When removing a drive from the host-side via drive_del we currently have
the following path:

drive_del
qemu_aio_flush()
bdrv_close()    // zaps bs->drv, which makes any subsequent I/O get
                // dropped.  Works as designed
drive_uninit()
bdrv_delete()   // frees the bs.  Since the device is still connected to
                // bs, any subsequent I/O is a use-after-free.

The value of bs->drv becomes unpredictable on free.  As long as it
remains null, I/O still gets dropped, however it could become non-null
at any point after the free resulting SEGVs or other QEMU state
corruption.

To resolve this issue as simply as possible, we can chose to not
actually delete the BlockDriverState pointer.  Since bdrv_close()
handles setting the drv pointer to NULL, we just need to remove the
BlockDriverState from the QLIST that is used to enumerate the block
devices.  This is currently handled within bdrv_delete, so move this
into its own function, bdrv_make_anon().

The result is that we can now invoke drive_del, this closes the file
descriptors and sets BlockDriverState->drv to NULL which prevents futher
IO to the device, and since we do not free BlockDriverState, we don't
have to worry about the copy retained in the block devices.

We also don't attempt to remove the qdev property since we are no longer
deleting the BlockDriverState on drives with associated drives.  This
also allows for removing Drives with no devices associated either.
Reported-by: NMarkus Armbruster <armbru@redhat.com>
Signed-off-by: NRyan Harper <ryanh@us.ibm.com>
Acked-by: NMarkus Armbruster <armbru@redhat.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

Bug fix: routines 'ioreq_runio_qemu_sync' and 'ioreq_runio_qemu_aio'
won't call 'ioreq_unmap' or 'ioreq_finish' on errors, leaving ioreq in
the blkdev->inflight list and a leak.
Signed-off-by: NFeiran Zheng <famcool@gmail.com>
Acked-by: NStefano Stabellini <stefano.stabellini@eu.citrix.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

Signed-off-by: NEdgar E. Iglesias <edgar.iglesias@gmail.com>

Standard autoconf scripts include a --version flag so people can easily
query things.  Add this to qemu's configure so it too can integrate with
build systems that have standard autotool helpers.
Signed-off-by: NMike Frysinger <vapier@gentoo.org>
Signed-off-by: NEdgar E. Iglesias <edgar.iglesias@gmail.com>

CPU_QuadU isn't used on all targets, but there's no harm in defining the
typedef anyway. It only needs to be guarded by CONFIG_SOFTFLOAT, because
softfloat-native doesn't have a float128 type. This avoids the need for
every new target which uses CPU_QuadU to add itself to an #ifdef in
what ought to be target-agnostic code.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

Make the Neon helper routines use the correct FP status from
the CPUEnv rather than using a dummy static one. This means
they will correctly handle denormals and NaNs and will set
FPSCR exception bits properly.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

Use the global 'env' variable in the helper functions in iwmmxt_helper.c.
This means we don't need to pass env as an argument to them any more.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

Use the global 'env' variable in the helper functions in neon_helper.c.
This means we don't need to pass env as an argument to them any more.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

Build all files matching *_helper.c with HELPER_CFLAGS, not just
op_helper.c. This allows you to put target helper functions which
use the global 'env' variable in multiple source files.

This only affects the ARM target as all the other targets currently only
have op_helper.c.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

At one point, usb-ccid.c attempts to use a %lX format specifier to print
a uint64_t, which is only correct on some host platforms.  This patch
corrects the statement to use the stdint specified PRIX64 constant instead.
Signed-off-by: NDavid Gibson <david@gibson.dropbear.id.au>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

Signed-off-by: NMichael Walle <michael@walle.cc>
Signed-off-by: NEdgar E. Iglesias <edgar.iglesias@gmail.com>

This patch adds almost complete support for the Milkymist system-on-chip
(http://www.milkymist.org).

Additional to running bare metal applications, booting a linux kernel with
initrd is supported.
Signed-off-by: NMichael Walle <michael@walle.cc>
Signed-off-by: NEdgar E. Iglesias <edgar.iglesias@gmail.com>

This patch adds wrappers for easy creation of the qdev devices.
Signed-off-by: NMichael Walle <michael@walle.cc>
Signed-off-by: NEdgar E. Iglesias <edgar.iglesias@gmail.com>

This patch adds support for Milkymist's VGA framebuffer.
Signed-off-by: NMichael Walle <michael@walle.cc>
Signed-off-by: NEdgar E. Iglesias <edgar.iglesias@gmail.com>

This patch adds support for Milkymist's simple UART.
Signed-off-by: NMichael Walle <michael@walle.cc>
Signed-off-by: NEdgar E. Iglesias <edgar.iglesias@gmail.com>

This patch adds support for Milkymist's texture mapping unit. For fast
computation this model needs hardware accelerated 3D graphics support
(OpenGL). There is no graphical output, all computations belong to internal
framebuffers only.
Signed-off-by: NMichael Walle <michael@walle.cc>
Signed-off-by: NEdgar E. Iglesias <edgar.iglesias@gmail.com>

This patch introduce a new config option CONFIG_OPENGL.
Signed-off-by: NMichael Walle <michael@walle.cc>
Signed-off-by: NEdgar E. Iglesias <edgar.iglesias@gmail.com>

This patch adds support for Milkymist's System Controller core. The model
has the following features:
 - support for shutting down and restarting the board
 - provide two timers and GPIO
 - provide registers for system identification and reading the boards
   capabilities
Signed-off-by: NMichael Walle <michael@walle.cc>
Signed-off-by: NEdgar E. Iglesias <edgar.iglesias@gmail.com>

This patch adds support for Milkymist's SoftUSB core. This model differ
from the real hardware in its functionality. The real hardware consits of a
tiny freely programmable microcontroller which controls the USB ports. For
simplicity reasons, this model emulates only keyboard and mouse input
devices, eg. input events translates directly to the corresponding expected
messages.
Signed-off-by: NMichael Walle <michael@walle.cc>
Signed-off-by: NEdgar E. Iglesias <edgar.iglesias@gmail.com>

This patch adds support for Milkymist's Programmable FPU.
Signed-off-by: NMichael Walle <michael@walle.cc>
Signed-off-by: NEdgar E. Iglesias <edgar.iglesias@gmail.com>

This patch adds support for Milkymist's minimal Ethernet MAC.
Signed-off-by: NMichael Walle <michael@walle.cc>
Signed-off-by: NEdgar E. Iglesias <edgar.iglesias@gmail.com>

This patch adds support for Milkymist's memory card core.
Signed-off-by: NMichael Walle <michael@walle.cc>
Signed-off-by: NEdgar E. Iglesias <edgar.iglesias@gmail.com>

This patch adds support for the Milkymist's High Performance Dynamic Memory
Controller. This is just a dumb model without any functionality. While the
real hardware acts for example as a bridge between software and hardware
for sending SDRAM commans, this model will only eat up these commands and
always returns the expected hardware states, eg. PLL locked etc.
Signed-off-by: NMichael Walle <michael@walle.cc>
Signed-off-by: NEdgar E. Iglesias <edgar.iglesias@gmail.com>

This patch adds support for the Milkymist AC97 compatible sound output and
input core.
Signed-off-by: NMichael Walle <michael@walle.cc>
Signed-off-by: NEdgar E. Iglesias <edgar.iglesias@gmail.com>

This reverts commit 9bcfc7da.

S390x uses the QuadU type, so let's enable it.
Signed-off-by: NUlrich Hecht <uli@suse.de>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

S390x user emulation can do nptl. Reflect this in the configure script.
Signed-off-by: NUlrich Hecht <uli@suse.de>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

This patch enables the instruction disassembler when using an
S390x target.
Signed-off-by: NUlrich Hecht <uli@suse.de>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

Commit 6b331efb broke the s390 proxy version
of virtio-serial by only taking its PCI brother into account.

So let's adjust s390-virtio-serial the same way as its PCI counterpart, making
it compile and work again.
Signed-off-by: NAlexander Graf <agraf@suse.de>
CC: Amit Shah <amit.shah@redhat.com>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

During Jan's rework of the generic KVM layer, he added some more error checks
and actually aborted if something went wrong. Unfortunately, one of the s390
internal error codes slipped through, aborting the VM without needing to.

This patch fixes booting of S390x virtual machines in KVM.
Signed-off-by: NAlexander Graf <agraf@suse.de>
CC: Jan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

We have two different virtio buses: pci and s390. The abstraction path
taken in qemu is to have generic aliases for each device type in the
architecture specific qdev devices.

So let's make use of these aliases whenever we can and define them
whenever we can.
Signed-off-by: NAlexander Graf <agraf@suse.de>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

The ivshmem depends on PCI and KVM, not only KVM. Reflect this
in the Makefile, so we don't get build errors on s390x.
Signed-off-by: NAlexander Graf <agraf@suse.de>
CC: Cam Macdonell <cam@cs.ualberta.ca>
CC: Juan Quintela <quintela@redhat.com>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

arpa/inet.h is not available for w32, so commit
edbb2136 breaks
w32 compilations.

This is fixed by using qemu_socket.h.
Signed-off-by: NStefan Weil <weil@mail.berlios.de>
Reviewed-by: NAlon Levy <alevy@redhat.com>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

SDL library initialization mangles signal handlers, so QEMU should
register them after initializing SDL. This was the case before and code
even have a comment about that. Fix it to be so again.
Signed-off-by: NGleb Natapov <gleb@redhat.com>
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

Tidy up the message printed when qemu exits due to a signal, so that
it's clearer where the message is coming from and that it's not just
stray debug output.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Reviewed-by: NStefan Hajnoczi <stefanha@linux.vnet.ibm.com>
Acked-by: NGleb Natapov <gleb@redhat.com>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

The common checksum functions were moved to net/checksum.c in commit
7200ac3c but the original net-checksum.c
was never deleted from the source tree.  Remove it now since all users
of the checksum functions link against net/checksum.o and net-checksum.c
is not even compiled anymore.
Signed-off-by: NStefan Hajnoczi <stefanha@linux.vnet.ibm.com>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

Rx and Tx descriptors are 16 byte aligned, so the lower bits are
ignored by real hardware. In fact, they always read back as zero on real
hardware, but probably nobody relies on that.
Signed-off-by: NKevin Wolf <mail@kevin-wolf.de>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

When the VM goes into stop state while there is a gdb frontend attached,
it makes sense to inform gdb about this fact and at least a bit about
the stop reason. Basically, all stops are interesting except for the
temporary VMSTOP_SAVE/LOADVM.

The patch maps the relevant VMSTOP reasons on unique and more or less
associatable signals that gdb understands.
Signed-off-by: NJan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

These errors were reported by cppcheck:

tests/cris/check_openpf1.c:30: error:
Mismatching allocation and deallocation: f

tests/cris/check_openpf2.c:13: error:
Mismatching allocation and deallocation: f

tests/cris/check_stat3.c:16: error:
Buffer overrun possible for long cmd-line args

tests/cris/check_stat4.c:18: error:
Buffer overrun possible for long cmd-line args

The first two are obvious coding errors (fopen needs fclose, not close).

The last two may seem less important (nobody will start test code
with an argument of more than 1022 characters which raises a buffer
overrun). Fixing them nevertheless helps with static code checks
like those done by cppcheck.
Signed-off-by: NStefan Weil <weil@mail.berlios.de>
Signed-off-by: NEdgar E. Iglesias <edgar.iglesias@gmail.com>

- the trigger mode is edge at first
- During initializatoin, the interrupt is raised as edge which is masked.
  The corresponding bit of irr is set.
- Then the mode is switched to level and it's unmasked.
- the bit of irr is set, so the interrupt is raised repeatedly by
  ioapic_service().
- OS considers that the irq line is broken and falls back to polling mode.

This patch fixes the issues.
After raising edige, clear the bit of irr.

> Bringing up interface eth0:
> Determining IP information for eth0...irq 18: nobody cared (try booting with the "irqpoll" option)
> Pid: 4126, comm: ip Not tainted 2.6.38-rc7 #1
> Call Trace:
>  <IRQ>  [<ffffffff8105b009>] ? __report_bad_irq+0x38/0x87
>  [<ffffffff8105b177>] ? note_interrupt+0x11f/0x188
>  [<ffffffff8105bacf>] ? handle_fasteoi_irq+0xa7/0xd1
>  [<ffffffff810046ff>] ? handle_irq+0x83/0x8c
>  [<ffffffff81003eb9>] ? do_IRQ+0x48/0xaf
>  [<ffffffff81300513>] ? ret_from_intr+0x0/0xe
>  [<ffffffff81031ab8>] ? __do_softirq+0x4f/0x114
>  [<ffffffff81002d6c>] ? call_softirq+0x1c/0x28
>  [<ffffffff81004647>] ? do_softirq+0x33/0x68
>  [<ffffffff810316fb>] ? irq_exit+0x36/0x38
>  [<ffffffff81015f2c>] ? smp_apic_timer_interrupt+0x88/0x96
>  [<ffffffff81002853>] ? apic_timer_interrupt+0x13/0x20
>  <EOI>  [<ffffffff810177ed>] ? __ioapic_set_affinity+0x68/0x7c
>  [<ffffffff813000f0>] ? _raw_spin_unlock_irqrestore+0x8/0xa
>  [<ffffffff8105a84f>] ? __setup_irq+0x224/0x2cb
>  [<ffffffff8120e3c5>] ? e1000_intr+0x0/0x103
>  [<ffffffff8105a9c7>] ? request_threaded_irq+0xd1/0x114
>  [<ffffffff8120e396>] ? e1000_request_irq+0x34/0x63
>  [<ffffffff8121237d>] ? e1000_open+0x81/0x11f
>  [<ffffffff8129097c>] ? call_netdevice_notifiers+0x45/0x4a
>  [<ffffffff81290d8d>] ? __dev_open+0x97/0xc4
>  [<ffffffff8128e9c5>] ? __dev_change_flags+0xb9/0x13d
>  [<ffffffff81290cc1>] ? dev_change_flags+0x1c/0x51
>  [<ffffffff812d0542>] ? devinet_ioctl+0x26e/0x594
>  [<ffffffff812d174c>] ? inet_ioctl+0x92/0xaa
>  [<ffffffff81281d75>] ? T.1003+0x13/0x32
>  [<ffffffff81282152>] ? sock_ioctl+0x1f2/0x1ff
>  [<ffffffff810ae2d3>] ? do_vfs_ioctl+0x498/0x4e7
>  [<ffffffff81281203>] ? sock_alloc_file+0xb3/0x115
>  [<ffffffff8109f79f>] ? fd_install+0x31/0x5d
>  [<ffffffff810ae364>] ? sys_ioctl+0x42/0x65
>  [<ffffffff81001f3b>] ? system_call_fastpath+0x16/0x1b
> handlers:
> [<ffffffff8120e3c5>] (e1000_intr+0x0/0x103)
> Disabling IRQ #18
Signed-off-by: NIsaku Yamahata <yamahata@valinux.co.jp>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>