We call pci_host_config_{read,write}_common() which perform PCI config
accesses. However they don't do all limit checking the way we expect
it to.

So let's introduce a small wrapper around them, making them behave the
way we would without touching generic code.

This patch is based on a patch by David Gibson which put this logic into
the generic code.
Signed-off-by: NDavid Gibson <david@gibson.dropbear.id.au>
Signed-off-by: NAlexander Graf <agraf@suse.de>

Just like prep_pci.c, these were not associated with any MAINTAINERS
section, including PCI.
Signed-off-by: NAndreas Färber <andreas.faerber@web.de>
Cc: Alexander Graf <agraf@suse.de>
Signed-off-by: NAlexander Graf <agraf@suse.de>

Signed-off-by: NAndreas Färber <andreas.faerber@web.de>
Cc: Alexander Graf <agraf@suse.de>
Signed-off-by: NAlexander Graf <agraf@suse.de>

Currently on the pseries machine the SLOF firmware is used normally,
but we bypass it when -kernel is specified.  Having these two

different boot paths can cause some confusion.

In particular at present we need to "probe" the (emulated) PCI bus and
produce device tree nodes for the PCI devices in qemu, for the -kernel
case.  In the SLOF case, it takes the device tree from qemu adds some
stuff to it then passes it on to the kernel.

It's been decided that a better approach is to always boot through
SLOF, even when using -kernel.  WIth this approach we can leave PCI
probing and device node creation to SLOF in all cases which removes a
bunch of code in qemu, and avoids iterating the PCI devices from the
machine specific init code which we're not supposed to do.

This patch changes qemu to always boot through SLOF, and not to create
PCI nodes.  Simultaneously it updates the included version of SLOF
(submodule and binary image) to one which supports (and requires) the
new approach.

The new SLOF version also includes a number of unrelated enhancements:
support for booting from virtio-pci devices and e1000, greatly
improved FCode support and many bugfixes.  It also makes SLOF ready to
be used even when specifying a kernel on the qemu command line.
Signed-off-by: NBenjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: NDavid Gibson <david@gibson.dropbear.id.au>
Signed-off-by: NAlexander Graf <agraf@suse.de>

The pseries machine expects a para-virtualized guest and so supplies RTAS
functions (via a hypercall) for performing PCI config space access.
Currently the implementation of these calls into
pci_default_{read,write}_config().  However this would be incorrect for
any PCI device which overrides the default config read/write functions.
AFAICT there's only one such device today, but we should still get it
right.  In addition the pci_host_config_{read,write}_common() functions
which do correctly do this dispatch, perform bounds checking on the config
space address, lack of which currently leads to an exploitable bug.

This patch corrects the problem.
Signed-off-by: NDavid Gibson <david@gibson.dropbear.id.au>
Signed-off-by: NAlexander Graf <agraf@suse.de>

On the pseries machine (which expexts a paravirtualized guest), guest
access to PCI config space is via host-provided RTAS functions.  This
patch extends these RTAS functions to permit access to PCI extended
config space, as specified in PAPR.
Signed-off-by: NBenjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: NDavid Gibson <david@gibson.dropbear.id.au>
Signed-off-by: NAlexander Graf <agraf@suse.de>

Back when I made patches introducing dma_addr_t and various PCI DMA
wrapper functions, I made a mistake.  The bmdma_addr_{read,write} functions
need to take target_phys_addr_t not dma_addr_t, since they are assigned
to MemoryRegionOps callbacks.

This patch corrects my error.
Signed-off-by: NDavid Gibson <david@gibson.dropbear.id.au>
Signed-off-by: NAlexander Graf <agraf@suse.de>

This patch adds several auto-generated files to .gitignore which were
previously missing.
Signed-off-by: NDavid Gibson <david@gibson.dropbear.id.au>
Signed-off-by: NAlexander Graf <agraf@suse.de>

The kvm_get_dirty_pages_log_range() function uses two address
variables to step through the monitored memory region to update the
dirty log.  However, these variables have type unsigned long, which
can overflow if running a 64-bit guest with a 32-bit qemu binary.

This patch changes these to target_phys_addr_t which will have the
correct size.
Signed-off-by: NBenjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: NDavid Gibson <david@gibson.dropbear.id.au>
Signed-off-by: NAlexander Graf <agraf@suse.de>

load_image_targphys() gets passed a max size for the file, but doesn't
enforce it at all. Add a check and return -1 (error) if the file is
too big, without loading it.  Fix the bracing style in the function
while we're at it.
Signed-off-by: NBenjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: NDavid Gibson <david@gibson.dropbear.id.au>
Signed-off-by: NAlexander Graf <agraf@suse.de>

When accessing the device specific virtio config space, we memcpy
the data into a variable in QEMU. At that point we're basically
pulling host endianness into the game which is a really bad idea.

So instead, let's use the target specific load/store helpers for
memory pointers which fetch things in target endianness. The whole
array is already populated in target endianness anyways
(see virtio-blk).
Signed-off-by: NAlexander Graf <agraf@suse.de>
Reviewed-by: NAnthony Liguori <aliguori@us.ibm.com>

The virtio config area in PIO space is a bit special. The initial
header is little endian but the rest (device specific) is guest
native endian.

The PIO accessors for PCI on machines that don't have native IO ports
assume that all PIO is little endian, which works fine for everything
except the above.

A complicated way to fix it would be to split the BAR into two memory
regions with different endianess settings, but this isn't practical
to do, besides, the PIO code doesn't honor region endianness anyway
(I have a patch for that too but it isn't necessary at this stage).

So I decided to go for the quick fix instead which consists of
reverting the swap in virtio-pci in selected places, hoping that when
we eventually do a "v2" of the virtio protocols, we sort that out once
and for all using a fixed endian setting for everything.
Signed-off-by: NBenjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: NAlexander Graf <agraf@suse.de>
[agraf: keep virtio in libhw and determine endianness through a
        helper function in exec.c]
Reviewed-by: NAnthony Liguori <aliguori@us.ibm.com>

Now that we have the SoC init function in the same file, let's integrate
it with the board initialization.

While at it, also make use of the newly qdev'ified PCI host controller.
Signed-off-by: NAlexander Graf <agraf@suse.de>

The separation of ppc440 and ppc440_bamboo makes some sense, since ppc440
is the SoC while ppc440_bamboo is the actual board. But the separation
makes things harder for us for no good reason, so let's just fold them
in together with each other.
Signed-off-by: NAlexander Graf <agraf@suse.de>

Due to popular demand, this qdevifies the PCI host controller of 4xx SoCs
the same way as e500.

We have to introduce a small stub function for pci init that will be
removed in a later patch, once we qdev'ified the board, to keep the build
working.
Signed-off-by: NAlexander Graf <agraf@suse.de>

Tabs followed by spaces are a no-go. My editor shows it red, distracting
me from actual work! :)
Signed-off-by: NAlexander Graf <agraf@suse.de>

Nobody needs to run bamboo in 0.12 compat mode. Remove the machine.
Signed-off-by: NAlexander Graf <agraf@suse.de>

Now that we have 440 TLB emulation, we can also support running the 440EP
CPU target in system emulation mode.
Signed-off-by: NAlexander Graf <agraf@suse.de>

Today we're exposing a Virtex 440 CPU to the guest despite the fact
that we're telling the guest that we're running on a 440EP one in the
device tree.

So let's better default to a real 440EP to make things synced again.
Signed-off-by: NAlexander Graf <agraf@suse.de>

Recent dtc doesn't compile our dts anymore. Change all hex numbers to have
0x prefixes, indicate the old version and recompile using recent dtc.

This doesn't change any semantics in the device tree.
Signed-off-by: NAlexander Graf <agraf@suse.de>

When running a 440 target, we currently get invalid irq_num values (-1)
which completely confuse the IRQ setting code.

This is most likely due to the missing qdev conversion.

While this shouldn't happen in the first place and should really rather
be fixed by converting the target, I dislike segfaults. So for now, let's
just print a warning and ignore invalid irq_num values.
Signed-off-by: NAlexander Graf <agraf@suse.de>

Back in the day when the bamboo target got introduced, the initial TLB was
dictated by KVM. TCG has been missing initial TLB values ever since, rendering
the target unusable for TCG usage.

This patch adds linear TLB maps the way Linux expects them, making the target
work.
Signed-off-by: NAlexander Graf <agraf@suse.de>

To be able to support CPU reset, we need to put all register initialization
and initial state into a CPU reset hook instead of a function that is only
called once on bootup.

This is a preparation step for the initial TLB setting code and brings bamboo
more in line with what e500 and virtex already do.
Signed-off-by: NAlexander Graf <agraf@suse.de>

When using TCG with a BookE PowerPC core, we need to explicitly initialize
the BookE timers with the correct frequencies.

This was missing for 440EP, since that code came from KVM and was never used
with TCG.
Signed-off-by: NAlexander Graf <agraf@suse.de>

* spice/spice.v47:
  qxl: Slot sanity check in qxl_phys2virt() is off by one, fix

* stefanha/trivial-patches:
  Makefile: Remove generated headers on clean
  Makefile: Exclude tests/Makefile in unconfigured tree
  lm32: Fix mixup of uint32 and uint32_t
  tests: Silence gtester in Makefile
  qemu-tool: Fix mixup of int64 and int64_t

* qmp/queue/qmp:
  block: use proper qerrors in qmp_block_resize
  qerror: restore alphabetical order over qerrors
  qerror: add check-qerror.sh to verify alphabetical order
  qmp: Add missing gcc format attribute and fix format string
  qapi: Convert block_set_io_throttle
  qapi: Convert change
  qerror: Extend QERR_DEVICE_ENCRYPTED
  qapi: Introduce change-vnc-password
  monitor: expose readline state
  qapi: Convert eject
  block: eject_device(): Use error_set()
  qapi: Convert expire_password
  qapi: Convert set_password
  vnc: Simplify vnc_display_password()

* pmaydell/arm-devs.for-upstream:
  arm: make the number of GIC interrupts configurable
  hw/lan9118: Add save/load support
  arm: Remove incorrect comment in arm_timer
  vexpress, realview: Add (dummy) L2 cache controller

* kraxel/usb.37:
  usb-redir: Improve some debugging messages
  usb-redir: Try to keep our buffer size near the target size
  usb-redir: Pre-fill our isoc input buffer before sending pkts to the host
  usb-redir: Dynamically adjust iso buffering size based on ep interval
  usb-redir: Clear iso / irq error when stopping the stream
  usb: link packets to endpoints not devices
  usb: add max_packet_size to USBEndpoint
  usb/debug: add usb_ep_dump
  usb-desc: USBEndpoint support
  usb: add ifnum to USBEndpoint
  usb: add USBEndpoint
  xhci: Initial xHCI implementation
  usb: add audio device model
  usb-desc: audio endpoint support
  usb: track altsetting in USBDevice
  usb: track configuration and interface count in USBDevice.
  usb-host: rip out legacy procfs support

Running `make distclean' followed by a new out-of-tree build would fail
due to stale generated QMP headers in the tree.

Commit 611b7273 (Makefile: remove more
generated files on clean) made sure generated sources are removed.

Also remove generated headers introduced in commit
e3193601 (qapi: use middle mode in QMP
server).
Signed-off-by: NAndreas Färber <andreas.faerber@web.de>
Cc: Michael S. Tsirkin <mst@redhat.com>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Luiz Capitulino <lcapitulino@redhat.com>
Signed-off-by: NStefan Hajnoczi <stefanha@linux.vnet.ibm.com>

Since commit dbfe06c6 (build:
split unit test builds to a separate makefile fragment),
in absence of config-host.mak an undefined $(SRC_PATH) breaks
`make distclean' due to /tests/Makefile not being include'able.

Fix by only including when config-host.mak is present.
Signed-off-by: NAndreas Färber <andreas.faerber@web.de>
Cc: Anthony Liguori <aliguori@us.ibm.com>
Signed-off-by: NStefan Hajnoczi <stefanha@linux.vnet.ibm.com>

Commit d23948b1 (lm32: add Milkymist
VGAFB support) introduced a stray usage of the softfloat uint32 type.

Use uint32_t instead.
Signed-off-by: NAndreas Färber <afaerber@suse.de>
Acked-by: NMichael Walle <michael@walle.cc>
Cc: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: NStefan Hajnoczi <stefanha@linux.vnet.ibm.com>

This prettifies make output a little by avoiding a very long line.
As gtester prints the checks when they are run, no information is lost.
Signed-off-by: NStefan Weil <sw@weilnetz.de>
Signed-off-by: NStefan Hajnoczi <stefanha@linux.vnet.ibm.com>

Commit cbcfa041 (link the main loop and
its dependencies into the tools) introduced stray usages of int64.

Use int64_t instead.
Signed-off-by: NAndreas Färber <afaerber@suse.de>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NStefan Hajnoczi <stefanha@linux.vnet.ibm.com>

Let's report specific errors so that management tools and users can
identify the problem.

Two new qerrors are needed:
 * QERR_DEVICE_HAS_NO_MEDIUM for ENOMEDIUM
 * QERR_DEVICE_IS_READ_ONLY for EACCES
Signed-off-by: NStefan Hajnoczi <stefanha@linux.vnet.ibm.com>
Signed-off-by: NLuiz Capitulino <lcapitulino@redhat.com>

Over time these must have gotten out of order.  Put everything back in
alphabetical order.

This is purely a clean up.  In practice nothing depends on the order.
Signed-off-by: NStefan Hajnoczi <stefanha@linux.vnet.ibm.com>
Signed-off-by: NLuiz Capitulino <lcapitulino@redhat.com>

We're supposed to keep qerror definitions and table entries in
alphabetical order.  In practice this is not checked.

I haven't found a nice way to integrate this into the makefile yet but
we can at least have this script which verifies that qerrors are in
alphabetical order.
Signed-off-by: NStefan Hajnoczi <stefanha@linux.vnet.ibm.com>
Signed-off-by: NLuiz Capitulino <lcapitulino@redhat.com>

Signed-off-by: NStefan Weil <sw@weilnetz.de>
Reviewed-by: NStefan Hajnoczi <stefanha@linux.vnet.ibm.com>
Signed-off-by: NLuiz Capitulino <lcapitulino@redhat.com>

Signed-off-by: NLuiz Capitulino <lcapitulino@redhat.com>

Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>
Signed-off-by: NLuiz Capitulino <lcapitulino@redhat.com>