Not sending zero pages breaks migration if a page is zero
at the source but not at the destination. This can e.g. happen
if different BIOS versions are used at source and destination.
It has also been reported that migration on pseries is completely
broken with this patch.

This effectively reverts commit f1c72795.

Conflicts:

	arch_init.c
Signed-off-by: NPeter Lieven <pl@kamp.de>
Signed-off-by: NJuan Quintela <quintela@redhat.com>
(cherry picked from commit 9ef051e5)
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

When creating image with backing file, the driver tries to calculate the
relative path from created image file to backing file, but the path
computation is incorrect. e.g.:

    $ qemu-img create -f vmdk -b vmdk-data-disk.vmdk vmdk-data-snapshot1
    Formatting 'vmdk-data-snapshot1', fmt=vmdk size=10737418240
    backing_file='vmdk-data-disk.vmdk' compat6=off zeroed_grain=off

    $ qemu-img info vmdk-data-snapshot1
    image: vmdk-data-snapshot1
    file format: vmdk
    virtual size: 10G (10737418240 bytes)
    disk size: 12K
->  backing file: disk.vmdk

The common part in file names, "vmdk-data-", is incorrectly forgotten by
relative_path(). As the VMDK specification has no restriction on
parentNameHint to be relative path, we simply remove this by using the
backing_file option.

Cc: qemu-stable@nongnu.org
Signed-off-by: NFam Zheng <famz@redhat.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>
(cherry picked from commit 8ed610a1)
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

GlusterFS volumes can be backed by block devices, in which case
bdrv_create() doesn't make sure that the image is zeroed out. It is
currently not possibly to detect whether a given image is backed by a
file or a block device, and incorrectly assuming that it is zeroed
corrupts images during qemu-img convert, so let's err on the side of
caution and always return 0.

Cc: qemu-stable@nongnu.org
Signed-off-by: NKevin Wolf <kwolf@redhat.com>
(cherry picked from commit 8ab6feec)
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

If the remote is a regular file, set it to true (ie. reads of
uninitialized areas in a newly created file will return zeroes).
If we can't prove that, return false (a safe default).

Tested by adding a debugging print statement [not part of this commit]
and creating a remote file and a remote block device:

  $ ./qemu-img create ssh://localhost/tmp/new 100M
  Formatting 'ssh://localhost/tmp/new', fmt=raw size=104857600
  filename ssh://localhost/tmp/new: has_zero_init = 1
  $ sudo lvcreate -L 1G -n tmp /dev/fedora
    Logical volume "tmp" created
  $ ./qemu-img create ssh://localhost/dev/fedora/tmp 1G
  Formatting 'ssh://localhost/dev/fedora/tmp', fmt=raw size=1073741824
  filename ssh://localhost/dev/fedora/tmp: has_zero_init = 0

Cc: Kevin Wolf <kwolf@redhat.com>
Cc: qemu-stable@nongnu.org
Signed-off-by: NRichard W.M. Jones <rjones@redhat.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>
(cherry picked from commit 0b3f21e6)
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

Don't assume that SG_IO is always invoked with a simple buffer,
check the iovec_count and if it is >= 1 then we need to pass an array
of iovectors to libiscsi instead of just a plain buffer.
Signed-off-by: NRonnie Sahlberg <ronniesahlberg@gmail.com>
Cc: qemu-stable@nongnu.org
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit 0a53f010)
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

The latest ipl code adaptions collided with some of the virtio
refactoring rework. This resulted in always booting the first
disk. Let's fix booting from a given ID.
The new code also checks for command lines without bootindex to
avoid random behaviour when accessing dev_st (==0).
Signed-off-by: NChristian Borntraeger <borntraeger@de.ibm.com>
Reviewed-by: NAndreas Färber <afaerber@suse.de>
Signed-off-by: NAlexander Graf <agraf@suse.de>
(cherry picked from commit 5c8ded6e)
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

... like host-{linux,bsd}.c do.

Cc: qemu-stable@nongnu.org
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
(cherry picked from commit 628e5485)
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

Watch this:

    $ upstream-qemu -nodefaults -S -vnc :0,acl,sasl -monitor stdio
    QEMU 1.5.50 monitor - type 'help' for more information
    (qemu) acl_add vnc.username drei allow
    acl: added rule at position 1
    (qemu) acl_show vnc.username
    policy: deny
    1: allow drei
    (qemu) acl_add vnc.username zwei allow 1
    acl: added rule at position 2
    (qemu) acl_show vnc.username
    policy: deny
    1: allow drei
    2: allow zwei
    (qemu) acl_add vnc.username eins allow 1
    acl: added rule at position 1
    (qemu) acl_show vnc.username
    policy: deny
    1: allow eins
    2: allow drei
    3: allow zwei

The second acl_add inserts at position 2 instead of 1.

Root cause is an off-by-one in qemu_acl_insert(): when index ==
acl->nentries, it appends instead of inserting before the last list
element.

Cc: qemu-stable@nongnu.org
Signed-off-by: NMarkus Armbruster <armbru@redhat.com>
Reviewed-by: NMichael Roth <mdroth@linux.vnet.ibm.com>
Signed-off-by: NMichael Tokarev <mjt@tls.msk.ru>
(cherry picked from commit 4999f3a8)
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

This fix a bug with scsi hotplug on virtio-scsi-pci:

As virtio-scsi-pci doesn't have any scsi bus, we need to forward scsi-hot-add
to the virtio-scsi-device plugged on the virtio-bus.

Cc: qemu-stable@nongnu.org
Reported-by: NAlexey Kardashevskiy <aik@ozlabs.ru>
Reviewed-by: NAndreas Färber <afaerber@suse.de>
Signed-off-by: NKONRAD Frederic <fred.konrad@greensocs.com>
Acked-by: NMichael S. Tsirkin <mst@redhat.com>
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

The qxl driver expect NULL for QXLRam.memory_configs, but this is never
initialized.

If memory is set to 0xc2c2.., it leads to a spice-critical error when
trying to start qxl.
Signed-off-by: NAnthony PERARD <anthony.perard@citrix.com>
Reviewed-by: NGerd Hoffmann <kraxel@redhat.com>
Signed-off-by: NMichael Tokarev <mjt@tls.msk.ru>
(cherry picked from commit 329f97fc)
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

IABR SPR is already registered in gen_spr_603(), called from init_proc_603E().
Signed-off-by: NHervé Poussineau <hpoussin@reactos.org>
Reviewed-by: NAndreas Färber <afaerber@suse.de>
Signed-off-by: NAlexander Graf <agraf@suse.de>
(cherry picked from commit 9fea2ae2)
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

The dtb blob returned by load_device_tree() is in memory allocated
with g_malloc(). Free it accordingly once we have copied its
contents into the guest memory. To make this easy, we need also to
clean up the error handling in load_dtb() so that we consistently
handle errors in the same way (by printing a message and then
returning -1, rather than either plowing on or exiting immediately).
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Reviewed-by: NAndreas Färber <afaerber@suse.de>
Message-id: 1371209256-11408-1-git-send-email-peter.maydell@linaro.org
(cherry picked from commit c23045de)

Conflicts:

	hw/arm/boot.c

* updated to include #ifdef for CONFIG_FDT
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

On virtio reset we must reset the indicator to avoid stale interrupts,
e.g. after a reset.
Signed-off-by: NChristian Borntraeger <borntraeger@de.ibm.com>
Cc: qemu-stable@nongnu.org
Signed-off-by: NCornelia Huck <cornelia.huck@de.ibm.com>
(cherry picked from commit 6504a930)
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

Reported-by: NLev Veyde <lveyde@redhat.com>
Reviewed-by: NEric Blake <eblake@redhat.com>
Signed-off-by: NLaszlo Ersek <lersek@redhat.com>
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

Acked-by: NMichael Roth <mdroth@linux.vnet.ibm.com>
Reviewed-by: NEric Blake <eblake@redhat.com>
Signed-off-by: NLaszlo Ersek <lersek@redhat.com>
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

Acked-by: NMichael Roth <mdroth@linux.vnet.ibm.com>
Reviewed-by: NEric Blake <eblake@redhat.com>
Signed-off-by: NLaszlo Ersek <lersek@redhat.com>
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

If the user selects a non-default state directory at service installation
time, we should remember it in the registered service.
Signed-off-by: NLaszlo Ersek <lersek@redhat.com>
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>
(cherry picked from commit a839ee77)

* modified to save state_dir unconditionally an avoid reliance on
  uncommitted CSIDL_COMMON_APPDATA dependencies
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

We shouldn't snprintf() from a buffer to the same buffer.
Signed-off-by: NLaszlo Ersek <lersek@redhat.com>
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>
(cherry picked from commit a880845f)
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

When this VMSD was introduced it's version fields were set to
sizeof(I6300State), making them essentially random from build to build,
version to version.

To fix this, we lock in a high version id and low minimum version id to
support old->new migration from all prior versions of this device's
state. This should work since the device state has not changed since
its introduction.

The potentially breaks migration from 1.5+ to 1.5, but since the
versioning was essentially random prior to this patch, new->old
migration was not consistently functional to begin with.
Reported-by: NNicholas Thomas <nick@bytemark.co.uk>
Suggested-by: NPeter Maydell <peter.maydell@linaro.org>
Cc: qemu-stable@nongnu.org
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>
(cherry picked from commit c1990468)
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

'default_backend' isn't always set, but 'rng' is, so use that.

$ ./x86_64-softmmu/qemu-system-x86_64 -object rng-random,id=rng0,filename=/dev/random -device virtio-rng-pci,rng=rng0
Segmentation fault (core dumped)

Regressed with virtio refactoring in 59ccd20a

CC: qemu-stable@nongnu.org
Signed-off-by: NCole Robinson <crobinso@redhat.com>
Acked-by: NAmit Shah <amit.shah@redhat.com>
Acked-by: NMichael S. Tsirkin <mst@redhat.com>
Tested-by: NMichael Roth <mdroth@linux.vnet.ibm.com>
Message-id: bf4505014a0a941dbd3c62068f3cf2c496b69e6a.1370023944.git.crobinso@redhat.com
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>
(cherry picked from commit 5b456438)
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

Avoid the goto, and use the same retry logic for the 10- and 16-
byte versions.

Cc: qemu-stable@nongnu.org
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit 1288844e)
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

Always free them in the iscsi_aio_*_acb functions and remove the
checks in their callers.  Remove ifs when the task struct was
previously dereferenced (spotted by Coverity).

Cc: qemu-stable@nongnu.org
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit f0d2a4d4)
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

Coverity picked up a copy-paste bug.  In vhost_scsi_start() we check for
!k->set_guest_notifiers and error out.  The check probably got copied
but instead of erroring we actually use the function pointer!

Cc: Nicholas Bellinger <nab@linux-iscsi.org>
Cc: Asias He <asias@redhat.com>
Cc: qemu-stable@nongnu.org
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit 0e22a2d1)
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

This patch adds a new SCSI_DISK_F_NO_REMOVABLE_DEVOPS feature. By this
feature we can set that the scsi-block (scsi pass-through) device will still
be removable from the guest side, but from monitor it cannot be removed.

Cc: qemu-stable@nongnu.org
Signed-off-by: NPavel Hrdina <phrdina@redhat.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit 18e673b8)
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

This fixes the bug introduced by this commit ad54ae80.
The bdrv_aio_ioctl() still could return null and we should return an error
in that case.

Cc: qemu-stable@nongnu.org
Signed-off-by: NPavel Hrdina <phrdina@redhat.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit d836f8d3)
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

Issuing the READ CAPACITY(10) command in the guest will cause QEMU
to update its knowledge of the maximum accessible LBA in the disk.
The recorded maximum LBA will be wrong if the disk is bigger than
1TB, because ldl_be_p returns a signed int.

When this is fixed, a latent bug will be unmasked.  If the READ
CAPACITY(10) command reported an overflow (0xFFFFFFFF), we must
not overwrite the previously-known maximum accessible LBA, or the guest
will fail to access the disk above the first 2TB.

Cc: qemu-stable@nongnu.org
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit 53254e56)
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

Tray statuses should be also reset. Some guests may lock the tray and
right after resetting the guest it should be unlocked and closed. This
is done on power-on, reset and resume from suspend/hibernate on bare-metal.

This fix is already committed for IDE CD.
Check the commit a7f3d65b.

Test results on bare-metal:
  - on reset/power-on the CD-ROM tray is closed even before the monitor
    is turned on
  - on resume from suspend/hibernate the tray is also closed before
    the monitor is turned on

From test results it seems that this behavior is OS and probably BIOS
independent.

Cc: qemu-stable@nongnu.org
Signed-off-by: NPavel Hrdina <phrdina@redhat.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit 7721c7f7)
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

Otherwise they would get passed to getaddrinfo and fail with:
address resolution failed for [::1]🔢 Name or service not known

(Broken by commit v1.4.0-736-gf17c90be)
Signed-off-by: NJán Tomko <jtomko@redhat.com>
Cc: qemu-stable@nongnu.org
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit 23307908)
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

According to RFC 1123 [1], hostnames can start with a digit too.

[1] http://tools.ietf.org/html/rfc1123#page-13Signed-off-by: NJán Tomko <jtomko@redhat.com>
Cc: qemu-stable@nongnu.org
[Use strspn, not strcspn. - Paolo]
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit 391b7b97)
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

Remember to byteswap VMDK4Header.desc_offset on big-endian machines.

Cc: qemu-stable@nongnu.org
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>
(cherry picked from commit 5a394b9e)
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

Spotted by Coverity,
x86_reg_info_32[] is CPU_NB_REGS32 elements long, so accessing
x86_reg_info_32[CPU_NB_REGS32] will be one element off array.
Signed-off-by: NIgor Mammedov <imammedo@redhat.com>
Reviewed-by: Nliguang <lig.fnst@cn.fujitsu.com>
Reviewed by: Jesse Larrew <jlarrew@linux.vnet.ibm.com>
Signed-off-by: NAndreas Färber <afaerber@suse.de>
(cherry picked from commit 31ccdde2)
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

QMP command "{ 'execute': 'cpu-add', 'arguments': { 'id': -1 }}" may cause
QEMU SIGSEGV at:
 piix4_cpu_hotplug_req ()
    ...
    g->sts[cpu_id / 8] |= (1 << (cpu_id % 8));
    ...

Since for PC in current implementation id should be in range [0...maxcpus)
and maxcpus is already checked, add check for lower bound and error out
on incorrect value.
Signed-off-by: NIgor Mammedov <imammedo@redhat.com>
Signed-off-by: NAndreas Färber <afaerber@suse.de>
(cherry picked from commit 8de433cb)
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

Signed-off-by: NMarkus Armbruster <armbru@redhat.com>
Reviewed-by: NLaszlo "ever the optimist" Ersek <lersek@redhat.com>
Message-id: 1370610036-10577-7-git-send-email-armbru@redhat.com
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>
(cherry picked from commit 6e5c4540)
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

Classic endianness bug due to careless dirty coding: assuming reading
a byte from an int variable gets the least significant byte.
Signed-off-by: NMarkus Armbruster <armbru@redhat.com>
Reviewed-by: NLaszlo "ever the optimist" Ersek <lersek@redhat.com>
Message-id: 1370610036-10577-6-git-send-email-armbru@redhat.com
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>
(cherry picked from commit 527cd96f)
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

Having size precede the associated pointer is odd.  Swap them, and fix
up the types.
Signed-off-by: NMarkus Armbruster <armbru@redhat.com>
Reviewed-by: NLaszlo "ever the optimist" Ersek <lersek@redhat.com>
Message-id: 1370610036-10577-5-git-send-email-armbru@redhat.com
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>
(cherry picked from commit ebc85e3f)
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

Improves diagnistics from ad hoc messages like

    Invalid SMBIOS UUID string

to

    qemu-system-x86_64: -smbios type=1,uuid=gaga: Invalid UUID
Signed-off-by: NMarkus Armbruster <armbru@redhat.com>
Reviewed-by: NLaszlo "ever the optimist" Ersek <lersek@redhat.com>
Message-id: 1370610036-10577-4-git-send-email-armbru@redhat.com
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>
(cherry picked from commit 5bb95e41)
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

<stdio.h> has always been missing.  Rest missed in commit eeacee4d.
Signed-off-by: NMarkus Armbruster <armbru@redhat.com>
Reviewed-by: NLaszlo "ever the optimist" Ersek <lersek@redhat.com>
Message-id: 1370610036-10577-3-git-send-email-armbru@redhat.com
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>
(cherry picked from commit f3eededb)
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

Missed in commit e5924d89.
Signed-off-by: NMarkus Armbruster <armbru@redhat.com>
Reviewed-by: NLaszlo "ever the optimist" Ersek <lersek@redhat.com>
Message-id: 1370610036-10577-2-git-send-email-armbru@redhat.com
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>
(cherry picked from commit b293796f)
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>