hw/9pfs: Fix segfault with 9p2000.u

When guest tries to chmod a block or char device file over 9pfs,
the qemu process segfaults. With 9p2000.u protocol we use wstat to
change mode bits and client don't send extension information for
chmod. We need to check for size field to check whether extension
info is present or not.

Reported-by: Michael Tokarev <mjt@tls.msk.ru>
Acked-by: Michael Tokarev <mjt@tls.msk.ru>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
(cherry picked from commit c7e587b73ebac05943df78f5f37d80d32ff47d3d)

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
hw/9pfs: use O_NOFOLLOW for mapped readlink operation

With mapped security models like mapped-xattr and mapped-file, we save the
symlink target as file contents. Now if we ever expose a normal directory
with mapped security model and find real symlinks in export path, never
follow them and return proper error.

Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
(cherry picked from commit aed858ce10ef09c7bdf03f73e75e772f567c74cd)

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
rtl8139: flush queued packets when RxBufPtr is written

Net queues support efficient "receive disable".  For example, tap's file
descriptor will not be polled while its peer has receive disabled.  This
saves CPU cycles for needlessly copying and then dropping packets which
the peer cannot receive.

rtl8139 is missing the qemu_flush_queued_packets() call that wakes the
queue up when receive becomes possible again.

As a result, the Windows 7 guest driver reaches a state where the
rtl8139 cannot receive packets.  The driver has actually refilled the
receive buffer but we never resume reception.

The bug can be reproduced by running a large FTP 'get' inside a Windows
7 guest:

  $ qemu -netdev tap,id=tap0,...
         -device rtl8139,netdev=tap0

The Linux guest driver does not trigger the bug, probably due to a
different buffer management strategy.

Reported-by: Oliver Francke <oliver.francke@filoo.de>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
(cherry picked from commit 00b7ade807b5ce6779ddd86ce29c5521ec5c529a)

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
qom/object: Don't poll cast cache for NULL objects

object_dynamic_cast_assert used to be tolerant of NULL objects and not
assert. It's clear from the implementation that this is the expected
behavior.

The preceding check of the cast cache dereferences obj however causing
a segfault. Fix by conditionalizing the cast cache logic on obj being
non-null.

Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
Reviewed-by: Andreas Färber <afaerber@suse.de>
Reviewed-by: Anthony Liguori <aliguori@us.ibm.com>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@gmail.com>
Message-id: 8e2bef6a55753869c50bfa32226f7fcf0439ca62.1369183592.git.peter.crosthwaite@xilinx.com
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
(cherry picked from commit 95916abcf428fb03644468c7fbce64356c6483c0)

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
xen: simplify xen_enabled

No need for preprocessor conditionals in xen_enabled: xen_allowed is
always defined.

Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
CC: qemu-stable@nongnu.org
(cherry picked from commit 49fa9881b2358e390e9e9466ddde74e995927efa)

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
main_loop: do not set nonblocking if xen_enabled()

Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
CC: qemu-stable@nongnu.org
(cherry picked from commit a7d4207d378069a5bb3175a131e8fdedd39ef97d)

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
xen_machine_pv: do not create a dummy CPU in machine->init

This fixes a regression introduced by:

commit 62fc403f11523169eb4264de31279745f48e3ecc
Author: Igor Mammedov <imammedo@redhat.com>
Date:   Mon Apr 29 18:54:13 2013 +0200

    target-i386: Attach ICC bus to CPU on its creation

    X86CPU should have parent bus so it could provide bus for child APIC.

The commit makes it mandatory to pass a valid ICC bus to cpu_x86_create,
but cpu_x86_init just passes NULL to it.
xen_machine_pv uses cpu_x86_init, therefore it has been broken.

This patch fixes the problem by removing the dummy CPU creation
altogether from xen_init_pv, relying on the fact that QEMU can now cope
with a machine without an emulated CPU.

Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
Reviewed-by: Andreas Färber <afaerber@suse.de>
CC: imammedo@redhat.com
CC: qemu-stable@nongnu.org
(cherry picked from commit 58ee9b0ae05d81c74d6869a25ce4263fc22ed809)

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
chardev: fix "info chardev" output

Fill unset CharDriverState->filename with the backend name, so
'info chardev' will return at least the chardev type.  Don't
touch it in case the chardev init function filled it already,
like the socket+pty chardevs do for example.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
(cherry picked from commit 60d95386abf1f5f37ded6a812d12ac458df2491b)

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
ide: Set BSY bit during FLUSH

The implementation of the ATA FLUSH command invokes a flush at the block
layer, which may on raw files on POSIX entail a synchronous fdatasync().
This may in some cases take so long that the SLES 11 SP1 guest driver
reports I/O errors and filesystems get corrupted or remounted read-only.

Avoid this by setting BUSY_STAT, so that the guest is made aware we are
in the middle of an operation and no ATA commands are attempted to be
processed concurrently.

Addresses BNC#637297.

Suggested-by: Gonglei (Arei) <arei.gonglei@huawei.com>
Signed-off-by: Andreas Färber <afaerber@suse.de>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
(cherry picked from commit f68ec8379e88502b4841a110c070e9b118d3151c)

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Revert "roms: switch oldnoconfig to olddefconfig"

This reverts commit a5519b42cfd6c00e9f8b31c5aad7682e7a9f1181.

Breaks "make bios" in roms/ as the kconfig version in seabios doesn't
support olddefconfig.  Must have been be totally untested.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
(cherry picked from commit 19cd090e17b293b49eec59346df94a668f5d2438)

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
update seabios to release 1.7.2.2

git shortlog from 1.7.2.1

Asias He (2):
      virtio-scsi: Pack struct virtio_scsi_{req_cmd,resp_cmd}
      virtio-scsi: Set _DRIVER_OK flag before scsi target scanning

Kevin O'Connor (1):
      Cache boot-fail-wait to avoid romfile access after POST.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
(cherry picked from commit 6683d7bc2759e9da8b5c4907a9de85d500933ffb)

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
target-i386: fix abort on bad PML4E/PDPTE/PDE/PTE addresses

The code used to walk IA-32e page-tables, and possibly PAE page-tables,
uses the bit mask ~0xfff to get the next PML4E/PDPTE/PDE/PTE address.

However, as we use a uint64_t to store the resulting address, that mask
gets expanded to 0xfffffffffffff000 which not only ends up selecting
reserved bits but also selects the XD bit (execute-disable) which
happens to be enabled by Windows 8, causing qemu_get_ram_ptr() to abort.

This commit fixes that problem by replacing ~0xfff by a correct mask
that only selects the address bit range (ie. bits 51:12).

Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>
Reviewed-by: Laszlo Ersek <lersek@redhat.com>
(cherry picked from commit fbc2ed9518efcdcdcbf0adb9539c17a65addd20a)

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Remove OSS support for OpenBSD

Remove the OSS support for OpenBSD. The OSS API has not been usable
for quite some time.

Signed-off-by: Brad Smith <brad@comstyle.com>
Reviewed-by: Laszlo Ersek <lersek@redhat.com>
Reviewed-by: Andreas Färber <afaerber@suse.de>
Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
(cherry picked from commit 4f6ab397b60615d2da77bff4f32666be9ac2e949)

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
xen: start PCI hole at 0xe0000000 (same as pc_init1 and qemu-xen-traditional)

We are currently setting the PCI hole to start at HVM_BELOW_4G_RAM_END,
that is 0xf0000000.
Start the PCI hole at 0xe0000000 instead, that is the same value used by
pc_init1 and qemu-xen-traditional.

Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
CC: qemu-stable@nongnu.org
(cherry picked from commit 9f24a8030a70ea4954b5b8c48f606012f086f65f)

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
do not check pointers after dereferencing them

Two instances, both spotted by Coverity.  In one, two blocks were
swapped.  In the other, the check is not needed anymore.

Cc: qemu-stable@nongnu.org
Cc: qemu-trivial@nongnu.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
(cherry picked from commit a4cc73d629d43c8a4d171d043ff229a959df3ca6)

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
qdev: fix get_fw_dev_path to support to add nothing to fw_dev_path

Recent virtio refactoring in QEMU made virtio-bus become the parent bus
of scsi-bus, and virtio-bus doesn't have get_fw_dev_path implementation,
typename will be added to fw_dev_path by default, the new fw_dev_path
could not be identified by seabios. It causes that bootindex parameter
of scsi device doesn't work.

This patch implements get_fw_dev_path() in BusClass, it will be called
if bus doesn't implement the method, tyename will be added to
fw_dev_path. If the implemented method returns NULL, nothing will be
added to fw_dev_path.

It also implements virtio_bus_get_fw_dev_path() to return NULL. Then
QEMU will still pass original style of fw_dev_path to seabios.

Signed-off-by: Amos Kong <akong@redhat.com>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Laszlo Ersek <lersek@redhat.com>
Message-id: 1369814202-10346-1-git-send-email-akong@redhat.com
--
v2: only add nothing to fw_dev_path when get_fw_dev_path() is
    implemented and returns NULL. then it will not effect other devices
    don't have get_fw_dev_path() implementation.
v3: implement default get_fw_dev_path() in BusClass
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
(cherry picked from commit bbfa18fca4e44ff9c23d36b50d8a998af9c9e9fc)

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
host-libusb: Correct test for USB packet state

USB_RET_ASYNC is -6, so inflight was always false.

Signed-off-by: Ed Maste <emaste@freebsd.org>
Cc: qemu-stable@nongnu.org
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
(cherry picked from commit 45ec267160307ce2ca7494d942589ba222b29479)

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Fix usage of USB_DEV_FLAG_IS_HOST flag.

USB_DEV_FLAG_IS_HOST is the bit number, not value. Booting with a
"Fitbit Base Station" USB dongle was triggering this assert.

Signed-off-by: Michael Marineau <mike@marineau.org>
Cc: qemu-stable@nongnu.org
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
(cherry picked from commit 756335292f2b46775992c314cc70b54480a46d26)

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
vmxnet3: fix NICState cleanup

Use qemu_del_nic() instead of qemu_del_net_client() to correctly free
the entire NICState.

Cc: qemu-stable@nongnu.org
Reported-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
(cherry picked from commit 3ffee3cd5fb29de2115bdcbde0a02f47ce69a24c)

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
ui/gtk.c: Fix *BSD build of Gtk+ UI

Fix the build of the Gtk+ UI on *BSD systems.

Signed-off-by: Brad Smith <brad@comstyle.com>
Reviewed-by: Laszlo Ersek <lersek@redhat.com>
Message-id: 20130521161324.GA29977@rox.home.comstyle.com
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
(cherry picked from commit 17bf9735dd5a46d829cfb175703c6a2c254a9aa2)

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>