Merge remote-tracking branch 'afaerber/qom-cpu' into staging

* afaerber/qom-cpu:
  target-i386: Use switch in check_hw_breakpoints()
  target-i386: Avoid goto in hw_breakpoint_insert()
  target-i386: Introduce hw_{local,global}_breakpoint_enabled()
  target-i386: Define DR7 bit field constants
  target-i386: Move kvm_check_features_against_host() check to realize time
  target-i386: cpu_x86_register() consolidate freeing resources
  target-i386: Move setting defaults out of cpu_x86_parse_featurestr()
  target-i386: check/enforce: Check all feature words
  target-i386/cpu.c: Add feature name array for ext4_features
  target-i386: kvm_check_features_against_host(): Use feature_word_info
  target-i386/cpu: Introduce FeatureWord typedefs
  target-i386: Disable kvm_mmu by default
  kvm: Add fake KVM constants to avoid #ifdefs on KVM-specific code
  exec: Return CPUState from qemu_get_cpu()
  xen: Simplify halting of first CPU
  kvm: Pass CPUState to kvm_init_vcpu()
  cpu: Move cpu_index field to CPUState
  cpu: Move numa_node field to CPUState
  target-mips: Clean up mips_cpu_map_tc() documentation
  cpu: Move nr_{cores,threads} fields to CPUState

Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>

Merge remote-tracking branch 'afaerber-or/prep-up' into staging

* afaerber-or/prep-up:
  pc87312: Avoid define conflict on mingw32
  pc87312: Replace register_ioport_*() with MemoryRegion

Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>

Merge remote-tracking branch 'mdroth/qga-pull-1-14-2013-2' into staging

* mdroth/qga-pull-1-14-2013-2:
  qga: add missing commas in json docs

Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>

Merge remote-tracking branch 'mdroth/qga-pull-1-14-2013' into staging

* mdroth/qga-pull-1-14-2013:
  qemu-ga: Handle errors uniformely in ga_channel_open()
  qemu-ga: Plug fd leak on ga_channel_open() error paths
  qemu-ga: Plug fd leak on ga_channel_listen_accept() error path
  qemu-ga: Plug file descriptor leak on ga_open_pidfile() error path
  qemu-ga: Drop pointless lseek() from ga_open_pidfile()
  qemu-ga: Document intentional fall through in channel_event_cb()
  qemu-ga: add ga_open_logfile()
  qemu-ga: ga_open_pidfile(): use qemu_open()

Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>

Merge remote-tracking branch 'sstabellini/xen-2013-01-14' into staging

* sstabellini/xen-2013-01-14:
  xen_disk: implement BLKIF_OP_FLUSH_DISKCACHE, remove BLKIF_OP_WRITE_BARRIER
  xen_disk: add persistent grant support to xen_disk backend
  xen_disk: fix memory leak

Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>

target-i386: Use switch in check_hw_breakpoints()

Replace an if statement using magic numbers for breakpoint type with a
more explicit switch statement. This is to aid readability.

Change the return type and force_dr6_update argument type to bool.

While at it, fix Coding Style issues (missing braces).

Signed-off-by: liguang <lig.fnst@cn.fujitsu.com>
Signed-off-by: Andreas Färber <afaerber@suse.de>

target-i386: Avoid goto in hw_breakpoint_insert()

  "Go To Statement Considered Harmful" -- E. Dijkstra

To avoid an unnecessary goto within the switch statement, move
watchpoint insertion out of the switch statement. Improves readability.

While at it, fix Coding Style issues (missing braces, indentation).

Signed-off-by: liguang <lig.fnst@cn.fujitsu.com>
Signed-off-by: Andreas Färber <afaerber@suse.de>

target-i386: Introduce hw_{local,global}_breakpoint_enabled()

hw_breakpoint_enabled() returned a bit field indicating whether a local
breakpoint and/or global breakpoint was enabled. Avoid this number magic
by using explicit boolean helper functions hw_local_breakpoint_enabled()
and hw_global_breakpoint_enabled(), to aid readability.

Reuse them for the hw_breakpoint_enabled() implementation and change
its return type to bool.

While at it, fix Coding Style issues (missing braces).

Signed-off-by: liguang <lig.fnst@cn.fujitsu.com>
Signed-off-by: Andreas Färber <afaerber@suse.de>

target-i386: Define DR7 bit field constants

Implicit use of dr7 bit field is a little hard to understand,
so define constants for them and use them consistently.

Signed-off-by: liguang <lig.fnst@cn.fujitsu.com>
Signed-off-by: Andreas Färber <afaerber@suse.de>

target-i386: Move kvm_check_features_against_host() check to realize time

kvm_check_features_against_host() should be called when features can't
be changed, and when features are converted to properties it would be
possible to change them until realize time, so correct way is to call
kvm_check_features_against_host() in x86_cpu_realize().

Signed-off-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
Signed-off-by: Andreas Färber <afaerber@suse.de>

target-i386: cpu_x86_register() consolidate freeing resources

Freeing resources in one place would require setting 'error'
to not NULL, so add some more error reporting before jumping to
exit branch.

Signed-off-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
Signed-off-by: Andreas Färber <afaerber@suse.de>

target-i386: Move setting defaults out of cpu_x86_parse_featurestr()

No functional change, needed for simplifying conversion to properties.

Signed-off-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
Signed-off-by: Andreas Färber <afaerber@suse.de>

target-i386: check/enforce: Check all feature words

This adds the following feature words to the list of flags to be checked
by kvm_check_features_against_host():

 - cpuid_7_0_ebx_features
 - ext4_features
 - kvm_features
 - svm_features

This will ensure the "enforce" flag works as it should: it won't allow
QEMU to be started unless every flag that was requested by the user or
defined in the CPU model is supported by the host.

This patch may cause existing configurations where "enforce" wasn't
preventing QEMU from being started to abort QEMU. But that's exactly the
point of this patch: if a flag was not supported by the host and QEMU
wasn't aborting, it was a bug in the "enforce" code.

Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Reviewed-by: Gleb Natapov <gleb@redhat.com>
Signed-off-by: Andreas Färber <afaerber@suse.de>

target-i386/cpu.c: Add feature name array for ext4_features

Feature names were taken from the X86_FEATURE_* constants in the Linux
kernel code.

Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Reviewed-by: Gleb Natapov <gleb@redhat.com>
Signed-off-by: Andreas Färber <afaerber@suse.de>

target-i386: kvm_check_features_against_host(): Use feature_word_info

Instead of carrying the CPUID leaf/register and feature name array on
the model_features_t struct, move that information into
feature_word_info so it can be reused by other functions.

The goal is to eventually kill model_features_t entirely, but to do that
we have to either convert x86_def_t.features to an array or use
offsetof() inside FeatureWordInfo (to replace the pointers inside
model_features_t). So by now just move most of the model_features_t
fields to FeatureWordInfo except for the two pointers to local
arguments.

Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Reviewed-by: Gleb Natapov <gleb@redhat.com>
Signed-off-by: Andreas Färber <afaerber@suse.de>

target-i386/cpu: Introduce FeatureWord typedefs

This introduces a FeatureWord enum, FeatureWordInfo struct (with
generation information about a feature word), and a FeatureWordArray
typedef, and changes add_flagname_to_bitmaps() code and
cpu_x86_parse_featurestr() to use the new typedefs instead of separate
variables for each feature word.

This will help us keep the code at kvm_check_features_against_host(),
cpu_x86_parse_featurestr() and add_flagname_to_bitmaps() sane while
adding new feature name arrays.

Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Reviewed-by: Gleb Natapov <gleb@redhat.com>
Signed-off-by: Andreas Färber <afaerber@suse.de>

target-i386: Disable kvm_mmu by default

KVM_CAP_PV_MMU capability reporting was removed from the kernel since
v2.6.33 (see commit a68a6a7282373), and was completely removed from the
kernel since v3.3 (see commit fb92045843). It doesn't make sense to keep
it enabled by default, as it would cause unnecessary hassle when using
the "enforce" flag.

This disables kvm_mmu on all machine-types. With this fix, the possible
scenarios when migrating from QEMU <= 1.3 to QEMU 1.4 are:

------------+----------+----------------------------------------------------
 src kernel | dst kern.| Result
------------+----------+----------------------------------------------------
 >= 2.6.33  | any      | kvm_mmu was already disabled and will stay disabled
 <= 2.6.32  | >= 3.3   | correct live migration is impossible
 <= 2.6.32  | <= 3.2   | kvm_mmu will be disabled on next guest reboot *
------------+----------+----------------------------------------------------

 * If they are running kernel <= 2.6.32 and want kvm_mmu to be kept
   enabled on guest reboot, they can explicitly add +kvm_mmu to the QEMU
   command-line. Using 2.6.33 and higher, it is not possible to enable
   kvm_mmu explicitly anymore.

Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Reviewed-by: Gleb Natapov <gleb@redhat.com>
Signed-off-by: Andreas Färber <afaerber@suse.de>

kvm: Add fake KVM constants to avoid #ifdefs on KVM-specific code

Any KVM-specific code that use these constants must check if
kvm_enabled() is true before using them.

Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Reviewed-by: Gleb Natapov <gleb@redhat.com>
Signed-off-by: Andreas Färber <afaerber@suse.de>

exec: Return CPUState from qemu_get_cpu()

Move the declaration to qemu/cpu.h and add documentation.
The implementation still depends on CPUArchState for CPU iteration.

Signed-off-by: Andreas Färber <afaerber@suse.de>

xen: Simplify halting of first CPU

Use the global first_cpu variable to halt the CPU rather than using a
local first_cpu initialized from qemu_get_cpu(0).

This will allow to change qemu_get_cpu() return type to CPUState
despite use of the CPU_COMMON halted field in the reset handler.

Signed-off-by: Andreas Färber <afaerber@suse.de>

kvm: Pass CPUState to kvm_init_vcpu()

CPUArchState is no longer needed, and it thereby no longer depends on
NEED_CPU_H.

Signed-off-by: Andreas Färber <afaerber@suse.de>

cpu: Move cpu_index field to CPUState

Note that target-alpha accesses this field from TCG, now using a
negative offset. Therefore the field is placed last in CPUState.

Pass PowerPCCPU to [kvm]ppc_fixup_cpu() to facilitate this change.

Move common parts of mips cpu_state_reset() to mips_cpu_reset().

Acked-by: Richard Henderson <rth@twiddle.net> (for alpha)
[AF: Rebased onto ppc CPU subclasses and openpic changes]
Signed-off-by: Andreas Färber <afaerber@suse.de>

cpu: Move numa_node field to CPUState

Signed-off-by: Andreas Färber <afaerber@suse.de>

target-mips: Clean up mips_cpu_map_tc() documentation

This function will be touched again soon, so a good understanding of env
vs. other helps. Adopt gtk-doc style.

Signed-off-by: Andreas Färber <afaerber@suse.de>
Reviewed-by: Eric Johnson <ericj@mips.com>

cpu: Move nr_{cores,threads} fields to CPUState

To facilitate the field movements, pass MIPSCPU to malta_mips_config();
avoid that for mips_cpu_map_tc() since callers only access MIPS Thread
Contexts, inside TCG helpers.

Signed-off-by: Andreas Färber <afaerber@suse.de>

pc87312: Avoid define conflict on mingw32

Mingw32 headers define FAR, causing this warning:
/src/qemu/hw/pc87312.c:38:0: warning: "FAR" redefined [enabled by default]
In file included from /usr/local/lib/gcc/i686-mingw32msvc/4.7.0/../../../../i686-mingw32msvc/include/windows.h:48:0,
                 from /src/qemu/include/sysemu/os-win32.h:29,
                 from /src/qemu/include/qemu-common.h:46,
                 from /src/qemu/include/exec/ioport.h:27,
                 from /src/qemu/hw/isa.h:6,
                 from /src/qemu/hw/pc87312.h:28,
                 from /src/qemu/hw/pc87312.c:26:
/usr/local/lib/gcc/i686-mingw32msvc/4.7.0/../../../../i686-mingw32msvc/include/windef.h:34:0: note: this is the location of the previous definition

Avoid the warning by expanding the macros.

Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
Acked-by: Hervé Poussineau <hpoussin@reactos.org>
Signed-off-by: Andreas Färber <andreas.faerber@web.de>

pc87312: Replace register_ioport_*() with MemoryRegion

Prepare an instance_init function for the MemoryRegion init.

Signed-off-by: Andreas Färber <andreas.faerber@web.de>
Tested-by: Hervé Poussineau <hpoussin@reactos.org>

virtio-9p: fix compilation error.

Fix the compilation error introduced by msg new field.

CC    hw/9pfs/virtio-9p.o
In file included from /home/konradf/Documents/safe/greensocs/virtio-project/x86-qemu/qemu/hw/9pfs/virtio-9p.c:17:0:
/home/konradf/Documents/safe/greensocs/virtio-project/x86-qemu/qemu/hw/virtio-pci.h:30:16: erreur: field ‘msg’ has incomplete type
make: *** [hw/9pfs/virtio-9p.o] Erreur 1

Signed-off-by: KONRAD Frederic <fred.konrad@greensocs.com>

qga: add missing commas in json docs

* qga/qapi-schema.json: Use valid JSON.

Signed-off-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

dataplane: fix build breakage on set_guest_notifiers()

virtio_pci_set_guest_notifiers() now takes an additional argument to
specify the number of virtqueues to assign a guest notifier for. This
causes a build breakage for CONFIG_VIRTIO_BLK_DATA_PLANE builds:

/home/mdroth/w/qemu2.git/hw/dataplane/virtio-blk.c: In function
‘virtio_blk_data_plane_start’:
/home/mdroth/w/qemu2.git/hw/dataplane/virtio-blk.c:451:47: error: too
few arguments to function ‘s->vdev->binding->set_guest_notifiers’
/home/mdroth/w/qemu2.git/hw/dataplane/virtio-blk.c: In function
‘virtio_blk_data_plane_stop’:
/home/mdroth/w/qemu2.git/hw/dataplane/virtio-blk.c:511:5: error: too few
arguments to function ‘s->vdev->binding->set_guest_notifiers’
make[1]: *** [hw/dataplane/virtio-blk.o] Error 1
make[1]: *** Waiting for unfinished jobs....
make: *** [subdir-x86_64-softmmu] Error 2

Fix this by passing 1 as the number of virtqueues to assign notifiers
for.

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>

virtio-pci: build for uninitialized return value in vq_vector_unmask

Fixes the following:

/home/mdroth/w/qemu2.git/hw/virtio-pci.c: In function
‘kvm_virtio_pci_vector_unmask’:
/home/mdroth/w/qemu2.git/hw/virtio-pci.c:673:12: error: ‘ret’ may be
used uninitialized in this function [-Werror=uninitialized]
cc1: all warnings being treated as errors
make: *** [hw/virtio-pci.o] Error 1
make: *** Waiting for unfinished jobs....

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>

Add GE IP-Octal 232 IndustryPack emulation

The GE IP-Octal 232 is an IndustryPack module that implements eight
RS-232 serial ports, each one of which can be redirected to a
character device in the host.

Signed-off-by: Alberto Garcia <agarcia@igalia.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>

Add TEWS TPCI200 IndustryPack emulation

The TPCI200 is a PCI board that supports up to 4 IndustryPack modules.

A new bus type called 'IndustryPack' has been created so any
compatible module can be attached to this board.

Reviewed-by: Andreas Färber <afaerber@suse.de>
Signed-off-by: Alberto Garcia <agarcia@igalia.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>

xen_disk: implement BLKIF_OP_FLUSH_DISKCACHE, remove BLKIF_OP_WRITE_BARRIER

Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>

xen_disk: add persistent grant support to xen_disk backend

This protocol extension reuses the same set of grant pages for all
transactions between the front/back drivers, avoiding expensive tlb
flushes, grant table lock contention and switches between userspace
and kernel space. The full description of the protocol can be found in
the public blkif.h header.

http://xenbits.xen.org/gitweb/?p=xen.git;a=blob_plain;f=xen/include/public/io/blkif.h

Speed improvement with 15 guests performing I/O is ~450%.

Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>

xen_disk: fix memory leak

On ioreq_release the full ioreq was memset to 0, loosing all the data
and memory allocations inside the QEMUIOVector, which leads to a
memory leak. Create a new function to specifically reset ioreq.

Reported-by: Maik Wessler <maik.wessler@yahoo.com>
Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>

qemu-ga: Handle errors uniformely in ga_channel_open()

We detect errors in several places.  One reports with g_error(), which
calls abort(), the others report with g_critical().  Three of them
exit(), three return false.

Always report with g_critical(), and return false.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Reviewed-by: Luiz Capitulino <lcapitulino@redhat.com>
*minor fix-up of commit msg

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

qemu-ga: Plug fd leak on ga_channel_open() error paths

Spotted by Coverity.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Reviewed-by: Luiz Capitulino <lcapitulino@redhat.com>
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

qemu-ga: Plug fd leak on ga_channel_listen_accept() error path

Spotted by Coverity.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Reviewed-by: Luiz Capitulino <lcapitulino@redhat.com>
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

qemu-ga: Plug file descriptor leak on ga_open_pidfile() error path

Spotted by Coverity.  Also document why we keep it open on success.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Reviewed-by: Luiz Capitulino <lcapitulino@redhat.com>
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

qemu-ga: Drop pointless lseek() from ga_open_pidfile()

After open(), the file offset is already zero, and neither lockf() nor
ftruncate() change it.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Reviewed-by: Luiz Capitulino <lcapitulino@redhat.com>
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

qemu-ga: Document intentional fall through in channel_event_cb()

For clarity, and to hush up Coverity.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Reviewed-by: Luiz Capitulino <lcapitulino@redhat.com>
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

qemu-ga: add ga_open_logfile()

This function sets O_CLOEXEC on the log file fd so that it isn't
leaked to executed processes.

Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Acked-by: Amos Kong <akong@redhat.com>
Tested-by: Amos Kong <akong@redhat.com>
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

qemu-ga: ga_open_pidfile(): use qemu_open()

This ensures that O_CLOEXEC is passed to open(), this way the
pid file fd is not leaked to executed processes.

Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Acked-by: Amos Kong <akong@redhat.com>
Tested-by: Amos Kong <akong@redhat.com>
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

Merge remote-tracking branch 'kraxel/pixman.v6' into staging

* kraxel/pixman.v6:
  pixman: pass extra cflags and ldflags

Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>

Merge remote-tracking branch 'kraxel/usb.76' into staging

* kraxel/usb.76:
  usb-host: Initialize dev->port the obviously safe way
  usb-host: Drop superfluous null test from usb_host_auto_scan()
  ehci: Assert state machine is sane w.r.t. EHCIQueue
  xhci: nuke transfe5rs on detach
  xhci: call xhci_detach_slot on root port detach too
  xhci: create xhci_detach_slot helper function

Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>

Merge remote-tracking branch 'spice/spice.v67' into staging

* spice/spice.v67:
  qxl: Don't drop client capability bits
  qxl: Fix SPICE_RING_PROD_ITEM(), SPICE_RING_CONS_ITEM() sanity check

Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>

Merge remote-tracking branch 'kraxel/testdev.2' into staging

* kraxel/testdev.2:
  pc-testdev: use typedefs

Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>

Merge remote-tracking branch 'kwolf/for-anthony' into staging

* kwolf/for-anthony:
  dataplane: handle misaligned virtio-blk requests
  dataplane: extract virtio-blk read/write processing into do_rdwr_cmd()
  block: make qiov_is_aligned() public
  raw-posix: fix bdrv_aio_ioctl
  sheepdog: implement direct write semantics
  block: do not probe zero-sized disks

Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>

Merge remote-tracking branch 'mst/tags/for_anthony' into staging

pci,virtio

This further optimizes MSIX handling in virtio-pci.
Also included is pci cleanup by Paolo, and pci device
assignment fix by Alex.

Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
* mst/tags/for_anthony:
  pci-assign: Enable MSIX on device to match guest
  pci: use constants for devices under the 1B36 device ID, document them
  ivshmem: use symbolic constant for PCI ID, add to pci-ids.txt
  virtio-9p: use symbolic constant, add to pci-ids.txt
  reorganize pci-ids.txt
  docs: move pci-ids.txt to docs/specs/
  vhost: backend masking support
  vhost: set started flag while start is in progress
  virtio-net: set/clear vhost_started in reverse order
  virtio: backend virtqueue notifier masking
  virtio-pci: cache msix messages
  kvm: add stub for update msi route
  msix: add api to access msix message
  virtio: don't waste irqfds on control vqs

Merge remote-tracking branch 'bonzini/stub' into staging

* bonzini/stub: (27 commits)
  build: improve quiet output for .stp rules
  build: fold trace-obj-y into libqemuutil.a
  build: some simplifications for "trace/Makefile.objs"
  build: remove coroutine-obj-y
  build: move version-obj-y to the generic LINK rule
  build: move base QAPI files to libqemuutil.a
  build: move QAPI definitions for QEMU out of qapi-obj-y
  build: consolidate multiple variables into universal-obj-y
  build: move qobject files to qobject/ and libqemuutil.a
  build: move libqemuutil.a components to util/
  build: move files away from tools-obj-y, common-obj-y, user-obj-y
  build: move util-obj-y to libqemuutil.a
  build: rename oslib-obj-y to util-obj-y
  libcacard: list oslib-obj-y file explicitly
  libcacard: link vscclient to dynamic library
  libcacard: rewrite Makefile in non-recursive style
  libcacard: add list of exported symbols
  libcacard: use per-target variable definitions
  libcacard: prepare to use -y trick in the Makefile
  libcacard: require libtool to build it
  ...

Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>

Merge remote-tracking branch 'qmp/queue/qmp' into staging

* qmp/queue/qmp:
  monitor: assert monitor_puts()'s loop invariant
  target-i386: fix bits 39:32 of the final physical address when using 4M page

Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>

pixman: pass extra cflags and ldflags

Store --extra-cflags and --extra-ldflags in config-host.mak,
then pass them on to the pixman configure script.

Cc: Scott Wood <scottwood@freescale.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

usb-host: Initialize dev->port the obviously safe way

Coverity worries the strcpy() could overrun the destination.  It
can't, because the source always points to usb_host_scan()'s auto
port[], which has the same size.  Use pstrcpy() anyway, to hush the
checker.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

usb-host: Drop superfluous null test from usb_host_auto_scan()

Coverity points out that port is later passed to usb_host_open(),
which dereferences it.  It actually can't be null: it always points to
usb_host_scan()'s auto port[].  Drop the superfluous port == NULL
test.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

ehci: Assert state machine is sane w.r.t. EHCIQueue

Coverity worries the EHCIQueue pointer could be null when we pass it
to functions that reference it.  The state machine ensures it can't be
null then.  Assert that, to hush the checker.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

dataplane: handle misaligned virtio-blk requests

O_DIRECT on Linux has alignment requirements on I/O buffers and
misaligned requests result in -EINVAL.  The Linux virtio_blk guest
driver usually submits aligned requests so I forgot to handle misaligned
requests.

It turns out that virtio-win guest drivers submit misaligned requests.
Handle them using a bounce buffer that meets alignment requirements.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>

dataplane: extract virtio-blk read/write processing into do_rdwr_cmd()

Extract code for read/write command processing into do_rdwr_cmd().  This
brings together pieces that are spread across process_request().

The real motivation is to set the stage for handling misaligned
requests, which the next patch tackles.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>

block: make qiov_is_aligned() public

The qiov_is_aligned() function checks whether a QEMUIOVector meets a
BlockDriverState's alignment requirements.  This is needed by
virtio-blk-data-plane so:

1. Move the function from block/raw-posix.c to block/block.c.
2. Make it public in block/block.h.
3. Rename to bdrv_qiov_is_aligned().
4. Change return type from int to bool.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>

raw-posix: fix bdrv_aio_ioctl

When the raw-posix aio=thread code was moved from posix-aio-compat.c
to block/raw-posix.c, there was an unintended change to the ioctl code.
The code used to return the ioctl command, which posix_aio_read()
would later morph into a zero.  This hack is not necessary anymore,
and in fact breaks scsi-generic (which expects a zero return code).
Remove it.

Cc: qemu-stable@nongnu.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>

sheepdog: implement direct write semantics

Sheepdog supports both writeback/writethrough write but has not yet supported
DIRECTIO semantics which bypass the cache completely even if Sheepdog daemon is
set up with cache enabled.

Suppose cache is enabled on Sheepdog daemon size, the new cache control is

cache=writeback # enable the writeback semantics for write
cache=writethrough # enable the emulated writethrough semantics for write
cache=directsync # disable cache competely

Guest WCE toggling on the run time to toggle writeback/writethrough is also
supported.

Cc: MORITA Kazutaka <morita.kazutaka@lab.ntt.co.jp>
Cc: Kevin Wolf <kwolf@redhat.com>
Cc: Stefan Hajnoczi <stefanha@gmail.com>
Signed-off-by: Liu Yuan <tailai.ly@taobao.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: MORITA Kazutaka <morita.kazutaka@lab.ntt.co.jp>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>

block: do not probe zero-sized disks

A blank CD or DVD is visible as a zero-sized disks.  Probing such
disks will lead to an EIO and a failure to start the VM.  Treating
them as raw is a better solution.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>

xhci: nuke transfe5rs on detach

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

xhci: call xhci_detach_slot on root port detach too

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

xhci: create xhci_detach_slot helper function

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

pc-testdev: use typedefs

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

qxl: Don't drop client capability bits

interface_set_client_capabilities() copies only the first few bits,
because it falls into a Classic C trap: you can declare a parameter
uint8_t caps[58], but the resulting parameter type is uint8_t *, not
uint8_t[58].  In particular, sizeof(caps) is sizeof(uint8_t *), not
the intended sizeof(uint8_t[58]).

Harmless, because the bits aren't used, yet.  Broken in commit
c10018d6.  Spotted by Coverity.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

qxl: Fix SPICE_RING_PROD_ITEM(), SPICE_RING_CONS_ITEM() sanity check

The pointer arithmetic there is safe, but ugly.  Coverity grouses
about it.  However, the actual comparison is off by one: <= end
instead of < end.  Fix by rewriting the check in a cleaner way.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

build: improve quiet output for .stp rules

Mention the directory in which the .stp file is being generated.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

build: fold trace-obj-y into libqemuutil.a

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

build: some simplifications for "trace/Makefile.objs"

Signed-off-by: Lluís Vilanova <vilanova@ac.upc.edu>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

build: remove coroutine-obj-y

Just fold it into block-obj-y.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

build: move version-obj-y to the generic LINK rule

There is no reason for it to be in block-obj-y, in particular.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

build: move base QAPI files to libqemuutil.a

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

build: move QAPI definitions for QEMU out of qapi-obj-y

There is no reason why for example qemu-ga should include all the
definitions for the QEMU monitor.  However, there are a few
that are needed (qapi_free_SocketAddress, qapi_free_InetSocketAddress,
ErrorClass_lookup).  These should be moved to a separate "core"
.json schema that goes into libqemuutil.a.

For now, make this clearer by moving the qapi-*.o definitions out
of libqemuutil.a.  Once the above refactoring is done, qga-obj-y
should not include anymore qapi-types.o and qapi-visit.o.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

build: consolidate multiple variables into universal-obj-y

The directory descent mechanism, and a less-flat tree both helped
in making some *-obj-y definitions very short.  Many of these
often end up in universal-obj-y, and used to be separate only
because of libuser (which is now part of history...).

Consolidate these variables in a single one.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

build: move qobject files to qobject/ and libqemuutil.a

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

build: move libqemuutil.a components to util/

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

build: move files away from tools-obj-y, common-obj-y, user-obj-y

Split them between libqemuutil.a and, for those used by qemu-img/io/nbd,
block-obj-y.

Static libraries ensure that binaries such as qemu-ga do not include
unused modules.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

build: move util-obj-y to libqemuutil.a

Use a static library to eliminate repetition in the linking rules.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

build: rename oslib-obj-y to util-obj-y

This prepares the creation of libqemuutil.a in the next patch.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

libcacard: list oslib-obj-y file explicitly

We will grow the list of files in the next patches, but libcacard
should remain slim.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

libcacard: link vscclient to dynamic library

There is no reason for vscclient to duplicate the code.  rules.mak
takes care of invoking libtool to do the link.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

libcacard: rewrite Makefile in non-recursive style

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

libcacard: add list of exported symbols

Do not export internal QEMU symbols.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

libcacard: use per-target variable definitions

This lets the libcacard Makefile use more rules.mak magic.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

libcacard: prepare to use -y trick in the Makefile

Rename variables to follow the conventions of the rest of the build
systems.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

libcacard: require libtool to build it

Do not fail at build time, instead just disable the library if libtool
is not present.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

libcacard: fix missing symbol in libcacard.so

Before patch:
$ make libcacard.la
$ nm ./libcacard/.libs/libcacard.so.0.0.0 | grep " U " | \
    egrep -v "(g_)|(GLIBC)|(SECMOD)|(PK11)|(CERT)|(NSS)|(PORT)|(PR)"
                 U error_set

Signed-off-by: Alon Levy <alevy@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

build: remove CONFIG_SMARTCARD

The passthru smartcard does not have the shared library dependency, build
it unconditionally.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

build: move dtrace rules to rules.mak

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

build: support linking with libtool objects/libraries

This patch moves the complication of using libtool to the generic
rules.mak file.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

build: make libtool verbose when making with V=1

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

stubs: fully replace qemu-tool.c and qemu-user.c

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

qemu-option: move standard option definitions out of qemu-config.c

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

Merge branch 'target-arm.next' of git://git.linaro.org/people/pmaydell/qemu-arm

* 'target-arm.next' of git://git.linaro.org/people/pmaydell/qemu-arm:
  target-arm: Fix SWI (SVC) instruction in M profile.
  target-arm: use type_register() instead of type_register_static()

Merge branch 'ppc-for-upstream' of git://repo.or.cz/qemu/agraf

* 'ppc-for-upstream' of git://repo.or.cz/qemu/agraf: (31 commits)
  PPC: linux-user: Calculate context pointer explicitly
  target-ppc: Error out for -cpu host on unknown PVR
  target-ppc: Slim conversion of model definitions to QOM subclasses
  PPC: Bring EPR support closer to reality
  PPC: KVM: set has-idle in guest device tree
  kvm: Update kernel headers
  openpic: fix CTPR and de-assertion of interrupts
  openpic: move IACK to its own function
  openpic: IRQ_check: search the queue a word at a time
  openpic: fix sense and priority bits
  openpic: add some bounds checking for IRQ numbers
  openpic: use standard bitmap operations
  Revert "openpic: Accelerate pending irq search"
  openpic: always call IRQ_check from IRQ_get_next
  openpic/fsl: critical interrupts ignore mask before v4.1
  openpic: make ctpr signed
  openpic: rework critical interrupt support
  openpic: make register names correspond better with hw docs
  ppc/booke: fix crit/mcheck/debug exceptions
  openpic: lower interrupt when reading the MSI register
  ...

Merge branch 's390-reorg' of git://repo.or.cz/qemu/rth

* 's390-reorg' of git://repo.or.cz/qemu/rth: (149 commits)
  target-s390: Claim maintainership
  target-s390: Use noreturn for exception and load_psw
  target-s390: Use TCG_CALL_NO_WG for misc helpers
  target-s390: Use TCG_CALL_NO_WG for integer helpers
  target-s390: Use TCG_CALL_NO_WG for floating-point helpers
  target-s390: Use TCG_CALL_NO_WG for memory helpers
  target-s390: Perform COMPARE AND SWAP inline
  target-s390: Optimize get_address
  target-s390: Optimize ADDC/SUBB
  target-s390: Optimize ADDU/SUBU CC testing
  target-s390: Tidy comparisons
  target-s390: Optmize emitting discards
  target-s390: Optimize XC
  target-s390: Fix cpu_clone_regs
  target-s390: Implement LOAD/SET FP AND SIGNAL
  target-s390: Implement SET ROUNDING MODE
  target-s390: Use uint64_to_float128
  target-s390: Implement LCDFR
  target-s390: Check insn operand specifications
  target-s390: Implement CPSDR
  ...

hw/pc.c: add ULL suffix in ioport80_read and ioportF0_read return value

The commit c02e1eac887b1b0aee7361b1fcf889e7d47fed9d broke the compilation
for i386. ULL need to be specify for uint64_t value.

Signed-off-by: Julien Grall <julien.grall@citrix.com>
Signed-off-by: Blue Swirl <blauwirbel@gmail.com>

tcg-i386: use LEA for 3-operand 64-bit addition

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Richard Henderson <rth@twiddle.net>
Signed-off-by: Blue Swirl <blauwirbel@gmail.com>