[Spice-commits] 33 commits - .gitignore configure docs/spice-port-fqdn.txt hw/arm_gic.c hw/pflash_cfi01.c hw/pflash_cfi02.c hw/qxl-render.c hw/virtio-serial-bus.c hw/vmmouse.c hw/xen_console.c hw/xen_pt.c hw/xen_pt_msi.c hw/zynq_slcr.c linux-user/syscall.c net/hub.c qemu-char.c qemu-options.hx spice-qemu-char.c trace-events ui/qemu-spice.h ui/spice-core.c user-exec.c xen-all.c

Gerd Hoffmann kraxel at kemper.freedesktop.org
Tue Dec 18 23:32:22 PST 2012


 .gitignore               |    1 
 configure                |   16 +--
 docs/spice-port-fqdn.txt |   19 ++++
 hw/arm_gic.c             |    2 
 hw/pflash_cfi01.c        |   14 +--
 hw/pflash_cfi02.c        |    6 -
 hw/qxl-render.c          |   11 +-
 hw/virtio-serial-bus.c   |  195 +++++++++++++++++++++++++++--------------------
 hw/vmmouse.c             |    1 
 hw/xen_console.c         |   28 +++++-
 hw/xen_pt.c              |    5 -
 hw/xen_pt_msi.c          |    2 
 hw/zynq_slcr.c           |    7 -
 linux-user/syscall.c     |    2 
 net/hub.c                |    2 
 qemu-char.c              |    3 
 qemu-options.hx          |   13 +++
 spice-qemu-char.c        |  107 +++++++++++++++++++++----
 trace-events             |    1 
 ui/qemu-spice.h          |    4 
 ui/spice-core.c          |    6 +
 user-exec.c              |    2 
 xen-all.c                |   83 ++++++++++++--------
 23 files changed, 356 insertions(+), 174 deletions(-)

New commits:
commit 914606d26e654d4c01bd5186f4d05e3fd445e219
Merge: 5455a47 779ab5e
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Tue Dec 18 15:41:43 2012 -0600

    Merge remote-tracking branch 'stefanha/trivial-patches' into staging
    
    * stefanha/trivial-patches:
      configure: Earlier pkg-config probe
      vmmouse_reset(): remove minimal code duplication
      linux-user/syscall.c: remove wrong forward decl of setgroups()
      fix build error on ARM due to wrong glibc check
      gitignore: Add virtfs-proxy-helper
      arm_gic: Add cpu nr to Raised IRQ message
      zynq_slcr: Compile time warning fixes.
      pflash_cfi0x: Send debug messages to stderr
      pflash_cfi01: qemu_log_mask "unimplemented" msg
      net, hub: fix the indent in the comments
    
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

commit 5455a474d92e345df83212fd1b2f59d4a5d46ca9
Merge: 510981a 91bdd1c
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Tue Dec 18 15:41:32 2012 -0600

    Merge remote-tracking branch 'amit/master' into staging
    
    * amit/master:
      virtio-serial-bus: assert port is non-null in remove_port()
      virtio-serial-bus: send_control_msg() should not deal with cpkts
      virtio-serial: delete timer if active during exit
      virtio-serial: allocate post_load only at load-time
      virtio-serial: move active ports loading to separate function
      virtio-serial: use uint32_t to count ports
    
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

commit 510981a097bf16ef4747c9a1dfe806edfc117177
Merge: c3a1ecd 700f6b6
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Tue Dec 18 15:41:21 2012 -0600

    Merge remote-tracking branch 'spice/spice.v66' into staging
    
    * spice/spice.v66:
      docs: add spice-port-fqdn.txt
      spice-qemu-char: register spicevmc ports during qemu_spice_init()
      spice-qemu-char: keep a list of spice chardev
      spice-qemu-char: add spiceport chardev
      spice-qemu-char: factor out CharDriverState creation
      spice-qemu-char: write to chardev whatever amount it can read
      qxl+vnc: register a vm state change handler for dummy spice_server
      qxl: save qemu_create_displaysurface_from result
    
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

commit c3a1ecd0fc565c913efc59663e7ac34b9c3c2291
Merge: a8a826a 249e7e0
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Tue Dec 18 15:41:04 2012 -0600

    Merge remote-tracking branch 'sstabellini/xen-20121217' into staging
    
    * sstabellini/xen-20121217:
      cpu_ioreq_pio, cpu_ioreq_move: i should be uint32_t rather than int
      cpu_ioreq_pio, cpu_ioreq_move: introduce read_phys_req_item, write_phys_req_item
      Fix compile errors when enabling Xen debug logging.
      xen: fix trivial PCI passthrough MSI-X bug
      xen: implement support for secondary consoles in the console backend
    
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

commit 779ab5e3ddb9ad903f9a0ec21e148ed7bfd2d255
Author: Stefan Weil <sw at weilnetz.de>
Date:   Sun Dec 16 11:29:45 2012 +0100

    configure: Earlier pkg-config probe
    
    Probe pkg-config before it is used for the first time (libseccomp check).
    
    Signed-off-by: Stefan Weil <sw at weilnetz.de>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/configure b/configure
index ecdb33a..728caca 100755
--- a/configure
+++ b/configure
@@ -1360,6 +1360,14 @@ esac
 fi
 
 ##########################################
+# pkg-config probe
+
+if ! has "$pkg_config_exe"; then
+  echo "Error: pkg-config binary '$pkg_config_exe' not found"
+  exit 1
+fi
+
+##########################################
 # NPTL probe
 
 if test "$nptl" != "no" ; then
@@ -1590,14 +1598,6 @@ if test "$xen_pci_passthrough" != "no"; then
 fi
 
 ##########################################
-# pkg-config probe
-
-if ! has "$pkg_config_exe"; then
-  echo "Error: pkg-config binary '$pkg_config_exe' not found"
-  exit 1
-fi
-
-##########################################
 # libtool probe
 
 if ! has $libtool; then
commit 5a6c7644b215060a43d94709307d86bc50e1b4b9
Author: Laszlo Ersek <lersek at redhat.com>
Date:   Thu Dec 13 15:01:49 2012 +0100

    vmmouse_reset(): remove minimal code duplication
    
    Commit 069ab0eb added a vmmouse_disable() call to vmmouse_reset().
    vmmouse_disable() resets the status already.
    
    Signed-off-by: Laszlo Ersek <lersek at redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/hw/vmmouse.c b/hw/vmmouse.c
index 6338efa..578122c 100644
--- a/hw/vmmouse.c
+++ b/hw/vmmouse.c
@@ -252,7 +252,6 @@ static void vmmouse_reset(DeviceState *d)
 {
     VMMouseState *s = container_of(d, VMMouseState, dev.qdev);
 
-    s->status = 0xffff;
     s->queue_size = VMMOUSE_QUEUE_SIZE;
 
     vmmouse_disable(s);
commit c56dc774242f902e51e2343f4472e742ef2b7838
Author: John Spencer <maillist-qemu at barfooze.de>
Date:   Mon Dec 10 07:59:46 2012 +0100

    linux-user/syscall.c: remove wrong forward decl of setgroups()
    
    this declaration is wrong:
    the correct prototype on linux is:
    int setgroups(size_t size, const gid_t *list);
    
    since by default musl libc exposes this symbol in unistd.h
    additionally to grp.h, the wrong declaration causes a build error.
    
    the proper fix is to simply include the correct header.
    
    Signed-off-by: John Spencer <maillist-qemu at barfooze.de>
    
    Reviewed-by: Stefan Weil <sw at weilnetz.de>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index 31d5276..275260a 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -28,6 +28,7 @@
 #include <fcntl.h>
 #include <time.h>
 #include <limits.h>
+#include <grp.h>
 #include <sys/types.h>
 #include <sys/ipc.h>
 #include <sys/msg.h>
@@ -584,7 +585,6 @@ extern int personality(int);
 extern int flock(int, int);
 extern int setfsuid(int);
 extern int setfsgid(int);
-extern int setgroups(int, gid_t *);
 
 /* ARM EABI and MIPS expect 64bit types aligned even on pairs or registers */
 #ifdef TARGET_ARM
commit e12cdb1b4055530c61fe99683d256c42e9e62ac8
Author: John Spencer <maillist-qemu at barfooze.de>
Date:   Mon Dec 10 07:59:44 2012 +0100

    fix build error on ARM due to wrong glibc check
    
    the test for glibc < 2 "succeeds" wrongly for any non-glibc C library,
    and breaks the build on musl libc.
    we must first test if __GLIBC__ is defined at all, before using it
    unconditionally.
    
    Signed-off-by: John Spencer <maillist-qemu at barfooze.de>
    Reviewed-by: Stefan Weil <sw at weilnetz.de>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/user-exec.c b/user-exec.c
index 1185cb0..5863b9f 100644
--- a/user-exec.c
+++ b/user-exec.c
@@ -436,7 +436,7 @@ int cpu_signal_handler(int host_signum, void *pinfo,
     unsigned long pc;
     int is_write;
 
-#if (__GLIBC__ < 2 || (__GLIBC__ == 2 && __GLIBC_MINOR__ <= 3))
+#if defined(__GLIBC__) && (__GLIBC__ < 2 || (__GLIBC__ == 2 && __GLIBC_MINOR__ <= 3))
     pc = uc->uc_mcontext.gregs[R15];
 #else
     pc = uc->uc_mcontext.arm_pc;
commit 887eb29930a7b48e46d16916cb050d114016f143
Author: Cole Robinson <crobinso at redhat.com>
Date:   Thu Dec 6 20:03:26 2012 -0500

    gitignore: Add virtfs-proxy-helper
    
    Signed-off-by: Cole Robinson <crobinso at redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/.gitignore b/.gitignore
index bd6ba1c..3ce57cc 100644
--- a/.gitignore
+++ b/.gitignore
@@ -47,6 +47,7 @@ test-qmp-output-visitor
 test-string-input-visitor
 test-string-output-visitor
 test-visitor-serialization
+fsdev/virtfs-proxy-helper
 fsdev/virtfs-proxy-helper.1
 fsdev/virtfs-proxy-helper.pod
 .gdbinit
commit 8c815fb30ed1940c66389be728b29d5ebdf05c0e
Author: Peter Crosthwaite <peter.crosthwaite at xilinx.com>
Date:   Tue Dec 4 16:04:36 2012 +1000

    arm_gic: Add cpu nr to Raised IRQ message
    
    Add the relevant CPU nr to this debug message to make IRQ debugging more
    informative.
    
    Signed-off-by: Peter Crosthwaite <peter.crosthwaite at xilinx.com>
    Reviewed-by: Peter Maydell <peter.maydell at linaro.org>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/hw/arm_gic.c b/hw/arm_gic.c
index 8d769de..b6062c4 100644
--- a/hw/arm_gic.c
+++ b/hw/arm_gic.c
@@ -76,7 +76,7 @@ void gic_update(GICState *s)
         if (best_prio < s->priority_mask[cpu]) {
             s->current_pending[cpu] = best_irq;
             if (best_prio < s->running_priority[cpu]) {
-                DPRINTF("Raised pending IRQ %d\n", best_irq);
+                DPRINTF("Raised pending IRQ %d (cpu %d)\n", best_irq, cpu);
                 level = 1;
             }
         }
commit 8f6038009662b481fbd1e43cd69af80aa10a8223
Author: Peter Crosthwaite <peter.crosthwaite at xilinx.com>
Date:   Tue Dec 4 16:04:35 2012 +1000

    zynq_slcr: Compile time warning fixes.
    
    Few warnings when compiled with debug printfs enabled. Fixed all.
    
    Signed-off-by: Peter Crosthwaite <peter.crosthwaite at xilinx.com>
    Reviewed-by: Peter Maydell <peter.maydell at linaro.org>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/hw/zynq_slcr.c b/hw/zynq_slcr.c
index dde4306..f55ab8d 100644
--- a/hw/zynq_slcr.c
+++ b/hw/zynq_slcr.c
@@ -334,7 +334,7 @@ static uint64_t zynq_slcr_read(void *opaque, hwaddr offset,
 {
     uint32_t ret = zynq_slcr_read_imp(opaque, offset);
 
-    DB_PRINT("addr: %08x data: %08x\n", offset, ret);
+    DB_PRINT("addr: %08x data: %08x\n", (unsigned)offset, (unsigned)ret);
     return ret;
 }
 
@@ -343,7 +343,7 @@ static void zynq_slcr_write(void *opaque, hwaddr offset,
 {
     ZynqSLCRState *s = (ZynqSLCRState *)opaque;
 
-    DB_PRINT("offset: %08x data: %08x\n", offset, (unsigned)val);
+    DB_PRINT("offset: %08x data: %08x\n", (unsigned)offset, (unsigned)val);
 
     switch (offset) {
     case 0x00: /* SCL */
@@ -476,7 +476,8 @@ static void zynq_slcr_write(void *opaque, hwaddr offset,
             break;
         default:
         bad_reg:
-            DB_PRINT("Bad register write %x <= %08x\n", (int)offset, val);
+            DB_PRINT("Bad register write %x <= %08x\n", (int)offset,
+                     (unsigned)val);
         }
     } else {
         DB_PRINT("SCLR registers are locked. Unlock them first\n");
commit ec9ea4890cd06de1648cbbfb99fcb63e01f4000f
Author: Peter Crosthwaite <peter.crosthwaite at xilinx.com>
Date:   Tue Dec 4 16:04:34 2012 +1000

    pflash_cfi0x: Send debug messages to stderr
    
    These debug info messages should go to stderr rather than stdout.
    
    Signed-off-by: Peter Crosthwaite <peter.crosthwaite at xilinx.com>
    Reviewed-by: Peter Maydell <peter.maydell at linaro.org>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/hw/pflash_cfi01.c b/hw/pflash_cfi01.c
index f9f8e5d..931264f 100644
--- a/hw/pflash_cfi01.c
+++ b/hw/pflash_cfi01.c
@@ -46,15 +46,15 @@
 
 #define PFLASH_BUG(fmt, ...) \
 do { \
-    printf("PFLASH: Possible BUG - " fmt, ## __VA_ARGS__); \
+    fprintf(stderr, "PFLASH: Possible BUG - " fmt, ## __VA_ARGS__); \
     exit(1); \
 } while(0)
 
 /* #define PFLASH_DEBUG */
 #ifdef PFLASH_DEBUG
-#define DPRINTF(fmt, ...)                          \
-do {                                               \
-    printf("PFLASH: " fmt , ## __VA_ARGS__);       \
+#define DPRINTF(fmt, ...)                                   \
+do {                                                        \
+    fprintf(stderr, "PFLASH: " fmt , ## __VA_ARGS__);       \
 } while (0)
 #else
 #define DPRINTF(fmt, ...) do { } while (0)
diff --git a/hw/pflash_cfi02.c b/hw/pflash_cfi02.c
index f918e36..c60ae83 100644
--- a/hw/pflash_cfi02.c
+++ b/hw/pflash_cfi02.c
@@ -45,9 +45,9 @@
 
 //#define PFLASH_DEBUG
 #ifdef PFLASH_DEBUG
-#define DPRINTF(fmt, ...)                          \
-do {                                               \
-    printf("PFLASH: " fmt , ## __VA_ARGS__);       \
+#define DPRINTF(fmt, ...)                                  \
+do {                                                       \
+    fprintf(stderr "PFLASH: " fmt , ## __VA_ARGS__);       \
 } while (0)
 #else
 #define DPRINTF(fmt, ...) do { } while (0)
commit d96fc51cc6defcd80bdf932823dadd88be532a0b
Author: Peter Crosthwaite <peter.crosthwaite at xilinx.com>
Date:   Tue Dec 4 16:04:33 2012 +1000

    pflash_cfi01: qemu_log_mask "unimplemented" msg
    
    This printf is informing the user of unimplemented functionality. It should be
    re-directed to qemu_log(LOG_UNIMP, ...) accordingly.
    
    Signed-off-by: Peter Crosthwaite <peter.crosthwaite at xilinx.com>
    Reviewed-by: Peter Maydell <peter.maydell at linaro.org>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/hw/pflash_cfi01.c b/hw/pflash_cfi01.c
index 7d040b5..f9f8e5d 100644
--- a/hw/pflash_cfi01.c
+++ b/hw/pflash_cfi01.c
@@ -438,9 +438,9 @@ static void pflash_write(pflash_t *pfl, hwaddr offset,
     return;
 
  error_flash:
-    printf("%s: Unimplemented flash cmd sequence "
-           "(offset " TARGET_FMT_plx ", wcycle 0x%x cmd 0x%x value 0x%x)\n",
-           __func__, offset, pfl->wcycle, pfl->cmd, value);
+    qemu_log_mask(LOG_UNIMP, "%s: Unimplemented flash cmd sequence "
+                  "(offset " TARGET_FMT_plx ", wcycle 0x%x cmd 0x%x value 0x%x)"
+                  "\n", __func__, offset, pfl->wcycle, pfl->cmd, value);
 
  reset_flash:
     memory_region_rom_device_set_readable(&pfl->mem, true);
commit e103129b1b5746f8388b37d18317e61d6b139b69
Author: Zhi Yong Wu <wuzhy at linux.vnet.ibm.com>
Date:   Fri Dec 7 09:43:18 2012 +0800

    net, hub: fix the indent in the comments
    
      Remove some redundant blanks in the comments of
    net_hub_id_for_client().
    
    Signed-off-by: Zhi Yong Wu <wuzhy at linux.vnet.ibm.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/net/hub.c b/net/hub.c
index be41301..3b2d1ff 100644
--- a/net/hub.c
+++ b/net/hub.c
@@ -256,7 +256,7 @@ void net_hub_info(Monitor *mon)
 /**
  * Get the hub id that a client is connected to
  *
- * @id              Pointer for hub id output, may be NULL
+ * @id: Pointer for hub id output, may be NULL
  */
 int net_hub_id_for_client(NetClientState *nc, int *id)
 {
commit 91bdd1cf08f65b7a127c22d4d65ff9d16dcac870
Author: Amit Shah <amit.shah at redhat.com>
Date:   Tue Dec 18 13:08:33 2012 +0530

    virtio-serial-bus: assert port is non-null in remove_port()
    
    remove_port() is called from qdev's unplug callback, and we're certain
    the port will be found in our list of ports.  Adding an assert()
    documents this.
    
    This was flagged by Coverity, fix suggested by Markus.
    
    CC: Markus Armbruster <armbru at redhat.com>
    Reviewed-by: Markus Armbruster <armbru at redhat.com>
    Signed-off-by: Amit Shah <amit.shah at redhat.com>

diff --git a/hw/virtio-serial-bus.c b/hw/virtio-serial-bus.c
index 3ea95b8..ce4556f 100644
--- a/hw/virtio-serial-bus.c
+++ b/hw/virtio-serial-bus.c
@@ -852,6 +852,12 @@ static void remove_port(VirtIOSerial *vser, uint32_t port_id)
     vser->ports_map[i] &= ~(1U << (port_id % 32));
 
     port = find_port_by_id(vser, port_id);
+    /*
+     * This function is only called from qdev's unplug callback; if we
+     * get a NULL port here, we're in trouble.
+     */
+    assert(port);
+
     /* Flush out any unconsumed buffers first */
     discard_vq_data(port->ovq, &port->vser->vdev);
 
commit 4e28976e563ad54f6adc5ae00b1fb8224f1a82ca
Author: Amit Shah <amit.shah at redhat.com>
Date:   Wed Dec 12 18:26:09 2012 +0530

    virtio-serial-bus: send_control_msg() should not deal with cpkts
    
    Stuff the cpkt before calling send_control_msg().  This function should
    not be concerned about contents of the buffer it receives.
    
    A few code refactorings recently have made making this change easier
    than earlier.
    
    Coverity and clang have flagged this code several times in the past
    (cpkt->id not set before send_control_event() passed it on to
    send_control_msg()).  This will finally eliminate the false-positive.
    
    CC: Markus Armbruster <armbru at redhat.com>
    Reviewed-by: Markus Armbruster <armbru at redhat.com>
    Signed-off-by: Amit Shah <amit.shah at redhat.com>

diff --git a/hw/virtio-serial-bus.c b/hw/virtio-serial-bus.c
index fc0166c..3ea95b8 100644
--- a/hw/virtio-serial-bus.c
+++ b/hw/virtio-serial-bus.c
@@ -217,13 +217,12 @@ static void flush_queued_data(VirtIOSerialPort *port)
     do_flush_queued_data(port, port->ovq, &port->vser->vdev);
 }
 
-static size_t send_control_msg(VirtIOSerialPort *port, void *buf, size_t len)
+static size_t send_control_msg(VirtIOSerial *vser, void *buf, size_t len)
 {
     VirtQueueElement elem;
     VirtQueue *vq;
-    struct virtio_console_control *cpkt;
 
-    vq = port->vser->c_ivq;
+    vq = vser->c_ivq;
     if (!virtio_queue_ready(vq)) {
         return 0;
     }
@@ -231,25 +230,24 @@ static size_t send_control_msg(VirtIOSerialPort *port, void *buf, size_t len)
         return 0;
     }
 
-    cpkt = (struct virtio_console_control *)buf;
-    stl_p(&cpkt->id, port->id);
     memcpy(elem.in_sg[0].iov_base, buf, len);
 
     virtqueue_push(vq, &elem, len);
-    virtio_notify(&port->vser->vdev, vq);
+    virtio_notify(&vser->vdev, vq);
     return len;
 }
 
-static size_t send_control_event(VirtIOSerialPort *port, uint16_t event,
-                                 uint16_t value)
+static size_t send_control_event(VirtIOSerial *vser, uint32_t port_id,
+                                 uint16_t event, uint16_t value)
 {
     struct virtio_console_control cpkt;
 
+    stl_p(&cpkt.id, port_id);
     stw_p(&cpkt.event, event);
     stw_p(&cpkt.value, value);
 
-    trace_virtio_serial_send_control_event(port->id, event, value);
-    return send_control_msg(port, &cpkt, sizeof(cpkt));
+    trace_virtio_serial_send_control_event(port_id, event, value);
+    return send_control_msg(vser, &cpkt, sizeof(cpkt));
 }
 
 /* Functions for use inside qemu to open and read from/write to ports */
@@ -261,7 +259,7 @@ int virtio_serial_open(VirtIOSerialPort *port)
     }
     /* Send port open notification to the guest */
     port->host_connected = true;
-    send_control_event(port, VIRTIO_CONSOLE_PORT_OPEN, 1);
+    send_control_event(port->vser, port->id, VIRTIO_CONSOLE_PORT_OPEN, 1);
 
     return 0;
 }
@@ -276,7 +274,7 @@ int virtio_serial_close(VirtIOSerialPort *port)
     port->throttled = false;
     discard_vq_data(port->ovq, &port->vser->vdev);
 
-    send_control_event(port, VIRTIO_CONSOLE_PORT_OPEN, 0);
+    send_control_event(port->vser, port->id, VIRTIO_CONSOLE_PORT_OPEN, 0);
 
     return 0;
 }
@@ -365,7 +363,7 @@ static void handle_control_message(VirtIOSerial *vser, void *buf, size_t len)
          * ports we have here.
          */
         QTAILQ_FOREACH(port, &vser->ports, next) {
-            send_control_event(port, VIRTIO_CONSOLE_PORT_ADD, 1);
+            send_control_event(vser, port->id, VIRTIO_CONSOLE_PORT_ADD, 1);
         }
         return;
     }
@@ -396,10 +394,11 @@ static void handle_control_message(VirtIOSerial *vser, void *buf, size_t len)
          * up to hvc.
          */
         if (vsc->is_console) {
-            send_control_event(port, VIRTIO_CONSOLE_CONSOLE_PORT, 1);
+            send_control_event(vser, port->id, VIRTIO_CONSOLE_CONSOLE_PORT, 1);
         }
 
         if (port->name) {
+            stl_p(&cpkt.id, port->id);
             stw_p(&cpkt.event, VIRTIO_CONSOLE_PORT_NAME);
             stw_p(&cpkt.value, 1);
 
@@ -410,12 +409,12 @@ static void handle_control_message(VirtIOSerial *vser, void *buf, size_t len)
             memcpy(buffer + sizeof(cpkt), port->name, strlen(port->name));
             buffer[buffer_len - 1] = 0;
 
-            send_control_msg(port, buffer, buffer_len);
+            send_control_msg(vser, buffer, buffer_len);
             g_free(buffer);
         }
 
         if (port->host_connected) {
-            send_control_event(port, VIRTIO_CONSOLE_PORT_OPEN, 1);
+            send_control_event(vser, port->id, VIRTIO_CONSOLE_PORT_OPEN, 1);
         }
 
         /*
@@ -655,7 +654,7 @@ static void virtio_serial_post_load_timer_cb(void *opaque)
              * We have to let the guest know of the host connection
              * status change
              */
-            send_control_event(port, VIRTIO_CONSOLE_PORT_OPEN,
+            send_control_event(s, port->id, VIRTIO_CONSOLE_PORT_OPEN,
                                port->host_connected);
         }
     }
@@ -841,9 +840,7 @@ static void mark_port_added(VirtIOSerial *vser, uint32_t port_id)
 static void add_port(VirtIOSerial *vser, uint32_t port_id)
 {
     mark_port_added(vser, port_id);
-
-    send_control_event(find_port_by_id(vser, port_id),
-                       VIRTIO_CONSOLE_PORT_ADD, 1);
+    send_control_event(vser, port_id, VIRTIO_CONSOLE_PORT_ADD, 1);
 }
 
 static void remove_port(VirtIOSerial *vser, uint32_t port_id)
@@ -858,7 +855,7 @@ static void remove_port(VirtIOSerial *vser, uint32_t port_id)
     /* Flush out any unconsumed buffers first */
     discard_vq_data(port->ovq, &port->vser->vdev);
 
-    send_control_event(port, VIRTIO_CONSOLE_PORT_REMOVE, 1);
+    send_control_event(vser, port->id, VIRTIO_CONSOLE_PORT_REMOVE, 1);
 }
 
 static int virtser_port_qdev_init(DeviceState *qdev)
commit 700f6b6a921861a8946377a9531b6d1e8b09bb51
Author: Marc-André Lureau <marcandre.lureau at gmail.com>
Date:   Wed Dec 5 16:15:37 2012 +0100

    docs: add spice-port-fqdn.txt
    
    Start a simple org.qemu.* registry of well known name.
    
    Signed-off-by: Gerd Hoffmann <kraxel at redhat.com>

diff --git a/docs/spice-port-fqdn.txt b/docs/spice-port-fqdn.txt
new file mode 100644
index 0000000..5077895
--- /dev/null
+++ b/docs/spice-port-fqdn.txt
@@ -0,0 +1,19 @@
+A Spice port channel is an arbitrary communication between the Spice
+server host side and the client side.
+
+Thanks to the associated reverse fully qualified domain name (fqdn),
+a Spice client can handle the various ports appropriately.
+
+The following fqdn names are reserved by the QEMU project:
+
+org.qemu.monitor.hmp.0
+  QEMU human monitor
+
+org.qemu.monitor.qmp.0:
+  QEMU control monitor
+
+org.qemu.console.serial.0
+  QEMU virtual serial port
+
+org.qemu.console.debug.0
+  QEMU debug console
commit afd0b4091fef7a1290cf76c6da8c9a24a3553d58
Author: Marc-André Lureau <marcandre.lureau at gmail.com>
Date:   Wed Dec 5 16:15:36 2012 +0100

    spice-qemu-char: register spicevmc ports during qemu_spice_init()
    
    Do the delayed registration of spicevmc ports after Spice server is
    initialized.
    
    Signed-off-by: Gerd Hoffmann <kraxel at redhat.com>

diff --git a/spice-qemu-char.c b/spice-qemu-char.c
index 4eb85ae..b2586c2 100644
--- a/spice-qemu-char.c
+++ b/spice-qemu-char.c
@@ -293,4 +293,16 @@ CharDriverState *qemu_chr_open_spice_port(QemuOpts *opts)
 
     return chr;
 }
+
+void qemu_spice_register_ports(void)
+{
+    SpiceCharDriver *s;
+
+    QLIST_FOREACH(s, &spice_chars, next) {
+        if (s->sin.portname == NULL) {
+            continue;
+        }
+        vmc_register_interface(s);
+    }
+}
 #endif
diff --git a/ui/qemu-spice.h b/ui/qemu-spice.h
index 5669767..642f012 100644
--- a/ui/qemu-spice.h
+++ b/ui/qemu-spice.h
@@ -48,6 +48,7 @@ void do_info_spice(Monitor *mon, QObject **ret_data);
 CharDriverState *qemu_chr_open_spice(QemuOpts *opts);
 #if SPICE_SERVER_VERSION >= 0x000c02
 CharDriverState *qemu_chr_open_spice_port(QemuOpts *opts);
+void qemu_spice_register_ports(void);
 #endif
 
 #else  /* CONFIG_SPICE */
diff --git a/ui/spice-core.c b/ui/spice-core.c
index 59ce5f6..ac46deb 100644
--- a/ui/spice-core.c
+++ b/ui/spice-core.c
@@ -714,6 +714,10 @@ void qemu_spice_init(void)
     g_free(x509_key_file);
     g_free(x509_cert_file);
     g_free(x509_cacert_file);
+
+#if SPICE_SERVER_VERSION >= 0x000c02
+    qemu_spice_register_ports();
+#endif
 }
 
 int qemu_spice_add_interface(SpiceBaseInstance *sin)
commit 7a5448ce6ef140a20b1a090d50aeb4248d0a9ffd
Author: Marc-André Lureau <marcandre.lureau at gmail.com>
Date:   Wed Dec 5 16:15:35 2012 +0100

    spice-qemu-char: keep a list of spice chardev
    
    Signed-off-by: Gerd Hoffmann <kraxel at redhat.com>

diff --git a/spice-qemu-char.c b/spice-qemu-char.c
index 4be75ba..4eb85ae 100644
--- a/spice-qemu-char.c
+++ b/spice-qemu-char.c
@@ -24,8 +24,12 @@ typedef struct SpiceCharDriver {
     uint8_t               *datapos;
     ssize_t               bufsize, datalen;
     uint32_t              debug;
+    QLIST_ENTRY(SpiceCharDriver) next;
 } SpiceCharDriver;
 
+static QLIST_HEAD(, SpiceCharDriver) spice_chars =
+    QLIST_HEAD_INITIALIZER(spice_chars);
+
 static int vmc_write(SpiceCharDeviceInstance *sin, const uint8_t *buf, int len)
 {
     SpiceCharDriver *scd = container_of(sin, SpiceCharDriver, sin);
@@ -179,6 +183,7 @@ static void spice_chr_close(struct CharDriverState *chr)
 
     printf("%s\n", __func__);
     vmc_unregister_interface(s);
+    QLIST_REMOVE(s, next);
     g_free(s);
 }
 
@@ -229,6 +234,8 @@ static CharDriverState *chr_open(QemuOpts *opts, const char *subtype)
     chr->chr_guest_open = spice_chr_guest_open;
     chr->chr_guest_close = spice_chr_guest_close;
 
+    QLIST_INSERT_HEAD(&spice_chars, s, next);
+
     return chr;
 }
 
commit 5a49d3e9a799b7e1bf87da7ae7f2a719e01da319
Author: Marc-André Lureau <marcandre.lureau at gmail.com>
Date:   Wed Dec 5 16:15:34 2012 +0100

    spice-qemu-char: add spiceport chardev
    
    Add a new spice chardev to allow arbitrary communication between the
    host and the Spice client via the spice server.
    
    Examples:
    
    This allows the Spice client to have a special port for the qemu
    monitor:
    
    ... -chardev spiceport,name=org.qemu.monitor,id=monitorport
        -mon chardev=monitorport
    
    v2:
    - remove support for chardev to chardev linking
    - conditionnaly compile with SPICE_SERVER_VERSION
    
    Signed-off-by: Gerd Hoffmann <kraxel at redhat.com>

diff --git a/qemu-char.c b/qemu-char.c
index 242b799..9940701 100644
--- a/qemu-char.c
+++ b/qemu-char.c
@@ -2762,6 +2762,9 @@ static const struct {
 #endif
 #ifdef CONFIG_SPICE
     { .name = "spicevmc",     .open = qemu_chr_open_spice },
+#if SPICE_SERVER_VERSION >= 0x000c02
+    { .name = "spiceport",    .open = qemu_chr_open_spice_port },
+#endif
 #endif
 };
 
diff --git a/qemu-options.hx b/qemu-options.hx
index 231cc4f..9df0cde 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -1749,6 +1749,7 @@ DEF("chardev", HAS_ARG, QEMU_OPTION_chardev,
 #endif
 #if defined(CONFIG_SPICE)
     "-chardev spicevmc,id=id,name=name[,debug=debug]\n"
+    "-chardev spiceport,id=id,name=name[,debug=debug]\n"
 #endif
     , QEMU_ARCH_ALL
 )
@@ -1776,6 +1777,7 @@ Backend is one of:
 @option{tty},
 @option{parport},
 @option{spicevmc}.
+ at option{spiceport}.
 The specific backend will determine the applicable options.
 
 All devices must have an id, which can be any string up to 127 characters long.
@@ -1961,6 +1963,17 @@ required.
 
 Connect to a spice virtual machine channel, such as vdiport.
 
+ at item -chardev spiceport ,id=@var{id} ,debug=@var{debug}, name=@var{name}
+
+ at option{spiceport} is only available when spice support is built in.
+
+ at option{debug} debug level for spicevmc
+
+ at option{name} name of spice port to connect to
+
+Connect to a spice port, allowing a Spice client to handle the traffic
+identified by a name (preferably a fqdn).
+
 @end table
 ETEXI
 
diff --git a/spice-qemu-char.c b/spice-qemu-char.c
index b86e83a..4be75ba 100644
--- a/spice-qemu-char.c
+++ b/spice-qemu-char.c
@@ -3,6 +3,7 @@
 #include "ui/qemu-spice.h"
 #include <spice.h>
 #include <spice-experimental.h>
+#include <spice/protocol.h>
 
 #include "osdep.h"
 
@@ -67,6 +68,27 @@ static int vmc_read(SpiceCharDeviceInstance *sin, uint8_t *buf, int len)
     return bytes;
 }
 
+#if SPICE_SERVER_VERSION >= 0x000c02
+static void vmc_event(SpiceCharDeviceInstance *sin, uint8_t event)
+{
+    SpiceCharDriver *scd = container_of(sin, SpiceCharDriver, sin);
+    int chr_event;
+
+    switch (event) {
+    case SPICE_PORT_EVENT_BREAK:
+        chr_event = CHR_EVENT_BREAK;
+        break;
+    default:
+        dprintf(scd, 2, "%s: unknown %d\n", __func__, event);
+        return;
+    }
+
+    dprintf(scd, 2, "%s: %d\n", __func__, event);
+    trace_spice_vmc_event(chr_event);
+    qemu_chr_be_event(scd->chr, chr_event);
+}
+#endif
+
 static void vmc_state(SpiceCharDeviceInstance *sin, int connected)
 {
     SpiceCharDriver *scd = container_of(sin, SpiceCharDriver, sin);
@@ -103,6 +125,9 @@ static SpiceCharDeviceInterface vmc_interface = {
     .state              = vmc_state,
     .write              = vmc_write,
     .read               = vmc_read,
+#if SPICE_SERVER_VERSION >= 0x000c02
+    .event              = vmc_event,
+#endif
 };
 
 
@@ -242,3 +267,23 @@ CharDriverState *qemu_chr_open_spice(QemuOpts *opts)
 
     return chr;
 }
+
+#if SPICE_SERVER_VERSION >= 0x000c02
+CharDriverState *qemu_chr_open_spice_port(QemuOpts *opts)
+{
+    CharDriverState *chr;
+    SpiceCharDriver *s;
+    const char *name = qemu_opt_get(opts, "name");
+
+    if (name == NULL) {
+        fprintf(stderr, "spice-qemu-char: missing name parameter\n");
+        return NULL;
+    }
+
+    chr = chr_open(opts, "port");
+    s = chr->opaque;
+    s->sin.portname = name;
+
+    return chr;
+}
+#endif
diff --git a/trace-events b/trace-events
index 6cb450a..bb7621e 100644
--- a/trace-events
+++ b/trace-events
@@ -535,6 +535,7 @@ spice_vmc_write(ssize_t out, int len) "spice wrottn %zd of requested %d"
 spice_vmc_read(int bytes, int len) "spice read %d of requested %d"
 spice_vmc_register_interface(void *scd) "spice vmc registered interface %p"
 spice_vmc_unregister_interface(void *scd) "spice vmc unregistered interface %p"
+spice_vmc_event(int event) "spice vmc event %d"
 
 # hw/lm32_pic.c
 lm32_pic_raise_irq(void) "Raise CPU interrupt"
diff --git a/ui/qemu-spice.h b/ui/qemu-spice.h
index 3299da8..5669767 100644
--- a/ui/qemu-spice.h
+++ b/ui/qemu-spice.h
@@ -46,6 +46,9 @@ void do_info_spice_print(Monitor *mon, const QObject *data);
 void do_info_spice(Monitor *mon, QObject **ret_data);
 
 CharDriverState *qemu_chr_open_spice(QemuOpts *opts);
+#if SPICE_SERVER_VERSION >= 0x000c02
+CharDriverState *qemu_chr_open_spice_port(QemuOpts *opts);
+#endif
 
 #else  /* CONFIG_SPICE */
 #include "monitor.h"
commit 71b423f4b970de2622803a67a2bf39b1d1f5a12c
Author: Marc-André Lureau <marcandre.lureau at gmail.com>
Date:   Wed Dec 5 16:15:33 2012 +0100

    spice-qemu-char: factor out CharDriverState creation
    
    Make the CharDriverState creation code reusable by spicevmc port.
    
    Signed-off-by: Gerd Hoffmann <kraxel at redhat.com>

diff --git a/spice-qemu-char.c b/spice-qemu-char.c
index 665efd3..b86e83a 100644
--- a/spice-qemu-char.c
+++ b/spice-qemu-char.c
@@ -186,13 +186,32 @@ static void print_allowed_subtypes(void)
     fprintf(stderr, "\n");
 }
 
-CharDriverState *qemu_chr_open_spice(QemuOpts *opts)
+static CharDriverState *chr_open(QemuOpts *opts, const char *subtype)
 {
     CharDriverState *chr;
     SpiceCharDriver *s;
-    const char* name = qemu_opt_get(opts, "name");
     uint32_t debug = qemu_opt_get_number(opts, "debug", 0);
-    const char** psubtype = spice_server_char_device_recognized_subtypes();
+
+    chr = g_malloc0(sizeof(CharDriverState));
+    s = g_malloc0(sizeof(SpiceCharDriver));
+    s->chr = chr;
+    s->debug = debug;
+    s->active = false;
+    s->sin.subtype = subtype;
+    chr->opaque = s;
+    chr->chr_write = spice_chr_write;
+    chr->chr_close = spice_chr_close;
+    chr->chr_guest_open = spice_chr_guest_open;
+    chr->chr_guest_close = spice_chr_guest_close;
+
+    return chr;
+}
+
+CharDriverState *qemu_chr_open_spice(QemuOpts *opts)
+{
+    CharDriverState *chr;
+    const char *name = qemu_opt_get(opts, "name");
+    const char **psubtype = spice_server_char_device_recognized_subtypes();
     const char *subtype = NULL;
 
     if (name == NULL) {
@@ -212,17 +231,7 @@ CharDriverState *qemu_chr_open_spice(QemuOpts *opts)
         return NULL;
     }
 
-    chr = g_malloc0(sizeof(CharDriverState));
-    s = g_malloc0(sizeof(SpiceCharDriver));
-    s->chr = chr;
-    s->debug = debug;
-    s->active = false;
-    s->sin.subtype = subtype;
-    chr->opaque = s;
-    chr->chr_write = spice_chr_write;
-    chr->chr_close = spice_chr_close;
-    chr->chr_guest_open = spice_chr_guest_open;
-    chr->chr_guest_close = spice_chr_guest_close;
+    chr = chr_open(opts, subtype);
 
 #if SPICE_SERVER_VERSION < 0x000901
     /* See comment in vmc_state() */
commit 07a54d704e62e2515db0b085d53d13a2f1b1b06a
Author: Marc-André Lureau <marcandre.lureau at gmail.com>
Date:   Wed Dec 5 16:15:32 2012 +0100

    spice-qemu-char: write to chardev whatever amount it can read
    
    The current code waits until the chardev can read MIN(len, VMC_MAX)
    But some chardev may never reach than amount, in fact some of them
    will only ever accept write of 1. Fix the min computation and remove
    the VMC_MAX constant.
    
    Signed-off-by: Gerd Hoffmann <kraxel at redhat.com>

diff --git a/spice-qemu-char.c b/spice-qemu-char.c
index 09aa22d..665efd3 100644
--- a/spice-qemu-char.c
+++ b/spice-qemu-char.c
@@ -14,8 +14,6 @@
         }                                                               \
     } while (0)
 
-#define VMC_MAX_HOST_WRITE    2048
-
 typedef struct SpiceCharDriver {
     CharDriverState*      chr;
     SpiceCharDeviceInstance     sin;
@@ -35,8 +33,8 @@ static int vmc_write(SpiceCharDeviceInstance *sin, const uint8_t *buf, int len)
     uint8_t* p = (uint8_t*)buf;
 
     while (len > 0) {
-        last_out = MIN(len, VMC_MAX_HOST_WRITE);
-        if (qemu_chr_be_can_write(scd->chr) < last_out) {
+        last_out = MIN(len, qemu_chr_be_can_write(scd->chr));
+        if (last_out <= 0) {
             break;
         }
         qemu_chr_be_write(scd->chr, p, last_out);
commit 938b8a36b65e44c44ca29245437f8d7ac0f826e8
Author: Uri Lublin <uril at redhat.com>
Date:   Wed Dec 12 18:30:47 2012 +0200

    qxl+vnc: register a vm state change handler for dummy spice_server
    
    When qxl + vnc are used, a dummy spice_server is initialized.
    The spice_server has to be told when the VM runstate changes,
    which is what this patch does.
    
    Without it, from qxl_send_events(), the following error message is shown:
      qxl_send_events: spice-server bug: guest stopped, ignoring
    
    Cc: qemu-stable at nongnu.org
    Signed-off-by: Uri Lublin <uril at redhat.com>
    Signed-off-by: Gerd Hoffmann <kraxel at redhat.com>

diff --git a/ui/spice-core.c b/ui/spice-core.c
index 261c6f2..59ce5f6 100644
--- a/ui/spice-core.c
+++ b/ui/spice-core.c
@@ -732,6 +732,8 @@ int qemu_spice_add_interface(SpiceBaseInstance *sin)
          */
         spice_server = spice_server_new();
         spice_server_init(spice_server, &core_interface);
+        qemu_add_vm_change_state_handler(vm_change_state_handler,
+                                         &spice_server);
     }
 
     return spice_server_add_interface(spice_server, sin);
commit 2f464b5a32b414adb545acc6d94b5c35c7d258ba
Author: Gerd Hoffmann <kraxel at redhat.com>
Date:   Mon Dec 10 07:41:07 2012 +0100

    qxl: save qemu_create_displaysurface_from result
    
    Spotted by Coverity.
    
    https://bugzilla.redhat.com/show_bug.cgi?id=885644
    
    Cc: qemu-stable at nongnu.org
    Reported-by: Markus Armbruster <armbru at redhat.com>
    Signed-off-by: Gerd Hoffmann <kraxel at redhat.com>

diff --git a/hw/qxl-render.c b/hw/qxl-render.c
index 98ecb21..88e63f8 100644
--- a/hw/qxl-render.c
+++ b/hw/qxl-render.c
@@ -113,11 +113,12 @@ static void qxl_render_update_area_unlocked(PCIQXLDevice *qxl)
                qxl->guest_primary.bits_pp);
         if (qxl->guest_primary.qxl_stride > 0) {
             qemu_free_displaysurface(vga->ds);
-            qemu_create_displaysurface_from(qxl->guest_primary.surface.width,
-                                            qxl->guest_primary.surface.height,
-                                            qxl->guest_primary.bits_pp,
-                                            qxl->guest_primary.abs_stride,
-                                            qxl->guest_primary.data);
+            vga->ds->surface = qemu_create_displaysurface_from
+                (qxl->guest_primary.surface.width,
+                 qxl->guest_primary.surface.height,
+                 qxl->guest_primary.bits_pp,
+                 qxl->guest_primary.abs_stride,
+                 qxl->guest_primary.data);
         } else {
             qemu_resize_displaysurface(vga->ds,
                     qxl->guest_primary.surface.width,
commit 249e7e0fff080df0eff54730f3b6459d92d61e5a
Author: Ian Jackson <ian.jackson at eu.citrix.com>
Date:   Mon Dec 17 11:44:02 2012 +0000

    cpu_ioreq_pio, cpu_ioreq_move: i should be uint32_t rather than int
    
    The current code compare i (int) with req->count (uint32_t) in a for
    loop, risking an infinite loop if req->count is equal to UINT_MAX.
    
    Also i is only used in comparisons or multiplications with unsigned
    integers.
    
    Signed-off-by: Stefano Stabellini <stefano.stabellini at eu.citrix.com>
    Cc: Dongxiao Xu <dongxiao.xu at intel.com>
    Cc: Stefano Stabellini <stefano.stabellini at eu.citrix.com>
    Signed-off-by: Ian Jackson <ian.jackson at eu.citrix.com>

diff --git a/xen-all.c b/xen-all.c
index ef430ca..daf43b9 100644
--- a/xen-all.c
+++ b/xen-all.c
@@ -721,7 +721,7 @@ static inline void write_phys_req_item(hwaddr addr,
 
 static void cpu_ioreq_pio(ioreq_t *req)
 {
-    int i;
+    uint32_t i;
 
     if (req->dir == IOREQ_READ) {
         if (!req->data_is_ptr) {
@@ -750,7 +750,7 @@ static void cpu_ioreq_pio(ioreq_t *req)
 
 static void cpu_ioreq_move(ioreq_t *req)
 {
-    int i;
+    uint32_t i;
 
     if (!req->data_is_ptr) {
         if (req->dir == IOREQ_READ) {
commit a38648290ee277c7cb8a53eabdcdb08bb7a9f23f
Author: Ian Jackson <ian.jackson at eu.citrix.com>
Date:   Mon Dec 17 11:43:19 2012 +0000

    cpu_ioreq_pio, cpu_ioreq_move: introduce read_phys_req_item, write_phys_req_item
    
    Replace a lot of formulaic multiplications (containing casts, no less)
    with calls to a pair of functions.  This encapsulates in a single
    place the operations which require care relating to integer overflow.
    
    Cc: Dongxiao Xu <dongxiao.xu at intel.com>
    Signed-off-by: Ian Jackson <ian.jackson at eu.citrix.com>
    Acked-by: Stefano Stabellini <stefano.stabellini at eu.citrix.com>

diff --git a/xen-all.c b/xen-all.c
index d0142bd..ef430ca 100644
--- a/xen-all.c
+++ b/xen-all.c
@@ -683,11 +683,45 @@ static void do_outp(pio_addr_t addr,
     }
 }
 
-static void cpu_ioreq_pio(ioreq_t *req)
+/*
+ * Helper functions which read/write an object from/to physical guest
+ * memory, as part of the implementation of an ioreq.
+ *
+ * Equivalent to
+ *   cpu_physical_memory_rw(addr + (req->df ? -1 : +1) * req->size * i,
+ *                          val, req->size, 0/1)
+ * except without the integer overflow problems.
+ */
+static void rw_phys_req_item(hwaddr addr,
+                             ioreq_t *req, uint32_t i, void *val, int rw)
+{
+    /* Do everything unsigned so overflow just results in a truncated result
+     * and accesses to undesired parts of guest memory, which is up
+     * to the guest */
+    hwaddr offset = (hwaddr)req->size * i;
+    if (req->df) {
+        addr -= offset;
+    } else {
+        addr += offset;
+    }
+    cpu_physical_memory_rw(addr, val, req->size, rw);
+}
+
+static inline void read_phys_req_item(hwaddr addr,
+                                      ioreq_t *req, uint32_t i, void *val)
 {
-    int i, sign;
+    rw_phys_req_item(addr, req, i, val, 0);
+}
+static inline void write_phys_req_item(hwaddr addr,
+                                       ioreq_t *req, uint32_t i, void *val)
+{
+    rw_phys_req_item(addr, req, i, val, 1);
+}
 
-    sign = req->df ? -1 : 1;
+
+static void cpu_ioreq_pio(ioreq_t *req)
+{
+    int i;
 
     if (req->dir == IOREQ_READ) {
         if (!req->data_is_ptr) {
@@ -697,9 +731,7 @@ static void cpu_ioreq_pio(ioreq_t *req)
 
             for (i = 0; i < req->count; i++) {
                 tmp = do_inp(req->addr, req->size);
-                cpu_physical_memory_write(
-                        req->data + (sign * i * (int64_t)req->size),
-                        (uint8_t *) &tmp, req->size);
+                write_phys_req_item(req->data, req, i, &tmp);
             }
         }
     } else if (req->dir == IOREQ_WRITE) {
@@ -709,9 +741,7 @@ static void cpu_ioreq_pio(ioreq_t *req)
             for (i = 0; i < req->count; i++) {
                 uint32_t tmp = 0;
 
-                cpu_physical_memory_read(
-                        req->data + (sign * i * (int64_t)req->size),
-                        (uint8_t*) &tmp, req->size);
+                read_phys_req_item(req->data, req, i, &tmp);
                 do_outp(req->addr, req->size, tmp);
             }
         }
@@ -720,22 +750,16 @@ static void cpu_ioreq_pio(ioreq_t *req)
 
 static void cpu_ioreq_move(ioreq_t *req)
 {
-    int i, sign;
-
-    sign = req->df ? -1 : 1;
+    int i;
 
     if (!req->data_is_ptr) {
         if (req->dir == IOREQ_READ) {
             for (i = 0; i < req->count; i++) {
-                cpu_physical_memory_read(
-                        req->addr + (sign * i * (int64_t)req->size),
-                        (uint8_t *) &req->data, req->size);
+                read_phys_req_item(req->addr, req, i, &req->data);
             }
         } else if (req->dir == IOREQ_WRITE) {
             for (i = 0; i < req->count; i++) {
-                cpu_physical_memory_write(
-                        req->addr + (sign * i * (int64_t)req->size),
-                        (uint8_t *) &req->data, req->size);
+                write_phys_req_item(req->addr, req, i, &req->data);
             }
         }
     } else {
@@ -743,21 +767,13 @@ static void cpu_ioreq_move(ioreq_t *req)
 
         if (req->dir == IOREQ_READ) {
             for (i = 0; i < req->count; i++) {
-                cpu_physical_memory_read(
-                        req->addr + (sign * i * (int64_t)req->size),
-                        (uint8_t*) &tmp, req->size);
-                cpu_physical_memory_write(
-                        req->data + (sign * i * (int64_t)req->size),
-                        (uint8_t*) &tmp, req->size);
+                read_phys_req_item(req->addr, req, i, &tmp);
+                write_phys_req_item(req->data, req, i, &tmp);
             }
         } else if (req->dir == IOREQ_WRITE) {
             for (i = 0; i < req->count; i++) {
-                cpu_physical_memory_read(
-                        req->data + (sign * i * (int64_t)req->size),
-                        (uint8_t*) &tmp, req->size);
-                cpu_physical_memory_write(
-                        req->addr + (sign * i * (int64_t)req->size),
-                        (uint8_t*) &tmp, req->size);
+                read_phys_req_item(req->data, req, i, &tmp);
+                write_phys_req_item(req->addr, req, i, &tmp);
             }
         }
     }
commit f1b8caf1d927f30f66054733a783651a24db4999
Author: Sander Eikelenboom <linux at eikelenboom.it>
Date:   Mon Dec 17 11:37:43 2012 +0000

    Fix compile errors when enabling Xen debug logging.
    
    Signed-off-by: Sander Eikelenboom <linux at eikelenboom.it>
    Acked-by: Stefano Stabellini <stefano.stabellini at eu.citrix.com>

diff --git a/hw/xen_pt.c b/hw/xen_pt.c
index 7a3846e..7aae826 100644
--- a/hw/xen_pt.c
+++ b/hw/xen_pt.c
@@ -671,7 +671,8 @@ static int xen_pt_initfn(PCIDevice *d)
     s->is_virtfn = s->real_device.is_virtfn;
     if (s->is_virtfn) {
         XEN_PT_LOG(d, "%04x:%02x:%02x.%d is a SR-IOV Virtual Function\n",
-                   s->real_device.domain, bus, slot, func);
+                   s->real_device.domain, s->real_device.bus,
+                   s->real_device.dev, s->real_device.func);
     }
 
     /* Initialize virtualized PCI configuration (Extended 256 Bytes) */
@@ -752,7 +753,7 @@ out:
     memory_listener_register(&s->memory_listener, &address_space_memory);
     memory_listener_register(&s->io_listener, &address_space_io);
     XEN_PT_LOG(d, "Real physical device %02x:%02x.%d registered successfuly!\n",
-               bus, slot, func);
+               s->hostaddr.bus, s->hostaddr.slot, s->hostaddr.function);
 
     return 0;
 }
diff --git a/xen-all.c b/xen-all.c
index 046cc2a..d0142bd 100644
--- a/xen-all.c
+++ b/xen-all.c
@@ -292,7 +292,8 @@ static int xen_add_to_physmap(XenIOState *state,
     return -1;
 
 go_physmap:
-    DPRINTF("mapping vram to %llx - %llx\n", start_addr, start_addr + size);
+    DPRINTF("mapping vram to %"HWADDR_PRIx" - %"HWADDR_PRIx"\n",
+            start_addr, start_addr + size);
 
     pfn = phys_offset >> TARGET_PAGE_BITS;
     start_gpfn = start_addr >> TARGET_PAGE_BITS;
@@ -365,8 +366,8 @@ static int xen_remove_from_physmap(XenIOState *state,
     phys_offset = physmap->phys_offset;
     size = physmap->size;
 
-    DPRINTF("unmapping vram to %llx - %llx, from %llx\n",
-            phys_offset, phys_offset + size, start_addr);
+    DPRINTF("unmapping vram to %"HWADDR_PRIx" - %"HWADDR_PRIx", from ",
+            "%"HWADDR_PRIx"\n", phys_offset, phys_offset + size, start_addr);
 
     size >>= TARGET_PAGE_BITS;
     start_addr >>= TARGET_PAGE_BITS;
commit 044b99c6555f562254ae70dc39f32190eecbc1f2
Author: Stefano Stabellini <stefano.stabellini at eu.citrix.com>
Date:   Mon Dec 17 11:36:58 2012 +0000

    xen: fix trivial PCI passthrough MSI-X bug
    
    We are currently passing entry->data as address parameter. Pass
    entry->addr instead.
    
    Signed-off-by: Stefano Stabellini <stefano.stabellini at eu.citrix.com>
    Tested-by: Sander Eikelenboom <linux at eikelenboom.it>
    Xen-devel: http://marc.info/?l=xen-devel&m=135515462613715

diff --git a/hw/xen_pt_msi.c b/hw/xen_pt_msi.c
index 6807672..db757cd 100644
--- a/hw/xen_pt_msi.c
+++ b/hw/xen_pt_msi.c
@@ -321,7 +321,7 @@ static int xen_pt_msix_update_one(XenPCIPassthroughState *s, int entry_nr)
 
     pirq = entry->pirq;
 
-    rc = msi_msix_setup(s, entry->data, entry->data, &pirq, true, entry_nr,
+    rc = msi_msix_setup(s, entry->addr, entry->data, &pirq, true, entry_nr,
                         entry->pirq == XEN_PT_UNASSIGNED_PIRQ);
     if (rc) {
         return rc;
commit 2c1d4d15f09cf95b8f832624e7aac2916f9d1865
Author: Stefano Stabellini <stefano.stabellini at eu.citrix.com>
Date:   Mon Dec 17 11:36:09 2012 +0000

    xen: implement support for secondary consoles in the console backend
    
    This patch corresponds to commit
    840184a106bc24e745beda5c77e392f6cecd2bc9 from
    git://xenbits.xensource.com/qemu-xen-unstable.git.
    
    Signed-off-by: Stefano Stabellini <stefano.stabellini at eu.citrix.com>

diff --git a/hw/xen_console.c b/hw/xen_console.c
index 9426d73..1349881 100644
--- a/hw/xen_console.c
+++ b/hw/xen_console.c
@@ -184,7 +184,11 @@ static int con_init(struct XenDevice *xendev)
 
     /* setup */
     dom = xs_get_domain_path(xenstore, con->xendev.dom);
-    snprintf(con->console, sizeof(con->console), "%s/console", dom);
+    if (!xendev->dev) {
+        snprintf(con->console, sizeof(con->console), "%s/console", dom);
+    } else {
+        snprintf(con->console, sizeof(con->console), "%s/device/console/%d", dom, xendev->dev);
+    }
     free(dom);
 
     type = xenstore_read_str(con->console, "type");
@@ -223,10 +227,16 @@ static int con_initialise(struct XenDevice *xendev)
     if (xenstore_read_int(con->console, "limit", &limit) == 0)
 	con->buffer.max_capacity = limit;
 
-    con->sring = xc_map_foreign_range(xen_xc, con->xendev.dom,
-				      XC_PAGE_SIZE,
-				      PROT_READ|PROT_WRITE,
-				      con->ring_ref);
+    if (!xendev->dev) {
+        con->sring = xc_map_foreign_range(xen_xc, con->xendev.dom,
+                                          XC_PAGE_SIZE,
+                                          PROT_READ|PROT_WRITE,
+                                          con->ring_ref);
+    } else {
+        con->sring = xc_gnttab_map_grant_ref(xendev->gnttabdev, con->xendev.dom,
+                                             con->ring_ref,
+                                             PROT_READ|PROT_WRITE);
+    }
     if (!con->sring)
 	return -1;
 
@@ -255,7 +265,11 @@ static void con_disconnect(struct XenDevice *xendev)
     xen_be_unbind_evtchn(&con->xendev);
 
     if (con->sring) {
-	munmap(con->sring, XC_PAGE_SIZE);
+        if (!xendev->gnttabdev) {
+            munmap(con->sring, XC_PAGE_SIZE);
+        } else {
+            xc_gnttab_munmap(xendev->gnttabdev, con->sring, 1);
+        }
 	con->sring = NULL;
     }
 }
@@ -273,7 +287,7 @@ static void con_event(struct XenDevice *xendev)
 
 struct XenDevOps xen_console_ops = {
     .size       = sizeof(struct XenConsole),
-    .flags      = DEVOPS_FLAG_IGNORE_STATE,
+    .flags      = DEVOPS_FLAG_IGNORE_STATE|DEVOPS_FLAG_NEED_GNTDEV,
     .init       = con_init,
     .initialise = con_initialise,
     .event      = con_event,
commit a75bf146503a94fb900e0dfa0529bd5d1be9fec5
Author: Amit Shah <amit.shah at redhat.com>
Date:   Thu Dec 13 15:54:43 2012 +0530

    virtio-serial: delete timer if active during exit
    
    The post_load timer was being freed, but not deleted.  This could cause
    problems when the timer is armed, but the device is hot-unplugged before
    the callback is executed.
    
    Signed-off-by: Amit Shah <amit.shah at redhat.com>

diff --git a/hw/virtio-serial-bus.c b/hw/virtio-serial-bus.c
index 09d4659..fc0166c 100644
--- a/hw/virtio-serial-bus.c
+++ b/hw/virtio-serial-bus.c
@@ -1038,6 +1038,7 @@ void virtio_serial_exit(VirtIODevice *vdev)
     g_free(vser->ports_map);
     if (vser->post_load) {
         g_free(vser->post_load->connected);
+        qemu_del_timer(vser->post_load->timer);
         qemu_free_timer(vser->post_load->timer);
         g_free(vser->post_load);
     }
commit bdb917bf8ab187b662c612ee6fb87479c0b82490
Author: Amit Shah <amit.shah at redhat.com>
Date:   Fri Nov 30 00:54:44 2012 +0530

    virtio-serial: allocate post_load only at load-time
    
    This saves us a few bytes in the VirtIOSerial struct.  Not a big
    savings, but since the entire structure is used only during a short
    while after migration, it's helpful to keep the struct cleaner and
    smaller.
    
    Signed-off-by: Amit Shah <amit.shah at redhat.com>

diff --git a/hw/virtio-serial-bus.c b/hw/virtio-serial-bus.c
index 2e0fe3d..09d4659 100644
--- a/hw/virtio-serial-bus.c
+++ b/hw/virtio-serial-bus.c
@@ -36,6 +36,15 @@ struct VirtIOSerialBus {
     uint32_t max_nr_ports;
 };
 
+typedef struct VirtIOSerialPostLoad {
+    QEMUTimer *timer;
+    uint32_t nr_active_ports;
+    struct {
+        VirtIOSerialPort *port;
+        uint8_t host_connected;
+    } *connected;
+} VirtIOSerialPostLoad;
+
 struct VirtIOSerial {
     VirtIODevice vdev;
 
@@ -54,14 +63,7 @@ struct VirtIOSerial {
 
     struct virtio_console_config config;
 
-    struct {
-        QEMUTimer *timer;
-        uint32_t nr_active_ports;
-        struct {
-            VirtIOSerialPort *port;
-            uint8_t host_connected;
-        } *connected;
-    } post_load;
+    struct VirtIOSerialPostLoad *post_load;
 };
 
 static VirtIOSerialPort *find_port_by_id(VirtIOSerial *vser, uint32_t id)
@@ -642,9 +644,12 @@ static void virtio_serial_post_load_timer_cb(void *opaque)
     VirtIOSerialPort *port;
     uint8_t host_connected;
 
-    for (i = 0 ; i < s->post_load.nr_active_ports; ++i) {
-        port = s->post_load.connected[i].port;
-        host_connected = s->post_load.connected[i].host_connected;
+    if (!s->post_load) {
+        return;
+    }
+    for (i = 0 ; i < s->post_load->nr_active_ports; ++i) {
+        port = s->post_load->connected[i].port;
+        host_connected = s->post_load->connected[i].host_connected;
         if (host_connected != port->host_connected) {
             /*
              * We have to let the guest know of the host connection
@@ -654,8 +659,10 @@ static void virtio_serial_post_load_timer_cb(void *opaque)
                                port->host_connected);
         }
     }
-    g_free(s->post_load.connected);
-    s->post_load.connected = NULL;
+    g_free(s->post_load->connected);
+    qemu_free_timer(s->post_load->timer);
+    g_free(s->post_load);
+    s->post_load = NULL;
 }
 
 static int fetch_active_ports_list(QEMUFile *f, int version_id,
@@ -663,9 +670,14 @@ static int fetch_active_ports_list(QEMUFile *f, int version_id,
 {
     uint32_t i;
 
-    s->post_load.nr_active_ports = nr_active_ports;
-    s->post_load.connected =
-        g_malloc0(sizeof(*s->post_load.connected) * nr_active_ports);
+    s->post_load = g_malloc0(sizeof(*s->post_load));
+    s->post_load->nr_active_ports = nr_active_ports;
+    s->post_load->connected =
+        g_malloc0(sizeof(*s->post_load->connected) * nr_active_ports);
+
+    s->post_load->timer = qemu_new_timer_ns(vm_clock,
+                                            virtio_serial_post_load_timer_cb,
+                                            s);
 
     /* Items in struct VirtIOSerialPort */
     for (i = 0; i < nr_active_ports; i++) {
@@ -679,8 +691,8 @@ static int fetch_active_ports_list(QEMUFile *f, int version_id,
         }
 
         port->guest_connected = qemu_get_byte(f);
-        s->post_load.connected[i].port = port;
-        s->post_load.connected[i].host_connected = qemu_get_byte(f);
+        s->post_load->connected[i].port = port;
+        s->post_load->connected[i].host_connected = qemu_get_byte(f);
 
         if (version_id > 2) {
             uint32_t elem_popped;
@@ -705,7 +717,7 @@ static int fetch_active_ports_list(QEMUFile *f, int version_id,
             }
         }
     }
-    qemu_mod_timer(s->post_load.timer, 1);
+    qemu_mod_timer(s->post_load->timer, 1);
     return 0;
 }
 
@@ -1003,6 +1015,8 @@ VirtIODevice *virtio_serial_init(DeviceState *dev, virtio_serial_conf *conf)
 
     vser->qdev = dev;
 
+    vser->post_load = NULL;
+
     /*
      * Register for the savevm section with the virtio-console name
      * to preserve backward compat
@@ -1010,9 +1024,6 @@ VirtIODevice *virtio_serial_init(DeviceState *dev, virtio_serial_conf *conf)
     register_savevm(dev, "virtio-console", -1, 3, virtio_serial_save,
                     virtio_serial_load, vser);
 
-    vser->post_load.timer = qemu_new_timer_ns(vm_clock,
-            virtio_serial_post_load_timer_cb, vser);
-
     return vdev;
 }
 
@@ -1025,9 +1036,11 @@ void virtio_serial_exit(VirtIODevice *vdev)
     g_free(vser->ivqs);
     g_free(vser->ovqs);
     g_free(vser->ports_map);
-    g_free(vser->post_load.connected);
-    qemu_free_timer(vser->post_load.timer);
-
+    if (vser->post_load) {
+        g_free(vser->post_load->connected);
+        qemu_free_timer(vser->post_load->timer);
+        g_free(vser->post_load);
+    }
     virtio_cleanup(vdev);
 }
 
commit 2e575a86abc36764ef34030f423ef118914a01cc
Author: Amit Shah <amit.shah at redhat.com>
Date:   Thu Nov 29 17:02:14 2012 +0530

    virtio-serial: move active ports loading to separate function
    
    The virtio_serial_load() function became too big, split the code that
    gets the port info from the source into a separate function.
    
    Signed-off-by: Amit Shah <amit.shah at redhat.com>

diff --git a/hw/virtio-serial-bus.c b/hw/virtio-serial-bus.c
index 30f450c..2e0fe3d 100644
--- a/hw/virtio-serial-bus.c
+++ b/hw/virtio-serial-bus.c
@@ -658,10 +658,60 @@ static void virtio_serial_post_load_timer_cb(void *opaque)
     s->post_load.connected = NULL;
 }
 
+static int fetch_active_ports_list(QEMUFile *f, int version_id,
+                                   VirtIOSerial *s, uint32_t nr_active_ports)
+{
+    uint32_t i;
+
+    s->post_load.nr_active_ports = nr_active_ports;
+    s->post_load.connected =
+        g_malloc0(sizeof(*s->post_load.connected) * nr_active_ports);
+
+    /* Items in struct VirtIOSerialPort */
+    for (i = 0; i < nr_active_ports; i++) {
+        VirtIOSerialPort *port;
+        uint32_t id;
+
+        id = qemu_get_be32(f);
+        port = find_port_by_id(s, id);
+        if (!port) {
+            return -EINVAL;
+        }
+
+        port->guest_connected = qemu_get_byte(f);
+        s->post_load.connected[i].port = port;
+        s->post_load.connected[i].host_connected = qemu_get_byte(f);
+
+        if (version_id > 2) {
+            uint32_t elem_popped;
+
+            qemu_get_be32s(f, &elem_popped);
+            if (elem_popped) {
+                qemu_get_be32s(f, &port->iov_idx);
+                qemu_get_be64s(f, &port->iov_offset);
+
+                qemu_get_buffer(f, (unsigned char *)&port->elem,
+                                sizeof(port->elem));
+                virtqueue_map_sg(port->elem.in_sg, port->elem.in_addr,
+                                 port->elem.in_num, 1);
+                virtqueue_map_sg(port->elem.out_sg, port->elem.out_addr,
+                                 port->elem.out_num, 1);
+
+                /*
+                 *  Port was throttled on source machine.  Let's
+                 *  unthrottle it here so data starts flowing again.
+                 */
+                virtio_serial_throttle_port(port, false);
+            }
+        }
+    }
+    qemu_mod_timer(s->post_load.timer, 1);
+    return 0;
+}
+
 static int virtio_serial_load(QEMUFile *f, void *opaque, int version_id)
 {
     VirtIOSerial *s = opaque;
-    VirtIOSerialPort *port;
     uint32_t max_nr_ports, nr_active_ports, ports_map;
     unsigned int i;
     int ret;
@@ -705,48 +755,12 @@ static int virtio_serial_load(QEMUFile *f, void *opaque, int version_id)
 
     qemu_get_be32s(f, &nr_active_ports);
 
-    s->post_load.nr_active_ports = nr_active_ports;
-    s->post_load.connected =
-        g_malloc0(sizeof(*s->post_load.connected) * nr_active_ports);
-
-    /* Items in struct VirtIOSerialPort */
-    for (i = 0; i < nr_active_ports; i++) {
-        uint32_t id;
-
-        id = qemu_get_be32(f);
-        port = find_port_by_id(s, id);
-        if (!port) {
-            return -EINVAL;
-        }
-
-        port->guest_connected = qemu_get_byte(f);
-        s->post_load.connected[i].port = port;
-        s->post_load.connected[i].host_connected = qemu_get_byte(f);
-
-        if (version_id > 2) {
-            uint32_t elem_popped;
-
-            qemu_get_be32s(f, &elem_popped);
-            if (elem_popped) {
-                qemu_get_be32s(f, &port->iov_idx);
-                qemu_get_be64s(f, &port->iov_offset);
-
-                qemu_get_buffer(f, (unsigned char *)&port->elem,
-                                sizeof(port->elem));
-                virtqueue_map_sg(port->elem.in_sg, port->elem.in_addr,
-                                 port->elem.in_num, 1);
-                virtqueue_map_sg(port->elem.out_sg, port->elem.out_addr,
-                                 port->elem.out_num, 1);
-
-                /*
-                 *  Port was throttled on source machine.  Let's
-                 *  unthrottle it here so data starts flowing again.
-                 */
-                virtio_serial_throttle_port(port, false);
-            }
+    if (nr_active_ports) {
+        ret = fetch_active_ports_list(f, version_id, s, nr_active_ports);
+        if (ret) {
+            return ret;
         }
     }
-    qemu_mod_timer(s->post_load.timer, 1);
     return 0;
 }
 
commit c3587ca1a25862628e06cc019f91e7b2dcef40bf
Author: Amit Shah <amit.shah at redhat.com>
Date:   Thu Nov 29 15:44:44 2012 +0530

    virtio-serial: use uint32_t to count ports
    
    Signed-off-by: Amit Shah <amit.shah at redhat.com>

diff --git a/hw/virtio-serial-bus.c b/hw/virtio-serial-bus.c
index 155da58..30f450c 100644
--- a/hw/virtio-serial-bus.c
+++ b/hw/virtio-serial-bus.c
@@ -56,7 +56,7 @@ struct VirtIOSerial {
 
     struct {
         QEMUTimer *timer;
-        int nr_active_ports;
+        uint32_t nr_active_ports;
         struct {
             VirtIOSerialPort *port;
             uint8_t host_connected;
@@ -637,7 +637,7 @@ static void virtio_serial_save(QEMUFile *f, void *opaque)
 
 static void virtio_serial_post_load_timer_cb(void *opaque)
 {
-    int i;
+    uint32_t i;
     VirtIOSerial *s = opaque;
     VirtIOSerialPort *port;
     uint8_t host_connected;


More information about the Spice-commits mailing list