It is pointless to add a uint32_t field for every new feature.
Since we will need a new feature soon, convert accesses to "removable"
to look at bit 0 only.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

scsi_cmd_xfer_mode() is used to specify the xfer direction for SCSI
commands that come in from the guest.  If the direction is set incorrectly
this will eventually cause QEMU to kernel-panic the guest.

Add UNMAP and ATAPASSTHROUGH as commands that send data to the device.

Without this change, recent kernels will send both UNMAP as well
as ATAPASSTHROUGH commands to any /dev/sg* device, which due to the
incorrect xfer direction very quickly causes the guest kernel to crash.

Example causing a crash without the patch applied:

./x86_64-softmmu/qemu-system-x86_64 -m 1024 -enable-kvm -cdrom linuxmint-12-gnome-dvd-64bit.iso -drive file=/dev/sg4,if=scsi,bus=0,unit=6
Signed-off-by: NRonnie Sahlberg <ronniesahlberg@gmail.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

Recently introduced FUA support also gave us a use-after-free
of the BlockAcctCookie within a SCSIDiskReq, due to unbalanced
reference counting.

The patch fixes this by making scsi_do_read look like a combination
of scsi_*_complete + scsi_*_data.  It does both a ref (like
scsi_read_data) and an unref (like scsi_flush_complete).
Reported-by: NDavid Gibson <david@gibson.dropbear.id.au>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

Avoid sending more than 2GB of data, as that can cause overflows
in int32_t variables.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

Update the configure test for libiscsi support to detect version 1.3
or later.  Version 1.3 of libiscsi provides both READCAPACITY16 as well
as UNMAP commands.

Update the iscsi block layer to use READCAPACITY16 to detect the size of
the LUN instead of READCAPACITY10. This allows support for LUNs larger
than 2TB.

Update to implement bdrv_aio_discard() using the UNMAP command.
This allows us to use thin-provisioned LUNs from TGTD and other iSCSI
targets that support thin-provisioning.
Signed-off-by: NRonnie Sahlberg <ronniesahlberg@gmail.com>
[squashed in subsequent patch from Ronnie to fix off-by-one in LBA count]
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

Signed-off-by: Nmalc <av1474@comtv.ru>

Signed-off-by: Nmalc <av1474@comtv.ru>

* kwolf/for-anthony:
  ATA: Allow WIN_SECURITY_FREEZE_LOCK as nop
  rbd: add discard support
  qcow2: fix the return value -ENOENT -> -EEXIST
  qcow2: Don't hold cache references across yield
  qcow2: Remove unused parameter in do_alloc_cluster_offset
  qemu-iotests: Many parallel allocating I/O requests
  docs: fix one issue in qcow2 specs
  block/qcow2: Add missing GCC_FMT_ATTR to function report_unsupported()
  qemu-iotests: ignore fragmentation information for qed

When using Windows 8 with an AHCI disk drive, it issues a blue screen.
The reason is that WIN_SECURITY_FREEZE_LOCK / CFA_WEAR_LEVEL is not
supported by our ATA implementation, but Windows expects it to be there.

Since without security stuff implemented, the lock would be a nop anyway
and CFA_WEAR_LEVEL already is treated as a nop, let's just allow the cmd
for HD drives as well. That way Windows is happy.
Signed-off-by: NAlexander Graf <agraf@suse.de>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

Change the write flag to an operation type in RBDAIOCB, and make the
buffer optional since discard doesn't use it.

Discard is first included in librbd 0.1.2 (which is in Ceph 0.46).
If librbd is too old, leave out qemu_rbd_aio_discard entirely,
so the old behavior is preserved.
Signed-off-by: NJosh Durgin <josh.durgin@dreamhost.com>
Reviewed-by: NStefan Hajnoczi <stefanha@linux.vnet.ibm.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

Signed-off-by: NZhi Yong Wu <wuzhy@linux.vnet.ibm.com>
Reviewed-by: NStefan Hajnoczi <stefanha@linux.vnet.ibm.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

If cache references are held while the coroutine has yielded, the cache
may get used up and abort() when it can't find a free entry.
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

Signed-off-by: NKevin Wolf <kwolf@redhat.com>

This test case manages to let qcow2 abort because its cache is used up
and it can't find free cache entries for new requests any more.
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

Signed-off-by: NZhi Yong Wu <wuzhy@linux.vnet.ibm.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

Cc: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: NStefan Weil <sw@weilnetz.de>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

We added image fragmentation statistics functions to qemu-img several days
ago, those patches will cause "./check -qed" failed. This patch will ignore
fragmentation statistics information of qed format, and then "./check -qed"
will work.
Signed-off-by: NDong Xu Wang <wdongxu@linux.vnet.ibm.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

* kiszka/queues/slirp:
  Declare state directory in smb.conf
  slirp: don't use "smb ports = 0" option

* stefanha/tracing:
  configure: check for supported Python 2.x versions
  tracetool: avoid pkgutil.iter_modules() Python 2.7 function
  tracetool: avoid str.rpartition() Python 2.5 function
  tracetool: use Python 2.4-compatible __import__() arguments
  tracetool: use Python 2.4-compatible exception handling syntax

* agraf/s390-for-upstream:
  s390: reset avail and used index on reboot
  S390: dont call system_shutdown on disabled wait
  S390: remove default cdrom, sd-card and floppy support
  S390: support reboot for kvm on s390
  S390: reboot: reset device pages on reboot
  S390: fix error handling on kernel and initrd failures
  S390: fix kernel_commandline handling

* stefanha/trivial-patches:
  iohandler: Use bool for boolean struct member and remove holes
  async: Use bool for boolean struct members and remove a hole
  configure: Fix creation of symbolic links for MinGW toolchain

* agraf/ppc-for-upstream:
  linux-user: Fix invalid TARGET_ABI_BITS usage on ppc hosts
  target-ppc: Some support for dumping TLB_EMB TLBs
  ppce500_spin: Replace assert by hw_error (fixes compiler warning)
  pseries: Fix use of global CPU state
  pseries: Use the same interrupt swizzling for host bridges as p2p bridges
  pseries: Implement automatic PAPR VIO address allocation
  PPC: Fix up e500 cache size setting
  booke:Use MMU API for creating initial mapping for secondary cpus

* mdroth/qga-pull-4-27-12:
  qemu-ga: persist tracking of fsfreeze state via filesystem
  qemu-ga: add a whitelist for fsfreeze-safe commands
  qemu-ga: improve recovery options for fsfreeze

The smb.conf generated by the userspace networking does not include a state directory
directive. Samba therefore falls back to the default value. Since the user generally
does not have write access to this path, smbd immediately crashes.

The "state directory" option was added in Samba 3.4.0 (commit
http://gitweb.samba.org/?p=samba.git;a=commit;h=7b02e05eb64f3ffd7aa1cf027d10a7343c0da757).

This patch adds the missing option.
Signed-off-by: NNikolaus Rath <Nikolaus@rath.org>
Signed-off-by: NJan Kiszka <jan.kiszka@siemens.com>

The "smb ports = 0" option causes recent samba versions to crash. It was
introduced in commit 157777ef with log message "Samba 3 support".
However, a value of 0 has never been officially supported by smb and is
also not necessary: if stdin is a socket, smb does not try to listen on
any ports and uses just stdin. This is necessary to support inetd based
operation (otherwise smbd would always fail when called from inetd,
because inetd already listens on the SMB port). Since samba has
supported inetd operation since pre-3.x, it should be safe to rely on
this feature. I have tested it with Samba 3.6.4 -- communication works
fine, and smbd is not listening on any ports.

I suspect the "smb ports = 0" hack may have been introduced when someone
tested the qemu generated samba config from the command line with "smbd
-i" and found it to fail (because then stdin isn't a socket).
Signed-off-by: NNikolaus Rath <Nikolaus@rath.org>
Signed-off-by: NJan Kiszka <jan.kiszka@siemens.com>

When trying to evaluate the size of the _host_ type size for olddev_t,
we need to expose the host's pointer size, not the guest pointer size.

This usage got introduced accidently in commit b754e4fc.

Fix things by not using TARGET_.*, but rather use host sizeof()
information, which gives us the correct size.
Reported-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NAlexander Graf <agraf@suse.de>

Add mmubooke_dump_mmu().

TODO: Add printing of individual flags.
Signed-off-by: NFrançois Revol <revol@free.fr>
[agraf: fix coding style]
Signed-off-by: NAlexander Graf <agraf@suse.de>

The default case in function spin_read should never be reached,
therefore the old code used assert(0) to abort QEMU.

This does not work when QEMU is compiled with macro NDEBUG defined.
In this case (and also when the compiler does not know that assert
never returns), there is a compiler warning because of the missing
return value.

Using hw_error allows an improved error message and aborts always.
Signed-off-by: NStefan Weil <sw@weilnetz.de>
[agraf: use __func__]
Signed-off-by: NAlexander Graf <agraf@suse.de>

Commit ed120055 (Implement PAPR VPA
functions for pSeries shared processor partitions) introduced the
deregister_dtl() function and typo "emv" as name of its argument.
This went unnoticed because the code in that function can access the
global variable "env" so that no build failure resulted.

Fix the argument to read "env". Resolves LP#986241.
Signed-off-by: NPeter Portante <peter.portante@redhat.com>
Acked-by: NAndreas Färber <afaerber@suse.de>
[agraf: fixed typo in commit message]
Signed-off-by: NAlexander Graf <agraf@suse.de>

Currently the pseries PCI code uses a somewhat strange scheme of PCI irq
allocation - one per slot up to a maximum that's greater than the usual 4.
This scheme more or less worked, because we were able to tell the guest the
irq mapping in the device tree, however it's a bit odd and may break
assumptions in the future.  Worse, the array used to construct the dev
tree interrupt map was mis-sized, we got away with it only because it
happened that our SPAPR_PCI_NUM_LSI value was greater than 7.

This patch changes the pseries PCI code to use the same interrupt swizzling
scheme as is standardized for PCI to PCI bridges.  This makes for better
consistency, deals better with any devices which use multiple interrupt
pins and will make life easier in the future when we add passthrough of
what may be either a host bridge or a PCI to PCI bridge.  This won't break
existing guests, because they don't assume a particular mapping scheme for
host bridges, but just follow what we tell them in the device tree (also
updated to match, of course).  This patch also fixes the allocation of the
irq map.
Signed-off-by: NDavid Gibson <david@gibson.dropbear.id.au>
Signed-off-by: NAlexander Graf <agraf@suse.de>

PAPR virtual IO (VIO) devices require a unique, but otherwise arbitrary,
"address" used as a token to the hypercalls which manipulate them.

Currently the pseries machine code does an ok job of allocating these
addresses when the legacy -net nic / -serial and so forth options are used
but will fail to allocate them properly when using -device.

Specifically, you can use -device if all addresses are explicitly assigned.
Without explicit assignment, only one VIO device of each type (network,
console, SCSI) will be assigned properly, any further ones will attempt
to take the same address leading to a fatal error.

This patch fixes the situation by adding a proper address allocator to the
VIO "bus" code.  This is used both by -device and the legacy options and
default devices.  Addresses can still be explicitly assigned with -device
options if desired.

This patch changes the (guest visible) numbering of VIO devices, but since
their addresses are discovered using the device tree and already differ
from the numbering found on existing PowerVM systems, this does not break
compatibility.
Signed-off-by: NDavid Gibson <david@gibson.dropbear.id.au>
Signed-off-by: NAlexander Graf <agraf@suse.de>

When initializing the e500 code, we need to expose its
cache line size for user and system mode, while the mmu
details are only interesting for system emulation.

Split the 2 switch statements apart, allowing us to #ifdef
out the mmu parts for user mode emulation while keeping all
cache information consistent.
Signed-off-by: NAlexander Graf <agraf@suse.de>

Initial Mapping creation for secondary CPU in SMP was missing new MMU API.
Signed-off-by: NBharat Bhushan <bharat.bhushan@freescale.com>
Signed-off-by: NAlexander Graf <agraf@suse.de>

On my PPC host, HOST_LONG_SIZE is not defined even after
running configure. Use the normal C way of determining the
long size instead.
Signed-off-by: NAlexander Graf <agraf@suse.de>
Signed-off-by: Nmalc <av1474@comtv.ru>

This reverts commit b754e4fc.

The tracetool code requires Python 2.4, which was released in 2004.
Check for a supported Python version so we can give a clear error
message.
Signed-off-by: NStefan Hajnoczi <stefanha@linux.vnet.ibm.com>
Reviewed-by: NLluís Vilanova <vilanova@ac.upc.edu>

The pkgutil.iter_modules() function provides a way to enumerate child
modules.  Unfortunately it's missing in Python <2.7 so we must implement
similar behavior ourselves.
Signed-off-by: NStefan Hajnoczi <stefanha@linux.vnet.ibm.com>
Reviewed-by: NLluís Vilanova <vilanova@ac.upc.edu>

The str.rpartition() function is related to str.split() and is used for
splitting strings.  It was introduced in Python 2.5 and therefore cannot
be used in tracetool as Python 2.4 compatibility is required.

Replace the code using str.rsplit().
Signed-off-by: NStefan Hajnoczi <stefanha@linux.vnet.ibm.com>
Reviewed-by: NLluís Vilanova <vilanova@ac.upc.edu>