The change corrects sign-related issue with MULQ_S.PH. It also includes
extension to the already existing test which will trigger the issue.
Signed-off-by: NPetar Jovanovic <petarj@mips.com>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>
(cherry picked from commit 9c19eb1e)
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

Our ehci code does not implement wakeup support, so claiming support for
it with usb-tablet in USB-2 mode causes all tablet events to get lost.

http://bugzilla.redhat.com/show_bug.cgi?id=929068Signed-off-by: NHans de Goede <hdegoede@redhat.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
(cherry picked from commit aa1c9e97)
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

When we receive a file descriptor over a UNIX domain socket the
O_NONBLOCK flag is preserved.  Clear the O_NONBLOCK flag and rely on
QEMU file descriptor users like migration, SPICE, VNC, block layer, and
others to set non-blocking only when necessary.

This change ensures we don't accidentally expose O_NONBLOCK in the QMP
API.  QMP clients should not need to get the non-blocking state
"correct".

A recent real-world example was when libvirt passed a non-blocking TCP
socket for migration where we expected a blocking socket.  The source
QEMU produced a corrupted migration stream since its code did not cope
with non-blocking sockets.
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>
(cherry picked from commit e374f7f816171f9783c1d9d00a041f26379f1ac6)
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

socket_connect() sets non-blocking on TCP or UNIX domain sockets if a
callback function is passed.  Do the same for file descriptor passing,
otherwise we could unexpectedly be using a blocking file descriptor.
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>
(cherry picked from commit 35fb94fa292173a3e1df0768433e06912a2a88e4)
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

There are several code paths in net_init_socket() depending on how the
socket is created: file descriptor passing, UDP multicast, TCP, or UDP.
Some of these support both listen and connect.

Not all code paths set the socket to non-blocking.  This patch addresses
the file descriptor passing and UDP cases which were missing
socket_set_nonblock(fd) calls.

I considered moving socket_set_nonblock(fd) to a central location but it
turns out the code paths are different enough to require non-blocking at
different places.
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>
(cherry picked from commit f05b707279dc7c29ab10d9d13dbf413df6ec22f1)
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

The fcntl(fd, F_SETFL, O_NONBLOCK) flag is not specific to sockets.
Rename to qemu_set_nonblock() just like qemu_set_cloexec().
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>
(cherry picked from commit 399f1c8f8af1f6f8b18ef4e37169c6301264e467)
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>

Conflicts:
	block/sheepdog.c

socket_set_block()/socket_set_nonblock() calls in different locations

	include/qemu/sockets.h

socket_set_nodelay() does not exist in v1.4.0, messes up diff context

	qemu-char.c

glib G_IO_IN events are not used in v1.4.0, messes up diff context

	savevm.c

qemu_fopen_socket() only has read mode in v1.4.0, qemu_set_block() not
necessary.

	slirp/misc.c

unportable setsockopt() calls in v1.4.0 mess up diff context

	slirp/tcp_subr.c

file was reformatted, diff context is messed up

	ui/vnc.c

old dcl->idle instead of vd->dcl.idle messes up diff context

Added:
	migration-tcp.c, migration-unix.c

qemu_fopen_socket() write mode does not exist yet, qemu_set_block() call
is needed here.
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

Alex Williamson (3):
      seabios q35: Enable all PIRQn IRQs at startup
      seabios q35: Add new PCI slot to irq routing function
      seabios: Add a dummy PCI slot to irq mapping function

Avik Sil (1):
      USB-EHCI: Fix null pointer assignment

Kevin O'Connor (4):
      Update tools/acpi_extract.py to handle iasl 20130117 release.
      Fix Makefile - don't reference "out/" directly, instead use "$(OUT)".
      build: Don't require $(OUT) to be a sub-directory of the main
directory.
      Verify CC is valid during build tests.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
(cherry picked from commit 5c75fb10)
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

The nature of the kernel ABI for the get_robust_list and set_robust_list
syscalls means we cannot implement them in QEMU. Make get_robust_list
silently return ENOSYS rather than using the default "print message and
then fail ENOSYS" code path, in the same way we already do for
set_robust_list, and add a comment documenting why we do this.

This silences warnings which were being produced for emulating
even trivial programs like 'ls' in x86-64-on-x86-64.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Reviewed-by: NRichard Henderson <rth@twiddle.net>
Signed-off-by: NRiku Voipio <riku.voipio@linaro.org>
(cherry picked from commit e9a970a8)
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

If the guest passes us a bogus negative length for an iovec, fail
EINVAL rather than proceeding blindly forward. This fixes some of
the error cases tests for readv and writev in the LTP.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Reviewed-by: NRichard Henderson <rth@twiddle.net>
Signed-off-by: NRiku Voipio <riku.voipio@linaro.org>
(cherry picked from commit dfae8e00)
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

Handle same as existing FUTEX_PRIVATE_FLAG.
Signed-off-by: NJohn Rigby <john.rigby@linaro.org>
Signed-off-by: NRiku Voipio <riku.voipio@linaro.org>
(cherry picked from commit bfb669f3)
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

Upstream libc has recently changed to start using
FUTEX_WAIT_BITSET instead of FUTEX_WAIT and this
is causing do_futex to return -TARGET_ENOSYS.

Pass bitset in val3 to sys_futex which will be
ignored by kernel for the FUTEX_WAIT case.
Signed-off-by: NJohn Rigby <john.rigby@linaro.org>
Signed-off-by: NRiku Voipio <riku.voipio@linaro.org>
(cherry picked from commit cce246e0)
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

Since qcow2 metadata is cached we need to flush the caches, not just the
underlying file.  Use bdrv_flush(bs) instead of bdrv_flush(bs->file).

Also add the error return path when bdrv_flush() fails and move the
flush after checking for qcow2_alloc_clusters() failure so that the
qcow2_alloc_clusters() error return value takes precedence.
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>
(cherry picked from commit f6977f15)
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

update_refcount() affects the refcount cache, it does not write to disk.
Therefore bdrv_flush(bs->file) does nothing.  We need to flush the
refcount cache in order to write out the refcount updates!

While we're here also add error returns when qcow2_cache_flush() fails.
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>
(cherry picked from commit 9991923b)
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

XBZRLE encoded migration introduced a MRU page cache
meachnism. Unfortunately, cached items where never freed in
case of a collision in the page cache on cache_insert().

This lead to out of memory conditions during XBZRLE migration
if the page cache was small and there where a lot of collisions
in the cache.
Signed-off-by: NPeter Lieven <pl@kamp.de>
Signed-off-by: NOrit Wasserman <owasserm@redhat.com>
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NJuan Quintela <quintela@redhat.com>
(cherry picked from commit 32a1c08b)
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

Signed-off-by: NOrit Wasserman <owasserm@redhat.com>
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NJuan Quintela <quintela@redhat.com>
(cherry picked from commit 0db65d62)
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

virtio-blk registers a vmstate change handler. Unfortunately this
handler is not unregistered on unplug, leading to some random
crashes if the system is restarted, e.g. via virsh reboot.
Lets unregister the vmstate change handler if the device is removed.
Signed-off-by: NChristian Borntraeger <borntraeger@de.ibm.com>
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>
(cherry picked from commit 69b302b2)
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

Commit 07a7484e accidentally introduced a bug
in the initialisation of the second macio DMA device which could cause some
DMA operations to segfault QEMU.

CC: Andreas Färber <afaerber@suse.de>
Signed-off-by: NMark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Acked-by: NAndreas Färber <afaerber@suse.de>
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>
(cherry picked from commit 02d583c7)
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

It was defined to ..._MPC8545E_v21 rather than ..._MPC8547E_v21.
Due to both resolving to CPU_POWERPC_e500v2_v21 this did not show.

Fixing this nontheless helps with QOM'ifying CPU aliases.
Signed-off-by: NAndreas Färber <afaerber@suse.de>
Signed-off-by: NAlexander Graf <agraf@suse.de>
(cherry picked from commit 0136d715)
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

Currently the spapr-vlan device does not supply a cleanup call for its
NetClientInfo structure.  With current qemu versions, that leads to a SEGV
on exit, when net_cleanup() attempts to call the cleanup handlers on all
net clients.
Signed-off-by: NDavid Gibson <david@gibson.dropbear.id.au>
Signed-off-by: NAlexander Graf <agraf@suse.de>
(cherry picked from commit 156dfade)
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

As of 5a49d3e9 we assume SPICE_PORT_EVENT_BREAK to be defined.
However, it is defined not in 0.12.2 what we require now, but in
0.12.3.  Therefore in order to prevent build failure we must
adjust our minimal requirements.
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>
(cherry picked from commit 358689fe)
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

Linux uses the lowest enslaved MAC address as the MAC address of
the bridge.  Set MAC address to a high value so that it does not
affect the MAC address of the bridge.

Changing the MAC address of the bridge could cause a few seconds
of network downtime.

Cc: qemu-stable@nongnu.org
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Message-id: 1363971468-21154-1-git-send-email-pbonzini@redhat.com
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>
(cherry picked from commit 226ecabf)
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

Verify that the virtio-ccw notify hypercall passed a reasonable
value for queue.

Cc: qemu-stable@nongnu.org
Reported-by: NAlexander Graf <agraf@suse.de>
Signed-off-by: NCornelia Huck <cornelia.huck@de.ibm.com>
(cherry picked from commit b57ed9bf)
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

is_tcg_gen_code() checks the upper limit of TCG generated code range wrong, so
that TCG could get broken occasionally only when CONFIG_QEMU_LDST_OPTIMIZATION
enabled. The reason is code_gen_buffer_max_size does not cover the upper range
up to (TCG_MAX_OP_SIZE * OPC_BUF_SIZE), thus code_gen_buffer_max_size should be
modified to code_gen_buffer_size.

CC: qemu-stable@nongnu.org
Signed-off-by: NYeongkyoon Lee <yeongkyoon.lee@samsung.com>
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>
(cherry picked from commit 52ae646d)

Conflicts:

	translate-all.c

*modified to use non-tcg-ctx version of code_gen_* variables
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

These functions don't exist until glib version 2.26. QEMU is currently only
mandating glib 2.12.

This patch replaces the functions with g_key_file_get/set_integer.

Unbreaks the build on Ubuntu 10.04 and RHEL 5.6.

Regression was introduced by 39097dafSigned-off-by: NPeter Crosthwaite <peter.crosthwaite@xilinx.com>
Message-id: 1363323879-682-1-git-send-email-peter.crosthwaite@xilinx.com
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>
(cherry picked from commit 4f306496)
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

Hosts hold on to handles provided by guest-file-open for periods that can
span beyond the life of the qemu-ga process that issued them. Since these
are issued starting from 0 on every restart, we run the risk of issuing
duplicate handles after restarts/reboots.

As a result, users with a stale copy of these handles may end up
reading/writing corrupted data due to their existing handles effectively
being re-assigned to an unexpected file or offset.

We unfortunately do not issue handles as strings, but as integers, so a
solution such as using UUIDs can't be implemented without introducing a
new interface.

As a workaround, we fix this by implementing a persistent key-value store
that will be used to track the value of the last handle that was issued
across restarts/reboots to avoid issuing duplicates.

The store is automatically written to the same directory we currently
set via --statedir to track fsfreeze state, and so should be applicable
for stable releases where this flag is supported.

A follow-up can use this same store for handling fsfreeze state, but
that change is cosmetic and left out for now.
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>
Cc: qemu-stable@nongnu.org

* fixed guest_file_handle_add() return value from uint64_t to int64_t
(cherry picked from commit 39097daf)
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

Otherwise, live migration of the top layer will miss zero clusters and
let the backing file show through.  This also matches what is done in qed.

QCOW2_CLUSTER_ZERO clusters are invalid in v2 image files.  Check this
directly in qcow2_get_cluster_offset instead of replicating the test
everywhere.

Cc: qemu-stable@nongnu.org
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>
(cherry picked from commit 381b487d)
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

Currently, for the pseries machine the device tree supplied by qemu to SLOF
and from there to the guest does not include a 'compatible property' at the
root level.  Usually that works fine, since in this case the compatible
property doesn't really give any information not already found in the
'device_type' or 'model' properties.

However, the lack of 'compatible' confuses the bootloader install in the
SLES11 SP2 and SLES11 SP3 installers.  This patch therefore adds a token
'compatible' property to work around that.
Signed-off-by: NDavid Gibson <david@gibson.dropbear.id.au>
Cc: qemu-stable@nongnu.org
Signed-off-by: NAlexander Graf <agraf@suse.de>
(cherry picked from commit d63919c9)
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

Enable all virtio-net features for the legacy s390 virtio bus. This also fixes
kernel BUG at /usr/src/packages/BUILD/kernel-default-3.0.58/linux-3.0/drivers/s390/kvm/kvm_virtio.c:121!
Signed-off-by: NChristian Borntraeger <borntraeger@de.ibm.com>
Cc: qemu-stable@nongnu.org
Signed-off-by: NAlexander Graf <agraf@suse.de>
(cherry picked from commit 35569cea)
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

As of glib 2.35.4, glib changed its logic for ordering test cases:

https://bugzilla.gnome.org/show_bug.cgi?id=694487

This was causing failures in rtc-test. Group the reordered test
cases into their own suite, which maintains the original ordering.

CC: qemu-stable@nongnu.org
Signed-off-by: NCole Robinson <crobinso@redhat.com>
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>
(cherry picked from commit eeb29fb9)
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

Canceled requests should never be completed, and doing that could cause
accesses to a NULL hba_private field.

Cc: qemu-stable@nongnu.org
Reported-by: NStefan Priebe <s.priebe@profihost.ag>
Tested-by: NStefan Priebe <s.priebe@profihost.ag>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit d0242ead)
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

Cc: qemu-stable@nongnu.org
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit 6f6710aa)
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

Due to library conflicts, Fedora will have to put libiscsi in
/usr/lib/iscsi.  Simplify configuration by using a pkg-config
file.  The Fedora package will distribute one, and the patch
to add it has been sent to upstream libiscsi as well.

Cc: qemu-stable@nongnu.org
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit 3c33ea96)
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

Always check it immediately after calling bdrv_acct_done, and
always do a "goto done" in case the "done" label has to free
some memory---as is the case for scsi_unmap_complete in the
previous patch.

This patch could fix problems that happen when a request is
split into multiple parts, and one of them is canceled.  Then
the next part is fired, but the HBA's cancellation callbacks have
fired already.  Whether this happens or not, depends on how the
block/ driver implements AIO cancellation.  It it does a simple
bdrv_drain_all() or similar, then it will not have a problem.
If it only cancels the given AIOCB, this scenario could happen.

Cc: qemu-stable@nongnu.org
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit 0c92e0e6)
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

We currently maintain a whitelist of commands that are safe during
fsfreeze. During fsfreeze, we disable all commands that aren't part of
that whitelist.

guest-sync-delimited meets the criteria for being whitelisted, and is
also required for qemu-ga clients that rely on guest-sync-delimited for
re-syncing the channel after a timeout.
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>
Cc: qemu-stable@nongnu.org
Reviewed-by: NEric Blake <eblake@redhat.com>
(cherry picked from commit c5dcb6ae)
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

Cc: qemu-stable@nongnu.org
Signed-off-by: NMarkus Armbruster <armbru@redhat.com>
Reviewed-by: NLaszlo Ersek <lersek@redhat.com>
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>
(cherry picked from commit af347aa5)
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

In case host and guest endianness differ the vga code first creates
a shared surface (using qemu_create_displaysurface_from), then goes
patch the surface format to indicate that the bytes must be swapped.

The switch to pixman broke that hack as the format patching isn't
propagated into the pixman image, so ui code using the pixman image
directly (such as vnc) uses the wrong format.

Fix that by adding a byteswap parameter to
qemu_create_displaysurface_from, so we'll use the correct format
when creating the surface (and the pixman image) and don't have
to patch the format afterwards.

[ v2: unbreak xen build ]

Cc: qemu-stable@nongnu.org
Cc: mark.cave-ayland@ilande.co.uk
Cc: agraf@suse.de
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
Message-id: 1361349432-23884-1-git-send-email-kraxel@redhat.com
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>
(cherry picked from commit b1424e03)
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

Cc: Markus Armbruster <armbru@redhat.com>
Cc: Jason Wang <jasowang@redhat.com>
Signed-off-by: NJason Wang <jasowang@redhat.com>
Message-id: 1361354641-51969-1-git-send-email-jasowang@redhat.com
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>
(cherry picked from commit 2ca81baa)
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

Edivaldo reports a problem that the array of NetClientState in NICState is too
large - MAX_QUEUE_NUM(1024) which will wastes memory even if multiqueue is not
used.

Instead of static arrays, solving this issue by allocating the queues on demand
for both the NetClientState array in NICState and VirtIONetQueue array in
VirtIONet.

Tested by myself, with single virtio-net-pci device. The memory allocation is
almost the same as when multiqueue is not merged.

Cc: Edivaldo de Araujo Pereira <edivaldoapereira@yahoo.com.br>
Cc: qemu-stable@nongnu.org
Signed-off-by: NJason Wang <jasowang@redhat.com>
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>
(cherry picked from commit f6b26cf2)
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

Current colon position in "waiting for telnet connection" message template
produces messages like:
QEMU waiting for connection on: telnet::127.0.0.16666,server

After moving a colon to the right, we will get a correct messages like:
QEMU waiting for connection on: telnet:127.0.0.1:6666,server
Signed-off-by: NIgor Mitsyanko <i.mitsyanko@gmail.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
(cherry picked from commit e5545854)
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

Obviously, hub does not support multiqueue tap. So this patch forbids creating
multiple queue tap when hub is used to prevent the crash when command line such
as "-net tap,queues=2" is used.

Cc: qemu-stable@nongnu.org
Signed-off-by: NJason Wang <jasowang@redhat.com>
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>
(cherry picked from commit ce675a75)
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>