* 's390-for-upstream' of git://repo.or.cz/qemu/agraf:
  s390: autodetect map private

* 'target-arm.for-upstream' of git://git.linaro.org/people/pmaydell/qemu-arm:
  target-arm: Add support for long format translation table walks
  target-arm: Implement TTBCR changes for LPAE
  target-arm: Implement long-descriptor PAR format
  target-arm: Use target_phys_addr_t in get_phys_addr()
  target-arm: Add 64 bit PAR, TTBR0, TTBR1 for LPAE
  target-arm: Add 64 bit variants of DBGDRAR and DBGDSAR for LPAE
  target-arm: Add AMAIR0, AMAIR1 LPAE cp15 registers
  target-arm: Extend feature flags to 64 bits
  target-arm: Implement privileged-execute-never (PXN)
  ARM: Make target_phys_addr_t 64 bits and physaddrs 40 bits
  hw/imx_avic.c: Avoid format error when target_phys_addr_t is 64 bits
  target-arm: Fix TCG temp handling in 64 bit cp writes
  target-arm: Fix some copy-and-paste errors in cp register names
  target-arm: Fix typo that meant TTBR1 accesses went to TTBR0
  target-arm: Fix CP15 based WFI

Implement the actual table walk code for LPAE's long format
translation tables.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Implement the changes to the TTBCR register required for LPAE:
 * many fewer bits should be RAZ/WI
 * since TTBCR changes can result in a change of ASID, we must
   flush the TLB on writes to it
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Implement the different format of the PAR when long descriptor
translation tables are in use. Note that we assume that
get_phys_addr() returns a long-descriptor format DFSR value on
failure if long descriptors are in use; this added subtlety tips
the balance and makes it worth adding a comment documenting the
API to get_phys_addr().
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

In the implementation of get_phys_addr(), consistently use
target_phys_addr_t to hold the physical address rather than
uint32_t.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Under LPAE, the cp15 registers PAR, TTBR0 and TTBR1 are extended
to 64 bits, with a 64 bit (MRRC/MCRR) access path to read the
full width of the register. Add the state fields for the top
half and the 64 bit access path. Actual use of the top half of
the register will come with the addition of the long-descriptor
translation table format support.

For the PAR we also need to correct the masking applied for
32 bit writes (there are no bits reserved if LPAE is implemented)
and clear the high half when doing a 32 bit result VA-to-PA
lookup.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

LPAE extends the DBGDRAR and DBGDSAR debug registers to 64 bits; we
only implement these as dummy RAZ versions; provide dummies for
the 64 bit accesses as well.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Add implementations of the AMAIR0 and AMAIR1 LPAE
Auxiliary Memory Attribute Indirection Registers.
These are implementation defined and we choose to
implement them as RAZ/WI, matching the Cortex-A7
and Cortex-A15.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Extend feature flags to 64 bits, as we've just run out of space
in the 32 bit integer we were using for them.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Implement the privileged-execute-never (PXN) translation table bit.
It is implementation-defined whether this is implemented, so we give
it its own ARM_FEATURE_ flag. LPAE requires PXN, so add also an
LPAE feature flag and the implication logic, as a placeholder
for actually implementing LPAE at a later date.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Make target_phys_addr_t 64 bits for ARM targets, and set
TARGET_PHYS_ADDR_SPACE_BITS to 40.  This should have no effect for ARM
boards where physical addresses really are 32 bits (except perhaps a
slight performance hit on 32 bit hosts for system emulation) but allows
us to implement the Large Physical Address Extensions for Cortex-A15,
which mean 40 bit physical addresses.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Add a missing cast to avoid gcc complaining about format string
errors when printing an expression based on a target_phys_addr_t.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Reviewed-by: NPeter Chubb <peter.chubb@nicta.com.au>

Fix errors in the TCG temp handling in the 64 bit coprocessor
write path: we were reusing a 32 bit temp after it had been
freed by store_reg(), and failing to free a 64 bit temp.

This bug has no visible effect at this point because there
aren't any non-NOP 64 bit registers yet; it needs to be fixed
as a prerequisite for the 64 bit registers in LPAE support.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Fix a couple of cases where cp register names were copy-and-pasted.
These are harmless since we don't use the name for anything (except
debugging convenience) but could be confusing.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Reviewed-by: NIgor Mitsyanko <i.mitsyanko@samsung.com>

Fix a copy-and-paste error in the register description for TTBR1
that meant it was a duplicate of TTBR0 rather than affecting the
correct bit of CPU state.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

The coprocessor register rework broke cp15 based WFI instructions.
We incorrectly fall through the normal register write case, which
incorrectly adds a forced block termination.  We've already done
a special version of this (DISAS_WFI), so return immediately.
Signed-off-by: NPaul Brook <paul@codesourcery.com>
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Commit 25e5e4c7 broke compilation for non POSIX hosts (e.g. MinGW)
because it partially replaced "ret" by "count".

It also changed the handling of EINTR in a wrong way.

The patch restores the old code for these two changes.
Signed-off-by: NStefan Weil <sw@weilnetz.de>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Make qemu_find_file() check for the passed in name as a straight
pathname even if it doesn't have any path separator character in it.
This means that "-bios foo", "-dtb foo" etc will find a file 'foo'
in the current directory.
This removes an inconsistency with -kernel and -initrd, which both
accept plain filenames as meaning files in the current directory.
It's also less confusing for the user than an undocumented restriction
that "this option accepts a filename, except for the special case
where the filename you pass happens not to have a '/' in it, in
which case we'll ignore it."
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

By default qemu will use MAP_PRIVATE for guest pages. This will write
protect pages and thus break on s390 systems that dont support this feature.
Therefore qemu has a hack to always use MAP_SHARED for s390. But MAP_SHARED
has other problems (no dirty pages tracking, a lot more swap overhead etc.)
Newer systems allow the distinction via KVM_CAP_S390_COW. With this feature
qemu can use the standard qemu alloc if available, otherwise it will use
the old s390 hack.
Signed-off-by: NChristian Borntraeger <borntraeger@de.ibm.com>
Signed-off-by: NJens Freimann <jfrei@linux.vnet.ibm.com>
Acked-by: NJan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: NAlexander Graf <agraf@suse.de>

The Buildbot has detected a new failure on builder default_i386_rhel61 while
building qemu.

Full details are available at:
 http://buildbot.b1-systems.de/qemu/builders/default_i386_rhel61/builds/304

The proper fix is non-trivial so let's disable the build by default until it's
fixed properly.
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

* mjt/mjt-iov2:
  rewrite iov_send_recv() and move it to iov.c
  cleanup qemu_co_sendv(), qemu_co_recvv() and friends
  export iov_send_recv() and use it in iov_send() and iov_recv()
  rename qemu_sendv to iov_send, change proto and move declarations to iov.h
  change qemu_iovec_to_buf() to match other to,from_buf functions
  consolidate qemu_iovec_copy() and qemu_iovec_concat() and make them consistent
  allow qemu_iovec_from_buffer() to specify offset from which to start copying
  consolidate qemu_iovec_memset{,_skip}() into single function and use existing iov_memset()
  rewrite iov_* functions
  change iov_* function prototypes to be more appropriate
  virtio-serial-bus: use correct lengths in control_out() message

Conflicts:
	tests/Makefile
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

* quintela/migration-anthony-v2:
  Maintain the number of dirty pages
  dirty bitmap: abstract its use
  Exit loop if we have been there too long
  Only calculate expected_time for stage 2
  Only TCG needs TLB handling
  No need to iterate if we already are over the limit
  Add tracepoints for savevm section start/end
  Add spent time for migration
  Add migration_end function
  Add debugging infrastructure
  Add save_block_hdr function
  Add MigrationParams structure
  Add missing check for host_from_stream_offset return value for RAM_SAVE_FLAG_PAGE

* kiszka/queues/slirp:
  slirp: Improve error reporting of inaccessible smb directories
  slirp: Ensure smbd and shared directory exist when enable smb
  slirp: add 'cmd:' target for guestfwd
  slirp: Enforce host-side user of smb share

Instead of guessing, print the error code returned by access.
Signed-off-by: NJan Kiszka <jan.kiszka@siemens.com>

Users may pass the following parameters to qemu:
    $ qemu-kvm -net nic -net user,smb= ...
    $ qemu-kvm -net nic -net user,smb ...
    $ qemu-kvm -net nic -net user,smb=bad_directory ...

In these cases, qemu started successfully while samba server
failed to start. Users will confuse since samba server
failed silently without any indication of what it did wrong.

To avoid it, we check whether the shared directory exist and
if users have permission to access this directory when QEMU's
"built-in" SMB server is enabled.
Signed-off-by: NDunrong Huang <riegamaths@gmail.com>
Signed-off-by: NJan Kiszka <jan.kiszka@siemens.com>

When using guestfwd=, Qemu only connects the virtual server's TCP port
to a single chardev. This is useless in most cases, as we usually want
to have more than a single connection from the guest to the outside world.

This patch adds a new cmd: target to guestfwd= that allows for execution
of a command on every TCP connection. This leverages the same code as
the -smb parameter, just that here the command is user defined.
Reported-by: NSascha Wilde <wilde@intevation.de>
Signed-off-by: NAlexander Graf <agraf@suse.de>
Signed-off-by: NJan Kiszka <jan.kiszka@siemens.com>

Windows 7 (and possibly other versions) cannot connect to the samba
share if the exported host directory is not world-readable. This can be
resolved by forcing the username used for access checks to the one
under which QEMU and smbd are running.
Signed-off-by: NJan Kiszka <jan.kiszka@siemens.com>

* kwolf/for-anthony: (24 commits)
  block: Factor bdrv_read_unthrottled() out of guess_disk_lchs()
  qtest: Tidy up temporary files properly
  fdc: Drop broken code for user-defined floppy geometry
  fdc_test: introduce test_sense_interrupt
  fdc_test: update media_change test
  fdc: fix interrupt handling
  fdc: rewrite seek and DSKCHG bit handling
  block: introduce bdrv_swap, implement bdrv_append on top of it
  block: copy over job and dirty bitmap fields in bdrv_append
  raw: hook into blkdebug
  blkdebug: optionally tie errors to a specific sector
  blkdebug: store list of active rules
  blkdebug: pass getlength to underlying file
  blkdebug: tiny cleanup
  blkdebug: remove sync i/o events
  sheepdog: traverse pending_list from the first for each time
  sheepdog: split outstanding list into inflight and pending
  sheepdog: make sure we don't free aiocb before sending all requests
  sheepdog: use coroutine based socket functions in coroutine context
  sheepdog: restart I/O when socket becomes ready in do_co_req()
  ...

To prepare move of guess_disk_lchs() into hw/, where it poking
BlockDriverState member io_limits_enabled directly would be unclean.
Signed-off-by: NMarkus Armbruster <armbru@redhat.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

Each test litters /tmp with several files: a pid file and two
sockets.  Tidy up.
Signed-off-by: NMarkus Armbruster <armbru@redhat.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

* kraxel/usb.55:
  usb-host: add trace events for iso xfers
  usb: fix interface initialization
  usb: split endpoint init and reset
  usb-redir: Correctly handle the usb_redir_babble usbredir status
  ehci: Kick async schedule on wakeup in the non companion case
  usb-ehci: Fix an assert whenever isoc transfers are used
  ehci: don't flush cache on doorbell rings.
  ehci: fix td writeback
  ehci: fix ehci_qh_do_overlay

* bonzini/scsi-next:
  scsi: Fix transfer length for READ POSITION commands.
  scsi: Add basic support for SCSI media changer commands.
  scsi: Ensure command and transfer lengths are set for all SCSI devices
  scsi: Fix LOAD_UNLOAD
  scsi: Fix data length == SCSI_SENSE_BUF_SIZE
  virtio-scsi: do not crash on adding buffers to the event queue
  megasas: LSI Megaraid SAS HBA emulation
  megasas: Add header file
  ISCSI: force use of sg for SMC and SSC devices
  ISCSI: Add SCSI passthrough via scsi-generic to libiscsi
  scsi-disk: implement READ DISC INFORMATION
  atapi: implement READ DISC INFORMATION
  scsi: add a qdev property for the disk's WWN
  scsi: simplify handling of the VPD page length field

* stefanha/trivial-patches:
  configure: Remove help for --disable-vnc-thread, --enable-vnc-thread
  cpu-common.h: Remove a pointless ifndef CONFIG_USER_ONLY
  cpu-common.h: Remove unnecessary guard on including targphys.h

bdrv_get_floppy_geometry_hint() fails to store through its parameter
drive when bs has a geometry hint.  Makes fd_revalidate() assign
random crap to drv->drive.

Has been broken that way for ages.  Harmless, because:

* The only way to set a geometry hint is -drive if=none,cyls=...
  Since commit c219331e, probably unintentional.

* The only use of drv->drive is as argument to another
  bdrv_get_floppy_geometry_hint().  Which doesn't use it, since the
  geometry hint is still there.

Drop the broken code, ignore -drive parameter cyls, heads and secs for
floppies even with if=none, just like before commit c219331e.  Matches
-help, which explains cyls, heads, secs as "hard disk physical
geometry".
Signed-off-by: NMarkus Armbruster <armbru@redhat.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

Calling sense interrupt status while there is no interrupt should
return invalid command (0x80).

Read command should always returns in st0 seek_end bit set to 1.
Signed-off-by: NPavel Hrdina <phrdina@redhat.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

After rewrite DSKCHG bit handling the test has to be updated. Now
is needed to seek to different track to clear DSKCHG bit.
Signed-off-by: NPavel Hrdina <phrdina@redhat.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

If you call the SENSE INTERRUPT STATUS command while there is no interrupt
waiting you get as result unknown command.

Fixed status0 register handling for read/write/format commands.
Signed-off-by: NPavel Hrdina <phrdina@redhat.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

This bit is cleared on every successful seek to a different track (cylinder).
The seek is also called on revalidate or on read/write/format commands which
also clear the DSKCHG bit.
Signed-off-by: NPavel Hrdina <phrdina@redhat.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

The new function can be made a bit nicer than bdrv_append.  It swaps the
whole contents, and then swaps back (using the usual t=a;a=b;b=t idiom)
the fields that need to stay on top.  Thus, it does not need explicit
bdrv_detach_dev, bdrv_iostatus_disable, etc.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>