Signed-off-by: NJason Wang <jasowang@redhat.com>
Acked-by: NMichael S. Tsirkin <mst@redhat.com>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>
(cherry picked from commit 96c94b29)

Update not only dbc but also dnad when skipping bytes during the MSGOUT
phase.  Previously only dbc was updated which is probably wrong and
could lead to bogus message codes being read.

Tested on Linux and Windows Server 2003.
Signed-off-by: NStefan Hajnoczi <stefanha@linux.vnet.ibm.com>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>
(cherry picked from commit 444dd39b)

Revert "prep: Disable second IDE channel, as long as ISA IDE emulation doesn't support same irq for both channels"

This reverts commit 491e2a33.
(cherry picked from commit 81aa0647)

Nothing prevented IRQ sharing on the ISA bus in principle. Not all
boards supported this, neither each and every card nor driver and OS.
Still, there existed valid IRQ sharing scenarios, (at least) two of them
can also be found in QEMU: >2 PC UARTs and the PREP IDE buses.

So remove this artificial restriction from our ISA model.
Signed-off-by: NJan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>
(cherry picked from commit ee951a37)

A pointer to a size_t variable was passed as the void * pointer to
lduw_p() in virtio_net_receive().  Instead of acting on the 16-bit value
this caused failure on big-endian hosts.

Avoid this issue in the future by using stw_p() instead.  In general we
should use ld*_p() for loading from target memory and st*_p() for
storing to target memory anyway, not the other way around.

Also tighten up a correct use of lduw_p() when stw_p() should be used
instead in virtio_net_get_config().
Signed-off-by: NStefan Hajnoczi <stefanha@linux.vnet.ibm.com>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>
(cherry picked from commit b46d97f2)

The SD_STATUS and SEND_NUM_WR_BLOCKS commands are supposed to cause
the card to send data back to the host. However sd.c was missing the
state change to sd_sendingdata_state for these commands, with the effect
that the Linux driver would either hang indefinitely waiting for
nonexistent data (pl181) or read zeroes and provoke a qemu warning
message (omap).
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

Reverse mode is unusable:

	qemu -vnc localhost:5500,reverse

crashes in vnc_refresh_server_surface because some pointers are NULL.

Fix this by calling vnc_dpy_resize (which initializes these pointers)
before calling vnc_refresh.

Cc: Anthony Liguori <aliguori@us.ibm.com>
Signed-off-by: NStefan Weil <weil@mail.berlios.de>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Check if the backend option is missing before searching the backend
table.  This fixes a NULL pointer dereference when QEMU is invoked with
the following invalid command-line:

  $ qemu -chardev id=foo,path=/tmp/socket

Previously QEMU would segfault, now it produces this error message:

  chardev: "foo" missing backend
Signed-off-by: NStefan Hajnoczi <stefanha@linux.vnet.ibm.com>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

I unfortunately got on an unnamed branch and pushed the wrong bits
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Since the addition of the slirp member to struct mbuf, the value of
SLIRP_MSIZE and the initialization of m_size have not been correct,
resulting in overrunning the end of the malloc'd buffer in some cases.
Signed-off-by: NBruce Rogers <brogers@novell.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

TPR blocks all interrupts in a priority class, so simple "less or
equal" check is not enough.
Signed-off-by: NGleb Natapov <gleb@redhat.com>
Reviewed-by: NJan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

When copying L2 tables (this happens only with internal snapshots), the order
wasn't completely safe, so that after a crash you could end up with a L2 table
that has too low refcount, possibly leading to corruption in the long run.

This patch puts the operations in the right order: First allocate the new
L2 table and replace the reference, and only then decrease the refcount of the
old table.
Signed-off-by: NKevin Wolf <kwolf@redhat.com>
(cherry picked from commit 16fde5f2)

Output the error message string of the bdrv_open return code. Also set a
non-empty device name for the images because the unknown feature error message
includes it.
Signed-off-by: NKevin Wolf <kwolf@redhat.com>
Reviewed-by: NAnthony Liguori <aliguori@us.ibm.com>
(cherry picked from commit b9eaf9ec)

Instead of just returning -ENOTSUP, generate a more detailed error.

Unfortunately we don't have a helpful text for features that we don't know yet,
so just print the feature mask. It might be useful at least if someone asks for
help.
Signed-off-by: NKevin Wolf <kwolf@redhat.com>
Reviewed-by: NAnthony Liguori <aliguori@us.ibm.com>
Acked-by: NStefan Hajnoczi <stefanha@linux.vnet.ibm.com>
(cherry picked from commit 10b758e8)

The qcow2 driver is now declared responsible for any QCOW image that has
version 2 or greater (before this, version 3 would be detected as raw).

For everything newer than version 2, an error is reported.
Signed-off-by: NKevin Wolf <kwolf@redhat.com>
Reviewed-by: NAnthony Liguori <aliguori@us.ibm.com>
(cherry picked from commit e8cdcec1)

Signed-off-by: NKevin Wolf <kwolf@redhat.com>
Reviewed-by: NAnthony Liguori <aliguori@us.ibm.com>
(cherry picked from commit f54e3641)

When reading a compressed cluster failed, qcow2 falsely returned success.
Signed-off-by: NKevin Wolf <kwolf@redhat.com>
Reviewed-by: NMarkus Armbruster <armbru@redhat.com>
(cherry picked from commit 8af36488)

Requests could return success even though they failed when bdrv_aio_readv
returned NULL for a backing file read.
Reported-by: NChunqiang Tang <ctang@us.ibm.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>
(cherry picked from commit 3ab4c7e9)

This patch fixes the following bug in QCOW2. For a QCOW2 image that is larger
than its base image, when handling a read request straddling over the end of the
base image, the QCOW2 driver attempts to read beyond the end of the base image
and the request would fail.

This bug was found by Fast Virtual Disk (FVD)'s fully automated testing tool.
The following test triggered the bug.

dd if=/dev/zero of=/var/ramdisk/truth.raw count=0 bs=1 seek=1098561536
dd if=/dev/zero of=/var/ramdisk/zero-500M.raw count=0 bs=1 seek=593099264
./qemu-img create -f qcow2 -ocluster_size=65536,backing_fmt=blksim -b /var/ramdisk/zero-500M.raw /var/ramdisk/test.qcow2 1098561536
./qemu-io --auto --seed=30477694 --truth=/var/ramdisk/truth.raw --format=qcow2 --test=blksim:/var/ramdisk/test.qcow2 --verify_write=true --compare_before=false --compare_after=true --round=100000 --parallel=100 --io_size=10485760 --fail_prob=0 --cancel_prob=0 --instant_qemubh=true
Signed-off-by: NChunqiang Tang <ctang@us.ibm.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>
(cherry picked from commit e0d9c6f9)

Pointed out by Markus
Signed-off-by: NJes Sorensen <Jes.Sorensen@redhat.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>
(cherry picked from commit 982aa955)

Extract from "man realloc":
"If realloc() fails the original block is left untouched;
it is not freed or moved."

Fix a possible memory leak (reported by cppcheck).

Cc: Riku Voipio <riku.voipio@iki.fi>
Signed-off-by: NStefan Weil <weil@mail.berlios.de>
Signed-off-by: NRiku Voipio <riku.voipio@nokia.com>
(cherry picked from commit 8d79de6e)

Extract from "man realloc":
"If realloc() fails the original block is left untouched;
it is not freed or moved."

Fix a possible memory leak (reported by cppcheck).

Cc: Riku Voipio <riku.voipio@iki.fi>
Signed-off-by: NStefan Weil <weil@mail.berlios.de>
Signed-off-by: NRiku Voipio <riku.voipio@nokia.com>

In case a chrooted build uses XEN or KVM, a looped mount needs to be done to setup the chroot.
The ioctl for loop mount works correctly for arm, mips, ppc32 and sh4, so its now activated.
Signed-off-by: NRiku Voipio <riku.voipio@nokia.com>

Should have spotted this when doing commit 319ae529.
Signed-off-by: NMarkus Armbruster <armbru@redhat.com>

Started leaking in commit 1dae12e6.
Signed-off-by: NMarkus Armbruster <armbru@redhat.com>

When broadcasting MCEs, we need to set MCIP and RIPV in mcg_status like
it is done for KVM. Use the symbolic constants at this chance.
Signed-off-by: NJan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: NMarcelo Tosatti <mtosatti@redhat.com>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>
(cherry picked from commit 29057492)

qemu_next_alarm_deadline() is needed by MinGW, too.

Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Anthony Liguori <aliguori@us.ibm.com>
Acked-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NStefan Weil <weil@mail.berlios.de>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>
(cherry picked from commit f26e5a54)

Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Set block device in use during block migration, disallow drive_del and
bdrv_truncate for in use devices.
Signed-off-by: NMarcelo Tosatti <mtosatti@redhat.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>
(cherry picked from commit 8591675f)

Certain operations such as drive_del or resize cannot be performed
while external users (eg. block migration) reference the block device.

Add a flag to indicate that.
Signed-off-by: NMarcelo Tosatti <mtosatti@redhat.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>
(cherry picked from commit db593f25)

So that ejection of attached device by guest does not free data
in use by block migration instance.
Signed-off-by: NMarcelo Tosatti <mtosatti@redhat.com>
CC: Markus Armbruster <armbru@redhat.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>
(cherry picked from commit f48905d4)

The host part of a block device can be deleted with in progress
block migration.

To fix this, add a reference count to DriveInfo, freeing resources
on last reference.
Signed-off-by: NMarcelo Tosatti <mtosatti@redhat.com>
CC: Markus Armbruster <armbru@redhat.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>
(cherry picked from commit 84fb3925)

Call to set_dirty_tracking() is misplaced.
Signed-off-by: NMarcelo Tosatti <mtosatti@redhat.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>
(cherry picked from commit 8f794c55)

Different AHCI controllers have a different number of ports, so the core
shouldn't care about the amount of ports available.

This patch makes the number of ports available to the AHCI core runtime
configurable, allowing us to have multiple different AHCI implementations
with different amounts of ports.
Signed-off-by: NAlexander Graf <agraf@suse.de>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>
(cherry picked from commit 2c4b9d0e)

The ahci code was missing its soft reset functionality. This wasn't really an
issue for Linux guests, but Windows gets confused when the controller doesn't
reset when it tells it so.

Using this patch I can now successfully boot Windows 7 from AHCI using AHCI
enabled SeaBIOS.
Signed-off-by: NAlexander Graf <agraf@suse.de>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>
(cherry picked from commit 760c3e44)

The drive sends a d2h init fis on initialization. Usually, the guest doesn't
receive fises yet at that point though, so the delivery is deferred.

Let's reflect that by sending the init fis on fis receive enablement.
Signed-off-by: NAlexander Graf <agraf@suse.de>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>
(cherry picked from commit 87e62065)