According the spec, the card works in network/host communication mode only when
both EEM1 and EEM0 are unset in 93C46 Command Register (normal op
mode). So this patch check these bits before trying to receive packets.

As some guest driver (such as linux, see cp_init_hw() in 8139cp.c)
allocate rx ring after the recevier were enabled, this would cause our
emulation codes tries to dma into guest memory when the rx descriptor
is not properly configured. This patch fixes this.
Signed-off-by: NJason Wang <jasowang@redhat.com>
Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>

According to the spec, only when opmode is "Config. Register Write
Enable" could driver write to CONFIG0,1,3,4 and bits 13,12,8 of BMCR.

Currently, we allow modifying to those registers also when 8139 is in
"Auto-load" mode and "93C46 (93C56) Programming" mode. This patch
fixes this.
Signed-off-by: NJason Wang <jasowang@redhat.com>
Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>

Reduce duplicated codes.
Signed-off-by: NJason Wang <jasowang@redhat.com>
Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>

Some drivers (such as win7) use byte read for TxStatus registers, so we need to
support this to let guest driver behave correctly.

For writing, only double-word access is allowed by spec.
Signed-off-by: NJason Wang <jasowang@redhat.com>
Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>

Signed-off-by: NJason Wang <jasowang@redhat.com>
Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>

The tx buffer would be re-allocated for tx descriptor with big size
and without LS bit set, this would make guest driver could easily let
qemu to allocate unlimited.

In linux host, a glib failure were easy to be triggered:

GLib-ERROR **: gmem.c:176: failed to allocate 18446744071562067968 bytes

This patch fix this by adding a limit. As the spec didn't tell the maximum size
of buffer allowed, stick it to current CP_TX_BUFFER_SIZE (65536).

Changes from V1:

Drop the while statement and s->cplus_txbuffer check.
Signed-off-by: NJason Wang <jasowang@redhat.com>
Reviewed-by: NStefan Hajnoczi <stefanha@linux.vnet.ibm.com>
Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>

Signed-off-by: NAnthony PERARD <anthony.perard@citrix.com>
Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>

Add DATA_VALID flag from the Linux header, to
keep us in sync with that.
Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>

Use pci_set_long for accesses.
Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>

commit 5caef97a16010f818ea8b950e2ee24ba876643ad introduced
a regression: we do not make IO base/limit upper 16
bit registers writeable, so we should report a 16 bit
IO range type, not a 32 bit one.
Note that PCI_PREF_RANGE_TYPE_32 is 0x0, but PCI_IO_RANGE_TYPE_32 is 0x1.

In particular, this broke sparc64.

Note: this just reverts to behaviour prior to the commit above.
Making PCI_IO_BASE_UPPER16 and PCI_IO_LIMIT_UPPER16
registers writeable should, and seems to, work just as well, but
as no system seems to actually be interested in 32 bit IO,
let's not make unnecessary changes.
Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>

Now that core sets memory type correctly,
remove this code from pcie port implementation.
Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>

As we make upper bits in IO and prefetcheable memory
registers writeable, we should declare support
for 64 bit prefetcheable memory and 32 bit io
in the bridge.

This changes the default for apb, dec, but I'm guessing
they got the defaults wrong by accident.
Alternatively, we could let bridges declare lack of
64 bit support and make the upper bits read-only zero.
Reported-by: NGerd Hoffmann <kraxel@redhat.com>
Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>

This adds support for a standard pci to pci bridge,
enabling support for more than 32 PCI devices in the system.
Device hotplug is supported by means of SHPC controller.
For guests with an SHPC driver, this allows robust hotplug
and even hotplug of nested bridges, up to 31 devices
per bridge.
Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>

This capability makes it possible for the guest to
report a unique chassis identifier to the user.

The spec also recommends making chassis indentifier
persist in eeprom.
This isn't implemented.
Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>

This adds support for SHPC interface, as defined by PCI Standard
Hot-Plug Controller and Subsystem Specification, Rev 1.0
http://www.pcisig.com/specifications/conventional/pci_hot_plug/SHPC_10

Only SHPC intergrated with a PCI-to-PCI bridge is supported,
SHPC integrated with a host bridge would need more work.

All main SHPC features are supported:
- MRL sensor
- Attention button
- Attention indicator
- Power indicator

Wake on hotplug and serr generation are stubbed out but unused
as we don't have interfaces to generate these events ATM.

One issue that isn't completely resolved is that qemu currently
expects an "eject" interface, which SHPC does not provide: it merely
removes the power to device and it's up to the user to remove the device
from slot. This patch works around that by ejecting the device
when power is removed and power LED goes off.
Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>

For a pci bridge device, if we don't override
the name with custom code, the bus will be addressed as
<id>.0, where id is the id specified by the user.

Since PCI Bridge devices have a single bus each, we don't need
the index: address the bus using the parent device name.
This is better since this way users don't care about
our internal bus/device distinctions.

As far as I could see, we only have built-in
bridges at this point which always override the
name. So this change will only affect ioh3420.c.
Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>

Make pci_find_bus static and rename to pci_find_bus_nr to match
functionality.
Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>

Make an internal function, pci_parse_devaddr,
static.
Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>

Value check in PCI Express Base Specification rev 1.1
Signed-off-by: NAnthony PERARD <anthony.perard@citrix.com>
Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>

Actually, pci_parse_devaddr checks if the dom/bus of the PCI address exist. But
this should be the jobs of a caller. In fact, the two callers of this function
will try to retrieve the PCIBus related to the devaddr and return an error if
they cannot.
Signed-off-by: NAnthony PERARD <anthony.perard@citrix.com>
Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>

Commit 9b9a970a
(target-lm32/microblaze: Typedef struct CPU{MB,LM32}State)
introduced necessary typedefs for cpu_mmu_index() and mmu.h
respectively.

On some GCC versions this leads to "error: redefinition of typedef".

Drop the original typedef to hopefully fix the build.
Signed-off-by: NAndreas Färber <afaerber@suse.de>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

* afaerber/qom-cpu.v5: (43 commits)
  qom: Introduce CPU class
  Rename CPUState -> CPUArchState
  xtensa hw/: Don't use CPUState
  sparc hw/: Don't use CPUState
  sh4 hw/: Don't use CPUState
  s390x hw/: Don't use CPUState
  ppc hw/: Don't use CPUState
  mips hw/: Don't use CPUState
  microblaze hw/: Don't use CPUState
  m68k hw/: Don't use CPUState
  lm32 hw/: Don't use CPUState
  i386 hw/: Don't use CPUState
  cris hw/: Don't use CPUState
  arm hw/: Don't use CPUState
  alpha hw/: Don't use CPUState
  xtensa-semi: Don't use CPUState
  m68k-semi: Don't use CPUState
  arm-semi: Don't use CPUState
  target-xtensa: Don't overuse CPUState
  target-unicore32: Don't overuse CPUState
  ...

This fixes memory reads and writes which exceeded the upper limit
of allocated memory vd->guest.ds->data and vd->server->data.

Cc: Anthony Liguori <aliguori@us.ibm.com>
Signed-off-by: NStefan Weil <weil@mail.berlios.de>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

The threaded VNC servers messed up with QEMU fd handlers without
any kind of locking, and that can cause some nasty race conditions.

Using qemu_mutex_lock_iothread() won't work because vnc_dpy_cpy(),
which will wait for the current job queue to finish, can be called with
the iothread lock held.

Instead, we now store the data in a temporary buffer, and use a bottom
half to notify the main thread that new data is available.

vnc_[un]lock_ouput() is still needed to access VncState members like
abort, csock or jobs_buffer.
Signed-off-by: NCorentin Chary <corentin.chary@gmail.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Reintroduce CPUState as QOM object: It's abstract and derived directly
from TYPE_OBJECT for compatibility with the user emulators.
The identifier CPUState avoids conflicts between CPU() and the struct.

Introduce $(qom-twice-y) to build it separately for system and for user
emulators.

Prepare a virtual reset method, (re)introduce cpu_reset() as wrapper.
Signed-off-by: NAndreas Färber <afaerber@suse.de>
Reviewed-by: NAnthony Liguori <aliguori@us.ibm.com>

Scripted conversion:
  for file in *.[hc] hw/*.[hc] hw/kvm/*.[hc] linux-user/*.[hc] linux-user/m68k/*.[hc] bsd-user/*.[hc] darwin-user/*.[hc] tcg/*/*.[hc] target-*/cpu.h; do
    sed -i "s/CPUState/CPUArchState/g" $file
  done

All occurrences of CPUArchState are expected to be replaced by QOM CPUState,
once all targets are QOM'ified and common fields have been extracted.
Signed-off-by: NAndreas Färber <afaerber@suse.de>
Reviewed-by: NAnthony Liguori <aliguori@us.ibm.com>

Scripted conversion:
  for file in hw/xtensa_*.[hc]; do
    sed -i "s/CPUState/CPUXtensaState/g" $file
  done
Signed-off-by: NAndreas Färber <afaerber@suse.de>
Acked-by: NAnthony Liguori <aliguori@us.ibm.com>

Scripted conversion:
  for file in hw/sun4m.c hw/sun4u.c hw/grlib.h hw/leon3.c; do
    sed -i "s/CPUState/CPUSPARCState/g" $file
  done
Signed-off-by: NAndreas Färber <afaerber@suse.de>
Acked-by: NAnthony Liguori <aliguori@us.ibm.com>

Scripted conversion:
  for file in hw/sh.h hw/shix.c hw/r2d.c; do
    sed -i "s/CPUState/CPUSH4State/g" $file
  done
Signed-off-by: NAndreas Färber <afaerber@suse.de>
Acked-by: NAnthony Liguori <aliguori@us.ibm.com>

Scripted conversion:
  for file in hw/s390-*.[hc]; do
    sed -i "s/CPUState/CPUS390XState/g" $file
  done
Signed-off-by: NAndreas Färber <afaerber@suse.de>
Acked-by: NAnthony Liguori <aliguori@us.ibm.com>

Scripted conversion:
  for file in hw/ppc*.[hc] hw/mpc8544_guts.c hw/spapr*.[hc] hw/virtex_ml507.c hw/xics.c; do
    sed -i "s/CPUState/CPUPPCState/g" $file
  done
Signed-off-by: NAndreas Färber <afaerber@suse.de>
Acked-by: NAnthony Liguori <aliguori@us.ibm.com>

Scripted conversion:
  for file in hw/mips_*.[hc]; do
    sed -i "s/CPUState/CPUMIPSState/g" $file
  done
Signed-off-by: NAndreas Färber <afaerber@suse.de>
Acked-by: NAnthony Liguori <aliguori@us.ibm.com>

Scripted conversion:
  for file in hw/microblaze_*.[hc] hw/petalogix_ml605_mmu.c hw/petalogix_s3adsp1800_mmu.c; do
    sed -i "s/CPUState/CPUMBState/g" $file
  done
Signed-off-by: NAndreas Färber <afaerber@suse.de>
Acked-by: NAnthony Liguori <aliguori@us.ibm.com>

Scripted conversion:
  for file in hw/an5206.c hw/dummy_m68k.c hw/mcf.h hw/mcf5206.c hw/mcf5208.c hw/mcf_intc.c; do
    sed -i "s/CPUState/CPUM68KState/g" $file
  done
Signed-off-by: NAndreas Färber <afaerber@suse.de>
Acked-by: NAnthony Liguori <aliguori@us.ibm.com>

Scripted conversion:
  for file in hw/lm32_boards.c hw/milkymist.c; do
    sed -i "s/CPUState/CPULM32State/g" $file
  done
Signed-off-by: NAndreas Färber <afaerber@suse.de>
Acked-by: NAnthony Liguori <aliguori@us.ibm.com>

Scripted conversion:
  for file in hw/apic.h hw/kvm/apic.c hw/kvmvapic.c hw/pc.c hw/vmport.c hw/xen_machine_pv.c; do
    sed -i "s/CPUState/CPUX86State/g" $file
  done
Signed-off-by: NAndreas Färber <afaerber@suse.de>
Acked-by: NAnthony Liguori <aliguori@us.ibm.com>

Scripted conversion:
  for file in hw/cris-boot.[hc] hw/cris_pic_cpu.c hw/axis_dev88.c hw/etraxfs.h hw/etraxfs_ser.c; do
    sed -i "s/CPUState/CPUCRISState/g" $file
  done
Signed-off-by: NAndreas Färber <afaerber@suse.de>
Acked-by: NAnthony Liguori <aliguori@us.ibm.com>

Scripted conversion:
  for file in hw/arm-misc.h hw/arm_boot.c hw/arm_pic.c hw/armv7m.c hw/exynos4210.h hw/highbank.c hw/integratorcp.c hw/musicpal.c hw/omap.h hw/pxa.h hw/pxa2xx_gpio.c hw/pxa2xx_pic.c hw/realview.c hw/strongarm.h hw/versatilepb.c hw/vexpress.c  hw/xilinx_zynq.c ; do
    sed -i "s/CPUState/CPUARMState/g" $file
  done
Signed-off-by: NAndreas Färber <afaerber@suse.de>
Acked-by: NAnthony Liguori <aliguori@us.ibm.com>

Scripted conversion:
  for file in hw/alpha_*.[hc]; do
    sed -i "s/CPUState/CPUAlphaState/g" $file
  done
Signed-off-by: NAndreas Färber <afaerber@suse.de>
Acked-by: NAnthony Liguori <aliguori@us.ibm.com>