* riku/linux-user-for-upstream:
  linux-user: fix emulation of /proc/self/maps
  linux-user: Clean up interim solution for exit syscall

* spice/spice.v54:
  qxl: don't assert on guest create_guest_primary
  qxl: ioport_write: remove guest trigerrable abort
  qxl: qxl_add_memslot: remove guest trigerrable panics
  qxl: interface_notify_update: remove guest trigerrable abort
  qxl: cleanup s/__FUNCTION__/__func__/
  qxl: don't abort on guest trigerrable ring indices mismatch
  qxl: fix > 80 chars line
  qxl: replace panic with guest bug in qxl_track_command
  qxl: check for NULL return from qxl_phys2virt
  hw/qxl.c: qxl_phys2virt: replace panics with guest_bug
  spice_info: add mouse_mode
  spice: require spice-protocol >= 0.8.1

* sweil/fixes:
  qemu-timer: Fix limits for w32 mmtimer
  qom: Fix memory leak in function container_get
  hw/pc_sysfw: Fix memory leak
  qdev: Fix memory leak in function set_pci_devfn
  arm-semi: Rename SYS_XXX macros to TARGET_SYS_XXX (fixes compiler warning)
  target-mips: Remove unused inline function

The Linux AC97 driver tests this bit to decide wether or not to show
an External amplifier toggle control.

This patch was also tested with a Windows XP guest without any issues.
Signed-off-by: NHans de Goede <hdegoede@redhat.com>
Signed-off-by: Nmalc <av1474@comtv.ru>

The Linux ac97 drivers does a number of register read/write tests to
see how much resolution a volume control actually has.

This patch takes this into account by masking out any bits written to
a volume control reg which should not be there according to the spec.

After this the Linux ac97 driver correctly uses a range of 0 - 0x1f for
the PCM out volume, as stated in the spec, and we can fix the FIXME
in update_combined_volume_out().

This patch was also tested with a Windows XP guest without any issues.
Signed-off-by: NHans de Goede <hdegoede@redhat.com>
Signed-off-by: Nmalc <av1474@comtv.ru>

After commit 19677a38:
"hw/ac97: add support for volume control"

We are (correctly) using AC97_Record_Gain_Mute and not AC97_Line_In_Volume_Mute
for recording volume, but various places in hw/ac97 were still assumimg that
we are using AC97_Line_In_Volume_Mute for record volume control, this patch
fixes this.
Signed-off-by: NHans de Goede <hdegoede@redhat.com>
Signed-off-by: Nmalc <av1474@comtv.ru>

The Linux ac97 driver tries to see if optional things like video input
volume control are available in 2 ways:
1) See if the mute bit is set after reset, if it is no further tests are done
2) If the mute bit is not set it does a write/read test of the mute bit

This patch changes our ac97 to conform to what the Linux driver expects, it
initializes registers for things which we don't emulate to 0 (so the mute bit
is not set) and makes them read only.

This causes Linux to now longer show the following (functionless)
controls in alsamixer:

Master Mono vol + mute
3d Control toggle
PCM out pre / post 3d select
Surround toggle
CD vol + mute
Mic vol + mute
Mic boost toggle
Mic mic1 / mic2 select
Video vol + mute
Phone vol + mute
Beep mono vol + mute
Aux vol + mute
Mono "output mic" / "mix" select
Sigmatel 4 speaker stereo toggle
Sigmatel ADC 6Db att toggle
Sigmatel DAC 6Db att toggle

This patch was also tested with a Windows XP guest and there it also makes
a number of functionless mixer controls go away.
Signed-off-by: NHans de Goede <hdegoede@redhat.com>
Signed-off-by: Nmalc <av1474@comtv.ru>

Fix a small copy and paste error in logging.
Signed-off-by: NHans de Goede <hdegoede@redhat.com>
Signed-off-by: Nmalc <av1474@comtv.ru>

Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Nmalc <av1474@comtv.ru>

Improve the emulation of /proc/self/maps by reading the underlying
host maps file and passing lines through with addresses adjusted
to be guest addresses. This is necessary to avoid false triggers
of the glibc check that a format string containing '%n' is not in
writable memory. (For an example see the bug reported in
https://bugs.launchpad.net/qemu-linaro/+bug/947888 where gpg aborts.)
Signed-off-by: NAlexander Graf <agraf@suse.de>
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NRiku Voipio <riku.voipio@linaro.org>

After all target CPUs have been QOM'ified, we no longer need an #ifdef
to switch between object_delete() and g_free() in NPTL thread exit.
Signed-off-by: NAndreas Färber <afaerber@suse.de>
Signed-off-by: NRiku Voipio <riku.voipio@linaro.org>

Signed-off-by: Nmalc <av1474@comtv.ru>

Signed-off-by: Nmalc <av1474@comtv.ru>

Signed-off-by: NAlon Levy <alevy@redhat.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Signed-off-by: NAlon Levy <alevy@redhat.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Signed-off-by: NAlon Levy <alevy@redhat.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Signed-off-by: NAlon Levy <alevy@redhat.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Signed-off-by: NAlon Levy <alevy@redhat.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Signed-off-by: NAlon Levy <alevy@redhat.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Signed-off-by: NAlon Levy <alevy@redhat.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Signed-off-by: NAlon Levy <alevy@redhat.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Signed-off-by: NAlon Levy <alevy@redhat.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Signed-off-by: NAlon Levy <alevy@redhat.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Add mouse_mode, either server or mouse, to qmp and hmp commands, based
on spice_server_is_server_mouse added in spice-server 0.10.3.
Signed-off-by: NAlon Levy <alevy@redhat.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Requiring spice-server >= 0.8.2 is not enough since spice-server.pc
doesn't require spice-protocol (any version). Until that is fixed
upstream an explicit requirement in qemu fixes compilation broken since

commit 2e1a98c9
Author: Alon Levy <alevy@redhat.com>
Date:   Fri Feb 24 23:19:30 2012 +0200

    qxl: introduce QXLCookie
Reported-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NAlon Levy <alevy@redhat.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

timeSetEvent only accepts delays in the range which is returned by
timeGetDevCaps.

The lower limit is typically 1 (= 1 ms), so the constant value of 1
in the old code usually worked.

The upper limit can be as low as 10000 ms, so the latest changes in
QEMU's timer handling which introduced timeout values above that limit
could result in failures of timeSetEvent when the timer was re-armed.
Signed-off-by: NStefan Weil <sw@weilnetz.de>

Valgrind reported this memory leak which occured very often.

Test scenario:

qemu-system-i386 (no arguments), only BIOS started, terminate with
monitor command (quit).
Signed-off-by: NStefan Weil <sw@weilnetz.de>
Reviewed-by: NAndreas Färber <afaerber@suse.de>

Valgrind reported this memory leak which occured a few times.

Test scenario:

qemu-system-i386 (no arguments), only BIOS started, terminate with
monitor command (quit).
Signed-off-by: NStefan Weil <sw@weilnetz.de>
Reviewed-by: NAndreas Färber <afaerber@suse.de>

Valgrind reported this memory leak which occured very often.

Test scenario:

qemu-system-i386 (no arguments), only BIOS started, terminate with
monitor command (quit).

v2:
Use error_free instead of g_free (hint from Andreas Färber, thanks).
Signed-off-by: NStefan Weil <sw@weilnetz.de>
Acked-by: NAndreas Färber <afaerber@suse.de>

SYS_OPEN is already defined in stdio.h of MinGW-w64,
therefore the compiler complains when building for w64.

Adding the prefix TARGET_ avoids that macro redefinition.
xtensa-semi.c also uses the same prefix (but mixed case macros
TARGET_SYS_xxx instead of TARGET_SYS_XXX).
Signed-off-by: NStefan Weil <sw@weilnetz.de>
Acked-by: NPeter Maydell <peter.maydell@linaro.org>

Function set_HILO is not needed anywhere.
Signed-off-by: NStefan Weil <sw@weilnetz.de>

* kwolf/for-anthony:
  ATA: Allow WIN_SECURITY_FREEZE_LOCK as nop
  rbd: add discard support
  qcow2: fix the return value -ENOENT -> -EEXIST
  qcow2: Don't hold cache references across yield
  qcow2: Remove unused parameter in do_alloc_cluster_offset
  qemu-iotests: Many parallel allocating I/O requests
  docs: fix one issue in qcow2 specs
  block/qcow2: Add missing GCC_FMT_ATTR to function report_unsupported()
  qemu-iotests: ignore fragmentation information for qed

When using Windows 8 with an AHCI disk drive, it issues a blue screen.
The reason is that WIN_SECURITY_FREEZE_LOCK / CFA_WEAR_LEVEL is not
supported by our ATA implementation, but Windows expects it to be there.

Since without security stuff implemented, the lock would be a nop anyway
and CFA_WEAR_LEVEL already is treated as a nop, let's just allow the cmd
for HD drives as well. That way Windows is happy.
Signed-off-by: NAlexander Graf <agraf@suse.de>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

Change the write flag to an operation type in RBDAIOCB, and make the
buffer optional since discard doesn't use it.

Discard is first included in librbd 0.1.2 (which is in Ceph 0.46).
If librbd is too old, leave out qemu_rbd_aio_discard entirely,
so the old behavior is preserved.
Signed-off-by: NJosh Durgin <josh.durgin@dreamhost.com>
Reviewed-by: NStefan Hajnoczi <stefanha@linux.vnet.ibm.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

Signed-off-by: NZhi Yong Wu <wuzhy@linux.vnet.ibm.com>
Reviewed-by: NStefan Hajnoczi <stefanha@linux.vnet.ibm.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

If cache references are held while the coroutine has yielded, the cache
may get used up and abort() when it can't find a free entry.
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

Signed-off-by: NKevin Wolf <kwolf@redhat.com>

This test case manages to let qcow2 abort because its cache is used up
and it can't find free cache entries for new requests any more.
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

Signed-off-by: NZhi Yong Wu <wuzhy@linux.vnet.ibm.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

Cc: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: NStefan Weil <sw@weilnetz.de>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>