This patch replaces time() function calls with calls to
qemu_clock_get_ns(QEMU_CLOCK_HOST). It makes such requests deterministic
in record/replay mode of icount.
Reviewed-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NPavel Dovgalyuk <Pavel.Dovgaluk@ispras.ru>
Message-Id: <20150227131102.11912.89850.stgit@PASHA-ISP>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

It's not safe to call blk_set_aio_context from outside BQL because of
the bdrv_drain_all there. Let's put it in the hotplug callback which
will be called by qdev device realization for each scsi device attached
to the bus.
Signed-off-by: NFam Zheng <famz@redhat.com>
Message-Id: <1423969591-23646-3-git-send-email-famz@redhat.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

Even if the caller has both the old and the new AioContext's, there can
be a deadlock, due to the leading bdrv_drain_all.

Suppose there are four io threads (A, B, A0, B0) with A and B owning a
BDS for each (bs_a, bs_b); Now A wants to move bs_a to iothread A0, and
B wants to move bs_b to B0, at the same time:

  iothread A                           iothread B
--------------------------------------------------------------------------
  aio_context_acquire(A0) /* OK */     aio_context_acquire(B0) /* OK */
  bdrv_set_aio_context(bs_a, A0)       bdrv_set_aio_context(bs_b, B0)
  -> bdrv_drain_all()                  -> bdrv_drain_all()
     -> acquire A /* OK */               -> acquire A /* blocked */
     -> acquire B /* blocked */          -> acquire B
     ...                                 ...

Deadlock happens because A is waiting for B, and B is waiting for A.
Signed-off-by: NFam Zheng <famz@redhat.com>
Reviewed-by: NPaolo Bonzini <pbonzini@redhat.com>
Message-Id: <1423969591-23646-2-git-send-email-famz@redhat.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

This mimics what is done in qdev_device_add, and lets the device be
freed in case something goes wrong.  Otherwise, object_unparent returns
immediately without freeing the device, which is on the other hand left
in the parent bus's list of children.

scsi_bus_legacy_handle_cmdline then returns an error, and the HBA is
destroyed as well with object_unparent.  But the lingering device that
was not removed in scsi_bus_legacy_add_drive cannot be removed now either,
and bus_unparent gets stuck in an infinite loop trying to empty the list
of children.

The right fix of course would be to assert in bus_add_child that the
device already has a bus, and remove the "safety net" that adds the
drive to the QOM tree in device_set_realized.  I am not yet sure whether
that would entail changing all callers to qdev_create (as well as
isa_create and usb_create and the corresponding _try_create versions).
Reported-by: NMarkus Armbruster <armbru@redhat.com>
Tested-by: NMarkus Armbruster <armbru@redhat.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

* remotes/qmp-unstable/queue/qmp:
  qapi-types: add C99 index names to arrays
  monitor: Fix missing err = NULL in client_migrate_info()
  balloon: Fix typo
  hmp: Fix warning from smatch (wrong argument in function call)
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

seabios: update to 1.8.0 release

# gpg: Signature made Thu Feb 19 08:36:30 2015 GMT using RSA key ID D3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
# gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
# gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

* remotes/kraxel/tags/pull-roms-20150219-1:
  seabios: update to 1.8.0 release
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Features for s390x/kvm

1. guest reIPL changes (Fan Zhang)
Implements subcode 5 and 6 of diag 0x308. This allows to use
/sys/firmware/[re]ipl/ccw/* and the chreipl and lsreipl tools in
Linux. In addition to the normal "change the disk" this also
allows to switch from booting an external kernel into rebooting
from a disk.

2. Memory page table walking (Thomas Huth)
Fix several page table walking functions, used in several places
like gdb server and instruction handling. Also use these functions
in several I/O related functions.

# gpg: Signature made Wed Feb 18 09:13:22 2015 GMT using RSA key ID B5A61C7C
# gpg: Good signature from "Christian Borntraeger (IBM) <borntraeger@de.ibm.com>"

* remotes/borntraeger/tags/s390x-20150218: (29 commits)
  s390x/helper: Remove s390_cpu_physical_memory_map
  s390x/pci: Rework memory access in zpci instruction
  s390x/ioinst: Rework memory access in TPI instruction
  s390x/ioinst: Rework memory access in CHSC instruction
  s390x/ioinst: Rework memory access in STCRW instruction
  s390x/ioinst: Rework memory access in TSCH instruction
  s390x/ioinst: Set condition code in ioinst_handle_tsch() handler
  s390x/ioinst: Rework memory access in STSCH instruction
  s390x/ioinst: Rework memory access in SSCH instruction
  s390x/ioinst: Rework memory access in MSCH instruction
  s390x/css: Make schib parameter of css_do_msch const
  s390x/mmu: Add function for accessing guest memory
  s390x/kvm: Add function for injecting pgm access exceptions
  s390x/mmu: Clean up mmu_translate_asc()
  s390x/mmu: Check bit 52 in page table entry
  s390x/mmu: Renaming related to the ASCE confusion
  s390x/mmu: Add support for read-only regions
  s390x/mmu: Fix the exception codes for illegal table entries
  s390x/mmu: Fix exception types when checking the ASCEs
  s390x/mmu: Fix translation exception code in lowcore
  ...
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Clean up around error_get_pretty(), qerror_report_err()

# gpg: Signature made Wed Feb 18 10:10:07 2015 GMT using RSA key ID EB918653
# gpg: Good signature from "Markus Armbruster <armbru@redhat.com>"
# gpg:                 aka "Markus Armbruster <armbru@pond.sub.org>"

* remotes/armbru/tags/pull-error-2015-02-18:
  qemu-char: Avoid qerror_report_err() outside QMP command handlers
  qemu-img: Avoid qerror_report_err() outside QMP command handlers
  vl: Avoid qerror_report_err() outside QMP command handlers
  tpm: Avoid qerror_report_err() outside QMP command handlers
  numa: Avoid qerror_report_err() outside QMP command handlers
  net: Avoid qerror_report_err() outside QMP command handlers
  monitor: Avoid qerror_report_err() outside QMP command handlers
  monitor: Clean up around monitor_handle_fd_param()
  error: Use error_report_err() where appropriate
  error: New convenience function error_report_err()
  vhost-scsi: Improve error reporting for invalid vhostfd
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

hmp: Normalize HMP command handler names

# gpg: Signature made Wed Feb 18 10:59:44 2015 GMT using RSA key ID EB918653
# gpg: Good signature from "Markus Armbruster <armbru@redhat.com>"
# gpg:                 aka "Markus Armbruster <armbru@pond.sub.org>"

* remotes/armbru/tags/pull-monitor-2015-02-18:
  hmp: Name HMP info handler functions hmp_info_SUBCOMMAND()
  hmp: Name HMP command handler functions hmp_COMMAND()
  hmp: Clean up declarations for long-gone info handlers
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

usb: error handling fixes from Markus, make sysbus ehci arm-only.

# gpg: Signature made Wed Feb 18 09:54:13 2015 GMT using RSA key ID D3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
# gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
# gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

* remotes/kraxel/tags/pull-usb-20150218-1:
  Make sysbus EHCI devices ARM only by default
  PPC: Don't use legacy -usbdevice support for setting up board
  r2d: Don't use legacy -usbdevice support for setting up board
  usb: Change usb_create_simple() to abort on failure
  usb: Suppress bogus error when automatic usb-hub creation fails
  usb: Do not prefix error_setg() messages with "Error: "
  usb: Improve -usbdevice error reporting a bit
  usb: usb_create() can't fail, drop useless error handling
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

tag for qga-pull-2015-02-16-v2

v2:

* generalized QAPI function definition for guest-memory-block-size
  to guest-memory-block-info for future extensibility (Eric)

# gpg: Signature made Tue Feb 17 22:36:08 2015 GMT using RSA key ID F108B584
# gpg: Good signature from "Michael Roth <flukshun@gmail.com>"
# gpg:                 aka "Michael Roth <mdroth@utexas.edu>"
# gpg:                 aka "Michael Roth <mdroth@linux.vnet.ibm.com>"
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg:          There is no indication that the signature belongs to the owner.
# Primary key fingerprint: CEAC C9E1 5534 EBAB B82D  3FA0 3353 C9CE F108 B584

* remotes/mdroth/tags/qga-pull-2015-02-16-v2-tag:
  qemu-ga-win: Fail loudly on bare 'set-time'
  qga: add memory block command that unsupported
  qga: implement qmp_guest_get_memory_block_info() for Linux with sysfs
  qga: implement qmp_guest_set_memory_blocks() for Linux with sysfs
  qga: implement qmp_guest_get_memory_blocks() for Linux with sysfs
  qga: introduce three guest memory block commmands with stubs
  qga: implement file commands for Windows guest
  guest agent: guest-file-open: refactoring
  utils: drop strtok_r from envlist_parse
  qga: add guest-set-user-password command
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

- vhost-scsi: add bootindex property
- RCU: fix MemoryRegion lifetime issues in PCI; document the rules;
convert of AddressSpaceDispatch and RAMList
- KVM: add kvm_exit reasons for aarch64

# gpg: Signature made Mon Feb 16 16:32:32 2015 GMT using RSA key ID 78C7AE83
# gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>"
# gpg:                 aka "Paolo Bonzini <pbonzini@redhat.com>"
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg:          There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4  E2F7 7E15 100C CD36 69B1
#      Subkey fingerprint: F133 3857 4B66 2389 866C  7682 BFFB D25F 78C7 AE83

* remotes/bonzini/tags/for-upstream: (21 commits)
  Convert ram_list to RCU
  exec: convert ram_list to QLIST
  cosmetic changes preparing for the following patches
  exec: protect mru_block with RCU
  rcu: add g_free_rcu
  rcu: introduce RCU-enabled QLIST
  exec: RCUify AddressSpaceDispatch
  exec: make iotlb RCU-friendly
  exec: introduce cpu_reload_memory_map
  docs: clarify memory region lifecycle
  pci: split shpc_cleanup and shpc_free
  pcie: remove mmconfig memory leak and wrap mmconfig update with transaction
  memory: keep the owner of the AddressSpace alive until do_address_space_destroy
  rcu: run RCU callbacks under the BQL
  rcu: do not let RCU callbacks pile up indefinitely
  vhost-scsi: set the bootable value of channel/target/lun
  vhost-scsi: add a property for booting
  vhost-scsi: expose the TYPE_FW_PATH_PROVIDER interface
  vhost-scsi: add bootindex property
  qdev: support to get a device firmware path directly
  ...
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Pull request

v2:
 * Fix C11 typedef redefinitions in ahci and libqos malloc [Peter]
 * Fix lx -> PRIx64 format specifiers in ahci [Peter]

# gpg: Signature made Mon Feb 16 15:45:53 2015 GMT using RSA key ID 81AB73C8
# gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>"
# gpg:                 aka "Stefan Hajnoczi <stefanha@gmail.com>"

* remotes/stefanha/tags/block-pull-request: (65 commits)
  block: Keep bdrv_check*_request()'s return value
  block: Remove "growable" from BDS
  block: Clamp BlockBackend requests
  qemu-io: Use BlockBackend
  qemu-io: Remove "growable" option
  qemu-io: Use blk_new_open() in openfile()
  qemu-nbd: Use blk_new_open() in main()
  qemu-img: Use BlockBackend as far as possible
  qemu-img: Use blk_new_open() in img_rebase()
  qemu-img: Use blk_new_open() in img_open()
  block/xen: Use blk_new_open() in blk_connect()
  blockdev: Use blk_new_open() in blockdev_init()
  iotests: Add test for driver=qcow2, format=qcow2
  block: Add Error parameter to bdrv_find_protocol()
  block: Add blk_new_open()
  block: Lift some BDS functions to the BlockBackend
  iotests: Add test for qemu-img convert to NBD
  qemu-img: Fix qemu-img convert -n
  qemu-iotests: Add 093 for IO throttling
  qemu-iotests: Allow caller to disable underscore convertion for qmp
  ...
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

vnc: fixup some QemuOpts conversion fallout.

# gpg: Signature made Mon Feb 16 08:13:32 2015 GMT using RSA key ID D3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
# gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
# gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

* remotes/kraxel/tags/pull-vnc-20150216-1:
  vnc: fix coverity warning
  ui/vnc: optimize full scanline updates
  vnc: auto assian an id when calling change vnc qmp interface
  vnc: introduce an wrapper for auto assign vnc id
  vnc: using bool type instead of int for QEMU_OPT_BOOL
  vnc: correct missing property about vnc_display
  vnc: fix qemu crash when not configure vnc option
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

MIPS patches 2015-02-13

Changes:
* bug fixes, cleanups and minor improvements

# gpg: Signature made Sat Feb 14 17:01:37 2015 GMT using RSA key ID 0B29DA6B
# gpg: Can't check signature: public key not found

* remotes/lalrae/tags/mips-20150213-2:
  linux-user: correct stat structure in MIPS N32
  target-mips: pass 0 instead of -1 as rs in microMIPS LUI instruction
  target-mips: fix broken snapshotting
  target-mips: use CP0EnLo_XI instead of magic number
  target-mips: ll and lld cause AdEL exception for unaligned address
  target-mips: fix detection of the end of the page during translation
  target-mips: Make CP0.Status.CU1 read-only for the 5Kc and 5KEc processors
  isa: remove isa_mem_base variable
  gt64xxx: remove isa_mem_base usage
  piix4: use PCI address space instead of system memory
  mips: remove isa_mem_base usage
  jazz: remove usage of isa_mem_base
  jazz: do not explode QEMUMachineInitArgs structure
  isa: add memory space parameter to isa_bus_new
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

It's not easy to figure out how monitor translates
strings: most QEMU code deals with translated indexes,
these are translated using _lookup arrays,
so you need to find the array name, and find the
appropriate offset.

This patch adds C99 indexes to lookup arrays, which makes it possible to
find the correct key using simple grep, and see that the matching is
correct at a glance.

Example:

Before:

const char *MigrationCapability_lookup[] = {
    "xbzrle",
    "rdma-pin-all",
    "auto-converge",
    "zero-blocks",
    NULL,
};

After:

const char *MigrationCapability_lookup[] = {
    [MIGRATION_CAPABILITY_XBZRLE] = "xbzrle",
    [MIGRATION_CAPABILITY_RDMA_PIN_ALL] = "rdma-pin-all",
    [MIGRATION_CAPABILITY_AUTO_CONVERGE] = "auto-converge",
    [MIGRATION_CAPABILITY_ZERO_BLOCKS] = "zero-blocks",
    [MIGRATION_CAPABILITY_MAX] = NULL,
};
Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>
Reviewed-by: NEric Blake <eblake@redhat.com>
Signed-off-by: NLuiz Capitulino <lcapitulino@redhat.com>

When SPICE isn't used, we either fail an assertion in error_set(),
or leak an error object.  Broken in commit b25d81ba.

Cc: Markus Armbruster <armbru@redhat.com>
Signed-off-by: NGonglei <arei.gonglei@huawei.com>
Reviewed-by: NMarkus Armbruster <armbru@redhat.com>
Signed-off-by: NLuiz Capitulino <lcapitulino@redhat.com>

Commit 422e0501 introduced a typo (unless removing an 'o' from
balloon is how you deflate it?)
Signed-off-by: NEric Blake <eblake@redhat.com>
Reviewed-by: NMarkus Armbruster <armbru@redhat.com>
Signed-off-by: NLuiz Capitulino <lcapitulino@redhat.com>

Fix this warning:
hmp.c:414:38: warning: Using plain integer as NULL pointer

qmp_query_block expects a pointer argument, so passing false is wrong.

Cc: Luiz Capitulino <lcapitulino@redhat.com>
Signed-off-by: NStefan Weil <sw@weilnetz.de>
Reviewed-by: NMarkus Armbruster <armbru@redhat.com>
Signed-off-by: NLuiz Capitulino <lcapitulino@redhat.com>

'git shortlog 8936dbb2..4c59f5d8' for seabios repo:

David Woodhouse (4):
      Update EFI_COMPATIBILITY16_TABLE to match 0.98 spec update
      build: use -m16 where available instead of asm(".code16gcc")
      romlayout: Use .code16 not .code16gcc
      vgabios: Use .code16 not .code16gcc

Gerd Hoffmann (2):
      add scripts/tarball.sh
      build: set LC_ALL=C

Hannes Reinecke (1):
      megasas: read addional PCI I/O bar

Ian Campbell (1):
      romlayout: Use "rep ; nop" not "rep nop".

Kevin O'Connor (139):
      vgabios: Return from handle_1011() if handler found.
      edd: Move EDD get drive parameters (int 1348) logic from disk.c to block.c.
      edd: Use sectors==-1 to detect removable media.
      edd: Separate out ATA and virtio specific parts of fill_edd().
      cdemu: store internal cdemu fields in standard "el-torito" spec format.
      Move cdemu call interface and disk_ret helper code to disk.c.
      smm: Replace SMI assembler code with C code.
      smm: Use a C struct to define the layout of the SMM area.
      smp: Replace QEMU SMP init assembler code with C; run only in 32bit mode.
      Don't enable thread preemption during S3 resume vga option rom execution.
      Remove old Bochs bios fixed address string at 0xfff00.
      Move most of the VAR16FIXED() defs to misc.c.
      build: Avoid absolute paths during "whole-program" compiling.
      Make sure handle_smi() and handle_smp() are compiled out if not enabled.
      Remove the TODO file.
      Abstract reset call (and possible 16bit mode switch) into reset() function.
      build: Remove unused function getSectionsStart() from layoutrom.py.
      build: Extract section visiting logic in layoutrom.py.
      build: Refactor layoutrom.py gc() function.
      build: Use customized entry point for each type of build.
      build: Refactor findInit() function.
      build: Rework getRelocs() to use a hash instead of categories in layoutrom.py
      build: Keep segmented sections separate until final link step.
      build: Use fileid instead of category to write sections in layoutrom.py.
      build: Only export needed fields in LayoutInfo in layoutrom.py.
      build: Get fixed address variables from 32bit compile pass (not 16bit)
      build: Minor - fix comments referring to old tools/ directory.
      xhci: Update the times for usb command timeouts.
      ehci: Update usb command timeouts to use usb_xfer_time()
      uhci: Update usb command timeouts to use usb_xfer_time()
      ohci: Update usb command timeouts to use usb_xfer_time()
      vgabios: Fix broken build resulting from e5749978.
      boot: Change ":rom%d" boot order rom instance to ":rom%x"
      Minor - remove stray tab from src/fw/smm.c.
      build: Update kconfig to version in Linux 3.16.
      usb: Fix usb_xfer_time() to work when called in 16bit mode.
      xhci: Call usb_desc2pipe() on xhci_update_pipe().
      xhci: Remove 16bit code wrappers.
      xhci: Use high memory instead of low memory for internal storage.
      xhci: Move root hub and setup code to top of file.
      xhci: Add xhci_check_ports() and xhci_free_pipes() functions.
      ehci: Move port power up from ehci_hub_detect() to check_ehci_ports().
      usb-hub: Enable power to all ports prior to calling usb_enumerate().
      xhci: Change xhci_hub_detect() to use connect status instead of link state.
      uhci: Repeatedly poll for device detect for 100ms.
      ohci: Repeatedly poll for device detect for 100ms.
      ehci: Stall uhci/ohci init only until default port routing is done.
      usb: Perform device detect polling on all usb controllers.
      ehci: Fix bug in hub port assignment
      Revert "Use the extra stack for 16bit USB and PS2 keyboard/mouse commands."
      pmm: Fix entry point to support non-zero %ss
      Move stack hop code below call32/call16 code in stacks.c
      Add need_hop_back() call that determines if stack_hop_back is needed
      Update invoke_mouse_handler() to use need_hop_back()
      Update stack_hop_back() to jump to 16bit mode if called in 32bit mode.
      Track when entering via call32() and use the same mode for stack_hop_back()
      Simplify farcall16 code
      Update reset() to use call16_back()
      build: Support declaring 32bit C functions that must reside in the f-segment
      Move call16() functions from romlayout.S to inline assembler in stacks.c
      Break up call32() into call32() and call32_sloppy()
      Fully restore 16bit state during call16_sloppy()
      Implement call32 mechanism using SMIs.
      Move a20 code from system.c and ps2port.h to x86.h
      Backup and restore a20 on call32_sloppy()
      usb: Rename ?hci_control() to ?hci_send_control()
      usb: Rename usb_getFrameExp() to usb_get_period()
      usb: Rename findEndPointDesc() to usb_find_desc()
      usb: Rename send_default_control() to usb_send_default_control()
      usb: Rename free_pipe() to usb_free_pipe()
      usb: Clarify usb freelist manipulations
      xhci: Change xhci_update_pipe() to xhci_realloc_pipe() and use for alloc too
      uhci: Export uhci_realloc_pipe() instead of uhci_alloc_pipe()
      ohci: Export ohci_realloc_pipe() instead of ohci_alloc_pipe()
      ehci: Export ehci_realloc_pipe() instead of ehci_alloc_pipe()
      usb: Use usb_realloc_pipe for pipe alloc, update, and free.
      Use 32bit memcpy in int1587 when applicable
      Don't clobber %ax on ENTRY_INTO32 macro
      Create assembler macros for saving and restoring 'struct bregs'
      Do full BREGS backup/restore for pmm, pnp, and irqentry_extrastack
      Remove unused macro ENTRY_ST
      vgabios: Don't declare custom internal BDA storage in std/bda.h
      vgabios: Cache a pointer to the current mode struct in the BDA
      vgabios: Don't pass vmode_g to vgafb_move_chars() / vgafb_clear_chars()
      vgabios: Rename vbe_flags to flags
      vgabios: Set cursor shape fixes
      vgabios: Refactor get/set_cursor_shape() code
      vgabios: Only init BDA device details in init_bios_area()
      vgabios: Only set the dcc_index=8 if stdvga ports are available
      vgabios: Move standard table definitions to std/vga.h
      vgabios: Fill in available legacy modes in video_func_static at runtime
      vgabios: Add support for reading framebuffer in "direct" mode
      Fix PNP regression introduced in 99cb8f3e due to missed conversion
      Minor - move PORT_PS2_CTRLB from hw/ps2port.h to hw/timer.c
      vgabios: Support emulating text mode attributes while in graphics mode
      vgabios: Add software cursor capability
      Use an aligned stack offset when entering on the extra stack
      Minor - comment updates in romlayout.S
      Fix build issue on gcc34
      pciinit: Fix build warning in mch_pci_slot_get_irq()
      floppy: Make sure to yield() during floppy PIO
      Minor - be consistent in placement of .code16/32 in romlayout.S
      Use macros for .code16/32 mode switches in inline asm in stacks.c
      Eliminate FUNCFSEG - only force portions of inline asm to f-segment
      usb: Update USB hub code to support super speed hubs
      Simplify README files - point to online documentation instead
      sdcard: Initial support for SD cards on PCI SDHCI controllers on QEMU
      Add wiki documentation to repository
      docs: Don't point to repo README files
      docs: Add info on MODE16/MODESEGMENT compile time flags
      docs: Add page describing SeaBIOS final object linking
      scsi: Move cdb_* functions above scsi_* functions
      scsi: Move process_scsi_op() to hw/blockcmd.c and rename
      cdrom: call scsi_process_op() instead of cdb_read()
      scsi: Don't export cdb_* functions
      cdrom: Break up very large read requests into smaller requests
      block: Check for read/write requests over 64K
      usb: Add support for OHCI bulk transfers
      readserial: Enhance pipe support
      docs: Add documentation on using readserial.py script
      uhci: Enable "depth" tree traversal for bulk transfers
      uhci: Increase bulk transfer STACKTDS to 16
      vgabios: Support emulated text in gfx_read_char()
      ehci: No need to support td array wrapping
      ehci: Simplify fillTDbuffer() and rename
      ehci: Merge ehci_send_control with ehci_send_bulk
      ohci: Merge ohci_send_control with ohci_send_bulk
      uhci: Merge uhci_send_control with uhci_send_bulk
      xhci: Merge xhci_send_control with xhci_send_bulk
      usb: Use usb_send_pipe() now that all drivers have x_send_pipe()
      xhci: Move xhci_xfer_x() functions together
      xhci: Merge some xhci_xfer_x() functions into xhci_send_pipe()
      usb: Control transfers always have an 8 byte command size
      usb: Minor - properly free memory on get_device_config() error path
      checkstack: Handle callw instruction
      docs: Document why v1.6.3 release came after v0.6.2
      docs: Update release history with dates of stable releases
      docs: There is only one VAR16 flag now
      docs: Note v1.8.0 release

Marcel Apfelbaum (1):
      hw/pci: reserve IO and mem for pci express downstream ports with no devices attached

Markus Armbruster (1):
      boot: Fix boot order for SCSI target, lun > 9

Paolo Bonzini (5):
      piix: add and use dev-piix.h
      smm: complete SMM setup
      smm: unify SMM handlers
      vgabios: fix graphics operation with Bochs VGA in non-DISPI modes
      vgabios: implement read char in graphics mode

zhanghailiang (1):
      acpi: use specified macro instead of magic-number
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Some are called do_info_SUBCOMMAND() (old ones, usually), some
hmp_info_SUBCOMMAND(), some SUBCOMMAND_info(), sometimes SUBCOMMAND
pointlessly differs in spelling.

Normalize to hmp_info_SUBCOMMAND(), where SUBCOMMAND is exactly the
subcommand name with '-' replaced by '_'.

Exceptions:

* sun4m_irq_info(), sun4m_pic_info() renamed to sun4m_hmp_info_irq(),
  sun4m_hmp_info_pic().

* lm32_irq_info(), lm32_pic_info() renamed to lm32_hmp_info_irq(),
  lm32_hmp_info_pic().
Signed-off-by: NMarkus Armbruster <armbru@redhat.com>

Some are called do_COMMAND() (old ones, usually), some hmp_COMMAND(),
and sometimes COMMAND pointlessly differs in spelling.

Normalize to hmp_COMMAND(), where COMMAND is exactly the command name
with '-' replaced by '_'.

Exceptions:

* do_device_add() and client_migrate_info() *not* renamed to
  hmp_device_add(), hmp_client_migrate_info(), because they're also
  QMP handlers.  They still need to be converted to QAPI.

* do_memory_dump(), do_physical_memory_dump(), do_ioport_read(),
  do_ioport_write() renamed do hmp_* instead of hmp_x(), hmp_xp(),
  hmp_i(), hmp_o(), because those names are too cryptic for my taste.

* do_info_help() renamed to hmp_info_help() instead of hmp_info(),
  because it only covers help.
Signed-off-by: NMarkus Armbruster <armbru@redhat.com>

Leftovers from
d1f29646 qapi: Convert query-spice
791e7c82 qapi: Convert query-migrate
0fe6a7f2 slirp: Drop statistic code
Signed-off-by: NMarkus Armbruster <armbru@redhat.com>

A number of ARM embedded boards include EHCI USB host controllers which
appear as directly mapped devices, rather than sitting on a PCI bus.

At present code to emulate such devices is included whenever EHCI support
is included.  This patch adjusts teh config options to only include them
in builds targetting ARM by default.
Signed-off-by: NDavid Gibson <david@gibson.dropbear.id.au>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

It's tempting, because usbdevice_create() is so simple to use.  But
there's a lot of unwanted complexity behind the simple interface.
Switch to usb_create_simple().

Cc: Alexander Graf <agraf@suse.de>
Cc: qemu-ppc@nongnu.org
Signed-off-by: NMarkus Armbruster <armbru@redhat.com>
Reviewed-by: NAlexander Graf <agraf@suse.de>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

It's tempting, because usbdevice_create() is so simple to use.  But
there's a lot of unwanted complexity behind the simple interface.
Switch to usb_create_simple().

Cc: Magnus Damm <magnus.damm@gmail.com>
Signed-off-by: NMarkus Armbruster <armbru@redhat.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Instead of returning null pointer.  Matches pci_create_simple(),
isa_create_simple(), sysbus_create_simple().  It's unused since the
previous commit, but I'll put it to use again shortly.
Signed-off-by: NMarkus Armbruster <armbru@redhat.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

USBDevice's realize method usb_qdev_realize() automatically creates a
usb-hub when only one port is left.  Creating devices in realize
methods is questionable, but works.

If usb-hub creation fails, an error is reported to stderr, but the
failure is otherwise ignored.  We then create the actual device using
the last port, which may well succeed.

Example:

    $ qemu -nodefaults -S -display none -machine usb=on -monitor stdio
    QEMU 2.2.50 monitor - type 'help' for more information
    (qemu) device_add usb-mouse
    [Repeat 36 times]
    (qemu) info usb
      Device 0.0, Port 1, Speed 12 Mb/s, Product QEMU USB Mouse
      Device 0.0, Port 2, Speed 12 Mb/s, Product QEMU USB Hub
      Device 0.0, Port 2.1, Speed 12 Mb/s, Product QEMU USB Mouse
    [More mice and hubs omitted...]
      Device 0.0, Port 2.8.8.8.8.7, Speed 12 Mb/s, Product QEMU USB Mouse
    (qemu) device_add usb-mouse
    usb hub chain too deep
    Failed to initialize USB device 'usb-hub'
    (qemu) info usb
    [...]
      Device 0.0, Port 2.8.8.8.8.7, Speed 12 Mb/s, Product QEMU USB Mouse
      Device 0.0, Port 2.8.8.8.8.8, Speed 12 Mb/s, Product QEMU USB Mouse

Despite the "Failed" message, the command actually succeeded.

In QMP, it's worse.  When adding the 37th mouse via QMP, the command
fails with

    {"error": {"class": "GenericError", "desc": "usb hub chain too deep"}}

Additionally, "Failed to initialize USB device 'usb-hub'" is reported
on stderr.  Despite the command failure, the device was created.  This
is wrong.

Fix by avoiding qdev_init() for usb-hub creation, so we can ignore
errors cleanly.
Signed-off-by: NMarkus Armbruster <armbru@redhat.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Because it produces beauties like

    (qemu) usb_add mouse
    Failed to initialize USB device 'usb-mouse': Error: tried to attach usb device QEMU USB Mouse to a bus with no free ports
Signed-off-by: NMarkus Armbruster <armbru@redhat.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Most LegacyUSBFactory usbdevice_init() methods realize with
qdev_init_nofail(), even though their caller usbdevice_create() can
handle failure.  Okay if it really can't fail (I didn't check), but
somewhat brittle.

usb_msd_init() and usb_bt_init() call qdev_init().  The latter
additionally reports an error when qdev_init() fails.

Realization failure produces multiple error reports: a specific one
from qdev_init(), and generic ones from usb_bt_init(),
usb_create_simple(), usbdevice_create() and usb_parse().

Remove realization from the usbdevice_init() methods.  Realize in
usbdevice_create(), and produce exactly one error message there.  You
still get another one from usb_parse().
Signed-off-by: NMarkus Armbruster <armbru@redhat.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Signed-off-by: NMarkus Armbruster <armbru@redhat.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

qerror_report_err() is a transitional interface to help with
converting existing monitor commands to QMP.  It should not be used
elsewhere.  Replace by error_report_err() in legacy chardev parser
qemu_chr_parse_compat().  Legacy chardev syntax is not to be used in
QMP.
Signed-off-by: NMarkus Armbruster <armbru@redhat.com>
Reviewed-by: NEric Blake <eblake@redhat.com>

qerror_report_err() is a transitional interface to help with
converting existing monitor commands to QMP.  It should not be used
elsewhere.  Replace by error_report_err().
Signed-off-by: NMarkus Armbruster <armbru@redhat.com>
Reviewed-by: NEric Blake <eblake@redhat.com>

qerror_report_err() is a transitional interface to help with
converting existing monitor commands to QMP.  It should not be used
elsewhere.  Replace by error_report_err() in initial startup helpers
machine_set_property() and object_create().
Signed-off-by: NMarkus Armbruster <armbru@redhat.com>
Reviewed-by: NEric Blake <eblake@redhat.com>

qerror_report_err() is a transitional interface to help with
converting existing monitor commands to QMP.  It should not be used
elsewhere.  Replace by error_report_err() in initial startup helper
configure_tpm().
Signed-off-by: NMarkus Armbruster <armbru@redhat.com>
Reviewed-by: NEric Blake <eblake@redhat.com>

qerror_report_err() is a transitional interface to help with
converting existing monitor commands to QMP.  It should not be used
elsewhere.  Replace by error_report_err() in initial startup helper
numa_init_func() and board setup helper
memory_region_allocate_system_memory().
Signed-off-by: NMarkus Armbruster <armbru@redhat.com>
Reviewed-by: NEric Blake <eblake@redhat.com>

qerror_report_err() is a transitional interface to help with
converting existing monitor commands to QMP.  It should not be used
elsewhere.  Replace by error_report_err() in HMP command handler
hmp_host_net_add() and initial startup helpers net_init_client(),
net_init_netdev().  Keep it in QMP command handler qmp_netdev_add().
Signed-off-by: NMarkus Armbruster <armbru@redhat.com>
Reviewed-by: NEric Blake <eblake@redhat.com>

qerror_report_err() is a transitional interface to help with
converting existing monitor commands to QMP.  It should not be used
elsewhere.  Replace by error_report_err() in HMP command handler
hmp_trace_event().
Signed-off-by: NMarkus Armbruster <armbru@redhat.com>
Reviewed-by: NEric Blake <eblake@redhat.com>

monitor_handle_fd_param() is a wrapper around
monitor_handle_fd_param2() that feeds errors to qerror_report_err()
instead of returning them.  qerror_report_err() is inappropriate in
many contexts.  monitor_handle_fd_param() looks simpler than
monitor_handle_fd_param2(), which tempts use.  Remove the temptation:
drop the wrapper and open-code the (trivial) error handling instead.

Replace the open-coded qerror_report_err() by error_report_err() in
places that already use error_report().  Turns out that's everywhere.

While there, rename monitor_handle_fd_param2() to monitor_fd_param().
Signed-off-by: NMarkus Armbruster <armbru@redhat.com>
Reviewed-by: NEric Blake <eblake@redhat.com>

Coccinelle semantic patch:

    @@
    expression E;
    @@
    -    error_report("%s", error_get_pretty(E));
    -    error_free(E);
    +    error_report_err(E);
    @@
    expression E, S;
    @@
    -    error_report("%s", error_get_pretty(E));
    +    error_report_err(E);
    (
         exit(S);
    |
         abort();
    )

Trivial manual touch-ups in block/sheepdog.c.
Signed-off-by: NMarkus Armbruster <armbru@redhat.com>
Reviewed-by: NEric Blake <eblake@redhat.com>