Tools were broken because they initialized the block layer while
qemu_aio_context was still NULL.
Reported-by: Nmalc <av1474@comtv.ru>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Nmalc <av1474@comtv.ru>

mmu access looks something like:

<check tlb>
if miss goto slow_path
<fast path>
done:
...

; end of the TB
slow_path:
 <pre process>
 mr r3, r27         ; move areg0 to r3
                    ; (r3 holds the first argument for all the PPC32 ABIs)
 <call mmu_helper>
 b $+8
 .long done
 <post process>
 b done

On ppc32 <call mmu_helper> is:

(SysV and Darwin)

mmu_helper is most likely not within direct branching distance from
the call site, necessitating

a. moving 32 bit offset of mmu_helper into a GPR ; 8 bytes
b. moving GPR to CTR/LR                          ; 4 bytes
c. (finally) branching to CTR/LR                 ; 4 bytes

r3 setting              - 4 bytes
call                    - 16 bytes
dummy jump over retaddr - 4 bytes
embedded retaddr        - 4 bytes
         Total overhead - 28 bytes

(PowerOpen (AIX))
a. moving 32 bit offset of mmu_helper's TOC into a GPR1 ; 8 bytes
b. loading 32 bit function pointer into GPR2            ; 4 bytes
c. moving GPR2 to CTR/LR                                ; 4 bytes
d. loading 32 bit small area pointer into R2            ; 4 bytes
e. (finally) branching to CTR/LR                        ; 4 bytes

r3 setting              - 4 bytes
call                    - 24 bytes
dummy jump over retaddr - 4 bytes
embedded retaddr        - 4 bytes
         Total overhead - 36 bytes

Following is done to trim the code size of slow path sections:

In tcg_target_qemu_prologue trampolines are emitted that look like this:

trampoline:
mfspr r3, LR
addi  r3, 4
mtspr LR, r3      ; fixup LR to point over embedded retaddr
mr    r3, r27
<jump mmu_helper> ; tail call of sorts

And slow path becomes:

slow_path:
 <pre process>
 <call trampoline>
 .long done
 <post process>
 b done

call                    - 4 bytes (trampoline is within code gen buffer
                                   and most likely accessible via
                                   direct branch)
embedded retaddr        - 4 bytes
         Total overhead - 8 bytes

In the end the icache pressure is decreased by 20/28 bytes at the cost
of an extra jump to trampoline and adjusting LR (to skip over embedded
retaddr) once inside.
Signed-off-by: Nmalc <av1474@comtv.ru>

Fix build on a 32 bit host:
  CC    mips-softmmu/target-mips/dsp_helper.o
/src/qemu/target-mips/dsp_helper.c: In function 'helper_dextr_rs_w':
/src/qemu/target-mips/dsp_helper.c:3556: error: integer constant is too large for 'long' type
/src/qemu/target-mips/dsp_helper.c: In function 'helper_extr_s_h':
/src/qemu/target-mips/dsp_helper.c:3656: error: integer constant is too large for 'long' type
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

Cc: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Signed-off-by: Nmalc <av1474@comtv.ru>

Postpone stopping the dirty log to the point where the command fifo is
configured to allow drivers which don't use the fifo to work too.
(Without this the picture rendered into the vram never got to the
screen and the DIRECT_VRAM option meant to support this case was
removed a year ago.)
Signed-off-by: NBALATON Zoltan <balaton@eik.bme.hu>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

According to the documentation drivers using this device should read
FB_SIZE before enabling the device to know what memory to map. This
would not work if we return 0 before enabled. The docs also mention
reading SVGA_REG_DEPTH but not writing it. (Only SVGA_REG_BITS_PER_PIXEL
can be written but we don't really support that either.)
Signed-off-by: NBALATON Zoltan <balaton@eik.bme.hu>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

Removed info from vmsvga_state that is available from elsewhere and
thus was duplicated here unnecessarily.
Signed-off-by: NBALATON Zoltan <balaton@eik.bme.hu>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

Fix coding style as suggested by checkpatch.pl
Signed-off-by: NBALATON Zoltan <balaton@eik.bme.hu>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

* 'trivial-patches' of git://github.com/stefanha/qemu:
  pc: Drop redundant test for ROM memory region
  exec: make some functions static
  target-ppc: make some functions static
  ppc: add missing static
  vnc: add missing static
  vl.c: add missing static
  target-sparc: make do_unaligned_access static
  m68k: Return semihosting errno values correctly
  cadence_uart: More debug information

Conflicts:
	target-m68k/m68k-semi.c

Add optimized TCG qemu_ld/st generation which locates the code of TLB miss
cases at the end of a block after generating the other IRs.
Currently, this optimization supports only i386 and x86_64 hosts.
Signed-off-by: NYeongkyoon Lee <yeongkyoon.lee@samsung.com>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

Add GETPC_EXT which is used by MMU helpers to selectively calculate the code
address of accessing guest memory when called from a qemu_ld/st optimized code
or a C function. Currently, it supports only i386 and x86-64 hosts.
Signed-off-by: NYeongkyoon Lee <yeongkyoon.lee@samsung.com>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

Enable CONFIG_QEMU_LDST_OPTIMIZATION for TCG qemu_ld/st optimization only when
a host is i386 or x86_64.
Signed-off-by: NYeongkyoon Lee <yeongkyoon.lee@samsung.com>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

Abstract out the use of put_user for returning semihosting call results,
so that we can log when a guest erroneously attempts a semihosting call
with an unwritable argument block.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

Handle failure of get_user accessing the semihosting
argument block, rather than simply ignoring the failures.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

Fixing a simple typo, s/errno/err/, that caused
the error status from GDB semihosted system calls
to be returned incorrectly.
Signed-off-by: NMeador Inge <meadori@codesourcery.com>
Reviewed-by: NAndreas Färber <afaerber@suse.de>
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

Commit ac4119c0 (chardev: Use timer instead of bottom-half to postpone
open event, 2012-10-12) moved the alarm timer initialization to an earlier
point but failed to consider that it depends on qemu_init_main_loop.

Later, commit 1c53786f (vl: init main loop earlier, 2012-10-30) fixed
this, but left -daemonize in two different ways.  First, timers need to
be reinitialized after forking.  Second, the global mutex was being held
by the parent, and thus dropped after forking.

The first is now fixed using pthread_atfork.  For the second part,
make sure that the global mutex is not taken before daemonization,
and similarly delay qemu_thread_self.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

init_timer_alarm was being called twice.  This is not needed.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Timers are not inherited by the child of a fork(2), so just use
pthread_atfork to reinstate them after daemonize.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

OpenBSD and Darwin do not have sem_timedwait.  Implement a fallback
for them.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Weakrefs only tell you if the symbol was defined elsewhere, so you
need a further check at runtime to pick the default definition
when needed.

This could be automated by the compiler, but it does not do it.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

* bonzini/migr-coroutine:
  migration: move process_incoming_migration to a coroutine
  migration: handle EAGAIN while reading QEMUFile
  migration: move qemu_fclose to process_incoming_migration
  migration: close socket QEMUFile from socket_close
  migration: xxx_close will only be called once
  migration: use closesocket, not close
  migration: use migrate_fd_close in migrate_fd_cleanup
  migration: clean up server sockets and handlers before invoking process_incoming_migration
  migration: replace qemu_stdio_fd with qemu_get_fd
  migration: add qemu_get_fd
  migration: consolidate QEMUFile methods in a single QEMUFileOps struct
  migration: unify stdio-based QEMUFile operations

Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

* afaerber/qom-cpu:
  target-i386: cpu: fix --disable-kvm compilation

The final part of incoming migration, which now consists of
process_incoming_migration for all protocols, is thus made non-blocking.
Reviewed-by: NOrit Wasserman <owasserm@redhat.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

This will never happen right now (the assertion would fail).  The
next patch will set the socket or pipe in non-blocking mode, thus
enabling this part of the code.

Coroutines can just stop whenever they want with qemu_coroutine_yield.
As soon as select tells the main loop that the migration stream is
readable, the coroutine is re-entered directly in qemu_get_buffer,
where it will read more data and pass it to the loading routines.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

The common suffix is now just process_incoming_migration.
Reviewed-by: NOrit Wasserman <owasserm@redhat.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

The common suffix now is process_incoming_migration+qemu_fclose.
Reviewed-by: NOrit Wasserman <owasserm@redhat.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

No need to test s->fd again, it is tested in the caller.
Reviewed-by: NOrit Wasserman <owasserm@redhat.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

Windows requires this.  Migration does not quite work under Windows
but let's be uniform across QEMU.
Reviewed-by: NOrit Wasserman <owasserm@redhat.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

migrate_fd_cleanup will usually close the file descriptor via
buffered_file_close's call to migrate_fd_close.  However, in the case
of s->file == NULL it is "inlining" migrate_fd_close (almost: there is a
direct close() instead of using s->close(s)).  To fix the inconsistency
and clean up the code, allow multiple calls to migrate_fd_close and use
the function in migrate_fd_cleanup.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

A first step towards making a common "suffix" for all migration protocols,
and moving it to process_incoming_migration.
Reviewed-by: NOrit Wasserman <owasserm@redhat.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

Reviewed-by: NOrit Wasserman <owasserm@redhat.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

Reviewed-by: NOrit Wasserman <owasserm@redhat.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

Reviewed-by: NOrit Wasserman <owasserm@redhat.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

Now that qemu_fseek does not exist anymore, there is no reason to do
an fseek before fread/fwrite when operating on an stdio file.
Thus, unify the get/put_buffer callbacks used by qemu_fopen
with those used for pipes.
Reviewed-by: NOrit Wasserman <owasserm@redhat.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

This fixes the following:
  target-i386/cpu.o: In function `kvm_cpu_fill_host':
  target-i386/cpu.c:783: undefined reference to `kvm_state'

I didn't notice the problem before because GCC was optimizing the entire
kvm_cpu_fill_host() function out (because all calls are conditional on
kvm_enabled()).

* cpu_x86_fill_model_id() is used only if CONFIG_KVM is set, so #ifdef it
  entirely to avoid compiler warnings.

* kvm_cpu_fill_host() should be called only if KVM is enabled, so
  use #ifdef CONFIG_KVM around the entire function body.
Reported-by: NAndreas Färber <afaerber@suse.de>
Signed-off-by: NEduardo Habkost <ehabkost@redhat.com>
Signed-off-by: NAndreas Färber <afaerber@suse.de>

Commit a93a4a22 changed the names of some fields in DisplayChangeListener
and broke compilation of the cocoa UI. Update to the new names.
Acked-by: NGerd Hoffmann <kraxel@redhat.com>
Reviewed-by: NAndreas Färber <andreas.faerber@web.de>
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Console cleanup series renamed dpy_resize and dpy_update all over the
tree, but hw/xenfb.c was forgotten.  Update it too so it builds again.
Reported-by: NJan Kiszka <jan.kiszka@web.de>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

* kraxel/usb.69: (31 commits)
  usb-redir: Allow redirecting super speed devices to high speed controllers
  usb-redir: Allow to attach USB 2.0 devices to 1.1 host controller
  usb-redir: Use reject rather the disconnect on bad ep info
  usb-redir: Add an usbredir_setup_usb_eps() helper function
  usb-redir: Add support for input pipelining
  usb-redir: Add support for 32 bits bulk packet length
  combined-packet: Add a workaround for Linux usbfs + live migration
  usb: Add packet combining functions
  uhci: Don't crash on device disconnect
  uhci: Add a uhci_handle_td_error() helper function
  usb/ehci-pci: add helper to create ich9 usb controllers
  usb/ehci-pci: add ich9 00:1a.* variant
  usb/ehci-pci: dynamic type generation
  uhci: add ich9 00:1a.* variants
  uhci: stick irq routing info into UHCIInfo too.
  uhci: dynamic type generation
  xilinx_zynq: add USB controllers
  usb/ehci: add sysbus variant
  usb/ehci: split into multiple source files
  usb/ehci: Guard definition of EHCI_DEBUG
  ...
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Just a few lines above, we already initialize rom_memory accordingly.
Signed-off-by: NJan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>