This hypercall either initializes a page with zeros, or copies
another page.
According to LoPAPR, the i-cache of the page should also be
flushed if using H_ICACHE_INVALIDATE or H_ICACHE_SYNCHRONIZE,
and the d-cache should be synchronized to the RAM if the
H_ICACHE_SYNCHRONIZE flag is used. For this, two new functions
are introduced, kvmppc_dcbst_range() and kvmppc_icbi()_range, which
use the corresponding assembler instructions to flush the caches
if running with KVM on Power. If the code runs with TCG instead,
the code only uses tb_flush(), assuming that this will be
enough for synchronization.
Signed-off-by: NThomas Huth <thuth@redhat.com>
Signed-off-by: NDavid Gibson <david@gibson.dropbear.id.au>

The main change is virtio 1.0 support.

The complete changelog is:
  > dhcp: fix warning messages when calling strtoip()
  > virtio-scsi: enable virtio 1.0
  > virtio-scsi: use virtio_fill desc api
  > virtio-scsi: use idx during initialization
  > virtio-net: enable virtio 1.0
  > virtio-blk: enable virtio 1.0
  > virtio: 1.0 helper to read 16/32/64 bit value
  > virtio: add and enable 1.0 device setup
  > virtio: 1.0 guest features negotiation
  > virtio: update features set/get register accessor
  > virtio: make all virtio apis 1.0 aware
  > virtio: add 64-bit virtio helpers for 1.0
  > virtio: add virtio 1.0 related struct and defines
  > virtio: get rid of type variable in virtio_device
  > virtio-net: move setup-mac to the open routine
  > virtio-net: make net_hdr_size a variable
  > virtio-net: replace vq array with vq_{tx,rx}
  > virtio-net: use virtio_fill_desc
  > virtio-{net,blk,scsi,9p}: use status variable
  > virtio-blk: add helpers for filling descriptors
  > virtio-{blk,9p}: enable resetting the device
  > virtio: introduce helper for initializing virt queue
  > virtio: fix code style/design issues.
  > fix code style in byteorder.h
  > pci: add byte read/write helper routines
  > virtio-net: fix gcc warnings (-Wextra)
  > virtio-blk: fix gcc warnings (-Wextra)
  > readme: Add a note about coding style
  > dhcp: Remove duplicated strtoip()
  > ethernet: Fix gcc warnings
  > net-snk: Fix gcc warnings
  > net-snk: Fix coding style
  > net-snk: Fix memory leak in dhcp6_process_options()
  > net-snk: Fix memory leak in ip6_to_multicast_mac() / send_ipv6()
  > net-snk: Remove bad NEIGHBOUR_SOLICITATION code in send_ipv6()
  > Fix dma-alloc and dma-map-in functions on board-js2x
  > net-snk: Allow stateless autoconfig IPv6 addresses with IP_INIT_IPV6_MANUAL
  > net-snk: Simplify the ip6_is_multicast() function
  > net-snk: Move global variable definition out of the header file
  > net-snk: Prefer non-link-local unicast IPv6 addresses if possible
  > net-snk: Fix the check for link-local addresses when receiving RAs
  > net-snk: Remove junk at the end of IPv6 TFTP ACK and error packets
  > Fix format strings in usb-ohci.c
  > net-snk: Get rid of junk at the end of sent DHCPv6 packets
  > net-snk: Use transaction IDs in DHCPv4, too
  > net-snk: Make use of DHCPv6 transaction IDs
  > net-snk: Seed the pseudo-random number generator
  > libc: Add srand() call
  > libc: Fix the rand() function to return non-zero values
  > net-snk: Improve printed text when booting via network
  > Increase temporary buffer size of ibm,client-architecture-support call
  > Move archsupport.fs into board-qemu directory
  > boot: stop booting when we encounter HALT
  > fat-files: Fix bug with root-entries = 0 on certain FAT32 file systems
  > usb: print unhandled descriptor in debug mode
  > Improve stack usage with libnvram get_partition function
  > Improve stack usage in libnvram environment variable code
  > libc: Port vsnprintf back from skiboot
  > Move the code for rfill into a separate function
  > Rework wrapper for new_nvram_partition() and fix possible bug in there
  > Stack optimization in libusb: split up setup_new_device()
  > Check for stack overflow in paflof engine
  > Clean up pending packet variable in ipv4 code
  > Fix tracking of pending outgoing packets when handling ARP replies
Signed-off-by: NAlexey Kardashevskiy <aik@ozlabs.ru>
Signed-off-by: NDavid Gibson <david@gibson.dropbear.id.au>

spice: initial opengl/virgl support, postcopy migration fix.

# gpg: Signature made Tue 23 Feb 2016 12:30:40 GMT using RSA key ID D3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
# gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
# gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

* remotes/spice/tags/pull-spice-20160223-1:
  Postcopy+spice: Pass spice migration data earlier
  spice/gl: tweak debug messages.
  spice/gl: add unblock timer
  spice: add opengl/virgl/dmabuf support
  spice: reset cursor on resize
  egl-helpers: add functions for render nodes and dma-buf passing
  configure: add dma-buf support detection.
  spice: init dcl before registering qxl interface
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

When generating the trace/generated-ust.c source file, make sure
it includes osdep.h as its first include.

This fixes compilation with --enable-trace-backends=ust
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Message-id: 1456240661-15422-1-git-send-email-peter.maydell@linaro.org
Reviewed-by: NEric Blake <eblake@redhat.com>

Clean up includes so that osdep.h is included first and headers
which it implies are not included manually.

This commit was created with scripts/clean-includes.

NB: If this commit breaks compilation for your out-of-tree
patchseries or fork, then you need to make sure you add
#include "qemu/osdep.h" to any new .c files that you have.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Reviewed-by: NEric Blake <eblake@redhat.com>

Clean up includes so that osdep.h is included first and headers
which it implies are not included manually.

This commit was created with scripts/clean-includes.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
---
This just catches a couple of stragglers since I posted
the last clean-includes patchset last week.

Clean up includes so that osdep.h is included first and headers
which it implies are not included manually.

This commit was created with scripts/clean-includes.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Reviewed-by: NEric Blake <eblake@redhat.com>

NEED_CPU_H is the define we use to distinguish per-target object
compilation from common object compilation. For the former, we must
also include config-target.h so that the .c files see the necessary
CONFIG_ constants.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Reviewed-by: NEric Blake <eblake@redhat.com>

Add a --all option which will run the script on every C
source and header file in the repository (except for those
in a few directories which contain standalone guest code).
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Reviewed-by: NEric Blake <eblake@redhat.com>

Enhance clean-includes to handle header files as well as .c source
files. For headers we merely remove all the redundant #include
lines, including any includes of qemu/osdep.h itself.

There is a simple mollyguard on the include file processing to
skip a few key headers like osdep.h itself, to avoid producing
bad patches if the script is run on every file in include/.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Reviewed-by: NEric Blake <eblake@redhat.com>

Rearrange include directives so that we include osdep.h first.
This has to be done manually because clean-includes doesn't
handle C++.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Reviewed-by: NEric Blake <eblake@redhat.com>

For C++ before C++11, <stdint.h> requires definition of the macros
__STDC_CONSTANT_MACROS, __STDC_LIMIT_MACROS and __STDC_FORMAT_MACROS
in order to enable definition of various macros by the header file.
Define these in osdep.h, so that we get the right header file
definitions whether osdep.h is being used by plain C, C++11 or
older C++.

In particular libvixl's header files depend on this and won't
compile if osdep.h is included before them otherwise.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Reviewed-by: NEric Blake <eblake@redhat.com>

Clean up includes so that osdep.h is included first and headers
which it implies are not included manually.

This commit was created with scripts/clean-includes.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Spice hooks the migration status changes to figure out when to
transmit information to the new spice server; but the migration
status in postcopy doesn't quite fit - the destination starts
running before the end of the source migration.

It's not a case of hanging off the migration status change to
postcopy-active either, since that happens before we stop the
guest CPU.

Fix it by sending a notify just after sending the device state,
and adding a flag that can be tested by the notify receiver.

Symptom:
   spice handover doesn't work with the error:
   red_worker.c:11540:display_channel_wait_for_migrate_data: timeout
Signed-off-by: NDr. David Alan Gilbert <dgilbert@redhat.com>
Reviewed-by: NAmit Shah <amit.shah@redhat.com>
Message-id: 1456161452-25318-1-git-send-email-dgilbert@redhat.com
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Adjust message levels, make messages more verbose.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Pure debug aid, print a warning in case unblocking
doesn't happen within one second.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
Reviewed-by: NMarc-André Lureau <marcandre.lureau@redhat.com>

This adds support for dma-buf passing to spice.  This makes virtio-gpu
with 3d acceleration work with spice.

Workflow:
 * virglrenderer renders the guest command stream into a texture.
 * qemu exports the texture as dma-buf and passes on that dma-buf
   to spice-server.
 * spice-server passes the dma-buf to spice-client, using unix
   socket file descriptor passing.
 * spice-client asks the window systems composer to render the
   dma-buf to the screen.

Requires cutting edge spice (server) and spice-gtk (client) builds,
from git master branch.

Also requires libvirt managing your qemu instance, and using
"virt-viewer --attach $guest".  libvirt will connect spice-server and
spice-client using unix sockets instead of tcp sockets then, which
is required for file descriptor passing.

Works for the local case (spice server and client on the same machine)
only.  Supporting remote too is planned (by feeding the dma-bufs into
gpu-assisted video encoder), but not there yet.

gl mode is turned off by default, use "-spice gl=on,$otherargs" to
enable it.
Signed-off-by: NMarc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Spice server will clear the cursor on resize. QXL driver reset it after
resize, however, virtio and other devices do not. Teach qemu to set it
back.
Signed-off-by: NMarc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Adds helpers to open a drm render node and create a opengl
context for it.  Also add a helper to export a texture as
dma-buf.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
Reviewed-by: NMarc-André Lureau <marcandre.lureau@redhat.com>

Set CONFIG_OPENGL_DMABUF in case both mesa and libepoxy are
new enough to have support for dma-buf import/export.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
Reviewed-by: NMarc-André Lureau <marcandre.lureau@redhat.com>

Without this spice might callback into qemu before ssd->dcl.con is
initialized, resulting in a segfault due to NULL pointer dereference.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
Reviewed-by: NMarc-André Lureau <marcandre.lureau@redhat.com>

usb: misc bugfixes.

# gpg: Signature made Tue 23 Feb 2016 10:53:01 GMT using RSA key ID D3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
# gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
# gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

* remotes/kraxel/tags/pull-usb-20160223-1:
  ohci: allocate timer only once.
  usb: add pid check at the first of uhci_handle_td()
  usb: check RNDIS buffer offsets & length
  usb: check RNDIS message length
  tusb6010: move from hw/timer to hw/usb
  usb: check USB configuration descriptor object
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Allocate timer once, at init time, instead of allocating/freeing
it all the time when starting/stopping the bus.  Simplifies the
code, also fixes bugs (memory leak) due to missing checks whenever
the time is already allocated or not.

Cc: Prasad J Pandit <pjp@fedoraproject.org>
Reported-by: NZuozhi Fzz <zuozhi.fzz@alibaba-inc.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

pid can be gotten from uhci device memory in uhci_handle_td(),
so the guest can trigger assert qemu if we get an invalid pid.
And the uhci spec 2.1.2 tells us The Host Controller sets Host
Controller Process Error bit to 1 when it detects a fatal error
and indicates that the Host Controller suffered a consistency
check failure while processing a Transfer Descriptor. An example
of a consistency check failure would be finding an illegal PID
field while processing the packet header portion of the TD.
When this error occurs, the Host Controller clears the Run/Stop
bit in the Command register to prevent further schedule execution.

We'd better to set UHCI_STS_HCPERR and kick an interrupt, check
the pid value at the first of uhci_handle_td function.

https://bugzilla.redhat.com/show_bug.cgi?id=1070027Signed-off-by: NGonglei <arei.gonglei@huawei.com>
Message-id: 1455867238-4720-1-git-send-email-arei.gonglei@huawei.com

[ applied minor codestyle fix ]
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

When processing remote NDIS control message packets,
the USB Net device emulator uses a fixed length(4096) data buffer.
The incoming informationBufferOffset & Length combination could
overflow and cross that range. Check control message buffer
offsets and length to avoid it.
Reported-by: NQinghao Tang <luodalongde@gmail.com>
Signed-off-by: NPrasad J Pandit <pjp@fedoraproject.org>
Message-id: 1455648821-17340-3-git-send-email-ppandit@redhat.com
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

When processing remote NDIS control message packets, the USB Net
device emulator uses a fixed length(4096) data buffer. The incoming
packet length could exceed this limit. Add a check to avoid it.
Signed-off-by: NPrasad J Pandit <pjp@fedoraproject.org>
Message-id: 1455648821-17340-2-git-send-email-ppandit@redhat.com
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

The TUSB6010 is a USB controller (as the name suggests). Move it from
hw/timer (where it was accidentally filed in 2013 when we moved
everything out of hw/) to hw/usb.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Message-id: 1455883404-10976-1-git-send-email-peter.maydell@linaro.org
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

When processing remote NDIS control message packets, the USB Net
device emulator checks to see if the USB configuration descriptor
object is of RNDIS type(2). But it does not check if it is null,
which leads to a null dereference error. Add check to avoid it.
Reported-by: NQinghao Tang <luodalongde@gmail.com>
Signed-off-by: NPrasad J Pandit <pjp@fedoraproject.org>
Message-id: 1455188480-14688-1-git-send-email-ppandit@redhat.com
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Block layer patches

# gpg: Signature made Mon 22 Feb 2016 15:59:25 GMT using RSA key ID C88F2FD6
# gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>"

* remotes/kevin/tags/for-upstream: (34 commits)
  qemu-iotests: 140: make description slightly more verbose
  qemu-iotests: 140: don't use IDE device
  qemu-iotests: 067: ignore QMP events
  blockdev: unset inappropriate flags when changing medium
  MAINTAINERS: Add myself as maintainer of the throttling code
  docs: Document the throttling infrastructure
  qapi: Correct the name of the iops_rd parameter
  qemu-iotests: Extend iotest 093 to test bursts
  throttle: Test throttle_compute_wait() during bursts
  throttle: Check that burst_level leaks correctly
  qapi: Add burst length fields to BlockDeviceInfo
  qapi: Add burst length parameters to block_set_io_throttle
  throttle: Add command-line settings to define the burst periods
  throttle: Add support for burst periods
  throttle: Use throttle_config_init() to initialize ThrottleConfig
  throttle: Merge all functions that check the configuration into one
  throttle: Set always an average value when setting a maximum value
  throttle: Make throttle_is_valid() set errp
  throttle: Make throttle_max_is_missing_limit() set errp
  throttle: Make throttle_conflicting() set errp
  ...
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Block patches of the last three weeks.

# gpg: Signature made Mon Feb 22 16:55:33 2016 CET using RSA key ID E838ACAD
# gpg: Good signature from "Max Reitz <mreitz@redhat.com>"

* mreitz/tags/pull-block-for-kevin-2016-02-22:
  qemu-iotests: 140: make description slightly more verbose
  qemu-iotests: 140: don't use IDE device
  qemu-iotests: 067: ignore QMP events
  blockdev: unset inappropriate flags when changing medium
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

Describe in a little more detail what the test is supposed to achieve.
Signed-off-by: NSascha Silbe <silbe@linux.vnet.ibm.com>
Message-id: 1455827853-33477-3-git-send-email-silbe@linux.vnet.ibm.com
Signed-off-by: NMax Reitz <mreitz@redhat.com>

IDE is only implemented by very few architectures (mostly PC). The
test doesn't actually need a block device attached to the
BlockBackend, so just drop it and adjust the reference output
accordingly.

Fixes: 16dee418 ("iotests: Add test for eject under NBD server")
Signed-off-by: NSascha Silbe <silbe@linux.vnet.ibm.com>
Message-id: 1455827853-33477-2-git-send-email-silbe@linux.vnet.ibm.com
Signed-off-by: NMax Reitz <mreitz@redhat.com>

The relative ordering of "device_del" return value and the
"DEVICE_DELETED" QMP event depends on the architecture being
tested. On x86 unplugging virtio disks is asynchronous
(=qdev_unplug()= → =hotplug_handler_unplug_request()=) while on s390x
it is synchronous (=qdev_unplug()= → =hotplug_handler_unplug()=). This
leads to the actual output on s390x consistently differing from the
reference output (that was probably produced on x86).

The easiest way to address this is to filter out QMP events in
067. The DEVICE_DELETED event is already getting explicitly tested by
the Python-based test case 139, so the test coverage should be
unaffected. Make use of the recently introduced _filter_qmp_events()
to remove QMP events from the test case output and adjust the
reference output accordingly.

The tr / sed / tr trick used for filtering was suggested by Max Reitz
<mreitz@redhat.com>.
Signed-off-by: NSascha Silbe <silbe@linux.vnet.ibm.com>
Message-id: 1455886869-139916-2-git-send-email-silbe@linux.vnet.ibm.com
Signed-off-by: NMax Reitz <mreitz@redhat.com>

Most importantly, this removes BDRV_O_TEMPORARY, to avoid unlink()ing an
image which replaces a snapshotted one.
Signed-off-by: NAlyssa Milburn <fuzzie@fuzzie.org>
Message-id: 20160206133618.GA16635@li141-249.members.linode.com
Signed-off-by: NMax Reitz <mreitz@redhat.com>

Signed-off-by: NAlberto Garcia <berto@igalia.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

Signed-off-by: NAlberto Garcia <berto@igalia.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

Signed-off-by: NAlberto Garcia <berto@igalia.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

This patch adds a new test that checks that the burst settings
('iops_max', 'iops_max_length', etc.) of the throttling code work as
expected.
Signed-off-by: NAlberto Garcia <berto@igalia.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

This test simulates an I/O burst for more than two seconds and checks
that it works as expected.
Signed-off-by: NAlberto Garcia <berto@igalia.com>
Reviewed-by: NStefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

This patch expands test_leak_bucket() to check that burst_level leaks
correctly.
Signed-off-by: NAlberto Garcia <berto@igalia.com>
Reviewed-by: NStefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>