Commit ac4119c0 (chardev: Use timer instead of bottom-half to postpone
open event, 2012-10-12) moved the alarm timer initialization to an earlier
point but failed to consider that it depends on qemu_init_main_loop.

Later, commit 1c53786f (vl: init main loop earlier, 2012-10-30) fixed
this, but left -daemonize in two different ways.  First, timers need to
be reinitialized after forking.  Second, the global mutex was being held
by the parent, and thus dropped after forking.

The first is now fixed using pthread_atfork.  For the second part,
make sure that the global mutex is not taken before daemonization,
and similarly delay qemu_thread_self.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

init_timer_alarm was being called twice.  This is not needed.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Timers are not inherited by the child of a fork(2), so just use
pthread_atfork to reinstate them after daemonize.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

OpenBSD and Darwin do not have sem_timedwait.  Implement a fallback
for them.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Weakrefs only tell you if the symbol was defined elsewhere, so you
need a further check at runtime to pick the default definition
when needed.

This could be automated by the compiler, but it does not do it.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

* bonzini/migr-coroutine:
  migration: move process_incoming_migration to a coroutine
  migration: handle EAGAIN while reading QEMUFile
  migration: move qemu_fclose to process_incoming_migration
  migration: close socket QEMUFile from socket_close
  migration: xxx_close will only be called once
  migration: use closesocket, not close
  migration: use migrate_fd_close in migrate_fd_cleanup
  migration: clean up server sockets and handlers before invoking process_incoming_migration
  migration: replace qemu_stdio_fd with qemu_get_fd
  migration: add qemu_get_fd
  migration: consolidate QEMUFile methods in a single QEMUFileOps struct
  migration: unify stdio-based QEMUFile operations

Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

* afaerber/qom-cpu:
  target-i386: cpu: fix --disable-kvm compilation

The final part of incoming migration, which now consists of
process_incoming_migration for all protocols, is thus made non-blocking.
Reviewed-by: NOrit Wasserman <owasserm@redhat.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

This will never happen right now (the assertion would fail).  The
next patch will set the socket or pipe in non-blocking mode, thus
enabling this part of the code.

Coroutines can just stop whenever they want with qemu_coroutine_yield.
As soon as select tells the main loop that the migration stream is
readable, the coroutine is re-entered directly in qemu_get_buffer,
where it will read more data and pass it to the loading routines.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

The common suffix is now just process_incoming_migration.
Reviewed-by: NOrit Wasserman <owasserm@redhat.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

The common suffix now is process_incoming_migration+qemu_fclose.
Reviewed-by: NOrit Wasserman <owasserm@redhat.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

No need to test s->fd again, it is tested in the caller.
Reviewed-by: NOrit Wasserman <owasserm@redhat.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

Windows requires this.  Migration does not quite work under Windows
but let's be uniform across QEMU.
Reviewed-by: NOrit Wasserman <owasserm@redhat.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

migrate_fd_cleanup will usually close the file descriptor via
buffered_file_close's call to migrate_fd_close.  However, in the case
of s->file == NULL it is "inlining" migrate_fd_close (almost: there is a
direct close() instead of using s->close(s)).  To fix the inconsistency
and clean up the code, allow multiple calls to migrate_fd_close and use
the function in migrate_fd_cleanup.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

A first step towards making a common "suffix" for all migration protocols,
and moving it to process_incoming_migration.
Reviewed-by: NOrit Wasserman <owasserm@redhat.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

Reviewed-by: NOrit Wasserman <owasserm@redhat.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

Reviewed-by: NOrit Wasserman <owasserm@redhat.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

Reviewed-by: NOrit Wasserman <owasserm@redhat.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

Now that qemu_fseek does not exist anymore, there is no reason to do
an fseek before fread/fwrite when operating on an stdio file.
Thus, unify the get/put_buffer callbacks used by qemu_fopen
with those used for pipes.
Reviewed-by: NOrit Wasserman <owasserm@redhat.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

This fixes the following:
  target-i386/cpu.o: In function `kvm_cpu_fill_host':
  target-i386/cpu.c:783: undefined reference to `kvm_state'

I didn't notice the problem before because GCC was optimizing the entire
kvm_cpu_fill_host() function out (because all calls are conditional on
kvm_enabled()).

* cpu_x86_fill_model_id() is used only if CONFIG_KVM is set, so #ifdef it
  entirely to avoid compiler warnings.

* kvm_cpu_fill_host() should be called only if KVM is enabled, so
  use #ifdef CONFIG_KVM around the entire function body.
Reported-by: NAndreas Färber <afaerber@suse.de>
Signed-off-by: NEduardo Habkost <ehabkost@redhat.com>
Signed-off-by: NAndreas Färber <afaerber@suse.de>

Commit a93a4a22 changed the names of some fields in DisplayChangeListener
and broke compilation of the cocoa UI. Update to the new names.
Acked-by: NGerd Hoffmann <kraxel@redhat.com>
Reviewed-by: NAndreas Färber <andreas.faerber@web.de>
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Console cleanup series renamed dpy_resize and dpy_update all over the
tree, but hw/xenfb.c was forgotten.  Update it too so it builds again.
Reported-by: NJan Kiszka <jan.kiszka@web.de>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

* kraxel/usb.69: (31 commits)
  usb-redir: Allow redirecting super speed devices to high speed controllers
  usb-redir: Allow to attach USB 2.0 devices to 1.1 host controller
  usb-redir: Use reject rather the disconnect on bad ep info
  usb-redir: Add an usbredir_setup_usb_eps() helper function
  usb-redir: Add support for input pipelining
  usb-redir: Add support for 32 bits bulk packet length
  combined-packet: Add a workaround for Linux usbfs + live migration
  usb: Add packet combining functions
  uhci: Don't crash on device disconnect
  uhci: Add a uhci_handle_td_error() helper function
  usb/ehci-pci: add helper to create ich9 usb controllers
  usb/ehci-pci: add ich9 00:1a.* variant
  usb/ehci-pci: dynamic type generation
  uhci: add ich9 00:1a.* variants
  uhci: stick irq routing info into UHCIInfo too.
  uhci: dynamic type generation
  xilinx_zynq: add USB controllers
  usb/ehci: add sysbus variant
  usb/ehci: split into multiple source files
  usb/ehci: Guard definition of EHCI_DEBUG
  ...
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

* kraxel/pixman.v3: (22 commits)
  pixman: drop obsolete fields from DisplaySurface
  pixman/vnc: remove dead code.
  pixman/vnc: remove rgb_prepare_row* functions
  pixman/vnc: use pixman images in vnc.
  pixman: switch screendump function.
  vga: stop direct access to DisplaySurface fields.
  qxl: stop direct access to DisplaySurface fields.
  console: don't set PixelFormat alpha fields for 32bpp
  console: make qemu_alloc_display static
  pixman: add pixman image to DisplaySurface
  pixman: helper functions
  pixman: windup in configure & makefiles
  pixman: add submodule
  console: remove DisplayAllocator
  console: remove dpy_gfx_fill
  vga: fix text mode updating
  console: init displaychangelisteners on register
  console: untangle gfx & txt updates
  console: s/TextConsole/QemuConsole/
  console: move set_mouse + cursor_define callbacks
  ...
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

* stefanha/net:
  e1000: pre-initialize RAH/RAL registers
  net: Reject non-netdevs in qmp_netdev_del()
  net: use "socket" model name for UDP sockets
  e1000: drop check_rxov, always treat RX ring with RDH == RDT as empty
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

* bonzini/threadpool: (39 commits)
  raw-win32: implement native asynchronous I/O
  raw-posix: move linux-aio.c to block/
  raw-win32: add emulated AIO support
  raw-posix: rename raw-posix-aio.h, hide unavailable prototypes
  raw: merge posix-aio-compat.c into block/raw-posix.c
  block: switch posix-aio-compat to threadpool
  threadpool: do not take lock in event_notifier_ready
  aio: add generic thread-pool facility
  qemu-thread: add QemuSemaphore
  linux-aio: use event notifiers
  aio: clean up now-unused functions
  main-loop: use aio_notify for qemu_notify_event
  main-loop: use GSource to poll AIO file descriptors
  aio: call aio_notify after setting I/O handlers
  aio: add aio_notify
  aio: make AioContexts GSources
  aio: add Win32 implementation
  aio: prepare for introducing GSource-based dispatch
  aio: add non-blocking variant of aio_wait
  aio: test node->deleted before calling io_flush
  ...
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

* qemu-kvm/uq/master: (28 commits)
  update-linux-headers.sh: Handle new kernel uapi/ directories
  target-i386: kvm_cpu_fill_host: use GET_SUPPORTED_CPUID
  target-i386: cpu: make -cpu host/check/enforce code KVM-specific
  target-i386: make cpu_x86_fill_host() void
  Emulate qemu-kvms -no-kvm option
  Issue warning when deprecated -tdf option is used
  Issue warning when deprecated drive parameter boot=on|off is used
  Use global properties to emulate -no-kvm-pit-reinjection
  Issue warning when deprecated -no-kvm-pit is used
  Use machine options to emulate -no-kvm-irqchip
  cirrus_vga: allow configurable vram size
  target-i386: Add missing kvm cpuid feature name
  i386: cpu: add missing CPUID[EAX=7,ECX=0] flag names
  i386: kvm: filter CPUID leaf 7 based on GET_SUPPORTED_CPUID, too
  i386: kvm: reformat filter_features_for_kvm() code
  i386: kvm: filter CPUID feature words earlier, on cpu.c
  i386: kvm: mask cpuid_ext4_features bits earlier
  i386: kvm: mask cpuid_kvm_features earlier
  i386: kvm: x2apic is not supported without in-kernel irqchip
  i386: kvm: set CPUID_EXT_TSC_DEADLINE_TIMER on kvm_arch_get_supported_cpuid()
  ...
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

* afaerber/qom-cpu: (35 commits)
  target-i386: Pass X86CPU to kvm_handle_halt()
  target-i386: Pass X86CPU to kvm_get_mp_state()
  cpu: Move thread_id to CPUState
  cpus: Pass CPUState to run_on_cpu()
  target-i386: Pass X86CPU to cpu_x86_inject_mce()
  target-i386: Pass X86CPU to kvm_mce_inject()
  cpus: Pass CPUState to [qemu_]cpu_has_work()
  spapr: Pass PowerPCCPU to hypercalls
  spapr: Pass PowerPCCPU to spapr_hypercall()
  target-ppc: Pass PowerPCCPU to cpu_ppc_hypercall
  target-ppc: Pass PowerPCCPU to powerpc_excp()
  xtensa_pic: Pass XtensaCPU to xtensa_ccompare_cb()
  cpus: Pass CPUState to qemu_wait_io_event_common()
  cpus: Pass CPUState to flush_queued_work()
  cpu: Move queued_work_{first,last} to CPUState
  cpus: Pass CPUState to qemu_cpu_kick()
  target-ppc: Rename kvm_kick_{env => cpu} and pass PowerPCCPU
  ppc: Pass PowerPCCPU to {ppc6xx,ppc970,power7,ppc40x,ppce500}_set_irq()
  cpus: Pass CPUState to qemu_tcg_init_vcpu()
  cpus: Pass CPUState to qemu_tcg_cpu_thread_fn
  ...
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

To avoid continually having to bump the initrd load address
to account for larger kernel images, put the initrd halfway
through RAM. This allows large kernels on new boards with lots
of RAM to work OK, without breaking existing usecases for
boards with only 32MB of RAM.

Note that this change fixes in passing a bug where we were
passing an overly large max_size to load_image_targphys()
for the initrd, which meant that we wouldn't correctly refuse
to load an enormous initrd that didn't actually fit into RAM.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Reviewed-by: NAurelien Jarno <aurelien@aurel32.net>
Reviewed-by: NIgor Mitsyanko <i.mitsyanko@samsung.com>
Tested-by: NCole Robinson <crobinso@redhat.com>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

* 'ppc-for-upstream' of git://repo.or.cz/qemu/agraf:
  pseries: Cleanup duplications of ics_valid_irq() code
  pseries: Clean up inconsistent variable name in xics.c
  target-ppc: Extend FPU state for newer POWER CPUs
  target-ppc: Rework storage of VPA registration state
  Revert "PPC: pseries: Remove hack for PIO window"

* 'arm-devs.for-upstream' of git://git.linaro.org/people/pmaydell/qemu-arm: (28 commits)
  hw/sd.c: add SD card save/load support
  vmstate: Add support for saving/loading bitmaps
  hw/sd.c: Fix erase for high capacity cards
  pflash_cfi01: Fix debug mode printfery
  pflash_cfi0x: QOMified
  pflash_cfi01: remove unused total_len field
  pflash_cfi0x: remove unused base field
  hw/versatile_i2c: Use LOG_GUEST_ERROR
  hw/arm_l2x0: Use LOG_GUEST_ERROR
  hw/arm_sysctl: Use LOG_GUEST_ERROR
  hw/armv7m_nvic: Use LOG_GUEST_ERROR and LOG_UNIMP
  hw/arm_timer: Use LOG_GUEST_ERROR and LOG_UNIMP
  hw/arm_gic: Use LOG_GUEST_ERROR
  hw/arm11mpcore: Use LOG_GUEST_ERROR rather than hw_error()
  hw/pl190: Use LOG_UNIMP rather than hw_error()
  hw/pl110: Use LOG_GUEST_ERROR rather than hw_error()
  hw/pl080: Use LOG_GUEST_ERROR and LOG_UNIMP
  hw/pl061: Use LOG_GUEST_ERROR
  hw/pl050: Use LOG_GUEST_ERROR
  hw/exynos4_boards: Don't prematurely explode QEMUMachineInitArgs
  ...

Signed-off-by: NHans de Goede <hdegoede@redhat.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

This follows the logic of host-linux: If a 2.0 device has no ISO
endpoint and no interrupt endpoint with a packet size > 64, we can
attach it also to an 1.1 host controller. In case the redir server does
not report endpoint sizes, play safe and remove the 1.1 compatibility as
well. Moreover, if we detect a conflicting change in the configuration
after the device was already attached, it will be disconnected
immediately.

HdG: Several small cleanups and fixes
Signed-off-by: NJan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: NHans de Goede <hdegoede@redhat.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

So that the client gets a notification about us disconnecting the device.
Signed-off-by: NHans de Goede <hdegoede@redhat.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Signed-off-by: NHans de Goede <hdegoede@redhat.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Signed-off-by: NHans de Goede <hdegoede@redhat.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Signed-off-by: NHans de Goede <hdegoede@redhat.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Older versions (anything but the latest) of Linux usbfs + libusb(x),
will submit larger (bulk) transfers split into multiple 16k submissions,
which means that rather then all tds getting linked into the queue in
one atomic operarion they get linked in a bunch at a time, which could
cause problems if:
1) We scan the queue while libusb is in the middle of submitting a split
   bulk transfer
2) While this bulk transfer is pending we migrate to another host.

The problem is that after 2, the new host will rescan the queue and
combine the packets in one large transfer, where as 1) has caused the
original host to see them as 2 transfers. This patch fixes this by stopping
combinging if we detect a 16k transfer with its int_req flag set.

This should not adversely effect performance for other cases as:
1) Linux never sets the interrupt flag on packets other then the last
2) Windows does set the in_req flag on each td, but will submit large
transfers in 20k tds thus never triggering the check
Signed-off-by: NHans de Goede <hdegoede@redhat.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Currently we only do pipelining for output endpoints, since to properly
support short-not-ok semantics we can only have one outstanding input
packet. Since the ehci and uhci controllers have a limited per td packet
size guests will split large input transfers to into multiple packets,
and since we don't pipeline these, this comes with a serious performance
penalty.

This patch adds helper functions to (re-)combine packets which belong to 1
transfer at the guest device-driver level into 1 large transger. This can be
used by (redirection) usb-devices to enable pipelining for input endpoints.

This patch will combine packets together until a transfer terminating packet
is encountered. A terminating packet is a packet which meets one or more of
the following conditions:
1) The packet size is *not* a multiple of the endpoint max packet size
2) The packet does *not* have its short-not-ok flag set
3) The packet has its interrupt-on-complete flag set

The short-not-ok flag of the combined packet is that of the terminating packet.
Multiple combined packets may be submitted to the device, if the combined
packets do not have their short-not-ok flag set, enabling true pipelining.

If a combined packet does have its short-not-ok flag set the queue will
wait with submitting further packets to the device until that packet has
completed.

Once enabled in the usb-redir and ehci code, this improves the speed (MB/s)
of a Linux guest reading from a USB mass storage device by a factor of
1.2 - 1.5.

And the main reason why I started working on this, when reading from a pl2303
USB<->serial converter, it combines the previous 4 packets submitted per
device-driver level read into 1 big read, reducing the number of packets / sec
by a factor 4, and it allows to have multiple reads outstanding. This allows
for much better latency tolerance without the pl2303's internal buffer
overflowing (which was happening at 115200 bps, without serial flow control).
Signed-off-by: NHans de Goede <hdegoede@redhat.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

My recent uhci cleanup series has introduced a regression, where
qemu sometimes crashes on a device disconnect. The problem is that
the uhci code never checked for a device not / no longer existing, instead
it was relying on usb_handle_packet accepting a NULL device.

But since we now pass usb_handle_packet q->ep->dev, rather then just
a local dev variable, we crash as q->ep == NULL due to the device no longer
existing.

This patch fixes this. Note that this patch also improves over
the old behavior were we would:
1) create a queue for the device
2) create an async for the packet
3) have usb_handle_packet fail
4) destroy the async
5) wait for the queue to be idle for 32 frames
6) destroy the queue

Which was rather sub-optimal.
Signed-off-by: NHans de Goede <hdegoede@redhat.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>