With pipelining it is possible to encounter a finished packet when cleaning
the queue due to a halt. This happens when a non stall error happens while
talking to a real device. In this case the queue on the usb-host side will
continue processing packets, and we can have completed packets waiting in
the queue after an error condition packet causing a halt.

There are 2 reasons to discard the completed packets at this point, rather
then trying to writing them back to the guest:

1) The guest expect to be able to cancel and/or change packets after the
packet with the error without doing an unlink, so writing them back may
confuse the guest.

2) Since the queue does not advance when halted, the writing back of these
packets will fail anyways since p->qtdaddr != q->qtdaddr, so the
ehci_verify_qtd call in ehci_writeback_async_complete_packet will fail.

Note that 2) means that then only functional change this patch introduces
is the printing of a warning when this scenario happens.

Note that discarding these packets means that the guest driver and the device
will get out of sync! This is unfortunate, but should not be a problem since
with a non stall error (iow an io-error) the 2 are out of sync already anyways.
Still this patch adds a warning to signal this happening.

Note that sofar this has only been seen with a DVB-T receiver, which gives
of a MPEG-2 stream, which allows for recovering from lost packets, see:
https://bugzilla.redhat.com/show_bug.cgi?id=890320Signed-off-by: NHans de Goede <hdegoede@redhat.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

filename was still uninitialised when it's used as a parameter to a
tracing function, so let's move the initialisation. Also, commit c2ad1b0c
forgot to add a NULL check, which this patch adds while we're at it.
Signed-off-by: NKevin Wolf <kwolf@redhat.com>
Reviewed-by: NEric Blake <eblake@redhat.com>
Tested-by: NAndreas Färber <afaerber@suse.de>
Message-id: 1366645720-11384-1-git-send-email-kwolf@redhat.com
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Simplify the creation of the cancel path given the TPM's device path.
Given the path /dev/tpm0 build the path /sys/class/misc/tpm0/device/cancel.
Signed-off-by: NStefan Berger <stefanb@linux.vnet.ibm.com>
Reviewed-by: NEric Blake <eblake@redhat.com>
Message-id: 1366146516-23814-1-git-send-email-stefanb@linux.vnet.ibm.com
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Handle the addresses and values for {in,out}[bwl] as unsigned (ie
with strtoul), as per the protocol specification comment. This fixes
a test failure in test_i440fx_defaults on 32-bit hosts where the test
tries to write 0x80000000 and qtest was instead writing 0x7fffffff.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Message-id: 1366551003-16649-1-git-send-email-peter.maydell@linaro.org
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

In certain scenario, latency induced by paging is significant and
memory locking is needed. Also, in the scenario with untrusted
guests, latency improvement due to mlock is desired.

This patch introduces a following new option to mlock guest and
qemu memory:

-realtime mlock=on|off
Signed-off-by: NSatoru Moriya <satoru.moriya@hds.com>
Reviewed-by: NPaolo Bonzini <pbonzini@redhat.com>
Reviewed-by: NMarcelo Tosatti <mtosatti@redhat.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Message-id: 1366382526-26146-1-git-send-email-pbonzini@redhat.com
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Due to a glib bug, the finalize callback is called with the GMainContext
lock held.  Thus, any operation on the context from the callback will
cause recursive locking and a deadlock.  This happens, for example,
when a client disconnects from a socket chardev.

The fix for this is somewhat ugly, because we need to forego polymorphism
and implement our own function to destroy IOWatchPoll sources.  The
right thing to do here would be child sources, but we support older
glib versions that do not have them.  Not coincidentially, glib developers
found and fixed the deadlock as part of implementing child sources.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Tested-by: NSander Eikelenboom <linux@eikelenboom.it>
Message-id: 1366385529-10329-5-git-send-email-pbonzini@redhat.com
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Even if a CharDriverState's source is blocked by the front-end,
it must not be dropped. The IOWatchPoll that wraps it will take
care of adding and removing it to the main loop.  Only remove
the source when the channel is closed; and in that case, make sure
that the wrapping IOWatchPoll is removed too.

These should just be theoretical bugs.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Message-id: 1366385529-10329-4-git-send-email-pbonzini@redhat.com
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

There is no need to use a timer and pty_chr_read to detect a connected
pty.  It is simpler to just call g_poll periodically and check for POLLHUP.
It is done once per second, and only if the pty is disconnected, so it
is cheap enough.

Tested with "-monitor pty" and "-serial mon:pty", both of which work
correctly and do not freeze QEMU.  (How to test ptys?  "socat -,raw,echo=0
/dev/pts/4,raw").
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Message-id: 1366385529-10329-3-git-send-email-pbonzini@redhat.com
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Always check that the source is active, and zero the tag afterwards.

The occurrence in pty_chr_state will trigger with the next patch, the
others are just theoretical.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Message-id: 1366385529-10329-2-git-send-email-pbonzini@redhat.com
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

The code did use profile_getclock() but did not include
include/qemu/timer.h where this function is defined. The patch fixes this.
Signed-off-by: NAlexey Kardashevskiy <aik@ozlabs.ru>
Message-id: 1366616571-4321-1-git-send-email-aik@ozlabs.ru
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

# By Kevin Wolf (16) and Stefan Hajnoczi (4)
# Via Kevin Wolf
* kwolf/for-anthony:
  qemu-iotests: add 053 unaligned compressed image size test
  block: Allow overriding backing.file.filename
  block: Remove filename parameter from .bdrv_file_open()
  vvfat: Use bdrv_open options instead of filename
  sheepdog: Use bdrv_open options instead of filename
  rbd: Use bdrv_open options instead of filename
  iscsi: Use bdrv_open options instead of filename
  gluster: Use bdrv_open options instead of filename
  curl: Use bdrv_open options instead of filename
  blkverify: Use bdrv_open options instead of filename
  blkdebug: Use bdrv_open options instead of filename
  raw-win32: Use bdrv_open options instead of filename
  raw-posix: Use bdrv_open options instead of filename
  block: Enable filename option
  block: Add driver-specific options for backing files
  block: Fail gracefully when using a format driver on protocol level
  qemu-iotests: Fix _filter_qemu
  qemu-img: do not zero-pad the compressed write buffer
  qcow: allow sub-cluster compressed write to last cluster
  qcow2: allow sub-cluster compressed write to last cluster

Message-id: 1366630294-18984-1-git-send-email-kwolf@redhat.com
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

# By Stefan Hajnoczi
# Via Paolo Bonzini
* bonzini/nbd-next:
  nbd: set TCP_NODELAY
  nbd: use TCP_CORK in nbd_co_send_request()
  nbd: unlock mutex in nbd_co_send_request() error path

Message-id: 1366381830-11267-1-git-send-email-pbonzini@redhat.com
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

# By Paolo Bonzini (5) and others
# Via Paolo Bonzini
* bonzini/scsi-next:
  vhost-scsi-s390: new device supporting the tcm_vhost Linux kernel module
  vhost-scsi-ccw: new device supporting the tcm_vhost Linux kernel module
  vhost-scsi-pci: new device supporting the tcm_vhost Linux kernel module
  vhost-scsi: new device supporting the tcm_vhost Linux kernel module
  virtio: simplify Makefile conditionals
  virtio-scsi: create VirtIOSCSICommon
  vhost: Add vhost_commit callback for SeaBIOS ROM region re-mapping
  scsi: VMWare PVSCSI paravirtual device implementation
  scsi: avoid assertion failure on VERIFY command

Message-id: 1366381460-6041-1-git-send-email-pbonzini@redhat.com
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

# By Amos Kong (1) and Luiz Capitulino (1)
# Via Luiz Capitulino
* luiz/queue/qmp:
  virtio-balloon: fix integer overflow in BALLOON_CHANGE QMP event
  monitor: fix the wrong order of releasing keys

Message-id: 1366375833-995-1-git-send-email-lcapitulino@redhat.com
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Test that qemu-img convert -c works when input image length is not a
multiple of the cluster size.

Previously an error message would be produced:

  qemu-img: error while compressing sector 0: Input/output error

Now that qcow2 and qcow handle this case the test passes successfully.
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

If a filename is passed in the driver-specific options from the command
line, the backing file path from the image is ignored now.
Signed-off-by: NKevin Wolf <kwolf@redhat.com>
Reviewed-by: NEric Blake <eblake@redhat.com>

It is unused now in all block drivers.
Signed-off-by: NKevin Wolf <kwolf@redhat.com>
Reviewed-by: NEric Blake <eblake@redhat.com>

Signed-off-by: NKevin Wolf <kwolf@redhat.com>
Reviewed-by: NEric Blake <eblake@redhat.com>

This is only to convert the internal interface that is used for passing
the "filename" to be parsed, but converting to actual fine grained
options is left for another day, as it doesn't look trivial.
Signed-off-by: NKevin Wolf <kwolf@redhat.com>
Reviewed-by: NEric Blake <eblake@redhat.com>

This is only to convert the internal interface that is used for passing
the "filename" to be parsed, but converting to actual fine grained
options is left for another day, as it doesn't look trivial.
Signed-off-by: NKevin Wolf <kwolf@redhat.com>
Reviewed-by: NEric Blake <eblake@redhat.com>

This is only to convert the internal interface that is used for passing
the "filename" to be parsed, but converting to actual fine grained
options is left for another day, as it doesn't look trivial.
Signed-off-by: NKevin Wolf <kwolf@redhat.com>
Reviewed-by: NEric Blake <eblake@redhat.com>

This is only to convert the internal interface that is used for passing
the "filename" to be parsed, but converting to actual fine grained
options is left for another day, as it doesn't look trivial.
Signed-off-by: NKevin Wolf <kwolf@redhat.com>
Reviewed-by: NEric Blake <eblake@redhat.com>

As a bonus, going through the QemuOpts QEMU_OPT_SIZE parser for the
readahead option gives us proper error reporting that the previous use
of atoi() lacked.
Signed-off-by: NKevin Wolf <kwolf@redhat.com>
Reviewed-by: NEric Blake <eblake@redhat.com>

Signed-off-by: NKevin Wolf <kwolf@redhat.com>
Reviewed-by: NEric Blake <eblake@redhat.com>

Signed-off-by: NKevin Wolf <kwolf@redhat.com>
Reviewed-by: NEric Blake <eblake@redhat.com>

Signed-off-by: NKevin Wolf <kwolf@redhat.com>
Reviewed-by: NEric Blake <eblake@redhat.com>

Signed-off-by: NKevin Wolf <kwolf@redhat.com>
Reviewed-by: NEric Blake <eblake@redhat.com>

This allows using the file.filename option instead of the string that
comes from -drive file=... and is passed around as a separate parameter.
The goal is to get rid of this parameter and use the options QDict more
consistently.

With this option you can access not only the top-level image, but
specify a filename for the backing file (currently only if no backing
file exists, but we'll allow overriding it later)
Signed-off-by: NKevin Wolf <kwolf@redhat.com>
Reviewed-by: NEric Blake <eblake@redhat.com>

Options starting in "backing." are passed to the backing file now. If
you don't need to specify the filename for the backing file, you can add
it on the command line instead of in the image file:

$ qemu-nbd -t /tmp/test.img
$ qemu-img create -f qcow2 empty.qcow2 1G
$ qemu-system-x86_64 -drive file=empty.qcow2,backing.file.driver=nbd,\
    backing.file.host=localhost

Note that this doesn't override the backing filename from the image. If
the image has one, this will fail because NBD doesn't want the options
and a filename at the same time.
Signed-off-by: NKevin Wolf <kwolf@redhat.com>
Reviewed-by: NEric Blake <eblake@redhat.com>

Specifying the wrong driver could fail an assertion:

$ qemu-system-x86_64 -drive file.driver=qcow2,file=x
qemu-system-x86_64: block.c:721: bdrv_open_common: Assertion `file !=
((void *)0)' failed.
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

$QEMU_PROG happens to be 'qemu' in my setup, so this sed command
replaces a bit too much. Restrict it to the start of the line and to
when it's followed by a colon, i.e. the form used by error messages.
Signed-off-by: NKevin Wolf <kwolf@redhat.com>
Reviewed-by: NEric Blake <eblake@redhat.com>
Reviewed-by: NStefan Hajnoczi <stefanha@redhat.com>

bdrv_write_compressed() does not allow requests that span the end of the
device.  Therefore it is useless to zero-pad the last cluster and
thereby exceed the end of the device.

Let image formats handle zero-padding the final compressed cluster, if
necessary.
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

Compression in qcow requires image length to be a multiple of the
cluster size.  Lift this requirement by zero-padding the final cluster
when necessary.  The virtual disk size is still not cluster-aligned, so
the guest cannot access the zero sectors.

Note that this is almost identical to the qcow2 version of this code.
qcow2's compression code is drawn from qcow.
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

Compression in qcow2 requires image length to be a multiple of the
cluster size.  Lift this requirement by zero-padding the final cluster
when necessary.  The virtual disk size is still not cluster-aligned, so
the guest cannot access the zero sectors.
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

Fix failures to compile introduced by recent console commits
1dbfa005, 81c0d5a6) which removed is_graphic_console() and
vga_hw_update() without updating the cocoa UI backend to match.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Reviewed-by: NGerd Hoffmann <kraxel@redhat.com>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

Fixed EFLAGS corruption by ROR r8/r16 instruction located at the end of the TB.
Signed-off-by: NPavel Dovgalyuk <pavel.dovgaluk@gmail.com>
Reviewed-by: NRichard Henderson <rth@twiddle.net>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

Drop all the infrastructure for taddr properties (ie ones which
are 'hwaddr' sized). These are now unused, and any further desired
use would be rather questionable since device properties shouldn't
generally depend on a type that is conceptually variable based on
the target CPU. 32 or 64 bit integer properties should be used instead
as appropriate for the specific device.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

The sysbus-ohci dma-address property is declared as a HEX64
property, not a TADDR, so use the correct setter for it.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Acked-by: NAndreas Färber <afaerber@suse.de>
Tested-by: NAurelien Jarno <aurelien@aurel32.net>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

* 'arm-devs.next' of git://git.linaro.org/people/pmaydell/qemu-arm:
  hw/versatile_pci: Drop unnecessary vpb_pci_config_addr()
  versatile_pci: Expose PCI memory space to system
  arm/realview: Fix mapping of PCI regions
  versatile_pci: Implement the PCI controller's control registers
  versatile_pci: Implement the correct PCI IRQ mapping
  versatile_pci: Put the host bridge PCI device at slot 29
  versatile_pci: Use separate PCI I/O space rather than system I/O space
  versatile_pci: Change to subclassing TYPE_PCI_HOST_BRIDGE
  versatile_pci: Update to realize and instance init functions
  versatile_pci: Expose PCI I/O region on Versatile PB
  versatile_pci: Fix hardcoded tabs