target-mips: Fix seg fault for LUI when MIPS_DEBUG_DISAS==1.

The call to gen_logic_imm for OPC_LUI passes -1 for rs.  This
causes the MIPS_DEBUG statement to seg fault due to the deference
of regnames[rs].  This patch fixes that.

Signed-off-by: Eric Johnson <[email protected]>
Signed-off-by: Aurelien Jarno <[email protected]>
(aurel32: replaced static string formating by a static string)

target-i386: avoid using cpu_single_env

Pass around CPUArchState instead of using global cpu_single_env.

Signed-off-by: Blue Swirl <[email protected]>
Reviewed-by: Andreas Färber <[email protected]>

target-xtensa: avoid using cpu_single_env

Pass around CPUArchState instead of using global cpu_single_env.

Signed-off-by: Blue Swirl <[email protected]>
Acked-by: Max Filippov <[email protected]>
Reviewed-by: Andreas Färber <[email protected]>

target-unicore32: avoid using cpu_single_env

Pass around CPUArchState instead of using global cpu_single_env.

Signed-off-by: Blue Swirl <[email protected]>
Acked-by: Guan Xuetao <[email protected]>
Reviewed-by: Andreas Färber <[email protected]>

kvm: avoid using cpu_single_env

Pass around CPUArchState instead of using global cpu_single_env.

Signed-off-by: Blue Swirl <[email protected]>
Reviewed-by: Andreas Färber <[email protected]>

disas: avoid using cpu_single_env

Pass around CPUArchState instead of using global cpu_single_env.

Signed-off-by: Blue Swirl <[email protected]>
Acked-by: Richard Henderson <[email protected]>
Acked-by: Aurelien Jarno <[email protected]>
Acked-by: Guan Xuetao <[email protected]>

slirp: remove unused function u_sleep

Signed-off-by: Blue Swirl <[email protected]>

sun4c: remove unused functions

Signed-off-by: Blue Swirl <[email protected]>

m48t59: remove unused m48t59_set_addr

Signed-off-by: Blue Swirl <[email protected]>

tests/tcg: new test for i386 FPREM and FPREM1

This is setting the stage for a cleanup of FPREM and FPREM1 helpers while being
sure that they behave same as bare metal.

The test constructs operands using combinations of corner cases for the
floating-point bitfields and prints operands, result and FPU status word for
FPREM and FPREM1. The outputs can then be compared between bare metal and QEMU.
The 'run-test-i386-fprem' make target does just that.

Signed-off-by: Catalin Patulea <[email protected]>
Signed-off-by: Blue Swirl <[email protected]>

memory: Don't dump disabled regions

This makes "info mtree" output readable again.

Signed-off-by: Jan Kiszka <[email protected]>
Signed-off-by: Blue Swirl <[email protected]>

memory: Reintroduce dirty flag to optimize changes on disabled regions

Cirrus is triggering this, e.g. during Win2k boot: Changes only on
disabled regions require no topology update when transaction depth drops
to 0 again.

Signed-off-by: Jan Kiszka <[email protected]>
Signed-off-by: Blue Swirl <[email protected]>

qemu-timer: Fix compilation for non-POSIX hosts

A compiler warning is caused by the unused local function reinit_timers
on non-POSIX hosts. Include that function only for POSIX hosts.

Signed-off-by: Stefan Weil <[email protected]>
Signed-off-by: Blue Swirl <[email protected]>

vmware_vga: Add back some info in local state partially reverting aa32b38c

Keep saving display surface parameters at init and using these cached
values instead of getting them when needed. Not sure why this is
needed (maybe due to the interaction with the vga device) but not
doing this broke the Xorg vmware driver at least.

Signed-off-by: BALATON Zoltan <[email protected]>
Tested-by: Jan Kiszka <[email protected]>
Signed-off-by: Blue Swirl <[email protected]>

kvmvapic: Fix TB invalidation after instruction patching

Since 0b57e287, cpu_memory_rw_debug already triggers a TB invalidation.
As it doesn't (and cannot) set is_cpu_write_access=1 but "consumes" the
currently executed TB, the tb_invalidate_phys_page_range call from
patch_instruction didn't work anymore.

Fix this by open-coding the required bits to restore the CPU state from
the current TB position before patching and resume execution on the
patched instruction afterward.

Signed-off-by: Jan Kiszka <[email protected]>
Tested-by: Hervé Poussineau <[email protected]>
Signed-off-by: Blue Swirl <[email protected]>

microblaze: translate.c: Fix swaph decoding

The swaph instruction was not decoding correctly. s/1e1/1e2 on the
9 LSBs on the instruction decode.

Reported-by: David Holsgrove <[email protected]>
Signed-off-by: Peter Crosthwaite <[email protected]>
Signed-off-by: Edgar E. Iglesias <[email protected]>

tools: initialize main loop before block layer

Tools were broken because they initialized the block layer while
qemu_aio_context was still NULL.

Reported-by: malc <[email protected]>
Signed-off-by: Paolo Bonzini <[email protected]>
Signed-off-by: malc <[email protected]>

tcg/ppc32: Use trampolines to trim the code size for mmu slow path accessors

mmu access looks something like:

<check tlb>
if miss goto slow_path
<fast path>
done:
...

; end of the TB
slow_path:
 <pre process>
 mr r3, r27         ; move areg0 to r3
                    ; (r3 holds the first argument for all the PPC32 ABIs)
 <call mmu_helper>
 b $+8
 .long done
 <post process>
 b done

On ppc32 <call mmu_helper> is:

(SysV and Darwin)

mmu_helper is most likely not within direct branching distance from
the call site, necessitating

a. moving 32 bit offset of mmu_helper into a GPR ; 8 bytes
b. moving GPR to CTR/LR                          ; 4 bytes
c. (finally) branching to CTR/LR                 ; 4 bytes

r3 setting              - 4 bytes
call                    - 16 bytes
dummy jump over retaddr - 4 bytes
embedded retaddr        - 4 bytes
         Total overhead - 28 bytes

(PowerOpen (AIX))
a. moving 32 bit offset of mmu_helper's TOC into a GPR1 ; 8 bytes
b. loading 32 bit function pointer into GPR2            ; 4 bytes
c. moving GPR2 to CTR/LR                                ; 4 bytes
d. loading 32 bit small area pointer into R2            ; 4 bytes
e. (finally) branching to CTR/LR                        ; 4 bytes

r3 setting              - 4 bytes
call                    - 24 bytes
dummy jump over retaddr - 4 bytes
embedded retaddr        - 4 bytes
         Total overhead - 36 bytes

Following is done to trim the code size of slow path sections:

In tcg_target_qemu_prologue trampolines are emitted that look like this:

trampoline:
mfspr r3, LR
addi  r3, 4
mtspr LR, r3      ; fixup LR to point over embedded retaddr
mr    r3, r27
<jump mmu_helper> ; tail call of sorts

And slow path becomes:

slow_path:
 <pre process>
 <call trampoline>
 .long done
 <post process>
 b done

call                    - 4 bytes (trampoline is within code gen buffer
                                   and most likely accessible via
                                   direct branch)
embedded retaddr        - 4 bytes
         Total overhead - 8 bytes

In the end the icache pressure is decreased by 20/28 bytes at the cost
of an extra jump to trampoline and adjusting LR (to skip over embedded
retaddr) once inside.

Signed-off-by: malc <[email protected]>

target-mips: use ULL for 64 bit constants

Fix build on a 32 bit host:
  CC    mips-softmmu/target-mips/dsp_helper.o
/src/qemu/target-mips/dsp_helper.c: In function 'helper_dextr_rs_w':
/src/qemu/target-mips/dsp_helper.c:3556: error: integer constant is too large for 'long' type
/src/qemu/target-mips/dsp_helper.c: In function 'helper_extr_s_h':
/src/qemu/target-mips/dsp_helper.c:3656: error: integer constant is too large for 'long' type

Signed-off-by: Blue Swirl <[email protected]>
Signed-off-by: Aurelien Jarno <[email protected]>

build: pthread_atfork() needs include of pthread.h

Cc: Paolo Bonzini <[email protected]>
Signed-off-by: Anthony Liguori <[email protected]>

tcg/ppc: ld/st optimization

Signed-off-by: malc <[email protected]>

vmware_vga: Allow simple drivers to work without using the fifo

Postpone stopping the dirty log to the point where the command fifo is
configured to allow drivers which don't use the fifo to work too.
(Without this the picture rendered into the vram never got to the
screen and the DIRECT_VRAM option meant to support this case was
removed a year ago.)

Signed-off-by: BALATON Zoltan <[email protected]>
Signed-off-by: Blue Swirl <[email protected]>

vmware_vga: Return a value for FB_SIZE before the device is enabled

According to the documentation drivers using this device should read
FB_SIZE before enabling the device to know what memory to map. This
would not work if we return 0 before enabled. The docs also mention
reading SVGA_REG_DEPTH but not writing it. (Only SVGA_REG_BITS_PER_PIXEL
can be written but we don't really support that either.)

Signed-off-by: BALATON Zoltan <[email protected]>
Signed-off-by: Blue Swirl <[email protected]>

vmware_vga: Remove duplicated info from local state

Removed info from vmsvga_state that is available from elsewhere and
thus was duplicated here unnecessarily.

Signed-off-by: BALATON Zoltan <[email protected]>
Signed-off-by: Blue Swirl <[email protected]>

vmware_vga: Coding style cleanup

Fix coding style as suggested by checkpatch.pl

Signed-off-by: BALATON Zoltan <[email protected]>
Signed-off-by: Blue Swirl <[email protected]>

Merge branch 'trivial-patches' of git://github.com/stefanha/qemu

* 'trivial-patches' of git://github.com/stefanha/qemu:
  pc: Drop redundant test for ROM memory region
  exec: make some functions static
  target-ppc: make some functions static
  ppc: add missing static
  vnc: add missing static
  vl.c: add missing static
  target-sparc: make do_unaligned_access static
  m68k: Return semihosting errno values correctly
  cadence_uart: More debug information

Conflicts:
target-m68k/m68k-semi.c

tcg: Optimize qemu_ld/st by generating slow paths at the end of a block

Add optimized TCG qemu_ld/st generation which locates the code of TLB miss
cases at the end of a block after generating the other IRs.
Currently, this optimization supports only i386 and x86_64 hosts.

Signed-off-by: Yeongkyoon Lee <[email protected]>
Signed-off-by: Blue Swirl <[email protected]>

tcg: Add extended GETPC mechanism for MMU helpers with ldst optimization

Add GETPC_EXT which is used by MMU helpers to selectively calculate the code
address of accessing guest memory when called from a qemu_ld/st optimized code
or a C function. Currently, it supports only i386 and x86-64 hosts.

Signed-off-by: Yeongkyoon Lee <[email protected]>
Signed-off-by: Blue Swirl <[email protected]>

configure: Add CONFIG_QEMU_LDST_OPTIMIZATION for TCG qemu_ld/st optimization

Enable CONFIG_QEMU_LDST_OPTIMIZATION for TCG qemu_ld/st optimization only when
a host is i386 or x86_64.

Signed-off-by: Yeongkyoon Lee <[email protected]>
Signed-off-by: Blue Swirl <[email protected]>

target-m68k/m68k-semi.c: Log when put_user for returning values fails

Abstract out the use of put_user for returning semihosting call results,
so that we can log when a guest erroneously attempts a semihosting call
with an unwritable argument block.

Signed-off-by: Peter Maydell <[email protected]>
Signed-off-by: Blue Swirl <[email protected]>

target-m68k/m68k-semi: Handle get_user failure

Handle failure of get_user accessing the semihosting
argument block, rather than simply ignoring the failures.

Signed-off-by: Peter Maydell <[email protected]>
Signed-off-by: Blue Swirl <[email protected]>

m68k: Return semihosting errno values correctly

Fixing a simple typo, s/errno/err/, that caused
the error status from GDB semihosted system calls
to be returned incorrectly.

Signed-off-by: Meador Inge <[email protected]>
Reviewed-by: Andreas Färber <[email protected]>
Signed-off-by: Peter Maydell <[email protected]>
Signed-off-by: Blue Swirl <[email protected]>

vl: delay thread initialization after daemonization

Commit ac4119c (chardev: Use timer instead of bottom-half to postpone
open event, 2012-10-12) moved the alarm timer initialization to an earlier
point but failed to consider that it depends on qemu_init_main_loop.

Later, commit 1c53786 (vl: init main loop earlier, 2012-10-30) fixed
this, but left -daemonize in two different ways.  First, timers need to
be reinitialized after forking.  Second, the global mutex was being held
by the parent, and thus dropped after forking.

The first is now fixed using pthread_atfork.  For the second part,
make sure that the global mutex is not taken before daemonization,
and similarly delay qemu_thread_self.

Signed-off-by: Paolo Bonzini <[email protected]>
Signed-off-by: Anthony Liguori <[email protected]>

vl: unify calls to init_timer_alarm

init_timer_alarm was being called twice.  This is not needed.

Signed-off-by: Paolo Bonzini <[email protected]>
Signed-off-by: Anthony Liguori <[email protected]>

qemu-timer: reinitialize timers after fork

Timers are not inherited by the child of a fork(2), so just use
pthread_atfork to reinstate them after daemonize.

Signed-off-by: Paolo Bonzini <[email protected]>
Signed-off-by: Anthony Liguori <[email protected]>

semaphore: implement fallback counting semaphores with mutex+condvar

OpenBSD and Darwin do not have sem_timedwait.  Implement a fallback
for them.

Signed-off-by: Paolo Bonzini <[email protected]>
Signed-off-by: Anthony Liguori <[email protected]>

compiler: support Darwin weak references

Weakrefs only tell you if the symbol was defined elsewhere, so you
need a further check at runtime to pick the default definition
when needed.

This could be automated by the compiler, but it does not do it.

Signed-off-by: Paolo Bonzini <[email protected]>
Signed-off-by: Anthony Liguori <[email protected]>

Merge remote-tracking branch 'bonzini/migr-coroutine' into staging

Signed-off-by: Anthony Liguori <[email protected]>
* bonzini/migr-coroutine:
  migration: move process_incoming_migration to a coroutine
  migration: handle EAGAIN while reading QEMUFile
  migration: move qemu_fclose to process_incoming_migration
  migration: close socket QEMUFile from socket_close
  migration: xxx_close will only be called once
  migration: use closesocket, not close
  migration: use migrate_fd_close in migrate_fd_cleanup
  migration: clean up server sockets and handlers before invoking process_incoming_migration
  migration: replace qemu_stdio_fd with qemu_get_fd
  migration: add qemu_get_fd
  migration: consolidate QEMUFile methods in a single QEMUFileOps struct
  migration: unify stdio-based QEMUFile operations

Merge remote-tracking branch 'afaerber/qom-cpu' into staging

Signed-off-by: Anthony Liguori <[email protected]>
* afaerber/qom-cpu:
  target-i386: cpu: fix --disable-kvm compilation

migration: move process_incoming_migration to a coroutine

The final part of incoming migration, which now consists of
process_incoming_migration for all protocols, is thus made non-blocking.

Reviewed-by: Orit Wasserman <[email protected]>
Signed-off-by: Paolo Bonzini <[email protected]>

migration: handle EAGAIN while reading QEMUFile

This will never happen right now (the assertion would fail).  The
next patch will set the socket or pipe in non-blocking mode, thus
enabling this part of the code.

Coroutines can just stop whenever they want with qemu_coroutine_yield.
As soon as select tells the main loop that the migration stream is
readable, the coroutine is re-entered directly in qemu_get_buffer,
where it will read more data and pass it to the loading routines.

Signed-off-by: Paolo Bonzini <[email protected]>

migration: move qemu_fclose to process_incoming_migration

The common suffix is now just process_incoming_migration.

Reviewed-by: Orit Wasserman <[email protected]>
Signed-off-by: Paolo Bonzini <[email protected]>

migration: close socket QEMUFile from socket_close

The common suffix now is process_incoming_migration+qemu_fclose.

Reviewed-by: Orit Wasserman <[email protected]>
Signed-off-by: Paolo Bonzini <[email protected]>

migration: xxx_close will only be called once

No need to test s->fd again, it is tested in the caller.

Reviewed-by: Orit Wasserman <[email protected]>
Signed-off-by: Paolo Bonzini <[email protected]>

migration: use closesocket, not close

Windows requires this.  Migration does not quite work under Windows
but let's be uniform across QEMU.

Reviewed-by: Orit Wasserman <[email protected]>
Signed-off-by: Paolo Bonzini <[email protected]>

migration: use migrate_fd_close in migrate_fd_cleanup

migrate_fd_cleanup will usually close the file descriptor via
buffered_file_close's call to migrate_fd_close.  However, in the case
of s->file == NULL it is "inlining" migrate_fd_close (almost: there is a
direct close() instead of using s->close(s)).  To fix the inconsistency
and clean up the code, allow multiple calls to migrate_fd_close and use
the function in migrate_fd_cleanup.

Signed-off-by: Paolo Bonzini <[email protected]>

migration: clean up server sockets and handlers before invoking process_incoming_migration

A first step towards making a common "suffix" for all migration protocols,
and moving it to process_incoming_migration.

Reviewed-by: Orit Wasserman <[email protected]>
Signed-off-by: Paolo Bonzini <[email protected]>

migration: replace qemu_stdio_fd with qemu_get_fd

Reviewed-by: Orit Wasserman <[email protected]>
Signed-off-by: Paolo Bonzini <[email protected]>

migration: add qemu_get_fd

Reviewed-by: Orit Wasserman <[email protected]>
Signed-off-by: Paolo Bonzini <[email protected]>

migration: consolidate QEMUFile methods in a single QEMUFileOps struct

Reviewed-by: Orit Wasserman <[email protected]>
Signed-off-by: Paolo Bonzini <[email protected]>

migration: unify stdio-based QEMUFile operations

Now that qemu_fseek does not exist anymore, there is no reason to do
an fseek before fread/fwrite when operating on an stdio file.
Thus, unify the get/put_buffer callbacks used by qemu_fopen
with those used for pipes.

Reviewed-by: Orit Wasserman <[email protected]>
Signed-off-by: Paolo Bonzini <[email protected]>

target-i386: cpu: fix --disable-kvm compilation

This fixes the following:
  target-i386/cpu.o: In function `kvm_cpu_fill_host':
  target-i386/cpu.c:783: undefined reference to `kvm_state'

I didn't notice the problem before because GCC was optimizing the entire
kvm_cpu_fill_host() function out (because all calls are conditional on
kvm_enabled()).

* cpu_x86_fill_model_id() is used only if CONFIG_KVM is set, so #ifdef it
  entirely to avoid compiler warnings.

* kvm_cpu_fill_host() should be called only if KVM is enabled, so
  use #ifdef CONFIG_KVM around the entire function body.

Reported-by: Andreas Färber <[email protected]>
Signed-off-by: Eduardo Habkost <[email protected]>
Signed-off-by: Andreas Färber <[email protected]>

ui/cocoa.m: Update to new DisplayChangeListener member names

Commit a93a4a2 changed the names of some fields in DisplayChangeListener
and broke compilation of the cocoa UI. Update to the new names.

Acked-by: Gerd Hoffmann <[email protected]>
Reviewed-by: Andreas Färber <[email protected]>
Signed-off-by: Peter Maydell <[email protected]>
Signed-off-by: Anthony Liguori <[email protected]>

xenfb: fix build breakage caused by console cleanup series

Console cleanup series renamed dpy_resize and dpy_update all over the
tree, but hw/xenfb.c was forgotten.  Update it too so it builds again.

Reported-by: Jan Kiszka <[email protected]>
Signed-off-by: Gerd Hoffmann <[email protected]>
Signed-off-by: Anthony Liguori <[email protected]>

Merge remote-tracking branch 'kraxel/usb.69' into staging

* kraxel/usb.69: (31 commits)
  usb-redir: Allow redirecting super speed devices to high speed controllers
  usb-redir: Allow to attach USB 2.0 devices to 1.1 host controller
  usb-redir: Use reject rather the disconnect on bad ep info
  usb-redir: Add an usbredir_setup_usb_eps() helper function
  usb-redir: Add support for input pipelining
  usb-redir: Add support for 32 bits bulk packet length
  combined-packet: Add a workaround for Linux usbfs + live migration
  usb: Add packet combining functions
  uhci: Don't crash on device disconnect
  uhci: Add a uhci_handle_td_error() helper function
  usb/ehci-pci: add helper to create ich9 usb controllers
  usb/ehci-pci: add ich9 00:1a.* variant
  usb/ehci-pci: dynamic type generation
  uhci: add ich9 00:1a.* variants
  uhci: stick irq routing info into UHCIInfo too.
  uhci: dynamic type generation
  xilinx_zynq: add USB controllers
  usb/ehci: add sysbus variant
  usb/ehci: split into multiple source files
  usb/ehci: Guard definition of EHCI_DEBUG
  ...

Signed-off-by: Anthony Liguori <[email protected]>

pc: Drop redundant test for ROM memory region

Just a few lines above, we already initialize rom_memory accordingly.

Signed-off-by: Jan Kiszka <[email protected]>
Signed-off-by: Stefan Hajnoczi <[email protected]>

exec: make some functions static

Signed-off-by: Blue Swirl <[email protected]>
Signed-off-by: Stefan Hajnoczi <[email protected]>

target-ppc: make some functions static

Signed-off-by: Blue Swirl <[email protected]>
Acked-by: Alexander Graf <[email protected]>
Signed-off-by: Stefan Hajnoczi <[email protected]>

ppc: add missing static

Add missing 'static' qualifiers.

Signed-off-by: Blue Swirl <[email protected]>
Acked-by: Alexander Graf <[email protected]>
Signed-off-by: Stefan Hajnoczi <[email protected]>

vnc: add missing static

Add missing 'static' qualifiers.

Signed-off-by: Blue Swirl <[email protected]>
Signed-off-by: Stefan Hajnoczi <[email protected]>

vl.c: add missing static

Add missing 'static' qualifiers.

Signed-off-by: Blue Swirl <[email protected]>
Signed-off-by: Stefan Hajnoczi <[email protected]>

target-sparc: make do_unaligned_access static

Signed-off-by: Blue Swirl <[email protected]>
Signed-off-by: Stefan Hajnoczi <[email protected]>

m68k: Return semihosting errno values correctly

Fixing a simple typo, s/errno/err/, that caused
the error status from GDB semihosted system calls
to be returned incorrectly.

Signed-off-by: Meador Inge <[email protected]>
Reviewed-by: Andreas Färber <[email protected]>
Signed-off-by: Stefan Hajnoczi <[email protected]>

cadence_uart: More debug information

Add more helpful debug information to the cadence UART.

Signed-off-by: Peter Crosthwaite <[email protected]>
Reviewed-by: Peter Maydell <[email protected]>
Signed-off-by: Stefan Hajnoczi <[email protected]>

Merge remote-tracking branch 'kraxel/pixman.v3' into staging

* kraxel/pixman.v3: (22 commits)
  pixman: drop obsolete fields from DisplaySurface
  pixman/vnc: remove dead code.
  pixman/vnc: remove rgb_prepare_row* functions
  pixman/vnc: use pixman images in vnc.
  pixman: switch screendump function.
  vga: stop direct access to DisplaySurface fields.
  qxl: stop direct access to DisplaySurface fields.
  console: don't set PixelFormat alpha fields for 32bpp
  console: make qemu_alloc_display static
  pixman: add pixman image to DisplaySurface
  pixman: helper functions
  pixman: windup in configure & makefiles
  pixman: add submodule
  console: remove DisplayAllocator
  console: remove dpy_gfx_fill
  vga: fix text mode updating
  console: init displaychangelisteners on register
  console: untangle gfx & txt updates
  console: s/TextConsole/QemuConsole/
  console: move set_mouse + cursor_define callbacks
  ...

Signed-off-by: Anthony Liguori <[email protected]>

Merge remote-tracking branch 'stefanha/net' into staging

* stefanha/net:
  e1000: pre-initialize RAH/RAL registers
  net: Reject non-netdevs in qmp_netdev_del()
  net: use "socket" model name for UDP sockets
  e1000: drop check_rxov, always treat RX ring with RDH == RDT as empty

Signed-off-by: Anthony Liguori <[email protected]>

Merge remote-tracking branch 'bonzini/threadpool' into staging

* bonzini/threadpool: (39 commits)
  raw-win32: implement native asynchronous I/O
  raw-posix: move linux-aio.c to block/
  raw-win32: add emulated AIO support
  raw-posix: rename raw-posix-aio.h, hide unavailable prototypes
  raw: merge posix-aio-compat.c into block/raw-posix.c
  block: switch posix-aio-compat to threadpool
  threadpool: do not take lock in event_notifier_ready
  aio: add generic thread-pool facility
  qemu-thread: add QemuSemaphore
  linux-aio: use event notifiers
  aio: clean up now-unused functions
  main-loop: use aio_notify for qemu_notify_event
  main-loop: use GSource to poll AIO file descriptors
  aio: call aio_notify after setting I/O handlers
  aio: add aio_notify
  aio: make AioContexts GSources
  aio: add Win32 implementation
  aio: prepare for introducing GSource-based dispatch
  aio: add non-blocking variant of aio_wait
  aio: test node->deleted before calling io_flush
  ...

Signed-off-by: Anthony Liguori <[email protected]>

Merge remote-tracking branch 'qemu-kvm/uq/master' into staging

* qemu-kvm/uq/master: (28 commits)
  update-linux-headers.sh: Handle new kernel uapi/ directories
  target-i386: kvm_cpu_fill_host: use GET_SUPPORTED_CPUID
  target-i386: cpu: make -cpu host/check/enforce code KVM-specific
  target-i386: make cpu_x86_fill_host() void
  Emulate qemu-kvms -no-kvm option
  Issue warning when deprecated -tdf option is used
  Issue warning when deprecated drive parameter boot=on|off is used
  Use global properties to emulate -no-kvm-pit-reinjection
  Issue warning when deprecated -no-kvm-pit is used
  Use machine options to emulate -no-kvm-irqchip
  cirrus_vga: allow configurable vram size
  target-i386: Add missing kvm cpuid feature name
  i386: cpu: add missing CPUID[EAX=7,ECX=0] flag names
  i386: kvm: filter CPUID leaf 7 based on GET_SUPPORTED_CPUID, too
  i386: kvm: reformat filter_features_for_kvm() code
  i386: kvm: filter CPUID feature words earlier, on cpu.c
  i386: kvm: mask cpuid_ext4_features bits earlier
  i386: kvm: mask cpuid_kvm_features earlier
  i386: kvm: x2apic is not supported without in-kernel irqchip
  i386: kvm: set CPUID_EXT_TSC_DEADLINE_TIMER on kvm_arch_get_supported_cpuid()
  ...

Signed-off-by: Anthony Liguori <[email protected]>

Merge remote-tracking branch 'afaerber/qom-cpu' into staging

* afaerber/qom-cpu: (35 commits)
  target-i386: Pass X86CPU to kvm_handle_halt()
  target-i386: Pass X86CPU to kvm_get_mp_state()
  cpu: Move thread_id to CPUState
  cpus: Pass CPUState to run_on_cpu()
  target-i386: Pass X86CPU to cpu_x86_inject_mce()
  target-i386: Pass X86CPU to kvm_mce_inject()
  cpus: Pass CPUState to [qemu_]cpu_has_work()
  spapr: Pass PowerPCCPU to hypercalls
  spapr: Pass PowerPCCPU to spapr_hypercall()
  target-ppc: Pass PowerPCCPU to cpu_ppc_hypercall
  target-ppc: Pass PowerPCCPU to powerpc_excp()
  xtensa_pic: Pass XtensaCPU to xtensa_ccompare_cb()
  cpus: Pass CPUState to qemu_wait_io_event_common()
  cpus: Pass CPUState to flush_queued_work()
  cpu: Move queued_work_{first,last} to CPUState
  cpus: Pass CPUState to qemu_cpu_kick()
  target-ppc: Rename kvm_kick_{env => cpu} and pass PowerPCCPU
  ppc: Pass PowerPCCPU to {ppc6xx,ppc970,power7,ppc40x,ppce500}_set_irq()
  cpus: Pass CPUState to qemu_tcg_init_vcpu()
  cpus: Pass CPUState to qemu_tcg_cpu_thread_fn
  ...

Signed-off-by: Anthony Liguori <[email protected]>

arm_boot: Change initrd load address to "halfway through RAM"

To avoid continually having to bump the initrd load address
to account for larger kernel images, put the initrd halfway
through RAM. This allows large kernels on new boards with lots
of RAM to work OK, without breaking existing usecases for
boards with only 32MB of RAM.

Note that this change fixes in passing a bug where we were
passing an overly large max_size to load_image_targphys()
for the initrd, which meant that we wouldn't correctly refuse
to load an enormous initrd that didn't actually fit into RAM.

Signed-off-by: Peter Maydell <[email protected]>
Reviewed-by: Aurelien Jarno <[email protected]>
Reviewed-by: Igor Mitsyanko <[email protected]>
Tested-by: Cole Robinson <[email protected]>
Signed-off-by: Aurelien Jarno <[email protected]>

Merge branch 'ppc-for-upstream' of git://repo.or.cz/qemu/agraf

* 'ppc-for-upstream' of git://repo.or.cz/qemu/agraf:
  pseries: Cleanup duplications of ics_valid_irq() code
  pseries: Clean up inconsistent variable name in xics.c
  target-ppc: Extend FPU state for newer POWER CPUs
  target-ppc: Rework storage of VPA registration state
  Revert "PPC: pseries: Remove hack for PIO window"

Merge branch 'arm-devs.for-upstream' of git://git.linaro.org/people/pmaydell/qemu-arm

* 'arm-devs.for-upstream' of git://git.linaro.org/people/pmaydell/qemu-arm: (28 commits)
  hw/sd.c: add SD card save/load support
  vmstate: Add support for saving/loading bitmaps
  hw/sd.c: Fix erase for high capacity cards
  pflash_cfi01: Fix debug mode printfery
  pflash_cfi0x: QOMified
  pflash_cfi01: remove unused total_len field
  pflash_cfi0x: remove unused base field
  hw/versatile_i2c: Use LOG_GUEST_ERROR
  hw/arm_l2x0: Use LOG_GUEST_ERROR
  hw/arm_sysctl: Use LOG_GUEST_ERROR
  hw/armv7m_nvic: Use LOG_GUEST_ERROR and LOG_UNIMP
  hw/arm_timer: Use LOG_GUEST_ERROR and LOG_UNIMP
  hw/arm_gic: Use LOG_GUEST_ERROR
  hw/arm11mpcore: Use LOG_GUEST_ERROR rather than hw_error()
  hw/pl190: Use LOG_UNIMP rather than hw_error()
  hw/pl110: Use LOG_GUEST_ERROR rather than hw_error()
  hw/pl080: Use LOG_GUEST_ERROR and LOG_UNIMP
  hw/pl061: Use LOG_GUEST_ERROR
  hw/pl050: Use LOG_GUEST_ERROR
  hw/exynos4_boards: Don't prematurely explode QEMUMachineInitArgs
  ...

usb-redir: Allow redirecting super speed devices to high speed controllers

Signed-off-by: Hans de Goede <[email protected]>
Signed-off-by: Gerd Hoffmann <[email protected]>

usb-redir: Allow to attach USB 2.0 devices to 1.1 host controller

This follows the logic of host-linux: If a 2.0 device has no ISO
endpoint and no interrupt endpoint with a packet size > 64, we can
attach it also to an 1.1 host controller. In case the redir server does
not report endpoint sizes, play safe and remove the 1.1 compatibility as
well. Moreover, if we detect a conflicting change in the configuration
after the device was already attached, it will be disconnected
immediately.

HdG: Several small cleanups and fixes

Signed-off-by: Jan Kiszka <[email protected]>
Signed-off-by: Hans de Goede <[email protected]>
Signed-off-by: Gerd Hoffmann <[email protected]>

usb-redir: Use reject rather the disconnect on bad ep info

So that the client gets a notification about us disconnecting the device.

Signed-off-by: Hans de Goede <[email protected]>
Signed-off-by: Gerd Hoffmann <[email protected]>

usb-redir: Add an usbredir_setup_usb_eps() helper function

Signed-off-by: Hans de Goede <[email protected]>
Signed-off-by: Gerd Hoffmann <[email protected]>

usb-redir: Add support for input pipelining

Signed-off-by: Hans de Goede <[email protected]>
Signed-off-by: Gerd Hoffmann <[email protected]>

usb-redir: Add support for 32 bits bulk packet length

Signed-off-by: Hans de Goede <[email protected]>
Signed-off-by: Gerd Hoffmann <[email protected]>

combined-packet: Add a workaround for Linux usbfs + live migration

Older versions (anything but the latest) of Linux usbfs + libusb(x),
will submit larger (bulk) transfers split into multiple 16k submissions,
which means that rather then all tds getting linked into the queue in
one atomic operarion they get linked in a bunch at a time, which could
cause problems if:
1) We scan the queue while libusb is in the middle of submitting a split
   bulk transfer
2) While this bulk transfer is pending we migrate to another host.

The problem is that after 2, the new host will rescan the queue and
combine the packets in one large transfer, where as 1) has caused the
original host to see them as 2 transfers. This patch fixes this by stopping
combinging if we detect a 16k transfer with its int_req flag set.

This should not adversely effect performance for other cases as:
1) Linux never sets the interrupt flag on packets other then the last
2) Windows does set the in_req flag on each td, but will submit large
transfers in 20k tds thus never triggering the check

Signed-off-by: Hans de Goede <[email protected]>
Signed-off-by: Gerd Hoffmann <[email protected]>

usb: Add packet combining functions

Currently we only do pipelining for output endpoints, since to properly
support short-not-ok semantics we can only have one outstanding input
packet. Since the ehci and uhci controllers have a limited per td packet
size guests will split large input transfers to into multiple packets,
and since we don't pipeline these, this comes with a serious performance
penalty.

This patch adds helper functions to (re-)combine packets which belong to 1
transfer at the guest device-driver level into 1 large transger. This can be
used by (redirection) usb-devices to enable pipelining for input endpoints.

This patch will combine packets together until a transfer terminating packet
is encountered. A terminating packet is a packet which meets one or more of
the following conditions:
1) The packet size is *not* a multiple of the endpoint max packet size
2) The packet does *not* have its short-not-ok flag set
3) The packet has its interrupt-on-complete flag set

The short-not-ok flag of the combined packet is that of the terminating packet.
Multiple combined packets may be submitted to the device, if the combined
packets do not have their short-not-ok flag set, enabling true pipelining.

If a combined packet does have its short-not-ok flag set the queue will
wait with submitting further packets to the device until that packet has
completed.

Once enabled in the usb-redir and ehci code, this improves the speed (MB/s)
of a Linux guest reading from a USB mass storage device by a factor of
1.2 - 1.5.

And the main reason why I started working on this, when reading from a pl2303
USB<->serial converter, it combines the previous 4 packets submitted per
device-driver level read into 1 big read, reducing the number of packets / sec
by a factor 4, and it allows to have multiple reads outstanding. This allows
for much better latency tolerance without the pl2303's internal buffer
overflowing (which was happening at 115200 bps, without serial flow control).

Signed-off-by: Hans de Goede <[email protected]>
Signed-off-by: Gerd Hoffmann <[email protected]>

uhci: Don't crash on device disconnect

My recent uhci cleanup series has introduced a regression, where
qemu sometimes crashes on a device disconnect. The problem is that
the uhci code never checked for a device not / no longer existing, instead
it was relying on usb_handle_packet accepting a NULL device.

But since we now pass usb_handle_packet q->ep->dev, rather then just
a local dev variable, we crash as q->ep == NULL due to the device no longer
existing.

This patch fixes this. Note that this patch also improves over
the old behavior were we would:
1) create a queue for the device
2) create an async for the packet
3) have usb_handle_packet fail
4) destroy the async
5) wait for the queue to be idle for 32 frames
6) destroy the queue

Which was rather sub-optimal.

Signed-off-by: Hans de Goede <[email protected]>
Signed-off-by: Gerd Hoffmann <[email protected]>

uhci: Add a uhci_handle_td_error() helper function

Signed-off-by: Hans de Goede <[email protected]>
Signed-off-by: Gerd Hoffmann <[email protected]>

usb/ehci-pci: add helper to create ich9 usb controllers

Signed-off-by: Gerd Hoffmann <[email protected]>

usb/ehci-pci: add ich9 00:1a.* variant

Signed-off-by: Gerd Hoffmann <[email protected]>

usb/ehci-pci: dynamic type generation

Signed-off-by: Gerd Hoffmann <[email protected]>

uhci: add ich9 00:1a.* variants

Signed-off-by: Gerd Hoffmann <[email protected]>

uhci: stick irq routing info into UHCIInfo too.

Kills the ugly "switch (device_id) { ... }" struct and makes it easier
to figure what the differences between the uhci variants are.

Need our own DeviceClass struct for that so we can allocate some space
to store UHCIInfo.

Signed-off-by: Gerd Hoffmann <[email protected]>

uhci: dynamic type generation

Signed-off-by: Gerd Hoffmann <[email protected]>

xilinx_zynq: add USB controllers

Add the two usb controllers in Zynq.

Signed-off-by: Peter Crosthwaite <[email protected]>
Signed-off-by: Gerd Hoffmann <[email protected]>

pixman: drop obsolete fields from DisplaySurface

Signed-off-by: Gerd Hoffmann <[email protected]>

pixman/vnc: remove dead code.

Switching the vnc server framebuffer to use 32bpp unconditionally
turns the code bits which handle 8 and 16 bpp into dead code.
Remove them.

Signed-off-by: Gerd Hoffmann <[email protected]>

pixman/vnc: remove rgb_prepare_row* functions

Let pixman do it instead.

Signed-off-by: Gerd Hoffmann <[email protected]>

pixman/vnc: use pixman images in vnc.

The vnc code uses *three* DisplaySurfaces:

First is the surface of the actual QemuConsole, usually the guest
screen, but could also be a text console (monitor/serial reachable via
Ctrl-Alt-<nr> keys).  This is left as-is.

Second is the current server's view of the screen content.  The vnc code
uses this to figure which parts of the guest screen did _really_ change
to reduce the amount of updates sent to the vnc clients.  It is also
used as data source when sending out the updates to the clients.  This
surface gets replaced by a pixman image.  The format changes too,
instead of using the guest screen format we'll use fixed 32bit rgb
framebuffer and convert the pixels on the fly when comparing and
updating the server framebuffer.

Third surface carries the format expected by the vnc client.  That isn't
used to store image data.  This surface is switched to PixelFormat and a
boolean for bigendian byte order.

Signed-off-by: Gerd Hoffmann <[email protected]>

pixman: switch screendump function.

Signed-off-by: Gerd Hoffmann <[email protected]>

vga: stop direct access to DisplaySurface fields.

Signed-off-by: Gerd Hoffmann <[email protected]>

qxl: stop direct access to DisplaySurface fields.

Signed-off-by: Gerd Hoffmann <[email protected]>

console: don't set PixelFormat alpha fields for 32bpp

Currently it is inconstent, PixelFormat->amask is left unset whereas
abits and amax and ashift are filled.  As an alpha channel doesn't make
sense for the vga framebuffer leave all alpha fields clear.

Signed-off-by: Gerd Hoffmann <[email protected]>

console: make qemu_alloc_display static

Signed-off-by: Gerd Hoffmann <[email protected]>

pixman: add pixman image to DisplaySurface

Surfaces are now allocated using pixman.  DisplaySurface gets new
struct fields with pixman image and data.  DisplayChangeListeners
can easily start using pixman now.

Signed-off-by: Gerd Hoffmann <[email protected]>

pixman: helper functions

Add some helper functions which will be put
into use by following patches.

Signed-off-by: Gerd Hoffmann <[email protected]>