# By Fam Zheng (8) and others
# Via Kevin Wolf
* kwolf/for-anthony:
  vmdk: rename num_gtes_per_gte to num_gtes_per_gt
  vmdk: use heap allocation for whole_grain
  vmdk: check l1 size before opening image
  vmdk: check l2 table size when opening
  vmdk: check granularity field in opening
  qemu-iotests: add empty test case for vmdk
  qemu-iotests: add poke_file utility function
  vmdk: use unsigned values for on disk header fields
  vmdk: Make VMDK3Header and VmdkGrainMarker QEMU_PACKED
  sheepdog: add missing .bdrv_has_zero_init
  qemu-iotests: filter QEMU version in monitor banner
  iov: handle EOF in iov_send_recv
  ignore SIGPIPE in qemu-img and qemu-io
  qemu-img: Error out for excess arguments

Message-id: 1375799990-995-1-git-send-email-kwolf@redhat.com
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

num_gtes_per_gte is a historical typo, rename it to a more sensible
name. It means "number of GrainTableEntries per GrainTable".
Signed-off-by: NFam Zheng <famz@redhat.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

We should never grow the stack beyond 1 MB, otherwise we'll fall off the
end.  Thread stacks and coroutine stacks (1 MB) do not grow.
get_cluster_offset() allocates a big stack offset, it will fail for big
cluster images, change to heap allocated buffer.
Signed-off-by: NFam Zheng <famz@redhat.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

L1 table size is calculated from capacity, granularity and l2 table
size. If capacity is too big or later two are too small, the L1 table
will be too big to allocate in memory. Limit it to a reasonable range.
Signed-off-by: NFam Zheng <famz@redhat.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

header.num_gtes_per_gte determines size for L2 table. Check for too big
value before using it. Limit to 512M entries (2GB per one L2 table).
Signed-off-by: NFam Zheng <famz@redhat.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

Granularity is used to calculate the cluster size and allocate r/w
buffer. Check the value from image before using it, so we don't abort()
for unbounded memory allocation.
Signed-off-by: NFam Zheng <famz@redhat.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

Will add vmdk specific tests later here.
Signed-off-by: NFam Zheng <famz@redhat.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

The new poke_file function sets bytes at an offset in a file given a
printf-style format string.  It can be used to corrupt an image file for
test coverage of error paths.
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

The size and offset fields are all non-negative values, use uint64_t for
them to avoid getting negative in memory value by int overflow.
Signed-off-by: NFam Zheng <famz@redhat.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

It's best to make it consistent that all on disk structures are
QEMU_PACKED.
Signed-off-by: NFam Zheng <famz@redhat.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

Fix incorrect assumption that DSP and non-DSP versions of the following
instructions have the same encoding:
MULT, MULTU, MADD, MADDU, MSUB, MSUBU, MFHI, MFLO, MTHI, MTLO.
Correct the existing (non-DSP) instructions and add DSP equivalents.

Reference:
MIPS Architecture for Programmers Volume II-B: The microMIPS32
Instruction Set
MIPS Architecture for Programmers Volume IV-e: The MIPS DSP Module for
the microMIPS32 Architecture
Signed-off-by: NLeon Alrae <leon.alrae@imgtec.com>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

Commit 3ac21627 changed the behaviour of bdrv_has_zero_init() to default
to 0. In the review for Sheepdog it turned out that enabling it is safe,
so that commit updated one BlockDriver definition of sheepdog to use
bdrv_has_zero_init_1, missed however that there are more BlockDrivers in
the driver. Fix these now.

Cc: Kevin Wolf <kwolf@redhat.com>
Cc: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: NLiu Yuan <namei.unix@gmail.com>
Reviewed-by: NMORITA Kazutaka <morita.kazutaka@lab.ntt.co.jp>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

Filter out the QEMU monitor version banner so that tests do not break
when the QEMU version number is changed.
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

Without this patch, iov_send_recv() never returns when do_send_recv()
returns zero.
Signed-off-by: NMORITA Kazutaka <morita.kazutaka@lab.ntt.co.jp>
Reviewed-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

This prevents the tools from being stopped when they write data to a
closed connection in the other side.
Signed-off-by: NMORITA Kazutaka <morita.kazutaka@lab.ntt.co.jp>
Reviewed-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

Don't silently ignore excess arguments at the end of the command line,
but error out instead. This can catch typos like 'resize test.img + 1G',
which doesn't increase the image size by 1G as intended, but truncates
the image to 1G. Even for less dangerous commands, the old behaviour is
confusing.
Signed-off-by: NKevin Wolf <kwolf@redhat.com>
Reviewed-by: NLaszlo Ersek <lersek@redhat.com>
Reviewed-by: NStefan Hajnoczi <stefanha@redhat.com>

Fix following bugs in "fallback implementation of counting semaphores
with mutex+condvar" added in c166cb72:
 - waiting threads are not restarted properly if more than one threads
   are waiting unblock signals in qemu_sem_timedwait()
 - possible missing pthread_cond_signal(3) calls when waiting threads
   are returned by ETIMEDOUT
 - fix an uninitialized variable
The problem is analyzed by and fix is provided by Noriyuki Soda.

Also put additional cleanup suggested by Laszlo Ersek:
 - make QemuSemaphore.count unsigned (it won't be negative)
 - check a return value of in pthread_cond_wait() in qemu_sem_wait()
Signed-off-by: NIzumi Tsutsui <tsutsui@ceres.dti.ne.jp>
Reviewed-by: NLaszlo Ersek <lersek@redhat.com>
Message-id: 1372841894-10634-1-git-send-email-tsutsui@ceres.dti.ne.jp
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

It is allocated by g_strdup(), so needs to be freed.
Reviewed-by: NMichael R. Hines <mrhines@us.ibm.com>
Signed-off-by: NIsaku Yamahata <yamahata@private.email.ne.jp>
Signed-off-by: NMichael R. Hines <mrhines@us.ibm.com>
Message-id: 1375584894-9917-8-git-send-email-mrhines@linux.vnet.ibm.com
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Reviewed-by: NMichael R. Hines <mrhines@us.ibm.com>
Signed-off-by: NIsaku Yamahata <yamahata@private.email.ne.jp>
Signed-off-by: NMichael R. Hines <mrhines@us.ibm.com>
Message-id: 1375584894-9917-7-git-send-email-mrhines@linux.vnet.ibm.com
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

RDMA_WRID_CONTROL should be used. And remove related work around.
Reviewed-by: NMichael R. Hines <mrhines@us.ibm.com>
Signed-off-by: NIsaku Yamahata <yamahata@private.email.ne.jp>
Signed-off-by: NMichael R. Hines <mrhines@us.ibm.com>
Message-id: 1375584894-9917-6-git-send-email-mrhines@linux.vnet.ibm.com
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Reviewed-by: NMichael R. Hines <mrhines@us.ibm.com>
Signed-off-by: NIsaku Yamahata <yamahata@private.email.ne.jp>
Signed-off-by: NMichael R. Hines <mrhines@us.ibm.com>
Message-id: 1375584894-9917-5-git-send-email-mrhines@linux.vnet.ibm.com
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Don't print newlines on the error_setg() function,
but still allow newlines on fprintf().
Signed-off-by: NMichael R. Hines <mrhines@us.ibm.com>
Message-id: 1375584894-9917-4-git-send-email-mrhines@linux.vnet.ibm.com
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Ooops. We forgot to turn off the flag.
Signed-off-by: NMichael R. Hines <mrhines@us.ibm.com>
Message-id: 1375584894-9917-3-git-send-email-mrhines@linux.vnet.ibm.com
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

RDMA does not use sockets, so we cannot use many of the socket
helper functions, but we *do* use inet_parse() which gives
RDMA all the necessary details of the connection parameters.

However, when testing with libvirt, a simple IPv6 migration test failed
because we were not using getaddrinfo() properly.

This makes IPv6 migration over RDMA work.
Signed-off-by: NMichael R. Hines <mrhines@us.ibm.com>
Message-id: 1375584894-9917-2-git-send-email-mrhines@linux.vnet.ibm.com
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

pxa2xx_i2c_init() creates a pxa2xx-i2c-slave device on a second i2c-bus,
which has a NULL parent device. This causes an assertion in
object_get_canonical_path() when accessing pxa2xx-i2c-slave's
"parent_bus" link<bus> property in tosa and likely other PXA2xx machines.

Fix this by using the pxa2xx_i2c device, created just before, as parent.
Signed-off-by: NAndreas Färber <afaerber@suse.de>
Signed-off-by: NAndreas Färber <afaerber@suse.de>
Message-id: 1375621501-5564-1-git-send-email-afaerber@suse.de
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

This patch adds CPU PVR definition for POWER7+.
Signed-off-by: NAlexey Kardashevskiy <aik@ozlabs.ru>
Message-id: 1375412374-24701-1-git-send-email-aik@ozlabs.ru
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

xtensa queue 2013-07-29

* filippov/tags/20130729-xtensa:
  target-xtensa: check register window inline
  target-xtensa: don't generate dead code to access invalid SRs
  tests/tcg/xtensa: Fix out-of-tree build
  target-xtensa: avoid double-stopping at breakpoints
  target-xtensa: add fallthrough markers
  target-xtensa: add extui unit test

Conflicts:
	configure
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

* mcayland/qemu-openbios:
  Update OpenBIOS images
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

# By Jan Kiszka
# Via Stefan Hajnoczi
* stefanha/net:
  pcnet: Flush queued packets on end of STOP state

Message-id: 1375704975-19128-1-git-send-email-stefanha@redhat.com
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

# By Kevin Wolf
# Via Stefan Hajnoczi
* stefanha/block:
  block: Disable driver-specific options for 1.6

Message-id: 1375461379-20277-1-git-send-email-stefanha@redhat.com
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

# By Fam Zheng (1) and others
# Via Michael Tokarev
* mjt/trivial-patches:
  vmdk: fix comment for vmdk_co_write_zeroes
  memory.c: drop kvm.h dependency
  block/iscsi.c: Fix printf format error.
  qemu-ga: build it even if !system

Message-id: 1375453248-7178-1-git-send-email-mjt@msgid.tls.msk.ru
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

# By Gerd Hoffmann
# Via Gerd Hoffmann
* kraxel/usb.86:
  usb-redir: fix use-after-free
  xhci: fix segfault

Message-id: 1375362669-14815-1-git-send-email-kraxel@redhat.com
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Analogously to other NICs, we have to inform the network layer when
the can_receive handler will no longer report 0. Without this, we may
get stuck waiting on queued incoming packets.
Signed-off-by: NJan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>

34Kf core does support DSP ASE.
CP0_Config3 configuration for 34Kf and description are wrong.

Please refer to MIPS32(R) 34Kf(TM) Processor Core Datasheet
Signed-off-by: NYongbok Kim <yongbok.kim@imgtec.com>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

We don't want to commit to the API yet before everything is worked out.
Like already for 1.5, disable it again for the 1.6 release. This commit
is meant to be reverted after the 1.6 release.

The disabling of the driver-specific options is achieved by applying the
old checks while parsing the command line.
Signed-off-by: NKevin Wolf <kwolf@redhat.com>
Reviewed-by: NEric Blake <eblake@redhat.com>
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>

The comment was truncated. Add the missing parts, especially explain why
we need zero_dry_run.
Signed-off-by: NFam Zheng <famz@redhat.com>
Signed-off-by: NMichael Tokarev <mjt@tls.msk.ru>

memory.c does not use any kvm specific interfaces,
don't include kvm.h
Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>
Acked-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NMichael Tokarev <mjt@tls.msk.ru>

The error on armv7hl was:

block/iscsi.c: In function ‘is_request_lun_aligned’:
block/iscsi.c:251:26: error: format ‘%ld’ expects argument of type ‘long int’, but argument 3 has type ‘int64_t’ [-Werror=format=]
                          iscsilun->block_size, sector_num, nb_sectors);
                          ^

This also splits the long line to comply with qemu coding guidelines.
Signed-off-by: NRichard W.M. Jones <rjones@redhat.com>
Reviewed-by: NStefan Weil <sw@weilnetz.de>
Reviewed-by: NStefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: NMichael Tokarev <mjt@tls.msk.ru>

Move qemu-ga build check out of if softmmu.. into its own section.
We want to build qemu-ga for _guest_ even if system build isn't
done.  It is controlled separately using --enable-guest-agent.
Additionally, give error message if guest agent is requested but
not supported.
Signed-off-by: NMichael Tokarev <mjt@tls.msk.ru>

QOM CPUState refactorings

* Clean up AlphaCPU and OpenRISCCPU migration

# gpg: Signature made Wed 31 Jul 2013 04:57:59 PM CDT using RSA key ID 3E7E013F
# gpg: Can't check signature: public key not found

# By Andreas Färber
# Via Andreas Färber
* afaerber/tags/qom-cpu-for-anthony:
  cpu: Fix VMSTATE_CPU() semantics