Hook into DeviceInfo->exit().

handle_destroy() must not free the state struct, this is handled
by the new usb_qdev_exit() function now.

qdev_free(usb_device) works now.

Fix usb hub to qdev_free() all connected devices on unplug.
Unplugging a usb hub works now.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

One more cleanup while being at it ;)
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

pci_unregister_device is static now and hooked into Devicestate->exit.
qdev_free(pci_device) works now.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

This adds a exit callback for device destruction to DeviceInfo, so
we can hook cleanups into qdev device destruction.

Followup patches will put that into use.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Two bug fixes:
 * When freeing a device we unregister even stuff we didn't register in
   the first place because the ->init() callback failed.
 * When freeing a device with child busses attached, we fail to zap the
   child bus (and the devices attached to it).
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Recent changes made on_vcpu hit the abort() path, even with the IO thread
disabled. This is because cpu_single_env is no longer set when we call this
function. Although the correct fix is a little bit more complicated that that,
the recent thread in which I proposed qemu_queue_work (which fixes that, btw),
is likely to go on a quite different direction.

So for the benefit of those using guest debugging, I'm proposing this simple
fix in the interim.
Signed-off-by: NGlauber Costa <glommer@redhat.com>
Signed-off-by: NJan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Hopefully the last regression of 4c0960c0: KVM_SET_GUEST_DEBUG requires
properly synchronized guest registers (on x86: eflags) on entry.
Signed-off-by: NJan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Commit 56aebc89 changed gdbstub in way
that debugging 32 or 16-bit guest code is no longer possible with qemu
for x86_64 guest CPUs. Since that commit, qemu only provides registers
sets for 64-bit, forcing current and foreseeable gdb to also switch its
architecture to 64-bit. And this breaks if the inferior is 32 or 16 bit.

No question, this is a gdb issue. But, as it was confirmed in several
discusssions with gdb people, it is a non-trivial thing to fix. So until
qemu finds a gdb version attach with a rework x86 support, we have to
work around it by switching the register layout as the guest switches
its execution mode between 16/32 and 64 bit.
Signed-off-by: NJan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Switch RTC emulations to the new host_clock instead of vm_clock by
default. This has the advantage that the emulated RTC will follow
automatically the host time while it might be tuned via NTP. vm_clock
can still be selected by passing '-rtc clock=vm' on the command line.

Note that some RTC emulations (at least M48T59) already use the host
time unconditionally while others (namely MC146818) do not. This patch
introduces the required infrastructure for selecting the base clock but
only converts MC146818 for now.
Signed-off-by: NJan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Deprecate -localtime, -setdate and -rtc-td-hack in favor of a new
unified command line switch:

    -rtc [base=utc|localtime|date][,driftfix=none|slew]
Signed-off-by: NJan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Despite its name QEMU_CLOCK_REALTIME is (normally) not using
CLOCK_REALTIME / the host system time as base. In order to allow also
non-trivial RTC emulations (MC146818) to follow the host time instead of
the virtual guest time, introduce the new clock type QEMU_CLOCK_HOST. It
is unconditionally based on CLOCK_REALTIME, thus will follow system time
changes of the host.

The only limitation of its current implementation is that pending
host_clock timers may not fire early if the host time is pushed forward
beyond their expiry. So far no urgent need to overcome this limitation
was identified, so it's left as simple as it is (expiry on next alarm
timer tick).
Signed-off-by: NJan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

nearest_delta_us is calculated but not used. Drop it.
Signed-off-by: NJan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

These constants select clocks, not timers. And init_timers initializes
clocks.
Signed-off-by: NJan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

If the user issues one of the following commands to the Monitor:

pci_add pci_addr=auto nic model=None
pci_add pci_addr=auto nic model=?

QEMU will exit, because the function used to perform sanity
checks (qemu_check_nic_model_list()) exits on error.

This function is used by the startup code, where it makes
sense to exit on error, but in the Monitor it doesn't.

Changing qemu_check_nic_model_list() to not exit on error
is not possible though, as it's used by the board init
code (the PC one), where all board specific code must have
void return.

The way I've chosen to fix this was to introduce a new function
called pci_nic_supported(), which checks if the NIC is supported
and returns true or false accordingly.

The new function is used only by the Monitor, it performs the
necessary check and returns an error in case the NIC is not
supported, thus qemu_check_nic_model_list()'s exit is never trigged.

The following should be observed:

1. Only the specified NIC is checked, the default one is assumed
to be supported

2. The NIC query command (model=?) won't work with pci_add, the
right way to do this with the Monitor is to add a new command
Signed-off-by: NLuiz Capitulino <lcapitulino@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

When we "free" a NICInfo structure, we can leak pointers, since we don't do
much more than setting used = 0.

We free() the model parameter, but we don't set it to NULL. This means that
a new user of this structure will see garbage in there. It was not noticed
before because reusing a NICInfo is not that common, but it can be, for
users of device pci hotplug.

A user hit it, described at https://bugzilla.redhat.com/show_bug.cgi?id=524022

This patch memset's the whole structure, guaranteeing that anyone reusing it
will see a fresh NICinfo. Also, we free some other strings that are currently
leaking.

This codebase is quite old, so this patch should feed all stable trees.
Signed-off-by: NGlauber Costa <glommer@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Currently, our check for qemu_cpu_self only checks if there is a cpu
currently in execution (represented by cpu_single_env being set). While
this might be okay for tcg, it is certainly not okay for kvm, since multiple
cpus might be executing.

Instead, I propose we use pthread primitives to test if the caller thread is
the same as env->thread.

For tcg, it will have the same semantics as before, since all CPUStates will
point to the same thread, and we'll only have one in execution at a time.
Signed-off-by: NGlauber Costa <glommer@mothafucka.localdomain>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

This brings bfd_boolean to the wonderful world of <stdbool.h>, it is needed
because it defines bdf_boolean as an enum with values true and false,
and some architectures use TRUE, FALSE and give problems when you try to use
<stdbool.h>
Signed-off-by: NJuan Quintela <quintela@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

This time, I add them in configure only if target compiler supports it
Signed-off-by: NJuan Quintela <quintela@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Signed-off-by: NJuan Quintela <quintela@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Register all relevant fields of Musicpal device states with the VMState
framework. This involves a few type changes of state variables.
Signed-off-by: NJan Kiszka <jan.kiszka@web.de>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Stop the periodic timers of the PIT on reset, disabling via the control
register and invalid parameters.
Signed-off-by: NJan Kiszka <jan.kiszka@web.de>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Signed-off-by: NJan Kiszka <jan.kiszka@web.de>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Signed-off-by: NJan Kiszka <jan.kiszka@web.de>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Signed-off-by: NJan Kiszka <jan.kiszka@web.de>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Signed-off-by: NJan Kiszka <jan.kiszka@web.de>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

The qdev_gpio conversion of 343ec8e4 caused come polarity mismatch of key
event pins and left an overly complex solution behind. Take this chance
and refactor the GPIO input system of the Musicpal, moving it closer to
reality:
 - Instantiate all 32 GPIO input pins and do the routing only via
   qdev_connect_gpio_out.
 - Implement IMR and IER registers. They manage the GPIO pin IRQ. IMR
   seems to enable IRQs on rising edges, IER on falling ones. At least
   this matches what the Musicpal fireware require.
 - Move key pin logic inversion from the GPIO layer to musicpal_key.
Signed-off-by: NJan Kiszka <jan.kiszka@web.de>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

They likely represent invalid queues that should be skipped. We already
do this for RX queues. Wish I had a spec...

Credits go to malc for analyzing the issue and suggesting this fix.
Signed-off-by: NJan Kiszka <jan.kiszka@web.de>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Signed-off-by: NJuan Quintela <quintela@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Signed-off-by: NJuan Quintela <quintela@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>