The qemu-img, qemu-nbd and qemu-io tools are built conditionally
based on whether any softmmu target is enabled. These are useful
self-contained tools which can be used in many other scenarios.
Add new --enable-tools/--disable-tools args to configure to allow
the user to explicitly turn on / off their build. The default
behaviour is now to build these tools are all times, regardless
of whether any softmmu target is enabled
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Allow passing of '--target-list=' to configure to request that
all targets are to be disabled. This allows for doing a very
fast tools-only build of things like qemu-img, qemu-io, qemu-nbd.
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

This is not used anymore and only written to.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

This patch makes rtc_set_time and rtc_set_cmos work without reading
s->current_tm.  In the case of rtc_set_time I introduce a new
function that retrieves the time and stores into a given struct tm
(not hard-coded to s->current_tm).  In the case of rtc_set_cmos, the
current time is similarly taken from a struct tm rather than
s->current_tm.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

This patch limits further the usage of a periodic timer.  It computes the
time of the next alarm, and uses it to skip all intermediate occurrences
of the timer.

Cc: Yang Zhang <yang.z.zhang@intel.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

The first update cycle begins one-half seconds after divider
reset is removed.  This feature is useful for testing.
Signed-off-by: NYang Zhang <yang.z.zhang@intel.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Calculate guest RTC based on the time of the last update, instead of
using timers.  The formula is

    (base_rtc + guest_time_now - guest_time_last_update + offset)

Base_rtc is the RTC value when the RTC was last updated.
Guest_time_now is the guest time when the access happens.
Guest_time_last_update was the guest time when the RTC was last updated.
Offset is used when divider reset happens or the set bit is toggled.

The timer is kept in order to signal interrupts, but it only needs to
run when either UF or AF is cleared.  When the bits are both set, the
timer does not run.

UIP is now synthesized when reading register A.  If the timer is not set,
or if there is more than one second before it (as is the case at the
end of this series), the leading edge of UIP is computed and the rising
edge occurs 220us later.  If the update timer occurs within one second,
however, the rising edge of the AF and UF bits should coincide withe
the falling edge of UIP.  We do not know exactly when this will happen
because there could be delays in the servicing of the timer.  Hence, in
this case reading register A only computes for the rising edge of UIP,
and latches the bit until the timer is fired and clears it.
Signed-off-by: NYang Zhang <yang.z.zhang@intel.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Also, for consistency with other occurrences, implement VMSTATE_TIMER
as a special case of VMSTATE_TIMER_V rather than VMSTATE_TIMER_TEST.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

If an interrupt flag is already set when the interrupt becomes enabled,
raise an interrupt immediately, and vice versa if interrupts become
disabled.
Signed-off-by: NYang Zhang <yang.z.zhang@intel.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Signed-off-by: NYang Zhang <yang.z.zhang@intel.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Changing the DM (binary/BCD) and 24/12 control bit doesn't affect the internal
registers. It only indicates what format is used for those registers.
Signed-off-by: NYang Zhang <yang.z.zhang@intel.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

* qemu-kvm/uq/master:
  kvm: i386: Add classic PCI device assignment
  kvm: i386: Add services required for PCI device assignment
  kvm: Introduce kvm_has_intx_set_mask
  kvm: Introduce kvm_irqchip_update_msi_route
  kvm: Clean up irqfd API
  qemu: Use valgrind annotations to mark kvm guest memory as defined

* mst/tags/for_anthony:
  vhost: Pass device path to vhost_dev_init()
  monitor: Rename+move net_handle_fd_param -> monitor_handle_fd_param
  pcie_aer: clear cmask for Advanced Error Interrupt Message Number
  pcie: drop version_id field for live migration
  qemu: add .exrc

Commit c3767ed0 introduced a possible SEGV when
using a socket chardev with server=on because it assumes that all TCP sockets
are in client mode.

This patch adds a check to only reconnect when in client mode.

Cc: Lei Li <lilei@linux.vnet.ibm.com>
Reported-by: NMichael Roth <mdroth@linux.vnet.ibm.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Commit 7b93fadf "Add basic version
of bridge helper" put the bridge helper executable into a fixed
${prefix}/libexec/ location, instead of using ${libexecdir} for
this.  At the same time, --libexecdir is being happily ignored
by ./configure.  Even more, the same patch sets unused $libexecdir
variable in the generated config-host.mak, and uses fixed string
(\${prefix}/libexecdir) for the bridge helper binary.

Fix this braindamage by introducing $libexecdir variable, using
it for the bridge helper binary, and recognizing --libexecdir.

This patch is applicable to stable-1.1.
Reviewed-by: NAndreas Färber <afaerber@suse.de>
Reviewed-by: NCorey Bryant <coreyb@linux.vnet.ibm.com>
Signed-off-by: NMichael Tokarev <mjt@tls.msk.ru>
Cc: Corey Bryant <coreyb@linux.vnet.ibm.com>
Cc: Richa Marwaha <rmarwah@linux.vnet.ibm.com>
Cc: qemu-stable@nongnu.org
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

* 'spice.v59' of git://anongit.freedesktop.org/spice/qemu:
  Remove #ifdef QXL_COMMAND_FLAG_COMPAT_16BPP
  qxl: Add set_client_capabilities() interface to QXLInterface
  spice: make number of surfaces runtime-configurable.
  configure: print spice-protocol and spice-server versions
  qxl: add QXL_IO_MONITORS_CONFIG_ASYNC
  qxl: disallow unknown revisions
  qxl/update_area_io: guest_bug on invalid parameters
  spice: increase the verbosity of spice section in "qemu --help"
  spice: adding seamless-migration option to the command line
  spice: add 'migrated' flag to spice info
  spice migration: add QEVENT_SPICE_MIGRATE_COMPLETED
  spice: notify on vm state change only via spice_server_vm_start/stop
  spice: notify spice server on vm start/stop
  spice: abort on invalid streaming cmdline params

* 'queue/qmp' of git://repo.or.cz/qemu/qmp-unstable:
  tcx: tcx_screen_dump(): add error handling
  tcx: tcx24_screen_dump(): add error handling
  g364fb: g364fb_screen_dump(): add error handling
  omap_lcdc: omap_ppm_save(): add error handling
  omap_lcdc: rename ppm_save() to omap_ppm_save()
  vga: ppm_save(): add error handling
  qapi: convert screendump
  console: vga_hw_screen_dump_ptr: take Error argument
  error: add error_setg()
  json-parser: Fix potential NULL pointer segfault
  qapi: Fix potential NULL pointer segfault
  qapi: convert sendkey
  monitor: move key_defs[] table and introduce two help functions
  qapi: add the QKeyCode enum
  qapi: generate list struct and visit_list for enum
  hmp: rename arguments
  monitor: rename keyname '<' to 'less'
  fix doc of using raw values with sendkey
  Add support for pretty-printing response in qmp-shell

Report from smatch:

mcf5206.c:384 m5206_mbar_readb(7) error: buffer overflow 'm5206_mbar_width' 128 <= 128
mcf5206.c:403 m5206_mbar_readw(8) error: buffer overflow 'm5206_mbar_width' 128 <= 128
mcf5206.c:427 m5206_mbar_readl(8) error: buffer overflow 'm5206_mbar_width' 128 <= 128
mcf5206.c:451 m5206_mbar_writeb(9) error: buffer overflow 'm5206_mbar_width' 128 <= 128
mcf5206.c:475 m5206_mbar_writew(9) error: buffer overflow 'm5206_mbar_width' 128 <= 128
mcf5206.c:503 m5206_mbar_writel(9) error: buffer overflow 'm5206_mbar_width' 128 <= 128

m5206_mbar_width has 0x80 elements and supports 0 <= offset < 0x200.
Signed-off-by: NStefan Weil <sw@weilnetz.de>
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

Report from smatch:

target-arm/helper.c:651 arm946_prbs_read(6) error:
 buffer overflow 'env->cp15.c6_region' 8 <= 8
target-arm/helper.c:661 arm946_prbs_write(6) error:
 buffer overflow 'env->cp15.c6_region' 8 <= 8

c7_region is an array with 8 elements, so the index must be less than 8.
Signed-off-by: NStefan Weil <sw@weilnetz.de>
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

Report from smatch:

hw/wm8750.c:369 wm8750_tx(12) error: buffer overflow 's->i2c_data' 2 <= 2

It looks like the preprocessor statements were simply misplaced.

Replace also __FUNCTION__ by __func__ to please checkpatch.pl.
Signed-off-by: NStefan Weil <sw@weilnetz.de>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org> 
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

This adds PCI device assignment for i386 targets using the classic KVM
interfaces. This version is 100% identical to what is being maintained
in qemu-kvm for several years and is supported by libvirt as well. It is
expected to remain relevant for another couple of years until kernels
without full-features and performance-wise equivalent VFIO support are
obsolete.

A refactoring to-do that should be done in-tree is to model MSI and
MSI-X support via the generic PCI layer, similar to what VFIO is already
doing for MSI-X. This should improve the correctness and clean up the
code from duplicate logic.
Signed-off-by: NJan Kiszka <jan.kiszka@siemens.com>
Acked-by: NAcked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: NAvi Kivity <avi@redhat.com>

These helpers abstract the interaction of upcoming pci-assign with the
KVM kernel services. Put them under i386 only as other archs will
implement device pass-through via VFIO and not this classic interface.
Signed-off-by: NJan Kiszka <jan.kiszka@siemens.com>
Acked-by: NAcked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: NAvi Kivity <avi@redhat.com>

Will be used by PCI device assignment code.
Signed-off-by: NJan Kiszka <jan.kiszka@siemens.com>
Acked-by: NAcked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: NAvi Kivity <avi@redhat.com>

This service allows to update an MSI route without releasing/reacquiring
the associated VIRQ. Will be used by PCI device assignment, later on
likely also by virtio/vhost and VFIO.
Signed-off-by: NJan Kiszka <jan.kiszka@siemens.com>
Acked-by: NAcked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: NAvi Kivity <avi@redhat.com>

The load/store slow path has been broken in e141ab52:
- We need to move 4 registers for store functions and 3 registers for
  load functions and not the reverse.
- According to the s390x calling convention the arguments of a function
  should be zero extended. This means that the register shift should be
  done with TCG_TYPE_I64 to ensure the higher word is correctly zero
  extended when needed.

I am aware that CONFIG_TCG_PASS_AREG0 is being removed and thus that
this patch can be improved, but doing so means it can also be applied to
the 1.1 and 1.2 stable branches.
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>
Signed-off-by: NAlexander Graf <agraf@suse.de>

Add an explicit CPUState parameter instead of relying on AREG0.

Remove temporary wrappers and switch to AREG0 free mode.
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>
[agraf: fix conflicts]
Signed-off-by: NAlexander Graf <agraf@suse.de>

Make misc helpers take a parameter for CPUState instead
of relying on global env.
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>
[agraf: fix conflict]
Signed-off-by: NAlexander Graf <agraf@suse.de>

Make condition code helpers take a parameter for CPUState instead
of relying on global env.
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>
Signed-off-by: NAlexander Graf <agraf@suse.de>

Make integer helpers take a parameter for CPUState instead
of relying on global env.
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>
Signed-off-by: NAlexander Graf <agraf@suse.de>

Make FPU helpers take a parameter for CPUState instead
of relying on global env.

Introduce temporary wrappers for FPU load and store ops.
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>
Signed-off-by: NAlexander Graf <agraf@suse.de>

Now op_helper.c contains miscellaneous helpers, rename
it to misc_helper.c.
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>
[agraf: fix conflict]
Signed-off-by: NAlexander Graf <agraf@suse.de>

Move memory access helpers to mem_helper.c.
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>
[agraf: fold softmmu include ifdefs together]
Signed-off-by: NAlexander Graf <agraf@suse.de>

Move integer helpers to int_helper.c.
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>
Signed-off-by: NAlexander Graf <agraf@suse.de>

Move condition code helpers to cc_helper.c.
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>
Signed-off-by: NAlexander Graf <agraf@suse.de>

Move floating point instructions to fpu_helper.c.

While exporting some condition code helpers,
avoid duplicate identifier conflict with translate.c.

Remove unused set_cc_nz_f64() in translate.c.
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>
Signed-off-by: NAlexander Graf <agraf@suse.de>

Before splitting op_helper.c and helper.c in the next patches,
fix style issues. No functional changes.

Replace also GCC specific __FUNCTION__ with
standard __func__.

Don't init static variable (cpu_s390x_init:inited) with 0.
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>
Signed-off-by: NAlexander Graf <agraf@suse.de>

No need to expose the fd-based interface, everyone will already be fine
with the more handy EventNotifier variant. Rename the latter to clarify
that we are still talking about irqfds here.
Signed-off-by: NJan Kiszka <jan.kiszka@siemens.com>
Acked-by: NAlex Williamson <alex.williamson@redhat.com>
Signed-off-by: NAvi Kivity <avi@redhat.com>

valgrind with kvm produces a big amount of false positives regarding
"Conditional jump or move depends on uninitialised value(s)". This
happens because the guest memory is allocated with qemu_vmalloc which
boils down posix_memalign etc. This function is (correctly) considered
by valgrind as returning undefined memory.

Since valgrind is based on jitting code, it will not be able to see
changes made by the guest to guest memory if this is done by KVM_RUN,
thus keeping most of the guest memory undefined.

Now lots of places in qemu will then use guest memory to change behaviour.
To avoid the flood of these messages, lets declare the whole guest
memory as defined. This will reduce the noise and allows us to see real
problems.

In the future we might want to make this conditional, since there
is actually something that we can use those false positives for:
These messages will point to code that depends on guest memory, so
we can use these backtraces to actually make an audit that is focussed
only at those code places. For normal development we dont want to
see those messages, though.
Signed-off-by: NChristian Borntraeger <borntraeger@de.ibm.com>
Signed-off-by: NAvi Kivity <avi@redhat.com>

The old arithmetic assumed 32 physical address bits which is no longer
true for ARM since 3cc0cd61.
Signed-off-by: NJan Kiszka <jan.kiszka@web.de>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>