The kvm kernel module includes a number of trace events which can be
useful when debugging system behavior.  Even on production systems these
trace events can be used to observe guest behavior and identify the
source of problems.

The kvm_flightrecorder script is a command-line wrapper for the
/sys/kernel/debug/tracing interface.  Kernel symbols do not need to be
installed.

This script captures a fixed-size buffer of KVM trace events.  Recent
events overwrite the oldest events when the buffer size is exceeded and
it is possible to leave KVM tracing enabled for any period of time with
just a fixed-size buffer.  If the buffer is large enough this script is
a useful tool for collecting detailed information after an issue occurs
with a guest.  Hence the name "flight recorder".

The script can also be used in 'tail' mode to simply view KVM trace
events as they occur.  This is handy for development and to ensure that
the guest is indeed running.
Signed-off-by: NStefan Hajnoczi <stefanha@linux.vnet.ibm.com>
Signed-off-by: NMarcelo Tosatti <mtosatti@redhat.com>

Microblaze cpu development has been driven and funded by PetaLogix. Added (c)
PetaLogix line accordingly.
Signed-off-by: NPeter A. G. Crosthwaite <peter.crosthwaite@petalogix.com>
Signed-off-by: NEdgar E. Iglesias <edgar.iglesias@gmail.com>

Commit afe0a595 ("rtl8139: support byte
read to TxStatus registers") reused rtl8139_TxStatus_read() for reading
TxAddr registers.  It relies on the fact that TxStatus[] and TxAddr[]
are adjacent.

This causes a gcc warning because the compiler can detect that array
access is out-of-bounds:

  hw/rtl8139.c:2501:27: error: array subscript is above array bounds [-Werror=array-bounds]

This patch refactors the function so that we don't rely on out-of-bounds
accesses.

Cc: Jason Wang <jasonwang@redhat.com>
Signed-off-by: NStefan Hajnoczi <stefanha@linux.vnet.ibm.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Move code from cpu_state_reset() into QOM x86_cpu_reset(),
fixing style issues for FPU init.
Signed-off-by: NAndreas Färber <afaerber@suse.de>

Move code from cpu_x86_init() to new QOM x86_cpu_initfn().
Also move mce_init() to cpu.c since it's used nowhere else.
Signed-off-by: NAndreas Färber <afaerber@suse.de>

Embed CPUX86State as first member of X86CPU.
Distinguish between "x86_64-cpu" and "i386-cpu".
Drop cpu_x86_close() in favor of calling object_delete() directly.

For now let CPUClass::reset() call cpu_state_reset().
Signed-off-by: NAndreas Färber <afaerber@suse.de>

Name it cpu.c to align with other QOM'ified targets.
Signed-off-by: NAndreas Färber <afaerber@suse.de>

* commit 'ff71f2e8': (21 commits)
  rtl8139: do the network/host communication only in normal operating mode
  rtl8139: correctly check the opmode
  net: move compute_mcast_idx() to net.h
  rtl8139: support byte read to TxStatus registers
  rtl8139: remove unused marco
  rtl8139: limit transmission buffer size in c+ mode
  pci_regs: Add PCI_EXP_TYPE_PCIE_BRIDGE
  virtio-net: add DATA_VALID flag
  pci_bridge: upper 32 bit are long registers
  pci: fix bridge IO/BASE
  pcie: drop functionality moved to core
  pci: set memory type for memory behind the bridge
  pci: add standard bridge device
  slotid: add slot id capability
  shpc: standard hot plug controller
  pci_bridge: user-friendly default bus name
  pci: make another unused extern function static
  pci: don't export an internal function
  pci_regs: Fix value of PCI_EXP_TYPE_RC_EC.
  pci: Do not check if a bus exist in pci_parse_devaddr.
  ...

* qmp/queue/qmp:
  qapi: convert device_del
  qdev: qdev_unplug(): use error_set()

* kwolf/for-anthony: (46 commits)
  qed: remove incoming live migration blocker
  qed: honor BDRV_O_INCOMING for incoming live migration
  migration: clear BDRV_O_INCOMING flags on end of incoming live migration
  qed: add bdrv_invalidate_cache to be called after incoming live migration
  blockdev: open images with BDRV_O_INCOMING on incoming live migration
  block: add a function to clear incoming live migration flags
  block: Add new BDRV_O_INCOMING flag to notice incoming live migration
  block stream: close unused files and update ->backing_hd
  qemu-iotests: Fix call syntax for qemu-io
  qemu-iotests: Fix call syntax for qemu-img
  qemu-iotests: Test unknown qcow2 header extensions
  qemu-iotests: qcow2.py
  sheepdog: fix send req helpers
  sheepdog: implement SD_OP_FLUSH_VDI operation
  block: bdrv_append() fixes
  qed: track dirty flag status
  qemu-img: add dirty flag status
  qed: image fragmentation statistics
  qemu-img: add image fragmentation statistics
  block: document job API
  ...

* stefanha/trivial-patches:
  make: fix clean rule by removing build file in qom/
  configure: Link qga against UST tracing related libraries
  configure: Link QEMU against 'liburcu-bp'
  main-loop: make qemu_event_handle static
  block/curl: Replace usleep by g_usleep
  qtest: Add missing GCC_FMT_ATTR
  w32: Undefine error constants before their redefinition
  configure: fix mingw32 libs_qga typo

This FIXME has already been actioned. Deleted comment.
Signed-off-by: NPeter A. G. Crosthwaite <peter.crosthwaite@petalogix.com>
Signed-off-by: NEdgar E. Iglesias <edgar.iglesias@gmail.com>

Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>
Signed-off-by: NLuiz Capitulino <lcapitulino@redhat.com>
Reviewed-by: NStefan Hajnoczi <stefanha@linux.vnet.ibm.com>

It currently uses qerror_report(), but next commit will convert
the drive_del command to the QAPI and this requires using
error_set().

One particularity of qerror_report() is that it knows when it's
running on monitor context or command-line context and prints the
error message accordingly. error_set() doesn't do this, so we
have to be careful not to drop error messages.

qdev_unplug() has three kinds of usages:

 1. It's called when hot adding a device fails, to undo anything
    that has been done before hitting the error

 2. It's called by function monitor functions like device_del(),
    to unplug a device

 3. It's used by xen_platform.c in a way that doesn't _seem_ to
    be in monitor context

Only item 2 can print an error message to the user, this commit
maintains that.
Signed-off-by: NLuiz Capitulino <lcapitulino@redhat.com>
Reviewed-by: NStefan Hajnoczi <stefanha@linux.vnet.ibm.com>

* 'memory/core' of git://git.kernel.org/pub/scm/virt/kvm/qemu-kvm:
  memory: check address space when a listener is registered
  memory: print aliased IO ranges in info mtree
  ioport: use INT64_MAX for IO ranges

cpu_io_recompile terminates by calling either cpu_abort or
cpu_resume_from_signal which both never return.
Signed-off-by: NStefan Weil <sw@weilnetz.de>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

cpu_resume_from_signal terminates by calling longjmp.
Signed-off-by: NStefan Weil <sw@weilnetz.de>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

The official spelling is QEMU.
Signed-off-by: NStefan Weil <sw@weilnetz.de>
Reviewed-by: NAndreas Färber <afaerber@suse.de>
[blauwirbel@gmail.com: fixed comment style in hw/sun4m.c]
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

The official spelling is QEMU.
Signed-off-by: NStefan Weil <sw@weilnetz.de>
Reviewed-by: NAndreas Färber <afaerber@suse.de>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

The official spelling is QEMU.
Signed-off-by: NStefan Weil <sw@weilnetz.de>
Reviewed-by: NAndreas Färber <afaerber@suse.de>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

The official spelling is QEMU.
Signed-off-by: NStefan Weil <sw@weilnetz.de>
Reviewed-by: NAndreas Färber <afaerber@suse.de>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

This comment is useless, just removes it and makes the codes clear.
Signed-off-by: NWanpeng Li <liwp@linux.vnet.ibm.com>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

Builds with --enable-tcg-interpreter failed because more and more
targets (currently alpha and sparc) replaced the global env in AREG0
by function parameters.

Convert the TCG interpreter to use the new helper functions and add
defines for those targets which still use AREG0.

Cc: Blue Swirl <blauwirbel@gmail.com>
Signed-off-by: NStefan Weil <sw@weilnetz.de>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

* 'linux-user-for-upstream' of git://git.linaro.org/people/rikuvoipio/qemu:
  Userspace ARM BE8 support
  elf.h: Update EF_ARM_ constants to newer ABI versions
  arm-linux-user: fix elfload.c's AT_HWCAP to reflect cpu features.
  linux-user/arm/syscall_nr.h: Add syscall number for ppoll
  linux-user: Add support for prctl PR_GET_NAME and PR_SET_NAME
  linux-user/syscall.c: Fix indentation in prctl handling
  linux-user: reserve 4GB of vmem for 32-on-64
  linux-user: resolve reserved_va vma downwards
  linux-user: take RESERVED_VA into account for g2h_valid()
  linux-user: fix fallocate
  linux-user: Add ioctl for BLKBSZGET
  linux-user: add BLKSSZGET ioctl wrapper
  linux-user: fix BLK ioctl arguments
  linux-user: add struct old_dev_t compat
  linux-user: implement device mapper ioctls
  linux-user: target_argv is placed on ts->bprm->argv and can't be freed()
  linux-user: improve fake /proc/self/stat making `ps` not segfault.

QEMU host addresses must use uintptr_t to be portable for hosts with
an unusual size of long (w64).

tb_jmp_offset is an uint16_t value, therefore the local variable offset
in function tb_set_jmp_target was changed from unsigned long to uint16_t.

The type cast to long in function tb_add_jump now also uses uintptr_t.
For the bit operation used here, the signedness of the type cast does
not matter.

Some remaining unsigned long values are either only used for ARM assembler
code or will be fixed in a later patch for PPC.

v2:
Fix signature of tb_find_pc in exec.c, too (hint from Blue Swirl, thanks).
There remain lots of other long / unsigned long in exec.c which must be
replaced by uintptr_t. This will be done in a separate patch. Here
only one of these type casts is fixed.

v3:
Also fix signature of page_unprotect.
Signed-off-by: NStefan Weil <sw@weilnetz.de>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

Fix code in roundAndPackInt32 that assumed that int32 was only
32 bits, by simply using int32_t instead. Fix the parallel bug
in roundAndPackInt64 as well, although that one is only theoretical
since it's unlikely that int64 will ever be more than 64 bits.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

Code in the float64_to_int32_round_to_zero() function was assuming
that int32 would not be wider than 32 bits; this meant it might
not correctly detect the overflow case. We take the simple approach
of using int32_t. Also fix equivalent issues in the functions
for other float sizes.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

These are pretty sane requirements to move forward with glib usage.
2.12 is the version found in RHEL/CentOS 5, and 2.20 is the
first version to support g_poll.  Without g_poll, we cannot
integrate well with the glib main loop.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

On w32, glib implements g_poll using WaitForMultipleObjects
or MsgWaitForMultipleObjects.  This means that we can simplify
our code by switching to g_poll, and at the same time prepare for
adding back glib sources.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

Right now, the main loop is not interrupted when data arrives on a
socket.  To fix this, register each socket to interrupt the main loop
with WSAEventSelect.  This does not replace select, it only communicates
a change in socket state that requires a select call.

Since the interrupt fires only once per recv call, or only once
after a send call returns EWOULDBLOCK we can activate it on all events
unconditionally.  If QEMU is momentarily uninterested on some condition,
the main loop will not busy wait.  Instead, it may get one extra wakeup,
but then it will ignore the condition until progress occurs and/or
qemu_set_fd_handler is called to set a callback.  At this point the
condition will be tested via select and the callback will be invoked
even if it is still disabled on the event.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

Using select with glib pollfds is wrong under w32.  Restrict
the code to the POSIX case.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

The timeval-based timeout is not needed until we actually invoke select,
so compute it only then.  Also group the two calls that modify the
timeout, glib_select_fill and os_host_main_loop_wait.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

Embed CPUSPARCState as first member of SPARCCPU.
Drop cpu_sparc_close() in favor of object_delete() and a finalizer.
Let cpu_state_reset() call cpu_reset().

Make TYPE_SPARC_CPU non-abstract for now.
Distinguish between "sparc-cpu" and "sparc64-cpu".
Signed-off-by: NAndreas Färber <afaerber@suse.de>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

Align QOM'ified targets, with a view to simplify Makefile.target.
Signed-off-by: NAndreas Färber <afaerber@suse.de>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

Add support for ARM BE8 userspace binaries.
i.e. big-endian data and little-endian code.
In principle LE8 mode is also possible, but AFAIK has never actually
been implemented/used.

System emulation doesn't have any useable big-endian board models,
but should in principle work once you fix that.
Dynamic endianness switching requires messing with data accesses,
preferably with TCG cooperation, and is orthogonal to BE8 support.
Signed-off-by: NPaul Brook <paul@codesourcery.com>
[PMM: various changes, mostly as per my suggestions in code review:
 * rebase
 * use EF_ defines rather than hardcoded constants
 * make bswap_code a bool for future VMSTATE macro compatibility
 * update comment in cpu.h about TB flags bit field usage
 * factor out load-code-and-swap into arm_ld*_code functions and
   get_user_code* macros
 * fix stray trailing space at end of line
 * added braces in disas.c to satisfy checkpatch
]
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NRiku Voipio <riku.voipio@linaro.org>

Update the EF_ARM_* constants (for the ELF header e_flags field)
to include the newer flags specified for later versions of the ABI.
(This set of constants is from include/elf/arm.h from binutils-2.17
and so licensed under GPL-v2-or-later.)
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NRiku Voipio <riku.voipio@linaro.org>

The cpu capabilities passed by the elf loader in AT_HWCAP where
a constant.
Make AT_HWCAP reflect the emulated cpu features in order to give
correct clues to eglibc.

Riku Voipio: fixed to apply to current head

Fix :  [Bug 887516] [NEW] VFP support reported for the PXA270
Signed-off-by: NBenoit Canet <benoit.canet@gmail.com>
Signed-off-by: NRiku Voipio <riku.voipio@linaro.org>

The list of ARM syscall numbers was missing the entry for ppoll,
which meant we were accidentally not providing it. (This wasn't
causing any practical issues beyond warnings about unimplemented
syscalls, because glibc will fall back to another code path if the
syscall isn't present.)
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NRiku Voipio <riku.voipio@linaro.org>

Add support for the prctl options PR_GET_NAME and PR_SET_NAME,
which take or return a name in a 16 byte buffer pointed to by arg2.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NRiku Voipio <riku.voipio@linaro.org>