tcg-sparc: Use UMULXHI instruction

Signed-off-by: Richard Henderson <rth@twiddle.net>

tcg-sparc: Rename ADDX/SUBX insns

The pre-v9 ADDX/SUBX insns were renamed ADDC/SUBC for v9.
Standardizing on the v9 name makes things less confusing.

Signed-off-by: Richard Henderson <rth@twiddle.net>

tcg-sparc: Use ADDXC in setcond_i64

Similar to the ADDC tricks we use in setcond_i32.

Signed-off-by: Richard Henderson <rth@twiddle.net>

tcg-sparc: Fix setcond_i32 uninitialized value

We failed to swap c1 and c2 correctly for NE c2 == 0.

Signed-off-by: Richard Henderson <rth@twiddle.net>

tcg-sparc: Use ADDXC in addsub2_i64

On T4 and newer Sparc chips we have an add-with-carry insn
that takes its input from %xcc instead of %icc.

Signed-off-by: Richard Henderson <rth@twiddle.net>

tcg-sparc: Support addsub2_i64

Signed-off-by: Richard Henderson <rth@twiddle.net>

Merge remote-tracking branch 'remotes/qmp-unstable/queue/qmp' into staging

* remotes/qmp-unstable/queue/qmp:
  Add HMP command "info memory-devices"
  qemu-socket: Eliminate silly QERR_ macros
  qemu-socket: Polish errors for connect() and listen() failure
  qemu-iotests: Test missing "driver" key for blockdev-add
  tests: add QMP input visitor test for unions with no discriminator
  qapi: dealloc visitor, implement visit_start_union
  qapi: add visit_start_union and visit_end_union
  virtio-balloon: fix integer overflow in memory stats feature
  monitor: Reset HMP mon->rs in CHR_EVENT_OPEN

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

libqos: use microseconds instead of iterations for virtio timeout

Some hosts are slow or overloaded so test execution takes a long time.
Test cases use timeouts to protect against an infinite loop stalling the
test forever (especially important in automated test setups).

Commit 6cd14054b67774cc58a51fca6660cfa1d3c08059 ("libqos virtio:
Increase ISR timeout") increased the clock_step() value in an attempt to
lengthen the virtio interrupt wait timeout, but timeout failures are
still occuring on the Travis automated testing platform.

This is because clock_step() only affects the guest's virtual time.
Virtio requests can be bottlenecked on host disk I/O latency - which
cannot be improved by stepping the clock, so the fix was ineffective.

This patch changes the qvirtio_wait_queue_isr() and
qvirtio_wait_config_isr() timeout mechanism from loop iterations to
microseconds.  This way the test case can specify an absolute 30 second
timeout.  Number of loop iterations is not a reliable timeout mechanism
since the speed depends on many factors including host performance.

Tests should no longer timeout on overloaded Travis instances.

Cc: Marc Marí <marc.mari.barcelo@gmail.com>
Reported-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

libqos: improve event_index test with timeout

The virtio event_index feature lets the device driver tell the device
how many requests to process before raising the next interrupt.
virtio-blk-test.c tries to verify that the device does not raise an
interrupt unnecessarily.

Unfortunately the test has a race condition.  It spins checking for an
interrupt up to 100 times and then assumes the request has finished.  On
a slow host the I/O request could still be in flight and the test would
fail.

This patch waits for the request to complete, or until a 30-second
timeout is reached.  If an interrupt is raised while waiting the test
fails since the device was not supposed to raise interrupts.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

raw-posix: Fix build without posix_fallocate()

Check for the presence of posix_fallocate() in configure and only
compile in support for PREALLOC_MODE_FALLOC when it's there.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging

Block patches

# gpg: Signature made Fri 26 Sep 2014 19:57:52 BST using RSA key ID C88F2FD6
# gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>"

* remotes/kevin/tags/for-upstream:
  qemu-iotests: Fail test if explicit test case number is unknown
  block: Validate node-name
  vpc: fix beX_to_cpu() and cpu_to_beX() confusion
  docs: add blkdebug block driver documentation
  block: Catch simultaneous usage of options and their aliases
  block: Specify -drive legacy option aliases in array
  block: Improve message for device name clashing with node name
  qemu-nbd: Destroy the BlockDriverState properly
  block: Keep DriveInfo alive until BlockDriverState dies
  blockdev: Disentangle BlockDriverState and DriveInfo creation
  blkdebug: show an error for invalid event names

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Merge remote-tracking branch 'remotes/mjt/tags/trivial-patches-2014-09-26' into staging

trivial patches for 2014-09-26

# gpg: Signature made Fri 26 Sep 2014 18:33:53 BST using RSA key ID A4C3D7DB
# gpg: Good signature from "Michael Tokarev <mjt@tls.msk.ru>"
# gpg:                 aka "Michael Tokarev <mjt@corpit.ru>"
# gpg:                 aka "Michael Tokarev <mjt@debian.org>"
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg:          There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 6EE1 95D1 886E 8FFB 810D  4324 457C E0A0 8044 65C5
#      Subkey fingerprint: 6F67 E18E 7C91 C5B1 5514  66A7 BEE5 9D74 A4C3 D7DB

* remotes/mjt/tags/trivial-patches-2014-09-26:
  os-posix: report error message when lock file failed
  os-posix: remove confused errno
  os-posix: change tab to space avoid violating coding style
  qapi: Update docs given recent event, spacing fixes
  qapi: Ignore files created during make check
  qapi: Consistent whitespace in tests/Makefile
  vmxcap: Update according to SDM of September 2014
  .travis.yml: remove "make check" from main matrix
  .travis.yml: pre-seed sub-modules for speed
  .travis.yml: make the make slightly more parallel
  .travis.yml: add more linux-user to the build matrix
  tests: avoid running duplicate qom-tests

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Add HMP command "info memory-devices"

Provides HMP equivalent of QMP query-memory-devices command.

Signed-off-by: Zhu Guihua <zhugh.fnst@cn.fujitsu.com>
Reviewed-By: Igor Mammedov <imammedo@redhat.com>
Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>

qemu-socket: Eliminate silly QERR_ macros

The QERR_ macros are leftovers from the days of "rich" error objects.
They're used with error_set() and qerror_report(), and expand into the
first *two* arguments.  This trickiness has become pointless.  Clean
up.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>

os-posix: report error message when lock file failed

It will cause that create vm failed When manager
tool is killed forcibly (kill -9 libvirtd_pid),
the file not was unlink, and unlock. It's better
that report the error message for users.

Signed-off-by: Huangweidong <weidong.huang@huawei.com>
Signed-off-by: Gonglei <arei.gonglei@huawei.com>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

os-posix: remove confused errno

If we get inside the 'else if (status == 1)' conditional,
then we know that read() succeeded, and therefore errno is
unspecified. Printing strerror(errno) on a random value
is not helpful.

Cc: Eric Blake <eblake@redhat.com>
Signed-off-by: Gonglei <arei.gonglei@huawei.com>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

os-posix: change tab to space avoid violating coding style

Cc: Eric Blake <eblake@redhat.com>
Signed-off-by: Gonglei <arei.gonglei@huawei.com>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

qemu-socket: Polish errors for connect() and listen() failure

connect() doesn't "connect to socket", it connects a socket to an
address and, if it's of type SOCK_STREAM, initiates a connection.
Scratch "to".

listen() does "set socket to listening mode", but it sounds awkward.
Change to "listen on socket".

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Gonglei <arei.gonglei@huawei.com>
Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>

qapi: Update docs given recent event, spacing fixes

Commit 21cd70d added event support but didn't document what the
generated code looks like.  Commit 05dfb26 removed some unwanted
spaces in the generated code, but didn't reflect those changes
into the documentation.  Finally, the docs start with a big
disclaimer about QMP not using QAPI yet, which feels rather stale.

Signed-off-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

qapi: Ignore files created during make check

After an in-tree build and run of 'make check-{qapi-schema,unit}',
I noticed some leftover files.

Signed-off-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Wenchao Xia <wenchaoqemu@gmail.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

qapi: Consistent whitespace in tests/Makefile

tests/Makefile had a mix of TAB vs. 8-space indentation; given
that it is a Makefile, TAB is more idiomatic even though in these
particular cases the choice of whitespace didn't matter.

Signed-off-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

qemu-iotests: Test missing "driver" key for blockdev-add

Signed-off-by: Fam Zheng <famz@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Cc: qemu-stable@nongnu.org
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>

tests: add QMP input visitor test for unions with no discriminator

This is more of an exercise of the dealloc visitor, where it may
erroneously use an uninitialized discriminator field as indication
that union fields corresponding to that discriminator field/type are
present, which can lead to attempts to free random chunks of heap
memory.

Cc: qemu-stable@nongnu.org
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>

qapi: dealloc visitor, implement visit_start_union

If the .data field of a QAPI Union is NULL, we don't need to free
any of the union fields.

Make use of the new visit_start_union interface to access this
information and instruct the generated code to not visit these
fields when this occurs.

Cc: qemu-stable@nongnu.org
Reported-by: Fam Zheng <famz@redhat.com>
Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>

qapi: add visit_start_union and visit_end_union

In some cases an input visitor might bail out on filling out a
struct for various reasons, such as missing fields when running
in strict mode. In the case of a QAPI Union type, this may lead
to cases where the .kind field which encodes the union type
is uninitialized. Subsequently, other visitors, such as the
dealloc visitor, may use this .kind value as if it were
initialized, leading to assumptions about the union type which
in this case may lead to segfaults. For example, freeing an
integer value.

However, we can generally rely on the fact that the always-present
.data void * field that we generate for these union types will
always be NULL in cases where .kind is uninitialized (at least,
there shouldn't be a reason where we'd do this purposefully).

So pass this information on to Visitor implementation via these
optional start_union/end_union interfaces so this information
can be used to guard against the situation above. We will make
use of this information in a subsequent patch for the dealloc
visitor.

Cc: qemu-stable@nongnu.org
Reported-by: Fam Zheng <famz@redhat.com>
Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>

virtio-balloon: fix integer overflow in memory stats feature

When a QMP client changes the polling interval time by setting
the guest-stats-polling-interval property, the interval value
is stored and manipulated as an int64_t variable.

However, the balloon_stats_change_timer() function, which is
used to set the actual timer with the interval value, takes
an int instead, causing an overflow for big interval values.

This commit fix this bug by changing balloon_stats_change_timer()
to take an int64_t and also it limits the polling interval value
to UINT_MAX to avoid other kinds of overflow.

Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>

monitor: Reset HMP mon->rs in CHR_EVENT_OPEN

Commit cdaa86a54 ("Add G_IO_HUP handler for socket chardev") exposed a bug in
the way the HMP monitor handles its command buffer. When a client closes the
connection to the monitor, tcp_chr_read() will detect the G_IO_HUP condition
and call tcp_chr_disconnect() to close the server-side connection too. Due to
the fact that monitor reads 1 byte at a time (for each tcp_chr_read()), the
monitor readline state / buffers might contain junk (i.e. a half-finished
command). Thus, without calling readline_restart() on mon->rs in
CHR_EVENT_OPEN, future HMP commands will fail.

Signed-off-by: Stratos Psomadakis <psomas@grnet.gr>
Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>
Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>

vmxcap: Update according to SDM of September 2014

This adds reporting of RDSEED exiting and XSAVES/XRSTORS #UD and fixes
the range of VMCS revision as well as some typos.

Signed-off-by: Adrian-Ken Rueegsegger <ken@codelabs.ch>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

.travis.yml: remove "make check" from main matrix

There are problems with unreliability in "make check" which still need
to be tracked down. As the tests are broadly the same for all targets if
added one explicit target to the matrix to run it. However this does
build all softmmu targets to ensure they at least "run"

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Alexander Graf <agraf@suse.de>
Reviewed-by: Brian Jackson <iggy@theiggy.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

.travis.yml: pre-seed sub-modules for speed

A significant portion of the build time is spent initialising all the
sub-modules we use in the source tree. Often this is almost as long as
the build itself. By pre-seeding the .git/modules tree this will
hopefully improve things.

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Alexander Graf <agraf@suse.de>
Reviewed-by: Brian Jackson <iggy@theiggy.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

.travis.yml: make the make slightly more parallel

The Travis VMs have 1.5 cores so we might as well make some use of the
paralellism.

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Alexander Graf <agraf@suse.de>
Reviewed-by: Brian Jackson <iggy@theiggy.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

.travis.yml: add more linux-user to the build matrix

At the same time I've grouped the $ARCH-linux-user and $ARCH-softmmu
builds together (hoping FS cache helps) and grouped all $ARCH-softmmu
only builds into one target. This reduces the build matrix slightly
which will hopefully help with build times.

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Alexander Graf <agraf@suse.de>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

tests: avoid running duplicate qom-tests

Since 3687d532 we've been unconditionally adding qom-test to our qtests
for every arch. However, some archs inherit their tests from Makefile
variables for other archs, such as i386/x86_64,
microblaze/microblazeel, and xtensa/xtensaeb. Since these are evaluated
in a lazy manner, we ultimately end up adding qom-test twice.

In the case x86_64, where we have a large number of machine types that
we rerun qom-test for, this has lead to a fairly noticeable increase
in the overall run-time of `make check` (78s vs. 42s on my machine).
Similar speed-ups are visible for other such archs, but not nearly as
significant.

Fix this by only adding qom-test to an arch's test list if it's not
already present.

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Andreas Färber <afaerber@suse.de>
Cc: qemu-stable@nongnu.org
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into staging

Usual mix of patches, the most important being Alex and Marcelo's
kvmclock fix.  This was reverted last minute for 2.1, but it is now back
with the problematic case fixed.

Note: I will soon switch to a subkey for signing purposes.  To verify
future signed pull requests from me, please update my key with
"gpg --recv-keys 9B4D86F2".  You should see 3 new subkeys---the
one for signing will be a 2048-bit RSA key, 4E6B09D7.

# gpg: Signature made Fri 26 Sep 2014 15:34:44 BST using RSA key ID 9B4D86F2
# gpg: Good signature from "Paolo Bonzini <pbonzini@redhat.com>"
# gpg:                 aka "Paolo Bonzini <bonzini@gnu.org>"

* remotes/bonzini/tags/for-upstream:
  kvm/valgrind: don't mark memory as initialized
  po: fix conflict with %.mo rule in rules.mak
  kvmvapic: fix migration when VM paused and when not running Windows
  serial: check if backed by a physical serial port at realize time
  serial: reset state at startup
  target-i386: update fp status fix
  hw/dma/i8257: Silence phony error message
  kvmclock: Ensure time in migration never goes backward
  kvmclock: Ensure proper env->tsc value for kvmclock_current_nsec calculation
  Introduce cpu_clean_all_dirty
  pit: fix pit interrupt can't inject into vm after migration

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

kvm/valgrind: don't mark memory as initialized

since commit 7dda5dc82a77 ("migration: initialize RAM to zero") the
guest memory is defined zero. No need to call valgrind on guest memory.
This reverts commit 62fe83318d2f ("qemu: Use valgrind annotations to
mark kvm guest memory as defined") thus speeding up kvm start if
<includedir>/valgrind/valgrind.h is available.

Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

po: fix conflict with %.mo rule in rules.mak

po/Makefile includes rules.mak to use the nice quiet-command macro.
However, this also brings in a %.mo rule that breaks "make build".
Put our own rule before the include, so that it has precedence.

Reported-by: Christian Borntraeger <borntraeger@de.ibm.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

kvmvapic: fix migration when VM paused and when not running Windows

This patch fixes migration by extending do_vapic_enable function. This function
called vapic_enable which read cpu number from the guest memory. When cpu
number could not be read, vapic was not enabled while loading the VM state.
This patch adds required code for cpu_number=0 to do_vapic_enable function,
because it is called only when cpu_number=0.

Signed-off-by: Pavel Dovgalyuk <Pavel.Dovgaluk@ispras.ru>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

Merge remote-tracking branch 'remotes/stefanha/tags/tracing-pull-request' into staging

# gpg: Signature made Fri 26 Sep 2014 11:59:34 BST using RSA key ID 81AB73C8
# gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>"
# gpg:                 aka "Stefan Hajnoczi <stefanha@gmail.com>"

* remotes/stefanha/tags/tracing-pull-request:
  ohci: drop computed flags from trace events
  ohci: Split long traces to smaller ones
  scripts/tracetool: don't barf on formats with precision
  trace: install trace-events file
  trace-events: Fix comments pointing to source files
  trace-events: Drop orphaned monitor trace event
  trace-events: Drop unused megasas trace event
  cleanup-trace-events.pl: Tighten search for trace event call
  trace: tighten up trace-events regex to fix bad parse
  trace-events: drop orphan iscsi trace events
  trace-events: drop orphan usb_mtp_data_out
  trace-events: drop orphan virtio_blk_data_plane_complete_request
  trace: [hmp] Reimplement "trace-event" and "info trace-events" using QMP
  trace: [qmp] Add commands to query and control event tracing state
  trace: docs: add trace file description
  trace: [ust] Fix format string computation in tcg-enabled events

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

main-loop.c: Handle SIGINT, SIGHUP and SIGTERM synchronously

Add the termination signals SIGINT, SIGHUP and SIGTERM to the
list of signals which we handle synchronously via a signalfd.
This avoids a race condition where if we took the SIGTERM
in the middle of qemu_shutdown_requested:
    int r = shutdown_requested;
[SIGTERM here...]
    shutdown_requested = 0;

then the setting of the shutdown_requested flag by
termsig_handler() would be lost and QEMU would fail to
shut down. This was causing 'make check' to hang occasionally.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 1411660269-11081-1-git-send-email-peter.maydell@linaro.org
Cc: qemu-stable@nongnu.org

ohci: drop computed flags from trace events

This exceeded the trace argument limit for LTTNG UST and wasn't really
needed as the flags value is stored anyway. Dropping this fixes the
compile failure for UST. It can probably be merged with the previous
trace shortening patch.

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

ohci: Split long traces to smaller ones

Recent traces rework introduced 2 tracepoints with 13 and 20
arguments. When dtrace backend is selected
(--enable-trace-backend=dtrace), compile fails as
sys/sdt.h defines DTRACE_PROBE up to DTRACE_PROBE12 only.

This splits long tracepoints.

Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

scripts/tracetool: don't barf on formats with precision

This only affects lttng user space tracing at the moment.

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

trace: install trace-events file

Install the ./trace-events file into the data directory.  This file
contains the list of trace events that were built into QEMU at
compile-time.

The file is a handy reference for the set of trace events that the QEMU
binary was built with.  It is also needed by the simpletrace.py tool
that parses binary trace data either emitted from QEMU when built with
--enable-trace-backend=simple or by the SystemTap simpletrace script
that QEMU provides.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 1411486175-3017-1-git-send-email-stefanha@redhat.com

trace-events: Fix comments pointing to source files

A few files have been renamed without updating their comment here.  A
few events have been added in the wrong place.  Clean that up.

Comments with no space after the '#' look ugly and confuse
cleanup-trace-events.pl.  Insert a space.

scripts/cleanup-trace-events.pl is now happy again.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-id: 1411476811-24251-5-git-send-email-armbru@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

trace-events: Drop orphaned monitor trace event

Event monitor_protocol_event is unused since commit 7517517.  Drop it.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-id: 1411476811-24251-4-git-send-email-armbru@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

trace-events: Drop unused megasas trace event

Event megasas_io_read was added in commit e8f943c, but never used.
Drop it.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-id: 1411476811-24251-3-git-send-email-armbru@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

cleanup-trace-events.pl: Tighten search for trace event call

The script can get fooled too easily.  For instance, it finds
trace_megasas_io_read_start when looking for trace_megasas_io_read,
and incorrectly concludes that event megasas_io_read is used.

Supply -w to git-grep to tighten the search.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-id: 1411476811-24251-2-git-send-email-armbru@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

trace: tighten up trace-events regex to fix bad parse

Use \w for properties and trace event names since they are both drawn
from [a-zA-Z0-9_] character sets.

The .* for matching properties was too aggressive and caused the
following failure with foo(int rc) "(this is a test)":

  Traceback (most recent call last):
    File "scripts/tracetool.py", line 139, in <module>
      main(sys.argv)
    File "scripts/tracetool.py", line 134, in main
      binary=binary, probe_prefix=probe_prefix)
    File "scripts/tracetool/__init__.py", line 334, in generate
      events = _read_events(fevents)
    File "scripts/tracetool/__init__.py", line 262, in _read_events
      res.append(Event.build(line))
    File "scripts/tracetool/__init__.py", line 225, in build
      return Event(name, props, fmt, args, arg_fmts)
    File "scripts/tracetool/__init__.py", line 185, in __init__
      % ", ".join(unknown_props))
  ValueError: Unknown properties: foo(int, rc)

Cc: Lluís Vilanova <vilanova@ac.upc.edu>
Reported-by: Eric Auger <eric.auger@linaro.org>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 1411468626-20450-1-git-send-email-stefanha@redhat.com

trace-events: drop orphan iscsi trace events

iscsi_aio_write16_cb, iscsi_aio_writev, iscsi_aio_read16_cb, and
iscsi_aio_readv have not not been in use since commit
063c3378a9e3c25cc0afac3c72e4823d0621e352 ("block/iscsi: introduce
bdrv_co_{readv, writev, flush_to_disk}").

These were the only trace events in block/iscsi.c so drop the the
trace.h include.

Cc: Peter Lieven <pl@kamp.de>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Message-id: 1411394595-15300-4-git-send-email-stefanha@redhat.com

trace-events: drop orphan usb_mtp_data_out

This trace event was added in commit
840a178c94dbd3f5b5550fb8621620cb761de72d ("usb: mtp filesharing") but
never used.

Cc: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Message-id: 1411394595-15300-3-git-send-email-stefanha@redhat.com

trace-events: drop orphan virtio_blk_data_plane_complete_request

This trace event has not been in use since commit
b002254dbd4c19a01f29790f840f983803e26893 ("virtio-blk: Unify
{non-,}dataplane's request handlings").

Cc: Fam Zheng <famz@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Message-id: 1411394595-15300-2-git-send-email-stefanha@redhat.com

trace: [hmp] Reimplement "trace-event" and "info trace-events" using QMP

Signed-off-by: Lluís Vilanova <vilanova@ac.upc.edu>
Message-id: 20140825112002.31112.60143.stgit@fimbulvetr.bsc.es
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

trace: [qmp] Add commands to query and control event tracing state

Signed-off-by: Lluís Vilanova <vilanova@ac.upc.edu>
Message-id: 20140825111957.31112.31733.stgit@fimbulvetr.bsc.es
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

trace: docs: add trace file description

When user used the trace print command from docs/tracing.txt:
  ./scripts/simpletrace.py trace-events trace-*

the user maybe be misled by the "trace-*", because if user
directly copy the comand line to run, there alway print the
bored message:
"usage: ./scripts/simpletrace.py <trace-events> <trace-file>"

then we should describe that the "trace-*" represented.

Signed-off-by: Chen Fan <chen.fan.fnst@cn.fujitsu.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

trace: [ust] Fix format string computation in tcg-enabled events

TCG-enabled events start with two format strings. Delay per-argument format
computation until requested ('Event.formats').

Signed-off-by: Lluís Vilanova <vilanova@ac.upc.edu>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

cpu-exec: Do CPU_INTERRUPT_HALT unconditionally

The signal is currently checked by 10 targets, but only actually
raised by Sparc and ARM.  For the sake of one test-and-branch,
we can handle this generic bit generically.

Signed-off-by: Richard Henderson <rth@twiddle.net>
Message-id: 1410626734-3804-24-git-send-email-rth@twiddle.net
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

target-i386: Use cpu_exec_interrupt qom hook

Signed-off-by: Richard Henderson <rth@twiddle.net>
Message-id: 1410626734-3804-23-git-send-email-rth@twiddle.net
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

target-ppc: Use cpu_exec_interrupt qom hook

Cc: qemu-ppc@nongnu.org
Signed-off-by: Richard Henderson <rth@twiddle.net>
Message-id: 1410626734-3804-22-git-send-email-rth@twiddle.net
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

target-lm32: Use cpu_exec_interrupt qom hook

Cc: Michael Walle <michael@walle.cc>
Signed-off-by: Richard Henderson <rth@twiddle.net>
Acked-by: Michael Walle <michael@walle.cc>
Message-id: 1410626734-3804-21-git-send-email-rth@twiddle.net
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

target-microblaze: Use cpu_exec_interrupt qom hook

Cc: Edgar E. Iglesias <edgar.iglesias@gmail.com>
Signed-off-by: Richard Henderson <rth@twiddle.net>
Message-id: 1410626734-3804-20-git-send-email-rth@twiddle.net
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

target-mips: Use cpu_exec_interrupt qom hook

Cc: Aurelien Jarno <aurelien@aurel32.net>
Signed-off-by: Richard Henderson <rth@twiddle.net>
Reviewed-by: Leon Alrae <leon.alrae@imgtec.com>
Tested-by: Leon Alrae <leon.alrae@imgtec.com>
Message-id: 1410626734-3804-19-git-send-email-rth@twiddle.net
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

target-tricore: Remove the dummy interrupt boilerplate

It can go back in when it actually does something.

Cc: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
Signed-off-by: Richard Henderson <rth@twiddle.net>
Reviewed-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
Message-id: 1410626734-3804-18-git-send-email-rth@twiddle.net
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

target-openrisc: Use cpu_exec_interrupt qom hook

Cc: Jia Liu <proljc@gmail.com>
Signed-off-by: Richard Henderson <rth@twiddle.net>
Tested-by: Jia Liu <proljc@gmail.com>
Message-id: 1410626734-3804-17-git-send-email-rth@twiddle.net
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

target-sparc: Use cpu_exec_interrupt qom hook

Cc: Blue Swirl <blauwirbel@gmail.com>
Signed-off-by: Richard Henderson <rth@twiddle.net>
Message-id: 1410626734-3804-16-git-send-email-rth@twiddle.net
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

target-arm: Use cpu_exec_interrupt qom hook

Cc: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <rth@twiddle.net>
Message-id: 1410626734-3804-15-git-send-email-rth@twiddle.net
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

target-unicore32: Use cpu_exec_interrupt qom hook

Cc: Guan Xuetao <gxt@mprc.pku.edu.cn>
Signed-off-by: Richard Henderson <rth@twiddle.net>
Message-id: 1410626734-3804-14-git-send-email-rth@twiddle.net
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

target-sh4: Use cpu_exec_interrupt qom hook

Cc: Aurelien Jarno <aurelien@aurel32.net>
Signed-off-by: Richard Henderson <rth@twiddle.net>
Message-id: 1410626734-3804-13-git-send-email-rth@twiddle.net
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

target-alpha: Use cpu_exec_interrupt qom hook

Signed-off-by: Richard Henderson <rth@twiddle.net>
Message-id: 1410626734-3804-12-git-send-email-rth@twiddle.net
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

target-cris: Use cpu_exec_interrupt qom hook

Cc: Edgar E. Iglesias <edgar.iglesias@gmail.com>
Signed-off-by: Richard Henderson <rth@twiddle.net>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Message-id: 1410626734-3804-11-git-send-email-rth@twiddle.net
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

target-m68k: Use cpu_exec_interrupt qom hook

Since do_interrupt_m68k_hardirq is no longer used outside
op_helper.c, make it static.

Signed-off-by: Richard Henderson <rth@twiddle.net>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 1410626734-3804-10-git-send-email-rth@twiddle.net
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

target-s390x: Use cpu_exec_interrupt qom hook

Cc: Alexander Graf <agraf@suse.de>
Signed-off-by: Richard Henderson <rth@twiddle.net>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 1410626734-3804-9-git-send-email-rth@twiddle.net
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

target-xtensa: Use cpu_exec_interrupt qom hook

Cc: Max Filippov <jcmvbkbc@gmail.com>
Signed-off-by: Richard Henderson <rth@twiddle.net>
Reviewed-by: Max Filippov <jcmvbkbc@gmail.com>
Message-id: 1410626734-3804-8-git-send-email-rth@twiddle.net
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

qom: Add cpu_exec_interrupt hook

Continuing the removal of ifdefs from cpu_exec.

Cc: Andreas Färber <afaerber@suse.de>
Signed-off-by: Richard Henderson <rth@twiddle.net>
Reviewed-by: Max Filippov <jcmvbkbc@gmail.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 1410626734-3804-7-git-send-email-rth@twiddle.net
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

target-ppc: Use cpu_exec_enter qom hook

Cc: qemu-ppc@nongnu.org
Signed-off-by: Richard Henderson <rth@twiddle.net>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 1410626734-3804-6-git-send-email-rth@twiddle.net
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

target-m68k: Use cpu_exec_enter/exit qom hooks

Signed-off-by: Richard Henderson <rth@twiddle.net>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 1410626734-3804-5-git-send-email-rth@twiddle.net
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

target-i386: Use cpu_exec_enter/exit qom hooks

Note that the code that was within the "exit" ifdef block
was identical to the cpu_compute_eflags inline, so make that
simplification at the same time.

Signed-off-by: Richard Henderson <rth@twiddle.net>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 1410626734-3804-4-git-send-email-rth@twiddle.net
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

cpu-exec: Remove do-nothing ifdef chains

Around the cpu_exec_enter/exit hooks contain many empty
ifdef blocks.  Delete all of these to highlight those
targets for which we actually need to do work.

Signed-off-by: Richard Henderson <rth@twiddle.net>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 1410626734-3804-3-git-send-email-rth@twiddle.net
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

qom: Add cpu_exec_enter and cpu_exec_exit hooks

In preparation for removing a bunch of ifdefs from cpu_exec.

Cc: Andreas Färber <afaerber@suse.de>
Signed-off-by: Richard Henderson <rth@twiddle.net>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 1410626734-3804-2-git-send-email-rth@twiddle.net
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Merge remote-tracking branch 'remotes/mcayland/tags/qemu-openbios-signed' into staging

Update OpenBIOS images

# gpg: Signature made Thu 25 Sep 2014 13:35:55 BST using RSA key ID AE0F321F
# gpg: Good signature from "Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>"
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg:          There is no indication that the signature belongs to the owner.
# Primary key fingerprint: CC62 1AB9 8E82 200D 915C  C9C4 5BC2 C56F AE0F 321F

* remotes/mcayland/tags/qemu-openbios-signed:
  Update OpenBIOS images

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

qemu-iotests: Fail test if explicit test case number is unknown

When we expand a number range, we just print "$id - unknown test,
ignored", this is convenient if we want to run a range of tests.

When we designate a test case number explicitly, we shouldn't just
ignore it if the case script doesn't exist.

Print an error and fail the test.

Signed-off-by: Fam Zheng <famz@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>

block: Validate node-name

The device_name of a BlockDriverState is currently checked because it is
always used as a QemuOpts ID and qemu_opts_create() checks whether such
IDs are wellformed.

node-name is supposed to share the same namespace, but it isn't checked
currently. This patch adds explicit checks both for device_name and
node-name so that the same rules will still apply even if QemuOpts won't
be used any more at some point.

qemu-img used to use names with spaces in them, which isn't allowed any
more. Replace them with underscores.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>

vpc: fix beX_to_cpu() and cpu_to_beX() confusion

The beX_to_cpu() and cpu_to_beX() functions perform the same operation -
they do a byteswap if the host CPU endianness is little-endian or a
nothing otherwise.

The point of two names for the same operation is that it documents which
direction the data is being converted.  This makes it clear whether the
data is suitable for CPU processing or in its external representation.

This patch fixes incorrect beX_to_cpu()/cpu_to_beX() usage.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>

docs: add blkdebug block driver documentation

The blkdebug block driver is undocumented.  Documenting it is worthwhile
since it offers powerful error injection features that are used by
qemu-iotests test cases.

This document will make it easier for people to learn about and use
blkdebug.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>

block: Catch simultaneous usage of options and their aliases

While thinking about precedence of conflicting block device options from
different sources, I noticed that you can specify both an option and its
legacy alias at the same time (e.g. readonly=on,read-only=off). Rather
than specifying the order of precedence, we should simply forbid such
combinations.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Benoît Canet <benoit.canet@nodalink.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>

block: Specify -drive legacy option aliases in array

Instead of a series of qemu_opt_rename() calls, use an array that
contains all of the renames and call qemu_opt_rename() in a loop. This
will keep the code readable even when we add an error return to
qemu_opt_rename().

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Benoît Canet <benoit.canet@nodalink.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>

block: Improve message for device name clashing with node name

Suggested-by: Benoit Canet <benoit.canet@nodalink.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Benoît Canet <benoit.canet@nodalink.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>

qemu-nbd: Destroy the BlockDriverState properly

Match the bdrv_new() with a bdrv_unref(), just to be tidy.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>

block: Keep DriveInfo alive until BlockDriverState dies

If the BDS's refcnt > 0, drive_del() destroys the DriveInfo, but not
the BDS.  This can happen in three places:

* Device model destruction during unplug: blockdev_auto_del()

* Xen IDE unplug: pci_piix3_xen_ide_unplug()

* drive_del command when no device model is attached: do_drive_del()

The other callers of drive_del are on error paths where refcnt == 1.

If the user somehow manages to plug in a device model using a BDS that
has gone through drive_del(), the legacy configuration passed in
DriveInfo doesn't reach the device model, and automatic deletion on
unplug doesn't work.  Worse, some device models such as scsi-disk
crash when DriveInfo doesn't exist.

This is theoretical; I didn't research an actual reproducer. The problem
was introduced when we replaced DriveInfo reference counting by BDS
reference counting in commit a94a3fa..fa510eb.

Fix by keeping DriveInfo alive until its BDS dies.

This affects qemu_drive_opts: now you can't reuse the same ID for new
drive options until the BDS dies.  Before, you could, but since the
code always attempts to create a BDS with the same ID next, the
enclosing operation "create a new drive" failed anyway.  Different
error path, same result.

Unfortunately, the fix involves use of blockdev.c stuff from block.c,
which is a layering violation.  Fortunately, my forthcoming
BlockBackend work will get rid of it again.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
Reviewed-by: Benoît Canet <benoit.canet@nodalink.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>

blockdev: Disentangle BlockDriverState and DriveInfo creation

blockdev_init() mixes up BlockDriverState and DriveInfo initialization
Finish the BlockDriverState job before starting to mess with
DriveInfo.  Easier on the eyes.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
Reviewed-by: Benoît Canet <benoit.canet@nodalink.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>

blkdebug: show an error for invalid event names

It is easy to typo a blkdebug configuration and waste a lot of time
figuring out why no rules are matching.

Push the Error** down into add_rule() so we can report an error when the
event name is invalid.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Gonglei <arei.gonglei@huawei.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>

Update OpenBIOS images

Update OpenBIOS images to SVN r1320 built from submodule.

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>

Merge remote-tracking branch 'remotes/mcayland/tags/qemu-sparc-signed' into staging

tcx: Implement hardware acceleration

# gpg: Signature made Tue 23 Sep 2014 22:52:34 BST using RSA key ID AE0F321F
# gpg: Can't check signature: public key not found

* remotes/mcayland/tags/qemu-sparc-signed:
  tcx: Implement hardware acceleration

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

virtio: Fix wrong type cast from pointer to long

Compiler warning (w32, w64):

include/hw/virtio/virtio_ring.h:142:26: warning:
 cast from pointer to integer of different size [-Wpointer-to-int-cast]

When sizeof(long) < sizeof(void *), this is not only a warning but a
real program error.

Add also missing blanks in the same statement.

Signed-off-by: Stefan Weil <sw@weilnetz.de>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Fam Zheng <famz@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 1411536002-14088-1-git-send-email-sw@weilnetz.de
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Merge remote-tracking branch 'remotes/awilliam/tags/vfio-pci-for-qemu-20140923.0' into staging

Endian updates to re-fix cross endian host and guest and
enable the same for ROM loading (Alexey)

# gpg: Signature made Tue 23 Sep 2014 18:03:03 BST using RSA key ID 3BB08B22
# gpg: Can't check signature: public key not found

* remotes/awilliam/tags/vfio-pci-for-qemu-20140923.0:
  vfio: make rom read endian sensitive
  Revert "vfio: Make BARs native endian"

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

tcx: Implement hardware acceleration

The S24/TCX framebuffer is a mildly accelerated video card with
blitter, stippler and hardware cursor.

* Solaris and NetBSD 6.x use all the hardware acceleration features
* The Xorg driver (used by Linux) can use the hardware cursor only

This patch implements hardware acceleration in both 8 bit and 24 bit
modes. It is based on the NetBSD driver sources and from tests with
Solaris.

Signed-off-by: Olivier Danet <odanet@caramail.com>
Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>

slirp: udp: fix NULL pointer dereference because of uninitialized socket

When guest sends udp packet with source port and source addr 0,
uninitialized socket is picked up when looking for matching and already
created udp sockets, and later passed to sosendto() where NULL pointer
dereference is hit during so->slirp->vnetwork_mask.s_addr access.

Fix this by checking that the socket is not just a socket stub.

This is CVE-2014-3640.

Signed-off-by: Petr Matousek <pmatouse@redhat.com>
Reported-by: Xavier Mehrenberger <xavier.mehrenberger@airbus.com>
Reported-by: Stephane Duverger <stephane.duverger@eads.net>
Reviewed-by: Jan Kiszka <jan.kiszka@siemens.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Message-id: 20140918063537.GX9321@dhcp-25-225.brq.redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Merge remote-tracking branch 'remotes/kraxel/tags/pull-usb-20140923-1' into staging

usb: enable hotplug, switch to realize, ohci tracing, misc fixes.

# gpg: Signature made Tue 23 Sep 2014 12:42:29 BST using RSA key ID D3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
# gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
# gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

* remotes/kraxel/tags/pull-usb-20140923-1: (26 commits)
  usb: tag standalone ehci as hotpluggable
  usb: tag standalone uhci as hotpluggable
  usb: tag xhci as hotpluggable
  usb-serial: only check speed once at realize time
  usb-bus: introduce a wrapper function to check speed
  usb-bus: remove "init" from USBDeviceClass struct
  usb-mtp: convert init to realize
  usb-redir: convert init to realize
  usb-audio: convert init to realize
  dev-wacom: convert init to realize
  dev-hid: convert init to realize
  usb-ccid: convert init to realize
  dev-serial: convert init to realize
  dev-bluetooth: convert init to realize
  dev-uas: using error_report instead of fprintf
  dev-uas: convert init to realize
  dev-storage: usring error_report instead of fprintf/printf
  dev-storage: convert init to realize
  usb-hub: convert init to realize
  libusb: using error_report instead of fprintf
  ...

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Merge remote-tracking branch 'remotes/borntraeger/tags/s390x-20140923' into staging

s390x/kvm: some fixes and cleanups

1. sclp: get of of duplicate defines
2. ccw: implement and fix handling of some special cases

# gpg: Signature made Tue 23 Sep 2014 13:10:47 BST using RSA key ID B5A61C7C
# gpg: Can't check signature: public key not found

* remotes/borntraeger/tags/s390x-20140923:
  s390x/css: catch ccw sequence errors
  s390x/css: support format-0 ccws
  s390x: remove duplicate defines in SCLP code

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

s390x/css: catch ccw sequence errors

We must not allow chains of more than 255 ccws without data transfer.

Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

s390x/css: support format-0 ccws

Add support for format-0 ccws in channel programs. As a format-1 ccw
contains the same information as format-0 ccws, only supporting larger
addresses, simply convert every ccw to format-1 as we walk the chain.

Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>