After disabling the QemuClock, we should make sure that no QemuTimers
are still in flight. To implement that with light overhead, we resort
to QemuEvent. The caller of disabling will wait on QemuEvent of each
timerlist.

Note, qemu_clock_enable(foo,false) can _not_ be called from timer's cb.
Also, the callers of qemu_clock_enable() should be protected by the BQL.
Signed-off-by: NLiu Ping Fan <pingfank@linux.vnet.ibm.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

This emulates Win32 manual-reset events using futexes or conditional
variables.  Typical ways to use them are with multi-producer,
single-consumer data structures, to test for a complex condition whose
elements come from different threads:

    for (;;) {
        qemu_event_reset(ev);
        ... test complex condition ...
        if (condition is true) {
            break;
        }
        qemu_event_wait(ev);
    }

Or more efficiently (but with some duplication):

    ... evaluate condition ...
    while (!condition) {
        qemu_event_reset(ev);
        ... evaluate condition ...
        if (!condition) {
            qemu_event_wait(ev);
            ... evaluate condition ...
        }
    }

QemuEvent provides a very fast userspace path in the common case when
no other thread is waiting, or the event is not changing state.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

QEMU_CLOCK_VIRTUAL may be read outside BQL. This will make its
foundation, i.e. cpu_clock_offset exposed to race condition.
Using private lock to protect it.

After this patch, reading QEMU_CLOCK_VIRTUAL is thread safe
unless use_icount is true, in which case the existing callers
still rely on the BQL.

Lock rule: private lock innermost, ie BQL->"this lock"
Signed-off-by: NLiu Ping Fan <pingfank@linux.vnet.ibm.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

Seqlock implementation for QEMU. Usage idiom

reader:
    do {
        start = seqlock_read_begin(&sl);
        ...
    } while (seqlock_read_retry(&sl, start));

writer:
    seqlock_write_lock(&sl);
    ...
    seqlock_write_unlock(&sl);

initialization:
    seqlock_init(QemuSeqLock *sl, QemuMutex *mutex)

    mutex could be NULL if the caller will provide its own protection
    for concurrent write sides (typically using the BQL).
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

This allows to remove the explicit qemu_flush_coalesced_mmio_buffer
calls.
Signed-off-by: NJan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

This allows to remove the explicit qemu_flush_coalesced_mmio_buffer
calls - the memory core will invoke them now.
Signed-off-by: NJan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

This will enable us to remove all remaining explicit calls of
qemu_flush_coalesced_mmio_buffer in IO handlers.
Signed-off-by: NJan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

qemu_thread_create already does signal blocking and detaching for us.
Signed-off-by: NJan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

mtree_print_mr() calls int128_get64() in 3 places but only 2 places
handle 2^64 correctly.

This fixes the third call of int128_get64().

Cc: qemu-stable@nongnu.org
Signed-off-by: NAlexey Kardashevskiy <aik@ozlabs.ru>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

# By Richard Henderson
# Via Richard Henderson
* rth/tcg-ldst-6:
  target-alpha: Convert to new ldst opcodes
  tcg-ppc64: Support new ldst opcodes
  tcg-ppc: Support new ldst opcodes
  tcg-ppc64: Convert to le/be ldst helpers
  tcg-ppc: Convert to le/be ldst helpers
  tcg-ppc64: Use TCGMemOp within qemu_ldst routines
  tcg-ppc: Use TCGMemOp within qemu_ldst routines
  tcg-arm: Improve GUEST_BASE qemu_ld/st
  tcg-arm: Convert to new ldst opcodes
  tcg-arm: Tidy variable naming convention in qemu_ld/st
  tcg-arm: Convert to le/be ldst helpers
  tcg-arm: Use TCGMemOp within qemu_ldst routines
  tcg-i386: Support new ldst opcodes
  tcg-i386: Remove "cb" output restriction from qemu_st8 for i386
  tcg-i386: Tidy softmmu routines
  tcg-i386: Use TCGMemOp within qemu_ldst routines
  tcg: Use TCGMemOp for TCGLabelQemuLdst.opc

Message-id: 1381620683-4568-1-git-send-email-rth@twiddle.net
Signed-off-by: NAnthony Liguori <aliguori@amazon.com>

# By Sebastian Macke
# Via Jia Liu
* jliu/or32:
  target-openrisc: Removes a non-conforming behavior for the first page of the memory
  target-openrisc: Correct handling of page faults.

Message-id: 1380789702-18935-1-git-send-email-proljc@gmail.com
Signed-off-by: NAnthony Liguori <aliguori@amazon.com>

vfio-pci updates include:
 - Forgotten MSI affinity patch posted several months ago
 - Lazy option ROM loading to delay load until after device/bus resets
 - Error reporting cleanups
 - PCI hot reset support introduced with Linux v3.12 development kernels
 - Debug build fix for int128

The lazy ROM loading and hot reset should help VGA assignment as we can
now do a bus reset when there are multiple devices on the bus, ex.
multi-function graphics and audio cards.

# gpg: Signature made Thu 10 Oct 2013 11:26:39 AM PDT using RSA key ID 3BB08B22
# gpg: Can't check signature: public key not found

# By Alex Williamson (7) and Alexey Kardashevskiy (1)
# Via Alex Williamson
* awilliam/tags/vfio-pci-for-qemu-20131010.0:
  vfio-pci: Fix endian issues in vfio_pci_size_rom()
  vfio-pci: Add dummy PCI ROM write accessor
  vfio: Fix debug output for int128 values
  vfio-pci: Implement PCI hot reset
  vfio-pci: Cleanup error_reports
  vfio-pci: Lazy PCI option ROM loading
  vfio-pci: Test device reset capabilities
  vfio-pci: Add support for MSI affinity

Message-id: 20131010184122.31667.28382.stgit@bling.home
Signed-off-by: NAnthony Liguori <aliguori@amazon.com>

phys_mem_alloc and its assigned values qemu_anon_ram_alloc and
legacy_s390_alloc must have identical argument lists.

legacy_s390_alloc uses the size parameter to call mmap, so size_t is
good enough for all of them.

This patch fixes compiler errors on i686 Linux hosts:

  CC    alpha-softmmu/exec.o
exec.c:752:51: error:
 initialization from incompatible pointer type [-Werror]
exec.c: In function 'qemu_ram_alloc_from_ptr':
exec.c:1139:32: error:
 comparison of distinct pointer types lacks a cast [-Werror]
exec.c: In function 'qemu_ram_remap':
exec.c:1283:21: error:
 comparison of distinct pointer types lacks a cast [-Werror]
Signed-off-by: NStefan Weil <sw@weilnetz.de>
Reviewed-by: NMarkus Armbruster <armbru@redhat.com>
Message-id: 1380481005-32399-1-git-send-email-sw@weilnetz.de
Signed-off-by: NAnthony Liguori <aliguori@amazon.com>

Or, partially.  The fundamental primitives for the port are gen_load_mem
and gen_store_mem, which take a callback to emit the memory operation.
For that, we continue to use the original inline functions that forward
to the new ops, rather than replicate the same thing privately.

That said, all free-standing calls to tcg_gen_qemu_* have been converted.
The 32-bit floating-point references now use _i32 opcodes, eliminating
a truncate or extension.
Signed-off-by: NRichard Henderson <rth@twiddle.net>

Signed-off-by: NRichard Henderson <rth@twiddle.net>

Signed-off-by: NRichard Henderson <rth@twiddle.net>

Signed-off-by: NRichard Henderson <rth@twiddle.net>

Signed-off-by: NRichard Henderson <rth@twiddle.net>

Signed-off-by: NRichard Henderson <rth@twiddle.net>

Signed-off-by: NRichard Henderson <rth@twiddle.net>

If we pull the code to emit the actual load/store into a subroutine,
we can share the reg+reg addressing mode code between softmmu and
usermode.  This lets us load GUEST_BASE into a temporary register
rather than attempting to add it piece-wise to the address.

Which lets us use movw+movt for armv7, rather than (up to) 4 adds.
Code size for pre-armv7 stays the same.
Signed-off-by: NRichard Henderson <rth@twiddle.net>

Signed-off-by: NRichard Henderson <rth@twiddle.net>

s/addr_reg2/addrhi/
s/addr_reg/addrlo/
s/data_reg2/datahi/
s/data_reg/datalo/
Signed-off-by: NRichard Henderson <rth@twiddle.net>

Signed-off-by: NRichard Henderson <rth@twiddle.net>

Signed-off-by: NRichard Henderson <rth@twiddle.net>

No support for helpers with non-default endianness yet,
but good enough to test the opcodes.
Signed-off-by: NRichard Henderson <rth@twiddle.net>

Once we form a combined qemu_st_i32 opcode, we won't be able to
have separate constraints based on size.  This one is fairly easy
to work around, since eax is available as a scratch register.

When storing variable data, this tends to merely exchange one mov
for another.  E.g.

-:  mov    %esi,%ecx
...
-:  mov    %cl,(%edx)
+:  mov    %esi,%eax
+:  mov    %al,(%edx)

Where we do have a regression is when storing constant data, in which
we may load the constant into edi, when only ecx/ebx ought to be used.

The proper way to recover this regression is to allow constants as
arguments to qemu_st_i32, so that we never load the constant data into
a register at all, must less the wrong register.  TBD.
Signed-off-by: NRichard Henderson <rth@twiddle.net>

Pass two TCGReg to tcg_out_tlb_load, rather than idx+args.

Move ldst_optimization routines just below tcg_out_tlb_load to avoid
the need for forward declarations.

Use TCGReg enum in preference to int where apprpriate.
Signed-off-by: NRichard Henderson <rth@twiddle.net>

Step one in the transition, with constants passed down from tcg_out_op.
Signed-off-by: NRichard Henderson <rth@twiddle.net>

Signed-off-by: NRichard Henderson <rth@twiddle.net>

# By Mark Wu (2) and Tomoki Sekiyama (1)
# Via Michael Roth
* mdroth/qga-pull-2013-10-10:
  qemu-ga: Extend 'guest-info' command to expose flag 'success-response'
  qemu-ga: Add interface to traverse the qmp command list by QmpCommand
  qemu-ga: execute fsfreeze-freeze in reverse order of mounts

Message-id: 1381435782-25524-1-git-send-email-mdroth@linux.vnet.ibm.com
Signed-off-by: NAnthony Liguori <aliguori@amazon.com>

# By Richard Henderson
# Via Richard Henderson
* rth/tcg-pull:
  exec: Add both big- and little-endian memory helpers
  tcg: Add qemu_ld_st_i32/64
  tcg: Add TCGMemOp
  configure: Remove CONFIG_QEMU_LDST_OPTIMIZATION
  tcg: Add tcg-be-ldst.h
  tcg: Add tcg-be-null.h
  exec: Delete is_tcg_gen_code and GETRA_EXT
  tcg-aarch64: Update to helper_ret_*_mmu routines
  tcg: Merge tcg_register_helper into tcg_context_init
  tcg: Add tcg-runtime.c helpers to all_helpers
  tcg: Put target helper data into an array.
  tcg: Remove stray semi-colons from target-*/helper.h
  tcg: Move helper registration into tcg_context_init
  target-m68k: Rename helpers.h to helper.h
  tcg: Use a GHashTable for tcg_find_helper
  tcg: Delete tcg_helper_get_name declaration
  tcg-hppa: Remove tcg backend

Message-id: 1381440525-6666-1-git-send-email-rth@twiddle.net
Signed-off-by: NAnthony Liguori <aliguori@amazon.com>

Output is a long, unsorted list.  Not very helpful.  Print one list
per device category instead, with a header line identifying the
category, plus a list of uncategorized devices.  Print each list in
case-insenitive alphabetical order.

Devices with multiple categories are listed multiple times.
Signed-off-by: NMarkus Armbruster <armbru@redhat.com>
Reviewed-by: NMarcel Apfelbaum <marcel.a@redhat.com>
Message-id: 1381410021-1538-3-git-send-email-armbru@redhat.com
Signed-off-by: NAnthony Liguori <aliguori@amazon.com>

This reverts most of commit 3d1237fb.

The commit claims to sort the output of "-device help" "by
functionality rather than alphabetical".  Issues:

* The output was unsorted before, not alphabetically sorted.
  Misleading, but harmless enough.

* The commit doesn't just sort the output of "-device help" as it
  claims, it adds categories to each line of "-device help", and it
  prints devices once per category.  In particular, devices without a
  category aren't shown anymore.  Maybe such devices should not exist,
  but they do.  Regression.

* Categories are also added to the output of "info qdm".  Silent
  change, not nice.  Output remains unsorted, unlike "-device help".

I'm going to reimplement the feature we actually want, without the
warts.  Reverting the flawed commit first should make it easier to
review.  However, I can't revert it completely, since DeviceClass
member categories has been put to use.  So leave that part in.
Signed-off-by: NMarkus Armbruster <armbru@redhat.com>
Reviewed-by: NMarcel Apfelbaum <marcel.a@redhat.com>
Message-id: 1381410021-1538-2-git-send-email-armbru@redhat.com
Signed-off-by: NAnthony Liguori <aliguori@amazon.com>

qemu.org is held by a third-party and no core community contributor has
access to the DNS configuration.  This leaves the website exposed to
outages due to DNS issues or IP address changes.  For example, if the
web server IP address needs to change we cannot guarantee qemu.org will
point to it!

The newer qemu-project.org domain name is owned by Anthony Liguori
<anthony@codemonkey.ws>.  You can confirm this by querying the whois
information.  Also note that the #qemu IRC channel topic already
references qemu-project.org.

Short of having a dedicated legal entity to hold the domain name on
behalf of the community, qemu-project.org seems like the safest bet.

Let's replace references to qemu.org with qemu-project.org.

Note that git-submodule(1) does not detect URL changes.  The following
commands clear out and re-initialize all submodules to ensure you are
using the latest URLs:

  $ git submodule deinit . # you'll be warned if you have local changes
  $ rm -rf .git/modules    # also clear cached .git/ directories
  $ git submodule update --init
Reviewed-by: NMarkus Armbruster <armbru@redhat.com>
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>
Message-id: 1381495958-8306-1-git-send-email-stefanha@redhat.com
Signed-off-by: NAnthony Liguori <aliguori@amazon.com>

# By Max Reitz (30) and others
# Via Kevin Wolf
* kwolf/for-anthony: (61 commits)
  qemu-iotests: Add test for inactive L2 overlap
  qemu-io: Let "open" pass options to block driver
  vmdk: Fix vmdk_parse_extents
  blockdev: blockdev_init() error conversion
  blockdev: Don't disable COR automatically with blockdev-add
  blockdev: Remove 'media' parameter from blockdev_init()
  qemu-iotests: Check autodel behaviour for device_del
  blockdev: Remove IF_* check for read-only blockdev_init
  blockdev: Move virtio-blk device creation to drive_init
  blockdev: Move bus/unit/index processing to drive_init
  blockdev: Move parsing of 'boot' option to drive_init
  blockdev: Moving parsing of geometry options to drive_init
  blockdev: Move parsing of 'if' option to drive_init
  blockdev: Move parsing of 'media' option to drive_init
  blockdev: Pass QDict to blockdev_init()
  blockdev: Separate ID generation from DriveInfo creation
  blockdev: 'blockdev-add' QMP command
  blockdev: Introduce DriveInfo.enable_auto_del
  qapi-types/visit.py: Inheritance for structs
  qapi-types/visit.py: Pass whole expr dict for structs
  ...

Message-id: 1381503951-27985-1-git-send-email-kwolf@redhat.com
Signed-off-by: NAnthony Liguori <aliguori@amazon.com>

Extend 060 by a test which creates a corrupted image with an active L2
entry pointing to an inactive L2 table and writes to the corresponding
guest offset.

Also, use overlap-check=all for all tests in 060.
Signed-off-by: NMax Reitz <mreitz@redhat.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

Add an option to the open command to specify runtime options for the
block driver used.
Signed-off-by: NMax Reitz <mreitz@redhat.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

An extra 'p++' after while loop when *p == '\n' will move p to unknown
data position, risking parsing junk data or memory access violation.

Cc: qemu-stable@nongnu.org
Signed-off-by: NFam Zheng <famz@redhat.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

This gives us meaningful error messages for the blockdev-add QMP
command.
Signed-off-by: NKevin Wolf <kwolf@redhat.com>
Reviewed-by: NMax Reitz <mreitz@redhat.com>
Reviewed-by: NEric Blake <eblake@redhat.com>