pty.h is polluting the global namespace with a CTRL macro.  spitz
thus fails compilation with the patch at
http://article.gmane.org/gmane.comp.emulators.qemu/211337 and
this patch fixes it.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Message-id: 1368533545-650-1-git-send-email-pbonzini@redhat.com
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Otherwise the guest can crash qemu (NULL pointer dereference).

https://bugzilla.redhat.com/show_bug.cgi?id=947691Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
Reviewed-by: NLaszlo Ersek <lersek@redhat.com>
Message-id: 1368534544-11826-1-git-send-email-kraxel@redhat.com
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

This reverts commit 9953f882.
While Markus's analysis is entirely correct, there are 1.6 patches
that fix the bug for real and without requiring machine type hacks.
Let's think of the children who will have to read this code, and
avoid a complicated mess of semantics that differ between <1.5,
1.5, and >1.5.

Conflicts:
	hw/i386/pc_piix.c
	hw/i386/pc_q35.c
	include/hw/i386/pc.h
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Acked-by: NAnthony Liguori <aliguori@us.ibm.com>
Message-id: 1368189483-7915-1-git-send-email-pbonzini@redhat.com
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Signed-off-by: NDong Xu Wang <wdongxu@linux.vnet.ibm.com>
Signed-off-by: NMichael Tokarev <mjt@tls.msk.ru>

Add new devices for various manufacturers, and re-sort Spansion list to
match the order in Linux, which requires chips with a non-zero extended ID
to come first.

With this commit the outstanding differences to Linux rev 55bf75b are:

- Erase size flag differences in s25sl032p, s25sl064p, s25fl016k, s25fl064k
  (These devices have only some blocks that support small erase sizes.)
- Linux lacks n25q128
- Devices without a Jedec ID have been excluded
Signed-off-by: NEd Maste <emaste@freebsd.org>
Signed-off-by: NMichael Tokarev <mjt@tls.msk.ru>

With a SPICE_DISPLAY_CAP_MONITORS_CONFIG capable client, the client needs to
know what part of the primary to use for each monitor. If the guest driver
does not support this, the server sends messages to the client for a
single monitor spanning the entire primary.

As soon as the guest calls spice_qxl_monitors_config_async once, the server
sets the red_worker driver_has_monitors_config flag and stops doing this.

This is a problem when the driver gets unloaded, for example after a reboot
or when switching to a text vc with usermode mode-setting under Linux.

To reproduce this start a multi-mon capable Linux guest which uses
usermode mode-setting and then once X has started switch to a text vc. Note
how the client window does not only not resize, if you try to resize it
manually you always keep blackborders since the aspect is wrong.

This patch calls a new spice-server method called spice_qxl_driver_unload
which clears the driver_has_monitors_config flag inside the server, thereby
fixing this.
Signed-off-by: NHans de Goede <hdegoede@redhat.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

There are several several issues in the current checking:

- The check was based on the minus of unsigned values which can overflow
- It was done after .{set|get}_config() which can lead crash when config_len
  is zero since vdev->config is NULL

Fix this by:

- Validate the address in virtio_pci_config_{read|write}() before
  .{set|get}_config
- Use addition instead minus to do the validation

Cc: Michael S. Tsirkin <mst@redhat.com>
Cc: Petr Matousek <pmatouse@redhat.com>
Signed-off-by: NJason Wang <jasowang@redhat.com>
Acked-by: NMichael S. Tsirkin <mst@redhat.com>
Acked-by: NPetr Matousek <pmatouse@redhat.com>
Message-id: 1367905369-10765-1-git-send-email-jasowang@redhat.com
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

mask notifiers are never called without msix,
so devices with backend masking like vhost don't work.
Call mask notifiers explicitly at
startup/cleanup to make it work.
Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>
Tested-by: NAlexander Graf <agraf@suse.de>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

The device is supposed to reset the Bus Master IDE Active bit in the
status register when 0 is written to the Start/Stop Bus Master bit in
the command register.

In the common cases this happens automatically because bdrv_drain_all()
flushes the requests, but with a large PRDT it could remain set.
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

An IDE bus provided by AHCI can only take a single IDE drive. If you add
a drive as slave, qemu used to accept the command line but the device
wouldn't be actually usable. Catch the situation instead and error out.
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

Commit 32993698 (vhost: disable on tap link down) tries to disable the vhost
also when the peer's link is down. But the check was not done properly, the
vhost were only started when:

1) peer's link is not down
2) virtio-net has already been started.

Since == have a higher precedence than &&, place a brace to make sure both the
conditions were met then does the check. This fixes the crash when doing a savem
after set the link off which let qemu crash and complains:

virtio_net_save: Assertion `!n->vhost_started' failed.

Cc: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: NJason Wang <jasowang@redhat.com>
Message-id: 1366972060-21606-1-git-send-email-jasowang@redhat.com
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Due to various unfortunate reasons we cannot reliable detect a guest
cancelling a packet as soon as it happens, instead we detect cancels
with some delay.

When packets are handled async, and we directly pass the guest memory for
the packet to the usb-device as iovec, this means that the usb-device can
write to guest-memory which the guest has already re-used for other purposes
-> not good!

This patch fixes this by adding an intermediate buffer and writing back not
only the result, but also the data, of async completed packets when scanning
the schedule.
Signed-off-by: NHans de Goede <hdegoede@redhat.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Alloes to pass through usb2 devices on usb1 host controllers if possible.
Brings the libusb implementation to feature-parity with the linux usbfs
code, so the usb-host implementation in 1.5 (libusb) doesn't regress
compared to 1.4 (usbfs).
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

The Atom core (cpu name "n270" in QEMU speak) supports MOVBE. This is
needed when booting 3.8 and later linux kernels built with the MATOM
target because we require MOVBE in order to boot properly now.
Signed-off-by: NBorislav Petkov <bp@suse.de>
[ehabkost: added compat code to disable MOVBE on pc-*-1.4 and older]
Signed-off-by: NEduardo Habkost <ehabkost@redhat.com>
Signed-off-by: NAndreas Färber <afaerber@suse.de>

Reuse it in qdev_prop_set_globals().
Reviewed-by: NEduardo Habkost <ehabkost@redhat.com>
[AF: Renamed from qdev_prop_set_custom_globals()]
Signed-off-by: NAndreas Färber <afaerber@suse.de>

Move error reporting to callers.
Reviewed-by: NEduardo Habkost <ehabkost@redhat.com>
Signed-off-by: NAndreas Färber <afaerber@suse.de>

If no kernel IPL entry is specified, boot the bios and pass if available
device information for the first boot device (as given by the boot index).

The provided information will be used in the next commit from the BIOS.
Signed-off-by: NDominik Dingel <dingel@linux.vnet.ibm.com>
Signed-off-by: NAlexander Graf <agraf@suse.de>

There is no use in have this splitted in two functions.
Signed-off-by: NDominik Dingel <dingel@linux.vnet.ibm.com>
Signed-off-by: NAlexander Graf <agraf@suse.de>

Add a check if the BIOS blob exists before trying to load.
Signed-off-by: NDominik Dingel <dingel@linux.vnet.ibm.com>
Signed-off-by: NAlexander Graf <agraf@suse.de>

Normally, the "tap" device is polled by QEMU if a guest NIC can
receive packets. If a guest NIC is stopped during transfer (rmmod or
ifdown), it may still have packets in a queue which have to be send
to the guest before QEMU enables polling of a "tap" interface via
tap_update_fd_handler().

However the spapr_llan device was missing the qemu_flush_queued_packets()
call so the tap_send_completed() callback was never called and therefore
"tap" interface polling was not enabled ever.

The patch fixes this problem.
Signed-off-by: NAlexey Kardashevskiy <aik@ozlabs.ru>
Signed-off-by: NAlexander Graf <agraf@suse.de>

We should sync params->ram_size after we fixup memory size on
a alignment boundary. Otherwise Guest would exceed the actual
memory region.
Signed-off-by: NTiejun Chen <tiejun.chen@windriver.com>
Signed-off-by: NAlexander Graf <agraf@suse.de>

ePAPR defines the initial values of cpu registers.
This patch initialize the GPRs as per ePAPR specification.

This resolves the issue of guest reboot/reset (guest hang on reboot).
Signed-off-by: NBharat Bhushan <bharat.bhushan@freescale.com>
[agraf: add whitespace line]
Signed-off-by: NAlexander Graf <agraf@suse.de>

Due to a brain outage, this message says "out-of-boards" instead of
"out-of-bounds".
Signed-off-by: NDavid Gibson <david@gibson.dropbear.id.au>
Signed-off-by: NAlexey Kardashevskiy <aik@ozlabs.ru>
Signed-off-by: NAlexander Graf <agraf@suse.de>

PAPR defines LIOBNs (Logical IO Bus Numbers) to be 32-bit, and we check for
values that aren't in the code for H_PUT_TCE.  This patch factors the check
into spapr_tce_find_by_liobn(), which already checks if a 32-bit LIOBN
actually exists.  This will become more important as future patches add
other hypercalls which need to look up a LIOBN.

At the same time we fix the typo in the message.
Signed-off-by: NDavid Gibson <david@gibson.dropbear.id.au>
Signed-off-by: NAlexey Kardashevskiy <aik@ozlabs.ru>
Signed-off-by: NAlexander Graf <agraf@suse.de>

Necessary since memory region accessor assumes read and write
methods are registered. Otherwise reading I/O port 0x7e segfaults.

https://bugzilla.redhat.com/show_bug.cgi?id=954306Signed-off-by: NMarcelo Tosatti <mtosatti@redhat.com>
Reviewed-by: NJan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: NGleb Natapov <gleb@redhat.com>

Port 0x0092 is documented as read/write, so for now return the
endianness state instead of hardcoded 0x00.
Signed-off-by: NJulio Guerra <guerr@julio.in>
[AF: Extracted from larger port 0092 patch]
Signed-off-by: NAndreas Färber <andreas.faerber@web.de>

This prepares for switching from OpenHack'Ware to OpenBIOS.

While touching the error handling code, switch from aborting hw_error()
to fprintf()+exit() and suppress failing without -bios for qtest.
Acked-by: NAlexander Graf <agraf@suse.de>
Signed-off-by: NAndreas Färber <andreas.faerber@web.de>

The value was changed by commit 09d9828a
"PPC: fix hreset_vector for 60x, ...".

Change it back for prep machine to unbreak OpenHack'Ware.
Signed-off-by: NFabien Chouteau <chouteau@adacore.com>
Signed-off-by: NAndreas Färber <andreas.faerber@web.de>

This patch is providing a complete version of the EPIT timer.

Note, however that the GPT timer in the same file is still not
complete.
Signed-off-by: NJean-Christophe DUBOIS <jcd@tribudubois.net>
Message-id: 1365624982-15647-1-git-send-email-jcd@tribudubois.net
Reviewed-by: NPeter Chubb <peter.chubb@nicta.com.au>
[PMM: wrapped an overly long line]
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Since commit 2f7bd829 "qdev: Fix device_add bus assumptions"
it's possible to device_add bus-less device, but if such device is
unplugged it will dereference NULL parent_bus in qdev_unplug().

Fix it by taking in account that parent_bus might be NULL and
skipping bus check.
Signed-off-by: NIgor Mammedov <imammedo@redhat.com>
Message-id: 1367587536-14964-1-git-send-email-imammedo@redhat.com
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

The bus name is wrong since the refactoring.

This keeps the behaviour of the command line.
Signed-off-by: NKONRAD Frederic <fred.konrad@greensocs.com>
Tested-by: NCornelia Huck <cornelia.huck@de.ibm.com>
Message-id: 1367330931-12994-6-git-send-email-fred.konrad@greensocs.com
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

The bus name is wrong since the refactoring.

This keeps the behaviour of the command line.
Signed-off-by: NKONRAD Frederic <fred.konrad@greensocs.com>
Tested-by: NCornelia Huck <cornelia.huck@de.ibm.com>
Message-id: 1367330931-12994-5-git-send-email-fred.konrad@greensocs.com
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

This adds the possibility to create a scsi-bus with a specified name.
Signed-off-by: NKONRAD Frederic <fred.konrad@greensocs.com>
Acked-by: NPaolo Bonzini <pbonzini@redhat.com>
Tested-by: NCornelia Huck <cornelia.huck@de.ibm.com>
Message-id: 1367330931-12994-4-git-send-email-fred.konrad@greensocs.com
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Add virtio_device_set_child_bus_name function.

It will be used with virtio-serial-x and virtio-scsi-x to set the
child bus name before calling virtio-x-device's init.
Signed-off-by: NKONRAD Frederic <fred.konrad@greensocs.com>
Tested-by: NCornelia Huck <cornelia.huck@de.ibm.com>
Message-id: 1367330931-12994-3-git-send-email-fred.konrad@greensocs.com
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

When the proxy id is set, this bus takes the name "id.0" which is expected
to be the virtio-device's first bus.

So force this name to "virtio-bus" as it is an internal bus.
Signed-off-by: NKONRAD Frederic <fred.konrad@greensocs.com>
Tested-by: NCornelia Huck <cornelia.huck@de.ibm.com>
Message-id: 1367330931-12994-2-git-send-email-fred.konrad@greensocs.com
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

This replaces the feature-bit fields on both X86CPU and x86_def_t
structs with an array.

With this, we will be able to simplify code that simply does the same
operation on all feature words (e.g. kvm_check_features_against_host(),
filter_features_for_kvm(), add_flagname_to_bitmaps(), CPU feature-bit
property lookup/registration, and the proposed "feature-words" property)

The following field replacements were made on X86CPU and x86_def_t:

  (cpuid_)features         -> features[FEAT_1_EDX]
  (cpuid_)ext_features     -> features[FEAT_1_ECX]
  (cpuid_)ext2_features    -> features[FEAT_8000_0001_EDX]
  (cpuid_)ext3_features    -> features[FEAT_8000_0001_ECX]
  (cpuid_)ext4_features    -> features[FEAT_C000_0001_EDX]
  (cpuid_)kvm_features     -> features[FEAT_KVM]
  (cpuid_)svm_features     -> features[FEAT_SVM]
  (cpuid_)7_0_ebx_features -> features[FEAT_7_0_EBX]
Signed-off-by: NEduardo Habkost <ehabkost@redhat.com>
Reviewed-by: NIgor Mammedov <imammedo@redhat.com>
Signed-off-by: NAndreas Färber <afaerber@suse.de>

similiar -> similar
recieve -> receive
transfered -> transferred
preperation -> preparation

Most changes are in comments, one modifies a parameter name in a function
prototype.

The spelling fixes were made using codespell.
Signed-off-by: NStefan Weil <sw@weilnetz.de>
Acked-by: NRichard Henderson <rth@twiddle.net>
Signed-off-by: NMichael Tokarev <mjt@tls.msk.ru>

Signed-off-by: NIgor Mammedov <imammedo@redhat.com>
Reviewed-by: NEduardo Habkost <ehabkost@redhat.com>
Signed-off-by: NAndreas Färber <afaerber@suse.de>