linux-user: correct stat structure in MIPS N32

Simple "hello world" MIPS N32 userland program crashes with segfault due to
incorrectly defined stat structure in QEMU.

Correct "target_stat" definition to match kernel's "stat64" as in MIPS N32
there are only plain "stat" syscalls using 64-bit structure.

Reported-by: Daniel Sanders <[email protected]>
Signed-off-by: Leon Alrae <[email protected]>
Tested-by: Daniel Sanders <[email protected]>
Reviewed-by: James Hogan <[email protected]>

target-mips: pass 0 instead of -1 as rs in microMIPS LUI instruction

Using rs = -1 in gen_logic_imm() for microMIPS LUI instruction is dangerous
and may bite us when implementing microMIPS R6 because in R6 AUI and LUI
are distinguished by rs value. Therefore use 0 for safety.

Reported-by: Paolo Bonzini <[email protected]>
Signed-off-by: Leon Alrae <[email protected]>

target-mips: fix broken snapshotting

Recently added CP0.BadInstr and CP0.BadInstrP registers ended up in cpu_load()
under different offset than in cpu_save(). These and all registers between were
incorrectly restored.

Signed-off-by: Leon Alrae <[email protected]>

target-mips: use CP0EnLo_XI instead of magic number

Signed-off-by: Leon Alrae <[email protected]>
Reviewed-by: Maciej W. Rozycki <[email protected]>

target-mips: ll and lld cause AdEL exception for unaligned address

Signed-off-by: Leon Alrae <[email protected]>
Reviewed-by: Maciej W. Rozycki <[email protected]>

target-mips: fix detection of the end of the page during translation

The test is supposed to terminate TB if the end of the page is reached.
However, with current implementation it may never succeed for microMIPS or
mips16.

Reported-by: Richard Henderson <[email protected]>
Signed-off-by: Leon Alrae <[email protected]>
Reviewed-by: Maciej W. Rozycki <[email protected]>
Reviewed-by: Richard Henderson <[email protected]>

target-mips: Make CP0.Status.CU1 read-only for the 5Kc and 5KEc processors

Signed-off-by: Maciej W. Rozycki <[email protected]>
Signed-off-by: Leon Alrae <[email protected]>

isa: remove isa_mem_base variable

Now that isa_mem_base variable is always 0, we can remove its usage.

Signed-off-by: Hervé Poussineau <[email protected]>
Signed-off-by: Leon Alrae <[email protected]>

gt64xxx: remove isa_mem_base usage

Create a custom address space for PCI memory region and use it for the PCI bus.
Dynamically handle PCI0 Mem0 and PCI0 Mem1 regions, as already done for PCI0 IO.

Signed-off-by: Hervé Poussineau <[email protected]>
Signed-off-by: Leon Alrae <[email protected]>

piix4: use PCI address space instead of system memory

piix4 is only used on MIPS Malta board, which gives get_system_memory()
to pci_register_bus().

Signed-off-by: Hervé Poussineau <[email protected]>
Signed-off-by: Leon Alrae <[email protected]>

mips: remove isa_mem_base usage

Signed-off-by: Hervé Poussineau <[email protected]>
Signed-off-by: Leon Alrae <[email protected]>

jazz: remove usage of isa_mem_base

Do assorted changes in memory-mapped rtc interface.

Also fix size of ISA I/O memory region, which should be 0x10000 bytes.

Signed-off-by: Hervé Poussineau <[email protected]>
Signed-off-by: Leon Alrae <[email protected]>

jazz: do not explode QEMUMachineInitArgs structure

Also remove address_space and address_space_io parameters, which
where always get_system_memory() and get_system_io().

Signed-off-by: Hervé Poussineau <[email protected]>
Signed-off-by: Leon Alrae <[email protected]>

isa: add memory space parameter to isa_bus_new

Currently, keep current behaviour by always using get_system_memory().

Also use QOM casts when possible.

Signed-off-by: Hervé Poussineau <[email protected]>
Reviewed-by: Paolo Bonzini <[email protected]>
Signed-off-by: Leon Alrae <[email protected]>

Merge remote-tracking branch 'remotes/rth/tags/pull-tcg-20150212' into staging

Convert to linked list.

# gpg: Signature made Fri 13 Feb 2015 05:40:41 GMT using RSA key ID 4DD0279B
# gpg: Good signature from "Richard Henderson <[email protected]>"
# gpg:                 aka "Richard Henderson <[email protected]>"
# gpg:                 aka "Richard Henderson <[email protected]>"

* remotes/rth/tags/pull-tcg-20150212:
  tcg: Remove unused opcodes
  tcg: Implement insert_op_before
  tcg: Remove opcodes instead of noping them out
  tcg: Put opcodes in a linked list
  tcg: Introduce tcg_op_buf_count and tcg_op_buf_full
  tcg: Move emit of INDEX_op_end into gen_tb_end
  tcg: Reduce ifdefs in tcg-op.c
  tcg: Move some opcode generation functions out of line

Signed-off-by: Peter Maydell <[email protected]>

Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20150213' into staging

target-arm queue:
 * PCIe support in virt board
 * Support 32-bit guests on 64-bit KVM hosts in virt board
 * Fixes to avoid C undefined behaviour

# gpg: Signature made Fri 13 Feb 2015 05:53:07 GMT using RSA key ID 14360CDE
# gpg: Good signature from "Peter Maydell <[email protected]>"

* remotes/pmaydell/tags/pull-target-arm-20150213:
  target-arm: A64: Avoid signed shifts in disas_ldst_pair()
  target-arm: A64: Avoid left shifting negative integers in disas_pc_rel_addr
  target-arm: A64: Fix handling of rotate in logic_imm_decode_wmask
  target-arm: A64: Fix shifts into sign bit
  target-arm: Add AArch32 guest support to KVM64
  target-arm: Add 32/64-bit register sync
  target-arm: Add feature parsing to virt
  target-arm: Add CPU property to disable AArch64
  pci: Move PCI VGA to pci.mak
  arm: Add PCIe host bridge in virt machine
  pci: Add generic PCIe host bridge
  pci: Allocate PCIe host bridge PCI ID

Signed-off-by: Peter Maydell <[email protected]>

target-arm: A64: Avoid signed shifts in disas_ldst_pair()

Avoid shifting potentially negative signed offset values in
disas_ldst_pair() by keeping the offset in a uint64_t rather
than an int64_t.

Signed-off-by: Peter Maydell <[email protected]>
Message-id: 1423233250[email protected]

target-arm: A64: Avoid left shifting negative integers in disas_pc_rel_addr

Shifting a negative integer left is undefined behaviour in C.
Avoid it by assembling and shifting the offset fields as
unsigned values and then sign extending as the final action.

Signed-off-by: Peter Maydell <[email protected]>
Message-id: 1423233250[email protected]

target-arm: A64: Fix handling of rotate in logic_imm_decode_wmask

The code in logic_imm_decode_wmask attempts to rotate a mask
value within the bottom 'e' bits of the value with
    mask = (mask >> r) | (mask << (e - r));
This has two issues:
 * if the element size is 64 then a rotate by zero results
   in a shift left by 64, which is undefined behaviour
 * if the element size is smaller than 64 then this will
   leave junk in the value at bit 'e' and above, which is
   not valid input to bitfield_replicate(). As it happens,
   the bits at bit 'e' to '2e - r' are exactly the ones
   which bitfield_replicate is going to copy in there,
   so this isn't a "wrong code generated" bug, but it's
   confusing and if we ever put an assert in
   bitfield_replicate it would fire on valid guest code.

Fix the former by not doing anything if r is zero, and
the latter by masking with bitmask64(e).

Signed-off-by: Peter Maydell <[email protected]>
Message-id: 1423233250[email protected]

target-arm: A64: Fix shifts into sign bit

Fix attempts to shift into the sign bit of an int, which is undefined
behaviour in C and warned about by the clang sanitizer.

Signed-off-by: Peter Maydell <[email protected]>
Message-id: 1423233250[email protected]

target-arm: Add AArch32 guest support to KVM64

Add 32-bit to/from 64-bit register synchronization on register gets and puts.
Set EL1_32BIT feature flag passed to KVM

Signed-off-by: Greg Bellows <[email protected]>
Message-id: 1423736974[email protected]
Signed-off-by: Peter Maydell <[email protected]>

target-arm: Add 32/64-bit register sync

Add AArch32 to AArch64 register sychronization functions.
Replace manual register synchronization with new functions in
aarch64_cpu_do_interrupt() and HELPER(exception_return)().

Signed-off-by: Greg Bellows <[email protected]>
Reviewed-by: Peter Maydell <[email protected]>
Message-id: 1423736974[email protected]
Signed-off-by: Peter Maydell <[email protected]>

target-arm: Add feature parsing to virt

Added machvirt parsing of feature keywords added to the -cpu command line
option.  Parsing occurs during machine initialization.

Signed-off-by: Greg Bellows <[email protected]>
Reviewed-by: Peter Maydell <[email protected]>
Message-id: 1423736974[email protected]
Signed-off-by: Peter Maydell <[email protected]>

target-arm: Add CPU property to disable AArch64

Adds registration and get/set functions for enabling/disabling the AArch64
execution state on AArch64 CPUs.  By default AArch64 execution state is enabled
on AArch64 CPUs, setting the property to off, will disable the execution state.
The below QEMU invocation would have AArch64 execution state disabled.

    $ ./qemu-system-aarch64 -machine virt -cpu cortex-a57,aarch64=off

Also adds stripping of features from CPU model string in acquiring the ARM CPU
by name.

Signed-off-by: Greg Bellows <[email protected]>
Reviewed-by: Peter Maydell <[email protected]>
Message-id: 1423736974[email protected]
Signed-off-by: Peter Maydell <[email protected]>

pci: Move PCI VGA to pci.mak

Every platform that supports PCI can also spawn the Bochs VGA PCI adapter. Move
it to pci.mak to enable it for everyone.

Signed-off-by: Alexander Graf <[email protected]>
Signed-off-by: Peter Maydell <[email protected]>

arm: Add PCIe host bridge in virt machine

Now that we have a working "generic" PCIe host bridge driver, we can plug
it into ARM's virt machine to always have PCIe available to normal ARM VMs.

I've successfully managed to expose a Bochs VGA device, XHCI and an e1000
into an AArch64 VM with this and they all lived happily ever after.

Signed-off-by: Alexander Graf <[email protected]>
Tested-by: Claudio Fontana <[email protected]>
[PMM: Squashed in fix for off-by-one error in bus-range DT property
 from Laszlo Ersek <[email protected]>]
Signed-off-by: Peter Maydell <[email protected]>

pci: Add generic PCIe host bridge

With simple exposure of MMFG, ioport window, mmio window and an IRQ line we
can successfully create a workable PCIe host bridge that can be mapped anywhere
and only needs to get described to the OS using whatever means it likes.

This patch implements such a "generic" host bridge. It handles 4 legacy IRQ
lines. MSIs need to be handled external to the host bridge.

This device is particularly useful for the "pci-host-ecam-generic" driver in
Linux.

Signed-off-by: Alexander Graf <[email protected]>
Reviewed-by: Claudio Fontana <[email protected]>
Tested-by: Claudio Fontana <[email protected]>
Signed-off-by: Peter Maydell <[email protected]>

pci: Allocate PCIe host bridge PCI ID

We are going to introduce a PCIe host controller that doesn't exist that
way in real hardware, but still needs to expose some PCIe root device which
has PCI IDs.

Allocate a PCI ID in the Red Hat space that we use for other devices of this
kind.

Signed-off-by: Alexander Graf <[email protected]>
Signed-off-by: Peter Maydell <[email protected]>

tcg: Remove unused opcodes

We no longer need INDEX_op_end to terminate the list, nor do we
need 5 forms of nop, since we just remove the TCGOp instead.

Reviewed-by: Bastian Koppelmann <[email protected]>
Signed-off-by: Richard Henderson <[email protected]>

tcg: Implement insert_op_before

Rather reserving space in the op stream for optimization,
let the optimizer add ops as necessary.

Reviewed-by: Bastian Koppelmann <[email protected]>
Signed-off-by: Richard Henderson <[email protected]>

tcg: Remove opcodes instead of noping them out

With the linked list scheme we need not leave nops in the stream
that we need to process later.

Reviewed-by: Bastian Koppelmann <[email protected]>
Signed-off-by: Richard Henderson <[email protected]>

tcg: Put opcodes in a linked list

The previous setup required ops and args to be completely sequential,
and was error prone when it came to both iteration and optimization.

Reviewed-by: Bastian Koppelmann <[email protected]>
Signed-off-by: Richard Henderson <[email protected]>

tcg: Introduce tcg_op_buf_count and tcg_op_buf_full

The method by which we count the number of ops emitted
is going to change.  Abstract that away into some inlines.

Reviewed-by: Bastian Koppelmann <[email protected]>
Signed-off-by: Richard Henderson <[email protected]>

tcg: Move emit of INDEX_op_end into gen_tb_end

Reviewed-by: Bastian Koppelmann <[email protected]>
Signed-off-by: Richard Henderson <[email protected]>

tcg: Reduce ifdefs in tcg-op.c

Almost completely eliminates the ifdefs in this file, improving
confidence in the lesser used 32-bit builds.

Reviewed-by: Bastian Koppelmann <[email protected]>
Signed-off-by: Richard Henderson <[email protected]>

tcg: Move some opcode generation functions out of line

Some of these functions are really quite large.  We have a number of
things that ought to be circularly dependent, but we duplicated code
to break that chain for the inlines.

This saved 25% of the code size of one of the translators I examined.

Reviewed-by: Bastian Koppelmann <[email protected]>
Signed-off-by: Richard Henderson <[email protected]>

Merge remote-tracking branch 'remotes/awilliam/tags/vfio-update-20150210.0' into staging

RCU fixes and cleanup (Paolo Bonzini)
Switch to v2 IOMMU interface (Alex Williamson)
DEBUG build fix (Alexey Kardashevskiy)

# gpg: Signature made Tue 10 Feb 2015 17:37:06 GMT using RSA key ID 3BB08B22
# gpg: Good signature from "Alex Williamson <[email protected]>"
# gpg:                 aka "Alex Williamson <[email protected]>"
# gpg:                 aka "Alex Williamson <[email protected]>"
# gpg:                 aka "Alex Williamson <[email protected]>"

* remotes/awilliam/tags/vfio-update-20150210.0:
  vfio: Fix debug message compile error
  vfio: Use vfio type1 v2 IOMMU interface
  vfio: unmap and free BAR data in instance_finalize
  vfio: free dynamically-allocated data in instance_finalize
  vfio: cleanup vfio_get_device error path, remove vfio_populate_device callback
  memory: unregister AddressSpace MemoryListener within BQL

Signed-off-by: Peter Maydell <[email protected]>

vfio: Fix debug message compile error

This fixes a compiler error which occurs if DEBUG_VFIO is defined.

Signed-off-by: Alexey Kardashevskiy <[email protected]>
Signed-off-by: Alex Williamson <[email protected]>

vfio: Use vfio type1 v2 IOMMU interface

The difference between v1 and v2 is fairly subtle, simply more
deterministic behavior for unmaps.  The v1 interface allows the user
to attempt to unmap sub-regions of previous mappings, returning
success with zero size if unable to comply.  This was a reflection of
the underlying IOMMU API.  The v2 interface requires that the user
may only unmap fully contained mappings, ie. an unmap cannot intersect
or bisect a previous mapping, but may cover multiple mappings.  QEMU
never made use of the sub-region v1 support anyway, so we can support
either v1 or v2.  We'll favor v2 since it's newer.

Signed-off-by: Alex Williamson <[email protected]>

vfio: unmap and free BAR data in instance_finalize

In the case of VFIO, the unrealize callback is too early to munmap the
BARs.  The munmap must be delayed until memory accesses are complete.
To do this, split vfio_unmap_bars in two.  The removal step, now called
vfio_unregister_bars, remains in vfio_exitfn.  The reclamation step
is vfio_unmap_bars and is moved to the instance_finalize callback.

Similarly, quirk MemoryRegions have to be removed during
vfio_unregister_bars, but freeing the data structure must be delayed
to vfio_unmap_bars.

Signed-off-by: Paolo Bonzini <[email protected]>
Signed-off-by: Alex Williamson <[email protected]>

vfio: free dynamically-allocated data in instance_finalize

In order to enable out-of-BQL address space lookup, destruction of
devices needs to be split in two phases.

Unrealize is the first phase; once it complete no new accesses will
be started, but there may still be pending memory accesses can still
be completed.

The second part is freeing the device, which only happens once all memory
accesses are complete.  At this point the reference count has dropped to
zero, an RCU grace period must have completed (because the RCU-protected
FlatViews hold a reference to the device via memory_region_ref).  This is
when instance_finalize is called.

Freeing data belongs in an instance_finalize callback, because the
dynamically allocated memory can still be used after unrealize by the
pending memory accesses.

This starts the process by creating an instance_finalize callback and
freeing most of the dynamically-allocated data in instance_finalize.
Because instance_finalize is also called on error paths or also when
the device is actually not realized, the common code needs some changes
to be ready for this.  The error path in vfio_initfn can be simplified too.

Signed-off-by: Paolo Bonzini <[email protected]>
Signed-off-by: Alex Williamson <[email protected]>

vfio: cleanup vfio_get_device error path, remove vfio_populate_device callback

Now that vfio_put_base_device is called unconditionally at instance_finalize
time, it can be called twice if vfio_populate_device fails.  This works
but it is slightly harder to follow.

Change vfio_get_device to not touch the vbasedev struct until it will
definitely succeed, moving the vfio_populate_device call back to vfio-pci.
This way, vfio_put_base_device will only be called once.

Signed-off-by: Paolo Bonzini <[email protected]>
Signed-off-by: Alex Williamson <[email protected]>

memory: unregister AddressSpace MemoryListener within BQL

address_space_destroy_dispatch is called from an RCU callback and hence
outside the iothread mutex (BQL).  However, after address_space_destroy
no new accesses can hit the destroyed AddressSpace so it is not necessary
to observe changes to the memory map.  Move the memory_listener_unregister
call earlier, to make it thread-safe again.

Reported-by: Alex Williamson <[email protected]>
Fixes: 374f2981d1f10bc4307f250f24b2a7ddb9b14be0
Signed-off-by: Paolo Bonzini <[email protected]>
Signed-off-by: Alex Williamson <[email protected]>

Merge remote-tracking branch 'remotes/mjt/tags/pull-trivial-patches-2015-02-10' into staging

trivial patches for 2015-02-10

# gpg: Signature made Tue 10 Feb 2015 07:27:11 GMT using RSA key ID A4C3D7DB
# gpg: Good signature from "Michael Tokarev <[email protected]>"
# gpg:                 aka "Michael Tokarev <[email protected]>"
# gpg:                 aka "Michael Tokarev <[email protected]>"

* remotes/mjt/tags/pull-trivial-patches-2015-02-10: (45 commits)
  virtio: Fix warning caused by missing 'static' attribute
  vga: Fix warning caused by missing 'static' attribute
  stubs: Fix warning caused by missing include statement
  spice: Add missing 'static' attribute
  serial: Fix warnings caused by missing 'static' attribute
  moxie: Fix warning caused by missing include statement
  migration: Fix warnings caused by missing 'static' attribute
  migration: Fix warning caused by missing declaration of vmstate_dummy
  disas/sh4: Fix warning caused by missing 'static' attribute
  translate-all: Use g_try_malloc() for dynamic translator buffer
  vnc: g_realloc() can't fail, bury dead error handling
  rdma: g_malloc0() can't fail, bury dead error handling
  kvm: g_malloc() can't fail, bury dead error handling
  rtl8139: g_malloc() can't fail, bury dead error handling
  onenand: g_malloc() can't fail, bury dead error handling
  Fix name error in migration stream analyzation script
  QJSON: fix typo in author's email address
  util/uri: URI member path can be null, compare more carfully
  util/uri: realloc2n() can't fail, drop dead error handling
  util/uri: uri_new() can't fail, drop dead error handling
  ...

Signed-off-by: Peter Maydell <[email protected]>

virtio: Fix warning caused by missing 'static' attribute

Warning from the Sparse static analysis tool:

hw/char/virtio-serial-bus.c:31:3:
 warning: symbol 'vserdevices' was not declared. Should it be static?

Cc: Amit Shah <[email protected]>
Cc: Anthony Liguori <[email protected]>
Cc: Michael S. Tsirkin <[email protected]>
Signed-off-by: Stefan Weil <[email protected]>
Signed-off-by: Michael Tokarev <[email protected]>

vga: Fix warning caused by missing 'static' attribute

Warning from the Sparse static analysis tool:

hw/display/vga.c:2012:26: warning:
 symbol 'vmstate_vga_endian' was not declared. Should it be static?

Signed-off-by: Stefan Weil <[email protected]>
Signed-off-by: Michael Tokarev <[email protected]>

stubs: Fix warning caused by missing include statement

Warning from the Sparse static analysis tool:

stubs/qtest.c:14:6:
 warning: symbol 'qtest_allowed' was not declared. Should it be static?

Add the missing include statement which declares qtest_allowed.

Signed-off-by: Stefan Weil <[email protected]>
Signed-off-by: Michael Tokarev <[email protected]>

spice: Add missing 'static' attribute

Signed-off-by: Stefan Weil <[email protected]>
Signed-off-by: Michael Tokarev <[email protected]>

serial: Fix warnings caused by missing 'static' attribute

Warnings from the Sparse static analysis tool:

hw/char/serial.c:630:26: warning: symbol
 'vmstate_serial_thr_ipending' was not declared. Should it be static?
hw/char/serial.c:646:26: warning: symbol
 'vmstate_serial_tsr' was not declared. Should it be static?
hw/char/serial.c:665:26: warning: symbol
 'vmstate_serial_recv_fifo' was not declared. Should it be static?
hw/char/serial.c:681:26: warning: symbol
 'vmstate_serial_xmit_fifo' was not declared. Should it be static?
hw/char/serial.c:697:26: warning: symbol
 'vmstate_serial_fifo_timeout_timer' was not declared. Should it be static?
hw/char/serial.c:713:26: warning: symbol
 'vmstate_serial_timeout_ipending' was not declared. Should it be static?
hw/char/serial.c:729:26: warning: symbol
 'vmstate_serial_poll' was not declared. Should it be static?

Signed-off-by: Stefan Weil <[email protected]>
Signed-off-by: Michael Tokarev <[email protected]>

moxie: Fix warning caused by missing include statement

Warning from the Sparse static analysis tool:

target-moxie/machine.c:4:26:
 warning: symbol 'vmstate_moxie_cpu' was not declared. Should it be static?

machine.h includes the missing declaration.

Cc: Anthony Green <[email protected]>
Signed-off-by: Stefan Weil <[email protected]>
Signed-off-by: Michael Tokarev <[email protected]>

migration: Fix warnings caused by missing 'static' attribute

Warnings from the Sparse static analysis tool:

migration-rdma.c:151:12: warning:
 symbol 'wrid_desc' was not declared. Should it be static?
migration-rdma.c:190:12: warning:
 symbol 'control_desc' was not declared. Should it be static?
migration-rdma.c:3301:19: warning:
 symbol 'rdma_read_ops' was not declared. Should it be static?
migration-rdma.c:3308:19: warning:
 symbol 'rdma_write_ops' was not declared. Should it be static?

Cc: Juan Quintela <[email protected]>
Cc: Amit Shah <[email protected]>
Signed-off-by: Stefan Weil <[email protected]>
Signed-off-by: Michael Tokarev <[email protected]>

migration: Fix warning caused by missing declaration of vmstate_dummy

Warning from the Sparse static analysis tool:

stubs/vmstate.c:4:26: warning:
 symbol 'vmstate_dummy' was not declared. Should it be static?

Cc: Juan Quintela <[email protected]>
Cc: Amit Shah <[email protected]>
Signed-off-by: Stefan Weil <[email protected]>
Signed-off-by: Michael Tokarev <[email protected]>

disas/sh4: Fix warning caused by missing 'static' attribute

Warning from the Sparse static analysis tool:

disas/sh4.c:335:22: warning:
 symbol 'sh_table' was not declared. Should it be static?

Signed-off-by: Stefan Weil <[email protected]>
Signed-off-by: Michael Tokarev <[email protected]>

translate-all: Use g_try_malloc() for dynamic translator buffer

The USE_MMAP code can fail, and the caller handles the failure
already.  Let the !USE_MMAP code fail as well, for consistency.

Signed-off-by: Markus Armbruster <[email protected]>
Reviewed-by: Eric Blake <[email protected]>
Reviewed-by: Gonglei <[email protected]>
Signed-off-by: Michael Tokarev <[email protected]>

vnc: g_realloc() can't fail, bury dead error handling

Signed-off-by: Markus Armbruster <[email protected]>
Reviewed-by: Eric Blake <[email protected]>
Reviewed-by: Gonglei <[email protected]>
Reviewed-by: Thomas Huth <[email protected]>
Signed-off-by: Michael Tokarev <[email protected]>

rdma: g_malloc0() can't fail, bury dead error handling

Signed-off-by: Markus Armbruster <[email protected]>
Reviewed-by: Eric Blake <[email protected]>
Reviewed-by: Gonglei <[email protected]>
Signed-off-by: Michael Tokarev <[email protected]>

kvm: g_malloc() can't fail, bury dead error handling

Signed-off-by: Markus Armbruster <[email protected]>
Reviewed-by: Eric Blake <[email protected]>
Reviewed-by: Gonglei <[email protected]>
Signed-off-by: Michael Tokarev <[email protected]>

rtl8139: g_malloc() can't fail, bury dead error handling

Signed-off-by: Markus Armbruster <[email protected]>
Reviewed-by: Eric Blake <[email protected]>
Reviewed-by: Gonglei <[email protected]>
Signed-off-by: Michael Tokarev <[email protected]>

onenand: g_malloc() can't fail, bury dead error handling

Signed-off-by: Markus Armbruster <[email protected]>
Reviewed-by: Eric Blake <[email protected]>
Reviewed-by: Gonglei <[email protected]>
Signed-off-by: Michael Tokarev <[email protected]>

Fix name error in migration stream analyzation script

It fixes the following error:

Traceback (most recent call last):
  File "./scripts/analyze-migration.py", line 584, in <module>
    dump.read(dump_memory = args.memory)
  File "./scripts/analyze-migration.py", line 528, in read
    self.sections[section_id].read()
  File "./scripts/analyze-migration.py", line 250, in read
    self.file.readvar(n_valid * HASH_PTE_SIZE_64)
NameError: global name 'HASH_PTE_SIZE_64' is not defined

Signed-off-by: Greg Kurz <[email protected]>
Signed-off-by: Michael Tokarev <[email protected]>

QJSON: fix typo in author's email address

Signed-off-by: Greg Kurz <[email protected]>
Signed-off-by: Michael Tokarev <[email protected]>

util/uri: URI member path can be null, compare more carfully

uri_resolve_relative() calls strcmp(bas->path, ref->path).  However,
either argument could be null!  Evidence: the code checks for null
after the comparison.  Spotted by Coverity.

I suspect this was screwed up when we stole the code from libxml2.
There the conditional reads

    xmlStrEqual((xmlChar *)bas->path, (xmlChar *)ref->path)

with

    int
    xmlStrEqual(const xmlChar *str1, const xmlChar *str2) {
if (str1 == str2) return(1);
if (str1 == NULL) return(0);
if (str2 == NULL) return(0);
do {
    if (*str1++ != *str2) return(0);
} while (*str2++);
return(1);
    }

Fix by replicating libxml2's logic faithfully.

Cc: Paolo Bonzini <[email protected]>
Signed-off-by: Markus Armbruster <[email protected]>
Signed-off-by: Michael Tokarev <[email protected]>

util/uri: realloc2n() can't fail, drop dead error handling

Signed-off-by: Markus Armbruster <[email protected]>
Signed-off-by: Michael Tokarev <[email protected]>

util/uri: uri_new() can't fail, drop dead error handling

Signed-off-by: Markus Armbruster <[email protected]>
Signed-off-by: Michael Tokarev <[email protected]>

usb: Pair g_malloc() with g_free(), not free()

Spotted by Coverity with preview checker ALLOC_FREE_MISMATCH enabled
and my "coverity: Model g_free() isn't necessarily free()" model patch
applied.

Signed-off-by: Markus Armbruster <[email protected]>
Reviewed-by: Eric Blake <[email protected]>
Signed-off-by: Michael Tokarev <[email protected]>

spapr_vio: Pair g_malloc() with g_free(), not free()

Spotted by Coverity with preview checker ALLOC_FREE_MISMATCH enabled
and my "coverity: Model g_free() isn't necessarily free()" model patch
applied.

Signed-off-by: Markus Armbruster <[email protected]>
Reviewed-by: Gonglei <[email protected]>
Reviewed-by: Eric Blake <[email protected]>
Signed-off-by: Michael Tokarev <[email protected]>

qemu-option: Pair g_malloc() with g_free(), not free()

Spotted by Coverity with preview checker ALLOC_FREE_MISMATCH enabled
and my "coverity: Model g_free() isn't necessarily free()" model patch
applied.

Signed-off-by: Markus Armbruster <[email protected]>
Reviewed-by: Gonglei <[email protected]>
Reviewed-by: Eric Blake <[email protected]>
Signed-off-by: Michael Tokarev <[email protected]>

qemu-option: Replace pointless use of g_malloc0() by g_malloc()

get_opt_value() takes a write-only buffer, so zeroing it is pointless.
We don't do it elsewhere, either.

Signed-off-by: Markus Armbruster <[email protected]>
Reviewed-by: Gonglei <[email protected]>
Reviewed-by: Eric Blake <[email protected]>
Signed-off-by: Michael Tokarev <[email protected]>

libcacard: stop linking against every single 3rd party library

Building QEMU results in a libcacard.so that links against
practically the entire world

linux-vdso.so.1 =>  (0x00007fff71e99000)
libssl3.so => /usr/lib64/libssl3.so (0x00007f49f94b6000)
libsmime3.so => /usr/lib64/libsmime3.so (0x00007f49f928e000)
libnss3.so => /usr/lib64/libnss3.so (0x00007f49f8f67000)
libnssutil3.so => /usr/lib64/libnssutil3.so (0x00007f49f8d3b000)
libplds4.so => /usr/lib64/libplds4.so (0x00007f49f8b36000)
libplc4.so => /usr/lib64/libplc4.so (0x00007f49f8931000)
libnspr4.so => /usr/lib64/libnspr4.so (0x00007f49f86f2000)
libdl.so.2 => /usr/lib64/libdl.so.2 (0x00007f49f84ed000)
libm.so.6 => /usr/lib64/libm.so.6 (0x00007f49f81e5000)
libgthread-2.0.so.0 => /usr/lib64/libgthread-2.0.so.0 (0x00007f49f7fe3000)
librt.so.1 => /usr/lib64/librt.so.1 (0x00007f49f7dda000)
libz.so.1 => /usr/lib64/libz.so.1 (0x00007f49f7bc4000)
libcap-ng.so.0 => /usr/lib64/libcap-ng.so.0 (0x00007f49f79be000)
libuuid.so.1 => /usr/lib64/libuuid.so.1 (0x00007f49f77b8000)
libgnutls.so.28 => /usr/lib64/libgnutls.so.28 (0x00007f49f749a000)
libSDL-1.2.so.0 => /usr/lib64/libSDL-1.2.so.0 (0x00007f49f71fd000)
libpthread.so.0 => /usr/lib64/libpthread.so.0 (0x00007f49f6fe0000)
libvte.so.9 => /usr/lib64/libvte.so.9 (0x00007f49f6d3f000)
libXext.so.6 => /usr/lib64/libXext.so.6 (0x00007f49f6b2d000)
libgtk-x11-2.0.so.0 => /usr/lib64/libgtk-x11-2.0.so.0 (0x00007f49f64a0000)
libgdk-x11-2.0.so.0 => /usr/lib64/libgdk-x11-2.0.so.0 (0x00007f49f61de000)
libpangocairo-1.0.so.0 => /usr/lib64/libpangocairo-1.0.so.0 (0x00007f49f5fd1000)
libatk-1.0.so.0 => /usr/lib64/libatk-1.0.so.0 (0x00007f49f5daa000)
libcairo.so.2 => /usr/lib64/libcairo.so.2 (0x00007f49f5a9d000)
libgdk_pixbuf-2.0.so.0 => /usr/lib64/libgdk_pixbuf-2.0.so.0 (0x00007f49f5878000)
libgio-2.0.so.0 => /usr/lib64/libgio-2.0.so.0 (0x00007f49f5500000)
libpangoft2-1.0.so.0 => /usr/lib64/libpangoft2-1.0.so.0 (0x00007f49f52eb000)
libpango-1.0.so.0 => /usr/lib64/libpango-1.0.so.0 (0x00007f49f50a0000)
libgobject-2.0.so.0 => /usr/lib64/libgobject-2.0.so.0 (0x00007f49f4e4e000)
libglib-2.0.so.0 => /usr/lib64/libglib-2.0.so.0 (0x00007f49f4b15000)
libfontconfig.so.1 => /usr/lib64/libfontconfig.so.1 (0x00007f49f48d6000)
libfreetype.so.6 => /usr/lib64/libfreetype.so.6 (0x00007f49f462b000)
libX11.so.6 => /usr/lib64/libX11.so.6 (0x00007f49f42e8000)
libxenstore.so.3.0 => /usr/lib64/libxenstore.so.3.0 (0x00007f49f40de000)
libxenctrl.so.4.4 => /usr/lib64/libxenctrl.so.4.4 (0x00007f49f3eb6000)
libxenguest.so.4.4 => /usr/lib64/libxenguest.so.4.4 (0x00007f49f3c8b000)
libseccomp.so.2 => /usr/lib64/libseccomp.so.2 (0x00007f49f3a74000)
librdmacm.so.1 => /usr/lib64/librdmacm.so.1 (0x00007f49f385d000)
libibverbs.so.1 => /usr/lib64/libibverbs.so.1 (0x00007f49f364a000)
libutil.so.1 => /usr/lib64/libutil.so.1 (0x00007f49f3447000)
libc.so.6 => /usr/lib64/libc.so.6 (0x00007f49f3089000)
/lib64/ld-linux-x86-64.so.2 (0x00007f49f9902000)
libp11-kit.so.0 => /usr/lib64/libp11-kit.so.0 (0x00007f49f2e23000)
libtspi.so.1 => /usr/lib64/libtspi.so.1 (0x00007f49f2bb2000)
libtasn1.so.6 => /usr/lib64/libtasn1.so.6 (0x00007f49f299f000)
libnettle.so.4 => /usr/lib64/libnettle.so.4 (0x00007f49f276d000)
libhogweed.so.2 => /usr/lib64/libhogweed.so.2 (0x00007f49f2545000)
libgmp.so.10 => /usr/lib64/libgmp.so.10 (0x00007f49f22cd000)
libncurses.so.5 => /usr/lib64/libncurses.so.5 (0x00007f49f20a5000)
libtinfo.so.5 => /usr/lib64/libtinfo.so.5 (0x00007f49f1e7a000)
libgmodule-2.0.so.0 => /usr/lib64/libgmodule-2.0.so.0 (0x00007f49f1c76000)
libXfixes.so.3 => /usr/lib64/libXfixes.so.3 (0x00007f49f1a6f000)
libXrender.so.1 => /usr/lib64/libXrender.so.1 (0x00007f49f1865000)
libXinerama.so.1 => /usr/lib64/libXinerama.so.1 (0x00007f49f1662000)
libXi.so.6 => /usr/lib64/libXi.so.6 (0x00007f49f1452000)
libXrandr.so.2 => /usr/lib64/libXrandr.so.2 (0x00007f49f1247000)
libXcursor.so.1 => /usr/lib64/libXcursor.so.1 (0x00007f49f103c000)
libXcomposite.so.1 => /usr/lib64/libXcomposite.so.1 (0x00007f49f0e39000)
libXdamage.so.1 => /usr/lib64/libXdamage.so.1 (0x00007f49f0c35000)
libharfbuzz.so.0 => /usr/lib64/libharfbuzz.so.0 (0x00007f49f09dd000)
libpixman-1.so.0 => /usr/lib64/libpixman-1.so.0 (0x00007f49f072f000)
libEGL.so.1 => /usr/lib64/libEGL.so.1 (0x00007f49f0505000)
libpng16.so.16 => /usr/lib64/libpng16.so.16 (0x00007f49f02d2000)
libxcb-shm.so.0 => /usr/lib64/libxcb-shm.so.0 (0x00007f49f00cd000)
libxcb-render.so.0 => /usr/lib64/libxcb-render.so.0 (0x00007f49efec3000)
libxcb.so.1 => /usr/lib64/libxcb.so.1 (0x00007f49efca1000)
libGL.so.1 => /usr/lib64/libGL.so.1 (0x00007f49efa06000)
libffi.so.6 => /usr/lib64/libffi.so.6 (0x00007f49ef7fe000)
libselinux.so.1 => /usr/lib64/libselinux.so.1 (0x00007f49ef5d8000)
libresolv.so.2 => /usr/lib64/libresolv.so.2 (0x00007f49ef3be000)
libexpat.so.1 => /usr/lib64/libexpat.so.1 (0x00007f49ef193000)
libbz2.so.1 => /usr/lib64/libbz2.so.1 (0x00007f49eef83000)
libgcc_s.so.1 => /usr/lib64/libgcc_s.so.1 (0x00007f49eed6c000)
liblzma.so.5 => /usr/lib64/liblzma.so.5 (0x00007f49eeb46000)
libnl-route-3.so.200 => /usr/lib64/libnl-route-3.so.200 (0x00007f49ee8e2000)
libnl-3.so.200 => /usr/lib64/libnl-3.so.200 (0x00007f49ee6c4000)
libcrypto.so.10 => /usr/lib64/libcrypto.so.10 (0x00007f49ee2d6000)
libssl.so.10 => /usr/lib64/libssl.so.10 (0x00007f49ee067000)
libgraphite2.so.3 => /usr/lib64/libgraphite2.so.3 (0x00007f49ede48000)
libX11-xcb.so.1 => /usr/lib64/libX11-xcb.so.1 (0x00007f49edc46000)
libxcb-dri2.so.0 => /usr/lib64/libxcb-dri2.so.0 (0x00007f49eda41000)
libxcb-xfixes.so.0 => /usr/lib64/libxcb-xfixes.so.0 (0x00007f49ed838000)
libxcb-shape.so.0 => /usr/lib64/libxcb-shape.so.0 (0x00007f49ed634000)
libgbm.so.1 => /usr/lib64/libgbm.so.1 (0x00007f49ed426000)
libwayland-client.so.0 => /usr/lib64/libwayland-client.so.0 (0x00007f49ed217000)
libwayland-server.so.0 => /usr/lib64/libwayland-server.so.0 (0x00007f49ed005000)
libglapi.so.0 => /usr/lib64/libglapi.so.0 (0x00007f49ecddb000)
libdrm.so.2 => /usr/lib64/libdrm.so.2 (0x00007f49ecbce000)
libXau.so.6 => /usr/lib64/libXau.so.6 (0x00007f49ec9ca000)
libxcb-glx.so.0 => /usr/lib64/libxcb-glx.so.0 (0x00007f49ec7b0000)
libxcb-dri3.so.0 => /usr/lib64/libxcb-dri3.so.0 (0x00007f49ec5ad000)
libxcb-present.so.0 => /usr/lib64/libxcb-present.so.0 (0x00007f49ec3aa000)
libxcb-randr.so.0 => /usr/lib64/libxcb-randr.so.0 (0x00007f49ec19b000)
libxcb-sync.so.1 => /usr/lib64/libxcb-sync.so.1 (0x00007f49ebf94000)
libxshmfence.so.1 => /usr/lib64/libxshmfence.so.1 (0x00007f49ebd91000)
libXxf86vm.so.1 => /usr/lib64/libXxf86vm.so.1 (0x00007f49ebb8a000)
libpcre.so.1 => /usr/lib64/libpcre.so.1 (0x00007f49eb91d000)
libgssapi_krb5.so.2 => /usr/lib64/libgssapi_krb5.so.2 (0x00007f49eb6cf000)
libkrb5.so.3 => /usr/lib64/libkrb5.so.3 (0x00007f49eb3ec000)
libcom_err.so.2 => /usr/lib64/libcom_err.so.2 (0x00007f49eb1e8000)
libk5crypto.so.3 => /usr/lib64/libk5crypto.so.3 (0x00007f49eafb4000)
libkrb5support.so.0 => /usr/lib64/libkrb5support.so.0 (0x00007f49eada5000)
libkeyutils.so.1 => /usr/lib64/libkeyutils.so.1 (0x00007f49eaba0000)

All libcacard actually needs are the NSS libs. Linking against the entire
world is a regression caused by

  commit 9d171bd9375e4d08feff9adda15163e0811f5f42
  Author: Michael Tokarev <[email protected]>
  Date:   Thu May 8 16:48:27 2014 +0400

    libcacard: remove libcacard-specific CFLAGS and LIBS from global vars

Which removed the setting of the LIBS variable in libcacard/Makefile.

Adding it back as an empty assignment brings the linked libs back to a more
reasonable set

linux-vdso.so.1 =>  (0x00007fff575c1000)
libssl3.so => /usr/lib64/libssl3.so (0x00007f7f753b1000)
libsmime3.so => /usr/lib64/libsmime3.so (0x00007f7f75189000)
libnss3.so => /usr/lib64/libnss3.so (0x00007f7f74e62000)
libnssutil3.so => /usr/lib64/libnssutil3.so (0x00007f7f74c36000)
libplds4.so => /usr/lib64/libplds4.so (0x00007f7f74a31000)
libplc4.so => /usr/lib64/libplc4.so (0x00007f7f7482c000)
libnspr4.so => /usr/lib64/libnspr4.so (0x00007f7f745ed000)
libpthread.so.0 => /usr/lib64/libpthread.so.0 (0x00007f7f743d0000)
libdl.so.2 => /usr/lib64/libdl.so.2 (0x00007f7f741cc000)
libgthread-2.0.so.0 => /usr/lib64/libgthread-2.0.so.0 (0x00007f7f73fca000)
libglib-2.0.so.0 => /usr/lib64/libglib-2.0.so.0 (0x00007f7f73c90000)
libc.so.6 => /usr/lib64/libc.so.6 (0x00007f7f738d3000)
libz.so.1 => /usr/lib64/libz.so.1 (0x00007f7f736bd000)
librt.so.1 => /usr/lib64/librt.so.1 (0x00007f7f734b4000)
/lib64/ld-linux-x86-64.so.2 (0x00007f7f757fd000)

Signed-off-by: Daniel P. Berrange <[email protected]>
Cc: <[email protected]>
Reviewed-by: Paolo Bonzini <[email protected]>
Signed-off-by: Michael Tokarev <[email protected]>

linux-user: wrong TARGET_SI_PAD_SIZE value for some targets.

Fix TARGET_SI_PAD_SIZE calculation to match the way the kernel does it.
Use different TARGET_SI_PREAMBLE_SIZE for 32-bit and 64-bit targets.

Signed-off-by: Maxim Ostapenko <[email protected]>
Reviewed-by: Peter Maydell <[email protected]>
Signed-off-by: Michael Tokarev <[email protected]>

qemu-sockets: Fix buffer overflow in inet_parse()

The size of the stack allocated host[] array didn't account for the
terminating '\0' byte that sscanf() writes. Fix the array size.

Signed-off-by: Kevin Wolf <[email protected]>
Reviewed-by: John Snow <[email protected]>
Signed-off-by: Michael Tokarev <[email protected]>

vl.c: fix memory leak spotted by valgrind

valgrind complains about:
==42062== 16 bytes in 1 blocks are definitely lost in loss record 387 of 1,048
==42062==    at 0x402DCB2: malloc (vg_replace_malloc.c:299)
==42062==    by 0x40C1BE3: g_malloc (in /usr/lib64/libglib-2.0.so.0.3800.2)
==42062==    by 0x40DA133: g_slice_alloc (in /usr/lib64/libglib-2.0.so.0.3800.2)
==42062==    by 0x40DB2E5: g_slist_prepend (in /usr/lib64/libglib-2.0.so.0.3800.2)
==42062==    by 0x801637FF: object_class_get_list_tramp (object.c:690)
==42062==    by 0x40A96C9: g_hash_table_foreach (in /usr/lib64/libglib-2.0.so.0.3800.2)
==42062==    by 0x80164885: object_class_foreach (object.c:665)
==42062==    by 0x80164975: object_class_get_list (object.c:698)
==42062==    by 0x800100A5: machine_parse (vl.c:2447)
==42062==    by 0x800100A5: main (vl.c:3756)

Lets free machines in case of mc.

Signed-off-by: Christian Borntraeger <[email protected]>
Reviewed-by: Paolo Bonzini <[email protected]>
Signed-off-by: Michael Tokarev <[email protected]>

aes: remove a dead return statement

bits is checked to be 128, 192 or 256 at the beginning of the function.

Signed-off-by: Paolo Bonzini <[email protected]>
Signed-off-by: Michael Tokarev <[email protected]>

qemu-sockets: improve error reporting in unix_listen_opts

Coverity complains about not checking the returned value of mkstemp.  While
at it, also improve error checking for snprintf, and refine error messages
in general.

Signed-off-by: Paolo Bonzini <[email protected]>
Signed-off-by: Michael Tokarev <[email protected]>

cpu-exec: simplify icount code

Use MIN instead of an "if" statement.  Move "tb" assignment where
the value is actually used.

Signed-off-by: Paolo Bonzini <[email protected]>
Signed-off-by: Michael Tokarev <[email protected]>

cpu-exec: drop dead assignment

All uses of TB inside cpu_exec are dominated by "tb = tb_find_fast(env)",
and there are no uses after the switch statement.  So the assignment
is dead, as reported by Coverity.

Signed-off-by: Paolo Bonzini <[email protected]>
Signed-off-by: Michael Tokarev <[email protected]>

qemu-log: Correct help text of 'log cpu_reset'

The logging of the CPU state during reset is done for all architectures
nowadays (see cpu_common_reset() in qom/cpu.c), so the "x86 only" text
does not apply here anymore.

Signed-off-by: Thomas Huth <[email protected]>
Signed-off-by: Michael Tokarev <[email protected]>

linux-user/syscall.c: do_ioctl_dm: Need to call unlock_user() before going to failure return in default case

In abi_long do_ioctl_dm(), after lock_user() call, the code does
not call unlock_user() before going to failure return in default case.

Signed-off-by: Chen Gang <[email protected]>
Reviewed-by: Peter Maydell <[email protected]>
Signed-off-by: Michael Tokarev <[email protected]>

linux-user/main.c: Use TARGET_SIG* instead of SIG*

In main.c, all SIG* should be TARGET_SIG*, since the relevant functions
(queue_signal() and gdb_handlesig()) expect TARGET_SIG*.

The corresponding vi command is "1,$ s/\<SIG/TARGET_SIG/g".

Signed-off-by: Chen Gang <[email protected]>
Reviewed-by: Peter Maydell <[email protected]>
Signed-off-by: Michael Tokarev <[email protected]>

linux-user/syscall.c: Fix typo issue for using target_vec[i].iov_len instead of target_vec[i].iov_base

It is only a typo issue, need use tswapal(target_vec[i].iov_len) for the
len.

Signed-off-by: Chen Gang <[email protected]>
Reviewed-by: Peter Maydell <[email protected]>
Signed-off-by: Michael Tokarev <[email protected]>

linux-user/syscall.c: lock_iovec: unlock vec[i] in failure processing code block

When failure occurs during locking of vec[i], we also need to unlock all
already locked vec[i] in failure processing code block before return.

Code in unlock_user() checks vec[i].iov_base for NULL, so there's no
need not check it .

If error is EFAULT when "i == 0", vec[i].iov_base is NULL, we can just
skip it, so can still use "while (--i >= 0)" loop condition.

Signed-off-by: Chen Gang <[email protected]>
Reviewed-by: Peter Maydell <[email protected]>
Signed-off-by: Michael Tokarev <[email protected]>

virtfs-proxy-helper: Fix possible socket leak.

Signed-off-by: Gonglei <[email protected]>
Reviewed-by: Markus Armbruster <[email protected]>
Signed-off-by: Michael Tokarev <[email protected]>

vl: Fix bogus error message for implied mon ID clashing

monitor_parse() desugars --monitor, --qmp and -qmp-pretty to --mon.
The ID it picks can clash with a user-specified ID.  When it happens,
the error message is misleading.

Reproducer:

    $ qemu --mon id=compat_monitor0 --monitor stdio

Message before the patch:

    duplicate chardev: compat_monitor0

There's no "duplicate chardev" here.  The problem is a duplicate
monitor ID.  Moreover, the message provides no clue which option
caused the problem.  The patch changes the message to:

    qemu: --monitor stdio: Duplicate ID 'compat_monitor0' for mon

monitor_parse() is also used for creating a default monitor, but
that's not done when the user specifies a monitor, so an ID clash is
impossible then.

Signed-off-by: Markus Armbruster <[email protected]>
Signed-off-by: Michael Tokarev <[email protected]>

Convert some debugging printfs to trace calls in pcnet.c.

Signed-off-by: Don Koch <[email protected]>
Signed-off-by: Michael Tokarev <[email protected]>

Add/convert trace calls in pcnet-pci.c.

Add trace calls. Convert some #ifdef DEBUG printfs to trace.

Signed-off-by: Don Koch <[email protected]>
Signed-off-by: Michael Tokarev <[email protected]>

Add trace to ps2.c.

Signed-off-by: Don Koch <[email protected]>
Signed-off-by: Michael Tokarev <[email protected]>

Add tracing to xenfb.

Signed-off-by: Don Koch <[email protected]>
Signed-off-by: Michael Tokarev <[email protected]>

fw_cfg: fix typos in comments: patch -> path

Signed-off-by: Gonglei <[email protected]>
Signed-off-by: Michael Tokarev <[email protected]>

target-mips: Clean up switch fall through after commit fecd264

Commit fecd264 added a number of fall-throughs, but neglected to
properly document them as intentional.  Commit d922445 cleaned that up
for many, but not all cases.  Take care of the remaining ones.

Spotted by Coverity.

Signed-off-by: Markus Armbruster <[email protected]>
Signed-off-by: Michael Tokarev <[email protected]>

qmp: unbreak build for non-vnc configuration

Signed-off-by: Leon Yu <[email protected]>
Message-id: 1422853731[email protected]
Fixes: df887684603a ("monitor: add query-vnc-servers command")
Signed-off-by: Peter Maydell <[email protected]>

Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging

Block patches for 2.3

# gpg: Signature made Fri 06 Feb 2015 17:14:10 GMT using RSA key ID C88F2FD6
# gpg: Good signature from "Kevin Wolf <[email protected]>"

* remotes/kevin/tags/for-upstream: (47 commits)
  block/raw-posix.c: Fix raw_getlength() on Mac OS X block devices
  block: Eliminate silly QERR_ macros used for encryption keys
  block: New bdrv_add_key(), convert monitor to use it
  blockdev: Eliminate silly QERR_BLOCK_JOB_NOT_ACTIVE macro
  blockdev: Give find_block_job() an Error ** parameter
  qcow2: Rewrite qcow2_alloc_bytes()
  block: Give always priority to unused entries in the qcow2 L2 cache
  nbd: fix max_discard/max_transfer_length
  block: introduce BDRV_REQUEST_MAX_SECTORS
  nbd: Improve error messages
  iotests: Fix 104 for NBD
  iotests: Fix 100 for nbd
  iotests: Fix 083
  block: fix off-by-one error in qcow and qcow2
  qemu-iotests: add 116 invalid QED input file tests
  qed: check for header size overflow
  block/dmg: improve zeroes handling
  block/dmg: support bzip2 block entry types
  block/dmg: factor out block type check
  block/dmg: use SectorNumber from BLKX header
  ...

Signed-off-by: Peter Maydell <[email protected]>

block/raw-posix.c: Fix raw_getlength() on Mac OS X block devices

This patch replaces the dummy code in raw_getlength() for block devices
on OS X, which always returned LLONG_MAX, with a real implementation
that returns the actual block device size.

Signed-off-by: John Arbuckle <[email protected]>
Reviewed-by: Stefan Hajnoczi <[email protected]>
Tested-by: Peter Maydell <[email protected]>
Signed-off-by: Kevin Wolf <[email protected]>

Merge remote-tracking branch 'mreitz/block' into queue-block

* mreitz/block:
  block: Eliminate silly QERR_ macros used for encryption keys
  block: New bdrv_add_key(), convert monitor to use it
  blockdev: Eliminate silly QERR_BLOCK_JOB_NOT_ACTIVE macro
  blockdev: Give find_block_job() an Error ** parameter

block: Eliminate silly QERR_ macros used for encryption keys

The QERR_ macros are leftovers from the days of "rich" error objects.
They're used with error_set() and qerror_report(), and expand into the
first *two* arguments.  This trickiness has become pointless.  Clean
up QERR_DEVICE_ENCRYPTED and QERR_DEVICE_NOT_ENCRYPTED.

Signed-off-by: Markus Armbruster <[email protected]>
Reviewed-by: Eric Blake <[email protected]>
Message-id: 1422524221[email protected]
Reviewed-by: Max Reitz <[email protected]>
Signed-off-by: Max Reitz <[email protected]>

block: New bdrv_add_key(), convert monitor to use it

Signed-off-by: Markus Armbruster <[email protected]>
Reviewed-by: Eric Blake <[email protected]>
Message-id: 1422524221[email protected]
Reviewed-by: Max Reitz <[email protected]>
Signed-off-by: Max Reitz <[email protected]>

blockdev: Eliminate silly QERR_BLOCK_JOB_NOT_ACTIVE macro

The QERR_ macros are leftovers from the days of "rich" error objects.
They're used with error_set() and qerror_report(), and expand into the
first *two* arguments.  This trickiness has become pointless.  Clean
this one up.

Signed-off-by: Markus Armbruster <[email protected]>
Reviewed-by: Eric Blake <[email protected]>
Message-id: 1422524221[email protected]
Reviewed-by: Max Reitz <[email protected]>
Signed-off-by: Max Reitz <[email protected]>

blockdev: Give find_block_job() an Error ** parameter

When find_block_job() fails, all its callers build the same Error
object.  Build it in find_block_job() instead.

Signed-off-by: Markus Armbruster <[email protected]>
Reviewed-by: Eric Blake <[email protected]>
Message-id: 1422524221[email protected]
Reviewed-by: Max Reitz <[email protected]>
Signed-off-by: Max Reitz <[email protected]>

qcow2: Rewrite qcow2_alloc_bytes()

qcow2_alloc_bytes() is a function with insufficient error handling and
an unnecessary goto. This patch rewrites it.

Signed-off-by: Max Reitz <[email protected]>
Signed-off-by: Kevin Wolf <[email protected]>

block: Give always priority to unused entries in the qcow2 L2 cache

The current algorithm to replace entries from the L2 cache gives
priority to newer hits by dividing the hit count of all existing
entries by two everytime there is a cache miss.

However, if there are several cache misses the hit count of the
existing entries can easily go down to 0. This will result in those
entries being replaced even when there are others that have never been
used.

This problem is more noticeable with larger disk images and cache
sizes, since the chances of having several misses before the cache is
full are higher.

If we make sure that the hit count can never go down to 0 again,
unused entries will always have priority.

Signed-off-by: Alberto Garcia <[email protected]>
Reviewed-by: Max Reitz <[email protected]>
Signed-off-by: Kevin Wolf <[email protected]>

nbd: fix max_discard/max_transfer_length

nbd_co_discard calls nbd_client_session_co_discard which uses uint32_t
as the length in bytes of the data to discard due to the following
definition:

struct nbd_request {
    uint32_t magic;
    uint32_t type;
    uint64_t handle;
    uint64_t from;
    uint32_t len; <-- the length of data to be discarded, in bytes
} QEMU_PACKED;

Thus we should limit bl_max_discard to UINT32_MAX >> BDRV_SECTOR_BITS to
avoid overflow.

NBD read/write code uses the same structure for transfers. Fix
max_transfer_length accordingly.

Signed-off-by: Denis V. Lunev <[email protected]>
CC: Peter Lieven <[email protected]>
CC: Kevin Wolf <[email protected]>
Signed-off-by: Kevin Wolf <[email protected]>