# By Henry Harrington (1) and Stefan Weil (1)
# Via Andreas Färber
* afaerber-or/cocoa-for-upstream:
  cocoa: Replace non-portable asprintf() by g_strdup_printf()
  cocoa: Fix VBE function Set Display Start

virtio,make,pci,e1000,vfio,piix

This includes my timestamp generation cleanup,
Amos's and my work on virtio net commands,
pci,e1000,vfio and piix fixes.

Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

# gpg: Signature made Thu 31 Jan 2013 06:20:27 AM CST using RSA key ID D28D5469
# gpg: Can't check signature: public key not found

# By Michael S. Tsirkin (6) and others
# Via Michael S. Tsirkin
* mst/tags/for_anthony:
  vfio-pci: Enable PCIe extended config space
  PIIX3: reset the VM when the Reset Control Register's RCPU bit gets set
  ich9: add support for pci assignment
  virtio-net: rename ctrl rx commands
  virtio-net: introduce a new macaddr control
  virtio-net: remove layout assumptions for ctrl vq
  virtio-net: revert mac on reset
  rules/mak: make clean should blow away timestamp files
  Makefile: clean timestamp generation rule
  rules.mak: cleanup config generation rules
  e1000: document ICS read behaviour

The pos field in the DSPControl register is not correctly initialized.
Per documentation, the result of MTHLIP is unpredictable if the value of the
pos field before the execution is greater than 32.

Signed-off-by: Petar Jovanovic <petarj@mips.com>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>

compute_hflags() will reset DSP h-flags, so MX bit should be initially set
for usermode in cpu_state_reset() if DSP ASE is implemented.
This change will bring back user-mode support for DSP ASE, since one of the
recent changes broke it.

Signed-off-by: Petar Jovanovic <petarj@mips.com>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>

Turn MADD.fmt, MSUB.fmt, NMADD.fmt and NMSUB.fmt from fused to unfused
operations, so that they behave in the same way as a separate multiplication
and addition.  The instructions were only fused in early MIPS IV processors.

Signed-off-by: Richard Sandiford <rdsandiford@googlemail.com>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>

Sign-extend the result of LWR, as is already done for LWL.  This is necessary
in the case where LWR loads the full word (i.e. the address is actually
aligned).  In the other cases, it is implementation defined whether the
upper 32 bits of the result are unchanged or a copy of bit 31.  The latter
seems easier to implement.

Previously the code used:

    (oldval & (0xfffffffe << (31 - bitshift))) | (newval >> bitshift)

which zeroed the upper bits of the register, losing any previous sign
extension in the unaligned cases.

Signed-off-by: Richard Sandiford <rdsandiford@googlemail.com>
Reviewed-by: Richard Henderson <rth@twiddle.net>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>

Make RESTORE use sign-extending rather than zero-extending loads.

Signed-off-by: Richard Sandiford <rdsandiford@googlemail.com>
Reviewed-by: Richard Henderson <rth@twiddle.net>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>

* 'target-arm.next' of git://git.linaro.org/people/pmaydell/qemu-arm:
  target-arm: Rename CPU types
  target-arm: Fix TCG temp leaks for WI and UNDEF VFP sysreg writes

DSP instruction from the (d)append sub-class can be implemented with
TCG. Use a different function for these instructions are they are quite
different from compare-pick sub-class.

Fix BALIGN instruction for negative value, where the value should be
zero-extended before being shift to the right.

Reviewed-by: Richard Henderson <rth@twiddle.net>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>

Reviewed-by: Richard Henderson <rth@twiddle.net>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>

This allow to reduce the number of macros.

Reviewed-by: Richard Henderson <rth@twiddle.net>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>

This allow to reduce the number of macros.

Reviewed-by: Richard Henderson <rth@twiddle.net>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>

Instead of playing with bit shifting, add two unions (one for 32-bit
values, one for 64-bit ones) to access all the DSP elements with the
correct type.

This make the code easier to read and less error prone, and allow GCC
to vectorize the code in some cases.

Reviewed-by: Eric Johnson <ericj@mips.com>
Reviewed-by: Richard Henderson <rth@twiddle.net>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>

On CPU without DSP ASE support, a reserved instruction exception (instead of
a DSP ASE sate disabled) should be generated.

Reviewed-by: Richard Henderson <rth@twiddle.net>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>

Copy insn_flags in DisasContext to avoid passing a CPUMIPSState pointer
to subroutines, as suggested by Richard Henderson. Change subroutines to
use this new field and remove the first argument.

Reviewed-by: Richard Henderson <rth@twiddle.net>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>

When rd is 0, which still need to do the actually load to possibly
generate a TLB exception.

Reviewed-by: Eric Johnson <ericj@mips.com>
Reviewed-by: Richard Henderson <rth@twiddle.net>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>

Signed-off-by: Stefan Weil <sw@weilnetz.de>
Signed-off-by: Andreas Färber <andreas.faerber@web.de>

Register a dpy_gfx_setdata callback so that the Cocoa code
is notified whenever the screen start address changes.

Commit 1d3323de has a similar fix for the VNC UI.

Signed-off-by: Henry Harrington <henry.harrington@gmail.com>
Cc: qemu-stable@nongnu.org (1.3.x)
Signed-off-by: Andreas Färber <andreas.faerber@web.de>

# By Christoffer Dall (1) and Peter Maydell (1)
# Via Peter Maydell
* pmaydell/arm-devs.next:
  hw/vexpress: Use correct HBI (board model number) for vexpress-a15
  hw/arm_sysctl: Clear sysctl cfgctrl start bit

# By Markus Armbruster (12) and others
# Via Stefan Hajnoczi
* stefanha/trivial-patches:
  qmp-commands.hx: s/tray-open/tray_open/ to match qapi schema
  tests: Fix {rtc, m48t59}-test build on illumos
  qemu-pixman.h: Avoid mutual inclusion loop with console.h
  qemu-ga: Fix unchecked strdup() by converting to g_strdup()
  qapi: Fix unchecked strdup() by converting to g_strdup()
  libcacard: Fix unchecked strdup() by converting to g_strdup()
  qemu-log: Plug trivial memory leak in cpu_set_log_filename()
  qemu-log: Fix unchecked strdup() by converting to g_strdup()
  virtfs-proxy-helper: Fix unchecked strdup() by conv. to g_strdup()
  spice: Fix unchecked strdup() by converting to g_strdup()
  readline: Fix unchecked strdup() by converting to g_strdup()
  hw/9pfs: Fix unchecked strdup() by converting to g_strdup()
  g_strdup(NULL) returns NULL; simplify
  g_malloc(0) and g_malloc0(0) return NULL; simplify
  xilinx_axidma: Fix debug mode compile messages
  cadence_gem: Debug mode compile fixes
  cadence_ttc: Debug mode compile fixes
  vnc: Clean up vncws_send_handshake_response()

# By Andreas Färber
# Via Andreas Färber
* afaerber-or/prep-up:
  prep: Move PReP machine to hw/ppc/
  prep_pci: Convert to QOM realizefn
  prep_pci: Create PCIBus and PCIDevice in-place

# By Cornelia Huck (13) and others
# Via Alexander Graf
* agraf/s390-for-upstream:
  s390: Drop set_bit usage in virtio_ccw.
  s390: css error codes.
  s390: Use s390_cpu_physical_memory_map for tpi.
  sclpconsole: Don't instantiate sclpconsole with -nodefaults
  s390: Add s390-ccw-virtio machine.
  s390-virtio: Check for NULL device in reset hypercall
  s390: Move hw files to hw/s390x
  virtio-s390: add a reset function to virtio-s390 devices
  s390: Make typeinfo const
  s390: Add new channel I/O based virtio transport.
  s390-virtio: Factor out some initialization code.
  s390: Wire up channel I/O in kvm.
  s390: Virtual channel subsystem support.
  s390: Add channel I/O instructions.
  s390: I/O interrupt and machine check injection.
  s390: Channel I/O basic definitions.
  s390: Add mapping helper functions.
  s390: Lowcore mapping helper.
  s390: Add default support for SCLP console

In the initial conversion of CPU models to QOM types, model names were
mapped 1:1 to type names. As a side effect this gained us a type "any",
which is now a device.

To avoid "-device any" silliness and to pave the way for compiling
multiple targets into one executable, adopt a <name>-<arch>-cpu scheme.
This leads to names like arm926-arm-cpu but is easiest to handle.

No functional changes for -cpu arguments or -cpu ? output.

Suggested-by: Eduardo Habkost <ehabkost@redhat.com>
Signed-off-by: Andreas Färber <afaerber@suse.de>
Signed-off-by: Andreas Färber <afaerber@suse.de>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Fix a leak of a TCG temporary in code paths for VFP system register
writes for cases which UNDEF or are write-ignored.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

The vexpress-a15 QEMU model is supposed to be a V2P-CA15; the HBI
(a kind of board model number) for this coretile is 237, not 217.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

The start bit should only be set to indicate that a function call is
underway, right now.  When done with function, clear it.

Signed-off-by: Christoffer Dall <c.dall@virtualopensystems.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Currently, we are using 'tray_open' in QMP and 'tray-open' in
HMP. However, the QMP documentation was mistakenly using the
HMP version.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

Struct tm does not have tm_gmtoff field on illumos.
Fix the build by not zero-initializing these fields on Solaris.

Cc: qemu-stable@nongnu.org
Signed-off-by: Andreas Färber <andreas.faerber@web.de>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

Remove an unnecessary mutual inclusion loop between qemu-pixman.h and
console.h, since the former was only including the latter for
'PixelFormat*', which can be provided by typedefs.h.  This requires a
minor adjustment to the files which included qemu-pixman.h, since
they were relying on it implicitly dragging in all of console.h.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Acked-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

I figure it's freed somewhere deep down in QAPI, with g_free().

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Luiz Capitulino <lcapitulino@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

Note that we already free with g_free().

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Luiz Capitulino <lcapitulino@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

Note that we already free with g_free().

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

Note: the allocation in virtio_9p_init() is still leaked.  To be fixed
in a followup commit.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

Once upon a time, it was decided that qemu_malloc(0) should abort.
Switching to glib retired that bright idea.  Some code that was added
to cope with it (e.g. in commits 702ef63f, b76b6e95) is still around.
Bury it.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>