Keep only DMA_init function as a wrapper around DMA controllers creation.
Signed-off-by: NHervé Poussineau <hpoussin@reactos.org>
Message-id: 1453843944-26833-20-git-send-email-hpoussin@reactos.org
Signed-off-by: NJohn Snow <jsnow@redhat.com>

Signed-off-by: NHervé Poussineau <hpoussin@reactos.org>
Message-id: 1453843944-26833-19-git-send-email-hpoussin@reactos.org
Signed-off-by: NJohn Snow <jsnow@redhat.com>

Signed-off-by: NHervé Poussineau <hpoussin@reactos.org>
Message-id: 1453843944-26833-18-git-send-email-hpoussin@reactos.org
Signed-off-by: NJohn Snow <jsnow@redhat.com>

Signed-off-by: NHervé Poussineau <hpoussin@reactos.org>
Message-id: 1453843944-26833-17-git-send-email-hpoussin@reactos.org
Signed-off-by: NJohn Snow <jsnow@redhat.com>

Signed-off-by: NHervé Poussineau <hpoussin@reactos.org>
Message-id: 1453843944-26833-16-git-send-email-hpoussin@reactos.org
Signed-off-by: NJohn Snow <jsnow@redhat.com>

All functions relative to DMA (DMA_*() functions) are stubs on sparc64 platform.
Disable the DMA of the floppy controller, instead of calling these stubs.
Signed-off-by: NHervé Poussineau <hpoussin@reactos.org>
Message-id: 1453843944-26833-15-git-send-email-hpoussin@reactos.org
Signed-off-by: NJohn Snow <jsnow@redhat.com>

All functions relative to DMA (DMA_*() functions) are stubs on sparc platform.
Disable the DMA in the floppy controller, instead of calling these stubs.
Signed-off-by: NHervé Poussineau <hpoussin@reactos.org>
Message-id: 1453843944-26833-14-git-send-email-hpoussin@reactos.org
Signed-off-by: NJohn Snow <jsnow@redhat.com>

Floppy uses the DMA controller in rc4030 chipset, and not the i8259 from the ISA bus.
It's better to disable DMA than to call the wrong DMA controller.
Signed-off-by: NHervé Poussineau <hpoussin@reactos.org>
Message-id: 1453843944-26833-13-git-send-email-hpoussin@reactos.org
Signed-off-by: NJohn Snow <jsnow@redhat.com>

Rewrite the global DMA_*() functions to use the IsaDma interface.
Note that these functions will be deleted in a few commits.
Signed-off-by: NHervé Poussineau <hpoussin@reactos.org>
Message-id: 1453843944-26833-12-git-send-email-hpoussin@reactos.org
Signed-off-by: NJohn Snow <jsnow@redhat.com>

This will permit to deprecate global DMA_*() functions.
Signed-off-by: NHervé Poussineau <hpoussin@reactos.org>
Message-id: 1453843944-26833-11-git-send-email-hpoussin@reactos.org
Signed-off-by: NJohn Snow <jsnow@redhat.com>

We will now be able to embed the i8257 interrupt controller in another object.
Signed-off-by: NHervé Poussineau <hpoussin@reactos.org>
Message-id: 1453843944-26833-10-git-send-email-hpoussin@reactos.org
Signed-off-by: NJohn Snow <jsnow@redhat.com>

Signed-off-by: NHervé Poussineau <hpoussin@reactos.org>
Message-id: 1453843944-26833-9-git-send-email-hpoussin@reactos.org
Signed-off-by: NJohn Snow <jsnow@redhat.com>

Signed-off-by: NHervé Poussineau <hpoussin@reactos.org>
Message-id: 1453843944-26833-8-git-send-email-hpoussin@reactos.org
Signed-off-by: NJohn Snow <jsnow@redhat.com>

This removes some static/global variables, and we're now running only the
required controller (master or slave)
Signed-off-by: NHervé Poussineau <hpoussin@reactos.org>
Message-id: 1453843944-26833-7-git-send-email-hpoussin@reactos.org
Signed-off-by: NJohn Snow <jsnow@redhat.com>

Signed-off-by: NHervé Poussineau <hpoussin@reactos.org>
Message-id: 1453843944-26833-6-git-send-email-hpoussin@reactos.org
Signed-off-by: NJohn Snow <jsnow@redhat.com>

Signed-off-by: NHervé Poussineau <hpoussin@reactos.org>
Message-id: 1453843944-26833-5-git-send-email-hpoussin@reactos.org
Signed-off-by: NJohn Snow <jsnow@redhat.com>

Signed-off-by: NHervé Poussineau <hpoussin@reactos.org>
Message-id: 1453843944-26833-4-git-send-email-hpoussin@reactos.org
Signed-off-by: NJohn Snow <jsnow@redhat.com>

i8257 DMA controller exists on one ISA bus, so let's specify it at initialization.
Signed-off-by: NHervé Poussineau <hpoussin@reactos.org>
Message-id: 1453843944-26833-3-git-send-email-hpoussin@reactos.org
Signed-off-by: NJohn Snow <jsnow@redhat.com>

Merge ISAi82374State fields into parent structure I82374State.
Signed-off-by: NHervé Poussineau <hpoussin@reactos.org>
Message-id: 1453843944-26833-2-git-send-email-hpoussin@reactos.org
Signed-off-by: NJohn Snow <jsnow@redhat.com>

Accidentally, I removed a "feature" where empty drives had geometry
values applied to them, which allows seek on empty drives to work
"by accident," as QEMU actually tries to disallow that.

Seeks on empty drives should work, though, but the easiest thing is to
restore the misfeature where empty drives have non-zero geometries
applied.

Document the hack accordingly.

[Maintainer edit]

This fix corrects a regression introduced in d5d47efc, where
pick_geometry was modified such that it would not operate on empty
drives, and as a result if there is no diskette inserted, QEMU
no longer populates it with geometry bounds. As a result, seek fails
when QEMU denies to move the current track, but reports success anyway.
This can confuse the guest, leading to kernel panics in the guest.
Signed-off-by: NJohn Snow <jsnow@redhat.com>
Reviewed-by: NEric Blake <eblake@redhat.com>
Message-id: 1454106932-17236-1-git-send-email-jsnow@redhat.com

virtio-gpu: bugfixes and spice support preparation

# gpg: Signature made Wed 03 Feb 2016 09:47:13 GMT using RSA key ID D3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
# gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
# gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

* remotes/kraxel/tags/pull-vga-20160203-1:
  virtio-gpu: block any rendering until client (ui) is done
  virtio-gpu: add support to enable/disable command processing
  virtio-gpu: maintain command queue
  virtio-gpu: fix memory leak in error path
  console: block rendering until client is done
  zap qemu_egl_has_ext in include/ui/egl-helpers.h
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Monitor patches for 2016-02-03

# gpg: Signature made Wed 03 Feb 2016 09:13:48 GMT using RSA key ID EB918653
# gpg: Good signature from "Markus Armbruster <armbru@redhat.com>"
# gpg:                 aka "Markus Armbruster <armbru@pond.sub.org>"

* remotes/armbru/tags/pull-monitor-2016-02-03:
  hmp: fix sendkey out of bounds write (CVE-2015-8619)
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Wire up gl_block callback, so ui code can request to stop
virtio-gpu rendering.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

So we can stop rendering for a while in case we have to.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
Reviewed-by: NMarc-André Lureau <marcandre.lureau@redhat.com>

We'll go take out the commands we receive out of the virt queue and put
them into a linked list, to decouple virtio queue handling from actual
command processing.

Also move cmd processing to new virtio_gpu_handle_ctrl func, so we can
easily kick it from different places.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Found by Coverity Scan, buf not freed on error.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
Reviewed-by: NMarc-André Lureau <marcandre.lureau@redhat.com>

Allow gl user interfaces to block display device gl rendering.
The ui code might want to do that in case it takes a little
longer to bring things to screen, for example because we'll
hand over a dma-buf to another process (spice will do that).
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
Reviewed-by: NMarc-André Lureau <marcandre.lureau@redhat.com>

Drop leftover prototype which sneaked in by mistake
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
Reviewed-by: NMarc-André Lureau <marcandre.lureau@redhat.com>

When processing 'sendkey' command, hmp_sendkey routine null
terminates the 'keyname_buf' array. This results in an OOB
write issue, if 'keyname_len' was to fall outside of
'keyname_buf' array.

Since the keyname's length is known the keyname_buf can be
removed altogether by adding a length parameter to
index_from_key() and using it for the error output as well.
Reported-by: NLing Liu <liuling-it@360.cn>
Signed-off-by: NWolfgang Bumiller <w.bumiller@proxmox.com>
Message-Id: <20160113080958.GA18934@olga>
[Comparison with "<" dumbed down, test for junk after strtoul()
tweaked]
Signed-off-by: NMarkus Armbruster <armbru@redhat.com>

Block patches

# gpg: Signature made Tue 02 Feb 2016 17:23:44 GMT using RSA key ID E838ACAD
# gpg: Good signature from "Max Reitz <mreitz@redhat.com>"

* remotes/maxreitz/tags/pull-block-for-peter-2016-02-02: (50 commits)
  block: qemu-iotests - add test for snapshot, commit, snapshot bug
  block: set device_list.tqe_prev to NULL on BDS removal
  iotests: Add "qemu-img map" test for VMDK extents
  qemu-img: Make MapEntry a QAPI struct
  qemu-img: In "map", use the returned "file" from bdrv_get_block_status
  block: Use returned *file in bdrv_co_get_block_status
  vmdk: Return extent's file in bdrv_get_block_status
  vmdk: Fix calculation of block status's offset
  vpc: Assign bs->file->bs to file in vpc_co_get_block_status
  vdi: Assign bs->file->bs to file in vdi_co_get_block_status
  sheepdog: Assign bs to file in sd_co_get_block_status
  qed: Assign bs->file->bs to file in bdrv_qed_co_get_block_status
  parallels: Assign bs->file->bs to file in parallels_co_get_block_status
  iscsi: Assign bs to file in iscsi_co_get_block_status
  raw: Assign bs to file in raw_co_get_block_status
  qcow2: Assign bs->file->bs to file in qcow2_co_get_block_status
  qcow: Assign bs->file->bs to file in qcow_co_get_block_status
  block: Add "file" output parameter to block status query functions
  block: acquire in bdrv_query_image_info
  iotests: Add test for block jobs and BDS ejection
  ...
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Signed-off-by: NJeff Cody <jcody@redhat.com>
Message-id: 2dbc05efba2f683cb3aaf71aaa9b776ebf7ec57c.1454376655.git.jcody@redhat.com
Reviewed-by: NMax Reitz <mreitz@redhat.com>
[Moved test number from 143 to 144]
Signed-off-by: NMax Reitz <mreitz@redhat.com>

This fixes a regression introduced with commit 3f09bfbc.  Multiple
bugs arise in conjunction with live snapshots and mirroring operations
(which include active layer commit).

After a live snapshot occurs, the active layer and the base layer both
have a non-NULL tqe_prev field in the device_list, although the base
node's tqe_prev field points to a NULL entry.  This non-NULL tqe_prev
field occurs after the bdrv_append() in the external snapshot calls
change_parent_backing_link().

In change_parent_backing_link(), when the previous active layer is
removed from device_list, the device_list.tqe_prev pointer is not
set to NULL.

The operating scheme in the block layer is to indicate that a BDS belongs
in the bdrv_states device_list iff the device_list.tqe_prev pointer
is non-NULL.

This patch does two things:

1.) Introduces a new block layer helper bdrv_device_remove() to remove a
    BDS from the device_list, and
2.) uses that new API, which also fixes the regression once used in
    change_parent_backing_link().
Signed-off-by: NJeff Cody <jcody@redhat.com>
Message-id: 0cd51e11c0666c04ddb7c05293fe94afeb551e89.1454376655.git.jcody@redhat.com
Reviewed-by: NMax Reitz <mreitz@redhat.com>
Signed-off-by: NMax Reitz <mreitz@redhat.com>

usb: two ehci fixes.

# gpg: Signature made Tue 02 Feb 2016 13:12:00 GMT using RSA key ID D3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
# gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
# gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

* remotes/kraxel/tags/pull-usb-20160202-1:
  ehci: update irq on reset
  usb: check page select value while processing iTD
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Signed-off-by: NFam Zheng <famz@redhat.com>
Message-id: 1453780743-16806-17-git-send-email-famz@redhat.com
Reviewed-by: NMax Reitz <mreitz@redhat.com>
Signed-off-by: NMax Reitz <mreitz@redhat.com>

The "flags" bit mask is expanded to two booleans, "data" and "zero";
"bs" is replaced with "filename" string.

Refactor the merge conditions in img_map() into entry_mergeable().
Reviewed-by: NEric Blake <eblake@redhat.com>
Reviewed-by: NStefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: NFam Zheng <famz@redhat.com>
Message-id: 1453780743-16806-16-git-send-email-famz@redhat.com
Signed-off-by: NMax Reitz <mreitz@redhat.com>

Now all drivers should return a correct "file", we can make use of it,
even with the recursion into backing chain above.
Reviewed-by: NEric Blake <eblake@redhat.com>
Reviewed-by: NStefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: NFam Zheng <famz@redhat.com>
Message-id: 1453780743-16806-15-git-send-email-famz@redhat.com
Signed-off-by: NMax Reitz <mreitz@redhat.com>

Now that all drivers return the right "file" pointer, we can use it.
Signed-off-by: NFam Zheng <famz@redhat.com>
Reviewed-by: NMax Reitz <mreitz@redhat.com>
Message-id: 1453780743-16806-14-git-send-email-famz@redhat.com
Signed-off-by: NMax Reitz <mreitz@redhat.com>

Signed-off-by: NFam Zheng <famz@redhat.com>
Message-id: 1453780743-16806-13-git-send-email-famz@redhat.com
Reviewed-by: NMax Reitz <mreitz@redhat.com>
Signed-off-by: NMax Reitz <mreitz@redhat.com>

"offset" is the offset of cluster and sector_num doesn't necessarily
refer to the start of it, it should add index_in_cluster.
Signed-off-by: NFam Zheng <famz@redhat.com>
Message-id: 1453780743-16806-12-git-send-email-famz@redhat.com
Reviewed-by: NMax Reitz <mreitz@redhat.com>
Signed-off-by: NMax Reitz <mreitz@redhat.com>

Reviewed-by: NStefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: NFam Zheng <famz@redhat.com>
Message-id: 1453780743-16806-11-git-send-email-famz@redhat.com
Signed-off-by: NMax Reitz <mreitz@redhat.com>