Commit Graph

6532 Commits

Author SHA1 Message Date
Anthony Liguori 3dde52d2fe qdev: add class_init to DeviceInfo
Since we are still dynamically creating TypeInfo, we need to chain the
class_init function in order to be able to make use of it within subclasses of
TYPE_DEVICE.

This will disappear once we register TypeInfos directly.

Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2012-01-27 10:50:46 -06:00
Anthony Liguori 3cc90eb2b7 qdev: add a interface to register subclasses
In order to introduce inheritance while still using the qdev registration
interfaces, we need to be able to use a parent other than TYPE_DEVICE.  Add a
new interface that allows this.

Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2012-01-27 10:50:46 -06:00
Anthony Liguori 94afdadcb3 qdev: use a wrapper to access reset and promote reset to a class method
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2012-01-27 10:50:46 -06:00
Anthony Liguori f79f2bfc6a qdev: don't access name through info
We already have a QOM interface for this so let's use it.

Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2012-01-27 10:50:39 -06:00
Anthony Liguori 30fbb9fc7c qdev: move qdev->info to class
Right now, DeviceInfo acts as the class for qdev.  In order to switch to a
proper ObjectClass derivative, we need to ween all of the callers off of
interacting directly with the info pointer.

Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2012-01-27 10:50:34 -06:00
Anthony Liguori 32fea4025b qdev: integrate with QEMU Object Model (v2)
This is a very shallow integration.  We register a TYPE_DEVICE but only use
QOM as basically a memory allocator.  This will make all devices show up as
QOM objects but they will all carry the TYPE_DEVICE.

Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
---
v1 -> v2
 - update for new location of object.h
2012-01-27 10:28:30 -06:00
Anthony Liguori 6fc4925bf6 pci: call reset unconditionally
Because now all PCI devices are converted to qdev.

Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2012-01-27 10:28:30 -06:00
Anthony Liguori 8a5faa1d3e openpic: remove dead code to make a PCI device version
bus is always NULL so the code in this if clause is dead (and therefore
untested).

Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2012-01-27 10:28:30 -06:00
Anthony Liguori d8c51b052b macio: convert to qdev
This is a "shallow", half hearted, and untested conversion.

Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2012-01-27 10:28:30 -06:00
Anthony Liguori 31841e463f Merge remote-tracking branch 'pmaydell/arm-devs.for-upstream' into staging
* pmaydell/arm-devs.for-upstream:
  arm: SoC model for Calxeda Highbank
  arm_boot: support board IDs more than 16 bits wide
  arm: add secondary cpu boot callbacks to arm_boot.c
  ahci: add support for non-PCI based controllers
  Add xgmac ethernet model
2012-01-27 09:00:03 -06:00
Anthony Liguori 21fe5bc678 Merge remote-tracking branch 'kwolf/for-anthony' into staging
* kwolf/for-anthony: (22 commits)
  scsi: Guard against buflen exceeding req->cmd.xfer in scsi_disk_emulate_command
  qcow: Use bdrv functions to replace file operation
  qcow: Return real error code in qcow_open
  block/vdi: Zero unused parts when allocating a new block (fix #919242)
  virtio-blk: add virtio_blk_handle_read trace event
  docs: describe live block operations
  block: add support for partial streaming
  add QERR_BASE_NOT_FOUND
  block: add bdrv_find_backing_image
  blockdev: make image streaming safe across hotplug
  qmp: add query-block-jobs
  qmp: add block_job_cancel command
  qmp: add block_job_set_speed command
  qmp: add block_stream command
  block: rate-limit streaming operations
  block: add image streaming block job
  block: add BlockJob interface for long-running operations
  block: make copy-on-read a per-request flag
  block: check bdrv_in_use() before blockdev operations
  coroutine: add co_sleep_ns() coroutine sleep function
  ...
2012-01-27 08:58:52 -06:00
Jan Kiszka 9f2a8d7ae8 pcnet: Preserve link state across device reset
A device reset does not affect the link state, only set_link does.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
2012-01-27 06:21:01 +00:00
Jan Kiszka b1927cf1ae e1000: Preserve link state across device reset
A device reset does not affect the link state, only set_link does.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
2012-01-27 06:20:37 +00:00
Jan Kiszka c455d17c09 qdev-property: Make bit property parsing stricter
By using strncasecmp, we allow for arbitrary characters after the
"on"/"off" string. Fix this by switching to strcasecmp.

Reviewed-by: Andreas Färber <afaerber@suse.de>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
2012-01-27 05:50:16 +00:00
Thomas Higdon e2f0c49ffa scsi: Guard against buflen exceeding req->cmd.xfer in scsi_disk_emulate_command
Limit the return value (corresponding to the length of the buffer to be
DMAed back to the intiator) to the value in req->cmd.xfer, which is the
amount of data that the initiator expects. Eliminate now-duplicate code
that does this guarding in the functions for individual commands.

Without this, the SCRIPTS code in the emulated LSI device eventually
raises a DMA interrupt for a data overrun when an INQUIRY command whose
buflen exceeds req->cmd.xfer is processed. It's the responsibility of
the client to provide a request buffer and allocation length that are
large enough for the result of the command.

Signed-off-by: Thomas Higdon <thigdon@akamai.com>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2012-01-26 14:49:18 +01:00
Stefan Hajnoczi 81b6b9faef virtio-blk: add virtio_blk_handle_read trace event
There already exists a virtio_blk_handle_write trace event as well as
completion events.  Add the virtio_blk_handle_read event so it's easy to
trace virtio-blk requests for both read and write operations.

Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2012-01-26 14:49:18 +01:00
Rob Herring 2488514cef arm: SoC model for Calxeda Highbank
Adds support for Calxeda's Highbank SoC.

Signed-off-by: Rob Herring <rob.herring@calxeda.com>
Signed-off-by: Mark Langsdorf <mark.langsdorf@calxeda.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2012-01-26 11:49:09 +00:00
Peter Maydell f8414cb5c8 arm_boot: support board IDs more than 16 bits wide
Support passing a board ID value to the kernel in r1
that is more than 16 bits wide. This is needed to pass
the '-1 == invalid' value for boards which only support
device tree booting.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Tested-by: Mark Langsdorf <mark.langsdorf@calxeda.com>
2012-01-26 11:49:09 +00:00
Mark Langsdorf 9d5ba9bfbc arm: add secondary cpu boot callbacks to arm_boot.c
Create two functions, write_secondary_boot() and secondary_cpu_reset_hook(),
to allow platforms more control of how secondary CPUs are brought up. The
new functions default to NULL and aren't called unless they are populated
so there are no changes to existing platform models.

Signed-off-by: Mark Langsdorf <mark.langsdorf@calxeda.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2012-01-26 11:43:48 +00:00
Rob Herring d9fa31a3e2 ahci: add support for non-PCI based controllers
Add support for ahci on sysbus.

Signed-off-by: Rob Herring <rob.herring@calxeda.com>
Signed-off-by: Mark Langsdorf <mark.langsdorf@calxeda.com>
Reviewed-by: Andreas Färber <afaerber@suse.de>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2012-01-26 11:43:47 +00:00
Rob Herring 4c0e167c9d Add xgmac ethernet model
This adds very basic support for the xgmac ethernet core. Missing things
include:

- statistics counters
- WoL support
- rx checksum offload
- chained descriptors (only linear descriptor ring)
- broadcast and multicast handling

Signed-off-by: Rob Herring <rob.herring@calxeda.com>
Signed-off-by: Mark Langsdorf <mark.langsdorf@calxeda.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2012-01-26 11:43:47 +00:00
Blue Swirl 331636431a vga: compile cirrus_vga in hwlib
Remove target dependencies and compile Cirrus VGA in hwlib.

Address masking can be removed since memory API handles that now.

Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
2012-01-25 18:32:59 +00:00
Blue Swirl fd4aa97903 memory: change dirty setting APIs to take a size
Instead of each target knowing or guessing the guest page size,
just pass the desired size of dirtied memory area.

Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
2012-01-25 18:32:47 +00:00
Anthony Liguori 5b4448d27d Merge remote-tracking branch 'qemu-kvm/uq/master' into staging
* qemu-kvm/uq/master:
  kvm: Activate in-kernel irqchip support
  kvm: x86: Add user space part for in-kernel IOAPIC
  kvm: x86: Add user space part for in-kernel i8259
  kvm: x86: Add user space part for in-kernel APIC
  kvm: x86: Establish IRQ0 override control
  kvm: Introduce core services for in-kernel irqchip support
  memory: Introduce memory_region_init_reservation
  ioapic: Factor out base class for KVM reuse
  ioapic: Drop post-load irr initialization
  i8259: Factor out base class for KVM reuse
  i8259: Completely privatize PicState
  apic: Open-code timer save/restore
  apic: Factor out base class for KVM reuse
  apic: Introduce apic_report_irq_delivered
  apic: Inject external NMI events via LINT1
  apic: Stop timer on reset
  kvm: Move kvmclock into hw/kvm folder
  msi: Generalize msix_supported to msi_supported
  hyper-v: initialize Hyper-V CPUID leaves.
  hyper-v: introduce Hyper-V support infrastructure.

Conflicts:
	Makefile.target

Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2012-01-23 11:00:26 -06:00
Anthony Liguori c4ccbeaca5 Merge remote-tracking branch 'afaerber/prep-up' into staging
* afaerber/prep-up:
  prep: Use i82378 PCI->ISA bridge for 'prep' machine
  prep: Add i82378 PCI-to-ISA bridge emulation
  prep: Add i82374 DMA emulation
  MAINTAINERS: Add PCI host bridge files to PReP machine
  prep: qdev'ify Raven host bridge (SysBus)
  prep_pci: Update I/O to MemoryRegion ops
  prep_pci: Simplify I/O endianness
  prep: qdev'ify Raven host bridge (PCIDevice)
  prep: Use ISA m48t59
  prep: Fix offset of BIOS MemoryRegion
2012-01-23 10:58:02 -06:00
Anthony Liguori 65f82df0d7 e1000: bounds packet size against buffer size
Otherwise we can write beyond the buffer and corrupt memory.  This is tracked
as CVE-2012-0029.

Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2012-01-23 07:30:43 -06:00
Blue Swirl 6618f9095c sga: fix copypasta
Fix the name of the init function.

Reviewed-by: Andreas Färber <afaerber@suse.de>
Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
2012-01-22 07:29:16 +00:00
Blue Swirl 3d402831de vga: make Cirrus ISA device optional
Reviewed-by: Jan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
2012-01-22 07:28:23 +00:00
Blue Swirl a369da5f31 vga: improve VGA logic
Improve VGA selection logic, push check for device availabilty to vl.c.
Create the devices at board level unconditionally.

Remove now unused pci_try_create*() functions.

Make PCI VGA devices optional.

Reviewed-by: Jan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
2012-01-22 07:27:06 +00:00
Andreas Färber 0ae4699694 grackle_pci: Clean up qdev names
Rename SysBus device from 'grackle' to 'grackle-pcihost' to resolve a
name conflict.

Also mark both devices as no_user.

Signed-off-by: Andreas Färber <afaerber@suse.de>
Cc: Alexander Graf <agraf@suse.de>
Cc: Anthony Liguori <aliguori@us.ibm.com>
Signed-off-by: Alexander Graf <agraf@suse.de>
2012-01-21 05:17:04 +01:00
Alexander Graf 88045ac555 PPC: Pseries: Check for PCI boundaries
We call pci_host_config_{read,write}_common() which perform PCI config
accesses. However they don't do all limit checking the way we expect
it to.

So let's introduce a small wrapper around them, making them behave the
way we would without touching generic code.

This patch is based on a patch by David Gibson which put this logic into
the generic code.

Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Alexander Graf <agraf@suse.de>
2012-01-21 05:17:02 +01:00
Benjamin Herrenschmidt 4d8d5467cd pseries: SLOF PCI flag day
Currently on the pseries machine the SLOF firmware is used normally,
but we bypass it when -kernel is specified.  Having these two

different boot paths can cause some confusion.

In particular at present we need to "probe" the (emulated) PCI bus and
produce device tree nodes for the PCI devices in qemu, for the -kernel
case.  In the SLOF case, it takes the device tree from qemu adds some
stuff to it then passes it on to the kernel.

It's been decided that a better approach is to always boot through
SLOF, even when using -kernel.  WIth this approach we can leave PCI
probing and device node creation to SLOF in all cases which removes a
bunch of code in qemu, and avoids iterating the PCI devices from the
machine specific init code which we're not supposed to do.

This patch changes qemu to always boot through SLOF, and not to create
PCI nodes.  Simultaneously it updates the included version of SLOF
(submodule and binary image) to one which supports (and requires) the
new approach.

The new SLOF version also includes a number of unrelated enhancements:
support for booting from virtio-pci devices and e1000, greatly
improved FCode support and many bugfixes.  It also makes SLOF ready to
be used even when specifying a kernel on the qemu command line.

Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Alexander Graf <agraf@suse.de>
2012-01-21 05:17:02 +01:00
David Gibson c9c3c80af7 pseries: Use correct dispatcher for PCI config space accesses
The pseries machine expects a para-virtualized guest and so supplies RTAS
functions (via a hypercall) for performing PCI config space access.
Currently the implementation of these calls into
pci_default_{read,write}_config().  However this would be incorrect for
any PCI device which overrides the default config read/write functions.
AFAICT there's only one such device today, but we should still get it
right.  In addition the pci_host_config_{read,write}_common() functions
which do correctly do this dispatch, perform bounds checking on the config
space address, lack of which currently leads to an exploitable bug.

This patch corrects the problem.

Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Alexander Graf <agraf@suse.de>
2012-01-21 05:17:02 +01:00
Benjamin Herrenschmidt 3f7565c957 pseries: Support PCI extended config space in RTAS calls
On the pseries machine (which expexts a paravirtualized guest), guest
access to PCI config space is via host-provided RTAS functions.  This
patch extends these RTAS functions to permit access to PCI extended
config space, as specified in PAPR.

Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Alexander Graf <agraf@suse.de>
2012-01-21 05:17:02 +01:00
David Gibson 964455f39e Correct types in bmdma_addr_{read,write}
Back when I made patches introducing dma_addr_t and various PCI DMA
wrapper functions, I made a mistake.  The bmdma_addr_{read,write} functions
need to take target_phys_addr_t not dma_addr_t, since they are assigned
to MemoryRegionOps callbacks.

This patch corrects my error.

Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Alexander Graf <agraf@suse.de>
2012-01-21 05:17:01 +01:00
Benjamin Herrenschmidt 17df768c1e load_image_targphys() should enforce the max size
load_image_targphys() gets passed a max size for the file, but doesn't
enforce it at all. Add a check and return -1 (error) if the file is
too big, without loading it.  Fix the bracing style in the function
while we're at it.

Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Alexander Graf <agraf@suse.de>
2012-01-21 05:17:01 +01:00
Alexander Graf 06dbfc6f88 virtio: change memcpy to guest reads
When accessing the device specific virtio config space, we memcpy
the data into a variable in QEMU. At that point we're basically
pulling host endianness into the game which is a really bad idea.

So instead, let's use the target specific load/store helpers for
memory pointers which fetch things in target endianness. The whole
array is already populated in target endianness anyways
(see virtio-blk).

Signed-off-by: Alexander Graf <agraf@suse.de>
Reviewed-by: Anthony Liguori <aliguori@us.ibm.com>
2012-01-21 05:17:01 +01:00
Benjamin Herrenschmidt 82afa58641 virtio-pci: Fix endianness of virtio config
The virtio config area in PIO space is a bit special. The initial
header is little endian but the rest (device specific) is guest
native endian.

The PIO accessors for PCI on machines that don't have native IO ports
assume that all PIO is little endian, which works fine for everything
except the above.

A complicated way to fix it would be to split the BAR into two memory
regions with different endianess settings, but this isn't practical
to do, besides, the PIO code doesn't honor region endianness anyway
(I have a patch for that too but it isn't necessary at this stage).

So I decided to go for the quick fix instead which consists of
reverting the swap in virtio-pci in selected places, hoping that when
we eventually do a "v2" of the virtio protocols, we sort that out once
and for all using a fixed endian setting for everything.

Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Alexander Graf <agraf@suse.de>
[agraf: keep virtio in libhw and determine endianness through a
        helper function in exec.c]
Reviewed-by: Anthony Liguori <aliguori@us.ibm.com>
2012-01-21 05:17:01 +01:00
Alexander Graf 34ba1dc873 PPC: Bamboo: Integrate SoC instatiation, use qdev for PCI
Now that we have the SoC init function in the same file, let's integrate
it with the board initialization.

While at it, also make use of the newly qdev'ified PCI host controller.

Signed-off-by: Alexander Graf <agraf@suse.de>
2012-01-21 05:17:01 +01:00
Alexander Graf 3960b04d62 PPC: Bamboo: fold ppc440.c and ppc440_bamboo.c into a single file
The separation of ppc440 and ppc440_bamboo makes some sense, since ppc440
is the SoC while ppc440_bamboo is the actual board. But the separation
makes things harder for us for no good reason, so let's just fold them
in together with each other.

Signed-off-by: Alexander Graf <agraf@suse.de>
2012-01-21 05:17:01 +01:00
Alexander Graf 623f7c2172 PPC: 4xx: Qdevify the 440 PCI host controller
Due to popular demand, this qdevifies the PCI host controller of 4xx SoCs
the same way as e500.

We have to introduce a small stub function for pci init that will be
removed in a later patch, once we qdev'ified the board, to keep the build
working.

Signed-off-by: Alexander Graf <agraf@suse.de>
2012-01-21 05:17:01 +01:00
Alexander Graf acd1bf9083 PPC: bamboo: fix whitespace
Tabs followed by spaces are a no-go. My editor shows it red, distracting
me from actual work! :)

Signed-off-by: Alexander Graf <agraf@suse.de>
2012-01-21 05:17:00 +01:00
Alexander Graf d3c4548b8e PPC: bamboo: remove old machine descriptions
Nobody needs to run bamboo in 0.12 compat mode. Remove the machine.

Signed-off-by: Alexander Graf <agraf@suse.de>
2012-01-21 05:17:00 +01:00
Alexander Graf e5ba83c53a PPC: 440: Default to 440EP CPU
Today we're exposing a Virtex 440 CPU to the guest despite the fact
that we're telling the guest that we're running on a 440EP one in the
device tree.

So let's better default to a real 440EP to make things synced again.

Signed-off-by: Alexander Graf <agraf@suse.de>
2012-01-21 05:17:00 +01:00
Alexander Graf d49bc1fb3e PPC: 440: Ignore invalid PCI IRQs
When running a 440 target, we currently get invalid irq_num values (-1)
which completely confuse the IRQ setting code.

This is most likely due to the missing qdev conversion.

While this shouldn't happen in the first place and should really rather
be fixed by converting the target, I dislike segfaults. So for now, let's
just print a warning and ignore invalid irq_num values.

Signed-off-by: Alexander Graf <agraf@suse.de>
2012-01-21 05:17:00 +01:00
Alexander Graf 72718e9a4a PPC: Bamboo: Set initial TLB entry
Back in the day when the bamboo target got introduced, the initial TLB was
dictated by KVM. TCG has been missing initial TLB values ever since, rendering
the target unusable for TCG usage.

This patch adds linear TLB maps the way Linux expects them, making the target
work.

Signed-off-by: Alexander Graf <agraf@suse.de>
2012-01-21 05:17:00 +01:00
Alexander Graf b10a04b5ae PPC: Bamboo: Register CPU reset
To be able to support CPU reset, we need to put all register initialization
and initial state into a CPU reset hook instead of a function that is only
called once on bootup.

This is a preparation step for the initial TLB setting code and brings bamboo
more in line with what e500 and virtex already do.

Signed-off-by: Alexander Graf <agraf@suse.de>
2012-01-21 05:16:59 +01:00
Alexander Graf d29d3404fc PPC: 440EP: Initialize timer
When using TCG with a BookE PowerPC core, we need to explicitly initialize
the BookE timers with the correct frequencies.

This was missing for 440EP, since that code came from KVM and was never used
with TCG.

Signed-off-by: Alexander Graf <agraf@suse.de>
2012-01-21 05:16:59 +01:00
Andreas Färber 506b7ddf88 prep: Use i82378 PCI->ISA bridge for 'prep' machine
Speaker I/O, ISA bus, i8259 PIC, RTC and DMA are no longer set up
individually by the machine. Effectively, no-op speaker I/O is replaced
by pcspk; PIT and i82374 DMA are introduced.

Signed-off-by: Hervé Poussineau <hpoussin@reactos.org>

Remove related dead, alternative code.
Wire up PCI host bridge IRQs via GPIO-in IRQs of PCI->ISA bridge.

Signed-off-by: Andreas Färber <andreas.faerber@web.de>
Cc: Alexander Graf <agraf@suse.de>
Cc: Jan Kiszka <jan.kiszka@siemens.com>
2012-01-20 00:27:13 +01:00
Andreas Färber a04ff94097 prep: Add i82378 PCI-to-ISA bridge emulation
Prepare Intel 82378 emulation for use by PReP platforms.

Signed-off-by: Hervé Poussineau <hpoussin@reactos.org>

Create ISA bus in this device (suggested by Markus).
Rebase onto Memory API, mark memory ops as Little Endian.
Add VMState. Provide access to i8259 IRQs via qdev GPIOs.

Signed-off-by: Andreas Färber <andreas.faerber@web.de>
Cc: Markus Armbruster <armbru@redhat.com>
Cc: Alexander Graf <agraf@suse.de>
Cc: Jan Kiszka <jan.kiszka@siemens.com>
2012-01-20 00:27:12 +01:00
Andreas Färber 23b96cdb15 prep: Add i82374 DMA emulation
Prepare Intel 82374 emulation for use by Intel 82378 PCI->ISA bridge.

Signed-off-by: Hervé Poussineau <hpoussin@reactos.org>

Confine to CONFIG_I82374. Add VMState.

Signed-off-by: Andreas Färber <andreas.faerber@web.de>
Reviewed-by: Alexander Graf <agraf@suse.de>
2012-01-20 00:27:12 +01:00
Andreas Färber 8ca8c7bce0 prep: qdev'ify Raven host bridge (SysBus)
Drop pci_prep_init() in favor of extended device state. Inspired by
patches from Hervé and Alex.

Assign the 4 IRQs from the board after device instantiation. This moves
the knowledge out of prep_pci and allows for future machines with
different IRQ wiring (IBM 40P). Suggested by Alex.

Signed-off-by: Andreas Färber <andreas.faerber@web.de>
Reviewed-by: Alexander Graf <agraf@suse.de>
Cc: Hervé Poussineau <hpoussin@reactos.org>
Cc: Michael S. Tsirkin <mst@redhat.com>
Cc: Anthony Liguori <aliguori@us.ibm.com>
2012-01-20 00:27:12 +01:00
Andreas Färber 7e5610ff72 prep_pci: Update I/O to MemoryRegion ops
Convert to new-style read/write callbacks.

Signed-off-by: Andreas Färber <andreas.faerber@web.de>
Cc: Alexander Graf <agraf@suse.de>
Cc: Michael S. Tsirkin <mst@redhat.com>
Cc: Avi Kivity <avi@redhat.com>
Cc: Benoît Canet <benoit.canet@gmail.com>
2012-01-20 00:27:12 +01:00
Andreas Färber 9c95f183fb prep_pci: Simplify I/O endianness
The prep PowerPC CPU is Big Endian. An explicit byte swap therefore
effectively becomes Little Endian.

Remove explicit byte swaps and mark as Little Endian.

Signed-off-by: Andreas Färber <andreas.faerber@web.de>
Reviewed-by: Alexander Graf <agraf@suse.de>
Cc: Michael S. Tsirkin <mst@redhat.com>
2012-01-20 00:27:12 +01:00
Andreas Färber 555260540d prep: qdev'ify Raven host bridge (PCIDevice)
Move initialization of vendor ID, etc. to PCIDeviceInfo.
Introduce VMState.

Signed-off-by: Andreas Färber <andreas.faerber@web.de>
Reviewed-by: Alexander Graf <agraf@suse.de>
Cc: Hervé Poussineau <hpoussin@reactos.org>
Cc: Michael S. Tsirkin <mst@redhat.com>
Cc: Anthony Liguori <aliguori@us.ibm.com>
2012-01-20 00:27:12 +01:00
Andreas Färber 48e937283a prep: Use ISA m48t59
This simplifies the code later when the i8259 moves to the i82378
PCI->ISA bridge and happens to fix a SysBus m48t59 io_base issue
introduced by commit 0fb56ffc5e (m48t59:
drop obsolete address base arithmetic). Suggested by Hervé and Jan.

Signed-off-by: Andreas Färber <andreas.faerber@web.de>
Cc: Hervé Poussineau <hpoussin@reactos.org>
Cc: Jan Kiszka <jan.kiszka@siemens.com>
Cc: Blue Swirl <blauwirbel@gmail.com>
2012-01-20 00:27:12 +01:00
Andreas Färber 809680c017 prep: Fix offset of BIOS MemoryRegion
Since 0c90c52fab (ppc_prep: convert to memory
API) OHW was "Trying to execute code outside RAM or ROM at 0xfff00700".

The BIOS MemoryRegion is created with a fixed size of 1 MiB.
Ensure that the full size can be accessed since the exception
vectors are located at 0xfff00000 and the BIOS may want to use them.

It thereby no longer depends on the actual BIOS binary size.

Signed-off-by: Andreas Färber <afaerber@suse.de>
Cc: Avi Kivity <avi@redhat.com>
Cc: Alexander Graf <agraf@suse.de>
2012-01-20 00:27:12 +01:00
Anthony Liguori 515689235c Merge remote-tracking branch 'spice/spice.v47' into staging
* spice/spice.v47:
  qxl: Slot sanity check in qxl_phys2virt() is off by one, fix
2012-01-19 12:51:02 -06:00
Anthony Liguori a75e6678fe Merge remote-tracking branch 'stefanha/trivial-patches' into staging
* stefanha/trivial-patches:
  Makefile: Remove generated headers on clean
  Makefile: Exclude tests/Makefile in unconfigured tree
  lm32: Fix mixup of uint32 and uint32_t
  tests: Silence gtester in Makefile
  qemu-tool: Fix mixup of int64 and int64_t
2012-01-19 09:23:59 -06:00
Anthony Liguori 5414b32542 Merge remote-tracking branch 'pmaydell/arm-devs.for-upstream' into staging
* pmaydell/arm-devs.for-upstream:
  arm: make the number of GIC interrupts configurable
  hw/lan9118: Add save/load support
  arm: Remove incorrect comment in arm_timer
  vexpress, realview: Add (dummy) L2 cache controller
2012-01-19 09:19:44 -06:00
Anthony Liguori 9ca2140ab1 Merge remote-tracking branch 'kraxel/usb.37' into staging
* kraxel/usb.37:
  usb-redir: Improve some debugging messages
  usb-redir: Try to keep our buffer size near the target size
  usb-redir: Pre-fill our isoc input buffer before sending pkts to the host
  usb-redir: Dynamically adjust iso buffering size based on ep interval
  usb-redir: Clear iso / irq error when stopping the stream
  usb: link packets to endpoints not devices
  usb: add max_packet_size to USBEndpoint
  usb/debug: add usb_ep_dump
  usb-desc: USBEndpoint support
  usb: add ifnum to USBEndpoint
  usb: add USBEndpoint
  xhci: Initial xHCI implementation
  usb: add audio device model
  usb-desc: audio endpoint support
  usb: track altsetting in USBDevice
  usb: track configuration and interface count in USBDevice.
  usb-host: rip out legacy procfs support
2012-01-19 08:34:38 -06:00
Jan Kiszka a39c1d47ac kvm: x86: Add user space part for in-kernel IOAPIC
This introduces the KVM-accelerated IOAPIC model 'kvm-ioapic' and
extends the IRQ routing setup by the 0->2 redirection when needed.

The kvm-ioapic model has a property that allows to define its GSI base
for injecting interrupts into the kernel model. This will allow to
disentangle PIC and IOAPIC pins for chipsets that support more
sophisticated IRQ routes than the PIIX3. So far the base is kept at 0,
i.e. PIC and IOAPIC share pins 0..15.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
2012-01-19 12:14:42 +01:00
Jan Kiszka 10b6188275 kvm: x86: Add user space part for in-kernel i8259
Introduce the alternative 'kvm-i8259' device model that exploits KVM
in-kernel acceleration.

The PIIX3 initialization code is furthermore extended by KVM specific
IRQ route setup. GSI injection differs in KVM mode from the user space
model. As we can dispatch ISA-range IRQs to both IOAPIC and PIC inside
the kernel, we do not need to inject them separately. This is reflected
by a KVM-specific GSI handler.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
2012-01-19 12:14:42 +01:00
Jan Kiszka 680c1c6fd7 kvm: x86: Add user space part for in-kernel APIC
This introduces the alternative APIC device which makes use of KVM's
in-kernel device model. External NMI injection via LINT1 is emulated by
checking the current state of the in-kernel APIC, only injecting a NMI
into the VCPU if LINT1 is unmasked and configured to DM_NMI.

MSI is not yet supported, so we disable this when the in-kernel model is
in use.

CC: Lai Jiangshan <laijs@cn.fujitsu.com>
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
2012-01-19 12:14:42 +01:00
Jan Kiszka 9b5b76d449 kvm: x86: Establish IRQ0 override control
KVM is forced to disable the IRQ0 override when we run with in-kernel
irqchip but without IRQ routing support of the kernel. Set the fwcfg
value correspondingly. This aligns us with qemu-kvm.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
2012-01-19 12:14:42 +01:00
Jan Kiszka 244ac3af23 ioapic: Factor out base class for KVM reuse
Split up the IOAPIC analogously to APIC and i8259. KVM will share the
IOAPICCommonState, the vmstate, reset logic and certain init parts with
the user space model.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
2012-01-19 12:14:41 +01:00
Jan Kiszka ac791b8814 ioapic: Drop post-load irr initialization
As all devices undergo a reset prior to vmloa, and the reset value of
irr is 0, we do not need to do this clearing for older vmstates
explicitly. Dropping this redundant code will also make KVM integration
a bit simpler.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
2012-01-19 12:14:41 +01:00
Jan Kiszka 512709f559 i8259: Factor out base class for KVM reuse
Analogously to the APIC, we will reuse some parts of the user space
i8259 model for KVM. The base class provides a common device state, the
vmstate, the property list, a reset core and some shared init bits.

This also introduces a common helper to instantiate a single i8259 chip
from the cascade-creating i8259_init function.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
2012-01-19 12:14:40 +01:00
Jan Kiszka 9aa78c425f i8259: Completely privatize PicState
Use DeviceState instead of PicState in the public i8259 API. This is
cleaner and allows to reorganize the PIC data structures for KVM reuse.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
2012-01-19 12:14:40 +01:00
Jan Kiszka 7a380ca350 apic: Open-code timer save/restore
To enable migration between accelerated and non-accelerated APIC models,
we will need to handle the timer saving and restoring specially and can
no longer rely on the automatics of VMSTATE_TIMER. Specifically,
accelerated model will not start any QEMUTimer.

This patch therefore factors out the generic bits into apic_next_timer
and use a post-load callback to implemented model-specific logic.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
2012-01-19 12:14:40 +01:00
Jan Kiszka dae0168528 apic: Factor out base class for KVM reuse
The KVM in-kernel APIC model will reuse parts of the user space model
while providing the same frontend view to guest and most management
interfaces.

Factor out an APIC base class to encapsulate those parts that will be
shared by user space and KVM model. This class offers callback hooks for
init, base/tpr setting, and the external NMI delivery that will be
set via APICCommonInfo structure and implemented specifically in the
subclasses.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
2012-01-19 12:14:40 +01:00
Jan Kiszka 343270ea87 apic: Introduce apic_report_irq_delivered
The in-kernel i8259 and IOAPIC backends for KVM will need this, so
encapsulate the shared bits.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
2012-01-19 12:14:40 +01:00
Jan Kiszka 02c091953c apic: Inject external NMI events via LINT1
On real hardware, NMI button events are injected via the LINT1 line of
the APICs. E.g. kdump expect this wiring and gets upset if the per-APIC
LINT1 mask is not respected, i.e. if NMIs are injected to VCPUs that
should not receive them. Change the APIC emulation code to reflect this.

Based on qemu-kvm patch by Lai Jiangshan.

CC: Lai Jiangshan <laijs@cn.fujitsu.com>
Reported-by: Kenji Kaneshige <kaneshige.kenji@jp.fujitsu.com>
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
2012-01-19 12:14:40 +01:00
Jan Kiszka ab388a9814 apic: Stop timer on reset
All LVTs are masked on reset, so the timer becomes ineffective. Letting
it tick nevertheless is harmless, but will at least create a spurious
trace event.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
2012-01-19 12:14:39 +01:00
Jan Kiszka 3b9a6ee50e kvm: Move kvmclock into hw/kvm folder
More KVM-specific devices will come, so let's start with moving the
kvmclock into a dedicated folder.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
2012-01-19 12:14:39 +01:00
Jan Kiszka 60ba3cc231 msi: Generalize msix_supported to msi_supported
Rename msix_supported to msi_supported and control MSI and MSI-X
activation this way. That was likely to original intention for this
flag, but MSI support came after MSI-X.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
2012-01-19 12:14:39 +01:00
Andreas Färber 0f3c3cc950 lm32: Fix mixup of uint32 and uint32_t
Commit d23948b15a (lm32: add Milkymist
VGAFB support) introduced a stray usage of the softfloat uint32 type.

Use uint32_t instead.

Signed-off-by: Andreas Färber <afaerber@suse.de>
Acked-by: Michael Walle <michael@walle.cc>
Cc: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
2012-01-19 08:16:41 +00:00
Markus Armbruster 6b7332eb40 qxl: Slot sanity check in qxl_phys2virt() is off by one, fix
Spotted by Coverity.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2012-01-17 16:30:57 +01:00
Mark Langsdorf a32134aad8 arm: make the number of GIC interrupts configurable
Increase the maximum number of GIC interrupts for a9mp and a11mp to 1020,
and create a configurable property for each defaulting to 96 and 64
(respectively) so that device modelers can set the value appropriately
for their SoC. Other ARM processors also set their maximum number of
used IRQs appropriately.

Set the maximum theoretical number of GIC interrupts to 1020 and
update the save/restore code to only use the appropriate number for
each SoC.

Signed-off-by: Mark Langsdorf <mark.langsdorf@calxeda.com>
Reviewed-by: Andreas Färber <afaerber@suse.de>
[Peter Maydell: fixed minor whitespace snafu]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2012-01-17 10:54:07 +00:00
Peter Maydell b09da0c335 hw/lan9118: Add save/load support
Implement save/load for the LAN9118.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Andreas Färber <afaerber@suse.de>
2012-01-17 10:54:07 +00:00
Mark Langsdorf 100cf55ff9 arm: Remove incorrect comment in arm_timer
The current comment says that the arm_timers are restricted to between
32 KHz and 1 MHz, but sp804 TRM does not specify those limits.

Signed-off-by: Mark Langsdorf <mark.langsdorf@calxeda.com>
Reviewed-by: Andreas Färber <afaerber@suse.de>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2012-01-17 10:54:07 +00:00
Peter Maydell 5a15758874 vexpress, realview: Add (dummy) L2 cache controller
Instantiate the L2 cache controller on the ARM devboards which have one,
since we have a dummy model of it now. Note that the only non-MP board
with an L2x0 is the PB1176, which we don't model.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2012-01-17 10:54:07 +00:00
Gerd Hoffmann 25d5de7d81 usb: link packets to endpoints not devices
Add USBEndpoint for the control endpoint to USBDevices.  Link async
packets to the USBEndpoint instead of the USBDevice.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2012-01-17 09:44:50 +01:00
Gerd Hoffmann f003397ce9 usb: add max_packet_size to USBEndpoint
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2012-01-17 09:44:50 +01:00
Gerd Hoffmann 5b6780d045 usb/debug: add usb_ep_dump
Add function to dump endpoint data, for debugging purposes.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2012-01-17 09:44:50 +01:00
Gerd Hoffmann 83a53bbcda usb-desc: USBEndpoint support
Initialize USBEndpoint structs from USBDesc* data.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2012-01-17 09:44:50 +01:00
Gerd Hoffmann 82f02fe965 usb: add ifnum to USBEndpoint
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2012-01-17 09:44:50 +01:00
Gerd Hoffmann d8e17efdec usb: add USBEndpoint
Start maintaining endpoint state at USBDevice level.  Add USBEndpoint
struct and some helper functions to deal with it.  For now it contains
the endpoint type only.  Moved over some bits from usb-linux.c

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2012-01-17 09:44:50 +01:00
Hector Martin 62c6ae04cf xhci: Initial xHCI implementation
Based on the implementation from Hector Martin <hector@marcansoft.com>

Hectors's implementation completely sidestepped the qemu usb system and
used libusb directly for usb device pass through.  So I've ripped out
the libusb bits (or left them in disabled, as reference for further
coding) and hooked up the qemu subsystem instead.  That work is not
complete yet though, partly due to limitations of the qemu usb
subsystem.  Nevertheless I think it is better to continue development
in-tree, especially as the qemu usb bits need a bunch of improvements
too for decent usb 3.0 support.

Current state:
  - usb-storage emulation should work ok.
  - Devices which need constant polling (HID emulation like usb-tablet)
    are known to not work.
  - ISO xfers are not implemented yet.
  - superspeed ports are not implemented yet.
  - usb pass-through is completely untested so far.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2012-01-17 09:44:32 +01:00
Andrzej Zaborowski 8c4ec5c026 pxa2xx_keypad: fix unbalanced parenthesis.
Breakage introduced by me when ammending a previous patch, sorry.
2012-01-17 02:14:42 +01:00
Evgeny Voevodin 078758d074 hw/arm_boot.c: Make SMP boards specify address to poll in bootup loop
The secondary CPU bootloader in arm_boot.c holds secondary CPUs in a
pen until the primary CPU releases them. Make boards specify the
address to be polled to determine whether to leave the pen (it was
previously hardcoded to 0x10000030, which is a Versatile Express/
Realview specific system register address).

Signed-off-by: Evgeny Voevodin <e.voevodin@samsung.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Andrzej Zaborowski <andrew.zaborowski@intel.com>
2012-01-17 02:08:22 +01:00
Evgeny Voevodin ea0e68411e hw/sysbus.h: Increase maximum number of device IRQs.
Samsung exynos4210 Interrupt Combiner needs 512 IRQ sources.

Signed-off-by: Evgeny Voevodin <e.voevodin@samsung.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Andrzej Zaborowski <andrew.zaborowski@intel.com>
2012-01-17 02:08:19 +01:00
Vasily Khoruzhick 753a97c6b4 pxa2xx_keypad: make single automatic scans work
u-boot uses single automatic scans and polling in
pxa2xx_keypad driver, so clear KPC_AS bit immediately
and update keys state even if KPC_AS and KPC_ASACT are
cleared.

Signed-off-by: Vasily Khoruzhick <anarsoul@gmail.com>
Signed-off-by: Andrzej Zaborowski <andrew.zaborowski@intel.com>
2012-01-17 01:48:47 +01:00
Vasily Khoruzhick 7ab3aedfe3 pxa2xx_lcd: fix palette parser
Pallete entry size for 16bpp format is 2 bytes, not 4

Signed-off-by: Vasily Khoruzhick <anarsoul@gmail.com>
Signed-off-by: Andrzej Zaborowski <andrew.zaborowski@intel.com>
2012-01-17 01:40:18 +01:00
Jan Kiszka ddcada7889 isapc: Fix segfault during initialization
Obviously, linking the RTC device state to the PIIX does not belong into
the common path that is shared with the isapc.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
2012-01-15 17:23:09 +01:00
Paolo Bonzini 6b620ca3b0 prepare for future GPLv2+ relicensing
All files under GPLv2 will get GPLv2+ changes starting tomorrow.
event_notifier.c and exec-obsolete.h were only ever touched by Red Hat
employees and can be relicensed now.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2012-01-13 10:55:56 -06:00
Amit Shah a10348c3ad virtio-console: no need to remove char handlers explicitly
qdev is now equipped (thanks to the last commit) to disassociate
chardevs from the qdev devices on the devices going away.  So doing it
in the virtio-console driver is not necessary.

Since that was the only thing being done in the qdev exit method, drop
it entirely.

Signed-off-by: Amit Shah <amit.shah@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2012-01-13 10:21:03 -06:00
Amit Shah a87f3e8b08 qdev: Add a 'free' method to disassociate chardev from qdev device
When a device is removed, remove the association with a chardev, if any,
so that the chardev can be re-used later for other devices.

Reported-by: Qunfang Zhang <qzhang@redhat.com>
Fix-suggested-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Amit Shah <amit.shah@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2012-01-13 10:21:03 -06:00
Paolo Bonzini 1ba1f2e319 virtio-blk: refuse SG_IO requests with scsi=off
QEMU does have a "scsi" option (to be used like -device
virtio-blk-pci,drive=foo,scsi=off).  However, it only
masks the feature bit, and does not reject the command
if a malicious guest disregards the feature bits and
issues a request.

Without this patch, using scsi=off does not protect you
from CVE-2011-4127.

Reviewed-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2012-01-13 10:20:51 -06:00
Paolo Bonzini 701a8f76aa vmstate: extract declarations out of hw/hw.h
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2012-01-13 10:20:51 -06:00