Cast debugging can have a substantial cost (20% or more).  Instead of adding
special-cased "fast casts" in the hot paths, we can just disable it in
releases.  The tracing facilities we just added make it easier to analyze
those problems that cast debugging would reveal.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Message-id: 1368188203-3407-7-git-send-email-pbonzini@redhat.com
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

This provides a way to detect the cast that leads to a (reproducible)
crash even when QOM cast debugging is disabled.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Message-id: 1368188203-3407-6-git-send-email-pbonzini@redhat.com
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Message-id: 1368188203-3407-5-git-send-email-pbonzini@redhat.com
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

For leaf classes, in many cases the callbacks will simply downcast
the object back to the original class.  Add this fast path to
object_class_dynamic_cast, object_dynamic_cast will inherit it.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Message-id: 1368188203-3407-4-git-send-email-pbonzini@redhat.com
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

This mimics what we do in object_dynamic_cast_assert.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Message-id: 1368188203-3407-3-git-send-email-pbonzini@redhat.com
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Message-id: 1368188203-3407-2-git-send-email-pbonzini@redhat.com
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

# By Dong Xu Wang (2) and others
# Via Michael Tokarev
* mjt/trivial-patches-next:
  osdep.h: include sys/types.h for ssize_t definition
  remove double semicolons
  clean unnecessary code: don't check g_strdup arg for NULL
  docs: mention AddressSpaces in docs/memory.txt
  audio: update documentation after removing --audio-card-list option
  m25p80.c: Sync Flash chip list with Linux
  bsd-user: OS-agnostic 64-bit SYSCTL types

Message-id: 518F61B9.9050803@msgid.tls.msk.ru
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

# By Hans de Goede
# Via Gerd Hoffmann
* spice/spice.v70:
  qxl: Call spice_qxl_driver_unload from qxl_enter_vga_mode

Message-id: 1368093776-8949-1-git-send-email-kraxel@redhat.com
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

sys/types.h is taken out from "ifdef __OpenBSD__" guard. It should be
safe for other systems, according to following survey:
http://hacks.owlfolio.org/header-survey/

This fixes build for CONFIG_IOVEC-less systems (mingw).
Signed-off-by: NIgor Mitsyanko <i.mitsyanko@gmail.com>
Signed-off-by: NMichael Tokarev <mjt@tls.msk.ru>

Signed-off-by: NDong Xu Wang <wdongxu@linux.vnet.ibm.com>
Signed-off-by: NMichael Tokarev <mjt@tls.msk.ru>

Signed-off-by: NDong Xu Wang <wdongxu@linux.vnet.ibm.com>
Signed-off-by: NMichael Tokarev <mjt@tls.msk.ru>

Reported-by: NDavid Gibson <david@gibson.dropbear.id.au>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NMichael Tokarev <mjt@tls.msk.ru>

Commit 98af93fd removed the
--audio-card-list option in configure, and commit
8f3b664f always compiled in
the adlib, gus and cs4231a audio cards.
Signed-off-by: NHervé Poussineau <hpoussin@reactos.org>
Signed-off-by: NMichael Tokarev <mjt@tls.msk.ru>

Add new devices for various manufacturers, and re-sort Spansion list to
match the order in Linux, which requires chips with a non-zero extended ID
to come first.

With this commit the outstanding differences to Linux rev 55bf75b are:

- Erase size flag differences in s25sl032p, s25sl064p, s25fl016k, s25fl064k
  (These devices have only some blocks that support small erase sizes.)
- Linux lacks n25q128
- Devices without a Jedec ID have been excluded
Signed-off-by: NEd Maste <emaste@freebsd.org>
Signed-off-by: NMichael Tokarev <mjt@tls.msk.ru>

Use existence of type as #ifdef condition rather than FreeBSD-specific
version check, as suggested by Patrick Welche.

Also handle the signed (CTLTYPE_S64) case identically to the unsigned
(CTLTYPE_U64) case, per later patches in the FreeBSD ports tree
(emulators/qemu-devel/files/patch-z-arm-bsd-user-001).
Signed-off-by: NEd Maste <emaste@freebsd.org>
Signed-off-by: NMichael Tokarev <mjt@tls.msk.ru>

Fix EFLAGS corruption by ROR r8/r16 imm instruction located at the end
of the TB, similarly to commit 089305ac for the non-immediate case.
Reported-by: NHervé Poussineau <hpoussin@reactos.org>
Reviewed-by: NRichard Henderson <rth@twiddle.net>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

When setcond2 is rewritten into setcond, the state of the destination
temp should be reset, so that a copy of the previous value is not
used instead of the result.
Reported-by: NMichael Tokarev <mjt@tls.msk.ru>
Reviewed-by: NRichard Henderson <rth@twiddle.net>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

With a SPICE_DISPLAY_CAP_MONITORS_CONFIG capable client, the client needs to
know what part of the primary to use for each monitor. If the guest driver
does not support this, the server sends messages to the client for a
single monitor spanning the entire primary.

As soon as the guest calls spice_qxl_monitors_config_async once, the server
sets the red_worker driver_has_monitors_config flag and stops doing this.

This is a problem when the driver gets unloaded, for example after a reboot
or when switching to a text vc with usermode mode-setting under Linux.

To reproduce this start a multi-mon capable Linux guest which uses
usermode mode-setting and then once X has started switch to a text vc. Note
how the client window does not only not resize, if you try to resize it
manually you always keep blackborders since the aspect is wrong.

This patch calls a new spice-server method called spice_qxl_driver_unload
which clears the driver_has_monitors_config flag inside the server, thereby
fixing this.
Signed-off-by: NHans de Goede <hdegoede@redhat.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

# By Kevin Wolf (7) and Fam Zheng (3)
# Via Kevin Wolf
* kwolf/for-anthony:
  qemu-iotests: fix 017 018 for vmdk
  qemu-iotests: exclude vmdk and qcow from 043
  qemu-iotests: exclude vmdk for test 042
  qtest/ide-test: Test short and long PRDTs
  qtest/ide-test: Add simple DMA read/write test case
  qtest: Add IDE test case
  libqos/pci: Enable bus mastering
  ide: Reset BMIDEA bit when the bus master is stopped
  de_DE.po: Add missing leading spaces
  ahci: Don't allow creating slave drives

Message-id: 1368023344-29731-1-git-send-email-kwolf@redhat.com
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

There are several several issues in the current checking:

- The check was based on the minus of unsigned values which can overflow
- It was done after .{set|get}_config() which can lead crash when config_len
  is zero since vdev->config is NULL

Fix this by:

- Validate the address in virtio_pci_config_{read|write}() before
  .{set|get}_config
- Use addition instead minus to do the validation

Cc: Michael S. Tsirkin <mst@redhat.com>
Cc: Petr Matousek <pmatouse@redhat.com>
Signed-off-by: NJason Wang <jasowang@redhat.com>
Acked-by: NMichael S. Tsirkin <mst@redhat.com>
Acked-by: NPetr Matousek <pmatouse@redhat.com>
Message-id: 1367905369-10765-1-git-send-email-jasowang@redhat.com
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

mask notifiers are never called without msix,
so devices with backend masking like vhost don't work.
Call mask notifiers explicitly at
startup/cleanup to make it work.
Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>
Tested-by: NAlexander Graf <agraf@suse.de>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

* 'ppc-for-upstream' of git://github.com/agraf/qemu:
  PPC: Depend behavior of cmp instructions only on instruction encoding

The implementation for rldcl tried to always fetch its
parameters from the opcode, even though the opcode was
already passed in in decoded and different forms.

Use the parameters instead, fixing rldcl.
Reported-by: NTorbjorn Granlund <tg@gmplib.org>
Reviewed-by: NAurelien Jarno <aurelien@aurel32.net>
Signed-off-by: NAlexander Graf <agraf@suse.de>

When running an L=1 cmp instruction on a 64bit PPC CPU with SF off, it
still behaves identical to what it does when SF is on. Remove the implicit
difference in the code.

Also, on most 32bit CPUs we should always treat the compare as 32bit
compare, as the CPU will ignore the L bit. This is not true for e500mc,
but that's up for a different patch.
Reported-by: NTorbjorn Granlund <tg@gmplib.org>
Reviewed-by: NRichard Henderson <rth@twiddle.net>
Signed-off-by: NAlexander Graf <agraf@suse.de>

Corner case for INSV instruction when size=32 has not been correctly
implemented. The mask for size should be one bit wider, and preparing the
filter variable should be aware of this case too.

The test for INSV has been extended to include the case that triggers the
bug.
Signed-off-by: NPetar Jovanovic <petar.jovanovic@imgtec.com>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

The emulator needs to check in hflags if DSP unit has been turned off before
it generates code for MUL_PH, MUL_S_PH, MULQ_S_W, and MULQ_RS_W.
Signed-off-by: NPetar Jovanovic <petar.jovanovic@imgtec.com>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

017 and 018 use /bin/mv to move base img from t.IMGFMG to t.IMGFMT.base
after filling data, this is not enough for vmdk, when t.IMGFMT is only a
description text file who points to t-{flat,s001,f001,...}.IMGFMT as
data extent, so testing such subformats alway fails on them.

This patch use the trick of temprorily changing TEST_IMG to avoid using
/bin/mv.
Signed-off-by: NFam Zheng <famz@redhat.com>
Reviewed-by: NJeff Cody <jcody@redhat.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

043 tests recursive backing file by changing backing file. VMDK has not
implemented this yet, and qcow1 probably never will.
Signed-off-by: NFam Zheng <famz@redhat.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

Zero sized disk is not supported by qemu vmdk driver, exclude vmdk from
the test script.

As tested on vmware-vdiskmanager and vmware workstation, zero sized disk
is not supported by vmware, either.
Signed-off-by: NFam Zheng <famz@redhat.com>
Reviewed-by: NJeff Cody <jcody@redhat.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

This tests the behaviour of the DMA engine when the given PRDT contains
physical region descriptors for either more or less bytes than the
IDE request is for.
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

This tests that single sectors can be successfully written and correctly
read back.
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

This adds a simple IDE test case and starts by verifying that IDENTIFY
can be successfully used and return the correct serial number, version
and the WCE flag is set for cache=writeback.
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

Signed-off-by: NKevin Wolf <kwolf@redhat.com>

The device is supposed to reset the Bus Master IDE Active bit in the
status register when 0 is written to the Start/Stop Bus Master bit in
the command register.

In the common cases this happens automatically because bdrv_drain_all()
flushes the requests, but with a large PRDT it could remain set.
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

Signed-off-by: NKevin Wolf <kwolf@redhat.com>

An IDE bus provided by AHCI can only take a single IDE drive. If you add
a drive as slave, qemu used to accept the command line but the device
wouldn't be actually usable. Catch the situation instead and error out.
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

# By Gerd Hoffmann (3) and Hans de Goede (1)
# Via Gerd Hoffmann
* kraxel/usb.82:
  xhci: handle USB_RET_BABBLE
  uhci: Use an intermediate buffer for usb packet data
  usb-host: add usb_host_full_speed_compat
  usb-host: live migration support for the libusb version

Message-id: 1367920207-1404-1-git-send-email-kraxel@redhat.com
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

The qemu guest agent creates a bunch of files with insecure permissions
when started in daemon mode. For example:

  -rw-rw-rw- 1 root root /var/log/qemu-ga.log
  -rw-rw-rw- 1 root root /var/run/qga.state
  -rw-rw-rw- 1 root root /var/log/qga-fsfreeze-hook.log

In addition, at least all files created with the "guest-file-open" QMP
command, and all files created with shell output redirection (or
otherwise) by utilities invoked by the fsfreeze hook script are affected.

For now mask all file mode bits for "group" and "others" in
become_daemon().

Temporarily, for compatibility reasons, stick with the 0666 file-mode in
case of files newly created by the "guest-file-open" QMP call. Do so
without changing the umask temporarily.
Signed-off-by: NLaszlo Ersek <lersek@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>