vmdk: Fix header structure

Commit bb45ded9 swapped gd_offset and rgd_offset. This is wrong.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
(cherry picked from commit 7a736bfa4e0a58087054cad68a1d4b3804bbb708)

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
vmdk: Read footer for streamOptimized images

The footer takes precedence over the header when it exists. It contains
the real grain directory offset that is missing in the header. Without
this patch, streamOptimized images with a footer cannot be read.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
Reviewed-by: Jeff Cody <jcody@redhat.com>
(cherry picked from commit 65bd155c7356d448ffee7f89149c4d473076b0ba)

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Documentation: Warn against qemu-img on active image

People have repeatedly expected that you can do things like snapshotting
an image with qemu-img while a qemu instance is running. Maybe we need
to consider locking the files while they are in use, but having a
warning in the qemu-img manpage is doable for 1.2 and can't hurt anyway.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
(cherry picked from commit 48467328c6dccc9c7be6628ed0ef0810f83be2a9)

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
iscsi: move iscsi_schedule_bh and iscsi_readv_writev_bh_cb

Put these functions at the beginning, to avoid forward references
in the next patches.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit 27cbd828c617944c0f9603763fdf4fa87e7ad923)

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
iscsi: simplify iscsi_schedule_bh

It is always used with the same callback, remove the argument.  And
its return value is never used, assume allocation succeeds.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit cfb3f5064af2d2e29c976e292c9472dfe9d61e31)

Conflicts:

	block/iscsi.c

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
iscsi: fix races between task completion and abort

This patch fixes two main issues with block/iscsi.c:

1) iscsi_task_mgmt_abort_task_async calls iscsi_scsi_task_cancel which
was also directly called in iscsi_aio_cancel

2) a race between task completion and task abortion could happen cause
the scsi_free_scsi_task were done before iscsi_schedule_bh has finished.
To fix this, all the freeing of IscsiTasks and releasing of the AIOCBs
is centralized in iscsi_bh_cb, independent of whether the SCSI command
has completed or was cancelled.

3) iscsi_aio_cancel was not synchronously waiting for the end of the
command.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit 1bd075f29ea6d11853475c7c42734595720c3ac6)

Conflicts:

	block/iscsi.c

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
eventfd: making it thread safe

QEMU uses IO handlers to run select() in the main loop.
The handlers list is managed by qemu_set_fd_handler() helper
which works fine when called from the main thread as it is
called when select() is not waiting.

However IO handlers list can be changed in the thread other than
the main one doing os_host_main_loop_wait(), for example, as a result
of a hypercall which changes PCI config space (VFIO on POWER is the case)
and enables/disabled MSI/MSIX which closes/creates eventfd handles.
As the main loop should be waiting on the newly created eventfds,
it has to be restarted.

The patch adds the qemu_notify_event() call to interrupt select()
to make main_loop() restart select() with the updated IO handlers
list.

Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
(cherry picked from commit 55ce75faf253d4369670f60409c608e665e8dde9)

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
i82378: Remove bogus MMIO coalescing

This MMIO area is an entry gate to legacy PC ISA devices, addressed via
PIO over there. Quite a few of the PIO ports have side effects on access
like starting/stopping timers that must be executed properly ordered
/wrt the CPU. So we have to remove the coalescing mark.

Acked-by: Hervé Poussineau <hpoussin@reactos.org>
Acked-by: Andreas Färber <andreas.faerber@web.de>
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
(cherry picked from commit 0ec64507a5e6366e6d8070a82c866b935f687ed9)

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Fix invalidate if memory requested was not bucket aligned

When memory is mapped in qemu_map_cache with lock != 0 a reverse mapping
is created pointing to the virtual address of location requested.
The cached mapped entry is saved in last_address_vaddr with the memory
location of the base virtual address (without bucket offset).
However when this entry is invalidated the virtual address saved in the
reverse mapping is used. This cause that the mapping is freed but the
last_address_vaddr is not reset.

Signed-off-by: Frediano Ziglio <frediano.ziglio@citrix.com>
Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
(cherry picked from commit 27b7652ef515bb4c694f79d657d2052c72b19536)

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
xen-all.c: fix multiply issue for int and uint types

If the two multiply operands are int and uint types separately,
the int type will be transformed to uint firstly, which is not the
intent in our code piece. The fix is to add (int64_t) transform
for the uint type before the multiply.

Signed-off-by: Dongxiao Xu <dongxiao.xu@intel.com>
Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
(cherry picked from commit 14d40183725361e6350166099556c7661063921b)

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
qemu-ga: don't leak a file descriptor upon failed lockf

Signed-off-by: Jim Meyering <meyering@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
(cherry picked from commit 4144f122b477164cf466ca69be24cf4ef5c218d3)

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
linux-user: do_msgrcv: don't leak host_mb upon TARGET_EFAULT failure

Also, use g_malloc to avoid NULL-deref upon OOM.

Signed-off-by: Jim Meyering <meyering@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
(cherry picked from commit 0d07fe47d4986271a21ed4ff5237275ff55dd93f)

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
sheepdog: don't leak socket file descriptor upon connection failure

Signed-off-by: Jim Meyering <meyering@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
(cherry picked from commit a7e47d4bfcbf256fae06891a8599950ff8e1b61b)

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
arm-semi: don't leak 1KB user string lock buffer upon TARGET_SYS_OPEN

Always call unlock_user before returning.

Signed-off-by: Jim Meyering <meyering@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
(cherry picked from commit 396bef4b3846bf4e80a2bee38e9a2d8554d0f251)

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
softmmu-semi: fix lock_user* functions not to deref NULL upon OOM

Return NULL upon malloc failure.

Signed-off-by: Jim Meyering <meyering@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
(cherry picked from commit 15d9e3bc6af8a56af8c61911aab8453a54795db1)

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
monitor: move json init from OPEN event to init

At some point in the past, the OPEN event was changed to be issued from a
bottom half.  This creates a small window whereas a data callback registered in
init may be invoked before the OPEN event has been issued.

This is reproducible with:

 echo "{'execute': 'qmp_capabilities'}" | qemu-system-x86_64 -M none -qmp stdio

We can fix this for the monitor by moving the parser initialization to init.

The remaining state that is set in OPEN appears harmless.

Reported-by: Daniel Berrange <berrange@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
(cherry picked from commit 58617a795c8067b2f9800cffce60f38707d3aa31)

Conflicts:

	monitor.c

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
target-mips: Enable access to required RDHWR hardware registers

While running in the usermode emulator all of the required*
MIPS32r2 RDHWR hardware registers should be accessible (the
Linux kernel enables access to these same registers).  Note
that these registers are still enabled when the MIPS ISA is
not release 2.  This is OK since the Linux kernel emulates
access to them when they are not available in hardware.

* There is also the ULR register which is only recommended
  for full release 2 compliance.  Incidentally, accessing
  this register in the current implementation works fine
  without flipping its access bit.

Signed-off-by: Meador Inge <meadori@codesourcery.com>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
(cherry picked from commit 94159135cb59684853dcd45ff70d6dbc54a29209)

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
target-mips: Fix some helper functions (VR54xx multiplication)

Commits b5dc7732e1cc2fb549e48b7b5d664f2c79628e2e and
be24bb4f3007c3e07cbf1934f7e781493d876ab7 optimized the code
and removed the correct setting of t0. Fix this.

gcc-4.7 detected this bug because parameter arg1 was unused
but set in set_HIT0_LO and set_HI_LOT0.

Cc: Aurelien Jarno <aurelien@aurel32.net>
Signed-off-by: Stefan Weil <sw@weilnetz.de>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
(cherry picked from commit 6fc97fafce05eee76479ca6d289241772d21b370)

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
monitor: don't try to initialize json parser when monitor is HMP

Reported-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
(cherry picked from commit 26efaca377e004b79ff50a6e936d029a0c095b8b)

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
qom: object_delete should unparent the object first

object_deinit is only called when the reference count goes to zero,
and yet tries to do an object_unparent.  Now, object_unparent
either does nothing or it will decrease the reference count.
Because we know the reference count is zero, the object_unparent
call in object_deinit is useless.

Instead, we need to disconnect the object from its parent just
before we remove the last reference apart from the parent's.  This
happens in object_delete.  Once we do this, all calls to
object_unparent peppered through QEMU can go away.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
(cherry picked from commit da5a44e8b0b727681fc33e8d94832d1cae48a788)

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>