Replace it by directly setting FD_SR0_SEEK if required
Signed-off-by: NHervé Poussineau <hpoussin@reactos.org>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

Signed-off-by: NHervé Poussineau <hpoussin@reactos.org>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

FD_MSR_CMDBUSY flag is already set in fdctrl_write_data(), just
before calling the command handler (fdctrl_start_transfer() here).
Signed-off-by: NHervé Poussineau <hpoussin@reactos.org>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

VERIFY command is like a READ command, except that read data is not
transfered by DMA.
As DMA engine is not used, so we have to start data transfer ourselves.
Signed-off-by: NHervé Poussineau <hpoussin@reactos.org>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

Do not always set FD_SR0_SEEK, as callers already set it if needed.
Signed-off-by: NHervé Poussineau <hpoussin@reactos.org>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

fdctrl_start_transfer() used to set FD_SR0_SEEK no matter if
there actually was a seek or not. This is obviously wrong.

fdctrl_start_transfer() has this information because it performs
the initial seek itself.
Signed-off-by: NHervé Poussineau <hpoussin@reactos.org>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

On non-DMA transfers, fdctrl_stop_transfer() used to set FD_SR0_SEEK
no matter if there actually was a seek or not. This is obviously wrong.

fdctrl_seek_to_next_sect() has this information because it performs
the seek itself.
Signed-off-by: NHervé Poussineau <hpoussin@reactos.org>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

Signed-off-by: NHervé Poussineau <hpoussin@reactos.org>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

It decided whether an interrupt is triggered. Only one caller made use
of this functionality, so move the code there.

In this one caller, the interrupt must actually be triggered
unconditionally, like it was before commit 2fee0088. For example, a
successful read without an implied seek can result in st0 = 0, but still
triggers the interrupt.
Signed-off-by: NKevin Wolf <kwolf@redhat.com>
Tested-by: NHervé Poussineau <hpoussin@reactos.org>

Now that AIOPool no longer keeps a freelist, it isn't really a "pool"
anymore.  Rename it to AIOCBInfo and make it const since it no longer
needs to be modified.
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

We can get rid of our local version now that a helper exists.
Signed-off-by: NAlex Williamson <alex.williamson@redhat.com>

This makes use of the new level irqfd support enabling bypass of qemu
userspace both on INTx injection and unmask.  This significantly
boosts the performance of devices making use of legacy interrupts (ex.
~60% better netperf TCP_RR scores for an e1000e assigned to a Linux
guest and booted with pci=nomsi).  This also avoids flipping mmaps on
and off to simulate EOIs, so greatly improves performance of device
access in addition to interrupt latency.
Signed-off-by: NAlex Williamson <alex.williamson@redhat.com>

Until address_space_rw was introduced, NULL was accepted as a
placeholder for DMA with no IOMMU (to address_space_memory).

This does not work anymore, and dma_context_memory needs to
be specified explicitly.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

Define a new global dma_context_memory which is a DMAContext corresponding
to the global address_space_memory AddressSpace. This can be used by
sysbus peripherals like sysbus-ohci which need to do DMA.

In particular, use it in the sysbus-ohci device, which fixes a
segfault when attempting to use that device.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Reviewed-by: NPeter Crosthwaite <peter.crosthwaite@xilinx.com>

The structure to reference a logical drive has an unused field,
which can be used to carry the lun ID. This enabled seabios to
establish the proper target/LUN mapping.

Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: NHannes Reinecke <hare@suse.de>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

SBC says that "if an application client changes the WCE bit from one to
zero via a MODE SELECT command, then the device server shall write
any data in volatile cache to non-volatile medium before completing
the command".
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

Suggested by Laszlo Ersek.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

Suggested by Laszlo Ersek.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

The inquiry command, for the case of VPD=1, was returning short
responses; the number of returned bytes was just the number of bytes
in the request, without padding to the specified allocation length
with zero bytes.  This is usually harmless, but it is a violation
of the SCSI specification.

To fix this, always pad with zero bytes to r->cmd.xfer in
scsi_disk_emulate_command, and return at most r->buflen bytes
(the size of the buffer for command data) rather than at most
buflen bytes (the number of bytes that was filled in).

Before this patch, "strace sg_inq -p0x83 /dev/sda" would report a
non-zero resid value.  After this patch, it reports resid=0.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

Keep saving display surface parameters at init and using these cached
values instead of getting them when needed. Not sure why this is
needed (maybe due to the interaction with the vga device) but not
doing this broke the Xorg vmware driver at least.
Signed-off-by: NBALATON Zoltan <balaton@eik.bme.hu>
Tested-by: NJan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

Since 0b57e287, cpu_memory_rw_debug already triggers a TB invalidation.
As it doesn't (and cannot) set is_cpu_write_access=1 but "consumes" the
currently executed TB, the tb_invalidate_phys_page_range call from
patch_instruction didn't work anymore.

Fix this by open-coding the required bits to restore the CPU state from
the current TB position before patching and resume execution on the
patched instruction afterward.
Signed-off-by: NJan Kiszka <jan.kiszka@siemens.com>
Tested-by: NHervé Poussineau <hpoussin@reactos.org>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

Commit 5010d4dc reorganized vmstate to
split core + pci, but got two little details wrong.  Fix them.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

The xhci device does correct endian switches on the results of some DMAs
but not all.  In particular, there are many DMAs of what are essentially
arrays of 32-bit integers which never get byteswapped.  This causes them
to be interpreted incorrectly on big-endian hosts, since (as per the xhci
spec) these arrays are always little-endian in guest memory.

This patch adds some helper functions to fix these bugs.  This may not be
all the endian bugs in the xhci code, but it's certainly some of them and
the Linux guest xhci driver certainly gets further with these fixes.
Signed-off-by: NDavid Gibson <david@gibson.dropbear.id.au>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Signed-off-by: NHans de Goede <hdegoede@redhat.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Signed-off-by: NHans de Goede <hdegoede@redhat.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Signed-off-by: NHans de Goede <hdegoede@redhat.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Instead make ehci_execute and ehci_fill_queue return the again value.
Signed-off-by: NHans de Goede <hdegoede@redhat.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Signed-off-by: NHans de Goede <hdegoede@redhat.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Since with the ehci and xhci controllers a single packet can be larger
then maxpacketsize, it is possible for the result of a single packet
to be both having transferred some data as well as the transfer to have
an error.

An example would be an input transfer from a bulk endpoint successfully
receiving 1 or more maxpacketsize packets from the device, followed
by a packet signalling halt.

While already touching all the devices and controllers handle_packet /
handle_data / handle_control code, also change the return type of
these functions to void, solely storing the status in the packet. To
make the code paths for regular versus async packet handling more
uniform.

This patch unfortunately is somewhat invasive, since makeing the qemu
usb core deal with this requires changes everywhere. This patch only
prepares the usb core for this, all the hcd / device changes are done
in such a way that there are no functional changes.

This patch has been tested with uhci and ehci hcds, together with usb-audio,
usb-hid and usb-storage devices, as well as with usb-redir redirection
with a wide variety of real devices.

Note that there is usually no need to directly set packet->actual_length
form devices handle_data callback, as that is done by usb_packet_copy()
Signed-off-by: NHans de Goede <hdegoede@redhat.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Register displaychangelistener last, after spice is fully initialized,
otherwise we may hit NULL pointer dereferences when qemu starts calling
our callbacks.

Commit e250d949 triggers this bug.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

When entering vga mode the display size likely changes,
notify all displaychangelisteners about this.

Probably went unnoticed for a while as one if the first
things the guest does after leaving qxl native mode and
entering qxl vga mode is to set the vga video mode.  But
there is still a small window where qemu can operate on
stale data, leading to crashes now and then.

https://bugzilla.redhat.com/show_bug.cgi?id=865767Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

When resetting the qxl cursor notify the qemu displaystate too.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Added a trace point for easy logging.

RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=870972Signed-off-by: NAlon Levy <alevy@redhat.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Due to usage of pixman for rendering on all spice surfaces we have
pixman's requirement that the stride be word aligned. A guest not
honoring that can crash spice and qemu with it due to failure to create
a surface (in spice-server). Avoid this early on in primary surface
creation and offscreen surface creation.

Recently windows guests got odd width support which triggers a non word
aligned primary surface in 16bit color depth. Off screen surfaces have
always been word aligned, but doesn't hurt to check them here too.
Signed-off-by: NAlon Levy <alevy@redhat.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Postpone stopping the dirty log to the point where the command fifo is
configured to allow drivers which don't use the fifo to work too.
(Without this the picture rendered into the vram never got to the
screen and the DIRECT_VRAM option meant to support this case was
removed a year ago.)
Signed-off-by: NBALATON Zoltan <balaton@eik.bme.hu>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

According to the documentation drivers using this device should read
FB_SIZE before enabling the device to know what memory to map. This
would not work if we return 0 before enabled. The docs also mention
reading SVGA_REG_DEPTH but not writing it. (Only SVGA_REG_BITS_PER_PIXEL
can be written but we don't really support that either.)
Signed-off-by: NBALATON Zoltan <balaton@eik.bme.hu>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

Removed info from vmsvga_state that is available from elsewhere and
thus was duplicated here unnecessarily.
Signed-off-by: NBALATON Zoltan <balaton@eik.bme.hu>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>