Thomas Huth [Mon, 27 Jun 2016 11:25:03 +0000 (13:25 +0200)]
hw/ppc/spapr: Add some missing hcall function set strings
Add "hcall-sprg0" (for H_SET_SPRG0), "hcall-copy" (for H_PAGE_INIT)
and "hcall-debug" (for H_LOGICAL_CI_LOAD/STORE) to the property
"ibm,hypertas-functions" to indicate that we support these hypercalls.
This handles filtering bits based on what is implemented by a
given architecture version. We also use it to copy to LPCR
some of the relevant 970 HID4 bits.
Paolo Bonzini [Thu, 30 Jun 2016 14:57:37 +0000 (16:57 +0200)]
pcspk: fix KVM
The link property that was added to the pcspk device has the wrong type:
it is only correct for TCG and for KVM's userspace or split irqchip
options. The default KVM option (fully in-kernel irqchip) breaks
because it uses a PIT whose type is a sibling of TYPE_I8254.
Blue hasn't been active in the QEMU project for a long time. Drop his
last MAINTAINERS entries.
As per Paolo's recommendation, downgrade status of "BSD user" from
Maintained to Orphan since the FreeBSD guys effectively forked it, and
"SPARC target" from Maintained to Odd Fixes, since we still have the
overall TCG maintainer looking after it.
I'm leaving Checkpatch's status at Odd Fixes. Calling it Maintained
wouldn't be wrong, but I'm not comfortable upgrading it while nobody
is willing to have his name nailed to the thing.
* remotes/cody/tags/block-pull-request:
mirror: fix misleading comments
blockjob: assert(cb) when create job
iotests: add small-granularity mirror test
mirror: limit niov to IOV_MAX elements, again
mirror: clarify mirror_do_read return code
block/gluster: add support for selecting debug logging level
mirror: fix trace_mirror_yield_in_flight usage in mirror_iteration()
block/nfs: add support for libnfs pagecache
block/nfs: refuse readahead if cache.direct is on
block/gluster: add support for SEEK_DATA/SEEK_HOLE
Peter Maydell [Wed, 29 Jun 2016 13:07:57 +0000 (14:07 +0100)]
Merge remote-tracking branch 'remotes/stefanha/tags/tracing-pull-request' into staging
# gpg: Signature made Tue 28 Jun 2016 22:27:20 BST
# gpg: using RSA key 0x9CA4ABB381AB73C8
# gpg: Good signature from "Stefan Hajnoczi <[email protected]>"
# gpg: aka "Stefan Hajnoczi <[email protected]>"
# Primary key fingerprint: 8695 A8BF D3F9 7CDA AC35 775A 9CA4 ABB3 81AB 73C8
* remotes/stefanha/tags/tracing-pull-request:
trace: [*-user] Add events to trace guest syscalls in syscall emulation mode
trace: enable tracing in qemu-img
qemu-img: move common options parsing before commands processing
trace: enable tracing in qemu-nbd
trace: enable tracing in qemu-io
trace: move qemu_trace_opts to trace/control.c
doc: move text describing --trace to specific .texi file
doc: sync help description for --trace with man for qemu.1
Andrew Jones [Tue, 21 Jun 2016 16:34:04 +0000 (18:34 +0200)]
vl: smp_parse: fix regression
Commit 0544edd88a "vl: smp_parse: cleanups" regressed any -smp
config that left either cores or threads unspecified, and specified
a topology supporting more cpus than the given online cpus. The
correct way to calculate the missing parameter would be to use
maxcpus, but it's too late to change that now. Restore the old
way, which is to calculate it with the online cpus (as is still
done), but then, if the result is zero, just set it to one.
Paolo Bonzini [Mon, 20 Jun 2016 13:02:40 +0000 (15:02 +0200)]
char: change qemu_chr_fe_add_watch to return unsigned
g_source_attach can return any value between 1 and UINT_MAX if you let
QEMU run long enough. However, qemu_chr_fe_add_watch can also return
a negative errno value when the device is disconnected or does not
support chr_add_watch. Change it to return zero to avoid overloading
these values.
Fix the cadence_uart which asserts in this case (easily obtained with
"-serial pty").
Paolo Bonzini [Mon, 20 Jun 2016 13:08:20 +0000 (15:08 +0200)]
serial: separate serial_xmit and serial_watch_cb
serial_xmit starts transmission of whatever is in the transmitter
register, THR or FIFO; serial_watch_cb is a wrapper around it and is
only used as a qemu_chr_fe_add_watch callback.
Paolo Bonzini [Tue, 14 Jun 2016 12:20:50 +0000 (14:20 +0200)]
serial: simplify tsr_retry reset
Move common code outside the if, and reset tsr_retry even in loopback mode.
Right now it cannot become non-zero, but it will be possible as soon as
we start respecting the baud rate.
Peter Lieven [Mon, 20 Jun 2016 09:24:40 +0000 (11:24 +0200)]
iscsi: fix assertion in is_sector_request_lun_aligned
Commit 94d047a added an assertion the the request alignment check.
This introduced 2 issues:
a) A off-by-one error since a request of BDRV_REQUEST_MAX_SECTORS
is actually allowed.
b) The bdrv_get_block_status call in the read path to check the allocation
status requests up to INT_MAX sectors which triggers the assertion.
This function needs to be converted to QOM hook and virtualised for
multi-arch. This rename interferes, as cpu-qom will not have access
to the renaming causing name divergence. This rename doesn't really do
anything anyway so just delete it.
Lin Ma [Wed, 15 Jun 2016 17:05:27 +0000 (01:05 +0800)]
pci-assign: Move "Invalid ROM" error message to pci-assign-load-rom.c
In function pci_assign_dev_load_option_rom, For those pci devices don't
have 'rom' file under sysfs or if loading ROM from external file, The
function returns NULL, and won't set the passed 'size' variable.
In these 2 cases, qemu still reports "Invalid ROM" error message, Users
may be confused by it.
Paolo Bonzini [Mon, 20 Jun 2016 14:32:39 +0000 (16:32 +0200)]
scsi: esp: fix migration
Commit 926cde5 ("scsi: esp: make cmdbuf big enough for maximum CDB size",
2016-06-16) changed the size of a migrated field. Split it in two
parts, and only migrate the second part in a new vmstate version.
Efimov Vasily [Wed, 22 Jun 2016 12:24:57 +0000 (15:24 +0300)]
MC146818 RTC: add GPIO access to output IRQ
The MC146818 RTC device has output IRQ line. Currently the corresponding field
is only accessible through direct access. Such access violates Qemu model.
The patch makes the field accessible through GPIO. It also updates the setting
of the IRQ during initialization.
Efimov Vasily [Wed, 22 Jun 2016 12:24:55 +0000 (15:24 +0300)]
ICH9 LPC: move call of isa_bus_irqs to 'realize' method
The isa_bus_irqs function initializes ISA bus IRQ array pointer with specified
value.
Previously the ICH9 LPC bridge model did not have its own IRQs but
only IRQ pointer cache. And same GSI were used for ISA bus and other sources
behind the bridge (PCI, SCI). Hence, the pc_q35_init was only possible place to
setup both ISA bus IRQs and the bridge IRQ cache.
As a result, the call of isa_bus_irqs was made from pc_q35_init.
Now the ICH9 LPC bridge has its own output IRQs which are connected to GSI. The
output IRQs are already used to route IRQs from PCI and SCI.
The patch makes the ICH9 LPC bridge output IRQs to used for ISA bus too.
Efimov Vasily [Wed, 22 Jun 2016 12:24:54 +0000 (15:24 +0300)]
ICH9 LPC: handle GSI as qdev GPIO
The ICH9 LPC bridge has 24 output IRQs connected to GSI. Currently the IRQs are
referenced by pointers. The pointers are initialized at startup by direct access
to the structure fields. This violates Qemu device model.
The patch makes the IRQs handling to use GPIO model.
Paolo Bonzini [Fri, 17 Jun 2016 15:12:09 +0000 (17:12 +0200)]
ich9: unify pic and ioapic IRQ vectors
ich9->pic and ich9->ioapic differ for the first 16 GSIs (because
ich9->pic is wired to 8259+IOAPIC but ich9->ioapic is wired to
IOAPIC only). However, ich9->ioapic is never used for the first
16 GSIs, so the two vectors can be merged.
Paolo Bonzini [Fri, 17 Jun 2016 15:07:31 +0000 (17:07 +0200)]
ich9: clean up ich9_lpc_update_pic/ich9_lpc_update_apic and callers
Make ich9_lpc_update_pic take care only of GSIs 0-15, and
ich9_lpc_update_apic take care only of GSIs 16-23. Assert
that they are called with the correct GSI indices.
Paolo Bonzini [Fri, 17 Jun 2016 15:01:21 +0000 (17:01 +0200)]
ich9: call ich9_lpc_update_pic for disabled pirqs
An asserted pirq can be disabled and the corresponding GSIs
should then go down to 0. However, because of the conditional in
ich9_lpc_update_by_pirq, the legacy 8259 pin could remain stuck to 1.
Efimov Vasily [Wed, 22 Jun 2016 12:24:53 +0000 (15:24 +0300)]
ICH9 SMB: make TYPE_ICH9_SMB_DEVICE macro public
ICH9 SMB bridge can be created using qdev API despite existence of helper
function. The type name is needed for such creation. Using a preprocessor
alias instead the string type name itself is preferable.
The patch makes the alias accessible through the header.
Efimov Vasily [Wed, 22 Jun 2016 12:24:52 +0000 (15:24 +0300)]
port92: handle A20 IRQ as GPIO
The port92 device has outgouing IRQ line A20. Currently the IRQ is referenced
by a pointer which normally is set during machine initialization. The
pointer is never changed at runtime. Hence, common GPIO model can be applied
to A20 IRQ line. Note that checking for IRQ to be connected as in
previous version of code is not required qemu_set_irq will do it.
Efimov Vasily [Wed, 22 Jun 2016 12:24:51 +0000 (15:24 +0300)]
pckbd: handle A20 IRQ as GPIO
The i8042 device has outgouing IRQ line A20. Currently the IRQ is referenced
by a pointer which normally is set during machine initialization. The pointer
is never changed at runtime. So common GPIO model can be applied to A20 IRQ
line. Note that checking for IRQ to be connected as in previous version
of code is not required because qemu_set_irq will do it.
Efimov Vasily [Wed, 22 Jun 2016 12:24:49 +0000 (15:24 +0300)]
Q35: implement property interfece to several parameters
During creation of Q35 instance several parameters are set using direct access.
It violates Qemu device model. Correctly, the parameters should be handled as
object properties.
The patch adds four link type properties for fields:
mch.ram_memory
mch.pci_address_space
mch.system_memory
mch.address_space_io
And, it adds two size type properties for fields:
mch.below_4g_mem_size
mch.above_4g_mem_size
Efimov Vasily [Wed, 22 Jun 2016 12:24:48 +0000 (15:24 +0300)]
pflash: make TYPE_CFI_PFLASH0{1,2} macros public
qdev API can be used to create CFI pflash devices despite existance of helper
functions. The type name is needed in course of such creation. Using the
preprocessor alias instead of the string literal itself is preferable.
The patch makes the aliases accessible through the header.
Efimov Vasily [Wed, 22 Jun 2016 12:24:46 +0000 (15:24 +0300)]
pcspk: convert "pit" property type from ptr to link
The speaker device needs pointer to ISA PIT device to operate. But according to
qdev-properties.h, properties of pointer type should be avoided. It seems a
link type property is a good substitution.
Efimov Vasily [Wed, 22 Jun 2016 12:24:45 +0000 (15:24 +0300)]
ide: move headers to include folder
The patch moves "hw/ide/achi.h", "hw/ide/pci.h" and "hw/ide/internal.h" headers
to corresponding folders inside "include" folder alike other Qemu headers.
Peter Maydell [Wed, 29 Jun 2016 09:43:07 +0000 (10:43 +0100)]
Merge remote-tracking branch 'remotes/riku/tags/pull-linux-user-20160628' into staging
Drop building linux-user targets on HPPA or m68k host systems
and add safe_syscall support for i386, aarch64, arm, ppc64 and
s390x.
# gpg: Signature made Tue 28 Jun 2016 19:31:16 BST
# gpg: using RSA key 0xB44890DEDE3C9BC0
# gpg: Good signature from "Riku Voipio <[email protected]>"
# gpg: aka "Riku Voipio <[email protected]>"
# Primary key fingerprint: FF82 03C8 C391 98AE 0581 41EF B448 90DE DE3C 9BC0
* remotes/riku/tags/pull-linux-user-20160628: (24 commits)
linux-user: Provide safe_syscall for ppc64
linux-user: Provide safe_syscall for s390x
linux-user: Provide safe_syscall for aarch64
linux-user: Provide safe_syscall for arm
linux-user: Provide safe_syscall for i386
linux-user: fix x86_64 safe_syscall
linux-user: don't swap NLMSG_DATA() fields
linux-user: fd_trans_host_to_target_data() must process only received data
linux-user: add missing return in netlink switch statement
linux-user: update get_thread_area/set_thread_area strace
linux-user: fix clone() strace
linux-user: add socket() strace
linux-user: add socketcall() strace
linux-user: Support F_GETPIPE_SZ and F_SETPIPE_SZ fcntls
linux-user: Fix wrong type used for argument to rt_sigqueueinfo
linux-user: Create a hostdep.h for each host architecture
user-exec: Remove unused code for OSX hosts
user-exec: Delete now-unused hppa and m68k cpu_signal_handler() code
configure: Don't allow user-only targets for unknown CPU architectures
configure: Don't override ARCH=unknown if enabling TCI
...
John Snow [Wed, 22 Jun 2016 19:51:02 +0000 (15:51 -0400)]
mirror: clarify mirror_do_read return code
mirror_do_read intends to return the number of sectors processed after
the starting sector, without regard to how many sectors were processed
before the starting sector due to alignment.
Clean up the comments and code to hopefully illustrate this more clearly.
This also fixes an issue in initialization where if the mirror buffer size
is initialized to smaller than the number of sectors being requested for
transfer, we report back an incorrectly large number to the caller.
Debug levels are 0-9, with 9 being the most verbose, and 0 representing
no debugging output. The default is the same as it was before, which
is a level of 4. The current logging levels defined in the gluster
source are:
Peter Lieven [Thu, 19 May 2016 12:48:03 +0000 (14:48 +0200)]
block/nfs: add support for libnfs pagecache
upcoming libnfs will have support for a read cache that can
significantly help to speed up requests since libnfs by design
circumvents the kernel cache.
Denis V. Lunev [Fri, 17 Jun 2016 14:44:12 +0000 (17:44 +0300)]
trace: enable tracing in qemu-nbd
Please note, trace_init_backends() must be called in the final process,
i.e. after daemonization. This is necessary to keep tracing thread in
the proper process.
Peter Maydell [Mon, 20 Jun 2016 17:07:05 +0000 (18:07 +0100)]
cputlb: don't cpu_abort() if guest tries to execute outside RAM or RAM
In get_page_addr_code(), if the guest program counter turns out not to
be in ROM or RAM, we can't handle executing from it, and we call
cpu_abort(). This results in the message
qemu: fatal: Trying to execute code outside RAM or ROM at 0x08000000
followed by a guest register dump, and then QEMU dumps core.
This situation happens in one of two cases:
(1) a guest kernel bug, where it jumped off into nowhere
(2) a user command line mistake, where they tried to run an image for
board A on a QEMU model of board B, or where they didn't provide
an image at all, and QEMU executed through a ROM or RAM full of
NOP instructions and then fell off the end
In either case, a core dump of QEMU itself is entirely useless, and
only confuses users into thinking that this is a bug in QEMU rather
than a bug in the guest or a problem with their command line. (This
is a variation on the general idea that we shouldn't assert() on
something the user can accidentally provoke.)
Replace the cpu_abort() with something that explains the situation
a bit better and exits QEMU without dumping core.
(See LP:1062220 for several examples of confused users.)
Peter Maydell [Sat, 18 Jun 2016 22:05:02 +0000 (23:05 +0100)]
configure: Make AVX2 test robust to non-ELF systems
The AVX2 optimization test assumes that the object format
is ELF and the system has the readelf utility. If this isn't
true then configure might fail or emit a warning (since in
a pipe "foo | bar >/dev/null 2>&1" does not redirect the
stderr of foo, only of bar). Adjust the check so that if
we don't have readelf or don't have an ELF object then we
just don't enable the AVX2 optimization.
The probe we do to determine what flags to use to make the usermode
executables use a non-default text address has some flaws:
* we run it even if we're not building the user binaries
* we don't expect "ld --verbose" to fail
The combination of these two results in a harmless but
ugly "ld: unknown option: --verbose" message when running
configure on OSX.
Improve the probe to only run when we need it and to fail
nicely when even the backstop 'ld --verbose' approach fails.
Peter Maydell [Fri, 10 Jun 2016 16:10:21 +0000 (17:10 +0100)]
hw/sh4/sh_pci.c: Use ldl_le_p() and stl_le_p()
Use ldl_le_p() and stl_le_p() instead of le32_to_cpup() and
cpu_to_le32w(); the former handle misaligned addresses and don't
need casts, and the latter are deprecated.
Peter Maydell [Tue, 28 Jun 2016 13:27:21 +0000 (14:27 +0100)]
Merge remote-tracking branch 'remotes/stefanha/tags/block-pull-request' into staging
# gpg: Signature made Tue 28 Jun 2016 14:23:24 BST
# gpg: using RSA key 0x9CA4ABB381AB73C8
# gpg: Good signature from "Stefan Hajnoczi <[email protected]>"
# gpg: aka "Stefan Hajnoczi <[email protected]>"
# Primary key fingerprint: 8695 A8BF D3F9 7CDA AC35 775A 9CA4 ABB3 81AB 73C8
* remotes/stefanha/tags/block-pull-request:
virtio-blk: add num-queues device property
virtio-blk: dataplane multiqueue support
virtio-blk: live migrate s->rq with multiqueue
virtio-blk: associate request with a virtqueue
virtio-blk: tell dataplane which vq to notify
virtio-blk: multiqueue batch notify
virtio-blk: add VirtIOBlockConf->num_queues
dma-helpers: dma_blk_io() cancel support
Revert "virtio: sync the dataplane vring state to the virtqueue before virtio_save"
Stefan Hajnoczi [Tue, 21 Jun 2016 12:13:15 +0000 (13:13 +0100)]
virtio-blk: dataplane multiqueue support
Monitor ioeventfds for all virtqueues in the device's AioContext. This
is not true multiqueue because requests from all virtqueues are
processed in a single IOThread. In the future it will be possible to
use multiple IOThreads when the QEMU block layer supports multiqueue.
Stefan Hajnoczi [Tue, 21 Jun 2016 12:13:14 +0000 (13:13 +0100)]
virtio-blk: live migrate s->rq with multiqueue
Add a field for the virtqueue index when migrating the s->rq request
list. The new field is only needed when num_queues > 1. Existing QEMUs
are unaffected by this change and therefore virtio-blk migration stays
compatible.
Stefan Hajnoczi [Tue, 21 Jun 2016 12:13:11 +0000 (13:13 +0100)]
virtio-blk: multiqueue batch notify
The batch notification BH needs to know which virtqueues to notify when
multiqueue is enabled. Use a bitmap to track the virtqueues with
pending notifications.
At this point there is only one virtqueue so hard-code virtqueue index
0. A later patch will switch to real virtqueue indices.
Dataplane has used the same virtqueue code as non-dataplane since
commits e24a47c5b73e04f94030e2daa356c7582aebfca2 ("virtio-scsi: do not
use vring in dataplane") and 03de2f527499ae0c6d16a379665d072345254f2c
("virtio-blk: do not use vring in dataplane"). It is no longer
necessary to stop dataplane in order to sync state since there is no
duplicated virtqueue state.
Peter Maydell [Tue, 28 Jun 2016 09:32:13 +0000 (10:32 +0100)]
Merge remote-tracking branch 'remotes/jasowang/tags/net-pull-request' into staging
# gpg: Signature made Tue 28 Jun 2016 04:29:53 BST
# gpg: using RSA key 0xEF04965B398D6211
# gpg: Good signature from "Jason Wang (Jason Wang on RedHat) <[email protected]>"
# gpg: WARNING: This key is not certified with sufficiently trusted signatures!
# gpg: It is not certain that the signature belongs to the owner.
# Primary key fingerprint: 215D 46F4 8246 689E C77F 3562 EF04 965B 398D 6211
* remotes/jasowang/tags/net-pull-request:
vmxnet3: Fix reading/writing guest memory specially when behind an IOMMU
rtl8139: save/load RxMulOk counter (again)
Change net/socket.c to use socket_*() functions
net: mipsnet: check transmit buffer size before sending
net: fix qemu_announce_self not emitting packets
Pranith Kumar [Mon, 27 Jun 2016 21:53:04 +0000 (17:53 -0400)]
misc/aspeed_scu: Fix build error caused by missing header
Tracing configurations error out currently as follows:
/home/travis/build/pranith/qemu/hw/misc/aspeed_scu.c: In function ‘aspeed_scu_read’:
/home/travis/build/pranith/qemu/hw/misc/aspeed_scu.c:130:9: error: implicit declaration of function ‘qemu_log_mask’ [-Werror=implicit-function-declaration]
/home/travis/build/pranith/qemu/hw/misc/aspeed_scu.c:130:9: error: nested extern declaration of ‘qemu_log_mask’ [-Werror=nested-externs]
/home/travis/build/pranith/qemu/hw/misc/aspeed_scu.c:130:23: error: ‘LOG_GUEST_ERROR’ undeclared (first use in this function)
/home/travis/build/pranith/qemu/hw/misc/aspeed_scu.c:130:23: note: each undeclared identifier is reported only once for each function it appears in
/home/travis/build/pranith/qemu/hw/misc/aspeed_scu.c: In function ‘aspeed_scu_write’:
/home/travis/build/pranith/qemu/hw/misc/aspeed_scu.c:154:23: error: ‘LOG_GUEST_ERROR’ undeclared (first use in this function)
KarimAllah Ahmed [Mon, 20 Jun 2016 13:50:40 +0000 (15:50 +0200)]
vmxnet3: Fix reading/writing guest memory specially when behind an IOMMU
When a PCI device lives behind an IOMMU, it should use 'pci_dma_*' family of
functions when any transfer from/to guest memory is required while
'cpu_physical_memory_*' family of functions completely bypass any MMU/IOMMU in
the system.
vmxnet3 in some places was using 'cpu_physical_memory_*' family of functions
which works fine with the default QEMU setup where IOMMU is not enabled but
fails miserably when IOMMU is enabled. This commit converts all such instances
in favor of 'pci_dma_*'
David Vrabel [Mon, 20 Jun 2016 17:53:46 +0000 (18:53 +0100)]
rtl8139: save/load RxMulOk counter (again)
Commit 9d29cdeaaca3a0383af764000b71492c4fc67c6e (rtl8139: port
TallyCounters to vmstate) introduced in incompatibility in the v4
format as it omitted the RxOkMul counter.
There are presumably no users that were impacted by the v4 to v4'
breakage, so increase the save version to 5 and re-add the field,
keeping backward compatibility with v4'.
We can't have a field conditional on the section version in
vmstate_tally_counters since this version checked would not be the
section version (but the version defined in this structure). So, move
all the fields into the main state structure.
Ashijeet Acharya [Sat, 18 Jun 2016 07:54:02 +0000 (13:24 +0530)]
Change net/socket.c to use socket_*() functions
Use socket_*() functions from include/qemu/sockets.h instead of
listen()/bind()/connect()/parse_host_port(). socket_*() fucntions are
QAPI based and this patch performs this api conversion since
everything will be using QAPI based sockets in the future. Also add a
helper function socket_address_to_string() in util/qemu-sockets.c
which returns the string representation of socket address. Thetask was
listed on http://wiki.qemu.org/BiteSizedTasks page.
net: mipsnet: check transmit buffer size before sending
When processing MIPSnet I/O port write operation, it uses a
transmit buffer tx_buffer[MAX_ETH_FRAME_SIZE=1514]. Two indices
's->tx_written' and 's->tx_count' are used to control data written
to this buffer. If the two were to be equal before writing, it'd
lead to an OOB write access beyond tx_buffer. Add check to avoid it.
Peter Lieven [Thu, 9 Jun 2016 09:39:27 +0000 (11:39 +0200)]
net: fix qemu_announce_self not emitting packets
commit fefe2a78 accidently dropped the code path for injecting
raw packets. This feature is needed for sending gratuitous ARPs
after an incoming migration has completed. The result is increased
network downtime for vservers where the network card is not virtio-net
with the VIRTIO_NET_F_GUEST_ANNOUNCE feature.
Peter Maydell [Mon, 27 Jun 2016 14:46:32 +0000 (15:46 +0100)]
Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20160627' into staging
target-arm queue:
* arm_gicv3: add missing 'break' statements
* cadence_uart: protect against transmit errors
* cadence_gem: avoid infinite loops with misconfigured buffer
* cadence_gem: set the 'last' bit when 'wrap' is set
* reenable tmp105 test case
* palmetto-bmc: add ASPEED system control unit model
* m25p80: add new 512Mbit and 1Gbit devices
* remotes/pmaydell/tags/pull-target-arm-20160627:
m25p80: Fix WINBOND fast read command handling
m25p80: New flash devices.
m25p80: Fast read commands family changes.
m25p80: Introduce configuration registers.
m25p80: Introduce quad and equad modes.
m25p80: Add additional flash commands:
m25p80: Introduce COLLECTING_VAR_LEN_DATA state.
m25p80: Allow more than four banks.
m25p80: Make a table for JEDEC ID.
m25p80: Replace JEDEC ID masking with function.
palmetto-bmc: Configure the SCU's hardware strapping register
ast2400: Integrate the SCU model and set silicon revision
hw/misc: Add a model for the ASPEED System Control Unit
arm: Re-enable tmp105 test
cadence_gem: Set the last bit when wrap is set
cadence_gem: Avoid infinite loops with a misconfigured buffer
cadence_uart: Protect against transmit errors
hw/intc/arm_gicv3: Add missing break