qemu-commits
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[Qemu-commits] [qemu/qemu] 814395: target-xtensa: convert host errno val


From: GitHub
Subject: [Qemu-commits] [qemu/qemu] 814395: target-xtensa: convert host errno values to guest
Date: Mon, 19 Nov 2012 17:30:38 -0800

  Branch: refs/heads/stable-1.2
  Home:   https://github.com/qemu/qemu
  Commit: 814395979efbca6b5f0ec83f7c6a77d9fba22427
      
https://github.com/qemu/qemu/commit/814395979efbca6b5f0ec83f7c6a77d9fba22427
  Author: Max Filippov <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M target-xtensa/xtensa-semi.c

  Log Message:
  -----------
  target-xtensa: convert host errno values to guest

Guest errno values are taken from the newlib. Convert only those errno
values that can be returned from used system calls.

Signed-off-by: Max Filippov <address@hidden>
Signed-off-by: Blue Swirl <address@hidden>
Signed-off-by: Michael Roth <address@hidden>


  Commit: 631287933e55adc272c57a6f8b3c09801c10c603
      
https://github.com/qemu/qemu/commit/631287933e55adc272c57a6f8b3c09801c10c603
  Author: Stefan Weil <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M target-cris/translate.c

  Log Message:
  -----------
  target-cris: Fix buffer overflow

Report from smatch:

target-cris/translate.c:3464 cpu_dump_state(32) error:
 buffer overflow 'env->sregs' 4 <= 255

sregs is declared 'uint32_t sregs[4][16]', so the first index must be
less than 4 or ARRAY_SIZE(env->sregs).

Signed-off-by: Stefan Weil <address@hidden>
Signed-off-by: Michael Roth <address@hidden>


  Commit: dafd8866beba60d2e3e2e3af4c3ed60538051cf0
      
https://github.com/qemu/qemu/commit/dafd8866beba60d2e3e2e3af4c3ed60538051cf0
  Author: Max Filippov <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M target-xtensa/xtensa-semi.c

  Log Message:
  -----------
  target-xtensa: fix missing errno codes for mingw32

Put the following errno value mappings under #ifdef:

xtensa-semi.c: In function 'errno_h2g':
xtensa-semi.c:113: error: 'ENOTBLK' undeclared (first use in this function)
xtensa-semi.c:113: error: (Each undeclared identifier is reported only once
xtensa-semi.c:113: error: for each function it appears in.)
xtensa-semi.c:113: error: array index in initializer not of integer type
xtensa-semi.c:113: error: (near initialization for 'guest_errno')
xtensa-semi.c:124: error: 'ETXTBSY' undeclared (first use in this function)
xtensa-semi.c:124: error: array index in initializer not of integer type
xtensa-semi.c:124: error: (near initialization for 'guest_errno')
xtensa-semi.c:134: error: 'ELOOP' undeclared (first use in this function)
xtensa-semi.c:134: error: array index in initializer not of integer type
xtensa-semi.c:134: error: (near initialization for 'guest_errno')

Signed-off-by: Max Filippov <address@hidden>
Signed-off-by: Blue Swirl <address@hidden>
Signed-off-by: Michael Roth <address@hidden>


  Commit: b16148e1c6de2d71ed048c86eeb9e2c05a9eb06a
      
https://github.com/qemu/qemu/commit/b16148e1c6de2d71ed048c86eeb9e2c05a9eb06a
  Author: Aurelien Jarno <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M target-sparc/fop_helper.c

  Log Message:
  -----------
  target-sparc: fix fcmp{s,d,q} instructions wrt exception

fcmp{s,d,q} instructions are supposed to ignore quiet NaN (contrary to
the fcmpe{s,d,q} instructions), but the current code is wrongly setting
the NV exception in that case. Moreover the current code is duplicated:
first the arguments are checked for NaN to generate an exception, and
later in case the comparison is unordered (which can only happens if one
of the argument is a NaN), the same check is done to generate an
exception.

Fix that by calling clear_float_exceptions() followed by
check_ieee_exceptions() as for the other floating point instructions.
Use the _compare_quiet functions for fcmp{s,d,q} and the _compare ones
for fcmpe{s,d,q}. Simplify the flag setting by not clearing a flag that
is set the line just below.

This fix allows the math glibc testsuite to pass.

Cc: Blue Swirl <address@hidden>
Signed-off-by: Aurelien Jarno <address@hidden>
Signed-off-by: Blue Swirl <address@hidden>
Signed-off-by: Michael Roth <address@hidden>


  Commit: b05900a7615a50acfa6d0d839b779d4bc14eb0e4
      
https://github.com/qemu/qemu/commit/b05900a7615a50acfa6d0d839b779d4bc14eb0e4
  Author: Blue Swirl <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M target-s390x/helper.c
    M target-s390x/op_helper.c

  Log Message:
  -----------
  target-s390x: fix style

Before splitting op_helper.c and helper.c in the next patches,
fix style issues. No functional changes.

Replace also GCC specific __FUNCTION__ with
standard __func__.

Don't init static variable (cpu_s390x_init:inited) with 0.

Signed-off-by: Blue Swirl <address@hidden>
Signed-off-by: Alexander Graf <address@hidden>
Signed-off-by: Michael Roth <address@hidden>


  Commit: 4bae8a0a900e8515fdc83aec22cb038987ada277
      
https://github.com/qemu/qemu/commit/4bae8a0a900e8515fdc83aec22cb038987ada277
  Author: Blue Swirl <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M target-s390x/Makefile.objs
    M target-s390x/cpu.h
    A target-s390x/fpu_helper.c
    M target-s390x/op_helper.c
    M target-s390x/translate.c

  Log Message:
  -----------
  target-s390x: split FPU ops

Move floating point instructions to fpu_helper.c.

While exporting some condition code helpers,
avoid duplicate identifier conflict with translate.c.

Remove unused set_cc_nz_f64() in translate.c.

Signed-off-by: Blue Swirl <address@hidden>
Signed-off-by: Alexander Graf <address@hidden>
Signed-off-by: Michael Roth <address@hidden>


  Commit: f7c50726dd57e255b66d1369cd7883b49b0aa1aa
      
https://github.com/qemu/qemu/commit/f7c50726dd57e255b66d1369cd7883b49b0aa1aa
  Author: Blue Swirl <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M target-s390x/Makefile.objs
    A target-s390x/cc_helper.c
    M target-s390x/cpu.h
    M target-s390x/op_helper.c

  Log Message:
  -----------
  target-s390x: split condition code helpers

Move condition code helpers to cc_helper.c.

Signed-off-by: Blue Swirl <address@hidden>
Signed-off-by: Alexander Graf <address@hidden>
Signed-off-by: Michael Roth <address@hidden>


  Commit: 7dc581be443c398cb745e55a3d474286b43bd533
      
https://github.com/qemu/qemu/commit/7dc581be443c398cb745e55a3d474286b43bd533
  Author: Blue Swirl <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M target-s390x/Makefile.objs
    A target-s390x/int_helper.c
    M target-s390x/op_helper.c

  Log Message:
  -----------
  target-s390x: split integer helpers

Move integer helpers to int_helper.c.

Signed-off-by: Blue Swirl <address@hidden>
Signed-off-by: Alexander Graf <address@hidden>
Signed-off-by: Michael Roth <address@hidden>


  Commit: 84dde20eea46d8ed4a02dd3f92a7cbcc9aea75ae
      
https://github.com/qemu/qemu/commit/84dde20eea46d8ed4a02dd3f92a7cbcc9aea75ae
  Author: Blue Swirl <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M target-s390x/Makefile.objs
    A target-s390x/mem_helper.c
    M target-s390x/op_helper.c

  Log Message:
  -----------
  target-s390x: split memory access helpers

Move memory access helpers to mem_helper.c.

Signed-off-by: Blue Swirl <address@hidden>
[agraf: fold softmmu include ifdefs together]
Signed-off-by: Alexander Graf <address@hidden>

Signed-off-by: Michael Roth <address@hidden>


  Commit: 1a392c895791dd7f3f880419e62c48188b15f573
      
https://github.com/qemu/qemu/commit/1a392c895791dd7f3f880419e62c48188b15f573
  Author: Blue Swirl <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M target-s390x/Makefile.objs
    M target-s390x/cpu.h
    A target-s390x/misc_helper.c
    R target-s390x/op_helper.c

  Log Message:
  -----------
  target-s390x: rename op_helper.c to misc_helper.c

Now op_helper.c contains miscellaneous helpers, rename
it to misc_helper.c.

Signed-off-by: Blue Swirl <address@hidden>
[agraf: fix conflict]
Signed-off-by: Alexander Graf <address@hidden>

Signed-off-by: Michael Roth <address@hidden>


  Commit: 313e38b4a155df8ca806bf93ce4abe1402cd4243
      
https://github.com/qemu/qemu/commit/313e38b4a155df8ca806bf93ce4abe1402cd4243
  Author: Blue Swirl <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M target-s390x/Makefile.objs
    M target-s390x/cc_helper.c
    M target-s390x/cpu.h
    M target-s390x/fpu_helper.c
    M target-s390x/helper.h
    M target-s390x/mem_helper.c
    M target-s390x/translate.c

  Log Message:
  -----------
  target-s390x: avoid AREG0 for FPU helpers

Make FPU helpers take a parameter for CPUState instead
of relying on global env.

Introduce temporary wrappers for FPU load and store ops.

Signed-off-by: Blue Swirl <address@hidden>
Signed-off-by: Alexander Graf <address@hidden>
Signed-off-by: Michael Roth <address@hidden>


  Commit: 1f983b49f7d54780e1234f594deb66785871e2e5
      
https://github.com/qemu/qemu/commit/1f983b49f7d54780e1234f594deb66785871e2e5
  Author: Blue Swirl <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M target-s390x/Makefile.objs
    M target-s390x/helper.h
    M target-s390x/int_helper.c
    M target-s390x/translate.c

  Log Message:
  -----------
  target-s390x: avoid AREG0 for integer helpers

Make integer helpers take a parameter for CPUState instead
of relying on global env.

Signed-off-by: Blue Swirl <address@hidden>
Signed-off-by: Alexander Graf <address@hidden>
Signed-off-by: Michael Roth <address@hidden>


  Commit: 719a60ddb3d239611126ef3ae8a2caf4828cea81
      
https://github.com/qemu/qemu/commit/719a60ddb3d239611126ef3ae8a2caf4828cea81
  Author: Blue Swirl <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M target-s390x/Makefile.objs
    M target-s390x/cc_helper.c
    M target-s390x/helper.h
    M target-s390x/translate.c

  Log Message:
  -----------
  target-s390x: avoid AREG0 for condition code helpers

Make condition code helpers take a parameter for CPUState instead
of relying on global env.

Signed-off-by: Blue Swirl <address@hidden>
Signed-off-by: Alexander Graf <address@hidden>
Signed-off-by: Michael Roth <address@hidden>


  Commit: 71742e6c6803e0b623c7b5de81723e081c23b88c
      
https://github.com/qemu/qemu/commit/71742e6c6803e0b623c7b5de81723e081c23b88c
  Author: Blue Swirl <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M target-s390x/Makefile.objs
    M target-s390x/helper.h
    M target-s390x/mem_helper.c
    M target-s390x/misc_helper.c
    M target-s390x/translate.c

  Log Message:
  -----------
  target-s390x: avoid AREG0 for misc helpers

Make misc helpers take a parameter for CPUState instead
of relying on global env.

Signed-off-by: Blue Swirl <address@hidden>
[agraf: fix conflict]
Signed-off-by: Alexander Graf <address@hidden>

Signed-off-by: Michael Roth <address@hidden>


  Commit: 265434460ed7a2912b06819cb113c04111a29dea
      
https://github.com/qemu/qemu/commit/265434460ed7a2912b06819cb113c04111a29dea
  Author: Blue Swirl <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M configure
    M target-s390x/Makefile.objs
    M target-s390x/cpu.h
    M target-s390x/fpu_helper.c
    M target-s390x/helper.c
    M target-s390x/helper.h
    M target-s390x/mem_helper.c
    M target-s390x/misc_helper.c
    M target-s390x/translate.c

  Log Message:
  -----------
  target-s390x: switch to AREG0 free mode

Add an explicit CPUState parameter instead of relying on AREG0.

Remove temporary wrappers and switch to AREG0 free mode.

Signed-off-by: Blue Swirl <address@hidden>
[agraf: fix conflicts]
Signed-off-by: Alexander Graf <address@hidden>

Signed-off-by: Michael Roth <address@hidden>


  Commit: 3bc7da7cd7c62c16da18484f1258b323f75ace61
      
https://github.com/qemu/qemu/commit/3bc7da7cd7c62c16da18484f1258b323f75ace61
  Author: Aurelien Jarno <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M tcg/s390/tcg-target.c

  Log Message:
  -----------
  tcg/s390: fix ld/st with CONFIG_TCG_PASS_AREG0

The load/store slow path has been broken in e141ab52d:
- We need to move 4 registers for store functions and 3 registers for
  load functions and not the reverse.
- According to the s390x calling convention the arguments of a function
  should be zero extended. This means that the register shift should be
  done with TCG_TYPE_I64 to ensure the higher word is correctly zero
  extended when needed.

I am aware that CONFIG_TCG_PASS_AREG0 is being removed and thus that
this patch can be improved, but doing so means it can also be applied to
the 1.1 and 1.2 stable branches.

Signed-off-by: Aurelien Jarno <address@hidden>
Signed-off-by: Alexander Graf <address@hidden>
Signed-off-by: Michael Roth <address@hidden>


  Commit: 62cdb0fdd319e1cc020d5b7a15bb8727d2c88c8b
      
https://github.com/qemu/qemu/commit/62cdb0fdd319e1cc020d5b7a15bb8727d2c88c8b
  Author: Stefan Weil <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M target-arm/helper.c

  Log Message:
  -----------
  target-arm: Fix potential buffer overflow

Report from smatch:

target-arm/helper.c:651 arm946_prbs_read(6) error:
 buffer overflow 'env->cp15.c6_region' 8 <= 8
target-arm/helper.c:661 arm946_prbs_write(6) error:
 buffer overflow 'env->cp15.c6_region' 8 <= 8

c7_region is an array with 8 elements, so the index must be less than 8.

Signed-off-by: Stefan Weil <address@hidden>
Reviewed-by: Peter Maydell <address@hidden>
Signed-off-by: Aurelien Jarno <address@hidden>
Signed-off-by: Michael Roth <address@hidden>


  Commit: d969307261eee2dd1fc42f6c570f4ac4f056b405
      
https://github.com/qemu/qemu/commit/d969307261eee2dd1fc42f6c570f4ac4f056b405
  Author: Aurelien Jarno <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M tcg/optimize.c

  Log Message:
  -----------
  tcg/optimize: split expression simplification

Split expression simplification in multiple parts so that a given op
can appear multiple times. This patch should not change anything.

Reviewed-by: Richard Henderson <address@hidden>
Signed-off-by: Aurelien Jarno <address@hidden>
Signed-off-by: Michael Roth <address@hidden>


  Commit: 6c9785fb4b32c5291abb36003bbe5384ba6d9296
      
https://github.com/qemu/qemu/commit/6c9785fb4b32c5291abb36003bbe5384ba6d9296
  Author: Aurelien Jarno <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M tcg/optimize.c

  Log Message:
  -----------
  tcg/optimize: simplify or/xor r, a, 0 cases

or/xor r, a, 0 is equivalent to a mov r, a.

Reviewed-by: Richard Henderson <address@hidden>
Signed-off-by: Aurelien Jarno <address@hidden>
Signed-off-by: Michael Roth <address@hidden>


  Commit: f66f1dab29c86f88e5904eb628b90b1be8aed61a
      
https://github.com/qemu/qemu/commit/f66f1dab29c86f88e5904eb628b90b1be8aed61a
  Author: Aurelien Jarno <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M tcg/optimize.c

  Log Message:
  -----------
  tcg/optimize: simplify and r, a, 0 cases

and r, a, 0 is equivalent to a movi r, 0.

Reviewed-by: Richard Henderson <address@hidden>
Signed-off-by: Aurelien Jarno <address@hidden>
Signed-off-by: Michael Roth <address@hidden>


  Commit: 52173babad7f17fc69eebe4ad3aeee42fdea0e48
      
https://github.com/qemu/qemu/commit/52173babad7f17fc69eebe4ad3aeee42fdea0e48
  Author: Aurelien Jarno <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M tcg/optimize.c

  Log Message:
  -----------
  tcg/optimize: simplify shift/rot r, 0, a => movi r, 0 cases

shift/rot r, 0, a is equivalent to movi r, 0.

Reviewed-by: Richard Henderson <address@hidden>
Signed-off-by: Aurelien Jarno <address@hidden>
Signed-off-by: Michael Roth <address@hidden>


  Commit: decddd9021b417186901baec037cc9b4d75a58f6
      
https://github.com/qemu/qemu/commit/decddd9021b417186901baec037cc9b4d75a58f6
  Author: Aurelien Jarno <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M tcg/optimize.c

  Log Message:
  -----------
  tcg/optimize: swap brcond/setcond arguments when possible

brcond and setcond ops are not commutative, but it's easy to compute the
new condition after swapping the arguments. Try to always put the constant
argument in second position like for commutative ops, to help backends to
generate better code.

Reviewed-by: Richard Henderson <address@hidden>
Signed-off-by: Aurelien Jarno <address@hidden>
Signed-off-by: Michael Roth <address@hidden>


  Commit: 2108a786ba806db778d9e51c123612888ae79313
      
https://github.com/qemu/qemu/commit/2108a786ba806db778d9e51c123612888ae79313
  Author: Aurelien Jarno <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M tcg/optimize.c

  Log Message:
  -----------
  tcg/optimize: add constant folding for setcond

Reviewed-by: Richard Henderson <address@hidden>
Signed-off-by: Aurelien Jarno <address@hidden>
Signed-off-by: Michael Roth <address@hidden>


  Commit: 97c012c76a2d990cddc0c63f5a8b96e4096cc7e6
      
https://github.com/qemu/qemu/commit/97c012c76a2d990cddc0c63f5a8b96e4096cc7e6
  Author: Aurelien Jarno <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M tcg/optimize.c

  Log Message:
  -----------
  tcg/optimize: add constant folding for brcond

Reviewed-by: Richard Henderson <address@hidden>
Signed-off-by: Aurelien Jarno <address@hidden>
Signed-off-by: Michael Roth <address@hidden>


  Commit: 578c758200c670df9fa73f4511dc44d45ee80a9d
      
https://github.com/qemu/qemu/commit/578c758200c670df9fa73f4511dc44d45ee80a9d
  Author: Aurelien Jarno <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M tcg/optimize.c

  Log Message:
  -----------
  tcg/optimize: fix if/else/break coding style

optimizer.c contains some cases were the break is appearing in both the
if and the else parts. Fix that by moving it to the outer part. Also
move some common code there.

Reviewed-by: Richard Henderson <address@hidden>
Signed-off-by: Aurelien Jarno <address@hidden>
Signed-off-by: Michael Roth <address@hidden>


  Commit: 1ada516f0e067a244a0d90db4ecf2974430441c5
      
https://github.com/qemu/qemu/commit/1ada516f0e067a244a0d90db4ecf2974430441c5
  Author: Blue Swirl <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M target-s390x/translate.c

  Log Message:
  -----------
  target-s390x: avoid cpu_single_env

Pass around CPUState instead of using global cpu_single_env.

Signed-off-by: Blue Swirl <address@hidden>
Signed-off-by: Michael Roth <address@hidden>


  Commit: 7a5311f64f6aebdaecaa54d6fdc84bcb2fd609c8
      
https://github.com/qemu/qemu/commit/7a5311f64f6aebdaecaa54d6fdc84bcb2fd609c8
  Author: Blue Swirl <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M configure
    M target-lm32/Makefile.objs
    M target-lm32/helper.h
    M target-lm32/op_helper.c
    M target-lm32/translate.c

  Log Message:
  -----------
  target-lm32: switch to AREG0 free mode

Add an explicit CPUState parameter instead of relying on AREG0
and switch to AREG0 free mode.

Signed-off-by: Blue Swirl <address@hidden>
Signed-off-by: Michael Roth <address@hidden>


  Commit: 3654ef451eca2386700a70aeb0073eb7a47ec3d4
      
https://github.com/qemu/qemu/commit/3654ef451eca2386700a70aeb0073eb7a47ec3d4
  Author: Blue Swirl <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M configure
    M target-m68k/Makefile.objs
    M target-m68k/helpers.h
    M target-m68k/op_helper.c
    M target-m68k/translate.c

  Log Message:
  -----------
  target-m68k: switch to AREG0 free mode

Add an explicit CPUState parameter instead of relying on AREG0
and switch to AREG0 free mode.

Signed-off-by: Blue Swirl <address@hidden>
Signed-off-by: Michael Roth <address@hidden>


  Commit: e67d4921fdfe42f3bbea3eaa40c4db496d3637ea
      
https://github.com/qemu/qemu/commit/e67d4921fdfe42f3bbea3eaa40c4db496d3637ea
  Author: Blue Swirl <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M target-m68k/translate.c

  Log Message:
  -----------
  target-m68k: avoid using cpu_single_env

Pass around CPUState instead of using global cpu_single_env.

Signed-off-by: Blue Swirl <address@hidden>
Signed-off-by: Michael Roth <address@hidden>


  Commit: af411212ce32a3ba5b191795b8f74fc0c7241e14
      
https://github.com/qemu/qemu/commit/af411212ce32a3ba5b191795b8f74fc0c7241e14
  Author: Blue Swirl <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M configure
    M target-unicore32/Makefile.objs
    M target-unicore32/helper.h
    M target-unicore32/op_helper.c
    M target-unicore32/translate.c

  Log Message:
  -----------
  target-unicore32: switch to AREG0 free mode

Add an explicit CPUState parameter instead of relying on AREG0
and switch to AREG0 free mode.

Tested-by: Guan Xuetao <address@hidden>
Signed-off-by: Blue Swirl <address@hidden>
Signed-off-by: Michael Roth <address@hidden>


  Commit: 6178b83f35843d1b5026c039f80595dab40920b0
      
https://github.com/qemu/qemu/commit/6178b83f35843d1b5026c039f80595dab40920b0
  Author: Blue Swirl <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M target-arm/helper.h
    M target-arm/op_helper.c
    M target-arm/translate.c

  Log Message:
  -----------
  target-arm: convert void helpers

Add an explicit CPUState parameter instead of relying on AREG0.

For easier review, convert only op helpers which don't return any value.

Signed-off-by: Blue Swirl <address@hidden>
Reviewed-by: Peter Maydell <address@hidden>
Signed-off-by: Michael Roth <address@hidden>


  Commit: 883864650e8d1ca5bc12e2c8ecf86c898f205bdc
      
https://github.com/qemu/qemu/commit/883864650e8d1ca5bc12e2c8ecf86c898f205bdc
  Author: Blue Swirl <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M target-arm/helper.h
    M target-arm/op_helper.c
    M target-arm/translate.c

  Log Message:
  -----------
  target-arm: convert remaining helpers

Convert remaining helpers to AREG0 free mode: add an explicit
CPUState parameter instead of relying on AREG0.

Signed-off-by: Blue Swirl <address@hidden>
Reviewed-by: Peter Maydell <address@hidden>
Signed-off-by: Michael Roth <address@hidden>


  Commit: 40b1f8a804a9f388b104f051b9289ac188aebf3a
      
https://github.com/qemu/qemu/commit/40b1f8a804a9f388b104f051b9289ac188aebf3a
  Author: Blue Swirl <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M configure
    M target-arm/Makefile.objs
    M target-arm/cpu.h
    M target-arm/helper.c
    M target-arm/op_helper.c
    M target-arm/translate.c

  Log Message:
  -----------
  target-arm: final conversion to AREG0 free mode

Convert code load functions and switch to AREG0 free mode.

Signed-off-by: Blue Swirl <address@hidden>
Reviewed-by: Peter Maydell <address@hidden>
Signed-off-by: Michael Roth <address@hidden>


  Commit: c9b89e8224afc0cf22c96b2be0cfa706121fb301
      
https://github.com/qemu/qemu/commit/c9b89e8224afc0cf22c96b2be0cfa706121fb301
  Author: Blue Swirl <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M configure
    M target-microblaze/Makefile.objs
    M target-microblaze/helper.h
    M target-microblaze/op_helper.c
    M target-microblaze/translate.c

  Log Message:
  -----------
  target-microblaze: switch to AREG0 free mode

Add an explicit CPUState parameter instead of relying on AREG0
and switch to AREG0 free mode.

Signed-off-by: Blue Swirl <address@hidden>
Signed-off-by: Michael Roth <address@hidden>


  Commit: d36ae16dd4626ab0754f0a40af622ded306c30ed
      
https://github.com/qemu/qemu/commit/d36ae16dd4626ab0754f0a40af622ded306c30ed
  Author: Aurelien Jarno <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M target-cris/helper.h
    M target-cris/op_helper.c
    M target-cris/translate.c
    M target-cris/translate_v10.c

  Log Message:
  -----------
  target-cris: Avoid AREG0 for helpers

Add an explicit CPUCRISState parameter instead of relying on AREG0.

Signed-off-by: Blue Swirl <address@hidden>
Signed-off-by: Aurelien Jarno <address@hidden>
Signed-off-by: Michael Roth <address@hidden>


  Commit: c383331e9d2351187e8462816c4f45d8f345c35f
      
https://github.com/qemu/qemu/commit/c383331e9d2351187e8462816c4f45d8f345c35f
  Author: Aurelien Jarno <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M configure
    M target-cris/Makefile.objs
    M target-cris/helper.c
    M target-cris/op_helper.c
    M target-cris/translate.c
    M target-cris/translate_v10.c

  Log Message:
  -----------
  target-cris: Switch to AREG0 free mode

Add an explicit CPUCRISState parameter instead of relying on AREG0, and
use cpu_ld* in translation and interrupt handling. Remove AREG0 swapping
in tlb_fill(). Switch to AREG0 free mode

Signed-off-by: Blue Swirl <address@hidden>
Signed-off-by: Aurelien Jarno <address@hidden>
Signed-off-by: Michael Roth <address@hidden>


  Commit: ca75e568211d7546b1fc1586fa443e04c0b66f3f
      
https://github.com/qemu/qemu/commit/ca75e568211d7546b1fc1586fa443e04c0b66f3f
  Author: Blue Swirl <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M configure
    M target-sh4/Makefile.objs
    M target-sh4/helper.h
    M target-sh4/op_helper.c
    M target-sh4/translate.c

  Log Message:
  -----------
  target-sh4: switch to AREG0 free mode

Add an explicit CPUState parameter instead of relying on AREG0
and switch to AREG0 free mode.

Acked-by: Aurelien Jarno <address@hidden>
Signed-off-by: Blue Swirl <address@hidden>
Signed-off-by: Michael Roth <address@hidden>


  Commit: 0c4b3c0198a4a299a34a060d0faf812d09502837
      
https://github.com/qemu/qemu/commit/0c4b3c0198a4a299a34a060d0faf812d09502837
  Author: Blue Swirl <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M configure
    M target-mips/Makefile.objs
    M target-mips/cpu.h
    M target-mips/helper.h
    M target-mips/op_helper.c
    M target-mips/translate.c

  Log Message:
  -----------
  target-mips: switch to AREG0 free mode

Add an explicit CPUState parameter instead of relying on AREG0
and switch to AREG0 free mode.

Signed-off-by: Blue Swirl <address@hidden>
Acked-by: Aurelien Jarno <address@hidden>
Signed-off-by: Michael Roth <address@hidden>


  Commit: a0969d7a4656c550fed40537aa269cc18b859a9f
      
https://github.com/qemu/qemu/commit/a0969d7a4656c550fed40537aa269cc18b859a9f
  Author: Blue Swirl <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M Makefile.target
    M configure
    M cpu-all.h
    M cputlb.c
    R dyngen-exec.h
    M exec-all.h
    M hw/spapr_hcall.c
    M softmmu_defs.h
    M softmmu_header.h
    M softmmu_template.h
    M target-m68k/op_helper.c
    M target-sparc/Makefile.objs
    M tcg/arm/tcg-target.c
    M tcg/arm/tcg-target.h
    M tcg/hppa/tcg-target.c
    M tcg/hppa/tcg-target.h
    M tcg/i386/tcg-target.c
    M tcg/i386/tcg-target.h
    M tcg/ia64/tcg-target.c
    M tcg/ia64/tcg-target.h
    M tcg/mips/tcg-target.c
    M tcg/mips/tcg-target.h
    M tcg/ppc/tcg-target.c
    M tcg/ppc64/tcg-target.c
    M tcg/s390/tcg-target.c
    M tcg/s390/tcg-target.h
    M tcg/sparc/tcg-target.c
    M tcg/sparc/tcg-target.h
    M tcg/tci/tcg-target.c
    M tci.c
    M user-exec.c

  Log Message:
  -----------
  Remove unused CONFIG_TCG_PASS_AREG0 and dead code

Now that CONFIG_TCG_PASS_AREG0 is enabled for all targets,
remove dead code and support for !CONFIG_TCG_PASS_AREG0 case.

Remove dyngen-exec.h and all references to it. Although included by
hw/spapr_hcall.c, it does not seem to use it.

Remove unused HELPER_CFLAGS.

Signed-off-by: Blue Swirl <address@hidden>
Reviewed-by: Richard Henderson <address@hidden>
Signed-off-by: Michael Roth <address@hidden>


  Commit: ea15fd7c1af0a87e768e1f55351eea3132653800
      
https://github.com/qemu/qemu/commit/ea15fd7c1af0a87e768e1f55351eea3132653800
  Author: Aurelien Jarno <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M tcg/i386/tcg-target.c

  Log Message:
  -----------
  tcg/i386: allow constants in load/store ops

On x86, it is possible to move a constant value to memory. Add code to
handle a constant argument to load/store ops.

Reviewed-by: Richard Henderson <address@hidden>
Signed-off-by: Aurelien Jarno <address@hidden>
Signed-off-by: Michael Roth <address@hidden>


  Commit: d39d648846ea2c218542a7fdf88b783ddf3db36c
      
https://github.com/qemu/qemu/commit/d39d648846ea2c218542a7fdf88b783ddf3db36c
  Author: Aurelien Jarno <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M tcg/tcg-opc.h
    M tcg/tcg.c

  Log Message:
  -----------
  tcg: mark set_label with TCG_OPF_BB_END flag

set_label is effectively the end of a basic block, as no optimization
can be made accross it. It was treated as such in the liveness analysis
code, but as a special case.

Mark it with TCG_OPF_BB_END flag so that this information can be used
by other parts of the TCG code, and remove the special case in the liveness
analysis code.

Cc: Blue Swirl <address@hidden>
Signed-off-by: Aurelien Jarno <address@hidden>
Signed-off-by: Michael Roth <address@hidden>


  Commit: 4f17bc1e89f32b63a20b8a09d225918211c12202
      
https://github.com/qemu/qemu/commit/4f17bc1e89f32b63a20b8a09d225918211c12202
  Author: Aurelien Jarno <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M tcg/optimize.c
    M tcg/tcg.h

  Log Message:
  -----------
  revert "TCG: fix copy propagation"

Given the copy propagation breakage on 32-bit hosts has been fixed
commit e31b0a7c050711884ad570fe73df806520953618 can be reverted.

Cc: Blue Swirl <address@hidden>
Signed-off-by: Aurelien Jarno <address@hidden>
Signed-off-by: Michael Roth <address@hidden>


  Commit: d25c2359deb87b58ab2b44ccfd5d844aa1724216
      
https://github.com/qemu/qemu/commit/d25c2359deb87b58ab2b44ccfd5d844aa1724216
  Author: Richard Henderson <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M target-mips/translate.c

  Log Message:
  -----------
  target-mips: Set opn in gen_ldst_multiple.

Used by MIPS_DEBUG, when enabled.

Signed-off-by: Richard Henderson <address@hidden>
Acked-by: Aurelien Jarno <address@hidden>
Signed-off-by: Aurelien Jarno <address@hidden>
Signed-off-by: Michael Roth <address@hidden>


  Commit: fe07dcf262e742cb3016981a9910a7040c8d69e2
      
https://github.com/qemu/qemu/commit/fe07dcf262e742cb3016981a9910a7040c8d69e2
  Author: Richard Henderson <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M target-mips/translate.c

  Log Message:
  -----------
  target-mips: Fix MIPS_DEBUG.

The macro uses the DisasContext.  Pass it around as needed.

Signed-off-by: Richard Henderson <address@hidden>
Acked-by: Aurelien Jarno <address@hidden>
Signed-off-by: Aurelien Jarno <address@hidden>
Signed-off-by: Michael Roth <address@hidden>


  Commit: 447f11b945601632849d1fe48acca10664a90361
      
https://github.com/qemu/qemu/commit/447f11b945601632849d1fe48acca10664a90361
  Author: Richard Henderson <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M target-mips/translate.c

  Log Message:
  -----------
  target-mips: Always evaluate debugging macro arguments

this will prevent some of the compilation errors with debugging
enabled from creeping back in.

Signed-off-by: Richard Henderson <address@hidden>
Signed-off-by: Aurelien Jarno <address@hidden>
Signed-off-by: Michael Roth <address@hidden>


  Commit: 5b681fffe42695ecfaa2e06d6e66eaf7a040c1ff
      
https://github.com/qemu/qemu/commit/5b681fffe42695ecfaa2e06d6e66eaf7a040c1ff
  Author: Aurelien Jarno <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M tcg/optimize.c

  Log Message:
  -----------
  tcg/optimize: fix end of basic block detection

Commit e31b0a7c050711884ad570fe73df806520953618 fixed copy propagation on
32-bit host by restricting the copy between different types. This was the
wrong fix.

The real problem is that the all temps states should be reset at the end
of a basic block. This was done by adding such operations in the switch,
but brcond2 was forgotten (that's why the crash was only observed on 32-bit
hosts).

Fix that by looking at the TCG_OPF_BB_END instead. We need to keep the case
for op_set_label as temps might be modified through another path.

Cc: Blue Swirl <address@hidden>
Signed-off-by: Aurelien Jarno <address@hidden>
Signed-off-by: Michael Roth <address@hidden>


  Commit: 44219e7df216df7c91aa6fccf650f7f847541793
      
https://github.com/qemu/qemu/commit/44219e7df216df7c91aa6fccf650f7f847541793
  Author: Max Filippov <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M target-xtensa/translate.c

  Log Message:
  -----------
  target-xtensa: fix extui shift amount

extui opcode only uses lowermost op1 bit for sa4.

Reported-by: malc <address@hidden>
Signed-off-by: Max Filippov <address@hidden>
Cc: qemu-stable <address@hidden>
Signed-off-by: malc <address@hidden>
Signed-off-by: Michael Roth <address@hidden>


  Commit: cc10061717877fc65b5c734c43c55f471913ce92
      
https://github.com/qemu/qemu/commit/cc10061717877fc65b5c734c43c55f471913ce92
  Author: Max Filippov <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M target-xtensa/translate.c

  Log Message:
  -----------
  target-xtensa: don't emit extra tcg_gen_goto_tb

Unconditional gen_check_loop_end at the end of disas_xtensa_insn
can emit tcg_gen_goto_tb with slot id already used in the TB (e.g. when
TB ends at LEND with a branch).

Signed-off-by: Max Filippov <address@hidden>
Cc: qemu-stable <address@hidden>
Signed-off-by: malc <address@hidden>
Signed-off-by: Michael Roth <address@hidden>


  Commit: 6314cc0c7386888217fd857b79301866c8d9637c
      
https://github.com/qemu/qemu/commit/6314cc0c7386888217fd857b79301866c8d9637c
  Author: Richard Henderson <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M tcg/README
    M tcg/arm/tcg-target.h
    M tcg/hppa/tcg-target.h
    M tcg/i386/tcg-target.h
    M tcg/ia64/tcg-target.h
    M tcg/mips/tcg-target.h
    M tcg/ppc/tcg-target.h
    M tcg/ppc64/tcg-target.h
    M tcg/s390/tcg-target.h
    M tcg/sparc/tcg-target.h
    M tcg/tcg-op.h
    M tcg/tcg-opc.h
    M tcg/tcg.c
    M tcg/tcg.h
    M tcg/tci/tcg-target.h

  Log Message:
  -----------
  tcg: Introduce movcond

Implemented with setcond if the target does not provide
the optional opcode.

Signed-off-by: Richard Henderson <address@hidden>
Signed-off-by: Aurelien Jarno <address@hidden>
Signed-off-by: Michael Roth <address@hidden>


  Commit: 72bdbb7f46293fb4328ef4d409646dcff44b1dcc
      
https://github.com/qemu/qemu/commit/72bdbb7f46293fb4328ef4d409646dcff44b1dcc
  Author: Richard Henderson <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M target-alpha/translate.c

  Log Message:
  -----------
  target-alpha: Use movcond

For proper cmov insns, as well as the non-goto-tb case
of conditional branch.

Signed-off-by: Richard Henderson <address@hidden>
Signed-off-by: Aurelien Jarno <address@hidden>
Signed-off-by: Michael Roth <address@hidden>


  Commit: 52080f688bcf00585d08d8d0a15e47bbae5fe5b4
      
https://github.com/qemu/qemu/commit/52080f688bcf00585d08d8d0a15e47bbae5fe5b4
  Author: Richard Henderson <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M tcg/i386/tcg-target.c
    M tcg/i386/tcg-target.h

  Log Message:
  -----------
  tcg-i386: Implement movcond

Signed-off-by: Richard Henderson <address@hidden>
Reviewed-by: Aurelien Jarno <address@hidden>
Signed-off-by: Aurelien Jarno <address@hidden>
Signed-off-by: Michael Roth <address@hidden>


  Commit: b5b6bb16b9b104c36079a471f2d793b67a0d5e9c
      
https://github.com/qemu/qemu/commit/b5b6bb16b9b104c36079a471f2d793b67a0d5e9c
  Author: Richard Henderson <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M tcg/optimize.c

  Log Message:
  -----------
  tcg: Optimize movcond for constant comparisons

Signed-off-by: Richard Henderson <address@hidden>
Signed-off-by: Aurelien Jarno <address@hidden>
Signed-off-by: Michael Roth <address@hidden>


  Commit: 1d465a94add76ea3854f9cdf803ce6124e9e0e9d
      
https://github.com/qemu/qemu/commit/1d465a94add76ea3854f9cdf803ce6124e9e0e9d
  Author: Richard Henderson <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M tcg/optimize.c

  Log Message:
  -----------
  tcg: Optimize two-address commutative operations

While swapping constants to the second operand, swap
sources matching destinations to the first operand.

Signed-off-by: Richard Henderson <address@hidden>
Signed-off-by: Aurelien Jarno <address@hidden>
Signed-off-by: Michael Roth <address@hidden>


  Commit: 15658ad01b413b62b70b7590a0c81197848a30c2
      
https://github.com/qemu/qemu/commit/15658ad01b413b62b70b7590a0c81197848a30c2
  Author: Aurelien Jarno <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M gdbstub.c

  Log Message:
  -----------
  gdbstub/sh4: fix build with USE_SOFTFLOAT_STRUCT_TYPES

We have to use different type to access float values when
USE_SOFTFLOAT_STRUCT_TYPES is defined.

Rework SH4 version of cpu_gdb_{read,write}_register() using
a single case, and fixing the coding style. Use ldll_p() and
stfl_p() to access float values.

Signed-off-by: Aurelien Jarno <address@hidden>
Signed-off-by: Michael Roth <address@hidden>


  Commit: 4c8f62d3885422949db31a750a96f149db474e9d
      
https://github.com/qemu/qemu/commit/4c8f62d3885422949db31a750a96f149db474e9d
  Author: Richard Henderson <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M tcg/tcg.h

  Log Message:
  -----------
  tcg: Fix !USE_DIRECT_JUMP

Commit 6375e09e changed the type of TranslationBlock.tb_next,
but failed to change the type of TCGContext.tb_next.

Signed-off-by: Richard Henderson <address@hidden>
Reviewed-by: Andreas Färber <address@hidden>
Signed-off-by: Aurelien Jarno <address@hidden>
Signed-off-by: Michael Roth <address@hidden>


  Commit: fb1d48edb657e5f7cf9cf87097cc05f4d258ca04
      
https://github.com/qemu/qemu/commit/fb1d48edb657e5f7cf9cf87097cc05f4d258ca04
  Author: Richard Henderson <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M tcg/hppa/tcg-target.c

  Log Message:
  -----------
  tcg-hppa: Fix brcond2 and setcond2

Neither of these functions were performing double-word
compares properly.

Signed-off-by: Richard Henderson <address@hidden>
Signed-off-by: Aurelien Jarno <address@hidden>
Signed-off-by: Michael Roth <address@hidden>


  Commit: 707eee12fdc7e0abd0066ba04b1a2a924f823467
      
https://github.com/qemu/qemu/commit/707eee12fdc7e0abd0066ba04b1a2a924f823467
  Author: Richard Henderson <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M tcg/hppa/tcg-target.c

  Log Message:
  -----------
  tcg-hppa: Fix broken load/store helpers

The CONFIG_TCG_PASS_AREG0 code for calling ld/st helpers
was not respecting the ABI requirement for 64-bit values
being aligned in registers.

Mirror the ARM port in use of helper functions to marshal
arguments into the correct registers.

Signed-off-by: Richard Henderson <address@hidden>
Signed-off-by: Aurelien Jarno <address@hidden>
Signed-off-by: Michael Roth <address@hidden>


  Commit: df3e097e21ee80ed7eefa62fca02a7f30f23baa2
      
https://github.com/qemu/qemu/commit/df3e097e21ee80ed7eefa62fca02a7f30f23baa2
  Author: Aurelien Jarno <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M tcg/mips/tcg-target.c

  Log Message:
  -----------
  tcg-mips: fix wrong usage of 'Z' constraint

The 'Z' constraint has been introduced to map the zero register. However
when the op also accept a constant, there is no point to accept the zero
register in addition.

Reviewed-by: Richard Henderson <address@hidden>
Signed-off-by: Aurelien Jarno <address@hidden>
Signed-off-by: Michael Roth <address@hidden>


  Commit: b7505cfd52d4a5fc8bd21d898d6cd1b76f7a9b91
      
https://github.com/qemu/qemu/commit/b7505cfd52d4a5fc8bd21d898d6cd1b76f7a9b91
  Author: Aurelien Jarno <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M tcg/mips/tcg-target.c

  Log Message:
  -----------
  tcg/mips: kill warnings in user mode

Recent versions of GCC emit warnings when compiling user mode targets.
Kill them by reordering a bit the #ifdef.

Reviewed-by: Richard Henderson <address@hidden>
Signed-off-by: Aurelien Jarno <address@hidden>
Signed-off-by: Michael Roth <address@hidden>


  Commit: f25f0d7751a88c3a7fbaab9979cec095c6a7cdc6
      
https://github.com/qemu/qemu/commit/f25f0d7751a88c3a7fbaab9979cec095c6a7cdc6
  Author: Aurelien Jarno <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M tcg/mips/tcg-target.c

  Log Message:
  -----------
  tcg/mips: use TCGArg or TCGReg instead of int

Instead of int, use the correct TCGArg and TCGReg type: TCGReg when
representing a TCG target register, TCGArg when representing the latter
or a constant.

Reviewed-by: Richard Henderson <address@hidden>
Signed-off-by: Aurelien Jarno <address@hidden>
Signed-off-by: Michael Roth <address@hidden>


  Commit: 8193cdd0d003de347e48c80e27ae0e92002dd6e5
      
https://github.com/qemu/qemu/commit/8193cdd0d003de347e48c80e27ae0e92002dd6e5
  Author: Aurelien Jarno <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M tcg/mips/tcg-target.c

  Log Message:
  -----------
  tcg/mips: don't use global pointer

Don't use the global pointer in TCG, in case helpers try access global
variables.

Signed-off-by: Aurelien Jarno <address@hidden>
Signed-off-by: Michael Roth <address@hidden>


  Commit: adf89e7483269563731284dc75c572efa23cfd97
      
https://github.com/qemu/qemu/commit/adf89e7483269563731284dc75c572efa23cfd97
  Author: Aurelien Jarno <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M tcg/mips/tcg-target.c

  Log Message:
  -----------
  tcg/mips: use stack for TCG temps

Use stack instead of temp_buf array in CPUState for TCG
temps.

Reviewed-by: Richard Henderson <address@hidden>
Signed-off-by: Aurelien Jarno <address@hidden>
Signed-off-by: Michael Roth <address@hidden>


  Commit: 86b4f7ca0571f50f5727cfaaf31aa94bb4437cc9
      
https://github.com/qemu/qemu/commit/86b4f7ca0571f50f5727cfaaf31aa94bb4437cc9
  Author: Aurelien Jarno <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M tcg/mips/tcg-target.c

  Log Message:
  -----------
  tcg/mips: optimize brcond arg, 0

MIPS has some conditional branch instructions when comparing with zero.
Use them.

Reviewed-by: Richard Henderson <address@hidden>
Signed-off-by: Aurelien Jarno <address@hidden>
Signed-off-by: Michael Roth <address@hidden>


  Commit: 3b63392482a72f89e08dbbd221f56fda8907803c
      
https://github.com/qemu/qemu/commit/3b63392482a72f89e08dbbd221f56fda8907803c
  Author: Aurelien Jarno <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M tcg/mips/tcg-target.c
    M tcg/mips/tcg-target.h

  Log Message:
  -----------
  tcg/mips: optimize bswap{16,16s,32} on MIPS32R2

bswap operations can be optimized on MIPS32 Release 2 using the ROTR,
WSBH and SEH instructions. We can't use the non-R2 code to implement the
ops due to registers constraints, so don't define the corresponding
TCG_TARGET_HAS_bswap* values.

Also bswap16* operations are supposed to be called with the 16 high bits
zeroed. This is the case everywhere (including for TCG by definition)
except when called from the store helper. Remove the AND instructions from
bswap16* and move it there.

Reviewed-by: Richard Henderson <address@hidden>
Signed-off-by: Aurelien Jarno <address@hidden>
Signed-off-by: Michael Roth <address@hidden>


  Commit: a8067da5d1e31a1232eb836d351057ceb79161dc
      
https://github.com/qemu/qemu/commit/a8067da5d1e31a1232eb836d351057ceb79161dc
  Author: Aurelien Jarno <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M tcg/mips/tcg-target.c
    M tcg/mips/tcg-target.h

  Log Message:
  -----------
  tcg/mips: implement rotl/rotr ops on MIPS32R2

rotr operations can be optimized on MIPS32 Release 2 using the ROTR and
ROTRV instructions. Also implemented rotl operations by subtracting the
shift from 32.

Reviewed-by: Richard Henderson <address@hidden>
Signed-off-by: Aurelien Jarno <address@hidden>
Signed-off-by: Michael Roth <address@hidden>


  Commit: 6d82e71b6ad199c0656a29ad7625abe3d996d0fa
      
https://github.com/qemu/qemu/commit/6d82e71b6ad199c0656a29ad7625abe3d996d0fa
  Author: Aurelien Jarno <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M tcg/mips/tcg-target.c
    M tcg/mips/tcg-target.h

  Log Message:
  -----------
  tcg/mips: implement deposit op on MIPS32R2

deposit operations can be optimized on MIPS32 Release 2 using the INS
instruction.

Reviewed-by: Richard Henderson <address@hidden>
Signed-off-by: Aurelien Jarno <address@hidden>
Signed-off-by: Michael Roth <address@hidden>


  Commit: 7ef9bee92493b85b944e0c8a0f2bd1867e2c091c
      
https://github.com/qemu/qemu/commit/7ef9bee92493b85b944e0c8a0f2bd1867e2c091c
  Author: Aurelien Jarno <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M tcg/mips/tcg-target.c
    M tcg/mips/tcg-target.h

  Log Message:
  -----------
  tcg/mips: implement movcond op on MIPS32R2

movcond operation can be implemented on MIPS32 Release 2 using the MOVN,
MOVZ, SLT and SLTU instructions.

Reviewed-by: Richard Henderson <address@hidden>
Signed-off-by: Aurelien Jarno <address@hidden>
Signed-off-by: Michael Roth <address@hidden>


  Commit: ad797145ae485d64ece97ed61bc719a1e425b06a
      
https://github.com/qemu/qemu/commit/ad797145ae485d64ece97ed61bc719a1e425b06a
  Author: Aurelien Jarno <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M tcg/optimize.c

  Log Message:
  -----------
  tcg/optimize: remove TCG_TEMP_ANY

TCG_TEMP_ANY has no different meaning than TCG_TEMP_UNDEF, so use
the later instead.

Reviewed-by: Richard Henderson <address@hidden>
Signed-off-by: Aurelien Jarno <address@hidden>
Signed-off-by: Michael Roth <address@hidden>


  Commit: a4c701ee768cc9f6ff7dda4081b3293caf9ba837
      
https://github.com/qemu/qemu/commit/a4c701ee768cc9f6ff7dda4081b3293caf9ba837
  Author: Aurelien Jarno <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M tcg/optimize.c

  Log Message:
  -----------
  tcg/optimize: check types in copy propagation

The copy propagation doesn't check the types of the temps during copy
propagation. However TCG is using the mov_i32 for the i64 to i32
conversion and thus the two are not equivalent.

With this patch tcg_opt_gen_mov() doesn't consider two temps of
different type as copies anymore.

So far it seems the optimization was not aggressive enough to trigger
this bug, but it will be triggered later in this series once the copy
propagation is improved.

Reviewed-by: Richard Henderson <address@hidden>
Signed-off-by: Aurelien Jarno <address@hidden>
Signed-off-by: Michael Roth <address@hidden>


  Commit: a17f24e08ddcf740bb235232c71aac8fba2a7c19
      
https://github.com/qemu/qemu/commit/a17f24e08ddcf740bb235232c71aac8fba2a7c19
  Author: Aurelien Jarno <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M tcg/optimize.c

  Log Message:
  -----------
  tcg/optimize: rework copy progagation

The copy propagation pass tries to keep track what is a copy of what
and what has copy of what, and in addition it keep a circular list of
of all the copies. Unfortunately this doesn't fully work: a mov from
a temp which has a state "COPY" changed it into a state "HAS_COPY".
Later when this temp is used again, it is considered has not having
copy and thus no propagation is done.

This patch fixes that by removing the hiearchy between copies, and thus
only keeping a "COPY" state both meaning "is a copy" and "has a copy".
The decision of which copy to use is deferred to the actual temp
replacement. At this stage there is not one best choice to do, but only
better choices than others. For doing the best choice the operation
would have to be parsed in reversed to know if a temp is going to be
used later or not. That what is done by the liveness analysis. At this
stage it is known that globals will be always live, that local temps
will be dead at the end of the translation block, and that the temps
will be dead at the end of the basic block. This means that this stage
should try to replace temps by local temps or globals and local temps
by globals.

Reviewed-by: Richard Henderson <address@hidden>
Signed-off-by: Aurelien Jarno <address@hidden>
Signed-off-by: Michael Roth <address@hidden>


  Commit: 6599e3faaea1228a1f8c9010775bb9e0c66ea552
      
https://github.com/qemu/qemu/commit/6599e3faaea1228a1f8c9010775bb9e0c66ea552
  Author: Aurelien Jarno <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M tcg/optimize.c

  Log Message:
  -----------
  tcg/optimize: do copy propagation for all operations

It is possible to due copy propagation for all operations, even the one
that have side effects or clobber arguments (it only concerns input
arguments). That said, the call operation should be handled differently
due to the variable number of arguments.

Reviewed-by: Richard Henderson <address@hidden>
Signed-off-by: Aurelien Jarno <address@hidden>
Signed-off-by: Michael Roth <address@hidden>


  Commit: d3b9fb75c601df3c8ec85af7187b7007bc635d87
      
https://github.com/qemu/qemu/commit/d3b9fb75c601df3c8ec85af7187b7007bc635d87
  Author: Aurelien Jarno <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M tcg/optimize.c

  Log Message:
  -----------
  tcg/optimize: optimize "op r, a, a => mov r, a"

Now that we can easily detect all copies, we can optimize the
"op r, a, a => mov r, a" case a bit more.

Reviewed-by: Richard Henderson <address@hidden>
Signed-off-by: Aurelien Jarno <address@hidden>
Signed-off-by: Michael Roth <address@hidden>


  Commit: f4643451e980a0da8b1a9f70b9a1355220ab9288
      
https://github.com/qemu/qemu/commit/f4643451e980a0da8b1a9f70b9a1355220ab9288
  Author: Aurelien Jarno <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M tcg/optimize.c

  Log Message:
  -----------
  tcg/optimize: optimize "op r, a, a => movi r, 0"

Now that it's possible to detect copies, we can optimize the case
the "op r, a, a => movi r, 0". This helps in the computation of
overflow flags when one of the two args is 0.

Reviewed-by: Richard Henderson <address@hidden>
Signed-off-by: Aurelien Jarno <address@hidden>
Signed-off-by: Michael Roth <address@hidden>


  Commit: 26adaf07da61b9bd92cb49430611ffe5a0ca3cfd
      
https://github.com/qemu/qemu/commit/26adaf07da61b9bd92cb49430611ffe5a0ca3cfd
  Author: Aurelien Jarno <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M tcg/optimize.c

  Log Message:
  -----------
  tcg/optimize: further optimize brcond/movcond/setcond

When both argument of brcond/movcond/setcond are the same or when one
of the two values is a constant equal to zero, it's possible to do
further optimizations.

Reviewed-by: Richard Henderson <address@hidden>
Signed-off-by: Aurelien Jarno <address@hidden>
Signed-off-by: Michael Roth <address@hidden>


  Commit: cfca711212fb5a99104897a593e9ea45f140a0a2
      
https://github.com/qemu/qemu/commit/cfca711212fb5a99104897a593e9ea45f140a0a2
  Author: Aurelien Jarno <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M tcg/optimize.c

  Log Message:
  -----------
  tcg/optimize: prefer the "op a, a, b" form for commutative ops

The "op a, a, b" form is better handled on non-RISC host than the "op
a, b, a" form, so swap the arguments to this form when possible, and
when b is not a constant.

This reduces the number of generated instructions by a tiny bit.

Reviewed-by: Richard Henderson <address@hidden>
Signed-off-by: Aurelien Jarno <address@hidden>
Signed-off-by: Michael Roth <address@hidden>


  Commit: ffc1c5681583f0d576855432a57e34496d2657a8
      
https://github.com/qemu/qemu/commit/ffc1c5681583f0d576855432a57e34496d2657a8
  Author: Aurelien Jarno <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M tcg/tcg.c

  Log Message:
  -----------
  tcg: remove #ifdef #endif around TCGOpcode tests

Commit 25c4d9cc changed all TCGOpcode enums to be available, so we don't
need to #ifdef #endif the one that are available only on some targets.
This makes the code easier to read.

Reviewed-by: Richard Henderson <address@hidden>
Signed-off-by: Aurelien Jarno <address@hidden>
Signed-off-by: Michael Roth <address@hidden>


  Commit: 2e1d09263b66dac508b308163606e22f9275a4ce
      
https://github.com/qemu/qemu/commit/2e1d09263b66dac508b308163606e22f9275a4ce
  Author: Aurelien Jarno <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M tcg/optimize.c

  Log Message:
  -----------
  tcg/optimize: add constant folding for deposit

Reviewed-by: Richard Henderson <address@hidden>
Signed-off-by: Aurelien Jarno <address@hidden>
Signed-off-by: Michael Roth <address@hidden>


  Commit: 5096a7c7d8529de2994a1bc47a1ba01d622ce0de
      
https://github.com/qemu/qemu/commit/5096a7c7d8529de2994a1bc47a1ba01d622ce0de
  Author: Max Filippov <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M tcg/README

  Log Message:
  -----------
  tcg/README: document tcg_gen_goto_tb restrictions

See
http://lists.nongnu.org/archive/html/qemu-devel/2012-09/msg03196.html
for the whole story.

Signed-off-by: Max Filippov <address@hidden>
Signed-off-by: Aurelien Jarno <address@hidden>
Signed-off-by: Michael Roth <address@hidden>


  Commit: a48028b8e9ec7a2063c1ac83acda006cd7b1289a
      
https://github.com/qemu/qemu/commit/a48028b8e9ec7a2063c1ac83acda006cd7b1289a
  Author: Stefan Weil <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M tcg/i386/tcg-target.c
    M tcg/i386/tcg-target.h

  Log Message:
  -----------
  w64: Fix TCG helper functions with 5 arguments

TCG uses 6 registers for function arguments on 64 bit Linux hosts,
but only 4 registers on W64 hosts.

Commit 2999a0b20074a7e4a58f56572bb1436749368f59 increased the number
of arguments for some important helper functions from 4 to 5
which triggered a bug for W64 hosts: QEMU aborts when executing
helper_lcall_real in the guest's BIOS because function
tcg_target_get_call_iarg_regs_count always returned 6.

As W64 has only 4 registers for arguments, the 5th argument must be
passed on the stack using a correct stack offset.

Signed-off-by: Stefan Weil <address@hidden>
Signed-off-by: Aurelien Jarno <address@hidden>
Signed-off-by: Michael Roth <address@hidden>


  Commit: 6164c1274eae35ddb3036860f2d52b93f4a72d3d
      
https://github.com/qemu/qemu/commit/6164c1274eae35ddb3036860f2d52b93f4a72d3d
  Author: malc <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M tcg/ppc/tcg-target.c
    M tcg/ppc/tcg-target.h

  Log Message:
  -----------
  tcg/ppc32: Implement movcond32

Thanks to Richard Henderson

Signed-off-by: malc <address@hidden>
Signed-off-by: Michael Roth <address@hidden>


  Commit: ee13de285330be3c00ba0cef8b3fd65ad6b6e9e7
      
https://github.com/qemu/qemu/commit/ee13de285330be3c00ba0cef8b3fd65ad6b6e9e7
  Author: Richard Henderson <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M tcg/sparc/tcg-target.c

  Log Message:
  -----------
  tcg-sparc: Hack in qemu_ld/st64 for 32-bit.

Not actually implemented, but at least we avoid the tcg assert at startup.

Signed-off-by: Richard Henderson <address@hidden>
Signed-off-by: Michael Roth <address@hidden>


  Commit: e183eb99fa4dd0c2aa92b36dc8a00ab524ac366d
      
https://github.com/qemu/qemu/commit/e183eb99fa4dd0c2aa92b36dc8a00ab524ac366d
  Author: Richard Henderson <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M tcg/sparc/tcg-target.c

  Log Message:
  -----------
  tcg-sparc: Fix ADDX opcode.

Signed-off-by: Richard Henderson <address@hidden>
Signed-off-by: Michael Roth <address@hidden>


  Commit: e1784a4cbd441e24064b347fa85b0fc4eae6056b
      
https://github.com/qemu/qemu/commit/e1784a4cbd441e24064b347fa85b0fc4eae6056b
  Author: Richard Henderson <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M exec.c

  Log Message:
  -----------
  tcg-sparc: Don't MAP_FIXED on top of the program

The address we pick in sparc64.ld is also 0x60000000, so doing a fixed map
on top of that is guaranteed to blow up.  Choosing 0x40000000 is exactly
right for the max of code_gen_buffer_size set below.

No need to ever use MAP_FIXED.  While getting our desired address helps
optimize the generated code, we won't fail if we don't get it.

Signed-off-by: Richard Henderson <address@hidden>
Signed-off-by: Michael Roth <address@hidden>


  Commit: 181dd0b27c3b450630b3dadb072f73423b4bf193
      
https://github.com/qemu/qemu/commit/181dd0b27c3b450630b3dadb072f73423b4bf193
  Author: Richard Henderson <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M configure
    M disas.c
    M exec.c
    M qemu-timer.h
    M tcg/sparc/tcg-target.c
    M tcg/sparc/tcg-target.h
    M tcg/tcg.c

  Log Message:
  -----------
  tcg-sparc: Assume v9 cpu always, i.e. force v8plus in 32-bit mode.

Current code doesn't actually work in 32-bit mode at all.  Since
no one really noticed, drop the complication of v7 and v8 cpus.
Eliminate the --sparc_cpu configure option and standardize macro
testing on TCG_TARGET_REG_BITS / HOST_LONG_BITS

Signed-off-by: Richard Henderson <address@hidden>
Signed-off-by: Michael Roth <address@hidden>


  Commit: e85ec822e9f892587b5bf913fe6dcac8e6357a0e
      
https://github.com/qemu/qemu/commit/e85ec822e9f892587b5bf913fe6dcac8e6357a0e
  Author: Richard Henderson <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M tcg/sparc/tcg-target.c

  Log Message:
  -----------
  tcg-sparc: Fix qemu_ld/st to handle 32-bit host.

At the same time, split out the tlb load logic to a new function.
Fixes the cases of two data registers and two address registers.
Fixes the signature of, and adds missing, qemu_ld/st opcodes.

Signed-off-by: Richard Henderson <address@hidden>
Signed-off-by: Michael Roth <address@hidden>


  Commit: 757ee3f9e270e9baa14a91348cd73d9c12729edb
      
https://github.com/qemu/qemu/commit/757ee3f9e270e9baa14a91348cd73d9c12729edb
  Author: Richard Henderson <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M configure
    M tcg/sparc/tcg-target.c
    M tcg/sparc/tcg-target.h

  Log Message:
  -----------
  tcg-sparc: Support GUEST_BASE.

Signed-off-by: Richard Henderson <address@hidden>
Signed-off-by: Michael Roth <address@hidden>


  Commit: 60db655378a158ebdcb938b1d240873f3180bf74
      
https://github.com/qemu/qemu/commit/60db655378a158ebdcb938b1d240873f3180bf74
  Author: Richard Henderson <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M tcg/sparc/tcg-target.c
    M tcg/sparc/tcg-target.h

  Log Message:
  -----------
  tcg-sparc: Change AREG0 in generated code to %i0.

We can now move the TCG variable from %g[56] to a call-preserved
windowed register.

Signed-off-by: Richard Henderson <address@hidden>
Signed-off-by: Michael Roth <address@hidden>


  Commit: 5c7199f164a26142290b548ede30ebc9538b4573
      
https://github.com/qemu/qemu/commit/5c7199f164a26142290b548ede30ebc9538b4573
  Author: Richard Henderson <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M configure
    M tcg/sparc/tcg-target.c
    M tcg/sparc/tcg-target.h

  Log Message:
  -----------
  tcg-sparc: Clean up cruft stemming from attempts to use global registers.

Don't use -ffixed-gN.  Don't link statically.  Don't save/restore
AREG0 around calls.  Don't allocate space on the stack for AREG0 save.

Signed-off-by: Richard Henderson <address@hidden>
Signed-off-by: Michael Roth <address@hidden>


  Commit: db0cfd14ba6da14dba0913cdb6e6933d34283cd8
      
https://github.com/qemu/qemu/commit/db0cfd14ba6da14dba0913cdb6e6933d34283cd8
  Author: Richard Henderson <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M tcg/sparc/tcg-target.c

  Log Message:
  -----------
  tcg-sparc: Mask shift immediates to avoid illegal insns.

The xtensa-test image generates a sra_i32 with count 0x40.
Whether this is accident of tcg constant propagation or
originating directly from the instruction stream is immaterial.

Signed-off-by: Richard Henderson <address@hidden>
Signed-off-by: Michael Roth <address@hidden>


  Commit: 39cbcb4b4534131d5a6d0673ce0c792e804e7d75
      
https://github.com/qemu/qemu/commit/39cbcb4b4534131d5a6d0673ce0c792e804e7d75
  Author: Richard Henderson <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M tcg/sparc/tcg-target.c

  Log Message:
  -----------
  tcg-sparc: Use defines for temporaries.

And change from %i4/%i5 to %g1/%o7 to remove a v8plus fixme.

Signed-off-by: Richard Henderson <address@hidden>
Signed-off-by: Michael Roth <address@hidden>


  Commit: ba8b16fac5ce6ee871e31c09ca8b03ac9f753f1e
      
https://github.com/qemu/qemu/commit/ba8b16fac5ce6ee871e31c09ca8b03ac9f753f1e
  Author: Richard Henderson <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M tcg/sparc/tcg-target.c

  Log Message:
  -----------
  tcg-sparc: Add %g/%o registers to alloc_order

Signed-off-by: Richard Henderson <address@hidden>
Signed-off-by: Michael Roth <address@hidden>


  Commit: 38df9027cefe2a0f40a0fcf26e0730602bd5d9b2
      
https://github.com/qemu/qemu/commit/38df9027cefe2a0f40a0fcf26e0730602bd5d9b2
  Author: Richard Henderson <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M exec-all.h
    M tcg/sparc/tcg-target.c

  Log Message:
  -----------
  tcg-sparc: Fix and enable direct TB chaining.

Signed-off-by: Richard Henderson <address@hidden>
Signed-off-by: Michael Roth <address@hidden>


  Commit: fef28a4336858cf25bb61f14b2283f2093541bf5
      
https://github.com/qemu/qemu/commit/fef28a4336858cf25bb61f14b2283f2093541bf5
  Author: Richard Henderson <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M tcg/sparc/tcg-target.c

  Log Message:
  -----------
  tcg-sparc: Preserve branch destinations during retranslation

Signed-off-by: Richard Henderson <address@hidden>
Signed-off-by: Michael Roth <address@hidden>


  Commit: df6502fac572b22c2332acc828d2503239e4cda7
      
https://github.com/qemu/qemu/commit/df6502fac572b22c2332acc828d2503239e4cda7
  Author: Richard Henderson <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M target-alpha/translate.c

  Log Message:
  -----------
  target-alpha: Initialize env->cpu_model_str

Save the cpu_model_str so that we have a non-null value when
creating a new cpu during clone.

Signed-off-by: Richard Henderson <address@hidden>
Signed-off-by: Andreas Färber <address@hidden>
Signed-off-by: Michael Roth <address@hidden>


  Commit: 6c975d03a28bb6ec7b8296ac3834ab31a25ccc43
      
https://github.com/qemu/qemu/commit/6c975d03a28bb6ec7b8296ac3834ab31a25ccc43
  Author: Aurelien Jarno <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M tcg/mips/tcg-target.c
    M tcg/mips/tcg-target.h

  Log Message:
  -----------
  tcg/mips: fix MIPS32(R2) detection

Fix the MIPS32(R2) cpu detection so that it also works with
-march=octeon. Thanks to Andrew Pinski for the hint.

Cc: Andrew Pinski <address@hidden>
Signed-off-by: Aurelien Jarno <address@hidden>
Signed-off-by: Michael Roth <address@hidden>


  Commit: e1312991ed3eb9f2a177332c40f7d13d24d9c3ce
      
https://github.com/qemu/qemu/commit/e1312991ed3eb9f2a177332c40f7d13d24d9c3ce
  Author: Richard Henderson <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M tcg/README

  Log Message:
  -----------
  tcg: Adjust descriptions of *cond opcodes

The README file documented the operand ordering of the tcg_gen_*
functions.  Since we're documenting opcodes here, use the true
operand ordering.

Signed-off-by: Richard Henderson <address@hidden>
Cc: malc <address@hidden>
Signed-off-by: Aurelien Jarno <address@hidden>
Signed-off-by: Michael Roth <address@hidden>


  Commit: c90a8840b47a1641ad6e46e4a52520e1148127c5
      
https://github.com/qemu/qemu/commit/c90a8840b47a1641ad6e46e4a52520e1148127c5
  Author: Aurelien Jarno <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M tcg/i386/tcg-target.c

  Log Message:
  -----------
  tcg/i386: fix build with -march < i686

The movcond_i32 op has to be protected with TCG_TARGET_HAS_movcond_i32
to fix the build with -march < i686.

Thanks to Richard Henderson for the hint.

Reported-by: Alex Barcelo <address@hidden>
Signed-off-by: Aurelien Jarno <address@hidden>
Signed-off-by: Michael Roth <address@hidden>


  Commit: e46258fb502546961aae5548ce388b3d7ea929f8
      
https://github.com/qemu/qemu/commit/e46258fb502546961aae5548ce388b3d7ea929f8
  Author: Stefan Weil <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M def-helper.h
    M exec-all.h

  Log Message:
  -----------
  tcg: Fix MAX_OPC_PARAM_IARGS

DEF_HELPER_FLAGS_5 was added some time ago without adjusting
MAX_OPC_PARAM_IARGS.

Fixing the definition becomes more important as QEMU is using
an increasing number of helper functions called with 5 arguments.

Add also a comment to avoid future problems when DEF_HELPER_FLAGS_6
will be added.

Signed-off-by: Stefan Weil <address@hidden>
Reviewed-by: Richard Henderson <address@hidden>
Signed-off-by: Blue Swirl <address@hidden>
Signed-off-by: Michael Roth <address@hidden>


  Commit: 7fd494086b2bbc83595ea7d63ca0e54f2917c203
      
https://github.com/qemu/qemu/commit/7fd494086b2bbc83595ea7d63ca0e54f2917c203
  Author: Stefan Weil <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M tcg/tci/tcg-target.c
    M tci.c

  Log Message:
  -----------
  tci: Fix for AREG0 free mode

Support for helper functions with 5 arguments was missing
in the code generator and in the interpreter.

There is no need to pass the constant TCG_AREG0 from the
code generator to the interpreter. Remove that code for
the INDEX_op_qemu_st* opcodes.

Signed-off-by: Stefan Weil <address@hidden>
Signed-off-by: Aurelien Jarno <address@hidden>
Signed-off-by: Michael Roth <address@hidden>


  Commit: 3c82758f04af24d3f642c0b808689d0cb26840aa
      
https://github.com/qemu/qemu/commit/3c82758f04af24d3f642c0b808689d0cb26840aa
  Author: Christophe Fergeau <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M ui/spice-core.c

  Log Message:
  -----------
  spice: abort on invalid streaming cmdline params

When parsing its command line parameters, spice aborts when it
finds unexpected values, except for the 'streaming-video' option.
This happens because the parsing of the parameters for this option
is done using the 'name2enum' helper, which does not error out
on unknown values. Using the 'parse_name' helper makes sure we
error out in this case. Looking at git history, the use of
'name2enum' instead of 'parse_name' seems to have been an oversight,
so let's change to that now.

Fixes rhbz#831708

Signed-off-by: Gerd Hoffmann <address@hidden>
(cherry picked from commit 835cab85ad83ed8dfe1c13243aeda5959b153e3e)

Signed-off-by: Michael Roth <address@hidden>


  Commit: fc24f3bd2ed4c97c99ad40e747732ae46dff2009
      
https://github.com/qemu/qemu/commit/fc24f3bd2ed4c97c99ad40e747732ae46dff2009
  Author: Yonit Halperin <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M ui/spice-core.c

  Log Message:
  -----------
  spice: notify spice server on vm start/stop

Spice server needs to know about the vm state in order to prevent
attempts to write to devices when they are stopped, mainly during
the non-live stage of migration.
Instead, spice will take care of restoring this writes, on the migration
target side, after migration completes.

Signed-off-by: Yonit Halperin <address@hidden>
Signed-off-by: Gerd Hoffmann <address@hidden>
(cherry picked from commit f5bb039c6d97ef3e664094eab3c9a4dc1824ed73)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 25bc2251ebb0fd7cfbc08d6e4bc27acac5aa7a6e
      
https://github.com/qemu/qemu/commit/25bc2251ebb0fd7cfbc08d6e4bc27acac5aa7a6e
  Author: Yonit Halperin <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M hw/qxl.c
    M ui/spice-core.c
    M ui/spice-display.c
    M ui/spice-display.h

  Log Message:
  -----------
  spice: notify on vm state change only via spice_server_vm_start/stop

QXLWorker->start/stop are deprecated since spice-server 0.11.2

Signed-off-by: Yonit Halperin <address@hidden>
Signed-off-by: Gerd Hoffmann <address@hidden>
(cherry picked from commit 71d388d420e68ac77cd42f15f7e68cf5a6fb01b2)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 986b9a1a2ae917a61ba4016c71e0505750202985
      
https://github.com/qemu/qemu/commit/986b9a1a2ae917a61ba4016c71e0505750202985
  Author: Yonit Halperin <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M monitor.c
    M monitor.h
    M ui/spice-core.c

  Log Message:
  -----------
  spice migration: add QEVENT_SPICE_MIGRATE_COMPLETED

When migrating, libvirt queries the migration status, and upon migration
completions, it closes the migration src. On the other hand, when
migration is completed, spice transfers data from the src to destination
via the client. This data is required for keeping the spice session
after migration, without suffering from data loss and inconsistencies.
In order to allow this data transfer, we add QEVENT for signaling
libvirt that spice migration has completed, and libvirt needs to wait
for this event before quitting the src process.

Signed-off-by: Yonit Halperin <address@hidden>
Signed-off-by: Gerd Hoffmann <address@hidden>
(cherry picked from commit 2fdd16e239c2a2763aa3266e637718123328688c)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 38a01d68c6bad5a4d9859aaa3a40c6c5df4b799e
      
https://github.com/qemu/qemu/commit/38a01d68c6bad5a4d9859aaa3a40c6c5df4b799e
  Author: Yonit Halperin <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M hmp.c
    M qapi-schema.json
    M ui/spice-core.c

  Log Message:
  -----------
  spice: add 'migrated' flag to spice info

The flag is 'true' when spice migration has completed on the src side.
It is needed for a case where libvirt dies before migration completes
and it misses the event QEVENT_SPICE_MIGRATE_COMPLETED.
When libvirt is restored and queries the migration status, it also needs
to query spice and check if its migration has completed.

Signed-off-by: Yonit Halperin <address@hidden>
Signed-off-by: Gerd Hoffmann <address@hidden>
(cherry picked from commit 61c4efe2cb85b0a9c6bc68f6a2dd107c8d7ec080)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 7908e4a3882e81dad38c7563541c8b9eee7f4132
      
https://github.com/qemu/qemu/commit/7908e4a3882e81dad38c7563541c8b9eee7f4132
  Author: Yonit Halperin <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M qemu-config.c
    M qemu-options.hx
    M ui/spice-core.c

  Log Message:
  -----------
  spice: adding seamless-migration option to the command line

The seamless-migration flag is required in order to identify
whether libvirt supports the new QEVENT_SPICE_MIGRATE_COMPLETED or not
(by default the flag is off).
New libvirt versions that wait for QEVENT_SPICE_MIGRATE_COMPLETED should turn 
on this flag.
When this flag is off, spice fallbacks to its old migration method, which
can result in data loss.

Signed-off-by: Yonit Halperin <address@hidden>
Signed-off-by: Gerd Hoffmann <address@hidden>
(cherry picked from commit 8c9570530c819821b9b5cc3113d2b2966afe7621)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 615198836ce2b21eb0910a8d22027965d5353044
      
https://github.com/qemu/qemu/commit/615198836ce2b21eb0910a8d22027965d5353044
  Author: Yonit Halperin <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M qemu-options.hx

  Log Message:
  -----------
  spice: increase the verbosity of spice section in "qemu --help"

Added all spice options to the help string. This can be used by libvirt
to determine which spice related features are supported by qemu.

Signed-off-by: Yonit Halperin <address@hidden>
Signed-off-by: Gerd Hoffmann <address@hidden>
(cherry picked from commit 27af778828db9aa893fa1de928744141e5de20e5)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 5b7582af06bd4313a12663ac96681940edae87de
      
https://github.com/qemu/qemu/commit/5b7582af06bd4313a12663ac96681940edae87de
  Author: Alon Levy <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M hw/qxl.c

  Log Message:
  -----------
  qxl/update_area_io: guest_bug on invalid parameters

Signed-off-by: Alon Levy <address@hidden>
Signed-off-by: Gerd Hoffmann <address@hidden>
(cherry picked from commit 511b13e2c9b426b3c56060909693de5097f0b496)

Signed-off-by: Michael Roth <address@hidden>


  Commit: b75c71057538a5e720afa2a122721fe2e6095d02
      
https://github.com/qemu/qemu/commit/b75c71057538a5e720afa2a122721fe2e6095d02
  Author: Alon Levy <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M configure
    M hw/qxl.c
    M hw/qxl.h
    M trace-events
    M ui/spice-display.h

  Log Message:
  -----------
  qxl: add QXL_IO_MONITORS_CONFIG_ASYNC

Revision bumped to 4 for new IO support, enabled for spice-server >=
0.11.1. New io enabled if revision is 4. Revision can be set to 4.

[ kraxel: 3 continues to be the default revision.  Once we have a new
    stable spice-server release and the qemu patches to enable
    the new bits merged we'll go flip the switch and make rev4
    the default ]

This io calls the corresponding new spice api
spice_qxl_monitors_config_async to let spice-server read a new guest set
monitors config and notify the client.

On migration reissue spice_qxl_monitors_config_async.

RHBZ: 770842

Signed-off-by: Alon Levy <address@hidden>
Signed-off-by: Gerd Hoffmann <address@hidden>

fixup

Signed-off-by: Gerd Hoffmann <address@hidden>
(cherry picked from commit 020af1c45fec664d5d4cf3b8e5117f8bc1d691f2)

Conflicts:

        hw/qxl.c

Signed-off-by: Michael Roth <address@hidden>


  Commit: ea4c86551de72721d52507af252f1aa541c29ac0
      
https://github.com/qemu/qemu/commit/ea4c86551de72721d52507af252f1aa541c29ac0
  Author: Alon Levy <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M configure

  Log Message:
  -----------
  configure: print spice-protocol and spice-server versions

Signed-off-by: Alon Levy <address@hidden>
Signed-off-by: Gerd Hoffmann <address@hidden>
(cherry picked from commit 2e0e3c399aa8067148055b9ea0edb822c5b584d2)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 23086b20543b71ce8e1ec435ef65923d93b1dcbb
      
https://github.com/qemu/qemu/commit/23086b20543b71ce8e1ec435ef65923d93b1dcbb
  Author: Amos Kong <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M hmp-commands.hx

  Log Message:
  -----------
  fix doc of using raw values with sendkey

(qemu) sendkey a
(qemu) sendkey 0x1e
(qemu) sendkey #0x1e
 unknown key: '#0x1e'

The last command doesn't work, '#' is not requested before
raw values, and the raw value in decimal format is not supported.

Signed-off-by: Amos Kong <address@hidden>
Signed-off-by: Luiz Capitulino <address@hidden>
(cherry picked from commit 886cc706ce5d4d3d1c296f028ddc2991cfbe3bbe)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 122b92d90af40cff485e5e9ba2a64842d1f7ff48
      
https://github.com/qemu/qemu/commit/122b92d90af40cff485e5e9ba2a64842d1f7ff48
  Author: Stefan Weil <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M scripts/qapi-visit.py

  Log Message:
  -----------
  qapi: Fix potential NULL pointer segfault

Report from smatch:

qapi-visit.c:1640 visit_type_BlockdevAction(8) error:
 we previously assumed 'obj' could be null (see line 1639)
qapi-visit.c:2432 visit_type_NetClientOptions(8) error:
 we previously assumed 'obj' could be null (see line 2431)

Signed-off-by: Stefan Weil <address@hidden>
Reviewed-by: Paolo Bonzini <address@hidden>
Signed-off-by: Luiz Capitulino <address@hidden>
(cherry picked from commit 227ccf6bff234c29974c2c18ecd3a29e6b965e3d)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 3aec24d19512bff2ffb0bf3bb97b8a48e47a8825
      
https://github.com/qemu/qemu/commit/3aec24d19512bff2ffb0bf3bb97b8a48e47a8825
  Author: Stefan Weil <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M qobject.h

  Log Message:
  -----------
  json-parser: Fix potential NULL pointer segfault

Report from smatch:
json-parser.c:474 parse_object(62) error: potential null derefence 'dict'.
json-parser.c:553 parse_array(75) error: potential null derefence 'list'.

Label 'out' in json-parser.c can be called with list == NULL
which is passed to QDECREF.

Modify QDECREF to handle a NULL argument (inline function qobject_decref
already handles them, too).

Signed-off-by: Stefan Weil <address@hidden>
Signed-off-by: Luiz Capitulino <address@hidden>
(cherry picked from commit 149474c93490e1c66f838391bd491db83136d91d)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 6ac46e32164002183aeda3dde0b82afca72f9131
      
https://github.com/qemu/qemu/commit/6ac46e32164002183aeda3dde0b82afca72f9131
  Author: Jason Baron <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M hw/pci.c
    M hw/pcie.h

  Log Message:
  -----------
  pcie: drop version_id field for live migration

While testing q35 live migration, I found that the migration would abort with
the following error: "Unknown savevm section type 76".

The error is due to this check failing in 'vmstate_load_state()':

    while(field->name) {
  if ((field->field_exists &&
       field->field_exists(opaque, version_id)) ||
      (!field->field_exists &&
       field->version_id <= version_id)) {

The VMSTATE_PCIE_DEVICE() currently has a 'version_id' set to 2. However,
'version_id' in the above check is 1. And thus we fail to load the pcie device
field. Further the code returns to 'qemu_loadvm_state()' which produces the
error that I saw.

I'm proposing to fix this by simply dropping the 'version_id' field from
VMSTATE_PCIE_DEVICE(). VMSTATE_PCI_DEVICE() defines no such field and further
the vmstate_pcie_device that VMSTATE_PCI_DEVICE() refers to is already
versioned. Thus, any versioning issues could be detected at the vmsd level.

Taking a step back, I think that the 'field->version_id' should be compared
against a saved version number for the field not the 'version_id'. Futhermore,
once vmstate_load_state() is called recursively on another vmsd, the check of:

    if (version_id > vmsd->version_id) {
  return -EINVAL;
    }

Will never fail since version_id is always equal to vmsd->version_id. So I'm
wondering why we aren't storing the vmsd version id of the source in the
migration stream?

This patch also renames the 'name' field of vmstate_pcie_device from:
PCIDevice -> PCIEDevice to differentiate it from vmstate_pci_device.

Signed-off-by: Jason Baron <address@hidden>
Signed-off-by: Michael S. Tsirkin <address@hidden>
(cherry picked from commit 1de53459272d89c52bb21b45d5d970de40fbb642)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 4382057785cc3e8c674977300dafced0e3be9f7b
      
https://github.com/qemu/qemu/commit/4382057785cc3e8c674977300dafced0e3be9f7b
  Author: Jason Baron <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M hw/pcie_aer.c

  Log Message:
  -----------
  pcie_aer: clear cmask for Advanced Error Interrupt Message Number

The Advanced Error Interrupt Message Number (bits 31:27 of the Root
Error Status Register) is updated when the number of msi messages assigned to a
device changes. Migration of windows 7 on q35 chipset failed because the check
in get_pci_config_device() fails due to cmask being set on these bits. Its valid
to update these bits and we must restore this state across migration.

Signed-off-by: Jason Baron <address@hidden>
Signed-off-by: Michael S. Tsirkin <address@hidden>
(cherry picked from commit 0e180d9c8a7429c55d23d2e7855f1e490a063aaa)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 4de6467cbc8f3ddff7f2dcb63f427b0e92de0e9d
      
https://github.com/qemu/qemu/commit/4de6467cbc8f3ddff7f2dcb63f427b0e92de0e9d
  Author: Henning Schild <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M hw/elf_ops.h

  Log Message:
  -----------
  fix entry pointer for ELF kernels loaded with -kernel option

 Find a hopefully proper patch attached. Take it or leave it.

Reviewed-by: Kevin Wolf <address@hidden>
Signed-off-by: Henning Schild <address@hidden>
Signed-off-by: Aurelien Jarno <address@hidden>
(cherry picked from commit 7e9c7ffe9fd9dfc3d0168dd584936db8144b230b)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 635cc81bf91135c12035f56ac5b6ce28cb19c5ab
      
https://github.com/qemu/qemu/commit/635cc81bf91135c12035f56ac5b6ce28cb19c5ab
  Author: Aurelien Jarno <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M hw/lan9118.c

  Log Message:
  -----------
  lan9118: fix multicast filtering

The lan9118 emulation tries to compute the multicast index by calling
directly the crc32() function from zlib, but fails to get the correct
result.

Use the common compute_mcast_idx() function instead, which gives the
correct result. This fixes IPv6 support.

Reviewed-by: Peter Maydell <address@hidden>
Signed-off-by: Aurelien Jarno <address@hidden>
(cherry picked from commit 449bc90e1f2e2fbafb64eb0c76d16c9352b0d2df)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 27aae39fa04c7fe714aabf18f65994538c65fb12
      
https://github.com/qemu/qemu/commit/27aae39fa04c7fe714aabf18f65994538c65fb12
  Author: Maciej W. Rozycki <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M target-mips/cpu.h
    M target-mips/op_helper.c
    M target-mips/translate.c

  Log Message:
  -----------
  MIPS/user: Fix reset CPU state initialization

 This change updates the CPU reset sequence to use a common piece of code
that figures out CPU state flags, fixing the problem with MIPS_HFLAG_COP1X
not being set where applicable that causes floating-point MADD family
instructions (and other instructions from the MIPS IV FP subset) to trap.

 As compute_hflags is now shared between op_helper.c and translate.c, the
function is now moved to a common header.  There are no changes to this
function.

 The problem was seen with the 24Kf MIPS32r2 processor in user emulation.
The new approach prevents system and user emulation from diverging -- all
the hflags state is initialized in one place now.

Signed-off-by: Maciej W. Rozycki <address@hidden>
Signed-off-by: Aurelien Jarno <address@hidden>
(cherry picked from commit 03e6e5017757645f00b2f3b4f3a257973985e455)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 2ecd8831e048b058e4b3067f33f1c436b93f850a
      
https://github.com/qemu/qemu/commit/2ecd8831e048b058e4b3067f33f1c436b93f850a
  Author: Fabien Chouteau <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M MAINTAINERS

  Log Message:
  -----------
  Add MAINTAINERS entry for leon3

Signed-off-by: Fabien Chouteau <address@hidden>
Signed-off-by: Blue Swirl <address@hidden>
(cherry picked from commit ce6c760c37b9a88db87c5b9b9bf39ca866e570f6)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 47b11da1e94aa17109522f97a6188f5ecd75c25e
      
https://github.com/qemu/qemu/commit/47b11da1e94aa17109522f97a6188f5ecd75c25e
  Author: Jan Kiszka <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M hw/musicpal.c

  Log Message:
  -----------
  musicpal: Fix flash mapping

The old arithmetic assumed 32 physical address bits which is no longer
true for ARM since 3cc0cd61f4.

Signed-off-by: Jan Kiszka <address@hidden>
Signed-off-by: Blue Swirl <address@hidden>
(cherry picked from commit 0c267217ca9985e6d118ec8368bebd382db7a099)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 7566759fd5896456fd6fa6d94ed388c11158dcef
      
https://github.com/qemu/qemu/commit/7566759fd5896456fd6fa6d94ed388c11158dcef
  Author: Christian Borntraeger <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M configure
    M kvm-all.c

  Log Message:
  -----------
  qemu: Use valgrind annotations to mark kvm guest memory as defined

valgrind with kvm produces a big amount of false positives regarding
"Conditional jump or move depends on uninitialised value(s)". This
happens because the guest memory is allocated with qemu_vmalloc which
boils down posix_memalign etc. This function is (correctly) considered
by valgrind as returning undefined memory.

Since valgrind is based on jitting code, it will not be able to see
changes made by the guest to guest memory if this is done by KVM_RUN,
thus keeping most of the guest memory undefined.

Now lots of places in qemu will then use guest memory to change behaviour.
To avoid the flood of these messages, lets declare the whole guest
memory as defined. This will reduce the noise and allows us to see real
problems.

In the future we might want to make this conditional, since there
is actually something that we can use those false positives for:
These messages will point to code that depends on guest memory, so
we can use these backtraces to actually make an audit that is focussed
only at those code places. For normal development we dont want to
see those messages, though.

Signed-off-by: Christian Borntraeger <address@hidden>
Signed-off-by: Avi Kivity <address@hidden>
(cherry picked from commit 62fe83318d2fc5b31f473d66326910d94c1c4907)

Signed-off-by: Michael Roth <address@hidden>


  Commit: bd4dba66584c36e33195e42ed4d503549b17d4d8
      
https://github.com/qemu/qemu/commit/bd4dba66584c36e33195e42ed4d503549b17d4d8
  Author: Stefan Weil <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M hw/wm8750.c

  Log Message:
  -----------
  hw/wm8750: Fix potential buffer overflow

Report from smatch:

hw/wm8750.c:369 wm8750_tx(12) error: buffer overflow 's->i2c_data' 2 <= 2

It looks like the preprocessor statements were simply misplaced.

Replace also __FUNCTION__ by __func__ to please checkpatch.pl.

Signed-off-by: Stefan Weil <address@hidden>
Reviewed-by: Peter Maydell <address@hidden>
Signed-off-by: Aurelien Jarno <address@hidden>
(cherry picked from commit 149eeb5fe57b853081e8059575d91b8a58a4f96c)

Signed-off-by: Michael Roth <address@hidden>


  Commit: b750d224664bd4b726c87117f51f90e47516230f
      
https://github.com/qemu/qemu/commit/b750d224664bd4b726c87117f51f90e47516230f
  Author: Stefan Weil <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M hw/mcf5206.c

  Log Message:
  -----------
  hw/mcf5206: Fix buffer overflow for MBAR read / write

Report from smatch:

mcf5206.c:384 m5206_mbar_readb(7) error: buffer overflow 'm5206_mbar_width' 128 
<= 128
mcf5206.c:403 m5206_mbar_readw(8) error: buffer overflow 'm5206_mbar_width' 128 
<= 128
mcf5206.c:427 m5206_mbar_readl(8) error: buffer overflow 'm5206_mbar_width' 128 
<= 128
mcf5206.c:451 m5206_mbar_writeb(9) error: buffer overflow 'm5206_mbar_width' 
128 <= 128
mcf5206.c:475 m5206_mbar_writew(9) error: buffer overflow 'm5206_mbar_width' 
128 <= 128
mcf5206.c:503 m5206_mbar_writel(9) error: buffer overflow 'm5206_mbar_width' 
128 <= 128

m5206_mbar_width has 0x80 elements and supports 0 <= offset < 0x200.

Signed-off-by: Stefan Weil <address@hidden>
Reviewed-by: Peter Maydell <address@hidden>
Signed-off-by: Aurelien Jarno <address@hidden>
(cherry picked from commit a32354e206895400d17c3de9a8df1de96d3df289)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 82645b9e93c649a586fdd5248f267dea474663a4
      
https://github.com/qemu/qemu/commit/82645b9e93c649a586fdd5248f267dea474663a4
  Author: Michael Tokarev <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M configure

  Log Message:
  -----------
  use --libexecdir instead of ignoring it first and reinventing it later

Commit 7b93fadf3a38d1ed65ea5536a52efc2772c6e3b8 "Add basic version
of bridge helper" put the bridge helper executable into a fixed
${prefix}/libexec/ location, instead of using ${libexecdir} for
this.  At the same time, --libexecdir is being happily ignored
by ./configure.  Even more, the same patch sets unused $libexecdir
variable in the generated config-host.mak, and uses fixed string
(\${prefix}/libexecdir) for the bridge helper binary.

Fix this braindamage by introducing $libexecdir variable, using
it for the bridge helper binary, and recognizing --libexecdir.

This patch is applicable to stable-1.1.

Reviewed-by: Andreas Färber <address@hidden>
Reviewed-by: Corey Bryant <address@hidden>
Signed-off-by: Michael Tokarev <address@hidden>
Cc: Corey Bryant <address@hidden>
Cc: Richa Marwaha <address@hidden>
Cc: address@hidden
Signed-off-by: Anthony Liguori <address@hidden>
(cherry picked from commit 8bf188aa18ef7a8355d9edbd43871d590468c4ed)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 5af6b07ab063a9d98f60965d1295cae444f257fc
      
https://github.com/qemu/qemu/commit/5af6b07ab063a9d98f60965d1295cae444f257fc
  Author: Anthony Liguori <address@hidden>
  Date:   2012-10-08 (Mon, 08 Oct 2012)

  Changed paths:
    M qemu-char.c

  Log Message:
  -----------
  socket: don't attempt to reconnect a TCP socket in server mode

Commit c3767ed0eb5d0bb25fe409ae5dec06e3411ff1b6 introduced a possible SEGV when
using a socket chardev with server=on because it assumes that all TCP sockets
are in client mode.

This patch adds a check to only reconnect when in client mode.

Cc: Lei Li <address@hidden>
Reported-by: Michael Roth <address@hidden>
Signed-off-by: Anthony Liguori <address@hidden>
(cherry picked from commit 455aa1e0818653c41fd794435b982426ce21ba2f)

Signed-off-by: Michael Roth <address@hidden>


  Commit: b5701820f8fb1c52d26da6bcedb0729a869a9b55
      
https://github.com/qemu/qemu/commit/b5701820f8fb1c52d26da6bcedb0729a869a9b55
  Author: Daniel P. Berrange <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M configure

  Log Message:
  -----------
  Add ability to force enable/disable of tools build

The qemu-img, qemu-nbd and qemu-io tools are built conditionally
based on whether any softmmu target is enabled. These are useful
self-contained tools which can be used in many other scenarios.
Add new --enable-tools/--disable-tools args to configure to allow
the user to explicitly turn on / off their build. The default
behaviour is now to build these tools are all times, regardless
of whether any softmmu target is enabled

Signed-off-by: Daniel P. Berrange <address@hidden>
Signed-off-by: Anthony Liguori <address@hidden>
(cherry picked from commit 4b1c11fd20e8901f04a2d9c225cd10fc05a762ff)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 4ebbf3229acac66085ca467d79cac38befebc28d
      
https://github.com/qemu/qemu/commit/4ebbf3229acac66085ca467d79cac38befebc28d
  Author: Hans de Goede <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M hw/usb/hcd-ehci.c
    M hw/usb/hcd-uhci.c

  Log Message:
  -----------
  usb: controllers do not need to check for babble themselves

If an (emulated) usb-device tries to write more data to a packet then
its iov len, this will trigger an assert in usb_packet_copy(), and if
a driver somehow circumvents that check and writes more data to the
iov then there is space, we have a much bigger problem then not correctly
reporting babble to the guest.

In practice babble will only happen with (real) redirected devices, and there
both the usb-host os and the qemu usb-device code already check for it.

Signed-off-by: Hans de Goede <address@hidden>
Signed-off-by: Gerd Hoffmann <address@hidden>
(cherry picked from commit 45b339b18c660eb85af2ba25bfcaed5469660d77)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 597330bd8d9e7d96a699749da8c8b2cd82110151
      
https://github.com/qemu/qemu/commit/597330bd8d9e7d96a699749da8c8b2cd82110151
  Author: Hans de Goede <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M hw/usb/core.c

  Log Message:
  -----------
  usb-core: Don't set packet state to complete on a nak

This way the hcd can re-use the same packet to retry without needing
to re-init it.

Signed-off-by: Hans de Goede <address@hidden>
Signed-off-by: Gerd Hoffmann <address@hidden>
(cherry picked from commit cc40997489260f405aecccd30d4626ceee862502)

Signed-off-by: Michael Roth <address@hidden>


  Commit: d780116ab095a3ac1e2a6b98f13ee4effde01544
      
https://github.com/qemu/qemu/commit/d780116ab095a3ac1e2a6b98f13ee4effde01544
  Author: Hans de Goede <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M hw/usb.h
    M hw/usb/core.c

  Log Message:
  -----------
  usb-core: Add a usb_ep_find_packet_by_id() helper function

Signed-off-by: Hans de Goede <address@hidden>
Signed-off-by: Gerd Hoffmann <address@hidden>
(cherry picked from commit c13a9e61366cc3e28299d8faeb65e65c6e5964cf)

Signed-off-by: Michael Roth <address@hidden>


  Commit: d6e508d3a5dacacf5b93daaf9eb4bc35e01a124d
      
https://github.com/qemu/qemu/commit/d6e508d3a5dacacf5b93daaf9eb4bc35e01a124d
  Author: Hans de Goede <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M hw/usb/core.c

  Log Message:
  -----------
  usb-core: Allow the first packet of a pipelined ep to complete immediately

This can happen with usb-redir live-migration when the packet gets re-queued
after the migration and the original queuing from the migration source side
has already finished.

Signed-off-by: Hans de Goede <address@hidden>
Signed-off-by: Gerd Hoffmann <address@hidden>
(cherry picked from commit 9c1f67654ab611553bbfca54a1e0922728c25760)

Signed-off-by: Michael Roth <address@hidden>


  Commit: a37d5e521a948dc582c66e52e84a0348a8c11de9
      
https://github.com/qemu/qemu/commit/a37d5e521a948dc582c66e52e84a0348a8c11de9
  Author: Hans de Goede <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M hw/usb/hcd-ehci.c

  Log Message:
  -----------
  Revert "ehci: don't flush cache on doorbell rings."

This reverts commit 9bc3a3a216e2689bfcdd36c3e079333bbdbf3ba0, which got
added to fix an issue where the real, underlying cause was not stopping
the ep queue on an error.

Now that the underlying cause is fixed by the "usb: Halt ep queue and
cancel pending packets on a packet error" patch, the "don't flush" fix
is no longer needed.

Not only is it not needed, it causes us to see cancellations (unlinks)
done by the Linux EHCI driver too late, which in combination with the new
usb-core packet-id generation where qtd addresses are used as ids, causes
duplicate ids for in flight packets.

Signed-off-by: Hans de Goede <address@hidden>
(cherry picked from commit 66f092d25697e11847b61d761c38ddebedaed8d1)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 712fc762a65479e2a4c77bf51da520ec6dcf4cb5
      
https://github.com/qemu/qemu/commit/712fc762a65479e2a4c77bf51da520ec6dcf4cb5
  Author: Hans de Goede <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M hw/usb/hcd-ehci.c

  Log Message:
  -----------
  ehci: Validate qh is not changed unexpectedly by the guest

-combine the qh check with the check for devaddr changes
-also ensure that p gets set to NULL when the queue gets cancelled on
 devaddr change, which was not done properly before this patch

Signed-off-by: Hans de Goede <address@hidden>
(cherry picked from commit dafe31fc2a8653b535d58f8c7b250c0827b14420)

Signed-off-by: Michael Roth <address@hidden>


  Commit: c15d61b25279a9fb704cb466db85f8d91ad9d12c
      
https://github.com/qemu/qemu/commit/c15d61b25279a9fb704cb466db85f8d91ad9d12c
  Author: Hans de Goede <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M hw/usb/hcd-ehci.c

  Log Message:
  -----------
  ehci: Update copyright headers to reflect recent work

Update copyright headers to reflect all the work Gerd and I have been doing
on the EHCI emulation.

Signed-off-by: Hans de Goede <address@hidden>
(cherry picked from commit 522079dd4461c38b9a88bf31a65ea038c5b2be45)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 307fea863ad31b6cd6ceb44d2585f610f33db938
      
https://github.com/qemu/qemu/commit/307fea863ad31b6cd6ceb44d2585f610f33db938
  Author: Hans de Goede <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M hw/usb/hcd-ehci.c

  Log Message:
  -----------
  ehci: Properly cleanup packets on cancel

Signed-off-by: Hans de Goede <address@hidden>
(cherry picked from commit 0e7953525f52aa6c098dc0c1ce0b4a80ce82da45)

Signed-off-by: Michael Roth <address@hidden>


  Commit: a8cf10d5d64c15c39ded647cf244fa45249c612e
      
https://github.com/qemu/qemu/commit/a8cf10d5d64c15c39ded647cf244fa45249c612e
  Author: Hans de Goede <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M hw/usb/hcd-ehci.c

  Log Message:
  -----------
  ehci: Properly report completed but not yet processed packets to the guest

Reported packets which have completed before being cancelled as such to the
host. Note that the new code path this patch adds is untested since it I've
been unable to actually trigger the race which needs this code path.

Signed-off-by: Hans de Goede <address@hidden>
(cherry picked from commit 4b63a0df3bda8a2c278e45d9d94d9ba6d5791d8d)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 4a6cdb480704d37d9ead3972b051558c42a7d54d
      
https://github.com/qemu/qemu/commit/4a6cdb480704d37d9ead3972b051558c42a7d54d
  Author: Gerd Hoffmann <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M hw/usb/hcd-ehci.c

  Log Message:
  -----------
  ehci: check for EHCI_ASYNC_FINISHED first in ehci_free_packet

Otherwise we'll see the packet free twice in the trace log even though
it actually happens only once.

Signed-off-by: Gerd Hoffmann <address@hidden>
(cherry picked from commit 616789cde2a83fad5e634880fd20214f0c984fd5)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 62fc5e6983152380d11d88ae5d3374a6cfda6939
      
https://github.com/qemu/qemu/commit/62fc5e6983152380d11d88ae5d3374a6cfda6939
  Author: Gerd Hoffmann <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M hw/usb/hcd-ehci.c
    M trace-events

  Log Message:
  -----------
  ehci: trace guest bugs

make qemu_queue_{cancel,reset} return the number of packets released,
so the caller can figure whenever there have been active packets even
though there shouldn't have been any.  Add tracepoint to log this.

Signed-off-by: Gerd Hoffmann <address@hidden>
(cherry picked from commit 5c514681abbb3ae2f61f517c1aa3197f2f3ca93c)

Signed-off-by: Michael Roth <address@hidden>


  Commit: d294ad632382a89b8219d7bb7ae675256a39f162
      
https://github.com/qemu/qemu/commit/d294ad632382a89b8219d7bb7ae675256a39f162
  Author: Gerd Hoffmann <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M hw/usb/hcd-ehci.c
    M trace-events

  Log Message:
  -----------
  ehci: add doorbell trace events

Signed-off-by: Gerd Hoffmann <address@hidden>
(cherry picked from commit 1defcbd1e81d67476b6e4e486bcd4d869162900d)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 0154d330c71bb483fdf39c766b32044921656bf3
      
https://github.com/qemu/qemu/commit/0154d330c71bb483fdf39c766b32044921656bf3
  Author: Hans de Goede <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M hw/usb/hcd-ehci.c

  Log Message:
  -----------
  ehci: Add some additional ehci_trace_guest_bug() calls

Signed-off-by: Hans de Goede <address@hidden>
Signed-off-by: Gerd Hoffmann <address@hidden>
(cherry picked from commit 3a8ca08e01ea4baafff2a513655008cdd00feebf)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 2f7ba4731bcc2d92760f291ea8b264bdc69dcc55
      
https://github.com/qemu/qemu/commit/2f7ba4731bcc2d92760f291ea8b264bdc69dcc55
  Author: Hans de Goede <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M hw/usb/hcd-ehci.c

  Log Message:
  -----------
  ehci: Fix memory leak in handling of NAK-ed packets

Currently each time we try to execute a NAK-ed packet we redo
ehci_init_transfer, and usb_packet_map, re-allocing (without freeing) the
sg list every time.

This patch fixes this, it does this by introducing another async state, so
that we also properly cleanup a NAK-ed packet on cancel.

Signed-off-by: Hans de Goede <address@hidden>
Signed-off-by: Gerd Hoffmann <address@hidden>
(cherry picked from commit ef5b234477df80700b128f561f5877a0688a70c8)

Signed-off-by: Michael Roth <address@hidden>


  Commit: e2ab86fe2d89db5a5dcf128f627e3b5c27fef5f5
      
https://github.com/qemu/qemu/commit/e2ab86fe2d89db5a5dcf128f627e3b5c27fef5f5
  Author: Hans de Goede <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M hw/usb/hcd-ehci.c

  Log Message:
  -----------
  ehci: Handle USB_RET_PROCERR in ehci_fill_queue

USB_RET_PROCERR can be triggered by the guest (by for example requesting more
then BUFFSIZE bytes), so don't assert on it.

Signed-off-by: Hans de Goede <address@hidden>
Signed-off-by: Gerd Hoffmann <address@hidden>
(cherry picked from commit eff6dce79bd7ad3c16d75c5e55b5a2a137ba6a60)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 77c3d59256533ea3377d33647a91f2337a9c760d
      
https://github.com/qemu/qemu/commit/77c3d59256533ea3377d33647a91f2337a9c760d
  Author: Hans de Goede <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M hw/usb/hcd-ehci.c

  Log Message:
  -----------
  ehci: Correct a comment in fetchqtd packet processing

Since my previous comment said "Should never happen", I tried changing the
next line to an assert(0), which did not go well, which as the new comments
explains is logical if you think about it for a moment.

Signed-off-by: Hans de Goede <address@hidden>
Signed-off-by: Gerd Hoffmann <address@hidden>
(cherry picked from commit cf1f81691d1998fa8fe5bfcb8b498fb3723cf3c3)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 1d5ba9a6a8051964bfdc1b36ee066f1765cf15c8
      
https://github.com/qemu/qemu/commit/1d5ba9a6a8051964bfdc1b36ee066f1765cf15c8
  Author: Hans de Goede <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M hw/usb/redirect.c

  Log Message:
  -----------
  usb-redir: Never return USB_RET_NAK for async handled packets

USB_RET_NAK is not a valid response for async handled packets (and will
trigger an assert as such).

Also drop the warning when receiving a status of cancelled for packets not
cancelled by qemu itself, this can happen when a device gets unredirected
by the usbredir-host while transfers are pending.

Signed-off-by: Hans de Goede <address@hidden>
Signed-off-by: Gerd Hoffmann <address@hidden>
(cherry picked from commit 181133404f520fab40a3ad40d935d91cf3cf546c)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 14ecfb09faafd07263e03c5f4772083a360dc36b
      
https://github.com/qemu/qemu/commit/14ecfb09faafd07263e03c5f4772083a360dc36b
  Author: Hans de Goede <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M hw/usb/redirect.c

  Log Message:
  -----------
  usb-redir: Don't delay handling of open events to a bottom half

There is no need for this, and doing so means that a backend trying to
write immediately after an open event will see qemu_chr_be_can_write
returning 0, which not all backends handle well as there is no wakeup
mechanism to detect when the frontend does become writable.

Signed-off-by: Hans de Goede <address@hidden>
Signed-off-by: Gerd Hoffmann <address@hidden>
(cherry picked from commit ed9873bfbf145c084d039baab08c63b9d67e7bd3)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 57eae744d45204e5b04b5ddcd9be044fef0b7da0
      
https://github.com/qemu/qemu/commit/57eae744d45204e5b04b5ddcd9be044fef0b7da0
  Author: Hans de Goede <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M hw/usb/redirect.c

  Log Message:
  -----------
  usb-redir: Get rid of async-struct get member

This is a preparation patch for completely getting rid of the async-packet
struct in usb-redir, instead relying on the (new) per ep queues in the
qemu usb core.

Signed-off-by: Hans de Goede <address@hidden>
Signed-off-by: Gerd Hoffmann <address@hidden>
(cherry picked from commit cb897117cdedd488f19985c8ec5ea05971103a27)

Signed-off-by: Michael Roth <address@hidden>


  Commit: aa57b628e0db7756746d83c2ca16034341356bc8
      
https://github.com/qemu/qemu/commit/aa57b628e0db7756746d83c2ca16034341356bc8
  Author: Hans de Goede <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M hw/usb/redirect.c

  Log Message:
  -----------
  usb-redir: Get rid of local shadow copy of packet headers

The shadow copy only serves as an extra check (besides the packet-id) to
ensure the packet we get back is a reply to the packet we think it is.

This check has never triggered in all the time usb-redir is in use now,
and since the verified data in the returned packet-header is not used
otherwise, removing the check does not open any possibilities for the
usbredirhost to confuse us.

This is a preparation patch for completely getting rid of the async-packet
struct in usb-redir, instead relying on the (new) per ep queues in the
qemu usb core.

Signed-off-by: Hans de Goede <address@hidden>
Signed-off-by: Gerd Hoffmann <address@hidden>
(cherry picked from commit 104981d52b63dc3d68f39d4442881c667f44bbb9)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 55a2f465b9ee17ddaa4a869f6b9733615c20f96d
      
https://github.com/qemu/qemu/commit/55a2f465b9ee17ddaa4a869f6b9733615c20f96d
  Author: Hans de Goede <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M hw/usb/redirect.c

  Log Message:
  -----------
  usb-redir: Get rid of unused async-struct dev member

This is a preparation patch for completely getting rid of the async-packet
struct in usb-redir, instead relying on the (new) per ep queues in the
qemu usb core.

Signed-off-by: Hans de Goede <address@hidden>
Signed-off-by: Gerd Hoffmann <address@hidden>
(cherry picked from commit 206e7f20fe7b920b362bcc02608680c5d5527f2a)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 636071de92b4a559a38203ba08ebea04df5212a9
      
https://github.com/qemu/qemu/commit/636071de92b4a559a38203ba08ebea04df5212a9
  Author: Hans de Goede <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M hw/usb/redirect.c

  Log Message:
  -----------
  usb-redir: Move to core packet id and queue handling

Signed-off-by: Hans de Goede <address@hidden>
Signed-off-by: Gerd Hoffmann <address@hidden>
(cherry picked from commit de550a6afb468ed3b8171019e19b63ae8254886d)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 22ba7a7488c5b6ecba901b4253184fa0815318eb
      
https://github.com/qemu/qemu/commit/22ba7a7488c5b6ecba901b4253184fa0815318eb
  Author: Hans de Goede <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M hw/usb/redirect.c

  Log Message:
  -----------
  usb-redir: Return babble when getting more bulk data then requested

Babble is the appropriate error in this case (rather then signalling a stall).

Signed-off-by: Hans de Goede <address@hidden>
Signed-off-by: Gerd Hoffmann <address@hidden>
(cherry picked from commit 2979a36183a3902cd75665e7c6bbc8668668fd17)

Signed-off-by: Michael Roth <address@hidden>


  Commit: fbcb89ddc9808ad4bb63c46d6e47ea088516a7a7
      
https://github.com/qemu/qemu/commit/fbcb89ddc9808ad4bb63c46d6e47ea088516a7a7
  Author: Samuel Thibault <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M hw/usb/dev-serial.c

  Log Message:
  -----------
  Better name usb braille device

Windows users need to know that they have to use the Baum driver to make
the qemu braille device work.

Signed-off-by: Samuel Thibault <address@hidden>
Signed-off-by: Gerd Hoffmann <address@hidden>
(cherry picked from commit 2964cd9bfa5100e433471d3e3fedcc9d62891894)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 3e3750e10ad3443defe1dce204b455e2a7368bbf
      
https://github.com/qemu/qemu/commit/3e3750e10ad3443defe1dce204b455e2a7368bbf
  Author: Gerd Hoffmann <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M hw/usb/dev-audio.c

  Log Message:
  -----------
  usb-audio: fix usb version

usb-audio is a full speed (1.1) device,
but bcdUSB claims it is usb 2.0.  Fix it.

Signed-off-by: Gerd Hoffmann <address@hidden>
(cherry picked from commit 2bbd086c41a00dc4384727ec895a94890c688eb5)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 64022e9d58dc7cf48fee14ca08f4c84ac5d70fe0
      
https://github.com/qemu/qemu/commit/64022e9d58dc7cf48fee14ca08f4c84ac5d70fe0
  Author: Gerd Hoffmann <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M hw/usb/hcd-xhci.c

  Log Message:
  -----------
  xhci: rip out background transfer code

original xhci code (the one which used libusb directly) used to use
'background transfers' for iso streams.  In upstream qemu the iso
stream buffering is handled by usb-host & usb-redir, so we will
never ever need this.  It has been left in as reference, but is dead
code anyway.  Rip it out.

Signed-off-by: Gerd Hoffmann <address@hidden>
(cherry picked from commit 331e9406f152b6bae6859a153d36e5076c58901d)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 640bda8df50d07daccceb646ed7d047bf1080c55
      
https://github.com/qemu/qemu/commit/640bda8df50d07daccceb646ed7d047bf1080c55
  Author: Gerd Hoffmann <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M hw/usb/hcd-xhci.c
    M trace-events

  Log Message:
  -----------
  xhci: drop buffering

This patch splits the xhci_xfer_data function into three.
The xhci_xfer_data function used to do does two things:

  (1) copy transfer data between guest memory and a temporary buffer.
  (2) report transfer results to the guest using events.

Now we three functions to handle this:

  (1) xhci_xfer_map creates a scatter list for the transfer and
      uses that (instead of the temporary buffer) to build a
      USBPacket.
  (2) xhci_xfer_unmap undoes the mapping.
  (3) xhci_xfer_report sends out events.

The patch also fixes reporting of transaction errors which must be
reported unconditinally, not only in case the guest asks for it
using the ISP flag.

[ v2: fix warning ]

Signed-off-by: Gerd Hoffmann <address@hidden>
(cherry picked from commit d5a15814b413869667b2a3215772986885be574a)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 23ba9d48381cb06e5a7e169ed8898c115094daf0
      
https://github.com/qemu/qemu/commit/23ba9d48381cb06e5a7e169ed8898c115094daf0
  Author: Gerd Hoffmann <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M hw/usb/hcd-xhci.c

  Log Message:
  -----------
  xhci: fix runtime write tracepoint

Signed-off-by: Gerd Hoffmann <address@hidden>
(cherry picked from commit 8e9f18b6db1cd67f0a7efd7d0285bee489445197)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 03c0342cb8725f7ae50d0db93516ef546825b4ff
      
https://github.com/qemu/qemu/commit/03c0342cb8725f7ae50d0db93516ef546825b4ff
  Author: Gerd Hoffmann <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M hw/usb/hcd-xhci.c

  Log Message:
  -----------
  xhci: allow bytewise capability register reads

Some guests need this according to
Alejandro Martinez Ruiz <address@hidden>

Signed-off-by: Gerd Hoffmann <address@hidden>
(cherry picked from commit 6ee021d41078844df60a3a466e3829a3e82776f3)

Conflicts:

        hw/usb/hcd-xhci.c

Signed-off-by: Michael Roth <address@hidden>


  Commit: b26859ab1803dc30e9510e8d8083c18b9970e6c4
      
https://github.com/qemu/qemu/commit/b26859ab1803dc30e9510e8d8083c18b9970e6c4
  Author: Dunrong Huang <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M hw/qxl.c

  Log Message:
  -----------
  qxl: dont update invalid area

This patch fixes the following error:

$ ~/usr/bin/qemu-system-x86_64 -enable-kvm -m 1024 -spice 
port=5900,disable-ticketing -vga qxl -cdrom 
~/Images/linuxmint-13-mate-dvd-32bit.iso
(/home/mathslinux/usr/bin/qemu-system-x86_64:10068): SpiceWorker-CRITICAL **: 
red_worker.c:4599:red_update_area: condition `area->left >= 0 && area->top >= 0 
&& area->left < area->right && area->top < area->bottom' failed
Aborted

spice server terminates QEMU process if we pass invalid area to it,
so dont update those invalid areas.

Signed-off-by: Dunrong Huang <address@hidden>
Signed-off-by: Gerd Hoffmann <address@hidden>
(cherry picked from commit ccc2960d654a233a6ed415b37d8ff41728d817c5)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 462ff6fda1409a8ae20772c09c6444dc3ce25d88
      
https://github.com/qemu/qemu/commit/462ff6fda1409a8ae20772c09c6444dc3ce25d88
  Author: Gerd Hoffmann <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M hw/usb/host-linux.c

  Log Message:
  -----------
  usb-host: allow emulated (non-async) control requests without USBPacket

xhci needs this for USB_REQ_SET_ADDRESS due to the way
usb addressing is handled by the xhci hardware.

Signed-off-by: Gerd Hoffmann <address@hidden>
(cherry picked from commit 63587e31353b6652cadfcfb869f5692a2b69daeb)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 9a5a94de581b47189f7df5ded0523b9a6991f581
      
https://github.com/qemu/qemu/commit/9a5a94de581b47189f7df5ded0523b9a6991f581
  Author: Uri Lublin <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M hw/qxl.c

  Log Message:
  -----------
  qxl: better cleanup for surface destroy

Add back a call to qxl_spice_destroy_surface_wait_complete() in 
qxl_spice_destroy_surface_wait(),
that was removed by commit c480bb7da465186b84d8427e068ef7502e47ffbf

It is needed to complete surface-removal cleanup, for non async.
For async, qxl_spice_destroy_surface_wait_complete is called upon operation 
completion.

Signed-off-by: Uri Lublin <address@hidden>
Signed-off-by: Gerd Hoffmann <address@hidden>
(cherry picked from commit 753b8b0d77ba1b343a35f9679cc777ea10a62bba)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 1f97f6c9fe45bcfc9e59d23076e5a39f1e22de51
      
https://github.com/qemu/qemu/commit/1f97f6c9fe45bcfc9e59d23076e5a39f1e22de51
  Author: Gerd Hoffmann <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M hw/usb/hcd-ehci.c
    M trace-events

  Log Message:
  -----------
  ehci: switch to new-style memory ops

Also register different memory regions for capabilities,
operational registers and port status registers.  Create
separate tracepoints for operational regs and port status
regs.  Ditch a bunch of sanity checks because the memory
core will do this for us now.

Offloading the byte, word and dword access handling to the
memory core also has the side effect of fixing ehci register
access on bigendian hosts.

Cc: David Gibson <address@hidden>
Signed-off-by: Gerd Hoffmann <address@hidden>
(cherry picked from commit 3e4f910c8d490a1490409a7e381dbbb229f9d272)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 29ecaa26a83753e67bc8ba7cacf08d3948e868af
      
https://github.com/qemu/qemu/commit/29ecaa26a83753e67bc8ba7cacf08d3948e868af
  Author: Hans de Goede <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M hw/usb/hcd-ehci.c

  Log Message:
  -----------
  ehci: Fix interrupts stopping when Interrupt Threshold Control is 8

If Interrupt Threshold Control is 8 or a multiple of 8, then
s->usbsts_frindex can become exactly 0x4000, at which point
(s->usbsts_frindex > s->frindex) will never become true, as
s->usbsts_frindex will not be lowered / reset in this case.

This patch fixes this.

Signed-off-by: Hans de Goede <address@hidden>
Signed-off-by: Gerd Hoffmann <address@hidden>
(cherry picked from commit ffa1f2e088eb7e3d57f2fc35f21e7bdb23e592c5)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 349b4e90707f5cefd199c9573fe34540a6aec327
      
https://github.com/qemu/qemu/commit/349b4e90707f5cefd199c9573fe34540a6aec327
  Author: Hans de Goede <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M hw/usb/hcd-ehci.c

  Log Message:
  -----------
  ehci: Don't process too much frames in 1 timer tick (v2)

The Linux ehci isoc scheduling code fills the entire schedule ahead of
time minus 80 frames. If we make a large jump in where we are in the
schedule, ie 40 frames, then the scheduler all of a sudden will only have
40 frames left to work in, causing it to fail packet submissions
with error -27 (-EFBIG).

Changes in v2:
-Don't hardcode a maximum number of frames to process in one tick, instead:
 -Process a minimum number of frames to ensure we do eventually catch up
 -Stop (after the minimum number) when the guest has requested an irq

Signed-off-by: Hans de Goede <address@hidden>
Signed-off-by: Gerd Hoffmann <address@hidden>
(cherry picked from commit 8f74ed1e43263293301031a10e440549bab19a6e)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 1fce4135f33e748980d9f1fa2fe79a19fcf57289
      
https://github.com/qemu/qemu/commit/1fce4135f33e748980d9f1fa2fe79a19fcf57289
  Author: MORITA Kazutaka <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M block/sheepdog.c

  Log Message:
  -----------
  sheepdog: fix savevm and loadvm

This patch sets data to be sent to Sheepdog correctly and fixes savevm
and loadvm operations on a Sheepdog image.

Signed-off-by: MORITA Kazutaka <address@hidden>
Signed-off-by: Kevin Wolf <address@hidden>
(cherry picked from commit 1f7a48de4467f31afc51169122453318efdb0f33)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 3900d1d99267f16710762786c8e50ca83923bda0
      
https://github.com/qemu/qemu/commit/3900d1d99267f16710762786c8e50ca83923bda0
  Author: Stefan Weil <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M hw/ide/core.c

  Log Message:
  -----------
  ide: Fix error messages from static code analysis (no real error)

Report from smatch:
hw/ide/core.c:1472 ide_exec_cmd(423) error: buffer overflow 'smart_attributes' 
8 <= 29
hw/ide/core.c:1474 ide_exec_cmd(425) error: buffer overflow 'smart_attributes' 
8 <= 29
hw/ide/core.c:1475 ide_exec_cmd(426) error: buffer overflow 'smart_attributes' 
8 <= 29
...

The upper limit of 30 was never reached because both for loops terminated
when 'smart_attributes' reached end of list, so there was no real buffer
overflow.

Nevertheless, changing the code not only fixes the error report, but also
reduces the size of smart_attributes and simplifies the for loops.

Signed-off-by: Stefan Weil <address@hidden>
Signed-off-by: Kevin Wolf <address@hidden>
(cherry picked from commit 1e53537fdaa4657d11f130a0f2673fcfb1956381)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 1e32a1651aeb071481b20f873f8d61a0692f7be5
      
https://github.com/qemu/qemu/commit/1e32a1651aeb071481b20f873f8d61a0692f7be5
  Author: Stefan Weil <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M block/curl.c

  Log Message:
  -----------
  block/curl: Fix wrong free statement

Report from smatch:
block/curl.c:546 curl_close(21) info: redundant null check on s->url calling 
free()

The check was redundant, and free was also wrong because the memory
was allocated using g_strdup.

Signed-off-by: Stefan Weil <address@hidden>
Signed-off-by: Kevin Wolf <address@hidden>
(cherry picked from commit 45724d6d02383b0d7d4a90e05787fca7c55cb070)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 1c224f0ab3ee2807844527126546abece2bdfc4b
      
https://github.com/qemu/qemu/commit/1c224f0ab3ee2807844527126546abece2bdfc4b
  Author: Stefan Weil <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M block/vdi.c

  Log Message:
  -----------
  vdi: Fix warning from clang

ccc-analyzer reports these warnings:

block/vdi.c:704:13: warning: Dereference of null pointer
      bmap[i] = VDI_UNALLOCATED;
      ^
block/vdi.c:702:13: warning: Dereference of null pointer
      bmap[i] = i;
      ^

Moving some code into the if block fixes this.
It also avoids calling function write with 0 bytes of data.

Signed-off-by: Stefan Weil <address@hidden>
Signed-off-by: Kevin Wolf <address@hidden>
(cherry picked from commit 514f21a5d4613e495adc2e2dd48f18091454efb8)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 84a2ca9f903dffa785b499979375aaadb58f1958
      
https://github.com/qemu/qemu/commit/84a2ca9f903dffa785b499979375aaadb58f1958
  Author: Pavel Hrdina <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M block.c

  Log Message:
  -----------
  block: fix block tray status

The tray status should change also if you eject empty block device.

Signed-off-by: Pavel Hrdina <address@hidden>
Signed-off-by: Kevin Wolf <address@hidden>
(cherry picked from commit 9ca111544c64b5abed2e79cf52e19a8f227b347b)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 7cf7e305cc93388063e92289622c72f3f5d4ab1d
      
https://github.com/qemu/qemu/commit/7cf7e305cc93388063e92289622c72f3f5d4ab1d
  Author: Jason Baron <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M hw/ide/ahci.c

  Log Message:
  -----------
  ahci: properly reset PxCMD on HBA reset

While testing q35, I found that windows 7 (specifically, windows 7 ultimate
with sp1 x64), wouldn't install because it can't find the cdrom or disk drive.
The failure message is: 'A required cd/dvd device driver is missing. If you
have a driver floppy disk, CD, DVD, or USB flash drive, please insert it now.'
This can also be reproduced on piix by adding an ahci controller, and
observing that windows 7 does not see any devices behind it.

The problem is that when windows issues a HBA reset, qemu does not reset the
individual ports' PxCMD register. Windows 7 then reads back the PxCMD register
and presumably assumes that the ahci controller has already been initialized.
Windows then never sets up the PxIE register to enable interrupts, and thus it
never gets irqs back when it sends ata device inquiry commands.

This change brings qemu into ahci 1.3 specification compliance.

Section 10.4.3 HBA Reset:

"
When GHC.HR is set to '1', GHC.AE, GHC.IE, the IS register, and all port
register fields (except PxFB/PxFBU/PxCLB/PxCLBU) that are not HwInit in the
HBA's register memory space are reset.
"

I've also re-tested Fedora 16 and 17 to verify that they continue to work with
this change.

Signed-off-by: Jason Baron <address@hidden>
Acked-by: Alexander Graf <address@hidden>
Signed-off-by: Kevin Wolf <address@hidden>
(cherry picked from commit 2a4f4f34e6fe55f4c82507c3e7ec9b58c2e24ad4)

Signed-off-by: Michael Roth <address@hidden>


  Commit: f9f552e80b2f19997f1fda77cc2ce59848e86e91
      
https://github.com/qemu/qemu/commit/f9f552e80b2f19997f1fda77cc2ce59848e86e91
  Author: Daniel P. Berrange <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M qemu-img.c

  Log Message:
  -----------
  Don't require encryption password for 'qemu-img info' command

The encryption password is only required if I/O is going to be
performed on a disk image. The 'qemu-img info' command merely
reports metadata, so it should not ask for a decryption password

Signed-off-by: Daniel P. Berrange <address@hidden>
Signed-off-by: Kevin Wolf <address@hidden>
(cherry picked from commit f0536bb848ad6eb2709a7dc675f261bd160c751b)

Conflicts:

        qemu-img.c

Signed-off-by: Michael Roth <address@hidden>


  Commit: 9cf4af689b9c4d92857df11857912d5f9b865c9b
      
https://github.com/qemu/qemu/commit/9cf4af689b9c4d92857df11857912d5f9b865c9b
  Author: Dunrong Huang <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M block.c

  Log Message:
  -----------
  block: Don't forget to delete temporary file

The caller would not delete temporary file after failed get_tmp_filename().

Signed-off-by: Dunrong Huang <address@hidden>
Signed-off-by: Kevin Wolf <address@hidden>
(cherry picked from commit fe235a06e1e008dedd2ac3cc0a3a655169ce9b33)

Signed-off-by: Michael Roth <address@hidden>


  Commit: bffb221775792f89b4214aa8f7616bfbb760a668
      
https://github.com/qemu/qemu/commit/bffb221775792f89b4214aa8f7616bfbb760a668
  Author: Alon Levy <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M hw/qxl.c
    M trace-events

  Log Message:
  -----------
  hw/qxl: tracing fixes

Add two new trace events:
qxl_send_events(int qid, uint32_t events) "%d %d"
qxl_set_guest_bug(int qid) "%d"

Change qxl_io_unexpected_vga_mode parameters to be equivalent to those
of qxl_io_write for easier grouping under a single systemtap probe.

Change d to qxl in one place.

Signed-off-by: Alon Levy <address@hidden>
Signed-off-by: Gerd Hoffmann <address@hidden>
(cherry picked from commit 917ae08ca1565aab2d10c8b6269cd905d6c5c05b)

Signed-off-by: Michael Roth <address@hidden>


  Commit: d28ed2ffbb695cc667ad32af164b23854e88e4a2
      
https://github.com/qemu/qemu/commit/d28ed2ffbb695cc667ad32af164b23854e88e4a2
  Author: Aurelien Jarno <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M configure

  Log Message:
  -----------
  configure: usbredir fixes

usbredir is only used by system emulation, so add the libraries to
libs_softmmu instead of LIBS.

Cc: Michael Tokarev <address@hidden>
Cc: Gerd Hoffmann <address@hidden>
Signed-off-by: Aurelien Jarno <address@hidden>
Signed-off-by: Hans de Goede <address@hidden>
Signed-off-by: Gerd Hoffmann <address@hidden>
(cherry picked from commit 56ab2ad177dc43d474dc0a0bd84e81ef00f31e11)

Signed-off-by: Michael Roth <address@hidden>


  Commit: ad2cea3878765c875da7a1f32b2c1dd68ad75a70
      
https://github.com/qemu/qemu/commit/ad2cea3878765c875da7a1f32b2c1dd68ad75a70
  Author: Hans de Goede <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M hw/usb/hcd-ehci.c

  Log Message:
  -----------
  ehci: Don't set seen to 0 when removing unseen queue-heads

When removing unseen queue-heads from the async queue list, we should not
set the seen flag to 0, as this may cause them to be removed by
ehci_queues_rip_unused() during the next call to ehci_advance_async_state()
if the timer is late or running at a low frequency.

Note:
1) This *may* have caused the instant unlink / relinks described in commit
   9bc3a3a216e2689bfcdd36c3e079333bbdbf3ba0

2) Rather then putting more if-s inside ehci_queues_rip_unused, this patch
   instead introduces a new ehci_queues_rip_unseen function.

3) This patch also makes it save to call ehci_queues_rip_unseen() multiple
   times, which gets used in the folluw up patch titled:
   "ehci: Walk async schedule before and after migration"

Signed-off-by: Hans de Goede <address@hidden>
Signed-off-by: Gerd Hoffmann <address@hidden>
(cherry picked from commit 8f5457eb04140714eaf57a99bc08dc661d83fa87)

Signed-off-by: Michael Roth <address@hidden>


  Commit: d56d7e6ef81e263cbab75742442aac48c0821016
      
https://github.com/qemu/qemu/commit/d56d7e6ef81e263cbab75742442aac48c0821016
  Author: Hans de Goede <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M hw/usb/hcd-ehci.c

  Log Message:
  -----------
  ehci: Walk async schedule before and after migration

Signed-off-by: Hans de Goede <address@hidden>
Signed-off-by: Gerd Hoffmann <address@hidden>
(cherry picked from commit ceab6f96454fe6589d1b09ce64403c041d79f9d9)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 981e213cf7a6309f0fcfeadf4b784ce27b1d505d
      
https://github.com/qemu/qemu/commit/981e213cf7a6309f0fcfeadf4b784ce27b1d505d
  Author: Hans de Goede <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M hw/usb/redirect.c

  Log Message:
  -----------
  usb-redir: Revert usb-redir part of commit 93bfef4c

Commit 93bfef4c6e4b23caea9d51e1099d06433d8835a4 makes qemu-devices
which report the qemu version string to the guest in some way use a
qemu_get_version function which reports a machine-specific version string.

However usb-redir does not expose the qemu version to the guest, only to
the usbredir-host as part of the initial handshake. This can then be logged
on the usbredir-host side for debugging purposes and is otherwise completely
unused! For debugging purposes it is important to have the real qemu version
in there, rather then the machine-specific version.

Signed-off-by: Hans de Goede <address@hidden>
Signed-off-by: Gerd Hoffmann <address@hidden>
(cherry picked from commit 35efba2cc6812dc980c336d7b9bf81dbfb5daf00)

Conflicts:

        hw/usb/redirect.c

Signed-off-by: Michael Roth <address@hidden>


  Commit: 2ee160f8e19dc6d1fd0860f37b8929f16f072eb2
      
https://github.com/qemu/qemu/commit/2ee160f8e19dc6d1fd0860f37b8929f16f072eb2
  Author: Hans de Goede <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M hw/usb/hcd-uhci.c

  Log Message:
  -----------
  uhci: Don't queue up packets after one with the SPD flag set

Don't queue up packets after a packet with the SPD (short packet detect)
flag set. Since we won't know if the packet will actually be short until it
has completed, and if it is short we should stop the queue.

This fixes a miniature photoframe emulating a USB cdrom with the windows
software for it not working.

Signed-off-by: Hans de Goede <address@hidden>
Signed-off-by: Gerd Hoffmann <address@hidden>
(cherry picked from commit 72a04d0c178f01908d74539230d9de64ffc6da19)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 3ed791b42d75f20dc194f9355121c55ee3ac4444
      
https://github.com/qemu/qemu/commit/3ed791b42d75f20dc194f9355121c55ee3ac4444
  Author: Stefan Weil <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M slirp/tcp_subr.c

  Log Message:
  -----------
  slirp: Remove wrong type casts ins debug statements

The type casts of pointers to long are not allowed
when sizeof(pointer) != sizeof(long).

Signed-off-by: Stefan Weil <address@hidden>
Signed-off-by: Jan Kiszka <address@hidden>
(cherry picked from commit c4d12a743c73a5b88a8705ca68ff620ce0f8bba7)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 6116adbc0e22c92015220591594df14d776cf5f6
      
https://github.com/qemu/qemu/commit/6116adbc0e22c92015220591594df14d776cf5f6
  Author: Stefan Weil <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M slirp/tcp_subr.c

  Log Message:
  -----------
  slirp: Fix error reported by static code analysis

Report from smatch:

slirp/tcp_subr.c:127 tcp_respond(17) error:
 we previously assumed 'tp' could be null (see line 124)

Return if 'tp' is NULL.

Signed-off-by: Stefan Weil <address@hidden>
Signed-off-by: Jan Kiszka <address@hidden>
(cherry picked from commit e56afbc54a2132c56931f44bae1992c28119944f)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 34f7e690c341ad526bd5012daf91f25b880fc709
      
https://github.com/qemu/qemu/commit/34f7e690c341ad526bd5012daf91f25b880fc709
  Author: Hervé Poussineau <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M slirp/tftp.c
    M slirp/tftp.h

  Log Message:
  -----------
  slirp: improve TFTP performance

When transferring a file, keep it open during the whole transfer,
instead of opening/closing it for each block.

Signed-off-by: Hervé Poussineau <address@hidden>
Reviewed-by: Aurelien Jarno <address@hidden>
Signed-off-by: Jan Kiszka <address@hidden>
(cherry picked from commit 78be056628c76ff73eedeade86fde44b97343c79)

Signed-off-by: Michael Roth <address@hidden>


  Commit: b83f395ba19c9fd9c2e3ad22b8b8d8f46ab9be12
      
https://github.com/qemu/qemu/commit/b83f395ba19c9fd9c2e3ad22b8b8d8f46ab9be12
  Author: Hervé Poussineau <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M slirp/tftp.c
    M slirp/tftp.h

  Log Message:
  -----------
  slirp: Handle more than 65535 blocks in TFTP transfers

RFC 1350 does not mention block count roll-over. However, a lot of TFTP servers
implement it to be able to transmit big files, so do it also.

Current block size is 512 bytes, so TFTP files were limited to 32 MB.

Signed-off-by: Hervé Poussineau <address@hidden>
Signed-off-by: Jan Kiszka <address@hidden>
(cherry picked from commit 4aa401f39e048e71020cceb59f126ab941095a42)

Signed-off-by: Michael Roth <address@hidden>


  Commit: c23314334d8d8fc13d6dd076fab7f0a8376ce1fb
      
https://github.com/qemu/qemu/commit/c23314334d8d8fc13d6dd076fab7f0a8376ce1fb
  Author: Hervé Poussineau <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M slirp/tftp.c

  Log Message:
  -----------
  slirp: Implement TFTP Blocksize option

This option is described in RFC 1783. As this is only an optional field,
we may ignore it in some situations and handle it in some others.

However, MS Windows 2003 PXE boot client requests a block size of the MTU
(most of the times 1472 bytes), and doesn't work if the option is not
acknowledged (with whatever value).

According to the RFC 1783, we cannot acknowledge the option with a bigger
value than the requested one.

As current implementation is using 512 bytes by block, accept the option
with a value of 512 if the option was specified, and don't acknowledge it
if it is not present or less than 512 bytes.

Signed-off-by: Hervé Poussineau <address@hidden>
Signed-off-by: Jan Kiszka <address@hidden>
(cherry picked from commit 95b1ad7ad86793c27ab8e9987be69571937900d1)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 34173da0214a10460ac0856b6ae4f1bd9ae84808
      
https://github.com/qemu/qemu/commit/34173da0214a10460ac0856b6ae4f1bd9ae84808
  Author: Stefan Weil <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M hw/srp.h

  Log Message:
  -----------
  srp: Don't use QEMU_PACKED for single elements of a structured type

QEMU_PACKED results in a MinGW compiler warning when it is
used for single structure elements:

warning: 'gcc_struct' attribute ignored

Using QEMU_PACKED for the whole structure avoids the compiler warning
without changing the memory layout.

Signed-off-by: Stefan Weil <address@hidden>
Signed-off-by: Stefan Hajnoczi <address@hidden>
(cherry picked from commit 93d3ad2a8048469d2b2bb157697425b66b2a37aa)

Signed-off-by: Michael Roth <address@hidden>


  Commit: a0d718a39599d1967b4cd80027c25047565734a3
      
https://github.com/qemu/qemu/commit/a0d718a39599d1967b4cd80027c25047565734a3
  Author: Stefan Weil <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M docs/specs/ppc-spapr-hcalls.txt
    M docs/usb2.txt
    M hw/xen_pt.h
    M hw/xen_pt_config_init.c
    M qemu-img.c
    M qemu-img.texi

  Log Message:
  -----------
  Spelling fixes in comments and documentation

These wrong spellings were detected by codespell:

* successully -> successfully

* alot -> a lot

* wanna -> want to

* infomation -> information

* occured -> occurred

["also is" -> "is also" and "ressources" -> "resources" suggested by
Peter Maydell <address@hidden>]

Signed-off-by: Stefan Weil <address@hidden>
Signed-off-by: Stefan Hajnoczi <address@hidden>
(cherry picked from commit 0546b8c2f089867cd7606ff47e026e8931157828)

Signed-off-by: Michael Roth <address@hidden>


  Commit: c6553fee8190eb3ea47bc07476c3f1ba0872cabc
      
https://github.com/qemu/qemu/commit/c6553fee8190eb3ea47bc07476c3f1ba0872cabc
  Author: BALATON Zoltan <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M console.c

  Log Message:
  -----------
  console: Clean up bytes per pixel calculation

Division with round up is the correct way to compute this even if the
only case where division with round down gives incorrect result is
probably 15 bpp. This case was explicitely patched up in one of these
functions but was unhandled in the other. (I'm not sure about setting
16 bpp for the 15bpp case either but I left that there for now.)

Signed-off-by: BALATON Zoltan <address@hidden>
Signed-off-by: Stefan Hajnoczi <address@hidden>
(cherry picked from commit feadf1a4de0d7468ffb671a2b9f681925469fa58)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 59a01f73c31ceadba600e3cfb3305aa6995ae563
      
https://github.com/qemu/qemu/commit/59a01f73c31ceadba600e3cfb3305aa6995ae563
  Author: Lei Li <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M qapi-schema-guest.json
    M qapi-schema.json

  Log Message:
  -----------
  qapi: Fix enumeration typo error

Signed-off-by: Lei Li <address@hidden>
Reviewed-by: Luiz Capitulino <address@hidden>
Signed-off-by: Stefan Hajnoczi <address@hidden>
(cherry picked from commit 6932a69b20a88428c531805cdd20eec8acf05b27)

Signed-off-by: Michael Roth <address@hidden>


  Commit: a78cedc09ebde304f3dbff70a15f507b7f5099e2
      
https://github.com/qemu/qemu/commit/a78cedc09ebde304f3dbff70a15f507b7f5099e2
  Author: Stefan Weil <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M kvm-all.c

  Log Message:
  -----------
  kvm: Fix warning from static code analysis

Report from smatch:

kvm-all.c:1373 kvm_init(135) warn:
 variable dereferenced before check 's' (see line 1360)

's' cannot by NULL (it was alloced using g_malloc0), so there is no need
to check it here.

Signed-off-by: Stefan Weil <address@hidden>
Reviewed-by: Peter Maydell <address@hidden>
Signed-off-by: Stefan Hajnoczi <address@hidden>
(cherry picked from commit 6d1cc3210ccc4372ffa337c187da9db68314c0c4)

Signed-off-by: Michael Roth <address@hidden>


  Commit: ca54dc1e752e1def95ce809b63a21932533d220c
      
https://github.com/qemu/qemu/commit/ca54dc1e752e1def95ce809b63a21932533d220c
  Author: Igor Mitsyanko <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M arch_init.c

  Log Message:
  -----------
  arch_init.c: add missing '%' symbols before PRIu64 in debug printfs

'%' symbols were missing in front of PRIu64 macros in DPRINTF() messages in
arch_init.c, this caused compilation warnings when compiled with 
DEBUG_ARCH_INIT defined.

Signed-off-by: Igor Mitsyanko <address@hidden>
Signed-off-by: Stefan Hajnoczi <address@hidden>
(cherry picked from commit ef37a699a06f96e098ee00683b7052b5fbb6ad7d)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 8e9fdc4a8818161f102457a4358fb5f617b61ac2
      
https://github.com/qemu/qemu/commit/8e9fdc4a8818161f102457a4358fb5f617b61ac2
  Author: Paolo Bonzini <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M hw/virtio-net.c
    M net.c
    M net/queue.c
    M net/queue.h

  Log Message:
  -----------
  net: notify iothread after flushing queue

virtio-net has code to flush the queue and notify the iothread
whenever new receive buffers are added by the guest.  That is
fine, and indeed we need to do the same in all other drivers.
However, notifying the iothread should be work for the network
subsystem.  And since we are at it we can add a little smartness:
if some of the queued packets already could not be delivered,
there is no need to notify the iothread.

Reported-by: Luigi Rizzo <address@hidden>
Cc: Stefan Hajnoczi <address@hidden>
Cc: Jan Kiszka <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>
Reviewed-by: Amos Kong <address@hidden>
Signed-off-by: Stefan Hajnoczi <address@hidden>
(cherry picked from commit 987a9b4800003567b1a47a379255e886a77d57ea)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 7575a6d2f2747f5d6ef263ad002a731402853fa6
      
https://github.com/qemu/qemu/commit/7575a6d2f2747f5d6ef263ad002a731402853fa6
  Author: Paolo Bonzini <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M hw/e1000.c

  Log Message:
  -----------
  e1000: flush queue whenever can_receive can go from false to true

When the guests replenish the receive ring buffer, the network device
should flush its queue of pending packets.  This is done with
qemu_flush_queued_packets.

e1000's can_receive can go from false to true when RCTL or RDT are
modified.

Reported-by: Luigi Rizzo <address@hidden>
Cc: Stefan Hajnoczi <address@hidden>
Cc: Jan Kiszka <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>
Reviewed-by: Amos Kong <address@hidden>
Signed-off-by: Stefan Hajnoczi <address@hidden>
(cherry picked from commit e8b4c680b41bd960ecccd9ff076b7b058e0afcd4)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 65a2f8e27c335c7edf4d6c8d1e1b7fb0090c72ff
      
https://github.com/qemu/qemu/commit/65a2f8e27c335c7edf4d6c8d1e1b7fb0090c72ff
  Author: Paolo Bonzini <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M hw/xen_nic.c

  Log Message:
  -----------
  xen: flush queue when getting an event

xen does not have a register that, when written, will cause can_receive
to go from false to true.  However, flushing the queue can be attempted
whenever the front-end raises its side of the Xen event channel.  There
is a single event channel for tx and rx.

Cc: Stefano Stabellini <address@hidden>
Cc: Stefan Hajnoczi <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>
Reviewed-by: Amos Kong <address@hidden>
Signed-off-by: Stefan Hajnoczi <address@hidden>
(cherry picked from commit a98b140223d3a627eab7ee3ddec645bab630d756)

Signed-off-by: Michael Roth <address@hidden>


  Commit: bfa23099aa1897f3a8dec7228e8ab23947d504ee
      
https://github.com/qemu/qemu/commit/bfa23099aa1897f3a8dec7228e8ab23947d504ee
  Author: Bo Yang <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M hw/eepro100.c

  Log Message:
  -----------
  eepro100: Fix network hang when rx buffers run out

This is reported by QA. When installing os with pxe, after the initial
kernel and initrd are loaded, the procedure tries to copy files from install
server to local harddisk, the network becomes stall because of running out of
receive descriptor.

[Whitespace fixes and removed qemu_notify_event() because Paolo's
earlier net patches have moved it into qemu_flush_queued_packets().

Additional info:

I can reproduce the network hang with a tap device doing a iPXE HTTP
boot as follows:

  $ qemu -enable-kvm -m 1024 \
    -netdev tap,id=netdev0,script=no,downscript=no \
    -device i82559er,netdev=netdev0,romfile=80861209.rom \
    -drive if=virtio,cache=none,file=test.img
  iPXE> ifopen net0
  iPXE> config # set static network configuration
  iPXE> kernel 
http://mirror.bytemark.co.uk/fedora/linux/releases/17/Fedora/x86_64/os/images/pxeboot/vmlinuz

I needed a vanilla iPXE ROM to get to the iPXE prompt.  I think the boot
prompt has been disabled in the ROMs that ship with QEMU to reduce boot
time.

During the vmlinuz HTTP download there is a network hang.  hw/eepro100.c
has reached the end of the rx descriptor list.  When the iPXE driver
replenishes the rx descriptor list we don't kick the QEMU net subsystem
and event loop, thereby leaving the tap netdev without its file
descriptor in select(2).

Stefan Hajnoczi <address@hidden>]

Signed-off-by: Bo Yang <address@hidden>
Signed-off-by: Stefan Hajnoczi <address@hidden>
(cherry picked from commit 1069985fb132cd4324fc02d371f1e61492a1823f)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 0d91cd5aa7ddc678f80f47041aa2ed5277172d9c
      
https://github.com/qemu/qemu/commit/0d91cd5aa7ddc678f80f47041aa2ed5277172d9c
  Author: Stefan Hajnoczi <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M net.c

  Log Message:
  -----------
  net: add receive_disabled logic to iov delivery path

This patch adds the missing NetClient->receive_disabled logic in the
sendv delivery code path.  It seems that commit
893379efd0e1b84ceb0c42a713293f3dbd27b1bd ("net: disable receiving if
client returns zero") only added the logic to qemu_deliver_packet() and
not qemu_deliver_packet_iov().

The receive_disabled flag should be automatically set when .receive(),
.receive_raw(), or .receive_iov() return 0.  No further packets will be
delivered to the NetClient until the receive_disabled flag is cleared
again by calling qemu_flush_queued_packets().

Typically the NetClient will wait until its file descriptor becomes
writable and then invoke qemu_flush_queued_packets() to resume
transmission.

Signed-off-by: Stefan Hajnoczi <address@hidden>
(cherry picked from commit c67f5dc10573687497f0f5c3aec19b15c35c63d7)

Signed-off-by: Michael Roth <address@hidden>


  Commit: a9d8f7b1c41a8a346f4cf5a0c6963a79fbd1249e
      
https://github.com/qemu/qemu/commit/a9d8f7b1c41a8a346f4cf5a0c6963a79fbd1249e
  Author: Stefan Hajnoczi <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M net/queue.c

  Log Message:
  -----------
  net: do not report queued packets as sent

Net send functions have a return value where 0 means the packet has not
been sent and will be queued.  A non-zero value means the packet was
sent or an error caused the packet to be dropped.

This patch fixes two instances where packets are queued but we return
their size.  This causes callers to believe the packets were sent.  When
the caller uses the async send interface this creates a real problem
because the callback will be invoked for a packet that the caller
believed to be already sent.  This bug can cause double-frees in the
caller.

Signed-off-by: Stefan Hajnoczi <address@hidden>
(cherry picked from commit 06b5f36d052b540a59b52150582d65674199b2ce)

Signed-off-by: Michael Roth <address@hidden>


  Commit: aa69dd05ce1a0cece7a1462807b3c4841f1ba01e
      
https://github.com/qemu/qemu/commit/aa69dd05ce1a0cece7a1462807b3c4841f1ba01e
  Author: Stefan Hajnoczi <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M qemu-options.hx

  Log Message:
  -----------
  net: add -netdev options to man page

Document the -netdev syntax which supercedes the older -net syntax.
This patch is a first step to making -netdev prominent in the QEMU
manual.

Reported-by: Anatoly Techtonik <address@hidden>
Signed-off-by: Stefan Hajnoczi <address@hidden>
(cherry picked from commit 08d12022c7f1aba6acccc75150659c6e4c9dff23)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 2747a3eee3d679bdffd35dc5bfa970fd80c4969e
      
https://github.com/qemu/qemu/commit/2747a3eee3d679bdffd35dc5bfa970fd80c4969e
  Author: Stefan Hajnoczi <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M hw/usb/dev-network.c

  Log Message:
  -----------
  net: clean up usbnet_receive()

The USB network interface has two code paths depending on whether or not
RNDIS mode is enabled.  Refactor usbnet_receive() so that there is a
common path throughout the function instead of duplicating everything
across if (is_rndis(s)) ... else ... code paths.

Clean up coding style and 80 character line wrap along the way.

Signed-off-by: Stefan Hajnoczi <address@hidden>
(cherry picked from commit f237ddbb89142c6948a2257c459e49dee7500a7c)

Signed-off-by: Michael Roth <address@hidden>


  Commit: d8f481188025e56c229e3fd41afa1d17f9e0cff0
      
https://github.com/qemu/qemu/commit/d8f481188025e56c229e3fd41afa1d17f9e0cff0
  Author: Stefan Hajnoczi <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M hw/usb/dev-network.c

  Log Message:
  -----------
  net: fix usbnet_receive() packet drops

The USB network interface has a single buffer which the guest reads
from.  This patch prevents multiple calls to usbnet_receive() from
clobbering the input buffer.  Instead we queue packets until buffer
space becomes available again.

This is inspired by virtio-net and e1000 rxbuf handling.

Signed-off-by: Stefan Hajnoczi <address@hidden>
(cherry picked from commit 190563f9a90c9df8ad32fc7f3e4b166deda949a6)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 5c8240c09ccb73e53984a2af80a6b90659e7b131
      
https://github.com/qemu/qemu/commit/5c8240c09ccb73e53984a2af80a6b90659e7b131
  Author: Stefan Hajnoczi <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M net/hub.c

  Log Message:
  -----------
  net: broadcast hub packets if at least one port can receive

In commit 60c07d933c66c4b30a83b7ccbc8a0cb3df1b2d0e ("net: fix
qemu_can_send_packet logic") the "VLAN" broadcast behavior was changed
to queue packets if any net client cannot receive.  It turns out that
this was not actually the right fix and just hides the real bug that
hw/usb/dev-network.c:usbnet_receive() clobbers its receive buffer when
called multiple times in a row.  The commit also introduced a new bug
that "VLAN" packets would not be sent if one of multiple net clients was
down.

The hw/usb/dev-network.c bug has since been fixed, so this patch reverts
broadcast behavior to send packets as long as one net client can
receive.  Packets simply get queued for the net clients that are
temporarily unable to receive.

Reported-by: Roy.Li <address@hidden>
Signed-off-by: Stefan Hajnoczi <address@hidden>
(cherry picked from commit 61518a74ca98870e8ff132f91dd5dda252e31f58)

Signed-off-by: Michael Roth <address@hidden>


  Commit: ab52df7712e0efe3bee32ccfed79729cb9dec9f8
      
https://github.com/qemu/qemu/commit/ab52df7712e0efe3bee32ccfed79729cb9dec9f8
  Author: Stefan Hajnoczi <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M net/socket.c

  Log Message:
  -----------
  net: asynchronous send/receive infrastructure for net/socket.c

The net/socket.c net client is not truly asynchronous.  This patch
borrows the qemu_set_fd_handler2() code from net/tap.c as the basis for
proper asynchronous send/receive.

Only read packets from the socket when the peer is able to receive.
This avoids needless queuing.

Later patches implement asynchronous send.

Signed-off-by: Stefan Hajnoczi <address@hidden>
(cherry picked from commit 863f678fba4191f3b695620f41056cb7c124425d)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 9d72a090b2f68201701b10b765c8b3eac596b3bc
      
https://github.com/qemu/qemu/commit/9d72a090b2f68201701b10b765c8b3eac596b3bc
  Author: Stefan Hajnoczi <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M net/socket.c

  Log Message:
  -----------
  net: EAGAIN handling for net/socket.c UDP

Implement asynchronous send for UDP (or other SOCK_DGRAM) sockets.  If
send fails with EAGAIN we wait for the socket to become writable again.

Signed-off-by: Stefan Hajnoczi <address@hidden>
(cherry picked from commit 213fd5087e2e4e2da10ad266df0ba950cf7618bf)

Signed-off-by: Michael Roth <address@hidden>


  Commit: a638498f513e68aacd6306b56afd504383713665
      
https://github.com/qemu/qemu/commit/a638498f513e68aacd6306b56afd504383713665
  Author: Stefan Hajnoczi <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M net/socket.c

  Log Message:
  -----------
  net: EAGAIN handling for net/socket.c TCP

Replace spinning send_all() with a proper non-blocking send.  When the
socket write buffer limit is reached, we should stop trying to send and
wait for the socket to become writable again.

Non-blocking TCP sockets can return in two different ways when the write
buffer limit is reached:

1. ret = -1 and errno = EAGAIN/EWOULDBLOCK.  No data has been written.

2. ret < total_size.  Short write, only part of the message was
   transmitted.

Handle both cases and keep track of how many bytes have been written in
s->send_index.  (This includes the 'length' header before the actual
payload buffer.)

Signed-off-by: Stefan Hajnoczi <address@hidden>
(cherry picked from commit 45a7f54a8bb3928ffa58d522e0d61acaee8277bb)

Signed-off-by: Michael Roth <address@hidden>


  Commit: a63eb7a22731c4b0ec863582231f24c4b32b5969
      
https://github.com/qemu/qemu/commit/a63eb7a22731c4b0ec863582231f24c4b32b5969
  Author: Yann E. MORIN <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M configure

  Log Message:
  -----------
  configure: fix seccomp check

Currently, if libseccomp is missing but the user explicitly requested
seccomp support using --enable-seccomp, configure silently ignores the
situation and disables seccomp support.

This is unlike all other tests that explicitly fail in such situation.

Fix that.

Signed-off-by: "Yann E. MORIN" <address@hidden>
Reviewed-by: Andreas Färber <address@hidden>
Signed-off-by: Stefan Hajnoczi <address@hidden>
(cherry picked from commit e84d5956cc6215d2f098e7b6090fc5ec4cba1be3)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 5d6ad6262b0c43400d60d7db37c0b9b524be3bd3
      
https://github.com/qemu/qemu/commit/5d6ad6262b0c43400d60d7db37c0b9b524be3bd3
  Author: Natanael Copa <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M configure

  Log Message:
  -----------
  configure: properly check if -lrt and -lm is needed

Fixes build against uClibc.

uClibc provides 2 versions of clock_gettime(), one with realtime
support and one without (this is so you can avoid linking in -lrt
unless actually needed). This means that the clock_gettime() don't
need -lrt. We still need it for timer_create() so we check for this
function in addition.

We also need check if -lm is needed for isnan().

Both -lm and -lrt are needed for libs_qga.

Signed-off-by: Natanael Copa <address@hidden>
Signed-off-by: Blue Swirl <address@hidden>
(cherry picked from commit 8bacde8d86a09699207d85d4bab06162aed18dc4)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 57683d635420c8cd01e67db3b0129d9b143913b3
      
https://github.com/qemu/qemu/commit/57683d635420c8cd01e67db3b0129d9b143913b3
  Author: Anthony Liguori <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M qemu-char.c

  Log Message:
  -----------
  Revert 455aa1e08 and c3767ed0eb

    commit c3767ed0eb5d0bb25fe409ae5dec06e3411ff1b6
    qemu-char: (Re-)connect for tcp_chr_write() unconnected writing

Has no hope of working because tcp_chr_connect() does not actually connect.

455aa1e08 just fixes the SEGV with server() but the attempt to connect a client
socket is still completely broken.

This patch reverts both.

Reported-by: Richard W.M. Jones <address@hidden>
Signed-off-by: Anthony Liguori <address@hidden>
(cherry picked from commit 6db0fdce02d72546a4c47100a9b2cd0090cf464d)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 8484fead29c731a5902b1c183e64c179a13a15b8
      
https://github.com/qemu/qemu/commit/8484fead29c731a5902b1c183e64c179a13a15b8
  Author: David Gibson <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M iohandler.c
    M qemu-char.c

  Log Message:
  -----------
  qemu-char: BUGFIX, don't call FD_ISSET with negative fd

tcp_chr_connect(), unlike for example udp_chr_update_read_handler() does
not check if the fd it is using is valid (>= 0) before passing it to
qemu_set_fd_handler2().  If using e.g. a TCP serial port, which is not
initially connected, this can result in -1 being passed to FD_ISSET, which
has undefined behaviour.  On x86 it seems to harmlessly return 0, but on
PowerPC, it causes a fortify buffer overflow error to be thrown.

This patch fixes this by putting an extra test in tcp_chr_connect(), and
also adds an assert qemu_set_fd_handler2() to catch other such errors on
all platforms, rather than just some.

Signed-off-by: David Gibson <address@hidden>
Signed-off-by: Anthony Liguori <address@hidden>
(cherry picked from commit bbdd2ad0814ea0911076419ea21b7957505cf1cc)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 668194d5a515247768d95f10fea933e27e3e3c95
      
https://github.com/qemu/qemu/commit/668194d5a515247768d95f10fea933e27e3e3c95
  Author: David Gibson <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M exec.c

  Log Message:
  -----------
  cpu_physical_memory_write_rom() needs to do TB invalidates

cpu_physical_memory_write_rom(), despite the name, can also be used to
write images into RAM - and will often be used that way if the machine
uses load_image_targphys() into RAM addresses.

However, cpu_physical_memory_write_rom(), unlike cpu_physical_memory_rw()
doesn't invalidate any cached TBs which might be affected by the region
written.

This was breaking reset (under full emu) on the pseries machine - we loaded
our firmware image into RAM, and while executing it rewrite the code at
the entry point (correctly causing a TB invalidate/refresh).  When we
reset the firmware image was reloaded, but the TB from the rewrite was
still active and caused us to get an illegal instruction trap.

This patch fixes the bug by duplicating the tb invalidate code from
cpu_physical_memory_rw() in cpu_physical_memory_write_rom().

Signed-off-by: David Gibson <address@hidden>
Signed-off-by: Anthony Liguori <address@hidden>
(cherry picked from commit 0b57e287138728f72d88b06e69b970c5d745c44a)

Signed-off-by: Michael Roth <address@hidden>


  Commit: b52c8f78f211d2b7f8fed92d02048095504df3a2
      
https://github.com/qemu/qemu/commit/b52c8f78f211d2b7f8fed92d02048095504df3a2
  Author: Peter Maydell <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M arch_init.c

  Log Message:
  -----------
  arch_init.c: Improve '-soundhw help' for non-HAS_AUDIO_CHOICE archs

For architectures which don't set HAS_AUDIO_CHOICE, improve the
'-soundhw help' message so that it doesn't simply print an empty
list, implying no sound support at all.

Signed-off-by: Peter Maydell <address@hidden>
Signed-off-by: malc <address@hidden>
(cherry picked from commit 55d4fd3c24bd253bd96270c7fdf1bb862f3a3400)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 34129550666731e3e163f136bee87a158dcdce26
      
https://github.com/qemu/qemu/commit/34129550666731e3e163f136bee87a158dcdce26
  Author: Peter A. G. Crosthwaite <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M hw/xilinx.h
    M hw/xilinx_timer.c

  Log Message:
  -----------
  xilinx_timer: Removed comma in device name

Fixes an error in a61e4b07a30c062260d2d01771773f14820d1eb7

Signed-off-by: Peter A. G. Crosthwaite <address@hidden>
(cherry picked from commit c0a1dcb9f0baf9269f8baeb02cbcca8dad75454c)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 36d7fb299a7c914ec6cc7cc8a30099a5a5a7af58
      
https://github.com/qemu/qemu/commit/36d7fb299a7c914ec6cc7cc8a30099a5a5a7af58
  Author: Peter A. G. Crosthwaite <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M hw/xilinx_timer.c

  Log Message:
  -----------
  xilinx_timer: Send dbg msgs to stderr not stdout

Signed-off-by: Peter A. G. Crosthwaite <address@hidden>
(cherry picked from commit e03377ae75808d33d0a7afc803b37bcda9f796b3)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 85368b79a01cc4f227673def44b1932f62c4bca5
      
https://github.com/qemu/qemu/commit/85368b79a01cc4f227673def44b1932f62c4bca5
  Author: Peter A. G. Crosthwaite <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M hw/xilinx.h

  Log Message:
  -----------
  xilinx.h: Error check when setting links

Assert that the ethernet and dma controller are sucessfully linked to their
peers.

Signed-off-by: Peter A. G. Crosthwaite <address@hidden>
(cherry picked from commit 4b5e52101f9ad077d1c016f2b7130e2fdae6d2da)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 584717a39a2ad3ee94629599f7a181900945923e
      
https://github.com/qemu/qemu/commit/584717a39a2ad3ee94629599f7a181900945923e
  Author: Chris Wulff <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M hw/xilinx_timer.c

  Log Message:
  -----------
  xilinx_timer: Fix a compile error if debug enabled

There was a missing include of qemu-log and a variable name in a printf was out
of date.

Signed-off-by: Chris Wulff <address@hidden>
Signed-off-by: Peter A. G. Crosthwaite <address@hidden>
(cherry picked from commit 8354cd722e0afae63bee3e4cb21c8f0ddb6874c2)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 68958c31b5dcacc7c8529cd47be9979ed853a324
      
https://github.com/qemu/qemu/commit/68958c31b5dcacc7c8529cd47be9979ed853a324
  Author: Aurelien Jarno <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M hw/pflash_cfi01.c

  Log Message:
  -----------
  pflash_cfi01: fix vendor specific extended query

pflash_cfi01 announces a version number of 1.1, which implies
"Protection Register Information" and "Burst Read information"
sections, which are not provided.

Decrease the version number to 1.0 so that only the "Protection
Register Information" section is needed.

Set the number of protection fields (0x3f) to 0x01, as 0x00 means 256
protections field, which makes the CFI table bigger than the current
implementation, causing some kernels to fail to read it.

Signed-off-by: Aurelien Jarno <address@hidden>
(cherry picked from commit 262e1eaafabf32d33a9fa0b03b3c8ea426c5ae1b)

Signed-off-by: Michael Roth <address@hidden>


  Commit: e8ca4a8ac7cdbb3c79d969815351107fae5ad867
      
https://github.com/qemu/qemu/commit/e8ca4a8ac7cdbb3c79d969815351107fae5ad867
  Author: Andreas Färber <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M MAINTAINERS

  Log Message:
  -----------
  MAINTAINERS: Add entry for QOM CPU

Signed-off-by: Andreas Färber <address@hidden>
(cherry picked from commit f2ca052414d7eddc10517e98a5a27ba8099b19b1)

Signed-off-by: Michael Roth <address@hidden>


  Commit: ae06193d73534719cd3631ca06f1420d40e2d5fc
      
https://github.com/qemu/qemu/commit/ae06193d73534719cd3631ca06f1420d40e2d5fc
  Author: Ronnie Sahlberg <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M block/iscsi.c

  Log Message:
  -----------
  iSCSI: We need to support SG_IO also from iscsi_ioctl()

We need to support SG_IO from the synchronous iscsi_ioctl() since
scsi-block uses this to do an INQ to the device to discover its properties
This patch makes scsi-block work with iscsi.

Signed-off-by: Ronnie Sahlberg <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>
(cherry picked from commit f1a12821d7df2e4d21be4f2206f84b4640533e53)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 60088e5b8332fc523919a137231824e222730636
      
https://github.com/qemu/qemu/commit/60088e5b8332fc523919a137231824e222730636
  Author: Ronnie Sahlberg <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M block/iscsi.c

  Log Message:
  -----------
  iSCSI: We dont need to explicitely call qemu_notify_event() any more

We no longer need to explicitely call qemu_notify_event() any more
since this is now done automatically any time the filehandles we listen
to change.

Signed-off-by: Ronnie Sahlberg <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>
(cherry picked from commit 40a13ca8d28c21062e35b10d9b80e76b92405bdf)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 394a2f28cb186a4c421a358204387da58d1ee7a1
      
https://github.com/qemu/qemu/commit/394a2f28cb186a4c421a358204387da58d1ee7a1
  Author: Paolo Bonzini <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M hw/scsi-disk.c

  Log Message:
  -----------
  scsi-disk: introduce check_lba_range

Abstract the test for an out-of-range (starting block, block count)
pair.

Signed-off-by: Paolo Bonzini <address@hidden>
(cherry picked from commit 444bc908611ccaf4512dc37c33ac3b54d873a62b)

Signed-off-by: Michael Roth <address@hidden>


  Commit: ff498e4a0dc188d2a441af6111065dd55feab57b
      
https://github.com/qemu/qemu/commit/ff498e4a0dc188d2a441af6111065dd55feab57b
  Author: Paolo Bonzini <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M hw/scsi-disk.c

  Log Message:
  -----------
  scsi-disk: fix check for out-of-range LBA

This fix is needed to correctly handle 0-block read and writes.
Without it, a 0-block access at LBA 0 would underflow.

Signed-off-by: Paolo Bonzini <address@hidden>
(cherry picked from commit 12ca76fc48081b3a0ad1a70546abfcf198aedfc4)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 75a44ae297b67aef5378f25fcf49b035e563b29b
      
https://github.com/qemu/qemu/commit/75a44ae297b67aef5378f25fcf49b035e563b29b
  Author: Ronnie Sahlberg <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M hw/scsi-disk.c

  Log Message:
  -----------
  SCSI: Standard INQUIRY data should report HiSup flag as set.

QEMU as far as I know only reports LUN numbers using the modes that
are described in SAM4.
As such, since all LUN numbers generated by the SCSI emulation in QEMU
follow SAM4, we should set the HiSup bit in the standard INQUIRY data
to indicate such.

>From SAM4:
  4.6.3 LUNs overview
  All LUN formats described in this standard are hierarchical in
  structure even when only a single level in that hierarchy is used.
  The HISUP bit shall be set to one in the standard INQUIRY data
  (see SPC-4) when any LUN format described in this standard is used.
  Non-hierarchical formats are outside the scope of this standard.

Signed-off-by: Ronnie Sahlberg <address@hidden>
(cherry picked from commit 1109c894052751df99962c009fd7dbae397721f5)

Signed-off-by: Michael Roth <address@hidden>


  Commit: b79ba45af114a5674a4790775502dbff26f6d3b7
      
https://github.com/qemu/qemu/commit/b79ba45af114a5674a4790775502dbff26f6d3b7
  Author: Stefan Weil <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M audio/audio_template.h

  Log Message:
  -----------
  audio: Fix warning from static code analysis

smatch report:
audio/audio_template.h:416 AUD_open_out(18) warn:
 variable dereferenced before check 'as' (see line 414)

Moving the ldebug statement after the statement which checks 'as'
fixes that warning.

Signed-off-by: Stefan Weil <address@hidden>
Signed-off-by: malc <address@hidden>
(cherry picked from commit 93b6599734f81328ee3d608f57667742cafeea72)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 907a34c9d7038abd68f9c06f026d7f049b5dbbe5
      
https://github.com/qemu/qemu/commit/907a34c9d7038abd68f9c06f026d7f049b5dbbe5
  Author: Stefan Weil <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M qemu-ga.c

  Log Message:
  -----------
  qemu-ga: Remove unreachable code after g_error

Report from smatch:
qemu-ga.c:117 register_signal_handlers(11) info: ignoring unreachable code.
qemu-ga.c:122 register_signal_handlers(16) info: ignoring unreachable code.

g_error calls abort which terminates the program.

Signed-off-by: Stefan Weil <address@hidden>
Signed-off-by: Stefan Hajnoczi <address@hidden>
(cherry picked from commit b548828862d3bf7214b7ef9cb361356b153b89c9)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 3c980e22acc8fcb070688417eb0d6d35d80c2b6b
      
https://github.com/qemu/qemu/commit/3c980e22acc8fcb070688417eb0d6d35d80c2b6b
  Author: Stefan Weil <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M qemu-sockets.c

  Log Message:
  -----------
  qemu-sockets: Fix potential memory leak

The old code leaks variable 'peer'.

Signed-off-by: Stefan Weil <address@hidden>
Signed-off-by: Stefan Hajnoczi <address@hidden>
(cherry picked from commit 39b384591fda27d6e1213cea0b11b1ebe0ed4b74)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 96d90d32ac4f3f2d39e0df881e0a9b12007a6d0d
      
https://github.com/qemu/qemu/commit/96d90d32ac4f3f2d39e0df881e0a9b12007a6d0d
  Author: Stefan Weil <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M hw/cadence_uart.c

  Log Message:
  -----------
  cadence_uart: Fix buffer overflow

Report from smatch:
hw/cadence_uart.c:413 uart_read(13) error: buffer overflow 's->r' 18 <= 18

This fixes read access to s->r[R_MAX] which is behind the limits of s->r.

Signed-off-by: Stefan Weil <address@hidden>
Signed-off-by: Stefan Hajnoczi <address@hidden>
(cherry picked from commit 5d40097fc09fe5d34cf316a411dc27d455ac2cd0)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 2b9a5aca51fba0d02af3ed5768adb1f448327d2f
      
https://github.com/qemu/qemu/commit/2b9a5aca51fba0d02af3ed5768adb1f448327d2f
  Author: Stefan Weil <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M hw/lm4549.c

  Log Message:
  -----------
  lm4549: Fix buffer overflow

Report from smatch:
lm4549.c:234 lm4549_write_samples(14) error:
 buffer overflow 's->buffer' 1024 <= 1024

There must be enough space to add two entries starting with index
s->buffer_level, therefore the old check was wrong.

[Peter Maydell <address@hidden> clarifies the nature of the
analyser warning:

I don't object to making the change to placate the analyser,
but I don't think this is actually a buffer overrun. We always
add and remove samples from the buffer two at a time, so it's
not possible to get here with s->buffer_level == BUFFER_SIZE-1
(which is the only case where the old and new conditions
give different answers).]

Signed-off-by: Stefan Weil <address@hidden>
Signed-off-by: Stefan Hajnoczi <address@hidden>
(cherry picked from commit 8139626643cbe8dc07bd9acc88057effeedf8064)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 4d0fcc1968afbcd69be08849016300d20a8d4023
      
https://github.com/qemu/qemu/commit/4d0fcc1968afbcd69be08849016300d20a8d4023
  Author: Stefan Weil <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M hw/ioh3420.c

  Log Message:
  -----------
  ioh3420: Remove unreachable code

Report from smatch:
hw/ioh3420.c:128 ioh3420_initfn(35) info: ignoring unreachable code.

Signed-off-by: Stefan Weil <address@hidden>
Reviewed-by: Juan Quintela <address@hidden>
Signed-off-by: Stefan Hajnoczi <address@hidden>
(cherry picked from commit 997f15672a5ca7714cf310d92f475d2c5fe40970)

Signed-off-by: Michael Roth <address@hidden>


  Commit: f3e98930787bc1cf21d962dc121448dea713b891
      
https://github.com/qemu/qemu/commit/f3e98930787bc1cf21d962dc121448dea713b891
  Author: Stefan Weil <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M hw/pflash_cfi01.c

  Log Message:
  -----------
  pflash_cfi01: Fix warning caused by unreachable code

Report from smatch:
hw/pflash_cfi01.c:431 pflash_write(180) info: ignoring unreachable code.

Instead of removing the return statement after the switch statement,
the patch replaces the return statements in the switch statement by
break statements. Other switch statements in the same code do it also
like that.

Signed-off-by: Stefan Weil <address@hidden>
Signed-off-by: Stefan Hajnoczi <address@hidden>
(cherry picked from commit 12dabc79f976d66755025272f7e2e8e4da31715a)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 57304014425895659dbfd75fea06c6d4183fe03c
      
https://github.com/qemu/qemu/commit/57304014425895659dbfd75fea06c6d4183fe03c
  Author: Hitoshi Mitake <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M os-posix.c
    M qemu-os-posix.h
    M qemu-os-win32.h
    M vl.c

  Log Message:
  -----------
  curses: don't initialize curses when qemu is daemonized

Current qemu initializes curses even if -daemonize option is
passed. This cause problem because shell prompt appears without
calling endwin().

This patch adds new function, is_daemonized(), to OS dependent
code. With this function, curses_display_init() can check that qemu is
daemonized or not. If daemonized, curses_display_init() isn't called
and the problem is avoided.

Of course, -daemonize && -curses doesn't make sense. Users shouldn't
pass the arguments at the same time. But the problem is very painful
because Ctrl-C cannot be delivered to the terminal.

Cc: Andrzej Zaborowski  <address@hidden>
Cc: Stefan Hajnoczi <address@hidden>
Cc: Anthony Liguori <address@hidden>
Cc: Michael Roth <address@hidden>
Signed-off-by: Hitoshi Mitake <address@hidden>
Signed-off-by: Stefan Hajnoczi <address@hidden>
(cherry picked from commit 995ee2bf469de6bbe5ce133ec853392b2a4ce34c)

Signed-off-by: Michael Roth <address@hidden>


  Commit: a2aad5fdc49b540d8b41c0a54c7078d034a3cf75
      
https://github.com/qemu/qemu/commit/a2aad5fdc49b540d8b41c0a54c7078d034a3cf75
  Author: Laszlo Ersek <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M console.c

  Log Message:
  -----------
  TextConsole: saturate escape parameter in TTY_STATE_CSI

Signed-off-by: Laszlo Ersek <address@hidden>
Reviewed-by: Markus Armbruster <address@hidden>
Signed-off-by: Stefan Hajnoczi <address@hidden>
(cherry picked from commit c10600af60865ba6c60987be313102ebb5fcee57)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 61dea8e914440d02720a929ad78178ed821f9946
      
https://github.com/qemu/qemu/commit/61dea8e914440d02720a929ad78178ed821f9946
  Author: Stefan Weil <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M linux-user/syscall.c

  Log Message:
  -----------
  linux-user: Remove redundant null check and replace free by g_free

Report from smatch:

linux-user/syscall.c:3632 do_ioctl_dm(220) info:
 redundant null check on big_buf calling free()

'big_buf' was allocated by g_malloc0, therefore free was also
replaced by g_free.

Signed-off-by: Stefan Weil <address@hidden>
Reviewed-by: Peter Maydell <address@hidden>
Signed-off-by: Stefan Hajnoczi <address@hidden>
(cherry picked from commit ad11ad77748bdd8016370db210751683dc038dd6)

Signed-off-by: Michael Roth <address@hidden>


  Commit: d4413913e1709bdbc892260124843e75e55d0eed
      
https://github.com/qemu/qemu/commit/d4413913e1709bdbc892260124843e75e55d0eed
  Author: Stefan Weil <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M net/socket.c
    M qemu-common.h

  Log Message:
  -----------
  net/socket: Fix compiler warning (regression for MinGW)

Commit 213fd5087e2e4e2da10ad266df0ba950cf7618bf removed a type cast
which is needed for MinGW:

net/socket.c:136: warning:
 pointer targets in passing argument 2 of ‘sendto’ differ in signedness
/usr/lib/gcc/amd64-mingw32msvc/4.4.4/../../../../amd64-mingw32msvc/include/winsock2.h:1313:
 note:
 expected ‘const char *’ but argument is of type ‘const uint8_t *’

Add a 'qemu_sendto' macro which provides that type cast where needed
and use the new macro instead of 'sendto'.

Signed-off-by: Stefan Weil <address@hidden>
Signed-off-by: Stefan Hajnoczi <address@hidden>
(cherry picked from commit 73062dfe6be0050dbd43ce3516e935ebb2545add)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 78fd27b3b6f0953a52b4a0f4d63265574d998582
      
https://github.com/qemu/qemu/commit/78fd27b3b6f0953a52b4a0f4d63265574d998582
  Author: Stefan Weil <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M compiler.h

  Log Message:
  -----------
  w32: Always use standard instead of native format strings

GLib 2.0 include files use __printf__ for the format attribute
which resolves to native format strings on w32 hosts.

QEMU wants standard format strings instead of native format
strings, so we simply change any declaration with __printf__
to use __gnu_printf__.

This works because all basic printf functions support both
kinds of format strings.

This fixes a compiler warning:

qapi/string-output-visitor.c: In function ‘print_type_int’:
qapi/string-output-visitor.c:34:5: warning: unknown conversion type character 
‘l’ in format [-Wformat]
qapi/string-output-visitor.c:34:5: warning: too many arguments for format 
[-Wformat-extra-args]

Signed-off-by: Stefan Weil <address@hidden>
Signed-off-by: Stefan Hajnoczi <address@hidden>
(cherry picked from commit 95df51a4a02a853af8828c281bce2d4f2a41d6fd)

Signed-off-by: Michael Roth <address@hidden>


  Commit: eea54caab066abb4c82573d552a49747f896665d
      
https://github.com/qemu/qemu/commit/eea54caab066abb4c82573d552a49747f896665d
  Author: Stefan Weil <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M oslib-win32.c
    M qemu-os-win32.h

  Log Message:
  -----------
  w32: Add implementation of gmtime_r, localtime_r

Those functions are missing in MinGW.

Some versions of MinGW-w64 include defines for gmtime_r and localtime_r.
Older versions of these macros are buggy (they return a pointer to a
static variable), therefore we don't want them. Newer versions are
similar to the code used here, but without the memset.

The implementation which is used here is not strictly reentrant,
but sufficiently good for QEMU on w32 or w64.

Signed-off-by: Stefan Weil <address@hidden>
address@hidden: added comment about locking]
Signed-off-by: Blue Swirl <address@hidden>
(cherry picked from commit d3e8f95753114a827f9cd8e819b1d5cc8333f76b)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 513cdda198bac6c40e8847c8e8136ec974b67da7
      
https://github.com/qemu/qemu/commit/513cdda198bac6c40e8847c8e8136ec974b67da7
  Author: Kevin Shanahan <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M blockdev.c

  Log Message:
  -----------
  blockdev: preserve readonly and snapshot states across media changes

If readonly=on is given at device creation time, the ->readonly flag
needs to be set in the block driver state for this device so that
readonly-ness is preserved across media changes (qmp change command).
Similarly, to preserve the snapshot property requires ->open_flags to
be correct.

Signed-off-by: Kevin Shanahan <address@hidden>
Signed-off-by: Kevin Wolf <address@hidden>
(cherry picked from commit 80dd1aae3657a902d262f5d20a7a3c655b23705e)

Signed-off-by: Michael Roth <address@hidden>


  Commit: d80210efbc96cc92c843eca6ab875665c6063a39
      
https://github.com/qemu/qemu/commit/d80210efbc96cc92c843eca6ab875665c6063a39
  Author: Jeff Cody <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M block.c
    M block.h

  Log Message:
  -----------
  block: correctly set the keep_read_only flag

I believe the bs->keep_read_only flag is supposed to reflect
the initial open state of the device. If the device is initially
opened R/O, then commit operations, or reopen operations changing
to R/W, are prohibited.

Currently, the keep_read_only flag is only accurate for the active
layer, and its backing file. Subsequent images end up always having
the keep_read_only flag set.

For instance, what happens now:

[  base  ]  kro = 1, ro = 1
    |
    v
[ snap-1 ]  kro = 1, ro = 1
    |
    v
[ snap-2 ]  kro = 0, ro = 1
    |
    v
[ active ]  kro = 0, ro = 0

What we want:

[  base  ]  kro = 0, ro = 1
    |
    v
[ snap-1 ]  kro = 0, ro = 1
    |
    v
[ snap-2 ]  kro = 0, ro = 1
    |
    v
[ active ]  kro = 0, ro = 0

Signed-off-by: Jeff Cody <address@hidden>
Signed-off-by: Kevin Wolf <address@hidden>
(cherry picked from commit be028adcedd68ca4d78fdc43e7e2fa4f1cdbc653)

Signed-off-by: Michael Roth <address@hidden>


  Commit: b83465006d2a747c70c6ba4eb0fc8bf827852492
      
https://github.com/qemu/qemu/commit/b83465006d2a747c70c6ba4eb0fc8bf827852492
  Author: Stefan Weil <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M Makefile
    M configure

  Log Message:
  -----------
  configure: Allow builds without any system or user emulation

The old code aborted configure when no emulation target was selected.
Even after removing the 'exit 1', it tried to read from STDIN
when QEMU was configured with

    configure' '--disable-user' '--disable-system'

This is fixed here.

Signed-off-by: Stefan Weil <address@hidden>
Signed-off-by: Anthony Liguori <address@hidden>
(cherry picked from commit 8bdd3d499fe0ddffa9901c56ab3bc8911d5b8be0)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 57f8a4c507be7b850756496e224e1dd3e9efc70e
      
https://github.com/qemu/qemu/commit/57f8a4c507be7b850756496e224e1dd3e9efc70e
  Author: Michael S. Tsirkin <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M qemu-sockets.c

  Log Message:
  -----------
  Refactor inet_connect_opts function

refactor address resolution code to fix nonblocking connect
remove getnameinfo call

Signed-off-by: Michael S. Tsirkin <address@hidden>
Signed-off-by: Amos Kong <address@hidden>
Signed-off-by: Orit Wasserman <address@hidden>
Signed-off-by: Anthony Liguori <address@hidden>
(cherry picked from commit 05bc1d8a4b2f77df8cc9880a552047e30c16f1f8)

Signed-off-by: Michael Roth <address@hidden>


  Commit: ee0999b16af3cfd874a1bd9a0cfe3f60426878cf
      
https://github.com/qemu/qemu/commit/ee0999b16af3cfd874a1bd9a0cfe3f60426878cf
  Author: Orit Wasserman <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M migration-tcp.c
    M nbd.c
    M qemu-char.c
    M qemu-sockets.c
    M qemu_socket.h
    M ui/vnc.c

  Log Message:
  -----------
  Separate inet_connect into inet_connect (blocking) and 
inet_nonblocking_connect

No need to add non blocking parameters to the blocking inet_connect
add block parameter for inet_connect_opts instead of using QemuOpt "block".

Signed-off-by: Orit Wasserman <address@hidden>
Signed-off-by: Anthony Liguori <address@hidden>
(cherry picked from commit 5db5f44cb4b7f24b9e0efdefc9015e36b7c34881)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 240f68ce5b9bdd13f859c80f286332036de33e6b
      
https://github.com/qemu/qemu/commit/240f68ce5b9bdd13f859c80f286332036de33e6b
  Author: Orit Wasserman <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M migration-tcp.c
    M qemu-char.c
    M qemu-sockets.c
    M qemu_socket.h

  Log Message:
  -----------
  Fix address handling in inet_nonblocking_connect

getaddrinfo can give us a list of addresses, but we only try to
connect to the first one. If that fails we never proceed to
the next one.  This is common on desktop setups that often have ipv6
configured but not actually working.

To fix this make inet_connect_nonblocking retry connection with a different
address.
callers on inet_nonblocking_connect register a callback function that will
be called when connect opertion completes, in case of failure the fd will have
a negative value

Signed-off-by: Orit Wasserman <address@hidden>
Signed-off-by: Michael S. Tsirkin <address@hidden>
Signed-off-by: Anthony Liguori <address@hidden>
(cherry picked from commit 233aa5c2d1cf4655ffe335025a68cf5454f87dad)

Signed-off-by: Michael Roth <address@hidden>


  Commit: d893e56f7249708080e2d363ce19d30a6de30733
      
https://github.com/qemu/qemu/commit/d893e56f7249708080e2d363ce19d30a6de30733
  Author: Orit Wasserman <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M migration.c

  Log Message:
  -----------
  Clear handler only for valid fd

Signed-off-by: Orit Wasserman <address@hidden>
Signed-off-by: Anthony Liguori <address@hidden>
(cherry picked from commit 3202becaa2b805497ce9e6faa6edfb83665f91b1)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 806d996789a01b09953b051350321183e272c76d
      
https://github.com/qemu/qemu/commit/806d996789a01b09953b051350321183e272c76d
  Author: Brendan Fennell <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M hw/pl190.c

  Log Message:
  -----------
  pl190: fix read of VECTADDR

Reading VECTADDR was causing us to set the current priority to
the wrong value, the most obvious effect of which was that we
would return the vector for the wrong interrupt as the result
of the read.

Signed-off-by: Brendan Fennell <address@hidden>
Signed-off-by: Peter Maydell <address@hidden>
(cherry picked from commit 14c126baf1c38607c5bd988878de85a06cefd8cf)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 14bdf978efc5de2a6b6d1f17f8561a2ac6c58541
      
https://github.com/qemu/qemu/commit/14bdf978efc5de2a6b6d1f17f8561a2ac6c58541
  Author: Meador Inge <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M hw/armv7m_nvic.c

  Log Message:
  -----------
  hw/armv7m_nvic: Correctly register GIC region when setting up NVIC

When setting up the NVIC memory regions the memory range
0x100..0xcff is aliased to an IO memory region that belongs
to the ARM GIC.  This aliased region should be added to the
NVIC memory container, but the actual GIC IO memory region
was being added instead.  This mixup was causing the wrong
IO memory access functions to be called when accessing parts
of the NVIC memory.

Signed-off-by: Meador Inge <address@hidden>
Signed-off-by: Peter Maydell <address@hidden>
(cherry picked from commit 9892cae39562d2e6c00ccc5966302c00f23be6d4)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 3e1954cb4aff1cb4108903d7b43fb93c4482dff1
      
https://github.com/qemu/qemu/commit/3e1954cb4aff1cb4108903d7b43fb93c4482dff1
  Author: Francesco Lavra <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M hw/vexpress.c

  Log Message:
  -----------
  Versatile Express: Fix NOR flash 0 address and remove flash alias

In the A series memory map (implemented in the Cortex A15 CoreTile), the
first NOR flash bank (flash 0) is mapped to address 0x08000000, while
address 0x00000000 can be configured as alias to either the first or the
second flash bank. This patch fixes the definition of flash 0 address,
and for simplicity removes the alias definition.

Signed-off-by: Francesco Lavra <address@hidden>
Signed-off-by: Peter Maydell <address@hidden>
(cherry picked from commit 661bafb3e14bfffcb0a7c7910534c7944608ca45)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 68fc5d1d27af39f21c688e6f4b0ea22d66800736
      
https://github.com/qemu/qemu/commit/68fc5d1d27af39f21c688e6f4b0ea22d66800736
  Author: Eduardo Habkost <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M target-i386/kvm.c

  Log Message:
  -----------
  i386: kvm: bit 10 of CPUID[8000_0001].EDX is reserved

Bit 10 of CPUID[8000_0001].EDX is not defined as an alias of
CPUID[1].EDX[10], so do not duplicate it on
kvm_arch_get_supported_cpuid().

Signed-off-by: Eduardo Habkost <address@hidden>
Reviewed-By: Igor Mammedov <address@hidden>
Reviewed-by: Don Slutz <address@hidden>
Signed-off-by: Blue Swirl <address@hidden>
(cherry picked from commit b1f4679392a03f2b26a37bfa52e95d6cc4f73d82)

Signed-off-by: Michael Roth <address@hidden>


  Commit: a8f2299d1b170b6100b0e9ad00788a7a7e31719b
      
https://github.com/qemu/qemu/commit/a8f2299d1b170b6100b0e9ad00788a7a7e31719b
  Author: Peter Maydell <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M fpu/softfloat.c

  Log Message:
  -----------
  fpu/softfloat.c: Return correctly signed values from uint64_to_float32

The uint64_to_float32() conversion function was incorrectly always
returning numbers with the sign bit set (ie negative numbers). Correct
this so we return positive numbers instead.

Signed-off-by: Peter Maydell <address@hidden>
Signed-off-by: Aurelien Jarno <address@hidden>
(cherry picked from commit e744c06fca438dc08271e626034e632a270c91c8)

Signed-off-by: Michael Roth <address@hidden>


  Commit: 159fe82dea23fdaf2e747d09c4f71afee00f664c
      
https://github.com/qemu/qemu/commit/159fe82dea23fdaf2e747d09c4f71afee00f664c
  Author: David Gibson <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M hw/spapr.c
    M hw/spapr_hcall.c

  Log Message:
  -----------
  pseries: Don't test for MSR_PR for hypercalls under KVM

PAPR hypercalls should only be invoked from the guest kernel, not guest
user programs, that is, with MSR[PR]=0.  Currently we check this in
spapr_hypercall, returning H_PRIVILEGE if MSR[PR]=1.

However, under KVM the state of MSR[PR] is already checked by the host
kernel before passing the hypercall to qemu, making this check redundant.
Worse, however, we don't generally synchronize KVM and qemu state on the
hypercall path, meaning that qemu could incorrectly reject a hypercall
because it has a stale MSR value.

This patch fixes the problem by moving the privilege test exclusively to
the TCG hypercall path.

Signed-off-by: David Gibson <address@hidden>
CC: address@hidden
Signed-off-by: Alexander Graf <address@hidden>
(cherry picked from commit efcb9383b974114e5f682e531346006f8f2466c0)

Signed-off-by: Michael Roth <address@hidden>


  Commit: f4c53d94d2538fcd335df25754c51444896e2c2c
      
https://github.com/qemu/qemu/commit/f4c53d94d2538fcd335df25754c51444896e2c2c
  Author: Michael Roth <address@hidden>
  Date:   2012-10-11 (Thu, 11 Oct 2012)

  Changed paths:
    M VERSION

  Log Message:
  -----------
  update VERSION for v1.2.1

Signed-off-by: Michael Roth <address@hidden>


Compare: https://github.com/qemu/qemu/compare/814395979efb^...f4c53d94d253

reply via email to

[Prev in Thread] Current Thread [Next in Thread]