Merge remote-tracking branch 'remotes/rth/tcg-next' into staging

* remotes/rth/tcg-next:
  tcg/optimize: Remember garbage high bits for 32-bit ops
  tcg/optimize: Move updating of gen_opc_buf into tcg_opt_gen_mov*
  tcg-sparc: Make debug_frame const
  tcg-s390: Make debug_frame const
  tcg-arm: Make debug_frame const
  tcg-aarch64: Make debug_frame const
  tcg-i386: Make debug_frame const
  tcg: Allow the debug_frame data structure to be constant
  tcg: Move size effects out of dh_arg
  tcg: Remove sizemask and flags arguments to tcg_gen_callN
  tcg: Save flags and computed sizemask in TCGHelperInfo
  tcg: Register the helper info struct rather than the name
  tcg: Move side effects out of dh_sizemask
  tcg: Inline tcg_gen_helperN
  tcg: Use helper-gen.h in tcg-op.h
  tcg: Push tcg-runtime routines into exec/helper-*
  tcg: Invert the inclusion of helper.h
  tcg: Optimize brcond2 and setcond2 ne/eq

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Merge remote-tracking branch 'remotes/afaerber/tags/qom-devices-for-peter' into staging

QOM/QTest infrastructure fixes and device conversions

* qom-test extension
* QEMUMachineInitArgs conversion to MachineState
* -machine options turned into /machine properties
* Named GPIO IRQs for devices

# gpg: Signature made Wed 28 May 2014 18:24:04 BST using RSA key ID 3E7E013F
# gpg: Can't check signature: public key not found

* remotes/afaerber/tags/qom-devices-for-peter:
  ssi: Name the CS GPIO
  qdev: Implement named GPIOs
  machine: Make -machine opts properties of MachineState
  tests: Check empty QMP output visitor
  qapi: Avoid output visitor crashing if it encounters a NULL value
  vl.c: Do not set 'type' property in obj_set_property()
  machine: Conversion of QEMUMachineInitArgs to MachineState
  qom-test: Test qom-list on link<> properties

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
qemu-img: Plug memory leak on block option help error path

Introduced in commit a283cb6; mostly harmless.  Spotted by Coverity.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Benoit Canet <benoit@irqsave.net>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
block/vvfat: Plug memory leak in enable_write_target()

I figure the leak originated in bdrv_create2(), and was duplicated
into callers when commit 91a073a dropped that function.  Looks like
the other places have since been fixed.

Spotted by Coverity.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Benoit Canet <benoit@irqsave.net>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
qcow2: Plug memory leak on qcow2_invalidate_cache() error paths

Introduced in commit 5a8a30d.  Spotted by Coverity.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Benoit Canet <benoit@irqsave.net>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
block: Plug memory leak on brv_open_image() error path

Introduced in commit da557a.  Spotted by Coverity.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Benoit Canet <benoit@irqsave.net>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
qemu-io: Support multiple -o in open command

Instead of ignoring all option values but the last one, multiple -o
options now have the same meaning as having a single option with all
settings in the order of their respective -o options.

Same as commit 2dc8328 for qemu-img convert, except here we do it with
QemuOpts rather than QEMUOptionParameter.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Benoit Canet <benoit@irqsave.net>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
qemu-io: Plug memory leak in open command

Introduced in commit b543c5c.  Spotted by Coverity.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
qemu-io: Don't print NULL when open without non-option arg fails

Reproducer: "open -o a=b".  Broken in commit fd0fee3.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
blockdev: Plug memory leak in blockdev_init()

blockdev_init() leaks bs_opts when qemu_opts_create() fails, i.e. when
the ID is bad.  Missed in commit ec9c10d.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Benoit Canet <benoit@irqsave.net>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
blockdev: Plug memory leak in drive_init()

bs_opts is leaked on all paths from its qdev_new() that don't got
through blockdev_init().  Add the missing QDECREF(), and zap bs_opts
after blockdev_init(), so the new QDECREF() does nothing when we go
through blockdev_init().

Leak introduced in commit f298d07.  Spotted by Coverity.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
block/qapi: Plug memory leak in dump_qobject() case QTYPE_QERROR

Introduced in commit a8d8ecb.  Spotted by Coverity.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Benoit Canet <benoit@irqsave.net>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
block/vvfat: Plug memory leak in check_directory_consistency()

On error path.  Introduced in commit a046433a.  Spotted by Coverity.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Benoit Canet <benoit@irqsave.net>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
block/vvfat: Plug memory leak in read_directory()

Has always been leaky.  Spotted by Coverity.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Benoit Canet <benoit@irqsave.net>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
block/sheepdog: Plug memory leak in sd_snapshot_create()

Has always been leaky.  Spotted by Coverity.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Benoit Canet <benoit@irqsave.net>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
qemu-img: Plug memory leak in convert command

Introduced in commit 661a0f7.  Spotted by Coverity.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Benoit Canet <benoit@irqsave.net>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
block/raw-posix.c: Avoid nonstandard LONG_LONG_MAX

In the MacOSX specific code in raw-posix.c we use the define
LONG_LONG_MAX. This is actually a non-standard pre-C99 define;
switch to using the standard LLONG_MAX instead.

This apparently fixes a compilation failure with certain
compiler/OS versions (though it is unclear which).

Reported-by: Peter Bartoli <peter@bartoli.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
vmdk: Fix local_err in vmdk_create

In vmdk_create and vmdk_create_extent, initialize local_err before using
it, and don't leak it on error.

Reported-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Fam Zheng <famz@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
vfio-pci: Quirk RTL8168 NIC

This device is ridiculous.  It has two MMIO BARs, BAR4 and BAR2.  BAR4
hosts the MSI-X table, so oviously it would be too easy to access it
directly, instead it creates a window register in BAR2 that, among
other things, provides access to the MSI-X table.  This means MSI-X
doesn't work in the guest because the driver actually manages to
program the physical table.  When interrupt remapping is present, the
device MSI will be blocked.  The Linux driver doesn't make use of this
window, so apparently it's not required to make use of MSI-X.  This
quirk makes the device work with the Windows driver that does use this
window for MSI-X, but I certainly cannot recommend this device for
assignment (the Windows 7 driver also constantly pokes PCI config
space).

Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
memory: Sanity check that no listeners remain on a destroyed AddressSpace

At the moment, most AddressSpace objects last as long as the guest system
in practice, but that could well change in future.  In addition, for VFIO
we will be introducing some private per-AdressSpace information, which must
be disposed of before the AddressSpace itself is destroyed.

To reduce the chances of subtle bugs in this area, this patch adds
asssertions to ensure that when an AddressSpace is destroyed, there are no
remaining MemoryListeners using that AS as a filter.

Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>