* stefanha/block:
  block: Fix how mirror_run() frees its buffer
  win32-aio: Fix how win32_aio_process_completion() frees buffer
  scsi-disk: qemu_vfree(NULL) is fine, simplify
  w32: Make qemu_vfree() accept NULL like the POSIX implementation
  sheepdog: clean up sd_aio_setup()
  sheepdog: multiplex the rw FD to flush cache
  block: clear dirty bitmap when discarding
  ide: issue discard asynchronously but serialize the pieces
  ide: fix TRIM with empty range entry
  block: make discard asynchronous
  raw: support discard on block devices
  raw-posix: remember whether discard failed
  raw-posix: support discard on more filesystems
  block: fix initialization in bdrv_io_limits_enable()
  qcow2: Fix segfault on zero-length write
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

* afaerber/qom-cpu:
  target-i386: Use switch in check_hw_breakpoints()
  target-i386: Avoid goto in hw_breakpoint_insert()
  target-i386: Introduce hw_{local,global}_breakpoint_enabled()
  target-i386: Define DR7 bit field constants
  target-i386: Move kvm_check_features_against_host() check to realize time
  target-i386: cpu_x86_register() consolidate freeing resources
  target-i386: Move setting defaults out of cpu_x86_parse_featurestr()
  target-i386: check/enforce: Check all feature words
  target-i386/cpu.c: Add feature name array for ext4_features
  target-i386: kvm_check_features_against_host(): Use feature_word_info
  target-i386/cpu: Introduce FeatureWord typedefs
  target-i386: Disable kvm_mmu by default
  kvm: Add fake KVM constants to avoid #ifdefs on KVM-specific code
  exec: Return CPUState from qemu_get_cpu()
  xen: Simplify halting of first CPU
  kvm: Pass CPUState to kvm_init_vcpu()
  cpu: Move cpu_index field to CPUState
  cpu: Move numa_node field to CPUState
  target-mips: Clean up mips_cpu_map_tc() documentation
  cpu: Move nr_{cores,threads} fields to CPUState
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

* afaerber-or/prep-up:
  pc87312: Avoid define conflict on mingw32
  pc87312: Replace register_ioport_*() with MemoryRegion
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

* mdroth/qga-pull-1-14-2013-2:
  qga: add missing commas in json docs
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

* mdroth/qga-pull-1-14-2013:
  qemu-ga: Handle errors uniformely in ga_channel_open()
  qemu-ga: Plug fd leak on ga_channel_open() error paths
  qemu-ga: Plug fd leak on ga_channel_listen_accept() error path
  qemu-ga: Plug file descriptor leak on ga_open_pidfile() error path
  qemu-ga: Drop pointless lseek() from ga_open_pidfile()
  qemu-ga: Document intentional fall through in channel_event_cb()
  qemu-ga: add ga_open_logfile()
  qemu-ga: ga_open_pidfile(): use qemu_open()
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

* sstabellini/xen-2013-01-14:
  xen_disk: implement BLKIF_OP_FLUSH_DISKCACHE, remove BLKIF_OP_WRITE_BARRIER
  xen_disk: add persistent grant support to xen_disk backend
  xen_disk: fix memory leak
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

It allocates with qemu_blockalign(), therefore it must free with
qemu_vfree(), not g_free().
Signed-off-by: NMarkus Armbruster <armbru@redhat.com>
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>

win32_aio_submit() allocates it with qemu_blockalign(), therefore it
must be freed with qemu_vfree(), not g_free().
Signed-off-by: NMarkus Armbruster <armbru@redhat.com>
Reviewed-by: NKevin Wolf <kwolf@redhat.com>
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>

Signed-off-by: NMarkus Armbruster <armbru@redhat.com>
Acked-by: NPaolo Bonzini <pbonzini@redhat.com>
Reviewed-by: NKevin Wolf <kwolf@redhat.com>
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>

On POSIX, qemu_vfree() accepts NULL, because it's merely wrapper
around free().  As far as I can tell, the Windows implementation
doesn't.  Breeds bugs that bite only under Windows.

Make the Windows implementation behave like the POSIX implementation.
Signed-off-by: NMarkus Armbruster <armbru@redhat.com>
Reviewed-by: NKevin Wolf <kwolf@redhat.com>
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>

The last two parameters of sd_aio_setup() are never used, so remove them.

Cc: MORITA Kazutaka <morita.kazutaka@lab.ntt.co.jp>
Cc: Kevin Wolf <kwolf@redhat.com>
Cc: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: NLiu Yuan <tailai.ly@taobao.com>
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>

This will reduce sockfds connected to the sheep server to one, which simply the
future hacks.

Cc: MORITA Kazutaka <morita.kazutaka@lab.ntt.co.jp>
Cc: Kevin Wolf <kwolf@redhat.com>
Cc: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: NLiu Yuan <tailai.ly@taobao.com>
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>

Note that resetting bits in the dirty bitmap is done _before_ actually
processing the request.  Writes, instead, set bits after the request
is completed.

This way, when there are concurrent write and discard requests, the
outcome will always be that the blocks are marked dirty.  This scenario
should never happen, but it is safer to do it this way.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>

Now that discard can take a long time, make it asynchronous.
Each LBA range entry is processed separately because discard
can be an expensive operation.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>

ATA-ACS-3 says "If the two byte range length is zero, then the LBA
Range Entry shall be discarded as padding."  iovecs are used as if
they are linearized, so it is incorrect to discard the rest of
this iovec.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>

This is easy with the thread pool, because we can use s->is_xfs and
s->has_discard from the worker function.

QEMU has a widespread assumption that each I/O operation writes less
than 2^32 bytes.  This patch doesn't fix it throughout of course,
but it starts correcting struct RawPosixAIOData so that there is
no regression with respect to the synchronous discard implementation.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>

Block devices use a ioctl instead of fallocate, so add a separate
implementation.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>

Avoid sending system calls repeatedly if they shall fail.  This
does not apply to XFS: if the filesystem-specific ioctl fails,
something weird is happening.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>

Linux 2.6.38 introduced the filesystem independent interface to
deallocate part of a file. As of Linux 3.7, btrfs, ext4, ocfs2,
tmpfs and xfs support it.

Even though the system calls here are in practice issued on Linux,
the code is structured to allow plugging in alternatives for other Unix
variants.  EOPNOTSUPP is used unconditionally in this patch, but it is
supported in both OpenBSD and Mac OS X since forever (see for example
http://lists.debian.org/debian-glibc/2006/02/msg00337.html).
Signed-off-by: NKusanagi Kouichi <slash@ac.auone-net.jp>
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>

bdrv_io_limits_enable() starts a new slice, but does not set io_base
correctly for that slice.

Here is how io_base is used:

    bytes_base  = bs->nr_bytes[is_write] - bs->io_base.bytes[is_write];
    bytes_res   = (unsigned) nb_sectors * BDRV_SECTOR_SIZE;

    if (bytes_base + bytes_res <= bytes_limit) {
        /* no wait */
    } else {
        /* operation needs to be throttled */
    }

As a result, any I/O operations that are triggered between now and
bs->slice_end are incorrectly limited.  If 10 MB of data has been
written since the VM was started, QEMU thinks that 10 MB of data has
been written in this slice. This leads to a I/O lockup in the guest.

We fix this by delaying the start of a new slice to the next
call of bdrv_exceed_io_limits().
Signed-off-by: NPeter Lieven <pl@kamp.de>
Reviewed-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>

Replace an if statement using magic numbers for breakpoint type with a
more explicit switch statement. This is to aid readability.

Change the return type and force_dr6_update argument type to bool.

While at it, fix Coding Style issues (missing braces).
Signed-off-by: Nliguang <lig.fnst@cn.fujitsu.com>
Signed-off-by: NAndreas Färber <afaerber@suse.de>

  "Go To Statement Considered Harmful" -- E. Dijkstra

To avoid an unnecessary goto within the switch statement, move
watchpoint insertion out of the switch statement. Improves readability.

While at it, fix Coding Style issues (missing braces, indentation).
Signed-off-by: Nliguang <lig.fnst@cn.fujitsu.com>
Signed-off-by: NAndreas Färber <afaerber@suse.de>

hw_breakpoint_enabled() returned a bit field indicating whether a local
breakpoint and/or global breakpoint was enabled. Avoid this number magic
by using explicit boolean helper functions hw_local_breakpoint_enabled()
and hw_global_breakpoint_enabled(), to aid readability.

Reuse them for the hw_breakpoint_enabled() implementation and change
its return type to bool.

While at it, fix Coding Style issues (missing braces).
Signed-off-by: Nliguang <lig.fnst@cn.fujitsu.com>
Signed-off-by: NAndreas Färber <afaerber@suse.de>

Implicit use of dr7 bit field is a little hard to understand,
so define constants for them and use them consistently.
Signed-off-by: Nliguang <lig.fnst@cn.fujitsu.com>
Signed-off-by: NAndreas Färber <afaerber@suse.de>

One of the recent refactoring patches (commit f50f88b9) didn't take care
to initialise l2meta properly, so with zero-length writes, which don't
even enter the write loop, qemu just segfaulted.
Signed-off-by: NKevin Wolf <kwolf@redhat.com>
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>

kvm_check_features_against_host() should be called when features can't
be changed, and when features are converted to properties it would be
possible to change them until realize time, so correct way is to call
kvm_check_features_against_host() in x86_cpu_realize().
Signed-off-by: NIgor Mammedov <imammedo@redhat.com>
Reviewed-by: NEduardo Habkost <ehabkost@redhat.com>
Signed-off-by: NAndreas Färber <afaerber@suse.de>

Freeing resources in one place would require setting 'error'
to not NULL, so add some more error reporting before jumping to
exit branch.
Signed-off-by: NIgor Mammedov <imammedo@redhat.com>
Reviewed-by: NEduardo Habkost <ehabkost@redhat.com>
Signed-off-by: NAndreas Färber <afaerber@suse.de>

No functional change, needed for simplifying conversion to properties.
Signed-off-by: NIgor Mammedov <imammedo@redhat.com>
Reviewed-by: NEduardo Habkost <ehabkost@redhat.com>
Signed-off-by: NAndreas Färber <afaerber@suse.de>

This adds the following feature words to the list of flags to be checked
by kvm_check_features_against_host():

 - cpuid_7_0_ebx_features
 - ext4_features
 - kvm_features
 - svm_features

This will ensure the "enforce" flag works as it should: it won't allow
QEMU to be started unless every flag that was requested by the user or
defined in the CPU model is supported by the host.

This patch may cause existing configurations where "enforce" wasn't
preventing QEMU from being started to abort QEMU. But that's exactly the
point of this patch: if a flag was not supported by the host and QEMU
wasn't aborting, it was a bug in the "enforce" code.
Signed-off-by: NEduardo Habkost <ehabkost@redhat.com>
Reviewed-by: NGleb Natapov <gleb@redhat.com>
Signed-off-by: NAndreas Färber <afaerber@suse.de>

Feature names were taken from the X86_FEATURE_* constants in the Linux
kernel code.
Signed-off-by: NEduardo Habkost <ehabkost@redhat.com>
Reviewed-by: NGleb Natapov <gleb@redhat.com>
Signed-off-by: NAndreas Färber <afaerber@suse.de>

Instead of carrying the CPUID leaf/register and feature name array on
the model_features_t struct, move that information into
feature_word_info so it can be reused by other functions.

The goal is to eventually kill model_features_t entirely, but to do that
we have to either convert x86_def_t.features to an array or use
offsetof() inside FeatureWordInfo (to replace the pointers inside
model_features_t). So by now just move most of the model_features_t
fields to FeatureWordInfo except for the two pointers to local
arguments.
Signed-off-by: NEduardo Habkost <ehabkost@redhat.com>
Reviewed-by: NGleb Natapov <gleb@redhat.com>
Signed-off-by: NAndreas Färber <afaerber@suse.de>

This introduces a FeatureWord enum, FeatureWordInfo struct (with
generation information about a feature word), and a FeatureWordArray
typedef, and changes add_flagname_to_bitmaps() code and
cpu_x86_parse_featurestr() to use the new typedefs instead of separate
variables for each feature word.

This will help us keep the code at kvm_check_features_against_host(),
cpu_x86_parse_featurestr() and add_flagname_to_bitmaps() sane while
adding new feature name arrays.
Signed-off-by: NEduardo Habkost <ehabkost@redhat.com>
Reviewed-by: NGleb Natapov <gleb@redhat.com>
Signed-off-by: NAndreas Färber <afaerber@suse.de>

KVM_CAP_PV_MMU capability reporting was removed from the kernel since
v2.6.33 (see commit a68a6a7282373), and was completely removed from the
kernel since v3.3 (see commit fb92045843). It doesn't make sense to keep
it enabled by default, as it would cause unnecessary hassle when using
the "enforce" flag.

This disables kvm_mmu on all machine-types. With this fix, the possible
scenarios when migrating from QEMU <= 1.3 to QEMU 1.4 are:

------------+----------+----------------------------------------------------
 src kernel | dst kern.| Result
------------+----------+----------------------------------------------------
 >= 2.6.33  | any      | kvm_mmu was already disabled and will stay disabled
 <= 2.6.32  | >= 3.3   | correct live migration is impossible
 <= 2.6.32  | <= 3.2   | kvm_mmu will be disabled on next guest reboot *
------------+----------+----------------------------------------------------

 * If they are running kernel <= 2.6.32 and want kvm_mmu to be kept
   enabled on guest reboot, they can explicitly add +kvm_mmu to the QEMU
   command-line. Using 2.6.33 and higher, it is not possible to enable
   kvm_mmu explicitly anymore.
Signed-off-by: NEduardo Habkost <ehabkost@redhat.com>
Reviewed-by: NGleb Natapov <gleb@redhat.com>
Signed-off-by: NAndreas Färber <afaerber@suse.de>

Any KVM-specific code that use these constants must check if
kvm_enabled() is true before using them.
Signed-off-by: NEduardo Habkost <ehabkost@redhat.com>
Reviewed-by: NGleb Natapov <gleb@redhat.com>
Signed-off-by: NAndreas Färber <afaerber@suse.de>

Move the declaration to qemu/cpu.h and add documentation.
The implementation still depends on CPUArchState for CPU iteration.
Signed-off-by: NAndreas Färber <afaerber@suse.de>

Use the global first_cpu variable to halt the CPU rather than using a
local first_cpu initialized from qemu_get_cpu(0).

This will allow to change qemu_get_cpu() return type to CPUState
despite use of the CPU_COMMON halted field in the reset handler.
Signed-off-by: NAndreas Färber <afaerber@suse.de>

CPUArchState is no longer needed, and it thereby no longer depends on
NEED_CPU_H.
Signed-off-by: NAndreas Färber <afaerber@suse.de>

Note that target-alpha accesses this field from TCG, now using a
negative offset. Therefore the field is placed last in CPUState.

Pass PowerPCCPU to [kvm]ppc_fixup_cpu() to facilitate this change.

Move common parts of mips cpu_state_reset() to mips_cpu_reset().

Acked-by: Richard Henderson <rth@twiddle.net> (for alpha)
[AF: Rebased onto ppc CPU subclasses and openpic changes]
Signed-off-by: NAndreas Färber <afaerber@suse.de>

Signed-off-by: NAndreas Färber <afaerber@suse.de>

This function will be touched again soon, so a good understanding of env
vs. other helps. Adopt gtk-doc style.
Signed-off-by: NAndreas Färber <afaerber@suse.de>
Reviewed-by: NEric Johnson <ericj@mips.com>