Always free them in the iscsi_aio_*_acb functions and remove the
checks in their callers.  Remove ifs when the task struct was
previously dereferenced (spotted by Coverity).

Cc: qemu-stable@nongnu.org
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

Coverity picked up a copy-paste bug.  In vhost_scsi_start() we check for
!k->set_guest_notifiers and error out.  The check probably got copied
but instead of erroring we actually use the function pointer!

Cc: Nicholas Bellinger <nab@linux-iscsi.org>
Cc: Asias He <asias@redhat.com>
Cc: qemu-stable@nongnu.org
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

This patch adds a new SCSI_DISK_F_NO_REMOVABLE_DEVOPS feature. By this
feature we can set that the scsi-block (scsi pass-through) device will still
be removable from the guest side, but from monitor it cannot be removed.

Cc: qemu-stable@nongnu.org
Signed-off-by: NPavel Hrdina <phrdina@redhat.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

This fixes the bug introduced by this commit ad54ae80.
The bdrv_aio_ioctl() still could return null and we should return an error
in that case.

Cc: qemu-stable@nongnu.org
Signed-off-by: NPavel Hrdina <phrdina@redhat.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

Issuing the READ CAPACITY(10) command in the guest will cause QEMU
to update its knowledge of the maximum accessible LBA in the disk.
The recorded maximum LBA will be wrong if the disk is bigger than
1TB, because ldl_be_p returns a signed int.

When this is fixed, a latent bug will be unmasked.  If the READ
CAPACITY(10) command reported an overflow (0xFFFFFFFF), we must
not overwrite the previously-known maximum accessible LBA, or the guest
will fail to access the disk above the first 2TB.

Cc: qemu-stable@nongnu.org
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

Tray statuses should be also reset. Some guests may lock the tray and
right after resetting the guest it should be unlocked and closed. This
is done on power-on, reset and resume from suspend/hibernate on bare-metal.

This fix is already committed for IDE CD.
Check the commit a7f3d65b.

Test results on bare-metal:
  - on reset/power-on the CD-ROM tray is closed even before the monitor
    is turned on
  - on resume from suspend/hibernate the tray is also closed before
    the monitor is turned on

From test results it seems that this behavior is OS and probably BIOS
independent.

Cc: qemu-stable@nongnu.org
Signed-off-by: NPavel Hrdina <phrdina@redhat.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

This is a little strange. It is lowering the parent IRQ pin on input
when HIE is cleared. There is no such behaviour in the real hardware.

ISR changes based on interrupt pin state are already guarded on HIE
being set. So we can just delete this if in its entirety.
Signed-off-by: NPeter Crosthwaite <peter.crosthwaite@xilinx.com>
Signed-off-by: NEdgar E. Iglesias <edgar.iglesias@gmail.com>

When the Hardware Interrupt Enable (HIE) bit is set, software cannot
change ISR. Add write guard accordingly.
Signed-off-by: NPeter Crosthwaite <peter.crosthwaite@xilinx.com>
Signed-off-by: NEdgar E. Iglesias <edgar.iglesias@gmail.com>

Acking a level sensitive interrupt should have no effect if the
interrupt pin is still asserted. The current implementation requires
and edge condition to occur for setting a level sensitive IRQ, which
means an ACK can clear a level sensitive interrupt, until the original
source strobes the interrupt again.

Fix by keeping track of the interrupt pin state and setting ISR based
on this every time update_irq() is called.
Signed-off-by: NPeter Crosthwaite <peter.crosthwaite@xilinx.com>
Signed-off-by: NEdgar E. Iglesias <edgar.iglesias@gmail.com>

For level sensitive interrupts, ISR bits are cleared when the input pin
is lowered. This is incorrect. Only software can clear ISR bits (via
IAR or direct write to ISR with !MER(2)).
Signed-off-by: NPeter Crosthwaite <peter.crosthwaite@xilinx.com>
Signed-off-by: NEdgar E. Iglesias <edgar.iglesias@gmail.com>

The UART IRQ is edge sensitive, whereas the machine was registering it
as level sensitive. Fix.
Signed-off-by: NPeter Crosthwaite <peter.crosthwaite@xilinx.com>
Signed-off-by: NEdgar E. Iglesias <edgar.iglesias@gmail.com>

# By Luiz Capitulino
# Via Luiz Capitulino
* luiz/queue/qmp:
  qerror: drop QERR_OPEN_FILE_FAILED macro
  block: bdrv_reopen_prepare(): don't use QERR_OPEN_FILE_FAILED
  savevm: qmp_xen_save_devices_state(): use error_setg_file_open()
  dump: qmp_dump_guest_memory(): use error_setg_file_open()
  cpus: use error_setg_file_open()
  blockdev: use error_setg_file_open()
  block: mirror_complete(): use error_setg_file_open()
  rng-random: use error_setg_file_open()
  error: add error_setg_file_open() helper

Message-id: 1371484631-29510-1-git-send-email-lcapitulino@redhat.com
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

# By Liu Yuan (2) and others
# Via Kevin Wolf
* kwolf/for-anthony:
  vmdk: Allow reading variable size descriptor files
  NVMe: Initial commit for new storage interface
  curl: Don't set curl options on the handle just before it's going to be deleted.
  vmdk: byteswap VMDK4Header.desc_offset field
  block/curl.c: Refuse to open the handle for writes.
  sheepdog: support 'qemu-img snapshot -a'
  sheepdog: fix snapshot tag initialization

Message-id: 1371486710-17793-1-git-send-email-kwolf@redhat.com
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

# By Anton Blanchard
# Via Richard Henderson
* rth/fix-ppc64:
  tcg-ppc64: rotr_i32 rotates wrong amount
  tcg-ppc64: Fix add2_i64
  tcg-ppc64: bswap64 rotates output 32 bits
  tcg-ppc64: Fix RLDCL opcode

Message-id: 1371491129-30246-1-git-send-email-rth@twiddle.net
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

rotr_i32 calculates the amount to left shift and puts it into a
temporary, but then doesn't use it when doing the shift.

Cc: qemu-stable@nongnu.org
Signed-off-by: NAnton Blanchard <anton@samba.org>
Signed-off-by: NRichard Henderson <rth@twiddle.net>

add2_i64 was adding the lower double word to the upper double word
of each input. Fix this so we add the lower double words, then the
upper double words with carry propagation.

Cc: qemu-stable@nongnu.org
Signed-off-by: NAnton Blanchard <anton@samba.org>
Signed-off-by: NRichard Henderson <rth@twiddle.net>

If our input and output is in the same register, bswap64 tries to
undo a rotate of the input. This just ends up rotating the output.

Cc: qemu-stable@nongnu.org
Signed-off-by: NAnton Blanchard <anton@samba.org>
Signed-off-by: NRichard Henderson <rth@twiddle.net>

The rldcl instruction doesn't have an sh field, so the minor opcode
is shifted 1 bit. We were using the XO30 macro which shifted the
minor opcode 2 bits.

Remove XO30 and add MD30 and MDS30 macros which match the
Power ISA categories.

Cc: qemu-stable@nongnu.org
Signed-off-by: NAnton Blanchard <anton@samba.org>
Signed-off-by: NRichard Henderson <rth@twiddle.net>

the hard-coded 2k buffer on the stack won't allow reading big descriptor
files which can be generated when storing big images. For example 500G
vmdk splitted to 2G chunks.
Signed-off-by: NEvgeny Budilovsky <evgeny.budilovsky@ravellosystems.com>
Reviewed-by: NStefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

Initial commit for emulated Non-Volatile-Memory Express (NVMe) pci
storage device.

NVMe is an open, industry driven storage specification defining
an optimized register and command set designed to deliver the full
capabilities of non-volatile memory on PCIe SSDs. Further information
may be found on the organizations website at:

http://www.nvmexpress.org/

This commit implements the minimum from the specification to work with
existing drivers.

Cc: Keith Busch <keith.busch@gmail.com>
Signed-off-by: NKeith Busch <keith.busch@intel.com>
Reviewed-by: NStefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

(Found by Kamil Dudka)
Signed-off-by: NRichard W.M. Jones <rjones@redhat.com>
Cc: Michael Tokarev <mjt@tls.msk.ru>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

Remember to byteswap VMDK4Header.desc_offset on big-endian machines.

Cc: qemu-stable@nongnu.org
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

Signed-off-by: NRichard W.M. Jones <rjones@redhat.com>
Signed-off-by: NFam Zheng <famz@redhat.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

Just call sd_create_branch() in the snapshot_goto to rollback the image is good
enough. With this patch, 'loadvm' process for sheepdog is modified:

Suppose we have a snapshot chain A --> B --> C, we do 'loadvm A' so as to get
a new chain,

A --> B
|
V
C1

in the old code:

1 reload inode of A (in snapshot_goto)
2 read vmstate via A's vdi_id (loadvm_state)
3 delete C and create C1, reload inode of C1 (sd_create_branch on write)

with this patch applied:

1 reload inode of A, delete C and create C1  (in snapshot_goto)
2 read vmstate via C1's parent, that is A's vdi_id (loadvm_state)

This will fix the possible bug that QEMU exit between 2 and 3 in the old code

Cc: qemu-devel@nongnu.org
Cc: MORITA Kazutaka <morita.kazutaka@lab.ntt.co.jp>
Cc: Kevin Wolf <kwolf@redhat.com>
Cc: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: NLiu Yuan <namei.unix@gmail.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

This is an old and obvious bug. We should pass snapshot_id to the
tag. Or simple command like 'qemu-img snapshot -a tag sheepdog:image' will fail

Cc: qemu-devel@nongnu.org
Cc: MORITA Kazutaka <morita.kazutaka@lab.ntt.co.jp>
Cc: Kevin Wolf <kwolf@redhat.com>
Cc: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: NKevin Wolf <kwolf@redhat.com>
Signed-off-by: NLiu Yuan <namei.unix@gmail.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

Not used since the last commit.
Signed-off-by: NLuiz Capitulino <lcapitulino@redhat.com>
Acked-by: NKevin Wolf <kwolf@redhat.com>

The call to drv->bdrv_reopen_prepare() can fail due to reasons
other than an open failure. Unfortunately, we can't use errno
nor -ret, cause they are not always set.

Stick to a generic error message then.
Signed-off-by: NLuiz Capitulino <lcapitulino@redhat.com>
Reviewed-by: NStefan Hajnoczi <stefanha@redhat.com>
Acked-by: NKevin Wolf <kwolf@redhat.com>

Signed-off-by: NLuiz Capitulino <lcapitulino@redhat.com>
Acked-by: NKevin Wolf <kwolf@redhat.com>

Signed-off-by: NLuiz Capitulino <lcapitulino@redhat.com>
Acked-by: NKevin Wolf <kwolf@redhat.com>

Signed-off-by: NLuiz Capitulino <lcapitulino@redhat.com>
Acked-by: NKevin Wolf <kwolf@redhat.com>

Signed-off-by: NLuiz Capitulino <lcapitulino@redhat.com>
Reviewed-by: NStefan Hajnoczi <stefanha@redhat.com>
Acked-by: NKevin Wolf <kwolf@redhat.com>

Signed-off-by: NLuiz Capitulino <lcapitulino@redhat.com>
Reviewed-by: NStefan Hajnoczi <stefanha@redhat.com>
Acked-by: NKevin Wolf <kwolf@redhat.com>

Signed-off-by: NLuiz Capitulino <lcapitulino@redhat.com>
Acked-by: NKevin Wolf <kwolf@redhat.com>

Signed-off-by: NLuiz Capitulino <lcapitulino@redhat.com>
Acked-by: NKevin Wolf <kwolf@redhat.com>

# By Paolo Bonzini (4) and others
# Via Peter Maydell
* pmaydell/configury.next:
  ppc: Remove CONFIG_FDT conditionals
  microblaze: Remove CONFIG_FDT conditionals
  arm: Remove CONFIG_FDT conditionals
  configure: Require libfdt for arm, ppc, microblaze softmmu targets
  configure: dtc: Probe for libfdt_env.h
  build: drop TARGET_TYPE
  main: use TARGET_ARCH only for the target-specific #define
  build: do not use TARGET_ARCH
  build: rename TARGET_ARCH2 to TARGET_NAME
  Add a stp file for usage from build directory

Message-id: 1371221594-11556-1-git-send-email-peter.maydell@linaro.org
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

# By Michael Tokarev (1) and Vladimir Senkov (1)
# Via Michael Tokarev
* mjt/trivial-patches:
  char/serial: fix copy&paste error (fifo8_is_full vs empty)
  vl: always define no_frame

Message-id: 1371455050-9523-1-git-send-email-mjt@msgid.tls.msk.ru
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Copy&paste error in serial.c causes a crash when attempting
to read from UART (if there is no data to be read)
Signed-off-by: NVladimir Senkov <hangup@gmail.com>
Reviewed-by: NPeter Crosthwaite <peter.crosthwaite@xilinx.com>
Signed-off-by: NMichael Tokarev <mjt@tls.msk.ru>

Commit 047d4e15 "Unbreak -no-quit for GTK, validate SDL options" broke
build of qemu without sdl, by referencing `no_frame' variable which is defined
inside #if SDL block.  Fix that by defining that variable unconditionally.

This is a better fix for the build issue introduced by that patch than
a revert.  This change keeps the new functinality introduced by that patch
and just fixes the compilation.  It still is not a complete fix around the
original issue (not working -no-frame et al with -display gtk), because it
makes only the legacy interface working, not the new suboption interface,
so a few more changes are needed.

Cc: Peter Wu <lekensteyn@gmail.com>
Cc: qemu-trivial@nongnu.org
Signed-off-by: NMichael Tokarev <mjt@tls.msk.ru>
Reviewed-by: NPeter Wu <lekensteyn@gmail.com>

With GTK 3, the function gdk_cursor_unref is deprecated:

qemu/ui/gtk.c: In function ‘gd_cursor_define’:
qemu/ui/gtk.c:380:5: error:
 ‘gdk_cursor_unref’ is deprecated (declared at /usr/include/gtk-3.0/gdk/gdkcursor.h:233): Use 'g_object_unref' instead [-Werror=deprecated-declarations]

Fix the gcc compiler warning by using conditional compilation.
Signed-off-by: NStefan Weil <sw@weilnetz.de>
Message-id: 1371391987-10795-1-git-send-email-sw@weilnetz.de
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Commit 047d4e15 "Unbreak -no-quit for GTK, validate SDL options" broke
build of qemu without sdl, by referencing `no_frame' variable which is defined
inside #if SDL block.  Fix that by defining that variable unconditionally.

This is a better fix for the build issue introduced by that patch than
a revert.  This change keeps the new functinality introduced by that patch
and just fixes the compilation.  It still is not a complete fix around the
original issue (not working -no-frame et al with -display gtk), because it
makes only the legacy interface working, not the new suboption interface,
so a few more changes are needed.

Cc: Peter Wu <lekensteyn@gmail.com>
Cc: qemu-trivial@nongnu.org
Signed-off-by: NMichael Tokarev <mjt@tls.msk.ru>
Reviewed-by: NPeter Wu <lekensteyn@gmail.com>
Tested-by: NAndreas Färber <afaerber@suse.de>
Message-id: 1371292923-28105-1-git-send-email-mjt@msgid.tls.msk.ru
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>