While testing the move to async packet handling for interrupt endpoints I
noticed that Windows-XP likes to play tricks with the next pointer for
periodic qh-s, so we should not fail qh / qtd verification when it changes.
Signed-off-by: NHans de Goede <hdegoede@redhat.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Windows links interrupt qtd-s in circles, which means that when interrupt
endpoints return USB_RET_ASYNC, combined with the recent
"ehci: Retry to fill the queue while waiting for td completion" patch,
we keep adding the tds to the queue over and over again, as we detect the
circle from fill_queue, but we call it over and over again ...

This patch fixes this by changing the circle detection to also detect
circling into tds already queued up previously.
Signed-off-by: NHans de Goede <hdegoede@redhat.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

This avoids the q->qtdaddr == p->qtdaddr asserts we have triggering, when
a queue contains multiple completed packages when we cancel the queue.

I triggered this with windows7 + async interrupt endpoint handling (*)
+ not detecting circles in ehci_fill_queue() properly, which makes the qtd
validation in ehci_fill_queue fail, causing cancellation of the queue on every
mouse event ...

*) Which is not going upstream as it will cause loss of interrupt events on
migration.
Signed-off-by: NHans de Goede <hdegoede@redhat.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

ehci_state_writeback() will free the packet, so we should not access
the packet after calling ehci_state_writeback().
Signed-off-by: NHans de Goede <hdegoede@redhat.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

The Linux is more tolerant here as well: Just stop parsing the device
descriptors when an error is detected but do not reset what was found
so far. This allows to run buggy devices with partially invalid
descriptors.
Signed-off-by: NJan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Commit a844ed84 leads to usb-host
detecting devices not right after qemu startup because the guest
isn't running yet.  Instead they are found on the first of the
regular usb device poll runs.  Which is too late for seabios to see
them, so booting from usb sticks fails.

Fix this by adding a vm state change handler which triggers a device
scan when the vm is started.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Elements in qemu SGLists can cross IOMMU page boundaries.  So, in commit
39c138c8 "usb: Fix usb_packet_map() in the
presence of IOMMUs", I changed usb_packet_map() to split up each SGList
element on IOMMU page boundaries and each resulting piece of qemu's memory
space separately to the iovec the usb code uses internally.

That was correct in concept, but the patch has a bug.  The 'base' variable
correctly steps through the dma address of each piece, but then we call
the dma_memory_map() function on the base address of the whole SGList
element every time.

This patch fixes at least one problem using XHCI on the pseries guest
machine.  It didn't affect OHCI because that doesn't use usb_packet_map().
In theory it also affects EHCI, but we haven't observed that in practice.
I think the transfers were small enough on EHCI that they never crossed an
IOMMU page boundary in practice.
Signed-off-by: NDavid Gibson <david@gibson.dropbear.id.au>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Commit 1c380f94 breaks live migration.
DMA stops working for ehci (and probably for any pci device) after
restoring the guest because the bus master region never gets enabled.
Add code doing that after loading the pci config space from vmstate.

Cc: Avi Kivity <avi@redhat.com>
Cc: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

While reading microMIPS decoding, I found a possible wrong opcode
encoding. According to [1] page 166, the bits 13..12 for MULTU is
0x01 rather than 0x00. Please review, thanks.

[1] MIPS Architecture for Programmers VolumeIV-e: The MIPS DSP
    Application-Specific Extension to the microMIPS32 Architecture
Signed-off-by: NChen Wei-Ren <chenwj@iis.sinica.edu.tw>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

According to the MIPS Malta Developement Platform User's Manual, the
i8259 interrupt controller is supposed to be connected to the hardware
IRQ0, and the CBUS UART to the hardware interrupt 2.

In QEMU they are both connected to hardware interrupt 0, the CBUS UART
interrupt being wrong. This patch fixes that. It should be noted that
the irq array in QEMU includes the software interrupts, hence
env->irq[2] is the first hardware interrupt.

Cc: Ralf Baechle <ralf@linux-mips.org>
Reviewed-by: NEric Johnson <ericj@mips.com>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

vfio-pci: KVM INTx accel & common msi_get_message

* awilliam/tags/vfio-pci-for-qemu-1.3.0-rc0:
  vfio-pci: Use common msi_get_message
  vfio-pci: Add KVM INTx acceleration
  linux-headers: Update to 3.7-rc5
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

* kraxel/pixman.v5:
  pixman: cleanup properly on make distclean
  pixman: add licensing info
  pixman: build internal version early
  pixman: pass cflags, add -fPIC
  pixman: disable gtk
  pixman: set --host for cross builds
  pixman: add output dir to include path
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

* bonzini/nbd-next:
  nbd: fixes to read-only handling
  hmp: add NBD server commands
  nbd: disallow nbd-server-add before nbd-server-start
  nbd: force read-only export for read-only devices
  nbd: fix nbd_server_stop crash when no server was running
  nbd: accept URIs
  nbd: accept relative path to Unix socket
  qemu-nbd: initialize main loop before block layer
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

* bonzini/scsi-next:
  virtio-scsi: use dma_context_memory
  dma: Define dma_context_memory and use in sysbus-ohci
  megasas: Correct target/lun mapping
  scsi-disk: flush cache after disabling it
  megasas: do not include block_int.h
  scsi: remove superfluous call to scsi_device_set_ua
  virtio-scsi: factor checks for VIRTIO_SCSI_S_DRIVER_OK when reporting events
  scsi: do not return short responses for emulated commands
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

* kraxel/usb.70:
  ehci: fix migration
  xhci: Fix some DMA host endian bugs
  usb/combined-packet: Move freeing of combined to usb_combined_packet_remove()
  xhci: Add support for packets with both data and an error status
  ehci: Add support for packets with both data and an error status
  ehci: Get rid of the magical PROC_ERR status
  usb-redir: Allow packets to have both data and an error-status
  usb: split packet result into actual_length + status
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

* spice/spice.v63:
  spice: fix initialization order
  pflib: unused, remove it.
  spice: switch to pixman
  qxl: call dpy_gfx_resize when entering vga mode
  qxl: fix cursor reset
  hw/qxl: qxl_send_events: nop if stopped
  hw/qxl: guest bug on primary create with stride %4 != 0
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Signed-off-by: NEric Johnson <ericj@mips.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Pass on CFLAGS to the pixman configure script.
Add -fPIC to the cflags, needed to make the final link succeed.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

gtk is only needed to build test cases.
Disable it to simplify the build.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Set --host when calling pixman configure while doing cross builds so
pixman's autoconf picks up the cross build tools correctly.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Needed to make sure the (generated) pixman-version.h file is found.
Based on a patch from Blue Swirl.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

We can get rid of our local version now that a helper exists.
Signed-off-by: NAlex Williamson <alex.williamson@redhat.com>

This makes use of the new level irqfd support enabling bypass of qemu
userspace both on INTx injection and unmask.  This significantly
boosts the performance of devices making use of legacy interrupts (ex.
~60% better netperf TCP_RR scores for an e1000e assigned to a Linux
guest and booted with pci=nomsi).  This also avoids flipping mmaps on
and off to simulate EOIs, so greatly improves performance of device
access in addition to interrupt latency.
Signed-off-by: NAlex Williamson <alex.williamson@redhat.com>

update-linux-headers.sh script run against Linux tag v3.7-rc5
Signed-off-by: NAlex Williamson <alex.williamson@redhat.com>

We do not need BLKROSET if the kernel supports setting flags.
Also, always do BLKROSET even for a read-write export, otherwise
the read-only state remains "sticky" after the invocation of
"qemu-nbd -r".
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

Commit ed2aec4867f0d5f5de496bb765347b5d0cfe113d changed the return
value of aio_ctx_prepare from false to true when only idle bottom
halves are available.  This broke PC old-style DMA, which uses them.
Fix this by making aio_ctx_prepare return true only when non-idle
bottom halves are scheduled to run.
Reported-by: Nmalc <av1474@comtv.ru>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Nmalc <av1474@comtv.ru>

Until address_space_rw was introduced, NULL was accepted as a
placeholder for DMA with no IOMMU (to address_space_memory).

This does not work anymore, and dma_context_memory needs to
be specified explicitly.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

Define a new global dma_context_memory which is a DMAContext corresponding
to the global address_space_memory AddressSpace. This can be used by
sysbus peripherals like sysbus-ohci which need to do DMA.

In particular, use it in the sysbus-ohci device, which fixes a
segfault when attempting to use that device.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Reviewed-by: NPeter Crosthwaite <peter.crosthwaite@xilinx.com>

The structure to reference a logical drive has an unused field,
which can be used to carry the lun ID. This enabled seabios to
establish the proper target/LUN mapping.

Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: NHannes Reinecke <hare@suse.de>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

SBC says that "if an application client changes the WCE bit from one to
zero via a MODE SELECT command, then the device server shall write
any data in volatile cache to non-volatile medium before completing
the command".
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

Suggested by Laszlo Ersek.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

Suggested by Laszlo Ersek.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

The inquiry command, for the case of VPD=1, was returning short
responses; the number of returned bytes was just the number of bytes
in the request, without padding to the specified allocation length
with zero bytes.  This is usually harmless, but it is a violation
of the SCSI specification.

To fix this, always pad with zero bytes to r->cmd.xfer in
scsi_disk_emulate_command, and return at most r->buflen bytes
(the size of the buffer for command data) rather than at most
buflen bytes (the number of bytes that was filled in).

Before this patch, "strace sg_inq -p0x83 /dev/sda" would report a
non-zero resid value.  After this patch, it reports resid=0.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

It works nicely with the QMP commands, but it adds useless complication
with HMP.  In particular, see the following:

    (qemu) nbd_server_add -w scsi0-hd0
    (qemu) nbd_server_start -a localhost:10809
    NBD server already exporting device scsi0-hd0
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

This is the desired behavior for HMP, but it is a better choice for QMP as well.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

This failed on the new assertion of qemu_set_fd_handler2:

qemu-system-x86_64: /home/pbonzini/work/upstream/qemu/iohandler.c:60: qemu_set_fd_handler2: Assertion `fd >= 0' failed.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>