* serial port fixes (Paolo)
* Q35 modeling improvements (Paolo, Vasily)
* chardev cleanup improvements (Marc-André)
* iscsi bugfix (Peter L.)
* cpu_exec patch from multi-arch patches (Peter C.)
* pci-assign tweak (Lin Ma)

# gpg: Signature made Wed 29 Jun 2016 15:56:30 BST
# gpg:                using RSA key 0xBFFBD25F78C7AE83
# gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>"
# gpg:                 aka "Paolo Bonzini <pbonzini@redhat.com>"
# Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4  E2F7 7E15 100C CD36 69B1
#      Subkey fingerprint: F133 3857 4B66 2389 866C  7682 BFFB D25F 78C7 AE83

* remotes/bonzini/tags/for-upstream: (35 commits)
  socket: unlink unix socket on remove
  socket: add listen feature
  char: clean up remaining chardevs when leaving
  vhost-user: disable chardev handlers on close
  vhost-user-test: fix g_cond_wait_until compat implementation
  vl: smp_parse: fix regression
  ich9: implement SCI_IRQ_SEL register
  ich9: implement ACPI_EN register
  serial: reinstate watch after migration
  serial: remove watch on reset
  char: change qemu_chr_fe_add_watch to return unsigned
  serial: separate serial_xmit and serial_watch_cb
  serial: simplify tsr_retry reset
  serial: make tsr_retry unsigned
  iscsi: fix assertion in is_sector_request_lun_aligned
  target-*: Don't redefine cpu_exec()
  pci-assign: Move "Invalid ROM" error message to pci-assign-load-rom.c
  vnc: generalize "VNC server running on ..." message
  scsi: esp: fix migration
  MC146818 RTC: add GPIO access to output IRQ
  ...
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

# gpg: Signature made Wed 29 Jun 2016 04:09:26 BST
# gpg:                using RSA key 0xBDBE7B27C0DE3057
# gpg: Good signature from "Jeffrey Cody <jcody@redhat.com>"
# gpg:                 aka "Jeffrey Cody <jeff@codyprime.org>"
# gpg:                 aka "Jeffrey Cody <codyprime@gmail.com>"
# Primary key fingerprint: 9957 4B4D 3474 90E7 9D98  D624 BDBE 7B27 C0DE 3057

* remotes/cody/tags/block-pull-request:
  mirror: fix misleading comments
  blockjob: assert(cb) when create job
  iotests: add small-granularity mirror test
  mirror: limit niov to IOV_MAX elements, again
  mirror: clarify mirror_do_read return code
  block/gluster: add support for selecting debug logging level
  mirror: fix trace_mirror_yield_in_flight usage in mirror_iteration()
  block/nfs: add support for libnfs pagecache
  block/nfs: refuse readahead if cache.direct is on
  block/gluster: add support for SEEK_DATA/SEEK_HOLE
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

qemu leaves unix socket files behind when removing a listening chardev
or leaving. qemu could clean that up, even if doing so isn't race-free.

Fixes:
https://bugzilla.redhat.com/show_bug.cgi?id=1347077Signed-off-by: NMarc-André Lureau <marcandre.lureau@redhat.com>
Message-Id: <1466105332-10285-4-git-send-email-marcandre.lureau@redhat.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

Add a flag to tell whether the channel socket is listening.
Signed-off-by: NMarc-André Lureau <marcandre.lureau@redhat.com>
Message-Id: <1466105332-10285-3-git-send-email-marcandre.lureau@redhat.com>
Acked-by: NDaniel P. Berrange <berrange@redhat.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NMarc-André Lureau <marcandre.lureau@redhat.com>

This helps to remove various chardev resources leaks when leaving qemu.
Signed-off-by: NMarc-André Lureau <marcandre.lureau@redhat.com>
Message-Id: <1466105332-10285-2-git-send-email-marcandre.lureau@redhat.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

This otherwise causes a use-after-free if network backend cleanup
is performed before character device cleanup.

Cc: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

This fixes compilation with glib versions up to 2.30, such
as the one in CentOS 6.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

# gpg: Signature made Tue 28 Jun 2016 22:27:20 BST
# gpg:                using RSA key 0x9CA4ABB381AB73C8
# gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>"
# gpg:                 aka "Stefan Hajnoczi <stefanha@gmail.com>"
# Primary key fingerprint: 8695 A8BF D3F9 7CDA AC35  775A 9CA4 ABB3 81AB 73C8

* remotes/stefanha/tags/tracing-pull-request:
  trace: [*-user] Add events to trace guest syscalls in syscall emulation mode
  trace: enable tracing in qemu-img
  qemu-img: move common options parsing before commands processing
  trace: enable tracing in qemu-nbd
  trace: enable tracing in qemu-io
  trace: move qemu_trace_opts to trace/control.c
  doc: move text describing --trace to specific .texi file
  doc: sync help description for --trace with man for qemu.1
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Commit 0544edd8 "vl: smp_parse: cleanups" regressed any -smp
config that left either cores or threads unspecified, and specified
a topology supporting more cpus than the given online cpus. The
correct way to calculate the missing parameter would be to use
maxcpus, but it's too late to change that now. Restore the old
way, which is to calculate it with the online cpus (as is still
done), but then, if the result is zero, just set it to one.
Signed-off-by: NAndrew Jones <drjones@redhat.com>
Message-Id: <1466526844-29245-1-git-send-email-drjones@redhat.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

Otherwise, a serial port can get stuck if it is migrated while flow control
is in effect.
Tested-by: NBret Ketchum <bcketchum@gmail.com>
Reviewed-by: NDr. David Alan Gilbert <dgilbert@redhat.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

Otherwise, this can cause serial_xmit to be entered with LSR.TEMT=0,
which is invalid and causes an assertion failure.
Reported-by: NBret Ketchum <bcketchum@gmail.com>
Tested-by: NBret Ketchum <bcketchum@gmail.com>
Reviewed-by: NDr. David Alan Gilbert <dgilbert@redhat.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

g_source_attach can return any value between 1 and UINT_MAX if you let
QEMU run long enough.  However, qemu_chr_fe_add_watch can also return
a negative errno value when the device is disconnected or does not
support chr_add_watch.  Change it to return zero to avoid overloading
these values.

Fix the cadence_uart which asserts in this case (easily obtained with
"-serial pty").
Tested-by: NBret Ketchum <bcketchum@gmail.com>
Reviewed-by: NDr. David Alan Gilbert <dgilbert@redhat.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

serial_xmit starts transmission of whatever is in the transmitter
register, THR or FIFO; serial_watch_cb is a wrapper around it and is
only used as a qemu_chr_fe_add_watch callback.
Tested-by: NBret Ketchum <bcketchum@gmail.com>
Reviewed-by: NDr. David Alan Gilbert <dgilbert@redhat.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

Move common code outside the if, and reset tsr_retry even in loopback mode.
Right now it cannot become non-zero, but it will be possible as soon as
we start respecting the baud rate.
Tested-by: NBret Ketchum <bcketchum@gmail.com>
Reviewed-by: NDr. David Alan Gilbert <dgilbert@redhat.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

It can never become negative; reflect this in the type of the field
and simplify the conditions.
Tested-by: NBret Ketchum <bcketchum@gmail.com>
Reviewed-by: NDr. David Alan Gilbert <dgilbert@redhat.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

Commit 94d047a3 added an assertion the the request alignment check.
This introduced 2 issues:
 a) A off-by-one error since a request of BDRV_REQUEST_MAX_SECTORS
    is actually allowed.
 b) The bdrv_get_block_status call in the read path to check the allocation
    status requests up to INT_MAX sectors which triggers the assertion.

Fixes: 94d047a3Signed-off-by: NPeter Lieven <pl@kamp.de>
Message-Id: <1466414680-18383-1-git-send-email-pl@kamp.de>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

This function needs to be converted to QOM hook and virtualised for
multi-arch. This rename interferes, as cpu-qom will not have access
to the renaming causing name divergence. This rename doesn't really do
anything anyway so just delete it.
Signed-off-by: NPeter Crosthwaite <crosthwaite.peter@gmail.com>
Message-Id: <69bd25a8678b8b31b91cd9760c777bed1aafb44e.1437212383.git.crosthwaite.peter@gmail.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NPeter Crosthwaite <crosthwaitepeter@gmail.com>

In function pci_assign_dev_load_option_rom, For those pci devices don't
have 'rom' file under sysfs or if loading ROM from external file, The
function returns NULL, and won't set the passed 'size' variable.

In these 2 cases, qemu still reports "Invalid ROM" error message, Users
may be confused by it.
Signed-off-by: NLin Ma <lma@suse.com>
Message-Id: <1466010327-22368-1-git-send-email-lma@suse.com>
Cc: qemu-stable@nongnu.org
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

The message is useful whenever the user specifies "-vnc to=XX".
Move it to ui/vnc.c.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

Commit 926cde5f ("scsi: esp: make cmdbuf big enough for maximum CDB size",
2016-06-16) changed the size of a migrated field.  Split it in two
parts, and only migrate the second part in a new vmstate version.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

The MC146818 RTC device has output IRQ line. Currently the corresponding field
is only accessible through direct access. Such access violates Qemu model.

The patch makes the field accessible through GPIO. It also updates the setting
of the IRQ during initialization.
Signed-off-by: NEfimov Vasily <real@ispras.ru>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

Currently a direct access to the device structure field is used to connect ISA
device IRQ to the bus. GPIO access should be used instead if possible.

The patch adds wrapper isa_connect_gpio_out. The function connects specified
output GPIO to specified ISA IRQ.
Signed-off-by: NEfimov Vasily <real@ispras.ru>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

The isa_bus_irqs function initializes ISA bus IRQ array pointer with specified
value.

Previously the ICH9 LPC bridge model did not have its own IRQs but
only IRQ pointer cache. And same GSI were used for ISA bus and other sources
behind the bridge (PCI, SCI). Hence, the pc_q35_init was only possible place to
setup both ISA bus IRQs and the bridge IRQ cache.

As a result, the call of isa_bus_irqs was made from pc_q35_init.

Now the ICH9 LPC bridge has its own output IRQs which are connected to GSI. The
output IRQs are already used to route IRQs from PCI and SCI.

The patch makes the ICH9 LPC bridge output IRQs to used for ISA bus too.
Signed-off-by: NEfimov Vasily <real@ispras.ru>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

The ICH9 LPC bridge has 24 output IRQs connected to GSI. Currently the IRQs are
referenced by pointers. The pointers are initialized at startup by direct access
to the structure fields. This violates Qemu device model.

The patch makes the IRQs handling to use GPIO model.
Signed-off-by: NEfimov Vasily <real@ispras.ru>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

ich9->pic and ich9->ioapic differ for the first 16 GSIs (because
ich9->pic is wired to 8259+IOAPIC but ich9->ioapic is wired to
IOAPIC only).  However, ich9->ioapic is never used for the first
16 GSIs, so the two vectors can be merged.
Reviewed-by: NEfimov Vasily <real@ispras.ru>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

Make ich9_lpc_update_pic take care only of GSIs 0-15, and
ich9_lpc_update_apic take care only of GSIs 16-23.  Assert
that they are called with the correct GSI indices.
Reviewed-by: NEfimov Vasily <real@ispras.ru>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

An asserted pirq can be disabled and the corresponding GSIs
should then go down to 0.  However, because of the conditional in
ich9_lpc_update_by_pirq, the legacy 8259 pin could remain stuck to 1.
Reviewed-by: NEfimov Vasily <real@ispras.ru>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

ICH9 SMB bridge can be created using qdev API despite existence of helper
function. The type name is needed for such creation. Using a preprocessor
alias instead the string type name itself is preferable.

The patch makes the alias accessible through the header.
Signed-off-by: NEfimov Vasily <real@ispras.ru>
Reviewed-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

The port92 device has outgouing IRQ line A20. Currently the IRQ is referenced
by a pointer which normally is set during machine initialization. The
pointer is never changed at runtime. Hence, common GPIO model can be applied
to A20 IRQ line. Note that checking for IRQ to be connected as in
previous version of code is not required qemu_set_irq will do it.
Signed-off-by: NEfimov Vasily <real@ispras.ru>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

The i8042 device has outgouing IRQ line A20. Currently the IRQ is referenced
by a pointer which normally is set during machine initialization. The pointer
is never changed at runtime. So common GPIO model can be applied to A20 IRQ
line. Note that checking for IRQ to be connected as in previous version
of code is not required because qemu_set_irq will do it.
Signed-off-by: NEfimov Vasily <real@ispras.ru>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

Currently, Q35 instance is configured using direct access to structure fields.
The patch uses property interface to set the fields.
Signed-off-by: NEfimov Vasily <real@ispras.ru>
Reviewed-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

During creation of Q35 instance several parameters are set using direct access.
It violates Qemu device model. Correctly, the parameters should be handled as
object properties.

The patch adds four link type properties for fields:
mch.ram_memory
mch.pci_address_space
mch.system_memory
mch.address_space_io
And, it adds two size type properties for fields:
mch.below_4g_mem_size
mch.above_4g_mem_size
Signed-off-by: NEfimov Vasily <real@ispras.ru>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

qdev API can be used to create CFI pflash devices despite existance of helper
functions. The type name is needed in course of such creation. Using the
preprocessor alias instead of the string literal itself is preferable.

The patch makes the aliases accessible through the header.
Signed-off-by: NEfimov Vasily <real@ispras.ru>
Reviewed-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

Currently vmport device is identified by the string literal. Using a
preprocessor alias instead is preferable.
Signed-off-by: NEfimov Vasily <real@ispras.ru>
Reviewed-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

The speaker device needs pointer to ISA PIT device to operate. But according to
qdev-properties.h, properties of pointer type should be avoided. It seems a
link type property is a good substitution.
Signed-off-by: NEfimov Vasily <real@ispras.ru>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

The patch moves "hw/ide/achi.h", "hw/ide/pci.h" and "hw/ide/internal.h" headers
to corresponding folders inside "include" folder alike other Qemu headers.
Signed-off-by: NEfimov Vasily <real@ispras.ru>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

Drop building linux-user targets on HPPA or m68k host systems
and add safe_syscall support for i386, aarch64, arm, ppc64 and
s390x.

# gpg: Signature made Tue 28 Jun 2016 19:31:16 BST
# gpg:                using RSA key 0xB44890DEDE3C9BC0
# gpg: Good signature from "Riku Voipio <riku.voipio@iki.fi>"
# gpg:                 aka "Riku Voipio <riku.voipio@linaro.org>"
# Primary key fingerprint: FF82 03C8 C391 98AE 0581  41EF B448 90DE DE3C 9BC0

* remotes/riku/tags/pull-linux-user-20160628: (24 commits)
  linux-user: Provide safe_syscall for ppc64
  linux-user: Provide safe_syscall for s390x
  linux-user: Provide safe_syscall for aarch64
  linux-user: Provide safe_syscall for arm
  linux-user: Provide safe_syscall for i386
  linux-user: fix x86_64 safe_syscall
  linux-user: don't swap NLMSG_DATA() fields
  linux-user: fd_trans_host_to_target_data() must process only received data
  linux-user: add missing return in netlink switch statement
  linux-user: update get_thread_area/set_thread_area strace
  linux-user: fix clone() strace
  linux-user: add socket() strace
  linux-user: add socketcall() strace
  linux-user: Support F_GETPIPE_SZ and F_SETPIPE_SZ fcntls
  linux-user: Fix wrong type used for argument to rt_sigqueueinfo
  linux-user: Create a hostdep.h for each host architecture
  user-exec: Remove unused code for OSX hosts
  user-exec: Delete now-unused hppa and m68k cpu_signal_handler() code
  configure: Don't allow user-only targets for unknown CPU architectures
  configure: Don't override ARCH=unknown if enabling TCI
  ...
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

s/target bs/to_replace/, also we check to_replace bs is not
blocked in qmp_drive_mirror() not here
Signed-off-by: NChanglong Xie <xiecl.fnst@cn.fujitsu.com>
Reviewed-by: NFam Zheng <famz@redhat.com>
Reviewed-by: NStefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: NJeff Cody <jcody@redhat.com>
Message-id: 1466672241-22485-3-git-send-email-xiecl.fnst@cn.fujitsu.com
Signed-off-by: NJeff Cody <jcody@redhat.com>