When loading an internal snapshot whose L1 table is smaller than the current L1
table, the size of the current L1 would be shrunk to the snapshot's L1 size in
memory, but not on disk. This lead to incorrect refcount updates and eventuelly
to image corruption.

Instead of writing the new L1 size to disk, this simply retains the bigger L1
size that is currently in use and makes sure that the unused part is zeroed.
Signed-off-by: NKevin Wolf <kwolf@redhat.com>
Tested-by: NPhilipp Hahn <hahn@univention.de>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

QAPI will require glib/python, but for now the guest agent is the only
user. For now, make these dependencies an explicit guest agent one, and
give users the option to disable it if need be.

Once QAPI is adopted in core QEMU code, we would basically revert this
patch.
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Signed-off-by: NBrad Smith <brad@comstyle.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

The system emulation code was not merged before the branch.
Let's leave that work for the next release.
Signed-off-by: NRichard Henderson <rth@twiddle.net>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

With vhost_net="" (most non-Linux hosts), configure prints an
error message:

test: 2551: =: unexpected operator

Fix this and similar code by adding the missing "".

Cc: Wolfgang Mauerer <wolfgang.mauerer@siemens.com>
Cc: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
Reviewed-by: NStefan Hajnoczi <stefanha@linux.vnet.ibm.com>
Signed-off-by: NStefan Weil <weil@mail.berlios.de>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Migrating after unplugging a virtio-balloon device resulted in an error
message on the destination:

Unknown savevm section or instance '0000:00:04.0/virtio-balloon' 0
load of migration failed

Fix this by unregistering the section on device unplug.
Signed-off-by: NAmit Shah <amit.shah@redhat.com>
Reviewed-by: NMarkus Armbruster <armbru@redhat.com>
Acked-by: NMichael S. Tsirkin <mst@redhat.com>

Add an exit handler that will free up RAM after a virtio-balloon device
is unplugged.
Signed-off-by: NAmit Shah <amit.shah@redhat.com>
Reviewed-by: NMarkus Armbruster <armbru@redhat.com>
Acked-by: NMichael S. Tsirkin <mst@redhat.com>

Negative balloon values don't make sense, reject them and throw a qerror
with QERR_INVALID_PARAMETER_VALUE.
Reported-by: NMike Cao <bcao@redhat.com>
Signed-off-by: NAmit Shah <amit.shah@redhat.com>
Reviewed-by: NMarkus Armbruster <armbru@redhat.com>
Acked-by: NMichael S. Tsirkin <mst@redhat.com>

Multiple balloon registrations are not allowed; check if the
registration with the qemu balloon api succeeded.  If not, fail the
device init.
Signed-off-by: NAmit Shah <amit.shah@redhat.com>
Reviewed-by: NMarkus Armbruster <armbru@redhat.com>
Acked-by: NMichael S. Tsirkin <mst@redhat.com>

Multiple balloon devices don't make sense; disallow more than one
registration attempt to register handlers.
Signed-off-by: NAmit Shah <amit.shah@redhat.com>
Reviewed-by: NMarkus Armbruster <armbru@redhat.com>
Acked-by: NMichael S. Tsirkin <mst@redhat.com>

Signed-off-by: NAmit Shah <amit.shah@redhat.com>

Signed-off-by: NAmit Shah <amit.shah@redhat.com>

Passing on '0' as ballooning target to indicate retrieval of stats is
bad API.  It also makes 'balloon 0' in the monitor cause a segfault.
Have two different functions handle the different functionality instead.

Detailed explanation from Markus's review:

1. do_info_balloon() is an info_async() method.  It receives a callback
   with argument, to be called exactly once (callback frees the
   argument).  It passes the callback via qemu_balloon_status() and
   indirectly through qemu_balloon_event to virtio_balloon_to_target().

   virtio_balloon_to_target() executes its balloon stats half.  It
   stores the callback in the device state.

   If it can't send a stats request, it resets stats and calls the
   callback right away.

   Else, it sends a stats request.  The device model runs the callback
   when it receives the answer.

   Works.

2. do_balloon() is a cmd_async() method.  It receives a callback with
   argument, to be called when the command completes.  do_balloon()
   calls it right before it succeeds.  Odd, but should work.

   Nevertheless, it passes the callback on via qemu_ballon() and
   indirectly through qemu_balloon_event to virtio_balloon_to_target().

   a. If the argument is non-zero, virtio_balloon_to_target() executes
      its balloon half, which doesn't use the callback in any way.

      Odd, but works.

   b. If the argument is zero, virtio_balloon_to_target() executes its
      balloon stats half, just like in 1.  It either calls the callback
      right away, or arranges for it to be called later.

      Thus, the callback runs twice: use after free and double free.

Test case: start with -S -device virtio-balloon, execute "balloon 0" in
human monitor.  Runs the callback first from virtio_balloon_to_target(),
then again from do_balloon().
Reported-by: NMike Cao <bcao@redhat.com>
Signed-off-by: NAmit Shah <amit.shah@redhat.com>
Reviewed-by: NMarkus Armbruster <armbru@redhat.com>

Separate out the code to retrieve balloon info from the code that sets
balloon values.

This will be used to separate the two callbacks from balloon.c and help
cope with 'balloon 0' on the monitor.  Currently, 'balloon 0' causes a
segfault in monitor_resume().
Signed-off-by: NAmit Shah <amit.shah@redhat.com>
Reviewed-by: NMarkus Armbruster <armbru@redhat.com>

Replace:
  if (foo) {
    ...
  } else {
    return 0;
  }

by

  if (!foo) {
    return 0;
  }
  ...
Signed-off-by: NAmit Shah <amit.shah@redhat.com>
Reviewed-by: NMarkus Armbruster <armbru@redhat.com>

Signed-off-by: NAmit Shah <amit.shah@redhat.com>
Reviewed-by: NMarkus Armbruster <armbru@redhat.com>

balloon.h had function declarations for a couple of functions that are
local to balloon.c.  Make them static.

Drop the 'qemu_' prefix for balloon.c-local variables, and make them
static.
Signed-off-by: NAmit Shah <amit.shah@redhat.com>
Reviewed-by: NMarkus Armbruster <armbru@redhat.com>

Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Almost pure code motion.  Unstatic hid interface functions and add
them to the header file.  Some renames.  Some code style cleanups.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Add hid_has_events function, use it to figure whenever there are pending
events instead of checking and updating USBHIDState->changed.

Setting ->changed to 1 on init is removed, that should have absolutely
no effect as the initial state of ->idle is 0 so we report hid state
anyway until the guest configures some idle time.  Also should clear
->idle on reset.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Add callback for event notification, which allows to un-usbify more
functions.  Also split separate hid_* functions for reset and release.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

First step in separating out the HID emulation code from usb-hid, so it
can be reused without creating a dummy usb device like bluetooth does.

This creates a HIDState struct, moves the non-usbish fields from
USBHIDStruct there.  Renames non-usbish structs, defines and functions
from usb* to hid*.  Adapts the code to that.

Also cleans up a bunch of code style issues along the way.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Map guest memory and pass on a direct pointer instead of copying
the bits to a indirect buffer.  EHCI transfer descriptors can
reference multiple (physical guest) pages so we'll actually start
seeing usb packets wich carry iovec with more than one element.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Map guest memory and pass on a direct pointer instead of copying
the bits to a indirect buffer.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Add full iovec support to usb-storage.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Add full support for iovecs to usb-host.  The code can split large
transfers into smaller ones already, we are using this to also split
requests at iovec borders.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Add full support for iovecs to usb-serial.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Zap data pointer from USBPacket, add a QEMUIOVector instead.
Add a bunch of helper functions to manage USBPacket data.
Switch over users to the new interface.

Note that USBPacket->len was used for two purposes:  First to
pass in the buffer size and second to return the number of
transfered bytes or the status code on async transfers.  There
is a new result variable for the latter.  A new status code
was added to catch uninitialized result.

Nobody creates iovecs with more than one element (yet).
Some users are (temporarely) limited to iovecs with a single
element to keep the patch size as small as possible.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Move the QEMUSGList typedef to qemu-common so it can easily be used.
The actual struct definition stays in dma.h.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Fill the spefified area with zeros.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Useful for debugging purposes.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

A bunch of code was disabled via #if 0, for a quite long time (since
Sept 2009).  Surprisingly the code builds just fine when they are
removed (tested on OpenBSD).  /me wonders nevertheless whenever there
are any users of those bits when this went unnoticed for almost two
years ...
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>