We'll need a pointer to the actual pci/sysbus device,
stick a pointer to it into the EHCIState struct.

https://bugzilla.redhat.com/show_bug.cgi?id=1005495Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
(cherry picked from commit adbecc89)
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

Now that the memory subsystem is propagating the endianness correctly,
the ne2000 device should have its I/O ports marked as LITTLE_ENDIAN, as
PCI devices are little endian.

This makes the ne2000 NIC to work again on PowerPC.

Cc: qemu-stable@nongnu.org
Cc: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>
(cherry picked from commit 45d883dc)
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

If offset_within_address_space falls in a page, then we register a
subpage. So check offset_within_address_space rather than
offset_within_region.

Cc: qemu-stable@nongnu.org
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Richard Henderson <rth@twiddle.net>
Cc: "Andreas Färber" <afaerber@suse.de>
Cc: Peter Maydell <peter.maydell@linaro.org>
Cc: Blue Swirl <blauwirbel@gmail.com>
Signed-off-by: NHu Tao <hutao@cn.fujitsu.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit 88266249)
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

This reverts commit 9b8c6924.

The commit was wrong: We only return -1 on invalid accesses, not on
valid but unbacked ones. This broke various corner cases.

Cc: qemu-stable@nongnu.org
Signed-off-by: NJan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit 68a7439a)
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

Accesses to unassigned io ports shall return -1 on read and be ignored
on write. Ensure these properties via dedicated ops, decoupling us from
the memory core's handling of unassigned accesses.

Cc: qemu-stable@nongnu.org
Signed-off-by: NJan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit 3bb28b72)
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

QEMU failed to open host devices like \\.\PhysicalDrive0 (first hard disk)
since some time (commit 8a79380b?).

Those devices use hdev_open which did not use the latest API for options.
This resulted in a fatal runtime error:

  Block protocol 'host_device' doesn't support the option 'filename'

Duplicate code from raw_open to fix this.

Cc: qemu-stable@nongnu.org
Reported-by: NDavid Brenner <david.brenner3@gmail.com>
Signed-off-by: NStefan Weil <sw@weilnetz.de>
Reviewed-by: NKevin Wolf <kwolf@redhat.com>
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>
(cherry picked from commit 68dc0364)
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

usb3 bulk endpoints with streams are implicitly pipelined now,
so the requests will actually be processed in parallel.  Also
allow them to complete out-of-order.

Fixes stalls in the uas driver.

Cc: qemu-stable@nongnu.org
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
(cherry picked from commit c96c41ed)
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

Cc: qemu-stable@nongnu.org
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
(cherry picked from commit 5c67dd7b)
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

MADV_DONTFORK prevents fork to fail with -ENOMEM if the default
overcommit heuristics decides there's too much anonymous virtual
memory allocated. If the KVM secondary MMU is synchronized with MMU
notifiers or not, doesn't make a difference in that regard.

Secondly it's always more efficient to avoid copying the guest
physical address space in the fork child (so we avoid to mark all the
guest memory readonly in the parent and so we skip the establishment
and teardown of lots of pagetables in the child).

In the common case we can ignore the error if MADV_DONTFORK is not
available. Leave a second invocation that errors out in the KVM path
if MMU notifiers are missing and KVM is enabled, to abort in such
case.
Signed-off-by: NAndrea Arcangeli <aarcange@redhat.com>
Tested-By: NBenoit Canet <benoit@irqsave.net>
Acked-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NGleb Natapov <gleb@redhat.com>
(cherry picked from commit 3e469dbf)
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

commit 62c96360
    virtio-pci: fix level interrupts
only helps systems without irqfd: on systems with irqfd support we
passed in flag requesting irqfd even when msix is disabled.

As a result, for level interrupts we didn't install an fd handler so
unmasking an fd had no effect.

Fix this up.

Cc: qemu-stable@nongnu.org
Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>
(cherry picked from commit 23fe2b3f)
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

The problem is introduced by commit 23326164 (exec: Support 64-bit
operations in address_space_rw, 2013-07-08).  Before that commit,
memory_access_size would only return 1/2/4.

Since alignment is already handled above, reduce l to the largest
power of two that is smaller than l.

Cc: qemu-stable@nongnu.org
Reported-by: NOleksii Shevchuk <alxchk@gmail.com>
Tested-by: NOleksii Shevchuk <alxchk@gmail.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit 098178f2)
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

This fixes the following assert when -device adlib is used:
ioport.c:240: portio_list_add: Assertion `pio->offset >= off_last' failed.
Signed-off-by: NHervé Poussineau <hpoussin@reactos.org>
Signed-off-by: NMichael Tokarev <mjt@tls.msk.ru>
(cherry picked from commit 2b21fb57)
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

CR4.PAE=1 will not enable paging if CR0.PG=0, but the "if" chain
in x86_cpu_get_phys_page_debug says otherwise.  Check CR0.PG
before everything else.

Fixes "-d in_asm" for a code section at the beginning of OVMF.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NRichard Henderson <rth@twiddle.net>
Reviewed-by: NMax Filippov <jcmvbkbc@gmail.com>
(cherry picked from commit f2f8560c)
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

Some bdrv_is_allocated callers do not expect errors, but the fallback
in qcow2.c might make other callers trip on assertion failures or
infinite loops.

Fix the callers to always look for errors.

Cc: qemu-stable@nongnu.org
Reviewed-by: NEric Blake <eblake@redhat.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>
(cherry picked from commit d663640c)

Conflicts:

	block/cow.c

*modified to avoid dependency on upstream's e641c1e8Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

This reverts commit a309ee6e.

This isn't in line with the usb specification and adds regressions,
win7 fails to drive the usb hub for example.

Was added because it "solved" the issue of hubs interacting badly
with the xhci host controller.  Now with the root cause being fixed
in xhci (commit <FIXME>) we can revert this one.

Cc: qemu-stable@nongnu.org
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
(cherry picked from commit bdebd6ee)
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

Cc: qemu-stable@nongnu.org
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
(cherry picked from commit ca716278)
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

virtqueue_get_avail_bytes: when found a indirect desc, we need loop over it.
           /* loop over the indirect descriptor table */
           indirect = 1;
           max = vring_desc_len(desc_pa, i) / sizeof(VRingDesc);
           num_bufs = i = 0;
           desc_pa = vring_desc_addr(desc_pa, i);
But, It init i to 0, then use i to update desc_pa. so we will always get:
desc_pa = vring_desc_addr(desc_pa, 0);
the last two line should swap.

Cc: qemu-stable@nongnu.org
Signed-off-by: NYin Yin <yin.yin@cs2c.com.cn>
Reviewed-by: NStefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>
(cherry picked from commit 1ae2757c)
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

A number of users are reporting stalls when using the pseries
hypervisor virtual console.

A simple test case is to paste 15 or 17 characters at a time
into the console. Pasting 15 characters at a time works fine
but pasting 17 characters hangs for a random amount of time.
Other activity (network, qemu monitor etc) unblocks it.

If qemu-char tries to send more than 16 characters at once,
vty_can_receive returns false. At this point we have to
wait for the guest to consume that output. Everything is good
so far.

The problem occurs when the the guest does consume the output.
We need to signal back to the qemu-char layer that we are
ready for more input. Without this we block until something
else kicks us (eg network activity).
Signed-off-by: NAnton Blanchard <anton@samba.org>
Signed-off-by: NAlexander Graf <agraf@suse.de>
(cherry picked from commit 7770b6f7)
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

commit 39848901
    pc: limit 64 bit hole to 2G by default
introduced a way for management to control
the window allocated to the 64 bit PCI hole.

This is useful, but existing management tools do not know how to set
this property.  As a result, e.g. specifying a large ivshmem device with
size > 4G is broken by default.  For example this configuration no
longer works:

-device ivshmem,size=4294967296,chardev=cfoo
-chardev socket,path=/tmp/sock,id=cfoo,server,nowait

Fix this by detecting that hole size was not specified
and defaulting to the backwards-compatible value of 1 << 62.

Cc: qemu-stable@nongnu.org
Cc: Igor Mammedov <imammedo@redhat.com>
Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>
(cherry picked from commit 1466cef3)
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

scsi_bus_legacy_add_drive() creates either a scsi-disk or a
scsi-generic device.  It sets property "serial" to argument serial
unless null.  Crashes with scsi-generic, because it doesn't have such
the property.

Only usb_msd_initfn_storage() passes non-null serial.  Reproducer:

    $ qemu-system-x86_64 -nodefaults -display none -S -usb \
    -drive if=none,file=/dev/sg1,id=usb-drv0 \
    -device usb-storage,id=usb-msd0,drive=usb-drv0,serial=123
    qemu-system-x86_64: -device usb-storage,id=usb-msd0,drive=usb-drv0,serial=123: Property '.serial' not found
    Aborted (core dumped)

Fix by handling exactly like "removable": set the property only when
it exists.

Cc: qemu-stable@nongnu.org
Reviewed-by: NAndreas Färber <afaerber@suse.de>
Signed-off-by: NMarkus Armbruster <armbru@redhat.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit c24e7517)
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

usb-tablet device was wrongly assigned to Misc category
Reported-by: NMarkus Armbruster <armbru@redhat.com>
Cc: qemu-stable@nongnu.org
Signed-off-by: NMarcel Apfelbaum <marcel.a@redhat.com>
Reviewed-by: NAndreas Färber <afaerber@suse.de>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
(cherry picked from commit 31efd2e8)
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

The Python "except Foo as x" syntax was only introduced in
Python 2.6, but we aim to support Python 2.4 and later.
Use the old-style "except Foo, x" syntax instead, thus
fixing configure/compile on systems with older Python.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NLuiz Capitulino <lcapitulino@redhat.com>
(cherry picked from commit 21e0043b)
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

My bad - but it's very important for us to warn the user that
IPv6 is broken on RoCE in linux right now, until linux releases
a fixed version.
Signed-off-by: NMichael R. Hines <mrhines@us.ibm.com>
Signed-off-by: NMichael Tokarev <mjt@tls.msk.ru>
(cherry picked from commit c89aa2f1)
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

Bit extraction for the FP BF and L field of the MTFSFI and MTFSF
instructions is wrong and doesn't match the reference manual (which
explain the bit number in big endian format). It has been broken in
commit 7d08d856.

This patch fixes this, which in turn fixes the problem reported by
Khem Raj about the floor() function of libm.
Reported-by: NKhem Raj <raj.khem@gmail.com>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>
CC: qemu-stable@nongnu.org (1.6)
Signed-off-by: NAlexander Graf <agraf@suse.de>
(cherry picked from commit 779f6590)
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

Commit a0e372f0 reorganized the register
counting for GDB. While it seems correct not to let the total number of
registers skyrocket in an SMP scenario through a static variable, the
distinction between total register count and 'g' packet register count
(last_reg vs. num_g_regs) got lost among the way.

Fix this by introducing CPUState::gdb_num_g_regs and using that in
gdb_handle_packet().
Reported-by: NAneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
Cc: qemu-stable@nongnu.org (stable-1.6)
Tested-by: NAneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
Tested-by: NMax Filippov <jcmvbkbc@gmail.com>
Tested-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NAndreas Färber <afaerber@suse.de>
(cherry picked from commit 35143f01)
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

In bdrv_delete() make sure to call bdrv_make_anon() *after* bdrv_close()
so that the device is still seen by bdrv_drain_all() when iterating
bdrv_states.

Cc: qemu-stable@nongnu.org
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>
(cherry picked from commit e1b5c52e)
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Since commit c658b94f, MIPS raises
exceptions when accessing invalid memory. This is not the correct
behaviour for MIPS Malta Core LV, as the GT-64120A system controller
just ignore undecoded access. This feature is used by the Linux kernel
to probe for some devices.

Emulate the correct behaviour in QEMU by adding an empty slot covering
the entire memory space decoded by the GT-64120A.
Tested-by: NStefan Weil <sw@weilnetz.de>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

bdrv_flags is set by bdrv_parse_discard_flags(), but later it is reset
to zero.
Signed-off-by: NM. Mohan Kumar <mohan@in.ibm.com>
Message-id: 1376483201-13466-1-git-send-email-mohan@in.ibm.com
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Since commit bd5c51ee (qemu-char: don't issue CHR_EVENT_OPEN in a BH), an
infinite recursion occurs when putting the monitor on a pty (-monitor
pty) and connecting a terminal to the slave port.

This is because of the qemu_chr_be_event(s, CHR_EVENT_OPENED) added to
qemu_chr_be_generic_open(). This event is captured by monitor_event()
which prints a welcome message to the character device. The flush of
that welcome message retriggers another open event in pty_chr_state()
because it checks s->connected, but only sets it to 1 after calling
qemu_chr_be_generic_open().

I've fixed this by setting s->connected = 1 before the call to
qemu_chr_be_generic_open() instead of after, so that the recursive
pty_chr_state() doesn't call it again.

An example snippet of repeating backtrace:
 ...
 #107486 0x007aec58 in monitor_flush (mon=0xf418b0) at qemu/monitor.c:288
 #107487 0x007aee7c in monitor_puts (mon=0xf418b0, str=0x1176d07 "") at qemu/monitor.c:322
 #107488 0x007aef20 in monitor_vprintf (mon=0xf418b0, fmt=0x8d4820 "QEMU %s monitor - type 'help' for more information\n",
     ap=0x7f432be0) at qemu/monitor.c:339
 #107489 0x007aefac in monitor_printf (mon=0xf418b0, fmt=0x8d4820 "QEMU %s monitor - type 'help' for more information\n")
     at qemu/monitor.c:347
 #107490 0x007ba4bc in monitor_event (opaque=0xf418b0, event=2) at qemu/monitor.c:4699
 #107491 0x00684c28 in qemu_chr_be_event (s=0xf37788, event=2) at qemu/qemu-char.c:108
 #107492 0x00684c70 in qemu_chr_be_generic_open (s=0xf37788) at qemu/qemu-char.c:113
 #107493 0x006880a4 in pty_chr_state (chr=0xf37788, connected=1) at qemu/qemu-char.c:1145
 #107494 0x00687fa4 in pty_chr_update_read_handler (chr=0xf37788) at qemu/qemu-char.c:1121
 #107495 0x00687c9c in pty_chr_write (chr=0xf37788, buf=0x70b3c008 <Address 0x70b3c008 out of bounds>, len=538720)
     at qemu/qemu-char.c:1063
 #107496 0x00684cc4 in qemu_chr_fe_write (s=0xf37788, buf=0x70b3c008 <Address 0x70b3c008 out of bounds>, len=538720)
     at qemu/qemu-char.c:118
 ...
Signed-off-by: NJames Hogan <james.hogan@imgtec.com>
Tested-by: NMichael Roth <mdroth@linux.vnet.ibm.com>
Message-id: 1375960178-10882-1-git-send-email-james.hogan@imgtec.com
Cc: Michael Roth <mdroth@linux.vnet.ibm.com>
Cc: Anthony Liguori <aliguori@us.ibm.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Context matching caused the 'has_pvpanic = true' to be applied to
the 1.6 machine type instead of the 1.5 machine type.
Reported-by: NMarkus Armbruster <armbru@redhat.com>
Reported-by: NMichael S. Tsirkin <mst@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

QOM CPUState refactorings

* Fix X86CPU Westmere CPUID for pc-*-1.4 and older

* afaerber/tags/qom-cpu-for-anthony:
  pc: Remove PCLMULQDQ from Westmere on pc-*-1.4 and older

Conflicts:
	hw/i386/pc_piix.c
	hw/i386/pc_q35.c
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

This breaks migration and is unneeded with modern SeaBIOS.
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>
Message-id: 1376316104-11269-1-git-send-email-aliguori@us.ibm.com

This patch is based on Hu Tao's:
http://lists.nongnu.org/archive/html/qemu-devel/2013-08/msg00125.html

The pvpanic device may be enabled now with "-device pvpanic"
from command line.
Signed-off-by: NMarcel Apfelbaum <marcel.a@redhat.com>
Reviewed-by: NHu Tao <hutao@cn.fujitsu.com>
Message-id: 1376233843-19410-3-git-send-email-marcel.a@redhat.com
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

This patch is based on Hu Tao's:
http://lists.nongnu.org/archive/html/qemu-devel/2013-08/msg00124.html

No need to hard-code pvpanic as part of the machine.
It can be added with "-device pvpanic" from command line (The next patch).
Anyway, for backport compatibility it is still part of 1.5
machine.
Signed-off-by: NMarcel Apfelbaum <marcel.a@redhat.com>
Reviewed-by: NHu Tao <hutao@cn.fujitsu.com>
Message-id: 1376233843-19410-2-git-send-email-marcel.a@redhat.com
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Commit 41cb383f made a guest-visible
change by adding the PCLMULQDQ bit to Westmere without adding
compatibility code to keep the ABI for older machine-types.
Fix it by adding the missing compat code.
Signed-off-by: NEduardo Habkost <ehabkost@redhat.com>
Signed-off-by: NAndreas Färber <afaerber@suse.de>

Was missing 'setup-time' in some of the QMP documentation...
Signed-off-by: NMichael R. Hines <mrhines@us.ibm.com>
Reviewed-by: NEric Blake <eblake@redhat.com>
Message-id: 1376078746-24948-7-git-send-email-mrhines@linux.vnet.ibm.com
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

We've gotten reports from multiple testers (including Frank Yangjie
and myself) that RDMA IPv6 support over RocE (Ethernet) is broken
in linux.

A patch to Linux is still in review:

http://comments.gmane.org/gmane.linux.drivers.rdma/16448

If the user is listening on '[::]', then we will not have a opened a device
yet and have no way of verifying if the device is RoCE or not.

In this case, the source VM will throw an error for ALL types of
connections (both IPv4 and IPv6) if the destination machine does not have
a regular infiniband network available for use.

The only way to gaurantee that an error is thrown for broken kernels is
for the management software to choose a *specific* interface at bind time
and validate what time of hardware it is.

Unfortunately, this puts the user in a fix:

 If the source VM connects with an IPv4 address without knowing that the
 destination has bound to '[::]' the migration will unconditionally fail
 unless the management software is not explicitly listening on the the IPv4
 address while using a RoCE-based device.

 If the source VM connects with an IPv6 address, then we're OK because we can
 throw an error on the source (and similarly on the destination).

 But in mixed environments, this will be broken for a while until it is fixed
 inside linux.

We do provide a *tiny* bit of help in mixed environments, though in this patch:

We can list all of the devices in the system and check to see if all the
devices are RoCE or Infiniband.

If we detect that we have a *pure* RoCE environment, then we can safely
thrown an error even if the management sofware has specified '[::]' as the
bind address.

However, if there is are multiple hetergeneous devices, then we cannot make
this assumption and the user just has to be sure they know what they are doing.
Signed-off-by: NMichael R. Hines <mrhines@us.ibm.com>
Message-id: 1376078746-24948-6-git-send-email-mrhines@linux.vnet.ibm.com
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

getaddrinfo() already knows what it's doing,
but it can potentially return multiple addresses.
We need to handle that...
Reviewed-by: NOrit Wasserman <owasserm@redhat.com>
Signed-off-by: NMichael R. Hines <mrhines@us.ibm.com>
Message-id: 1376078746-24948-5-git-send-email-mrhines@linux.vnet.ibm.com
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>