softfloat: fix floatx80 handling of NaN

The floatx80 format uses an explicit bit that should be taken into account
when converting to and from commonNaN format.

When converting to commonNaN, the explicit bit should be removed if it is
a 1, and a default NaN should be used if it is 0.

When converting from commonNan, the explicit bit should be added.

Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>

vmstate: port mac_dbdma

Signed-off-by: Juan Quintela <quintela@redhat.com>

mac_dbdma: create DBDMAState instead of passing one array around

Signed-off-by: Juan Quintela <quintela@redhat.com>

vmstate: port piix4

Signed-off-by: Juan Quintela <quintela@redhat.com>

piix4: create PIIX4State

It only contains a PCIDevice by know, but it makes easy to use migration code

Signed-off-by: Juan Quintela <quintela@redhat.com>

vmstate: port mac_nvram

Signed-off-by: Juan Quintela <quintela@redhat.com>

mac_nvram: size is a size, no need to be a target dependent type

Signed-off-by: Juan Quintela <quintela@redhat.com>

vmstate: port nand

Signed-off-by: Juan Quintela <quintela@redhat.com>

nand: pin values are uint8_t

Signed-off-by: Juan Quintela <quintela@redhat.com>

vmstate: port max111x

Signed-off-by: Juan Quintela <quintela@redhat.com>

max111x: input field is only used as uint8_t

Signed-off-by: Juan Quintela <quintela@redhat.com>

vmstate: port pxa2xx_lcd

Signed-off-by: Juan Quintela <quintela@redhat.com>

pxa2xx_lcd: up field is used as a bool and migrated as an uint8_t

Signed-off-by: Juan Quintela <quintela@redhat.com>

pxa2xx_lcd: name anonymous struct

Signed-off-by: Juan Quintela <quintela@redhat.com>

vmstate: stellaris use unused for placeholder entries

Signed-off-by: Juan Quintela <quintela@redhat.com>

vmstate: port stellaris gamepad

Signed-off-by: Juan Quintela <quintela@redhat.com>

vmstate: port syborg_keyboard

Signed-off-by: Juan Quintela <quintela@redhat.com>

vmstate: port syborg_serial

Signed-off-by: Juan Quintela <quintela@redhat.com>

vmstate: port stellaris_adc

Signed-off-by: Juan Quintela <quintela@redhat.com>

vmstate: port syborg_pointer

Signed-off-by: Juan Quintela <quintela@redhat.com>

vmstate: port ppc4xx_pci

Signed-off-by: Juan Quintela <quintela@redhat.com>

vmstate: port ppce500_pci

Signed-off-by: Juan Quintela <quintela@redhat.com>

vmstate: port pxa2xx_pm

Signed-off-by: Juan Quintela <quintela@redhat.com>

vmstate: port pxa2xx_mm

Signed-off-by: Juan Quintela <quintela@redhat.com>

vmstate: port pxa2xx_cm

Signed-off-by: Juan Quintela <quintela@redhat.com>

vmstate: port pxa2xx_i2s

Signed-off-by: Juan Quintela <quintela@redhat.com>

vmstate: port stellaris gptm

Signed-off-by: Juan Quintela <quintela@redhat.com>

vmstate: port cuda

Signed-off-by: Juan Quintela <quintela@redhat.com>

vmstate: port heathrow_pic

Signed-off-by: Juan Quintela <quintela@redhat.com>

vmstate: port pl022 ssp

Signed-off-by: Juan Quintela <quintela@redhat.com>

vmstate: port stellaris sys

Signed-off-by: Juan Quintela <quintela@redhat.com>

vmstate: port stellaris ssi bus

Signed-off-by: Juan Quintela <quintela@redhat.com>

vmstate: port stellaris i2c

Signed-off-by: Juan Quintela <quintela@redhat.com>

vmstate: port armv7m nvic

Signed-off-by: Juan Quintela <quintela@redhat.com>

vmstate: port pl011

Signed-off-by: Juan Quintela <quintela@redhat.com>

vmstate: port pxa2xx_keypad

Signed-off-by: Juan Quintela <quintela@redhat.com>

vmstate: port syborg_rtc

Signed-off-by: Juan Quintela <quintela@redhat.com>

vmstate: port pmtimer

It was a half conversion.  Finish it.
enabled can only get values of 0, 1 or 2, was declared as an int but
sent as an unint8_t, change its type.

Signed-off-by: Juan Quintela <quintela@redhat.com>

vmstate: port sysborg_timer

Signed-off-by: Juan Quintela <quintela@redhat.com>

vmstate: port arm_timer

Signed-off-by: Juan Quintela <quintela@redhat.com>

vmstate: port arm sp804

Signed-off-by: Juan Quintela <quintela@redhat.com>

vmstate: port mipsnet

Signed-off-by: Juan Quintela <quintela@redhat.com>

vmstate: port m48t59

Signed-off-by: Juan Quintela <quintela@redhat.com>

vmstate: port ads7846

Signed-off-by: Juan Quintela <quintela@redhat.com>

vmstate: port adb_mouse

Signed-off-by: Juan Quintela <quintela@redhat.com>

vmstate: port adb_kbd

Signed-off-by: Juan Quintela <quintela@redhat.com>

target-arm: Set Invalid flag for NaN in float-to-int conversions

When we catch the special case of an input NaN in ARM float to int
helper functions, set the Invalid flag as well as returning the
correct result.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>

hw/arm_boot.c: move initrd load address up to accommodate large kernels

Newer kernels are large enough that they can overlap the address
where qemu places the initrd. Move the initrd up so that there is
enough space for the kernel again.

Unfortunately it's not possible to automatically determine the
size of the kernel if it is compressed, so this is the best we
can do.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>

Basic implementation of Sharp Zaurus SL-5500 collie PDA

Add very basic implementation of collie PDA emulation. The system lacks
LoCoMo and graphics/sound emulation. Linux kernel boots up to mounting
rootfs (theoretically it can be provided in pflash images).

Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>

Implement basic part of SA-1110/SA-1100

Basic implementation of DEC/Intel SA-1100/SA-1110 chips emulation.
Implemented:
 - IRQs
 - GPIO
 - PPC
 - RTC
 - UARTs (no IrDA/etc.)
 - OST reused from pxa25x

Everything else is TODO (esp. PM/idle/sleep!) - see the todo in the
hw/strongarm.c

Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>

Remove unused function parameter from cpu_restore_state

The previous patch removed the need for parameter puc.
Is is now unused, so remove it.

Cc: Aurelien Jarno <aurelien@aurel32.net>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Stefan Weil <weil@mail.berlios.de>

Remove unused function parameters from gen_pc_load and rename the function

Function gen_pc_load was introduced in commit
d2856f1ad4c259e5766847c49acbb4e390731bd4.
The only reason for parameter searched_pc was
a debug statement in target-i386/translate.c.

Parameter puc was needed by target-sparc until
commit d7da2a10402f1644128b66414ca8f86bdea9ae7c.

Remove searched_pc from the debug statement and remove both
parameters from the parameter list of gen_pc_load.

As the function name gen_pc_load was also misleading,
it is now called restore_state_to_opc. This new name
was suggested by Peter Maydell, thanks.

v2: Remove last parameter, too, and rename the function.

v3: Fix [] typo in target-arm/translate.c.
    Fix wrong SHA1 object name in commit message (copy+paste error).

Cc: Aurelien Jarno <aurelien@aurel32.net>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Stefan Weil <weil@mail.berlios.de>

s390x: virtio machine storage keys

For emulation (and migration) we need to know about the guest's storage keys.
These are separate from actual RAM contents, so we need to allocate them in
parallel to RAM.

While touching the file, this patch also adjusts the hypercall function
to a new syntax that aligns better with tcg emulated code.

Signed-off-by: Alexander Graf <agraf@suse.de>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>

s390x: Dispatch interrupts to KVM or the real CPU

The KVM interrupt injection path is non-generic for now. So we need to push
knowledge of how to inject a device interrupt using KVM into the actual device
code.

Signed-off-by: Alexander Graf <agraf@suse.de>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>

s390x: Enable s390x-softmmu target

This patch adds some code paths for running s390x guest OSs without the
need for KVM.

Signed-off-by: Alexander Graf <agraf@suse.de>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>

s390x: Prepare cpu.h for emulation

We need to add some more logic to the CPU description to leverage emulation
of an s390x CPU. This patch adds all the required helpers, fields in CPUState
and constant definitions required for user and system emulation.

Signed-off-by: Alexander Graf <agraf@suse.de>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>

move helpers.h to helper.h

This provides a consistent naming scheme across all targets.

Signed-off-by: Lluís Vilanova <vilanova@ac.upc.edu>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>

libcacard: fix opposite usage of isspace

Signed-off-by: Alon Levy <alevy@redhat.com>
Tested-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>

target-mips: clear softfpu exception state for comparison instructions

MIPS FPU instructions should start with a clean softfpu status. This
is done for the most instructions, but not for comparison ones.

Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>

target-mips: fix c.ps.* instructions

Contrary to cabs.ps.* instructions, c.ps.* should not compare the absolute
value of the operand, but directly the operands.

Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>

target-mips: don't hardcode softfloat exception bits

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>

target-mips: simplify FP comparisons

As the softfloat comparison functions already test for NaN, there is no
need to always call the float*_unordered*() functions.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>

target-ppc: fix SPE comparison functions

efstst*() functions are fast SPE funtions which do not take into account
special values (infinites, NaN, etc.), while efscmp*() functions are
IEEE754 compliant.

Given that float32_*() functions are IEEE754 compliant, the efscmp*()
functions are correctly implemented, while efstst*() are not. This
patch reverse the implementation of this two groups of functions and
fix the comments. It also use float32_eq() instead of float32_eq_quiet()
as qNaNs should not be ignored.

Cc: Alexander Graf <agraf@suse.de>
Cc: Nathan Froyd <froydnj@codesourcery.com>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>

softfloat: improve description of comparison functions

Make clear for all comparison functions which ones trigger an exception
for all NaNs, and which one only for sNaNs.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>

softfloat: move float*_eq and float*_eq_quiet

I am not a big fan of code moving, but having the signaling version in
the middle of quiet versions and vice versa doesn't make the code easy
to read.

This patch is a simple code move, basically swapping locations of
float*_eq and float*_eq_quiet.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>

softfloat: rename float*_eq_signaling() into float*_eq()

float*_eq_signaling functions have a different semantics than other
comparison functions. Fix that by renaming float*_quiet_signaling() into
float*_eq().

Note that it is purely mechanical, and the behaviour should be unchanged.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>

softfloat: rename float*_eq() into float*_eq_quiet()

float*_eq functions have a different semantics than other comparison
functions. Fix that by first renaming float*_quiet() into float*_eq_quiet().

Note that it is purely mechanical, and the behaviour should be unchanged.
That said it clearly highlight problems due to this different semantics,
they are fixed later in this patch series.

Cc: Alexander Graf <agraf@suse.de>
Acked-by: Edgar E. Iglesias <edgar.iglesias@gmail.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>

target-i386: fix CMPUNORDPS/D and CMPORDPS/D instructions

SSE instructions CMPUNORDPS/D and CMPORDPS/D do not trigger an invalid
exception if operands are qNANs.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>

target-mips: use new float*_unordered*() functions

Use the new float*_unordered*() functions from softfloat instead of
redefining a private version.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>

target-alpha: use new float64_unordered_quiet() function

Use float64_unordered_quiet() in helper_cmptun() instead of doing the
the comparison manually.

According to the "Alpha Compiler Writer's Guide", we should use the
_quiet version here, as CMPTUN and CMPTEQ should generate InvalidOp
for SNaNs but not for QNaNs.

Thanks to Peter Maydell <peter.maydell@linaro.org> and Richard
Henderson <rth@twiddle.net> for digging into the manuals.

Acked-by: Richard Henderson <rth@twiddle.net>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>

softfloat-native: add float*_unordered_quiet() functions

Add float*_unordered_quiet() functions to march the softfloat versions.
As FPU status is not tracked with softfloat-native, they don't differ
from the signaling version.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>

softfloat: add float*_unordered_{,quiet}() functions

Add float*_unordered() functions to softfloat, matching the softfloat-native
ones. Also add float*_unordered_quiet() functions to match the others
comparison functions.

This allow target-i386/ops_sse.h to be compiled with softfloat.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>

target-i386: add floatx_{add,mul,sub} and use them

Add floatx_{add,mul,sub} defines, and use them instead of using direct
C operations.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>

target-i386: use float unions from cpu-all.h

Use float unions from cpu-all.h instead of redefining new (wrong for arm)
ones in target-i386. This also allows building cpu-exec.o with softfloat.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>

target-i386: use CPU_LDoubleU instead of a private union

Use CPU_LDoubleU in cpu_dump_state() instead of redefining a union for
doing the conversion.

Based on a patch from Laurent Vivier <laurent@vivier.eu>.

Cc: Laurent Vivier <laurent@vivier.eu>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>

cpu-all.h: define CPU_LDoubleU

Add a CPU_LDoubleU type, matching the floatx80 definition and the long
double type on x86 hosts.

Based on a patch from Laurent Vivier <laurent@vivier.eu>.

Cc: Laurent Vivier <laurent@vivier.eu>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>

softfloat: use GCC builtins to count the leading zeros

Softfloat has its own implementation to count the leading zeros. However
a lot of architectures have either a dedicated instruction or an
optimized to do that. When using GCC >= 3.4, this patch uses GCC builtins
instead of the handcoded implementation.

Note that I amware that QEMU_GNUC_PREREQ is defined in osdep.h and that
clz32() and clz64() are defined in host-utils.h, but I think it is better
to keep the softfloat implementation self contained.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>

usb: fix spelling errors in usb-linux.c

Signed-off-by: Brad Hards <bradh@frogmouth.net>
Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>

usb: initialise data element in Linux USB_DISCONNECT ioctl

This isn't used, but leaving it empty causes valgrind noise.

Signed-off-by: Brad Hards <bradh@frogmouth.net>
Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>

usb: trivial spelling fixes

Signed-off-by: Brad Hards <bradh@frogmouth.net>
Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>

Makefile: Clean up after "make pdf"

Signed-off-by: Brad Hards <bradh@frogmouth.net>
Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>

Fix some typos in comments and documentation

helpfull -> helpful
usefull -> useful
cotrol -> control

and a grammar fix.

Signed-off-by: Stefan Weil <weil@mail.berlios.de>
Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>

migration: move some declarations to migration.h

Move a few migration related declarations to migration.h.

Signed-off-by: Blue Swirl <blauwirbel@gmail.com>

Move CPU related functions to cpus.h

Move declarations of CPU related functions to cpus.h. Adjust the only user.

Signed-off-by: Blue Swirl <blauwirbel@gmail.com>

Move clock related functions to qemu-timer.h

Move declarations for clock related functions from sysemu.h to qemu-timer.h.

Signed-off-by: Blue Swirl <blauwirbel@gmail.com>

Move generic or OS function declarations to qemu-common.h

Move generic or OS related function declarations and macro
TFR to qemu-common.h.

Move win32 include directives to qemu-os-win32.h. While moving,
also add #include <winsock2.h> to fix a recent mingw32
build breakage.

Signed-off-by: Blue Swirl <blauwirbel@gmail.com>

Use qemu-common.h or qemu-timer.h in place of sysemu.h

In some cases qemu-common.h or qemu-timer.h can be used in place
of sysemu.h.

Signed-off-by: Blue Swirl <blauwirbel@gmail.com>

Remove unused sysemu.h include directives

Remove unused sysemu.h include directives to speed up build
with the following patches.

Signed-off-by: Blue Swirl <blauwirbel@gmail.com>

json-lexer: fix conflict with mingw32 ERROR definition

The name ERROR is too generic, it conflicts with mingw32 ERROR definition.

Replace ERROR with IN_ERROR.

Signed-off-by: Blue Swirl <blauwirbel@gmail.com>

sparc: Fix assertion caused by empty memory slot with 0 byte

If the memory size given on the command line is equal to the
maximum size of memory defined by the hardware, there is no
"empty slot" after physical memory.

The following command

qemu-system-sparc -m 256

raised an assertion:
exec.c:2614: cpu_register_physical_memory_offset: Assertion `size' failed

This can be fixed either at the caller side (don't call empty_slot_init)
or in empty_slot_init (do nothing) when size == 0. The second solution
was choosen here because it is more robust.

Signed-off-by: Stefan Weil <weil@mail.berlios.de>

qemu_next_deadline should not consider host-time timers

It is purely for icount-based virtual timers.  And now that we got the
code right, rename the function to clarify the intended scope.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Tested-by: Edgar E. Iglesias <edgar.iglesias@gmail.com>
Signed-off-by: Edgar E. Iglesias <edgar.iglesias@gmail.com>

Revert wrong fixes for -icount in the iothread case

This reverts commits 225d02cd and c9f7383c.  While some parts of
the latter could be saved, I preferred a smooth, complete revert.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Tested-by: Edgar E. Iglesias <edgar.iglesias@gmail.com>
Signed-off-by: Edgar E. Iglesias <edgar.iglesias@gmail.com>

enable vm_clock to "warp" in the iothread+icount case

The previous patch however is not enough, because if the virtual CPU
goes to sleep waiting for a future timer interrupt to wake it up, qemu
deadlocks.  The timer interrupt never comes because time is driven by
icount, but the vCPU doesn't run any insns.

You could say that VCPUs should never go to sleep in icount
mode if there is a pending vm_clock timer; rather time should
just warp to the next vm_clock event with no sleep ever taking place.
Even better, you can sleep for some time related to the
time left until the next event, to avoid that the warps are too visible
externally; for example, you could be sending network packets continously
instead of every 100ms.

This is what this patch implements.  qemu_clock_warp is called: 1)
whenever a vm_clock timer is adjusted, to ensure the warp_timer is
synchronized; 2) at strategic points in the CPU thread, to make sure
the insn counter is synchronized before the CPU starts running.
In any case, the warp_timer is disabled while the CPU is running,
because the insn counter will then be making progress on its own.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Tested-by: Edgar E. Iglesias <edgar.iglesias@gmail.com>
Signed-off-by: Edgar E. Iglesias <edgar.iglesias@gmail.com>

really fix -icount in the iothread case

The correct fix for -icount is to consider the biggest difference
between iothread and non-iothread modes.  In the traditional model,
CPUs run _before_ the iothread calls select (or WaitForMultipleObjects
for Win32).  In the iothread model, CPUs run while the iothread
isn't holding the mutex, i.e. _during_ those same calls.

So, the iothread should always block as long as possible to let
the CPUs run smoothly---the timeout might as well be infinite---and
either the OS or the CPU thread itself will let the iothread know
when something happens.  At this point, the iothread wakes up and
interrupts the CPU.

This is exactly the approach that this patch takes: when cpu_exec_all
returns in -icount mode, and it is because a vm_clock deadline has
been met, it wakes up the iothread to process the timers.  This is
really the "bulk" of fixing icount.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Tested-by: Edgar E. Iglesias <edgar.iglesias@gmail.com>
Signed-off-by: Edgar E. Iglesias <edgar.iglesias@gmail.com>

tests/test-mmap.c: Check mmap() return value before using it

Correct the position of a "stop if MAP_FAILED" check in the mmap()
tests, so that if mmap() does fail we print a failure message
rather than segfaulting inside memcpy().

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Edgar E. Iglesias <edgar.iglesias@gmail.com>

target-arm: Don't overflow when calculating value for signed VABAL

In the VABAL instruction we take the absolute difference of two
values of size x and store it in a result of size 2x. This means
we have to be careful to calculate the absolute difference using
a wide enough type that we don't accidentally overflow.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>

Revert SeaBIOS change due to overzealous commit -a

Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>

lm32: fix build breakage due to uninitialized variable 'r'

gcc 4.5.2 correctly complains that r is potentially uninitialized in this
function.

Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>

vpc.c: Use get_option_parameter() does the search

Use get_option_parameter() to instead of duplicating the loop, and
use BDRV_SECTOR_SIZE to instead of 512

Signed-off-by: Mitnick Lyu <mitnick.lyu@gmail.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>

atapi: GESN: implement 'media' subcommand

Implement the 'media' sub-command of the GET_EVENT_STATUS_NOTIFICATION
command.  This helps us report tray open, tray closed, no media, media
present states to the guest.

Newer Linux kernels (2.6.38+) rely on this command to revalidate discs
after media change.

This patch also sends out tray open/closed status to the guest driver
when requested e.g. via the CDROM_DRIVE_STATUS ioctl (thanks Markus).
Without such notification, the guest and qemu's tray open/close status
was frequently out of sync, causing installers like Anaconda detecting
no disc instead of tray open, confusing them terribly.

Signed-off-by: Amit Shah <amit.shah@redhat.com>
Acked-by: Jes Sorensen <Jes.Sorensen@redhat.com>
Acked-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>