Two slightly different versions of a patch to conditionally set
VIRTIO_BLK_F_CONFIG_WCE through the "config-wce" qdev property have been
applied (ea776abc and eec7f96c).  David Gibson
<david@gibson.dropbear.id.au> noticed that the "config-wce"
property is broken as a result and fixed it recently.

The fix sets the host_features VIRTIO_BLK_F_CONFIG_WCE bit from a qdev
property.  Unfortunately, the virtio device then has no chance to test
for the presence of the feature bit during virtio_blk_init().

Therefore, reinstate the VirtIOBlkConf->config_wce flag.  Drop the
duplicate qdev property to set the host_features bit.  The
VirtIOBlkConf->config_wce flag will be used by virtio-blk-data-plane in
a later patch.
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>

The qemu_iovec_concat() function copies a subset of a QEMUIOVector.  The
new qemu_iovec_concat_iov() function does the same for a iov/cnt pair.

It is easy to define qemu_iovec_concat() in terms of
qemu_iovec_concat_iov().  The existing code is mostly unchanged, except
for the assertion src->size >= soffset, which cannot be efficiently
checked upfront on a iov/cnt pair.  Instead we assert upon hitting the
end of src with an unsatisfied soffset.
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>

Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>

The iov_discard_front/back() functions remove data from the front or
back of the vector.  This is useful when peeling off header/footer
structs.
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>

The IOQueue has a pool of iocb structs and a function to add new
read/write requests.  Multiple requests can be added before calling the
submit function to actually tell the host kernel to begin I/O.  This
allows callers to batch requests and submit them in one go.

The actual I/O is performed using Linux AIO.
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>

Outside the safety of the global mutex we need to poll on file
descriptors.  I found epoll(2) is a convenient way to do that, although
other options could replace this module in the future (such as an
AioContext-based loop or glib's GMainLoop).

One important feature of this small event loop implementation is that
the loop can be terminated in a thread-safe way.  This allows QEMU to
stop the data plane thread cleanly.
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>

The virtio-blk-data-plane cannot access memory using the usual QEMU
functions since it executes outside the global mutex and the memory APIs
are this time are not thread-safe.

This patch introduces a virtqueue module based on the kernel's vhost
vring code.  The trick is that we map guest memory ahead of time and
access it cheaply outside the global mutex.

Once the hardware emulation code can execute outside the global mutex it
will be possible to drop this code.
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>

The data plane thread needs to map guest physical addresses to host
pointers.  Normally this is done with cpu_physical_memory_map() but the
function assumes the global mutex is held.  The data plane thread does
not touch the global mutex and therefore needs a thread-safe memory
mapping mechanism.

Hostmem registers a MemoryListener similar to how vhost collects and
pushes memory region information into the kernel.  There is a
fine-grained lock on the regions list which is held during lookup and
when installing a new regions list.

When the physical memory map changes the MemoryListener callbacks are
invoked.  They build up a new list of memory regions which is finally
installed when the list has been completed.
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>

The virtio-blk-data-plane feature only works with Linux AIO.  Therefore
add a ./configure option and necessary checks to implement this
dependency.
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>

The raw_get_aio_fd() function allows virtio-blk-data-plane to get the
file descriptor of a raw image file with Linux AIO enabled.  This
interface is really a layering violation that can be resolved once the
block layer is able to run outside the global mutex - at that point
virtio-blk-data-plane will switch from custom Linux AIO code to using
the block layer.
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>

There are several ARM and MIPS boards which are manufactured with
either Intel (pflash_cfi01.c) or AMD (pflash_cfi02.c) flash memory.

The Linux kernel supports both and first probes for AMD flash which
resulted in one or two warnings from the Intel flash emulation:

pflash_write: Unimplemented flash cmd sequence (offset 0000000000000000, wcycle 0x0 cmd 0x0 value 0xf000f0)
pflash_write: Unimplemented flash cmd sequence (offset 0000000000000000, wcycle 0x0 cmd 0x0 value 0xf0)

These warnings confuse users, so suppress them.
Signed-off-by: NStefan Weil <sw@weilnetz.de>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

  From the discussion on the ML [1], the exception limit defined by
magic number 0x100 is actually EXCP_SC defined in cpu.h. Replace the
magic number with EXCP_SC. Remove "#if 1 .. #endif" as well.

[1] http://lists.gnu.org/archive/html/qemu-devel/2012-11/msg03080.htmlSigned-off-by: NChen Wei-Ren <chenwj@iis.sinica.edu.tw>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

The immediate value is 9bits, should sign-extend to 16bits. The return value to
register should sign-extend to target_long, as Richard says, removing an
unnecessary cast works fun.
Signed-off-by: NDongxue Zhang <elta.era@gmail.com>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

Fix my email address, last time it's wrong.
Signed-off-by: NDongxue Zhang <elta.era@gmail.com>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

Macro RESTORE_FLUSH_MODE is similar to RESTORE_ROUNDING_MODE
but included a semicolon.

The code which uses that macro also includes a semicolon,
so the result was an empty statement.

Remove the superfluous semicolon from the macro definition.
Signed-off-by: NStefan Weil <sw@weilnetz.de>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

The change removes some unnecessary and incorrect code for EXTR_S.H.
Further, it corrects the mask for shift value in the EXTR_ instructions. It also
extends the existing tests so they trigger the issues corrected with the change.
Signed-off-by: NPetar Jovanovic <petarj@mips.com>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

Upper 4 bits of ccond (bits 31..28 ) of DSPControl register are not used in
the MIPS32 architecture. They are used in the MIPS64 architecture. For MIPS32
these bits must be written as zero, and return zero on read.

The change fixes writes (WRDSP) and reads (RDDSP) to the register. It also fixes
the tests that use these instructions, and makes them smaller and simpler.
Signed-off-by: NPetar Jovanovic <petarj@mips.com>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

As reported in bug 1087114 the semaphores fallback code is broken which
results in QEMU crashing and making QEMU unusable.

This patch is from Paolo.

This needs to be back ported to the 1.3 stable tree as well.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NBrad Smith <brad@comstyle.com>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

Reported-by: NStuart Brady <sdb@zubnet.me.uk>
Signed-off-by: NRichard Henderson <rth@twiddle.net>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

Existing compile-time detection is spotty at best.  Convert
it all to runtime detection instead.
Signed-off-by: NRichard Henderson <rth@twiddle.net>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

Cc: Aurelien Jarno <aurelien@aurel32.net>
Signed-off-by: NRichard Henderson <rth@twiddle.net>
Reviewed-by: NAndreas Färber <afaerber@suse.de>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

Disable the semaphores fallback code for OpenBSD as modern OpenBSD
releases now have sem_timedwait().
Signed-off-by: NBrad Smith <brad@comstyle.com>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

Broken since:

commit 927d4878
Author: Paolo Bonzini <pbonzini@redhat.com>
Date:   Mon Dec 17 18:20:05 2012 +0100

    softmmu: move remaining include files to include/ subdirectories
Signed-off-by: NAlon Levy <alevy@redhat.com>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

* 'qom-cpu' of git://repo.or.cz/qemu/afaerber:
  MAINTAINERS: Include X86CPU in CPU maintenance area
  cpu: Move kvm_run into CPUState
  cpu: Move kvm_state field into CPUState
  ppc_booke: Pass PowerPCCPU to ppc_booke_timers_init()
  ppc4xx_devs: Return PowerPCCPU from ppc4xx_init()
  ppc_booke: Pass PowerPCCPU to {decr,fit,wdt} timer callbacks
  ppc: Pass PowerPCCPU to [h]decr timer callbacks
  ppc: Pass PowerPCCPU to [h]decr callbacks
  ppc: Pass PowerPCCPU to ppc_set_irq()
  kvm: Pass CPUState to kvm_vcpu_ioctl()
  kvm: Pass CPUState to kvm_arch_*
  cpu: Move kvm_fd into CPUState
  qdev-properties.c: Separate core from the code used only by qemu-system-*
  qdev: Coding style fixes
  cpu: Introduce CPUListState struct
  target-alpha: Add support for -cpu ?
  target-alpha: Turn CPU definitions into subclasses
  target-alpha: Avoid leaking the alarm timer over reset
  alpha: Pass AlphaCPU array to Typhoon
  target-alpha: Let cpu_alpha_init() return AlphaCPU

Replace Avi with myself as kvm maintainer.
Signed-off-by: NGleb Natapov <gleb@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

When we build neither any system emulation targets nor the tools there
is actually no need for pixman library.  In that case do not enforce
presence of that library on the system.
Reviewed-by: NAndreas F=E4rber <afaerber@suse.de>
Signed-off-by: NRobert Schiele <rschiele@gmail.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

* Define enum for TMP105 registers
* Move tmp105_set() from I2C to TMP105 header
* Document units and range of temperature as preconditions
Reviewed-by: NAndreas Färber <afaerber@suse.de>
Signed-off-by: NAlex Horn <alex.horn@cs.ox.ac.uk>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Reviewed-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NLluís Vilanova <vilanova@ac.upc.edu>
--
Changes in v2:

* Do not depend on "qemu-timer-common.o".
* Use "$(obj)" in rules to refer to the build sub-directory.
* Remove dependencies against "$(GENERATED_HEADERS)".

Cc: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

We already depend on working __thread support for coroutines, so this
complication here is no longer needed.
Reviewed-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NJan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

This fixes a subtle bug. A bug that probably won't cause trouble for any
existing OS, but a bug anyway:

Intel SDM Volume 2, CPUID Instruction states:

> Two types of information are returned: basic and extended function
> information. If a value entered for CPUID.EAX is higher than the maximum
> input value for basic or extended function for that processor then the
> data for the highest basic information leaf is returned. For example,
> using the Intel Core i7 processor, the following is true:
>
>   CPUID.EAX = 05H (* Returns MONITOR/MWAIT leaf. *)
>   CPUID.EAX = 0AH (* Returns Architectural Performance Monitoring leaf. *)
>   CPUID.EAX = 0BH (* Returns Extended Topology Enumeration leaf. *)
>   CPUID.EAX = 0CH (* INVALID: Returns the same information as CPUID.EAX = 0BH. *)
>   CPUID.EAX = 80000008H (* Returns linear/physical address size data. *)
>   CPUID.EAX = 8000000AH (* INVALID: Returns same information as CPUID.EAX = 0BH. *)

AMD's CPUID Specification, on the other hand, is less specific:

> The CPUID instruction supports two sets or ranges of functions,
> standard and extended.
>
> • The smallest function number of the standard function range is
>   Fn0000_0000. The largest function num- ber of the standard function
>   range, for a particular implementation, is returned in CPUID
>   Fn0000_0000_EAX.
>
> • The smallest function number of the extended function range is
>   Fn8000_0000. The largest function num- ber of the extended function
>   range, for a particular implementation, is returned in CPUID
>   Fn8000_0000_EAX.
>
> Functions that are neither standard nor extended are undefined and
> should not be relied upon.

QEMU's behavior matched Intel's specification before, but this was
changed by commit b3baa152. This patch
restores the behavior documented by Intel when cpuid_xlevel2 is 0.

The existing behavior when cpuid_xlevel2 is set (falling back to
level=cpuid_xlevel) is being kept, as I couldn't find any public
documentation on the CPUID 0xC0000000 function range on Centaur CPUs.
Signed-off-by: NEduardo Habkost <ehabkost@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Changes since V1:
  - Avoid crashing since qemu_opts_id() may return null on some
    systems according to Markus's suggestion.

When controlling a qemu instance from another program, it's
hard to know which serial port or monitor device is redirected
to which pty. With more than one device using "pty" a lot of
guesswork is involved.

$ ./x86_64-softmmu/qemu-system-x86_64 -serial pty -serial pty -monitor pty
char device redirected to /dev/pts/5
char device redirected to /dev/pts/6
char device redirected to /dev/pts/7

Although we can find out what everything else is connected to
by the "info chardev" with "-monitor stdio" in the command line,
It'd be very useful to be able to have qemu inherit pseudo-tty
file descriptors so they could just be specified on the command
line like:

$ ./x86_64-softmmu/qemu-system-x86_64 -serial pty -serial pty -monitor pty
char device compat_monitor0 redirected to /dev/pts/5
char device serial0 redirected to /dev/pts/6
char device serial1 redirected to /dev/pts/7

Referred link: https://bugs.launchpad.net/qemu/+bug/938552Signed-off-by: NLei Li <lilei@linux.vnet.ibm.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Adapt header include paths.
Signed-off-by: NAndreas Färber <afaerber@suse.de>

Zero out tcg_ctx.gen_opc_instr_start for instructions representing the
last guest opcode in the TB.

Cc: qemu-stable@nongnu.org
Signed-off-by: NMax Filippov <jcmvbkbc@gmail.com>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

To fix building error:

CC    net/vde.o
net/vde.c: In function ‘vde_cleanup’:
net/vde.c:65:5: error: implicit declaration of function ‘qemu_set_fd_handler’ [-Werror=implicit-function-declaration]
net/vde.c:65:5: error: nested extern declaration of ‘qemu_set_fd_handler’ [-Werror=nested-externs]
cc1: all warnings being treated as errors
Signed-off-by: NLiming Wang <walimisdev@gmail.com>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

  When tb_remove was first commited at fd6ce8f6, there were three different
calls pass different names to offsetof. In current codebase, the other two
calls are replaced with tb_page_remove. There is no need to have a general
tb_remove. Omit passing the third parameter and using tb1->phys_hash_next
directly.
Signed-off-by: NChen Wei-Ren <chenwj@iis.sinica.edu.tw>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

These and some more compiler warnings were caused by a recent commit:

net/tap-win32.c:724: warning: no previous prototype for ‘tap_has_ufo’
net/tap-win32.c:729: warning: no previous prototype for ‘tap_has_vnet_hdr’
...
Signed-off-by: NStefan Weil <sw@weilnetz.de>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

xen-all needs to access CharDeviceState's filename field, so
it needs to include char/char.h.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Tested-by: NAndreas Färber <afaerber@suse.de>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

vnc-tls.h is included by vnc.h, and it includes gnutls/gnutls.h.
Hence, GnuTLS header files are needed by all files that include
vnc.h, most notably qmp.c.  Move these flags to QEMU_CFLAGS for
simplicity.
Reported-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

* quintela/thread-20121220.next: (79 commits)
  migration: merge QEMUFileBuffered into MigrationState
  migration: fix qemu_get_fd for BufferedFile
  ram: refactor ram_save_block() return value
  ram: account the amount of transferred ram better
  ram: optimize migration bitmap walking
  ram: Use memory_region_test_and_clear_dirty
  memory: introduce memory_region_test_and_clear_dirty
  ram: Add last_sent_block
  ram: rename last_block to last_seen_block
  migration: move migration notifier
  migration: Inline qemu_fopen_ops_buffered into migrate_fd_connect
  migration: move migration_fd_put_ready()
  migration: add XFER_LIMIT_RATIO
  migration: move buffered_file.c code into migration.c
  savevm: New save live migration method: pending
  buffered_file: unfold buffered_append in buffered_put_buffer
  buffered_file: don't flush on put buffer
  buffered_file: Unfold the trick to restart generating migration data
  migration: just lock migrate_fd_put_ready
  migration: remove unfreeze logic
  ...
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Avoid splitting the state of outgoing migration, more or less arbitrarily,
between two data structures.  QEMUFileBuffered anyway is used only during
migration.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NJuan Quintela <quintela@redhat.com>