Make the VEDBoardInfo struct extend arm_boot_info; this will
allow us to get at the VEDBoardInfo information inside callbacks
from arm/boot code.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Message-id: 1373977512-28932-8-git-send-email-peter.maydell@linaro.org

Add a callback hook in arm_boot_info to allow board models to
modify the device tree blob if they need to. (The major expected
use case is to add virtio-mmio nodes for virtio-mmio transports
that exist in QEMU but not in the hardware.)
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Message-id: 1373977512-28932-7-git-send-email-peter.maydell@linaro.org

Add support for the generic MMIO based virtio transport.

This patch includes some fixes for bugs spotted by
Ying-Shiuan Pan <yspan@itri.org.tw>.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NKONRAD Frederic <fred.konrad@greensocs.com>
Message-id: 1373977512-28932-6-git-send-email-peter.maydell@linaro.org
[Fred changes: updated to new virtio-bus mechanisms]
Signed-off-by: NKONRAD Frederic <fred.konrad@greensocs.com>
[PMM changes:
 * fixed trivial makefile conflict
 * removed unused int_enable
 * host_features doesn't need migrating
 * reset guest accessible state in the reset function
 * minor style fixes like extra blank lines
 * RAZ/WI if there's no backend
 * made transport size 0x200, in line with kvmtool
 * set has_variable_vring_alignment
]

Support virtio transports which can specify the vring alignment
(ie where the guest communicates this to the host) by providing
a new virtio_queue_set_align() function. (The default alignment
remains as before.)

Transports which wish to make use of this must set the
has_variable_vring_alignment field in their VirtioBusClass
struct to true; they can then change the alignment via
virtio_queue_set_align().
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Message-id: 1373977512-28932-5-git-send-email-peter.maydell@linaro.org

The MMIO virtio transport spec allows the guest to tell the host how
large the queue size is. Add virtio_queue_set_num() function which
implements this in the QEMU common virtio support code.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Message-id: 1373977512-28932-4-git-send-email-peter.maydell@linaro.org

Replace the opencoded assembly of the reg property array for the
/memory node with a call to qemu_devtree_setprop_sized_cells().
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Reviewed-by: NPeter Crosthwaite <peter.crosthwaite@xilinx.com>
Message-id: 1373977512-28932-3-git-send-email-peter.maydell@linaro.org

Add support for error containment when a VFIO device assigned to a KVM
guest encounters an error. This is for PCIe devices/drivers that support AER
functionality. When the host OS is notified of an error in a device either
through the firmware first approach or through an interrupt handled by the AER
root port driver, the error handler registered by the vfio-pci driver gets
invoked. The qemu process is signaled through an eventfd registered per
VFIO device by the qemu process. In the eventfd handler, qemu decides on
what action to take. In this implementation, guest is brought down to
contain the error.

The kernel patches for the above functionality has been already accepted.

This is a refresh of the QEMU patch which was reviewed earlier.
http://marc.info/?l=linux-kernel&m=136281557608087&w=2
This patch has the same contents and has been built after refreshing
to latest upstream and after the linux headers have been updated in qemu.

	- Create eventfd per vfio device assigned to a guest and register an
          event handler

	- This fd is passed to the vfio_pci driver through the SET_IRQ ioctl

	- When the device encounters an error, the eventfd is signalled
          and the qemu eventfd handler gets invoked.

	- In the handler decide what action to take. Current action taken
          is to stop the guest.
Signed-off-by: NVijay Mohan Pandarathil <vijaymohan.pandarathil@hp.com>
Signed-off-by: NAlex Williamson <alex.williamson@redhat.com>

Turns out all the suspicions for AMD devices were correct, everywhere
we read a BAR address that the address matches the config space offset,
there's full access to PCI config space.  Attempt to generalize some
helpers to allow quirks to easily be added for mirrors and windows.
Also fill in complete config space for AMD.
Signed-off-by: NAlex Williamson <alex.williamson@redhat.com>

commit f8c457b8
     "pc: pass PCI hole ranges to Guests"
broke Xen as it has no fw_cfg.
Check for this configuration and boil out.
Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>
Tested-by: NStefano Stabellini <stefano.stabellini@eu.citrix.com>

Currently macvtap based macvlan device is working in promiscuous
mode, we want to implement mac-programming over macvtap through
Libvirt for better performance.

Design:
 QEMU notifies Libvirt when rx-filter config is changed in guest,
 then Libvirt query the rx-filter information by a monitor command,
 and sync the change to macvtap device. Related rx-filter config
 of the nic contains main mac, rx-mode items and vlan table.

This patch adds a QMP event to notify management of rx-filter change,
and adds a monitor command for management to query rx-filter
information.

Test:
 If we repeatedly add/remove vlan, and change macaddr of vlan
 interfaces in guest by a loop script.

Result:
 The events will flood the QMP client(management), management takes
 too much resource to process the events.

 Event_throttle API (set rate to 1 ms) can avoid the events to flood
 QMP client, but it could cause an unexpected delay (~1ms), guests
 guests normally expect rx-filter updates immediately.

 So we use a flag for each nic to avoid events flooding, the event
 is emitted once until the query command is executed. The flag
 implementation could not introduce unexpected delay.

There maybe exist an uncontrollable delay if we let Libvirt do the
real change, guests normally expect rx-filter updates immediately.
But it's another separate issue, we can investigate it when the
work in Libvirt side is done.

Michael S. Tsirkin: tweaked to enable events on start
Michael S. Tsirkin: fixed not to crash when no id
Michael S. Tsirkin: fold in patch:
   "additional fixes for mac-programming feature"
Amos Kong: always notify QMP client if mactable is changed
Amos Kong: return NULL list if no net client supports rx-filter query
Reviewed-by: NEric Blake <eblake@redhat.com>
Reviewed-by: NMarkus Armbruster <armbru@redhat.com>
Signed-off-by: NAmos Kong <akong@redhat.com>
Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>

Add property x-data-plane to virtio-ccw-blk devices.
Signed-off-by: NDominik Dingel <dingel@linux.vnet.ibm.com>
Signed-off-by: NCornelia Huck <cornelia.huck@de.ibm.com>

The Calxeda ECX-2000 chip (aka. Midway) is model-wise quite similar
to the Highbank. The most prominent difference is the Cortex-A15 CPU
core in it, together with the associated core peripherals.

Add a new ARM machine type called "midway".
Move the L2 cache controller device into the Highbank specific part,
since Midway does not have (and need) it.
Signed-off-by: NAndre Przywara <andre.przywara@calxeda.com>
Message-id: 1373026897-12085-3-git-send-email-andre.przywara@calxeda.com
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

To allow the modelling of machines similar to Calxeda Highbank,
introduce a parameter to the init function and call it from a
wrapper. This allows to tweak the definition for individual machines
later on.
Signed-off-by: NAndre Przywara <andre.przywara@calxeda.com>
Message-id: 1373026897-12085-2-git-send-email-andre.przywara@calxeda.com
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

The A15 Versatile Express board can remap a variety of things at address
0. We don't currently emulate the Serial Configuration Controller which
is how the guest can control this remapping, but we can provide the
initial default mapping of the first flash device into this space.
In particular this allows QEMU to boot flash images such as UEFI which
expect to include an exception vector table.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Tested-by: NGrant Likely <grant.likely@linaro.org>
Message-id: 1373374180-19884-1-git-send-email-peter.maydell@linaro.org

The drqbmp field of struct soc_dma_s is a uint64_t; however several
places in the code attempt to set bits in it using "(1 << drq)",
which will fail if drq is large enough that the 1 bit gets shifted
off the top of a 32 bit integer.  Change these to "(1ULL << drq)" so
that the promotion to 64 bit happens before the shift rather than
afterwards.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Message-id: 1372423919-5669-1-git-send-email-peter.maydell@linaro.org

Add a cast to avoid potentially shifting into the sign bit of
a signed value, which is undefined behaviour in C.

(Detected with clang's -fsanitize=undefined.)
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Message-id: 1372341831-4264-1-git-send-email-peter.maydell@linaro.org

The a15mpcore device claims that its default value for num-irq
is the number of interrupts used by the A15MP in the vexpress-a15
board. However that chip has 128 external interrupts, not 64.
Since there is only one A15 based model in QEMU currently, we
can fix this by simply changing the default value.

This error was causing recent (3.10) Linux kernels to print
warnings/backtraces when the number of interrupts reported
by the GIC was smaller than an interrupt number they wanted
to use.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Message-id: 1373032481-15280-1-git-send-email-peter.maydell@linaro.org

commit 1db8b5ef introduced an issue
where QEMU would segfault if you have an unattached Cadence UART.

Fix by guarding the flush-on-reset logic on there being a qemu_chr
attachment.
Reported-by: NSoren Brinkmann <soren.brinkmann@xilinx.com>
Signed-off-by: NPeter Crosthwaite <peter.crosthwaite@xilinx.com>
Tested-by: NSoren Brinkmann <soren.brinkmann@xilinx.com>
Message-id: 9009578ee10a50d994b2e10aa2840d73765f5968.1370577272.git.peter.crosthwaite@xilinx.com
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

AHCI couldn't cope with asynchronous commands that aren't doing DMA, it
simply wouldn't complete them. Due to the bug fixed in commit f68ec837,
FLUSH commands would seem to have completed immediately even if they
were still running on the host. After the commit, they would simply hang
and never unset the BSY bit, rendering AHCI unusable on any OS sending
flushes.

This patch adds another callback for the completion of asynchronous
commands. This is what AHCI really wants to use for its command
completion logic rather than an DMA completion callback.

Cc: qemu-stable@nongnu.org
Signed-off-by: NKevin Wolf <kwolf@redhat.com>
Reviewed-by: NStefan Hajnoczi <stefanha@redhat.com>

The 1980 epoch is used by the ARC PALcode for NT.  But we're emulating
a system using the SRM PALcode.  Using the proper epoch results in less
confusion in the guest userland.
Signed-off-by: NRichard Henderson <rth@twiddle.net>

The memory and i/o core now support passing 64-bit accesses along
from the guest, so we no longer need to emulate them.
Signed-off-by: NRichard Henderson <rth@twiddle.net>

Not really correct, but we don't implement all of the random devices
that the kernel looks for.  This is good enough to keep us booting.
Signed-off-by: NRichard Henderson <rth@twiddle.net>

Advancements in the ioport subsystem mean that we need no longer
thunk memory-mapped i/o through the system-io address space.
Signed-off-by: NRichard Henderson <rth@twiddle.net>

A DMA request can happen for data that hasn't been completely been
provided by the IDE core yet. For example

  - DBDMA request for 0x1000 bytes
  - IDE request for 1 sector
  - DBDMA wants to read 0x1000 bytes (8 sectors) from bdrv
  - breakage

Instead, we should truncate our bdrv request to the maximum number
of sectors we're allowed to read at that given time. Once that transfer
is through, we will fall into our recently introduced waiting logic.

  - DBDMA requests for 0x1000 bytes
  - IDE request for 1 sector
  - DBDMA wants to read MIN(0x1000, 1 * 512) bytes
  - DBDMA finishes reading, indicates to IDE core that transfer is complete
  - IDE request for 7 sectors
  - DBDMA finishes the DMA
Reported-by: NMark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Signed-off-by: NAlexander Graf <agraf@suse.de>

Mac OS X accesses fancy timer registers inside of the mac-io on bootup.

These really should be ticking at the mac-io bus frequency, but I don't
see anyone upset when we just make them as fast as we want to.

With this patch on top of my previous patch queue and latest OpenBIOS
I am able to boot Mac OS X 10.4 with -M mac99.
Signed-off-by: NAlexander Graf <agraf@suse.de>

The DBDMA engine really just reads bytes from a producing device (IDE
in our case) and shoves these bytes into memory. It doesn't care whether
any alignment takes place or not.

Our code today however assumes that block accesses always happen on
sector (512 byte) boundaries. This is a fair assumption for most cases.

However, Mac OS X really likes to do unaligned, incomplete accesses
that it finishes with the next DMA request.

So we need to read / write the unaligned bits independent of the actual
asynchronous request, because that one can only handle 512-byte-aligned
data. We also need to cache these unaligned sectors until the next DMA
request, at which point the data might be successfully flushed from the
pipe.
Signed-off-by: NAlexander Graf <agraf@suse.de>

We should only start processing DMA requests when we have data to process.
Hold off working through the DMA shuffling until the IDE core told us that
it's ready.

This is required because the guest can program the DMA engine or the IDE
transfer first. Both are legal.
Signed-off-by: NAlexander Graf <agraf@suse.de>

Soon we will introduce intermediate processing pauses which will
allow the bottom half to restart a DMA request that couldn't be
fulfilled yet.

For that to work, move the processing variable into the io struct
which is what DMA providers work with.

While touching it, also change it into a bool
Signed-off-by: NAlexander Graf <agraf@suse.de>

We need to know when the IDE core starts a DMA transfer. Add a notifier
function so we have the chance to start transmitting data.
Signed-off-by: NAlexander Graf <agraf@suse.de>

The DBDMA controller has a bottom half to asynchronously process DMA
request queues.

This bh was stored as a gross static variable. Move it into the device
struct instead.

While at it, move all users of it to the new generic kick function.
Signed-off-by: NAlexander Graf <agraf@suse.de>

The DBDMA engine really is running all the time, waiting for input. However
we don't want to waste cycles constantly polling.

So introduce a kick function that data providers can call to notify the
DBDMA controller of new input.
Signed-off-by: NAlexander Graf <agraf@suse.de>

We usually keep struct and constant definitions in header files. Move
them there to stay consistent and to make access to fields easier.
Signed-off-by: NAlexander Graf <agraf@suse.de>

The DBDMA controller can not change its command stream while it's
actively streaming data, true. But the fact that it's in RUN state
doesn't actually indicate anything. It could just as well be in
WAIT while in RUN. And then it's legal to change commands.

This fixes a real world issue I've encountered with Mac OS X.
Signed-off-by: NAlexander Graf <agraf@suse.de>

There was a debug print that didn't compile for me because the format
and the arguments weren't in sync. Fix it up.
Signed-off-by: NAlexander Graf <agraf@suse.de>

The macio code is basically undebuggable as it stands today, with no
debug prints anywhere whatsoever. DBDMA was better, but I needed a
few more to create reasonable logs that tell me where breakage is.

Add a DPRINTF macro in the macio source file and add a bunch of debug
prints that are all disabled by default of course.
Signed-off-by: NAlexander Graf <agraf@suse.de>

s/^I/        /g on the file with a few manual tweaks to align things.
Signed-off-by: NAlexander Graf <agraf@suse.de>

s/^I/        /g on the file.
Signed-off-by: NAlexander Graf <agraf@suse.de>

On a real G3 Beige the secondary IDE bus lives on the mac-io chip, not
on some random PCI device. Move it there to become more compatible.

While at it, also clean up the IDE channel connection logic.
Signed-off-by: NAlexander Graf <agraf@suse.de>

We can tell the guest the frequency of its time base through fwcfg.

However, we tell it a different value from the speed tb actually runs
at. Let's fix it and make the tbfreq initialization and the fwcfg exposure
use the same values.
Signed-off-by: NAlexander Graf <agraf@suse.de>

Signed-off-by: NAlexey Kardashevskiy <aik@ozlabs.ru>
Reviewed-by: NAndreas Färber <afaerber@suse.de>
Signed-off-by: NAlexander Graf <agraf@suse.de>