block: vhdx - minor comments and typo correction.

Just a couple of minor comments to help note where allocated
buffers are freed, and a typo fix.

Signed-off-by: Jeff Cody <jcody@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

block/vpc: fix virtual size for images created with disk2vhd

Signed-off-by: Peter Lieven <pl@kamp.de>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

block: Save errno before error_setg_errno

error_setg_errno() may overwrite errno; therefore, its value should be
read before calling that function and not afterwards.

Signed-off-by: Max Reitz <mreitz@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Benoit Canet <benoit@irqsave.net>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

qdev-monitor-test: add device_add leak test cases

Ensure that the device_add error code path deletes device objects.
Failure to do so not only leaks the objects but can also keep other
objects (like drive or netdev) alive due to qdev properties holding
references.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>

blockdev-test: add test case for drive_add duplicate IDs

The following should work:

  (qemu) drive_add if=none,id=drive0
  (qemu) drive_del drive0
  (qemu) drive_add if=none,id=drive0

Previous versions of QEMU produced a duplicate ID error because
drive_add leaked the options.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>

libqtest: add qmp(fmt, ...) -> QDict* function

Add a qtest qmp() function that returns the response object.  This
allows test cases to verify the result or to check for error responses.
It also allows waiting for QMP events.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Andreas Färber <afaerber@suse.de>

libqtest: rename qmp() to qmp_discard_response()

Existing qmp() callers do not expect a response object.  In order to
implement real QMP test cases it will be necessary to inspect the
response object.

Rename qmp() to qmp_discard_response().  Later patches will introduce a
qmp() function that returns the response object and tests that use it.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Andreas Färber <afaerber@suse.de>

blockdev: fix drive_init() opts and bs_opts leaks

These memory leaks also make drive_add if=none,id=drive0 without a file=
option leak the options list.  This keeps ID "drive0" around forever.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>

block: qemu-iotests, add quotes to $TEST_IMG usage in 061

When creating images with backing files in the test, the backing
file argument was not quoted properly.  This caused the test to fail
when run from a pathname with a space.  Pass the backing argument in
with the -b option to _make_test_img, so it can be properly quoted.

Signed-off-by: Jeff Cody <jcody@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

block: qemu-iotests, add quotes to $TEST_IMG usage for 051

There were still a couple of instances of unquoted usage of
$TEST_IMG and $TEST_IMG.orig.  Quoted these so they will not fail
on pathnames with spaces in them.

Signed-off-by: Jeff Cody <jcody@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

block: qemu-iotests, removes duplicate double quotes in 039

Test 039 had $TEST_IMG with duplicate double quotes - remove duplicate.

Signed-off-by: Jeff Cody <jcody@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

block: qemu-iotests, add quotes to $TEST_IMG usage in 019

There were still instances of $TEST_IMG not being properly quoted.
This was in the usage of a string built up for a 'for' loop; modify
the loop so we can quote $TEST_IMG properly.

Signed-off-by: Jeff Cody <jcody@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

block: qemu-iotests, add quotes to $TEST_IMG.base usage in 017

$TEST_IMG.base is used unquoted. Add quotes so that pathnames with
spaces are supported.

Signed-off-by: Jeff Cody <jcody@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

block: qemu-iotests, fix _make_test_img() to work with spaced pathnames

_make_test_img() currently works with spaced pathnames only when not
specifying a backing file.  This fixes it so that the backing file
argument is properly quoted.

Signed-off-by: Jeff Cody <jcody@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

block: qemu-iotests, add quotes to $TEST_IMG usage io pattern tests

The usage of $TEST_IMG was not properly quoted everywhere in
common.pattern.

Signed-off-by: Jeff Cody <jcody@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

block/raw-posix: fix FreeBSD compilation

The below patch is needed to compile qemu trunk on FreeBSD with gcc48,
clang will fail.... ;). Host x84_64-freebsd.

Signed-off-by: Andreas Tobler <andreast@FreeBSD.org>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

qemu-iotests: Filter out actual image size in 067

The actual size of the image file may differ depending on the Linux
kernel currently running on the host. Filtering out this value makes
this test pass in such cases.

Signed-off-by: Max Reitz <mreitz@redhat.com>
Reviewed-by: Benoit Canet <benoit@irqsave.net>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

qapi: Fix comment for create-type to match code.

Signed-off-by: Fam Zheng <famz@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

Update version for 1.7.0-rc0 release

Signed-off-by: Anthony Liguori <aliguori@amazon.com>

sdl: Reverse support for video mode setting

Currently, If the setting of video mode failed, qemu will exit. It
should go back to the previous setting if the new screen resolution
failed. This patch fixes LP#1216368, add support to revert to existing
surface for the failure of video mode setting.

Reported-by: Sascha Krissler <sascha@srlabs.de>
Signed-off-by: Lei Li <lilei@linux.vnet.ibm.com>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Message-id: 1378285636-7091-1-git-send-email-lilei@linux.vnet.ibm.com
Signed-off-by: Anthony Liguori <aliguori@amazon.com>

timers: fix stop/cont with -icount

Stop/cont commands are broken with -icount due to a deadlock.  The
real problem is that the computation of timers_state.cpu_ticks_offset
makes no sense with -icount enabled: we set it to an icount clock value
in cpu_disable_ticks, and subtract a TSC (or similar, whatever
cpu_get_real_ticks happens to return) value in cpu_enable_ticks.

The fix is simple.  timers_state.cpu_ticks_offset is only used
together with cpu_get_real_ticks, so we can use cpu_get_real_ticks
in cpu_disable_ticks.  There is no need to update cpu_ticks_prev
at the time cpu_disable_ticks is called; instead, we can do it
the next time cpu_get_ticks is called.

The change to cpu_disable_ticks is the important part of the patch.
The rest modifies the code to always check timers_state.cpu_ticks_prev,
even when the ticks are not advancing (i.e. the VM is stopped).  It also
makes a similar change to cpu_get_clock_locked, so that the code remains
similar for cpu_get_ticks and cpu_get_clock_locked.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Message-id: 1382977938-13844-1-git-send-email-pbonzini@redhat.com
Signed-off-by: Anthony Liguori <aliguori@amazon.com>

e1000/rtl8139: update HMP NIC when every bit is written

We currently just update the HMP NIC info when the last bit of macaddr
is written. This assumes that guest driver will write all the macaddr
from bit 0 to bit 5 when it changes the macaddr, this is the current
behavior of linux driver (e1000/rtl8139cp), but we can't do this
assumption.

The macaddr that is used for rx-filter will be updated when every bit
is changed. This patch updates the e1000/rtl8139 nic to update HMP NIC
info when every bit is changed. It will be same as virtio-net.

Signed-off-by: Amos Kong <akong@redhat.com>
Reviewed-by: Alex Williamson <alex.williamson@redhat.com>
Message-id: 1383650238-16015-1-git-send-email-akong@redhat.com
Signed-off-by: Anthony Liguori <aliguori@amazon.com>

virtio-net: only delete bh that existed

We delete without check whether it existed during exit. This will lead NULL
pointer deference since it was created conditionally depends on guest driver
status and features. So add a check of existence before trying to delete it.

Cc: qemu-stable@nongnu.org
Signed-off-by: Jason Wang <jasowang@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-id: 1383728288-28469-1-git-send-email-jasowang@redhat.com
Signed-off-by: Anthony Liguori <aliguori@amazon.com>

rtc: remove dead SQW IRQ code

This was once introduced by commit 100d9891d6 but was never used in-tree
and then got broken by commit 32e0c8260d. Time to clean up.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Message-id: 520B6A27.4040207@siemens.com
Signed-off-by: Anthony Liguori <aliguori@amazon.com>

vga: fix invalid read after free

After calling dpy_gfx_replace_surface(s->con, surface), the outer
surface is invalid.

==5370== Invalid read of size 4
==5370==    at 0x460229: surface_bits_per_pixel (console.h:250)
==5370==    by 0x466A81: get_depth_index (vga.c:1173)
==5370==    by 0x467EC2: vga_draw_graphic (vga.c:1718)
==5370==    by 0x4687A5: vga_update_display (vga.c:1914)
==5370==    by 0x2A782E: qxl_hw_update (qxl.c:1766)
==5370==    by 0x3EB83B: graphic_hw_update (console.c:254)
==5370==    by 0x3FBE31: qemu_spice_display_refresh (spice-display.c:418)
==5370==    by 0x2A7D01: display_refresh (qxl.c:1886)
==5370==    by 0x3EEE1C: dpy_refresh (console.c:1436)
==5370==    by 0x3EB543: gui_update (console.c:192)
==5370==    by 0x3C43B3: timerlist_run_timers (qemu-timer.c:488)
==5370==    by 0x3C4416: qemu_clock_run_timers (qemu-timer.c:499)
==5370==  Address 0x22ffb1e0 is 0 bytes inside a block of size 56 free'd
==5370==    at 0x4A074C4: free (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==5370==    by 0x4245FC: free_and_trace (vl.c:2771)
==5370==    by 0x50899AE: g_free (gmem.c:252)
==5370==    by 0x3EE8D3: qemu_free_displaysurface (console.c:1332)
==5370==    by 0x3EEDB7: dpy_gfx_replace_surface (console.c:1427)
==5370==    by 0x467EB6: vga_draw_graphic (vga.c:1714)
==5370==    by 0x4687A5: vga_update_display (vga.c:1914)
==5370==    by 0x2A782E: qxl_hw_update (qxl.c:1766)
==5370==    by 0x3EB83B: graphic_hw_update (console.c:254)
==5370==    by 0x3FBE31: qemu_spice_display_refresh (spice-display.c:418)
==5370==    by 0x2A7D01: display_refresh (qxl.c:1886)
==5370==    by 0x3EEE1C: dpy_refresh (console.c:1436)

Signed-off-by: Marc-André Lureau <marcandre.lureau@gmail.com>
Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
Message-id: 1383664554-15248-1-git-send-email-marcandre.lureau@gmail.com
Signed-off-by: Anthony Liguori <aliguori@amazon.com>

tests: fix 64-bit int literals for 32-bit hosts

On 32-bit hosts:

  CC    tests/test-opts-visitor.o
tests/test-opts-visitor.c: In function 'test_value':
tests/test-opts-visitor.c:128: warning: integer constant is too large for 'long' type
  CC    tests/test-bitops.o
tests/test-bitops.c:34: warning: integer constant is too large for 'long' type
tests/test-bitops.c:35: warning: integer constant is too large for 'long' type
tests/test-bitops.c:35: warning: integer constant is too large for 'long' type
  CC    tests/endianness-test.o
tests/endianness-test.c:47: warning: integer constant is too large for 'long' type

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Message-id: 1383669768-23926-1-git-send-email-stefanha@redhat.com
Signed-off-by: Anthony Liguori <aliguori@amazon.com>

docs/memory.txt: Clarify and expand priority/overlap documentation

The documentation of how overlapping memory regions behave and how
the priority system works was rather brief, and confusion about
priorities seems to be quite common for developers trying to understand
how the memory region system works, so expand and clarify it.
This includes a worked example with overlaps, documentation of the
behaviour when an overlapped container has "holes", and mention
that it's valid for a region to have both MMIO callbacks and
subregions (and how this interacts with priorities when it does).

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-id: 1381848154-31602-1-git-send-email-peter.maydell@linaro.org
Signed-off-by: Anthony Liguori <aliguori@amazon.com>

configure: detect endian via compile test

This avoids needing to execute a program and keeping an (incomplete)
list when cross-compiling.

Signed-off-by: Mike Frysinger <vapier@gentoo.org>
Reviewed-by: Richard Henderson <rth@twiddle.net>
Tested-by: James Hogan <james.hogan@imgtec.com> [mips]
Message-id: 1372649418-4987-1-git-send-email-vapier@gentoo.org
Signed-off-by: Anthony Liguori <aliguori@amazon.com>

tests: fix memleak in error path test for input visitor

Signed-off-by: Wenchao Xia <xiawenc@linux.vnet.ibm.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Message-id: 1383676551-18806-3-git-send-email-xiawenc@linux.vnet.ibm.com
Cc: qemu-stable@nongnu.org
Signed-off-by: Anthony Liguori <aliguori@amazon.com>

qapi: fix memleak by adding implict struct functions in dealloc visitor

Otherwise member "base" is leaked in a qapi_free_STRUCTURE() call.

Signed-off-by: Wenchao Xia <xiawenc@linux.vnet.ibm.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Message-id: 1383676551-18806-2-git-send-email-xiawenc@linux.vnet.ibm.com
Cc: qemu-stable@nongnu.org
Signed-off-by: Anthony Liguori <aliguori@amazon.com>

bswap.h: Remove cpu_to_32wu()

Replace the legacy cpu_to_32wu() with stl_p().

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <rth@twiddle.net>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-id: 1383669517-25598-10-git-send-email-peter.maydell@linaro.org
Signed-off-by: Anthony Liguori <aliguori@amazon.com>

bswap.h: Remove cpu_to_be64wu()

Replace the legacy cpu_to_be64wu() with stq_be_p().

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <rth@twiddle.net>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-id: 1383669517-25598-9-git-send-email-peter.maydell@linaro.org
Signed-off-by: Anthony Liguori <aliguori@amazon.com>

bswap.h: Remove cpu_to_be32wu()

Replace the legacy cpu_to_be32wu() with stl_be_p().

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <rth@twiddle.net>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-id: 1383669517-25598-8-git-send-email-peter.maydell@linaro.org
Signed-off-by: Anthony Liguori <aliguori@amazon.com>

bswap.h: Remove cpu_to_be16wu()

Replace the legacy cpu_to_be16wu() with stw_be_p().

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <rth@twiddle.net>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-id: 1383669517-25598-7-git-send-email-peter.maydell@linaro.org
Signed-off-by: Anthony Liguori <aliguori@amazon.com>

bswap.h: Remove be32_to_cpupu()

Replace the legacy be32_to_cpupu() with ldl_be_p().

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <rth@twiddle.net>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-id: 1383669517-25598-6-git-send-email-peter.maydell@linaro.org
Signed-off-by: Anthony Liguori <aliguori@amazon.com>

bswap.h: Remove le32_to_cpupu()

Replace the legacy le32_to_cpupu() with ldl_le_p().

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <rth@twiddle.net>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-id: 1383669517-25598-5-git-send-email-peter.maydell@linaro.org
Signed-off-by: Anthony Liguori <aliguori@amazon.com>

bswap.h: Remove le16_to_cpupu()

Replace the legacy le16_to_cpupu() with lduw_le_p().

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <rth@twiddle.net>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-id: 1383669517-25598-4-git-send-email-peter.maydell@linaro.org
Signed-off-by: Anthony Liguori <aliguori@amazon.com>

bswap.h: Remove cpu_to_le32wu()

Replace the legacy cpu_to_le32wu() with stl_le_p().

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <rth@twiddle.net>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-id: 1383669517-25598-3-git-send-email-peter.maydell@linaro.org
Signed-off-by: Anthony Liguori <aliguori@amazon.com>

bswap.h: Remove cpu_to_le16wu()

Replace the legacy cpu_to_le16wu() with stw_le_p().

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <rth@twiddle.net>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-id: 1383669517-25598-2-git-send-email-peter.maydell@linaro.org
Signed-off-by: Anthony Liguori <aliguori@amazon.com>

Merge remote-tracking branch 'afaerber/tags/qom-devices-for-anthony' into staging

QOM device refactorings

* QTest coverage for all machines
* QOM realize for Milkymist UART
* QOM realize for ARM MPCore
* device_add bug fixes and cleanups
* QOM for PCMCIA/MicroDrive (last legacy IDE device)

# gpg: Signature made Tue 05 Nov 2013 09:07:03 AM PST using RSA key ID 3E7E013F
# gpg: Can't check signature: public key not found

# By Andreas Färber (49) and others
# Via Andreas Färber
* afaerber/tags/qom-devices-for-anthony: (54 commits)
  pcmcia/pxa2xx: QOM'ify PXA2xxPCMCIAState
  ide: Drop ide_init2_with_non_qdev_drives()
  microdrive: Coding Style cleanups
  pcmcia: QOM'ify PCMCIACardState and MicroDriveState
  pxa: Fix typo "dettach"
  qom: Fix pointer to int property helpers' documentation
  qdev-monitor: Inline qdev_init() for device_add
  qdev-monitor: Avoid qdev as variable name
  qdev: Drop misleading qdev_free() function
  qdev-monitor: Unref device when device_add fails
  qdev-monitor: Fix crash when device_add is called with abstract driver
  qdev-monitor: Clean up qdev_device_add() variable naming
  arm11mpcore: Split off RealView MPCore
  arm11mpcore: Prepare for QOM embedding
  arm11mpcore: Convert mpcore_rirq_state to QOM realize
  realview_gic: Prepare for QOM embedding
  realview_gic: Convert to QOM realize
  arm11mpcore: Convert ARM11MPCorePriveState to QOM realize
  arm11mpcore: Split off SCU device
  arm11mpcore: Create container MemoryRegion in instance_init
  ...

pcmcia/pxa2xx: QOM'ify PXA2xxPCMCIAState

Turn it into a SysBusDevice and use a container MemoryRegion.

Add a link<pcmcia-card> property to the PCMCIACardState.

Signed-off-by: Andreas Färber <afaerber@suse.de>

ide: Drop ide_init2_with_non_qdev_drives()

All its users have finally been converted.

Signed-off-by: Andreas Färber <afaerber@suse.de>

microdrive: Coding Style cleanups

Add missing braces.

Signed-off-by: Andreas Färber <afaerber@suse.de>

pcmcia: QOM'ify PCMCIACardState and MicroDriveState

Turn PCMCIACardState into a device.
Move callbacks to new PCMCIACardClass.

Derive TYPE_MICRODRIVE from TYPE_PCMCIA_CARD.
Replace ide_init2_with_non_qdev_drives().

Signed-off-by: Othmar Pasteka <pasteka@kabsi.at>
Signed-off-by: Andreas Färber <afaerber@suse.de>

pxa: Fix typo "dettach"

Signed-off-by: Andreas Färber <afaerber@suse.de>

qom: Fix pointer to int property helpers' documentation

Relocate to alongside the other object_property_add_* helpers while at it.

Signed-off-by: Andreas Färber <afaerber@suse.de>

qdev-monitor: Inline qdev_init() for device_add

For historic reasons, qdev_init() unparents the device on failure.
Inline this to make the error paths clearer and consistent.

Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Signed-off-by: Andreas Färber <afaerber@suse.de>

qdev-monitor: Avoid qdev as variable name

Prepares for bringing error cleanup code into canonical QOM form.

Includes a whitespace removal after curly brace by Stefan.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Signed-off-by: Andreas Färber <afaerber@suse.de>

qdev: Drop misleading qdev_free() function

The qdev_free() function name is misleading since all the function does
is unlink the device from its parent.  The device is not necessarily
freed.

The device will be freed when its QObject refcount reaches zero.  It is
usual for the parent (bus) to hold the final reference but there are
cases where something else holds a reference so "free" is a misleading
name.

Call object_unparent(obj) directly instead of having a qdev wrapper
function.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Andreas Färber <afaerber@suse.de>

qdev-monitor: Unref device when device_add fails

qdev_device_add() leaks the created device upon failure.  I suspect this
problem crept in because qdev_free() unparents the device but does not
drop a reference - confusing name.

Cc: qemu-stable@nongnu.org
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Andreas Färber <afaerber@suse.de>

qdev-monitor: Fix crash when device_add is called with abstract driver

User is able to crash running QEMU when following monitor
command is called:

 device_add intel-hda-generic

Crash is caused by assertion in object_initialize_with_type()
when type is abstract.

Checking if type is abstract before instance is created in
qdev_device_add() allows to prevent crash on incorrect user input.

Cc: qemu-stable@nongnu.org
Signed-off-by: Igor Mammedov <imammedo@redhat.com>
Signed-off-by: Andreas Färber <afaerber@suse.de>

qdev-monitor: Clean up qdev_device_add() variable naming

Avoid confusion between object (obj) and object class (oc).
Tidy DeviceClass variable while at it (k -> dc).

Signed-off-by: Andreas Färber <afaerber@suse.de>

arm11mpcore: Split off RealView MPCore

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Andreas Färber <afaerber@suse.de>

arm11mpcore: Prepare for QOM embedding

Move state struct, type constant and cast macro to a new header.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Andreas Färber <afaerber@suse.de>

arm11mpcore: Convert mpcore_rirq_state to QOM realize

Embed ARM11MPCorePriveState and RealViewGICState and replace SysBus
initfn with realizefn.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Andreas Färber <afaerber@suse.de>

realview_gic: Prepare for QOM embedding

Move state struct, type constant and cast macro to a new header.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Andreas Färber <afaerber@suse.de>

realview_gic: Convert to QOM realize

Embed GICState and replace SysBus initfn with realizefn.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Andreas Färber <afaerber@suse.de>

arm11mpcore: Convert ARM11MPCorePriveState to QOM realize

Embed child devices and replace SysBus initfn with realizefn.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Andreas Färber <afaerber@suse.de>

arm11mpcore: Split off SCU device

Inspired by a9scu.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Andreas Färber <afaerber@suse.de>

arm11mpcore: Create container MemoryRegion in instance_init

This allows to map the region directly after object initialization.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Andreas Färber <afaerber@suse.de>

arm11mpcore: Drop unused fields

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Andreas Färber <afaerber@suse.de>

arm11mpcore: Fix typo in MemoryRegion name

"mpcode" -> "mpcore"

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Andreas Färber <afaerber@suse.de>

a9scu: Build only once

It does not have a target or ARMCPU dependency.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Andreas Färber <afaerber@suse.de>

a15mpcore: Prepare for QOM embedding

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Andreas Färber <andreas.faerber@web.de>

a15mpcore: Convert to QOM realize

Turn SysBusDevice initfn into a QOM realizefn.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Andreas Färber <andreas.faerber@web.de>

a15mpcore: Embed GICState

This covers both emulated and KVM GIC.

Prepares for QOM realize.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Andreas Färber <andreas.faerber@web.de>

a15mpcore: Split off instance_init

Prepares for QOM realize.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Andreas Färber <andreas.faerber@web.de>

a9mpcore: Prepare for QOM embedding

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Andreas Färber <andreas.faerber@web.de>

a9mpcore: Convert to QOM realize

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Andreas Färber <andreas.faerber@web.de>

a9mpcore: Embed ARMMPTimerState

Prepares for QOM realize.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Andreas Färber <andreas.faerber@web.de>

arm_mptimer: Convert to QOM realize

Split the SysBusDevice initfn into instance_init and realizefn.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Andreas Färber <andreas.faerber@web.de>

a9mpcore: Embed A9SCUState

Prepares for QOM realize.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Andreas Färber <andreas.faerber@web.de>

a9scu: QOM cleanups

Rename A9SCUState::busdev field to parent_obj and turn realizefn into an
instance_init function to allow early MMIO mapping.

Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Andreas Färber <andreas.faerber@web.de>

a9mpcore: Embed GICState

Prepares for conversion to QOM realize.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Andreas Färber <andreas.faerber@web.de>

arm_gic: Extract headers hw/intc/arm_gic{,_common}.h

Rename NCPU to GIC_NCPU and move GICState away from gic_internal.h.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Andreas Färber <afaerber@suse.de>

a9mpcore: Split off instance_init

Prepares for QOM realize.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Andreas Färber <andreas.faerber@web.de>

milkymist-uart: Use Device::realize instead of SysBusDevice::init

Use of SysBusDevice::init is deprecated. Use Device::realize instead.

Also introduce TypeInfo::instance_init milkymist_uart_init().

Reported-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
Signed-off-by: Antony Pavlov <antonynpavlov@gmail.com>
Signed-off-by: Andreas Färber <afaerber@suse.de>

qtest: Prepare QOM machine tests

Instantiate all [*] machines per target, so that they get a bit of test
coverage at all. This has proven helpful during QOM refactorings.

[*] ppcemb target contains some non-working non-embedded machines, and
ppc405 CPUs are not available there either.
i386 and x86_64 do not cover pc*-x.y or xenfv.

Signed-off-by: Andreas Färber <afaerber@suse.de>

leon3: Don't enforce use of -bios with qtest

Signed-off-by: Andreas Färber <afaerber@suse.de>

shix: Don't require firmware presence for qtest

Adopt error_report() while at it.

Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
Signed-off-by: Andreas Färber <afaerber@suse.de>

shix: Drop debug output

Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
Signed-off-by: Andreas Färber <afaerber@suse.de>

milkymist: Suppress -kernel/-bios/-drive error for qtest

Acked-by: Michael Walle <michael@walle.cc>
Signed-off-by: Andreas Färber <afaerber@suse.de>

an5206: Don't enforce use of kernel for qtest

Signed-off-by: Andreas Färber <afaerber@suse.de>

mcf5208: Don't enforce use of kernel for qtest

Signed-off-by: Andreas Färber <afaerber@suse.de>

axis_dev88: Don't enforce use of kernel for qtest

Reviewed-by: Edgar E. Iglesias <edgar.iglesias@gmail.com>
Signed-off-by: Andreas Färber <afaerber@suse.de>

armv7m: Don't enforce use of kernel for qtest

Adopt error_report().

Signed-off-by: Andreas Färber <afaerber@suse.de>

exynos4_boards: Silence lack of -smp 2 warning for qtest

Signed-off-by: Andreas Färber <afaerber@suse.de>

omap_sx1: Don't enforce use of kernel or flash for qtest

Signed-off-by: Andreas Färber <afaerber@suse.de>

palm: Don't enforce loading ROM or kernel for qtest

Signed-off-by: Andreas Färber <afaerber@suse.de>

z2: Don't enforce use of -pflash for qtest

Signed-off-by: Andreas Färber <afaerber@suse.de>

gumstix: Don't enforce use of -pflash for qtest

Signed-off-by: Andreas Färber <afaerber@suse.de>

mainstone: Don't enforce use of -pflash for qtest

Simply skip flash setup for now.

Also drop useless debug output.

Signed-off-by: Andreas Färber <afaerber@suse.de>

puv3: Turn puv3_load_kernel() into a no-op for qtest without -kernel

Replacing the assert() with more user-friendly error handling is left
for a follow-up.

Signed-off-by: Andreas Färber <afaerber@suse.de>

mips_mipssim: Silence BIOS loading warning for qtest

Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
Signed-off-by: Andreas Färber <afaerber@suse.de>

Merge tag 'for_anthony' of git://git./virt/kvm/mst/qemu

pci, pc, pvpanic bug fixes

This fixes strange pvpanic behaviour: you had to
pause to let VM continue (and potentially reboot on panic
if enabled).

This also fixes two bugs reported by Andreas.
One is a long-standing bug exposed by recent pci changes,
the other affects old piix machine types and was caused
by recent acpi changes.

Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Andreas Färber <afaerber@suse.de>

ossaudio: do not enable by default

Modern Linux's no longer support /dev/dsp so enabling it by
default causes audio failures on newer Linux distros.

Signed-off-by: Anthony Liguori <aliguori@amazon.com>
Tested-by: Andreas Färber <afaerber@suse.de>
Message-id: 1383497154-9271-1-git-send-email-aliguori@amazon.com

Merge remote-tracking branch 'spice/spice.v76' into staging

# By Gerd Hoffmann
# Via Gerd Hoffmann
* spice/spice.v76:
  qxl: replace pipe signaling with bottom half

Message-id: 1383656322-24150-1-git-send-email-kraxel@redhat.com
Signed-off-by: Anthony Liguori <aliguori@amazon.com>

Merge remote-tracking branch 'mst/tags/for_anthony' into staging

pci, pc, pvpanic bug fixes

This fixes strange pvpanic behaviour: you had to
pause to let VM continue (and potentially reboot on panic
if enabled).

This also fixes two bugs reported by Andreas.
One is a long-standing bug exposed by recent pci changes,
the other affects old piix machine types and was caused
by recent acpi changes.

Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
# gpg: Signature made Mon 04 Nov 2013 05:42:46 AM PST using RSA key ID D28D5469
# gpg: Can't check signature: public key not found

# By Michael S. Tsirkin (2) and Paolo Bonzini (1)
# Via Michael S. Tsirkin
* mst/tags/for_anthony:
  vl: allow "cont" from panicked state
  exec: limit system memory size
  pc: disable acpi info for isapc and old pc machine

Message-id: 1383572851-28326-1-git-send-email-mst@redhat.com
Signed-off-by: Anthony Liguori <aliguori@amazon.com>

Merge remote-tracking branch 'kraxel/e820.1' into staging

# By Gerd Hoffmann
# Via Gerd Hoffmann
* kraxel/e820.1:
  pc: register e820 entries for ram
  pc: add etc/e820 fw_cfg file

Message-id: 1383567431-13540-1-git-send-email-kraxel@redhat.com
Signed-off-by: Anthony Liguori <aliguori@amazon.com>

vl: allow "cont" from panicked state

After reporting the GUEST_PANICKED monitor event, QEMU stops the VM.
The reason for this is that events are edge-triggered, and can be lost if
management dies at the wrong time.  Stopping a panicked VM lets management
know of a panic even if it has crashed; management can learn about the
panic when it restarts and queries running QEMU processes.  The downside
is of course that the VM will be paused while management is not running,
but that is acceptable if it only happens with explicit "-device pvpanic".

Upon learning of a panic, management (if configured to do so) can pick a
variety of behaviors: leave the VM paused, reset it, destroy it.  In
addition to all of these behaviors, it is possible to dump the VM core
from the host.

However, right now, the panicked state is irreversible, and can only be
exited by resetting the machine.  This means that any policy decision
is entirely in the hands of the host.  In particular there is no way to
use the "reboot on panic" option together with pvpanic.

This patch makes the panicked state reversible (and removes various
workarounds that were there because of the state being irreversible).
With this change, management has a wider set of possible policies: it
can just log the crash and leave policy to the guest, it can leave the
VM paused.  In particular, the "log the crash and continue" is implemented
simply by sending a "cont" as soon as management learns about the panic.
Management could also implement the "irreversible paused state" itself.
And again, all such actions can be coupled with dumping the VM core.

Unfortunately we cannot change the behavior of 1.6.0.  Thus, even if
it uses "-device pvpanic", management should check for "cont" failures.
If "cont" fails, management can then log that the VM remained paused
and urge the administrator to update QEMU.

Reviewed-by: Laszlo Ersek <lersek@redhat.com>
Reviewed-by: Luiz Capitulino <lcapitulino@redhat.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>