* kraxel/usb.73:
  ehci-sysbus: Attach DMA context.
  usb: fail usbdevice_create() when there is no USB bus
  usb: tag usb host adapters as not hotpluggable.
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

* qmp/queue/qmp:
  qapi: fix qapi_dealloc_type_size parameter type
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

This reverts commit 456a84d1.

This patch wasn't submitted to the list and did not get Acked by other
copyright holders in the file.
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

This reverts commit 72bc6f1b.

This patch wasn't submitted to the list and did not get Acked by other
copyright holders in the file.
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

The e801 memory sizes in the multiboot structures hard-code the available
low memory to 640.  However, the value should not include the size of the
EBDA.  Fill the value in the option ROM, getting the size of low memory
from the BIOS.

Cc: Alexander Graf <agraf@suse.de>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

According to the bug 855162[0] - there's the need of adding new syscalls
to the whitelist when using Qemu with Libvirt.

[0] - https://bugzilla.redhat.com/show_bug.cgi?id=855162Reported-by: NPaul Moore <pmoore@redhat.com>
Tested-by: NPaul Moore <pmoore@redhat.com>
Signed-off-by: NEduardo Otubo <otubo@linux.vnet.ibm.com>
Signed-off-by: NCorey Bryant <coreyb@linux.vnet.ibm.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Commit 0d8d7690 introduced
a regression in virtio-net performance because it looks
into the ring aggressively while we really only care
about a single packet worth of buffers.
Reported as bugzilla 1066055 in launchpad.

To fix, add parameters limiting lookahead, and
use in virtqueue_avail_bytes.
Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>
Reported-by: NEdivaldo de Araujo Pereira <edivaldoapereira@yahoo.com.br>
Tested-by: NEdivaldo de Araujo Pereira <edivaldoapereira@yahoo.com.br>
Reviewed-by: NStefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Debug option is available since QEMU-1.2; FP coprocessor and
coprocessor context is available since QEMU-1.3.
Signed-off-by: NMax Filippov <jcmvbkbc@gmail.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

We are currently checking for an exact type match.  Use QOM dynamic_cast to
check for a compatible type instead.

Cc: Konrad Frederic <fred.konrad@greensocs.com>
Cc: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>
---
v1 -> v2:
 - also add cast to qbus_find_recursive (Peter)
 - simplify by doing object_dynamic_cast instead of messing with classes

The second parameter to qapi_dealloc_type_size should be a uint64_t *,
not a size_t *. This was causing our 32 bit x86 build to fail, since
warnings are treated as errors.
Signed-off-by: NBruce Rogers <brogers@suse.com>
Reviewed-by: NMichael Roth <mdroth@linux.vnet.ibm.com>
Reviewed-by: NStefan Weil <sw@weilnetz.de>
Signed-off-by: NLuiz Capitulino <lcapitulino@redhat.com>

This was left as NULL on the initial merge due to debate on the mailing list on
how to handle DMA contexts for sysbus devices. Patch
9e11908f was later merged to fix OHCI. This is the,
equivalent fix for sysbus EHCI.
Signed-off-by: NPeter Crosthwaite <peter.crosthwaite@xilinx.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Report an error instead of segfaulting when attaching a USB device to a
machine with no USB busses:

  $ qemu-system-arm -machine vexpress-a9 \
      -sd Fedora-17-armhfp-vexpress-mmcblk0.img \
      -kernel vmlinuz-3.4.2-3.fc17.armv7hl \
      -initrd initramfs-3.4.2-3.fc17.armv7hl.img \
      -usbdevice disk:format=raw:test.img

Note that the vexpress-a9 machine does not have a USB host controller.
Reported-by: NDavid Abdurachmanov <David.Abdurachmanov@cern.ch>
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Hotplugging them simply doesn't work, so tag them accordingly to
avoid users trying and then crashing qemu.

For xhci there is nothing fundamental which prevents hotplug from
working, we'll "only" need a exit() function which cleans up
everything properly.  That isn't for 1.3 though.

For ehci+uhci+ohci hotplug can't be supported until qemu gains the
capability to hotplug multifunction pci devices.

https://bugzilla.redhat.com/show_bug.cgi?id=879096Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

The event notifier state is only reset by test_and_clear. But we created
the windows event object with auto-reset, which subtly swallowed events.
Reviewed-by: NStefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: NJan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

* bonzini/nbd-next:
  nbd-server-add: Fix the default for 'writable'
  nbd: fix use of two uninitialized bytes when connecting to a named export
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

* bonzini/scsi-next:
  virtio-scsi: Fix subtle (guest) endian bug
  virtio-scsi: Fix some endian bugs with virtio-scsi
  iscsi: do not assume device is zero initialized
  iscsi: fix deadlock during login
  iscsi: fix segfault in url parsing
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

* agraf/s390-for-upstream-1.3:
  sclp: Fix uninitialized var in handle_write_event_buf().
  s390: Fix ram_size updating in machine init
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

* agraf/ppc-for-upstream-1.3:
  fbdev: fix pixman compile on old pixman
  vl.c: Fix broken -usb option
  pseries: Fix bug in PCI MSI allocation
  kvm: fix incorrect length in a loop over kvm dirty pages map
  PPC: Fix missing TRACE exception
  hw/ide/macio: Fix segfault caused by NULL DMAContext*
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

* afaerber/qom-cpu-1.3:
  target-i386: Enable SSSE3 TCG support
  target-i386/cpu: Add missing flags to Haswell CPU model
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

These versions of GCC require insane (>2GB) amounts of memory to compile
translate.o.  As a countermeasure, disable the culprit optimization pass.
This should fix the buildbot failure for default_x86_64_fedora16.  Anyway
this is a good thing to do because people will try to compile 1.3 with
less than 2GB of memory and complain.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

The virtio-scsi config space is, by specification, in guest endian (which
is ill-defined, but there you go).  In virtio_scsi_get_config() we set up
all the fields in there, using stl_raw().  Which is a problem for the
max_channel and max_target fields, which are 16-bit, not 32-bit.  For
little-endian targets we get away with it by accident, since the first
two bytes will still be correct, and the extra two bytes written (with
zeroes) will be overwritten correctly by the next store.

But for big-endian guests, this means the max_target field ends up as zero,
which means the guest will only recognize a single disk on the virtio-scsi
bus.  This patch fixes the problem.

Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Paul 'Rusty' Russell <rusty@rustcorp.com.au>
Signed-off-by: NDavid Gibson <david@gibson.dropbear.id.au>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

The virtio-scsi specification does not specify the correct endianness for
fields in the request structure.  It's therefore best to assume that it is
"guest native" endian since that's the (stupid and poorly defined) norm in
virtio.

However, the qemu device for virtio-scsi has no byteswaps at all, and so
will break if the guest has different endianness from the host.  This patch
fixes it by adding tswap() calls for the sense_len and resid fields in
the request structure.  In theory status_qualifier needs swaps as well,
but that field is never actually touched.  The tag field is a uint64_t, but
since its value is completely arbitrary, it might as well be uint8_t[8]
and so it does not need swapping.

Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Paul 'Rusty' Russell <rusty@rustcorp.com.au>
Signed-off-by: NDavid Gibson <david@gibson.dropbear.id.au>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

Without any complex checks we can't assume that an
iscsi target is initialized to zero.
Signed-off-by: NPeter Lieven <pl@kamp.de>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

If the connection is interrupted before the first login is successfully
completed qemu-kvm is waiting forever in qemu_aio_wait().

This is fixed by performing an sync login to the target. If the
connection breaks after the first successful login errors are
handled internally by libiscsi.
Signed-off-by: NPeter Lieven <pl@kamp.de>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

If an invalid URL is specified iscsi_get_error(iscsi) is called
with iscsi == NULL.
Signed-off-by: NPeter Lieven <pl@kamp.de>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

The documentation to this monitor command tells, that 'writable'
argument is optional and defaults to false. However, the code sets
true as the default. But since some applications may already been
using this, it's safer to fix the code and not documentation which
would break those applications.
Signed-off-by: NMichal Privoznik <mprivozn@redhat.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

Reported-by: NMichal Privoznik <mprivoznik@redhat.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

This bug occurs when the SET flag of Register B is enabled. When an RTC
data register (i.e. any of the ten time/calender CMOS bytes) is set, the
data is (as expected) correctly stored in the cmos_data array. However,
since the SET flag is enabled, the function rtc_set_time is not invoked.
As a result, the field base_rtc in RTCState remains uninitialized. This
causes a problem on subsequent writes which can end up overwriting data.
To see this, consider writing data to Register A after having written
data to any of the RTC data registers; the following figure illustrates
the call stack for the Register A write operation:

 +- cmos_io_port_write
 +-- check_update_timer
 +---- get_next_alarm
 +------ rtc_update_time

In rtc_update_time, get_guest_rtc calculates the wrong time and
overwrites the previously written RTC data register values.
Signed-off-by: NAlex Horn <alex.horn@cs.ox.ac.uk>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

g_assert_cmpint is not available on glib 2.12, which is the minimum
version required to build QEMU (we only require 2.16 to run tests,
since that is the first version including GTester).  Do not use it
in hardware models, use a normal assertion instead.

This fixes the buildbot failure for default_x86_64_rhel5.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

The cancellation test is failing on the buildbots.  While the failure
merits a little more investigation to understand what is going on,
the logs show that the failure is not impacting the coverage
provided by the test.  Hence, loosen a bit the assertions in a
way that should let the test proceed and hopefully pass.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Fix typos, whitespace and update comments to match current
implementation.
Signed-off-by: NAmit Shah <amit.shah@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Disable the rate-limit timer on device remove (e.g. hot-unplug).
Signed-off-by: NAmit Shah <amit.shah@redhat.com>
Reviewed-by: NAnthony Liguori <aliguori@us.ibm.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

If we got fewer bytes from the backend than requested, don't poke the
backend for more bytes; the guest will ask for more (or if the guest has
already asked for more, the backend knows about it via handle_input()).
Signed-off-by: NAmit Shah <amit.shah@redhat.com>
Reviewed-by: NAnthony Liguori <aliguori@us.ibm.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Popping an elem from the vq just to find out its length causes problems
with save/load later on.  Use the new virtqueue_get_avail_bytes()
function instead, saves us the complexity in the migration code, as well
as makes the migration endian-safe.
Signed-off-by: NAmit Shah <amit.shah@redhat.com>
Reviewed-by: NAnthony Liguori <aliguori@us.ibm.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

It used a wrong struct type name since its introduction in
8f04ee08 (isa: pic: convert to QEMU
Object Model), apparently it is unused so far.
Signed-off-by: NAndreas Färber <afaerber@suse.de>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

visit_type_size() requires either visitor->type_size() or
visitor_uint64() to be implemented, otherwise a NULL function pointer is
invoked.

It is possible to trigger this crash as follows:

  $ qemu-system-x86_64 -netdev tap,sndbuf=0,id=netdev0 \
                       -device virtio-blk-pci,netdev=netdev0

The 'sndbuf' option has type "size".
Reviewed-by: NAndreas Färber <afaerber@suse.de>
Reviewed-by: NMichael Roth <mdroth@linux.vnet.ibm.com>
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

When adding the Haswell CPU model, I intended to make it a superset of the
features present on the SandyBridge model, but I have removed the SEP and
RDTSCP features from the feature list by mistake. This patch adds the missing
SEP and RDTSCP features (that are present on SandyBridge) to Haswell.
Reported-by: NMartin Kletzander <mkletzan@redhat.com>
Acked-by: NAndreas Färber <afaerber@suse.de>
Signed-off-by: NEduardo Habkost <ehabkost@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Commit 094b287f accidentally broke the "-usb" command line
option, so it would have no effect if the user had not specified
any machine options at that point. (the return value from
'qemu_opts_find(qemu_find_opts("machine"), 0);' is NULL if there
are no user specified options, so it is only to be used for
looking up an option, not when trying to set one.) Similarly,
would '-usbdevice' no longer cause USB to default to enabled.

Fix this regression by using the same style of code for forcing
the usb=on machine option that we use for other aliases such as
'-enable-kvm'.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

It is not used anymore, and there is no need to make it public.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>