It is possible that subpage mmio is registered over existing memory
page. When this happens "memory" will have real memory address and not
index into io_mem array so next access to the page will generate
segfault. It is uncommon to have some part of a page to be accessed as
memory and some as mmio, but qemu shouldn't crash even when guest does
stupid things. So lets just pretend that the rest of the page is
unassigned if guest configure part of the memory page as mmio.
Signed-off-by: NGleb Natapov <gleb@redhat.com>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

Combining bitwise AND and logical NOT is suspicious.

Fixed by this Coccinelle script:
// From http://article.gmane.org/gmane.linux.kernel/646367
@@ expression E1,E2; @@
(
 !E1 & !E2
|
- !E1 & E2
+ !(E1 & E2)
)
Acked-by: NEdgar E. Iglesias <edgar.iglesias@gmail.com>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

Update Sparc32 and Sparc64 OpenBIOS images to SVN revision 859.

Bring also pc-bios/README up to date including the update performed by
419ef5f1.
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

We can't use the return value of load_uimage() for the kernel because it
can't account for BSS size, and the PowerPC kernel does not relocate
blobs before zeroing BSS.

Instead, we now load at the fixed addresses chosen by u-boot (the normal
firmware for the board).
Signed-off-by: NHollis Blanchard <hollis@penguinppc.org>

The PowerPC 4xx SDRAM controller emulation unregisters RAM in its reset
callback. However, qemu_system_reset() is now called at initialization
time, so all RAM is unregistered before starting the guest (!).
Signed-off-by: NHollis Blanchard <hollis@penguinppc.org>

The message "Truncating memory to %d MiB to fit SDRAM controller limits"
should be displayed only when a user chooses an amount of RAM which
can't be represented by the PPC 4xx SDRAM controller (e.g. 129MB, which
would only be valid if the controller supports a bank size of 1MB).
Signed-off-by: NHollis Blanchard <hollis@penguinppc.org>

We must be able to use a non-native strip executable, but not all
versions of 'install' support the --strip-program option (e.g.
OpenBSD). Accordingly, we can't use 'install -s', and we must run strip
separately.
Signed-off-by: NHollis Blanchard <hollis@penguinppc.org>
Cc: blauwirbel@gmail.com

This updates the openBIOS binary to r589, adding support for PPC PV feature
pass-through in KVM.
Signed-off-by: NAlexander Graf <agraf@suse.de>

On KVM for PPC we need to tell the guest which instructions to use when
doing a hypercall. The clean way to do this is to go through an ioctl
from userspace and passing it on to the guest using the device tree.

So let's do the qemu part here: read out the hypercall and pass it on
to the guest's fw_cfg so openBIOS can read it out and expose it again.
Signed-off-by: NAlexander Graf <agraf@suse.de>

Changing block.h or blockdev.h resulted in recompiling most objects.

Move DriveInfo typedef and BlockInterfaceType enum definitions
to qemu-common.h and rearrange blockdev.h use to decrease churn.
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Switch tree to lookup-by-name using qemu_find_opts().
Also hook up virtfs options so qemu_find_opts works for them too.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Old versions of the BOCHs VGA BIOS (cira 2003) made use of VBE
registers at 0xff80/81.  In VBE API version 0xb0c2 these were
moved to 0x1ce/cf.  Unfortunately, QEMU still registers handlers
for the old range.  If a guest attempts to assign an I/O device
overlapping this region, QEMU exits with a hw_error.  Windows
guests seem to like to assign I/O devices to the high end of
the address space, so it's pretty easy to hot add an rtl8139
to a Win2k8 guest and trigger the bug.  I can't find any reason
to register these handlers, so let's remove the cruft.
Signed-off-by: NAlex Williamson <alex.williamson@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

A number of changes I prefer to do in one shot:

- Fix example
- Small clarifications
- Add multiple monitors example
- Add 'Development Process' section
Signed-off-by: NLuiz Capitulino <lcapitulino@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Signed-off-by: NLuiz Capitulino <lcapitulino@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

This code was originally developed by Daniel P. Berrange <berrange@redhat.com>
Signed-off-by: NMiguel Di Ciurcio Filho <miguel.filho@gmail.com>
Signed-off-by: NLuiz Capitulino <lcapitulino@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Update the documentation of 'query-version' to output the string version broken
down.
Signed-off-by: NMiguel Di Ciurcio Filho <miguel.filho@gmail.com>
Signed-off-by: NLuiz Capitulino <lcapitulino@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Setting fd = -1 to qemu_set_fd_handler2() causes bus error at FD_SET
in main_loop_wait().
Signed-off-by: NYoshiaki Tamura <tamura.yoshiaki@lab.ntt.co.jp>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Free malloc'ed memory, unregister from savevm and clean up virtio-common
bits on device hot-unplug.

This was found performing a migration after device hot-unplug.

Reported-by: <lihuang@redhat.com>
Signed-off-by: NAmit Shah <amit.shah@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Correct the calculation of the offset in the msrpm
for the MSR range 0 - 0x1fff.
Signed-off-by: NAdam Lackorzynski <adam@os.inf.tu-dresden.de>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Since most of the code in qemu_ram_alloc() and
qemu_ram_alloc_from_ptr() are duplicated, let
qemu_ram_alloc_from_ptr() to switch by checking void *host, and change
qemu_ram_alloc() to a wrapper.
Signed-off-by: NYoshiaki Tamura <tamura.yoshiaki@lab.ntt.co.jp>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Signed-off-by: NYoshiaki Tamura <tamura.yoshiaki@lab.ntt.co.jp>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Signed-off-by: NYoshiaki Tamura <tamura.yoshiaki@lab.ntt.co.jp>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

I have a guest OS which sends the command 0xfd to the keyboard
controller during initialization. To get rid of the message
"qemu: unsupported keyboard cmd=0x%02x\n" I added support for
the pulse output bit commands.

I found the following explanation here:
http://www.win.tue.nl/~aeb/linux/kbd/scancodes-11.html#ss11.3

Command 0xf0-0xff: Pulse output bit
Bits 3-0 of the output port P2 of the keyboard controller may
be pulsed low for approximately 6 µseconds. Bits 3-0 of this
command specify the output port bits to be pulsed. 0: Bit should
be pulsed. 1: Bit should not be modified. The only useful version
of this command is Command 0xfe.
(For MCA, replace 3-0 by 1-0 in the above.)

Command 0xfe: System reset
Pulse bit 0 of the output port P2 of the keyboard controller.
This will reset the CPU.
Signed-off-by: NBernhard Kohl <bernhard.kohl@nsn.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Replace a qemu_malloc call, followed by a memset, with qemu_mallocz.

Found with this Coccinelle semantic patch, adapted from
Coccinelle test package rule 94:
@@
type T;
expression x;
expression E;
@@

- x = (T)qemu_malloc(E)
+ x = qemu_mallocz(E)
  ...
(
- memset(x,0,E);
|
- memset(x,0,sizeof(*x));
)

Some files (tests/*) had to be filtered out.
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

Replace array size calculations with ARRAY_SIZE macro.

Implemented with this Coccinelle semantic patch, adapted from
Linux kernel:
@@
type T;
T[] E;
@@

- (sizeof(E)/sizeof(*E))
+ ARRAY_SIZE(E)

@@
type T;
T[] E;
@@

- (sizeof(E)/sizeof(E[...]))
+ ARRAY_SIZE(E)

@@
type T;
T[] E;
@@

- (sizeof(E)/sizeof(T))
+ ARRAY_SIZE(E)

Some files (*-dis.c, tests/*) had to be filtered out.
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

Found with this Coccinelle semantic patch:
@@
expression E;
identifier ptr;
identifier fn ~= "qemu_strn?dup";
@@

-ptr = fn(E);
-if (ptr == NULL) { ... }
-
+ptr = fn(E);
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

Found with this Coccinelle semantic patch:
@@
expression E;
identifier ptr;
identifier fn ~= "qemu_mallocz*";
@@

-ptr = fn(E);
-if (ptr == NULL) { ... }
-
+ptr = fn(E);
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

If we save more than once we need to reset the last block info or else
only the first save has the actual block info and each subsequent save
will only use continue flags, making them unloadable independently.
Found-by: NMiguel Di Ciurcio Filho <miguel.filho@gmail.com>
Signed-off-by: NAlex Williamson <alex.williamson@redhat.com>
Acked-by: NGlauber Costa <glommer@redhat.com>
Signed-off-by: NLuiz Capitulino <lcapitulino@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

If ->write fails, declare migration status as MIG_STATE_ERROR.

Also, in buffered_file.c, ->close the object in case of an
error.

Fixes "migrate -d "exec:dd of=file", where dd fails to open file.
Signed-off-by: NMarcelo Tosatti <mtosatti@redhat.com>
Signed-off-by: NLuiz Capitulino <lcapitulino@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

qemu-config.c doesn't contain any target-specific code, and the
TARGET_I386 conditional code didn't get compiled as a result. Removing
this enables the driftfix parameter for rtc.
Signed-off-by: NAmit Shah <amit.shah@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

QEMUFileBuffered stops writing when the underlying QEMUFile is not ready,
and tells its producer so.  However, when the underlying QEMUFile becomes
ready, it neglects to pass that information along, resulting in stoppage
of all data until the next tick (a tenths of a second).

Usually this doesn't matter, because most QEMUFiles used with QEMUFileBuffered
are almost always ready, but in the case of exec: migration this is not true,
due to the small pipe buffers used to connect to the target process.  The
result is very slow migration.

Fix by detecting the readiness notification and propagating it.  The detection
is a little ugly since QEMUFile overloads put_buffer() to send it, but that's
the suject for a different patch.
Signed-off-by: NAvi Kivity <avi@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

According to scc_escc_um.pdf:
 - Reset Highest IUS must update irq status to allow processing
   of the next priority interrupt.
 - rx interrupt has always higher priority than tx on same channel

The documentation only explicitly says that Reset Highest IUS
command (0x38) clears IUS bits, not that it clears the corresponding
interrupt too, so don't clear interrupts on this command.

The patch allows SunOS 4.1.4 to use the serial ports
Signed-off-by: NArtyom Tarasenko <atar4qemu@gmail.com>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

Don't define qemu_chr_open_eventfd() on Windows.
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

configure adds the macro WIN32_LEAN_AND_MEAN to
QEMU_CFLAGS, and SDL_syswm.h defines it, too.

This results in a compiler warning (redefinition of
WIN32_LEAN_AND_MEAN in SDL_syswm.h. That warning prevents
compilations for win32 with warning = error).

Fix this by removing the definition of WIN32_LEAN_AND_MEAN
before including SDL_syswm.h.

[blauwirbel@gmail.com: rebased]
Signed-off-by: NStefan Weil <weil@mail.berlios.de>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

Mingw32 does not provide a declaration and implementation of function
setenv (which is used in sdl.c), so this patch adds both.
Signed-off-by: NStefan Weil <weil@mail.berlios.de>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

Signed-off-by: NCam Macdonell <cam@cs.ualberta.ca>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

Signed-off-by: NCam Macdonell <cam@cs.ualberta.ca>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>