* sweil/fixes:
  qemu-timer: Fix limits for w32 mmtimer
  qom: Fix memory leak in function container_get
  hw/pc_sysfw: Fix memory leak
  qdev: Fix memory leak in function set_pci_devfn
  arm-semi: Rename SYS_XXX macros to TARGET_SYS_XXX (fixes compiler warning)
  target-mips: Remove unused inline function

The Linux AC97 driver tests this bit to decide wether or not to show
an External amplifier toggle control.

This patch was also tested with a Windows XP guest without any issues.
Signed-off-by: NHans de Goede <hdegoede@redhat.com>
Signed-off-by: Nmalc <av1474@comtv.ru>

The Linux ac97 drivers does a number of register read/write tests to
see how much resolution a volume control actually has.

This patch takes this into account by masking out any bits written to
a volume control reg which should not be there according to the spec.

After this the Linux ac97 driver correctly uses a range of 0 - 0x1f for
the PCM out volume, as stated in the spec, and we can fix the FIXME
in update_combined_volume_out().

This patch was also tested with a Windows XP guest without any issues.
Signed-off-by: NHans de Goede <hdegoede@redhat.com>
Signed-off-by: Nmalc <av1474@comtv.ru>

After commit 19677a38:
"hw/ac97: add support for volume control"

We are (correctly) using AC97_Record_Gain_Mute and not AC97_Line_In_Volume_Mute
for recording volume, but various places in hw/ac97 were still assumimg that
we are using AC97_Line_In_Volume_Mute for record volume control, this patch
fixes this.
Signed-off-by: NHans de Goede <hdegoede@redhat.com>
Signed-off-by: Nmalc <av1474@comtv.ru>

The Linux ac97 driver tries to see if optional things like video input
volume control are available in 2 ways:
1) See if the mute bit is set after reset, if it is no further tests are done
2) If the mute bit is not set it does a write/read test of the mute bit

This patch changes our ac97 to conform to what the Linux driver expects, it
initializes registers for things which we don't emulate to 0 (so the mute bit
is not set) and makes them read only.

This causes Linux to now longer show the following (functionless)
controls in alsamixer:

Master Mono vol + mute
3d Control toggle
PCM out pre / post 3d select
Surround toggle
CD vol + mute
Mic vol + mute
Mic boost toggle
Mic mic1 / mic2 select
Video vol + mute
Phone vol + mute
Beep mono vol + mute
Aux vol + mute
Mono "output mic" / "mix" select
Sigmatel 4 speaker stereo toggle
Sigmatel ADC 6Db att toggle
Sigmatel DAC 6Db att toggle

This patch was also tested with a Windows XP guest and there it also makes
a number of functionless mixer controls go away.
Signed-off-by: NHans de Goede <hdegoede@redhat.com>
Signed-off-by: Nmalc <av1474@comtv.ru>

Fix a small copy and paste error in logging.
Signed-off-by: NHans de Goede <hdegoede@redhat.com>
Signed-off-by: Nmalc <av1474@comtv.ru>

Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Nmalc <av1474@comtv.ru>

Signed-off-by: Nmalc <av1474@comtv.ru>

Signed-off-by: Nmalc <av1474@comtv.ru>

timeSetEvent only accepts delays in the range which is returned by
timeGetDevCaps.

The lower limit is typically 1 (= 1 ms), so the constant value of 1
in the old code usually worked.

The upper limit can be as low as 10000 ms, so the latest changes in
QEMU's timer handling which introduced timeout values above that limit
could result in failures of timeSetEvent when the timer was re-armed.
Signed-off-by: NStefan Weil <sw@weilnetz.de>

Valgrind reported this memory leak which occured very often.

Test scenario:

qemu-system-i386 (no arguments), only BIOS started, terminate with
monitor command (quit).
Signed-off-by: NStefan Weil <sw@weilnetz.de>
Reviewed-by: NAndreas Färber <afaerber@suse.de>

Valgrind reported this memory leak which occured a few times.

Test scenario:

qemu-system-i386 (no arguments), only BIOS started, terminate with
monitor command (quit).
Signed-off-by: NStefan Weil <sw@weilnetz.de>
Reviewed-by: NAndreas Färber <afaerber@suse.de>

Valgrind reported this memory leak which occured very often.

Test scenario:

qemu-system-i386 (no arguments), only BIOS started, terminate with
monitor command (quit).

v2:
Use error_free instead of g_free (hint from Andreas Färber, thanks).
Signed-off-by: NStefan Weil <sw@weilnetz.de>
Acked-by: NAndreas Färber <afaerber@suse.de>

SYS_OPEN is already defined in stdio.h of MinGW-w64,
therefore the compiler complains when building for w64.

Adding the prefix TARGET_ avoids that macro redefinition.
xtensa-semi.c also uses the same prefix (but mixed case macros
TARGET_SYS_xxx instead of TARGET_SYS_XXX).
Signed-off-by: NStefan Weil <sw@weilnetz.de>
Acked-by: NPeter Maydell <peter.maydell@linaro.org>

Function set_HILO is not needed anywhere.
Signed-off-by: NStefan Weil <sw@weilnetz.de>

* kwolf/for-anthony:
  ATA: Allow WIN_SECURITY_FREEZE_LOCK as nop
  rbd: add discard support
  qcow2: fix the return value -ENOENT -> -EEXIST
  qcow2: Don't hold cache references across yield
  qcow2: Remove unused parameter in do_alloc_cluster_offset
  qemu-iotests: Many parallel allocating I/O requests
  docs: fix one issue in qcow2 specs
  block/qcow2: Add missing GCC_FMT_ATTR to function report_unsupported()
  qemu-iotests: ignore fragmentation information for qed

When using Windows 8 with an AHCI disk drive, it issues a blue screen.
The reason is that WIN_SECURITY_FREEZE_LOCK / CFA_WEAR_LEVEL is not
supported by our ATA implementation, but Windows expects it to be there.

Since without security stuff implemented, the lock would be a nop anyway
and CFA_WEAR_LEVEL already is treated as a nop, let's just allow the cmd
for HD drives as well. That way Windows is happy.
Signed-off-by: NAlexander Graf <agraf@suse.de>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

Change the write flag to an operation type in RBDAIOCB, and make the
buffer optional since discard doesn't use it.

Discard is first included in librbd 0.1.2 (which is in Ceph 0.46).
If librbd is too old, leave out qemu_rbd_aio_discard entirely,
so the old behavior is preserved.
Signed-off-by: NJosh Durgin <josh.durgin@dreamhost.com>
Reviewed-by: NStefan Hajnoczi <stefanha@linux.vnet.ibm.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

Signed-off-by: NZhi Yong Wu <wuzhy@linux.vnet.ibm.com>
Reviewed-by: NStefan Hajnoczi <stefanha@linux.vnet.ibm.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

If cache references are held while the coroutine has yielded, the cache
may get used up and abort() when it can't find a free entry.
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

Signed-off-by: NKevin Wolf <kwolf@redhat.com>

This test case manages to let qcow2 abort because its cache is used up
and it can't find free cache entries for new requests any more.
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

Signed-off-by: NZhi Yong Wu <wuzhy@linux.vnet.ibm.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

Cc: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: NStefan Weil <sw@weilnetz.de>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

We added image fragmentation statistics functions to qemu-img several days
ago, those patches will cause "./check -qed" failed. This patch will ignore
fragmentation statistics information of qed format, and then "./check -qed"
will work.
Signed-off-by: NDong Xu Wang <wdongxu@linux.vnet.ibm.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

* kiszka/queues/slirp:
  Declare state directory in smb.conf
  slirp: don't use "smb ports = 0" option

* stefanha/tracing:
  configure: check for supported Python 2.x versions
  tracetool: avoid pkgutil.iter_modules() Python 2.7 function
  tracetool: avoid str.rpartition() Python 2.5 function
  tracetool: use Python 2.4-compatible __import__() arguments
  tracetool: use Python 2.4-compatible exception handling syntax

* agraf/s390-for-upstream:
  s390: reset avail and used index on reboot
  S390: dont call system_shutdown on disabled wait
  S390: remove default cdrom, sd-card and floppy support
  S390: support reboot for kvm on s390
  S390: reboot: reset device pages on reboot
  S390: fix error handling on kernel and initrd failures
  S390: fix kernel_commandline handling

* stefanha/trivial-patches:
  iohandler: Use bool for boolean struct member and remove holes
  async: Use bool for boolean struct members and remove a hole
  configure: Fix creation of symbolic links for MinGW toolchain

* agraf/ppc-for-upstream:
  linux-user: Fix invalid TARGET_ABI_BITS usage on ppc hosts
  target-ppc: Some support for dumping TLB_EMB TLBs
  ppce500_spin: Replace assert by hw_error (fixes compiler warning)
  pseries: Fix use of global CPU state
  pseries: Use the same interrupt swizzling for host bridges as p2p bridges
  pseries: Implement automatic PAPR VIO address allocation
  PPC: Fix up e500 cache size setting
  booke:Use MMU API for creating initial mapping for secondary cpus

* mdroth/qga-pull-4-27-12:
  qemu-ga: persist tracking of fsfreeze state via filesystem
  qemu-ga: add a whitelist for fsfreeze-safe commands
  qemu-ga: improve recovery options for fsfreeze

The smb.conf generated by the userspace networking does not include a state directory
directive. Samba therefore falls back to the default value. Since the user generally
does not have write access to this path, smbd immediately crashes.

The "state directory" option was added in Samba 3.4.0 (commit
http://gitweb.samba.org/?p=samba.git;a=commit;h=7b02e05eb64f3ffd7aa1cf027d10a7343c0da757).

This patch adds the missing option.
Signed-off-by: NNikolaus Rath <Nikolaus@rath.org>
Signed-off-by: NJan Kiszka <jan.kiszka@siemens.com>

The "smb ports = 0" option causes recent samba versions to crash. It was
introduced in commit 157777ef with log message "Samba 3 support".
However, a value of 0 has never been officially supported by smb and is
also not necessary: if stdin is a socket, smb does not try to listen on
any ports and uses just stdin. This is necessary to support inetd based
operation (otherwise smbd would always fail when called from inetd,
because inetd already listens on the SMB port). Since samba has
supported inetd operation since pre-3.x, it should be safe to rely on
this feature. I have tested it with Samba 3.6.4 -- communication works
fine, and smbd is not listening on any ports.

I suspect the "smb ports = 0" hack may have been introduced when someone
tested the qemu generated samba config from the command line with "smbd
-i" and found it to fail (because then stdin isn't a socket).
Signed-off-by: NNikolaus Rath <Nikolaus@rath.org>
Signed-off-by: NJan Kiszka <jan.kiszka@siemens.com>

When trying to evaluate the size of the _host_ type size for olddev_t,
we need to expose the host's pointer size, not the guest pointer size.

This usage got introduced accidently in commit b754e4fc.

Fix things by not using TARGET_.*, but rather use host sizeof()
information, which gives us the correct size.
Reported-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NAlexander Graf <agraf@suse.de>

Add mmubooke_dump_mmu().

TODO: Add printing of individual flags.
Signed-off-by: NFrançois Revol <revol@free.fr>
[agraf: fix coding style]
Signed-off-by: NAlexander Graf <agraf@suse.de>

The default case in function spin_read should never be reached,
therefore the old code used assert(0) to abort QEMU.

This does not work when QEMU is compiled with macro NDEBUG defined.
In this case (and also when the compiler does not know that assert
never returns), there is a compiler warning because of the missing
return value.

Using hw_error allows an improved error message and aborts always.
Signed-off-by: NStefan Weil <sw@weilnetz.de>
[agraf: use __func__]
Signed-off-by: NAlexander Graf <agraf@suse.de>

Commit ed120055 (Implement PAPR VPA
functions for pSeries shared processor partitions) introduced the
deregister_dtl() function and typo "emv" as name of its argument.
This went unnoticed because the code in that function can access the
global variable "env" so that no build failure resulted.

Fix the argument to read "env". Resolves LP#986241.
Signed-off-by: NPeter Portante <peter.portante@redhat.com>
Acked-by: NAndreas Färber <afaerber@suse.de>
[agraf: fixed typo in commit message]
Signed-off-by: NAlexander Graf <agraf@suse.de>

Currently the pseries PCI code uses a somewhat strange scheme of PCI irq
allocation - one per slot up to a maximum that's greater than the usual 4.
This scheme more or less worked, because we were able to tell the guest the
irq mapping in the device tree, however it's a bit odd and may break
assumptions in the future.  Worse, the array used to construct the dev
tree interrupt map was mis-sized, we got away with it only because it
happened that our SPAPR_PCI_NUM_LSI value was greater than 7.

This patch changes the pseries PCI code to use the same interrupt swizzling
scheme as is standardized for PCI to PCI bridges.  This makes for better
consistency, deals better with any devices which use multiple interrupt
pins and will make life easier in the future when we add passthrough of
what may be either a host bridge or a PCI to PCI bridge.  This won't break
existing guests, because they don't assume a particular mapping scheme for
host bridges, but just follow what we tell them in the device tree (also
updated to match, of course).  This patch also fixes the allocation of the
irq map.
Signed-off-by: NDavid Gibson <david@gibson.dropbear.id.au>
Signed-off-by: NAlexander Graf <agraf@suse.de>

PAPR virtual IO (VIO) devices require a unique, but otherwise arbitrary,
"address" used as a token to the hypercalls which manipulate them.

Currently the pseries machine code does an ok job of allocating these
addresses when the legacy -net nic / -serial and so forth options are used
but will fail to allocate them properly when using -device.

Specifically, you can use -device if all addresses are explicitly assigned.
Without explicit assignment, only one VIO device of each type (network,
console, SCSI) will be assigned properly, any further ones will attempt
to take the same address leading to a fatal error.

This patch fixes the situation by adding a proper address allocator to the
VIO "bus" code.  This is used both by -device and the legacy options and
default devices.  Addresses can still be explicitly assigned with -device
options if desired.

This patch changes the (guest visible) numbering of VIO devices, but since
their addresses are discovered using the device tree and already differ
from the numbering found on existing PowerVM systems, this does not break
compatibility.
Signed-off-by: NDavid Gibson <david@gibson.dropbear.id.au>
Signed-off-by: NAlexander Graf <agraf@suse.de>