slavio_misc: convert configuration to memory API

Signed-off-by: Benoit Canet <benoit.canet@gmail.com>
Signed-off-by: Avi Kivity <avi@redhat.com>

slavio_misc: convert apc to memory API

Signed-off-by: Benoit Canet <benoit.canet@gmail.com>
Signed-off-by: Avi Kivity <avi@redhat.com>

xilinx_axienet: convert to memory API

Signed-off-by: Avi Kivity <avi@redhat.com>

xilinx_axidma: convert to memory API

Signed-off-by: Avi Kivity <avi@redhat.com>

sun4c_intctl: convert to memory API

Signed-off-by: Avi Kivity <avi@redhat.com>

sun4m_iommu: convert to memory API

Signed-off-by: Avi Kivity <avi@redhat.com>

grlib_irqmp: convert to memory API

Signed-off-by: Avi Kivity <avi@redhat.com>

grlib_gptimer: convert to memory API

Signed-off-by: Avi Kivity <avi@redhat.com>

grlib_apbuart: convert to memory API

Signed-off-by: Avi Kivity <avi@redhat.com>

musicpal: avoid call to sysbus_init_mmio()

Instead of calling sysbus_init_mmio() with a null region,
create a dummy region using the memory API.

Signed-off-by: Avi Kivity <avi@redhat.com>

bitbang_i2c: avoid call to sysbus_init_mmio()

Instead of calling sysbus_init_mmio() with a null region,
create a dummy region using the memory API.

Signed-off-by: Avi Kivity <avi@redhat.com>

sparc32_dma: convert to memory API

Signed-off-by: Avi Kivity <avi@redhat.com>

pxa2xx_dma: convert to memory API

Signed-off-by: Avi Kivity <avi@redhat.com>

axis_dev88: convert to memory API

Signed-off-by: Avi Kivity <avi@redhat.com>

eccmemctl: convert to memory API

Signed-off-by: Avi Kivity <avi@redhat.com>

empty_slot: convert to memory API

Signed-off-by: Avi Kivity <avi@redhat.com>

mpc8544_guts: convert to memory API

Signed-off-by: Avi Kivity <avi@redhat.com>

fw_cfg: convert to memory API

Because the new API doesn't allow overlapping regions with just different
access sizes, we have to create a new "combined" region for both control
and data, when the two share an ioport offset.

Signed-off-by: Avi Kivity <avi@redhat.com>

esp: convert to memory API

[benoit: fix]

Signed-off-by: Benoit Canet <benoit.canet@gmail.com>
Signed-off-by: Avi Kivity <avi@redhat.com>

memory: add MemoryRegionOps::valid.accepts

MemoryRegionOps::valid tries to declaratively specify which transactions
are accepted by the device/bus, however it is not completely generic.  Add
a callback for special cases.

Signed-off-by: Avi Kivity <avi@redhat.com>

m48t59: convert to memory API

Signed-off-by: Avi Kivity <avi@redhat.com>

ds1225y: convert to memory API

Signed-off-by: Avi Kivity <avi@redhat.com>

dp8393x: convert to memory API

Fixes address space leak on hotunplug.

Signed-off-by: Avi Kivity <avi@redhat.com>

cs4321: convert to memory API

Signed-off-by: Avi Kivity <avi@redhat.com>

ide/mmio: convert to memory API

Signed-off-by: Avi Kivity <avi@redhat.com>

hpet: convert to memory API

Signed-off-by: Avi Kivity <avi@redhat.com>

rc4030: convert to memory API

Signed-off-by: Avi Kivity <avi@redhat.com>

pxa2xx_lcd: convert to memory API

Signed-off-by: Benoit Canet <benoit.canet@gmail.com>
Signed-off-by: Avi Kivity <avi@redhat.com>

pxa2xx_mmci: convert to memory API

Convert mechanicaly; the access size of the old_mmio fields
seems odd.

Signed-off-by: Benoit Canet <benoit.canet@gmail.com>
Signed-off-by: Avi Kivity <avi@redhat.com>

pxa2xx_pic: convert to memory API

The ARM documentation say transfers between the cpu and the
coprocessor are 32 bits wide.
Use 4 as size for coprocessor read and writes.

Signed-off-by: Benoit Canet <benoit.canet@gmail.com>
Signed-off-by: Avi Kivity <avi@redhat.com>

pxa2xx_timer: convert to memory API

Signed-off-by: Benoit Canet <benoit.canet@gmail.com>
Signed-off-by: Avi Kivity <avi@redhat.com>

pxa2xx_keypad: convert to memory API

Signed-off-by: Benoit Canet <benoit.canet@gmail.com>
Signed-off-by: Avi Kivity <avi@redhat.com>

pxa2xx_pcmcia.c: convert io memory space to memory API

Signed-off-by: Benoit Canet <benoit.canet@gmail.com>
Signed-off-by: Avi Kivity <avi@redhat.com>

pxa2xx_pcmcia.c: convert attribute memory space to memory API

Signed-off-by: Benoit Canet <benoit.canet@gmail.com>
Signed-off-by: Avi Kivity <avi@redhat.com>

pxa2xx_pcmcia.c: convert common memory space to memory API

Signed-off-by: Benoit Canet <benoit.canet@gmail.com>
Signed-off-by: Avi Kivity <avi@redhat.com>

pxa2xx_gpio: convert to memory API

Signed-off-by: Benoit Canet <benoit.canet@gmail.com>
Signed-off-by: Avi Kivity <avi@redhat.com>

syborg_virtio: convert to memory API

Signed-off-by: Benoit Canet <benoit.canet@gmail.com>
Signed-off-by: Avi Kivity <avi@redhat.com>

syborg_timer: convert to memory API

Signed-off-by: Benoit Canet <benoit.canet@gmail.com>
Signed-off-by: Avi Kivity <avi@redhat.com>

syborg_serial: convert to memory API

Signed-off-by: Benoit Canet <benoit.canet@gmail.com>
Signed-off-by: Avi Kivity <avi@redhat.com>

syborg_rtc: convert to memory API

Signed-off-by: Benoit Canet <benoit.canet@gmail.com>
Signed-off-by: Avi Kivity <avi@redhat.com>

syborg_pointer: convert to memory API

Signed-off-by: Benoit Canet <benoit.canet@gmail.com>
Signed-off-by: Avi Kivity <avi@redhat.com>

syborg_keyboard: convert to memory API

Signed-off-by: Benoit Canet <benoit.canet@gmail.com>
Signed-off-by: Avi Kivity <avi@redhat.com>

syborg_interrupt: convert to memory API

Signed-off-by: Benoit Canet <benoit.canet@gmail.com>
Signed-off-by: Avi Kivity <avi@redhat.com>

syborg_fb: convert to memory API

Signed-off-by: Benoit Canet <benoit.canet@gmail.com>
Signed-off-by: Avi Kivity <avi@redhat.com>

mst_fpga: convert to memory API

Signed-off-by: Benoit Canet <benoit.canet@gmail.com>
Signed-off-by: Avi Kivity <avi@redhat.com>

marvell_88x8618_audio: convert to memory API

Signed-off-by: Benoit Canet <benoit.canet@gmail.com>
Signed-off-by: Avi Kivity <avi@redhat.com>

stellaris: convert gptm to memory API

Signed-off-by: Benoit Canet <benoit.canet@gmail.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Avi Kivity <avi@redhat.com>

stellaris: convert adc to memory API

Signed-off-by: Benoit Canet <benoit.canet@gmail.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Avi Kivity <avi@redhat.com>

stellaris: convert i2c to memory API

Signed-off-by: Benoit Canet <benoit.canet@gmail.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Avi Kivity <avi@redhat.com>

stellaris: convert sys to memory API

Signed-off-by: Benoit Canet <benoit.canet@gmail.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Avi Kivity <avi@redhat.com>

integratorcp: convert control to memory API

Signed-off-by: Benoit Canet <benoit.canet@gmail.com>
Signed-off-by: Avi Kivity <avi@redhat.com>

integratorcp: convert icp pic to memory API

Signed-off-by: Benoit Canet <benoit.canet@gmail.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Avi Kivity <avi@redhat.com>

integratorcp: convert core to memory API

Signed-off-by: Benoit Canet <benoit.canet@gmail.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Avi Kivity <avi@redhat.com>

ioapic: Convert to memory API

This maintains the old imprecise access size handling.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: Avi Kivity <avi@redhat.com>

ioapic: Reject non-dword accesses to IOWIN register

Aligns the model with the spec.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: Avi Kivity <avi@redhat.com>

sbi: convert to memory API

Signed-off-by: Avi Kivity <avi@redhat.com>

fdc: convert to memory API

FIXME: instance ID for migration

Signed-off-by: Avi Kivity <avi@redhat.com>

pl190: convert to memory API

Signed-off-by: Avi Kivity <avi@redhat.com>

pl181: convert to memory API

Signed-off-by: Avi Kivity <avi@redhat.com>

pl110: convert to memory API

Signed-off-by: Avi Kivity <avi@redhat.com>

pl080: convert to memory API

Signed-off-by: Avi Kivity <avi@redhat.com>

pl061: convert to memory API

Signed-off-by: Avi Kivity <avi@redhat.com>

pl050: convert to memory API

Signed-off-by: Avi Kivity <avi@redhat.com>

pl031: convert to memory API

Signed-off-by: Avi Kivity <avi@redhat.com>

pl022: convert to memory API

Signed-off-by: Avi Kivity <avi@redhat.com>

pl011: convert to memory API

Signed-off-by: Avi Kivity <avi@redhat.com>

zaurus: convert to memory API

Signed-off-by: Avi Kivity <avi@redhat.com>

parallel: convert to memory API

Signed-off-by: Avi Kivity <avi@redhat.com>

jazz_led: convert to memory API

Signed-off-by: Avi Kivity <avi@redhat.com>

shix: convert to memory API

RAM wasn't actually allocated, only used, so fix that as well.

Signed-off-by: Avi Kivity <avi@redhat.com>

virtex_ml507: convert to memory API

Signed-off-by: Avi Kivity <avi@redhat.com>

vexpress: convert to memory API

Signed-off-by: Avi Kivity <avi@redhat.com>

versatilepb: convert to memory API

Signed-off-by: Avi Kivity <avi@redhat.com>

tosa: convert to memory API

Signed-off-by: Avi Kivity <avi@redhat.com>

Update version for 1.0-rc3 release

Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>

configure: check for EFD_NONBLOCK | EFD_CLOEXEC flags

Add check for the EFD_NONBLOCK and EFD_CLOEXEC flags to the
CONFIG_EVENTFD test.
This fixes the following build failure on Fedora 9:

      CC    event_notifier.o
    event_notifier.c: In function `event_notifier_init':
    event_notifier.c:21: error: `EFD_NONBLOCK' undeclared (first use in this function)
    event_notifier.c:21: error: (Each undeclared identifier is reported only once
    event_notifier.c:21: error: for each function it appears in.)
    event_notifier.c:21: error: `EFD_CLOEXEC' undeclared (first use in this function)
    make: *** [event_notifier.o] Error 1

Reviewed-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>

configure: build position independent executables on x86-Linux hosts

Change the default on x86 Linux hosts to building PIE (position
independent executables); instead of restricting the option to
user-only targets, apply it to all targets.

In addition, set the relocation sections to read-only (relro) when
available; this reduces the attack surface by disallowing changes to
relocation tables at runtime.

While PIE reduces performance and relro increases load time, it
greatly improves security, with the potential to reduce a code
execution vulnerability to a self denial of service.

Non-x86 are not changed, as they require TCG changes; neither are
non-Linux, due to lack of test coverage.

Signed-off-by: Avi Kivity <avi@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>

ivshmem: fix PCI BAR2 registration during initialization

Ivshmem cannot work, and the command lspci cannot show ivshmem BAR2 in the guest.
As for pci_register_bar(), parameter MemoryRegion should be s->bar instead of s->ivshmem.

Reviewed-by: Avi Kivity <avi@redhat.com>
Signed-off-by: Hongyong Zang <zanghongyong@huawei.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>

msix: avoid mask updates if mask is unchanged

Check pending bit only if vector mask status changed.
This is not really important for qemu.git but helps
fix a bug in qemu-kvm.git.

Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>

msix: Prevent bogus mask updates on MMIO accesses

>From: Jan Kiszka <jan.kiszka@siemens.com>

Only accesses to the MSI-X table must trigger a call to
msix_handle_mask_update, otherwise the vector
value might be out of range.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>

msix: track function masked in pci device state

Only go over the table when function is masked.
This is not really important for qemu.git but helps
fix a bug in qemu-kvm.git.

Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>

Include zlib.h using #include <>

zlib.h is not a local include file, therefore it should be included
using <> instead of "".

Signed-off-by: Stefan Weil <sw@weilnetz.de>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>

9p: pass dotl flags to the unlinkat method

AT_REMOVEDIR is not defined on all systems.  Pass the raw flags from the
9p protocol, which are always there.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>

9p: allow compiling the dummy virtio-9p-handle.c code on Linux

Avoid a conflict on the definition of struct file_handle by
using a replacement name.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>

qed: add migration blocker (v2)

Now when you try to migrate with qed, you get:

(qemu) migrate tcp:localhost:1025
Block format 'qed' used by device 'ide0-hd0' does not support feature 'live migration'
(qemu)

Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>

qcow2: implement bdrv_invalidate_cache (v2)

We don't reopen the actual file, but instead invoke the close and open routines.
We specifically ignore the backing file since it's contents are read-only and
therefore immutable.

Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>

block: allow migration to work with image files (v3)

Image files have two types of data: immutable data that describes things like
image size, backing files, etc. and mutable data that includes offset and
reference count tables.

Today, image formats aggressively cache mutable data to improve performance.  In
some cases, this happens before a guest even starts.  When dealing with live
migration, since a file is open on two machines, the caching of meta data can
lead to data corruption.

This patch addresses this by introducing a mechanism to invalidate any cached
mutable data a block driver may have which is then used by the live migration
code.

NB, this still requires coherent shared storage.  Addressing migration without
coherent shared storage (i.e. NFS) requires additional work.

Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>

ivshmem: use migration blockers to prevent live migration in peer mode (v2)

Now when you try to migrate with ivshmem, you get a proper QMP error:

(qemu) migrate tcp:localhost:1025
Migration is disabled when using feature 'peer mode' in device 'ivshmem'
(qemu)

Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>

migrate: add migration blockers

This lets different subsystems register an Error that is thrown whenever
migration is attempted.  This works nicely because it gracefully supports
things like hotplug.

Right now, if multiple errors are registered, only one of them is reported.
I expect that for 1.1, we'll extend query-migrate to return all of the reasons
why migration is disabled at any given point in time.

Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>

Merge remote-tracking branch 'kraxel/usb.31' into staging

Merge remote-tracking branch 'origin/master' into staging

usb-linux: fix /proc/bus/usb/devices scan

Commit 0c402e5abb8c2755390eee864b43a98280fc2453 is incomplete
and misses one of the two function pointer calls in
usb_host_scan_dev().  Add the additional port handling logic
to the other call too.

Spotted by Coverity.

Cc: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

ehci: add assert

Coverity thinks q could be NULL there and warns.
I believe it can't be NULL there.
Add assert to prove it.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

usb-storage: don't try to send the status early.

Until recently all scsi commands sent to scsi-disk did either transfer
data or finished instantly.  The correct implementation of
SYNCRONIZE_CACHE changed the picture though, and usb-storage needs
a fix to handle that case correctly.

usb-storage: drop result from device state.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

usb-storage: drop tag from device state.

scsi keeps track of the tag in SCSIRequest,
no need to store a separate copy.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

usb-storage: fill status in complete callback.

Put status word into device state, fill it in command_complete, have
usb_msd_send_status just send it out.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

usb-storage: move status debug message to usb_msd_send_status.

usb_msd_send_status can be called from different code paths, move the
debug message into the function to make sure it is printed
unconditionally.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

x86: fix pcmpestrm and pcmpistrm

Fix obvious typos (decrement and off-by-one error) in pcmpestrm and pcmpistrm
which resulted in infinite loop. Reported by Frank Mehnert,
spotted also by Coverity (bug 84752853).

Reported-by: Frank Mehnert <frank.mehnert@oracle.com>
Signed-off-by: Blue Swirl <blauwirbel@gmail.com>

loader: Fix read_targphys() to behave when read() fails

Happily passes (size_t)-1 to rom_add_blob_fixed(), which promptly dies
attempting to malloc that much.  Spotted by Coverity.

Bonus fix for ROMs larger than INT_MAX bytes: return ssize_t instead
of int.  Bug can't bite, because the only user load_aout() limits ROM
size to an int value.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Blue Swirl <blauwirbel@gmail.com>