[Spice-commits] 53 commits - MAINTAINERS Makefile VERSION block.c block/linux-aio.c block/mirror.c block/raw-aio.h block/raw-posix.c disas/libvixl hw/acpi hw/arm hw/block hw/core hw/display hw/ide hw/mem hw/pci hw/pci-host hw/ppc hw/s390x hw/virtio hw/xen include/block include/hw include/sysemu linux-user/main.c numa.c pc-bios/README pc-bios/ppc_rom.bin pc-bios/s390-ccw pc-bios/s390-ccw.img pc-bios/slof.bin qemu-char.c qemu-doc.texi qemu-img.texi qmp.c roms/SLOF roms/openhackware target-arm/cpu-qom.h target-arm/kvm32.c target-ppc/cpu-models.c target-ppc/cpu-models.h target-ppc/cpu-qom.h target-ppc/gdbstub.c target-ppc/mmu_helper.c target-ppc/translate_init.c tests/Makefile tests/qemu-iotests tests/test-string-output-visitor.c xen-hvm.c xen-mapcache.c

Gerd Hoffmann kraxel at kemper.freedesktop.org
Fri Jul 11 02:35:14 PDT 2014


 MAINTAINERS                        |    3 
 Makefile                           |    3 
 VERSION                            |    2 
 block.c                            |   31 +++++++++
 block/linux-aio.c                  |   96 ++++++++++++++++++++++++++++-
 block/mirror.c                     |    4 -
 block/raw-aio.h                    |    2 
 block/raw-posix.c                  |   73 ++++++++++++++++++++--
 disas/libvixl/Makefile.objs        |    2 
 hw/acpi/memory_hotplug.c           |    2 
 hw/arm/vexpress.c                  |    2 
 hw/block/dataplane/virtio-blk.c    |    2 
 hw/core/qdev-properties-system.c   |    3 
 hw/core/qdev.c                     |    8 ++
 hw/display/xenfb.c                 |   18 +++--
 hw/ide/ahci.c                      |   32 +++++----
 hw/ide/ahci.h                      |    2 
 hw/mem/pc-dimm.c                   |    8 ++
 hw/pci-host/prep.c                 |    4 -
 hw/pci/pci.c                       |    2 
 hw/ppc/prep.c                      |   12 ---
 hw/ppc/spapr.c                     |    3 
 hw/ppc/spapr_hcall.c               |    2 
 hw/s390x/css.c                     |    9 ++
 hw/s390x/s390-virtio-bus.c         |    2 
 hw/s390x/virtio-ccw.c              |   11 +--
 hw/virtio/virtio-mmio.c            |    6 +
 hw/virtio/virtio-pci.c             |   16 ++--
 hw/xen/xen_backend.c               |   18 +++++
 include/block/block.h              |    4 +
 include/block/block_int.h          |    5 +
 include/hw/virtio/virtio-blk.h     |    3 
 include/hw/virtio/virtio-net.h     |    1 
 include/hw/virtio/virtio-scsi.h    |    1 
 include/hw/xen/xen_backend.h       |    2 
 include/sysemu/char.h              |    1 
 linux-user/main.c                  |    8 +-
 numa.c                             |    8 ++
 pc-bios/README                     |    2 
 pc-bios/ppc_rom.bin                |binary
 pc-bios/s390-ccw.img               |binary
 pc-bios/s390-ccw/bootmap.c         |    2 
 pc-bios/s390-ccw/main.c            |   17 ++++-
 pc-bios/s390-ccw/s390-ccw.h        |    1 
 pc-bios/slof.bin                   |binary
 qemu-char.c                        |   36 ++++------
 qemu-doc.texi                      |    4 -
 qemu-img.texi                      |    4 -
 qmp.c                              |   99 +++++++++++++++++++++++-------
 roms/SLOF                          |    2 
 roms/openhackware                  |    2 
 target-arm/cpu-qom.h               |    4 -
 target-arm/kvm32.c                 |   19 +----
 target-ppc/cpu-models.c            |    5 -
 target-ppc/cpu-models.h            |    6 -
 target-ppc/cpu-qom.h               |    2 
 target-ppc/gdbstub.c               |   34 ++++------
 target-ppc/mmu_helper.c            |    6 -
 target-ppc/translate_init.c        |  122 +++++++++++--------------------------
 tests/Makefile                     |    8 +-
 tests/qemu-iotests/041             |   46 +++++++++++++
 tests/qemu-iotests/041.out         |    4 -
 tests/test-string-output-visitor.c |    7 --
 xen-hvm.c                          |    2 
 xen-mapcache.c                     |    4 -
 65 files changed, 568 insertions(+), 281 deletions(-)

New commits:
commit 9e99c5fd7060267a0331d900e73fdb36047bfe0c
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jul 9 22:28:49 2014 +0200

    tests: Fix unterminated string output visitor enum human string
    
    The buffer was being allocated of size string length plus two.
    Around the string two quotes were being added, but no terminating NUL.
    It was then compared using g_assert_cmpstr(), resulting in fairly random
    assertion failures:
    
     ERROR:tests/test-string-output-visitor.c:213:test_visitor_out_enum: assertion failed (str == str_human): ("\"value1\"" == "\"value1\"\001EEEEEEEEEEEEEE\0171")
    
    There is no g_assert_cmpnstr() counterpart, so use g_strdup_printf()
    for safely assembling the string in the first place.
    
    Cc: Hu Tao <hutao at cn.fujitsu.com>
    Cc: Michael S. Tsirkin <mst at redhat.com>
    Suggested-by: Eric Blake <eblake at redhat.com>
    Fixes: b4900c0 tests: add human format test for string output visitor
    Signed-off-by: Andreas Färber <afaerber at suse.de>
    Reviewed-by: Eric Blake <eblake at redhat.com>
    Reviewed-by: Hu Tao <hutao at cn.fujitsu.com>
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>

diff --git a/tests/test-string-output-visitor.c b/tests/test-string-output-visitor.c
index e89e43c..101fb27 100644
--- a/tests/test-string-output-visitor.c
+++ b/tests/test-string-output-visitor.c
@@ -196,16 +196,11 @@ static void test_visitor_out_enum(TestOutputVisitorData *data,
 
     for (i = 0; i < ENUM_ONE_MAX; i++) {
         char *str_human;
-        int len;
 
         visit_type_EnumOne(data->ov, &i, "unused", &err);
         g_assert(!err);
 
-        len = strlen(EnumOne_lookup[i]) + 2;
-        str_human = g_malloc0(len);
-        str_human[0] = '"';
-        strncpy(str_human + 1, EnumOne_lookup[i], strlen(EnumOne_lookup[i]));
-        str_human[len - 1] = '"';
+        str_human = g_strdup_printf("\"%s\"", EnumOne_lookup[i]);
 
         str = string_output_get_string(data->sov);
         g_assert(str != NULL);
commit 675879f6f3c9463e103735a4e41e9deb0bee9b39
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Tue Jul 8 16:53:59 2014 +0100

    Update version for v2.1.0-rc1 release
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>

diff --git a/VERSION b/VERSION
index 36831c3..a162201 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-2.0.90
+2.0.91
commit b653282eccd2b43fd8068b9d6de40a3ff9e801ec
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Tue Jul 8 15:53:42 2014 +0100

    hw/ppc/spapr_hcall.c: Add ULL suffix to 64 bit constant
    
    Add ULL suffix to 64 bit constant to prevent compiler warnings
    on some 32 bit platforms.
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>

diff --git a/hw/ppc/spapr_hcall.c b/hw/ppc/spapr_hcall.c
index 7952077..467858c 100644
--- a/hw/ppc/spapr_hcall.c
+++ b/hw/ppc/spapr_hcall.c
@@ -770,7 +770,7 @@ static target_ulong h_set_mode_resouce_addr_trans_mode(PowerPCCPU *cpu,
         prefix = 0x18000;
         break;
     case H_SET_MODE_ADDR_TRANS_C000_0000_0000_4000:
-        prefix = 0xC000000000004000;
+        prefix = 0xC000000000004000ULL;
         break;
     default:
         return H_UNSUPPORTED_FLAG;
commit d614cb68dacca24eb003825144d5a55d8f459a13
Merge: 67d01fb 2ed982b
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Tue Jul 8 15:10:42 2014 +0100

    Merge remote-tracking branch 'remotes/cohuck/tags/s390x-20140708' into staging
    
    Bugfixes for s390x: set subsystem id in the lowcore when booting from the
    s390-ccw bios, and set the channel-program address after I/O completion,
    when applicable.
    
    # gpg: Signature made Tue 08 Jul 2014 14:18:20 BST using RSA key ID C6F02FAF
    # gpg: Can't check signature: public key not found
    
    * remotes/cohuck/tags/s390x-20140708:
      s390x/css: reflect cpa in scsw
      pc-bios/s390-ccw: update binary
      pc-bios/s390-ccw: store proper subsystem information word
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>

commit 2ed982b6a984cdf2940f426ee246f52492d4a415
Author: Cornelia Huck <cornelia.huck at de.ibm.com>
Date:   Mon Jun 30 14:33:38 2014 +0200

    s390x/css: reflect cpa in scsw
    
    We neglected to update the the channel-program-address field of the scsw
    after completion of the start or the halt function: Fortunately, Linux
    didn't miss it so far. Let's update it for the cases where the cpa is
    expected to be valid; in some cases, the cpa is 'unpredictable', so we
    leave it untouched.
    
    Reviewed-by: David Hildenbrand <dahi at linux.vnet.ibm.com>
    Signed-off-by: Cornelia Huck <cornelia.huck at de.ibm.com>

diff --git a/hw/s390x/css.c b/hw/s390x/css.c
index e758890..49c2aaf 100644
--- a/hw/s390x/css.c
+++ b/hw/s390x/css.c
@@ -200,6 +200,7 @@ static void sch_handle_halt_func(SubchDev *sch)
 
     PMCW *p = &sch->curr_status.pmcw;
     SCSW *s = &sch->curr_status.scsw;
+    hwaddr curr_ccw = sch->channel_prog;
     int path;
 
     /* Path management: In our simple css, we always choose the only path. */
@@ -216,6 +217,10 @@ static void sch_handle_halt_func(SubchDev *sch)
           (s->ctrl & SCSW_ACTL_SUSP))) {
         s->dstat = SCSW_DSTAT_DEVICE_END;
     }
+    if ((s->ctrl & (SCSW_ACTL_SUBCH_ACTIVE | SCSW_ACTL_DEVICE_ACTIVE)) ||
+        (s->ctrl & SCSW_ACTL_SUSP)) {
+        s->cpa = curr_ccw + 8;
+    }
     s->cstat = 0;
     p->lpum = path;
 
@@ -398,6 +403,7 @@ static void sch_handle_start_func(SubchDev *sch, ORB *orb)
             s->ctrl |= SCSW_STCTL_PRIMARY | SCSW_STCTL_SECONDARY |
                     SCSW_STCTL_STATUS_PEND;
             s->dstat = SCSW_DSTAT_CHANNEL_END | SCSW_DSTAT_DEVICE_END;
+            s->cpa = sch->channel_prog + 8;
             break;
         case -ENOSYS:
             /* unsupported command, generate unit check (command reject) */
@@ -408,6 +414,7 @@ static void sch_handle_start_func(SubchDev *sch, ORB *orb)
             s->ctrl &= ~SCSW_CTRL_MASK_STCTL;
             s->ctrl |= SCSW_STCTL_PRIMARY | SCSW_STCTL_SECONDARY |
                     SCSW_STCTL_ALERT | SCSW_STCTL_STATUS_PEND;
+            s->cpa = sch->channel_prog + 8;
             break;
         case -EFAULT:
             /* memory problem, generate channel data check */
@@ -416,6 +423,7 @@ static void sch_handle_start_func(SubchDev *sch, ORB *orb)
             s->ctrl &= ~SCSW_CTRL_MASK_STCTL;
             s->ctrl |= SCSW_STCTL_PRIMARY | SCSW_STCTL_SECONDARY |
                     SCSW_STCTL_ALERT | SCSW_STCTL_STATUS_PEND;
+            s->cpa = sch->channel_prog + 8;
             break;
         case -EBUSY:
             /* subchannel busy, generate deferred cc 1 */
@@ -436,6 +444,7 @@ static void sch_handle_start_func(SubchDev *sch, ORB *orb)
             s->ctrl &= ~SCSW_CTRL_MASK_STCTL;
             s->ctrl |= SCSW_STCTL_PRIMARY | SCSW_STCTL_SECONDARY |
                     SCSW_STCTL_ALERT | SCSW_STCTL_STATUS_PEND;
+            s->cpa = sch->channel_prog + 8;
             break;
         }
     } while (ret == -EAGAIN);
commit 32a02d070be46b5c5a863e1542883f4a39231a39
Author: Cornelia Huck <cornelia.huck at de.ibm.com>
Date:   Mon Jul 7 09:52:03 2014 +0200

    pc-bios/s390-ccw: update binary
    
    Signed-off-by: Cornelia Huck <cornelia.huck at de.ibm.com>

diff --git a/pc-bios/s390-ccw.img b/pc-bios/s390-ccw.img
index 603e19e..e3ea0d5 100644
Binary files a/pc-bios/s390-ccw.img and b/pc-bios/s390-ccw.img differ
commit f2879a5c9e45e8432d15deea84fdf53586e9949c
Author: Christian Borntraeger <borntraeger at de.ibm.com>
Date:   Tue Jul 1 12:17:41 2014 +0200

    pc-bios/s390-ccw: store proper subsystem information word
    
    POP chapter 17 requires to store a subsystem information word at 184
    during IPL. Furthermore bytes 188-191 should be zero. The bootmap might
    contain data blocks that are written to the first page. We have to
    write these values after we processed the bootmap and before the final
    IPL.
    
    Signed-off-by: Christian Borntraeger <borntraeger at de.ibm.com>
    Reviewed-by: Cornelia Huck <cornelia.huck at de.ibm.com>
    Signed-off-by: Cornelia Huck <cornelia.huck at de.ibm.com>

diff --git a/pc-bios/s390-ccw/bootmap.c b/pc-bios/s390-ccw/bootmap.c
index fa54abb..f175679 100644
--- a/pc-bios/s390-ccw/bootmap.c
+++ b/pc-bios/s390-ccw/bootmap.c
@@ -51,6 +51,8 @@ static void jump_to_IPL_2(void)
 
 static void jump_to_IPL_code(uint64_t address)
 {
+    /* store the subsystem information _after_ the bootmap was loaded */
+    write_subsystem_identification();
     /*
      * The IPL PSW is at address 0. We also must not overwrite the
      * content of non-BIOS memory after we loaded the guest, so we
diff --git a/pc-bios/s390-ccw/main.c b/pc-bios/s390-ccw/main.c
index dbfb40e..f9ec215 100644
--- a/pc-bios/s390-ccw/main.c
+++ b/pc-bios/s390-ccw/main.c
@@ -13,6 +13,22 @@
 
 char stack[PAGE_SIZE * 8] __attribute__((__aligned__(PAGE_SIZE)));
 uint64_t boot_value;
+struct subchannel_id blk_schid = { .one = 1 };
+
+/*
+ * Priniciples of Operations (SA22-7832-09) chapter 17 requires that
+ * a subsystem-identification is at 184-187 and bytes 188-191 are zero
+ * after list-directed-IPL and ccw-IPL.
+ */
+void write_subsystem_identification(void)
+{
+    struct subchannel_id *schid = (struct subchannel_id *) 184;
+    uint32_t *zeroes = (uint32_t *) 188;
+
+    *schid = blk_schid;
+    *zeroes = 0;
+}
+
 
 void virtio_panic(const char *string)
 {
@@ -23,7 +39,6 @@ void virtio_panic(const char *string)
 
 static void virtio_setup(uint64_t dev_info)
 {
-    struct subchannel_id blk_schid = { .one = 1 };
     struct schib schib;
     int i;
     int r;
diff --git a/pc-bios/s390-ccw/s390-ccw.h b/pc-bios/s390-ccw/s390-ccw.h
index 959aed0..2b773de 100644
--- a/pc-bios/s390-ccw/s390-ccw.h
+++ b/pc-bios/s390-ccw/s390-ccw.h
@@ -50,6 +50,7 @@ void disabled_wait(void);
 
 /* main.c */
 void virtio_panic(const char *string);
+void write_subsystem_identification(void);
 
 /* sclp-ascii.c */
 void sclp_print(const char *string);
commit 67d01fb8066b7bfa9be1b2c8537ad3f2406d98cf
Merge: eaa4980 75c9a1a
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Tue Jul 8 14:01:58 2014 +0100

    Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20140708' into staging
    
    target-arm queue:
     * fix handling of KVM reset for 32-bit ARM CPUs
     * implement NOR flash alias for vexpress-a9
     * make sure libvixl gets its own utils.h rather than somebody else's
    
    # gpg: Signature made Tue 08 Jul 2014 13:12:05 BST using RSA key ID 14360CDE
    # gpg: Good signature from "Peter Maydell <peter.maydell at linaro.org>"
    
    * remotes/pmaydell/tags/pull-target-arm-20140708:
      target-arm: Implement vCPU reset via KVM_ARM_VCPU_INIT for 32-bit CPUs
      hw/arm/vexpress: Alias NOR flash at 0 for vexpress-a9
      disas/libvixl: prepend the include path of libvixl header files
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>

commit 75c9a1a0473cc5ca9756d11b236c715c7bc0ba67
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Thu Jun 26 18:16:13 2014 +0100

    target-arm: Implement vCPU reset via KVM_ARM_VCPU_INIT for 32-bit CPUs
    
    Implement kvm_arm_vcpu_init() as a simple call to arm_arm_vcpu_init()
    (which uses the KVM_ARM_VCPU_INIT vcpu ioctl to tell the kernel
    to re-initialize the vCPU), rather than via the complicated code
    which saves a copy of the register state on first init and then
    writes it back to the kernel. This is much simpler and brings the
    32-bit KVM code into line with the 64-bit code.
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Message-id: 1403802973-20841-1-git-send-email-peter.maydell at linaro.org

diff --git a/target-arm/cpu-qom.h b/target-arm/cpu-qom.h
index eaee944..ee4fbb1 100644
--- a/target-arm/cpu-qom.h
+++ b/target-arm/cpu-qom.h
@@ -72,10 +72,6 @@ typedef struct ARMCPU {
     uint64_t *cpreg_indexes;
     /* Values of the registers (cpreg_indexes[i]'s value is cpreg_values[i]) */
     uint64_t *cpreg_values;
-    /* When using KVM, keeps a copy of the initial state of the VCPU,
-     * so that on reset we can feed the reset values back into the kernel.
-     */
-    uint64_t *cpreg_reset_values;
     /* Length of the indexes, values, reset_values arrays */
     int32_t cpreg_array_len;
     /* These are used only for migration: incoming data arrives in
diff --git a/target-arm/kvm32.c b/target-arm/kvm32.c
index 068af7d..5ec4eb1 100644
--- a/target-arm/kvm32.c
+++ b/target-arm/kvm32.c
@@ -270,13 +270,6 @@ int kvm_arch_init_vcpu(CPUState *cs)
         goto out;
     }
 
-    /* Save a copy of the initial register values so that we can
-     * feed it back to the kernel on VCPU reset.
-     */
-    cpu->cpreg_reset_values = g_memdup(cpu->cpreg_values,
-                                       cpu->cpreg_array_len *
-                                       sizeof(cpu->cpreg_values[0]));
-
 out:
     g_free(rlp);
     return ret;
@@ -518,11 +511,9 @@ int kvm_arch_get_registers(CPUState *cs)
 
 void kvm_arm_reset_vcpu(ARMCPU *cpu)
 {
-    /* Feed the kernel back its initial register state */
-    memmove(cpu->cpreg_values, cpu->cpreg_reset_values,
-            cpu->cpreg_array_len * sizeof(cpu->cpreg_values[0]));
-
-    if (!write_list_to_kvmstate(cpu)) {
-        abort();
-    }
+    /* Re-init VCPU so that all registers are set to
+     * their respective reset values.
+     */
+    kvm_arm_vcpu_init(CPU(cpu));
+    write_kvmstate_to_list(cpu);
 }
commit 6ec1588e09770ac7e9c60194faff6101111fc7f0
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Wed Jul 2 15:07:50 2014 +0100

    hw/arm/vexpress: Alias NOR flash at 0 for vexpress-a9
    
    Make the vexpress-a9 board alias the first NOR flash region at
    address zero, like vexpress-a15. This makes "-bios" actually usable
    on this board.
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Message-id: 1404310070-3561-1-git-send-email-peter.maydell at linaro.org
    Reviewed-by: Greg Bellows <greg.bellows at linaro.org>

diff --git a/hw/arm/vexpress.c b/hw/arm/vexpress.c
index 3d83e6c..a88732c 100644
--- a/hw/arm/vexpress.c
+++ b/hw/arm/vexpress.c
@@ -84,6 +84,7 @@ enum {
 };
 
 static hwaddr motherboard_legacy_map[] = {
+    [VE_NORFLASHALIAS] = 0,
     /* CS7: 0x10000000 .. 0x10020000 */
     [VE_SYSREGS] = 0x10000000,
     [VE_SP810] = 0x10001000,
@@ -114,7 +115,6 @@ static hwaddr motherboard_legacy_map[] = {
     [VE_VIDEORAM] = 0x4c000000,
     [VE_ETHERNET] = 0x4e000000,
     [VE_USB] = 0x4f000000,
-    [VE_NORFLASHALIAS] = -1, /* not present */
 };
 
 static hwaddr motherboard_aseries_map[] = {
commit 834fb1b269f4c9eb0ffc058fd6ab5a018c3bce1f
Author: Stefano Stabellini <stefano.stabellini at eu.citrix.com>
Date:   Mon Jul 7 16:25:07 2014 +0100

    disas/libvixl: prepend the include path of libvixl header files
    
    Currently the Makefile of disas/libvixl appends
    -I$(SRC_PATH)/disas/libvixl to QEMU_CFLAGS. As a consequence C++ files
    that #include "utils.h", such as disas/libvixl/a64/instructions-a64.cc,
    are going to look for utils.h on all the other include paths first.
    
    When building QEMU as part of the Xen make system, another unrelated
    utils.h file is going to be chosen for inclusion, causing a build
    failure:
    
    In file included from disas/libvixl/a64/instructions-a64.cc:27:0:
    /qemu/disas/libvixl/a64/instructions-a64.h:88:64: error:
    'rawbits_to_float' was not declared in this scope
     const float kFP32PositiveInfinity = rawbits_to_float(0x7f800000);
    
    Fix the problem by prepending (rather than appending) the libvixl
    include path to QEMU_CFLAGS.
    
    Signed-off-by: Stefano Stabellini <stefano.stabellini at eu.citrix.com>
    Reviewed-by: Peter Maydell <peter.maydell at linaro.org>
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>

diff --git a/disas/libvixl/Makefile.objs b/disas/libvixl/Makefile.objs
index 0adb3ce..17e6565 100644
--- a/disas/libvixl/Makefile.objs
+++ b/disas/libvixl/Makefile.objs
@@ -3,6 +3,6 @@ libvixl_OBJS = utils.o \
                a64/decoder-a64.o \
                a64/disasm-a64.o
 
-$(addprefix $(obj)/,$(libvixl_OBJS)): QEMU_CFLAGS += -I$(SRC_PATH)/disas/libvixl
+$(addprefix $(obj)/,$(libvixl_OBJS)): QEMU_CFLAGS := -I$(SRC_PATH)/disas/libvixl $(QEMU_CFLAGS)
 
 common-obj-$(CONFIG_ARM_A64_DIS) += $(libvixl_OBJS)
commit eaa4980185943da6e36f6f2e052d41924705e1ea
Merge: 128f0e6 0c6ab8c
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Tue Jul 8 11:38:12 2014 +0100

    Merge remote-tracking branch 'remotes/agraf/tags/signed-ppc-for-upstream' into staging
    
    Patch queue for ppc - 2014-07-08
    
    A few bug fixes for 2.1:
    
      - Fix e500* TLB emulation with qemu-system-ppc
      - Update SLOF to current upstream (good number of bugfixes)
      - Make POWER7 / POWER8 PVR match more agnostic (needed in 2.1 for cmdline compat)
      - Fix u-boot.e500 install (how did that happen?)
      - Fix H_CAS on LE hosts
      - ppc64le-linux-user fixes
    
    # gpg: Signature made Tue 08 Jul 2014 11:18:58 BST using RSA key ID 03FEDC60
    # gpg: Can't check signature: public key not found
    
    * remotes/agraf/tags/signed-ppc-for-upstream:
      PPC: e500: Actually install u-boot.e500
      target-ppc: Remove POWER7+ and POWER8E families
      target-ppc: Add pvr_match() callback
      pseries: Update SLOF firmware image to qemu-slof-20140630
      PPC: Fix booke206 TLB with phys addrs > 32bit
      target-ppc: Fix gdbstub for ppc64le-linux-user
      target-ppc: Change default cpu for ppc64le-linux-user
      target-ppc: KVMPPC_H_CAS fix cpu-version endianess
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>

commit 0c6ab8c988830d3fe01c4ee88100a95ea95c49fa
Author: Cole Robinson <crobinso at redhat.com>
Date:   Fri Jul 4 15:43:18 2014 -0400

    PPC: e500: Actually install u-boot.e500
    
    Signed-off-by: Cole Robinson <crobinso at redhat.com>
    Signed-off-by: Alexander Graf <agraf at suse.de>

diff --git a/Makefile b/Makefile
index 1eea0c4..d6b9dc1 100644
--- a/Makefile
+++ b/Makefile
@@ -344,7 +344,8 @@ multiboot.bin linuxboot.bin kvmvapic.bin \
 s390-zipl.rom \
 s390-ccw.img \
 spapr-rtas.bin slof.bin \
-palcode-clipper
+palcode-clipper \
+u-boot.e500
 else
 BLOBS=
 endif
commit b60c60070c0df4ef01d5c727929fe0e93e6fdd09
Author: Alexey Kardashevskiy <aik at ozlabs.ru>
Date:   Tue Jul 1 00:30:18 2014 +1000

    target-ppc: Remove POWER7+ and POWER8E families
    
    POWER8E is architecturally equal to POWER8 and POWER7+ is equal to
    POWER7. Also no user space tool makes any difference for CPU node name
    in the device tree (such as PowerPC,POWER7 at 0 vs. PowerPC,POWER7+ at 0).
    So there is no point in emulating POWER7+ and POWER8E apart from POWER7
    and POWER8. Also, the previos patch implemented multiple PVR mask support
    per CPU class so POWER7 class now covers both POWER7 and POWER7+ CPUs,
    same is valid for POWER8/8E.
    
    This removes POWER7+ and POWER8E classes. This replaces references
    to POWER7P/POWER8E families with POWER7/POWER8 families.
    
    Signed-off-by: Alexey Kardashevskiy <aik at ozlabs.ru>
    Signed-off-by: Alexander Graf <agraf at suse.de>

diff --git a/target-ppc/cpu-models.c b/target-ppc/cpu-models.c
index c9112e9..52ac6ec 100644
--- a/target-ppc/cpu-models.c
+++ b/target-ppc/cpu-models.c
@@ -1135,9 +1135,9 @@
 #endif
     POWERPC_DEF("POWER7_v2.3",   CPU_POWERPC_POWER7_v23,             POWER7,
                 "POWER7 v2.3")
-    POWERPC_DEF("POWER7+_v2.1",  CPU_POWERPC_POWER7P_v21,            POWER7P,
+    POWERPC_DEF("POWER7+_v2.1",  CPU_POWERPC_POWER7P_v21,            POWER7,
                 "POWER7+ v2.1")
-    POWERPC_DEF("POWER8E_v1.0",  CPU_POWERPC_POWER8E_v10,            POWER8E,
+    POWERPC_DEF("POWER8E_v1.0",  CPU_POWERPC_POWER8E_v10,            POWER8,
                 "POWER8E v1.0")
     POWERPC_DEF("POWER8_v1.0",   CPU_POWERPC_POWER8_v10,             POWER8,
                 "POWER8 v1.0")
diff --git a/target-ppc/translate_init.c b/target-ppc/translate_init.c
index 2c9c277..5eacd46 100644
--- a/target-ppc/translate_init.c
+++ b/target-ppc/translate_init.c
@@ -8133,66 +8133,6 @@ POWERPC_FAMILY(POWER7)(ObjectClass *oc, void *data)
     pcc->interrupts_big_endian = ppc_cpu_interrupts_big_endian_lpcr;
 }
 
-POWERPC_FAMILY(POWER7P)(ObjectClass *oc, void *data)
-{
-    DeviceClass *dc = DEVICE_CLASS(oc);
-    PowerPCCPUClass *pcc = POWERPC_CPU_CLASS(oc);
-
-    dc->fw_name = "PowerPC,POWER7+";
-    dc->desc = "POWER7+";
-    dc->props = powerpc_servercpu_properties;
-    pcc->pvr_match = ppc_pvr_match_power7;
-    pcc->pcr_mask = PCR_COMPAT_2_05 | PCR_COMPAT_2_06;
-    pcc->init_proc = init_proc_POWER7;
-    pcc->check_pow = check_pow_nocheck;
-    pcc->insns_flags = PPC_INSNS_BASE | PPC_ISEL | PPC_STRING | PPC_MFTB |
-                       PPC_FLOAT | PPC_FLOAT_FSEL | PPC_FLOAT_FRES |
-                       PPC_FLOAT_FSQRT | PPC_FLOAT_FRSQRTE |
-                       PPC_FLOAT_FRSQRTES |
-                       PPC_FLOAT_STFIWX |
-                       PPC_FLOAT_EXT |
-                       PPC_CACHE | PPC_CACHE_ICBI | PPC_CACHE_DCBZ |
-                       PPC_MEM_SYNC | PPC_MEM_EIEIO |
-                       PPC_MEM_TLBIE | PPC_MEM_TLBSYNC |
-                       PPC_64B | PPC_ALTIVEC |
-                       PPC_SEGMENT_64B | PPC_SLBI |
-                       PPC_POPCNTB | PPC_POPCNTWD;
-    pcc->insns_flags2 = PPC2_VSX | PPC2_DFP | PPC2_DBRX | PPC2_ISA205 |
-                        PPC2_PERM_ISA206 | PPC2_DIVE_ISA206 |
-                        PPC2_ATOMIC_ISA206 | PPC2_FP_CVT_ISA206 |
-                        PPC2_FP_TST_ISA206;
-    pcc->msr_mask = (1ull << MSR_SF) |
-                    (1ull << MSR_VR) |
-                    (1ull << MSR_VSX) |
-                    (1ull << MSR_EE) |
-                    (1ull << MSR_PR) |
-                    (1ull << MSR_FP) |
-                    (1ull << MSR_ME) |
-                    (1ull << MSR_FE0) |
-                    (1ull << MSR_SE) |
-                    (1ull << MSR_DE) |
-                    (1ull << MSR_FE1) |
-                    (1ull << MSR_IR) |
-                    (1ull << MSR_DR) |
-                    (1ull << MSR_PMM) |
-                    (1ull << MSR_RI) |
-                    (1ull << MSR_LE);
-    pcc->mmu_model = POWERPC_MMU_2_06;
-#if defined(CONFIG_SOFTMMU)
-    pcc->handle_mmu_fault = ppc_hash64_handle_mmu_fault;
-#endif
-    pcc->excp_model = POWERPC_EXCP_POWER7;
-    pcc->bus_model = PPC_FLAGS_INPUT_POWER7;
-    pcc->bfd_mach = bfd_mach_ppc64;
-    pcc->flags = POWERPC_FLAG_VRE | POWERPC_FLAG_SE |
-                 POWERPC_FLAG_BE | POWERPC_FLAG_PMM |
-                 POWERPC_FLAG_BUS_CLK | POWERPC_FLAG_CFAR |
-                 POWERPC_FLAG_VSX;
-    pcc->l1_dcache_size = 0x8000;
-    pcc->l1_icache_size = 0x8000;
-    pcc->interrupts_big_endian = ppc_cpu_interrupts_big_endian_lpcr;
-}
-
 static void init_proc_POWER8(CPUPPCState *env)
 {
     init_proc_book3s_64(env, BOOK3S_CPU_POWER8);
@@ -8209,13 +8149,13 @@ static bool ppc_pvr_match_power8(PowerPCCPUClass *pcc, uint32_t pvr)
     return false;
 }
 
-POWERPC_FAMILY(POWER8E)(ObjectClass *oc, void *data)
+POWERPC_FAMILY(POWER8)(ObjectClass *oc, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     PowerPCCPUClass *pcc = POWERPC_CPU_CLASS(oc);
 
     dc->fw_name = "PowerPC,POWER8";
-    dc->desc = "POWER8E";
+    dc->desc = "POWER8";
     dc->props = powerpc_servercpu_properties;
     pcc->pvr_match = ppc_pvr_match_power8;
     pcc->pcr_mask = PCR_COMPAT_2_05 | PCR_COMPAT_2_06;
@@ -8271,15 +8211,6 @@ POWERPC_FAMILY(POWER8E)(ObjectClass *oc, void *data)
     pcc->l1_icache_size = 0x8000;
     pcc->interrupts_big_endian = ppc_cpu_interrupts_big_endian_lpcr;
 }
-
-POWERPC_FAMILY(POWER8)(ObjectClass *oc, void *data)
-{
-    DeviceClass *dc = DEVICE_CLASS(oc);
-
-    ppc_POWER8E_cpu_family_class_init(oc, data);
-
-    dc->desc = "POWER8";
-}
 #endif /* defined (TARGET_PPC64) */
 
 
commit 03ae4133ab8675d4c67e6fdc8032de7c53a89514
Author: Alexey Kardashevskiy <aik at ozlabs.ru>
Date:   Fri Jul 4 00:48:55 2014 +1000

    target-ppc: Add pvr_match() callback
    
    So far it was enough to have a base PVR value and mask per CPU
    family such as POWER7 or POWER8. However there CPUs which are
    completely architecturally compatible but have different PVRs such
    as POWER7/POWER7+ and POWER8/POWER8E. For these CPUs, top 16 bits
    are CPU family and low 16 bits are the version. The families have
    PVR base values different enough so defining a mask which
    would cover both (or potentially more) CPUs within the family is
    not possible.
    
    This adds a pvr_match() callback to PowerPCCPUClass. The default
    handler simply compares PVR defined in the class.
    
    This implements ppc_pvr_match_power7/ppc_pvr_match_power8 callbacks
    for POWER7/8 families. These check for POWER7/POWER7+ and POWER8/POWER8E.
    
    This changes ppc_cpu_compare_class_pvr_mask() not to check masks but
    use the pvr_match() callback.
    
    Since all server CPUs use the same mask, this defines one mask
    value - CPU_POWERPC_POWER_SERVER_MASK - which is used everywhere now.
    This removes other mask definitions.
    
    This removes pvr_mask from PowerPCCPUClass as it is not used anymore.
    This removes pvr initialization for POWER7/8 families as it is not used
    to find the class, the pvr_match() callback is used instead.
    
    Signed-off-by: Alexey Kardashevskiy <aik at ozlabs.ru>
    Signed-off-by: Alexander Graf <agraf at suse.de>

diff --git a/target-ppc/cpu-models.c b/target-ppc/cpu-models.c
index 9a91af9..c9112e9 100644
--- a/target-ppc/cpu-models.c
+++ b/target-ppc/cpu-models.c
@@ -44,7 +44,6 @@
         PowerPCCPUClass *pcc = POWERPC_CPU_CLASS(oc);                       \
                                                                             \
         pcc->pvr          = _pvr;                                           \
-        pcc->pvr_mask     = CPU_POWERPC_DEFAULT_MASK;                       \
         pcc->svr          = _svr;                                           \
         dc->desc          = _desc;                                          \
     }                                                                       \
diff --git a/target-ppc/cpu-models.h b/target-ppc/cpu-models.h
index c39d03a..290a759 100644
--- a/target-ppc/cpu-models.h
+++ b/target-ppc/cpu-models.h
@@ -39,7 +39,6 @@ extern PowerPCCPUAlias ppc_cpu_aliases[];
 /*****************************************************************************/
 /* PVR definitions for most known PowerPC                                    */
 enum {
-    CPU_POWERPC_DEFAULT_MASK       = 0xFFFFFFFF,
     /* PowerPC 401 family */
     /* Generic PowerPC 401 */
 #define CPU_POWERPC_401              CPU_POWERPC_401G2
@@ -553,17 +552,14 @@ enum {
     CPU_POWERPC_POWER6             = 0x003E0000,
     CPU_POWERPC_POWER6_5           = 0x0F000001, /* POWER6 in POWER5 mode */
     CPU_POWERPC_POWER6A            = 0x0F000002,
+    CPU_POWERPC_POWER_SERVER_MASK  = 0xFFFF0000,
     CPU_POWERPC_POWER7_BASE        = 0x003F0000,
-    CPU_POWERPC_POWER7_MASK        = 0xFFFF0000,
     CPU_POWERPC_POWER7_v23         = 0x003F0203,
     CPU_POWERPC_POWER7P_BASE       = 0x004A0000,
-    CPU_POWERPC_POWER7P_MASK       = 0xFFFF0000,
     CPU_POWERPC_POWER7P_v21        = 0x004A0201,
     CPU_POWERPC_POWER8E_BASE       = 0x004B0000,
-    CPU_POWERPC_POWER8E_MASK       = 0xFFFF0000,
     CPU_POWERPC_POWER8E_v10        = 0x004B0100,
     CPU_POWERPC_POWER8_BASE        = 0x004D0000,
-    CPU_POWERPC_POWER8_MASK        = 0xFFFF0000,
     CPU_POWERPC_POWER8_v10         = 0x004D0100,
     CPU_POWERPC_970                = 0x00390202,
     CPU_POWERPC_970FX_v10          = 0x00391100,
diff --git a/target-ppc/cpu-qom.h b/target-ppc/cpu-qom.h
index f1f0a52..0fee36f 100644
--- a/target-ppc/cpu-qom.h
+++ b/target-ppc/cpu-qom.h
@@ -56,7 +56,7 @@ typedef struct PowerPCCPUClass {
     void (*parent_reset)(CPUState *cpu);
 
     uint32_t pvr;
-    uint32_t pvr_mask;
+    bool (*pvr_match)(struct PowerPCCPUClass *pcc, uint32_t pvr);
     uint64_t pcr_mask;
     uint32_t svr;
     uint64_t insns_flags;
diff --git a/target-ppc/translate_init.c b/target-ppc/translate_init.c
index 7b4d9be..2c9c277 100644
--- a/target-ppc/translate_init.c
+++ b/target-ppc/translate_init.c
@@ -8062,6 +8062,17 @@ static void init_proc_POWER7 (CPUPPCState *env)
     init_proc_book3s_64(env, BOOK3S_CPU_POWER7);
 }
 
+static bool ppc_pvr_match_power7(PowerPCCPUClass *pcc, uint32_t pvr)
+{
+    if ((pvr & CPU_POWERPC_POWER_SERVER_MASK) == CPU_POWERPC_POWER7P_BASE) {
+        return true;
+    }
+    if ((pvr & CPU_POWERPC_POWER_SERVER_MASK) == CPU_POWERPC_POWER7_BASE) {
+        return true;
+    }
+    return false;
+}
+
 POWERPC_FAMILY(POWER7)(ObjectClass *oc, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
@@ -8070,8 +8081,7 @@ POWERPC_FAMILY(POWER7)(ObjectClass *oc, void *data)
     dc->fw_name = "PowerPC,POWER7";
     dc->desc = "POWER7";
     dc->props = powerpc_servercpu_properties;
-    pcc->pvr = CPU_POWERPC_POWER7_BASE;
-    pcc->pvr_mask = CPU_POWERPC_POWER7_MASK;
+    pcc->pvr_match = ppc_pvr_match_power7;
     pcc->pcr_mask = PCR_COMPAT_2_05 | PCR_COMPAT_2_06;
     pcc->init_proc = init_proc_POWER7;
     pcc->check_pow = check_pow_nocheck;
@@ -8131,8 +8141,7 @@ POWERPC_FAMILY(POWER7P)(ObjectClass *oc, void *data)
     dc->fw_name = "PowerPC,POWER7+";
     dc->desc = "POWER7+";
     dc->props = powerpc_servercpu_properties;
-    pcc->pvr = CPU_POWERPC_POWER7P_BASE;
-    pcc->pvr_mask = CPU_POWERPC_POWER7P_MASK;
+    pcc->pvr_match = ppc_pvr_match_power7;
     pcc->pcr_mask = PCR_COMPAT_2_05 | PCR_COMPAT_2_06;
     pcc->init_proc = init_proc_POWER7;
     pcc->check_pow = check_pow_nocheck;
@@ -8189,6 +8198,17 @@ static void init_proc_POWER8(CPUPPCState *env)
     init_proc_book3s_64(env, BOOK3S_CPU_POWER8);
 }
 
+static bool ppc_pvr_match_power8(PowerPCCPUClass *pcc, uint32_t pvr)
+{
+    if ((pvr & CPU_POWERPC_POWER_SERVER_MASK) == CPU_POWERPC_POWER8E_BASE) {
+        return true;
+    }
+    if ((pvr & CPU_POWERPC_POWER_SERVER_MASK) == CPU_POWERPC_POWER8_BASE) {
+        return true;
+    }
+    return false;
+}
+
 POWERPC_FAMILY(POWER8E)(ObjectClass *oc, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
@@ -8197,8 +8217,7 @@ POWERPC_FAMILY(POWER8E)(ObjectClass *oc, void *data)
     dc->fw_name = "PowerPC,POWER8";
     dc->desc = "POWER8E";
     dc->props = powerpc_servercpu_properties;
-    pcc->pvr = CPU_POWERPC_POWER8E_BASE;
-    pcc->pvr_mask = CPU_POWERPC_POWER8E_MASK;
+    pcc->pvr_match = ppc_pvr_match_power8;
     pcc->pcr_mask = PCR_COMPAT_2_05 | PCR_COMPAT_2_06;
     pcc->init_proc = init_proc_POWER8;
     pcc->check_pow = check_pow_nocheck;
@@ -8256,13 +8275,10 @@ POWERPC_FAMILY(POWER8E)(ObjectClass *oc, void *data)
 POWERPC_FAMILY(POWER8)(ObjectClass *oc, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
-    PowerPCCPUClass *pcc = POWERPC_CPU_CLASS(oc);
 
     ppc_POWER8E_cpu_family_class_init(oc, data);
 
     dc->desc = "POWER8";
-    pcc->pvr = CPU_POWERPC_POWER8_BASE;
-    pcc->pvr_mask = CPU_POWERPC_POWER8_MASK;
 }
 #endif /* defined (TARGET_PPC64) */
 
@@ -9245,7 +9261,6 @@ static gint ppc_cpu_compare_class_pvr_mask(gconstpointer a, gconstpointer b)
     ObjectClass *oc = (ObjectClass *)a;
     uint32_t pvr = *(uint32_t *)b;
     PowerPCCPUClass *pcc = (PowerPCCPUClass *)a;
-    gint ret;
 
     /* -cpu host does a PVR lookup during construction */
     if (unlikely(strcmp(object_class_get_name(oc),
@@ -9257,9 +9272,11 @@ static gint ppc_cpu_compare_class_pvr_mask(gconstpointer a, gconstpointer b)
         return -1;
     }
 
-    ret = (((pcc->pvr & pcc->pvr_mask) == (pvr & pcc->pvr_mask)) ? 0 : -1);
+    if (pcc->pvr_match(pcc, pvr)) {
+        return 0;
+    }
 
-    return ret;
+    return -1;
 }
 
 PowerPCCPUClass *ppc_cpu_class_by_pvr_mask(uint32_t pvr)
@@ -9660,6 +9677,11 @@ static void ppc_cpu_initfn(Object *obj)
     }
 }
 
+static bool ppc_pvr_match_default(PowerPCCPUClass *pcc, uint32_t pvr)
+{
+    return pcc->pvr == pvr;
+}
+
 static void ppc_cpu_class_init(ObjectClass *oc, void *data)
 {
     PowerPCCPUClass *pcc = POWERPC_CPU_CLASS(oc);
@@ -9667,8 +9689,7 @@ static void ppc_cpu_class_init(ObjectClass *oc, void *data)
     DeviceClass *dc = DEVICE_CLASS(oc);
 
     pcc->parent_realize = dc->realize;
-    pcc->pvr = CPU_POWERPC_DEFAULT_MASK;
-    pcc->pvr_mask = CPU_POWERPC_DEFAULT_MASK;
+    pcc->pvr_match = ppc_pvr_match_default;
     pcc->interrupts_big_endian = ppc_cpu_interrupts_big_endian_always;
     dc->realize = ppc_cpu_realizefn;
     dc->unrealize = ppc_cpu_unrealizefn;
commit d6c23f8a1b0d3ffdd7e826e1d555b519645257d9
Author: Alexey Kardashevskiy <aik at ozlabs.ru>
Date:   Thu Jul 3 23:25:56 2014 +1000

    pseries: Update SLOF firmware image to qemu-slof-20140630
    
    The changelog is:
      > Quieten the grub warning
      > Add boot menu support
      > boot from disk having chrp-boot file
      > fat16: fix read and remove debug messages
      > dhcparch define missing in compilation
      > pci-scan: reserve memory for pci-bridge without devices
      > pci-bridge: Fix ranges when no device beyond the bridge
      > Set dhcp arch in board-qemu config file
      > xhci: fix controller stop
      > dhcp: support client architecture code 93
      > virtio-blk: support variable block size
      > usb: use common pci dma alloc/mapping routines
      > Remove unused SLOF code
      > pci-bridge: generic bridge needs to support pci dma functions
      > pci: extract dma functions as separate file
      > e1000: fix usage of multiple nics
    
    Signed-off-by: Alexey Kardashevskiy <aik at ozlabs.ru>
    Signed-off-by: Alexander Graf <agraf at suse.de>

diff --git a/pc-bios/README b/pc-bios/README
index 49cdacf..edfadd7 100644
--- a/pc-bios/README
+++ b/pc-bios/README
@@ -17,7 +17,7 @@
 - SLOF (Slimline Open Firmware) is a free IEEE 1275 Open Firmware
   implementation for certain IBM POWER hardware.  The sources are at
   https://github.com/aik/SLOF, and the image currently in qemu is
-  built from git tag qemu-slof-20140404.
+  built from git tag qemu-slof-20140630.
 
 - sgabios (the Serial Graphics Adapter option ROM) provides a means for
   legacy x86 software to communicate with an attached serial console as
diff --git a/pc-bios/slof.bin b/pc-bios/slof.bin
index 972e012..69b0a5d 100644
Binary files a/pc-bios/slof.bin and b/pc-bios/slof.bin differ
diff --git a/roms/SLOF b/roms/SLOF
index c90b50b..f284ab3 160000
--- a/roms/SLOF
+++ b/roms/SLOF
@@ -1 +1 @@
-Subproject commit c90b50b5055f976a0da3c032f26fb80157292adc
+Subproject commit f284ab3f03ae69a20e1ae966f6ddf76da33cbf72
commit da89a1cf92be6c195ff35afd253a11b427a152c3
Author: Alexander Graf <agraf at suse.de>
Date:   Wed Jul 2 19:09:47 2014 +0200

    PPC: Fix booke206 TLB with phys addrs > 32bit
    
    We were truncating physical addresses to 32bit when using qemu-system-ppc
    with a booke206 TLB implementation. This patch fixes that and makes the full
    address space available.
    
    Signed-off-by: Alexander Graf <agraf at suse.de>

diff --git a/target-ppc/mmu_helper.c b/target-ppc/mmu_helper.c
index 4d6b1e2..4a34a73 100644
--- a/target-ppc/mmu_helper.c
+++ b/target-ppc/mmu_helper.c
@@ -897,10 +897,10 @@ static hwaddr booke206_tlb_to_page_size(CPUPPCState *env,
 
 /* TLB check function for MAS based SoftTLBs */
 static int ppcmas_tlb_check(CPUPPCState *env, ppcmas_tlb_t *tlb,
-                            hwaddr *raddrp,
-                     target_ulong address, uint32_t pid)
+                            hwaddr *raddrp, target_ulong address,
+                            uint32_t pid)
 {
-    target_ulong mask;
+    hwaddr mask;
     uint32_t tlb_pid;
 
     if (!msr_cm) {
commit be5c9ddabc25f73b619974027f7894d8cb8a2c82
Author: Richard Henderson <rth at twiddle.net>
Date:   Sat Jun 28 09:45:28 2014 -0700

    target-ppc: Fix gdbstub for ppc64le-linux-user
    
    The bswap that's needed for system mode isn't required for
    user mode, and in fact breaks debugging.
    
    Signed-off-by: Richard Henderson <rth at twiddle.net>
    [agraf: fix apple gdbstub implementation]
    Signed-off-by: Alexander Graf <agraf at suse.de>

diff --git a/target-ppc/gdbstub.c b/target-ppc/gdbstub.c
index 694d303..14675f4 100644
--- a/target-ppc/gdbstub.c
+++ b/target-ppc/gdbstub.c
@@ -83,16 +83,24 @@ static int ppc_gdb_register_len(int n)
     }
 }
 
-
-static void ppc_gdb_swap_register(uint8_t *mem_buf, int n, int len)
+/* We need to present the registers to gdb in the "current" memory ordering.
+   For user-only mode we get this for free; TARGET_WORDS_BIGENDIAN is set to
+   the proper ordering for the binary, and cannot be changed.
+   For system mode, TARGET_WORDS_BIGENDIAN is always set, and we must check
+   the current mode of the chip to see if we're running in little-endian.  */
+static void maybe_bswap_register(CPUPPCState *env, uint8_t *mem_buf, int len)
 {
-    if (len == 4) {
+#ifndef CONFIG_USER_ONLY
+    if (!msr_le) {
+        /* do nothing */
+    } else if (len == 4) {
         bswap32s((uint32_t *)mem_buf);
     } else if (len == 8) {
         bswap64s((uint64_t *)mem_buf);
     } else {
         g_assert_not_reached();
     }
+#endif
 }
 
 /* Old gdb always expects FP registers.  Newer (xml-aware) gdb only
@@ -150,10 +158,7 @@ int ppc_cpu_gdb_read_register(CPUState *cs, uint8_t *mem_buf, int n)
             break;
         }
     }
-    if (msr_le) {
-        /* If cpu is in LE mode, convert memory contents to LE. */
-        ppc_gdb_swap_register(mem_buf, n, r);
-    }
+    maybe_bswap_register(env, mem_buf, r);
     return r;
 }
 
@@ -209,10 +214,7 @@ int ppc_cpu_gdb_read_register_apple(CPUState *cs, uint8_t *mem_buf, int n)
             break;
         }
     }
-    if (msr_le) {
-        /* If cpu is in LE mode, convert memory contents to LE. */
-        ppc_gdb_swap_register(mem_buf, n, r);
-    }
+    maybe_bswap_register(env, mem_buf, r);
     return r;
 }
 
@@ -225,10 +227,7 @@ int ppc_cpu_gdb_write_register(CPUState *cs, uint8_t *mem_buf, int n)
     if (!r) {
         return r;
     }
-    if (msr_le) {
-        /* If cpu is in LE mode, convert memory contents to LE. */
-        ppc_gdb_swap_register(mem_buf, n, r);
-    }
+    maybe_bswap_register(env, mem_buf, r);
     if (n < 32) {
         /* gprs */
         env->gpr[n] = ldtul_p(mem_buf);
@@ -278,10 +277,7 @@ int ppc_cpu_gdb_write_register_apple(CPUState *cs, uint8_t *mem_buf, int n)
     if (!r) {
         return r;
     }
-    if (msr_le) {
-        /* If cpu is in LE mode, convert memory contents to LE. */
-        ppc_gdb_swap_register(mem_buf, n, r);
-    }
+    maybe_bswap_register(env, mem_buf, r);
     if (n < 32) {
         /* gprs */
         env->gpr[n] = ldq_p(mem_buf);
commit a74029f6cbce43074793dc30534fb6b3aeab7584
Author: Richard Henderson <rth at twiddle.net>
Date:   Sat Jun 28 09:45:27 2014 -0700

    target-ppc: Change default cpu for ppc64le-linux-user
    
    The default, 970fx, doesn't support MSR_LE.  So even though we set LE in
    ppc_cpu_reset, it gets cleared again in hreg_store_msr.  Error out if a
    user-selected cpu model doesn't support LE.
    
    Signed-off-by: Richard Henderson <rth at twiddle.net>
    [agraf: switch to POWER7 as default for BE and LE]
    Signed-off-by: Alexander Graf <agraf at suse.de>

diff --git a/linux-user/main.c b/linux-user/main.c
index 900a17f..b453a39 100644
--- a/linux-user/main.c
+++ b/linux-user/main.c
@@ -3901,11 +3901,11 @@ int main(int argc, char **argv, char **envp)
 #elif defined TARGET_OPENRISC
         cpu_model = "or1200";
 #elif defined(TARGET_PPC)
-#ifdef TARGET_PPC64
-        cpu_model = "970fx";
-#else
+# ifdef TARGET_PPC64
+        cpu_model = "POWER7";
+# else
         cpu_model = "750";
-#endif
+# endif
 #else
         cpu_model = "any";
 #endif
diff --git a/target-ppc/translate_init.c b/target-ppc/translate_init.c
index 2ab2810..7b4d9be 100644
--- a/target-ppc/translate_init.c
+++ b/target-ppc/translate_init.c
@@ -9551,6 +9551,10 @@ static void ppc_cpu_reset(CPUState *s)
 #endif
 #if !defined(TARGET_WORDS_BIGENDIAN)
     msr |= (target_ulong)1 << MSR_LE; /* Little-endian user mode */
+    if (!((env->msr_mask >> MSR_LE) & 1)) {
+        fprintf(stderr, "Selected CPU does not support little-endian.\n");
+        exit(1);
+    }
 #endif
 #endif
 
commit 4bce526ec4b88362a684fd858e0e14c83ddf0db4
Author: Laurent Dufour <ldufour at linux.vnet.ibm.com>
Date:   Fri Jun 27 15:47:37 2014 +0200

    target-ppc: KVMPPC_H_CAS fix cpu-version endianess
    
    During KVMPPC_H_CAS processing, the cpu-version updated value is stored
    without taking care of the current endianess. As a consequence, the guest
    may not switch to the right CPU model, leading to unexpected results.
    
    If needed, the value is now converted.
    
    Fixes: 6d9412ea8132 ("target-ppc: Implement "compat" CPU option")
    Signed-off-by: Laurent Dufour <ldufour at linux.vnet.ibm.com>
    Reviewed-by: Greg Kurz <gkurz at linux.vnet.ibm.com>
    Signed-off-by: Alexander Graf <agraf at suse.de>

diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
index a8ba916..a23c0f0 100644
--- a/hw/ppc/spapr.c
+++ b/hw/ppc/spapr.c
@@ -160,8 +160,7 @@ static int spapr_fixup_cpu_smt_dt(void *fdt, int offset, PowerPCCPU *cpu,
     int index = ppc_get_vcpu_dt_id(cpu);
 
     if (cpu->cpu_version) {
-        ret = fdt_setprop(fdt, offset, "cpu-version",
-                          &cpu->cpu_version, sizeof(cpu->cpu_version));
+        ret = fdt_setprop_cell(fdt, offset, "cpu-version", cpu->cpu_version);
         if (ret < 0) {
             return ret;
         }
commit 128f0e66149afb2dfc325dfd183aac345f417763
Merge: c6ea9b7 ee0f260
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Mon Jul 7 19:06:55 2014 +0100

    Merge remote-tracking branch 'remotes/afaerber/tags/prep-for-2.1' into staging
    
    PowerPC Reference Platform (PReP)
    
    * Update OpenHack'Ware firmware to replace QEMU-side workarounds
    
    # gpg: Signature made Mon 07 Jul 2014 15:49:42 BST using RSA key ID 3E7E013F
    # gpg: Good signature from "Andreas Färber <afaerber at suse.de>"
    # gpg:                 aka "Andreas Färber <afaerber at suse.com>"
    
    * remotes/afaerber/tags/prep-for-2.1:
      prep: Update ppc_rom.bin
      prep: Remove CPU reset entry point hack related to OpenHack'Ware
      prep: Remove PCI memory hack related to OpenHack'Ware
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>

commit c6ea9b73b12054ec96973d8b6bb7bf27f7d126cb
Merge: 9540d1f 3f0838a
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Mon Jul 7 16:30:14 2014 +0100

    Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into staging
    
    pc,vhost,virtio fixes, test
    
    Bugfixes all over the place.
    
    There's a  non bugfix here: re-enabling the vhost-user test,
    though the patch just brings back functionality that
    I disabled earlier to fix mingw build failures.
    This is now sorted, and keeping the unit test enabled
    seems important since the feature relies on an external
    server to work, so isn't easy to test.
    
    Signed-off-by: Michael S. Tsirkin <mst at redhat.com>
    
    # gpg: Signature made Sun 06 Jul 2014 11:01:35 BST using RSA key ID D28D5469
    # gpg: Good signature from "Michael S. Tsirkin <mst at kernel.org>"
    # gpg:                 aka "Michael S. Tsirkin <mst at redhat.com>"
    
    * remotes/mst/tags/for_upstream:
      qemu-char: add chr_add_watch support in mux chardev
      virtio-pci: fix MSI memory region use after free
      qdev: Fix crash when using non-device class name on -global
      qdev: Don't abort() in case globals can't be set
      hw/virtio: enable common virtio feature for mmio device
      acpi: fix typo in memory hotplug MMIO region name
      pci: assign devfn to pci_dev before calling pci_device_iommu_address_space()
      Handle G_IO_HUP in tcp_chr_read for tcp chardev
      virtio: move common virtio properties to bus class device
      pc-dimm: error out if memory hotplug is not enabled
      numa: check for busy memory backend
      qtest: enable vhost-user-test
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>

commit ee0f2601b911e53e27827cc105d194bb311e6224
Author: Andreas Färber <andreas.faerber at web.de>
Date:   Fri Jul 4 17:35:32 2014 +0200

    prep: Update ppc_rom.bin
    
    This replaces QEMU-side workarounds for PCI BARs and CPU reset.
    
    Signed-off-by: Andreas Färber <andreas.faerber at web.de>

diff --git a/pc-bios/ppc_rom.bin b/pc-bios/ppc_rom.bin
index e7f7693..174a247 100644
Binary files a/pc-bios/ppc_rom.bin and b/pc-bios/ppc_rom.bin differ
diff --git a/roms/openhackware b/roms/openhackware
index 1af7e55..c559da7 160000
--- a/roms/openhackware
+++ b/roms/openhackware
@@ -1 +1 @@
-Subproject commit 1af7e55425e58a6dcb5133b092fcf16f8c654fb9
+Subproject commit c559da7c8eec5e45ef1f67978827af6f0b9546f5
commit 56de2e52693aac6ce2cfbf80a8be6ae75660f58c
Author: Hervé Poussineau <hpoussin at reactos.org>
Date:   Tue Apr 1 23:19:16 2014 +0200

    prep: Remove CPU reset entry point hack related to OpenHack'Ware
    
    Signed-off-by: Hervé Poussineau <hpoussin at reactos.org>
    Signed-off-by: Andreas Färber <andreas.faerber at web.de>

diff --git a/hw/ppc/prep.c b/hw/ppc/prep.c
index 567f56e..aa8717d 100644
--- a/hw/ppc/prep.c
+++ b/hw/ppc/prep.c
@@ -346,9 +346,6 @@ static void ppc_prep_reset(void *opaque)
     PowerPCCPU *cpu = opaque;
 
     cpu_reset(CPU(cpu));
-
-    /* Reset address */
-    cpu->env.nip = 0xfffffffc;
 }
 
 static const MemoryRegionPortio prep_portio_list[] = {
commit 97db046678822baf9ec3cb9430ec47ed87d0c89e
Author: Hervé Poussineau <hpoussin at reactos.org>
Date:   Tue Apr 1 23:19:15 2014 +0200

    prep: Remove PCI memory hack related to OpenHack'Ware
    
    Signed-off-by: Hervé Poussineau <hpoussin at reactos.org>
    Signed-off-by: Andreas Färber <andreas.faerber at web.de>

diff --git a/hw/pci-host/prep.c b/hw/pci-host/prep.c
index 4014540..ec6f186 100644
--- a/hw/pci-host/prep.c
+++ b/hw/pci-host/prep.c
@@ -256,9 +256,7 @@ static void raven_pcihost_initfn(Object *obj)
     memory_region_init(&s->pci_io, obj, "pci-io", 0x3f800000);
     memory_region_init_io(&s->pci_io_non_contiguous, obj, &raven_io_ops, s,
                           "pci-io-non-contiguous", 0x00800000);
-    /* Open Hack'Ware hack: real size should be only 0x3f000000 bytes */
-    memory_region_init(&s->pci_memory, obj, "pci-memory",
-                       0x3f000000 + 0xc0000000ULL);
+    memory_region_init(&s->pci_memory, obj, "pci-memory", 0x3f000000);
     address_space_init(&s->pci_io_as, &s->pci_io, "raven-io");
 
     /* CPU address space */
diff --git a/hw/ppc/prep.c b/hw/ppc/prep.c
index 2383254..567f56e 100644
--- a/hw/ppc/prep.c
+++ b/hw/ppc/prep.c
@@ -382,7 +382,6 @@ static void ppc_prep_init(MachineState *machine)
 #endif
     int linux_boot, i, nb_nics1;
     MemoryRegion *ram = g_new(MemoryRegion, 1);
-    MemoryRegion *vga = g_new(MemoryRegion, 1);
     uint32_t kernel_base, initrd_base;
     long kernel_size, initrd_size;
     DeviceState *dev;
@@ -508,14 +507,6 @@ static void ppc_prep_init(MachineState *machine)
 
     /* init basic PC hardware */
     pci_vga_init(pci_bus);
-    /* Open Hack'Ware hack: PCI BAR#0 is programmed to 0xf0000000.
-     * While bios will access framebuffer at 0xf0000000, real physical
-     * address is 0xf0000000 + 0xc0000000 (PCI memory base).
-     * Alias the wrong memory accesses to the right place.
-     */
-    memory_region_init_alias(vga, NULL, "vga-alias", pci_address_space(pci),
-                             0xf0000000, 0x1000000);
-    memory_region_add_subregion_overlap(sysmem, 0xf0000000, vga, 10);
 
     nb_nics1 = nb_nics;
     if (nb_nics1 > NE2000_NB_MAX)
commit 9540d1f8d9b4b974af2fd359d7c642f09fc6f44d
Merge: f811d47 f4eb32b
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Mon Jul 7 15:02:36 2014 +0100

    Merge remote-tracking branch 'remotes/stefanha/tags/block-pull-request' into staging
    
    Block pull request
    
    # gpg: Signature made Mon 07 Jul 2014 13:27:20 BST using RSA key ID 81AB73C8
    # gpg: Good signature from "Stefan Hajnoczi <stefanha at redhat.com>"
    # gpg:                 aka "Stefan Hajnoczi <stefanha at gmail.com>"
    
    * remotes/stefanha/tags/block-pull-request:
      qmp: show QOM properties in device-list-properties
      dataplane: submit I/O as a batch
      linux-aio: implement io plug, unplug and flush io queue
      block: block: introduce APIs for submitting IO as a batch
      ahci: map memory via device's address space instead of address_space_memory
      raw-posix: Fix raw_getlength() to always return -errno on error
      qemu-iotests: Disable Quorum testing in 041 when Quorum is not builtin
      ahci.c: mask unused flags when reading size PRDT DBC
      MAINTAINERS: add Stefan Hajnoczi to IDE maintainers
      mirror: Fix qiov size for short requests
      Fix nocow typos in manpage
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>

commit f811d4743b358bc53a8c79576c903c0dbee29e72
Merge: 9d9de25 643f593
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Mon Jul 7 13:43:03 2014 +0100

    Merge remote-tracking branch 'remotes/sstabellini/xen_arm_20140707' into staging
    
    * remotes/sstabellini/xen_arm_20140707:
      xen: build on ARM
      xen_backend: introduce xenstore_read_uint64 and xenstore_read_fe_uint64
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>

commit 643f59322432d77165329dfabe2d040d7e30dae8
Author: Stefano Stabellini <stefano.stabellini at eu.citrix.com>
Date:   Wed Dec 18 19:17:32 2013 +0000

    xen: build on ARM
    
    Collection of fixes to build QEMU with Xen support on ARM:
    - use xenstore_read_fe_uint64 to retrieve the page-ref (xenfb);
    - use xen_pfn_t instead of unsigned long in xenfb;
    - unsigned long/xenpfn_t in xen_remove_from_physmap;
    - in xen-mapcache.c use HOST_LONG_BITS to check for QEMU's address space
    size.
    
    Signed-off-by: Stefano Stabellini <stefano.stabellini at eu.citrix.com>
    Reviewed-by: Peter Maydell <peter.maydell at linaro.org>

diff --git a/hw/display/xenfb.c b/hw/display/xenfb.c
index 032eb7a..07ddc9d 100644
--- a/hw/display/xenfb.c
+++ b/hw/display/xenfb.c
@@ -93,10 +93,12 @@ struct XenFB {
 
 static int common_bind(struct common *c)
 {
-    int mfn;
+    uint64_t mfn;
 
-    if (xenstore_read_fe_int(&c->xendev, "page-ref", &mfn) == -1)
+    if (xenstore_read_fe_uint64(&c->xendev, "page-ref", &mfn) == -1)
 	return -1;
+    assert(mfn == (xen_pfn_t)mfn);
+
     if (xenstore_read_fe_int(&c->xendev, "event-channel", &c->xendev.remote_port) == -1)
 	return -1;
 
@@ -107,7 +109,7 @@ static int common_bind(struct common *c)
 	return -1;
 
     xen_be_bind_evtchn(&c->xendev);
-    xen_be_printf(&c->xendev, 1, "ring mfn %d, remote-port %d, local-port %d\n",
+    xen_be_printf(&c->xendev, 1, "ring mfn %"PRIx64", remote-port %d, local-port %d\n",
 		  mfn, c->xendev.remote_port, c->xendev.local_port);
 
     return 0;
@@ -409,7 +411,7 @@ static void input_event(struct XenDevice *xendev)
 
 /* -------------------------------------------------------------------- */
 
-static void xenfb_copy_mfns(int mode, int count, unsigned long *dst, void *src)
+static void xenfb_copy_mfns(int mode, int count, xen_pfn_t *dst, void *src)
 {
     uint32_t *src32 = src;
     uint64_t *src64 = src;
@@ -424,8 +426,8 @@ static int xenfb_map_fb(struct XenFB *xenfb)
     struct xenfb_page *page = xenfb->c.page;
     char *protocol = xenfb->c.xendev.protocol;
     int n_fbdirs;
-    unsigned long *pgmfns = NULL;
-    unsigned long *fbmfns = NULL;
+    xen_pfn_t *pgmfns = NULL;
+    xen_pfn_t *fbmfns = NULL;
     void *map, *pd;
     int mode, ret = -1;
 
@@ -483,8 +485,8 @@ static int xenfb_map_fb(struct XenFB *xenfb)
     n_fbdirs = xenfb->fbpages * mode / 8;
     n_fbdirs = (n_fbdirs + (XC_PAGE_SIZE - 1)) / XC_PAGE_SIZE;
 
-    pgmfns = g_malloc0(sizeof(unsigned long) * n_fbdirs);
-    fbmfns = g_malloc0(sizeof(unsigned long) * xenfb->fbpages);
+    pgmfns = g_malloc0(sizeof(xen_pfn_t) * n_fbdirs);
+    fbmfns = g_malloc0(sizeof(xen_pfn_t) * xenfb->fbpages);
 
     xenfb_copy_mfns(mode, n_fbdirs, pgmfns, pd);
     map = xc_map_foreign_pages(xen_xc, xenfb->c.xendev.dom,
diff --git a/xen-hvm.c b/xen-hvm.c
index bafdf12..c928b36 100644
--- a/xen-hvm.c
+++ b/xen-hvm.c
@@ -390,7 +390,7 @@ static int xen_remove_from_physmap(XenIOState *state,
     start_addr >>= TARGET_PAGE_BITS;
     phys_offset >>= TARGET_PAGE_BITS;
     for (i = 0; i < size; i++) {
-        unsigned long idx = start_addr + i;
+        xen_pfn_t idx = start_addr + i;
         xen_pfn_t gpfn = phys_offset + i;
 
         rc = xc_domain_add_to_physmap(xen_xc, xen_domid, XENMAPSPACE_gmfn, idx, gpfn);
diff --git a/xen-mapcache.c b/xen-mapcache.c
index eda914a..66da1a6 100644
--- a/xen-mapcache.c
+++ b/xen-mapcache.c
@@ -33,10 +33,10 @@
 #  define DPRINTF(fmt, ...) do { } while (0)
 #endif
 
-#if defined(__i386__)
+#if HOST_LONG_BITS == 32
 #  define MCACHE_BUCKET_SHIFT 16
 #  define MCACHE_MAX_SIZE     (1UL<<31) /* 2GB Cap */
-#elif defined(__x86_64__)
+#else
 #  define MCACHE_BUCKET_SHIFT 20
 #  define MCACHE_MAX_SIZE     (1UL<<35) /* 32GB Cap */
 #endif
commit 4aba9eb138e5d68c400de0b116f15217d7a92d3a
Author: Stefano Stabellini <stefano.stabellini at eu.citrix.com>
Date:   Wed Dec 18 19:17:31 2013 +0000

    xen_backend: introduce xenstore_read_uint64 and xenstore_read_fe_uint64
    
    Signed-off-by: Stefano Stabellini <stefano.stabellini at eu.citrix.com>
    Reviewed-by: Peter Maydell <peter.maydell at linaro.org>

diff --git a/hw/xen/xen_backend.c b/hw/xen/xen_backend.c
index 3cd45b4..b2cb22b 100644
--- a/hw/xen/xen_backend.c
+++ b/hw/xen/xen_backend.c
@@ -111,6 +111,19 @@ int xenstore_read_int(const char *base, const char *node, int *ival)
     return rc;
 }
 
+int xenstore_read_uint64(const char *base, const char *node, uint64_t *uval)
+{
+    char *val;
+    int rc = -1;
+
+    val = xenstore_read_str(base, node);
+    if (val && 1 == sscanf(val, "%"SCNu64, uval)) {
+        rc = 0;
+    }
+    g_free(val);
+    return rc;
+}
+
 int xenstore_write_be_str(struct XenDevice *xendev, const char *node, const char *val)
 {
     return xenstore_write_str(xendev->be, node, val);
@@ -146,6 +159,11 @@ int xenstore_read_fe_int(struct XenDevice *xendev, const char *node, int *ival)
     return xenstore_read_int(xendev->fe, node, ival);
 }
 
+int xenstore_read_fe_uint64(struct XenDevice *xendev, const char *node, uint64_t *uval)
+{
+    return xenstore_read_uint64(xendev->fe, node, uval);
+}
+
 /* ------------------------------------------------------------- */
 
 const char *xenbus_strstate(enum xenbus_state state)
diff --git a/include/hw/xen/xen_backend.h b/include/hw/xen/xen_backend.h
index 3b7d96d..3b4125e 100644
--- a/include/hw/xen/xen_backend.h
+++ b/include/hw/xen/xen_backend.h
@@ -74,6 +74,8 @@ char *xenstore_read_be_str(struct XenDevice *xendev, const char *node);
 int xenstore_read_be_int(struct XenDevice *xendev, const char *node, int *ival);
 char *xenstore_read_fe_str(struct XenDevice *xendev, const char *node);
 int xenstore_read_fe_int(struct XenDevice *xendev, const char *node, int *ival);
+int xenstore_read_uint64(const char *base, const char *node, uint64_t *uval);
+int xenstore_read_fe_uint64(struct XenDevice *xendev, const char *node, uint64_t *uval);
 
 const char *xenbus_strstate(enum xenbus_state state);
 struct XenDevice *xen_be_find_xendev(const char *type, int dom, int dev);
commit f4eb32b590bf58c1c67570775eb78beb09964fad
Author: Stefan Hajnoczi <stefanha at redhat.com>
Date:   Tue May 20 14:29:01 2014 +0200

    qmp: show QOM properties in device-list-properties
    
    Devices can use a mix of qdev and QOM properties.  Currently only the
    qdev properties are displayed by device-list-properties.
    
    This patch extends the property enumeration algorithm to also display
    QOM properties (excluding the implicit "type", "realized",
    "hotpluggable", and "parent_bus" properties).
    
    When a qdev property exists, use the qdev type name to preserve
    backwards compatibility.  QOM type names can be different for bool (qdev
    on/off) and str (used by qdev pointers).
    
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/qmp.c b/qmp.c
index dca6efb..0d2553a 100644
--- a/qmp.c
+++ b/qmp.c
@@ -433,11 +433,57 @@ ObjectTypeInfoList *qmp_qom_list_types(bool has_implements,
     return ret;
 }
 
+/* Return a DevicePropertyInfo for a qdev property.
+ *
+ * If a qdev property with the given name does not exist, use the given default
+ * type.  If the qdev property info should not be shown, return NULL.
+ *
+ * The caller must free the return value.
+ */
+static DevicePropertyInfo *make_device_property_info(ObjectClass *klass,
+                                                     const char *name,
+                                                     const char *default_type)
+{
+    DevicePropertyInfo *info;
+    Property *prop;
+
+    do {
+        for (prop = DEVICE_CLASS(klass)->props; prop && prop->name; prop++) {
+            if (strcmp(name, prop->name) != 0) {
+                continue;
+            }
+
+            /*
+             * TODO Properties without a parser are just for dirty hacks.
+             * qdev_prop_ptr is the only such PropertyInfo.  It's marked
+             * for removal.  This conditional should be removed along with
+             * it.
+             */
+            if (!prop->info->set) {
+                return NULL;           /* no way to set it, don't show */
+            }
+
+            info = g_malloc0(sizeof(*info));
+            info->name = g_strdup(prop->name);
+            info->type = g_strdup(prop->info->legacy_name ?: prop->info->name);
+            return info;
+        }
+        klass = object_class_get_parent(klass);
+    } while (klass != object_class_by_name(TYPE_DEVICE));
+
+    /* Not a qdev property, use the default type */
+    info = g_malloc0(sizeof(*info));
+    info->name = g_strdup(name);
+    info->type = g_strdup(default_type);
+    return info;
+}
+
 DevicePropertyInfoList *qmp_device_list_properties(const char *typename,
                                                    Error **errp)
 {
     ObjectClass *klass;
-    Property *prop;
+    Object *obj;
+    ObjectProperty *prop;
     DevicePropertyInfoList *prop_list = NULL;
 
     klass = object_class_by_name(typename);
@@ -453,32 +499,39 @@ DevicePropertyInfoList *qmp_device_list_properties(const char *typename,
         return NULL;
     }
 
-    do {
-        for (prop = DEVICE_CLASS(klass)->props; prop && prop->name; prop++) {
-            DevicePropertyInfoList *entry;
-            DevicePropertyInfo *info;
+    obj = object_new(typename);
 
-            /*
-             * TODO Properties without a parser are just for dirty hacks.
-             * qdev_prop_ptr is the only such PropertyInfo.  It's marked
-             * for removal.  This conditional should be removed along with
-             * it.
-             */
-            if (!prop->info->set) {
-                continue;           /* no way to set it, don't show */
-            }
+    QTAILQ_FOREACH(prop, &obj->properties, node) {
+        DevicePropertyInfo *info;
+        DevicePropertyInfoList *entry;
+
+        /* Skip Object and DeviceState properties */
+        if (strcmp(prop->name, "type") == 0 ||
+            strcmp(prop->name, "realized") == 0 ||
+            strcmp(prop->name, "hotpluggable") == 0 ||
+            strcmp(prop->name, "parent_bus") == 0) {
+            continue;
+        }
 
-            info = g_malloc0(sizeof(*info));
-            info->name = g_strdup(prop->name);
-            info->type = g_strdup(prop->info->legacy_name ?: prop->info->name);
+        /* Skip legacy properties since they are just string versions of
+         * properties that we already list.
+         */
+        if (strstart(prop->name, "legacy-", NULL)) {
+            continue;
+        }
 
-            entry = g_malloc0(sizeof(*entry));
-            entry->value = info;
-            entry->next = prop_list;
-            prop_list = entry;
+        info = make_device_property_info(klass, prop->name, prop->type);
+        if (!info) {
+            continue;
         }
-        klass = object_class_get_parent(klass);
-    } while (klass != object_class_by_name(TYPE_DEVICE));
+
+        entry = g_malloc0(sizeof(*entry));
+        entry->value = info;
+        entry->next = prop_list;
+        prop_list = entry;
+    }
+
+    object_unref(obj);
 
     return prop_list;
 }
commit dd67c1d7e75151e2c058ccdd2162643074357442
Author: Ming Lei <ming.lei at canonical.com>
Date:   Fri Jul 4 18:04:35 2014 +0800

    dataplane: submit I/O as a batch
    
    Before commit 580b6b2aa2(dataplane: use the QEMU block
    layer for I/O), dataplane for virtio-blk submits block
    I/O as a batch.
    
    This commit 580b6b2aa2 replaces the custom linux AIO
    implementation(including submit I/O as a batch) with QEMU
    block layer, but this commit causes ~40% throughput regression
    on virtio-blk performance, and removing submitting I/O
    as a batch is one of the causes.
    
    This patch applies the newly introduced bdrv_io_plug() and
    bdrv_io_unplug() interfaces to support submitting I/O
    at batch for Qemu block layer, and in my test, the change
    can improve throughput by ~30% with 'aio=native'.
    
    Following my fio test script:
    
    	[global]
    	direct=1
    	size=4G
    	bsrange=4k-4k
    	timeout=40
    	numjobs=4
    	ioengine=libaio
    	iodepth=64
    	filename=/dev/vdc
    	group_reporting=1
    
    	[f]
    	rw=randread
    
    Result on one of my small machine(host: x86_64, 2cores, 4thread, guest: 4cores):
    	- qemu master: 65K IOPS
    	- qemu master with these patches: 92K IOPS
    	- 2.0.0 release(dataplane using custom linux aio): 104K IOPS
    
    Reviewed-by: Paolo Bonzini <pbonzini at redhat.com>
    Signed-off-by: Ming Lei <ming.lei at canonical.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/hw/block/dataplane/virtio-blk.c b/hw/block/dataplane/virtio-blk.c
index 4c5ba18..4bc0729 100644
--- a/hw/block/dataplane/virtio-blk.c
+++ b/hw/block/dataplane/virtio-blk.c
@@ -84,6 +84,7 @@ static void handle_notify(EventNotifier *e)
     };
 
     event_notifier_test_and_clear(&s->host_notifier);
+    bdrv_io_plug(s->blk->conf.bs);
     for (;;) {
         /* Disable guest->host notifies to avoid unnecessary vmexits */
         vring_disable_notification(s->vdev, &s->vring);
@@ -117,6 +118,7 @@ static void handle_notify(EventNotifier *e)
             break;
         }
     }
+    bdrv_io_unplug(s->blk->conf.bs);
 }
 
 /* Context: QEMU global mutex held */
commit 1b3abdcccf18d98c3952b41be0bc1db3ef6009dd
Author: Ming Lei <ming.lei at canonical.com>
Date:   Fri Jul 4 18:04:34 2014 +0800

    linux-aio: implement io plug, unplug and flush io queue
    
    This patch implements .bdrv_io_plug, .bdrv_io_unplug and
    .bdrv_flush_io_queue callbacks for linux-aio Block Drivers,
    so that submitting I/O as a batch can be supported on linux-aio.
    
    [Unprocessed requests are completed with -EIO instead of a bogus ret
    value.
    --Stefan]
    
    Signed-off-by: Ming Lei <ming.lei at canonical.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/block/linux-aio.c b/block/linux-aio.c
index f0a2c08..4867369 100644
--- a/block/linux-aio.c
+++ b/block/linux-aio.c
@@ -25,6 +25,8 @@
  */
 #define MAX_EVENTS 128
 
+#define MAX_QUEUED_IO  128
+
 struct qemu_laiocb {
     BlockDriverAIOCB common;
     struct qemu_laio_state *ctx;
@@ -36,9 +38,19 @@ struct qemu_laiocb {
     QLIST_ENTRY(qemu_laiocb) node;
 };
 
+typedef struct {
+    struct iocb *iocbs[MAX_QUEUED_IO];
+    int plugged;
+    unsigned int size;
+    unsigned int idx;
+} LaioQueue;
+
 struct qemu_laio_state {
     io_context_t ctx;
     EventNotifier e;
+
+    /* io queue for submit at batch */
+    LaioQueue io_q;
 };
 
 static inline ssize_t io_event_ret(struct io_event *ev)
@@ -135,6 +147,79 @@ static const AIOCBInfo laio_aiocb_info = {
     .cancel             = laio_cancel,
 };
 
+static void ioq_init(LaioQueue *io_q)
+{
+    io_q->size = MAX_QUEUED_IO;
+    io_q->idx = 0;
+    io_q->plugged = 0;
+}
+
+static int ioq_submit(struct qemu_laio_state *s)
+{
+    int ret, i = 0;
+    int len = s->io_q.idx;
+
+    do {
+        ret = io_submit(s->ctx, len, s->io_q.iocbs);
+    } while (i++ < 3 && ret == -EAGAIN);
+
+    /* empty io queue */
+    s->io_q.idx = 0;
+
+    if (ret < 0) {
+        i = 0;
+    } else {
+        i = ret;
+    }
+
+    for (; i < len; i++) {
+        struct qemu_laiocb *laiocb =
+            container_of(s->io_q.iocbs[i], struct qemu_laiocb, iocb);
+
+        laiocb->ret = (ret < 0) ? ret : -EIO;
+        qemu_laio_process_completion(s, laiocb);
+    }
+    return ret;
+}
+
+static void ioq_enqueue(struct qemu_laio_state *s, struct iocb *iocb)
+{
+    unsigned int idx = s->io_q.idx;
+
+    s->io_q.iocbs[idx++] = iocb;
+    s->io_q.idx = idx;
+
+    /* submit immediately if queue is full */
+    if (idx == s->io_q.size) {
+        ioq_submit(s);
+    }
+}
+
+void laio_io_plug(BlockDriverState *bs, void *aio_ctx)
+{
+    struct qemu_laio_state *s = aio_ctx;
+
+    s->io_q.plugged++;
+}
+
+int laio_io_unplug(BlockDriverState *bs, void *aio_ctx, bool unplug)
+{
+    struct qemu_laio_state *s = aio_ctx;
+    int ret = 0;
+
+    assert(s->io_q.plugged > 0 || !unplug);
+
+    if (unplug && --s->io_q.plugged > 0) {
+        return 0;
+    }
+
+    if (s->io_q.idx > 0) {
+        ret = ioq_submit(s);
+    }
+
+    return ret;
+}
+
 BlockDriverAIOCB *laio_submit(BlockDriverState *bs, void *aio_ctx, int fd,
         int64_t sector_num, QEMUIOVector *qiov, int nb_sectors,
         BlockDriverCompletionFunc *cb, void *opaque, int type)
@@ -168,8 +253,13 @@ BlockDriverAIOCB *laio_submit(BlockDriverState *bs, void *aio_ctx, int fd,
     }
     io_set_eventfd(&laiocb->iocb, event_notifier_get_fd(&s->e));
 
-    if (io_submit(s->ctx, 1, &iocbs) < 0)
-        goto out_free_aiocb;
+    if (!s->io_q.plugged) {
+        if (io_submit(s->ctx, 1, &iocbs) < 0) {
+            goto out_free_aiocb;
+        }
+    } else {
+        ioq_enqueue(s, iocbs);
+    }
     return &laiocb->common;
 
 out_free_aiocb:
@@ -204,6 +294,8 @@ void *laio_init(void)
         goto out_close_efd;
     }
 
+    ioq_init(&s->io_q);
+
     return s;
 
 out_close_efd:
diff --git a/block/raw-aio.h b/block/raw-aio.h
index 8cf084e..e18c975 100644
--- a/block/raw-aio.h
+++ b/block/raw-aio.h
@@ -40,6 +40,8 @@ BlockDriverAIOCB *laio_submit(BlockDriverState *bs, void *aio_ctx, int fd,
         BlockDriverCompletionFunc *cb, void *opaque, int type);
 void laio_detach_aio_context(void *s, AioContext *old_context);
 void laio_attach_aio_context(void *s, AioContext *new_context);
+void laio_io_plug(BlockDriverState *bs, void *aio_ctx);
+int laio_io_unplug(BlockDriverState *bs, void *aio_ctx, bool unplug);
 #endif
 
 #ifdef _WIN32
diff --git a/block/raw-posix.c b/block/raw-posix.c
index fa005b3..a857def 100644
--- a/block/raw-posix.c
+++ b/block/raw-posix.c
@@ -1057,6 +1057,36 @@ static BlockDriverAIOCB *raw_aio_submit(BlockDriverState *bs,
                        cb, opaque, type);
 }
 
+static void raw_aio_plug(BlockDriverState *bs)
+{
+#ifdef CONFIG_LINUX_AIO
+    BDRVRawState *s = bs->opaque;
+    if (s->use_aio) {
+        laio_io_plug(bs, s->aio_ctx);
+    }
+#endif
+}
+
+static void raw_aio_unplug(BlockDriverState *bs)
+{
+#ifdef CONFIG_LINUX_AIO
+    BDRVRawState *s = bs->opaque;
+    if (s->use_aio) {
+        laio_io_unplug(bs, s->aio_ctx, true);
+    }
+#endif
+}
+
+static void raw_aio_flush_io_queue(BlockDriverState *bs)
+{
+#ifdef CONFIG_LINUX_AIO
+    BDRVRawState *s = bs->opaque;
+    if (s->use_aio) {
+        laio_io_unplug(bs, s->aio_ctx, false);
+    }
+#endif
+}
+
 static BlockDriverAIOCB *raw_aio_readv(BlockDriverState *bs,
         int64_t sector_num, QEMUIOVector *qiov, int nb_sectors,
         BlockDriverCompletionFunc *cb, void *opaque)
@@ -1544,6 +1574,9 @@ static BlockDriver bdrv_file = {
     .bdrv_aio_flush = raw_aio_flush,
     .bdrv_aio_discard = raw_aio_discard,
     .bdrv_refresh_limits = raw_refresh_limits,
+    .bdrv_io_plug = raw_aio_plug,
+    .bdrv_io_unplug = raw_aio_unplug,
+    .bdrv_flush_io_queue = raw_aio_flush_io_queue,
 
     .bdrv_truncate = raw_truncate,
     .bdrv_getlength = raw_getlength,
@@ -1943,6 +1976,9 @@ static BlockDriver bdrv_host_device = {
     .bdrv_aio_flush	= raw_aio_flush,
     .bdrv_aio_discard   = hdev_aio_discard,
     .bdrv_refresh_limits = raw_refresh_limits,
+    .bdrv_io_plug = raw_aio_plug,
+    .bdrv_io_unplug = raw_aio_unplug,
+    .bdrv_flush_io_queue = raw_aio_flush_io_queue,
 
     .bdrv_truncate      = raw_truncate,
     .bdrv_getlength	= raw_getlength,
@@ -2088,6 +2124,9 @@ static BlockDriver bdrv_host_floppy = {
     .bdrv_aio_writev    = raw_aio_writev,
     .bdrv_aio_flush	= raw_aio_flush,
     .bdrv_refresh_limits = raw_refresh_limits,
+    .bdrv_io_plug = raw_aio_plug,
+    .bdrv_io_unplug = raw_aio_unplug,
+    .bdrv_flush_io_queue = raw_aio_flush_io_queue,
 
     .bdrv_truncate      = raw_truncate,
     .bdrv_getlength      = raw_getlength,
@@ -2216,6 +2255,9 @@ static BlockDriver bdrv_host_cdrom = {
     .bdrv_aio_writev    = raw_aio_writev,
     .bdrv_aio_flush	= raw_aio_flush,
     .bdrv_refresh_limits = raw_refresh_limits,
+    .bdrv_io_plug = raw_aio_plug,
+    .bdrv_io_unplug = raw_aio_unplug,
+    .bdrv_flush_io_queue = raw_aio_flush_io_queue,
 
     .bdrv_truncate      = raw_truncate,
     .bdrv_getlength      = raw_getlength,
@@ -2350,6 +2392,9 @@ static BlockDriver bdrv_host_cdrom = {
     .bdrv_aio_writev    = raw_aio_writev,
     .bdrv_aio_flush	= raw_aio_flush,
     .bdrv_refresh_limits = raw_refresh_limits,
+    .bdrv_io_plug = raw_aio_plug,
+    .bdrv_io_unplug = raw_aio_unplug,
+    .bdrv_flush_io_queue = raw_aio_flush_io_queue,
 
     .bdrv_truncate      = raw_truncate,
     .bdrv_getlength      = raw_getlength,
commit 448ad91db4a560c01f89bd6f7e4bec7d869926a5
Author: Ming Lei <ming.lei at canonical.com>
Date:   Fri Jul 4 18:04:33 2014 +0800

    block: block: introduce APIs for submitting IO as a batch
    
    This patch introduces three APIs so that following
    patches can support queuing I/O requests and submitting them
    as a batch for improving I/O performance.
    
    Reviewed-by: Paolo Bonzini <pbonzini at redhat.com>
    Signed-off-by: Ming Lei <ming.lei at canonical.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/block.c b/block.c
index f80e2b2..8800a6b 100644
--- a/block.c
+++ b/block.c
@@ -1905,6 +1905,7 @@ void bdrv_drain_all(void)
             bool bs_busy;
 
             aio_context_acquire(aio_context);
+            bdrv_flush_io_queue(bs);
             bdrv_start_throttled_reqs(bs);
             bs_busy = bdrv_requests_pending(bs);
             bs_busy |= aio_poll(aio_context, bs_busy);
@@ -5782,3 +5783,33 @@ BlockDriverState *check_to_replace_node(const char *node_name, Error **errp)
 
     return to_replace_bs;
 }
+
+void bdrv_io_plug(BlockDriverState *bs)
+{
+    BlockDriver *drv = bs->drv;
+    if (drv && drv->bdrv_io_plug) {
+        drv->bdrv_io_plug(bs);
+    } else if (bs->file) {
+        bdrv_io_plug(bs->file);
+    }
+}
+
+void bdrv_io_unplug(BlockDriverState *bs)
+{
+    BlockDriver *drv = bs->drv;
+    if (drv && drv->bdrv_io_unplug) {
+        drv->bdrv_io_unplug(bs);
+    } else if (bs->file) {
+        bdrv_io_unplug(bs->file);
+    }
+}
+
+void bdrv_flush_io_queue(BlockDriverState *bs)
+{
+    BlockDriver *drv = bs->drv;
+    if (drv && drv->bdrv_flush_io_queue) {
+        drv->bdrv_flush_io_queue(bs);
+    } else if (bs->file) {
+        bdrv_flush_io_queue(bs->file);
+    }
+}
diff --git a/include/block/block.h b/include/block/block.h
index baecc26..32d3676 100644
--- a/include/block/block.h
+++ b/include/block/block.h
@@ -584,4 +584,8 @@ AioContext *bdrv_get_aio_context(BlockDriverState *bs);
  */
 void bdrv_set_aio_context(BlockDriverState *bs, AioContext *new_context);
 
+void bdrv_io_plug(BlockDriverState *bs);
+void bdrv_io_unplug(BlockDriverState *bs);
+void bdrv_flush_io_queue(BlockDriverState *bs);
+
 #endif
diff --git a/include/block/block_int.h b/include/block/block_int.h
index 8f8e65e..f6c3bef 100644
--- a/include/block/block_int.h
+++ b/include/block/block_int.h
@@ -261,6 +261,11 @@ struct BlockDriver {
     void (*bdrv_attach_aio_context)(BlockDriverState *bs,
                                     AioContext *new_context);
 
+    /* io queue for linux-aio */
+    void (*bdrv_io_plug)(BlockDriverState *bs);
+    void (*bdrv_io_unplug)(BlockDriverState *bs);
+    void (*bdrv_flush_io_queue)(BlockDriverState *bs);
+
     QLIST_ENTRY(BlockDriver) list;
 };
 
commit 5a18e67dfd515992076c5fcae47035fdd3ed2462
Author: Le Tan <tamlokveer at gmail.com>
Date:   Thu Jul 3 16:26:27 2014 +0800

    ahci: map memory via device's address space instead of address_space_memory
    
    In map_page() in hw/ide/ahci.c, replace cpu_physical_memory_map() and
    cpu_physical_memory_unmap() with dma_memory_map() and dma_memory_unmap(),
    because ahci devices should not access memory directly but via their address
    space. Add an AddressSpace parameter to map_page(). In order to call
    map_page(), we should pass the AHCIState.as as the AddressSpace argument.
    
    Signed-off-by: Le Tan <tamlokveer at gmail.com>
    Reviewed-by: Michael S. Tsirkin <mst at redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/hw/ide/ahci.c b/hw/ide/ahci.c
index cd140d1..604152a 100644
--- a/hw/ide/ahci.c
+++ b/hw/ide/ahci.c
@@ -175,17 +175,18 @@ static void ahci_trigger_irq(AHCIState *s, AHCIDevice *d,
     ahci_check_irq(s);
 }
 
-static void map_page(uint8_t **ptr, uint64_t addr, uint32_t wanted)
+static void map_page(AddressSpace *as, uint8_t **ptr, uint64_t addr,
+                     uint32_t wanted)
 {
     hwaddr len = wanted;
 
     if (*ptr) {
-        cpu_physical_memory_unmap(*ptr, len, 1, len);
+        dma_memory_unmap(as, *ptr, len, DMA_DIRECTION_FROM_DEVICE, len);
     }
 
-    *ptr = cpu_physical_memory_map(addr, &len, 1);
+    *ptr = dma_memory_map(as, addr, &len, DMA_DIRECTION_FROM_DEVICE);
     if (len < wanted) {
-        cpu_physical_memory_unmap(*ptr, len, 1, len);
+        dma_memory_unmap(as, *ptr, len, DMA_DIRECTION_FROM_DEVICE, len);
         *ptr = NULL;
     }
 }
@@ -198,24 +199,24 @@ static void  ahci_port_write(AHCIState *s, int port, int offset, uint32_t val)
     switch (offset) {
         case PORT_LST_ADDR:
             pr->lst_addr = val;
-            map_page(&s->dev[port].lst,
+            map_page(s->as, &s->dev[port].lst,
                      ((uint64_t)pr->lst_addr_hi << 32) | pr->lst_addr, 1024);
             s->dev[port].cur_cmd = NULL;
             break;
         case PORT_LST_ADDR_HI:
             pr->lst_addr_hi = val;
-            map_page(&s->dev[port].lst,
+            map_page(s->as, &s->dev[port].lst,
                      ((uint64_t)pr->lst_addr_hi << 32) | pr->lst_addr, 1024);
             s->dev[port].cur_cmd = NULL;
             break;
         case PORT_FIS_ADDR:
             pr->fis_addr = val;
-            map_page(&s->dev[port].res_fis,
+            map_page(s->as, &s->dev[port].res_fis,
                      ((uint64_t)pr->fis_addr_hi << 32) | pr->fis_addr, 256);
             break;
         case PORT_FIS_ADDR_HI:
             pr->fis_addr_hi = val;
-            map_page(&s->dev[port].res_fis,
+            map_page(s->as, &s->dev[port].res_fis,
                      ((uint64_t)pr->fis_addr_hi << 32) | pr->fis_addr, 256);
             break;
         case PORT_IRQ_STAT:
@@ -1265,9 +1266,9 @@ static int ahci_state_post_load(void *opaque, int version_id)
         ad = &s->dev[i];
         AHCIPortRegs *pr = &ad->port_regs;
 
-        map_page(&ad->lst,
+        map_page(s->as, &ad->lst,
                  ((uint64_t)pr->lst_addr_hi << 32) | pr->lst_addr, 1024);
-        map_page(&ad->res_fis,
+        map_page(s->as, &ad->res_fis,
                  ((uint64_t)pr->fis_addr_hi << 32) | pr->fis_addr, 256);
         /*
          * All pending i/o should be flushed out on a migrate. However,
commit aa729704f48331787d0afac510df214aedda2843
Author: Markus Armbruster <armbru at redhat.com>
Date:   Thu Jun 26 13:23:16 2014 +0200

    raw-posix: Fix raw_getlength() to always return -errno on error
    
    We got a merry mix of -1 and -errno here.
    
    Signed-off-by: Markus Armbruster <armbru at redhat.com>
    Reviewed-by: Eric Blake <eblake at redhat.com>
    Reviewed-by: Benoit Canet <benoit at irqsave.net>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/block/raw-posix.c b/block/raw-posix.c
index 825a0c8..fa005b3 100644
--- a/block/raw-posix.c
+++ b/block/raw-posix.c
@@ -1133,12 +1133,12 @@ static int64_t raw_getlength(BlockDriverState *bs)
     struct stat st;
 
     if (fstat(fd, &st))
-        return -1;
+        return -errno;
     if (S_ISCHR(st.st_mode) || S_ISBLK(st.st_mode)) {
         struct disklabel dl;
 
         if (ioctl(fd, DIOCGDINFO, &dl))
-            return -1;
+            return -errno;
         return (uint64_t)dl.d_secsize *
             dl.d_partitions[DISKPART(st.st_rdev)].p_size;
     } else
@@ -1152,7 +1152,7 @@ static int64_t raw_getlength(BlockDriverState *bs)
     struct stat st;
 
     if (fstat(fd, &st))
-        return -1;
+        return -errno;
     if (S_ISCHR(st.st_mode) || S_ISBLK(st.st_mode)) {
         struct dkwedge_info dkw;
 
@@ -1162,7 +1162,7 @@ static int64_t raw_getlength(BlockDriverState *bs)
             struct disklabel dl;
 
             if (ioctl(fd, DIOCGDINFO, &dl))
-                return -1;
+                return -errno;
             return (uint64_t)dl.d_secsize *
                 dl.d_partitions[DISKPART(st.st_rdev)].p_size;
         }
@@ -1175,6 +1175,7 @@ static int64_t raw_getlength(BlockDriverState *bs)
     BDRVRawState *s = bs->opaque;
     struct dk_minfo minfo;
     int ret;
+    int64_t size;
 
     ret = fd_open(bs);
     if (ret < 0) {
@@ -1193,7 +1194,11 @@ static int64_t raw_getlength(BlockDriverState *bs)
      * There are reports that lseek on some devices fails, but
      * irc discussion said that contingency on contingency was overkill.
      */
-    return lseek(s->fd, 0, SEEK_END);
+    size = lseek(s->fd, 0, SEEK_END);
+    if (size < 0) {
+        return -errno;
+    }
+    return size;
 }
 #elif defined(CONFIG_BSD)
 static int64_t raw_getlength(BlockDriverState *bs)
@@ -1231,6 +1236,9 @@ again:
         size = LLONG_MAX;
 #else
         size = lseek(fd, 0LL, SEEK_END);
+        if (size < 0) {
+            return -errno;
+        }
 #endif
 #if defined(__FreeBSD__) || defined(__FreeBSD_kernel__)
         switch(s->type) {
@@ -1247,6 +1255,9 @@ again:
 #endif
     } else {
         size = lseek(fd, 0, SEEK_END);
+        if (size < 0) {
+            return -errno;
+        }
     }
     return size;
 }
@@ -1255,13 +1266,18 @@ static int64_t raw_getlength(BlockDriverState *bs)
 {
     BDRVRawState *s = bs->opaque;
     int ret;
+    int64_t size;
 
     ret = fd_open(bs);
     if (ret < 0) {
         return ret;
     }
 
-    return lseek(s->fd, 0, SEEK_END);
+    size = lseek(s->fd, 0, SEEK_END);
+    if (size < 0) {
+        return -errno;
+    }
+    return size;
 }
 #endif
 
commit a42a1facb77fb0e3db9a416922de13d9ab66c26a
Author: Benoît Canet <benoit.canet at irqsave.net>
Date:   Tue Jul 1 13:34:12 2014 +0200

    qemu-iotests: Disable Quorum testing in 041 when Quorum is not builtin
    
    This avoid breaking tests on RHEL6 where gnutls is too old for quorum to be
    built by default.
    
    Signed-off-by: Benoit Canet <benoit at irqsave.net>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/tests/qemu-iotests/041 b/tests/qemu-iotests/041
index 005090e..5dbd4ee 100755
--- a/tests/qemu-iotests/041
+++ b/tests/qemu-iotests/041
@@ -740,6 +740,9 @@ class TestRepairQuorum(ImageMirroringTestCase):
     image_len = 1 * 1024 * 1024 # MB
     IMAGES = [ quorum_img1, quorum_img2, quorum_img3 ]
 
+    def has_quorum(self):
+        return 'quorum' in iotests.qemu_img_pipe('--help')
+
     def setUp(self):
         self.vm = iotests.VM()
 
@@ -757,8 +760,9 @@ class TestRepairQuorum(ImageMirroringTestCase):
         #assemble the quorum block device from the individual files
         args = { "options" : { "driver": "quorum", "id": "quorum0",
                  "vote-threshold": 2, "children": [ "img0", "img1", "img2" ] } }
-        result = self.vm.qmp("blockdev-add", **args)
-        self.assert_qmp(result, 'return', {})
+        if self.has_quorum():
+            result = self.vm.qmp("blockdev-add", **args)
+            self.assert_qmp(result, 'return', {})
 
 
     def tearDown(self):
@@ -771,6 +775,9 @@ class TestRepairQuorum(ImageMirroringTestCase):
                 pass
 
     def test_complete(self):
+        if not self.has_quorum():
+            return
+
         self.assert_no_active_block_jobs()
 
         result = self.vm.qmp('drive-mirror', device='quorum0', sync='full',
@@ -789,6 +796,9 @@ class TestRepairQuorum(ImageMirroringTestCase):
                         'target image does not match source after mirroring')
 
     def test_cancel(self):
+        if not self.has_quorum():
+            return
+
         self.assert_no_active_block_jobs()
 
         result = self.vm.qmp('drive-mirror', device='quorum0', sync='full',
@@ -805,6 +815,9 @@ class TestRepairQuorum(ImageMirroringTestCase):
         self.vm.shutdown()
 
     def test_cancel_after_ready(self):
+        if not self.has_quorum():
+            return
+
         self.assert_no_active_block_jobs()
 
         result = self.vm.qmp('drive-mirror', device='quorum0', sync='full',
@@ -823,6 +836,9 @@ class TestRepairQuorum(ImageMirroringTestCase):
                         'target image does not match source after mirroring')
 
     def test_pause(self):
+        if not self.has_quorum():
+            return
+
         self.assert_no_active_block_jobs()
 
         result = self.vm.qmp('drive-mirror', device='quorum0', sync='full',
@@ -851,6 +867,9 @@ class TestRepairQuorum(ImageMirroringTestCase):
                         'target image does not match source after mirroring')
 
     def test_medium_not_found(self):
+        if not self.has_quorum():
+            return
+
         result = self.vm.qmp('drive-mirror', device='ide1-cd0', sync='full',
                              node_name='repair0',
                              replaces='img1',
@@ -858,6 +877,9 @@ class TestRepairQuorum(ImageMirroringTestCase):
         self.assert_qmp(result, 'error/class', 'GenericError')
 
     def test_image_not_found(self):
+        if not self.has_quorum():
+            return
+
         result = self.vm.qmp('drive-mirror', device='quorum0', sync='full',
                              node_name='repair0',
                              replaces='img1',
@@ -866,6 +888,9 @@ class TestRepairQuorum(ImageMirroringTestCase):
         self.assert_qmp(result, 'error/class', 'GenericError')
 
     def test_device_not_found(self):
+        if not self.has_quorum():
+            return
+
         result = self.vm.qmp('drive-mirror', device='nonexistent', sync='full',
                              node_name='repair0',
                              replaces='img1',
@@ -873,6 +898,9 @@ class TestRepairQuorum(ImageMirroringTestCase):
         self.assert_qmp(result, 'error/class', 'DeviceNotFound')
 
     def test_wrong_sync_mode(self):
+        if not self.has_quorum():
+            return
+
         result = self.vm.qmp('drive-mirror', device='quorum0',
                              node_name='repair0',
                              replaces='img1',
@@ -880,12 +908,18 @@ class TestRepairQuorum(ImageMirroringTestCase):
         self.assert_qmp(result, 'error/class', 'GenericError')
 
     def test_no_node_name(self):
+        if not self.has_quorum():
+            return
+
         result = self.vm.qmp('drive-mirror', device='quorum0', sync='full',
                              replaces='img1',
                              target=quorum_repair_img, format=iotests.imgfmt)
         self.assert_qmp(result, 'error/class', 'GenericError')
 
     def test_unexistant_replaces(self):
+        if not self.has_quorum():
+            return
+
         result = self.vm.qmp('drive-mirror', device='quorum0', sync='full',
                              node_name='repair0',
                              replaces='img77',
@@ -893,6 +927,9 @@ class TestRepairQuorum(ImageMirroringTestCase):
         self.assert_qmp(result, 'error/class', 'GenericError')
 
     def test_after_a_quorum_snapshot(self):
+        if not self.has_quorum():
+            return
+
         result = self.vm.qmp('blockdev-snapshot-sync', node_name='img1',
                              snapshot_file=quorum_snapshot_file,
                              snapshot_node_name="snap1");
commit d02f8adc6d2a178bcbf77d0413f9a96fdbed53f0
Author: Reza Jelveh <reza.jelveh at tuhh.de>
Date:   Tue Jul 1 13:13:27 2014 +0200

    ahci.c: mask unused flags when reading size PRDT DBC
    
    The data byte count(DBC) read from the description information is defined for
    bits 21:00. Bits 30:22 are reserved and bit 31 is the Interrupt on Completion
    (I) flag.
    
    Completion interrupts are triggered after every transaction instead of on
    I-flag in QEMU. tbl_entry_size is a signed integer and improperly reading the
    DBC leads to a negative offset that causes sglist allocation to fail.
    
    Signed-off-by: Reza Jelveh <reza.jelveh at tuhh.de>
    Reviewed-by: Alexander Graf <agraf at suse.de>
    Reviewed-by: Kevin Wolf <kwolf at redhat.com>
    Reviewed-by: John Snow <jsnow at redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/hw/ide/ahci.c b/hw/ide/ahci.c
index 9bae22e..cd140d1 100644
--- a/hw/ide/ahci.c
+++ b/hw/ide/ahci.c
@@ -639,6 +639,11 @@ static void ahci_write_fis_d2h(AHCIDevice *ad, uint8_t *cmd_fis)
     }
 }
 
+static int prdt_tbl_entry_size(const AHCI_SG *tbl)
+{
+    return (le32_to_cpu(tbl->flags_size) & AHCI_PRDT_SIZE_MASK) + 1;
+}
+
 static int ahci_populate_sglist(AHCIDevice *ad, QEMUSGList *sglist, int offset)
 {
     AHCICmdHdr *cmd = ad->cur_cmd;
@@ -681,7 +686,7 @@ static int ahci_populate_sglist(AHCIDevice *ad, QEMUSGList *sglist, int offset)
         sum = 0;
         for (i = 0; i < sglist_alloc_hint; i++) {
             /* flags_size is zero-based */
-            tbl_entry_size = (le32_to_cpu(tbl[i].flags_size) + 1);
+            tbl_entry_size = prdt_tbl_entry_size(&tbl[i]);
             if (offset <= (sum + tbl_entry_size)) {
                 off_idx = i;
                 off_pos = offset - sum;
@@ -700,12 +705,12 @@ static int ahci_populate_sglist(AHCIDevice *ad, QEMUSGList *sglist, int offset)
         qemu_sglist_init(sglist, qbus->parent, (sglist_alloc_hint - off_idx),
                          ad->hba->as);
         qemu_sglist_add(sglist, le64_to_cpu(tbl[off_idx].addr + off_pos),
-                        le32_to_cpu(tbl[off_idx].flags_size) + 1 - off_pos);
+                        prdt_tbl_entry_size(&tbl[off_idx]) - off_pos);
 
         for (i = off_idx + 1; i < sglist_alloc_hint; i++) {
             /* flags_size is zero-based */
             qemu_sglist_add(sglist, le64_to_cpu(tbl[i].addr),
-                            le32_to_cpu(tbl[i].flags_size) + 1);
+                            prdt_tbl_entry_size(&tbl[i]));
         }
     }
 
diff --git a/hw/ide/ahci.h b/hw/ide/ahci.h
index 9a4064f..f418b30 100644
--- a/hw/ide/ahci.h
+++ b/hw/ide/ahci.h
@@ -201,6 +201,8 @@
 
 #define AHCI_COMMAND_TABLE_ACMD            0x40
 
+#define AHCI_PRDT_SIZE_MASK                0x3fffff
+
 #define IDE_FEATURE_DMA                    1
 
 #define READ_FPDMA_QUEUED                  0x60
commit 37253e1ec898b167c5ff1fe63e14914bd35e28d9
Author: Stefan Hajnoczi <stefanha at redhat.com>
Date:   Tue Jul 1 14:04:31 2014 +0200

    MAINTAINERS: add Stefan Hajnoczi to IDE maintainers
    
    Make Stefan officially co-maintain hw/ide/ with Kevin.
    
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>
    Acked-by: Kevin Wolf <kwolf at redhat.com>

diff --git a/MAINTAINERS b/MAINTAINERS
index e7dc907..906f252 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -563,6 +563,7 @@ Devices
 -------
 IDE
 M: Kevin Wolf <kwolf at redhat.com>
+M: Stefan Hajnoczi <stefanha at redhat.com>
 S: Odd Fixes
 F: include/hw/ide.h
 F: hw/ide/
commit 5a0f6fd5c84573387056e0464a7fc0c6fb70b2dc
Author: Kevin Wolf <kwolf at redhat.com>
Date:   Tue Jul 1 16:52:21 2014 +0200

    mirror: Fix qiov size for short requests
    
    When mirroring an image of a size that is not a multiple of the
    mirror job granularity, the last request would have the right nb_sectors
    argument, but a qiov that is rounded up to the next multiple of the
    granularity. Don't do this.
    
    This fixes a segfault that is caused by raw-posix being confused by this
    and allocating a buffer with request length, but operating on it with
    qiov length.
    
    [s/Driver/Drive/ in qemu-iotests 041 as suggested by Eric
    --Stefan]
    
    Reported-by: Eric Blake <eblake at redhat.com>
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>
    Tested-by: Eric Blake <eblake at redhat.com>
    Reviewed-by: Eric Blake <eblake at redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/block/mirror.c b/block/mirror.c
index 6c3ee70..c7a655f 100644
--- a/block/mirror.c
+++ b/block/mirror.c
@@ -265,9 +265,11 @@ static uint64_t coroutine_fn mirror_iteration(MirrorBlockJob *s)
     next_sector = sector_num;
     while (nb_chunks-- > 0) {
         MirrorBuffer *buf = QSIMPLEQ_FIRST(&s->buf_free);
+        size_t remaining = (nb_sectors * BDRV_SECTOR_SIZE) - op->qiov.size;
+
         QSIMPLEQ_REMOVE_HEAD(&s->buf_free, next);
         s->buf_free_count--;
-        qemu_iovec_add(&op->qiov, buf, s->granularity);
+        qemu_iovec_add(&op->qiov, buf, MIN(s->granularity, remaining));
 
         /* Advance the HBitmapIter in parallel, so that we do not examine
          * the same sector twice.
diff --git a/tests/qemu-iotests/041 b/tests/qemu-iotests/041
index 0815e19..005090e 100755
--- a/tests/qemu-iotests/041
+++ b/tests/qemu-iotests/041
@@ -217,6 +217,11 @@ class TestSingleDriveZeroLength(TestSingleDrive):
     test_small_buffer2 = None
     test_large_cluster = None
 
+class TestSingleDriveUnalignedLength(TestSingleDrive):
+    image_len = 1025 * 1024
+    test_small_buffer2 = None
+    test_large_cluster = None
+
 class TestMirrorNoBacking(ImageMirroringTestCase):
     image_len = 2 * 1024 * 1024 # MB
 
diff --git a/tests/qemu-iotests/041.out b/tests/qemu-iotests/041.out
index 42147c0..24093bc 100644
--- a/tests/qemu-iotests/041.out
+++ b/tests/qemu-iotests/041.out
@@ -1,5 +1,5 @@
-..............................................
+......................................................
 ----------------------------------------------------------------------
-Ran 46 tests
+Ran 54 tests
 
 OK
commit bc3a7f90ff44037bbe898708081db23a08fa7189
Author: Chunyan Liu <cyliu at suse.com>
Date:   Wed Jul 2 12:27:29 2014 +0800

    Fix nocow typos in manpage
    
    Signed-off-by: Chunyan Liu <cyliu at suse.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/qemu-doc.texi b/qemu-doc.texi
index ad92c85..551619a 100644
--- a/qemu-doc.texi
+++ b/qemu-doc.texi
@@ -590,7 +590,7 @@ check -r all} is required, which may take some time.
 This option can only be enabled if @code{compat=1.1} is specified.
 
 @item nocow
-If this option is set to @code{on}, it will trun off COW of the file. It's only
+If this option is set to @code{on}, it will turn off COW of the file. It's only
 valid on btrfs, no effect on other file systems.
 
 Btrfs has low performance when hosting a VM image file, even more when the guest
@@ -603,7 +603,7 @@ does.
 Note: this option is only valid to new or empty files. If there is an existing
 file which is COW and has data blocks already, it couldn't be changed to NOCOW
 by setting @code{nocow=on}. One can issue @code{lsattr filename} to check if
-the NOCOW flag is set or not (Capitabl 'C' is NOCOW flag).
+the NOCOW flag is set or not (Capital 'C' is NOCOW flag).
 
 @end table
 
diff --git a/qemu-img.texi b/qemu-img.texi
index 8496f3b..514be90 100644
--- a/qemu-img.texi
+++ b/qemu-img.texi
@@ -475,7 +475,7 @@ check -r all} is required, which may take some time.
 This option can only be enabled if @code{compat=1.1} is specified.
 
 @item nocow
-If this option is set to @code{on}, it will trun off COW of the file. It's only
+If this option is set to @code{on}, it will turn off COW of the file. It's only
 valid on btrfs, no effect on other file systems.
 
 Btrfs has low performance when hosting a VM image file, even more when the guest
@@ -488,7 +488,7 @@ does.
 Note: this option is only valid to new or empty files. If there is an existing
 file which is COW and has data blocks already, it couldn't be changed to NOCOW
 by setting @code{nocow=on}. One can issue @code{lsattr filename} to check if
-the NOCOW flag is set or not (Capitabl 'C' is NOCOW flag).
+the NOCOW flag is set or not (Capital 'C' is NOCOW flag).
 
 @end table
 
commit 3f0838ab8557c6071a5931183b2d7fed568cd35c
Author: Kirill Batuzov <batuzovk at ispras.ru>
Date:   Fri Jul 4 16:43:15 2014 +0400

    qemu-char: add chr_add_watch support in mux chardev
    
    Forward chr_add_watch call from mux chardev to underlying
    implementation.
    
    This should fix bug #1335444
    
    Signed-off-by: Kirill Batuzov <batuzovk at ispras.ru>
    Acked-by: Paolo Bonzini <pbonzini at redhat.com>
    Acked-by: Michael S. Tsirkin <mst at redhat.com>
    Signed-off-by: Michael S. Tsirkin <mst at redhat.com>

diff --git a/qemu-char.c b/qemu-char.c
index 22a9777..55e372c 100644
--- a/qemu-char.c
+++ b/qemu-char.c
@@ -581,6 +581,12 @@ static Notifier muxes_realize_notify = {
     .notify = muxes_realize_done,
 };
 
+static GSource *mux_chr_add_watch(CharDriverState *s, GIOCondition cond)
+{
+    MuxDriver *d = s->opaque;
+    return d->drv->chr_add_watch(d->drv, cond);
+}
+
 static CharDriverState *qemu_chr_open_mux(CharDriverState *drv)
 {
     CharDriverState *chr;
@@ -597,6 +603,9 @@ static CharDriverState *qemu_chr_open_mux(CharDriverState *drv)
     chr->chr_accept_input = mux_chr_accept_input;
     /* Frontend guest-open / -close notification is not support with muxes */
     chr->chr_set_fe_open = NULL;
+    if (drv->chr_add_watch) {
+        chr->chr_add_watch = mux_chr_add_watch;
+    }
     /* only default to opened state if we've realized the initial
      * set of muxes
      */
commit 8b81bb3b069d4007bc44c8d5888d630b7f0b42ff
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Fri Jul 4 11:43:49 2014 +0200

    virtio-pci: fix MSI memory region use after free
    
    After memory region QOMification QEMU is stricter in detecting
    wrong usage of the memory region API.  Here it detected a
    memory_region_destroy done before the corresponding
    memory_region_del_subregion; the memory_region_destroy is
    done by msix_uninit_exclusive_bar, the memory_region_del_subregion
    is done by the PCI core's pci_unregister_io_regions before
    pc->exit is called.
    
    The problem was introduced by
    commit 06a1307379fcd6c551185ad87679cd7ed896b9ea
        virtio-pci: add device_unplugged callback
    As noted in that commit log, virtio device kick callbacks need to be
    stopped before generic virtio is cleaned up. This is because these are
    notifications from pci proxy to the generic virtio device so they need
    to be stopped in the unplug call before the virtio device is unrealized.
    However interrupts are notifications from the virtio device to
    the pci proxy so they need to stay around while the device
    is realized.
    
    The memory API misuse caused an assertion when hot-unplugging virtio
    devices.  Using the API correctly fixes the assertion.
    
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>
    Reviewed-by: Michael S. Tsirkin <mst at redhat.com>
    Signed-off-by: Michael S. Tsirkin <mst at redhat.com>

diff --git a/hw/virtio/virtio-pci.c b/hw/virtio/virtio-pci.c
index 7102728..3007319 100644
--- a/hw/virtio/virtio-pci.c
+++ b/hw/virtio/virtio-pci.c
@@ -1002,11 +1002,9 @@ static void virtio_pci_device_plugged(DeviceState *d)
 
 static void virtio_pci_device_unplugged(DeviceState *d)
 {
-    PCIDevice *pci_dev = PCI_DEVICE(d);
     VirtIOPCIProxy *proxy = VIRTIO_PCI(d);
 
     virtio_pci_stop_ioeventfd(proxy);
-    msix_uninit_exclusive_bar(pci_dev);
 }
 
 static int virtio_pci_init(PCIDevice *pci_dev)
@@ -1023,6 +1021,8 @@ static int virtio_pci_init(PCIDevice *pci_dev)
 static void virtio_pci_exit(PCIDevice *pci_dev)
 {
     VirtIOPCIProxy *proxy = VIRTIO_PCI(pci_dev);
+
+    msix_uninit_exclusive_bar(pci_dev);
     memory_region_destroy(&proxy->bar);
 }
 
commit dd98b71f4885814de9a64e7acc0e17b38ab7c38b
Author: Eduardo Habkost <ehabkost at redhat.com>
Date:   Thu Jul 3 16:45:35 2014 -0300

    qdev: Fix crash when using non-device class name on -global
    
    This fixes the following crash:
    
        $ qemu-system-x86_64 -global container.xxx=y
        hw/core/qdev-properties-system.c:399:qdev_add_one_global: Object 0x7f7eff234100 is not an instance of type device
        Aborted (core dumped)
    
    New behavior will be to just warn, just like when non-existing clas
    names are used:
    
        $ qemu-system-x86_64 -global container.xxx=y
        qemu-system-x86_64: Warning: "-global container.xxx=y" not used
    
    Signed-off-by: Eduardo Habkost <ehabkost at redhat.com>
    Reviewed-by: Michael S. Tsirkin <mst at redhat.com>
    Signed-off-by: Michael S. Tsirkin <mst at redhat.com>
    Signed-off-by: Eduardo Habkost <ehabkost at redhat.com>
    Tested-by: Don Slutz <dslutz at verizon.com>

diff --git a/hw/core/qdev-properties-system.c b/hw/core/qdev-properties-system.c
index 8e140af..ae0900f 100644
--- a/hw/core/qdev-properties-system.c
+++ b/hw/core/qdev-properties-system.c
@@ -394,7 +394,8 @@ static int qdev_add_one_global(QemuOpts *opts, void *opaque)
     g->driver   = qemu_opt_get(opts, "driver");
     g->property = qemu_opt_get(opts, "property");
     g->value    = qemu_opt_get(opts, "value");
-    oc = object_class_by_name(g->driver);
+    oc = object_class_dynamic_cast(object_class_by_name(g->driver),
+                                   TYPE_DEVICE);
     if (oc) {
         DeviceClass *dc = DEVICE_CLASS(oc);
 
commit 319627006a8f4c43b3618932ccac615c4662dfdc
Author: Eduardo Habkost <ehabkost at redhat.com>
Date:   Thu Jul 3 16:45:34 2014 -0300

    qdev: Don't abort() in case globals can't be set
    
    It would be much better if we didn't terminate QEMU inside
    device_post_init(), but at least exiting cleanly is better than aborting
    and dumping core.
    
    Before this patch:
    
        $ qemu-system-x86_64 -global cpu.xxx=y
        qemu-system-x86_64: Property '.xxx' not found
        Aborted (core dumped)
    
    After this patch:
    
        $ qemu-system-x86_64 -global cpu.xxx=y
        qemu-system-x86_64: Property '.xxx' not found
    
    Reviewed-by: Michael S. Tsirkin <mst at redhat.com>
    Reviewed-By: Igor Mammedov <imammedo at redhat.com>
    Signed-off-by: Eduardo Habkost <ehabkost at redhat.com>
    Reviewed-by: Michael S. Tsirkin <mst at redhat.com>
    Signed-off-by: Michael S. Tsirkin <mst at redhat.com>
    Reviewed-by: Michael S. Tsirkin <mst at redhat.com>
    Signed-off-by: Eduardo Habkost <ehabkost at redhat.com>

diff --git a/hw/core/qdev.c b/hw/core/qdev.c
index 3bdda8e..da1ba48 100644
--- a/hw/core/qdev.c
+++ b/hw/core/qdev.c
@@ -957,7 +957,13 @@ static void device_initfn(Object *obj)
 
 static void device_post_init(Object *obj)
 {
-    qdev_prop_set_globals(DEVICE(obj), &error_abort);
+    Error *err = NULL;
+    qdev_prop_set_globals(DEVICE(obj), &err);
+    if (err) {
+        qerror_report_err(err);
+        error_free(err);
+        exit(EXIT_FAILURE);
+    }
 }
 
 /* Unlink device from bus and free the structure.  */
commit b7c9285b8d60d1b235a2ef03d48168d372367c5a
Author: Ming Lei <ming.lei at canonical.com>
Date:   Wed Jun 4 10:05:55 2014 +0800

    hw/virtio: enable common virtio feature for mmio device
    
    Both 'indirect_desc' and 'event_idx' are bus independent features,
    and they should be enabled for mmio devices too.
    
    On arm64 quad core VM(qemu-kvm), the patch can increase block I/O
    performance a lot with latest linux tree:
            - without the patch: 14K IOPS
            - with the patch: 34K IOPS
    
    fio script:
            [global]
            direct=1
            bsrange=4k-4k
            timeout=10
            numjobs=4
            ioengine=libaio
            iodepth=64
    
            filename=/dev/vdc
            group_reporting=1
    
            [f1]
            rw=randread
    
    Cc: Peter Maydell <peter.maydell at linaro.org>
    Signed-off-by: Ming Lei <ming.lei at canonical.com>
    Acked-by: Michael S. Tsirkin <mst at redhat.com>
    Signed-off-by: Michael S. Tsirkin <mst at redhat.com>

diff --git a/hw/virtio/virtio-mmio.c b/hw/virtio/virtio-mmio.c
index 8829eb0..18c6e5b 100644
--- a/hw/virtio/virtio-mmio.c
+++ b/hw/virtio/virtio-mmio.c
@@ -369,10 +369,16 @@ static void virtio_mmio_realizefn(DeviceState *d, Error **errp)
     sysbus_init_mmio(sbd, &proxy->iomem);
 }
 
+static Property virtio_mmio_properties[] = {
+    DEFINE_VIRTIO_COMMON_FEATURES(VirtIOMMIOProxy, host_features),
+    DEFINE_PROP_END_OF_LIST(),
+};
+
 static void virtio_mmio_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
+    dc->props = virtio_mmio_properties;
     dc->realize = virtio_mmio_realizefn;
     dc->reset = virtio_mmio_reset;
     set_bit(DEVICE_CATEGORY_MISC, dc->categories);
commit 22dc50d75838e83b4bb05ae5554728be9f266e87
Author: Igor Mammedov <imammedo at redhat.com>
Date:   Wed Jul 2 11:16:33 2014 +0200

    acpi: fix typo in memory hotplug MMIO region name
    
    Reported-by: Sergey Fionov <fionov at gmail.com>
    Signed-off-by: Igor Mammedov <imammedo at redhat.com>
    Reviewed-by: Michael S. Tsirkin <mst at redhat.com>
    Signed-off-by: Michael S. Tsirkin <mst at redhat.com>
    Reviewed-by: Peter Crosthwaite <peter.crosthwaite at xilinx.com>

diff --git a/hw/acpi/memory_hotplug.c b/hw/acpi/memory_hotplug.c
index 38ca415..ed39241 100644
--- a/hw/acpi/memory_hotplug.c
+++ b/hw/acpi/memory_hotplug.c
@@ -159,7 +159,7 @@ void acpi_memory_hotplug_init(MemoryRegion *as, Object *owner,
 
     state->devs = g_malloc0(sizeof(*state->devs) * state->dev_count);
     memory_region_init_io(&state->io, owner, &acpi_memory_hotplug_ops, state,
-                          "apci-mem-hotplug", ACPI_MEMORY_HOTPLUG_IO_LEN);
+                          "acpi-mem-hotplug", ACPI_MEMORY_HOTPLUG_IO_LEN);
     memory_region_add_subregion(as, ACPI_MEMORY_HOTPLUG_BASE, &state->io);
 }
 
commit efc8188e9398e54567b238b756eec2cc746cd2a4
Author: Le Tan <tamlokveer at gmail.com>
Date:   Wed Jul 2 08:06:35 2014 +0800

    pci: assign devfn to pci_dev before calling pci_device_iommu_address_space()
    
    In function do_pci_register_device() in file hw/pci/pci.c, move the assignment
    of pci_dev->devfn to the position before the call to
    pci_device_iommu_address_space(pci_dev) which will use the value of
    pci_dev->devfn.
    
    Fixes: 9eda7d373e9c691c070eddcbe3467b991f67f6bd
        pci: Introduce helper to retrieve a PCI device's DMA address space
    
    Cc: qemu-stable at nongnu.org
    Signed-off-by: Le Tan <tamlokveer at gmail.com>
    Reviewed-by: Michael S. Tsirkin <mst at redhat.com>
    Signed-off-by: Michael S. Tsirkin <mst at redhat.com>

diff --git a/hw/pci/pci.c b/hw/pci/pci.c
index 17ed510..351d320 100644
--- a/hw/pci/pci.c
+++ b/hw/pci/pci.c
@@ -827,6 +827,7 @@ static PCIDevice *do_pci_register_device(PCIDevice *pci_dev, PCIBus *bus,
     }
 
     pci_dev->bus = bus;
+    pci_dev->devfn = devfn;
     dma_as = pci_device_iommu_address_space(pci_dev);
 
     memory_region_init_alias(&pci_dev->bus_master_enable_region,
@@ -836,7 +837,6 @@ static PCIDevice *do_pci_register_device(PCIDevice *pci_dev, PCIBus *bus,
     address_space_init(&pci_dev->bus_master_as, &pci_dev->bus_master_enable_region,
                        name);
 
-    pci_dev->devfn = devfn;
     pstrcpy(pci_dev->name, sizeof(pci_dev->name), name);
     pci_dev->irq_state = 0;
     pci_config_alloc(pci_dev);
commit 812c1057f6175ac9a9829fa2920a2b5783814193
Author: Kirill Batuzov <batuzovk at ispras.ru>
Date:   Tue Jul 1 15:52:32 2014 +0400

    Handle G_IO_HUP in tcp_chr_read for tcp chardev
    
    Since commit cdaa86a54b232572bba594bf87a7416e527e460c
    ("Add G_IO_HUP handler for socket chardev")
    GLib limitation results in a bug on Windows host. Steps to reproduce:
    
    Start qemu: qemu-system-i386 -qmp tcp:127.0.0.1:4444:server:nowait
    Connect with telnet: telnet 127.0.0.1 4444
    Try sending some data from telnet.
    Expected result: answers from QEMU.
    Observed result: no answers (actually tcp_chr_read is not called at all).
    
    Due to GLib limitations it is not possible to create several watches on one
    channel on Windows hosts. See bug #338943 in GNOME bugzilla for details:
    https://bugzilla.gnome.org/show_bug.cgi?id=338943
    
    This reimplements commit cdaa86a54b232572bba594bf87a7416e527e460c
    ("Add G_IO_HUP handler for socket chardev") using a single watch:
    
    Handle G_IO_HUP in tcp_chr_read instead. It is already watched by a
    corresponding watch.  Remove the second watch with its handler.
    
    Cc: Antonios Motakis <a.motakis at virtualopensystems.com>
    Cc: Nikolay Nikolaev <n.nikolaev at virtualopensystems.com>
    Cc: Michael S. Tsirkin <mst at redhat.com>
    Signed-off-by: Kirill Batuzov <batuzovk at ispras.ru>
    Signed-off-by: Nikita Belov <zodiac at ispras.ru>
    Reviewed-by: Michael S. Tsirkin <mst at redhat.com>
    Signed-off-by: Michael S. Tsirkin <mst at redhat.com>

diff --git a/include/sysemu/char.h b/include/sysemu/char.h
index c8b15f9..0bbd631 100644
--- a/include/sysemu/char.h
+++ b/include/sysemu/char.h
@@ -84,7 +84,6 @@ struct CharDriverState {
     int avail_connections;
     int is_mux;
     guint fd_in_tag;
-    guint fd_hup_tag;
     QemuOpts *opts;
     QTAILQ_ENTRY(CharDriverState) next;
 };
diff --git a/qemu-char.c b/qemu-char.c
index 51917de..22a9777 100644
--- a/qemu-char.c
+++ b/qemu-char.c
@@ -2673,6 +2673,12 @@ static gboolean tcp_chr_read(GIOChannel *chan, GIOCondition cond, void *opaque)
     uint8_t buf[READ_BUF_LEN];
     int len, size;
 
+    if (cond & G_IO_HUP) {
+        /* connection closed */
+        tcp_chr_disconnect(chr);
+        return TRUE;
+    }
+
     if (!s->connected || s->max_size <= 0) {
         return TRUE;
     }
@@ -2724,25 +2730,6 @@ CharDriverState *qemu_chr_open_eventfd(int eventfd)
 }
 #endif
 
-static gboolean tcp_chr_chan_close(GIOChannel *channel, GIOCondition cond,
-                                   void *opaque)
-{
-    CharDriverState *chr = opaque;
-
-    if (cond != G_IO_HUP) {
-        return FALSE;
-    }
-
-    /* connection closed */
-    tcp_chr_disconnect(chr);
-    if (chr->fd_hup_tag) {
-        g_source_remove(chr->fd_hup_tag);
-        chr->fd_hup_tag = 0;
-    }
-
-    return TRUE;
-}
-
 static void tcp_chr_connect(void *opaque)
 {
     CharDriverState *chr = opaque;
@@ -2752,8 +2739,6 @@ static void tcp_chr_connect(void *opaque)
     if (s->chan) {
         chr->fd_in_tag = io_add_watch_poll(s->chan, tcp_chr_read_poll,
                                            tcp_chr_read, chr);
-        chr->fd_hup_tag = g_io_add_watch(s->chan, G_IO_HUP, tcp_chr_chan_close,
-                                         chr);
     }
     qemu_chr_be_generic_open(chr);
 }
commit 85d1277e668106294d134a101729c6f36289da1a
Author: Ming Lei <ming.lei at canonical.com>
Date:   Tue Jul 1 00:01:58 2014 +0800

    virtio: move common virtio properties to bus class device
    
    The two common virtio features can be defined per bus, so move all
    into bus class device to make code more clean.
    
    As discussed with cornelia, s390-virtio-blk doesn't support
    the two features at all, so keep s390-virtio as it.
    
    Acked-by: Cornelia Huck <cornelia.huck at de.ibm.com> #for s390 ccw
    Suggested-by: Paolo Bonzini <pbonzini at redhat.com>
    Signed-off-by: Ming Lei <ming.lei at canonical.com>
    Reviewed-by: Michael S. Tsirkin <mst at redhat.com>
    Signed-off-by: Michael S. Tsirkin <mst at redhat.com>
    
    MST: rebase and resolve conflicts

diff --git a/hw/s390x/s390-virtio-bus.c b/hw/s390x/s390-virtio-bus.c
index c0dc365..6b6fb61 100644
--- a/hw/s390x/s390-virtio-bus.c
+++ b/hw/s390x/s390-virtio-bus.c
@@ -494,6 +494,7 @@ static unsigned virtio_s390_get_features(DeviceState *d)
 
 static Property s390_virtio_net_properties[] = {
     DEFINE_NIC_PROPERTIES(VirtIONetS390, vdev.nic_conf),
+    DEFINE_VIRTIO_COMMON_FEATURES(VirtIOS390Device, host_features),
     DEFINE_VIRTIO_NET_FEATURES(VirtIOS390Device, host_features),
     DEFINE_VIRTIO_NET_PROPERTIES(VirtIONetS390, vdev.net_conf),
     DEFINE_PROP_END_OF_LIST(),
@@ -614,6 +615,7 @@ static const TypeInfo virtio_s390_device_info = {
 
 static Property s390_virtio_scsi_properties[] = {
     DEFINE_VIRTIO_SCSI_PROPERTIES(VirtIOSCSIS390, vdev.parent_obj.conf),
+    DEFINE_VIRTIO_COMMON_FEATURES(VirtIOS390Device, host_features),
     DEFINE_VIRTIO_SCSI_FEATURES(VirtIOS390Device, host_features),
     DEFINE_PROP_END_OF_LIST(),
 };
diff --git a/hw/s390x/virtio-ccw.c b/hw/s390x/virtio-ccw.c
index c279968..33a1d86 100644
--- a/hw/s390x/virtio-ccw.c
+++ b/hw/s390x/virtio-ccw.c
@@ -1402,7 +1402,6 @@ static const TypeInfo virtio_ccw_net = {
 
 static Property virtio_ccw_blk_properties[] = {
     DEFINE_PROP_STRING("devno", VirtioCcwDevice, bus_id),
-    DEFINE_VIRTIO_BLK_FEATURES(VirtioCcwDevice, host_features[0]),
     DEFINE_PROP_BIT("ioeventfd", VirtioCcwDevice, flags,
                     VIRTIO_CCW_FLAG_USE_IOEVENTFD_BIT, true),
     DEFINE_PROP_END_OF_LIST(),
@@ -1430,7 +1429,6 @@ static const TypeInfo virtio_ccw_blk = {
 static Property virtio_ccw_serial_properties[] = {
     DEFINE_PROP_STRING("devno", VirtioCcwDevice, bus_id),
     DEFINE_VIRTIO_SERIAL_PROPERTIES(VirtioSerialCcw, vdev.serial),
-    DEFINE_VIRTIO_COMMON_FEATURES(VirtioCcwDevice, host_features[0]),
     DEFINE_PROP_BIT("ioeventfd", VirtioCcwDevice, flags,
                     VIRTIO_CCW_FLAG_USE_IOEVENTFD_BIT, true),
     DEFINE_PROP_END_OF_LIST(),
@@ -1457,7 +1455,6 @@ static const TypeInfo virtio_ccw_serial = {
 
 static Property virtio_ccw_balloon_properties[] = {
     DEFINE_PROP_STRING("devno", VirtioCcwDevice, bus_id),
-    DEFINE_VIRTIO_COMMON_FEATURES(VirtioCcwDevice, host_features[0]),
     DEFINE_PROP_BIT("ioeventfd", VirtioCcwDevice, flags,
                     VIRTIO_CCW_FLAG_USE_IOEVENTFD_BIT, true),
     DEFINE_PROP_END_OF_LIST(),
@@ -1514,7 +1511,6 @@ static const TypeInfo virtio_ccw_scsi = {
 static Property vhost_ccw_scsi_properties[] = {
     DEFINE_PROP_STRING("devno", VirtioCcwDevice, bus_id),
     DEFINE_VHOST_SCSI_PROPERTIES(VirtIOSCSICcw, vdev.parent_obj.conf),
-    DEFINE_VIRTIO_COMMON_FEATURES(VirtioCcwDevice, host_features[0]),
     DEFINE_PROP_END_OF_LIST(),
 };
 
@@ -1551,7 +1547,6 @@ static void virtio_ccw_rng_instance_init(Object *obj)
 
 static Property virtio_ccw_rng_properties[] = {
     DEFINE_PROP_STRING("devno", VirtioCcwDevice, bus_id),
-    DEFINE_VIRTIO_COMMON_FEATURES(VirtioCcwDevice, host_features[0]),
     DEFINE_VIRTIO_RNG_PROPERTIES(VirtIORNGCcw, vdev.conf),
     DEFINE_PROP_BIT("ioeventfd", VirtioCcwDevice, flags,
                     VIRTIO_CCW_FLAG_USE_IOEVENTFD_BIT, true),
@@ -1617,10 +1612,16 @@ static int virtio_ccw_busdev_unplug(DeviceState *dev)
     return 0;
 }
 
+static Property virtio_ccw_properties[] = {
+    DEFINE_VIRTIO_COMMON_FEATURES(VirtioCcwDevice, host_features[0]),
+    DEFINE_PROP_END_OF_LIST(),
+};
+
 static void virtio_ccw_device_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
+    dc->props = virtio_ccw_properties;
     dc->init = virtio_ccw_busdev_init;
     dc->exit = virtio_ccw_busdev_exit;
     dc->unplug = virtio_ccw_busdev_unplug;
diff --git a/hw/virtio/virtio-pci.c b/hw/virtio/virtio-pci.c
index 3c42cda..7102728 100644
--- a/hw/virtio/virtio-pci.c
+++ b/hw/virtio/virtio-pci.c
@@ -914,7 +914,6 @@ static Property virtio_9p_pci_properties[] = {
     DEFINE_PROP_BIT("ioeventfd", VirtIOPCIProxy, flags,
                     VIRTIO_PCI_FLAG_USE_IOEVENTFD_BIT, true),
     DEFINE_PROP_UINT32("vectors", VirtIOPCIProxy, nvectors, 2),
-    DEFINE_VIRTIO_COMMON_FEATURES(VirtIOPCIProxy, host_features),
     DEFINE_VIRTIO_9P_PROPERTIES(V9fsPCIState, vdev.fsconf),
     DEFINE_PROP_END_OF_LIST(),
 };
@@ -1037,11 +1036,17 @@ static void virtio_pci_reset(DeviceState *qdev)
     proxy->flags &= ~VIRTIO_PCI_FLAG_BUS_MASTER_BUG;
 }
 
+static Property virtio_pci_properties[] = {
+    DEFINE_VIRTIO_COMMON_FEATURES(VirtIOPCIProxy, host_features),
+    DEFINE_PROP_END_OF_LIST(),
+};
+
 static void virtio_pci_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
 
+    dc->props = virtio_pci_properties;
     k->init = virtio_pci_init;
     k->exit = virtio_pci_exit;
     k->vendor_id = PCI_VENDOR_ID_REDHAT_QUMRANET;
@@ -1066,7 +1071,6 @@ static Property virtio_blk_pci_properties[] = {
     DEFINE_PROP_BIT("ioeventfd", VirtIOPCIProxy, flags,
                     VIRTIO_PCI_FLAG_USE_IOEVENTFD_BIT, true),
     DEFINE_PROP_UINT32("vectors", VirtIOPCIProxy, nvectors, 2),
-    DEFINE_VIRTIO_BLK_FEATURES(VirtIOPCIProxy, host_features),
     DEFINE_PROP_END_OF_LIST(),
 };
 
@@ -1191,7 +1195,6 @@ static const TypeInfo virtio_scsi_pci_info = {
 static Property vhost_scsi_pci_properties[] = {
     DEFINE_PROP_UINT32("vectors", VirtIOPCIProxy, nvectors,
                        DEV_NVECTORS_UNSPECIFIED),
-    DEFINE_VIRTIO_COMMON_FEATURES(VirtIOPCIProxy, host_features),
     DEFINE_VHOST_SCSI_PROPERTIES(VHostSCSIPCI, vdev.parent_obj.conf),
     DEFINE_PROP_END_OF_LIST(),
 };
@@ -1272,7 +1275,6 @@ static void balloon_pci_stats_set_poll_interval(Object *obj, struct Visitor *v,
 }
 
 static Property virtio_balloon_pci_properties[] = {
-    DEFINE_VIRTIO_COMMON_FEATURES(VirtIOPCIProxy, host_features),
     DEFINE_PROP_UINT32("class", VirtIOPCIProxy, class_code, 0),
     DEFINE_PROP_END_OF_LIST(),
 };
@@ -1375,7 +1377,6 @@ static Property virtio_serial_pci_properties[] = {
                     VIRTIO_PCI_FLAG_USE_IOEVENTFD_BIT, true),
     DEFINE_PROP_UINT32("vectors", VirtIOPCIProxy, nvectors, 2),
     DEFINE_PROP_UINT32("class", VirtIOPCIProxy, class_code, 0),
-    DEFINE_VIRTIO_COMMON_FEATURES(VirtIOPCIProxy, host_features),
     DEFINE_VIRTIO_SERIAL_PROPERTIES(VirtIOSerialPCI, vdev.serial),
     DEFINE_PROP_END_OF_LIST(),
 };
@@ -1471,7 +1472,6 @@ static const TypeInfo virtio_net_pci_info = {
 /* virtio-rng-pci */
 
 static Property virtio_rng_pci_properties[] = {
-    DEFINE_VIRTIO_COMMON_FEATURES(VirtIOPCIProxy, host_features),
     DEFINE_VIRTIO_RNG_PROPERTIES(VirtIORngPCI, vdev.conf),
     DEFINE_PROP_END_OF_LIST(),
 };
diff --git a/include/hw/virtio/virtio-blk.h b/include/hw/virtio/virtio-blk.h
index 223530e..b3080a2 100644
--- a/include/hw/virtio/virtio-blk.h
+++ b/include/hw/virtio/virtio-blk.h
@@ -152,9 +152,6 @@ typedef struct VirtIOBlockReq {
     BlockAcctCookie acct;
 } VirtIOBlockReq;
 
-#define DEFINE_VIRTIO_BLK_FEATURES(_state, _field) \
-        DEFINE_VIRTIO_COMMON_FEATURES(_state, _field)
-
 int virtio_blk_handle_scsi_req(VirtIOBlock *blk,
                                VirtQueueElement *elem);
 
diff --git a/include/hw/virtio/virtio-net.h b/include/hw/virtio/virtio-net.h
index f7fccc0..6ceb5aa 100644
--- a/include/hw/virtio/virtio-net.h
+++ b/include/hw/virtio/virtio-net.h
@@ -258,7 +258,6 @@ struct virtio_net_ctrl_mq {
  #define VIRTIO_NET_CTRL_GUEST_OFFLOADS_SET        0
 
 #define DEFINE_VIRTIO_NET_FEATURES(_state, _field) \
-        DEFINE_VIRTIO_COMMON_FEATURES(_state, _field), \
         DEFINE_PROP_BIT("any_layout", _state, _field, VIRTIO_F_ANY_LAYOUT, true), \
         DEFINE_PROP_BIT("csum", _state, _field, VIRTIO_NET_F_CSUM, true), \
         DEFINE_PROP_BIT("guest_csum", _state, _field, VIRTIO_NET_F_GUEST_CSUM, true), \
diff --git a/include/hw/virtio/virtio-scsi.h b/include/hw/virtio/virtio-scsi.h
index a8f6185..0419ee4 100644
--- a/include/hw/virtio/virtio-scsi.h
+++ b/include/hw/virtio/virtio-scsi.h
@@ -178,7 +178,6 @@ typedef struct {
     DEFINE_PROP_UINT32("cmd_per_lun", _state, _conf_field.cmd_per_lun, 128)
 
 #define DEFINE_VIRTIO_SCSI_FEATURES(_state, _feature_field)                    \
-    DEFINE_VIRTIO_COMMON_FEATURES(_state, _feature_field),                     \
     DEFINE_PROP_BIT("hotplug", _state, _feature_field, VIRTIO_SCSI_F_HOTPLUG,  \
                                                        true),                  \
     DEFINE_PROP_BIT("param_change", _state, _feature_field,                    \
commit 9b79a76cdbb43b0b00aaf6e9421298842fc68841
Author: Igor Mammedov <imammedo at redhat.com>
Date:   Mon Jun 30 12:43:29 2014 +0200

    pc-dimm: error out if memory hotplug is not enabled
    
    fixes QEMU abort in case it's started without memory
    hotplug enabled.
    
    as result of fix it will print following messages:
    "
    -device pc-dimm,id=d1,memdev=m1: memory hotplug is not enabled, enable it on startup
    -device pc-dimm,id=d1,memdev=m1: Device 'pc-dimm' could not be initialized
    "
    
    Also fixup assert condition to detect hotplug address
    space overflow.
    
    Signed-off-by: Igor Mammedov <imammedo at redhat.com>
    Reported-by:  Hu Tao <hutao at cn.fujitsu.com>
    Reviewed-by: Michael S. Tsirkin <mst at redhat.com>
    Signed-off-by: Michael S. Tsirkin <mst at redhat.com>

diff --git a/hw/mem/pc-dimm.c b/hw/mem/pc-dimm.c
index ad176b7..08f49ed 100644
--- a/hw/mem/pc-dimm.c
+++ b/hw/mem/pc-dimm.c
@@ -146,7 +146,13 @@ uint64_t pc_dimm_get_free_addr(uint64_t address_space_start,
     uint64_t new_addr, ret = 0;
     uint64_t address_space_end = address_space_start + address_space_size;
 
-    assert(address_space_end > address_space_size);
+    if (!address_space_size) {
+        error_setg(errp, "memory hotplug is not enabled, "
+                         "please add maxmem option");
+        goto out;
+    }
+
+    assert(address_space_end > address_space_start);
     object_child_foreach(qdev_get_machine(), pc_dimm_built_list, &list);
 
     if (hint) {
commit 0462faee67eb9ee39e51f764891fb6b767602eed
Author: Hu Tao <hutao at cn.fujitsu.com>
Date:   Mon Jun 30 18:28:15 2014 +0800

    numa: check for busy memory backend
    
    Specifying the same memory backend twice leads to an assert:
    
    ./x86_64-softmmu/qemu-system-x86_64 -m 512M -enable-kvm -object
    memory-backend-ram,size=256M,id=ram0 -numa node,nodeid=0,memdev=ram0
    -numa node,nodeid=1,memdev=ram0
    qemu-system-x86_64: /scm/qemu/memory.c:1506:
    memory_region_add_subregion_common: Assertion `!subregion->container'
    failed.
    Aborted (core dumped)
    
    Detect and exit with an error message instead.
    
    Reviewed-by: Igor Mammedov <imammedo at redhat.com>
    Signed-off-by: Hu Tao <hutao at cn.fujitsu.com>
    Reviewed-by: Michael S. Tsirkin <mst at redhat.com>
    Signed-off-by: Michael S. Tsirkin <mst at redhat.com>

diff --git a/numa.c b/numa.c
index 2fde740..7bf7834 100644
--- a/numa.c
+++ b/numa.c
@@ -301,6 +301,14 @@ void memory_region_allocate_system_memory(MemoryRegion *mr, Object *owner,
             exit(1);
         }
 
+        if (memory_region_is_mapped(seg)) {
+            char *path = object_get_canonical_path_component(OBJECT(backend));
+            error_report("memory backend %s is used multiple times. Each "
+                         "-numa option must use a different memdev value.",
+                         path);
+            exit(1);
+        }
+
         memory_region_add_subregion(mr, addr, seg);
         vmstate_register_ram_global(seg);
         addr += size;
commit e06cbc376ea79061c009f529df196a3efde47d9e
Author: Nikolay Nikolaev <n.nikolaev at virtualopensystems.com>
Date:   Thu Jun 19 20:35:42 2014 +0300

    qtest: enable vhost-user-test
    
    Use qtest-obj-y to get the right library order. CONFIG_POSIX ensures
    mingw compilation won't break.
    
    Signed-off-by: Nikolay Nikolaev <n.nikolaev at virtualopensystems.com>
    Acked-by: Michael S. Tsirkin <mst at redhat.com>
    Signed-off-by: Michael S. Tsirkin <mst at redhat.com>
    
    MST: whitespace tweak

diff --git a/tests/Makefile b/tests/Makefile
index 7e53d0d..1fcd633 100644
--- a/tests/Makefile
+++ b/tests/Makefile
@@ -158,7 +158,7 @@ gcov-files-i386-y += hw/usb/hcd-ehci.c
 gcov-files-i386-y += hw/usb/hcd-uhci.c
 gcov-files-i386-y += hw/usb/dev-hid.c
 gcov-files-i386-y += hw/usb/dev-storage.c
-#check-qtest-i386-y += tests/vhost-user-test$(EXESUF)
+check-qtest-i386-$(CONFIG_POSIX) += tests/vhost-user-test$(EXESUF)
 check-qtest-x86_64-y = $(check-qtest-i386-y)
 gcov-files-i386-y += i386-softmmu/hw/timer/mc146818rtc.c
 gcov-files-x86_64-y = $(subst i386-softmmu/,x86_64-softmmu/,$(gcov-files-i386-y))
@@ -333,11 +333,13 @@ tests/es1370-test$(EXESUF): tests/es1370-test.o
 tests/intel-hda-test$(EXESUF): tests/intel-hda-test.o
 tests/ioh3420-test$(EXESUF): tests/ioh3420-test.o
 tests/usb-hcd-ehci-test$(EXESUF): tests/usb-hcd-ehci-test.o $(libqos-pc-obj-y)
-tests/vhost-user-test$(EXESUF): tests/vhost-user-test.o qemu-char.o qemu-timer.o libqemuutil.a libqemustub.a
+tests/vhost-user-test$(EXESUF): tests/vhost-user-test.o qemu-char.o qemu-timer.o $(qtest-obj-y)
 tests/qemu-iotests/socket_scm_helper$(EXESUF): tests/qemu-iotests/socket_scm_helper.o
 tests/test-qemu-opts$(EXESUF): tests/test-qemu-opts.o libqemuutil.a libqemustub.a
 
-#LIBS+= -lutil
+ifeq ($(CONFIG_POSIX),y)
+LIBS += -lutil
+endif
 
 # QTest rules
 
commit 9d9de254c2b81b68cd48f2324cc753a570a4cdd8
Author: Eduardo Otubo <eduardo.otubo at profitbricks.com>
Date:   Wed Jul 2 10:04:30 2014 +0200

    MAINTAINERS: seccomp: change email contact for Eduardo Otubo
    
    Signed-off-by: Eduardo Otubo <eduardo.otubo at profitbricks.com>
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>

diff --git a/MAINTAINERS b/MAINTAINERS
index 9b93edd..e7dc907 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -853,7 +853,7 @@ S: Odd Fixes
 F: scripts/checkpatch.pl
 
 Seccomp
-M: Eduardo Otubo <otubo at linux.vnet.ibm.com>
+M: Eduardo Otubo <eduardo.otubo at profitbricks.com>
 S: Supported
 F: qemu-seccomp.c
 F: include/sysemu/seccomp.h


More information about the Spice-commits mailing list