Signed-off-by: NEric Bénard <eric@eukrea.com>
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NStefan Hajnoczi <stefanha@linux.vnet.ibm.com>

val is an uint64_t, therefore %d was not correct.
Signed-off-by: NStefan Weil <sw@weilnetz.de>
Acked-by: NGerd Hoffmann <kraxel@redhat.com>
Signed-off-by: NStefan Hajnoczi <stefanha@linux.vnet.ibm.com>

Notify any listeners such as vnc that the displaysurface has been
changed, otherwise they will segfault when first accessing the freed old
displaysurface data.
Signed-off-by: NAlon Levy <alevy@redhat.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

The addition of those values caused a regression where not specifying
any value for the vram bar size would result in a 4096 _byte_ surface
area. This is ok for the windows driver but causes the X driver to be
unusable. Also, it's a regression. This patch returns the default
behavior of having a 64 megabyte vram BAR.
Signed-off-by: NAlon Levy <alevy@redhat.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Combine output volume with Master and PCM registers values.
Use default values in mixer_reset ().
Set volume on post-load to update backend values.

v4,v5:
- fix some code style
Signed-off-by: NMarc-Andr? Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Nmalc <av1474@comtv.ru>

It's a case by case (see Table 66. AC ?97 Baseline Audio Register Map)
Signed-off-by: NMarc-Andr? Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Nmalc <av1474@comtv.ru>

That code doesn't compile. The interesting bits for volume control are
going to be rewritten in the following patch.
Signed-off-by: NMarc-Andr? Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Nmalc <av1474@comtv.ru>

Not sure what the purpose of the assert() was, in any case it is bogous.
We can arrive there if transfer descriptors passed to us from the guest
failed to pass sanity checks, i.e. it is guest-triggerable.  We deal
with that case by resetting the host controller.  Everything is ok, no
need to throw a core dump here.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Also cleanup (reset) our device state when we reject a device due to a
speed mismatch.
Signed-off-by: NHans de Goede <hdegoede@redhat.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

The sofv value only ever gets a value assigned and is never used (read)
anywhere, so we can just drop it.
Signed-off-by: NHans de Goede <hdegoede@redhat.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

This patch carries a complete rewrite of the usb descriptor parser.
Changes / improvements:

 * We are using the USBDescriptor struct instead of hard-coded offsets
   now to access descriptor data.
 * (debug) printfs are all gone, tracepoints have been added instead.
 * We don't try (and fail) to skip over unneeded descriptors.  We parse
   them all one by one.  We keep track of which configuration, interface
   and altsetting we are looking at and use this information to figure
   which desciptors are in use and which we can ignore.
 * On parse errors we clear all endpoint information, which will
   disallow any communication with the device, except control endpoint
   messages.  This makes sure we don't end up with a silly device state
   where half of the endpoints got enabled and the other half was left
   disabled.
 * Some sanity checks have been added.

The new parser is more robust and also leaves complete device
information in the trace log if you enable the ush_host_parse_*
tracepoints.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Add endpoint descriptor substruct to USBDescriptor,
use it in the descriptor generator code.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Add interface descriptor substruct to USBDescriptor,
use it in the descriptor generator code.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Add config descriptor substruct to USBDescriptor,
use it in the descriptor generator code.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Add device qualifier substruct to USBDescriptor,
use it in the descriptor generator code.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

This patch adds a new type for the binary representation of usb
descriptors.  It is put into use for the descriptor generator code
where the struct replaces the hard-coded offsets.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

frindex always is a 14 bits counter, and not a 13 bits one as we were
emulating. There are some subtle hints to this in the spec, first of all
"Table 2-12. FRINDEX - Frame Index Register" says:
"Bit 13:0 Frame Index. The value in this register increments at the end of
each time frame (e.g. micro-frame). Bits [N:3] are used for the Frame List
current index. This means that each location of the frame list is accessed
8 times (frames or micro-frames) before moving to the next index. The
following illustrates values of N based on the value of the Frame List
Size field in the USBCMD register.

USBCMD[Frame List Size]	Number Elements		 N
00b				1024		12
01b				 512		11
10b				 256		10
11b			    Reserved"

Notice how the text talks about "Bits [N:3]" are used ..., it does
NOT say that when N == 12 (our case) the counter will wrap from 8191 to 0,
or in otherwords that it is a 13 bits counter (bits 0 - 12).

The other hint is in "Table 2-10. USBSTS USB Status Register Bit Definitions":

"Bit 3 Frame List Rollover - R/WC. The Host Controller sets this bit to a one
when the Frame List Index (see Section 2.3.4) rolls over from its maximum value
to zero. The exact value at which the rollover occurs depends on the frame
list size. For example, if the frame list size (as programmed in the Frame
List Size field of the USBCMD register) is 1024, the Frame Index Register
rolls over every time FRINDEX[13] toggles. Similarly, if the size is 512,
the Host Controller sets this bit to a one every time FRINDEX[12] toggles."

Notice how this text talks about setting bit 3 when bit 13 of frindex toggles
(when there are 1024 entries, so our case), so this indicates that frindex
has a bit 13 making it a 14 bit counter.

Besides these clear hints the real proof is in the pudding. Before this
patch I could not stream data from a USB2 webcam under Windows XP, after
this cam using a USB2 webcam under Windows XP works fine, and no regressions
with other operating systems were seen.
Signed-off-by: NHans de Goede <hdegoede@redhat.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Looks like a cut+paste bug from ehci_detach.  When the device itself is
detached from a ehci port (ehci_detach op) we have to clear the
device pointer for the companion port too.  When a device gets removed
from a downstream port of a usb hub (ehci_child_detach op) the ehci port
where the usb hub is plugged in is not affected.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Add tracepoints to the usb hub emulation.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

usb_packet_set_state can be called with p->ep = NULL.  The tracepoint
there tries to log endpoint information, which leads to a segfault.
This patch makes usb_packet_set_state handle the NULL pointer properly.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Add a property to usb-host to disable the bulk endpoint pipelining.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Add pointer to USBPacket to all tracepoints tracking requests to make it
easier to identify them when multiple requests are in flight.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Add tracepoints to track canceled requests.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Add tracepoint to track completion of emulated control requests.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

When passing through a usb pendrive seabios will present it in the F12
boot menu and will happily boot from it.

This patch adds bootorder support so you can even make it the default
boot device.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

When we queue up usb packets we may happen to find a already queued
packet, which also might be finished at that point already.  We don't
want continue processing the packet at this point though, so lets
just signal back we've found a in-flight packet when in queuing mode.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Not only QHs can form rings, but TDs too.  With the new
queuing/pipelining support we are following TD chains and
can actually walk in circles.  An assert() prevents us from
entering an endless loop then.

Fix is easy:  Just stop queuing when we figure the TD we are
about to queue up is in flight already.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

... to make vmstate id string truely unique with multiple host
controllers, i.e. move from "1/usb-ptr" to "0000:00:01.3/1/usb-ptr"
(usb tabled connected to piix3 uhci).

This obviously breaks migration.  To handle this the usb bus
property "full-path" is added.  When setting this to false old
behavior is maintained.  This way current qemu will be compatible
with old versions when started using '-M pc-$oldversion'.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

The kvmvapic was not present in older QEMU versions, thus must be
disabled in compat machines.
Signed-off-by: NJan Kiszka <jan.kiszka@siemens.com>

As long as we have no link and we aren't in internal loopback mode, no
packet must be sent. Instead, LCAR needs to be set in any active TX
descriptor and also CERR in CSR0.
Signed-off-by: NJan Kiszka <jan.kiszka@siemens.com>

pcnet_stop already clears any reason (BABL, CERR, MISS, MERR) why ERR
(bit 15) should be set in CRS0. So we have to clear that bit as well.
Signed-off-by: NJan Kiszka <jan.kiszka@siemens.com>

Currently, the PAPR VIO network device does not have a reset handler.  This
means that after a hard reset, H_REGISTER_LOGICAL_LAN will return an error
when the new guest boot attempts to initialize the device.

This patch corrects this, adding a suitable reset hook.
Signed-off-by: NDavid Gibson <david@gibson.dropbear.id.au>
Signed-off-by: NAndreas Färber <afaerber@suse.de>

Currently the PAPR vscsi implementation does not properly clear its table
of request tags when the system is reset.  This patch adds a reset hook
to do so.
Signed-off-by: NDavid Gibson <david@gibson.dropbear.id.au>
Signed-off-by: NAndreas Färber <afaerber@suse.de>

Recently we added code to properly clean away VIO CRQs on reset  However,
this directly uses qemu_register, rather than the existing device model
reset callbacks.  This patch cleans this up by adding proper use of the
reset hook to the VIO bus model.  The existing CRQ reset code is converted
to the new method.
Signed-off-by: NDavid Gibson <david@gibson.dropbear.id.au>
Signed-off-by: NAndreas Färber <afaerber@suse.de>

Some time ago we removed all use of the 'hcalls' callback in the pseries
VIO code, which was used to workaround an ordering problem which has since
been solved properly.  However, the function pointer for the hook remains.
This patch cleans it away.
Signed-off-by: NDavid Gibson <david@gibson.dropbear.id.au>
Signed-off-by: NAndreas Färber <afaerber@suse.de>

The PAPR VSCSI emulation contains a few lines of code which were once used
for debug but now do nothing at all.  This patch removes them.
Signed-off-by: NDavid Gibson <david@gibson.dropbear.id.au>
Signed-off-by: NAndreas Färber <afaerber@suse.de>

On the pseries platform, access to PCI config space is via RTAS calls(
which go to the hypervisor) rather than MMIO.  This means we don't use
the same code path as nearly everyone else which goes through pci_host.c
and we're missing some of the parameter checking along the way.

We do have some parameter checking in the RTAS calls, but it's not enough.
It checks for overruns, but does not check for unaligned accesses,
oversized accesses (which means the guest could trigger an assertion
failure from pci_host_config_{read,write}_common().  Worse it doesn't do
the basic checking for the number of RTAS arguments and results before
accessing them.

This patch fixes these bugs.

Cc: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: NDavid Gibson <david@gibson.dropbear.id.au>
[AF: Fix typos spotted by mst]
Signed-off-by: NAndreas Färber <afaerber@suse.de>

Currently the pseries machine contains not one but two somewhat ugly hacks
to allow printing of early debug messages before the guest has properly
read the device tree.

First, we special case H_PUT_TERM_CHAR so that a vtermno of 0 (usually
invalid) will look for a suitable vty and use that.  This supports Linux's
early debug code which will use H_PUT_TERM_CHAR with vtermno==0 before
reading the device tree.  Second, we support the RTAS display-character call.
This takes no vtermno so we assume the address of the default first VTY.

This patch makes things more consistent by folding the second hack into the
first.  Now, display-character uses the existing vty_lookup() function to
do the same search for a suitable VTY.
Signed-off-by: NDavid Gibson <david@gibson.dropbear.id.au>
Signed-off-by: NAndreas Färber <afaerber@suse.de>

The VIOsPAPRBus structure, used on the pseries machine contains some old
fields which are no longer used anywhere.  This patch removes them.
Signed-off-by: NDavid Gibson <david@gibson.dropbear.id.au>
Signed-off-by: NAndreas Färber <afaerber@suse.de>

This patch adds the PAPR defined RTAS system-reboot call to the pseries
machine emulation, providing the guest with a way to trigger a reboot.
Signed-off-by: NDavid Gibson <david@gibson.dropbear.id.au>
Signed-off-by: NAndreas Färber <afaerber@suse.de>