Updates for QEMU 2.3-rc0:
 - Error reporting and static cleanup (Alexey Kardashevskiy)
 - Runtime mmap disable for tracing (Samuel Pitoiset)
 - Support for host directed device request (Alex Williamson)

# gpg: Signature made Mon Mar  2 18:42:50 2015 GMT using RSA key ID 3BB08B22
# gpg: Good signature from "Alex Williamson <alex.williamson@redhat.com>"
# gpg:                 aka "Alex Williamson <alex@shazbot.org>"
# gpg:                 aka "Alex Williamson <alwillia@redhat.com>"
# gpg:                 aka "Alex Williamson <alex.l.williamson@gmail.com>"

* remotes/awilliam/tags/vfio-update-20150302.0:
  vfio-pci: Enable device request notification support
  vfio: allow to disable MMAP per device with -x-mmap=off option
  vfio: Make type1 listener symbols static
  vfio: Add ioctl number to error report
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

If the iothread lock isn't taken by the main thread, the RCU callbacks
might run concurrently with the main thread.  QEMU's not ready for that.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Tested-by: NChristian Borntraeger <borntraeger@de.ibm.com>
Tested-by: NGonglei <arei.gonglei@huawei.com>
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

- more config options
- bootdevice, iscsi, virtio-scsi fixes
- build system patches for MinGW and config-devices.mak
- qemu_mutex_lock_iothread deadlock fixes
- another tiny patch from the record/replay series

# gpg: Signature made Mon Mar  2 09:59:14 2015 GMT using RSA key ID 78C7AE83
# gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>"
# gpg:                 aka "Paolo Bonzini <pbonzini@redhat.com>"
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg:          There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4  E2F7 7E15 100C CD36 69B1
#      Subkey fingerprint: F133 3857 4B66 2389 866C  7682 BFFB D25F 78C7 AE83

* remotes/bonzini/tags/for-upstream:
  cpus: be more paranoid in avoiding deadlocks
  cpus: fix deadlock and segfault in qemu_mutex_lock_iothread
  virtio-scsi: Allocate op blocker reason before blocking
  Makefile.target: binary depends on config-devices
  Makefile: don't silence mak file test with V=1
  Makefile: fix up parallel building under MSYS+MinGW
  iscsi: Handle write protected case in reopen
  Give ivshmem its own config option
  Create specific config option for "platform-bus"
  Add specific config options for PCI-E bridges
  bootdevice: fix segment fault when booting guest with '-kernel' and '-initrd'
  timer: replace time() with QEMU_CLOCK_HOST
  virtio-scsi-dataplane: Call blk_set_aio_context within BQL
  block: Forbid bdrv_set_aio_context outside BQL
  scsi: give device a parent before setting properties
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

QemuOpts: Convert various setters to Error

# gpg: Signature made Thu Feb 26 13:56:43 2015 GMT using RSA key ID EB918653
# gpg: Good signature from "Markus Armbruster <armbru@redhat.com>"
# gpg:                 aka "Markus Armbruster <armbru@pond.sub.org>"

* remotes/armbru/tags/pull-error-2015-02-26:
  qtest: Use qemu_opt_set() instead of qemu_opts_parse()
  pc: Use qemu_opt_set() instead of qemu_opts_parse()
  qemu-sockets: Simplify setting numeric and boolean options
  block: Simplify setting numeric options
  qemu-img: Suppress unhelpful extra errors in convert, amend
  QemuOpts: Propagate errors through opts_parse()
  QemuOpts: Propagate errors through opts_do_parse()
  QemuOpts: Drop qemu_opt_set(), rename qemu_opt_set_err(), fix use
  block: Suppress unhelpful extra errors in bdrv_img_create()
  qemu-img: Suppress unhelpful extra errors in convert, resize
  QemuOpts: Convert qemu_opts_set() to Error, fix its use
  QemuOpts: Convert qemu_opt_set_number() to Error, fix its use
  QemuOpts: Convert qemu_opt_set_bool() to Error, fix its use
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

This reverts commit b8a173b2, reversing
changes made to 5de09046.

(I applied this pull request when I should not have done so, and
am now immediately reverting it.)
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Linux v4.0-rc1 vfio-pci introduced a new virtual interrupt to allow
the kernel to request a device from the user.  When signaled, QEMU
will by default attmempt to hot-unplug the device.  This is a one-
shot attempt with the expectation that the kernel will continue to
poll for the device if it is not returned.  Returning the device when
requested is the expected standard model of cooperative usage, but we
also add an option option to disable this feature.  Initially this
opt-out is set as an experimental option because we really should
honor kernel requests for the device.
Signed-off-by: NAlex Williamson <alex.williamson@redhat.com>

Disabling MMAP support uses the slower read/write accesses but allows to
trace all MMIO accesses, which is not good for performance, but very
useful for reverse engineering PCI drivers. This option allows to
disable MMAP per device without a compile-time change.
Signed-off-by: NSamuel Pitoiset <samuel.pitoiset@gmail.com>
Signed-off-by: NAlex Williamson <alex.williamson@redhat.com>

They are not used from anywhere but common.c which is where these are
defined so make them static.
Signed-off-by: NAlexey Kardashevskiy <aik@ozlabs.ru>
Signed-off-by: NAlex Williamson <alex.williamson@redhat.com>

This makes the error report more informative.
Signed-off-by: NAlexey Kardashevskiy <aik@ozlabs.ru>
Signed-off-by: NAlex Williamson <alex.williamson@redhat.com>

* remotes/ehabkost/tags/x86-pull-request:
  target-i386: Move APIC ID compatibility code to pc.c
  target-i386: Require APIC ID to be explicitly set before CPU realize
  target-i386: Set APIC ID using cpu_index on CONFIG_USER
  linux-user: Check for cpu_init() errors
  target-i386: Move CPUX86State.cpuid_apic_id to X86CPU.apic_id
  target-i386: Simplify error handling on cpu_x86_init_user()
  target-i386: Eliminate cpu_init() function
  target-i386: Rename cpu_x86_init() to cpu_x86_init_user()
  target-i386: Move topology.h to include/hw/i386
  target-i386: Eliminate unnecessary get_cpuid_vendor() function
  target-i386: Simplify listflags() function

Conflicts:
	target-i386/cpu.c
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

QOM infrastructure fixes and device conversions

* Assertion fix for device_add with non-device types
* Documentation fix
* qdev_init() error reporting cleanups

# gpg: Signature made Tue Feb 24 13:56:33 2015 GMT using RSA key ID 3E7E013F
# gpg: Good signature from "Andreas Färber <afaerber@suse.de>"
# gpg:                 aka "Andreas Färber <afaerber@suse.com>"

* remotes/afaerber/tags/qom-devices-for-peter:
  parallel: parallel_hds_isa_init() shouldn't fail
  parallel: Factor out common parallel_hds_isa_init()
  serial: serial_hds_isa_init() shouldn't fail
  serial: Factor out common serial_hds_isa_init()
  etsec: Replace qdev_init() by qdev_init_nofail()
  leon3: Replace unchecked qdev_init() by qdev_init_nofail()
  ide/isa: Replace unchecked qdev_init() by qdev_init_nofail()
  qdev: Improve qdev_init_nofail()'s error reporting
  qom: Fix typo, 'my_class_init' -> 'derived_class_init'
  qdev: Avoid type assertion in qdev_build_hotpluggable_device_list()
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

NUMA fixes queue

# gpg: Signature made Mon Feb 23 19:28:42 2015 GMT using RSA key ID 984DC5A6
# gpg: Can't check signature: public key not found

* remotes/ehabkost/tags/numa-pull-request:
  numa: Rename set_numa_modes() to numa_post_machine_init()
  numa: Rename option parsing functions
  numa: Move QemuOpts parsing to set_numa_nodes()
  numa: Make max_numa_nodeid static
  numa: Move NUMA globals to numa.c
  vl.c: Remove unnecessary zero-initialization of NUMA globals
  numa: Move NUMA declarations from sysemu.h to numa.h
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

For good measure, ensure that the following sequence:

   thread 1 calls qemu_mutex_lock_iothread
   thread 2 calls qemu_mutex_lock_iothread
   VCPU thread are created
   VCPU thread enters execution loop

results in the VCPU threads letting the other two threads run
and obeying iothread_requesting_mutex even if the VCPUs are
not halted.  To do this, check iothread_requesting_mutex
before execution starts.
Tested-by: NLeon Alrae <leon.alrae@imgtec.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

When two threads (other than the low-priority TCG VCPU thread)
are competing for the iothread lock, a deadlock can happen.  This
is because iothread_requesting_mutex is set to false by the first
thread that gets the mutex, and then the VCPU thread might never
yield from the execution loop.  If iothread_requesting_mutex is
changed from a bool to a counter, the deadlock is fixed.

However, there is another bug in qemu_mutex_lock_iothread that
can be triggered by the new call_rcu thread.  The bug happens
if qemu_mutex_lock_iothread is called before the CPUs are
created.  In that case, first_cpu is NULL and the caller
segfaults in qemu_mutex_lock_iothread.  To fix this, just
do not do the kick if first_cpu is NULL.
Reported-by: NLeon Alrae <leon.alrae@imgtec.com>
Reported-by: NAndreas Gustafsson <gson@gson.org>
Tested-by: NLeon Alrae <leon.alrae@imgtec.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

s->blocker is really only used in hw/scsi/virtio-scsi.c; the only places
where it is used in hw/scsi/virtio-scsi-dataplane.c is when it is
allocated and when it is freed. That does not make a whole lot of sense
(and is actually wrong because this leads to s->blocker potentially
being NULL when blk_op_block_all() is called in virtio-scsi.c), so move
the allocation and destruction of s->blocker to the device realization
and unrealization in virtio-scsi.c, respectively.

Case in point:

$ echo -e 'eject drv\nquit' | \
    x86_64-softmmu/qemu-system-x86_64 \
        -monitor stdio -machine accel=qtest -display none \
        -object iothread,id=thr -device virtio-scsi-pci,iothread=thr \
        -drive if=none,file=test.qcow2,format=qcow2,id=drv \
        -device scsi-cd,drive=drv

Without this patch:

(qemu) eject drv
[1]    10102 done
       10103 segmentation fault (core dumped)

With this patch:

(qemu) eject drv
Device 'drv' is busy: block device is in use by data plane
(qemu) quit
Signed-off-by: NMax Reitz <mreitz@redhat.com>
Message-Id: <1425057113-26940-1-git-send-email-mreitz@redhat.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

relink binary whenever config-devices.mak changes:
this makes sense as we are adding/removing devices,
so binary has to be relinked to be up to date.
Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>
Message-Id: <1424332114-13440-2-git-send-email-mst@redhat.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

V=1 should show what's going on, it's not nice
to silence things unconditionally.
Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>
Message-Id: <1424332114-13440-1-git-send-email-mst@redhat.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

This patch enables parallel building of QEMU in MSYS+MinGW environment.
Currently an attempt to build QEMU in parallel fails on generation of
version.lo (and version.o too).

The cause of the failure is that when listing prerequisites "Makefile"
references "config-host.h" by absolute path in some rules and by relative
path in others. Make cannot figure out that these references points to the
same file which leads to the race: the generation of "version.*" which
requires "$(BUILD_DIR)/config-host.h" is launched in parallel with the
generation of "config-host.h" needed by other "Makefile" targets.

This patch removes "$(BUILD_DIR)/" prefix from corresponding prerequisite
of "version.*". There is no other prerequisites "$(BUILD_DIR)/config-host.h"
found.

Also note that not every version of MSYS is able to build QEMU in parallel,
see: "http://sourceforge.net/p/mingw/bugs/1950/". The suggested version is
1.0.17.
Signed-off-by: NVasily Efimov <real@ispras.ru>
Message-Id: <1424264377-5992-1-git-send-email-real@ispras.ru>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

Save the write protected flag and check before reopen.
Signed-off-by: NFam Zheng <famz@redhat.com>
Message-Id: <1424839208-5195-1-git-send-email-famz@redhat.com>
[Fixed typo in the name of the new field. - Paolo]
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

Currently the ivshmem device is built whenever both PCI and KVM support are
included.  This patch gives it its own config option to allow easier
customization of whether to include it.  It's enabled by default in the
same circumstances as now - when both PCI and KVM are available.
Signed-off-by: NDavid Gibson <david@gibson.dropbear.id.au>
Reviewed-by: NPeter Crosthwaite <peter.crosthwaite@xilinx.com>
Message-Id: <1425017077-18487-4-git-send-email-david@gibson.dropbear.id.au>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

Currently the "platform-bus" device is included for all softmmu builds.
This bridge is intended for use on any platforms that require dynamic
creation of sysbus devices.  However, at present it is used only for the
PPC E500 target, with plans for the ARM "virt" target in the immediate
future.

To avoid a not-very-useful entry appearing in "qemu -device ?" output on
other targets, this patch makes a specific config option for platform-bus
and enables it (for now) only on ppc configurations which include E500
and on ARM (which always includes the "virt" target).
Signed-off-by: NDavid Gibson <david@gibson.dropbear.id.au>
Message-Id: <1425017077-18487-3-git-send-email-david@gibson.dropbear.id.au>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

The i82801b11, ioh3420 and xio3130 PCI Express devices are currently
included in the build unconditionally.

While they could theoretically appear on any target platform with PCI-E,
they're pretty unlikely to appear on platforms that aren't Intel derived.

Therefore, to avoid presenting unlikely-to-be-relevant devices to the user,
add config options to enable these components, and enable them by default
only on x86 and arm platforms.

(Note that this patch does include these for aarch64, via its inclusion of
arm-softmmu.mak).
Signed-off-by: NDavid Gibson <david@gibson.dropbear.id.au>
Reviewed-by: NPeter Crosthwaite <peter.crosthwaite@xilinx.com>
Message-Id: <1425017077-18487-2-git-send-email-david@gibson.dropbear.id.au>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

Reproducer:

 $./qemu-system-x86_64 --enable-kvm -kernel /home/vmlinuz-2.6.32.12-0.7-default \
  -initrd /home/initrd-2.6.32.12-0.7-default -append \
 "root=/dev/ram rw console=ttyS0,115200" -dtb guest.dtb -vnc :10 --monitor stdio -smp 2
QEMU 2.2.50 monitor - type 'help' for more information
(qemu) Segmentation fault (core dumped)
Reported-by: NEdivaldo de Araujo Pereira <edivaldoapereira@yahoo.com.br>
Signed-off-by: NGonglei <arei.gonglei@huawei.com>
Message-Id: <1425001784-6752-1-git-send-email-arei.gonglei@huawei.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

This patch replaces time() function calls with calls to
qemu_clock_get_ns(QEMU_CLOCK_HOST). It makes such requests deterministic
in record/replay mode of icount.
Reviewed-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NPavel Dovgalyuk <Pavel.Dovgaluk@ispras.ru>
Message-Id: <20150227131102.11912.89850.stgit@PASHA-ISP>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

It's not safe to call blk_set_aio_context from outside BQL because of
the bdrv_drain_all there. Let's put it in the hotplug callback which
will be called by qdev device realization for each scsi device attached
to the bus.
Signed-off-by: NFam Zheng <famz@redhat.com>
Message-Id: <1423969591-23646-3-git-send-email-famz@redhat.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

Even if the caller has both the old and the new AioContext's, there can
be a deadlock, due to the leading bdrv_drain_all.

Suppose there are four io threads (A, B, A0, B0) with A and B owning a
BDS for each (bs_a, bs_b); Now A wants to move bs_a to iothread A0, and
B wants to move bs_b to B0, at the same time:

  iothread A                           iothread B
--------------------------------------------------------------------------
  aio_context_acquire(A0) /* OK */     aio_context_acquire(B0) /* OK */
  bdrv_set_aio_context(bs_a, A0)       bdrv_set_aio_context(bs_b, B0)
  -> bdrv_drain_all()                  -> bdrv_drain_all()
     -> acquire A /* OK */               -> acquire A /* blocked */
     -> acquire B /* blocked */          -> acquire B
     ...                                 ...

Deadlock happens because A is waiting for B, and B is waiting for A.
Signed-off-by: NFam Zheng <famz@redhat.com>
Reviewed-by: NPaolo Bonzini <pbonzini@redhat.com>
Message-Id: <1423969591-23646-2-git-send-email-famz@redhat.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

This mimics what is done in qdev_device_add, and lets the device be
freed in case something goes wrong.  Otherwise, object_unparent returns
immediately without freeing the device, which is on the other hand left
in the parent bus's list of children.

scsi_bus_legacy_handle_cmdline then returns an error, and the HBA is
destroyed as well with object_unparent.  But the lingering device that
was not removed in scsi_bus_legacy_add_drive cannot be removed now either,
and bus_unparent gets stuck in an infinite loop trying to empty the list
of children.

The right fix of course would be to assert in bus_add_child that the
device already has a bus, and remove the "safety net" that adds the
drive to the QOM tree in device_set_realized.  I am not yet sure whether
that would entail changing all callers to qdev_create (as well as
isa_create and usb_create and the corresponding _try_create versions).
Reported-by: NMarkus Armbruster <armbru@redhat.com>
Tested-by: NMarkus Armbruster <armbru@redhat.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

Signed-off-by: NMarkus Armbruster <armbru@redhat.com>
Reviewed-by: NEric Blake <eblake@redhat.com>

Less code, same result.
Signed-off-by: NMarkus Armbruster <armbru@redhat.com>
Reviewed-by: NEric Blake <eblake@redhat.com>

Don't convert numbers or bools to strings for use with qemu_opt_set(),
simply use qemu_opt_set_number() or qemu_opt_set_bool() instead.
Signed-off-by: NMarkus Armbruster <armbru@redhat.com>
Reviewed-by: NEric Blake <eblake@redhat.com>

Don't convert numbers to strings for use with qemu_opt_set(), simply
use qemu_opt_set_number() instead.
Signed-off-by: NMarkus Armbruster <armbru@redhat.com>
Reviewed-by: NEric Blake <eblake@redhat.com>

img_convert() and img_amend() use qemu_opts_do_parse(), which reports
errors with qerror_report_err().  Its error messages aren't helpful
here, the caller reports one that actually makes sense.  Reproducer:

    $ qemu-img convert -o backing_format=raw in.img out.img
    qemu-img: Invalid parameter 'backing_format'
    qemu-img: Invalid options for file format 'raw'

To fix, propagate errors through qemu_opts_do_parse().  This lifts the
error reporting into callers.  Drop it from img_convert() and
img_amend(), keep it in qemu_chr_parse_compat(), bdrv_img_create().

Since I'm touching qemu_opts_do_parse() anyway, write a function
comment for it.
Signed-off-by: NMarkus Armbruster <armbru@redhat.com>
Reviewed-by: NEric Blake <eblake@redhat.com>

Since I'm touching qemu_opts_parse() anyway, write a function comment
for it.
Signed-off-by: NMarkus Armbruster <armbru@redhat.com>
Reviewed-by: NEric Blake <eblake@redhat.com>

Signed-off-by: NMarkus Armbruster <armbru@redhat.com>
Reviewed-by: NEric Blake <eblake@redhat.com>

qemu_opt_set() is a wrapper around qemu_opt_set() that reports the
error with qerror_report_err().

Most of its users assume the function can't fail.  Make them use
qemu_opt_set_err() with &error_abort, so that should the assumption
ever break, it'll break noisily.

Just two users remain, in util/qemu-config.c.  Switch them to
qemu_opt_set_err() as well, then rename qemu_opt_set_err() to
qemu_opt_set().
Signed-off-by: NMarkus Armbruster <armbru@redhat.com>
Reviewed-by: NEric Blake <eblake@redhat.com>

bdrv_img_create() uses qemu_opt_set(), which reports errors with
qerror_report_err().  Its error messages aren't helpful here, the
caller reports one that actually makes sense.  I don't know how to
trigger the error conditions, though.

Switch to qemu_opt_set_err() to get rid of the unwanted messages.
Signed-off-by: NMarkus Armbruster <armbru@redhat.com>
Reviewed-by: NEric Blake <eblake@redhat.com>

add_old_style_options() for img_convert() and img_resize() use
qemu_opt_set(), which reports errors with qerror_report_err().  Its
error messages aren't helpful here, the caller reports one that
actually makes sense.  Reproducer:

    $ qemu-img convert -B raw in.img out.img
    qemu-img: Invalid parameter 'backing_file'
    qemu-img: Backing file not supported for file format 'raw'

Switch to qemu_opt_set_err() to get rid of the unwanted messages.
Signed-off-by: NMarkus Armbruster <armbru@redhat.com>
Reviewed-by: NEric Blake <eblake@redhat.com>

Return the Error object instead of reporting it with
qerror_report_err().

Change callers that assume the function can't fail to pass
&error_abort, so that should the assumption ever break, it'll break
noisily.

Turns out all callers outside its unit test assume that.  We could
drop the Error ** argument, but that would make the interface less
regular, so don't.
Signed-off-by: NMarkus Armbruster <armbru@redhat.com>
Reviewed-by: NEric Blake <eblake@redhat.com>

Return the Error object instead of reporting it with
qerror_report_err().

Change callers that assume the function can't fail to pass
&error_abort, so that should the assumption ever break, it'll break
noisily.

Turns out all callers outside its unit test assume that.  We could
drop the Error ** argument, but that would make the interface less
regular, so don't.
Signed-off-by: NMarkus Armbruster <armbru@redhat.com>
Reviewed-by: NEric Blake <eblake@redhat.com>

Return the Error object instead of reporting it with
qerror_report_err().

Change callers that assume the function can't fail to pass
&error_abort, so that should the assumption ever break, it'll break
noisily.

Turns out all callers outside its unit test assume that.  We could
drop the Error ** argument, but that would make the interface less
regular, so don't.
Signed-off-by: NMarkus Armbruster <armbru@redhat.com>
Reviewed-by: NEric Blake <eblake@redhat.com>