Merge remote branch 'upstream/stable-0.12' into stable-0.12

* upstream/stable-0.12: (27 commits)
  Update version and changelog for release
  Update SeaBIOS to 0.5.1
  Qemu's internal TFTP server breaks lock-step-iness of TFTP
  osdep.c: Fix accept4 fallback
  pc: add rombar to compat properties for pc-0.10 and pc-0.11
  pci: allow loading roms via fw_cfg.
  roms: rework rom loading via fw
  fw_cfg: rom loader tweaks.
  roms: minor fixes and cleanups.
  pc: add machine type for 0.12
  loader: more ignores for rom intended to be loaded by the bios
  vnc_refresh: return if vd->timer is NULL
  QMP: Don't free async event's 'data'
  Handle TFTP ERROR from client
  dmg: fix ->open failure
  virtio-pci: thinko fix
  pc-bios: Update README (SeaBIOS)
  vmware_vga: Check cursor dimensions passed from guest to avoid buffer overflow
  remove pending exception on vcpu reset.
  Fix CPU topology initialization
  ...

Conflicts:
	hw/pc.c
	hw/pci.h
	qemu-options.hx

Signed-off-by: Avi Kivity <avi@redhat.com>

8 files changed, 97 insertions, 37 deletions

diff --git a/hw/fw_cfg.c b/hw/fw_cfg.c
index fe9c52758..ea120ba55 100644
--- a/hw/fw_cfg.c
+++ b/hw/fw_cfg.c
@@ -278,7 +278,7 @@ int fw_cfg_add_file(FWCfgState *s,  const char *dir, const char *filename,
                     uint8_t *data, uint32_t len)
 {
     const char *basename;
-    int index;
+    int i, index;
 
     if (!s->files) {
         int dsize = sizeof(uint32_t) + sizeof(FWCfgFile) * FW_CFG_FILE_SLOTS;
@@ -300,13 +300,17 @@ int fw_cfg_add_file(FWCfgState *s,  const char *dir, const char *filename,
     } else {
         basename = filename;
     }
-    if (dir) {
-        snprintf(s->files->f[index].name, sizeof(s->files->f[index].name),
-                 "%s/%s", dir, basename);
-    } else {
-        snprintf(s->files->f[index].name, sizeof(s->files->f[index].name),
-                 "%s", basename);
+
+    snprintf(s->files->f[index].name, sizeof(s->files->f[index].name),
+             "%s/%s", dir, basename);
+    for (i = 0; i < index; i++) {
+        if (strcmp(s->files->f[index].name, s->files->f[i].name) == 0) {
+            FW_CFG_DPRINTF("%s: skip duplicate: %s\n", __FUNCTION__,
+                           s->files->f[index].name);
+            return 1;
+        }
     }
+
     s->files->f[index].size   = cpu_to_be32(len);
     s->files->f[index].select = cpu_to_be16(FW_CFG_FILE_FIRST + index);
     FW_CFG_DPRINTF("%s: #%d: %s (%d bytes)\n", __FUNCTION__,
diff --git a/hw/loader.c b/hw/loader.c
index eef385eb5..b3bbd77d1 100644
--- a/hw/loader.c
+++ b/hw/loader.c
@@ -535,6 +535,7 @@ struct Rom {
     QTAILQ_ENTRY(Rom) next;
 };
 
+static FWCfgState *fw_cfg;
 static QTAILQ_HEAD(, Rom) roms = QTAILQ_HEAD_INITIALIZER(roms);
 int rom_enable_driver_roms;
 
@@ -556,7 +557,7 @@ static void rom_insert(Rom *rom)
     QTAILQ_INSERT_TAIL(&roms, rom, next);
 }
 
-int rom_add_file(const char *file, const char *fw_dir, const char *fw_file,
+int rom_add_file(const char *file, const char *fw_dir,
                  target_phys_addr_t addr)
 {
     Rom *rom;
@@ -576,8 +577,10 @@ int rom_add_file(const char *file, const char *fw_dir, const char *fw_file,
         goto err;
     }
 
-    rom->fw_dir  = fw_dir  ? qemu_strdup(fw_dir)  : NULL;
-    rom->fw_file = fw_file ? qemu_strdup(fw_file) : NULL;
+    if (fw_dir) {
+        rom->fw_dir  = qemu_strdup(fw_dir);
+        rom->fw_file = qemu_strdup(file);
+    }
     rom->addr    = addr;
     rom->romsize = lseek(fd, 0, SEEK_END);
     rom->data    = qemu_mallocz(rom->romsize);
@@ -590,6 +593,8 @@ int rom_add_file(const char *file, const char *fw_dir, const char *fw_file,
     }
     close(fd);
     rom_insert(rom);
+    if (rom->fw_file && fw_cfg)
+        fw_cfg_add_file(fw_cfg, rom->fw_dir, rom->fw_file, rom->data, rom->romsize);
     return 0;
 
 err:
@@ -621,14 +626,14 @@ int rom_add_vga(const char *file)
 {
     if (!rom_enable_driver_roms)
         return 0;
-    return rom_add_file(file, "vgaroms", file, 0);
+    return rom_add_file(file, "vgaroms", 0);
 }
 
 int rom_add_option(const char *file)
 {
     if (!rom_enable_driver_roms)
         return 0;
-    return rom_add_file(file, "genroms", file, 0);
+    return rom_add_file(file, "genroms", 0);
 }
 
 static void rom_reset(void *unused)
@@ -639,8 +644,9 @@ static void rom_reset(void *unused)
         if (rom->fw_file) {
             continue;
         }
-        if (rom->data == NULL)
+        if (rom->data == NULL) {
             continue;
+        }
         cpu_physical_memory_write_rom(rom->addr, rom->data, rom->romsize);
         if (rom->isrom) {
             /* rom needs to be written only once */
@@ -678,16 +684,9 @@ int rom_load_all(void)
     return 0;
 }
 
-int rom_load_fw(void *fw_cfg)
+void rom_set_fw(void *f)
 {
-    Rom *rom;
-
-    QTAILQ_FOREACH(rom, &roms, next) {
-        if (!rom->fw_file)
-            continue;
-        fw_cfg_add_file(fw_cfg, rom->fw_dir, rom->fw_file, rom->data, rom->romsize);
-    }
-    return 0;
+    fw_cfg = f;
 }
 
 static Rom *find_rom(target_phys_addr_t addr)
@@ -695,10 +694,15 @@ static Rom *find_rom(target_phys_addr_t addr)
     Rom *rom;
 
     QTAILQ_FOREACH(rom, &roms, next) {
-        if (rom->addr > addr)
+        if (rom->fw_file) {
             continue;
-        if (rom->addr + rom->romsize < addr)
+        }
+        if (rom->addr > addr) {
+            continue;
+        }
+        if (rom->addr + rom->romsize < addr) {
             continue;
+        }
         return rom;
     }
     return NULL;
@@ -717,12 +721,18 @@ int rom_copy(uint8_t *dest, target_phys_addr_t addr, size_t size)
     Rom *rom;
 
     QTAILQ_FOREACH(rom, &roms, next) {
-        if (rom->addr + rom->romsize < addr)
+        if (rom->fw_file) {
             continue;
-        if (rom->addr > end)
+        }
+        if (rom->addr + rom->romsize < addr) {
+            continue;
+        }
+        if (rom->addr > end) {
             break;
-        if (!rom->data)
+        }
+        if (!rom->data) {
             continue;
+        }
 
         d = dest + (rom->addr - addr);
         s = rom->data;
@@ -765,10 +775,9 @@ void do_info_roms(Monitor *mon)
                            rom->isrom ? "rom" : "ram",
                            rom->name);
         } else {
-            monitor_printf(mon, "fw=%s%s%s"
+            monitor_printf(mon, "fw=%s/%s"
                            " size=0x%06zx name=\"%s\" \n",
-                           rom->fw_dir ? rom->fw_dir : "",
-                           rom->fw_dir ? "/" : "",
+                           rom->fw_dir,
                            rom->fw_file,
                            rom->romsize,
                            rom->name);
diff --git a/hw/loader.h b/hw/loader.h
index 77beb0e93..8ff3c9445 100644
--- a/hw/loader.h
+++ b/hw/loader.h
@@ -19,18 +19,19 @@ void pstrcpy_targphys(const char *name,
                       target_phys_addr_t dest, int buf_size,
                       const char *source);
 
-int rom_add_file(const char *file, const char *fw_dir, const char *fw_file,
+
+int rom_add_file(const char *file, const char *fw_dir,
                  target_phys_addr_t addr);
 int rom_add_blob(const char *name, const void *blob, size_t len,
                  target_phys_addr_t addr);
 int rom_load_all(void);
-int rom_load_fw(void *fw_cfg);
+void rom_set_fw(void *f);
 int rom_copy(uint8_t *dest, target_phys_addr_t addr, size_t size);
 void *rom_ptr(target_phys_addr_t addr);
 void do_info_roms(Monitor *mon);
 
 #define rom_add_file_fixed(_f, _a)              \
-    rom_add_file(_f, NULL, NULL, _a)
+    rom_add_file(_f, NULL, _a)
 #define rom_add_blob_fixed(_f, _b, _l, _a)      \
     rom_add_blob(_f, _b, _l, _a)
 
diff --git a/hw/pc.c b/hw/pc.c
index 51603f8cf..78a07c2fd 100644
--- a/hw/pc.c
+++ b/hw/pc.c
@@ -1105,6 +1105,7 @@ static void pc_init1(ram_addr_t ram_size,
                                  bios_size, bios_offset | IO_MEM_ROM);
 
     fw_cfg = bochs_bios_init();
+    rom_set_fw(fw_cfg);
 
     if (linux_boot) {
         load_linux(fw_cfg, kernel_filename, initrd_filename, kernel_cmdline, below_4g_mem_size);
@@ -1292,8 +1293,6 @@ static void pc_init1(ram_addr_t ram_size,
         }
     }
 
-    rom_load_fw(fw_cfg);
-
 #ifdef CONFIG_KVM_DEVICE_ASSIGNMENT
     if (kvm_enabled()) {
         add_assigned_devices(pci_bus, assigned_devices, assigned_devices_index);
@@ -1336,7 +1335,7 @@ void cmos_set_s3_resume(void)
 }
 
 static QEMUMachine pc_machine = {
-    .name = "pc-0.11",
+    .name = "pc-0.12",
     .alias = "pc",
     .desc = "Standard PC",
     .init = pc_init_pci,
@@ -1344,6 +1343,25 @@ static QEMUMachine pc_machine = {
     .is_default = 1,
 };
 
+static QEMUMachine pc_machine_v0_11 = {
+    .name = "pc-0.11",
+    .desc = "Standard PC, qemu 0.11",
+    .init = pc_init_pci,
+    .max_cpus = 255,
+    .compat_props = (GlobalProperty[]) {
+        {
+            .driver   = "virtio-blk-pci",
+            .property = "vectors",
+            .value    = stringify(0),
+        },{
+            .driver   = "PCI",
+            .property = "rombar",
+            .value    = stringify(0),
+        },
+        { /* end of list */ }
+    }
+};
+
 static QEMUMachine pc_machine_v0_10 = {
     .name = "pc-0.10",
     .desc = "Standard PC, qemu 0.10",
@@ -1366,6 +1384,10 @@ static QEMUMachine pc_machine_v0_10 = {
             .driver   = "virtio-blk-pci",
             .property = "vectors",
             .value    = stringify(0),
+        },{
+            .driver   = "PCI",
+            .property = "rombar",
+            .value    = stringify(0),
         },
         { /* end of list */ }
     },
@@ -1381,6 +1403,7 @@ static QEMUMachine isapc_machine = {
 static void pc_machine_init(void)
 {
     qemu_register_machine(&pc_machine);
+    qemu_register_machine(&pc_machine_v0_11);
     qemu_register_machine(&pc_machine_v0_10);
     qemu_register_machine(&isapc_machine);
 }
diff --git a/hw/pci.c b/hw/pci.c
index 637289b9b..861d42784 100644
--- a/hw/pci.c
+++ b/hw/pci.c
@@ -67,6 +67,7 @@ static struct BusInfo pci_bus_info = {
     .props      = (Property[]) {
         DEFINE_PROP_PCI_DEVFN("addr", PCIDevice, devfn, -1),
         DEFINE_PROP_STRING("romfile", PCIDevice, romfile),
+        DEFINE_PROP_UINT32("rombar",  PCIDevice, rom_bar, 1),
         DEFINE_PROP_END_OF_LIST()
     }
 };
@@ -1612,6 +1613,20 @@ static int pci_add_option_rom(PCIDevice *pdev)
     if (strlen(pdev->romfile) == 0)
         return 0;
 
+    if (!pdev->rom_bar) {
+        /*
+         * Load rom via fw_cfg instead of creating a rom bar,
+         * for 0.11 compatibility.
+         */
+        int class = pci_get_word(pdev->config + PCI_CLASS_DEVICE);
+        if (class == 0x0300) {
+            rom_add_vga(pdev->romfile);
+        } else {
+            rom_add_option(pdev->romfile);
+        }
+        return 0;
+    }
+
     path = qemu_find_file(QEMU_FILE_TYPE_BIOS, pdev->romfile);
     if (path == NULL) {
         path = qemu_strdup(pdev->romfile);
diff --git a/hw/pci.h b/hw/pci.h
index 5d82cce4e..a225a6a2a 100644
--- a/hw/pci.h
+++ b/hw/pci.h
@@ -271,6 +271,7 @@ struct PCIDevice {
     /* Location of option rom */
     char *romfile;
     ram_addr_t rom_offset;
+    uint32_t rom_bar;
 
     /* How much space does an MSIX table need. */
     /* The spec requires giving the table structure
diff --git a/hw/virtio-pci.c b/hw/virtio-pci.c
index 62b46bd48..359415226 100644
--- a/hw/virtio-pci.c
+++ b/hw/virtio-pci.c
@@ -372,7 +372,7 @@ static void virtio_write_config(PCIDevice *pci_dev, uint32_t address,
 
     if (PCI_COMMAND == address) {
         if (!(val & PCI_COMMAND_MASTER)) {
-            proxy->vdev->status &= !VIRTIO_CONFIG_S_DRIVER_OK;
+            proxy->vdev->status &= ~VIRTIO_CONFIG_S_DRIVER_OK;
         }
     }
 
diff --git a/hw/vmware_vga.c b/hw/vmware_vga.c
index 7ab1c7910..5e969aedb 100644
--- a/hw/vmware_vga.c
+++ b/hw/vmware_vga.c
@@ -562,6 +562,13 @@ static void vmsvga_fifo_run(struct vmsvga_state_s *s)
             cursor.height = y = vmsvga_fifo_read(s);
             vmsvga_fifo_read(s);
             cursor.bpp = vmsvga_fifo_read(s);
+
+	    if (SVGA_BITMAP_SIZE(x, y) > sizeof cursor.mask ||
+		SVGA_PIXMAP_SIZE(x, y, cursor.bpp) > sizeof cursor.image) {
+		    args = SVGA_BITMAP_SIZE(x, y) + SVGA_PIXMAP_SIZE(x, y, cursor.bpp);
+		    goto badcmd;
+	    }
+
             for (args = 0; args < SVGA_BITMAP_SIZE(x, y); args ++)
                 cursor.mask[args] = vmsvga_fifo_read_raw(s);
             for (args = 0; args < SVGA_PIXMAP_SIZE(x, y, cursor.bpp); args ++)