rtl8139: support byte read to TxStatus registers

Some drivers (such as win7) use byte read for TxStatus registers, so we need to
support this to let guest driver behave correctly.

For writing, only double-word access is allowed by spec.

Signed-off-by: Jason Wang <[email protected]>
Signed-off-by: Michael S. Tsirkin <[email protected]>

rtl8139: remove unused marco

Signed-off-by: Jason Wang <[email protected]>
Signed-off-by: Michael S. Tsirkin <[email protected]>

rtl8139: limit transmission buffer size in c+ mode

The tx buffer would be re-allocated for tx descriptor with big size
and without LS bit set, this would make guest driver could easily let
qemu to allocate unlimited.

In linux host, a glib failure were easy to be triggered:

GLib-ERROR **: gmem.c:176: failed to allocate 18446744071562067968 bytes

This patch fix this by adding a limit. As the spec didn't tell the maximum size
of buffer allowed, stick it to current CP_TX_BUFFER_SIZE (65536).

Changes from V1:

Drop the while statement and s->cplus_txbuffer check.

Signed-off-by: Jason Wang <[email protected]>
Reviewed-by: Stefan Hajnoczi <[email protected]>
Signed-off-by: Michael S. Tsirkin <[email protected]>

pci_regs: Add PCI_EXP_TYPE_PCIE_BRIDGE

Signed-off-by: Anthony PERARD <[email protected]>
Signed-off-by: Michael S. Tsirkin <[email protected]>

virtio-net: add DATA_VALID flag

Add DATA_VALID flag from the Linux header, to
keep us in sync with that.

Signed-off-by: Michael S. Tsirkin <[email protected]>

pci_bridge: upper 32 bit are long registers

Use pci_set_long for accesses.

Signed-off-by: Michael S. Tsirkin <[email protected]>

pci: fix bridge IO/BASE

commit 5caef97a16010f818ea8b950e2ee24ba876643ad introduced
a regression: we do not make IO base/limit upper 16
bit registers writeable, so we should report a 16 bit
IO range type, not a 32 bit one.
Note that PCI_PREF_RANGE_TYPE_32 is 0x0, but PCI_IO_RANGE_TYPE_32 is 0x1.

In particular, this broke sparc64.

Note: this just reverts to behaviour prior to the commit above.
Making PCI_IO_BASE_UPPER16 and PCI_IO_LIMIT_UPPER16
registers writeable should, and seems to, work just as well, but
as no system seems to actually be interested in 32 bit IO,
let's not make unnecessary changes.

Signed-off-by: Michael S. Tsirkin <[email protected]>

pcie: drop functionality moved to core

Now that core sets memory type correctly,
remove this code from pcie port implementation.

Signed-off-by: Michael S. Tsirkin <[email protected]>

pci: set memory type for memory behind the bridge

As we make upper bits in IO and prefetcheable memory
registers writeable, we should declare support
for 64 bit prefetcheable memory and 32 bit io
in the bridge.

This changes the default for apb, dec, but I'm guessing
they got the defaults wrong by accident.
Alternatively, we could let bridges declare lack of
64 bit support and make the upper bits read-only zero.

Reported-by: Gerd Hoffmann <[email protected]>
Signed-off-by: Michael S. Tsirkin <[email protected]>

pci: add standard bridge device

This adds support for a standard pci to pci bridge,
enabling support for more than 32 PCI devices in the system.
Device hotplug is supported by means of SHPC controller.
For guests with an SHPC driver, this allows robust hotplug
and even hotplug of nested bridges, up to 31 devices
per bridge.

Signed-off-by: Michael S. Tsirkin <[email protected]>

slotid: add slot id capability

This capability makes it possible for the guest to
report a unique chassis identifier to the user.

The spec also recommends making chassis indentifier
persist in eeprom.
This isn't implemented.

Signed-off-by: Michael S. Tsirkin <[email protected]>

shpc: standard hot plug controller

This adds support for SHPC interface, as defined by PCI Standard
Hot-Plug Controller and Subsystem Specification, Rev 1.0
http://www.pcisig.com/specifications/conventional/pci_hot_plug/SHPC_10

Only SHPC intergrated with a PCI-to-PCI bridge is supported,
SHPC integrated with a host bridge would need more work.

All main SHPC features are supported:
- MRL sensor
- Attention button
- Attention indicator
- Power indicator

Wake on hotplug and serr generation are stubbed out but unused
as we don't have interfaces to generate these events ATM.

One issue that isn't completely resolved is that qemu currently
expects an "eject" interface, which SHPC does not provide: it merely
removes the power to device and it's up to the user to remove the device
from slot. This patch works around that by ejecting the device
when power is removed and power LED goes off.

Signed-off-by: Michael S. Tsirkin <[email protected]>

pci_bridge: user-friendly default bus name

For a pci bridge device, if we don't override
the name with custom code, the bus will be addressed as
<id>.0, where id is the id specified by the user.

Since PCI Bridge devices have a single bus each, we don't need
the index: address the bus using the parent device name.
This is better since this way users don't care about
our internal bus/device distinctions.

As far as I could see, we only have built-in
bridges at this point which always override the
name. So this change will only affect ioh3420.c.

Signed-off-by: Michael S. Tsirkin <[email protected]>

pci: make another unused extern function static

Make pci_find_bus static and rename to pci_find_bus_nr to match
functionality.

Signed-off-by: Michael S. Tsirkin <[email protected]>

pci: don't export an internal function

Make an internal function, pci_parse_devaddr,
static.

Signed-off-by: Michael S. Tsirkin <[email protected]>

pci_regs: Fix value of PCI_EXP_TYPE_RC_EC.

Value check in PCI Express Base Specification rev 1.1

Signed-off-by: Anthony PERARD <[email protected]>
Signed-off-by: Michael S. Tsirkin <[email protected]>

pci: Do not check if a bus exist in pci_parse_devaddr.

Actually, pci_parse_devaddr checks if the dom/bus of the PCI address exist. But
this should be the jobs of a caller. In fact, the two callers of this function
will try to retrieve the PCIBus related to the devaddr and return an error if
they cannot.

Signed-off-by: Anthony PERARD <[email protected]>
Signed-off-by: Michael S. Tsirkin <[email protected]>

pci_bridge: fix status: do not override cap bit

target-lm32/microblaze: Drop second CPU{LM32, MB}State typedef

Commit 9b9a970a23625de4ae6b7461906a9a0d98d3ca95
(target-lm32/microblaze: Typedef struct CPU{MB,LM32}State)
introduced necessary typedefs for cpu_mmu_index() and mmu.h
respectively.

On some GCC versions this leads to "error: redefinition of typedef".

Drop the original typedef to hopefully fix the build.

Signed-off-by: Andreas Färber <[email protected]>
Signed-off-by: Anthony Liguori <[email protected]>

Merge remote-tracking branch 'afaerber/qom-cpu.v5' into staging

* afaerber/qom-cpu.v5: (43 commits)
  qom: Introduce CPU class
  Rename CPUState -> CPUArchState
  xtensa hw/: Don't use CPUState
  sparc hw/: Don't use CPUState
  sh4 hw/: Don't use CPUState
  s390x hw/: Don't use CPUState
  ppc hw/: Don't use CPUState
  mips hw/: Don't use CPUState
  microblaze hw/: Don't use CPUState
  m68k hw/: Don't use CPUState
  lm32 hw/: Don't use CPUState
  i386 hw/: Don't use CPUState
  cris hw/: Don't use CPUState
  arm hw/: Don't use CPUState
  alpha hw/: Don't use CPUState
  xtensa-semi: Don't use CPUState
  m68k-semi: Don't use CPUState
  arm-semi: Don't use CPUState
  target-xtensa: Don't overuse CPUState
  target-unicore32: Don't overuse CPUState
  ...

vnc: Limit r/w access to size of allocated memory

This fixes memory reads and writes which exceeded the upper limit
of allocated memory vd->guest.ds->data and vd->server->data.

Cc: Anthony Liguori <[email protected]>
Signed-off-by: Stefan Weil <[email protected]>
Signed-off-by: Anthony Liguori <[email protected]>

vnc: don't mess up with iohandlers in the vnc thread

The threaded VNC servers messed up with QEMU fd handlers without
any kind of locking, and that can cause some nasty race conditions.

Using qemu_mutex_lock_iothread() won't work because vnc_dpy_cpy(),
which will wait for the current job queue to finish, can be called with
the iothread lock held.

Instead, we now store the data in a temporary buffer, and use a bottom
half to notify the main thread that new data is available.

vnc_[un]lock_ouput() is still needed to access VncState members like
abort, csock or jobs_buffer.

Signed-off-by: Corentin Chary <[email protected]>
Signed-off-by: Anthony Liguori <[email protected]>

qom: Introduce CPU class

Reintroduce CPUState as QOM object: It's abstract and derived directly
from TYPE_OBJECT for compatibility with the user emulators.
The identifier CPUState avoids conflicts between CPU() and the struct.

Introduce $(qom-twice-y) to build it separately for system and for user
emulators.

Prepare a virtual reset method, (re)introduce cpu_reset() as wrapper.

Signed-off-by: Andreas Färber <[email protected]>
Reviewed-by: Anthony Liguori <[email protected]>

Rename CPUState -> CPUArchState

Scripted conversion:
  for file in *.[hc] hw/*.[hc] hw/kvm/*.[hc] linux-user/*.[hc] linux-user/m68k/*.[hc] bsd-user/*.[hc] darwin-user/*.[hc] tcg/*/*.[hc] target-*/cpu.h; do
    sed -i "s/CPUState/CPUArchState/g" $file
  done

All occurrences of CPUArchState are expected to be replaced by QOM CPUState,
once all targets are QOM'ified and common fields have been extracted.

Signed-off-by: Andreas Färber <[email protected]>
Reviewed-by: Anthony Liguori <[email protected]>

xtensa hw/: Don't use CPUState

Scripted conversion:
  for file in hw/xtensa_*.[hc]; do
    sed -i "s/CPUState/CPUXtensaState/g" $file
  done

Signed-off-by: Andreas Färber <[email protected]>
Acked-by: Anthony Liguori <[email protected]>

sparc hw/: Don't use CPUState

Scripted conversion:
  for file in hw/sun4m.c hw/sun4u.c hw/grlib.h hw/leon3.c; do
    sed -i "s/CPUState/CPUSPARCState/g" $file
  done

Signed-off-by: Andreas Färber <[email protected]>
Acked-by: Anthony Liguori <[email protected]>

sh4 hw/: Don't use CPUState

Scripted conversion:
  for file in hw/sh.h hw/shix.c hw/r2d.c; do
    sed -i "s/CPUState/CPUSH4State/g" $file
  done

Signed-off-by: Andreas Färber <[email protected]>
Acked-by: Anthony Liguori <[email protected]>

s390x hw/: Don't use CPUState

Scripted conversion:
  for file in hw/s390-*.[hc]; do
    sed -i "s/CPUState/CPUS390XState/g" $file
  done

Signed-off-by: Andreas Färber <[email protected]>
Acked-by: Anthony Liguori <[email protected]>

ppc hw/: Don't use CPUState

Scripted conversion:
  for file in hw/ppc*.[hc] hw/mpc8544_guts.c hw/spapr*.[hc] hw/virtex_ml507.c hw/xics.c; do
    sed -i "s/CPUState/CPUPPCState/g" $file
  done

Signed-off-by: Andreas Färber <[email protected]>
Acked-by: Anthony Liguori <[email protected]>

mips hw/: Don't use CPUState

Scripted conversion:
  for file in hw/mips_*.[hc]; do
    sed -i "s/CPUState/CPUMIPSState/g" $file
  done

Signed-off-by: Andreas Färber <[email protected]>
Acked-by: Anthony Liguori <[email protected]>

microblaze hw/: Don't use CPUState

Scripted conversion:
  for file in hw/microblaze_*.[hc] hw/petalogix_ml605_mmu.c hw/petalogix_s3adsp1800_mmu.c; do
    sed -i "s/CPUState/CPUMBState/g" $file
  done

Signed-off-by: Andreas Färber <[email protected]>
Acked-by: Anthony Liguori <[email protected]>

m68k hw/: Don't use CPUState

Scripted conversion:
  for file in hw/an5206.c hw/dummy_m68k.c hw/mcf.h hw/mcf5206.c hw/mcf5208.c hw/mcf_intc.c; do
    sed -i "s/CPUState/CPUM68KState/g" $file
  done

Signed-off-by: Andreas Färber <[email protected]>
Acked-by: Anthony Liguori <[email protected]>

lm32 hw/: Don't use CPUState

Scripted conversion:
  for file in hw/lm32_boards.c hw/milkymist.c; do
    sed -i "s/CPUState/CPULM32State/g" $file
  done

Signed-off-by: Andreas Färber <[email protected]>
Acked-by: Anthony Liguori <[email protected]>

i386 hw/: Don't use CPUState

Scripted conversion:
  for file in hw/apic.h hw/kvm/apic.c hw/kvmvapic.c hw/pc.c hw/vmport.c hw/xen_machine_pv.c; do
    sed -i "s/CPUState/CPUX86State/g" $file
  done

Signed-off-by: Andreas Färber <[email protected]>
Acked-by: Anthony Liguori <[email protected]>

cris hw/: Don't use CPUState

Scripted conversion:
  for file in hw/cris-boot.[hc] hw/cris_pic_cpu.c hw/axis_dev88.c hw/etraxfs.h hw/etraxfs_ser.c; do
    sed -i "s/CPUState/CPUCRISState/g" $file
  done

Signed-off-by: Andreas Färber <[email protected]>
Acked-by: Anthony Liguori <[email protected]>

arm hw/: Don't use CPUState

Scripted conversion:
  for file in hw/arm-misc.h hw/arm_boot.c hw/arm_pic.c hw/armv7m.c hw/exynos4210.h hw/highbank.c hw/integratorcp.c hw/musicpal.c hw/omap.h hw/pxa.h hw/pxa2xx_gpio.c hw/pxa2xx_pic.c hw/realview.c hw/strongarm.h hw/versatilepb.c hw/vexpress.c  hw/xilinx_zynq.c ; do
    sed -i "s/CPUState/CPUARMState/g" $file
  done

Signed-off-by: Andreas Färber <[email protected]>
Acked-by: Anthony Liguori <[email protected]>

alpha hw/: Don't use CPUState

Scripted conversion:
  for file in hw/alpha_*.[hc]; do
    sed -i "s/CPUState/CPUAlphaState/g" $file
  done

Signed-off-by: Andreas Färber <[email protected]>
Acked-by: Anthony Liguori <[email protected]>

xtensa-semi: Don't use CPUState

Scripted conversion:
  sed -i "s/CPUState/CPUXtensaState/g" xtensa-semi.c

Signed-off-by: Andreas Färber <[email protected]>
Acked-by: Anthony Liguori <[email protected]>

m68k-semi: Don't use CPUState

Scripted conversion:
  sed -i "s/CPUState/CPUM68KState/g" m68k-semi.c

Signed-off-by: Andreas Färber <[email protected]>
Acked-by: Anthony Liguori <[email protected]>

arm-semi: Don't use CPUState

Scripted conversion:
  sed -i "s/CPUState/CPUARMState/g" arm-semi.c

Signed-off-by: Andreas Färber <[email protected]>
Acked-by: Anthony Liguori <[email protected]>

target-xtensa: Don't overuse CPUState

Scripted conversion:
  sed -i "s/CPUState/CPUXtensaState/g" target-xtensa/*.[hc]
  sed -i "s/#define CPUXtensaState/#define CPUState/" target-xtensa/cpu.h

Signed-off-by: Andreas Färber <[email protected]>
Acked-by: Anthony Liguori <[email protected]>

target-unicore32: Don't overuse CPUState

Scripted conversion:
  sed -i "s/CPUState/CPUUniCore32State/g" target-unicore32/*.[hc]
  sed -i "s/#define CPUUniCore32State/#define CPUState/" target-unicore32/cpu.h

Signed-off-by: Andreas Färber <[email protected]>
Acked-by: Anthony Liguori <[email protected]>

target-sparc: Don't overuse CPUState

Scripted conversion:
  sed -i "s/CPUState/CPUSPARCState/g" target-sparc/*.[hc]
  sed -i "s/#define CPUSPARCState/#define CPUState/" target-sparc/cpu.h

Signed-off-by: Andreas Färber <[email protected]>
Acked-by: Anthony Liguori <[email protected]>

target-sh4: Don't overuse CPUState

Scripted conversion:
  sed -i "s/CPUState/CPUSH4State/g" target-sh4/*.[hc]
  sed -i "s/#define CPUSH4State/#define CPUState/" target-sh4/cpu.h

Signed-off-by: Andreas Färber <[email protected]>
Acked-by: Anthony Liguori <[email protected]>

target-s390x: Don't overuse CPUState

Scripted conversion:
  sed -i "s/CPUState/CPUS390XState/g" target-s390x/*.[hc]
  sed -i "s/#define CPUS390XState/#define CPUState/" target-s390x/cpu.h

Signed-off-by: Andreas Färber <[email protected]>
Acked-by: Anthony Liguori <[email protected]>

target-ppc: Don't overuse CPUState

Scripted conversion:
  sed -i "s/CPUState/CPUPPCState/g" target-ppc/*.[hc]
  sed -i "s/#define CPUPPCState/#define CPUState/" target-ppc/cpu.h

Signed-off-by: Andreas Färber <[email protected]>
Acked-by: Anthony Liguori <[email protected]>

target-mips: Don't overuse CPUState

Scripted conversion:
  sed -i "s/CPUState/CPUMIPSState/g" target-mips/*.[hc]
  sed -i "s/#define CPUMIPSState/#define CPUState/" target-mips/cpu.h

Signed-off-by: Andreas Färber <[email protected]>
Acked-by: Anthony Liguori <[email protected]>

target-microblaze: Don't overuse CPUState

Scripted conversion:
  sed -i "s/CPUState/CPUMBState/g" target-microblaze/*.[hc]
  sed -i "s/#define CPUMBState/#define CPUState/" target-microblaze/cpu.h

Signed-off-by: Andreas Färber <[email protected]>
Acked-by: Anthony Liguori <[email protected]>

target-m68k: Don't overuse CPUState

Scripted conversion:
  sed -i "s/CPUState/CPUM68KState/g" target-m68k/*.[hc]
  sed -i "s/#define CPUM68KState/#define CPUState/" target-m68k/cpu.h

Signed-off-by: Andreas Färber <[email protected]>
Acked-by: Anthony Liguori <[email protected]>

target-lm32: Don't overuse CPUState

Scripted conversion:
  sed -i "s/CPUState/CPULM32State/g" target-lm32/*.[hc]
  sed -i "s/#define CPULM32State/#define CPUState/" target-lm32/cpu.h

Signed-off-by: Andreas Färber <[email protected]>
Acked-by: Anthony Liguori <[email protected]>

target-i386: Don't overuse CPUState

Scripted conversion:
  sed -i "s/CPUState/CPUX86State/g" target-i386/*.[hc]
  sed -i "s/#define CPUX86State/#define CPUState/" target-i386/cpu.h

Signed-off-by: Andreas Färber <[email protected]>
Acked-by: Anthony Liguori <[email protected]>

target-cris: Don't overuse CPUState

Scripted conversion:
  sed -i "s/CPUState/CPUCRISState/g" target-cris/*.[hc]
  sed -i "s/#define CPUCRISState/#define CPUState/" target-cris/cpu.h

Signed-off-by: Andreas Färber <[email protected]>
Acked-by: Anthony Liguori <[email protected]>

target-arm: Don't overuse CPUState

Scripted conversion:
  sed -i "s/CPUState/CPUARMState/g" target-arm/*.[hc]
  sed -i "s/#define CPUARMState/#define CPUState/" target-arm/cpu.h

Signed-off-by: Andreas Färber <[email protected]>
Acked-by: Anthony Liguori <[email protected]>
Acked-by: Peter Maydell <[email protected]>

target-alpha: Don't overuse CPUState

Scripted conversion:
  sed -i "s/CPUState/CPUAlphaState/g" target-alpha/*.[hc]
  sed -i "s/#define CPUAlphaState/#define CPUState/" target-alpha/cpu.h

Signed-off-by: Andreas Färber <[email protected]>
Acked-by: Anthony Liguori <[email protected]>

bsd-user: Don't overuse CPUState

Use CPU*State where applicable.

Signed-off-by: Andreas Färber <[email protected]>

darwin-user: Don't overuse CPUState

Use CPU*State where applicable.

Signed-off-by: Andreas Färber <[email protected]>

linux-user: Don't overuse CPUState

In target-specific code use CPU*State.

While at it, fix indentation on those lines.

Signed-off-by: Andreas Färber <[email protected]>

hw/mc146818: Drop unneeded #includes

pc.h and apic.h are not needed; apic.h would drag in x86 CPUState and
is now included directly for TARGET_I386.

isa.h is already #included from mc146818rtc.h.

Signed-off-by: Andreas Färber <[email protected]>
Reviewed-by: Anthony Liguori <[email protected]>

target-unicore32: Rename to CPUUniCore32State

This aids in refactoring CPUState by adopting the common naming scheme.

Signed-off-by: Andreas Färber <[email protected]>
Reviewed-by: Anthony Liguori <[email protected]>

target-sparc: Typedef struct CPUSPARCState early

Will be needed for qemu_irq_ack callback.

Signed-off-by: Andreas Färber <[email protected]>
Reviewed-by: Anthony Liguori <[email protected]>

target-lm32/microblaze: Typedef struct CPU{MB,LM32}State

Signed-off-by: Andreas Färber <[email protected]>
Reviewed-by: Anthony Liguori <[email protected]>

monitor: Avoid CPUState in read/write functions

Signed-off-by: Andreas Färber <[email protected]>
Reviewed-by: Anthony Liguori <[email protected]>

monitor: Don't access registers through CPUState

Use CPUX86State etc. instead (hand-converted).

Signed-off-by: Andreas Färber <[email protected]>
Reviewed-by: Anthony Liguori <[email protected]>

Rename cpu_reset() to cpu_state_reset()

Frees the identifier cpu_reset for QOM CPUs (manual rename).

Don't hide the parameter type behind explicit casts, use static
functions with strongly typed argument to indirect.

Signed-off-by: Andreas Färber <[email protected]>
Reviewed-by: Anthony Liguori <[email protected]>

PPC: 405: Use proper CPU reset

On ppc405ep there is a register that allows for software to reset the
core, but not the whole system. Implement this reset using a reset
interrupt.

This gets rid of a bunch of #if 0'ed code.

Reported-by: Andreas Färber <[email protected]>
Signed-off-by: Alexander Graf <[email protected]>
Signed-off-by: Andreas Färber <[email protected]>

qom: Introduce object_class_get_list()

This function allows to obtain a singly-linked list of classes, which
can be sorted by the caller.

Signed-off-by: Andreas Färber <[email protected]>
Cc: Anthony Liguori <[email protected]>
Signed-off-by: Anthony Liguori <[email protected]>

qom/object.c: rename type_class_init() to type_initialize()

Function name type_class_init() gave us a wrong impression of separation
of type's "class" and "object" entities initialization. Name type_initialize()
is more appropriate for type_class_init() function (considering what operations
it performs).

Signed-off-by: Igor Mitsyanko <[email protected]>
Signed-off-by: Anthony Liguori <[email protected]>

qom: if @instance_size==0, assign size of object to parent object size

QOM documentation states that for objects of type with @instance_size == 0 size
will be assigned to match parent object's size. But currently this feauture is
not implemented and qemu asserts during creation of object with zero instance_size.

Set appropriate value for type instance_size during type_class_init() call.
object_initialize_with_type() must call type_class_init() before asserting
type->instance_size, and object_new_with_type() must call type_class_init() before
object allocation.

Signed-off-by: Igor Mitsyanko <[email protected]>
Signed-off-by: Anthony Liguori <[email protected]>

kvmvapic: align start address as well as size

The kvmvapic code remaps a section of ROM as RAM to allow the guest to
maintain state there.  It is careful to align the section size to a page
boundary, to avoid creating subpages, but neglects to do the same for
the start address.  These leads to an assert later on when the memory
core tries to create a page which is half RAM and half ROM.

Fix by aligning the start address to a page boundary.

This can be triggered by running qemu-system-x86_64 -enable-kvm -vga none.

Signed-off-by: Avi Kivity <[email protected]>
Signed-off-by: Anthony Liguori <[email protected]>

Merge remote-tracking branch 'kiszka/queues/slirp' into staging

* kiszka/queues/slirp:
  slirp: Fix compiler warning for w64
  slirp: Cleanup resources on instance removal
  slirp: Remove unneeded if_queued
  slirp: Fix queue walking in if_start
  slirp: Prevent recursion of if_start
  slirp: Keep next_m always valid

Merge remote-tracking branch 'kraxel/usb.44' into staging

* kraxel/usb.44:
  Endian fix an assertion in usb-msd
  uhci: alloc can't fail, drop check.
  uhci: new uhci_handle_td return code for tds still in flight
  uhci: renumber uhci_handle_td return codes
  uhci: use enum for uhci_handle_td return codes
  uhci: tracing support
  uhci: cancel on schedule stop.
  uhci: fix uhci_async_cancel_all
  uhci: pass addr to uhci_async_alloc
  usb: improve packet state sanity checks
  usb-ohci: DMA writeback bug fixes
  usb-ehci: drop unused isoch_pause variable
  usb: zap hw/ush-{ohic,uhci}.h + init wrappers
  usb: the big rename

qom: Add QOM support to user emulators

Link the Object base class and the module infrastructure for class
registration. Introduce $(universal-obj-y) for objects that are more
common than $(common-obj-y), so that those only get built once.

Call QOM module init for type registration.

Signed-off-by: Andreas Färber <[email protected]>
Cc: Anthony Liguori <[email protected]>
Signed-off-by: Anthony Liguori <[email protected]>

qom: Register QOM infrastructure early

The constructors for QOM TYPE_INTERFACE were executed rather late in
vl.c's main(). Call them very early so that QOM can safely be used for
machines and CPUs.

Signed-off-by: Andreas Färber <[email protected]>
Cc: Anthony Liguori <[email protected]>
Signed-off-by: Anthony Liguori <[email protected]>

kvmclock: Always register type

Currently, the "kvmclock" type is only registered when kvm_enabled().

This breaks when moving type registration to before command line
parsing (so that QOM types can be used for CPU and machine).

Since the QOM classes are lazy-initialized anyway and kvmclock_create()
has another kvm_enabled() check, simply drop the KVM check in
kvmclock_register_types().

kvm-i8259, kvm-apic and kvm-ioapic do not suffer from such a check.

Reviewed-by: please.
Signed-off-by: Andreas Färber <[email protected]>
Reviewed-by: Jan Kiszka <[email protected]>
Cc: Marcelo Tosatti <[email protected]>
Signed-off-by: Anthony Liguori <[email protected]>

slirp: Fix compiler warning for w64

Casting a pointer to an integer value must use uintptr_t or intptr_t
(not long) for portable code. MinGW-w64 requires this because
sizeof(long) != sizeof(void *) for w64 hosts, so casting to long
raises a compiler warning.

I use uintptr_t instead of intptr_t because changing the sign does not
matter here and casting pointers to unsigned values seems more
reasonable (the unsigned value is a non negative offset.

Cc: Jan Kiszka <[email protected]>
Signed-off-by: Stefan Weil <[email protected]>
Signed-off-by: Jan Kiszka <[email protected]>

slirp: Cleanup resources on instance removal

Close & free sockets when shutting down a slirp instance, also release
all buffers.

CC: Michael S. Tsirkin <[email protected]>
Signed-off-by: Jan Kiszka <[email protected]>

slirp: Remove unneeded if_queued

There is now a trivial check on entry of if_start for pending packets,
so we can drop the additional tracking via if_queued.

Signed-off-by: Jan Kiszka <[email protected]>

slirp: Fix queue walking in if_start

Another attempt to get this right: We need to carefully walk both the
fastq and the batchq in if_start while trying to send packets to
possibly not yet resolved hosts on the virtual network.

So far we just requeued a delayed packet where it was and then started
walking the queues from the top again - that couldn't work. Now we pre-
calculate the next packet in the queue so that the current one can
safely be removed if it was sent successfully. We also need to take into
account that the next packet can be from the same session if the current
one was sent and there are no other sessions.

CC: Fabien Chouteau <[email protected]>
CC: Zhi Yong Wu <[email protected]>
CC: Stefan Weil <[email protected]>
Tested-by: Stefan Weil <[email protected]>
Signed-off-by: Jan Kiszka <[email protected]>

slirp: Prevent recursion of if_start

if_start can be called recursively via if_encap. Avoid this as our
scheme of dequeuing packets is not compatible with this.

CC: Fabien Chouteau <[email protected]>
CC: Zhi Yong Wu <[email protected]>
CC: Stefan Weil <[email protected]>
Signed-off-by: Jan Kiszka <[email protected]>

slirp: Keep next_m always valid

Make sure that next_m always points to a packet if batchq is non-empty.
This will simplify walking the queues in if_start.

CC: Fabien Chouteau <[email protected]>
CC: Zhi Yong Wu <[email protected]>
CC: Stefan Weil <[email protected]>
Signed-off-by: Jan Kiszka <[email protected]>

Endian fix an assertion in usb-msd

This fixes a broken endian assumption in an assertion in usb-msd.

Cc: Gerd Hoffman <[email protected]>
Signed-off-by: Benjamin Herrenschmidt <[email protected]>
Signed-off-by: David Gibson <[email protected]>
Signed-off-by: Gerd Hoffmann <[email protected]>

uhci: alloc can't fail, drop check.

Signed-off-by: Gerd Hoffmann <[email protected]>

uhci: new uhci_handle_td return code for tds still in flight

Signed-off-by: Gerd Hoffmann <[email protected]>

uhci: renumber uhci_handle_td return codes

Step #2 (separate for better bisectability): renumber so the silly '-1'
goes away.  Pick a range which doesn't overlap the old values.

Signed-off-by: Gerd Hoffmann <[email protected]>

uhci: use enum for uhci_handle_td return codes

Step #1 (separate for better bisectability): replace numbers with names.

Signed-off-by: Gerd Hoffmann <[email protected]>

uhci: tracing support

Zap DPRINTF, add tracepoints instead.

Signed-off-by: Gerd Hoffmann <[email protected]>

uhci: cancel on schedule stop.

Cancel any in-flight transaction when the guest stops the uhci schedule.

Signed-off-by: Gerd Hoffmann <[email protected]>

uhci: fix uhci_async_cancel_all

It should also free all queues.

Signed-off-by: Gerd Hoffmann <[email protected]>

uhci: pass addr to uhci_async_alloc

Also do async->td initialization in uhci_async_alloc now.
Prepares for adding tracepoints.

Signed-off-by: Gerd Hoffmann <[email protected]>

usb: improve packet state sanity checks

Add a new function to check whenever the packet state is as expected,
log more informations in case it isn't.

Signed-off-by: Gerd Hoffmann <[email protected]>

usb-ohci: DMA writeback bug fixes

This patch fixes two bugs in the OHCI device where the device writes
back data to system memory that should be exclusively under the
control of the guest side driver.

In OHCI specification Section 5.2.7, it mentioned "In all cases, Host
Controller Driver is responsible for the insertion and removal of all
Endpoint Descriptors in the various Host Controller Endpoint
Descriptor lists".  In the ohci_frame_boundary(), ohci_put_hcca()
writes the entire hcca back including the interrupt ED lists which
should be under driver control. This violates the specification and
can race with a host driver updating that list at the same time.

In the OHCI Spec Section 4.6, Transfer Descriptor Queue Processing, it
mentioned "Since the TD pointed to by TailP is not accessed by the HC,
the Host Controller Driver can initialize that TD and link at least
one other to it without creating a coherency or synchronization
problem".  While the function ohci_put_ed() writes the entire endpoint
descriptor back including the TailP which should under driver
control. This violate the specification and can race with a host
driver updating the TD list at the same time.

In each case the solution is to make sure we don't write data which is
under driver control.

Cc: Gerd Hoffman <[email protected]>
Signed-off-by: Wei Yang <[email protected]>
Signed-off-by: David Gibson <[email protected]>
Signed-off-by: Gerd Hoffmann <[email protected]>

usb-ehci: drop unused isoch_pause variable

Signed-off-by: Hans de Goede <[email protected]>
Signed-off-by: Gerd Hoffmann <[email protected]>

usb: zap hw/ush-{ohic,uhci}.h + init wrappers

Remove the uhci and ohci init wrappers, which all wrapped a
pci_create_simple() one-liner.  Switch callsites to call
pci_create_simple directly.  Remove the header files where
the wrappers where declared.

Signed-off-by: Gerd Hoffmann <[email protected]>

usb: the big rename

Reorganize usb source files.  Create a new hw/usb/ directory and move
all usb source code to that place.  Also make filenames a bit more
descriptive.  Host adapters are prefixed with "hch-" now, usb device
emulations are prefixed with "dev-".  Fixup paths Makefile and include
paths to make it compile.  No code changes.

Signed-off-by: Gerd Hoffmann <[email protected]>

Merge remote-tracking branch 'mdroth/qga-pull-3-12-2012' into staging

* mdroth/qga-pull-3-12-2012:
  qemu-ga: add guest-sync-delimited
  qemu-ga: add guest-network-get-interfaces command
  qemu-ga: add win32 guest-suspend-ram command
  qemu-ga: add win32 guest-suspend-disk command.
  qemu-ga: add guest-suspend-hybrid
  qemu-ga: add guest-suspend-ram
  qemu-ga: add guest-suspend-disk

Merge remote-tracking branch 'kwolf/for-anthony' into staging

* kwolf/for-anthony:
  test-coroutine: add performance test for nesting
  coroutine: adding configure option for sigaltstack coroutine backend
  coroutine: adding configure choose mechanism for coroutine backend
  coroutine: adding sigaltstack method (.c source)
  qcow2: Reduce number of I/O requests
  qcow2: Add qcow2_alloc_clusters_at()
  qcow2: Factor out count_cow_clusters
  qmp: convert blockdev-snapshot-sync to a wrapper around transactions
  add mode field to blockdev-snapshot-sync transaction item
  rename blockdev-group-snapshot-sync
  qapi: complete implementation of unions
  use QSIMPLEQ_FOREACH_SAFE when freeing list elements
  Add 'make check-block'
  make check: Add qemu-iotests subset
  qemu-iotests: Mark some tests as quick
  qcow2: Add error messages in qcow2_truncate
  block: handle -EBUSY in bdrv_commit_all()
  qcow2: Add some tracing
  qed: do not evict in-use L2 table cache entries
  Group snapshot: Fix format name for backing file

Merge remote-tracking branch 'qemu-kvm/memory/core' into staging

* qemu-kvm/memory/core:
  memory: get rid of cpu_register_io_memory()
  memory: dispatch directly via MemoryRegion
  exec: fix code tlb entry misused as iotlb in get_page_addr_code()
  memory: store section indices in iotlb instead of io indices
  memory: make phys_page_find() return an unadjusted section

Merge remote-tracking branch 'stefanha/tracing' into staging

* stefanha/tracing:
  vga: add trace event for ppm_save
  console: add some trace events
  maintainers: Add docs/tracing.txt to Tracing
  docs: correct ./configure line in tracing.txt
  trace: make trace_thread_create() use its function arg
  tracetool: Omit useless QEMU_*_ENABLED() check
  trace: Provide a per-event status define for conditional compilation

Merge remote-tracking branch 'qmp/queue/qmp' into staging

* qmp/queue/qmp:
  qapi-schema.json: fix comment for type ObjectPropretyInfo
  qapi-schema: fix typos and explain 'spice' auth
  qjson.h: include compiler.h for GCC_FMT_ATTR

qemu-ga: add guest-sync-delimited

guest-sync leaves it as an exercise to the user as to how to reliably
obtain the response to guest-sync if the client had previously read in a
partial response (due qemu-ga previously being restarted mid-"sentence"
due to reboot, forced restart, etc).

qemu-ga handles this situation on its end by having a client precede
their guest-sync request with a 0xFF byte (invalid UTF-8), which
qemu-ga/QEMU JSON parsers will treat as a flush event. Thus we can
reliably flush the qemu-ga parser state in preparation for receiving
the guest-sync request.

guest-sync-delimited provides the same functionality for a client: when
a guest-sync-delimited is issued, qemu-ga will precede it's response
with a 0xFF byte that the client can use as an indicator to flush its
buffer/parser state in preparation for reliably receiving the
guest-sync-delimited response.

It is also useful as an optimization for clients, since, after issuing a
guest-sync-delimited, clients can safely discard all stale data read
from the channel until the 0xFF is found.

More information available on the wiki:

http://wiki.qemu.org/Features/QAPI/GuestAgent#QEMU_Guest_Agent_Protocol

Signed-off-by: Michael Roth <[email protected]>