]> git.proxmox.com Git - qemu.git/log
qemu.git
11 years agonbd: pass NBDClient to nbd_send_negotiate
Paolo Bonzini [Wed, 22 Aug 2012 13:30:31 +0000 (15:30 +0200)]
nbd: pass NBDClient to nbd_send_negotiate

We will need the NBDClient in nbd_send_negotiate to store the
export requested by the client.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
11 years agonbd: add more constants
Paolo Bonzini [Wed, 22 Aug 2012 13:13:30 +0000 (15:13 +0200)]
nbd: add more constants

Avoid magic numbers and magic size computations; hide them behind
constants.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
11 years agoRemove unused CONFIG_TCG_PASS_AREG0 and dead code
Blue Swirl [Sun, 2 Sep 2012 15:28:56 +0000 (15:28 +0000)]
Remove unused CONFIG_TCG_PASS_AREG0 and dead code

Now that CONFIG_TCG_PASS_AREG0 is enabled for all targets,
remove dead code and support for !CONFIG_TCG_PASS_AREG0 case.

Remove dyngen-exec.h and all references to it. Although included by
hw/spapr_hcall.c, it does not seem to use it.

Remove unused HELPER_CFLAGS.

Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
Reviewed-by: Richard Henderson <rth@twiddle.net>
11 years agotarget-mips: switch to AREG0 free mode
Blue Swirl [Sun, 2 Sep 2012 14:52:59 +0000 (14:52 +0000)]
target-mips: switch to AREG0 free mode

Add an explicit CPUState parameter instead of relying on AREG0
and switch to AREG0 free mode.

Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
Acked-by: Aurelien Jarno <aurelien@aurel32.net>
11 years agotarget-sh4: switch to AREG0 free mode
Blue Swirl [Sun, 2 Sep 2012 10:37:06 +0000 (10:37 +0000)]
target-sh4: switch to AREG0 free mode

Add an explicit CPUState parameter instead of relying on AREG0
and switch to AREG0 free mode.

Acked-by: Aurelien Jarno <aurelien@aurel32.net>
Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
11 years agotarget-cris: Switch to AREG0 free mode
Aurelien Jarno [Fri, 7 Sep 2012 14:13:27 +0000 (16:13 +0200)]
target-cris: Switch to AREG0 free mode

Add an explicit CPUCRISState parameter instead of relying on AREG0, and
use cpu_ld* in translation and interrupt handling. Remove AREG0 swapping
in tlb_fill(). Switch to AREG0 free mode

Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
11 years agotarget-cris: Avoid AREG0 for helpers
Aurelien Jarno [Thu, 30 Aug 2012 14:56:39 +0000 (16:56 +0200)]
target-cris: Avoid AREG0 for helpers

Add an explicit CPUCRISState parameter instead of relying on AREG0.

Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
11 years agotarget-microblaze: switch to AREG0 free mode
Blue Swirl [Sun, 2 Sep 2012 08:39:22 +0000 (08:39 +0000)]
target-microblaze: switch to AREG0 free mode

Add an explicit CPUState parameter instead of relying on AREG0
and switch to AREG0 free mode.

Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
11 years agotarget-arm: final conversion to AREG0 free mode
Blue Swirl [Tue, 4 Sep 2012 20:25:59 +0000 (20:25 +0000)]
target-arm: final conversion to AREG0 free mode

Convert code load functions and switch to AREG0 free mode.

Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
11 years agotarget-arm: convert remaining helpers
Blue Swirl [Tue, 4 Sep 2012 20:19:15 +0000 (20:19 +0000)]
target-arm: convert remaining helpers

Convert remaining helpers to AREG0 free mode: add an explicit
CPUState parameter instead of relying on AREG0.

Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
11 years agotarget-arm: convert void helpers
Blue Swirl [Tue, 4 Sep 2012 20:08:34 +0000 (20:08 +0000)]
target-arm: convert void helpers

Add an explicit CPUState parameter instead of relying on AREG0.

For easier review, convert only op helpers which don't return any value.

Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
11 years agotarget-unicore32: switch to AREG0 free mode
Blue Swirl [Sun, 2 Sep 2012 07:42:33 +0000 (07:42 +0000)]
target-unicore32: switch to AREG0 free mode

Add an explicit CPUState parameter instead of relying on AREG0
and switch to AREG0 free mode.

Tested-by: Guan Xuetao <gxt@mprc.pku.edu.cn>
Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
11 years agotarget-m68k: avoid using cpu_single_env
Blue Swirl [Sat, 8 Sep 2012 10:48:20 +0000 (10:48 +0000)]
target-m68k: avoid using cpu_single_env

Pass around CPUState instead of using global cpu_single_env.

Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
11 years agotarget-m68k: switch to AREG0 free mode
Blue Swirl [Sun, 2 Sep 2012 07:27:38 +0000 (07:27 +0000)]
target-m68k: switch to AREG0 free mode

Add an explicit CPUState parameter instead of relying on AREG0
and switch to AREG0 free mode.

Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
11 years agotarget-lm32: switch to AREG0 free mode
Blue Swirl [Sun, 2 Sep 2012 06:57:17 +0000 (06:57 +0000)]
target-lm32: switch to AREG0 free mode

Add an explicit CPUState parameter instead of relying on AREG0
and switch to AREG0 free mode.

Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
11 years agotarget-s390x: avoid cpu_single_env
Blue Swirl [Sat, 8 Sep 2012 11:15:37 +0000 (11:15 +0000)]
target-s390x: avoid cpu_single_env

Pass around CPUState instead of using global cpu_single_env.

Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
11 years agoconfigure: properly check if -lrt and -lm is needed
Natanael Copa [Wed, 12 Sep 2012 09:06:51 +0000 (09:06 +0000)]
configure: properly check if -lrt and -lm is needed

Fixes build against uClibc.

uClibc provides 2 versions of clock_gettime(), one with realtime
support and one without (this is so you can avoid linking in -lrt
unless actually needed). This means that the clock_gettime() don't
need -lrt. We still need it for timer_create() so we check for this
function in addition.

We also need check if -lm is needed for isnan().

Both -lm and -lrt are needed for libs_qga.

Signed-off-by: Natanael Copa <ncopa@alpinelinux.org>
Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
11 years agotcg: Fix MAX_OPC_PARAM_IARGS
Stefan Weil [Wed, 12 Sep 2012 17:18:55 +0000 (19:18 +0200)]
tcg: Fix MAX_OPC_PARAM_IARGS

DEF_HELPER_FLAGS_5 was added some time ago without adjusting
MAX_OPC_PARAM_IARGS.

Fixing the definition becomes more important as QEMU is using
an increasing number of helper functions called with 5 arguments.

Add also a comment to avoid future problems when DEF_HELPER_FLAGS_6
will be added.

Signed-off-by: Stefan Weil <sw@weilnetz.de>
Reviewed-by: Richard Henderson <rth@twiddle.net>
Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
11 years agoMerge branch 'usb.64' of git://git.kraxel.org/qemu
Aurelien Jarno [Tue, 11 Sep 2012 16:06:56 +0000 (18:06 +0200)]
Merge branch 'usb.64' of git://git.kraxel.org/qemu

* 'usb.64' of git://git.kraxel.org/qemu: (54 commits)
  xhci: allow bytewise capability register reads
  xhci: kill xhci_mem_{read,write} dispatcher functions
  xhci: support multiple interrupters
  xhci: pick target interrupter
  xhci: prepare xhci_runtime_{read,write} for multiple interrupters
  xhci: add XHCIInterrupter
  xhci: move register update into xhci_intr_raise
  xhci: add msix support
  xhci: rework interrupt handling
  xhci: fix & cleanup msi.
  usb-storage: usb3 support
  usb3: bos decriptor
  usb3: superspeed endpoint companion
  usb3: superspeed descriptors
  xhci: update port handling
  xhci: update register layout
  xhci: fix runtime write tracepoint
  xhci: add trace_usb_xhci_ep_set_dequeue
  xhci: trace cc codes in cleartext
  xhci: iso xfer support
  ...

11 years agotcg/optimize: fix if/else/break coding style
Aurelien Jarno [Fri, 7 Sep 2012 10:24:32 +0000 (12:24 +0200)]
tcg/optimize: fix if/else/break coding style

optimizer.c contains some cases were the break is appearing in both the
if and the else parts. Fix that by moving it to the outer part. Also
move some common code there.

Reviewed-by: Richard Henderson <rth@twiddle.net>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
11 years agotcg/optimize: add constant folding for brcond
Aurelien Jarno [Thu, 6 Sep 2012 14:47:14 +0000 (16:47 +0200)]
tcg/optimize: add constant folding for brcond

Reviewed-by: Richard Henderson <rth@twiddle.net>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
11 years agotcg/optimize: add constant folding for setcond
Aurelien Jarno [Thu, 6 Sep 2012 14:47:14 +0000 (16:47 +0200)]
tcg/optimize: add constant folding for setcond

Reviewed-by: Richard Henderson <rth@twiddle.net>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
11 years agotcg/optimize: swap brcond/setcond arguments when possible
Aurelien Jarno [Thu, 6 Sep 2012 14:47:14 +0000 (16:47 +0200)]
tcg/optimize: swap brcond/setcond arguments when possible

brcond and setcond ops are not commutative, but it's easy to compute the
new condition after swapping the arguments. Try to always put the constant
argument in second position like for commutative ops, to help backends to
generate better code.

Reviewed-by: Richard Henderson <rth@twiddle.net>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
11 years agotcg/optimize: simplify shift/rot r, 0, a => movi r, 0 cases
Aurelien Jarno [Thu, 6 Sep 2012 14:47:14 +0000 (16:47 +0200)]
tcg/optimize: simplify shift/rot r, 0, a => movi r, 0 cases

shift/rot r, 0, a is equivalent to movi r, 0.

Reviewed-by: Richard Henderson <rth@twiddle.net>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
11 years agotcg/optimize: simplify and r, a, 0 cases
Aurelien Jarno [Thu, 6 Sep 2012 14:47:14 +0000 (16:47 +0200)]
tcg/optimize: simplify and r, a, 0 cases

and r, a, 0 is equivalent to a movi r, 0.

Reviewed-by: Richard Henderson <rth@twiddle.net>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
11 years agotcg/optimize: simplify or/xor r, a, 0 cases
Aurelien Jarno [Thu, 6 Sep 2012 14:47:14 +0000 (16:47 +0200)]
tcg/optimize: simplify or/xor r, a, 0 cases

or/xor r, a, 0 is equivalent to a mov r, a.

Reviewed-by: Richard Henderson <rth@twiddle.net>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
11 years agotcg/optimize: split expression simplification
Aurelien Jarno [Thu, 6 Sep 2012 14:47:13 +0000 (16:47 +0200)]
tcg/optimize: split expression simplification

Split expression simplification in multiple parts so that a given op
can appear multiple times. This patch should not change anything.

Reviewed-by: Richard Henderson <rth@twiddle.net>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
11 years agotcg: improve profiler
Aurelien Jarno [Thu, 6 Sep 2012 14:47:13 +0000 (16:47 +0200)]
tcg: improve profiler

Now that there are two passes of optimization (optimize.c, liveness)
there is no point of outputing the statistics of the liveness part
only. Update the code to take into account both optimizations.

Reviewed-by: Richard Henderson <rth@twiddle.net>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
11 years agoxhci: allow bytewise capability register reads
Gerd Hoffmann [Tue, 4 Sep 2012 12:48:03 +0000 (14:48 +0200)]
xhci: allow bytewise capability register reads

Some guests need this according to
Alejandro Martinez Ruiz <alex@securiforest.com>

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
11 years agoxhci: kill xhci_mem_{read,write} dispatcher functions
Gerd Hoffmann [Tue, 4 Sep 2012 12:42:20 +0000 (14:42 +0200)]
xhci: kill xhci_mem_{read,write} dispatcher functions

... and register subregions instead, so we offload the dispatching
to the the memory subsystem which is designed to handle it.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
11 years agoxhci: support multiple interrupters
Gerd Hoffmann [Tue, 4 Sep 2012 10:56:55 +0000 (12:56 +0200)]
xhci: support multiple interrupters

Everything is in place, flip the big switch now
and enable support for multiple interrupters.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
11 years agoxhci: pick target interrupter
Gerd Hoffmann [Fri, 31 Aug 2012 13:30:51 +0000 (15:30 +0200)]
xhci: pick target interrupter

Pick the correct interrupter when queuing an event.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
11 years agoxhci: prepare xhci_runtime_{read,write} for multiple interrupters
Gerd Hoffmann [Thu, 30 Aug 2012 15:15:12 +0000 (17:15 +0200)]
xhci: prepare xhci_runtime_{read,write} for multiple interrupters

Prepare xhci runtime register access function for multiple interrupters.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
11 years agoxhci: add XHCIInterrupter
Gerd Hoffmann [Thu, 30 Aug 2012 13:49:03 +0000 (15:49 +0200)]
xhci: add XHCIInterrupter

Move all state belonging to the (single) interrupter into a separate
struct.  First step in adding support for multiple interrupters.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
11 years agoxhci: move register update into xhci_intr_raise
Gerd Hoffmann [Thu, 30 Aug 2012 12:04:04 +0000 (14:04 +0200)]
xhci: move register update into xhci_intr_raise

Now that we have a separate function to raise an IRQ we can move
some comon code into the function.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
11 years agoxhci: add msix support
Gerd Hoffmann [Thu, 30 Aug 2012 10:06:59 +0000 (12:06 +0200)]
xhci: add msix support

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
11 years agoxhci: rework interrupt handling
Gerd Hoffmann [Thu, 30 Aug 2012 11:05:10 +0000 (13:05 +0200)]
xhci: rework interrupt handling

Split xhci_irq_update into a function which handles intx updates
(including lowering the irq line once the guests acks the interrupt)
and one which is used for raising an irq only.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
11 years agoxhci: fix & cleanup msi.
Gerd Hoffmann [Thu, 30 Aug 2012 08:57:12 +0000 (10:57 +0200)]
xhci: fix & cleanup msi.

Drop custom write_config function which isn't needed any more.
Make the msi property a bit property so it accepts 'on' & 'off'.
Enable MSI by default.

TODO: add compat property to disable on old machine types.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
11 years agousb-storage: usb3 support
Gerd Hoffmann [Tue, 28 Aug 2012 15:29:15 +0000 (17:29 +0200)]
usb-storage: usb3 support

Add usb3 descriptors to usb-storage, so it shows up as superspeed
device when connected to xhci.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
11 years agousb3: bos decriptor
Gerd Hoffmann [Tue, 28 Aug 2012 15:46:29 +0000 (17:46 +0200)]
usb3: bos decriptor

Add support for creating BOS descriptor and
device cappability descriptors.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
11 years agousb3: superspeed endpoint companion
Gerd Hoffmann [Tue, 28 Aug 2012 15:28:03 +0000 (17:28 +0200)]
usb3: superspeed endpoint companion

Add support for building superspeed endpoint companion descriptors,
create them for superspeed usb devices.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
11 years agousb3: superspeed descriptors
Gerd Hoffmann [Tue, 28 Aug 2012 15:28:50 +0000 (17:28 +0200)]
usb3: superspeed descriptors

Add superspeed descriptor entry to USBDesc,
advertise superspeed support when present.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
11 years agoxhci: update port handling
Gerd Hoffmann [Tue, 28 Aug 2012 11:38:01 +0000 (13:38 +0200)]
xhci: update port handling

This patch changes the way xhci ports are linked to USBPorts.  The fixed
1:1 relationship between xhci ports and USBPorts is gone.  Now each
USBPort represents a physical plug which has usually two xhci ports
assigned: one usb2 and ond usb3 port.  usb devices show up at one or the
other, depending on whenever they support superspeed or not.

This patch also makes the number of usb2 and usb3 ports runtime
configurable by adding 'p2' and 'p3' properties.  It is allowed to
have different numbers of usb2 and usb3 ports.  Specifying p2=4,p3=2
will give you an xhci adapter which supports all speeds on physical
ports 1+2 and usb2 only on ports 3+4.

11 years agoxhci: update register layout
Gerd Hoffmann [Thu, 23 Aug 2012 11:26:25 +0000 (13:26 +0200)]
xhci: update register layout

Change the register layout to be a bit more sparse and also not depend
on the number of ports.  Useful when for making the number of ports
runtime-configurable.

11 years agoxhci: fix runtime write tracepoint
Gerd Hoffmann [Thu, 30 Aug 2012 10:42:32 +0000 (12:42 +0200)]
xhci: fix runtime write tracepoint

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
11 years agoxhci: add trace_usb_xhci_ep_set_dequeue
Gerd Hoffmann [Wed, 29 Aug 2012 10:54:59 +0000 (12:54 +0200)]
xhci: add trace_usb_xhci_ep_set_dequeue

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
11 years agoxhci: trace cc codes in cleartext
Gerd Hoffmann [Mon, 27 Aug 2012 14:09:20 +0000 (16:09 +0200)]
xhci: trace cc codes in cleartext

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
11 years agoxhci: iso xfer support
Gerd Hoffmann [Fri, 24 Aug 2012 12:13:08 +0000 (14:13 +0200)]
xhci: iso xfer support

Add support for iso transfers.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
11 years agoxhci: implement mfindex
Gerd Hoffmann [Tue, 21 Aug 2012 10:32:58 +0000 (12:32 +0200)]
xhci: implement mfindex

Implement mfindex register and mfindex wrap event.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
11 years agoxhci: move device lookup into xhci_setup_packet
Gerd Hoffmann [Fri, 24 Aug 2012 12:21:39 +0000 (14:21 +0200)]
xhci: move device lookup into xhci_setup_packet

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
11 years agoxhci: drop buffering
Gerd Hoffmann [Fri, 17 Aug 2012 09:04:36 +0000 (11:04 +0200)]
xhci: drop buffering

This patch splits the xhci_xfer_data function into three.
The xhci_xfer_data function used to do does two things:

  (1) copy transfer data between guest memory and a temporary buffer.
  (2) report transfer results to the guest using events.

Now we three functions to handle this:

  (1) xhci_xfer_map creates a scatter list for the transfer and
      uses that (instead of the temporary buffer) to build a
      USBPacket.
  (2) xhci_xfer_unmap undoes the mapping.
  (3) xhci_xfer_report sends out events.

The patch also fixes reporting of transaction errors which must be
reported unconditinally, not only in case the guest asks for it
using the ISP flag.

[ v2: fix warning ]

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
11 years agoxhci: rip out background transfer code
Gerd Hoffmann [Fri, 17 Aug 2012 12:05:21 +0000 (14:05 +0200)]
xhci: rip out background transfer code

original xhci code (the one which used libusb directly) used to use
'background transfers' for iso streams.  In upstream qemu the iso
stream buffering is handled by usb-host & usb-redir, so we will
never ever need this.  It has been left in as reference, but is dead
code anyway.  Rip it out.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
11 years agousb-audio: fix usb version
Gerd Hoffmann [Tue, 28 Aug 2012 14:43:34 +0000 (16:43 +0200)]
usb-audio: fix usb version

usb-audio is a full speed (1.1) device,
but bcdUSB claims it is usb 2.0.  Fix it.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
11 years agoBetter name usb braille device
Samuel Thibault [Thu, 23 Aug 2012 07:59:27 +0000 (09:59 +0200)]
Better name usb braille device

Windows users need to know that they have to use the Baum driver to make
the qemu braille device work.

Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
11 years agousb-redir: Enable pipelining for bulk endpoints
Hans de Goede [Mon, 3 Sep 2012 11:44:04 +0000 (13:44 +0200)]
usb-redir: Enable pipelining for bulk endpoints

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
11 years agousb-redir: Ensure our peer has the necessary caps when redirecting to XHCI
Hans de Goede [Mon, 3 Sep 2012 10:04:49 +0000 (12:04 +0200)]
usb-redir: Ensure our peer has the necessary caps when redirecting to XHCI

In order for redirection to work properly when redirecting to an emulated
XHCI controller, the usb-redir-host must support both
usb_redir_cap_ep_info_max_packet_size and usb_redir_cap_64bits_ids,
reject any devices redirected to an XHCI controller when these are not
supported.

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
11 years agousb-redir: Add a usbredir_reject_device helper function
Hans de Goede [Mon, 3 Sep 2012 09:53:28 +0000 (11:53 +0200)]
usb-redir: Add a usbredir_reject_device helper function

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
11 years agousb-redir: Set ep max_packet_size if available
Hans de Goede [Mon, 3 Sep 2012 09:49:07 +0000 (11:49 +0200)]
usb-redir: Set ep max_packet_size if available

This is needed for usb-redir to work properly with the xhci emulation.

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
11 years agousb-redir: Convert to new libusbredirparser 0.5 API
Hans de Goede [Fri, 31 Aug 2012 11:41:38 +0000 (13:41 +0200)]
usb-redir: Convert to new libusbredirparser 0.5 API

This gives us support for 64 bit ids which is needed for using XHCI with
the new hcd generated ids.

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
11 years agousb-redir: Return babble when getting more bulk data then requested
Hans de Goede [Tue, 28 Aug 2012 09:33:47 +0000 (11:33 +0200)]
usb-redir: Return babble when getting more bulk data then requested

Babble is the appropriate error in this case (rather then signalling a stall).

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
11 years agousb-redir: Move to core packet id and queue handling
Hans de Goede [Tue, 28 Aug 2012 09:30:13 +0000 (11:30 +0200)]
usb-redir: Move to core packet id and queue handling

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
11 years agousb-redir: Get rid of unused async-struct dev member
Hans de Goede [Tue, 28 Aug 2012 07:08:45 +0000 (09:08 +0200)]
usb-redir: Get rid of unused async-struct dev member

This is a preparation patch for completely getting rid of the async-packet
struct in usb-redir, instead relying on the (new) per ep queues in the
qemu usb core.

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
11 years agousb-redir: Get rid of local shadow copy of packet headers
Hans de Goede [Tue, 28 Aug 2012 07:05:38 +0000 (09:05 +0200)]
usb-redir: Get rid of local shadow copy of packet headers

The shadow copy only serves as an extra check (besides the packet-id) to
ensure the packet we get back is a reply to the packet we think it is.

This check has never triggered in all the time usb-redir is in use now,
and since the verified data in the returned packet-header is not used
otherwise, removing the check does not open any possibilities for the
usbredirhost to confuse us.

This is a preparation patch for completely getting rid of the async-packet
struct in usb-redir, instead relying on the (new) per ep queues in the
qemu usb core.

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
11 years agousb-redir: Get rid of async-struct get member
Hans de Goede [Mon, 27 Aug 2012 14:33:08 +0000 (16:33 +0200)]
usb-redir: Get rid of async-struct get member

This is a preparation patch for completely getting rid of the async-packet
struct in usb-redir, instead relying on the (new) per ep queues in the
qemu usb core.

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
11 years agousb-redir: Don't delay handling of open events to a bottom half
Hans de Goede [Thu, 23 Aug 2012 14:37:19 +0000 (16:37 +0200)]
usb-redir: Don't delay handling of open events to a bottom half

There is no need for this, and doing so means that a backend trying to
write immediately after an open event will see qemu_chr_be_can_write
returning 0, which not all backends handle well as there is no wakeup
mechanism to detect when the frontend does become writable.

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
11 years agousb-redir: Never return USB_RET_NAK for async handled packets
Hans de Goede [Fri, 17 Aug 2012 15:27:08 +0000 (17:27 +0200)]
usb-redir: Never return USB_RET_NAK for async handled packets

USB_RET_NAK is not a valid response for async handled packets (and will
trigger an assert as such).

Also drop the warning when receiving a status of cancelled for packets not
cancelled by qemu itself, this can happen when a device gets unredirected
by the usbredir-host while transfers are pending.

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
11 years agoehci: Correct a comment in fetchqtd packet processing
Hans de Goede [Mon, 3 Sep 2012 10:17:48 +0000 (12:17 +0200)]
ehci: Correct a comment in fetchqtd packet processing

Since my previous comment said "Should never happen", I tried changing the
next line to an assert(0), which did not go well, which as the new comments
explains is logical if you think about it for a moment.

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
11 years agoehci: Handle USB_RET_PROCERR in ehci_fill_queue
Hans de Goede [Mon, 3 Sep 2012 09:35:58 +0000 (11:35 +0200)]
ehci: Handle USB_RET_PROCERR in ehci_fill_queue

USB_RET_PROCERR can be triggered by the guest (by for example requesting more
then BUFFSIZE bytes), so don't assert on it.

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
11 years agoehci: Fix memory leak in handling of NAK-ed packets
Hans de Goede [Mon, 3 Sep 2012 09:01:13 +0000 (11:01 +0200)]
ehci: Fix memory leak in handling of NAK-ed packets

Currently each time we try to execute a NAK-ed packet we redo
ehci_init_transfer, and usb_packet_map, re-allocing (without freeing) the
sg list every time.

This patch fixes this, it does this by introducing another async state, so
that we also properly cleanup a NAK-ed packet on cancel.

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
11 years agoehci: Add some additional ehci_trace_guest_bug() calls
Hans de Goede [Mon, 3 Sep 2012 08:22:16 +0000 (10:22 +0200)]
ehci: Add some additional ehci_trace_guest_bug() calls

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
11 years agoehci: add doorbell trace events
Gerd Hoffmann [Fri, 31 Aug 2012 10:41:43 +0000 (12:41 +0200)]
ehci: add doorbell trace events

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
11 years agoehci: trace guest bugs
Gerd Hoffmann [Fri, 31 Aug 2012 08:44:21 +0000 (10:44 +0200)]
ehci: trace guest bugs

make qemu_queue_{cancel,reset} return the number of packets released,
so the caller can figure whenever there have been active packets even
though there shouldn't have been any.  Add tracepoint to log this.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
11 years agoehci: check for EHCI_ASYNC_FINISHED first in ehci_free_packet
Gerd Hoffmann [Fri, 31 Aug 2012 08:31:54 +0000 (10:31 +0200)]
ehci: check for EHCI_ASYNC_FINISHED first in ehci_free_packet

Otherwise we'll see the packet free twice in the trace log even though
it actually happens only once.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
11 years agoehci: Properly report completed but not yet processed packets to the guest
Hans de Goede [Thu, 30 Aug 2012 13:18:24 +0000 (15:18 +0200)]
ehci: Properly report completed but not yet processed packets to the guest

Reported packets which have completed before being cancelled as such to the
host. Note that the new code path this patch adds is untested since it I've
been unable to actually trigger the race which needs this code path.

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
11 years agoehci: Properly cleanup packets on cancel
Hans de Goede [Thu, 30 Aug 2012 13:00:33 +0000 (15:00 +0200)]
ehci: Properly cleanup packets on cancel

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
11 years agoehci: Update copyright headers to reflect recent work
Hans de Goede [Tue, 28 Aug 2012 14:21:12 +0000 (16:21 +0200)]
ehci: Update copyright headers to reflect recent work

Update copyright headers to reflect all the work Gerd and I have been doing
on the EHCI emulation.

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
11 years agoehci: Validate qh is not changed unexpectedly by the guest
Hans de Goede [Wed, 29 Aug 2012 08:37:37 +0000 (10:37 +0200)]
ehci: Validate qh is not changed unexpectedly by the guest

-combine the qh check with the check for devaddr changes
-also ensure that p gets set to NULL when the queue gets cancelled on
 devaddr change, which was not done properly before this patch

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
11 years agoRevert "ehci: don't flush cache on doorbell rings."
Hans de Goede [Wed, 29 Aug 2012 08:12:52 +0000 (10:12 +0200)]
Revert "ehci: don't flush cache on doorbell rings."

This reverts commit 9bc3a3a216e2689bfcdd36c3e079333bbdbf3ba0, which got
added to fix an issue where the real, underlying cause was not stopping
the ep queue on an error.

Now that the underlying cause is fixed by the "usb: Halt ep queue and
cancel pending packets on a packet error" patch, the "don't flush" fix
is no longer needed.

Not only is it not needed, it causes us to see cancellations (unlinks)
done by the Linux EHCI driver too late, which in combination with the new
usb-core packet-id generation where qtd addresses are used as ids, causes
duplicate ids for in flight packets.

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
11 years agousb-core: Allow the first packet of a pipelined ep to complete immediately
Hans de Goede [Mon, 3 Sep 2012 10:48:49 +0000 (12:48 +0200)]
usb-core: Allow the first packet of a pipelined ep to complete immediately

This can happen with usb-redir live-migration when the packet gets re-queued
after the migration and the original queuing from the migration source side
has already finished.

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
11 years agousb-core: Add a usb_ep_find_packet_by_id() helper function
Hans de Goede [Tue, 28 Aug 2012 07:43:18 +0000 (09:43 +0200)]
usb-core: Add a usb_ep_find_packet_by_id() helper function

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
11 years agousb-core: Don't set packet state to complete on a nak
Hans de Goede [Mon, 3 Sep 2012 10:33:44 +0000 (12:33 +0200)]
usb-core: Don't set packet state to complete on a nak

This way the hcd can re-use the same packet to retry without needing
to re-init it.

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
11 years agousb: controllers do not need to check for babble themselves
Hans de Goede [Fri, 17 Aug 2012 09:39:16 +0000 (11:39 +0200)]
usb: controllers do not need to check for babble themselves

If an (emulated) usb-device tries to write more data to a packet then
its iov len, this will trigger an assert in usb_packet_copy(), and if
a driver somehow circumvents that check and writes more data to the
iov then there is space, we have a much bigger problem then not correctly
reporting babble to the guest.

In practice babble will only happen with (real) redirected devices, and there
both the usb-host os and the qemu usb-device code already check for it.

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
11 years agoAdd ability to force enable/disable of tools build
Daniel P. Berrange [Mon, 10 Sep 2012 11:26:29 +0000 (12:26 +0100)]
Add ability to force enable/disable of tools build

The qemu-img, qemu-nbd and qemu-io tools are built conditionally
based on whether any softmmu target is enabled. These are useful
self-contained tools which can be used in many other scenarios.
Add new --enable-tools/--disable-tools args to configure to allow
the user to explicitly turn on / off their build. The default
behaviour is now to build these tools are all times, regardless
of whether any softmmu target is enabled

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
11 years agoAdd ability to disable build of all targets
Daniel P. Berrange [Mon, 10 Sep 2012 11:27:21 +0000 (12:27 +0100)]
Add ability to disable build of all targets

Allow passing of '--target-list=' to configure to request that
all targets are to be disabled. This allows for doing a very
fast tools-only build of things like qemu-img, qemu-io, qemu-nbd.

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
11 years agoRTC: Remove the current_tm field
Paolo Bonzini [Thu, 2 Aug 2012 16:04:13 +0000 (18:04 +0200)]
RTC: Remove the current_tm field

This is not used anymore and only written to.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
11 years agoRTC: Get and set time without going through s->current_tm
Paolo Bonzini [Thu, 2 Aug 2012 16:04:12 +0000 (18:04 +0200)]
RTC: Get and set time without going through s->current_tm

This patch makes rtc_set_time and rtc_set_cmos work without reading
s->current_tm.  In the case of rtc_set_time I introduce a new
function that retrieves the time and stores into a given struct tm
(not hard-coded to s->current_tm).  In the case of rtc_set_cmos, the
current time is similarly taken from a struct tm rather than
s->current_tm.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
11 years agoRTC: Do not fire timer periodically to catch next alarm
Paolo Bonzini [Thu, 2 Aug 2012 16:04:11 +0000 (18:04 +0200)]
RTC: Do not fire timer periodically to catch next alarm

This patch limits further the usage of a periodic timer.  It computes the
time of the next alarm, and uses it to skip all intermediate occurrences
of the timer.

Cc: Yang Zhang <yang.z.zhang@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
11 years agoRTC: Add divider reset support
Yang Zhang [Thu, 2 Aug 2012 16:04:10 +0000 (18:04 +0200)]
RTC: Add divider reset support

The first update cycle begins one-half seconds after divider
reset is removed.  This feature is useful for testing.

Signed-off-by: Yang Zhang <yang.z.zhang@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
11 years agoRTC: Update the RTC clock only when reading it
Yang Zhang [Thu, 2 Aug 2012 16:04:09 +0000 (18:04 +0200)]
RTC: Update the RTC clock only when reading it

Calculate guest RTC based on the time of the last update, instead of
using timers.  The formula is

    (base_rtc + guest_time_now - guest_time_last_update + offset)

Base_rtc is the RTC value when the RTC was last updated.
Guest_time_now is the guest time when the access happens.
Guest_time_last_update was the guest time when the RTC was last updated.
Offset is used when divider reset happens or the set bit is toggled.

The timer is kept in order to signal interrupts, but it only needs to
run when either UF or AF is cleared.  When the bits are both set, the
timer does not run.

UIP is now synthesized when reading register A.  If the timer is not set,
or if there is more than one second before it (as is the case at the
end of this series), the leading edge of UIP is computed and the rising
edge occurs 220us later.  If the update timer occurs within one second,
however, the rising edge of the AF and UF bits should coincide withe
the falling edge of UIP.  We do not know exactly when this will happen
because there could be delays in the servicing of the timer.  Hence, in
this case reading register A only computes for the rising edge of UIP,
and latches the bit until the timer is fired and clears it.

Signed-off-by: Yang Zhang <yang.z.zhang@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
11 years agovmstate: add VMSTATE_TIMER_V
Paolo Bonzini [Thu, 2 Aug 2012 16:04:08 +0000 (18:04 +0200)]
vmstate: add VMSTATE_TIMER_V

Also, for consistency with other occurrences, implement VMSTATE_TIMER
as a special case of VMSTATE_TIMER_V rather than VMSTATE_TIMER_TEST.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
11 years agoRTC: Update interrupt state when interrupts are masked/unmasked
Yang Zhang [Thu, 2 Aug 2012 16:04:07 +0000 (18:04 +0200)]
RTC: Update interrupt state when interrupts are masked/unmasked

If an interrupt flag is already set when the interrupt becomes enabled,
raise an interrupt immediately, and vice versa if interrupts become
disabled.

Signed-off-by: Yang Zhang <yang.z.zhang@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
11 years agoRTC: introduce RTC_CLOCK_RATE
Paolo Bonzini [Thu, 2 Aug 2012 16:04:06 +0000 (18:04 +0200)]
RTC: introduce RTC_CLOCK_RATE

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
11 years agoRTC: Rename rtc_timer_update
Yang Zhang [Thu, 2 Aug 2012 16:04:05 +0000 (18:04 +0200)]
RTC: Rename rtc_timer_update

Signed-off-by: Yang Zhang <yang.z.zhang@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
11 years agoRTC: Remove the logic to update time format when DM bit changed
Yang Zhang [Thu, 2 Aug 2012 16:04:04 +0000 (18:04 +0200)]
RTC: Remove the logic to update time format when DM bit changed

Changing the DM (binary/BCD) and 24/12 control bit doesn't affect the internal
registers. It only indicates what format is used for those registers.

Signed-off-by: Yang Zhang <yang.z.zhang@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
11 years agoMerge remote-tracking branch 'qemu-kvm/uq/master' into staging
Anthony Liguori [Mon, 10 Sep 2012 17:51:44 +0000 (12:51 -0500)]
Merge remote-tracking branch 'qemu-kvm/uq/master' into staging

* qemu-kvm/uq/master:
  kvm: i386: Add classic PCI device assignment
  kvm: i386: Add services required for PCI device assignment
  kvm: Introduce kvm_has_intx_set_mask
  kvm: Introduce kvm_irqchip_update_msi_route
  kvm: Clean up irqfd API
  qemu: Use valgrind annotations to mark kvm guest memory as defined

11 years agoMerge remote-tracking branch 'mst/tags/for_anthony' into staging
Anthony Liguori [Mon, 10 Sep 2012 17:48:43 +0000 (12:48 -0500)]
Merge remote-tracking branch 'mst/tags/for_anthony' into staging

* mst/tags/for_anthony:
  vhost: Pass device path to vhost_dev_init()
  monitor: Rename+move net_handle_fd_param -> monitor_handle_fd_param
  pcie_aer: clear cmask for Advanced Error Interrupt Message Number
  pcie: drop version_id field for live migration
  qemu: add .exrc

11 years agosocket: don't attempt to reconnect a TCP socket in server mode
Anthony Liguori [Wed, 5 Sep 2012 18:52:49 +0000 (13:52 -0500)]
socket: don't attempt to reconnect a TCP socket in server mode

Commit c3767ed0eb5d0bb25fe409ae5dec06e3411ff1b6 introduced a possible SEGV when
using a socket chardev with server=on because it assumes that all TCP sockets
are in client mode.

This patch adds a check to only reconnect when in client mode.

Cc: Lei Li <lilei@linux.vnet.ibm.com>
Reported-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
11 years agouse --libexecdir instead of ignoring it first and reinventing it later
Michael Tokarev [Wed, 6 Jun 2012 21:11:00 +0000 (01:11 +0400)]
use --libexecdir instead of ignoring it first and reinventing it later

Commit 7b93fadf3a38d1ed65ea5536a52efc2772c6e3b8 "Add basic version
of bridge helper" put the bridge helper executable into a fixed
${prefix}/libexec/ location, instead of using ${libexecdir} for
this.  At the same time, --libexecdir is being happily ignored
by ./configure.  Even more, the same patch sets unused $libexecdir
variable in the generated config-host.mak, and uses fixed string
(\${prefix}/libexecdir) for the bridge helper binary.

Fix this braindamage by introducing $libexecdir variable, using
it for the bridge helper binary, and recognizing --libexecdir.

This patch is applicable to stable-1.1.

Reviewed-by: Andreas Färber <afaerber@suse.de>
Reviewed-by: Corey Bryant <coreyb@linux.vnet.ibm.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Cc: Corey Bryant <coreyb@linux.vnet.ibm.com>
Cc: Richa Marwaha <rmarwah@linux.vnet.ibm.com>
Cc: qemu-stable@nongnu.org
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
11 years agoMerge branch 'spice.v59' of git://anongit.freedesktop.org/spice/qemu
Aurelien Jarno [Mon, 10 Sep 2012 13:32:11 +0000 (15:32 +0200)]
Merge branch 'spice.v59' of git://anongit.freedesktop.org/spice/qemu

* 'spice.v59' of git://anongit.freedesktop.org/spice/qemu:
  Remove #ifdef QXL_COMMAND_FLAG_COMPAT_16BPP
  qxl: Add set_client_capabilities() interface to QXLInterface
  spice: make number of surfaces runtime-configurable.
  configure: print spice-protocol and spice-server versions
  qxl: add QXL_IO_MONITORS_CONFIG_ASYNC
  qxl: disallow unknown revisions
  qxl/update_area_io: guest_bug on invalid parameters
  spice: increase the verbosity of spice section in "qemu --help"
  spice: adding seamless-migration option to the command line
  spice: add 'migrated' flag to spice info
  spice migration: add QEVENT_SPICE_MIGRATE_COMPLETED
  spice: notify on vm state change only via spice_server_vm_start/stop
  spice: notify spice server on vm start/stop
  spice: abort on invalid streaming cmdline params

11 years agoMerge branch 'queue/qmp' of git://repo.or.cz/qemu/qmp-unstable
Aurelien Jarno [Mon, 10 Sep 2012 13:04:36 +0000 (15:04 +0200)]
Merge branch 'queue/qmp' of git://repo.or.cz/qemu/qmp-unstable

* 'queue/qmp' of git://repo.or.cz/qemu/qmp-unstable:
  tcx: tcx_screen_dump(): add error handling
  tcx: tcx24_screen_dump(): add error handling
  g364fb: g364fb_screen_dump(): add error handling
  omap_lcdc: omap_ppm_save(): add error handling
  omap_lcdc: rename ppm_save() to omap_ppm_save()
  vga: ppm_save(): add error handling
  qapi: convert screendump
  console: vga_hw_screen_dump_ptr: take Error argument
  error: add error_setg()
  json-parser: Fix potential NULL pointer segfault
  qapi: Fix potential NULL pointer segfault
  qapi: convert sendkey
  monitor: move key_defs[] table and introduce two help functions
  qapi: add the QKeyCode enum
  qapi: generate list struct and visit_list for enum
  hmp: rename arguments
  monitor: rename keyname '<' to 'less'
  fix doc of using raw values with sendkey
  Add support for pretty-printing response in qmp-shell