Signed-off-by: NMarkus Armbruster <armbru@redhat.com>
Reviewed-by: NLaszlo Ersek <lersek@redhat.com>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

read_splashfile() passes the address of an int variable as size_t *
parameter to g_file_get_contents(), with a cast to gag the compiler.

No problem on machines where sizeof(size_t) == sizeof(int).

Happens to work on my x86_64 box (64 bit little endian): the least
significant 32 bits of the file size end up in the right place
(caller's variable file_size), and the most significant 32 bits
clobber a place that gets assigned to before its next use (caller's
variable file_type).

I'd expect it to break on a 64 bit big-endian box.

Fix up the variable types and drop the problematic cast.
Signed-off-by: NMarkus Armbruster <armbru@redhat.com>
Reviewed-by: NLaszlo Ersek <lersek@redhat.com>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

Honour float_muladd_negate_c in the case where the product is zero and
c is nonzero.  Previously we would fail to negate c.

Seen in (and tested against) the gfortran testsuite on MIPS.
Signed-off-by: NRichard Sandiford <rdsandiford@googlemail.com>
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

Explicitly mark the fallthroughs as intentional in the code
pattern where we gradually increment an index before falling
into the code to read/write that array entry:
    case THINGY_3: idx++;
    case THINGY_2: idx++;
    case THINGY_1: idx++;
    case THINGY_0: return s->thingy[idx];

This makes static analysers happy.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

Add an explicit 'return' statement to a case in smc91c111_readb
rather than relying on fallthrough to the following case's
return statement, for code clarity and to placate static analysers.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

Mark the deliberate fallthrough where we treat the case of
an attempt to read flash when it is an unknown command
state as if it were a normal read.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

Explicitly mark the fallthroughs as intentional in the code
pattern where we gradually increment an index before falling
into the code to read/write that array entry:
  case THINGY_3: idx++;
  case THINGY_2: idx++;
  case THINGY_1: idx++;
  case THINGY_0: return s->thingy[idx];

This makes static analysers happy.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

Explicitly mark cases where we are deliberately falling
through to the following code. In one case we insert a
'break' instead of falling through to a 'break', as this
seems slightly clearer.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

Add some break statements that were accidentally omitted
from some cases of arm_sysctl_write(). The omission was
harmless because in both cases the following case did
an immediate break, but adding the breaks explicitly
placates static analysers and avoids weird behaviour if
the following register is ever implemented as something
other than a no-op.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

Now, if seccomp is detected, it is linked into every executable,
but is used only by softmmu targets (from vl.c).  So link it
only where it is actually needed.
Signed-off-by: NMichael Tokarev <mjt@tls.msk.ru>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

Rename qemu_vmalloc() to bsd_vmalloc(), adjust the only user.

Remove #ifdeffery in oslib-posix.c.
Tested-by: NAndreas Färber <andreas.faerber@web.de>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

extra-obj-y is somewhat complicated to understand.  Replace it with a
special CONFIG_ALL symbol that is defined only at toplevel.
This limits the case of directories defining more than one
*-obj-y target.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

All of universal-obj-y, user-obj-y (right now unused) and common-obj-y can
be unified into common-obj-y if we take care of defining CONFIG_SOFTMMU
and CONFIG_USER_ONLY in the toplevel makefile.  This is similar to how
we define symbols for hardware components.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Acked-by: NAndreas Färber <afaerber@suse.de>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

It is also needed if !CONFIG_SOFTMMU, unlike everything that surrounds it.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

I had missed the introduction of the gcov-files-* variables.

Cc: Blue Swirl <blauwirbel@gmail.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

# By Paolo Bonzini (1) and Peter Lieven (1)
# Via Paolo Bonzini
* bonzini/scsi-next:
  iscsi: add support for iovectors
  iscsi: do not leak acb->buf when commands are aborted

This reverts commit 67c5322d:

    I'm not sure if the retry logic has ever worked when not using FIFO mode.  I
    found this while writing a test case although code inspection confirms it is
    definitely broken.

    The TSR retry logic will never actually happen because it is guarded by an
    'if (s->tsr_rety > 0)' but this is the only place that can ever make the
    variable greater than zero.  That effectively makes the retry logic an 'if (0)

    I believe this is a typo and the intention was >= 0.  Once this is fixed thoug
    I see double transmits with my test case.  This is because in the non FIFO
    case, serial_xmit may get invoked while LSR.THRE is still high because the
    character was processed but the retransmit timer was still active.

    We can handle this by simply checking for LSR.THRE and returning early.  It's
    possible that the FIFO paths also need some attention.

    Cc: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Even if the previous logic was never worked, new logic breaks stuff -
namely,

 qemu -enable-kvm -nographic -kernel /boot/vmlinuz-$(uname -r) -append console=ttyS0 -serial pty

the above command will cause the virtual machine to stuck at startup
using 100% CPU till one connects to the pty and sends any char to it.

Note this is rather typical invocation for various headless virtual
machines by libvirt.

So revert this change for now, till a better solution will be found.
Signed-off-by: NMichael Tokarev <mjt@tls.msk.ru>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

This patch adds support for directly passing the iovec
array from QEMUIOVector if libiscsi supports it (1.8.0
or newer).
Signed-off-by: NPeter Lieven <pl@kamp.de>
[Preserve the improvements from commit 4cc841b5, iscsi: partly
 avoid iovec linearization in iscsi_aio_writev, 2012-11-19 - Paolo]
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

acb->buf is freed in the WRITE(16) callback, but this may not
get called at all when commands are aborted.  Add another
free in the ABORT TASK callback, which requires setting acb->buf
to NULL everywhere.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

It's __VA_ARGS__. Fixes the build with CRIS_[OP_]HELPER_DEBUG defined.

Broken since r6338 / 93fcfe39 (Convert
references to logfile/loglevel to use qemu_log*() macros).

Cc: Eduardo Habkost <ehabkost@redhat.com>
Signed-off-by: NAndreas Färber <afaerber@suse.de>
Signed-off-by: NEdgar E. Iglesias <edgar.iglesias@gmail.com>

This is a trivial patch to harmonize the coding style on
hw/etraxfs_eth.c. This is in preparation to split off the bitbang mdio
code into a separate file.

Cc: Peter Maydell <peter.maydell@linaro.org>
Cc: Paul Brook <paul@codesourcery.com>
Cc: Edgar E. Iglesias <edgar.iglesias@gmail.com>
Cc: Anthony Liguori <aliguori@us.ibm.com>
Cc: Andreas Färber <afaerber@suse.de>
Signed-off-by: NGrant Likely <grant.likely@secretlab.ca>
Signed-off-by: NEdgar E. Iglesias <edgar.iglesias@gmail.com>

# By Peter Lieven (3) and others
# Via Paolo Bonzini
* bonzini/scsi-next:
  scsi: Drop useless null test in scsi_unit_attention()
  lsi: use qbus_reset_all to reset SCSI bus
  scsi: fix segfault with 0-byte disk
  iscsi: add support for iSCSI NOPs [v2]
  iscsi: partly avoid iovec linearization in iscsi_aio_writev
  iscsi: add iscsi_create support

# By Gerd Hoffmann
# Via Gerd Hoffmann
* kraxel/usb.77:
  usb: add usb-bot device (scsi bulk-only transport).
  ohci: add missing break
  Revert "usb-storage: Drop useless null test in usb_msd_handle_data()"

# By Alon Levy
# Via Gerd Hoffmann
* spice/spice.v68:
  qxl: change rom size to 8192
  qxl: stop using non revision 4 rom fields for revision < 4

req was created by scsi_req_alloc(), which initializes req->dev to a
value it dereferences.  req->dev isn't changed anywhere else.
Therefore, req->dev can't be null.

Drop the useless null test; it spooks Coverity.
Signed-off-by: NMarkus Armbruster <armbru@redhat.com>

Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

When a 0-sized disk is found, READ CAPACITY will return a
LUN NOT READY error.  However, because it returns -1 instead
of zero, the HBA will call scsi_req_continue.  This will
typically cause a segmentation fault or an assertion failure.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

This patch will send NOP-Out PDUs every 5 seconds to the iSCSI target.
If a consecutive number of NOP-In replies fail a reconnect is initiated.
iSCSI NOPs help to ensure that the connection to the target is still operational.
This should not, but in reality may be the case even if the TCP connection is still
alive if there are bugs in either the target or the initiator implementation.

v2:
 - track the NOPs inside libiscsi so libiscsi can reset the counter
   in case it initiates a reconnect.
Signed-off-by: NPeter Lieven <pl@kamp.de>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

libiscsi expects all write16 data in a linear buffer. If the
iovec only contains one buffer we can skip the linearization
step as well as the additional malloc/free and pass the
buffer directly.
Reported-by: NRonnie Sahlberg <ronniesahlberg@gmail.com>
Signed-off-by: NPeter Lieven <pl@kamp.de>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

This patch adds support for bdrv_create. This allows e.g.
to use qemu-img to convert from any supported device to
an iscsi backed storage as destination.
Signed-off-by: NPeter Lieven <pl@kamp.de>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

Basically the same as usb-storage, but without automatic scsi
device setup.  Also features support for up to 16 LUNs.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

This is a simpler solution to 869981, where migration breaks since qxl's
rom bar size has changed. Instead of ignoring fields in QXLRom, which is what has
actually changed, we remove some of the modes, a mechanism already
accounted for by the guest. The modes left allow for portrait and
landscape only modes, corresponding to orientations 0 and 1.
Orientations 2 and 3 are dropped.

Added assert so that rom size will fit the future QXLRom increases via
spice-protocol changes.

This patch has been tested with 6.1.0.10015. With the newer 6.1.0.10016
there are problems with both "(flipped)" modes prior to the patch, and
the patch loses the ability to set "Portrait" modes. But this is a
separate bug to be fixed in the driver, and besides the patch doesn't
affect the new arbitrary mode setting functionality.
Signed-off-by: NAlon Levy <alevy@redhat.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

This reverts commit a1cbfd55.

Test isn't useless.  scsi_req_enqueue() may finish the request (will
actually happen for requests which don't trigger any I/O such as
INQUIRY), then call usb_msd_command_complete() which in turn will
set s->req to NULL after unref'ing it.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Signed-off-by: NAlon Levy <alevy@redhat.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Replace by SYS_BUS_DEVICE() QOM cast macro using a scripted conversion.
Avoids the old macro creeping into new code.

Resolve a Coding Style warning in openpic code.
Signed-off-by: NAndreas Färber <afaerber@suse.de>
Cc: Anthony Liguori <anthony@codemonkey.ws>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Some VncState values are not initialized before the Websocket handshake.
If it fails QEMU segfaults during the cleanup. To prevent this behavior
intialization checks are added.
Signed-off-by: NTim Hardeck <thardeck@suse.de>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

This patch adds basic Websocket Protocol version 13 - RFC 6455 - support
to QEMU VNC. Binary encoding support on the client side is mandatory.

Because of the GnuTLS requirement the Websockets implementation is
optional (--enable-vnc-ws).

To activate Websocket support the VNC option "websocket"is used, for
example "-vnc :0,websocket".
The listen port for Websocket connections is (5700 + display) so if
QEMU VNC is started with :0 the Websocket port would be 5700.
As an alternative the Websocket port could be manually specified by
using ",websocket=<port>" instead.

Parts of the implementation base on Anthony Liguori's QEMU Websocket
patch from 2010 and on Joel Martin's LibVNC Websocket implementation.
Signed-off-by: NTim Hardeck <thardeck@suse.de>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Following Anthony Liguori's Websocket implementation I have added the
buffer_advance function to VNC and replaced all related buffer memmove
operations with it.
Signed-off-by: NTim Hardeck <thardeck@suse.de>
Reviewed-by: NAnthony Liguori <aliguori@us.ibm.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>