* bonzini/scsi-next:
  scsi: add support for ATA_PASSTHROUGH_xx scsi command
  esp: add missing const on TypeInfo structures
  esp: enable for all PCI machines
  Revert "megasas: disable due to build breakage"
  megasas: static SAS addresses
  scsi-disk: fix compilation with DEBUG_SCSI
  megasas: Update function megasys_scsi_uninit
  SCSI: STARTSTOPUNIT only eject/load media if powercondition is 0
  SCSI: Update the sense code for PREVENT REMOVAL errors

Correct the command names of opcode 0x85 and 0xa1, and calculate
their xfer size from CDB.
Signed-off-by: NCong Meng <mc@linux.vnet.ibm.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

FIPS 140-2 requires disabling certain ciphers, including DES, which is used
by VNC to obscure passwords when they are sent over the network.  The
solution for FIPS users is to disable the use of VNC password auth when the
host system is operating in FIPS compliance mode and the user has specified
'-enable-fips' on the QEMU command line.

This patch causes QEMU to emit a message to stderr when the host system is
running in FIPS mode and a VNC password was specified on the commend line.
If the system is not running in FIPS mode, or is running in FIPS mode but
VNC password authentication was not requested, QEMU operates normally.
Signed-off-by: NPaul Moore <pmoore@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

* qmp/queue/qmp:
  hmp: show the backing file depth
  block: Use bdrv_get_backing_file_depth()
  block: create bdrv_get_backing_file_depth()
  qapi: qapi.py: allow the "'" character to be escaped

* afaerber-or/qom-cpu-4:
  cpu: Move thread_kicked to CPUState
  cpu: Move thread field into CPUState
  cpu: Move CPU_COMMON_THREAD into CPUState
  qemu-thread: Let qemu_thread_is_self() return bool

* sstabellini/xen-fixes-20120801:
  fix Xen compilation
  configure: Fix xen probe with Xen 4.2 and later

* stefanha/net:
  net: add the support for -netdev socket, listen
  net: fix the coding style
  hub: add the support for hub own flow control
  net: determine if packets can be sent before net queue deliver packets
  net: cleanup deliver/deliver_iov func pointers
  net: Make "info network" output more readable info
  net: Rename qemu_del_vlan_client() to qemu_del_net_client()
  net: Rename vc local variables to nc
  net: Rename VLANClientState to NetClientState
  net: Rename non_vlan_clients to net_clients
  net: Remove VLANState
  net: Remove vlan code from net.c
  net: Convert qdev_prop_vlan to peer with hub
  net: Drop vlan argument to qemu_new_net_client()
  hub: Check that hubs are configured correctly
  net: Look up 'vlan' net clients using hubs
  net: Use hubs for the vlan feature
  net: Add a hub net client
  net: Add interface to bridge when SIOCBRADDIF isn't available

* stefanha/trivial-patches:
  exec.c: Remove out of date comment
  exec.c: Use subpages for large unaligned mappings
  exec.c: Fix off-by-one error in register_subpage
  socket: clean up redundant assignment
  qom: Clean libuser object and dependency files
  usb: Clean common object and dependency files

* aneesh/for-upstream:
  hw/9pfs: Fix assert when disabling migration
  configure: Fix build with capabilities

Remove an out of date comment: this comment used to be attached to
cpu_register_physical_memory_log(), before commit 0f0cb164 accidentally
inserted a couple of other functions between the comment and its function.
It is in any case obsolete since (a) the function arguments it refers
to have been replaced with a single MemoryRegionSection* argument and
(b) the inability to handle regions whose offset_within_address_space
and offset_within_region aren't equally aligned was fixed as part of
the rewrite of this code.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NStefan Hajnoczi <stefanha@linux.vnet.ibm.com>

Registering a multi-page memory region that is non-page-aligned results
in a subpage from the start to the page boundary, some number of full
pages, and possibly another subpage from the last page boundary to the
end. The full pages will have a value for offset_within_region that is
not a multiple of TARGET_PAGE_SIZE. Accesses through softmmu are unable
to handle this and will segfault.

Handling full pages through subpages is not optimal, but only
non-page-aligned mappings take the penalty.
Signed-off-by: NTyler Hall <tylerwhall@gmail.com>
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Reviewed-by: NAvi Kivity <avi@redhat.com>
Signed-off-by: NStefan Hajnoczi <stefanha@linux.vnet.ibm.com>

subpage_register() expects "end" to be the last byte in the mapping.
Registering a non-page-aligned memory region that extends up to or
beyond a page boundary causes subpage_register() to silently fail
through the (end >= PAGE_SIZE) check.

This bug does not cause noticeable problems for mappings that do not
extend to a page boundary, though they do register an extra byte.
Signed-off-by: NTyler Hall <tylerwhall@gmail.com>
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Reviewed-by: NAvi Kivity <avi@redhat.com>
Signed-off-by: NStefan Hajnoczi <stefanha@linux.vnet.ibm.com>

Signed-off-by: NAmos Kong <akong@redhat.com>
Signed-off-by: NStefan Hajnoczi <stefanha@linux.vnet.ibm.com>

Signed-off-by: NBenoit Canet <benoit@irqsave.net>
Reviewed-by: NEric Blake <eblake@redhat.com>
Signed-off-by: NLuiz Capitulino <lcapitulino@redhat.com>

Use the dedicated counting function in qmp_query_block in order to
propagate the backing file depth to HMP and add backing_file_depth
to qmp-commands.hx
Signed-off-by: NBenoit Canet <benoit@irqsave.net>
Reviewed-by: NEric Blake <eblake@redhat.com>
Signed-off-by: NLuiz Capitulino <lcapitulino@redhat.com>

Create bdrv_get_backing_file_depth() in order to be able to show
in QMP and HMP how many ancestors backing an image a block device
have.
Signed-off-by: NBenoit Canet <benoit@irqsave.net>
Reviewed-by: NEric Blake <eblake@redhat.com>
Signed-off-by: NLuiz Capitulino <lcapitulino@redhat.com>

Signed-off-by: NJan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: NStefan Hajnoczi <stefanha@linux.vnet.ibm.com>

Signed-off-by: NJan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: NStefan Hajnoczi <stefanha@linux.vnet.ibm.com>

Signed-off-by: NHervé Poussineau <hpoussin@reactos.org>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

This reverts commit 92336855.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

This patch introduces a new property 'sas_address' which
allows the user to specify the SAS address for the HBA.
The default address is following the NAA locally assigned
identifier format with the locally assigned address
0x525400 as used eg for the MAC addresses.
The lower bytes are set to the pci address which
will ensure uniqueness for the local machine.

The port addresses are now calculated based on the magic
number 0x1221 (which is found in real hardware, too) plus
the device number.
Signed-off-by: NHannes Reinecke <hare@suse.de>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Andreas Faerber <afaerber@suse.de>
Cc: Anthony Liguori <anthony@codemonkey.ws>
Cc: Alexander Graf <agraf@suse.de>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

Reported-by: NGerhard Wiesinger <lists@wiesinger.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

Commit f90c2bcd changed
PCIUnregisterFunc, therefore the function prototype
needs an update.

megasas.o is currently not linked, so this bug was not
detected by the buildbots.
Signed-off-by: NStefan Weil <sw@weilnetz.de>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

The START STOP UNIT command will only eject/load media if
power condition is zero.

If power condition is !0 then LOEJ and START will be ignored.

From MMC (sbc contains similar wordings too)
  The Power Conditions field requests the block device to be placed
  in the power condition defined in
  Table 558. If this field has a value other than 0h then the Start
  and LoEj bits shall be ignored.
Signed-off-by: NRonnie Sahlberg <ronniesahlberg@gmail.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

Change the sense codes for failures to eject a device that is locked
by PREVENT_ALLOW_MEDIUM_REMOVAL from
the generic MEDIA_LOAD_OR_EJECT_FAILED to the more specific
MEDIUM_REMOVAL_PREVENTED.

The second sense code is more accurate, and is also listed in MMC annex F
for the recommended sense codes for MMC devices while the first sense code is not.
Signed-off-by: NRonnie Sahlberg <ronniesahlberg@gmail.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

For command line options which permit '?' meaning 'please list the
permitted values', add support for 'help' as a synonym, by abstracting
the check out into a helper function.

This change means that in some cases where we were being lazy in
our string parsing, "?junk" will now be rejected as an invalid option
rather than being (undocumentedly) treated the same way as "?".

Update the documentation to use 'help' rather than '?', since '?'
is a shell metacharacter and thus prone to fail confusingly if there
is a single character filename in the current working directory and
the '?' has not been escaped. It's therefore better to steer users
towards 'help', though '?' is retained for backwards compatibility.

We do not, however, update the output of the system emulator's -help
(or any documentation autogenerated from the qemu-options.hx which
is the source of the -help text) because libvirt parses our -help
output and will break. At a later date when QEMU provides a better
interface so libvirt can avoid having to do this, we can update the
-help text too.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Change field type to bool.
Signed-off-by: NAndreas Färber <afaerber@suse.de>

Signed-off-by: NAndreas Färber <afaerber@suse.de>

CPU_COMMON_THREAD was only used for Windows, adding an hThread field
to CPU_COMMON.

Move the field into QOM CPUState and change its type to HANDLE,
which it is assigned from. This requires Windows headers, pulled in
through qemu-thread.h.
Signed-off-by: NAndreas Färber <afaerber@suse.de>

qemu_cpu_is_self(), passing the return value through, will later be
adapted to return bool as well.
Signed-off-by: NAndreas Färber <afaerber@suse.de>
Reviewed-by: NStefan Weil <sw@weilnetz.de>

Support escaping the escape character, and make more robust (don't die
for '', handle ' without matching '.
Signed-off-by: NMarkus Armbruster <armbru@redhat.com>
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NLuiz Capitulino <lcapitulino@redhat.com>

glibc 2.16 will remove the undocumented definition of 'struct siginfo'
from <bits/siginfo.h>.

This change is already present in glibc 2.15.90, so qemu compilation
of certain targets (eg. cris-user) breaks.

This struct was always typedef'd to be the same as 'siginfo_t' which
is what POSIX documents, so use that instead.
Signed-off-by: NRichard W.M. Jones <rjones@redhat.com>
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Moving reset callback into cpu object from board level and
resetting cpu at the end of x86_cpu_realize() will allow properly
create cpu object during run-time (hotplug) without calling reset externaly.

When reset over QOM hierarchy is implemented, reset callback
should be removed.

v2:
  - leave cpu_reset in pc_new_cpu() for now, it's to be cleaned up when APIC
    init is moved in cpu.c
Signed-off-by: NIgor Mammedov <imammedo@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

MP initialization protocol differs between cpu families, and for P6 and
onward models it is up to CPU to decide if it will be BSP using this
protocol, so try to model this. However there is no point in implementing
MP initialization protocol in qemu. Thus first CPU is always marked as BSP.

This patch:
 - moves decision to designate BSP from board into cpu, making cpu
self-sufficient in this regard. Later it will allow to cleanup hw/pc.c
and remove cpu_reset and wrappers from there.
 - stores flag that CPU is BSP in IA32_APIC_BASE to model behavior
described in Inted SDM vol 3a part 1 chapter 8.4.1
 - uses MSR_IA32_APICBASE_BSP flag in apic_base for checking if cpu is BSP

patch is based on Jan Kiszka's proposal:
    http://thread.gmane.org/gmane.comp.emulators.qemu/100806Signed-off-by: NIgor Mammedov <imammedo@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

xen_pt_unregister_device is used as PCIUnregisterFunc, so it should
match the type.
Signed-off-by: NStefano Stabellini <stefano.stabellini@eu.citrix.com>
Tested-by: NAndreas Färber <afaerber@suse.de>

xen_pt_unregister_device is used as PCIUnregisterFunc, so it should
match the type.
Signed-off-by: NStefano Stabellini <stefano.stabellini@eu.citrix.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

The xs.h header is now deprecated and produces a warning. This prevents the
configure script from enabling Xen with xen-unstable whom will become 4.2. As
this header is not anymore common to every version of Xen, we just remove it
from the early probe for Xen.
Signed-off-by: NAnthony PERARD <anthony.perard@citrix.com>
Acked-by: NStefano Stabellini <stefano.stabellini@eu.citrix.com>

The -net socket,listen option does not work with the newer -netdev
syntax:
 http://lists.gnu.org/archive/html/qemu-devel/2011-11/msg01508.html

This patch makes it work now.

For the case where one vlan has multiple listenning sockets,
the patch will also provide the support.

Supported syntax:
 1.) -net socket,listen=127.0.0.1:1234,vlan=0
 2.) -net socket,listen=127.0.0.1:1234,vlan=0 -net socket,listen=127.0.0.1:1235,vlan=0
 3.) -netdev socket,listen=127.0.0.1:1234,id=socket0

 Drop the NetSocketListenState struct and add a listen_fd field
to NetSocketState.  When a -netdev socket,listen= instance is created
there will be a NetSocketState with fd=-1 and a valid listen_fd.  The
net_socket_accept() handler waits for listen_fd to become readable and
then accepts the connection.  When this state transition happens, we no
longer monitor listen_fd for incoming connections...until the client
disconnects again.
Signed-off-by: NZhi Yong Wu <wuzhy@linux.vnet.ibm.com>
Signed-off-by: NStefan Hajnoczi <stefanha@linux.vnet.ibm.com>
Reviewed-by: NLaszlo Ersek <lersek@redhat.com>

Signed-off-by: NZhi Yong Wu <wuzhy@linux.vnet.ibm.com>
Signed-off-by: NStefan Hajnoczi <stefanha@linux.vnet.ibm.com>
Reviewed-by: NLaszlo Ersek <lersek@redhat.com>