tap: fix NULL dereference when passing invalid parameters to tap

This patch forbid the following invalid parameters to tap:

1) fd and vhostfds were specified but vhostfd were not specified
2) vhostfds were specified but fds were not specified
3) fds and vhostfd were specified

For 1 and 2, net_init_tap_one() will still pass NULL as vhostfdname to
monitor_handle_fd_param(), which may crash the qemu.

Also remove the unnecessary has_fd check.

Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Stefan Hajnoczi <shajnocz@redhat.com>
Cc: Laszlo Ersek <lersek@redhat.com>
Cc: qemu-stable@nongnu.org
Signed-off-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
(cherry picked from commit c87826a878be05208c3906eb9d5e1f37cff5e98e)

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Makefile: Install qemu-img and qemu-nbd man pages only if built

When splitting openSUSE's qemu and qemu-linux-user packages we noticed
that for linux-user-only builds unrelated man pages got installed.
It's surely possible to delete them before packaging, but not installing
them in the first place seems more logical.

Cc: qemu-stable@nongnu.org
Signed-off-by: Andreas Färber <afaerber@suse.de>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
(cherry picked from commit 8a3e8f7fd8144343f6c83e810b988c1e8a99d50a)

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
ivshmem: add missing error exit(2)

If the user fails to specify 'chardev' or 'shm' then we cannot continue.
Exit right away so that we don't invoke shm_open(3) with a NULL pointer.

It would be nice to replace exit(1) with error returns in the PCI device
.init() function, but leave that for another patch since exit(1) is
currently used elsewhere.

Spotted by Coverity.

Cc: Cam Macdonell <cam@cs.ualberta.ca>
Cc: qemu-stable@nongnu.org
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
(cherry picked from commit baefb8bf8e4a708c601bbab898a6039cd9cd12e3)

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
tcg-ppc64: bswap64 rotates output 32 bits

If our input and output is in the same register, bswap64 tries to
undo a rotate of the input. This just ends up rotating the output.

Cc: qemu-stable@nongnu.org
Signed-off-by: Anton Blanchard <anton@samba.org>
Signed-off-by: Richard Henderson <rth@twiddle.net>
(cherry picked from commit 82e0f9170ac9307de4fc15bfb4d12d5534550322)

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
error-report.h: Supply missing include

Missed in commit e5924d8.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Laszlo "ever the optimist" Ersek <lersek@redhat.com>
Message-id: 1370610036-10577-2-git-send-email-armbru@redhat.com
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
(cherry picked from commit b293796fd71009ecffe4343713a4e4e568c33fb0)

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
log.h: Supply missing includes

<stdio.h> has always been missing.  Rest missed in commit eeacee4.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Laszlo "ever the optimist" Ersek <lersek@redhat.com>
Message-id: 1370610036-10577-3-git-send-email-armbru@redhat.com
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
(cherry picked from commit f3eededb2fbc73c73daf08f791f0407b8541f4f4)

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
smbios: Convert to error_report()

Improves diagnistics from ad hoc messages like

    Invalid SMBIOS UUID string

to

    qemu-system-x86_64: -smbios type=1,uuid=gaga: Invalid UUID

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Laszlo "ever the optimist" Ersek <lersek@redhat.com>
Message-id: 1370610036-10577-4-git-send-email-armbru@redhat.com
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
(cherry picked from commit 5bb95e41868b461f37159efb48908828ebd7ab36)

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
smbios: Clean up smbios_add_field() parameters

Having size precede the associated pointer is odd.  Swap them, and fix
up the types.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Laszlo "ever the optimist" Ersek <lersek@redhat.com>
Message-id: 1370610036-10577-5-git-send-email-armbru@redhat.com
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
(cherry picked from commit ebc85e3f724d17530e74df665d1a30fb9b0041b5)

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
smbios: Fix -smbios type=0, release=... for big endian hosts

Classic endianness bug due to careless dirty coding: assuming reading
a byte from an int variable gets the least significant byte.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Laszlo "ever the optimist" Ersek <lersek@redhat.com>
Message-id: 1370610036-10577-6-git-send-email-armbru@redhat.com
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
(cherry picked from commit 527cd96f15348f4454d5bb71f69aaeb95461c90e)

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
smbios: Check R in -smbios type=0, release=R parses okay

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Laszlo "ever the optimist" Ersek <lersek@redhat.com>
Message-id: 1370610036-10577-7-git-send-email-armbru@redhat.com
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
(cherry picked from commit 6e5c4540d18d1e9a5253104df161a7e0d408ca95)

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
tcg-ppc64: Fix add2_i64

add2_i64 was adding the lower double word to the upper double word
of each input. Fix this so we add the lower double words, then the
upper double words with carry propagation.

Cc: qemu-stable@nongnu.org
Signed-off-by: Anton Blanchard <anton@samba.org>
Signed-off-by: Richard Henderson <rth@twiddle.net>
(cherry picked from commit 84247357104044b8c4ec4a634e84769f432cbe52)

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
tcg-ppc64: rotr_i32 rotates wrong amount

rotr_i32 calculates the amount to left shift and puts it into a
temporary, but then doesn't use it when doing the shift.

Cc: qemu-stable@nongnu.org
Signed-off-by: Anton Blanchard <anton@samba.org>
Signed-off-by: Richard Henderson <rth@twiddle.net>
(cherry picked from commit d1bdd3af49f227dd4a4b03b90cb020c55cbed440)

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
pc: Fix crash when attempting to hotplug CPU with negative ID

QMP command "{ 'execute': 'cpu-add', 'arguments': { 'id': -1 }}" may cause
QEMU SIGSEGV at:
 piix4_cpu_hotplug_req ()
    ...
    g->sts[cpu_id / 8] |= (1 << (cpu_id % 8));
    ...

Since for PC in current implementation id should be in range [0...maxcpus)
and maxcpus is already checked, add check for lower bound and error out
on incorrect value.

Signed-off-by: Igor Mammedov <imammedo@redhat.com>
Signed-off-by: Andreas Färber <afaerber@suse.de>
(cherry picked from commit 8de433cb0820dc1f387a2d580d255744aacd60cc)

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
target-i386: cpu: Fix potential buffer overrun in get_register_name_32()

Spotted by Coverity,
x86_reg_info_32[] is CPU_NB_REGS32 elements long, so accessing
x86_reg_info_32[CPU_NB_REGS32] will be one element off array.

Signed-off-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: liguang <lig.fnst@cn.fujitsu.com>
Reviewed by: Jesse Larrew <jlarrew@linux.vnet.ibm.com>
Signed-off-by: Andreas Färber <afaerber@suse.de>
(cherry picked from commit 31ccdde298d98b08526dc23059071c9086dec6c2)

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
vmdk: byteswap VMDK4Header.desc_offset field

Remember to byteswap VMDK4Header.desc_offset on big-endian machines.

Cc: qemu-stable@nongnu.org
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
(cherry picked from commit 5a394b9e96eb3c39676353bdf8a230180ae8d6f4)

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>