This reverts commit 66e3dd92.

From Avi,

 "Anthony, I think we should revert that commit and refactor cpuid for
  1.1.  The logic is spread over too many places which makes it hard to
  reason about."
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

This should have be part of my TCI patch series.
Signed-off-by: NStefan Weil <sw@weilnetz.de>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

We should only claim that something is a cast if we did not encouter a
token before, that did set av_pending.

This fixes the operator * in the line below to be detected as binary (vs
unary).

kmalloc(sizeof(struct alphatrack_ocmd) * true_size, GFP_KERNEL);

Reported-by: Peter Chubb <nicta.com.au>
Signed-off-by: NFlorian Mickler <florian@mickler.org>
(cherry-picked from Linux kernel commit c023e4734c3e8801e0ecb5e81b831d42a374d861)
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Cc: Blue Swirl <blauwirbel@gmail.com>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

- ITLB/DTLB ways 5 and 6 have 4 and 8 entries respectively;
- ITLB/DTLB way 6 attr field is set to 3 on reset.
Signed-off-by: NMax Filippov <jcmvbkbc@gmail.com>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

Signed-off-by: NStefano Stabellini <stefano.stabellini@eu.citrix.com>
Signed-off-by: NStefan Hajnoczi <stefanha@linux.vnet.ibm.com>

This patch makes iPXE work with the rtl8139 emulation. The rtl8139
driver in iPXE issues a 16bit access on the ChipCmd register
(offset 0x37) to check the status of the rx buffer. The offset of the
ioport access was getting fixed up to 0x36 in qemu, causing the value
read in iPXE to be invalid.

This fixes an issue with iPXE reporting timeouts during TFTP transfers.

Reposting this here because it is trivial enough and the original post
on qemu-devel didn't attract much attention.

Also, the inw() which was causing the issue has been replaced with an
inb() in upstream iPXE:
https://git.ipxe.org/ipxe.git/commit/91dd64ad25baa27954a7518e73df4fca8a2d0c93Signed-off-by: NJulian Pidancet <julian.pidancet@gmail.com>
Signed-off-by: NStefan Hajnoczi <stefanha@linux.vnet.ibm.com>

get_str_sep() can fail, but net_slirp_hostfwd_remove() doesn't check.
Works, because it initializes buf[] to "", which get_str_sep() doesn't
touch when it fails.  Coverity doesn't like it, and neither do I.

Change it to work exactly like slirp_hostfwd().
Acked-by: NJan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: NMarkus Armbruster <armbru@redhat.com>
Signed-off-by: NStefan Hajnoczi <stefanha@linux.vnet.ibm.com>

Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Add check for the EFD_NONBLOCK and EFD_CLOEXEC flags to the
CONFIG_EVENTFD test.
This fixes the following build failure on Fedora 9:

      CC    event_notifier.o
    event_notifier.c: In function `event_notifier_init':
    event_notifier.c:21: error: `EFD_NONBLOCK' undeclared (first use in this function)
    event_notifier.c:21: error: (Each undeclared identifier is reported only once
    event_notifier.c:21: error: for each function it appears in.)
    event_notifier.c:21: error: `EFD_CLOEXEC' undeclared (first use in this function)
    make: *** [event_notifier.o] Error 1
Reviewed-by: NStefan Hajnoczi <stefanha@linux.vnet.ibm.com>
Signed-off-by: NMax Filippov <jcmvbkbc@gmail.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Change the default on x86 Linux hosts to building PIE (position
independent executables); instead of restricting the option to
user-only targets, apply it to all targets.

In addition, set the relocation sections to read-only (relro) when
available; this reduces the attack surface by disallowing changes to
relocation tables at runtime.

While PIE reduces performance and relro increases load time, it
greatly improves security, with the potential to reduce a code
execution vulnerability to a self denial of service.

Non-x86 are not changed, as they require TCG changes; neither are
non-Linux, due to lack of test coverage.
Signed-off-by: NAvi Kivity <avi@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Ivshmem cannot work, and the command lspci cannot show ivshmem BAR2 in the guest.
As for pci_register_bar(), parameter MemoryRegion should be s->bar instead of s->ivshmem.
Reviewed-by: NAvi Kivity <avi@redhat.com>
Signed-off-by: NHongyong Zang <zanghongyong@huawei.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Check pending bit only if vector mask status changed.
This is not really important for qemu.git but helps
fix a bug in qemu-kvm.git.
Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

>From: Jan Kiszka <jan.kiszka@siemens.com>

Only accesses to the MSI-X table must trigger a call to
msix_handle_mask_update, otherwise the vector
value might be out of range.
Signed-off-by: NJan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Only go over the table when function is masked.
This is not really important for qemu.git but helps
fix a bug in qemu-kvm.git.
Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

zlib.h is not a local include file, therefore it should be included
using <> instead of "".
Signed-off-by: NStefan Weil <sw@weilnetz.de>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

AT_REMOVEDIR is not defined on all systems.  Pass the raw flags from the
9p protocol, which are always there.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Avoid a conflict on the definition of struct file_handle by
using a replacement name.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Now when you try to migrate with qed, you get:

(qemu) migrate tcp:localhost:1025
Block format 'qed' used by device 'ide0-hd0' does not support feature 'live migration'
(qemu)
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

We don't reopen the actual file, but instead invoke the close and open routines.
We specifically ignore the backing file since it's contents are read-only and
therefore immutable.
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Image files have two types of data: immutable data that describes things like
image size, backing files, etc. and mutable data that includes offset and
reference count tables.

Today, image formats aggressively cache mutable data to improve performance.  In
some cases, this happens before a guest even starts.  When dealing with live
migration, since a file is open on two machines, the caching of meta data can
lead to data corruption.

This patch addresses this by introducing a mechanism to invalidate any cached
mutable data a block driver may have which is then used by the live migration
code.

NB, this still requires coherent shared storage.  Addressing migration without
coherent shared storage (i.e. NFS) requires additional work.
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Now when you try to migrate with ivshmem, you get a proper QMP error:

(qemu) migrate tcp:localhost:1025
Migration is disabled when using feature 'peer mode' in device 'ivshmem'
(qemu)
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

This lets different subsystems register an Error that is thrown whenever
migration is attempted.  This works nicely because it gracefully supports
things like hotplug.

Right now, if multiple errors are registered, only one of them is reported.
I expect that for 1.1, we'll extend query-migrate to return all of the reasons
why migration is disabled at any given point in time.
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Commit 0c402e5a is incomplete
and misses one of the two function pointer calls in
usb_host_scan_dev().  Add the additional port handling logic
to the other call too.

Spotted by Coverity.

Cc: Markus Armbruster <armbru@redhat.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Coverity thinks q could be NULL there and warns.
I believe it can't be NULL there.
Add assert to prove it.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Until recently all scsi commands sent to scsi-disk did either transfer
data or finished instantly.  The correct implementation of
SYNCRONIZE_CACHE changed the picture though, and usb-storage needs
a fix to handle that case correctly.

Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

scsi keeps track of the tag in SCSIRequest,
no need to store a separate copy.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Put status word into device state, fill it in command_complete, have
usb_msd_send_status just send it out.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

usb_msd_send_status can be called from different code paths, move the
debug message into the function to make sure it is printed
unconditionally.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Fix obvious typos (decrement and off-by-one error) in pcmpestrm and pcmpistrm
which resulted in infinite loop. Reported by Frank Mehnert,
spotted also by Coverity (bug 84752853).
Reported-by: NFrank Mehnert <frank.mehnert@oracle.com>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

Happily passes (size_t)-1 to rom_add_blob_fixed(), which promptly dies
attempting to malloc that much.  Spotted by Coverity.

Bonus fix for ROMs larger than INT_MAX bytes: return ssize_t instead
of int.  Bug can't bite, because the only user load_aout() limits ROM
size to an int value.
Signed-off-by: NMarkus Armbruster <armbru@redhat.com>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

This patch replace the previous implementation with this simplified and
more complete version (no shutdown when psret == 1).
Signed-off-by: NFabien Chouteau <chouteau@adacore.com>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

cppcheck report:
  gdbstub.c:1781: error: Memory leak: s

Rearranging of the code avoids the leak.

v2:
Replace the g_malloc0() by g_new0() (suggested by Stuart Brady).
Signed-off-by: NStefan Weil <sw@weilnetz.de>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

In both cases, val is computed, but then not used in the
subsequent line, which then re-computes the quantity in
a different type (int32_t vs unsigned long).

Keep the computation type that's been working so far.
Signed-off-by: NRichard Henderson <rth@twiddle.net>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

* 's390-1.0' of git://repo.or.cz/qemu/agraf:
  s390x: initialize virtio dev region
  tcg: Use TCGReg for standard tcg-target entry points.
  tcg: Standardize on TCGReg as the enum for hard registers
  s390x: Add shutdown for TCG s390-virtio machine
  s390: Fix cpu shutdown for KVM
  s390: fix short kernel command lines
  s390: fix reset hypercall to reset the status
  s390x: implement SIGP restart and shutdown
  s390x: implement rrbe instruction properly
  s390x: update R and C bits in storage key
  s390x: make ipte 31-bit aware
  s390x: add ldeb instruction

* 'ppc-1.0' of git://repo.or.cz/qemu/agraf:
  pseries: Fix qdev.id handling in the VIO bus code
  pseries: Allow kernel's early debug output to work
  pseries: Default reg for vty should be SPAPR_VTY_BASE_ADDRESS
  pseries: Check we have a chardev in spapr_vty_init()
  pseries: Fix buggy spapr_vio_find_by_reg()
  pseries: Correct RAM size check for SLOF
  PPC: Fix for the gdb single step problem on an rfi instruction
  tcg-ppc64: Fix compile errors for userspace only builds with gcc 4.6
  pseries: Fix initialization of sPAPREnvironment structure