During processing of certain commands such as FD_CMD_READ_ID and
FD_CMD_DRIVE_SPECIFICATION_COMMAND the fifo memory access could
get out of bounds leading to memory corruption with values coming
from the guest.

Fix this by making sure that the index is always bounded by the
allocated memory.

This is CVE-2015-3456.
Signed-off-by: NPetr Matousek <pmatouse@redhat.com>
Reviewed-by: NJohn Snow <jsnow@redhat.com>
Signed-off-by: NJohn Snow <jsnow@redhat.com>

target-arm queue:
 * Support TZ and grouping in the GIC
 * hw/sd: sd_reset cleanup
 * armv7m_nvic: fix bug in systick device

# gpg: Signature made Tue May 12 12:02:26 2015 BST using RSA key ID 14360CDE
# gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>"

* remotes/pmaydell/tags/pull-target-arm-20150512:
  hw/arm/highbank.c: Wire FIQ between CPU <> GIC
  hw/arm/vexpress.c: Wire FIQ between CPU <> GIC
  hw/arm/virt.c: Wire FIQ between CPU <> GIC
  hw/intc/arm_gic: Add grouping support to gic_update()
  hw/intc/arm_gic: Change behavior of IAR writes
  hw/intc/arm_gic: Change behavior of EOIR writes
  hw/intc/arm_gic: Handle grouping for GICC_HPPIR
  hw/intc/arm_gic: Restrict priority view
  hw/intc/arm_gic: Implement Non-secure view of RPR
  hw/intc/arm_gic: Make ICCICR/GICC_CTLR banked
  hw/intc/arm_gic: Make ICCBPR/GICC_BPR banked
  hw/intc/arm_gic: Make ICDDCR/GICD_CTLR banked
  hw/intc/arm_gic_kvm.c: Save and restore GICD_IGROUPRn state
  hw/intc/arm_gic: Add Interrupt Group Registers
  hw/intc/arm_gic: Switch to read/write callbacks with tx attributes
  hw/intc/arm_gic: Add Security Extensions property
  hw/intc/arm_gic: Create outbound FIQ lines
  hw/sd: Don't pass BlockBackend to sd_reset()
  armv7m_nvic: systick: Reload the RELOAD value and count down only if ENABLE bit is set
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Connect FIQ output of the GIC CPU interfaces to the CPUs.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Message-id: 1430502643-25909-18-git-send-email-peter.maydell@linaro.org

Connect FIQ output of the GIC CPU interfaces to the CPUs.
Signed-off-by: NFabian Aggeler <aggelerf@ethz.ch>
Signed-off-by: NGreg Bellows <greg.bellows@linaro.org>
Reviewed-by: NEdgar E. Iglesias <edgar.iglesias@xilinx.com>
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Message-id: 1430502643-25909-17-git-send-email-peter.maydell@linaro.org
Message-id: 1429113742-8371-3-git-send-email-greg.bellows@linaro.org
[PMM: minor format tweak]
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Connect FIQ output of the GIC CPU interfaces to the CPUs.
Signed-off-by: NGreg Bellows <greg.bellows@linaro.org>
Reviewed-by: NEdgar E. Iglesias <edgar.iglesias@xilinx.com>
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Message-id: 1430502643-25909-16-git-send-email-peter.maydell@linaro.org
Message-id: 1429113742-8371-4-git-send-email-greg.bellows@linaro.org
[PMM: minor format tweak]
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Add support to gic_update() for determining the current IRQ
and FIQ status when interrupt grouping is supported. This
simply requires that instead of always raising IRQ we
check the group of the highest priority pending interrupt
and the GICC_CTLR.FIQEn bit to see whether we should raise
IRQ or FIQ.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Reviewed-by: NEdgar E. Iglesias <edgar.iglesias@xilinx.com>
Message-id: 1430502643-25909-15-git-send-email-peter.maydell@linaro.org

Grouping (GICv2) and Security Extensions change the behavior of IAR
reads. Acknowledging Group0 interrupts is only allowed from Secure
state and acknowledging Group1 interrupts from Secure state is only
allowed if AckCtl bit is set.
Signed-off-by: NFabian Aggeler <aggelerf@ethz.ch>
Signed-off-by: NGreg Bellows <greg.bellows@linaro.org>
Reviewed-by: NEdgar E. Iglesias <edgar.iglesias@xilinx.com>
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Message-id: 1430502643-25909-14-git-send-email-peter.maydell@linaro.org
Message-id: 1429113742-8371-14-git-send-email-greg.bellows@linaro.org
[PMM: simplify significantly by reusing the existing
 gic_get_current_pending_irq() rather than reimplementing the
 same logic here]
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Grouping (GICv2) and Security Extensions change the behavior of EOIR
writes. Completing Group0 interrupts is only allowed from Secure state.
Signed-off-by: NFabian Aggeler <aggelerf@ethz.ch>
Signed-off-by: NGreg Bellows <greg.bellows@linaro.org>
Reviewed-by: NEdgar E. Iglesias <edgar.iglesias@xilinx.com>
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Message-id: 1430502643-25909-13-git-send-email-peter.maydell@linaro.org
Message-id: 1429113742-8371-13-git-send-email-greg.bellows@linaro.org
[PMM: Rather than go to great lengths to ignore the UNPREDICTABLE case
 of a Secure EOI of a Group1 (NS) irq with AckCtl == 0, we just let
 it fall through; add a comment about it.]
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Grouping (GICv2) and Security Extensions change the behaviour of reads
of the highest priority pending interrupt register (ICCHPIR/GICC_HPPIR).
Signed-off-by: NFabian Aggeler <aggelerf@ethz.ch>
Signed-off-by: NGreg Bellows <greg.bellows@linaro.org>
Reviewed-by: NEdgar E. Iglesias <edgar.iglesias@xilinx.com>
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Message-id: 1430502643-25909-12-git-send-email-peter.maydell@linaro.org
Message-id: 1429113742-8371-12-git-send-email-greg.bellows@linaro.org
[PMM: make utility fn static; coding style fixes; AckCtl has an effect
 for GICv2 without security extensions as well; removed checks on enable
 bits because these are done when we set current_pending[cpu]]
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

GICs with Security Extensions restrict the non-secure view of the
interrupt priority and priority mask registers.
Signed-off-by: NFabian Aggeler <aggelerf@ethz.ch>
Signed-off-by: NGreg Bellows <greg.bellows@linaro.org>
Reviewed-by: NEdgar E. Iglesias <edgar.iglesias@xilinx.com>
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Message-id: 1430502643-25909-11-git-send-email-peter.maydell@linaro.org
Message-id: 1429113742-8371-15-git-send-email-greg.bellows@linaro.org
[PMM: minor code tweaks; fixed missing masking in gic_set_priority_mask
and gic_set_priority]
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

For GICs with Security Extensions Non-secure reads have a restricted
view on the current running priority.
Signed-off-by: NFabian Aggeler <aggelerf@ethz.ch>
Signed-off-by: NGreg Bellows <greg.bellows@linaro.org>
Reviewed-by: NEdgar E. Iglesias <edgar.iglesias@xilinx.com>
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Message-id: 1430502643-25909-10-git-send-email-peter.maydell@linaro.org
Message-id: 1429113742-8371-11-git-send-email-greg.bellows@linaro.org
[PMM: make function static, minor comment tweak]
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

ICCICR/GICC_CTLR is banked in GICv1 implementations with Security
Extensions or in GICv2 in independent from Security Extensions.
This makes it possible to enable forwarding of interrupts from
the CPU interfaces to the connected processors for Group0 and Group1.

We also allow to set additional bits like AckCtl and FIQEn by changing
the type from bool to uint32. Since the field does not only store the
enable bit anymore and since we are touching the vmstate, we use the
opportunity to rename the field to cpu_ctlr.
Signed-off-by: NFabian Aggeler <aggelerf@ethz.ch>
Signed-off-by: NGreg Bellows <greg.bellows@linaro.org>
Reviewed-by: NEdgar E. Iglesias <edgar.iglesias@xilinx.com>
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Message-id: 1430502643-25909-9-git-send-email-peter.maydell@linaro.org
Message-id: 1429113742-8371-9-git-send-email-greg.bellows@linaro.org
[PMM: rewrote to store state in a single uint32_t rather than
 keeping the NS and S banked variants separate; this considerably
 simplifies the get/set functions]
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

This register is banked in GICs with Security Extensions. Storing the
non-secure copy of BPR in the abpr, which is an alias to the non-secure
copy for secure access. ABPR itself is only accessible from secure state
if the GIC implements Security Extensions.
Signed-off-by: NFabian Aggeler <aggelerf@ethz.ch>
Signed-off-by: NGreg Bellows <greg.bellows@linaro.org>
Reviewed-by: NEdgar E. Iglesias <edgar.iglesias@xilinx.com>
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Message-id: 1430502643-25909-8-git-send-email-peter.maydell@linaro.org
Message-id: 1429113742-8371-10-git-send-email-greg.bellows@linaro.org
[PMM: rewrote to fix style issues and correct handling of GICv2
 without security extensions]
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

ICDDCR/GICD_CTLR is banked if the GIC has the security extensions,
and the S (or only) copy has separate enable bits for Group0 and
Group1 enable if the GIC implements interrupt groups.

EnableGroup0 (Bit [1]) in GICv1 is architecturally IMPDEF. Since this
bit (Enable Non-secure) is present in the integrated GIC of the Cortex-A9
MPCore, we support this bit in our GICv1 implementation too.
Signed-off-by: NFabian Aggeler <aggelerf@ethz.ch>
Signed-off-by: NGreg Bellows <greg.bellows@linaro.org>
Reviewed-by: NEdgar E. Iglesias <edgar.iglesias@xilinx.com>
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Message-id: 1430502643-25909-7-git-send-email-peter.maydell@linaro.org
Message-id: 1429113742-8371-8-git-send-email-greg.bellows@linaro.org
[PMM: rewritten to store the state in a single s->ctlr uint32,
 with the NS register handled as an alias of bit 1 in that value;
 added vmstate version bump]
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Now that the GIC base class has state fields for the GICD_IGROUPRn
registers, make kvm_arm_gic_get() and kvm_arm_gic_put() write and
read them. This allows us to remove the check that made us
fail migration if the guest had set any of the group register bits.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Message-id: 1430502643-25909-6-git-send-email-peter.maydell@linaro.org

The Interrupt Group Registers allow the guest to configure interrupts
into one of two groups, where Group0 are higher priority and may
be routed to IRQ or FIQ, and Group1 are lower priority and always
routed to IRQ. (In a GIC with the security extensions Group0 is
Secure interrupts and Group 1 is NonSecure.)
The GICv2 always supports interrupt grouping; the GICv1 does only
if it implements the security extensions.

This patch implements the ability to read and write the registers;
the actual functionality the bits control will be added in a
subsequent patch.
Signed-off-by: NFabian Aggeler <aggelerf@ethz.ch>
Signed-off-by: NGreg Bellows <greg.bellows@linaro.org>
Reviewed-by: NEdgar E. Iglesias <edgar.iglesias@xilinx.com>
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Message-id: 1430502643-25909-5-git-send-email-peter.maydell@linaro.org
Message-id: 1429113742-8371-7-git-send-email-greg.bellows@linaro.org
[PMM: bring GIC_*_GROUP macros into line with the others, ie a
 simple SET/CLEAR/TEST rather than GROUP0/GROUP1;
 utility gic_has_groups() function;
 minor style fixes;
 bump vmstate version]
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Switch the GIC's MMIO callback functions to the read_with_attrs
and write_with_attrs functions which provide MemTxAttrs. This will
allow the GIC to correctly handle secure and nonsecure register
accesses.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Reviewed-by: NEdgar E. Iglesias <edgar.iglesias@xilinx.com>
Message-id: 1430502643-25909-4-git-send-email-peter.maydell@linaro.org

Add a QOM property which allows the GIC Security Extensions to be
enabled. These are an optional part of the GICv1 and GICv2 architecture.
This commit just adds the property and some sanity checks that it
is only enabled on GIC revisions that support it.
Signed-off-by: NFabian Aggeler <aggelerf@ethz.ch>
Signed-off-by: NGreg Bellows <greg.bellows@linaro.org>
Reviewed-by: NEdgar E. Iglesias <edgar.iglesias@xilinx.com>
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Message-id: 1430502643-25909-3-git-send-email-peter.maydell@linaro.org
Message-id: 1429113742-8371-5-git-send-email-greg.bellows@linaro.org
[PMM: changed property name, added checks that it isn't set for
 older GIC revisions or if using the KVM VGIC; reworded commit message]
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Create the outbound FIQ lines from the GIC to the CPUs; these are
used if the GIC has security extensions or grouping support.
Signed-off-by: NFabian Aggeler <aggelerf@ethz.ch>
Signed-off-by: NGreg Bellows <greg.bellows@linaro.org>
Reviewed-by: NEdgar E. Iglesias <edgar.iglesias@xilinx.com>
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Message-id: 1430502643-25909-2-git-send-email-peter.maydell@linaro.org
Message-id: 1429113742-8371-2-git-send-email-greg.bellows@linaro.org
[PMM: added FIQ lines to kvm-arm-gic so its interface is the same;
tweaked commit message]
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

The only valid BlockBackend to pass to sd_reset() is the one for
the SD card, which is sd->blk. Drop the second argument from this
function in favour of having it just use sd->blk.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Reviewed-by: NMarkus Armbruster <armbru@redhat.com>
Message-id: 1430683444-9797-1-git-send-email-peter.maydell@linaro.org

Consider the following pseudo code to configure SYSTICK (The
recommended programming sequence from "the definitive guide to the
arm cortex-m3"):
    SYSTICK Reload Value Register = 0xffff
    SYSTICK Current Value Register = 0
    SYSTICK Control and Status Register = 0x7

The pseudo code "SYSTICK Current Value Register = 0" leads to invoking
systick_reload(). As a consequence, the systick.tick member is updated
and the systick timer starts to count down when the ENABLE bit of
SYSTICK Control and Status Register is cleared.

The worst case is that: during the system initialization, the reset
value of the SYSTICK Control and Status Register is 0x00000000.
When the code "SYSTICK Current Value Register = 0" is executed, the
systick.tick member is accumulated with "(s->systick.reload + 1) *
systick_scale(s)". The systick_scale() gets the external_ref_clock
scale because the CLKSOURCE bit of the SYSTICK Control and Status
Register is cleared. This is the incorrect behavior because of the
code "SYSTICK Control and Status Register = 0x7". Actually, we want
the processor clock instead of the external reference clock.

This incorrect behavior defers the generation of the first interrupt.

The patch fixes the above-mentioned issue by setting the systick.tick
member and modifying the systick timer only if the ENABLE bit of
the SYSTICK Control and Status Register is set.

In addition, the Cortex-M3 Devices Generic User Guide mentioned that
"When ENABLE is set to 1, the counter loads the RELOAD value from the
SYST RVR register and then counts down". This patch adheres to the
statement of the user guide.
Signed-off-by: NAdrian Huang <adrianhuang0701@gmail.com>
Reviewed-by: NJim Huang <jserv.tw@gmail.com>
[PMM: minor tweak to comment text]
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

# gpg: Signature made Mon May 11 16:25:58 2015 BST using RSA key ID 81AB73C8
# gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>"
# gpg:                 aka "Stefan Hajnoczi <stefanha@gmail.com>"

* remotes/stefanha/tags/net-pull-request:
  rocker: timestamp on the debug logs helps correlate with events in the VM
  MAINTAINERS: add rocker
  rocker: add tests
  rocker: add new rocker switch device
  pci: add network device class 'other' for network switches
  pci: add rocker device ID
  rocker: add register programming guide
  virtio-net: use qemu_mac_strdup_printf
  net: add MAC address string printer
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

QMP pull request

# gpg: Signature made Mon May 11 14:15:19 2015 BST using RSA key ID E24ED5A7
# gpg: Good signature from "Luiz Capitulino <lcapitulino@gmail.com>"

* remotes/qmp-unstable/tags/for-upstream:
  scripts: qmp-shell: Add verbose flag
  scripts: qmp-shell: add transaction subshell
  scripts: qmp-shell: Expand support for QMP expressions
  scripts: qmp-shell: refactor helpers
  MAINTAINERS: New maintainer for QMP and QAPI
  json-parser: Accept 'null' in QMP
  qobject: Add a special null QObject
  qobject: Clean up around qtype_code
  QJSON: Use OBJECT_CHECK
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

pc, virtio enhancements

Memory hot-unplug support for pc, MSI-X
mapping update speedup for virtio-pci,
misc refactorings and bugfixes.
Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>

# gpg: Signature made Mon May 11 08:23:43 2015 BST using RSA key ID D28D5469
# gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>"
# gpg:                 aka "Michael S. Tsirkin <mst@redhat.com>"

* remotes/mst/tags/for_upstream: (28 commits)
  acpi: update expected files for memory unplug
  virtio-scsi: Move DEFINE_VIRTIO_SCSI_FEATURES to virtio-scsi
  virtio-net: Move DEFINE_VIRTIO_NET_FEATURES to virtio-net
  pci: Merge pci_nic_init() into pci_nic_init_nofail()
  acpi: add a missing backslash to the \_SB scope.
  qmp-event: add event notification for memory hot unplug error
  acpi: add hardware implementation for memory hot unplug
  acpi: fix "Memory device control fields" register
  acpi: extend aml_field() to support UpdateRule
  acpi, mem-hotplug: add unplug cb for memory device
  acpi, mem-hotplug: add unplug request cb for memory device
  acpi, mem-hotplug: add acpi_memory_slot_status() to get MemStatus
  docs: update documentation for memory hot unplug
  virtio: coding style tweak
  pci: remove hard-coded bar size in msix_init_exclusive_bar()
  virtio-pci: speedup MSI-X masking and unmasking
  virtio: introduce vector to virtqueues mapping
  virtio-ccw: using VIRTIO_NO_VECTOR instead of 0 for invalid virtqueue
  monitor: check return value of qemu_find_net_clients_except()
  monitor: replace the magic number 255 with MAX_QUEUE_NUM
  ...

Conflicts:
	hw/s390x/s390-virtio-bus.c

[PMM: fixed conflict in s390_virtio_scsi_properties and
s390_virtio_net_properties arrays; since the result of the
two conflicting patches is to empty the property arrays
completely, the conflict resolution is to remove them entirely.]
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

TriCore bugfixes

# gpg: Signature made Mon May 11 13:26:40 2015 BST using RSA key ID 6B69CA14
# gpg: Good signature from "Bastian Koppelmann <kbastian@mail.uni-paderborn.de>"

* remotes/bkoppelmann/tags/pull-tricore-20150511:
  target-tricore: fix rfe not restoring the PC
  target-tricore: fix rslcx restoring the upper context instead of the lower
  target-tricore: fix BO_OFF10_SEXT calculating the wrong offset
  target-tricore: fix SLR_LD_W and SLR_LD_W_POSTINC insn being a 2 byte memory access insted of 4
  target-tricore: Fix LOOP using wrong register for compare
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Signed-off-by: NDavid Ahern <dsahern@gmail.com>
Signed-off-by: NScott Feldman <sfeldma@gmail.com>
Signed-off-by: NJiri Pirko <jiri@resnulli.us>
Message-id: 1426306173-24884-10-git-send-email-sfeldma@gmail.com
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>

Signed-off-by: NScott Feldman <sfeldma@gmail.com>
Signed-off-by: NJiri Pirko <jiri@resnulli.us>
Message-id: 1426306173-24884-9-git-send-email-sfeldma@gmail.com
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>

Add some basic test for rocker to test L2/L3/L4 functionality.  Requires an
external test environment, simp, located here:

https://github.com/scottfeldman/simp

To run tests, simp environment must be installed and a suitable VM image built
and installed with a Linux 3.18 (or greater) kernel with rocker driver support
enabled.
Signed-off-by: NScott Feldman <sfeldma@gmail.com>
Message-id: 1426306173-24884-8-git-send-email-sfeldma@gmail.com
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>

Rocker is a simulated ethernet switch device.  The device supports up to 62
front-panel ports and supports L2 switching and L3 routing functions, as well
as L2/L3/L4 ACLs.  The device presents a single PCI device for each switch,
with a memory-mapped register space for device driver access.

Rocker device is invoked with -device, for example a 4-port switch:

  -device rocker,name=sw1,len-ports=4,ports[0]=dev0,ports[1]=dev1, \
         ports[2]=dev2,ports[3]=dev3

Each port is a netdev and can be paired with using -netdev id=<port name>.
Signed-off-by: NScott Feldman <sfeldma@gmail.com>
Signed-off-by: NJiri Pirko <jiri@resnulli.us>
Acked-by: NScott Feldman <sfeldma@gmail.com>
Acked-by: NJiri Pirko <jiri@resnulli.us>
Signed-off-by: NDavid Ahern <dsahern@gmail.com>
Message-id: 1426306173-24884-7-git-send-email-sfeldma@gmail.com

rocker: fix clang compiler errors

Consolidate all forward typedef declarations to rocker.h.
Signed-off-by: NDavid Ahern <dsahern@gmail.com>
Acked-by: NScott Feldman <sfeldma@gmail.com>
Acked-by: NJiri Pirko <jiri@resnulli.us>

rocker: add support for flow modification

We had support for flow add/del.  This adds support for flow mod.  I needed
this for L3 support where an existing route is modified using NLM_F_REPLACE.
For example:

  ip route add 12.0.0.0/30 nexthop via 11.0.0.1 dev swp1
  ip route change 12.0.0.0/30 nexthop via 11.0.0.9 dev swp2

The first cmd adds the route.  The second cmd changes the existing route by
changing its nexthop info.

In the device, a mod operation results in the matching flow enty being modified
with the new settings.  This is atomic to the device.
Signed-off-by: NScott Feldman <sfeldma@gmail.com>
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>

Rocker is an ethernet switch device, so add 'other' network device class as
defined by PCI to cover these types of devices.
Signed-off-by: NScott Feldman <sfeldma@gmail.com>
Signed-off-by: NJiri Pirko <jiri@resnulli.us>
Message-id: 1426306173-24884-6-git-send-email-sfeldma@gmail.com
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>

Signed-off-by: NScott Feldman <sfeldma@gmail.com>
Signed-off-by: NJiri Pirko <jiri@resnulli.us>
Message-id: 1426306173-24884-5-git-send-email-sfeldma@gmail.com
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>

This is the register programming guide for the Rocker device.  It's intended
for driver writers and device writers.  It covers the device's PCI space,
the register set, DMA interface, and interrupts.
Signed-off-by: NScott Feldman <sfeldma@gmail.com>
Signed-off-by: NJiri Pirko <jiri@resnulli.us>
Message-id: 1426306173-24884-4-git-send-email-sfeldma@gmail.com
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>

Signed-off-by: NScott Feldman <sfeldma@gmail.com>
Reviewed-by: NEric Blake <eblake@redhat.com>
Message-id: 1426306173-24884-3-git-send-email-sfeldma@gmail.com
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>

We can use this in virtio-net code as well as new Rocker driver code, so
up-level this.
Signed-off-by: NScott Feldman <sfeldma@gmail.com>
Reviewed-by: NEric Blake <eblake@redhat.com>
Message-id: 1426306173-24884-2-git-send-email-sfeldma@gmail.com
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>

Add a verbose flag that shows the QMP command that was
constructed, to allow for later copy/pasting, reference,
debugging, etc.

The QMP is converted from a Python literal to JSON first,
to ensure that it is viable input to the actual QMP parser.

As a side-effect, this JSON output will helpfully show all
the necessary conversions that were performed on the input,
illustrating that "True" was transformed back into "true",
literal values are now escaped with "" instead of '', and so on.
Signed-off-by: NJohn Snow <jsnow@redhat.com>
Reviewed-by: NEric Blake <eblake@redhat.com>
Tested-by: NKashyap Chamarthy <kchamart@redhat.com>
Signed-off-by: NLuiz Capitulino <lcapitulino@redhat.com>

Add a special processing mode to craft transactions.

By entering "transaction(" the shell will enter a special
mode where each subsequent command will be saved as a transaction
instead of executed as an individual command.

The transaction can be submitted by entering ")" on a line by itself.

Examples:

Separate lines:

(QEMU) transaction(
TRANS> block-dirty-bitmap-add node=drive0 name=bitmap1
TRANS> block-dirty-bitmap-clear node=drive0 name=bitmap0
TRANS> )

With a transaction action included on the first line:

(QEMU) transaction( block-dirty-bitmap-add node=drive0 name=bitmap2
TRANS> block-dirty-bitmap-add node=drive0 name=bitmap3
TRANS> )

As a one-liner, with just one transaction action:

(QEMU) transaction( block-dirty-bitmap-add node=drive0 name=bitmap0 )

As a side-effect of this patch, blank lines are now parsed as no-ops,
regardless of which shell mode you are in.
Signed-off-by: NJohn Snow <jsnow@redhat.com>
Reviewed-by: NEric Blake <eblake@redhat.com>
Tested-by: NKashyap Chamarthy <kchamart@redhat.com>
Signed-off-by: NLuiz Capitulino <lcapitulino@redhat.com>

This includes support for [] expressions, single-quotes in
QMP expressions (which is not strictly a part of JSON), and
the ability to use "True", "False" and "None" literals instead
of JSON's equivalent true, false, and null literals.

qmp-shell currently allows you to describe values as
JSON expressions:
key={"key":{"key2":"val"}}

But it does not currently support arrays, which are needed
for serializing and deserializing transactions:
key=[{"type":"drive-backup","data":{...}}]

qmp-shell also only currently accepts doubly quoted strings
as-per JSON spec, but QMP allows single quotes.

Lastly, python allows you to utilize "True" or "False" as
boolean literals, but JSON expects "true" or "false". Expand
qmp-shell to allow the user to type either, converting to the
correct type.

As a consequence of the above, the key=val parsing is also improved
to give better error messages if a key=val token is not provided.

CAVEAT: The parser is still extremely rudimentary and does not
expect to find spaces in {} nor [] expressions. This patch does
not improve this functionality.
Signed-off-by: NJohn Snow <jsnow@redhat.com>
Reviewed-by: NEric Blake <eblake@redhat.com>
Tested-by: NKashyap Chamarthy <kchamart@redhat.com>
Signed-off-by: NLuiz Capitulino <lcapitulino@redhat.com>

Refactor the qmp-shell command line processing function
into two components. This will be used to allow sub-expressions,
which will assist us in adding transactional support to qmp-shell.
Signed-off-by: NJohn Snow <jsnow@redhat.com>
Reviewed-by: NEric Blake <eblake@redhat.com>
Tested-by: NKashyap Chamarthy <kchamart@redhat.com>
Signed-off-by: NLuiz Capitulino <lcapitulino@redhat.com>

Markus is taking over maintership of QMP and the QAPI from
me. Markus has always been a great reviewer and contributor
to those subsystems. In the last few months he's also doing
pull requests that are a lot more relevant than the ones I
was able to do. So, this is a natural move.

I'm still the maintainer of HMP and QObjects, but I'm
looking for someone to take over those too.

PS: This commit also fixes the file listing for the QMP
    entry.
Signed-off-by: NLuiz Capitulino <lcapitulino@redhat.com>
Reviewed-by: NMichael Roth <mdroth@linux.vnet.ibm.com>
Signed-off-by: NMarkus Armbruster <armbru@redhat.com>

We document that in QMP, the client may send any json-value
for the optional "id" key, and then return that same value
on reply (both success and failures, insofar as the failure
happened after parsing the id).  [Note that the output may
not be identical to the input, as whitespace may change and
since we may reorder keys within a json-object, but that this
still constitutes the same json-value].  However, we were not
handling the JSON literal null, which counts as a json-value
per RFC 7159.

Also, down the road, given the QAPI schema of {'*foo':'str'} or
{'*foo':'ComplexType'}, we could decide to allow the QMP client
to pass { "foo":null } instead of the current representation of
{ } where omitting the key is the only way to get at the default
NULL value.  Such a change might be useful for argument
introspection (if a type in older qemu lacks 'foo' altogether,
then an explicit "foo":null probe will force an easily
distinguished error message for whether the optional "foo" key
is even understood in newer qemu).  And if we add default values
to optional arguments, allowing an explicit null would be
required for getting a NULL value associated with an optional
string that has a non-null default.  But all that can come at a
later day.

The 'check-unit' testsuite is enhanced to test that parsing
produces the same object as explicitly requesting a reference
to the special qnull object.  In addition, I tested with:

$ ./x86_64-softmmu/qemu-system-x86_64 -qmp stdio -nodefaults
{"QMP": {"version": {"qemu": {"micro": 91, "minor": 2, "major": 2}, "package": ""}, "capabilities": []}}
{"execute":"qmp_capabilities","id":null}
{"return": {}, "id": null}
{"id":{"a":null,"b":[1,null]},"execute":"quit"}
{"return": {}, "id": {"a": null, "b": [1, null]}}
{"timestamp": {"seconds": 1427742379, "microseconds": 423128}, "event": "SHUTDOWN"}
Signed-off-by: NEric Blake <eblake@redhat.com>
Signed-off-by: NMarkus Armbruster <armbru@redhat.com>
Signed-off-by: NLuiz Capitulino <lcapitulino@redhat.com>