As best I can tell, this is a false positive.

  [aliguori@ccnode4 qemu-s390]$ make
    CC    s390x-softmmu/target-s390x/helper.o
  /home/aliguori/git/qemu/target-s390x/helper.c: In function ‘do_interrupt’:
  /home/aliguori/git/qemu/target-s390x/helper.c:673:17: error: ‘addr’ may be used uninitialized in this function [-Werror=maybe-uninitialized]
  /home/aliguori/git/qemu/target-s390x/helper.c:620:20: note: ‘addr’ was declared here
  /home/aliguori/git/qemu/target-s390x/helper.c:673:17: error: ‘mask’ may be used uninitialized in this function [-Werror=maybe-uninitialized]
  /home/aliguori/git/qemu/target-s390x/helper.c:620:14: note: ‘mask’ was declared here
  cc1: all warnings being treated as errors
  make[1]: *** [target-s390x/helper.o] Error 1
  make: *** [subdir-s390x-softmmu] Error 2

Cc: Cornelia Huck <cornelia.huck@de.ibm.com>
Cc: Stefan Weil <sw@weilnetz.de>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

b0b873a0 bumped the vmstate version and
introduced an old-style load function to handle migration from prior
(<= 1.2) versions.

The load function passes the top-level PIIX4PMState pointer to
vmstate_load_state() to handle nested structs for APMState and
pci_status, which leads to corruption of the top-level PIIX4PMState,
since pointers to the nested structs are expected.

A segfault can be fairly reliably triggered by migrating from 1.2 and
issuing a reset, which will trigger a number of QOM operations which
rely on the now corrupted ObjectClass/Object members.

Fix this by passing in the expected pointers for vmstate_load_state().

Cc: qemu-stable@nongnu.org
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

- Accept empty strings without aborting
- Use parse_uint*() to parse numbers
- Abort if anything except '-' or end-of-string is found after the first
  number.
- Check for endvalue < value

Also change the MAX_CPUMASK_BITS warning message from "A max of %d CPUs
are supported in a guest" to "qemu: NUMA: A max of %d VCPUs are
supported".
Signed-off-by: NEduardo Habkost <ehabkost@redhat.com>
Reviewed-by: NEric Blake <eblake@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

This will make it easier to refactor that code later.
Signed-off-by: NEduardo Habkost <ehabkost@redhat.com>
Reviewed-by: NEric Blake <eblake@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

This should catch many kinds of errors that the current code wasn't
checking for:

 - Values that can't be parsed as a number
 - Negative values
 - Overflow
 - Empty string
Signed-off-by: NEduardo Habkost <ehabkost@redhat.com>
Reviewed-by: NEric Blake <eblake@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Without this check, QEMU will corrupt memory if a too-large nodeid is
provided in the command-line. e.g.:

  -numa node,mem=...,cpus=...,nodeid=65

This changes nodenr to unsigned long long, to avoid integer conversion
issues when converting the strtoull() result to int.
Signed-off-by: NEduardo Habkost <ehabkost@redhat.com>
Reviewed-by: NEric Blake <eblake@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Instead of checking the limit before calling numa_add(), check the limit
only when we already know we're going to add a new node.
Signed-off-by: NEduardo Habkost <ehabkost@redhat.com>
Reviewed-by: NEric Blake <eblake@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Abort in case an invalid -numa option is provided, instead of silently
ignoring it.
Signed-off-by: NEduardo Habkost <ehabkost@redhat.com>
Reviewed-by: NEric Blake <eblake@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

The numa_add() code was unconditionally adding 1 to the get_opt_name()
return value, making it point after the end of the string if no ','
separator is present.

Example of weird behavior caused by the bug:

  $ qemu-img create -f qcow2 this-file-image-has,cpus=5,mem=1000,in-its-name.qcow2 5G
  Formatting 'this-file-image-has,cpus=5,mem=1000,in-its-name.qcow2', fmt=qcow2 size=5368709120 encryption=off cluster_size=65536
  $ ./x86_64-softmmu/qemu-system-x86_64 -S -monitor stdio -numa node 'this-file-image-has,cpus=5,mem=1000,in-its-name.qcow2'
  QEMU 1.3.50 monitor - type 'help' for more information
  (qemu) info numa
  1 nodes
  node 0 cpus: 0
  node 0 size: 1000 MB
  (qemu)

This changes the code to nove the pointer only if ',' is found.
Signed-off-by: NEduardo Habkost <ehabkost@redhat.com>
Reviewed-by: NEric Blake <eblake@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

There are lots of duplicate parsing code using strto*() in QEMU, and
most of that code is broken in one way or another. Even the visitors
code have duplicate integer parsing code[1]. This introduces functions
to help parsing unsigned int values: parse_uint() and parse_uint_full().

Parsing functions for signed ints and floats will be submitted later.

parse_uint_full() has all the checks made by opts_type_uint64() at
opts-visitor.c:

 - Check for NULL (returns -EINVAL)
 - Check for negative numbers (returns -EINVAL)
 - Check for empty string (returns -EINVAL)
 - Check for overflow or other errno values set by strtoll() (returns
   -errno)
 - Check for end of string (reject invalid characters after number)
   (returns -EINVAL)

parse_uint() does everything above except checking for the end of the
string, so callers can continue parsing the remainder of string after
the number.

Unit tests included.

[1] string-input-visitor.c:parse_int() could use the same parsing code
    used by opts-visitor.c:opts_type_int(), instead of duplicating that
    logic.
Signed-off-by: NEduardo Habkost <ehabkost@redhat.com>
Reviewed-by: NEric Blake <eblake@redhat.com>
Reviewed-by: NLaszlo Ersek <lersek@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Around r3361 (81fdc5f8) env->debug1 used
to contain the address of an MMU fault. This is now written into
env->pregs[PR_EDA] instead.
Signed-off-by: NAndreas Färber <afaerber@suse.de>
Signed-off-by: NEdgar E. Iglesias <edgar.iglesias@gmail.com>

We had two copies of a ffs function for longs with subtly different
semantics and, for the one in bitops.h, a confusing name: the result
was off-by-one compared to the library function ffsl.

Unify the functions into one, and solve the name problem by calling
the 0-based functions "bitops_ctzl" and "bitops_ctol" respectively.

This also fixes the build on platforms with ffsl, including Mac OS X
and Windows.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Reviewed-by: NEric Blake <eblake@redhat.com>
Tested-by: NAndreas Färber <afaerber@suse.de>
Tested-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

MinGW has no strtok_r, so we need a declaration in sysemu/os-win32.h.
We must also fix the include statements in util/envlist.c to include
that file.

We currently don't need an implementation of strtok_r because the
code is compiled but not linked for MinGW.
Signed-off-by: NStefan Weil <sw@weilnetz.de>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

The multiqueue patch series broke -netdev tap,fd=X which manifests
as libvirt not being able to start a guest.  This was because it
passed NULL for the netdev name which results in an anonymous netdev
device regardless of what the user specified.

Cc: Jason Wang <jasowang@redhat.com>
Cc: Bruce Rogers <brogers@suse.com>
Reported-by: NBruce Rogers <brogers@suse.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

This is now unused.  Document the initial reference count of an object
and when it will be freed/finalized.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

CPUs are never added to the composition tree, so delete is achieved
simply by removing the last references to them.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

qdev_free and qbus_free have to do unparent+unref, because nobody else
drops the initial reference (the one included by object_initialize)
before them.

For device_init_func and do_device_add, this is trivially correct,
since the DeviceState goes out of scope.

For qdev_create, qdev_try_create and qbus_init, it is a bit more tricky.
What we are doing here is just assuming that the caller knows what it's
doing, and won't call qdev_free/qbus_free while the device is still there.
This is a pretty reasonable assumption and (behind the scenes) is also
what GObject/GTK does.  GTK actually has a "floating reference" that
goes away as soon as the caller does gtk_container_add or something
like that, but in the end qbus_init and qdev_try_create are already
adding the new object to its qdev parent!  So in the end the two solutions
are the same.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

We want object_delete to disappear, and we will do this one class at a
time.  Inline it for the qdev case, which we will tackle first.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Now that the unparent callbacks are complete, we can correctly account
more missing references.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Similarly, a bus holds a reference back to the device, and this will
prevent the device from going away as soon as this reference is counted
properly.  To avoid this, move the unrealization of devices to the
unparent callback.  This includes recursively unparenting all the buses
and (after the previous patch) the devices on those buses, which ensures
that the web of references completely disappears for all devices that
reside (in the qdev tree) below the one being unplugged.

After this patch, the qdev tree and the bus<->child relationship is
defined as "A is above B, iff unplugging A will automatically unplug B".
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

A device will never be finalized as long as it has a reference from
other devices that sit on its buses.  To ensure that the references
go away, deassociate a bus from its children in the unparent callback
for the bus.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Each device has a reference through the BusChild.  This reference
was not accounted for, add it now.
Reviewed-by: NAndreas Färber <afaerber@suse.de>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Avoid that the object disappears after it's deleted from the QOM
composition tree, in case that was the only reference to it.
Acked-by: NAndreas Färber <afaerber@suse.de>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Remove knowledge of QOM innards.  The common part of pci_bus_new and
pci_bus_new_inplace is moved to a new function pci_bus_init.
Acked-by: NAndreas Färber <afaerber@suse.de>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Make it clear that no BUS() macro is needed in the callers (in fact it
wouldn't work because the object has not been initialized yet with the
right class).
Suggested-by: NAndreas Faerber <afaerber@suse.de>
Acked-by: NAndreas F=E4rber <afaerber@suse.de>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Move the common part to qbus_realize.
Acked-by: NAndreas Färber <afaerber@suse.de>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Signed-off-by: Nliguang <lig.fnst@cn.fujitsu.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

command:
qemu-system-x86_64 -hda disk.img -smp 32 --enable-kvm
error:
Number of SMP cpus requested (32) exceeds max cpus supported by KVM (16)
failed to initialize KVM: Invalid argument
No accelerator found!

well, it did find kvm, but failed to init,
so message "No accelerator found!" is confusing,
this commit remove the confusing error message.
Signed-off-by: Nliguang <lig.fnst@cn.fujitsu.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Signed-off-by: Nliguang <lig.fnst@cn.fujitsu.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

We've seen this repeatedly in buildbot but I can now reliably
reproduce it myself too.  With a few hundred runs of 'make check',
qemu-system-sparc will hang consuming 100% CPU.  I've attached GDB
to the hung process and unfortunately, I can't get anything useful
out of GDB (RIP is not a valid simple and there is nothing else on
the stack).

At any rate, since this only manifests in qemu-system-sparc and it
doesn't appear to be a qtest specific problem, I think we should
disable it until the problem is resolved.
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

# By Kevin Wolf (7) and others
# Via Stefan Hajnoczi
* stefanha/block:
  block/raw-posix: Build fix for O_ASYNC
  vmdk: Allow space in file name
  parallels: Fix bdrv_open() error handling
  dmg: Use g_free instead of free
  dmg: Fix bdrv_open() error handling
  vpc: Fix bdrv_open() error handling
  cloop: Fix bdrv_open() error handling
  bochs: Fix bdrv_open() error handling
  sheepdog: pass vdi_id to sheep daemon for sd_close()
  vmdk: Allow selecting SCSI adapter in image creation
  block: Adds mirroring tests for resized images
  block: Fix is_allocated_above with resized files
  qemu-iotests: Add regression test for b7ab0fea

Reported-by Andreas Färber <afaerber@suse.de>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Disable multiqueue support for pre 1.4.
Signed-off-by: NJason Wang <jasowang@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

This patch add migration support for multiqueue virtio-net. Instead of bumping
the version, we conditionally send the info of multiqueue only when the device
support more than one queue to maintain the backward compatibility.
Signed-off-by: NJason Wang <jasowang@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

This patch implements both userspace and vhost support for multiple queue
virtio-net (VIRTIO_NET_F_MQ). This is done by introducing an array of
VirtIONetQueue to VirtIONet.
Signed-off-by: NJason Wang <jasowang@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

To support multiqueue virtio-net, the first step is to separate the virtqueue
related fields from VirtIONet to a new structure VirtIONetQueue. The following
patches will add an array of VirtIONetQueue to VirtIONet based on this patch.
Signed-off-by: NJason Wang <jasowang@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Add a queue_index to VirtQueue and a helper to fetch it, this could be used by
multiqueue supported device.
Signed-off-by: NJason Wang <jasowang@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Some device (such as virtio-net) needs the ability to destroy or re-order the
virtqueues, this patch adds a helper to do this.

Signed-off-by: Jason Wang <jasowang>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>