Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging

Block patches

# gpg: Signature made Mon 02 Jun 2014 14:56:00 BST using RSA key ID C88F2FD6
# gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>"

* remotes/kevin/tags/for-upstream:
  qemu-img: Report error even with --oformat=json
  vmdk: Fix local_err in vmdk_create
  block/raw-posix.c: Avoid nonstandard LONG_LONG_MAX
  qemu-img: Plug memory leak in convert command
  block/sheepdog: Plug memory leak in sd_snapshot_create()
  block/vvfat: Plug memory leak in read_directory()
  block/vvfat: Plug memory leak in check_directory_consistency()
  block/qapi: Plug memory leak in dump_qobject() case QTYPE_QERROR
  blockdev: Plug memory leak in drive_init()
  blockdev: Plug memory leak in blockdev_init()
  qemu-io: Don't print NULL when open without non-option arg fails
  qemu-io: Plug memory leak in open command
  qemu-io: Support multiple -o in open command
  block: Plug memory leak on brv_open_image() error path
  qcow2: Plug memory leak on qcow2_invalidate_cache() error paths
  block/vvfat: Plug memory leak in enable_write_target()
  qemu-img: Plug memory leak on block option help error path

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Revert "bsd-user: replace fprintf(stderr, ...) with error_report()"

This reverts commit 1fba509527beb74bdcf50bc07ad3cd8244ad9c61.

That commit converted various fprintf(stderr, ...) calls to
use error_report(); however none of these bsd-user files include
a header which gives a prototype for error_report, so this
causes compiler warnings. Since these are just straightforward
reporting of command line errors, we should handle these in the
obvious way by printing to stderr, as we do for linux-user.
There's no need to drag in the error-handling framework for this,
especially since user-mode doesn't have the "maybe we need to
send this to the monitor" issues system emulation does.

Acked-by: Michael Tokarev <mjt@tls.msk.ru>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

qemu-img: Report error even with --oformat=json

img_check() should report that the format of the given image does not
support checks even if JSON output is desired. JSON data is output to
stdout, as opposed to error messages, which are (in the case of
qemu-img) printed to stderr. Therefore, it is easy to distinguish
between the two.

Also, img_info() does already use error_report() for human-readable
messages even though JSON output is desired (through
collect_image_info_list()).

Signed-off-by: Max Reitz <mreitz@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>

vmdk: Fix local_err in vmdk_create

In vmdk_create and vmdk_create_extent, initialize local_err before using
it, and don't leak it on error.

Reported-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Fam Zheng <famz@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>

block/raw-posix.c: Avoid nonstandard LONG_LONG_MAX

In the MacOSX specific code in raw-posix.c we use the define
LONG_LONG_MAX. This is actually a non-standard pre-C99 define;
switch to using the standard LLONG_MAX instead.

This apparently fixes a compilation failure with certain
compiler/OS versions (though it is unclear which).

Reported-by: Peter Bartoli <peter@bartoli.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>

qemu-img: Plug memory leak in convert command

Introduced in commit 661a0f7.  Spotted by Coverity.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Benoit Canet <benoit@irqsave.net>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>

block/sheepdog: Plug memory leak in sd_snapshot_create()

Has always been leaky.  Spotted by Coverity.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Benoit Canet <benoit@irqsave.net>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>

block/vvfat: Plug memory leak in read_directory()

Has always been leaky.  Spotted by Coverity.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Benoit Canet <benoit@irqsave.net>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>

block/vvfat: Plug memory leak in check_directory_consistency()

On error path.  Introduced in commit a046433a.  Spotted by Coverity.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Benoit Canet <benoit@irqsave.net>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>

block/qapi: Plug memory leak in dump_qobject() case QTYPE_QERROR

Introduced in commit a8d8ecb.  Spotted by Coverity.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Benoit Canet <benoit@irqsave.net>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>

blockdev: Plug memory leak in drive_init()

bs_opts is leaked on all paths from its qdev_new() that don't got
through blockdev_init().  Add the missing QDECREF(), and zap bs_opts
after blockdev_init(), so the new QDECREF() does nothing when we go
through blockdev_init().

Leak introduced in commit f298d07.  Spotted by Coverity.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>

blockdev: Plug memory leak in blockdev_init()

blockdev_init() leaks bs_opts when qemu_opts_create() fails, i.e. when
the ID is bad.  Missed in commit ec9c10d.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Benoit Canet <benoit@irqsave.net>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>

qemu-io: Don't print NULL when open without non-option arg fails

Reproducer: "open -o a=b".  Broken in commit fd0fee3.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>

qemu-io: Plug memory leak in open command

Introduced in commit b543c5c.  Spotted by Coverity.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>

qemu-io: Support multiple -o in open command

Instead of ignoring all option values but the last one, multiple -o
options now have the same meaning as having a single option with all
settings in the order of their respective -o options.

Same as commit 2dc8328 for qemu-img convert, except here we do it with
QemuOpts rather than QEMUOptionParameter.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Benoit Canet <benoit@irqsave.net>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>

block: Plug memory leak on brv_open_image() error path

Introduced in commit da557a.  Spotted by Coverity.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Benoit Canet <benoit@irqsave.net>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>

qcow2: Plug memory leak on qcow2_invalidate_cache() error paths

Introduced in commit 5a8a30d.  Spotted by Coverity.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Benoit Canet <benoit@irqsave.net>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>

block/vvfat: Plug memory leak in enable_write_target()

I figure the leak originated in bdrv_create2(), and was duplicated
into callers when commit 91a073a dropped that function.  Looks like
the other places have since been fixed.

Spotted by Coverity.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Benoit Canet <benoit@irqsave.net>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>

qemu-img: Plug memory leak on block option help error path

Introduced in commit a283cb6; mostly harmless.  Spotted by Coverity.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Benoit Canet <benoit@irqsave.net>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>

Merge remote-tracking branch 'remotes/afaerber/tags/qom-devices-for-peter' into staging

QOM/QTest infrastructure fixes and device conversions

* qom-test extension
* QEMUMachineInitArgs conversion to MachineState
* -machine options turned into /machine properties
* Named GPIO IRQs for devices

# gpg: Signature made Wed 28 May 2014 18:24:04 BST using RSA key ID 3E7E013F
# gpg: Can't check signature: public key not found

* remotes/afaerber/tags/qom-devices-for-peter:
  ssi: Name the CS GPIO
  qdev: Implement named GPIOs
  machine: Make -machine opts properties of MachineState
  tests: Check empty QMP output visitor
  qapi: Avoid output visitor crashing if it encounters a NULL value
  vl.c: Do not set 'type' property in obj_set_property()
  machine: Conversion of QEMUMachineInitArgs to MachineState
  qom-test: Test qom-list on link<> properties

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Merge remote-tracking branch 'remotes/rth/tcg-next' into staging

* remotes/rth/tcg-next:
  tcg/optimize: Remember garbage high bits for 32-bit ops
  tcg/optimize: Move updating of gen_opc_buf into tcg_opt_gen_mov*
  tcg-sparc: Make debug_frame const
  tcg-s390: Make debug_frame const
  tcg-arm: Make debug_frame const
  tcg-aarch64: Make debug_frame const
  tcg-i386: Make debug_frame const
  tcg: Allow the debug_frame data structure to be constant
  tcg: Move size effects out of dh_arg
  tcg: Remove sizemask and flags arguments to tcg_gen_callN
  tcg: Save flags and computed sizemask in TCGHelperInfo
  tcg: Register the helper info struct rather than the name
  tcg: Move side effects out of dh_sizemask
  tcg: Inline tcg_gen_helperN
  tcg: Use helper-gen.h in tcg-op.h
  tcg: Push tcg-runtime routines into exec/helper-*
  tcg: Invert the inclusion of helper.h
  tcg: Optimize brcond2 and setcond2 ne/eq

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

tcg/optimize: Remember garbage high bits for 32-bit ops

For a 64-bit host, the high bits of a register after a 32-bit operation
are undefined.  Adjust the temps mask for all 32-bit ops to reflect that.

Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Richard Henderson <rth@twiddle.net>

tcg/optimize: Move updating of gen_opc_buf into tcg_opt_gen_mov*

No functional change, just reduce a bit of redundancy.

Signed-off-by: Richard Henderson <rth@twiddle.net>

tcg-sparc: Make debug_frame const

Signed-off-by: Richard Henderson <rth@twiddle.net>

tcg-s390: Make debug_frame const

Signed-off-by: Richard Henderson <rth@twiddle.net>

tcg-arm: Make debug_frame const

Signed-off-by: Richard Henderson <rth@twiddle.net>

tcg-aarch64: Make debug_frame const

Signed-off-by: Richard Henderson <rth@twiddle.net>

tcg-i386: Make debug_frame const

Signed-off-by: Richard Henderson <rth@twiddle.net>

tcg: Allow the debug_frame data structure to be constant

Adjust the FDE to point to the code_buffer after we've copied it
to the image, rather than requiring that the backend set it prior.
This allows the backend to use read-only storage for its data.

Signed-off-by: Richard Henderson <rth@twiddle.net>

tcg: Move size effects out of dh_arg

Tidying the initialization of the args arrays at the same time.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <rth@twiddle.net>

tcg: Remove sizemask and flags arguments to tcg_gen_callN

Take them from the TCGHelperInfo struct instead.

Signed-off-by: Richard Henderson <rth@twiddle.net>

tcg: Save flags and computed sizemask in TCGHelperInfo

Signed-off-by: Richard Henderson <rth@twiddle.net>

tcg: Register the helper info struct rather than the name

This will let us find all the info from the hash table.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <rth@twiddle.net>

tcg: Move side effects out of dh_sizemask

Moving them into dh_arg instead.

Signed-off-by: Richard Henderson <rth@twiddle.net>

tcg: Inline tcg_gen_helperN

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <rth@twiddle.net>

tcg: Use helper-gen.h in tcg-op.h

No need to open-code the setup of the builtin helpers.

Signed-off-by: Richard Henderson <rth@twiddle.net>

tcg: Push tcg-runtime routines into exec/helper-*

Rather than special casing them, use the standard mechanisms
for tcg helper generation.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <rth@twiddle.net>

tcg: Invert the inclusion of helper.h

Rather than include helper.h with N values of GEN_HELPER, include a
secondary file that sets up the macros to include helper.h.  This
minimizes the files that must be rebuilt when changing the macros
for file N.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <rth@twiddle.net>

tcg: Optimize brcond2 and setcond2 ne/eq

If either the high or low pair can be resolved, we can
simplify to either a constant or to a 32-bit comparison.

Signed-off-by: Richard Henderson <rth@twiddle.net>

ssi: Name the CS GPIO

To get it out of the default GPIO list. This allows child devices to
use the un-named GPIO namespace without having to be SSI aware. That
is, there is no more need for machines to know about the obscure
policy where GPIO 0 is the SSI chip-select and GPIO 1..N are the
concrete class GPIOs (defined locally as 0..N-1).

This is most notable in stellaris, which uses a device which has both
SSI and concrete level GPIOs.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
Signed-off-by: Andreas Färber <afaerber@suse.de>

qdev: Implement named GPIOs

Implement named GPIOs on the Device layer. Listifies the existing GPIOs
stuff using string keys. Legacy un-named GPIOs are preserved by using
a NULL name string - they are just a single matchable element in the
name list.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
Signed-off-by: Andreas Färber <afaerber@suse.de>

machine: Make -machine opts properties of MachineState

Make machine's QemuOpts QOM properties of /machine. The properties
are automatically filled in. This opens the possibility to create
opts per machine rather than global.

Signed-off-by: Marcel Apfelbaum <marcel.a@redhat.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Acked-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Signed-off-by: Andreas Färber <afaerber@suse.de>

tests: Check empty QMP output visitor

Checks the output visitor behaviour for NULL values.

Signed-off-by: Marcel Apfelbaum <marcel.a@redhat.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Acked-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Signed-off-by: Andreas Färber <afaerber@suse.de>

qapi: Avoid output visitor crashing if it encounters a NULL value

A NULL value is not added to visitor's stack, but there
is no check for that when the visitor tries to return
that value, leading to QEMU crash.

Reviewed-by: Eric Blake <eblake@redhat.com>
Acked-by: Luiz Capitulino <lcapitulino@redhat.com>
Signed-off-by: Marcel Apfelbaum <marcel.a@redhat.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Acked-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Signed-off-by: Andreas Färber <afaerber@suse.de>

vl.c: Do not set 'type' property in obj_set_property()

Filter out also 'type' property when setting
object's properties.

Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Marcel Apfelbaum <marcel.a@redhat.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Acked-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Signed-off-by: Andreas Färber <afaerber@suse.de>

machine: Conversion of QEMUMachineInitArgs to MachineState

Total removal of QEMUMachineInitArgs struct. QEMUMachineInitArgs's fields
are copied into MachineState. Removed duplicated fields from MachineState.

All the other changes are only mechanical refactoring, no semantic changes.

Signed-off-by: Marcel Apfelbaum <marcel.a@redhat.com>
Acked-by: Cornelia Huck <cornelia.huck@de.ibm.com> (s390)
Reviewed-by: Michael S. Tsirkin <mst@redhat.com> (PC)
[AF: Renamed ms -> machine, use MACHINE_GET_CLASS()]
Signed-off-by: Andreas Färber <afaerber@suse.de>

qom-test: Test qom-list on link<> properties

But don't test their properties, otherwise we will recurse forever.
Their properties are already tested when we encounter them as child<>
properties elsewhere in the hierarchy, like /machine/unattached/...

This would have caught the crash fixed by 92b3eead.

Signed-off-by: Cole Robinson <crobinso@redhat.com>
Signed-off-by: Andreas Färber <afaerber@suse.de>

Merge remote-tracking branch 'remotes/stefanha/tags/block-pull-request' into staging

Block pull request

# gpg: Signature made Wed 28 May 2014 13:31:15 BST using RSA key ID 81AB73C8
# gpg: Can't check signature: public key not found

* remotes/stefanha/tags/block-pull-request: (33 commits)
  block/sheepdog: Don't use qerror_report()
  block/sheepdog: Fix silent sd_open(), sd_create() failures
  block/sheepdog: Propagate errors to open and create methods
  block/sheepdog: Propagate errors through find_vdi_name()
  block/sheepdog: Propagate errors through do_sd_create()
  block/sheepdog: Propagate errors through sd_prealloc()
  block/sheepdog: Propagate errors through get_sheep_fd()
  block/sheepdog: Propagate errors through connect_to_sdog()
  block/vvfat: Propagate errors through init_directories()
  block/vvfat: Propagate errors through enable_write_target()
  block/ssh: Propagate errors to open and create methods
  block/ssh: Propagate errors through connect_to_ssh()
  block/ssh: Propagate errors through authenticate()
  block/ssh: Propagate errors through check_host_key()
  block/ssh: Drop superfluous libssh2_session_last_errno() calls
  block/rbd: Propagate errors to open and create methods
  qemu-nbd: Don't use qerror_report()
  blockdev: Don't use qerror_report() in do_drive_del()
  blockdev: Don't use qerror_report_err() in drive_init()
  docs: Define refcount_bits value
  ...

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20140527' into staging

target-arm:
 * Preliminary restructuring for EL2/EL3 support
 * improve CPACR handling
 * fix pxa2xx_lcd palette formats
 * update highbank/midway maintainer

# gpg: Signature made Tue 27 May 2014 17:26:27 BST using RSA key ID 14360CDE
# gpg: Can't check signature: public key not found

* remotes/pmaydell/tags/pull-target-arm-20140527: (26 commits)
  target-arm: A64: Register VBAR_EL3
  target-arm: A64: Register VBAR_EL2
  target-arm: Make vbar_write writeback to any CPREG
  target-arm: A64: Generalize update_spsel for the various ELs
  target-arm: A64: Generalize ERET to various ELs
  target-arm: A64: Trap ERET from EL0 at translation time
  target-arm: A64: Forbid ERET to higher or unimplemented ELs
  target-arm: Register EL3 versions of ELR and SPSR
  target-arm: Register EL2 versions of ELR and SPSR
  target-arm: Add a feature flag for EL3
  target-arm: Add a feature flag for EL2
  target-arm: A64: Introduce aarch64_banked_spsr_index()
  target-arm: Add SPSR entries for EL2/HYP and EL3/MON
  target-arm: A64: Add ELR entries for EL2 and 3
  target-arm: A64: Add SP entries for EL2 and 3
  target-arm: c12_vbar -> vbar_el[]
  target-arm: Make esr_el1 an array
  target-arm: Make elr_el1 an array
  target-arm: Use a 1:1 mapping between EL and MMU index
  target-arm: A32: Use get_mem_index for load/stores
  ...

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Merge remote-tracking branch 'remotes/xtensa/tags/20140526-xtensa' into staging

Xtensa fixes queue 2014-05-26:
- fix cross-page jumps/calls at the end of TB;
- add tests for TBs and instructions crossing page boundary.

# gpg: Signature made Mon 26 May 2014 09:37:39 BST using RSA key ID F83FA044
# gpg: Can't check signature: public key not found

* remotes/xtensa/tags/20140526-xtensa:
  target-xtensa: add tests for cross-page TB
  target-xtensa: completely clean TLB between MMU tests
  target-xtensa: fix cross-page jumps/calls at the end of TB

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Merge remote-tracking branch 'remotes/kraxel/tags/pull-usb-7' into staging

usb: usb3 streams support for usb-host and usb-redir
usb: xhci and mtp bugfixes.

# gpg: Signature made Mon 26 May 2014 09:44:09 BST using RSA key ID D3E87138
# gpg: Can't check signature: public key not found

* remotes/kraxel/tags/pull-usb-7:
  usb-host-libusb: Set stream id when submitting bulk-stream transfers
  usb-host-libusb: Add alloc / free streams ops
  usb-host-libusb: Fill in endpoint max_streams when available
  usb-redir: Add support for bulk streams
  usb-mtp: handle usb_mtp_get_object failure
  usb-mtp: handle lseek failure
  usb-mtp: use bool to track MTPObject init status
  xhci: add xhci_get_flag
  xhci: add endpoint cap on express bus only
  xhci: child detach fix

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

block/sheepdog: Don't use qerror_report()

qerror_report() is a transitional interface to help with converting
existing HMP commands to QMP.  It should not be used elsewhere.
Replace by error_report().

Cc: MORITA Kazutaka <morita.kazutaka@lab.ntt.co.jp>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

block/sheepdog: Fix silent sd_open(), sd_create() failures

Open and create methods must set an error when they fail.

Cc: MORITA Kazutaka <morita.kazutaka@lab.ntt.co.jp>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

block/sheepdog: Propagate errors to open and create methods

Completes the conversion to Error started in commit 015a103^..d5124c0,
except for a few bugs fixed in the next commit.

Cc: MORITA Kazutaka <morita.kazutaka@lab.ntt.co.jp>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

block/sheepdog: Propagate errors through find_vdi_name()

Cc: MORITA Kazutaka <morita.kazutaka@lab.ntt.co.jp>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

block/sheepdog: Propagate errors through do_sd_create()

Cc: MORITA Kazutaka <morita.kazutaka@lab.ntt.co.jp>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

block/sheepdog: Propagate errors through sd_prealloc()

Cc: MORITA Kazutaka <morita.kazutaka@lab.ntt.co.jp>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

block/sheepdog: Propagate errors through get_sheep_fd()

Cc: MORITA Kazutaka <morita.kazutaka@lab.ntt.co.jp>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

block/sheepdog: Propagate errors through connect_to_sdog()

Cc: MORITA Kazutaka <morita.kazutaka@lab.ntt.co.jp>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

block/vvfat: Propagate errors through init_directories()

Completes the conversion of the open method to Error started in commit
015a103.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

block/vvfat: Propagate errors through enable_write_target()

Continues the conversion of the open method to Error started in commit
015a103.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

block/ssh: Propagate errors to open and create methods

Completes the conversion to Error started in commit 015a103^..d5124c0.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Richard W.M. Jones <rjones@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

block/ssh: Propagate errors through connect_to_ssh()

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Richard W.M. Jones <rjones@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

block/ssh: Propagate errors through authenticate()

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Richard W.M. Jones <rjones@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

block/ssh: Propagate errors through check_host_key()

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Richard W.M. Jones <rjones@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

block/ssh: Drop superfluous libssh2_session_last_errno() calls

libssh2_session_last_error() already returns the error code.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Richard W.M. Jones <rjones@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

block/rbd: Propagate errors to open and create methods

Completes the conversion to Error started in commit 015a103^..d5124c0.

Cc: Josh Durgin <josh.durgin@inktank.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

qemu-nbd: Don't use qerror_report()

qerror_report() is a transitional interface to help with converting
existing HMP commands to QMP.  It should not be used elsewhere.
Replace by error_report().

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

blockdev: Don't use qerror_report() in do_drive_del()

qerror_report() is a transitional interface to help with converting
existing HMP commands to QMP.  It should not be used elsewhere.

do_drive_del() is an HMP command that won't be converted to QMP (we'll
create a new QMP command instead).  It uses both qerror_report() and
error_report().  Convert the former to the latter.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

blockdev: Don't use qerror_report_err() in drive_init()

qerror_report_err() is a transitional interface to help with
converting existing HMP commands to QMP.  It should not be used
elsewhere.

drive_init() is not meant to be used by QMP commands.  It uses both
qerror_report_err() and error_report().  Convert the former to the
latter.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

docs: Define refcount_bits value

The 'refcount_bits' term used in the description of refcount block entry is
not defined in the specification. The definition is added in the
'refcount_order' section where refcount_bits was used as 'width in bits'.

Signed-off-by: Maria Kustova <maria.k@catit.be>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

block: Drop redundant bdrv_refresh_limits

The above bdrv_set_backing_hd already does this.

Signed-off-by: Fam Zheng <famz@redhat.com>
Reviewed-by: Jeff Cody <jcody@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

block: Add backing_blocker in BlockDriverState

This makes use of op_blocker and blocks all the operations except for
commit target, on each BlockDriverState->backing_hd.

The asserts for op_blocker in bdrv_swap are removed because with this
change, the target of block commit has at least the backing blocker of
its child, so the assertion is not true. Callers should do their check.

Signed-off-by: Fam Zheng <famz@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

block: Use bdrv_set_backing_hd everywhere

We need to handle the coming backing_blocker properly, so don't open
code the assignment, instead, call bdrv_set_backing_hd to change
backing_hd.

Signed-off-by: Fam Zheng <famz@redhat.com>
Reviewed-by: Jeff Cody <jcody@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

block: Add bdrv_set_backing_hd()

This is the common but non-trivial steps to assign or change the
backing_hd of BDS.

Signed-off-by: Fam Zheng <famz@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Jeff Cody <jcody@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

block: Move op_blocker check from block_job_create to its caller

It makes no sense to check for "any" blocker on bs, we are here only
because of the mechanical conversion from in_use to op_blockers. Remove
it now, and let the callers check specific operation types. Backup and
mirror already have it, add checker to stream and commit.

Signed-off-by: Fam Zheng <famz@redhat.com>
Reviewed-by: Benoit Canet <benoit@irqsave.net>
Reviewed-by: Jeff Cody <jcody@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

block: Replace in_use with operation blocker

This drops BlockDriverState.in_use with op_blockers:

  - Call bdrv_op_block_all in place of bdrv_set_in_use(bs, 1).

  - Call bdrv_op_unblock_all in place of bdrv_set_in_use(bs, 0).

  - Check bdrv_op_is_blocked() in place of bdrv_in_use(bs).

    The specific types are used, e.g. in place of starting block backup,
    bdrv_op_is_blocked(bs, BLOCK_OP_TYPE_BACKUP, ...).

    There is one exception in block_job_create, where
    bdrv_op_blocker_is_empty() is used, because we don't know the operation
    type here. This doesn't matter because in a few commits away we will drop
    the check and move it to callers that _do_ know the type.

  - Check bdrv_op_blocker_is_empty() in place of assert(!bs->in_use).

Note: there is only bdrv_op_block_all and bdrv_op_unblock_all callers at
this moment. So although the checks are specific to op types, this
changes can still be seen as identical logic with previously with
in_use. The difference is error message are improved because of blocker
error info.

Signed-off-by: Fam Zheng <famz@redhat.com>
Reviewed-by: Jeff Cody <jcody@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

block: Introduce op_blockers to BlockDriverState

BlockDriverState.op_blockers is an array of lists with BLOCK_OP_TYPE_MAX
elements. Each list is a list of blockers of an operation type
(BlockOpType), that marks this BDS as currently blocked for a certain
type of operation with reason errors stored in the list. The rule of
usage is:

 * BDS user who wants to take an operation should check if there's any
   blocker of the type with bdrv_op_is_blocked().

 * BDS user who wants to block certain types of operation, should call
   bdrv_op_block (or bdrv_op_block_all to block all types of operations,
   which is similar to the existing bdrv_set_in_use()).

 * A blocker is only referenced by op_blockers, so the lifecycle is
   managed by caller, and shouldn't be lost until unblock, so typically
   a caller does these:

   - Allocate a blocker with error_setg or similar, call bdrv_op_block()
     to block some operations.
   - Hold the blocker, do his job.
   - Unblock operations that it blocked, with the same reason pointer
     passed to bdrv_op_unblock().
   - Release the blocker with error_free().

Signed-off-by: Fam Zheng <famz@redhat.com>
Reviewed-by: Benoit Canet <benoit@irqsave.net>
Reviewed-by: Jeff Cody <jcody@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

block: Add BlockOpType enum

This adds the enum of all the operations that can be taken on a block
device.

Signed-off-by: Fam Zheng <famz@redhat.com>
Reviewed-by: Benoit Canet <benoit@irqsave.net>
Reviewed-by: Jeff Cody <jcody@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

iotests: Use _img_info in test 089

Currently, test 089 uses $QEMU_IMG info manually in order to obtain the
according output. However, the iotests should generally use _img_info as
this filters out more irrelevant information such as the host image size
or format specific information. Therefore, test 089 should use _img_info
as well.

Signed-off-by: Max Reitz <mreitz@redhat.com>
Reported-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

aio: Fix use-after-free in cancellation path

The current flow of canceling a thread from THREAD_ACTIVE state is:

  1) Caller wants to cancel a request, so it calls thread_pool_cancel.

  2) thread_pool_cancel waits on the conditional variable
     elem->check_cancel.

  3) The worker thread changes state to THREAD_DONE once the task is
     done, and notifies elem->check_cancel to allow thread_pool_cancel
     to continue execution, and signals the notifier (pool->notifier) to
     allow callback function to be called later. But because of the
     global mutex, the notifier won't get processed until step 4) and 5)
     are done.

  4) thread_pool_cancel continues, leaving the notifier signaled, it
     just returns to caller.

  5) Caller thinks the request is already canceled successfully, so it
     releases any related data, such as freeing elem->common.opaque.

  6) In the next main loop iteration, the notifier handler,
     event_notifier_ready, is called. It finds the canceled thread in
     THREAD_DONE state, so calls elem->common.cb, with an (likely)
     dangling opaque pointer. This is a use-after-free.

Fix it by calling event_notifier_ready before leaving
thread_pool_cancel.

Test case update: This change will let cancel complete earlier than
test-thread-pool.c expects, so update the code to check this case: if
it's already done, done_cb sets .aiocb to NULL, skip calling
bdrv_aio_cancel on them.

Reported-by: Ulrich Obergfell <uobergfe@redhat.com>
Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Fam Zheng <famz@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

qcow2: Fix memory leak in COW error path

This triggers if bs->drv becomes NULL in a concurrent request. This is
currently only the case when corruption prevention kicks in (i.e. at
most once per image, and after that it produces I/O errors).

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

QemuOpt: add unit tests

Cover basic aspects and API usage for QemuOpt. The current implementation
covers the API's planned to be changed by Chunyan Liu in his QEMUOptionParameter
replacement/cleanup job.

Other APIs should be covered in future improvements.

[Squashing in a small fix "QemuOpt: use qemu_find_opts_err() to avoid
output on stderr in tests".

qemu_find_opts() calls error_report() instead of propagating the Error
object.  It is undesirable to clutter test case output with error
messages from a passing test.

Use qemu_find_opts_err() to avoid the output on stderr.
--Stefan]

Signed-off-by: Leandro Dorileo <l@dorileo.org>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

qemu-iotests: Handle cache mode option in 091

We should allow testing this on tmpfs. Any cache setting in iotests
should try to obey $CACHEMODE.

The cache mode is still "none" by default but overridable

Signed-off-by: Fam Zheng <famz@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

Merge remote-tracking branch 'remotes/kraxel/tags/pull-console-1' into staging

console: multiwindow support for text terminal QemuConsoles
console: small fixes

# gpg: Signature made Mon 26 May 2014 09:17:27 BST using RSA key ID D3E87138
# gpg: Can't check signature: public key not found

* remotes/kraxel/tags/pull-console-1:
  console: add kbd_put_keysym_console
  console: rework text terminal cursor logic
  console: update text terminal surface unconditionally
  console: nicer initial screen
  console: Abort on property access errors

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Merge remote-tracking branch 'remotes/kraxel/tags/pull-gtk-7' into staging

gtk: ui overhaul, multiwindow support.

# gpg: Signature made Mon 26 May 2014 08:54:55 BST using RSA key ID D3E87138
# gpg: Can't check signature: public key not found

* remotes/kraxel/tags/pull-gtk-7: (24 commits)
  gtk: workaround gtk2 vte resize issue
  gtk: window sizing overhaul
  gtk: zap unused global_state
  gtk: Add handling for the xfree86 keycodes
  gtk: enable untabify for gfx
  gtk: detached window pointer grabs
  gtk: update all windows on mouse mode changes
  gtk: fix grab checks
  gtk: update gd_update_caption
  gtk: skip keyboard grab when hover autograb is active
  gtk: keep track of grab owner
  gtk: add gd_grab trace event
  gtk: add tab to trace events
  gtk: allow moving tabs to windows and back.
  gtk: simplify resize
  gtk: use device type as label
  gtk: support multiple gfx displays
  gtk: move vga state into VirtualGfxConsole
  gtk: VirtualConsole restruction
  gtk: remove page numbering assumtions from the code
  ...

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Merge remote-tracking branch 'remotes/kraxel/tags/pull-input-9' into staging

input: add event routing and multiseat support.
input: misc bugfixes and minor improvements.

# gpg: Signature made Mon 26 May 2014 07:44:29 BST using RSA key ID D3E87138
# gpg: Can't check signature: public key not found

* remotes/kraxel/tags/pull-input-9:
  docs: add multiseat.txt
  usb: add input routing support for tablet and keyboard
  sdl: pass key event source to input layer
  input: bind devices and input routing
  input: switch hid mouse and tablet to the new input layer api.
  input: switch hid keyboard to new input layer api.
  input: keymap: add meta keys
  input: add name to input_event_key_number
  input: add qemu_input_key_number_to_qcode
  input (curses): mask keycodes to remove modifier bits

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Merge remote-tracking branch 'remotes/mjt/tags/trivial-patches-2014-05-26' into staging

trivial patches for 2014-05-26

# gpg: Signature made Mon 26 May 2014 08:17:08 BST using RSA key ID A4C3D7DB
# gpg: Can't check signature: public key not found

* remotes/mjt/tags/trivial-patches-2014-05-26: (23 commits)
  libcacard: remove useless initializers
  net: cadence_gem: Fix top comment
  bsd-user: replace fprintf(stderr, ...) with error_report()
  audio: replace fprintf(stderr, ...) with error_report() in audio
  libcacard: fix wrong array expansion logic
  libcacard/vcard_emul_nss: Drop a redundant conditional
  libcacard: Convert two leftover realloc() to GLib
  libcacard/vreader: Tighten assertion to clarify intent
  libcacard/vreader: Drop broken recovery from failed assertion
  libcacard: Plug memory leaks around vreader_get_reader_list()
  libcacard/vscclient: Bury some dead code
  vl: fix 'name' option to work with -readconfig
  configure: Put tempfiles in a subdir of the build directory
  dma-helpers: avoid calling dma_bdrv_unmap() twice
  arch_init: replace fprintf(stderr, ...) with error_report()
  pci: move dereferencing of root only after verifying valid root pointer
  jazz_led: Add missing break in switch case
  bswap.h: Rename ldl_p, stl_p, etc to ldl_he_p, stl_he_p, etc
  configure: Automatically select GTK+ 3.0 if GTK+ 2.0 is unavailable
  nbd: Miscellaneous typo fixes.
  ...

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Merge remote-tracking branch 'remotes/mwalle/tags/lm32-semihosting/20140524' into staging

* remotes/mwalle/tags/lm32-semihosting/20140524:
  lm32: remove lm32_sys
  test: lm32: use semihosting for testing
  target-lm32: add semihosting support
  test: lm32: make test cases independent

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Merge remote-tracking branch 'remotes/rth/tcg-mips' into staging

* remotes/rth/tcg-mips: (24 commits)
  tcg-mips: Enable direct chaining of TBs
  tcg-mips: Simplify movcond
  tcg-mips: Simplify brcond2
  tcg-mips: Improve setcond eq/ne vs zeros
  tcg-mips: Simplify setcond2
  tcg-mips: Simplify brcond
  tcg-mips: Simplify setcond
  tcg-mips: Commonize opcode implementations
  tcg-mips: Improve add2/sub2
  tcg-mips: Hoist args loads
  tcg-mips: Fix subtract immediate range
  tcg-mips: Name the opcode enumeration
  tcg-mips: Use EXT for AND on mips32r2
  tcg-mips: Use T9 for TCG_TMP1
  tcg-mips: Introduce TCG_TMP0, TCG_TMP1
  tcg-mips: Rearrange register allocation
  tcg-mips: Convert to new_ldst
  tcg-mips: Convert to new qemu_l/st helpers
  tcg-mips: Move softmmu slow path out of line
  tcg-mips: Split large ldst offsets
  ...

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

target-arm: A64: Register VBAR_EL3

Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Message-id: 1400980132-25949-24-git-send-email-edgar.iglesias@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

target-arm: A64: Register VBAR_EL2

Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Message-id: 1400980132-25949-23-git-send-email-edgar.iglesias@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

target-arm: Make vbar_write writeback to any CPREG

Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Message-id: 1400980132-25949-22-git-send-email-edgar.iglesias@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

target-arm: A64: Generalize update_spsel for the various ELs

Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Message-id: 1400980132-25949-21-git-send-email-edgar.iglesias@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

target-arm: A64: Generalize ERET to various ELs

Adds support for ERET to and from AArch64 EL2 and 3.

Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Message-id: 1400980132-25949-20-git-send-email-edgar.iglesias@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

target-arm: A64: Trap ERET from EL0 at translation time

Suggested-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Message-id: 1400980132-25949-19-git-send-email-edgar.iglesias@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

target-arm: A64: Forbid ERET to higher or unimplemented ELs

Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Message-id: 1400980132-25949-18-git-send-email-edgar.iglesias@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

target-arm: Register EL3 versions of ELR and SPSR

Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Message-id: 1400980132-25949-17-git-send-email-edgar.iglesias@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

target-arm: Register EL2 versions of ELR and SPSR

Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Message-id: 1400980132-25949-16-git-send-email-edgar.iglesias@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

target-arm: Add a feature flag for EL3

Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Message-id: 1400980132-25949-15-git-send-email-edgar.iglesias@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>