_bytes / time_spent;
 max_size = bandwidth * migrate_max_downtime() / 100;

@@ -747,11 +748,13 @@ static void *buffered_file_thread(void *opaque)
 transferred_bytes, time_spent, bandwidth, max_size);

 s->bytes_xfer = 0;
+sleep_time = 0;
 initial_time = current_time;
 }
 if (!last_round && (s->bytes_xfer >= s->xfer_limit)) {
 /* usleep expects microseconds */
 g_usleep((initial_time + BUFFER_DELAY - current_time)*1000);
+sleep_time += qemu_get_clock_ms(rt_clock) - current_time;
 }
 ret = buffered_flush(s);
 if (ret < 0) {
-- 
1.8.1

[Qemu-devel] [PATCH qom-cpu-next 4/6] cpu: Move current_tb field to CPUState

[Andreas Färber]

Explictly NULL it on CPU reset since it was located before breakpoints.

Change vapic_report_tpr_access() argument to CPUState. This also
resolves the use of void* for cpu.h independence.
Change vAPIC patch_instruction() argument to X86CPU.

Signed-off-by: Andreas Färber 
---
 cpu-exec.c  |   13 -
 cputlb.c|6 --
 hw/apic_common.c|2 +-
 hw/apic_internal.h  |2 +-
 hw/kvmvapic.c   |   13 -
 include/exec/cpu-defs.h |1 -
 include/exec/exec-all.h |4 +++-
 include/qom/cpu.h   |3 +++
 qom/cpu.c   |1 +
 translate-all.c |   29 +++--
 10 Dateien geändert, 48 Zeilen hinzugefügt(+), 26 Zeilen entfernt(-)

diff --git a/cpu-exec.c b/cpu-exec.c
index 32f3559..83ddea4 100644
--- a/cpu-exec.c
+++ b/cpu-exec.c
@@ -34,7 +34,9 @@ bool qemu_cpu_has_work(CPUState *cpu)
 
 void cpu_loop_exit(CPUArchState *env)
 {
-env->current_tb = NULL;
+CPUState *cpu = ENV_GET_CPU(env);
+
+cpu->current_tb = NULL;
 longjmp(env->jmp_env, 1);
 }
 
@@ -56,6 +58,7 @@ void cpu_resume_from_signal(CPUArchState *env, void *puc)
 static void cpu_exec_nocache(CPUArchState *env, int max_cycles,
  TranslationBlock *orig_tb)
 {
+CPUState *cpu = ENV_GET_CPU(env);
 tcg_target_ulong next_tb;
 TranslationBlock *tb;
 
@@ -66,10 +69,10 @@ static void cpu_exec_nocache(CPUArchState *env, int 
max_cycles,
 
 tb = tb_gen_code(env, orig_tb->pc, orig_tb->cs_base, orig_tb->flags,
  max_cycles);
-env->current_tb = tb;
+cpu->current_tb = tb;
 /* execute the generated code */
 next_tb = tcg_qemu_tb_exec(env, tb->tc_ptr);
-env->current_tb = NULL;
+cpu->current_tb = NULL;
 
 if ((next_tb & 3) == 2) {
 /* Restore PC.  This may happen if async event occurs before
@@ -591,7 +594,7 @@ int cpu_exec(CPUArchState *env)
TB, but before it is linked into a potentially
infinite loop and becomes env->current_tb. Avoid
starting execution if there is a pending interrupt. */
-env->current_tb = tb;
+cpu->current_tb = tb;
 barrier();
 if (likely(!cpu->exit_request)) {
 tc_ptr = tb->tc_ptr;
@@ -625,7 +628,7 @@ int cpu_exec(CPUArchState *env)
 }
 }
 }
-env->current_tb = NULL;
+cpu->current_tb = NULL;
 /* reset soft MMU for next block (it can currently
only be set by a memory fault) */
 } /* for(;;) */
diff --git a/cputlb.c b/cputlb.c
index 88239c4..aba7e44 100644
--- a/cputlb.c
+++ b/cputlb.c
@@ -54,6 +54,7 @@ static const CPUTLBEntry s_cputlb_empty_entry = {
  */
 void tlb_flush(CPUArchState *env, int flush_global)
 {
+CPUState *cpu = ENV_GET_CPU(env);
 int i;
 
 #if defined(DEBUG_TLB)
@@ -61,7 +62,7 @@ void tlb_flush(CPUArchState *env, int flush_global)
 #endif
 /* must reset current TB so that interrupts cannot modify the
links while we are modifying them */
-env->current_tb = NULL;
+cpu->current_tb = NULL;
 
 for (i = 0; i < CPU_TLB_SIZE; i++) {
 int mmu_idx;
@@ -92,6 +93,7 @@ static inline void tlb_flush_entry(CPUTLBEntry *tlb_entry, 
target_ulong addr)
 
 void tlb_flush_page(CPUArchState *env, target_ulong addr)
 {
+CPUState *cpu = ENV_GET_CPU(env);
 int i;
 int mmu_idx;
 
@@ -110,7 +112,7 @@ void tlb_flush_page(CPUArchState *env, target_ulong addr)
 }
 /* must reset current TB so that interrupts cannot modify the
links while we are modifying them */
-env->current_tb = NULL;
+cpu->current_tb = NULL;
 
 addr &= TARGET_PAGE_MASK;
 i = (addr >> TARGET_PAGE_BITS) & (CPU_TLB_SIZE - 1);
diff --git a/hw/apic_common.c b/hw/apic_common.c
index 6e1b1e0..d8c9810 100644
--- a/hw/apic_common.c
+++ b/hw/apic_common.c
@@ -103,7 +103,7 @@ void apic_handle_tpr_access_report(DeviceState *d, 
target_ulong ip,
 {
 APICCommonState *s = DO_UPCAST(APICCommonState, busdev.qdev, d);
 
-vapic_report_tpr_access(s->vapic, &s->cpu->env, ip, access);
+vapic_report_tpr_access(s->vapic, CPU(s->cpu), ip, access);
 }
 
 void apic_report_irq_delivered(int delivered)
diff --git a/hw/apic_internal.h b/hw/apic_internal.h
index dcbbfd4..9265e52 100644
--- a/hw/apic_internal.h
+++ b/hw/apic_internal.h
@@ -143,7 +143,7 @@ bool apic_next_timer(APICCommonState *s, int64_t 
current_time);
 void apic_enable_tpr_access_reporting(DeviceState *d, bool enable);
 void apic_enable_vapic(DeviceState *d, hwaddr paddr);
 
-void vapic_report_tpr_access(DeviceState *dev, void *cpu, target_ulong ip,
+void vapic_report_tpr_access(DeviceState *dev, CPUState *cpu, target_ulong ip,
  TPRAccess access);
 
 #endif /* !QEMU_APIC_INTERNAL_H */
diff --git a/hw/kvmvapic.c b/hw/kvmvapic.c
ind

[Qemu-devel] [PATCH 1/4] migration: change initial value of expected_downtime

[Juan Quintela]

0 is a very bad initial value, what we are trying to get is
max_downtime, so that is a much better estimation.

Signed-off-by: Juan Quintela 
---
 migration.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/migration.c b/migration.c
index 77c1971..d86946e 100644
--- a/migration.c
+++ b/migration.c
@@ -782,6 +782,8 @@ void migrate_fd_connect(MigrationState *s)
 s->buffer = NULL;
 s->buffer_size = 0;
 s->buffer_capacity = 0;
+/* This is a best 1st approximation. ns to ms */
+s->expected_downtime = max_downtime/100;

 s->xfer_limit = s->bandwidth_limit / XFER_LIMIT_RATIO;
 s->complete = false;
-- 
1.8.1

[Qemu-devel] [PATCH 0/4] migration stats fixes

[Juan Quintela]

Hi

migration expected_downtime calculation was removed on commit
e4ed1541ac9413eac494a03532e34beaf8a7d1c5.

We add the calculation back.  Before doing the calculation we do:

- expected_downtime intial value is max_downtime.  Much, much better
  intial value than 0.

- we move when we measure the time.  We used to measure how much it
  took "before" we really sent the data.

- we introduce sleep_time concept.  While we are sleeping because we
  have sent all the allowed data for this second we shouldn't be
  accounting that time as "sending".

- last patch just introduces the re-calculation of expected_downtime.

It just changes the stats value.  Well, patchs 2 & 3 change the
bandwidth calculation for migration, but I think that we were
undercalculating it enough than it was a bug.

Without the 2 & 3 patches, the "expected_downtime" for an idle gust
was calculated as 80ms (with 30 ms default target value), and we ended
having a downtime of around 15ms.

With this patches applied, we calculate an expected downtime of around
15ms or so, and then we spent aroqund 18ms on downtime.  Notice that
we only calculate how much it takes to sent the rest of the RAM, it
just happens that there is some more data to sent that what we are calculating.

Review, please.

Later, Juan.


The following changes since commit 8a55ebf01507ab73cc458cfcd5b9cb856aba0b9e:

  Merge remote-tracking branch 'afaerber/qom-cpu' into staging (2013-01-31 
19:37:33 -0600)

are available in the git repository at:


  git://repo.or.cz/qemu/quintela.git stats.next

for you to fetch changes up to 791128495e3546ccc88dd037ea4dfd31eca14a56:

  migration: calculate expected_downtime (2013-02-01 13:22:37 +0100)


Juan Quintela (4):
  migration: change initial value of expected_downtime
  migration: calculate end time after we have sent the data
  migration: don't account sleep time for calculating bandwidth
  migration: calculate expected_downtime

 arch_init.c   |  1 +
 include/migration/migration.h |  1 +
 migration.c   | 15 +--
 3 files changed, 15 insertions(+), 2 deletions(-)

[Qemu-devel] [PATCH qom-cpu-next 1/6] cpu: Move host_tid field to CPUState

[Andreas Färber]

Change gdbstub's cpu_index() argument to CPUState now that CPUArchState
is no longer used.

Signed-off-by: Andreas Färber 
---
 dump.c  |8 ++--
 gdbstub.c   |   14 +-
 include/exec/cpu-defs.h |1 -
 include/exec/gdbstub.h  |5 ++---
 include/qom/cpu.h   |2 ++
 linux-user/syscall.c|4 +++-
 6 Dateien geändert, 22 Zeilen hinzugefügt(+), 12 Zeilen entfernt(-)

diff --git a/dump.c b/dump.c
index 4ed1fa8..a25f509 100644
--- a/dump.c
+++ b/dump.c
@@ -271,11 +271,13 @@ static int write_elf64_note(DumpState *s)
 static int write_elf64_notes(DumpState *s)
 {
 CPUArchState *env;
+CPUState *cpu;
 int ret;
 int id;
 
 for (env = first_cpu; env != NULL; env = env->next_cpu) {
-id = cpu_index(env);
+cpu = ENV_GET_CPU(env);
+id = cpu_index(cpu);
 ret = cpu_write_elf64_note(fd_write_vmcore, env, id, s);
 if (ret < 0) {
 dump_error(s, "dump: failed to write elf notes.\n");
@@ -321,11 +323,13 @@ static int write_elf32_note(DumpState *s)
 static int write_elf32_notes(DumpState *s)
 {
 CPUArchState *env;
+CPUState *cpu;
 int ret;
 int id;
 
 for (env = first_cpu; env != NULL; env = env->next_cpu) {
-id = cpu_index(env);
+cpu = ENV_GET_CPU(env);
+id = cpu_index(cpu);
 ret = cpu_write_elf32_note(fd_write_vmcore, env, id, s);
 if (ret < 0) {
 dump_error(s, "dump: failed to write elf notes.\n");
diff --git a/gdbstub.c b/gdbstub.c
index 6cd26f1..32dfea9 100644
--- a/gdbstub.c
+++ b/gdbstub.c
@@ -2066,9 +2066,11 @@ static void gdb_set_cpu_pc(GDBState *s, target_ulong pc)
 static CPUArchState *find_cpu(uint32_t thread_id)
 {
 CPUArchState *env;
+CPUState *cpu;
 
 for (env = first_cpu; env != NULL; env = env->next_cpu) {
-if (cpu_index(env) == thread_id) {
+cpu = ENV_GET_CPU(env);
+if (cpu_index(cpu) == thread_id) {
 return env;
 }
 }
@@ -2096,7 +2098,7 @@ static int gdb_handle_packet(GDBState *s, const char 
*line_buf)
 case '?':
 /* TODO: Make this return the correct value for user-mode.  */
 snprintf(buf, sizeof(buf), "T%02xthread:%02x;", GDB_SIGNAL_TRAP,
- cpu_index(s->c_cpu));
+ cpu_index(ENV_GET_CPU(s->c_cpu)));
 put_packet(s, buf);
 /* Remove all the breakpoints when this query is issued,
  * because gdb is doing and initial connect and the state
@@ -2391,7 +2393,8 @@ static int gdb_handle_packet(GDBState *s, const char 
*line_buf)
 } else if (strcmp(p,"sThreadInfo") == 0) {
 report_cpuinfo:
 if (s->query_cpu) {
-snprintf(buf, sizeof(buf), "m%x", cpu_index(s->query_cpu));
+snprintf(buf, sizeof(buf), "m%x",
+ cpu_index(ENV_GET_CPU(s->query_cpu)));
 put_packet(s, buf);
 s->query_cpu = s->query_cpu->next_cpu;
 } else
@@ -2512,6 +2515,7 @@ static void gdb_vm_state_change(void *opaque, int 
running, RunState state)
 {
 GDBState *s = gdbserver_state;
 CPUArchState *env = s->c_cpu;
+CPUState *cpu = ENV_GET_CPU(env);
 char buf[256];
 const char *type;
 int ret;
@@ -2540,7 +2544,7 @@ static void gdb_vm_state_change(void *opaque, int 
running, RunState state)
 }
 snprintf(buf, sizeof(buf),
  "T%02xthread:%02x;%swatch:" TARGET_FMT_lx ";",
- GDB_SIGNAL_TRAP, cpu_index(env), type,
+ GDB_SIGNAL_TRAP, cpu_index(cpu), type,
  env->watchpoint_hit->vaddr);
 env->watchpoint_hit = NULL;
 goto send_packet;
@@ -2573,7 +2577,7 @@ static void gdb_vm_state_change(void *opaque, int 
running, RunState state)
 ret = GDB_SIGNAL_UNKNOWN;
 break;
 }
-snprintf(buf, sizeof(buf), "T%02xthread:%02x;", ret, cpu_index(env));
+snprintf(buf, sizeof(buf), "T%02xthread:%02x;", ret, cpu_index(cpu));
 
 send_packet:
 put_packet(s, buf);
diff --git a/include/exec/cpu-defs.h b/include/exec/cpu-defs.h
index 2911b9f..ae832a9 100644
--- a/include/exec/cpu-defs.h
+++ b/include/exec/cpu-defs.h
@@ -191,7 +191,6 @@ typedef struct CPUWatchpoint {
 int exception_index;\
 \
 CPUArchState *next_cpu; /* next CPU sharing TB cache */ \
-uint32_t host_tid; /* host thread ID */ \
 int running; /* Nonzero if cpu is currently running(usermode).  */  \
 /* user data */ \
 void *opaque;   \
diff --git a/include/exec/gdbstub.h b/include/exec/gdbstub.h
index 49231fe..ba20afa 100644
--- a/include/exec/gdbstub.h
+++ b/include/exec/gdbstub.h
@@ -30,12 +30,11 @@

Re: [Qemu-devel] [PATCH 2/4] fix scripts/make_device_config.sh

[Andreas Färber]

Am 01.02.2013 13:00, schrieb Gerd Hoffmann:
> Make it handle multiple include statements in a file.
> 
> Signed-off-by: Gerd Hoffmann 
> ---
>  scripts/make_device_config.sh |2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/scripts/make_device_config.sh b/scripts/make_device_config.sh
> index 0778fe2..81fe942 100644
> --- a/scripts/make_device_config.sh
> +++ b/scripts/make_device_config.sh
> @@ -18,7 +18,7 @@ process_includes () {
>  
>  f=$src
>  while [ -n "$f" ] ; do
> -  f=`tr -d '\r' < $f | awk '/^include / {printf "'$src_dir'/%s", $2}'`
> +  f=`cat $f | tr -d '\r' | awk '/^include / {printf "'$src_dir'/%s ", $2}'`
>[ $? = 0 ] || exit 1
>all_includes="$all_includes $f"
>  done

The actual fix is appending a space? Or how does cat make a difference?

Cheers,
Andreas

-- 
SUSE LINUX Products GmbH, Maxfeldstr. 5, 90409 Nürnberg, Germany
GF: Jeff Hawn, Jennifer Guild, Felix Imendörffer; HRB 16746 AG Nürnberg

Re: [Qemu-devel] [PATCH V17 07/10] libqblock: libqblock API design and type defines

[Stefan Hajnoczi]

On Fri, Feb 01, 2013 at 01:51:21PM +0800, Wenchao Xia wrote:
> >>+typedef enum QBlockProtocol {
> >>+QB_PROTO_NONE = 0,
> >>+QB_PROTO_FILE,
> >>+QB_PROTO_MAX
> >>+} QBlockProtocol;
> >
> >What prevents libqblock from supporting all protocols?
> >
>   I think no problem exist in supporting all protocols, it just
> need more work to sort out the options in protocols, so removed
> them in 1st version.

Good to hear.

> >Are these struct definitions frozen?
> >
> >An application could do:
> >
> >QBlockFormatInfo info = ...;
> >QBlockFormatOptionsCOW opts = info.o_cow; /* broken */
> >
> >If QBlockFormatOptionsCOW changes size then the application can break.
> >It's hard to demand that applications don't use these structs directly
> >and once broken applications rely on it we may have a hard time arguing
> >with them that it's their fault the application is incompatible with new
> >versions of libqblock (even if we're technically right).
> >
>   The size may grow with new member added in tail, and have different
> cases:
> 1 user just switched the .so file.
>   It is OK, new added member are ignored.

No, it's not okay:

QBlockFormatOptionsCOW opts = old_info.o_cow;
QBlockFormatInfo new_info;
new_info.o_cow = opts; /* broken, only copies old fields */

http://davidz25.blogspot.de/2011/07/writing-c-library-part-5.html#abi-api-versioning
http://plan99.net/~mike/writing-shared-libraries.html

If you want to allow backwards-compatible changes to
QBlockFormatOptionsCOW in the future, then it needs to include padding.

> >What is the relationship between QBlockImage and its context?  Can I
> >have two contexts A and B like this:
> >
> >qb_image_ref(ctx_a, &qbi);
> >qb_image_unref(ctx_b, &qbi);
> >
> >Is this okay?
> >
>   it should be OK if block layer is thread safe in the future,
> a thread should own a context. But caller may need to make sure
> every context should call ref/unref as pairs.

Hmm...I still don't understand the relationship between QBlockImage and
a context.  Is it safe to use a QBlockImage with context B if it was
created with context A?  This should be documented.

It would be simpler if a QBlockImage is associated with a context.  Then
you can drop the context argument from functions that operate on a
QBlockImage.

If necessary for multi-threading, you can provide a function later that
associated a QBlockImage with a new context.  This allows applications
to use QBlockImage with more than one context.

> >>+/**
> >>+ * qb_location_info_delete: free a QBlockLocationInfo.
> >>+ *
> >>+ * @context: operation context.
> >>+ * @p_loc: pointer to the object, *p_loc would be set to NULL.
> >>+ */
> >>+QEMU_DLL_PUBLIC
> >>+void qb_location_info_delete(QBlockContext *context,
> >>+ QBlockLocationInfo **p_loc);
> >
> >Why are these functions necessary?  The user has the struct definitions
> >for QBlockLocationInfo so they can allocate/free them.
> >
>   More likely a helper function. For ABI libqblock allocate
> the struct instead of user, as a counter part free is also
> handered by libqblock, to make sure the new added member
> is not missed in free.

We need to be very disciplined about struct definitions that are exposed
to applications.  There are no compiler warnings when an application
copies a libqblock struct, so we cannot prevent (bad) applications from
breaking when the struct changes.

Either provide the struct definition with padding and allow the
application to allocate/free it - then you don't need these helper
functions.

Or hide the struct and manage allocation/freeing and field access with
accessor functions.

If you try to mix these approaches the ABI will break when the library
changes.

> >>+/* sync access */
> >>+/**
> >>+ * qb_read: block sync read.
> >>+ *
> >>+ * return number of bytes read, libqblock negative error value on fail.
> >>+ *
> >>+ * @context: operation context.
> >>+ * @qbi: pointer to QBlockImage.
> >>+ * @buf: buffer that receive the content.
> >>+ * @len: length to read.
> >>+ * @offset: offset in the block data.
> >>+ */
> >>+QEMU_DLL_PUBLIC
> >>+int32_t qb_read(QBlockContext *context,
> >>+QBlockImage *qbi,
> >>+uint8_t *buf,
> >>+uint32_t len,
> >>+uint64_t offset);
> >
> >The uint32_t len and int32_t return types don't match up.  The return
> >value needs to be int64_t to handle the full uint32_t range.
> >
> >However, the return value is only necessary if we want to do short
> >reads.  How about making the return value int with 0 on success and
> >negative on error?  Don't do short reads.
> >
>   I think change len to int32_t make more sense, this gives more
> flexibilty, if we found the implement or API inside may return
> a not completed operation.

Kevin: Does the block layer do short reads/writes?

> >>+/**
> >>+ * qb_formattype2str: translate libqblock format enum type to a string.
> >>+ *
> >>+ * return a pointer to the string, or NULL if type is not s

[Qemu-devel] [PATCH v2 0/9] main-loop: switch to g_poll(3) on POSIX hosts

[Stefan Hajnoczi]

Amos Kong  reported that file descriptors numbered higher
than 1024 could crash QEMU.  This is due to the fixed size of the fd_set type
used for select(2) event polling.

This series converts the main-loop.c and aio-posix.c select(2) calls to
g_poll(3).  This eliminates the fd_set type and allows QEMU to scale to high
numbers of file descriptors.

The g_poll(3) interface is a portable version of the poll(2) system call.  The
difference to select(2) is that fine-grained events (G_IO_IN, G_IO_OUT,
G_IO_HUP, G_IO_ERR, G_IO_PRI) can be monitored instead of just
read/write/exception.  Also, there is no limit to the file descriptor numbers
that may be used, allowing applications to scale to many file descriptors.  See
the documentation for details:

  http://developer.gnome.org/glib/2.28/glib-The-Main-Event-Loop.html#g-poll

The QEMU main loop works as follows today:

1. Call out to slirp, iohandlers, and glib sources to fill rfds/wfds/xfds with
   the file descriptors to select(2).
2. Perform the select(2) call.
3. Call out to slirp, iohandlers, and glib sources to handle events polled in
   rfds/wfds/xfds.

The plan of attack is as follows:

1. Replace select(2) with g_poll(3).  Use glue that converts between
   rfds/wfds/xfds and GPollFD so that the unconverted QEMU components still
   work.

2. Convert slirp, iohandlers, and glib source fill/poll functions to use
   GPollFD directly instead of rfds/wfds/xfds.

3. Drop the glue since all components now natively use GPollFD.

4. Convert aio-posix.c to g_poll(3) by reusing GPollFD.

I have tested that the series builds and is bisectable on Linux and Windows
hosts.  But I have not done extensive testing on other host platforms or with
long-term guests to check for performance regressions.

v2:
 * Replace custom Poller type with GArray [aliguori]

Stefan Hajnoczi (9):
  main-loop: fix select_ret uninitialized variable warning
  main-loop: switch to g_poll() on POSIX hosts
  main-loop: switch POSIX glib integration to GPollFD
  slirp: switch to GPollFD
  iohandler: switch to GPollFD
  main-loop: drop rfds/wfds/xfds for good
  aio: extract aio_dispatch() from aio_poll()
  aio: convert aio_poll() to g_poll(3)
  aio: support G_IO_HUP and G_IO_ERR

 aio-posix.c  | 130 ++-
 async.c  |   2 +
 include/block/aio.h  |   3 +
 include/qemu/main-loop.h |   4 +-
 iohandler.c  |  40 +---
 main-loop.c  | 156 ++-
 slirp/libslirp.h |   6 +-
 slirp/main.h |   1 -
 slirp/slirp.c| 136 -
 slirp/socket.c   |   9 ---
 slirp/socket.h   |   2 +
 stubs/slirp.c|   6 +-
 12 files changed, 270 insertions(+), 225 deletions(-)

-- 
1.8.1

[Qemu-devel] [PATCH v2 7/9] aio: extract aio_dispatch() from aio_poll()

[Stefan Hajnoczi]

We will need to loop over AioHandlers calling ->io_read()/->io_write()
when aio_poll() is converted from select(2) to g_poll(2).

Luckily the code for this already exists, extract it into the new
aio_dispatch() function.

Two small changes:

 * aio_poll() checks !node->deleted to avoid calling handlers that have
   been deleted.

 * Fix typo 'then' -> 'them' in aio_poll() comment.

Signed-off-by: Stefan Hajnoczi 
---
 aio-posix.c | 57 +++--
 1 file changed, 35 insertions(+), 22 deletions(-)

diff --git a/aio-posix.c b/aio-posix.c
index fe4dbb4..35131a3 100644
--- a/aio-posix.c
+++ b/aio-posix.c
@@ -129,30 +129,12 @@ bool aio_pending(AioContext *ctx)
 return false;
 }
 
-bool aio_poll(AioContext *ctx, bool blocking)
+static bool aio_dispatch(AioContext *ctx)
 {
-static struct timeval tv0;
 AioHandler *node;
-fd_set rdfds, wrfds;
-int max_fd = -1;
-int ret;
-bool busy, progress;
-
-progress = false;
-
-/*
- * If there are callbacks left that have been queued, we need to call then.
- * Do not call select in this case, because it is possible that the caller
- * does not need a complete flush (as is the case for qemu_aio_wait loops).
- */
-if (aio_bh_poll(ctx)) {
-blocking = false;
-progress = true;
-}
+bool progress = false;
 
 /*
- * Then dispatch any pending callbacks from the GSource.
- *
  * We have to walk very carefully in case qemu_aio_set_fd_handler is
  * called while we're walking.
  */
@@ -167,11 +149,15 @@ bool aio_poll(AioContext *ctx, bool blocking)
 node->pfd.revents = 0;
 
 /* See comment in aio_pending.  */
-if (revents & (G_IO_IN | G_IO_HUP | G_IO_ERR) && node->io_read) {
+if (!node->deleted &&
+(revents & (G_IO_IN | G_IO_HUP | G_IO_ERR)) &&
+node->io_read) {
 node->io_read(node->opaque);
 progress = true;
 }
-if (revents & (G_IO_OUT | G_IO_ERR) && node->io_write) {
+if (!node->deleted &&
+(revents & (G_IO_OUT | G_IO_ERR)) &&
+node->io_write) {
 node->io_write(node->opaque);
 progress = true;
 }
@@ -186,6 +172,33 @@ bool aio_poll(AioContext *ctx, bool blocking)
 g_free(tmp);
 }
 }
+return progress;
+}
+
+bool aio_poll(AioContext *ctx, bool blocking)
+{
+static struct timeval tv0;
+AioHandler *node;
+fd_set rdfds, wrfds;
+int max_fd = -1;
+int ret;
+bool busy, progress;
+
+progress = false;
+
+/*
+ * If there are callbacks left that have been queued, we need to call them.
+ * Do not call select in this case, because it is possible that the caller
+ * does not need a complete flush (as is the case for qemu_aio_wait loops).
+ */
+if (aio_bh_poll(ctx)) {
+blocking = false;
+progress = true;
+}
+
+if (aio_dispatch(ctx)) {
+progress = true;
+}
 
 if (progress && !blocking) {
 return true;
-- 
1.8.1

[Qemu-devel] [PATCH v2 5/9] iohandler: switch to GPollFD

[Stefan Hajnoczi]

Convert iohandler_select_fill() and iohandler_select_poll() to use
GPollFD instead of rfds/wfds/xfds.

Signed-off-by: Stefan Hajnoczi 
---
 include/qemu/main-loop.h |  4 ++--
 iohandler.c  | 40 ++--
 main-loop.c  |  4 ++--
 3 files changed, 34 insertions(+), 14 deletions(-)

diff --git a/include/qemu/main-loop.h b/include/qemu/main-loop.h
index e8059c3..0995288 100644
--- a/include/qemu/main-loop.h
+++ b/include/qemu/main-loop.h
@@ -297,8 +297,8 @@ void qemu_mutex_unlock_iothread(void);
 /* internal interfaces */
 
 void qemu_fd_register(int fd);
-void qemu_iohandler_fill(int *pnfds, fd_set *readfds, fd_set *writefds, fd_set 
*xfds);
-void qemu_iohandler_poll(fd_set *readfds, fd_set *writefds, fd_set *xfds, int 
rc);
+void qemu_iohandler_fill(GArray *pollfds);
+void qemu_iohandler_poll(GArray *pollfds, int rc);
 
 QEMUBH *qemu_bh_new(QEMUBHFunc *cb, void *opaque);
 void qemu_bh_schedule_idle(QEMUBH *bh);
diff --git a/iohandler.c b/iohandler.c
index 2523adc..ae2ef8f 100644
--- a/iohandler.c
+++ b/iohandler.c
@@ -39,6 +39,7 @@ typedef struct IOHandlerRecord {
 void *opaque;
 QLIST_ENTRY(IOHandlerRecord) next;
 int fd;
+int pollfds_idx;
 bool deleted;
 } IOHandlerRecord;
 
@@ -78,6 +79,7 @@ int qemu_set_fd_handler2(int fd,
 ioh->fd_read = fd_read;
 ioh->fd_write = fd_write;
 ioh->opaque = opaque;
+ioh->pollfds_idx = -1;
 ioh->deleted = 0;
 qemu_notify_event();
 }
@@ -92,38 +94,56 @@ int qemu_set_fd_handler(int fd,
 return qemu_set_fd_handler2(fd, NULL, fd_read, fd_write, opaque);
 }
 
-void qemu_iohandler_fill(int *pnfds, fd_set *readfds, fd_set *writefds, fd_set 
*xfds)
+void qemu_iohandler_fill(GArray *pollfds)
 {
 IOHandlerRecord *ioh;
 
 QLIST_FOREACH(ioh, &io_handlers, next) {
+int events = 0;
+
 if (ioh->deleted)
 continue;
 if (ioh->fd_read &&
 (!ioh->fd_read_poll ||
  ioh->fd_read_poll(ioh->opaque) != 0)) {
-FD_SET(ioh->fd, readfds);
-if (ioh->fd > *pnfds)
-*pnfds = ioh->fd;
+events |= G_IO_IN | G_IO_HUP | G_IO_ERR;
 }
 if (ioh->fd_write) {
-FD_SET(ioh->fd, writefds);
-if (ioh->fd > *pnfds)
-*pnfds = ioh->fd;
+events |= G_IO_OUT | G_IO_ERR;
+}
+if (events) {
+GPollFD pfd = {
+.fd = ioh->fd,
+.events = events,
+};
+ioh->pollfds_idx = pollfds->len;
+g_array_append_val(pollfds, pfd);
+} else {
+ioh->pollfds_idx = -1;
 }
 }
 }
 
-void qemu_iohandler_poll(fd_set *readfds, fd_set *writefds, fd_set *xfds, int 
ret)
+void qemu_iohandler_poll(GArray *pollfds, int ret)
 {
 if (ret > 0) {
 IOHandlerRecord *pioh, *ioh;
 
 QLIST_FOREACH_SAFE(ioh, &io_handlers, next, pioh) {
-if (!ioh->deleted && ioh->fd_read && FD_ISSET(ioh->fd, readfds)) {
+int revents = 0;
+
+if (!ioh->deleted && ioh->pollfds_idx != -1) {
+GPollFD *pfd = &g_array_index(pollfds, GPollFD,
+  ioh->pollfds_idx);
+revents = pfd->revents;
+}
+
+if (!ioh->deleted && ioh->fd_read &&
+(revents & (G_IO_IN | G_IO_HUP | G_IO_ERR))) {
 ioh->fd_read(ioh->opaque);
 }
-if (!ioh->deleted && ioh->fd_write && FD_ISSET(ioh->fd, writefds)) 
{
+if (!ioh->deleted && ioh->fd_write &&
+(revents & (G_IO_OUT | G_IO_ERR))) {
 ioh->fd_write(ioh->opaque);
 }
 
diff --git a/main-loop.c b/main-loop.c
index 49e97ff..313f369 100644
--- a/main-loop.c
+++ b/main-loop.c
@@ -505,9 +505,9 @@ int main_loop_wait(int nonblocking)
 slirp_update_timeout(&timeout);
 slirp_pollfds_fill(gpollfds);
 #endif
-qemu_iohandler_fill(&nfds, &rfds, &wfds, &xfds);
+qemu_iohandler_fill(gpollfds);
 ret = os_host_main_loop_wait(timeout);
-qemu_iohandler_poll(&rfds, &wfds, &xfds, ret);
+qemu_iohandler_poll(gpollfds, ret);
 #ifdef CONFIG_SLIRP
 slirp_pollfds_poll(gpollfds, (ret < 0));
 #endif
-- 
1.8.1

[Qemu-devel] [PATCH v2 9/9] aio: support G_IO_HUP and G_IO_ERR

[Stefan Hajnoczi]

aio-posix.c could not take advantage of G_IO_HUP and G_IO_ERR because
select(2) does not have equivalent events.  Now that g_poll(3) is used
we can support G_IO_HUP and G_IO_ERR.

Signed-off-by: Stefan Hajnoczi 
---
 aio-posix.c | 12 ++--
 1 file changed, 2 insertions(+), 10 deletions(-)

diff --git a/aio-posix.c b/aio-posix.c
index 7769927..1c5e601 100644
--- a/aio-posix.c
+++ b/aio-posix.c
@@ -88,8 +88,8 @@ void aio_set_fd_handler(AioContext *ctx,
 node->opaque = opaque;
 node->pollfds_idx = -1;
 
-node->pfd.events = (io_read ? G_IO_IN | G_IO_HUP : 0);
-node->pfd.events |= (io_write ? G_IO_OUT : 0);
+node->pfd.events = (io_read ? G_IO_IN | G_IO_HUP | G_IO_ERR : 0);
+node->pfd.events |= (io_write ? G_IO_OUT | G_IO_ERR : 0);
 }
 
 aio_notify(ctx);
@@ -112,13 +112,6 @@ bool aio_pending(AioContext *ctx)
 QLIST_FOREACH(node, &ctx->aio_handlers, node) {
 int revents;
 
-/*
- * FIXME: right now we cannot get G_IO_HUP and G_IO_ERR because
- * main-loop.c is still select based (due to the slirp legacy).
- * If main-loop.c ever switches to poll, G_IO_ERR should be
- * tested too.  Dispatching G_IO_ERR to both handlers should be
- * okay, since handlers need to be ready for spurious wakeups.
- */
 revents = node->pfd.revents & node->pfd.events;
 if (revents & (G_IO_IN | G_IO_HUP | G_IO_ERR) && node->io_read) {
 return true;
@@ -150,7 +143,6 @@ static bool aio_dispatch(AioContext *ctx)
 revents = node->pfd.revents & node->pfd.events;
 node->pfd.revents = 0;
 
-/* See comment in aio_pending.  */
 if (!node->deleted &&
 (revents & (G_IO_IN | G_IO_HUP | G_IO_ERR)) &&
 node->io_read) {
-- 
1.8.1

[Qemu-devel] [PATCH v2 6/9] main-loop: drop rfds/wfds/xfds for good

[Stefan Hajnoczi]

Now that all *_fill() and *_poll() functions use GPollFD we no longer
need rfds/wfds/xfds or pollfds_from_select()/pollfds_to_select().

>From now on everything uses GPollFD.

Signed-off-by: Stefan Hajnoczi 
---
 main-loop.c | 77 ++---
 1 file changed, 2 insertions(+), 75 deletions(-)

diff --git a/main-loop.c b/main-loop.c
index 313f369..587cc30 100644
--- a/main-loop.c
+++ b/main-loop.c
@@ -143,66 +143,8 @@ int qemu_init_main_loop(void)
 return 0;
 }
 
-static fd_set rfds, wfds, xfds;
-static int nfds;
 static int max_priority;
 
-/* Load rfds/wfds/xfds into gpollfds.  Will be removed a few commits later. */
-static void gpollfds_from_select(void)
-{
-int fd;
-for (fd = 0; fd <= nfds; fd++) {
-int events = 0;
-if (FD_ISSET(fd, &rfds)) {
-events |= G_IO_IN | G_IO_HUP | G_IO_ERR;
-}
-if (FD_ISSET(fd, &wfds)) {
-events |= G_IO_OUT | G_IO_ERR;
-}
-if (FD_ISSET(fd, &xfds)) {
-events |= G_IO_PRI;
-}
-if (events) {
-GPollFD pfd = {
-.fd = fd,
-.events = events,
-};
-g_array_append_val(gpollfds, pfd);
-}
-}
-}
-
-/* Store gpollfds revents into rfds/wfds/xfds.  Will be removed a few commits
- * later.
- */
-static void gpollfds_to_select(int ret)
-{
-int i;
-
-FD_ZERO(&rfds);
-FD_ZERO(&wfds);
-FD_ZERO(&xfds);
-
-if (ret <= 0) {
-return;
-}
-
-for (i = 0; i < gpollfds->len; i++) {
-int fd = g_array_index(gpollfds, GPollFD, i).fd;
-int revents = g_array_index(gpollfds, GPollFD, i).revents;
-
-if (revents & (G_IO_IN | G_IO_HUP | G_IO_ERR)) {
-FD_SET(fd, &rfds);
-}
-if (revents & (G_IO_OUT | G_IO_ERR)) {
-FD_SET(fd, &wfds);
-}
-if (revents & G_IO_PRI) {
-FD_SET(fd, &xfds);
-}
-}
-}
-
 #ifndef _WIN32
 static int glib_pollfds_idx;
 static int glib_n_poll_fds;
@@ -251,15 +193,8 @@ static int os_host_main_loop_wait(uint32_t timeout)
 qemu_mutex_unlock_iothread();
 }
 
-/* We'll eventually drop fd_set completely.  But for now we still have
- * *_fill() and *_poll() functions that use rfds/wfds/xfds.
- */
-gpollfds_from_select();
-
 ret = g_poll((GPollFD *)gpollfds->data, gpollfds->len, timeout);
 
-gpollfds_to_select(ret);
-
 if (timeout > 0) {
 qemu_mutex_lock_iothread();
 }
@@ -417,6 +352,8 @@ static int os_host_main_loop_wait(uint32_t timeout)
 WaitObjects *w = &wait_objects;
 gint poll_timeout;
 static struct timeval tv0;
+fd_set rfds, wfds, xfds;
+int nfds;
 
 /* XXX: need to suppress polling by better using win32 events */
 ret = 0;
@@ -463,10 +400,6 @@ static int os_host_main_loop_wait(uint32_t timeout)
  * improve socket latency.
  */
 
-/* This back-and-forth between GPollFDs and select(2) is temporary.  We'll
- * drop it in a couple of patches, I promise :).
- */
-gpollfds_from_select();
 FD_ZERO(&rfds);
 FD_ZERO(&wfds);
 FD_ZERO(&xfds);
@@ -478,7 +411,6 @@ static int os_host_main_loop_wait(uint32_t timeout)
 pollfds_poll(gpollfds, nfds, &rfds, &wfds, &xfds);
 }
 }
-gpollfds_to_select(select_ret || g_poll_ret);
 
 return select_ret || g_poll_ret;
 }
@@ -496,11 +428,6 @@ int main_loop_wait(int nonblocking)
 /* poll any events */
 g_array_set_size(gpollfds, 0); /* reset for new iteration */
 /* XXX: separate device handlers from system ones */
-nfds = -1;
-FD_ZERO(&rfds);
-FD_ZERO(&wfds);
-FD_ZERO(&xfds);
-
 #ifdef CONFIG_SLIRP
 slirp_update_timeout(&timeout);
 slirp_pollfds_fill(gpollfds);
-- 
1.8.1

Re: [Qemu-devel] [RFC 2/2] qbus_find_recursive(): the "free slots" constraint needs a dedicated error

[Laszlo Ersek]

On 01/31/13 19:24, Peter Maydell wrote:

> We should only be reporting one error:
> "we failed because you asked for this bus and it's full" should
> override the default "we failed to find this bus". We can fix
> that by having the recursion stop as soon as we get an error.

> I think the QMP caller should also only get one error.

> Why does the qmp user need to get QERR_BUS_NOT_FOUND?
> (it would be an incorrect error anyway in the case where
> we have the GENERIC_ERROR text, because we have in fact found
> the bus, we just couldn't use it.)

That's a good clear goal which I can stick to -- let the first /
innermost error (the one with the most specific human readable text
usually) prevail, no matter the client type.

Thanks!
Laszlo

[Qemu-devel] [QEMU]Installed qemu-img and qemu/qemu-img have different size

[harryxiyou]

Hi all,

I did following operations to install QEMU to my PC.

1. git clone git://git.qemu.org/qemu.git
2. cd qemu
3, git reset --hard v1.3.0
4, ./configure
5, make
6, sudo make install

After step 6, i did following jobs.

a: see size of qemu-img bin in qemu package
jiawei@jiawei-laptop:~/workshop4/qemu$ ls -alh ./qemu-img
-rwxr-xr-x 1 jiawei jiawei 586K 2013-02-01 11:24 ./qemu-img

b: see size of qemu-img bin in system
jiawei@jiawei-laptop:/usr/bin$ ls -alh ./qemu-img
-rwxr-xr-x 1 root root 219K 2013-01-16 00:33 ./qemu-img

Why do a and b have different size? Could anyone give me some
suggestions? Thanks in advance ;-)

-- 
Thanks
Harry Wei

Re: [Qemu-devel] [PATCH for-1.4 v2] block/raw-posix: Build fix for O_ASYNC

[Stefan Hajnoczi]

On Thu, Jan 31, 2013 at 03:40:14PM +0100, Andreas Färber wrote:
> Commit eeb6b45d48800e96f67ef2a5c80332557fd45ddb (block: raw-posix image
> file reopen) broke the build on OpenIndiana.
> 
> illumos has no O_ASYNC. Exclude it from flags to be compared
> and instead assert that it is not set where defined.
> 
> Cf. e61ab1da7e98357da47c54d8f893b9bd6ff2f7f9 for qemu-ga.
> 
> Cc: qemu-sta...@nongnu.org (1.3.x)
> Cc: Jeff Cody 
> Suggested-by: Paolo Bonzini 
> Signed-off-by: Andreas Färber 
> ---
>  v1 -> v2:
>  * Instead of excluding O_ASYNC from flag comparison only for CONFIG_SOLARIS,
>assert that O_ASYNC is not set if defined. Suggested by Paolo.
> 
>  block/raw-posix.c |   11 ++-
>  1 Datei geändert, 10 Zeilen hinzugefügt(+), 1 Zeile entfernt(-)

Thanks, applied to my block tree:
https://github.com/stefanha/qemu/commits/block

Stefan

[Qemu-devel] [PATCH v2 1/9] main-loop: fix select_ret uninitialized variable warning

[Stefan Hajnoczi]

Signed-off-by: Stefan Hajnoczi 
---
 main-loop.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/main-loop.c b/main-loop.c
index 6f52ac3..d0d8fe4 100644
--- a/main-loop.c
+++ b/main-loop.c
@@ -330,7 +330,8 @@ void qemu_fd_register(int fd)
 static int os_host_main_loop_wait(uint32_t timeout)
 {
 GMainContext *context = g_main_context_default();
-int select_ret, g_poll_ret, ret, i;
+int select_ret = 0;
+int g_poll_ret, ret, i;
 PollingEntry *pe;
 WaitObjects *w = &wait_objects;
 gint poll_timeout;
-- 
1.8.1

[Qemu-devel] [PATCH v2 3/9] main-loop: switch POSIX glib integration to GPollFD

[Stefan Hajnoczi]

Convert glib file descriptor polling from rfds/wfds/xfds to GPollFD.

The Windows code still needs poll_fds[] and n_poll_fds but they can now
become local variables.

Signed-off-by: Stefan Hajnoczi 
---
 main-loop.c | 71 +++--
 1 file changed, 22 insertions(+), 49 deletions(-)

diff --git a/main-loop.c b/main-loop.c
index f1dcd14..12b0213 100644
--- a/main-loop.c
+++ b/main-loop.c
@@ -145,8 +145,6 @@ int qemu_init_main_loop(void)
 
 static fd_set rfds, wfds, xfds;
 static int nfds;
-static GPollFD poll_fds[1024 * 2]; /* this is probably overkill */
-static int n_poll_fds;
 static int max_priority;
 
 /* Load rfds/wfds/xfds into gpollfds.  Will be removed a few commits later. */
@@ -206,65 +204,39 @@ static void gpollfds_to_select(int ret)
 }
 
 #ifndef _WIN32
-static void glib_select_fill(int *max_fd, fd_set *rfds, fd_set *wfds,
- fd_set *xfds, uint32_t *cur_timeout)
+static int glib_pollfds_idx;
+static int glib_n_poll_fds;
+
+static void glib_pollfds_fill(uint32_t *cur_timeout)
 {
 GMainContext *context = g_main_context_default();
-int i;
 int timeout = 0;
+int n;
 
 g_main_context_prepare(context, &max_priority);
 
-n_poll_fds = g_main_context_query(context, max_priority, &timeout,
-  poll_fds, ARRAY_SIZE(poll_fds));
-g_assert(n_poll_fds <= ARRAY_SIZE(poll_fds));
-
-for (i = 0; i < n_poll_fds; i++) {
-GPollFD *p = &poll_fds[i];
-
-if ((p->events & G_IO_IN)) {
-FD_SET(p->fd, rfds);
-*max_fd = MAX(*max_fd, p->fd);
-}
-if ((p->events & G_IO_OUT)) {
-FD_SET(p->fd, wfds);
-*max_fd = MAX(*max_fd, p->fd);
-}
-if ((p->events & G_IO_ERR)) {
-FD_SET(p->fd, xfds);
-*max_fd = MAX(*max_fd, p->fd);
-}
-}
+glib_pollfds_idx = gpollfds->len;
+n = glib_n_poll_fds;
+do {
+GPollFD *pfds;
+glib_n_poll_fds = n;
+g_array_set_size(gpollfds, glib_pollfds_idx + glib_n_poll_fds);
+pfds = &g_array_index(gpollfds, GPollFD, glib_pollfds_idx);
+n = g_main_context_query(context, max_priority, &timeout, pfds,
+ glib_n_poll_fds);
+} while (n != glib_n_poll_fds);
 
 if (timeout >= 0 && timeout < *cur_timeout) {
 *cur_timeout = timeout;
 }
 }
 
-static void glib_select_poll(fd_set *rfds, fd_set *wfds, fd_set *xfds,
- bool err)
+static void glib_pollfds_poll(void)
 {
 GMainContext *context = g_main_context_default();
+GPollFD *pfds = &g_array_index(gpollfds, GPollFD, glib_pollfds_idx);
 
-if (!err) {
-int i;
-
-for (i = 0; i < n_poll_fds; i++) {
-GPollFD *p = &poll_fds[i];
-
-if ((p->events & G_IO_IN) && FD_ISSET(p->fd, rfds)) {
-p->revents |= G_IO_IN;
-}
-if ((p->events & G_IO_OUT) && FD_ISSET(p->fd, wfds)) {
-p->revents |= G_IO_OUT;
-}
-if ((p->events & G_IO_ERR) && FD_ISSET(p->fd, xfds)) {
-p->revents |= G_IO_ERR;
-}
-}
-}
-
-if (g_main_context_check(context, max_priority, poll_fds, n_poll_fds)) {
+if (g_main_context_check(context, max_priority, pfds, glib_n_poll_fds)) {
 g_main_context_dispatch(context);
 }
 }
@@ -273,7 +245,7 @@ static int os_host_main_loop_wait(uint32_t timeout)
 {
 int ret;
 
-glib_select_fill(&nfds, &rfds, &wfds, &xfds, &timeout);
+glib_pollfds_fill(&timeout);
 
 if (timeout > 0) {
 qemu_mutex_unlock_iothread();
@@ -292,7 +264,7 @@ static int os_host_main_loop_wait(uint32_t timeout)
 qemu_mutex_lock_iothread();
 }
 
-glib_select_poll(&rfds, &wfds, &xfds, (ret < 0));
+glib_pollfds_poll();
 return ret;
 }
 #else
@@ -438,8 +410,9 @@ static void pollfds_poll(GArray *pollfds, int nfds, fd_set 
*rfds,
 static int os_host_main_loop_wait(uint32_t timeout)
 {
 GMainContext *context = g_main_context_default();
+GPollFD poll_fds[1024 * 2]; /* this is probably overkill */
 int select_ret = 0;
-int g_poll_ret, ret, i;
+int g_poll_ret, ret, i, n_poll_fds;
 PollingEntry *pe;
 WaitObjects *w = &wait_objects;
 gint poll_timeout;
-- 
1.8.1

[Qemu-devel] [PATCH v2 2/9] main-loop: switch to g_poll() on POSIX hosts

[Stefan Hajnoczi]

Use g_poll(3) instead of select(2).  Well, this is kind of a cheat.
It's true that we're now using g_poll(3) on POSIX hosts but the *_fill()
and *_poll() functions are still using rfds/wfds/xfds.

We've set the scene to start converting *_fill() and *_poll() functions
step-by-step until no more rfds/wfds/xfds users remain.  Then we'll drop
the temporary gpollfds_from_select() and gpollfds_to_select() functions
and be left with native g_poll(2).

On Windows things are a little crazy: convert from rfds/wfds/xfds to
GPollFDs, back to rfds/wfds/xfds, call select(2), rfds/wfds/xfds back to
GPollFDs, and finally back to rfds/wfds/xfds again.  This is only
temporary and keeps the Windows build working through the following
patches.  We'll drop this excessive conversion later and be left with a
single GPollFDs -> select(2) -> GPollFDs sequence that allows Windows to
use select(2) while the rest of QEMU only knows about GPollFD.

Signed-off-by: Stefan Hajnoczi 
---
 main-loop.c | 135 
 1 file changed, 127 insertions(+), 8 deletions(-)

diff --git a/main-loop.c b/main-loop.c
index d0d8fe4..f1dcd14 100644
--- a/main-loop.c
+++ b/main-loop.c
@@ -117,6 +117,8 @@ void qemu_notify_event(void)
 aio_notify(qemu_aio_context);
 }
 
+static GArray *gpollfds;
+
 int qemu_init_main_loop(void)
 {
 int ret;
@@ -133,6 +135,7 @@ int qemu_init_main_loop(void)
 return ret;
 }
 
+gpollfds = g_array_new(FALSE, FALSE, sizeof(GPollFD));
 qemu_aio_context = aio_context_new();
 src = aio_get_g_source(qemu_aio_context);
 g_source_attach(src, NULL);
@@ -146,6 +149,62 @@ static GPollFD poll_fds[1024 * 2]; /* this is probably 
overkill */
 static int n_poll_fds;
 static int max_priority;
 
+/* Load rfds/wfds/xfds into gpollfds.  Will be removed a few commits later. */
+static void gpollfds_from_select(void)
+{
+int fd;
+for (fd = 0; fd <= nfds; fd++) {
+int events = 0;
+if (FD_ISSET(fd, &rfds)) {
+events |= G_IO_IN | G_IO_HUP | G_IO_ERR;
+}
+if (FD_ISSET(fd, &wfds)) {
+events |= G_IO_OUT | G_IO_ERR;
+}
+if (FD_ISSET(fd, &xfds)) {
+events |= G_IO_PRI;
+}
+if (events) {
+GPollFD pfd = {
+.fd = fd,
+.events = events,
+};
+g_array_append_val(gpollfds, pfd);
+}
+}
+}
+
+/* Store gpollfds revents into rfds/wfds/xfds.  Will be removed a few commits
+ * later.
+ */
+static void gpollfds_to_select(int ret)
+{
+int i;
+
+FD_ZERO(&rfds);
+FD_ZERO(&wfds);
+FD_ZERO(&xfds);
+
+if (ret <= 0) {
+return;
+}
+
+for (i = 0; i < gpollfds->len; i++) {
+int fd = g_array_index(gpollfds, GPollFD, i).fd;
+int revents = g_array_index(gpollfds, GPollFD, i).revents;
+
+if (revents & (G_IO_IN | G_IO_HUP | G_IO_ERR)) {
+FD_SET(fd, &rfds);
+}
+if (revents & (G_IO_OUT | G_IO_ERR)) {
+FD_SET(fd, &wfds);
+}
+if (revents & G_IO_PRI) {
+FD_SET(fd, &xfds);
+}
+}
+}
+
 #ifndef _WIN32
 static void glib_select_fill(int *max_fd, fd_set *rfds, fd_set *wfds,
  fd_set *xfds, uint32_t *cur_timeout)
@@ -212,22 +271,22 @@ static void glib_select_poll(fd_set *rfds, fd_set *wfds, 
fd_set *xfds,
 
 static int os_host_main_loop_wait(uint32_t timeout)
 {
-struct timeval tv, *tvarg = NULL;
 int ret;
 
 glib_select_fill(&nfds, &rfds, &wfds, &xfds, &timeout);
 
-if (timeout < UINT32_MAX) {
-tvarg = &tv;
-tv.tv_sec = timeout / 1000;
-tv.tv_usec = (timeout % 1000) * 1000;
-}
-
 if (timeout > 0) {
 qemu_mutex_unlock_iothread();
 }
 
-ret = select(nfds + 1, &rfds, &wfds, &xfds, tvarg);
+/* We'll eventually drop fd_set completely.  But for now we still have
+ * *_fill() and *_poll() functions that use rfds/wfds/xfds.
+ */
+gpollfds_from_select();
+
+ret = g_poll((GPollFD *)gpollfds->data, gpollfds->len, timeout);
+
+gpollfds_to_select(ret);
 
 if (timeout > 0) {
 qemu_mutex_lock_iothread();
@@ -327,6 +386,55 @@ void qemu_fd_register(int fd)
FD_CONNECT | FD_WRITE | FD_OOB);
 }
 
+static int pollfds_fill(GArray *pollfds, fd_set *rfds, fd_set *wfds,
+fd_set *xfds)
+{
+int nfds = -1;
+int i;
+
+for (i = 0; i < pollfds->len; i++) {
+GPollFD *pfd = &g_array_index(pollfds, GPollFD, i);
+int fd = pfd->fd;
+int events = pfd->events;
+if (events & (G_IO_IN | G_IO_HUP | G_IO_ERR)) {
+FD_SET(fd, rfds);
+nfds = MAX(nfds, fd);
+}
+if (events & (G_IO_OUT | G_IO_ERR)) {
+FD_SET(fd, wfds);
+nfds = MAX(nfds, fd);
+}
+if (events & G_IO_PRI) {
+FD_SET(fd, xfds);
+nfds = MAX(nfds, fd);
+  

[Qemu-devel] [PATCH v2 8/9] aio: convert aio_poll() to g_poll(3)

[Stefan Hajnoczi]

AioHandler already has a GPollFD so we can directly use its
events/revents.

Add the int pollfds_idx field to AioContext so we can map g_poll(3)
results back to AioHandlers.

Reuse aio_dispatch() to invoke handlers after g_poll(3).

Signed-off-by: Stefan Hajnoczi 
---
 aio-posix.c | 67 +++--
 async.c |  2 ++
 include/block/aio.h |  3 +++
 3 files changed, 29 insertions(+), 43 deletions(-)

diff --git a/aio-posix.c b/aio-posix.c
index 35131a3..7769927 100644
--- a/aio-posix.c
+++ b/aio-posix.c
@@ -25,6 +25,7 @@ struct AioHandler
 IOHandler *io_write;
 AioFlushHandler *io_flush;
 int deleted;
+int pollfds_idx;
 void *opaque;
 QLIST_ENTRY(AioHandler) node;
 };
@@ -85,6 +86,7 @@ void aio_set_fd_handler(AioContext *ctx,
 node->io_write = io_write;
 node->io_flush = io_flush;
 node->opaque = opaque;
+node->pollfds_idx = -1;
 
 node->pfd.events = (io_read ? G_IO_IN | G_IO_HUP : 0);
 node->pfd.events |= (io_write ? G_IO_OUT : 0);
@@ -177,10 +179,7 @@ static bool aio_dispatch(AioContext *ctx)
 
 bool aio_poll(AioContext *ctx, bool blocking)
 {
-static struct timeval tv0;
 AioHandler *node;
-fd_set rdfds, wrfds;
-int max_fd = -1;
 int ret;
 bool busy, progress;
 
@@ -206,12 +205,13 @@ bool aio_poll(AioContext *ctx, bool blocking)
 
 ctx->walking_handlers++;
 
-FD_ZERO(&rdfds);
-FD_ZERO(&wrfds);
+g_array_set_size(ctx->pollfds, 0);
 
-/* fill fd sets */
+/* fill pollfds */
 busy = false;
 QLIST_FOREACH(node, &ctx->aio_handlers, node) {
+node->pollfds_idx = -1;
+
 /* If there aren't pending AIO operations, don't invoke callbacks.
  * Otherwise, if there are no AIO requests, qemu_aio_wait() would
  * wait indefinitely.
@@ -222,13 +222,13 @@ bool aio_poll(AioContext *ctx, bool blocking)
 }
 busy = true;
 }
-if (!node->deleted && node->io_read) {
-FD_SET(node->pfd.fd, &rdfds);
-max_fd = MAX(max_fd, node->pfd.fd + 1);
-}
-if (!node->deleted && node->io_write) {
-FD_SET(node->pfd.fd, &wrfds);
-max_fd = MAX(max_fd, node->pfd.fd + 1);
+if (!node->deleted && node->pfd.events) {
+GPollFD pfd = {
+.fd = node->pfd.fd,
+.events = node->pfd.events,
+};
+node->pollfds_idx = ctx->pollfds->len;
+g_array_append_val(ctx->pollfds, pfd);
 }
 }
 
@@ -240,41 +240,22 @@ bool aio_poll(AioContext *ctx, bool blocking)
 }
 
 /* wait until next event */
-ret = select(max_fd, &rdfds, &wrfds, NULL, blocking ? NULL : &tv0);
+ret = g_poll((GPollFD *)ctx->pollfds->data,
+ ctx->pollfds->len,
+ blocking ? -1 : 0);
 
 /* if we have any readable fds, dispatch event */
 if (ret > 0) {
-/* we have to walk very carefully in case
- * qemu_aio_set_fd_handler is called while we're walking */
-node = QLIST_FIRST(&ctx->aio_handlers);
-while (node) {
-AioHandler *tmp;
-
-ctx->walking_handlers++;
-
-if (!node->deleted &&
-FD_ISSET(node->pfd.fd, &rdfds) &&
-node->io_read) {
-node->io_read(node->opaque);
-progress = true;
-}
-if (!node->deleted &&
-FD_ISSET(node->pfd.fd, &wrfds) &&
-node->io_write) {
-node->io_write(node->opaque);
-progress = true;
-}
-
-tmp = node;
-node = QLIST_NEXT(node, node);
-
-ctx->walking_handlers--;
-
-if (!ctx->walking_handlers && tmp->deleted) {
-QLIST_REMOVE(tmp, node);
-g_free(tmp);
+QLIST_FOREACH(node, &ctx->aio_handlers, node) {
+if (node->pollfds_idx != -1) {
+GPollFD *pfd = &g_array_index(ctx->pollfds, GPollFD,
+  node->pollfds_idx);
+node->pfd.revents |= pfd->revents;
 }
 }
+if (aio_dispatch(ctx)) {
+progress = true;
+}
 }
 
 assert(progress || busy);
diff --git a/async.c b/async.c
index 72d268a..f2d47ba 100644
--- a/async.c
+++ b/async.c
@@ -174,6 +174,7 @@ aio_ctx_finalize(GSource *source)
 
 aio_set_event_notifier(ctx, &ctx->notifier, NULL, NULL);
 event_notifier_cleanup(&ctx->notifier);
+g_array_free(ctx->pollfds, TRUE);
 }
 
 static GSourceFuncs aio_source_funcs = {
@@ -198,6 +199,7 @@ AioContext *aio_context_new(void)
 {
 AioContext *ctx;
 ctx = (AioContext *) g_source_new(&aio_source_funcs, sizeof(AioContext));
+ctx->pollfds = g_array_new(FALSE, FALSE, sizeof(GPollFD));
 event_notifier_init(&ctx->notifier, false);
 aio_set_event_notifier(ctx, &ctx->notifier

[Qemu-devel] [PULL for-1.4 00/13] Block patches

[Stefan Hajnoczi]

The following changes since commit 8a55ebf01507ab73cc458cfcd5b9cb856aba0b9e:

  Merge remote-tracking branch 'afaerber/qom-cpu' into staging (2013-01-31 
19:37:33 -0600)

are available in the git repository at:


  git://github.com/stefanha/qemu.git block

for you to fetch changes up to fdf263f63fad86b04032da86686a952edfe4644f:

  block/raw-posix: Build fix for O_ASYNC (2013-02-01 15:11:12 +0100)


Andreas Färber (1):
  block/raw-posix: Build fix for O_ASYNC

Kevin Wolf (7):
  qemu-iotests: Add regression test for b7ab0fea
  bochs: Fix bdrv_open() error handling
  cloop: Fix bdrv_open() error handling
  vpc: Fix bdrv_open() error handling
  dmg: Fix bdrv_open() error handling
  dmg: Use g_free instead of free
  parallels: Fix bdrv_open() error handling

Liu Yuan (1):
  sheepdog: pass vdi_id to sheep daemon for sd_close()

Othmar Pasteka (1):
  vmdk: Allow selecting SCSI adapter in image creation

Philipp Hahn (1):
  vmdk: Allow space in file name

Vishvananda Ishaya (2):
  block: Fix is_allocated_above with resized files
  block: Adds mirroring tests for resized images

 block.c|   4 +-
 block/bochs.c  |  22 ---
 block/cloop.c  |  29 ++---
 block/dmg.c| 153 +++--
 block/parallels.c  |  23 ---
 block/raw-posix.c  |  11 +++-
 block/sheepdog.c   |   5 +-
 block/vmdk.c   |  41 
 block/vpc.c|  42 +
 include/block/block_int.h  |   1 +
 tests/qemu-iotests/041 |  48 ++
 tests/qemu-iotests/041.out |   4 +-
 tests/qemu-iotests/047 |  75 ++
 tests/qemu-iotests/047.out |  22 +++
 tests/qemu-iotests/group   |   1 +
 15 files changed, 379 insertions(+), 102 deletions(-)
 create mode 100755 tests/qemu-iotests/047
 create mode 100644 tests/qemu-iotests/047.out

-- 
1.8.1

[Qemu-devel] [PATCH 08/13] vpc: Fix bdrv_open() error handling

[Stefan Hajnoczi]

From: Kevin Wolf 

Return -errno instead of -1 on errors. While touching the
code, fix a memory leak.

Signed-off-by: Kevin Wolf 
Signed-off-by: Stefan Hajnoczi 
---
 block/vpc.c | 42 ++
 1 file changed, 30 insertions(+), 12 deletions(-)

diff --git a/block/vpc.c b/block/vpc.c
index 7948609..82229ef 100644
--- a/block/vpc.c
+++ b/block/vpc.c
@@ -163,24 +163,33 @@ static int vpc_open(BlockDriverState *bs, int flags)
 struct vhd_dyndisk_header* dyndisk_header;
 uint8_t buf[HEADER_SIZE];
 uint32_t checksum;
-int err = -1;
 int disk_type = VHD_DYNAMIC;
+int ret;
 
-if (bdrv_pread(bs->file, 0, s->footer_buf, HEADER_SIZE) != HEADER_SIZE)
+ret = bdrv_pread(bs->file, 0, s->footer_buf, HEADER_SIZE);
+if (ret < 0) {
 goto fail;
+}
 
 footer = (struct vhd_footer*) s->footer_buf;
 if (strncmp(footer->creator, "conectix", 8)) {
 int64_t offset = bdrv_getlength(bs->file);
-if (offset < HEADER_SIZE) {
+if (offset < 0) {
+ret = offset;
+goto fail;
+} else if (offset < HEADER_SIZE) {
+ret = -EINVAL;
 goto fail;
 }
+
 /* If a fixed disk, the footer is found only at the end of the file */
-if (bdrv_pread(bs->file, offset-HEADER_SIZE, s->footer_buf, 
HEADER_SIZE)
-!= HEADER_SIZE) {
+ret = bdrv_pread(bs->file, offset-HEADER_SIZE, s->footer_buf,
+ HEADER_SIZE);
+if (ret < 0) {
 goto fail;
 }
 if (strncmp(footer->creator, "conectix", 8)) {
+ret = -EMEDIUMTYPE;
 goto fail;
 }
 disk_type = VHD_FIXED;
@@ -203,19 +212,21 @@ static int vpc_open(BlockDriverState *bs, int flags)
 
 /* Allow a maximum disk size of approximately 2 TB */
 if (bs->total_sectors >= 65535LL * 255 * 255) {
-err = -EFBIG;
+ret = -EFBIG;
 goto fail;
 }
 
 if (disk_type == VHD_DYNAMIC) {
-if (bdrv_pread(bs->file, be64_to_cpu(footer->data_offset), buf,
-HEADER_SIZE) != HEADER_SIZE) {
+ret = bdrv_pread(bs->file, be64_to_cpu(footer->data_offset), buf,
+ HEADER_SIZE);
+if (ret < 0) {
 goto fail;
 }
 
 dyndisk_header = (struct vhd_dyndisk_header *) buf;
 
 if (strncmp(dyndisk_header->magic, "cxsparse", 8)) {
+ret = -EINVAL;
 goto fail;
 }
 
@@ -226,8 +237,10 @@ static int vpc_open(BlockDriverState *bs, int flags)
 s->pagetable = g_malloc(s->max_table_entries * 4);
 
 s->bat_offset = be64_to_cpu(dyndisk_header->table_offset);
-if (bdrv_pread(bs->file, s->bat_offset, s->pagetable,
-s->max_table_entries * 4) != s->max_table_entries * 4) {
+
+ret = bdrv_pread(bs->file, s->bat_offset, s->pagetable,
+ s->max_table_entries * 4);
+if (ret < 0) {
 goto fail;
 }
 
@@ -265,8 +278,13 @@ static int vpc_open(BlockDriverState *bs, int flags)
 migrate_add_blocker(s->migration_blocker);
 
 return 0;
- fail:
-return err;
+
+fail:
+g_free(s->pagetable);
+#ifdef CACHE
+g_free(s->pageentry_u8);
+#endif
+return ret;
 }
 
 static int vpc_reopen_prepare(BDRVReopenState *state,
-- 
1.8.1

Re: [Qemu-devel] [PATCH for-1.4] Revert "e1000: no need auto-negotiation if link was down"

[mdroth]

On Fri, Feb 01, 2013 at 03:20:59PM +0800, Amos Kong wrote:
> On Thu, Jan 31, 2013 at 05:43:51PM -0600, Michael Roth wrote:
> > This reverts commit 84dd2120247a7d25ff1bb337de21c0e76816ad2d.
> > 
> > I'm not sure what issue the original commit was meant to fix, or if
> > the logic is actually wrong, but it causes e1000 to stop working
> > after a guest issues a reset.
> 
> Hi Michael,
> 
> What's your test scenario?

Nothing special, I just started a guest with

-net nic,model=e1000 -net user

or

-net nic,model=e1000 -net tap

and networking stopped working (could not lease an IP, no outbound
traffic) after I rebooted.

> 
> I tried this test with current qemu code, link status is not reseted
> to 'up' after step 3. Is it the problem you said?

I think it's related, but I'm not so much concerned with the qmp-visible
link status changing as I am with the guest.

> This problem also exists with current virtio (existed in the past) /
> rtl8139 (introduced in 83f58e570f21c3e7227e7fbef1fc0e18b5ed7ea9)
> 
> 1) boot a guest with e1000 nic
> 2) set link down in monitor
>(hmp) set_link e1000.0 down
> 3) reset guest by 'system_reset' in monitor
>(hmp) system_reset
> 
> 
> My original patch is used to restore the link status after guest
> reboot(execute 'reboot' insider guest system).
> The link status should always be up after virtual 'hardware' reset
> (execute 'system_reset' in monitor).

You sure you don't have that backwards? It seems to me that your
original patch was meant to *prevent* the link status from changing
after a system reset, which makes sense from the perspective of a
qmp-issued "set_link down" meaning "unplug the cable".

> 
> Thanks, Amos
> 
> > >From what I can tell a guest with an e1000 nic has no way of changing
> > the link status, as far as it's NetClient peer is concerned, except
> > in the auto-negotiation path, so with this patch in place there's no
> > recovery after a reset, since the link goes down and stays that way.
> > 
> > Revert this patch now to fix the bigger problem, and handle any
> > lingering issues with a follow-up.
> > 
> > Reproduced/tested with qemu-jeos and Ubuntu 12.10.
> > 
> > Signed-off-by: Michael Roth 
> > ---
> >  hw/e1000.c |5 -
> >  1 file changed, 5 deletions(-)
> > 
> > diff --git a/hw/e1000.c b/hw/e1000.c
> > index ef06ca1..563a58f 100644
> > --- a/hw/e1000.c
> > +++ b/hw/e1000.c
> > @@ -166,11 +166,6 @@ static void
> >  set_phy_ctrl(E1000State *s, int index, uint16_t val)
> >  {
> >  if ((val & MII_CR_AUTO_NEG_EN) && (val & MII_CR_RESTART_AUTO_NEG)) {
> > -/* no need auto-negotiation if link was down */
> > -if (s->nic->nc.link_down) {
> > -s->phy_reg[PHY_STATUS] |= MII_SR_AUTONEG_COMPLETE;
> > -return;
> > -}
> >  s->nic->nc.link_down = true;
> >  e1000_link_down(s);
> >  s->phy_reg[PHY_STATUS] &= ~MII_SR_AUTONEG_COMPLETE;
> > -- 
> > 1.7.9.5
> 

[Qemu-devel] [PATCH 05/13] sheepdog: pass vdi_id to sheep daemon for sd_close()

[Stefan Hajnoczi]

From: Liu Yuan 

Sheep daemon needs vdi_id to identify which vdi is closed to release resources
such as object cache.

Cc: MORITA Kazutaka 
Cc: Kevin Wolf 
Cc: Stefan Hajnoczi 
Signed-off-by: Liu Yuan 
Reviewed-by: MORITA Kazutaka 
Signed-off-by: Stefan Hajnoczi 
---
 block/sheepdog.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/block/sheepdog.c b/block/sheepdog.c
index 3e49bb8..d466b23 100644
--- a/block/sheepdog.c
+++ b/block/sheepdog.c
@@ -145,7 +145,7 @@ typedef struct SheepdogVdiReq {
 uint32_t id;
 uint32_t data_length;
 uint64_t vdi_size;
-uint32_t base_vdi_id;
+uint32_t vdi_id;
 uint32_t copies;
 uint32_t snapid;
 uint32_t pad[3];
@@ -1201,7 +1201,7 @@ static int do_sd_create(char *filename, int64_t vdi_size,
 
 memset(&hdr, 0, sizeof(hdr));
 hdr.opcode = SD_OP_NEW_VDI;
-hdr.base_vdi_id = base_vid;
+hdr.vdi_id = base_vid;
 
 wlen = SD_MAX_VDI_LEN;
 
@@ -1384,6 +1384,7 @@ static void sd_close(BlockDriverState *bs)
 memset(&hdr, 0, sizeof(hdr));
 
 hdr.opcode = SD_OP_RELEASE_VDI;
+hdr.vdi_id = s->inode.vdi_id;
 wlen = strlen(s->name) + 1;
 hdr.data_length = wlen;
 hdr.flags = SD_FLAG_CMD_WRITE;
-- 
1.8.1

[Qemu-devel] [PATCH 12/13] vmdk: Allow space in file name

[Stefan Hajnoczi]

From: Philipp Hahn 

The previous scanf() format string stopped parsing the file name on the
first white white space, which seems to be allowed at least by VMware
Workstation.

Change the format string to collect everything between the first and
second quote as the file name, disallowing line breaks.

Signed-off-by: Philipp Hahn 
Reviewed-by: Markus Armbruster 
Signed-off-by: Stefan Hajnoczi 
---
 block/vmdk.c | 10 +-
 1 file changed, 1 insertion(+), 9 deletions(-)

diff --git a/block/vmdk.c b/block/vmdk.c
index a8cb5c9..aef1abc 100644
--- a/block/vmdk.c
+++ b/block/vmdk.c
@@ -641,7 +641,7 @@ static int vmdk_parse_extents(const char *desc, 
BlockDriverState *bs,
  * RW [size in sectors] SPARSE "file-name.vmdk"
  */
 flat_offset = -1;
-ret = sscanf(p, "%10s %" SCNd64 " %10s %511s %" SCNd64,
+ret = sscanf(p, "%10s %" SCNd64 " %10s \"%511[^\n\r\"]\" %" SCNd64,
 access, §ors, type, fname, &flat_offset);
 if (ret < 4 || strcmp(access, "RW")) {
 goto next_line;
@@ -653,14 +653,6 @@ static int vmdk_parse_extents(const char *desc, 
BlockDriverState *bs,
 return -EINVAL;
 }
 
-/* trim the quotation marks around */
-if (fname[0] == '"') {
-memmove(fname, fname + 1, strlen(fname));
-if (strlen(fname) <= 1 || fname[strlen(fname) - 1] != '"') {
-return -EINVAL;
-}
-fname[strlen(fname) - 1] = '\0';
-}
 if (sectors <= 0 ||
 (strcmp(type, "FLAT") && strcmp(type, "SPARSE")) ||
 (strcmp(access, "RW"))) {
-- 
1.8.1

Re: [Qemu-devel] [PATCH for-1.4] Revert "e1000: no need auto-negotiation if link was down"

[mdroth]

On Fri, Feb 01, 2013 at 03:53:22PM +0800, Amos Kong wrote:
> On Fri, Feb 01, 2013 at 03:20:59PM +0800, Amos Kong wrote:
> > On Thu, Jan 31, 2013 at 05:43:51PM -0600, Michael Roth wrote:
> > > This reverts commit 84dd2120247a7d25ff1bb337de21c0e76816ad2d.
> > > 
> > > I'm not sure what issue the original commit was meant to fix, or if
> > > the logic is actually wrong, but it causes e1000 to stop working
> > > after a guest issues a reset.
> > 
> > Hi Michael,
> > 
> > What's your test scenario?
> > 
> > I tried this test with current qemu code, link status is not reseted
> > to 'up' after step 3. Is it the problem you said?
> > This problem also exists with current virtio (existed in the past) /
> > rtl8139 (introduced in 83f58e570f21c3e7227e7fbef1fc0e18b5ed7ea9)
> > 
> > 1) boot a guest with e1000 nic
> > 2) set link down in monitor
> >(hmp) set_link e1000.0 down
> > 3) reset guest by 'system_reset' in monitor
> >(hmp) system_reset
> > 
> > 
> > My original patch is used to restore the link status after guest
> > reboot(execute 'reboot' insider guest system).
> 
> > The link status should always be up after virtual 'hardware' reset
> > (execute 'system_reset' in monitor).
> 
> Is it expected?
> 
> When we reset the virtual system, do we need to reset the status
> of simulation of network cable?

I don't so. If we "unplug the cable", it should stay unplugged when we
reset the machine.

When we reset the machine, we should set the NIC's link status in
accordance with it's NetClient peer. So if that's what your patch was
attempting to enforce I think we're in agreement there.

I think the problem with your original patch is that it doesn't check
the link status of the nic's NetClient peer, but instead checks it's
own internal NetClient state, so we end up trying to enforce "leave the
cable unplugged" even when "set_link down" was never issued.

And if that's the case I think you can re-spin your original patch for
1.4 accordingly. But we definitely need to revert the current one ASAP
since it breaks all QEMU guests that are started using the default nic.

> I think it's deciced by that if we think simulation of network
> cable is a part of the virtual machine.
> 
> 
> commit 436e5e53c97d8fb469306b18a0c31dc60f5e546c
> Author: aliguori 
> Date:   Thu Jan 8 19:44:06 2009 +
> 
> Add 'set_link' monitor command (Mark McLoughlin)
> 
> Add a monitor command to setting a given network device's link status
> to 'up' or 'down'.
> 
> Allows simulation of network cable disconnect.
> 
> Signed-off-by: Mark McLoughlin 
> Signed-off-by: Anthony Liguori 
> 

Re: [Qemu-devel] [PATCH for-1.4] Revert "e1000: no need auto-negotiation if link was down"

[Anthony Liguori]

Michael Roth  writes:

> This reverts commit 84dd2120247a7d25ff1bb337de21c0e76816ad2d.
>
> I'm not sure what issue the original commit was meant to fix, or if
> the logic is actually wrong, but it causes e1000 to stop working
> after a guest issues a reset.
>
>>From what I can tell a guest with an e1000 nic has no way of changing
> the link status, as far as it's NetClient peer is concerned, except
> in the auto-negotiation path, so with this patch in place there's no
> recovery after a reset, since the link goes down and stays that way.
>
> Revert this patch now to fix the bigger problem, and handle any
> lingering issues with a follow-up.
>
> Reproduced/tested with qemu-jeos and Ubuntu 12.10.
>
> Signed-off-by: Michael Roth 
> ---
>  hw/e1000.c |5 -
>  1 file changed, 5 deletions(-)
>
> diff --git a/hw/e1000.c b/hw/e1000.c
> index ef06ca1..563a58f 100644
> --- a/hw/e1000.c
> +++ b/hw/e1000.c
> @@ -166,11 +166,6 @@ static void
>  set_phy_ctrl(E1000State *s, int index, uint16_t val)
>  {
>  if ((val & MII_CR_AUTO_NEG_EN) && (val & MII_CR_RESTART_AUTO_NEG)) {
> -/* no need auto-negotiation if link was down */
> -if (s->nic->nc.link_down) {
> -s->phy_reg[PHY_STATUS] |= MII_SR_AUTONEG_COMPLETE;
> -return;
> -}

The problem with this patch is that it skips autonegotiate if the link
is down however it doesn't take reset into account.

Consider if you reset the guest during autonegotiation.  The link is down
but it's not really down--the guest is in the process of bringing it
back up.

But since it was down before reset, we won't let autonegotiation happen
again.

We shouldn't use nc.link_down state to indicate this.  We should use
another variable that we can clear during reset.

I'm going to take this revert since it fixes a serious problem
(networking doesn't work after a reboot) at the cost of a less serious
problem (bring the link up if it was previously set to be down).  But I
hope we can get a proper fix during the -rc cycle.

Regards,

Anthony Liguori

>  s->nic->nc.link_down = true;
>  e1000_link_down(s);
>  s->phy_reg[PHY_STATUS] &= ~MII_SR_AUTONEG_COMPLETE;
> -- 
> 1.7.9.5

[Qemu-devel] [PATCH 09/13] dmg: Fix bdrv_open() error handling

[Stefan Hajnoczi]

From: Kevin Wolf 

Return -errno instead of -1 on errors and add error checks in some
places that didn't have one. Passing things by reference requires more
correct typing, replaced a few off_ts therefore - with a 32-bit off_t
this is even a fix for truncation bugs.

While touching the code, fix even some more memory leaks than in the
other drivers...

Signed-off-by: Kevin Wolf 
Signed-off-by: Stefan Hajnoczi 
---
 block/dmg.c | 135 +++-
 1 file changed, 97 insertions(+), 38 deletions(-)

diff --git a/block/dmg.c b/block/dmg.c
index ac397dc..53be25d 100644
--- a/block/dmg.c
+++ b/block/dmg.c
@@ -57,29 +57,42 @@ static int dmg_probe(const uint8_t *buf, int buf_size, 
const char *filename)
 return 0;
 }
 
-static off_t read_off(BlockDriverState *bs, int64_t offset)
+static int read_uint64(BlockDriverState *bs, int64_t offset, uint64_t *result)
 {
-   uint64_t buffer;
-   if (bdrv_pread(bs->file, offset, &buffer, 8) < 8)
-   return 0;
-   return be64_to_cpu(buffer);
+uint64_t buffer;
+int ret;
+
+ret = bdrv_pread(bs->file, offset, &buffer, 8);
+if (ret < 0) {
+return ret;
+}
+
+*result = be64_to_cpu(buffer);
+return 0;
 }
 
-static off_t read_uint32(BlockDriverState *bs, int64_t offset)
+static int read_uint32(BlockDriverState *bs, int64_t offset, uint32_t *result)
 {
-   uint32_t buffer;
-   if (bdrv_pread(bs->file, offset, &buffer, 4) < 4)
-   return 0;
-   return be32_to_cpu(buffer);
+uint32_t buffer;
+int ret;
+
+ret = bdrv_pread(bs->file, offset, &buffer, 4);
+if (ret < 0) {
+return ret;
+}
+
+*result = be32_to_cpu(buffer);
+return 0;
 }
 
 static int dmg_open(BlockDriverState *bs, int flags)
 {
 BDRVDMGState *s = bs->opaque;
-off_t info_begin,info_end,last_in_offset,last_out_offset;
-uint32_t count;
+uint64_t info_begin,info_end,last_in_offset,last_out_offset;
+uint32_t count, tmp;
 uint32_t max_compressed_size=1,max_sectors_per_chunk=1,i;
 int64_t offset;
+int ret;
 
 bs->read_only = 1;
 s->n_chunks = 0;
@@ -88,21 +101,32 @@ static int dmg_open(BlockDriverState *bs, int flags)
 /* read offset of info blocks */
 offset = bdrv_getlength(bs->file);
 if (offset < 0) {
+ret = offset;
 goto fail;
 }
 offset -= 0x1d8;
 
-info_begin = read_off(bs, offset);
-if (info_begin == 0) {
-   goto fail;
+ret = read_uint64(bs, offset, &info_begin);
+if (ret < 0) {
+goto fail;
+} else if (info_begin == 0) {
+ret = -EINVAL;
+goto fail;
 }
 
-if (read_uint32(bs, info_begin) != 0x100) {
+ret = read_uint32(bs, info_begin, &tmp);
+if (ret < 0) {
+goto fail;
+} else if (tmp != 0x100) {
+ret = -EINVAL;
 goto fail;
 }
 
-count = read_uint32(bs, info_begin + 4);
-if (count == 0) {
+ret = read_uint32(bs, info_begin + 4, &count);
+if (ret < 0) {
+goto fail;
+} else if (count == 0) {
+ret = -EINVAL;
 goto fail;
 }
 info_end = info_begin + count;
@@ -114,12 +138,20 @@ static int dmg_open(BlockDriverState *bs, int flags)
 while (offset < info_end) {
 uint32_t type;
 
-   count = read_uint32(bs, offset);
-   if(count==0)
-   goto fail;
+ret = read_uint32(bs, offset, &count);
+if (ret < 0) {
+goto fail;
+} else if (count == 0) {
+ret = -EINVAL;
+goto fail;
+}
 offset += 4;
 
-   type = read_uint32(bs, offset);
+ret = read_uint32(bs, offset, &type);
+if (ret < 0) {
+goto fail;
+}
+
if (type == 0x6d697368 && count >= 244) {
int new_size, chunk_count;
 
@@ -134,8 +166,11 @@ static int dmg_open(BlockDriverState *bs, int flags)
s->sectors = g_realloc(s->sectors, new_size);
s->sectorcounts = g_realloc(s->sectorcounts, new_size);
 
-   for(i=s->n_chunks;in_chunks+chunk_count;i++) {
-   s->types[i] = read_uint32(bs, offset);
+for (i = s->n_chunks; i < s->n_chunks + chunk_count; i++) {
+ret = read_uint32(bs, offset, &s->types[i]);
+if (ret < 0) {
+goto fail;
+}
offset += 4;
if(s->types[i]!=0x8005 && s->types[i]!=1 && s->types[i]!=2) 
{
if(s->types[i]==0x) {
@@ -149,17 +184,31 @@ static int dmg_open(BlockDriverState *bs, int flags)
}
offset += 4;
 
-   s->sectors[i] = last_out_offset+read_off(bs, offset);
-   offset += 8;
-
-   s->sectorcounts[i] = read_off(bs, offset);
-   offset += 8;
-
-   s->offsets[i] = last_in_offset+read_off(bs, offset);
-   offset += 8;
-
-   s->lengths[i] = read_off

Re: [Qemu-devel] [PULL 0/4] generic linux-user patches

[Anthony Liguori]

Hi Laurent,

Laurent Vivier  writes:

> Hi,
>
>
> Please pull this linux-user patches queue into master.
>
> All these patches have already been sent and reviewed on the mailing list.
>
> The following changes since commit 4c37ef022381e777251d7084591978a4dc622efe:
>
> host-utils: add ffsl (2013-01-25 18:18:32 +0100)
>
> are available in the git repository at:
>
> https://git.gitorious.org/qemu-m68k/qemu-m68k.git for-linux-user
>
> for you to fetch changes up to c07ecc6866f8c5eb2e0b23ba20214000310355e0:
>
> linux-user: correct reboot() (2013-01-30 12:13:21 +0100)

Did you use git-request-pull to generate this?  Perhaps your mailer
munged all of the whitespace...

Anyway, I'd expect this to come through Riku.  I'm willing to pull if
Riku Ack's.

Regards,

Anthony Liguori

>
> 
> Laurent Vivier (4):
> linux-user: correct msgrcv()
> linux-user: correct print_timeval() swap tv_sec and tv_usec
> linux-user: correct setsockopt()
> linux-user: correct reboot()
>
> linux-user/strace.c | 2 +-
> linux-user/syscall.c | 48 
> 2 files changed, 37 insertions(+), 13 deletions(-)

[Qemu-devel] [PATCH for 1.5] virtio: make virtio device's structures public.

[fred . konrad]

From: KONRAD Frederic 

These structures must be made public to avoid two memory allocations for
refactored virtio devices.

Signed-off-by: KONRAD Frederic 
---
 hw/virtio-balloon.c| 15 ---
 hw/virtio-balloon.h| 14 ++
 hw/virtio-blk.c| 16 
 hw/virtio-blk.h| 15 +++
 hw/virtio-net.c| 41 -
 hw/virtio-net.h| 41 +
 hw/virtio-rng.c| 19 ---
 hw/virtio-rng.h| 19 +++
 hw/virtio-scsi.c   | 15 ---
 hw/virtio-scsi.h   | 16 
 hw/virtio-serial-bus.c | 41 -
 hw/virtio-serial.h | 41 +
 12 files changed, 146 insertions(+), 147 deletions(-)

diff --git a/hw/virtio-balloon.c b/hw/virtio-balloon.c
index c0a7902..c2ad249 100644
--- a/hw/virtio-balloon.c
+++ b/hw/virtio-balloon.c
@@ -29,21 +29,6 @@
 #include 
 #endif
 
-typedef struct VirtIOBalloon
-{
-VirtIODevice vdev;
-VirtQueue *ivq, *dvq, *svq;
-uint32_t num_pages;
-uint32_t actual;
-uint64_t stats[VIRTIO_BALLOON_S_NR];
-VirtQueueElement stats_vq_elem;
-size_t stats_vq_offset;
-QEMUTimer *stats_timer;
-int64_t stats_last_update;
-int64_t stats_poll_interval;
-DeviceState *qdev;
-} VirtIOBalloon;
-
 static VirtIOBalloon *to_virtio_balloon(VirtIODevice *vdev)
 {
 return (VirtIOBalloon *)vdev;
diff --git a/hw/virtio-balloon.h b/hw/virtio-balloon.h
index b1828f4..579a1e5 100644
--- a/hw/virtio-balloon.h
+++ b/hw/virtio-balloon.h
@@ -52,4 +52,18 @@ typedef struct VirtIOBalloonStat {
 uint64_t val;
 } QEMU_PACKED VirtIOBalloonStat;
 
+typedef struct VirtIOBalloon {
+VirtIODevice vdev;
+VirtQueue *ivq, *dvq, *svq;
+uint32_t num_pages;
+uint32_t actual;
+uint64_t stats[VIRTIO_BALLOON_S_NR];
+VirtQueueElement stats_vq_elem;
+size_t stats_vq_offset;
+QEMUTimer *stats_timer;
+int64_t stats_last_update;
+int64_t stats_poll_interval;
+DeviceState *qdev;
+} VirtIOBalloon;
+
 #endif
diff --git a/hw/virtio-blk.c b/hw/virtio-blk.c
index 34913ee..5380211 100644
--- a/hw/virtio-blk.c
+++ b/hw/virtio-blk.c
@@ -25,22 +25,6 @@
 # include 
 #endif
 
-typedef struct VirtIOBlock
-{
-VirtIODevice vdev;
-BlockDriverState *bs;
-VirtQueue *vq;
-void *rq;
-QEMUBH *bh;
-BlockConf *conf;
-VirtIOBlkConf *blk;
-unsigned short sector_mask;
-DeviceState *qdev;
-#ifdef CONFIG_VIRTIO_BLK_DATA_PLANE
-VirtIOBlockDataPlane *dataplane;
-#endif
-} VirtIOBlock;
-
 static VirtIOBlock *to_virtio_blk(VirtIODevice *vdev)
 {
 return (VirtIOBlock *)vdev;
diff --git a/hw/virtio-blk.h b/hw/virtio-blk.h
index 43ca492..2a7aef2 100644
--- a/hw/virtio-blk.h
+++ b/hw/virtio-blk.h
@@ -108,6 +108,21 @@ struct VirtIOBlkConf
 uint32_t data_plane;
 };
 
+typedef struct VirtIOBlock {
+VirtIODevice vdev;
+BlockDriverState *bs;
+VirtQueue *vq;
+void *rq;
+QEMUBH *bh;
+BlockConf *conf;
+VirtIOBlkConf *blk;
+unsigned short sector_mask;
+DeviceState *qdev;
+#ifdef CONFIG_VIRTIO_BLK_DATA_PLANE
+VirtIOBlockDataPlane *dataplane;
+#endif
+} VirtIOBlock;
+
 #define DEFINE_VIRTIO_BLK_FEATURES(_state, _field) \
 DEFINE_VIRTIO_COMMON_FEATURES(_state, _field)
 
diff --git a/hw/virtio-net.c b/hw/virtio-net.c
index dfb9687..ba0d70b 100644
--- a/hw/virtio-net.c
+++ b/hw/virtio-net.c
@@ -26,47 +26,6 @@
 #define MAC_TABLE_ENTRIES64
 #define MAX_VLAN(1 << 12)   /* Per 802.1Q definition */
 
-typedef struct VirtIONet
-{
-VirtIODevice vdev;
-uint8_t mac[ETH_ALEN];
-uint16_t status;
-VirtQueue *rx_vq;
-VirtQueue *tx_vq;
-VirtQueue *ctrl_vq;
-NICState *nic;
-QEMUTimer *tx_timer;
-QEMUBH *tx_bh;
-uint32_t tx_timeout;
-int32_t tx_burst;
-int tx_waiting;
-uint32_t has_vnet_hdr;
-size_t host_hdr_len;
-size_t guest_hdr_len;
-uint8_t has_ufo;
-struct {
-VirtQueueElement elem;
-ssize_t len;
-} async_tx;
-int mergeable_rx_bufs;
-uint8_t promisc;
-uint8_t allmulti;
-uint8_t alluni;
-uint8_t nomulti;
-uint8_t nouni;
-uint8_t nobcast;
-uint8_t vhost_started;
-struct {
-int in_use;
-int first_multi;
-uint8_t multi_overflow;
-uint8_t uni_overflow;
-uint8_t *macs;
-} mac_table;
-uint32_t *vlans;
-DeviceState *qdev;
-} VirtIONet;
-
 /* TODO
  * - we could suppress RX interrupt if we were so inclined.
  */
diff --git a/hw/virtio-net.h b/hw/virtio-net.h
index c0bb284..609818b 100644
--- a/hw/virtio-net.h
+++ b/hw/virtio-net.h
@@ -130,6 +130,47 @@ struct virtio_net_ctrl_mac {
 uint32_t entries;
 uint8_t macs[][ETH_ALEN];
 };
+
+typedef struct VirtIONet {
+VirtIODevice vdev;
+uint8_t mac[ETH_ALEN];
+uint16_t status;
+VirtQueue *rx_vq;
+VirtQueue *

[Qemu-devel] [PATCH 07/13] cloop: Fix bdrv_open() error handling

[Stefan Hajnoczi]

From: Kevin Wolf 

Return -errno instead of -1 on errors. While touching the
code, fix a memory leak.

Signed-off-by: Kevin Wolf 
Signed-off-by: Stefan Hajnoczi 
---
 block/cloop.c | 29 +++--
 1 file changed, 19 insertions(+), 10 deletions(-)

diff --git a/block/cloop.c b/block/cloop.c
index 5a0d0d8..8fe13e9 100644
--- a/block/cloop.c
+++ b/block/cloop.c
@@ -57,27 +57,32 @@ static int cloop_open(BlockDriverState *bs, int flags)
 {
 BDRVCloopState *s = bs->opaque;
 uint32_t offsets_size, max_compressed_block_size = 1, i;
+int ret;
 
 bs->read_only = 1;
 
 /* read header */
-if (bdrv_pread(bs->file, 128, &s->block_size, 4) < 4) {
-goto cloop_close;
+ret = bdrv_pread(bs->file, 128, &s->block_size, 4);
+if (ret < 0) {
+return ret;
 }
 s->block_size = be32_to_cpu(s->block_size);
 
-if (bdrv_pread(bs->file, 128 + 4, &s->n_blocks, 4) < 4) {
-goto cloop_close;
+ret = bdrv_pread(bs->file, 128 + 4, &s->n_blocks, 4);
+if (ret < 0) {
+return ret;
 }
 s->n_blocks = be32_to_cpu(s->n_blocks);
 
 /* read offsets */
 offsets_size = s->n_blocks * sizeof(uint64_t);
 s->offsets = g_malloc(offsets_size);
-if (bdrv_pread(bs->file, 128 + 4 + 4, s->offsets, offsets_size) <
-offsets_size) {
-goto cloop_close;
+
+ret = bdrv_pread(bs->file, 128 + 4 + 4, s->offsets, offsets_size);
+if (ret < 0) {
+goto fail;
 }
+
 for(i=0;in_blocks;i++) {
 s->offsets[i] = be64_to_cpu(s->offsets[i]);
 if (i > 0) {
@@ -92,7 +97,8 @@ static int cloop_open(BlockDriverState *bs, int flags)
 s->compressed_block = g_malloc(max_compressed_block_size + 1);
 s->uncompressed_block = g_malloc(s->block_size);
 if (inflateInit(&s->zstream) != Z_OK) {
-goto cloop_close;
+ret = -EINVAL;
+goto fail;
 }
 s->current_block = s->n_blocks;
 
@@ -101,8 +107,11 @@ static int cloop_open(BlockDriverState *bs, int flags)
 qemu_co_mutex_init(&s->lock);
 return 0;
 
-cloop_close:
-return -1;
+fail:
+g_free(s->offsets);
+g_free(s->compressed_block);
+g_free(s->uncompressed_block);
+return ret;
 }
 
 static inline int cloop_read_block(BlockDriverState *bs, int block_num)
-- 
1.8.1

Re: [Qemu-devel] [PULL 0/4] generic linux-user patches

[Peter Maydell]

On 1 February 2013 15:05, Anthony Liguori  wrote:
> Laurent Vivier  writes:
>> Please pull this linux-user patches queue into master.
>>
>> All these patches have already been sent and reviewed on the mailing list.

> Did you use git-request-pull to generate this?  Perhaps your mailer
> munged all of the whitespace...
>
> Anyway, I'd expect this to come through Riku.  I'm willing to pull if
> Riku Ack's.

Riku asked Laurent to send this pull:
http://lists.nongnu.org/archive/html/qemu-devel/2013-01/msg05686.html

-- PMM

[Qemu-devel] [PATCH 02/13] block: Fix is_allocated_above with resized files

[Stefan Hajnoczi]

From: Vishvananda Ishaya 

In an image chain, if the base image is smaller than the current
image, we need to make sure to use the current images count of
unallocated blocks once we get to the end of the base image. Without
this change the code will return 0 blocks when it gets to the end
of the base image and mirror_run will fail its assertion.

Signed-off-by: Vishvananda Ishaya 
Signed-off-by: Stefan Hajnoczi 
---
 block.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/block.c b/block.c
index ba67c0d..50dab8e 100644
--- a/block.c
+++ b/block.c
@@ -2800,7 +2800,9 @@ int coroutine_fn 
bdrv_co_is_allocated_above(BlockDriverState *top,
  *
  * [sector_num+x, nr_sectors] allocated.
  */
-if (n > pnum_inter) {
+if (n > pnum_inter &&
+(intermediate == top ||
+ sector_num + pnum_inter < intermediate->total_sectors)) {
 n = pnum_inter;
 }
 
-- 
1.8.1

Re: [Qemu-devel] [PATCH] configure: Undefine _FORTIFY_SOURCE prior using it

[Michal Privoznik]

On 01.02.2013 10:54, Andreas Färber wrote:
> Am 31.01.2013 11:15, schrieb Michal Privoznik:
>> Currently, we are enforcing the _FORTIFY_SOURCE=2 without any
>> previous detection if the macro has been already defined, e.g.
>> by environment, or is just enabled by compiler by default.
>>
>> Signed-off-by: Michal Privoznik 
>> ---
>>  configure | 2 +-
>>  1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/configure b/configure
>> index b7635e4..97070eb 100755
>> --- a/configure
>> +++ b/configure
>> @@ -3159,7 +3159,7 @@ if test "$gcov" = "yes" ; then
>>CFLAGS="-fprofile-arcs -ftest-coverage -g $CFLAGS"
>>LDFLAGS="-fprofile-arcs -ftest-coverage $LDFLAGS"
>>  elif test "$debug" = "no" ; then
>> -  CFLAGS="-O2 -D_FORTIFY_SOURCE=2 $CFLAGS"
>> +  CFLAGS="-O2 -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2 $CFLAGS"
>>  fi
>>  
>>  
> 
> Should we maybe instead add a compile-test?
> 
> #ifdef _FORTIFY_SOURCE
> #if _FORTIFY_SOURCE >= 2
> #error Environment already has _FORTIFY_SOURCE
> #endif
> #endif
> 
> I admit I have no clue what the number means and whether there are more
> fortified levels.
> 
> Cheers,
> Andreas
> 

I don't think that's necessary. The 2nd level is the highest one [1] or [2].
It seems like in my case it's compiler who's defining the macro:

$ echo "int main() {return 0;}" | gcc -D_FORTIFY_SOURCE=2 -x c -
:0:0: warning: "_FORTIFY_SOURCE" redefined [enabled by default]
:1:0: note: this is the location of the previous definition

in which case we must undefine it. However, if the _FORTIFY_SOURCE is
defined by environment, I think we should not override it. So maybe need
a different approach. Anyway, with current state I cannot compile. I am using
gcc version 4.7.2 (Gentoo 4.7.2 p1.3, pie-0.5.5)

Michal

1: http://gcc.gnu.org/ml/gcc-patches/2004-09/msg02055.html
2: http://gcc.gnu.org/git/?p=gcc.git;a=blob;f=libssp/ssp/ssp.h.in

Re: [Qemu-devel] [PATCH 2/4] fix scripts/make_device_config.sh

[Gerd Hoffmann]

On 02/01/13 14:38, Andreas Färber wrote:
> Am 01.02.2013 13:00, schrieb Gerd Hoffmann:
>> Make it handle multiple include statements in a file.
>>
>> Signed-off-by: Gerd Hoffmann 
>> ---
>>  scripts/make_device_config.sh |2 +-
>>  1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/scripts/make_device_config.sh b/scripts/make_device_config.sh
>> index 0778fe2..81fe942 100644
>> --- a/scripts/make_device_config.sh
>> +++ b/scripts/make_device_config.sh
>> @@ -18,7 +18,7 @@ process_includes () {
>>  
>>  f=$src
>>  while [ -n "$f" ] ; do
>> -  f=`tr -d '\r' < $f | awk '/^include / {printf "'$src_dir'/%s", $2}'`
>> +  f=`cat $f | tr -d '\r' | awk '/^include / {printf "'$src_dir'/%s ", $2}'`
>>[ $? = 0 ] || exit 1
>>all_includes="$all_includes $f"
>>  done
> 
> The actual fix is appending a space? Or how does cat make a difference?

Both changes are needed.

Without the space you get "pci.makusb.mak" instead of "pci.mak usb.mak"
in $f (and $all_includes).

The cat makes sure it still works with two files in $f.

cheers,
  Gerd

[Qemu-devel] [PATCH 03/13] block: Adds mirroring tests for resized images

[Stefan Hajnoczi]

From: Vishvananda Ishaya 

This test verifies two mirroring issues are fixed with resized images:

 * sync='top' creates an image that is the proper size
 * sync='full' doesn't cause an assertion failure and crash qemu
Reviewed-by: Paolo Bonzini 

Signed-off-by: Stefan Hajnoczi 
---
 tests/qemu-iotests/041 | 48 ++
 tests/qemu-iotests/041.out |  4 ++--
 2 files changed, 50 insertions(+), 2 deletions(-)

diff --git a/tests/qemu-iotests/041 b/tests/qemu-iotests/041
index b040820..720eeff 100755
--- a/tests/qemu-iotests/041
+++ b/tests/qemu-iotests/041
@@ -344,6 +344,54 @@ class TestMirrorNoBacking(ImageMirroringTestCase):
 self.assertTrue(self.compare_images(test_img, target_img),
 'target image does not match source after mirroring')
 
+class TestMirrorResized(ImageMirroringTestCase):
+backing_len = 1 * 1024 * 1024 # MB
+image_len = 2 * 1024 * 1024 # MB
+
+def setUp(self):
+self.create_image(backing_img, TestMirrorResized.backing_len)
+qemu_img('create', '-f', iotests.imgfmt, '-o', 'backing_file=%s' % 
backing_img, test_img)
+qemu_img('resize', test_img, '2M')
+self.vm = iotests.VM().add_drive(test_img)
+self.vm.launch()
+
+def tearDown(self):
+self.vm.shutdown()
+os.remove(test_img)
+os.remove(backing_img)
+try:
+os.remove(target_img)
+except OSError:
+pass
+
+def test_complete_top(self):
+self.assert_no_active_mirrors()
+
+result = self.vm.qmp('drive-mirror', device='drive0', sync='top',
+ target=target_img)
+self.assert_qmp(result, 'return', {})
+
+self.complete_and_wait()
+result = self.vm.qmp('query-block')
+self.assert_qmp(result, 'return[0]/inserted/file', target_img)
+self.vm.shutdown()
+self.assertTrue(self.compare_images(test_img, target_img),
+'target image does not match source after mirroring')
+
+def test_complete_full(self):
+self.assert_no_active_mirrors()
+
+result = self.vm.qmp('drive-mirror', device='drive0', sync='full',
+ target=target_img)
+self.assert_qmp(result, 'return', {})
+
+self.complete_and_wait()
+result = self.vm.qmp('query-block')
+self.assert_qmp(result, 'return[0]/inserted/file', target_img)
+self.vm.shutdown()
+self.assertTrue(self.compare_images(test_img, target_img),
+'target image does not match source after mirroring')
+
 class TestReadErrors(ImageMirroringTestCase):
 image_len = 2 * 1024 * 1024 # MB
 
diff --git a/tests/qemu-iotests/041.out b/tests/qemu-iotests/041.out
index 84bfd63..42314e9 100644
--- a/tests/qemu-iotests/041.out
+++ b/tests/qemu-iotests/041.out
@@ -1,5 +1,5 @@
-..
+
 --
-Ran 22 tests
+Ran 24 tests
 
 OK
-- 
1.8.1

Re: [Qemu-devel] [PATCH V20 1/8] Support for TPM command line options

[Corey Bryant]

Thanks for the fixes since the last version.  I have a few comments 
below.  Apologies for not catching some of these the first time through.


On 01/18/2013 11:02 AM, Stefan Berger wrote:

This patch adds support for TPM command line options.
The command line options supported here are

./qemu-... -tpmdev passthrough,path=,id=
-device tpm-tis,tpmdev=

and

./qemu-... -tpmdev ?

where the latter works similar to -soundhw ? and shows a list of
available TPM backends (for example 'passthrough').

Using the type parameter, the backend is chosen, i.e., 'passthrough' for the
passthrough driver. The interpretation of the other parameters along
with determining whether enough parameters were provided is pushed into
the backend driver, which needs to implement the interface function
'create' and return a TPMDriver structure if the VM can be started or 'NULL'
if not enough or bad parameters were provided.

Monitor support for 'info tpm' has been added. It for example prints the
following:

(qemu) info tpm
TPM devices:
  tpm0: model=tpm-tis
   \ tpm0: type=passthrough,path=/dev/tpm0

Signed-off-by: Stefan Berger 
---
  hmp-commands.hx  |   2 +
  hmp.c|  30 
  hmp.h|   1 +
  hw/tpm_tis.h |  78 
  monitor.c|   8 ++
  qapi-schema.json |  32 
  qemu-config.c|  20 +
  qemu-options.hx  |  33 +
  qmp-commands.hx  |   5 ++
  tpm.c| 217 +++
  tpm.h|  84 +
  vl.c |  17 +
  12 files changed, 527 insertions(+)
  create mode 100644 hw/tpm_tis.h
  create mode 100644 tpm.c
  create mode 100644 tpm.h

diff --git a/hmp-commands.hx b/hmp-commands.hx
index 010b8c9..b3a1005 100644
--- a/hmp-commands.hx
+++ b/hmp-commands.hx
@@ -1570,6 +1570,8 @@ show device tree
  show qdev device model list
  @item info roms
  show roms
+@item info tpm
+show the TPM device
  @end table
  ETEXI

diff --git a/hmp.c b/hmp.c
index 180ba2b..8d63d03 100644
--- a/hmp.c
+++ b/hmp.c
@@ -628,6 +628,36 @@ void hmp_info_block_jobs(Monitor *mon)
  }
  }

+void hmp_info_tpm(Monitor *mon)
+{
+TPMInfoList *info_list, *info;
+Error *err = NULL;
+unsigned int c = 0;
+
+info_list = qmp_query_tpm(&err);
+if (err) {
+monitor_printf(mon, "TPM device not supported\n");
+error_free(err);
+return;
+}
+
+monitor_printf(mon, "TPM device:\n");
+
+for (info = info_list; info; info = info->next) {
+TPMInfo *ti = info->value;
+monitor_printf(mon, " tpm%d: model=%s\n",
+   c, ti->model);
+monitor_printf(mon, "  \\ %s: type=%s%s%s%s%s\n",
+   ti->id, ti->type,
+   ti->has_path ? ",path=" : "",
+   ti->has_path ? ti->path : "",
+   ti->has_cancel_path ? ",cancel_path=" : "",
+   ti->has_cancel_path ? ti->cancel_path : "");


Does this cause spacing issues if path is not specified and cancel_path is?


+c++;
+}
+qapi_free_TPMInfoList(info_list);
+}
+
  void hmp_quit(Monitor *mon, const QDict *qdict)
  {
  monitor_suspend(mon);
diff --git a/hmp.h b/hmp.h
index 0ab03be..df43f7d 100644
--- a/hmp.h
+++ b/hmp.h
@@ -36,6 +36,7 @@ void hmp_info_spice(Monitor *mon);
  void hmp_info_balloon(Monitor *mon);
  void hmp_info_pci(Monitor *mon);
  void hmp_info_block_jobs(Monitor *mon);
+void hmp_info_tpm(Monitor *mon);
  void hmp_quit(Monitor *mon, const QDict *qdict);
  void hmp_stop(Monitor *mon, const QDict *qdict);
  void hmp_system_reset(Monitor *mon, const QDict *qdict);
diff --git a/hw/tpm_tis.h b/hw/tpm_tis.h
new file mode 100644
index 000..7f6dcb9
--- /dev/null
+++ b/hw/tpm_tis.h
@@ -0,0 +1,78 @@
+/*
+ * tpm_tis.c - QEMU's TPM TIS interface emulator


Should me point out somewhere that this is based on the v1.2 TIS?


+ *
+ * Copyright (C) 2006,2010,2011 IBM Corporation


Should this be updated to 2013?  That's a global comment throughout the 
patch series.



+ *
+ * Authors:
+ *  Stefan Berger 
+ *  David Safford 
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ *
+ * Implementation of the TIS interface according to specs found at
+ * http://www.trustedcomputiggroup.org
+ *
+ */
+#ifndef HW_TPM_TIS_H
+#define HW_TPM_TIS_H
+
+#include "isa.h"
+#include "qemu-common.h"
+
+#define TPM_TIS_ADDR_BASE   0xFED4
+
+#define TPM_TIS_NUM_LOCALITIES  5 /* per spec */
+#define TPM_TIS_LOCALITY_SHIFT  12
+#define TPM_TIS_NO_LOCALITY 0xff
+
+#define TPM_TIS_IS_VALID_LOCTY(x)   ((x) < TPM_TIS_NUM_LOCALITIES)
+
+#define TPM_TIS_IRQ 5
+
+#define TPM_TIS_BUFFER_MAX  4096
+
+
+typedef struct TPMSizedBuffer {
+uint32_t size;
+uint8_t  *buffer;
+} TPMSizedBuffer;
+
+typedef enum {
+TPM_TIS_STATE_IDLE = 0,
+TPM_TIS_STATE_R

[Qemu-devel] [PATCH 04/13] vmdk: Allow selecting SCSI adapter in image creation

[Stefan Hajnoczi]

From: Othmar Pasteka 

Introduce a new option "adapter_type" when converting to vmdk images.
It can be one of the following: ide (default), buslogic, lsilogic
or legacyESX (according to the vmdk spec from vmware).

In case of a non-ide adapter, heads is set to 255 instead of the 16.
The latter is used for "ide".

Also see LP#545089

Signed-off-by: Othmar Pasteka 
Signed-off-by: Stefan Hajnoczi 
---
 block/vmdk.c  | 31 ---
 include/block/block_int.h |  1 +
 2 files changed, 29 insertions(+), 3 deletions(-)

diff --git a/block/vmdk.c b/block/vmdk.c
index 8333afb..a8cb5c9 100644
--- a/block/vmdk.c
+++ b/block/vmdk.c
@@ -1442,6 +1442,7 @@ static int vmdk_create(const char *filename, 
QEMUOptionParameter *options)
 int fd, idx = 0;
 char desc[BUF_SIZE];
 int64_t total_size = 0, filesize;
+const char *adapter_type = NULL;
 const char *backing_file = NULL;
 const char *fmt = NULL;
 int flags = 0;
@@ -1453,6 +1454,7 @@ static int vmdk_create(const char *filename, 
QEMUOptionParameter *options)
 const char *desc_extent_line;
 char parent_desc_line[BUF_SIZE] = "";
 uint32_t parent_cid = 0x;
+uint32_t number_heads = 16;
 const char desc_template[] =
 "# Disk DescriptorFile\n"
 "version=1\n"
@@ -1469,9 +1471,9 @@ static int vmdk_create(const char *filename, 
QEMUOptionParameter *options)
 "\n"
 "ddb.virtualHWVersion = \"%d\"\n"
 "ddb.geometry.cylinders = \"%" PRId64 "\"\n"
-"ddb.geometry.heads = \"16\"\n"
+"ddb.geometry.heads = \"%d\"\n"
 "ddb.geometry.sectors = \"63\"\n"
-"ddb.adapterType = \"ide\"\n";
+"ddb.adapterType = \"%s\"\n";
 
 if (filename_decompose(filename, path, prefix, postfix, PATH_MAX)) {
 return -EINVAL;
@@ -1480,6 +1482,8 @@ static int vmdk_create(const char *filename, 
QEMUOptionParameter *options)
 while (options && options->name) {
 if (!strcmp(options->name, BLOCK_OPT_SIZE)) {
 total_size = options->value.n;
+} else if (!strcmp(options->name, BLOCK_OPT_ADAPTER_TYPE)) {
+adapter_type = options->value.s;
 } else if (!strcmp(options->name, BLOCK_OPT_BACKING_FILE)) {
 backing_file = options->value.s;
 } else if (!strcmp(options->name, BLOCK_OPT_COMPAT6)) {
@@ -1489,6 +1493,20 @@ static int vmdk_create(const char *filename, 
QEMUOptionParameter *options)
 }
 options++;
 }
+if (!adapter_type) {
+adapter_type = "ide";
+} else if (strcmp(adapter_type, "ide") &&
+   strcmp(adapter_type, "buslogic") &&
+   strcmp(adapter_type, "lsilogic") &&
+   strcmp(adapter_type, "legacyESX")) {
+fprintf(stderr, "VMDK: Unknown adapter type: '%s'.\n", adapter_type);
+return -EINVAL;
+}
+if (strcmp(adapter_type, "ide") != 0) {
+/* that's the number of heads with which vmware operates when
+   creating, exporting, etc. vmdk files with a non-ide adapter type */
+number_heads = 255;
+}
 if (!fmt) {
 /* Default format to monolithicSparse */
 fmt = "monolithicSparse";
@@ -1576,7 +1594,8 @@ static int vmdk_create(const char *filename, 
QEMUOptionParameter *options)
 parent_desc_line,
 ext_desc_lines,
 (flags & BLOCK_FLAG_COMPAT6 ? 6 : 4),
-total_size / (int64_t)(63 * 16 * 512));
+total_size / (int64_t)(63 * number_heads * 512), number_heads,
+adapter_type);
 if (split || flat) {
 fd = qemu_open(filename,
O_WRONLY | O_CREAT | O_TRUNC | O_BINARY | O_LARGEFILE,
@@ -1661,6 +1680,12 @@ static QEMUOptionParameter vmdk_create_options[] = {
 .help = "Virtual disk size"
 },
 {
+.name = BLOCK_OPT_ADAPTER_TYPE,
+.type = OPT_STRING,
+.help = "Virtual adapter type, can be one of "
+"ide (default), lsilogic, buslogic or legacyESX"
+},
+{
 .name = BLOCK_OPT_BACKING_FILE,
 .type = OPT_STRING,
 .help = "File name of a base image"
diff --git a/include/block/block_int.h b/include/block/block_int.h
index f7279b9..eaad53e 100644
--- a/include/block/block_int.h
+++ b/include/block/block_int.h
@@ -56,6 +56,7 @@
 #define BLOCK_OPT_SUBFMT"subformat"
 #define BLOCK_OPT_COMPAT_LEVEL  "compat"
 #define BLOCK_OPT_LAZY_REFCOUNTS"lazy_refcounts"
+#define BLOCK_OPT_ADAPTER_TYPE  "adapter_type"
 
 typedef struct BdrvTrackedRequest BdrvTrackedRequest;
 
-- 
1.8.1

[Qemu-devel] [PATCH 13/13] block/raw-posix: Build fix for O_ASYNC

[Stefan Hajnoczi]

From: Andreas Färber 

Commit eeb6b45d48800e96f67ef2a5c80332557fd45ddb (block: raw-posix image
file reopen) broke the build on OpenIndiana.

illumos has no O_ASYNC. Exclude it from flags to be compared
and instead assert that it is not set where defined.

Cf. e61ab1da7e98357da47c54d8f893b9bd6ff2f7f9 for qemu-ga.

Cc: qemu-sta...@nongnu.org (1.3.x)
Cc: Jeff Cody 
Suggested-by: Paolo Bonzini 
Signed-off-by: Andreas Färber 
Signed-off-by: Stefan Hajnoczi 
---
 block/raw-posix.c | 11 ++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/block/raw-posix.c b/block/raw-posix.c
index 657af95..8b6b926 100644
--- a/block/raw-posix.c
+++ b/block/raw-posix.c
@@ -345,11 +345,20 @@ static int raw_reopen_prepare(BDRVReopenState *state,
 
 raw_s->fd = -1;
 
-int fcntl_flags = O_APPEND | O_ASYNC | O_NONBLOCK;
+int fcntl_flags = O_APPEND | O_NONBLOCK;
 #ifdef O_NOATIME
 fcntl_flags |= O_NOATIME;
 #endif
 
+#ifdef O_ASYNC
+/* Not all operating systems have O_ASYNC, and those that don't
+ * will not let us track the state into raw_s->open_flags (typically
+ * you achieve the same effect with an ioctl, for example I_SETSIG
+ * on Solaris). But we do not use O_ASYNC, so that's fine.
+ */
+assert((s->open_flags & O_ASYNC) == 0);
+#endif
+
 if ((raw_s->open_flags & ~fcntl_flags) == (s->open_flags & ~fcntl_flags)) {
 /* dup the original fd */
 /* TODO: use qemu fcntl wrapper */
-- 
1.8.1

[Qemu-devel] [buildbot patch 6/6] add log tail to failure reports

[Gerd Hoffmann]

Signed-off-by: Gerd Hoffmann 
---
 qemu-master.cfg |   27 +++
 1 file changed, 27 insertions(+)

diff --git a/qemu-master.cfg b/qemu-master.cfg
index 04d26bf..b54ceb4 100644
--- a/qemu-master.cfg
+++ b/qemu-master.cfg
@@ -45,6 +45,32 @@ emailAddressesNotify = ["gol...@b1-systems.de", 
"qemu-devel@nongnu.org", "agraf@
 
 ### STATUS TARGETS
 
+def logtailMessageFormatter(mode, name, build, results, master_status):
+result = Results[results]
+defmsg = mail.defaultMessage(mode, name, build, results, master_status);
+text = list();
+text.append(defmsg['body']);
+
+# get log for last step
+logs = build.getLogs()
+for log in reversed(logs):
+if log.getName() == 'stdio':
+break
+content = log.getText().splitlines() # Note: can be VERY LARGE
+url = "%s/steps/%s/logs/%s" % (master_status.getURLForThing(build),
+   log.getStep().getName(),
+   log.getName())
+
+# append log info to standard message
+text.append("== log tail ==")
+for line in content[-32:]:
+text.append(unicode(line,'utf8'))
+text.append("")
+text.append("== full log ==")
+text.append(url);
+
+return { 'body' : "\n".join(text), 'type' : 'plain' }
+
 c['status'] = []
 
 from buildbot.status import html
@@ -57,6 +83,7 @@ c['status'].append(
 fromaddr=emailAddressFrom,
 mode='problem', # only send mail about a build which failed when the 
previous build passed
 extraRecipients=emailAddressesNotify,
+messageFormatter=logtailMessageFormatter,
 sendToInterestedUsers=False
   )
 )
-- 
1.7.9.7

[Qemu-devel] [PATCH 01/13] qemu-iotests: Add regression test for b7ab0fea

[Stefan Hajnoczi]

From: Kevin Wolf 

It turned out that the change in b7ab0fea was actually a real qcow2
corruption fix. This is a reproducer for the bug.

Signed-off-by: Kevin Wolf 
Signed-off-by: Stefan Hajnoczi 
---
 tests/qemu-iotests/047 | 75 ++
 tests/qemu-iotests/047.out | 22 ++
 tests/qemu-iotests/group   |  1 +
 3 files changed, 98 insertions(+)
 create mode 100755 tests/qemu-iotests/047
 create mode 100644 tests/qemu-iotests/047.out

diff --git a/tests/qemu-iotests/047 b/tests/qemu-iotests/047
new file mode 100755
index 000..0cf36b4
--- /dev/null
+++ b/tests/qemu-iotests/047
@@ -0,0 +1,75 @@
+#!/bin/bash
+#
+# Regression test for commit b7ab0fea (which was a corruption fix,
+# despite the commit message claiming otherwise)
+#
+# Copyright (C) 2013 Red Hat, Inc.
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see .
+#
+
+# creator
+owner=kw...@redhat.com
+
+seq=`basename $0`
+echo "QA output created by $seq"
+
+here=`pwd`
+tmp=/tmp/$$
+status=1   # failure is the default!
+
+_cleanup()
+{
+   _cleanup_test_img
+}
+trap "_cleanup; exit \$status" 0 1 2 3 15
+
+# get standard environment, filters and checks
+. ./common.rc
+. ./common.filter
+
+_supported_fmt qcow2
+_supported_proto generic
+_supported_os Linux
+
+size=128M
+
+_make_test_img $size
+
+function qemu_io_cmds()
+{
+cat < wrote 327680/327680 bytes at offset 0
+320 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+qemu-io> wrote 131072/131072 bytes at offset 327680
+128 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+qemu-io> wrote 131072/131072 bytes at offset 1048576
+128 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+qemu-io> wrote 131072/131072 bytes at offset 458752
+128 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+qemu-io> discard 131072/131072 bytes at offset 327680
+128 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+qemu-io> qemu-io> qemu-io> wrote 491520/491520 bytes at offset 0
+480 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+qemu-io> qemu-io> qemu-io> read 491520/491520 bytes at offset 0
+480 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+qemu-io> read 98304/98304 bytes at offset 491520
+96 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+qemu-io> read 131072/131072 bytes at offset 1048576
+128 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+qemu-io> No errors were found on the image.
+*** done
diff --git a/tests/qemu-iotests/group b/tests/qemu-iotests/group
index a0307de..1bbd2bf 100644
--- a/tests/qemu-iotests/group
+++ b/tests/qemu-iotests/group
@@ -53,3 +53,4 @@
 044 rw auto
 045 rw auto
 046 rw auto aio
+047 rw auto
-- 
1.8.1

[Qemu-devel] [buildbot patch 5/6] save config.log

[Gerd Hoffmann]

Signed-off-by: Gerd Hoffmann 
---
 qemu-master.cfg |4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/qemu-master.cfg b/qemu-master.cfg
index 2502ced..04d26bf 100644
--- a/qemu-master.cfg
+++ b/qemu-master.cfg
@@ -699,7 +699,9 @@ def create_build_factory(repourl, branch="HEAD",
 f.addStep(Configure(command=[configure,
  "--disable-debug-info"] +
 list(configure_args),
-env={'LANG': 'C'}, workdir=workdir))
+env={'LANG': 'C'},
+logfiles={"config.log": "config.log"},
+workdir=workdir))
 f.addStep(Compile(command=[make],
   env={'LANG': 'C'},
   timeout=2400,
-- 
1.7.9.7

[Qemu-devel] [PATCH 06/13] bochs: Fix bdrv_open() error handling

[Stefan Hajnoczi]

From: Kevin Wolf 

Return -errno instead of -1 on errors. While touching the
code, fix a memory leak.

Signed-off-by: Kevin Wolf 
Signed-off-by: Stefan Hajnoczi 
---
 block/bochs.c | 22 +++---
 1 file changed, 15 insertions(+), 7 deletions(-)

diff --git a/block/bochs.c b/block/bochs.c
index 3737583..a6eb33d 100644
--- a/block/bochs.c
+++ b/block/bochs.c
@@ -114,11 +114,13 @@ static int bochs_open(BlockDriverState *bs, int flags)
 int i;
 struct bochs_header bochs;
 struct bochs_header_v1 header_v1;
+int ret;
 
 bs->read_only = 1; // no write support yet
 
-if (bdrv_pread(bs->file, 0, &bochs, sizeof(bochs)) != sizeof(bochs)) {
-goto fail;
+ret = bdrv_pread(bs->file, 0, &bochs, sizeof(bochs));
+if (ret < 0) {
+return ret;
 }
 
 if (strcmp(bochs.magic, HEADER_MAGIC) ||
@@ -138,9 +140,13 @@ static int bochs_open(BlockDriverState *bs, int flags)
 
 s->catalog_size = le32_to_cpu(bochs.extra.redolog.catalog);
 s->catalog_bitmap = g_malloc(s->catalog_size * 4);
-if (bdrv_pread(bs->file, le32_to_cpu(bochs.header), s->catalog_bitmap,
-   s->catalog_size * 4) != s->catalog_size * 4)
-   goto fail;
+
+ret = bdrv_pread(bs->file, le32_to_cpu(bochs.header), s->catalog_bitmap,
+ s->catalog_size * 4);
+if (ret < 0) {
+goto fail;
+}
+
 for (i = 0; i < s->catalog_size; i++)
le32_to_cpus(&s->catalog_bitmap[i]);
 
@@ -153,8 +159,10 @@ static int bochs_open(BlockDriverState *bs, int flags)
 
 qemu_co_mutex_init(&s->lock);
 return 0;
- fail:
-return -1;
+
+fail:
+g_free(s->catalog_bitmap);
+return ret;
 }
 
 static int64_t seek_to_sector(BlockDriverState *bs, int64_t sector_num)
-- 
1.8.1

Re: [Qemu-devel] [PATCH 4/7 v2] KVM regsync: Add register bitmap parameter to do_kvm_cpu_synchronize_state

[Jason J. Herne]

On 01/24/2013 07:40 AM, Alexander Graf wrote:

I think for now the best choice for get_regs() would be to ignore the 
FULL/RESET bits and always keep the syncing as it happens today under the 
RUNTIME umbrella only. So all of get_regs() only checks for RUNTIME.

Whenever get_xxx() happens, a bit gets set for set_xxx(). Up to this point, 
only the RUNTIME bit is ever set, because that's what 
cpu_synchronize_registers() sets.

Then s390 can add special separate bits for "sync GPRs" and "sync CRs". 
SYNC_RUNTIME would include those bits. The kvm hypercall exit calls a new synchronize_registers() 
function with a parameter telling it to only sync GPRs. This marks GPRs dirty, but not RUNTIME. The 
set_registers() function in s390 specific code could handle this particular case specially.

That way everything's solved and scalable, no?

Alex



Ok, based on the discussions we've had I think I have a plan of attack 
based on Alex's above suggestion.  I believe it also satisfies the 
concerns Marcelo pointed out.  Please correct me if I'm wrong.


kvm_arch_get_registers() stays exactly as is for all architectures 
(reads RUNTIME state only). No new parameters.


Each architecture defines arch specific bits for runtime/reset/full states:
#define KVM_REGSYNC_I386_RUNTIME_BIT  (1 << 1)
#define KVM_REGSYNC_I386_RESET_BIT(1 << 2)
#define KVM_REGSYNC_I386_FULL_BIT (1 << 3)

Each architecture defines generic bits (for use in platform agnostic 
code: kvm-all.c) for runtime/reset/full states:

#define KVM_REGSYNC_RUNTIME_STATEKVM_REGSYNC_I386_RUNTIME_BIT
#define KVM_REGSYNC_RESET_STATE  KVM_REGSYNC_I386_RESET_BIT
#define KVM_REGSYNC_FULL_STATE   KVM_REGSYNC_I386_FULL_BIT

S390: replace KVM_REGSYNC_S390_RUNTIME_BIT with two new bits so the S390 
arch specific bits look like this:

#define KVM_REGSYNC_S390_RUNTIME_SOME_BIT  (1 << 1)
#define KVM_REGSYNC_S390_RUNTIME_REST_BIT  (1 << 2)
#define KVM_REGSYNC_S390_RESET_BIT (1 << 3)
#define KVM_REGSYNC_S390_FULL_BIT  (1 << 4)
The idea being that SOME represents the set of RUNTIME registers we 
always want to read when we exit from KVM. And REST represents the set 
of RUNTIME registers we want to read for migration/dump and potentially 
other special cases.  My understanding is that SOME and REST should be 
mutually exclusive.  I think they need better names as well :).


S390 defines it's generic bits like this:
#define KVM_REGSYNC_RUNTIME_STATE
(KVM_REGSYNC_S390_RUNTIME_SOME_BIT |
KVM_REGSYNC_S390_RUNTIME_REST_BIT)
#define KVM_REGSYNC_RESET_STATE  KVM_REGSYNC_S390_RESET_BIT
#define KVM_REGSYNC_FULL_STATEKVM_REGSYNC_S390_FULL_BIT

S390: A new function is created: s390_sync_partial_runtime_registers(int 
bitmap).  The bitmap argument indicates which of the SOME/REST register 
sets to read.  Either this new function or perhaps the caller will 
update the cpu->kvm_vcpu_dirty bitmap to indicate which regs are now dirty.


S390: On the hot paths we call 
s390_sync_partial_runtime_registers(KVM_REGSYNC_S390_RUNTIME_SOME_BIT) 
instead of cpu_synchronize_state() to read only the set of runtime 
registers we need on the hot path.  If at some later point 
cpu_synchronize_state() happens to be called then the S390 version of 
kvm_arch_get_registers() needs to be smart enough to avoid data loss. 
So we make it write back all dirty registers (env->kvm_vcpu_dirty) 
before getting anything.


I think this works.  Comments please and thank you!! :)

--
-- Jason J. Herne (jjhe...@linux.vnet.ibm.com)

[Qemu-devel] [PATCH 11/13] parallels: Fix bdrv_open() error handling

[Stefan Hajnoczi]

From: Kevin Wolf 

Return -errno instead of -1 on errors. Hey, no memory leak to fix here
while we're touching it!

Signed-off-by: Kevin Wolf 
Signed-off-by: Stefan Hajnoczi 
---
 block/parallels.c | 23 +++
 1 file changed, 15 insertions(+), 8 deletions(-)

diff --git a/block/parallels.c b/block/parallels.c
index 3773750..8688f6c 100644
--- a/block/parallels.c
+++ b/block/parallels.c
@@ -73,14 +73,18 @@ static int parallels_open(BlockDriverState *bs, int flags)
 BDRVParallelsState *s = bs->opaque;
 int i;
 struct parallels_header ph;
+int ret;
 
 bs->read_only = 1; // no write support yet
 
-if (bdrv_pread(bs->file, 0, &ph, sizeof(ph)) != sizeof(ph))
+ret = bdrv_pread(bs->file, 0, &ph, sizeof(ph));
+if (ret < 0) {
 goto fail;
+}
 
 if (memcmp(ph.magic, HEADER_MAGIC, 16) ||
-   (le32_to_cpu(ph.version) != HEADER_VERSION)) {
+(le32_to_cpu(ph.version) != HEADER_VERSION)) {
+ret = -EMEDIUMTYPE;
 goto fail;
 }
 
@@ -90,18 +94,21 @@ static int parallels_open(BlockDriverState *bs, int flags)
 
 s->catalog_size = le32_to_cpu(ph.catalog_entries);
 s->catalog_bitmap = g_malloc(s->catalog_size * 4);
-if (bdrv_pread(bs->file, 64, s->catalog_bitmap, s->catalog_size * 4) !=
-   s->catalog_size * 4)
-   goto fail;
+
+ret = bdrv_pread(bs->file, 64, s->catalog_bitmap, s->catalog_size * 4);
+if (ret < 0) {
+goto fail;
+}
+
 for (i = 0; i < s->catalog_size; i++)
le32_to_cpus(&s->catalog_bitmap[i]);
 
 qemu_co_mutex_init(&s->lock);
 return 0;
+
 fail:
-if (s->catalog_bitmap)
-   g_free(s->catalog_bitmap);
-return -1;
+g_free(s->catalog_bitmap);
+return ret;
 }
 
 static int64_t seek_to_sector(BlockDriverState *bs, int64_t sector_num)
-- 
1.8.1

[Qemu-devel] [buildbot patch 1/6] add linebreaks to make create_build_factory more readable

[Gerd Hoffmann]

Signed-off-by: Gerd Hoffmann 
---
 qemu-master.cfg |   24 ++--
 1 file changed, 18 insertions(+), 6 deletions(-)

diff --git a/qemu-master.cfg b/qemu-master.cfg
index 03db6ee..2f793c1 100644
--- a/qemu-master.cfg
+++ b/qemu-master.cfg
@@ -681,17 +681,29 @@ from buildbot.steps.shell import Configure, Compile, 
ShellCommand, Test
 #  test=None
 #)
 
-def create_build_factory(repourl, branch="HEAD", make="make", 
configure_args=[], outoftree=False):
+def create_build_factory(repourl, branch="HEAD",
+ make="make", configure_args=[],
+ outoftree=False):
 """Return a BuildFactory pre-configured with common build steps"""
 f = factory.BuildFactory()
-f.addStep(Git(repourl=repourl, timeout=2400, mode='copy', retry=(5 * 60, 
3), locks=repo_locks_from_url(repourl)))
+f.addStep(Git(repourl=repourl,
+  timeout=2400, mode='copy', retry=(5 * 60, 3),
+  locks=repo_locks_from_url(repourl)))
 workdir = f.workdir
 if outoftree:
-f.addStep(ShellCommand(command="mkdir -p outoftree", env={'LANG': 
'C'}))
+f.addStep(ShellCommand(command="mkdir -p outoftree",
+   env={'LANG': 'C'}))
 workdir = os.path.join(workdir, 'outoftree')
-f.addStep(Configure(command=["./configure"] + list(configure_args), 
env={'LANG': 'C'}, workdir=workdir))
-f.addStep(Compile(command=[make, "CFLAGS=-O2"], env={'LANG': 'C'}, 
timeout=2400, workdir=workdir))
-f.addStep(Test(command=[make, "check"], env={'LANG': 'C'}, maxTime=2400, 
workdir=workdir))
+f.addStep(Configure(command=["./configure"] + list(configure_args),
+env={'LANG': 'C'}, workdir=workdir))
+f.addStep(Compile(command=[make, "CFLAGS=-O2"],
+  env={'LANG': 'C'},
+  timeout=2400,
+  workdir=workdir))
+f.addStep(Test(command=[make, "check"],
+   env={'LANG': 'C'},
+   maxTime=2400,
+   workdir=workdir))
 return f
 
 f_default = create_build_factory("git://git.qemu-project.org/qemu.git")
-- 
1.7.9.7

[Qemu-devel] [buildbot patch 0/6] buildbot update

[Gerd Hoffmann]

  Hi,

Goes on top of stefans update.  Untested.  Shoveling
over some goodies from my local buildbot config.

https://github.com/kraxel/buildbot/tree/kraxel
(will create a pull req in a moment)

One question on the buildslave config (which isn't in the tree for
security reasons):  Do you have max_builds=1 in there, i.e. like
this:

c['slaves'].append(BuildSlave("rhel6.xenb", "idonttellyoumypasswd", 
max_builds=1))

This makes sure buildbot runs at most a single build per buildslave,
and I think this would make the slow_lock obsolete ...

cheers,
  Gerd

Gerd Hoffmann (6):
  add linebreaks to make create_build_factory more readable
  make tests configurable
  fix out-of-tree build
  use --disable-debug-info
  save config.log
  add log tail to failure reports

 qemu-master.cfg |   58 +--
 1 file changed, 52 insertions(+), 6 deletions(-)

-- 
1.7.9.7

Re: [Qemu-devel] [PATCH for-1.4] Revert "e1000: no need auto-negotiation if link was down"

[Amos Kong]

On Fri, Feb 01, 2013 at 08:49:00AM -0600, mdroth wrote:
> On Fri, Feb 01, 2013 at 03:53:22PM +0800, Amos Kong wrote:
> > On Fri, Feb 01, 2013 at 03:20:59PM +0800, Amos Kong wrote:
> > > On Thu, Jan 31, 2013 at 05:43:51PM -0600, Michael Roth wrote:
> > > > This reverts commit 84dd2120247a7d25ff1bb337de21c0e76816ad2d.
> > > > 
> > > > I'm not sure what issue the original commit was meant to fix, or if
> > > > the logic is actually wrong, but it causes e1000 to stop working
> > > > after a guest issues a reset.
> > > 
> > > Hi Michael,
> > > 
> > > What's your test scenario?
> > > 
> > > I tried this test with current qemu code, link status is not reseted
> > > to 'up' after step 3. Is it the problem you said?
> > > This problem also exists with current virtio (existed in the past) /
> > > rtl8139 (introduced in 83f58e570f21c3e7227e7fbef1fc0e18b5ed7ea9)
> > > 
> > > 1) boot a guest with e1000 nic
> > > 2) set link down in monitor
> > >(hmp) set_link e1000.0 down
> > > 3) reset guest by 'system_reset' in monitor
> > >(hmp) system_reset
> > > 
> > > 
> > > My original patch is used to restore the link status after guest
> > > reboot(execute 'reboot' insider guest system).
> > 
> > > The link status should always be up after virtual 'hardware' reset
> > > (execute 'system_reset' in monitor).
> > 
> > Is it expected?
> > 
> > When we reset the virtual system, do we need to reset the status
> > of simulation of network cable?
> 
> I don't so. If we "unplug the cable", it should stay unplugged when we
> reset the machine.

Ok.
 
> When we reset the machine, we should set the NIC's link status in
> accordance with it's NetClient peer. So if that's what your patch was
> attempting to enforce I think we're in agreement there.
> 
> I think the problem with your original patch is that it doesn't check
> the link status of the nic's NetClient peer, but instead checks it's
> own internal NetClient state, so we end up trying to enforce "leave the
> cable unplugged" even when "set_link down" was never issued.
> 
> And if that's the case I think you can re-spin your original patch for
> 1.4 accordingly. But we definitely need to revert the current one ASAP
> since it breaks all QEMU guests that are started using the default nic.

Agree, thanks.

[Qemu-devel] [PATCH v2 4/9] slirp: switch to GPollFD

[Stefan Hajnoczi]

Slirp uses rfds/wfds/xfds more extensively than other QEMU components.

The rarely-used out-of-band TCP data feature is used.  That means we
need the full table of select(2) to g_poll(3) events:

  rfds -> G_IO_IN | G_IO_HUP | G_IO_ERR
  wfds -> G_IO_OUT | G_IO_ERR
  xfds -> G_IO_PRI

I came up with this table by looking at Linux fs/select.c which maps
select(2) to poll(2) internally.

Another detail to watch out for are the global variables that reference
rfds/wfds/xfds during slirp_select_poll().  sofcantrcvmore() and
sofcantsendmore() use these globals to clear fd_set bits.  When
sofcantrcvmore() is called, the wfds bit is cleared so that the write
handler will no longer be run for this iteration of the event loop.

This actually seems buggy to me since TCP connections can be half-closed
and we'd still want to handle data in half-duplex fashion.  I think the
real intention is to avoid running the read/write handler when the
socket has been fully closed.  This is indicated with the SS_NOFDREF
state bit so we now check for it before invoking the TCP write handler.
Note that UDP/ICMP code paths don't care because they are
connectionless.

Note that slirp/ has a lot of tabs and sometimes mixed tabs with spaces.
I followed the style of the surrounding code.

Signed-off-by: Stefan Hajnoczi 
---
 main-loop.c  |   4 +-
 slirp/libslirp.h |   6 +--
 slirp/main.h |   1 -
 slirp/slirp.c| 136 +--
 slirp/socket.c   |   9 
 slirp/socket.h   |   2 +
 stubs/slirp.c|   6 +--
 7 files changed, 89 insertions(+), 75 deletions(-)

diff --git a/main-loop.c b/main-loop.c
index 12b0213..49e97ff 100644
--- a/main-loop.c
+++ b/main-loop.c
@@ -503,13 +503,13 @@ int main_loop_wait(int nonblocking)
 
 #ifdef CONFIG_SLIRP
 slirp_update_timeout(&timeout);
-slirp_select_fill(&nfds, &rfds, &wfds, &xfds);
+slirp_pollfds_fill(gpollfds);
 #endif
 qemu_iohandler_fill(&nfds, &rfds, &wfds, &xfds);
 ret = os_host_main_loop_wait(timeout);
 qemu_iohandler_poll(&rfds, &wfds, &xfds, ret);
 #ifdef CONFIG_SLIRP
-slirp_select_poll(&rfds, &wfds, &xfds, (ret < 0));
+slirp_pollfds_poll(gpollfds, (ret < 0));
 #endif
 
 qemu_run_all_timers();
diff --git a/slirp/libslirp.h b/slirp/libslirp.h
index 49609c2..ceabff8 100644
--- a/slirp/libslirp.h
+++ b/slirp/libslirp.h
@@ -17,11 +17,9 @@ Slirp *slirp_init(int restricted, struct in_addr vnetwork,
 void slirp_cleanup(Slirp *slirp);
 
 void slirp_update_timeout(uint32_t *timeout);
-void slirp_select_fill(int *pnfds,
-   fd_set *readfds, fd_set *writefds, fd_set *xfds);
+void slirp_pollfds_fill(GArray *pollfds);
 
-void slirp_select_poll(fd_set *readfds, fd_set *writefds, fd_set *xfds,
-   int select_error);
+void slirp_pollfds_poll(GArray *pollfds, int select_error);
 
 void slirp_input(Slirp *slirp, const uint8_t *pkt, int pkt_len);
 
diff --git a/slirp/main.h b/slirp/main.h
index 66e4f92..f2e58cf 100644
--- a/slirp/main.h
+++ b/slirp/main.h
@@ -31,7 +31,6 @@ extern int ctty_closed;
 extern char *slirp_tty;
 extern char *exec_shell;
 extern u_int curtime;
-extern fd_set *global_readfds, *global_writefds, *global_xfds;
 extern struct in_addr loopback_addr;
 extern unsigned long loopback_mask;
 extern char *username;
diff --git a/slirp/slirp.c b/slirp/slirp.c
index 0e6e232..967b836 100644
--- a/slirp/slirp.c
+++ b/slirp/slirp.c
@@ -39,9 +39,6 @@ static const uint8_t special_ethaddr[ETH_ALEN] = {
 
 static const uint8_t zero_ethaddr[ETH_ALEN] = { 0, 0, 0, 0, 0, 0 };
 
-/* XXX: suppress those select globals */
-fd_set *global_readfds, *global_writefds, *global_xfds;
-
 u_int curtime;
 static u_int time_fasttimo, last_slowtimo;
 static int do_slowtimo;
@@ -261,7 +258,6 @@ void slirp_cleanup(Slirp *slirp)
 
 #define CONN_CANFSEND(so) (((so)->so_state & 
(SS_FCANTSENDMORE|SS_ISFCONNECTED)) == SS_ISFCONNECTED)
 #define CONN_CANFRCV(so) (((so)->so_state & (SS_FCANTRCVMORE|SS_ISFCONNECTED)) 
== SS_ISFCONNECTED)
-#define UPD_NFDS(x) if (nfds < (x)) nfds = (x)
 
 void slirp_update_timeout(uint32_t *timeout)
 {
@@ -270,23 +266,15 @@ void slirp_update_timeout(uint32_t *timeout)
 }
 }
 
-void slirp_select_fill(int *pnfds,
-   fd_set *readfds, fd_set *writefds, fd_set *xfds)
+void slirp_pollfds_fill(GArray *pollfds)
 {
 Slirp *slirp;
 struct socket *so, *so_next;
-int nfds;
 
 if (QTAILQ_EMPTY(&slirp_instances)) {
 return;
 }
 
-/* fail safe */
-global_readfds = NULL;
-global_writefds = NULL;
-global_xfds = NULL;
-
-nfds = *pnfds;
/*
 * First, TCP sockets
 */
@@ -302,8 +290,12 @@ void slirp_select_fill(int *pnfds,
 
for (so = slirp->tcb.so_next; so != &slirp->tcb;
 so = so_next) {
+   int events = 0;
+
so_next = so->so_next;
 
+   so->pollfds_idx = -1;
+
/*