commit 39848901
    pc: limit 64 bit hole to 2G by default
introduced a way for management to control
the window allocated to the 64 bit PCI hole.

This is useful, but existing management tools do not know how to set
this property.  As a result, e.g. specifying a large ivshmem device with
size > 4G is broken by default.  For example this configuration no
longer works:

-device ivshmem,size=4294967296,chardev=cfoo
-chardev socket,path=/tmp/sock,id=cfoo,server,nowait

Fix this by detecting that hole size was not specified
and defaulting to the backwards-compatible value of 1 << 62.

Cc: qemu-stable@nongnu.org
Cc: Igor Mammedov <imammedo@redhat.com>
Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>

A PCI device's DMA address space (possibly an IOMMU) is returned by a
method on the PCIBus.  At the moment that only has one caller, so the
method is simply open coded.  We'll need another caller for VFIO, so
this patch introduces a helper/wrapper function.

If IOMMU is not set, the pci_device_iommu_address_space() function
returns the parent's IOMMU skipping the "bus master" address space as
otherwise proper emulation would require more effort for no benefit.
Signed-off-by: NDavid Gibson <david@gibson.dropbear.id.au>
[aik: added inheritance from parent if iommu is not set for the current bus]
Signed-off-by: NAlexey Kardashevskiy <aik@ozlabs.ru>
Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>

virtqueue_get_avail_bytes: when found a indirect desc, we need loop over it.
           /* loop over the indirect descriptor table */
           indirect = 1;
           max = vring_desc_len(desc_pa, i) / sizeof(VRingDesc);
           num_bufs = i = 0;
           desc_pa = vring_desc_addr(desc_pa, i);
But, It init i to 0, then use i to update desc_pa. so we will always get:
desc_pa = vring_desc_addr(desc_pa, 0);
the last two line should swap.

Cc: qemu-stable@nongnu.org
Signed-off-by: NYin Yin <yin.yin@cs2c.com.cn>
Reviewed-by: NStefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>

All callers always use the same values (get_system_memory(),
get_system_io()), so the parameters are pointless.

If one day we decide to eliminate get_system_memory() and
get_system_io(), we will be able to do that more easily by adding the
values to struct QEMUMachineInitArgs.
Signed-off-by: NEduardo Habkost <ehabkost@redhat.com>
Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>

It just needs to set has_pvpanic=false after calling it. This way, it
won't be a special case anymore.
Signed-off-by: NEduardo Habkost <ehabkost@redhat.com>
Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>

Making the older compat functions call the newer compat functions at the
beginning allows the older functions undo what's done by newer compat
functions. e.g.: pc_compat_1_4() will be able to call pc_compat_1_5()
and then set has_pvpanic=false.
Signed-off-by: NEduardo Habkost <ehabkost@redhat.com>
Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>

The pc_init_pci_1_2()/pc_init_pci_1_0() split was made on commit
6fd028f6, in preparation for commit
9953f882. The latter was reverted, so there's
no reason to keep two separate functions that do exactly the same, anymore.
Signed-off-by: NEduardo Habkost <ehabkost@redhat.com>
Cc: Markus Armbruster <armbru@redhat.com>
Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>

Don't explode when the variable is used just a few times, and never
changed.
Signed-off-by: NMarkus Armbruster <armbru@redhat.com>
Reviewed-by: NLaszlo Ersek <lersek@redhat.com>
Reviewed-by: NEduardo Habkost <ehabkost@redhat.com>
Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>

Don't explode QEMUMachineInitArgs before passing it to pc_init1().
Signed-off-by: NMarkus Armbruster <armbru@redhat.com>
Reviewed-by: NLaszlo Ersek <lersek@redhat.com>
Reviewed-by: NEduardo Habkost <ehabkost@redhat.com>
Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>

Pass on the generic arguments unadulterated, and the machine-specific
ones as separate argument.
Signed-off-by: NMarkus Armbruster <armbru@redhat.com>
Acked-by: NAlexander Graf <agraf@suse.de>
Reviewed-by: NLaszlo Ersek <lersek@redhat.com>
Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>

Don't explode when the variable is used just once, and never changed.
Signed-off-by: NMarkus Armbruster <armbru@redhat.com>
Acked-by: NAlexander Graf <agraf@suse.de>
Reviewed-by: NLaszlo Ersek <lersek@redhat.com>
Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>

Don't explode QEMUMachineInitArgs before passing it to
sun4m_hw_init(), sun4uv_init().
Signed-off-by: NMarkus Armbruster <armbru@redhat.com>
Reviewed-by: NLaszlo Ersek <lersek@redhat.com>
Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>

Signed-off-by: NAlex Williamson <alex.williamson@redhat.com>
Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>

ROM files that are put in FW CFG are copied to guest ram, by BIOS, but
they are not backed by RAM so they don't get migrated.

Each time we change two bytes in such a ROM this breaks cross-version
migration: since we can migrate after BIOS has read the first byte but
before it has read the second one, getting an inconsistent state.

Future-proof this by creating, for each such ROM,
an MR serving as the backing store.
This MR is never mapped into guest memory, but it's registered
as RAM so it's migrated with the guest.

Naturally, this only helps for -M 1.7 and up, older machine types
will still have the cross-version migration bug.
Luckily the race window for the problem to trigger is very small,
which is also likely why we didn't notice the cross-version
migration bug in testing yet.
Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>
Reviewed-by: NLaszlo Ersek <lersek@redhat.com>

Migration code assumes that each MR is a multiple of TARGET_PAGE_SIZE:
MR size is divided by TARGET_PAGE_SIZE, so if it isn't migration
never completes.
But this isn't really required for regions set up with
memory_region_init_ram, since that calls qemu_ram_alloc
which aligns size up using TARGET_PAGE_ALIGN.

Align MR size up to full target page sizes, this way
migration completes even if we create a RAM MR
which is not a full target page size.
Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>
Reviewed-by: NLaszlo Ersek <lersek@redhat.com>

Make 1.4 compat code call the 1.6 one, reducing
code duplication. Add comment explaining why we can't
make 1.4 call 1.5 as usual.
Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>
Reviewed-by: NAndreas Färber <afaerber@suse.de>
Reviewed-by: NEduardo Habkost <ehabkost@redhat.com>

target-arm queue

# gpg: Signature made Tue 20 Aug 2013 08:56:28 AM CDT using RSA key ID 14360CDE
# gpg: Can't check signature: public key not found

# By Peter Maydell (20) and Peter Chubb (1)
# Via Peter Maydell
* pmaydell/tags/pull-target-arm-20130820: (21 commits)
  hw/timer/imx_epit: Simplify and fix imx_epit implementation
  default-configs: Fix A9MP and A15MP config names
  hw/cpu/a15mpcore: Wire generic timer outputs to GIC inputs
  target-arm: Implement the generic timer
  target-arm: Support coprocessor registers which do I/O
  target-arm: Allow raw_read() and raw_write() to handle 64 bit regs
  hw/arm/pic_cpu: Remove the now-unneeded arm_pic_init_cpu()
  hw/arm/xilinx_zynq: Don't use arm_pic_init_cpu()
  hw/arm/vexpress: Don't use arm_pic_init_cpu()
  hw/arm/versatilepb: Don't use arm_pic_init_cpu()
  hw/arm/strongarm: Don't use arm_pic_init_cpu()
  hw/arm/realview: Don't use arm_pic_init_cpu()
  hw/arm/omap*: Don't use arm_pic_init_cpu()
  hw/arm/musicpal: Don't use arm_pic_init_cpu()
  hw/arm/kzm: Don't use arm_pic_init_cpu()
  hw/arm/integratorcp: Don't use arm_pic_init_cpu()
  hw/arm/highbank: Don't use arm_pic_init_cpu()
  hw/arm/exynos4210: Don't use arm_pic_init_cpu()
  hw/arm/armv7m: Don't use arm_pic_init_cpu()
  target-arm: Make IRQ and FIQ gpio lines on the CPU object
  ...

Message-id: 1377007680-4934-1-git-send-email-peter.maydell@linaro.org
Signed-off-by: NAnthony Liguori <anthony@codemonkey.ws>

# By Stefan Hajnoczi
# Via Stefan Hajnoczi
* stefanha/block-next:
  aio: drop io_flush argument
  tests: drop event_active_cb()
  thread-pool: drop thread_pool_active()
  dataplane/virtio-blk: drop flush_true() and flush_io()
  block/ssh: drop return_true()
  block/sheepdog: drop have_co_req() and aio_flush_request()
  block/rbd: drop qemu_rbd_aio_flush_cb()
  block/nbd: drop nbd_have_request()
  block/linux-aio: drop qemu_laio_completion_cb()
  block/iscsi: drop iscsi_process_flush()
  block/gluster: drop qemu_gluster_aio_flush_cb()
  block/curl: drop curl_aio_flush()
  aio: stop using .io_flush()
  tests: adjust test-thread-pool to new aio_poll() semantics
  tests: adjust test-aio to new aio_poll() semantics
  dataplane/virtio-blk: check exit conditions before aio_poll()
  block: stop relying on io_flush() in bdrv_drain_all()
  block: ensure bdrv_drain_all() works during bdrv_delete()

Message-id: 1376921877-9576-1-git-send-email-stefanha@redhat.com
Signed-off-by: NAnthony Liguori <anthony@codemonkey.ws>

# By Richard Henderson
# Via Richard Henderson
* rth/axp-next:
  target-alpha: Implement the typhoon iommu
  target-alpha: Consider the superpage when threading and ending TBs
  target-alpha: Use goto_tb in call_pal
  target-alpha: Implement call_pal without an exception

Message-id: 1376720412-2165-1-git-send-email-rth@twiddle.net
Signed-off-by: NAnthony Liguori <anthony@codemonkey.ws>

QOM CPUState refactorings / X86CPU

* gdbstub coprocessor register count bugfix
* QOM instance_post_init infrastructure to override dynamic properties
* X86CPU HyperV preparations for CPU subclasses

# gpg: Signature made Fri 16 Aug 2013 11:49:02 AM CDT using RSA key ID 3E7E013F
# gpg: Can't check signature: public key not found

# By Eduardo Habkost (3) and others
# Via Andreas Färber
* afaerber/tags/qom-cpu-for-anthony:
  cpus: Use cpu_is_stopped() efficiently
  target-i386: Move hyperv_* static globals to X86CPU
  qdev: Set globals in instance_post_init function
  qom: Introduce instance_post_init hook
  tests: Unit tests for qdev global properties handling
  gdbstub: Fix gdb_register_coprocessor() register counting

When imx_epit.c was last refactored, a common usecase (comparison
register zero) broke.  This patch fixes that, and simplifies the code
yet more.  It also fixes a major thinko in the reset path --- the
wrong bits in the control register were being cleared.
Signed-off-by: NPeter Chubb <peter.chubb@nicta.com.au>
Reviewed-by: NJean-Christophe DUBOIS <jcd@tribudubois.net>
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

When individual CONFIG_ switches for the A9MPcore and A15MPcore
devices were created, they were inadvertently given incorrect names
(CONFIG_ARM9MPCORE and CONFIG_ARM15MPCORE). These CPUs are
"Cortex-A9MP" and "Cortex-A15MP", and in particular the ARM9 is
a different (rather older) CPU than the Cortex-A9. Rename the
CONFIG_ switches to bring them into line with the source file
names and CPU names.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Message-id: 1376056215-26391-1-git-send-email-peter.maydell@linaro.org

Now our A15 CPU implements the generic timers, we can wire them
up to the appropriate inputs on the GIC.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Tested-by: NLaurent Desnogues <laurent.desnogues@gmail.com>
Message-id: 1376065080-26661-5-git-send-email-peter.maydell@linaro.org

The ARMv7 architecture specifies a 'generic timer' which is implemented
via cp15 registers. Newer kernels will prefer to use this rather than
a devboard-level timer. Implement the generic timer for TCG; for KVM
we will already use the hardware's virtualized timer for this.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Tested-by: NLaurent Desnogues <laurent.desnogues@gmail.com>
Message-id: 1376065080-26661-4-git-send-email-peter.maydell@linaro.org

Add an ARM_CP_IO flag which an ARMCPRegInfo definition can use to
indicate that the register's implementation does I/O and thus
its accesses need to be surrounded by gen_io_start()/gen_io_end()
in order for icount to work. Most notably, cp registers which
implement clocks or timers need this.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Tested-by: NLaurent Desnogues <laurent.desnogues@gmail.com>
Reviewed-by: NEdgar E. Iglesias <edgar.iglesias@gmail.com>
Message-id: 1376065080-26661-3-git-send-email-peter.maydell@linaro.org

Extend the raw_read() and raw_write() helper accessors so that
they can be used for 64 bit registers as well as 32 bit registers.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Tested-by: NLaurent Desnogues <laurent.desnogues@gmail.com>
Reviewed-by: NEdgar E. Iglesias <edgar.iglesias@gmail.com>
Message-id: 1376065080-26661-2-git-send-email-peter.maydell@linaro.org

Now all the boards have been converted arm_pic_init_cpu()
is unused and can just be deleted.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Message-id: 1375977856-25046-15-git-send-email-peter.maydell@linaro.org

Drop the now-deprecated arm_pic_init_cpu() in favour of directly
getting the IRQ line from the ARMCPU object.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Message-id: 1375977856-25046-14-git-send-email-peter.maydell@linaro.org

Drop the now-deprecated arm_pic_init_cpu() in favour of directly
getting the IRQ line from the ARMCPU object.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Message-id: 1375977856-25046-13-git-send-email-peter.maydell@linaro.org

Drop the now-deprecated arm_pic_init_cpu() in favour of directly
getting the IRQ line from the ARMCPU object.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Message-id: 1375977856-25046-12-git-send-email-peter.maydell@linaro.org

Drop the now-deprecated arm_pic_init_cpu() in favour of directly
getting the IRQ line from the ARMCPU object.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Message-id: 1375977856-25046-11-git-send-email-peter.maydell@linaro.org

Drop the now-deprecated arm_pic_init_cpu() in favour of directly
getting the IRQ line from the ARMCPU object.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Message-id: 1375977856-25046-10-git-send-email-peter.maydell@linaro.org

Drop the now-deprecated arm_pic_init_cpu() in favour of directly
getting the IRQ line from the ARMCPU object.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Message-id: 1375977856-25046-9-git-send-email-peter.maydell@linaro.org

Drop the now-deprecated arm_pic_init_cpu() in favour of directly
getting the IRQ line from the ARMCPU object.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Message-id: 1375977856-25046-8-git-send-email-peter.maydell@linaro.org

Drop the now-deprecated arm_pic_init_cpu() in favour of directly
getting the IRQ line from the ARMCPU object.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Message-id: 1375977856-25046-7-git-send-email-peter.maydell@linaro.org

Drop the now-deprecated arm_pic_init_cpu() in favour of directly
getting the IRQ line from the ARMCPU object.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Message-id: 1375977856-25046-6-git-send-email-peter.maydell@linaro.org

Drop the now-deprecated arm_pic_init_cpu() in favour of directly
getting the IRQ line from the ARMCPU object.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Message-id: 1375977856-25046-5-git-send-email-peter.maydell@linaro.org

Drop the now-deprecated arm_pic_init_cpu() in favour of directly
getting the IRQ line from the ARMCPU object.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Message-id: 1375977856-25046-4-git-send-email-peter.maydell@linaro.org

Drop the now-deprecated arm_pic_init_cpu() in favour of directly
getting the IRQ line from the ARMCPU object.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Message-id: 1375977856-25046-3-git-send-email-peter.maydell@linaro.org

Now that ARMCPU is a subclass of DeviceState, we can make the
CPU's inbound IRQ and FIQ lines be simply gpio lines, which
means we can remove the odd arm_pic shim.

We retain the arm_pic_init_cpu() function as a backwards
compatibility shim layer so we can convert the board models
to get the IRQ and FIQ lines directly from the ARMCPU
object one at a time.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Message-id: 1375977856-25046-2-git-send-email-peter.maydell@linaro.org