Make Tx frame assembly buffer to be a paort of IMXFECState structure
to avoid a concern about having large data buffer on the stack.

Cc: Peter Maydell <peter.maydell@linaro.org>
Cc: Jason Wang <jasowang@redhat.com>
Cc: Philippe Mathieu-Daudé <f4bug@amsat.org>
Cc: qemu-devel@nongnu.org
Cc: qemu-arm@nongnu.org
Cc: yurovsky@gmail.com
Signed-off-by: NAndrey Smirnov <andrew.smirnov@gmail.com>
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

In current implementation, packet queue flushing logic seem to suffer
from a deadlock like scenario if a packet is received by the interface
before before Rx ring is initialized by Guest's driver. Consider the
following sequence of events:

	1. A QEMU instance is started against a TAP device on Linux
	   host, running Linux guest, e. g., something to the effect
	   of:

	   qemu-system-arm \
	      -net nic,model=imx.fec,netdev=lan0 \
	      netdev tap,id=lan0,ifname=tap0,script=no,downscript=no \
	      ... rest of the arguments ...

	2. Once QEMU starts, but before guest reaches the point where
	   FEC deriver is done initializing the HW, Guest, via TAP
	   interface, receives a number of multicast MDNS packets from
	   Host (not necessarily true for every OS, but it happens at
	   least on Fedora 25)

	3. Recieving a packet in such a state results in
	   imx_eth_can_receive() returning '0', which in turn causes
	   tap_send() to disable corresponding event (tap.c:203)

	4. Once Guest's driver reaches the point where it is ready to
	   recieve packets it prepares Rx ring descriptors and writes
	   ENET_RDAR_RDAR to ENET_RDAR register to indicate to HW that
	   more descriptors are ready. And at this points emulation
	   layer does this:

	   	 s->regs[index] = ENET_RDAR_RDAR;
                 imx_eth_enable_rx(s);

	   which, combined with:

	   	  if (!s->regs[ENET_RDAR]) {
		     qemu_flush_queued_packets(qemu_get_queue(s->nic));
		  }

	   results in Rx queue never being flushed and corresponding
	   I/O event beign disabled.

To prevent the problem, change the code to always flush packet queue
when ENET_RDAR transitions 0 -> ENET_RDAR_RDAR.

Cc: Peter Maydell <peter.maydell@linaro.org>
Cc: Jason Wang <jasowang@redhat.com>
Cc: Philippe Mathieu-Daudé <f4bug@amsat.org>
Cc: qemu-devel@nongnu.org
Cc: qemu-arm@nongnu.org
Cc: yurovsky@gmail.com
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NAndrey Smirnov <andrew.smirnov@gmail.com>
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Refactor imx_eth_enable_rx() to have more meaningfull variable name
than 'tmp' and to reduce number of logical negations done.

Cc: Peter Maydell <peter.maydell@linaro.org>
Cc: Jason Wang <jasowang@redhat.com>
Cc: Philippe Mathieu-Daudé <f4bug@amsat.org>
Cc: qemu-devel@nongnu.org
Cc: qemu-arm@nongnu.org
Cc: yurovsky@gmail.com
Reviewed-by: NPhilippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NAndrey Smirnov <andrew.smirnov@gmail.com>
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Binding to a particular netdev doesn't seem to belong to this layer
and should probably be done as a part of board or SoC specific code.

Convert all of the users of this IP block to use
qdev_set_nic_properties() instead.

Cc: Peter Maydell <peter.maydell@linaro.org>
Cc: Jason Wang <jasowang@redhat.com>
Cc: Philippe Mathieu-Daudé <f4bug@amsat.org>
Cc: qemu-devel@nongnu.org
Cc: qemu-arm@nongnu.org
Cc: yurovsky@gmail.com
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NAndrey Smirnov <andrew.smirnov@gmail.com>
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

acpi_data_push uses g_array_set_size to resize the memory size. If there
is no enough contiguous memory, the address will be changed. If we use
the old value, it will assert.
qemu-kvm: hw/acpi/bios-linker-loader.c:214: bios_linker_loader_add_checksum:
Assertion `start_offset < file->blob->len' failed.`

This issue only happens in building SRAT table now but here we unify the
pattern for other tables as well to avoid possible issues in the future.
Signed-off-by: NZhaoshenglong <zhaoshenglong@huawei.com>
Reviewed-by: NAndrew Jones <drjones@redhat.com>
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

ldxp loads two consecutive doublewords from memory regardless of CPU
endianness. On store, stlxp currently assumes to work with a 128bit
value and consequently switches order in big-endian mode. With this
change it packs the doublewords in reverse order in anticipation of the
128bit big-endian store operation interposing them so they end up in
memory in the right order. This makes it work for both MTTCG and !MTTCG.
It effectively implements the ARM ARM STLXP operation pseudo-code:

data = if BigEndian() then el1:el2 else el2:el1;

With this change an aarch64_be Linux 4.14.4 kernel succeeds to boot up
in system emulation mode.
Signed-off-by: NMichael Weiser <michael.weiser@gmx.de>
Reviewed-by: NRichard Henderson <richard.henderson@linaro.org>
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

armeb is missing from the target list in qemu-binfmt-conf.sh. Add it so
the handler for those binaries gets registered by the script.
Signed-off-by: NMichael Weiser <michael.weiser@gmx.de>
Reviewed-by: NLaurent Vivier <laurent@vivier.eu>
Message-id: 20171220212308.12614-8-michael.weiser@gmx.de
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Give big-endian arm and aarch64 CPUs their own family in
qemu-binfmt-conf.sh to make sure we register qemu-user for binaries of
the opposite endianness on arm and aarch64. Apart from the family
assignments of the magic values, qemu_get_family() needs to be able to
distinguish the two and recognise aarch64{,_be} as well.
Signed-off-by: NMichael Weiser <michael.weiser@gmx.de>
Reviewed-by: NLaurent Vivier <laurent@vivier.eu>
Message-id: 20171220212308.12614-7-michael.weiser@gmx.de
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

As we now have a linux-user aarch64_be target, we can add it to the list
of supported targets in qemu-binfmt-conf.sh
Signed-off-by: NMichael Weiser <michael.weiser@gmx.de>
Reviewed-by: NLaurent Vivier <laurent@vivier.eu>
Message-id: 20171220212308.12614-6-michael.weiser@gmx.de
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Add target aarch64_be-linux-user. This allows a qemu-aarch64_be binary
to be built that will run big-endian aarch64 binaries.
Signed-off-by: NMichael Weiser <michael.weiser@gmx.de>
Reviewed-by: NRichard Henderson <richard.henderson@linaro.org>
Reviewed-by: NLaurent Vivier <laurent@vivier.eu>
Message-id: 20171220212308.12614-5-michael.weiser@gmx.de
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Since for aarch64 the signal trampoline is synthesized directly into the
signal frame we need to make sure the instructions end up little-endian.
Otherwise the wrong endianness will cause a SIGILL upon return from the
signal handler on big-endian targets.
Signed-off-by: NMichael Weiser <michael.weiser@gmx.de>
Reviewed-by: NRichard Henderson <richard.henderson@linaro.org>
Message-id: 20171220212308.12614-4-michael.weiser@gmx.de
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Make big-endian aarch64 systems identify as aarch64_be as expected by
big-endian userland and toolchains.
Signed-off-by: NMichael Weiser <michael.weiser@gmx.de>
Reviewed-by: NRichard Henderson <richard.henderson@linaro.org>
Reviewed-by: NLaurent Vivier <laurent@vivier.eu>
Message-id: 20171220212308.12614-3-michael.weiser@gmx.de
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Enable big-endian mode for data accesses on aarch64 for big-endian linux
user mode. Activate it for all exception levels as documented by ARM:
Set the SCTLR EE bit for ELs 1 through 3. Additionally set bit E0E in
EL1 to enable it in EL0 as well.
Signed-off-by: NMichael Weiser <michael.weiser@gmx.de>
Reviewed-by: NRichard Henderson <richard.henderson@linaro.org>
Message-id: 20171220212308.12614-2-michael.weiser@gmx.de
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

nbd patches for 2018-01-10

- Vladimir Sementsov-Ogievskiy: nbd: rename nbd_option and nbd_opt_reply
- Vladimir Sementsov-Ogievskiy: nbd/server: add additional assert to nbd_export_put

# gpg: Signature made Wed 10 Jan 2018 22:53:49 GMT
# gpg:                using RSA key 0xA7A16B4A2527436A
# gpg: Good signature from "Eric Blake <eblake@redhat.com>"
# gpg:                 aka "Eric Blake (Free Software Programmer) <ebb9@byu.net>"
# gpg:                 aka "[jpeg image of size 6874]"
# Primary key fingerprint: 71C2 CC22 B1C4 6029 27D2  F3AA A7A1 6B4A 2527 436A

* remotes/ericb/tags/pull-nbd-2018-01-10:
  nbd: rename nbd_option and nbd_opt_reply
  nbd/server: add additional assert to nbd_export_put
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

qemu-sparc update

# gpg: Signature made Tue 09 Jan 2018 22:12:22 GMT
# gpg:                using RSA key 0x5BC2C56FAE0F321F
# gpg: Good signature from "Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>"
# Primary key fingerprint: CC62 1AB9 8E82 200D 915C  C9C4 5BC2 C56F AE0F 321F

* remotes/mcayland/tags/qemu-sparc-signed: (25 commits)
  sun4u_iommu: add trace event for IOMMU translations
  sun4u_iommu: convert from IOMMU_DPRINTF to trace-events
  sun4u_iommu: update to reflect IOMMU is no longer part of the APB device
  sun4u: split IOMMU device out from apb.c to sun4u_iommu.c
  apb: QOMify IOMMU
  sun4m: remove include/hw/sparc/sun4m.h and all references to it
  sun4m: move IOMMU declarations from sun4m.h to sun4m_iommu.h
  sun4m: move sun4m_iommu.c from hw/dma to hw/sparc
  sun4u: switch from EBUS_DPRINTF() macro to trace-events
  sparc64: introduce trace-events for hw/sparc64
  apb: replace OBIO interrupt numbers in pci_pbmA_map_irq() with constants
  ebus: wire up OBIO interrupts to APB pbm via qdev GPIOs
  apb: remove busA property from PBMPCIBridge state
  apb: split pci_pbm_map_irq() into separate functions for bus A and bus B
  apb: remove pci_apb_init() and instantiate APB device using qdev
  apb: move the two secondary PCI bridges objects into APBState
  apb: use gpios to wire up the apb device to the SPARC CPU IRQs
  apb: return APBState from pci_apb_init() rather than PCIBus
  apb: APB QOMify tidy-up
  sun4u: move initialisation of all ISABus devices into ebus_realize()
  ...
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Rename nbd_option and nbd_opt_reply to NBDOption and NBDOptionReply
to correspond to Qemu coding style and other structures here.
Signed-off-by: NVladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: NEric Blake <eblake@redhat.com>
Message-Id: <20171122101958.17065-5-vsementsov@virtuozzo.com>
Signed-off-by: NEric Blake <eblake@redhat.com>

Signed-off-by: NMark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Acked-by: NArtyom Tarasenko <atar4qemu@gmail.com>

Signed-off-by: NMark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Acked-by: NArtyom Tarasenko <atar4qemu@gmail.com>

Signed-off-by: NMark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Acked-by: NArtyom Tarasenko <atar4qemu@gmail.com>

By separating the sun4u IOMMU device into new sun4u_iommu.c and sun4m_iommu.h
files we noticeably simplify apb.c whilst bringing sun4u in line with all the
other IOMMU-supporting architectures.
Signed-off-by: NMark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Acked-by: NArtyom Tarasenko <atar4qemu@gmail.com>

This is in preparation to split the IOMMU device out of the APB. As part of
this commit we also enforce separation of the IOMMU and APB devices by using
a QOM object link to pass the IOMMU reference and accessing the IOMMU registers
via a separate memory region mapped into the APB config space rather than
directly.
Signed-off-by: NMark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Acked-by: NArtyom Tarasenko <atar4qemu@gmail.com>

With the previous commit there is now nothing left in sun4m.h so it can be
removed, along with all remaining references to it.
Signed-off-by: NMark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Acked-by: NArtyom Tarasenko <atar4qemu@gmail.com>

Also updating the relevant .c files as required.
Signed-off-by: NMark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Acked-by: NArtyom Tarasenko <atar4qemu@gmail.com>

This seems more appropriate and brings sun4m in line with the other
architectures.
Signed-off-by: NMark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Acked-by: NArtyom Tarasenko <atar4qemu@gmail.com>

Signed-off-by: NMark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: NPhilippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: NArtyom Tarasenko <atar4qemu@gmail.com>

This is in preparation for switching code in hw/sparc64 from DPRINTF over to
trace events.
Signed-off-by: NMark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: NArtyom Tarasenko <atar4qemu@gmail.com>
Reviewed-by: NPhilippe Mathieu-Daudé <f4bug@amsat.org>

Following on from the previous commit, we can also do the same with
with legacy OBIO interrupts in pci_pbmA_map_irq().
Signed-off-by: NMark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: NArtyom Tarasenko <atar4qemu@gmail.com>
Reviewed-by: NPhilippe Mathieu-Daudé <f4bug@amsat.org>

This enables us to remove the static array mapping in the ISA IRQ
handler (and the embedded reference to the APB device) by formalising
the interrupt wiring via the qdev GPIO API.

For more clarity we replace the APB OBIO interrupt numbers with constants
designating the interrupt source, and rename isa_irq_handler() to
ebus_isa_irq_handler().
Signed-off-by: NMark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: NArtyom Tarasenko <atar4qemu@gmail.com>
Reviewed-by: NPhilippe Mathieu-Daudé <f4bug@amsat.org>

Since the previous commit the only remaining use of the qdev busA property is
to configure the PCI bridge in front of the onboard ebus devices differently
to allow early OpenBIOS serial console access.

Instead we can now manually update the PCI configuration for bridge A in
pci_pbm_reset() and thus completely remove the busA property from the
PBMPCIBridge state.
Signed-off-by: NMark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: NArtyom Tarasenko <atar4qemu@gmail.com>

After the previous refactoring it is now possible to use separate functions
to improve the clarity of the interrupt paths.
Signed-off-by: NMark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: NArtyom Tarasenko <atar4qemu@gmail.com>

By making the special_base and mem_base values qdev properties, we can move
the remaining parts of pci_apb_init() into the pbm init() and realize()
functions.

This finally allows us to instantiate the APB directly using standard qdev
create/init functions in sun4u.c.
Signed-off-by: NMark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: NArtyom Tarasenko <atar4qemu@gmail.com>
Reviewed-by: NPhilippe Mathieu-Daudé <f4bug@amsat.org>

This enables us to remove these parameters from pci_apb_init().
Signed-off-by: NMark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: NArtyom Tarasenko <atar4qemu@gmail.com>
Reviewed-by: NPhilippe Mathieu-Daudé <f4bug@amsat.org>

Signed-off-by: NMark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: NPhilippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: NArtyom Tarasenko <atar4qemu@gmail.com>

This is a first step towards removing pci_apb_init() completely.
Signed-off-by: NMark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: NPhilippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: NArtyom Tarasenko <atar4qemu@gmail.com>

Use DeviceClass rather than SysBusDeviceClass in pbm_host_class_init() and
adjust pci_pbm_init_device() accordingly.
Signed-off-by: NMark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: NPhilippe Mathieu-Daudé <f4bug@amsat.org>

This belongs in the PCI-ISA bridge rather than at the machine level.
Signed-off-by: NMark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: NPhilippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: NArtyom Tarasenko <atar4qemu@gmail.com>

This is initialisation that should really take place in the ebus realize
function. As part of this we also rework the ebus IRQ mapping so that
instead of having to pass in the array of pbm_irqs, we obtain a reference
to them by looking up the APB device during ebus realize.
Signed-off-by: NMark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: NArtyom Tarasenko <atar4qemu@gmail.com>
Reviewed-by: NPhilippe Mathieu-Daudé <f4bug@amsat.org>

Since the EBus is effectively a PCI-ISA bridge then the underlying ISA bus
should be contained within the PCI bridge itself.
Signed-off-by: NMark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: NArtyom Tarasenko <atar4qemu@gmail.com>
Reviewed-by: NPhilippe Mathieu-Daudé <f4bug@amsat.org>

The main change here is to introduce the proper TYPE_EBUS/EBUS QOM macros
and remove the use of DO_UPCAST.

Alongside this there are some a couple of minor cosmetic changes and a rename
of pci_ebus_realize() to ebus_realize() since the ebus device is always what
is effectively a PCI-ISA bridge.
Signed-off-by: NMark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: NPhilippe Mathieu-Daudé <f4bug@amsat.org>

This also includes the related IOMMUState typedef and defines.
Signed-off-by: NMark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: NArtyom Tarasenko <atar4qemu@gmail.com>
Reviewed-by: NPhilippe Mathieu-Daudé <f4bug@amsat.org>