aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2017-02-24qcow2: Use BB for resizing in qcow2_amend_options()Kevin Wolf
In order to able to convert bdrv_truncate() to take a BdrvChild and later to correctly check the resize permission here, we need to use a BlockBackend for resizing the image. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com>
2017-02-24blockdev: Use BlockBackend to resize in qmp_block_resize()Kevin Wolf
In order to be able to do permission checking and to keep working with the BdrvChild based bdrv_truncate() that this involves, we need to create a temporary BlockBackend to resize the image. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com>
2017-02-24iotests: Fix another race in 030John Snow
We can't rely on a non-paused job to be present and running for us. Assume that if the job is not present that it completed already. Signed-off-by: John Snow <jsnow@redhat.com> Reviewed-by: Fam Zheng <famz@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2017-02-24qemu-img: Improve documentation for PREALLOC_MODE_FALLOCNir Soffer
Now that we are truncating the file in both PREALLOC_MODE_FULL and PREALLOC_MODE_OFF, not truncating in PREALLOC_MODE_FALLOC looks odd. Add a comment explaining why we do not truncate in this case. Signed-off-by: Nir Soffer <nirsof@gmail.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2017-02-24qemu-img: Truncate before full preallocationNir Soffer
In a previous commit (qemu-img: Do not truncate before preallocation) we moved truncate to the PREALLOC_MODE_OFF branch to avoid slowdown in posix_fallocate(). However this change is not optimal when using PREALLOC_MODE_FULL, since knowing the final size from the beginning could allow the file system driver to do less allocations and possibly avoid fragmentation of the file. Now we truncate also before doing full preallocation. Signed-off-by: Nir Soffer <nirsof@gmail.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2017-02-24qemu-img: Add tests for raw image preallocationNir Soffer
Add tests for creating raw image with and without the preallocation option. Signed-off-by: Nir Soffer <nirsof@gmail.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2017-02-24qemu-img: Do not truncate before preallocationNir Soffer
When using file system that does not support fallocate() (e.g. NFS < 4.2), truncating the file only when preallocation=OFF speeds up creating raw file. Here is example run, tested on Fedora 24 machine, creating raw file on NFS version 3 server. $ time ./qemu-img-master create -f raw -o preallocation=falloc mnt/test 1g Formatting 'mnt/test', fmt=raw size=1073741824 preallocation=falloc real 0m21.185s user 0m0.022s sys 0m0.574s $ time ./qemu-img-fix create -f raw -o preallocation=falloc mnt/test 1g Formatting 'mnt/test', fmt=raw size=1073741824 preallocation=falloc real 0m11.601s user 0m0.016s sys 0m0.525s $ time dd if=/dev/zero of=mnt/test bs=1M count=1024 oflag=direct 1024+0 records in 1024+0 records out 1073741824 bytes (1.1 GB, 1.0 GiB) copied, 15.6627 s, 68.6 MB/s real 0m16.104s user 0m0.009s sys 0m0.220s Running with strace we can see that without this change we do one pread() and one pwrite() for each block. With this change, we do only one pwrite() per block. $ strace ./qemu-img-master create -f raw -o preallocation=falloc mnt/test 8192 ... pread64(9, "\0", 1, 4095) = 1 pwrite64(9, "\0", 1, 4095) = 1 pread64(9, "\0", 1, 8191) = 1 pwrite64(9, "\0", 1, 8191) = 1 $ strace ./qemu-img-fix create -f raw -o preallocation=falloc mnt/test 8192 ... pwrite64(9, "\0", 1, 4095) = 1 pwrite64(9, "\0", 1, 8191) = 1 This happens because posix_fallocate is checking if each block is allocated before writing a byte to the block, and when truncating the file before preallocation, all blocks are unallocated. Signed-off-by: Nir Soffer <nirsof@gmail.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2017-02-24qemu-iotests: redirect nbd server stdout to /dev/nullJeff Cody
Some iotests (e.g. 174) try to filter the output of _make_test_image by piping the stdout. Pipe the server stdout to /dev/null, so that filter pipe does not need to wait until process completion. Signed-off-by: Jeff Cody <jcody@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2017-02-24qemu-iotests: add ability to exclude certain protocols from testsJeff Cody
Add the ability for shell script tests to exclude specific protocols. This is useful to allow all protocols except ones known to not support a feature used in the test (e.g. .bdrv_create). Signed-off-by: Jeff Cody <jcody@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2017-02-24qemu-iotests: Test 137 only supports 'file' protocolJeff Cody
Since test 137 make uses of qcow2.py, only local files are supported. Signed-off-by: Jeff Cody <jcody@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2017-02-24Merge remote-tracking branch 'remotes/armbru/tags/pull-qapi-2017-02-22' into ↵Peter Maydell
staging QAPI patches for 2017-02-22 # gpg: Signature made Wed 22 Feb 2017 19:12:27 GMT # gpg: using RSA key 0x3870B400EB918653 # gpg: Good signature from "Markus Armbruster <armbru@redhat.com>" # gpg: aka "Markus Armbruster <armbru@pond.sub.org>" # Primary key fingerprint: 354B C8B3 D7EB 2A6B 6867 4E5F 3870 B400 EB91 8653 * remotes/armbru/tags/pull-qapi-2017-02-22: block: Don't bother asserting type of output visitor's output monitor: Clean up handle_hmp_command() a bit tests: Don't check qobject_type() before qobject_to_qbool() tests: Don't check qobject_type() before qobject_to_qfloat() tests: Don't check qobject_type() before qobject_to_qint() tests: Don't check qobject_type() before qobject_to_qstring() tests: Don't check qobject_type() before qobject_to_qlist() Don't check qobject_type() before qobject_to_qdict() test-qmp-event: Simplify and tighten event_test_emit() libqtest: Clean up qmp_response() a bit check-qjson: Simplify around compare_litqobj_to_qobj() check-qdict: Tighten qdict_crumple_test_recursive() some check-qdict: Simplify qdict_crumple_test_recursive() qdict: Make qdict_get_qlist() safe like qdict_get_qdict() net: Flatten simple union NetLegacyOptions numa: Flatten simple union NumaOptions Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-24cpu-exec: remove unnecessary check of cpu->exit_requestPaolo Bonzini
The cpu->exit_request check in cpu_loop_exec_tb is unnecessary, because cpu->tcg_exit_req is always set after cpu->exit_request. So let the TB exit and we will pick up the exit request later in cpu_handle_interrupt. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-02-24replay: check icount in cpu exec loopPavel Dovgalyuk
This patch adds check to break cpu loop when icount expires without setting the TB_EXIT_ICOUNT_EXPIRED flag. It happens when there is no available translated blocks and all instructions were executed. In icount replay mode unnecessary tb_find will be called (which may cause an exception) and execution will be non-deterministic. Because cpu_loop_exec_tb cannot longjmp anymore, we can remove the anticipated call to align_clocks in cpu_loop_exec_tb, as well as the SyncClocks *sc argument. Signed-off-by: Pavel Dovgalyuk <pavel.dovgaluk@ispras.ru> Message-Id: <002801d2810f$18809c20$4981d460$@ru> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Pavel Dovgalyuk <dovgaluk@ispras.ru>
2017-02-24Merge remote-tracking branch ↵Peter Maydell
'remotes/kraxel/tags/pull-cve-2017-2620-20170224-1' into staging cirrus: add blit_is_unsafe call to cirrus_bitblt_cputovideo (CVE-2017-2620) # gpg: Signature made Fri 24 Feb 2017 13:42:39 GMT # gpg: using RSA key 0x4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * remotes/kraxel/tags/pull-cve-2017-2620-20170224-1: cirrus: add blit_is_unsafe call to cirrus_bitblt_cputovideo (CVE-2017-2620) Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-24cirrus: add blit_is_unsafe call to cirrus_bitblt_cputovideo (CVE-2017-2620)Gerd Hoffmann
CIRRUS_BLTMODE_MEMSYSSRC blits do NOT check blit destination and blit width, at all. Oops. Fix it. Security impact: high. The missing blit destination check allows to write to host memory. Basically same as CVE-2014-8106 for the other blit variants. Cc: qemu-stable@nongnu.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2017-02-24Merge remote-tracking branch 'remotes/kraxel/tags/pull-usb-20170223-1' into ↵Peter Maydell
staging usb: ohci bugfix, switch core to unrealize, xhci property cleanup # gpg: Signature made Thu 23 Feb 2017 15:37:57 GMT # gpg: using RSA key 0x4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * remotes/kraxel/tags/pull-usb-20170223-1: xhci: properties cleanup usb: ohci: fix error return code in servicing td usb: replace handle_destroy with unrealize Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-24hw/mips: MIPS Boston board supportPaul Burton
Introduce support for emulating the MIPS Boston development board. The Boston board is built around an FPGA & 3 PCIe controllers, one of which is connected to an Intel EG20T Platform Controller Hub. It is used during the development & debug of new CPUs and the software intended to run on them, and is essentially the successor to the older MIPS Malta board. This patch does not implement the EG20T, instead connecting an already supported ICH-9 AHCI controller. Whilst this isn't accurate it's enough for typical stock Boston software (eg. Linux kernels) to work with hard disks given that both the ICH-9 & EG20T implement the AHCI specification. Boston boards typically boot kernels in the FIT image format, and this patch will treat kernels provided to QEMU as such. When loading a kernel directly, the board code will generate minimal firmware much as the Malta board code does. This firmware will set up the CM, CPC & GIC register base addresses then set argument registers & jump to the kernel entry point. Alternatively, bootloader code may be loaded using the bios argument in which case no firmware will be generated & execution will proceed from the start of the boot code at the default MIPS boot exception vector (offset 0x1fc00000 into (c)kseg1). Currently real Boston boards are always used with FPGA bitfiles that include a Global Interrupt Controller (GIC), so the interrupt configuration is only defined for such cases. Therefore the board will only allow use of CPUs which implement the CPS components, including the GIC, and will otherwise exit with a message. Signed-off-by: Paul Burton <paul.burton@imgtec.com> Reviewed-by: Yongbok Kim <yongbok.kim@imgtec.com> [yongbok.kim@imgtec.com: isolated boston machine support for mips64el. updated for recent Chardev changes. ignore missing bios/kernel for qtest. added default -drive to if=ide explicitly. changed default memory size into 1G due to make check failure on 32-bit hosts] Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
2017-02-24tcg: enable MTTCG by default for ARM on x86 hostsAlex Bennée
This enables the multi-threaded system emulation by default for ARMv7 and ARMv8 guests using the x86_64 TCG backend. This is because on the guest side: - The ARM translate.c/translate-64.c have been converted to - use MTTCG safe atomic primitives - emit the appropriate barrier ops - The ARM machine has been updated to - hold the BQL when modifying shared cross-vCPU state - defer powerctl changes to async safe work All the host backends support the barrier and atomic primitives but need to provide same-or-better support for normal load/store operations. Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <rth@twiddle.net> Acked-by: Peter Maydell <peter.maydell@linaro.org> Tested-by: Pranith Kumar <bobby.prani@gmail.com> Reviewed-by: Pranith Kumar <bobby.prani@gmail.com>
2017-02-24hw/misc/imx6_src: defer clearing of SRC_SCR reset bitsAlex Bennée
The arm_reset_cpu/set_cpu_on/set_cpu_off() functions do their work asynchronously in the target vCPUs context. As a result we need to ensure the SRC_SCR reset bits correctly report the reset status at the right time. To do this we defer the clearing of the bit with an async job which will run after the work queued by ARM powerctl functions. Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-24target-arm: ensure all cross vCPUs TLB flushes completeAlex Bennée
Previously flushes on other vCPUs would only get serviced when they exited their TranslationBlocks. While this isn't overly problematic it violates the semantics of TLB flush from the point of view of source vCPU. To solve this we call the cputlb *_all_cpus_synced() functions to do the flushes which ensures all flushes are completed by the time the vCPU next schedules its own work. As the TLB instructions are modelled as CP writes the TB ends at this point meaning cpu->exit_request will be checked before the next instruction is executed. Deferring the work until the architectural sync point is a possible future optimisation. Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <rth@twiddle.net> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-24target-arm: don't generate WFE/YIELD calls for MTTCGAlex Bennée
The WFE and YIELD instructions are really only hints and in TCG's case they were useful to move the scheduling on from one vCPU to the next. In the parallel context (MTTCG) this just causes an unnecessary cpu_exit and contention of the BQL. Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <rth@twiddle.net> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-24target-arm/powerctl: defer cpu reset work to CPU contextAlex Bennée
When switching a new vCPU on we want to complete a bunch of the setup work before we start scheduling the vCPU thread. To do this cleanly we defer vCPU setup to async work which will run the vCPUs execution context as the thread is woken up. The scheduling of the work will kick the vCPU awake. This avoids potential races in MTTCG system emulation. Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <rth@twiddle.net> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-24cputlb: introduce tlb_flush_*_all_cpus[_synced]Alex Bennée
This introduces support to the cputlb API for flushing all CPUs TLBs with one call. This avoids the need for target helpers to iterate through the vCPUs themselves. An additional variant of the API (_synced) will cause the source vCPUs work to be scheduled as "safe work". The result will be all the flush operations will be complete by the time the originating vCPU executes its safe work. The calling implementation can either end the TB straight away (which will then pick up the cpu->exit_request on entering the next block) or defer the exit until the architectural sync point (usually a barrier instruction). Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <rth@twiddle.net>
2017-02-24cputlb: atomically update tlb fields used by tlb_reset_dirtyAlex Bennée
The main use case for tlb_reset_dirty is to set the TLB_NOTDIRTY flags in TLB entries to force the slow-path on writes. This is used to mark page ranges containing code which has been translated so it can be invalidated if written to. To do this safely we need to ensure the TLB entries in question for all vCPUs are updated before we attempt to run the code otherwise a race could be introduced. To achieve this we atomically set the flag in tlb_reset_dirty_range and take care when setting it when the TLB entry is filled. On 32 bit systems attempting to emulate 64 bit guests we don't even bother as we might not have the atomic primitives available. MTTCG is disabled in this case and can't be forced on. The copy_tlb_helper function helps keep the atomic semantics in one place to avoid confusion. The dirty helper function is made static as it isn't used outside of cputlb. Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <rth@twiddle.net>
2017-02-24cputlb: add tlb_flush_by_mmuidx async routinesAlex Bennée
This converts the remaining TLB flush routines to use async work when detecting a cross-vCPU flush. The only minor complication is having to serialise the var_list of MMU indexes into a form that can be punted to an asynchronous job. The pending_tlb_flush field on QOM's CPU structure also becomes a bitfield rather than a boolean. Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <rth@twiddle.net>
2017-02-24cputlb and arm/sparc targets: convert mmuidx flushes from varg to bitmapAlex Bennée
While the vargs approach was flexible the original MTTCG ended up having munge the bits to a bitmap so the data could be used in deferred work helpers. Instead of hiding that in cputlb we push the change to the API to make it take a bitmap of MMU indexes instead. For ARM some the resulting flushes end up being quite long so to aid readability I've tended to move the index shifting to a new line so all the bits being or-ed together line up nicely, for example: tlb_flush_page_by_mmuidx(other_cs, pageaddr, (1 << ARMMMUIdx_S1SE1) | (1 << ARMMMUIdx_S1SE0)); Signed-off-by: Alex Bennée <alex.bennee@linaro.org> [AT: SPARC parts only] Reviewed-by: Artyom Tarasenko <atar4qemu@gmail.com> Reviewed-by: Richard Henderson <rth@twiddle.net> [PM: ARM parts only] Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-24cputlb: introduce tlb_flush_* async work.KONRAD Frederic
Some architectures allow to flush the tlb of other VCPUs. This is not a problem when we have only one thread for all VCPUs but it definitely needs to be an asynchronous work when we are in true multithreaded work. We take the tb_lock() when doing this to avoid racing with other threads which may be invalidating TB's at the same time. The alternative would be to use proper atomic primitives to clear the tlb entries en-mass. This patch doesn't do anything to protect other cputlb function being called in MTTCG mode making cross vCPU changes. Signed-off-by: KONRAD Frederic <fred.konrad@greensocs.com> [AJB: remove need for g_malloc on defer, make check fixes, tb_lock] Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <rth@twiddle.net>
2017-02-24cputlb: tweak qemu_ram_addr_from_host_nofail reportingAlex Bennée
This moves the helper function closer to where it is called and updates the error message to report via error_report instead of the deprecated fprintf. Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <rth@twiddle.net>
2017-02-24cputlb: add assert_cpu_is_self checksAlex Bennée
For SoftMMU the TLB flushes are an example of a task that can be triggered on one vCPU by another. To deal with this properly we need to use safe work to ensure these changes are done safely. The new assert can be enabled while debugging to catch these cases. Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <rth@twiddle.net>
2017-02-24tcg: handle EXCP_ATOMIC exception for system emulationPranith Kumar
The patch enables handling atomic code in the guest. This should be preferably done in cpu_handle_exception(), but the current assumptions regarding when we can execute atomic sections cause a deadlock. The current mechanism discards the flags which were set in atomic execution. We ensure they are properly saved by calling the cc->cpu_exec_enter/leave() functions around the loop. As we are running cpu_exec_step_atomic() from the outermost loop we need to avoid an abort() when single stepping over atomic code since debug exception longjmp will point to the the setlongjmp in cpu_exec(). We do this by setting a new jmp_env so that it jumps back here on an exception. Signed-off-by: Pranith Kumar <bobby.prani@gmail.com> [AJB: tweak title, merge with new patches, add mmap_lock] Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <rth@twiddle.net> CC: Paolo Bonzini <pbonzini@redhat.com>
2017-02-24tcg: enable thread-per-vCPUAlex Bennée
There are a couple of changes that occur at the same time here: - introduce a single vCPU qemu_tcg_cpu_thread_fn One of these is spawned per vCPU with its own Thread and Condition variables. qemu_tcg_rr_cpu_thread_fn is the new name for the old single threaded function. - the TLS current_cpu variable is now live for the lifetime of MTTCG vCPU threads. This is for future work where async jobs need to know the vCPU context they are operating in. The user to switch on multi-thread behaviour and spawn a thread per-vCPU. For a simple test kvm-unit-test like: ./arm/run ./arm/locking-test.flat -smp 4 -accel tcg,thread=multi Will now use 4 vCPU threads and have an expected FAIL (instead of the unexpected PASS) as the default mode of the test has no protection when incrementing a shared variable. We enable the parallel_cpus flag to ensure we generate correct barrier and atomic code if supported by the front and backends. This doesn't automatically enable MTTCG until default_mttcg_enabled() is updated to check the configuration is supported. Signed-off-by: KONRAD Frederic <fred.konrad@greensocs.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> [AJB: Some fixes, conditionally, commit rewording] Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <rth@twiddle.net>
2017-02-24tcg: enable tb_lock() for SoftMMUAlex Bennée
tb_lock() has long been used for linux-user mode to protect code generation. By enabling it now we prepare for MTTCG and ensure all code generation is serialised by this lock. The other major structure that needs protecting is the l1_map and its PageDesc structures. For the SoftMMU case we also use tb_lock() to protect these structures instead of linux-user mmap_lock() which as the name suggests serialises updates to the structure as a result of guest mmap operations. Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <rth@twiddle.net>
2017-02-24tcg: remove global exit_requestAlex Bennée
There are now only two uses of the global exit_request left. The first ensures we exit the run_loop when we first start to process pending work and in the kick handler. This is just as easily done by setting the first_cpu->exit_request flag. The second use is in the round robin kick routine. The global exit_request ensured every vCPU would set its local exit_request and cause a full exit of the loop. Now the iothread isn't being held while running we can just rely on the kick handler to push us out as intended. We lightly re-factor the main vCPU thread to ensure cpu->exit_requests cause us to exit the main loop and process any IO requests that might come along. As an cpu->exit_request may legitimately get squashed while processing the EXCP_INTERRUPT exception we also check cpu->queued_work_first to ensure queued work is expedited as soon as possible. Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <rth@twiddle.net>
2017-02-24tcg: drop global lock during TCG code executionJan Kiszka
This finally allows TCG to benefit from the iothread introduction: Drop the global mutex while running pure TCG CPU code. Reacquire the lock when entering MMIO or PIO emulation, or when leaving the TCG loop. We have to revert a few optimization for the current TCG threading model, namely kicking the TCG thread in qemu_mutex_lock_iothread and not kicking it in qemu_cpu_kick. We also need to disable RAM block reordering until we have a more efficient locking mechanism at hand. Still, a Linux x86 UP guest and my Musicpal ARM model boot fine here. These numbers demonstrate where we gain something: 20338 jan 20 0 331m 75m 6904 R 99 0.9 0:50.95 qemu-system-arm 20337 jan 20 0 331m 75m 6904 S 20 0.9 0:26.50 qemu-system-arm The guest CPU was fully loaded, but the iothread could still run mostly independent on a second core. Without the patch we don't get beyond 32206 jan 20 0 330m 73m 7036 R 82 0.9 1:06.00 qemu-system-arm 32204 jan 20 0 330m 73m 7036 S 21 0.9 0:17.03 qemu-system-arm We don't benefit significantly, though, when the guest is not fully loading a host CPU. Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com> Message-Id: <1439220437-23957-10-git-send-email-fred.konrad@greensocs.com> [FK: Rebase, fix qemu_devices_reset deadlock, rm address_space_* mutex] Signed-off-by: KONRAD Frederic <fred.konrad@greensocs.com> [EGC: fixed iothread lock for cpu-exec IRQ handling] Signed-off-by: Emilio G. Cota <cota@braap.org> [AJB: -smp single-threaded fix, clean commit msg, BQL fixes] Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <rth@twiddle.net> Reviewed-by: Pranith Kumar <bobby.prani@gmail.com> [PM: target-arm changes] Acked-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-24tcg: rename tcg_current_cpu to tcg_current_rr_cpuAlex Bennée
..and make the definition local to cpus. In preparation for MTTCG the concept of a global tcg_current_cpu will no longer make sense. However we still need to keep track of it in the single-threaded case to be able to exit quickly when required. qemu_cpu_kick_no_halt() moves and becomes qemu_cpu_kick_rr_cpu() to emphasise its use-case. qemu_cpu_kick now kicks the relevant cpu as well as qemu_kick_rr_cpu() which will become a no-op in MTTCG. For the time being the setting of the global exit_request remains. Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <rth@twiddle.net> Reviewed-by: Pranith Kumar <bobby.prani@gmail.com>
2017-02-24tcg: add kick timer for single-threaded vCPU emulationAlex Bennée
Currently we rely on the side effect of the main loop grabbing the iothread_mutex to give any long running basic block chains a kick to ensure the next vCPU is scheduled. As this code is being re-factored and rationalised we now do it explicitly here. Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <rth@twiddle.net> Reviewed-by: Pranith Kumar <bobby.prani@gmail.com>
2017-02-24tcg: add options for enabling MTTCGKONRAD Frederic
We know there will be cases where MTTCG won't work until additional work is done in the front/back ends to support. It will however be useful to be able to turn it on. As a result MTTCG will default to off unless the combination is supported. However the user can turn it on for the sake of testing. Signed-off-by: KONRAD Frederic <fred.konrad@greensocs.com> [AJB: move to -accel tcg,thread=multi|single, defaults] Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <rth@twiddle.net>
2017-02-24tcg: move TCG_MO/BAR types into own fileAlex Bennée
We'll be using the memory ordering definitions to define values for both the host and guest. To avoid fighting with circular header dependencies just move these types into their own minimal header. Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <rth@twiddle.net>
2017-02-24mttcg: Add missing tb_lock/unlock() in cpu_exec_step()Pranith Kumar
The recent patch enabling lock assertions uncovered the missing lock acquisition in cpu_exec_step(). This patch adds them. Signed-off-by: Pranith Kumar <bobby.prani@gmail.com> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <rth@twiddle.net>
2017-02-24mttcg: translate-all: Enable locking debug in a debug buildPranith Kumar
Enable tcg lock debug asserts in a debug build by default instead of relying on DEBUG_LOCKING. None of the other DEBUG_* macros have asserts, so this patch removes DEBUG_LOCKING and enable these asserts in a debug build. CC: Richard Henderson <rth@twiddle.net> Signed-off-by: Pranith Kumar <bobby.prani@gmail.com> [AJB: tweak ifdefs so can be early in series] Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <rth@twiddle.net>
2017-02-24docs: new design document multi-thread-tcg.txtAlex Bennée
This documents the current design for upgrading TCG emulation to take advantage of modern CPUs by running a thread-per-CPU. The document goes through the various areas of the code affected by such a change and proposes design requirements for each part of the solution. The text marked with (Current solution[s]) to document what the current approaches being used are. Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <rth@twiddle.net>
2017-02-24Merge remote-tracking branch 'remotes/dgibson/tags/ppc-for-2.9-20170222' ↵Peter Maydell
into staging ppc patch queue for 2017-02-22 This pull request has: * Yet more POWER9 instruction implementations * Some extensions to the softfloat code which are necesssary for some of those instructions * Some preliminary patches in preparation for POWER9 softmmu implementation * Igor Mammedov's cleanups to unify hotplug cpu handling across architectures * Assorted bugfixes The softfloat and cpu hotplug changes aren't entirely ppc specific (in fact the hotplug stuff contains some pc specific patches). However they're included here because ppc is one of the main beneficiaries, and the series depend on some ppc specific patches. # gpg: Signature made Wed 22 Feb 2017 06:29:47 GMT # gpg: using RSA key 0x6C38CACA20D9B392 # gpg: Good signature from "David Gibson <david@gibson.dropbear.id.au>" # gpg: aka "David Gibson (Red Hat) <dgibson@redhat.com>" # gpg: aka "David Gibson (ozlabs.org) <dgibson@ozlabs.org>" # gpg: aka "David Gibson (kernel.org) <dwg@kernel.org>" # Primary key fingerprint: 75F4 6586 AE61 A66C C44E 87DC 6C38 CACA 20D9 B392 * remotes/dgibson/tags/ppc-for-2.9-20170222: (43 commits) hw/ppc/ppc405_uc.c: Avoid integer overflows hw/ppc/spapr: Check for valid page size when hot plugging memory target-ppc: fix Book-E TLB matching hw/net/spapr_llan: 6 byte mac address device tree entry machine: replace query_hotpluggable_cpus() callback with has_hotpluggable_cpus flag machine: unify [pc_|spapr_]query_hotpluggable_cpus() callbacks spapr: reuse machine->possible_cpus instead of cores[] change CPUArchId.cpu type to Object* pc: pass apic_id to pc_find_cpu_slot() directly so lookup could be done without CPU object pc: calculate topology only once when possible_cpus is initialised pc: move pcms->possible_cpus init out of pc_cpus_init() machine: move possible_cpus to MachineState hw/pci-host/prep: Do not use hw_error() in realize function target/ppc/POWER9: Direct all instr and data storage interrupts to the hypv target/ppc/POWER9: Adapt LPCR handling for POWER9 target/ppc/POWER9: Add ISAv3.00 MMU definition target/ppc: Fix LPCR DPFD mask define target-ppc: Add xscvqpudz and xscvqpuwz instructions target-ppc: Implement round to odd variants of quad FP instructions softfloat: Add float128_to_uint32_round_to_zero() ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-24s390x/css: handle format-0 TIC CCW correctlyDong Jia Shi
For TIC CCW, bit positions 8-32 of the format-1 CCW must contain zeros; otherwise, a program-check condition is generated. For format-0 TIC CCWs, bits 32-63 are ignored. To convert TIC from format-0 CCW to format-1 CCW correctly, let's clear bits 8-32 to guarantee compatibility. Reviewed-by: Pierre Morel <pmorel@linux.vnet.ibm.com> Signed-off-by: Dong Jia Shi <bjsdjshi@linux.vnet.ibm.com> Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
2017-02-24s390x/arch_dump: pass cpuid into notes sectionsChristian Borntraeger
we need to pass the cpuid into the pid field of the notes section, otherwise the notes for different CPUs all have 0: e.g. objdump -h shows: old: 5 .reg-s390-prefix/0 00000004 0000000000000000 0000000000000000 6 .reg-s390-prefix 00000004 0000000000000000 0000000000000000 21 .reg-s390-prefix/0 00000004 0000000000000000 0000000000000000 new: 5 .reg-s390-prefix/1 00000004 0000000000000000 0000000000000000 6 .reg-s390-prefix 00000004 0000000000000000 0000000000000000 21 .reg-s390-prefix/2 00000004 0000000000000000 0000000000000000 Reported-by: Philipp Rudo <prudo@linux.vnet.ibm.com> Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com> Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
2017-02-24s390x/arch_dump: use proper note name and note sizeChristian Borntraeger
In binutils/libbfd (bfd/elf.c) it is enforced that all s390 specific ELF notes like e.g. NT_S390_PREFIX or NT_S390_CTRS have "LINUX" specified as note name and that the namesz is 6. Otherwise the notes are ignored. QEMU currently uses "CORE" for these notes. Up to now this has not been a real problem because the dump analysis tool "crash" does handle that. But it will break all programs that use libbfd for processing ELF notes. So fix this and use "LINUX" for all s390 specific notes to comply with libbfd. Also set the correct namesz. Reported-by: Philipp Rudo <prudo@linux.vnet.ibm.com> Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com> Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
2017-02-24virtio-ccw: support VIRTIO_QUEUE_MAX virtqueuesHalil Pasic
The maximal number of virtqueues per device can be limited on a per transport basis. For virtio-ccw this limit is defined by VIRTIO_CCW_QUEUE_MAX, however the limitation used to come form the number of adapter routes supported by flic (via notifiers). Recently the limitation of the flic was adjusted so that it can accommodate VIRTIO_QUEUE_MAX queues, and is in the meanwhile checked for separately too. Let us remove the transport specific limitation of virtio-ccw by dropping VIRTIO_CCW_QUEUE_MAX and using VIRTIO_QUEUE_MAX instead. Signed-off-by: Halil Pasic <pasic@linux.vnet.ibm.com> Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
2017-02-24s390x: bump ADAPTER_ROUTES_MAX_GSIHalil Pasic
Let's increase ADAPTER_ROUTES_MAX_GSI to VIRTIO_QUEUE_MAX which is the largest demand foreseeable at the moment. Let us add a compatibility macro for the previous machines so client code can maintain backwards migration compatibility To not mess up migration compatibility for virtio-ccw VIRTIO_CCW_QUEUE_MAX is left at it's current value, and will be dropped when virtio-ccw is converted to use the capability of the flic introduced by this patch. Signed-off-by: Halil Pasic <pasic@linux.vnet.ibm.com> Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
2017-02-24virtio-ccw: check flic->adapter_routes_max_batchHalil Pasic
Currently VIRTIO_CCW_QUEUE_MAX is defined as ADAPTER_ROUTES_MAX_GSI. That is when checking queue max we implicitly check the constraint concerning the number of adapter routes. This won't be satisfactory any more (due to backward migration considerations) if ADAPTER_ROUTES_MAX_GSI changes (ADAPTER_ROUTES_MAX_GSI is going to change because we want to support up to VIRTIO_QUEUE_MAX queues per virtio-ccw device). Let us introduce a check on a recently introduce flic property which gives us the compatibility machine aware limit on adapter routes. Signed-off-by: Halil Pasic <pasic@linux.vnet.ibm.com> Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
2017-02-24s390x: add property adapter_routes_max_batchHalil Pasic
To make virtio-ccw supports more that 64 virtqueues we will have to increase ADAPTER_ROUTES_MAX_GSI which is currently limiting the number if possible adapter routes. Of course increasing the number of supported routes can break backwards migration. Let us introduce a compatibility property adapter_routes_max_batch so client code can use the some old limit if in compatibility mode and retain the migration compatibility. Signed-off-by: Halil Pasic <pasic@linux.vnet.ibm.com> Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
2017-02-24virtio-ccw: Check the number of vqs in CCW_CMD_SET_INDHalil Pasic
We cannot support more than 64 virtqueues with the 64 bits provided by classic indicators. If a driver tries to setup classic indicators (which it is free to do even for virtio-1 devices) for a device with more than 64 virtqueues, we should reject the attempt so that the driver does not end up with an unusable device. This is in preparation for bumping the number of supported virtqueues on the ccw transport. Signed-off-by: Halil Pasic <pasic@linux.vnet.ibm.com> Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com> Reviewed-by: Christian Borntraeger <borntraeger@de.ibm.com> Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>