* spice/spice.v52:
  qxl-render: fix broken vnc+spice since commit f934493
  qxl: set default values of vram*_size_mb to -1
  trace-events: remove unused qxl_vga_ioport_while_not_in_vga_mode

* kraxel/usb.46: (21 commits)
  usb-ehci: drop assert()
  usb-redir: Notify our peer when we reject a device due to a speed mismatch
  usb-ehci: Drop unused sofv value
  usb-host: rewrite usb_linux_update_endp_table
  usb: use USBDescriptor for endpoint descriptors.
  usb: use USBDescriptor for interface descriptors.
  usb: use USBDescriptor for config descriptors.
  usb: use USBDescriptor for device qualifier descriptors.
  usb: add USBDescriptor, use for device descriptors.
  usb-ehci: frindex always is a 14 bits counter
  usb-ehci: fix ehci_child_detach
  usb-hub: add tracepoints
  usb_packet_set_state: handle p->ep == NULL
  usb-host: add property to turn off pipelining
  usb-host: add usb packet to request tracepoints
  usb-host: trace canceled requests
  usb-host: trace emulated requests
  Add bootindex support to usb-host and usb-redir
  usb-uhci: queuing fix
  usb-uhci: stop queue filling when we find a in-flight td
  ...

Notify any listeners such as vnc that the displaysurface has been
changed, otherwise they will segfault when first accessing the freed old
displaysurface data.
Signed-off-by: NAlon Levy <alevy@redhat.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

The addition of those values caused a regression where not specifying
any value for the vram bar size would result in a 4096 _byte_ surface
area. This is ok for the windows driver but causes the X driver to be
unusable. Also, it's a regression. This patch returns the default
behavior of having a 64 megabyte vram BAR.
Signed-off-by: NAlon Levy <alevy@redhat.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

The resulting stp file fails to load because of an unresolvable probe.
Signed-off-by: NAlon Levy <alevy@redhat.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Update roms/seabios and pc-bios/bios.bin to the 1.7.0 release.
Most noticable new feature is virtio-scsi support.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Not sure what the purpose of the assert() was, in any case it is bogous.
We can arrive there if transfer descriptors passed to us from the guest
failed to pass sanity checks, i.e. it is guest-triggerable.  We deal
with that case by resetting the host controller.  Everything is ok, no
need to throw a core dump here.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Also cleanup (reset) our device state when we reject a device due to a
speed mismatch.
Signed-off-by: NHans de Goede <hdegoede@redhat.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

The sofv value only ever gets a value assigned and is never used (read)
anywhere, so we can just drop it.
Signed-off-by: NHans de Goede <hdegoede@redhat.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

This patch carries a complete rewrite of the usb descriptor parser.
Changes / improvements:

 * We are using the USBDescriptor struct instead of hard-coded offsets
   now to access descriptor data.
 * (debug) printfs are all gone, tracepoints have been added instead.
 * We don't try (and fail) to skip over unneeded descriptors.  We parse
   them all one by one.  We keep track of which configuration, interface
   and altsetting we are looking at and use this information to figure
   which desciptors are in use and which we can ignore.
 * On parse errors we clear all endpoint information, which will
   disallow any communication with the device, except control endpoint
   messages.  This makes sure we don't end up with a silly device state
   where half of the endpoints got enabled and the other half was left
   disabled.
 * Some sanity checks have been added.

The new parser is more robust and also leaves complete device
information in the trace log if you enable the ush_host_parse_*
tracepoints.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Add endpoint descriptor substruct to USBDescriptor,
use it in the descriptor generator code.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Add interface descriptor substruct to USBDescriptor,
use it in the descriptor generator code.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Add config descriptor substruct to USBDescriptor,
use it in the descriptor generator code.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Add device qualifier substruct to USBDescriptor,
use it in the descriptor generator code.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

This patch adds a new type for the binary representation of usb
descriptors.  It is put into use for the descriptor generator code
where the struct replaces the hard-coded offsets.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

frindex always is a 14 bits counter, and not a 13 bits one as we were
emulating. There are some subtle hints to this in the spec, first of all
"Table 2-12. FRINDEX - Frame Index Register" says:
"Bit 13:0 Frame Index. The value in this register increments at the end of
each time frame (e.g. micro-frame). Bits [N:3] are used for the Frame List
current index. This means that each location of the frame list is accessed
8 times (frames or micro-frames) before moving to the next index. The
following illustrates values of N based on the value of the Frame List
Size field in the USBCMD register.

USBCMD[Frame List Size]	Number Elements		 N
00b				1024		12
01b				 512		11
10b				 256		10
11b			    Reserved"

Notice how the text talks about "Bits [N:3]" are used ..., it does
NOT say that when N == 12 (our case) the counter will wrap from 8191 to 0,
or in otherwords that it is a 13 bits counter (bits 0 - 12).

The other hint is in "Table 2-10. USBSTS USB Status Register Bit Definitions":

"Bit 3 Frame List Rollover - R/WC. The Host Controller sets this bit to a one
when the Frame List Index (see Section 2.3.4) rolls over from its maximum value
to zero. The exact value at which the rollover occurs depends on the frame
list size. For example, if the frame list size (as programmed in the Frame
List Size field of the USBCMD register) is 1024, the Frame Index Register
rolls over every time FRINDEX[13] toggles. Similarly, if the size is 512,
the Host Controller sets this bit to a one every time FRINDEX[12] toggles."

Notice how this text talks about setting bit 3 when bit 13 of frindex toggles
(when there are 1024 entries, so our case), so this indicates that frindex
has a bit 13 making it a 14 bit counter.

Besides these clear hints the real proof is in the pudding. Before this
patch I could not stream data from a USB2 webcam under Windows XP, after
this cam using a USB2 webcam under Windows XP works fine, and no regressions
with other operating systems were seen.
Signed-off-by: NHans de Goede <hdegoede@redhat.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Looks like a cut+paste bug from ehci_detach.  When the device itself is
detached from a ehci port (ehci_detach op) we have to clear the
device pointer for the companion port too.  When a device gets removed
from a downstream port of a usb hub (ehci_child_detach op) the ehci port
where the usb hub is plugged in is not affected.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Add tracepoints to the usb hub emulation.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

usb_packet_set_state can be called with p->ep = NULL.  The tracepoint
there tries to log endpoint information, which leads to a segfault.
This patch makes usb_packet_set_state handle the NULL pointer properly.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Add a property to usb-host to disable the bulk endpoint pipelining.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Add pointer to USBPacket to all tracepoints tracking requests to make it
easier to identify them when multiple requests are in flight.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Add tracepoints to track canceled requests.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Add tracepoint to track completion of emulated control requests.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

When passing through a usb pendrive seabios will present it in the F12
boot menu and will happily boot from it.

This patch adds bootorder support so you can even make it the default
boot device.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

When we queue up usb packets we may happen to find a already queued
packet, which also might be finished at that point already.  We don't
want continue processing the packet at this point though, so lets
just signal back we've found a in-flight packet when in queuing mode.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Not only QHs can form rings, but TDs too.  With the new
queuing/pipelining support we are following TD chains and
can actually walk in circles.  An assert() prevents us from
entering an endless loop then.

Fix is easy:  Just stop queuing when we figure the TD we are
about to queue up is in flight already.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

... to make vmstate id string truely unique with multiple host
controllers, i.e. move from "1/usb-ptr" to "0000:00:01.3/1/usb-ptr"
(usb tabled connected to piix3 uhci).

This obviously breaks migration.  To handle this the usb bus
property "full-path" is added.  When setting this to false old
behavior is maintained.  This way current qemu will be compatible
with old versions when started using '-M pc-$oldversion'.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Basically, the main wait loop calls qemu_run_all_timers() unconditionally. The
first thing this routine used to do is to see if a timer had been serviced,
and then reset the loop timeout to the next deadline.

However, the new deadlines had not been calculated at that point, as
qemu_run_timers() had not been called yet for each of the clocks. So
qemu_rearm_alarm_timer() would end up with a negative or zero deadline, and
default to setting a 250us timeout for the loop.

As qemu_run_timers() is called for each clock, the real deadlines would be put
in place, but because a loop timeout was already set, the loop timeout would
not be changed.

Once that 250us timeout fired, the real deadline would be used for the
subsequent timeout.

For idle VMs, this effectively doubles the number of times through the loop,
doubling the number of select() system calls, timer calls, etc. putting added
scheduling pressure on the kernel. And under cgroups, this really causes a big
problem because the cgroup code does not scale well.

By simply running the timers before trying to rearm the timer, we always rearm
with a non-zero deadline, effectively halving the number of system calls.
Signed-off-by: NPeter Portante <pportant@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

* kiszka/queues/pending:
  vapic: Disable for pre-1.1 machines
  Kick io-thread on qemu_chr_accept_input
  pcnet: Properly handle TX requests during Link Fail
  pcnet: Clear ERR in CSR0 on stop
  signrom: Rewrite as python script

Conflicts:
	hw/pc_piix.c
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

* mst/tags/for_anthony:
  pci: fix corrupted pci conf index register by unaligned write
  acpi: explicitly account for >1 device per slot
  acpi_piix4: Re-define PCI hotplug eject register read
  acpi_piix4: Remove PCI_RMV_BASE write code
  acpi_piix4: Fix PCI hotplug race
  acpi_piix4: Disallow write to up/down PCI hotplug registers
  virtio-pci: change virtio balloon PCI class code
  ivshmem: add missing msix calls
  vhost: readd assert statement
  vhost: Fix size of dirty log sync on resize
  pc: reduce duplication in compat machine types
  piix_pci: fix typo in i400FX chipset init code

* sstabellini/for_anthony:
  xen: introduce an event channel for buffered io event notifications
  xen-mapcache: don't unmap locked entry during mapcache invalidation
  Xen, mapcache: Fix the compute of the size of bucket.
  xen: handle backend deletion from xenstore
  Xen: Add xen-apic support and hook it up.
  Xen: basic HVM MSI injection support.

The kvmvapic was not present in older QEMU versions, thus must be
disabled in compat machines.
Signed-off-by: NJan Kiszka <jan.kiszka@siemens.com>

Once a chr frontend is able to receive input again, we need to inform
the io-thread about this fact. Otherwise, main_loop_wait may continue to
select without the related backend file descriptor in its set. This can
cause high input latencies if only low-rate events arrive otherwise.
Signed-off-by: NJan Kiszka <jan.kiszka@siemens.com>

As long as we have no link and we aren't in internal loopback mode, no
packet must be sent. Instead, LCAR needs to be set in any active TX
descriptor and also CERR in CSR0.
Signed-off-by: NJan Kiszka <jan.kiszka@siemens.com>

pcnet_stop already clears any reason (BABL, CERR, MISS, MERR) why ERR
(bit 15) should be set in CRS0. So we have to clear that bit as well.
Signed-off-by: NJan Kiszka <jan.kiszka@siemens.com>

Now that we have a hard dependency on python anyway, we can replace the
slow shell script to calculate the option ROM checksum with a fast AND
portable python version. Tested both with python 2.7 and 3.1.
Signed-off-by: NJan Kiszka <jan.kiszka@siemens.com>

* 'w64' of git://qemu.weilnetz.de/qemu:
  w64: Fix time conversion for some versions of MinGW-w64
  nbd: Fix compiler warning (w64)
  disas: Replace 'unsigned long' by 'uintptr_t'
  cpu-exec: Remove non-portable type cast and fix format string
  target-mips: Fix type cast for w64 (uintptr_t)
  w64: Fix type cast in os_host_main_loop_wait
  w64: Fix data types in softmmu*.h
  w64: Use uintptr_t in exec.c
  softmmu: Use uintptr_t for physaddr and rename it
  w64: Fix struct CPUTLBEntry
  w64: Fix definition of setjmp
  w32: Move defines for socket specific errors to qemu-os-win32.h
  w64: Use larger alignment for section with generated code
  w64: Fix data types in cpu-all.h, exec.c
  w64: Fix type casts used in some macros in cpu-all.h
  tcg/i386: Add support for w64 ABI
  tcg/i386: Use GDB JIT debugging interface only for hosts with ELF

Move code from cpu_alpha_init() into a CPU initializer.
Signed-off-by: NAndreas Färber <afaerber@suse.de>
Acked-by: NRichard Henderson <rth@twiddle.net>

Embed CPUAlphaState as first member of AlphaCPU.
Signed-off-by: NAndreas Färber <afaerber@suse.de>
Acked-by: NRichard Henderson <rth@twiddle.net>

tb.time is a time value, but not necessarily of the same size as time_t:
while time_t is 64 bit for w64, tb.time still is 32 bit only.

Therefore we need en explicit conversion.
Signed-off-by: NStefan Weil <sw@weilnetz.de>