Add "secure" Vexpress machine specific property to allow override of the
default secure state configuration.  By default, when using the QEMU
-kernel command line argument, Vexpress machines boot into NS/SVC.  When using
the QEMU -bios command line argument, Vexpress machines boot into S/SVC.

The secure state can be changed from the default specifying the secure
state as a machine property.  For example, the below command line would disable
security extensions on a -kernel Linux boot:

    aarch64-softmmu/qemu-system-aarch64
        -machine type=vexpress-a15,secure=off
        -kernel ...
Signed-off-by: NGreg Bellows <greg.bellows@linaro.org>
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Message-id: 1418684992-8996-5-git-send-email-greg.bellows@linaro.org
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Switched the Vexpress machine initialization to use the common function with
the machine pointer to board info.
Signed-off-by: NGreg Bellows <greg.bellows@linaro.org>
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Message-id: 1418684992-8996-4-git-send-email-greg.bellows@linaro.org
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Add Vexpress machine objects for the the Cortex A9 & A15 variants.  The older
style QEMUMachine types were replaced with dedicated TypeInfo objects. The new
objects include dedicated class init functions that currently ustilze dedicated
machine init methods.  The previous qemu_register_machine calls were replaced
with the newer type_register_status calls.
Signed-off-by: NGreg Bellows <greg.bellows@linaro.org>
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Message-id: 1418684992-8996-3-git-send-email-greg.bellows@linaro.org
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Adds base Vexpress class and machine objects and infrastructure.  This is in
preparation for switching to the full QEMU object model.  The base vexpress
infrastructure is intended to handle common vexpress details.
Signed-off-by: NGreg Bellows <greg.bellows@linaro.org>
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Message-id: 1418684992-8996-2-git-send-email-greg.bellows@linaro.org
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

The help is based on the actual machine properties
exposing only the relevant options.
Signed-off-by: NMarcel Apfelbaum <marcel.a@redhat.com>
Reviewed-by: NAlexander Graf <agraf@suse.de>
Reviewed-by: NGreg Bellows <greg.bellows@linaro.org>
Message-id: 1418217570-15517-4-git-send-email-marcel.a@redhat.com
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Refactored the code to re-use object_property_parse.
Signed-off-by: NMarcel Apfelbaum <marcel.a@redhat.com>
Reviewed-by: NAlexander Graf <agraf@suse.de>
Reviewed-by: NGreg Bellows <greg.bellows@linaro.org>
Message-id: 1418217570-15517-3-git-send-email-marcel.a@redhat.com
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

QEMU has support for options per machine, keeping
a global list of options is no longer necessary.
Signed-off-by: NMarcel Apfelbaum <marcel.a@redhat.com>
Reviewed-by: NAlexander Graf <agraf@suse.de>
Reviewed-by: NGreg Bellows <greg.bellows@linaro.org>
Message-id: 1418217570-15517-2-git-send-email-marcel.a@redhat.com
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Merge of the v8_el2_cp_reginfo and el3_cp_reginfo ARMCPRegInfo lists.
Previously, some EL3 registers were restricted to the ARMv8 list under the
impression that they were not needed on ARMv7.  However, this is not the case
as the ARMv7/32-bit variants rely on the ARMv8/64-bit variants to handle
migration and reset.  For this reason they must always exist.
Signed-off-by: NGreg Bellows <greg.bellows@linaro.org>
Message-id: 1418406450-14961-1-git-send-email-greg.bellows@linaro.org
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

When stopping an audio voice, call the audio backend's fini
method before calling audio_pcm_hw_free_resources_ rather than
afterwards. This allows backends which use helper threads (like
pulseaudio) to terminate those threads before the conv_buf or
mix_buf are freed and avoids race conditions where the helper
may access a NULL pointer or freed memory.

Cc: qemu-stable@nongnu.org
Reviewed-by: NGerd Hoffmann <kraxel@redhat.com>
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Message-id: 1418406239-9838-1-git-send-email-peter.maydell@linaro.org

bootdevice: Refactor and improvement

# gpg: Signature made Mon 22 Dec 2014 06:44:08 GMT using RSA key ID DDE30FBB
# gpg: Can't check signature: public key not found

* remotes/gonglei/tags/bootdevice-next-20141222:
  bootdevice: add Error **errp argument for QEMUBootSetHandler
  bootdevice: add validate check for qemu_boot_set()
  bootdevice: add Error **errp argument for qemu_boot_set()
  bootdevice: add Error **errp argument for validate_bootdevices()
  bootdevice: move code about bootorder from vl.c to bootdevice.c
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

TriCore RR, RR1 insn added and several bug fixes

# gpg: Signature made Sun 21 Dec 2014 18:39:11 GMT using RSA key ID 6B69CA14
# gpg: Good signature from "Bastian Koppelmann <kbastian@mail.uni-paderborn.de>"

* remotes/bkoppelmann/tags/pull-tricore-20141221:
  target-tricore: Add instructions of RR1 opcode format, that have 0xb3 as first opcode
  target-tricore: Fix MFCR/MTCR insn and B format offset.
  target-tricore: Add missing 1.6 insn of BOL opcode format
  target-tricore: Add instructions of RR opcode format, that have 0x4b as the first opcode
  target-tricore: Add instructions of RR opcode format, that have 0x1 as the first opcode
  target-tricore: Add instructions of RR opcode format, that have 0xf as the first opcode
  target-tricore: Add instructions of RR opcode format, that have 0xb as the first opcode
  target-tricore: Change SSOV/SUOV makro name to SSOV32/SUOV32
  target-tricore: Fix mask handling JNZ.T being 7 bit long
  target-tricore: pretty-print register dump and show more status registers
  target-tricore: add missing 64-bit MOV in RLC format
  target-tricore: typo in BOL format
  target-tricore: fix offset masking in BOL format
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

It will be useful for checking when we change traditional
boot order dynamically and propagate error message
to the monitor.
For x86 architecture, we pass &local_err to set_boot_dev()
when vm startup in pc_coms_init().

Cc: Michael S. Tsirkin <mst@redhat.com>
Cc: Alexander Graf <agraf@suse.de>
Cc: Blue Swirl <blauwirbel@gmail.com>
Cc: qemu-ppc@nongnu.org
Signed-off-by: NGonglei <arei.gonglei@huawei.com>
Reviewed-by: NMarkus Armbruster <armbru@redhat.com>

Signed-off-by: NGonglei <arei.gonglei@huawei.com>
Reviewed-by: NMarkus Armbruster <armbru@redhat.com>

It will be useful for checking when we change traditional
boot order dynamically and propagate error message
to the monitor.
Signed-off-by: NGonglei <arei.gonglei@huawei.com>
Reviewed-by: NMarkus Armbruster <armbru@redhat.com>

It will be useful for checking when we change traditional
boot order dynamically and propagate error message
to the monitor.
Signed-off-by: NGonglei <arei.gonglei@huawei.com>
Reviewed-by: NMarkus Armbruster <armbru@redhat.com>

First, we can downsize vl.c, make it simpler by
little and little. Second, I can maintain those code
and make some improvement.

Cc: Jan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: NGonglei <arei.gonglei@huawei.com>
Reviewed-by: NMarkus Armbruster <armbru@redhat.com>

sdl2: fixes, cleanups and opengl preparation.

# gpg: Signature made Fri 19 Dec 2014 09:06:07 GMT using RSA key ID D3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
# gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
# gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

* remotes/kraxel/tags/pull-sdl-20141219-1:
  sdl2: Work around SDL2 SDL_ShowWindow() bug
  sdl2: Use correct sdl2_console for window events
  sdl2: move sdl2_2d_refresh to sdl2-2d.c
  sdl2: factor out sdl2_poll_events
  sdl2: add+use sdl2_2d_redraw function.
  sdl2: move sdl_switch to sdl2-2d.c
  sdl2: overhaul window size handling
  sdl2: move sdl_update to new sdl2-2d.c
  sdl2: turn on keyboard grabs
  sdl2: move keyboard input code to new sdl2-input.c
  sdl2: rename sdl2_state to sdl2_console, move to header file
  sdl: move version logic from source code to makefile
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Add instructions of RR1 opcode format, that have 0xb3 as first opcode.
Add helper functions mulh, mulmh and mulrh, that compute multiplication,
with multiprecision (mulmh) or rounding (mulrh) of 4 halfwords, being either low or high parts
of two 32 bit regs.
Signed-off-by: NBastian Koppelmann <kbastian@mail.uni-paderborn.de>
Reviewed-by: NRichard Henderson <rth@twiddle.net>

Fix gen_mtcr using wrong register.
Fix gen_mtcr/mfcr using sign extended offsets.
Fix B format insn using not sign extendend offsets.
Signed-off-by: NBastian Koppelmann <kbastian@mail.uni-paderborn.de>
Reviewed-by: NRichard Henderson <rth@twiddle.net>

Some of the 1.6 ISA instructions were still missing. So let's add them.
Signed-off-by: NBastian Koppelmann <kbastian@mail.uni-paderborn.de>
Reviewed-by: NRichard Henderson <rth@twiddle.net>

Add instructions of RR opcode format, that have 0x4b as the first opcode.
Add helper functions:
    * parity: Calculates the parity bits for every byte of a 32 int.
    * bmerge/bsplit: Merges two regs into one bitwise/Splits one reg into two bitwise.
    * unpack: unpack a IEEE 754 single precision floating point number as exponent and mantissa.
    * dvinit_b_13/131: (ISA v1.3/v1.31)Prepare operands for a divide operation,
                       where the quotient result is guaranteed to fit into 8 bit.
    * dvinit_h_13/131: (ISA v1.3/v1.31)Prepare operands for a divide operation,
                       where the quotient result is guaranteed to fit into 16 bit.
OPCM_32_RR_FLOAT -> OPCM_32_RR_DIVIDE.
Signed-off-by: NBastian Koppelmann <kbastian@mail.uni-paderborn.de>
Reviewed-by: NRichard Henderson <rth@twiddle.net>

Add instructions of RR opcode format, that have 0x1 as the first opcode.
Signed-off-by: NBastian Koppelmann <kbastian@mail.uni-paderborn.de>
Reviewed-by: NRichard Henderson <rth@twiddle.net>

Add instructions of RR opcode format, that have 0xf as the first opcode.
Add helper functions:
    * clo/z/s: Counts leading ones/zeros/signs.
    * clo/z/s_h: Count leading ones/zeros/signs in two haflwords.
    * sh/_h: Shifts one/two word/hwords.
    * sha/_h: Shifts one/two word/hwords arithmeticly.
Signed-off-by: NBastian Koppelmann <kbastian@mail.uni-paderborn.de>
Reviewed-by: NRichard Henderson <rth@twiddle.net>

Add instructions of RR opcode format, that have 0xb as the first opcode.
Add helper functions, for hword and byte arithmetics:
    * add_h_ssov/suov: Add two halfword and saturate on overflow.
    * sub_h_ssov/suov: Sub two halfword and saturate on overflow.
    * absdif_h_ssov: Compute absolute difference for halfwords and saturate on overflow.
    * abs_h_ssov/suov: Compute absolute value for two halfwords and saturate on overflow.
    * abs_b/h: Compute absolute value for four/two bytes/halfwords
    * absdif_b/h: Compute absolute difference for four/two bytes/halfwords
    * add_b/h: Add four/two bytes/halfwords.
    * sub_b/h: Sub four/two bytes/halfwords.
    * eq_b/h: Compare four/two bytes/halfwords with four/two bytes/halfwords on
              equality and set all bits of to either one ore zero.
    * eqany_b/h: Compare four/two bytes/halfwords with four/two bytes/halfwords on equality.
    * lt_b/bu/h/hu: Compare four/two bytes/halfwords with four/two bytes/halfwords
                    on less than signed and unsigned.
    * max_b/bu/h/hu: Calculate max for four/two bytes/halfwords signed and unsigned.
    * min_b/bu/h/hu: Calculate min for four/two bytes/halfwords signed and unsigned.
Add helper function abs_ssov, that computes the absolute value for a 32 bit integer and saturates on overflow.
Add microcode generator functions:
    * gen_sub_CC: Caluclates sub and sets the carry bit.
    * gen_subc_CC: Caluclates sub and carry and sets the carry bit
    * gen_abs: Compute absolute value for a 32 bit integer.
    * gen_cond_w: Compares two 32 bit values on cond and sets result either zero or all bits one.

OPC2_32_RR_MIN switched with OPC2_32_RR_MIN_U.
Signed-off-by: NBastian Koppelmann <kbastian@mail.uni-paderborn.de>
Reviewed-by: NRichard Henderson <rth@twiddle.net>

Those makros are exclusively used for 32 bit arithmetics and won't work for
16 bit with two halfwords. So lets get rid of the len parameter and make them
always use 32 bit. Now no token pasting is needed anymore and they can be
regular functions.
Signed-off-by: NBastian Koppelmann <kbastian@mail.uni-paderborn.de>
Reviewed-by: NRichard Henderson <rth@twiddle.net>

The mask is actually 7 bit long, instead of 6, so the expression checking
for JNZ.T is always false. Let's make the mask 1 bit wider.
Signed-off-by: NBastian Koppelmann <kbastian@mail.uni-paderborn.de>

Now using psw_read() to retrieve the status bits correctly.
Signed-off-by: NAlex Zuepke <alexander.zuepke@hs-rm.de>
Reviewed-by: NBastian Koppelmann <kbastian@mail.uni-paderborn.de>
Signed-off-by: NBastian Koppelmann <kbastian@mail.uni-paderborn.de>

Signed-off-by: NAlex Zuepke <alexander.zuepke@hs-rm.de>
Reviewed-by: NBastian Koppelmann <kbastian@mail.uni-paderborn.de>
Signed-off-by: NBastian Koppelmann <kbastian@mail.uni-paderborn.de>

Signed-off-by: NAlex Zuepke <alexander.zuepke@hs-rm.de>
Reviewed-by: NBastian Koppelmann <kbastian@mail.uni-paderborn.de>
Signed-off-by: NBastian Koppelmann <kbastian@mail.uni-paderborn.de>

Signed-off-by: NAlex Zuepke <alexander.zuepke@hs-rm.de>
Reviewed-by: NBastian Koppelmann <kbastian@mail.uni-paderborn.de>
Signed-off-by: NBastian Koppelmann <kbastian@mail.uni-paderborn.de>

# gpg: Signature made Fri 19 Dec 2014 13:18:18 GMT using RSA key ID 81AB73C8
# gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>"
# gpg:                 aka "Stefan Hajnoczi <stefanha@gmail.com>"

* remotes/stefanha/tags/net-pull-request:
  e1000: defer packets until BM enabled
  net: Use g_new() & friends where that makes obvious sense
  net: Fuse g_malloc(); memset() into g_new0()
  net: don't use set/get_pointer() in set/get_netdev()
  tap: fix vcpu long time io blocking on tap
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

update ipxe from 69313ed to 35c5379

# gpg: Signature made Wed 17 Dec 2014 14:45:04 GMT using RSA key ID D3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
# gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
# gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

* remotes/kraxel/tags/pull-roms-20141217-1:
  update ipxe from 69313ed to 35c5379
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

In QEMU 2.2 the exception_index value was added to the migration stream
through a subsection.  The default was set to 0, which is wrong and
should have been -1.

However, 2.2 does not have commit e511b4d7 (cpu-exec: reset exception_index
correctly, 2014-11-26), hence in 2.2 the exception_index is never used
and is set to -1 on the next call to cpu_exec.  So we can change the
migration stream to make the default -1.  The effects are:

- 2.2.1 -> 2.2.0: cpu->exception_index set incorrectly to 0 if it
were -1 on the source; then reset to -1 in cpu_exec.  This is TCG
only; KVM does not use exception_index.

- 2.2.0 -> 2.2.1: cpu->exception_index set incorrectly to -1 if it
were 0 on the source; but it would be reset to -1 in cpu_exec anyway.
This is TCG only; KVM does not use exception_index.

- 2.2.1 -> 2.1: two bugs fixed: 1) can migrate backwards if
cpu->exception_index is set to -1; 2) should not migrate backwards
(but 2.2.0 allows it) if cpu->exception_index is set to 0

- 2.2.0 -> 2.3.0: 2.2.0 will send the subsection unnecessarily if
exception_index is -1, but that is not a problem.  2.3.0 will set
cpu->exception_index to -1 if it is 0 on the source, but this would
be anyway a problem for 2.2.0 -> 2.2.x migration (due to lack of
commit e511b4d7 in 2.2.x) so we can ignore it

- 2.2.1 -> 2.3.0: everything works.

In addition, play it safe and never send the subsection unless TCG
is in use.  KVM does not use exception_index (PPC KVM stores values
in it for use in the subsequent call to ppc_cpu_do_interrupt, but
does not need it as soon as kvm_handle_debug returns).  Xen and
qtest do not run any code for the CPU at all.
Reported-by: NIgor Mammedov <imammedo@redhat.com>
Tested-by: NLaurent Desnogues <laurent.desnogues@gmail.com>
Tested-by: NEduardo Habkost <ehabkost@redhat.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Message-id: 1418989994-17244-3-git-send-email-pbonzini@redhat.com
Cc: qemu-stable@nongnu.org
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

This unbreaks linux-user (broken by e511b4d7, cpu-exec: reset exception_index
correctly, 2014-11-26).
Reported-by: NEduardo Habkost <ehabkost@redhat.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Tested-by: NLaurent Desnogues <laurent.desnogues@gmail.com>
Tested-by: NEduardo Habkost <ehabkost@redhat.com>
Message-id: 1418989994-17244-2-git-send-email-pbonzini@redhat.com
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Some guests seem to set BM for e1000 after
enabling RX.
If packets arrive in the window, device is wedged.
Probably works by luck on real hardware, work around
this by making can_receive depend on BM.
Tested-by: NGabriel Somlo <somlo@cmu.edu>
Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>
Reviewed-by: NJason Wang <jasowang@redhat.com>
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>

g_new(T, n) is neater than g_malloc(sizeof(T) * n).  It's also safer,
for two reasons.  One, it catches multiplication overflowing size_t.
Two, it returns T * rather than void *, which lets the compiler catch
more type errors.

This commit only touches allocations with size arguments of the form
sizeof(T).
Signed-off-by: NMarkus Armbruster <armbru@redhat.com>
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>

Signed-off-by: NMarkus Armbruster <armbru@redhat.com>
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>

Commit 1ceef9f2 (net: multiqueue
support) tries to use set_pointer() and get_pointer() to set and get
NICPeers which is not a pointer defined in DEFINE_PROP_NETDEV. This
trick works but result a unclean and fragile implementation (e.g
print_netdev and parse_netdev).

This patch solves this issue by not using set/get_pinter() and set and
get netdev directly in set_netdev() and get_netdev(). After this the
parse_netdev() and print_netdev() were no longer used and dropped from
the source.

[Renamed 'err' label to 'out' as suggested by Markus Armbruster.
--Stefan]

Cc: Markus Armbruster <armbru@redhat.com>
Cc: Stefan Hajnoczi <stefanha@redhat.com>
Cc: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: NJason Wang <jasowang@redhat.com>
Reviewed-by: NMarkus Armbruster <armbru@redhat.com>
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>

[Adjusted doc comment for grammar.
--Stefan]
Signed-off-by: NWangkai <wangkai86@huawei.com>
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>

cirrus hwcursor fixes.
set secondary-vga category.

# gpg: Signature made Tue 16 Dec 2014 14:44:09 GMT using RSA key ID D3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
# gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
# gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

* remotes/kraxel/tags/pull-vga-20141216-1:
  vga: set catagory bit for secondary vga device
  move hw cursor pos from cirrus to vga
  cirrus: Force use of shadow pixmap when HW cursor is enabled
  vga: Add mechanism to force the use of a shadow surface
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>