This patch fixes a bunch of issues in the itd descriptor handling.
Most important fix is to handle transfers which cross page borders
correctly by looking up the address of the next page.  Luckily the
linux uses physically contigous memory so the data used to hits the
correct location even with this bug instead of corrupting guest
memory.  Also the transfer length updates for outgoing transfers wasn't
correct.

While being at it DPRINTFs have been replaced by tracepoints.

The isoch_pause logic has been disabled.  Not clear to me which propose
this serves and I think it is incorrect too as we just skip processing
itds.  Even when no xfer happens we have to clear the active bit.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

The USB tablet advertises that it supports the "boot" protocol.
However, its reports aren't "boot" protocol compatible.  So, it
shouldn't claim that.
Signed-off-by: NKevin O'Connor <kevin@koconnor.net>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

The QEMU USB mouse claims to support the "boot" protocol
(bInterfaceSubClass is 1).  However, the mouse rejects the
Set_Protocol command.

The qemu mouse does support the "boot" protocol specification, so a
simple fix is to enable the Set_Protocol request.
Signed-off-by: NKevin O'Connor <kevin@koconnor.net>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

The state machine doesn't stop in EXECUTING state any more when async
packets are in flight, so the checks are not needed any more and can
be dropped.

Also kick out the check for the frame timer.  As we don't stop & sleep
any more on async packets this is obsolete.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

This patch adds USBBusOps struct with (for now) only a single callback
which is called when a device is about to be destroyed.  The USB Host
adapters are implementing this callback and use it to cancel any async
requests which might be in flight before the device actually goes away.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Set the correct bits for nodev, stall and babble errors.
Raise errint irq.  Fix state transition from WRITEBACK
to the next state.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Two bugs at once:

First the mask is backwards, so the it used to keeps the offset and
clears the page address, which is not what we need when we update the
offset.

Second the offset calculation is wrong in case head isn't page aligned.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

This patch adds support for keeping multiple queues going at the same
time.  One slow device will not affect other devices any more.

The patch adds code to manage EHCIQueue structs.  It also does a number
of changes to the state machine:

 * The state machine will never ever stop in EXECUTING any more.
   Instead it will continue with the next queue (aka HORIZONTALQH) when
   the usb device returns USB_RET_ASYNC.
 * The state machine will stop processing when it figures it walks in
   circles (easy to figure now that we have a EHCIQueue struct for each
   QH we've processed).  The bailout logic should not be needed any
   more.  For now it is still in, but will assert() in case it triggers.
 * The state machine will just skip queues with a async USBPacket in
   flight.
 * The state machine will resume processing as soon as the async
   USBPacket is finished.

The patch also takes care to flush the QH struct back to guest memory
when needed, so we don't get stale data when (re-)loading it from guest
memory in FETCHQH state.

It also makes the writeback code to not touch the first three dwords of
the QH struct as the EHCI must not write them.  This actually fixes a
bug where QH chaining changes (next ptr) by the linux ehci driver where
overwritten by the emulated EHCI.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Add EHCIQueue struct, move the fields needed to track the queue state
into that struct.  Pass the new struct instead of ehci state down to
functions which handle the queue state.  Lot of variable references have
changed due to that without an actual functional change.

Replace fetch_addr with two variables, one for async and one for
periodic schedule.  Add functions to get and set the fetch address.

Use EHCIQueue->usb_status (old name: EHCIState->exec_status) directly in
ehci_execute_complete instead of passing around the status using a
parameters and the return value.

ehci_state_fetchqh returns a EHCIQueue struct now.

No change in behavior.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Add a trace point for buffer copies and drop the DPRINTF's.

No change in behavior.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Add a separate tracepoint to log how register values change in response
to a mmio write.  Especially useful for registers which have read-only
or clear-on-write bits in them.

No change in behavior.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Trace usb port operations (attach, detach, reset),
drop a few obsolete DPRINTF's.

No change in behavior.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Add functions to get and set the current state of the state machine,
add tracepoints there to trace state transitions.  Add support for
traceing the queue heads and transfer descriptors as we look at them.

Drop a few DPRINTFs and all DPRINTF_ST lines, they are obsolete now.

No change in behavior.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

This patch starts adding trace support to ehci.  It traces
updates of the status register (USBSTS), mmio access and
controller reset.

It also adds functions to set and clear status register bits
and puts them in use everywhere.

Some DPRINTF's are dropped in favor of the new tracepoints.

No change in behavior.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Factor out disconnect code (called when a device disappears) to a
separate function.  Add a check for ENODEV errno to a few more places
to make sure we notice disconnects.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Older versions of libcurl don't have some of the features we try to
use, in particular curl_multi_setopt(). Check for this in the 'is
libcurl available?' configure test so we disable curl support if the
library is too old.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NEdgar E. Iglesias <edgar.iglesias@gmail.com>

Add an explanatory note to the top of Changelog pointing at the
wiki and git history for changelogs for more recent releases.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NEdgar E. Iglesias <edgar.iglesias@gmail.com>

Thanks to agraf_, stefanha and Snader_LB for their IRC assistance.

Thanks to Markus Armbruster and Alexander Graf (again) for their
assistance with the second version of this patch. No patch is too
simple to test...
Signed-off-by: NBrad Hards <bradh@frogmouth.net>
Signed-off-by: NEdgar E. Iglesias <edgar.iglesias@gmail.com>

Qemu uses signalfd to figure out, if a signal occured without the need
to actually receive the signal. Instead, it can read from the fd to receive
its news.

Now, we obviously don't always have signalfd around. Especially not on
non-Linux systems. So what we do there is that we create a new thread,
block that thread on all signals and simply call sigwait to wait for a
signal we're interested in to occur.

This all sounds great, but what we're really doing is:

    sigset_t all;

    sigfillset(&all);
    sigprocmask(SIG_BLOCK, &all, NULL);

which - on Darwin - blocks all signals on the current _process_, not only
on the current thread. To block signals on the thread, we can use
pthread_sigmask().

This patch does that, assuming that my above analysis is correct, and thus
renders Qemu useable on Darwin again.
Reported-by: NAndreas Färber <andreas.faerber@web.de>
Acked-by: NPaolo Bonizni <pbonzini@redhat.com>
CC: Jan Kiszka <jan.kiszka@siemens.com>
CC: Anthony Liguori <anthony@codemonkey.ws>
Signed-off-by: NAlexander Graf <agraf@suse.de>
Signed-off-by: NEdgar E. Iglesias <edgar.iglesias@gmail.com>

* rth/axp-next: (26 commits)
  target-alpha: Implement TLB flush primitives.
  target-alpha: Use a fixed frequency for the RPCC in system mode.
  target-alpha: Trap for unassigned and unaligned addresses.
  target-alpha: Remap PIO space for 43-bit KSEG for EV6.
  target-alpha: Implement cpu_alpha_handle_mmu_fault for system mode.
  target-alpha: Implement more CALL_PAL values inline.
  target-alpha: Disable interrupts properly.
  target-alpha: All ISA checks to use TB->FLAGS.
  target-alpha: Swap shadow registers moving to/from PALmode.
  target-alpha: Implement do_interrupt for system mode.
  target-alpha: Add IPRs to be used by the emulation PALcode.
  target-alpha: Use kernel mmu_idx for pal_mode.
  target-alpha: Add various symbolic constants.
  target-alpha: Use do_restore_state for arithmetic exceptions.
  target-alpha: Tidy up arithmetic exceptions.
  target-alpha: Tidy exception constants.
  target-alpha: Enable the alpha-softmmu target.
  target-alpha: Rationalize internal processor registers.
  target-alpha: Merge HW_REI and HW_RET implementations.
  target-alpha: Cleanup MMU modes.
  ...

Fix provided by: "Aneesh Kumar K.V" <aneesh.kumar@linux.vnet.ibm.com>
Signed-off-by: NEdgar E. Iglesias <edgar.iglesias@gmail.com>

Conflicts:
	vl.c

When not specifying a cluster size on the command line, qemu-img printed
a cluster size of 0:

    Formatting '/tmp/test.qcow2', fmt=qcow2 size=67108864
    encryption=off cluster_size=0

This patch adds the default cluster size to the QEMUOptionParameter list, so
that it displays the default value that is used.
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

Block drivers that don't support creating images don't have a size option. Fail
gracefully instead of segfaulting when trying to access the option's value.
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

This fixes memory leaks that may be caused by I/O errors during L1 table growth
(can happen during save_vm) and in qemu-img check.
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

Reviewed-by: NChristian Brunner <chb@muc.de>
Signed-off-by: NJosh Durgin <josh.durgin@dreamhost.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

If scheduling fails, the number of outstanding I/Os must be correct,
or there will be a hang when waiting for everything to be flushed.
Reviewed-by: NChristian Brunner <chb@muc.de>
Reported-by: NStefan Hajnoczi <stefanha@gmail.com>
Signed-off-by: NJosh Durgin <josh.durgin@dreamhost.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

The new format is rbd:pool/image[@snapshot][:option1=value1[:option2=value2...]]
Each option is used to configure rados, and may be any Ceph option, or "conf".
The "conf" option specifies a Ceph configuration file to read.

This allows rbd volumes from more than one Ceph cluster to be used by
specifying different monitor addresses, as well as having different
logging levels or locations for different volumes.
Reviewed-by: NChristian Brunner <chb@muc.de>
Signed-off-by: NJosh Durgin <josh.durgin@dreamhost.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

librbd stacks on top of librados to provide access
to rbd images.

Using librbd simplifies the qemu code, and allows
qemu to use new versions of the rbd format
with few (if any) changes.
Reviewed-by: NChristian Brunner <chb@muc.de>
Signed-off-by: NJosh Durgin <josh.durgin@dreamhost.com>
Signed-off-by: NYehuda Sadeh <yehuda@hq.newdream.net>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

use the correct way to get the size of a disk device or partition

From: Adam Hamsik <haad@netbsd.org>
Signed-off-by: NChristoph Egger <Christoph.Egger@amd.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

On NetBSD a userland process is better with the character device
interface. In addition, a block device can't be opened twice; if a Xen
backend opens it, qemu can't and vice-versa.
Signed-off-by: NChristoph Egger <Christoph.Egger@amd.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

The vmdk code is sloppy when handling the header descriptor during
creation of an image. Fix all header accesses in the create path to
either store native endianness or convert it when appropriate.
Reported-by: NYury Tsarev <ytsarev@novell.com>
Signed-off-by: NAlexander Graf <agraf@suse.de>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

Change BDRV_O_NOCACHE to only imply bypassing the host OS file cache,
but no writeback semantics.  All existing callers are changed to also
specify BDRV_O_CACHE_WB to give them writeback semantics.
Signed-off-by: NChristoph Hellwig <hch@lst.de>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

BM_STATUS_INT is automatically set during ide_set_irq(), there's no reason to
set it manually in addition.

There is even one case where the interrupt status bit was set, but no IRQ was
raised. This is when the PRD table was reached but there is more data to
transfer. The correct behaviour for this case is not to set BM_STATUS_INT.
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

This module has no target dependencies (except for target_phys_addr_t
size) and can thus be built as part of libhw.
Signed-off-by: NJan Kiszka <jan.kiszka@siemens.com>
Reviewed-by: NAurelien Jarno <aurelien@aurel32.net>
Signed-off-by: NStefan Hajnoczi <stefanha@linux.vnet.ibm.com>

While trying to use qemu -cpu pentium3 to test for incorrect uses of certain
SSE2 instructions, I found that QEMU allowed the mfence and lfence
instructions to be executed even though Pentium 3 doesn't support them.

According to the processor specs (and experience on a real Pentium 3), these
instructions are only available with SSE2, but QEMU is checking for SSE.  The
check for the related sfence instruction is correct (it works with SSE).

This trival patch fixes the test.
Signed-off-by: NMartin Simmons <martin@lispworks.com>
Signed-off-by: NStefan Hajnoczi <stefanha@linux.vnet.ibm.com>