]> git.proxmox.com Git - mirror_qemu.git/log
mirror_qemu.git
8 years agosPAPR: Introduce rtas_ldq()
Gavin Shan [Tue, 1 Sep 2015 01:05:12 +0000 (11:05 +1000)]
sPAPR: Introduce rtas_ldq()

This introduces rtas_ldq() to load 64-bits parameter from continuous
two 4-bytes memory chunk of RTAS parameter buffer, to simplify the
code.

Signed-off-by: Gavin Shan <gwshan@linux.vnet.ibm.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
8 years agospapr_rtas: Prevent QEMU crash during hotplug without a prior device_add
Bharata B Rao [Mon, 31 Aug 2015 23:53:52 +0000 (09:53 +1000)]
spapr_rtas: Prevent QEMU crash during hotplug without a prior device_add

If drmgr is used in the guest to hotplug a device before a device_add
has been issued via the QEMU monitor, QEMU segfaults in configure_connector
call. This occurs due to accessing of NULL FDT which otherwise would have
been created and associated with the DRC during device_add command.

Check for NULL FDT and return failure from configure_connector call.
As per PAPR+, an error value of -9003 seems appropriate for this failure.

Signed-off-by: Bharata B Rao <bharata@linux.vnet.ibm.com>
Cc: Michael Roth <mdroth@linux.vnet.ibm.com>
Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
8 years agoppc/spapr: Use qemu_log_mask() for hcall_dprintf()
Thomas Huth [Tue, 1 Sep 2015 01:29:02 +0000 (11:29 +1000)]
ppc/spapr: Use qemu_log_mask() for hcall_dprintf()

To see the output of the hcall_dprintf statements, you currently have
to enable the DEBUG_SPAPR_HCALLS macro in include/hw/ppc/spapr.h.
This is ugly because a) not every user who wants to debug guest
problems can or wants to recompile QEMU to be able to see such issues,
and b) since this macro is disabled by default, the code in the
hcall_dprintf() brackets tends to bitrot until somebody temporarily
enables that macro again.
Since the hcall_dprintf statements except one indicate guest
problems, let's always use qemu_log_mask(LOG_GUEST_ERROR, ...) for
this macro instead. One spot indicated an unimplemented host feature,
so this is changed into qemu_log_mask(LOG_UNIMP, ...) instead. Now
it's possible to see all those messages by simply adding the CLI
parameter "-d guest_errors,unimp", without the need to re-compile
the binary.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
8 years agospapr_drc: Fix potential undefined behaviour
David Gibson [Thu, 3 Sep 2015 00:08:23 +0000 (10:08 +1000)]
spapr_drc: Fix potential undefined behaviour

The DRC_INDEX_ID_MASK macro does a left shift on ~0, which is a signed
quantity, and therefore undefined behaviour according to the C spec.  In
particular this causes warnings from the clang sanitizer.

This fixes it by calculating the same mask without using ~0 (I think the
new method is a more common idiom for generating masks anyway).  For good
measure I also use 1ULL to force the expression's type to unsigned long
long, which should be good for assigning to anything we're going to want
to.

Reported-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Reviewed-by: Alexey Kardashevskiy <aik@ozlabs.ru>
8 years agospapr: add dumpdtb support
Andrew Jones [Tue, 1 Sep 2015 01:25:35 +0000 (11:25 +1000)]
spapr: add dumpdtb support

dumpdtb (-machine dumpdtb=<file>) allows one to inspect the generated
device tree of machine types that generate device trees. This is
useful for a) seeing what's there b) debugging/testing device tree
generator patches. It can be used as follows

$QEMU_CMDLINE -machine dumpdtb=dtb
dtc -I dtb -O dts dtb

Signed-off-by: Andrew Jones <drjones@redhat.com>
Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
8 years agospapr: SPLPAR Characteristics
Sam Bobroff [Tue, 1 Sep 2015 01:24:37 +0000 (11:24 +1000)]
spapr: SPLPAR Characteristics

Improve the SPLPAR Characteristics information:

    Add MaxPlatProcs: set to max_cpus, the maximum CPUs that could be
    addded to the system.
    Add DesMem: set to the initial memory of the system.
    Add DesProcs: set to smp_cpus, the inital number of CPUs in the
    system.

These tokens and values are specified by PAPR.

Signed-off-by: Sam Bobroff <sam.bobroff@au1.ibm.com>
Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
8 years agospapr: Make ibm, change-msi respect 3 return values
Sam Bobroff [Tue, 1 Sep 2015 01:23:47 +0000 (11:23 +1000)]
spapr: Make ibm, change-msi respect 3 return values

Currently, rtas_ibm_change_msi() always returns four values even if
less are specified.

Correct this by only returning the fourth parameter if it was
requested.

This is specified by PAPR.

Signed-off-by: Sam Bobroff <sam.bobroff@au1.ibm.com>
Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
8 years agospapr: Add /rtas/ibm,change-msix-capable
Sam Bobroff [Tue, 1 Sep 2015 01:23:34 +0000 (11:23 +1000)]
spapr: Add /rtas/ibm,change-msix-capable

QEMU is MSI-X capable and makes it available via ibm,change-msi, so
we should indicate this by adding /rtas/ibm,change-msix-capable to the
device tree.

This is specificed by PAPR.

Signed-off-by: Sam Bobroff <sam.bobroff@au1.ibm.com>
Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
8 years agospapr: Add /ibm,partition-name
Sam Bobroff [Tue, 1 Sep 2015 01:23:19 +0000 (11:23 +1000)]
spapr: Add /ibm,partition-name

QEMU has a notion of the guest name, so if it's present we might as
well put that into the device tree as /ibm,partition-name.

This is specificed by PAPR.

Signed-off-by: Sam Bobroff <sam.bobroff@au1.ibm.com>
Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
8 years agospapr: Create pseries-2.5 machine
David Gibson [Wed, 12 Aug 2015 03:15:56 +0000 (13:15 +1000)]
spapr: Create pseries-2.5 machine

Add pseries-2.5 machine version.

Signed-off-by: Bharata B Rao <bharata@linux.vnet.ibm.com>
[Altered to merge before memory hotplug -- dwg]
[Altered to work with b9f072d01 -- dwg]
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
8 years agospapr: Provide an error message when migration fails due to htab_shift mismatch
Bharata B Rao [Thu, 30 Jul 2015 14:55:15 +0000 (20:25 +0530)]
spapr: Provide an error message when migration fails due to htab_shift mismatch

Include an error message when migration fails due to mismatch in
htab_shift values at source and target. This should provide a bit more
verbose message in addition to the current migration failure message
that reads like:

qemu-system-ppc64: error while loading state for instance 0x0 of device 'spapr/htab'

After this patch, the failure message will look like this:

qemu-system-ppc64: htab_shift mismatch: source 29 target 24
qemu-system-ppc64: error while loading state for instance 0x0 of device 'spapr/htab'

Signed-off-by: Bharata B Rao <bharata@linux.vnet.ibm.com>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
8 years agoMerge remote-tracking branch 'remotes/kraxel/tags/pull-ipxe-20150903-1' into staging
Peter Maydell [Tue, 22 Sep 2015 18:22:23 +0000 (19:22 +0100)]
Merge remote-tracking branch 'remotes/kraxel/tags/pull-ipxe-20150903-1' into staging

ipxe: update to 35c53797 to 4e03af8, build tweaks.

# gpg: Signature made Thu 03 Sep 2015 13:52:01 BST using RSA key ID D3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
# gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
# gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

* remotes/kraxel/tags/pull-ipxe-20150903-1:
  ipxe: update binaries
  ipxe: use upstream configuration
  ipxe: don't override GITVERSION
  ipxe: update from 35c53797 to 4e03af8

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
8 years agoMerge remote-tracking branch 'remotes/armbru/tags/pull-monitor-2015-09-22' into staging
Peter Maydell [Tue, 22 Sep 2015 15:51:36 +0000 (16:51 +0100)]
Merge remote-tracking branch 'remotes/armbru/tags/pull-monitor-2015-09-22' into staging

Monitor patches

# gpg: Signature made Tue 22 Sep 2015 10:33:34 BST using RSA key ID EB918653
# gpg: Good signature from "Markus Armbruster <armbru@redhat.com>"
# gpg:                 aka "Markus Armbruster <armbru@pond.sub.org>"

* remotes/armbru/tags/pull-monitor-2015-09-22:
  hmp: Restore "info pci"
  monitor: allow device_del to accept QOM paths

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
8 years agohmp: Restore "info pci"
Paolo Bonzini [Fri, 18 Sep 2015 15:18:29 +0000 (17:18 +0200)]
hmp: Restore "info pci"

Dropped by commit da76ee76f78b9705e2a91e3c964aef28fecededb's
transition to hmp-commands-info.hx.

Reported-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Message-Id: <1442589509-10806-1-git-send-email-pbonzini@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
8 years agomonitor: allow device_del to accept QOM paths
Daniel P. Berrange [Fri, 11 Sep 2015 12:33:56 +0000 (13:33 +0100)]
monitor: allow device_del to accept QOM paths

Currently device_del requires that the client provide the
device short ID. device_add allows devices to be created
without giving an ID, at which point there is no way to
delete them with device_del. The QOM object path, however,
provides an alternative way to identify the devices.

Allowing device_del to accept an object path ensures all
devices are deletable regardless of whether they have an
ID.

 (qemu) device_add usb-mouse
 (qemu) qom-list /machine/peripheral-anon
 device[0] (child<usb-mouse>)
 type (string)
 (qemu) device_del /machine/peripheral-anon/device[0]

Devices are required to be marked as hotpluggable
otherwise an error is raised

 (qemu) device_del /machine/unattached/device[4]
 Device 'PIIX3' does not support hotplugging

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
Message-Id: <1441974836-17476-1-git-send-email-berrange@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
[Commit message touched up, accidental white-space change dropped]
Signed-off-by: Markus Armbruster <armbru@redhat.com>
8 years agoMerge remote-tracking branch 'remotes/spice/tags/pull-spice-20150921-1' into staging
Peter Maydell [Mon, 21 Sep 2015 23:37:05 +0000 (00:37 +0100)]
Merge remote-tracking branch 'remotes/spice/tags/pull-spice-20150921-1' into staging

spice: surface switch fast path requires same format too.

# gpg: Signature made Mon 21 Sep 2015 10:05:54 BST using RSA key ID D3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
# gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
# gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

* remotes/spice/tags/pull-spice-20150921-1:
  spice: surface switch fast path requires same format too.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
8 years agoMerge remote-tracking branch 'remotes/armbru/tags/pull-qapi-2015-09-21' into staging
Peter Maydell [Mon, 21 Sep 2015 21:33:51 +0000 (22:33 +0100)]
Merge remote-tracking branch 'remotes/armbru/tags/pull-qapi-2015-09-21' into staging

qapi: QMP introspection

# gpg: Signature made Mon 21 Sep 2015 08:59:17 BST using RSA key ID EB918653
# gpg: Good signature from "Markus Armbruster <armbru@redhat.com>"
# gpg:                 aka "Markus Armbruster <armbru@pond.sub.org>"

* remotes/armbru/tags/pull-qapi-2015-09-21: (26 commits)
  qapi-introspect: Hide type names
  qapi: New QMP command query-qmp-schema for QMP introspection
  qapi: Pseudo-type '**' is now unused, drop it
  qapi-schema: Fix up misleading specification of netdev_add
  qom: Don't use 'gen': false for qom-get, qom-set, object-add
  qapi: Introduce a first class 'any' type
  qapi: Make output visitor return qnull() instead of NULL
  qapi: Improve built-in type documentation
  qapi-commands: De-duplicate output marshaling functions
  qapi: De-duplicate parameter list generation
  qapi: Rename qmp_marshal_input_FOO() to qmp_marshal_FOO()
  qapi-commands: Rearrange code
  qapi-visit: Rearrange code a bit
  qapi: Clean up after recent conversions to QAPISchemaVisitor
  qapi: Replace dirty is_c_ptr() by method c_null()
  qapi-event: Convert to QAPISchemaVisitor, fixing data with base
  qapi-event: Eliminate global variable event_enum_value
  qapi: De-duplicate enum code generation
  qapi-commands: Convert to QAPISchemaVisitor
  qapi-visit: Convert to QAPISchemaVisitor, fixing bugs
  ...

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
8 years agoMerge remote-tracking branch 'remotes/aurel/tags/pull-tcg-mips-20150921' into staging
Peter Maydell [Mon, 21 Sep 2015 18:42:33 +0000 (19:42 +0100)]
Merge remote-tracking branch 'remotes/aurel/tags/pull-tcg-mips-20150921' into staging

TCG MIPS queue

- Fixes for 64-bit guests
- Small cleanups

# gpg: Signature made Sun 20 Sep 2015 23:33:15 BST using RSA key ID 1DDD8C9B
# gpg: Good signature from "Aurelien Jarno <aurelien@aurel32.net>"
# gpg:                 aka "Aurelien Jarno <aurelien@jarno.fr>"
# gpg:                 aka "Aurelien Jarno <aurel32@debian.org>"
# gpg: WARNING: This key is not certified with sufficiently trusted signatures!
# gpg:          It is not certain that the signature belongs to the owner.
# Primary key fingerprint: 7746 2642 A9EF 94FD 0F77  196D BA9C 7806 1DDD 8C9B

* remotes/aurel/tags/pull-tcg-mips-20150921:
  tcg/mips: pass oi to tcg_out_tlb_load
  tcg/mips: move tcg_out_addsub2
  tcg/mips: Fix clobbering of qemu_ld inputs

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
8 years agoMerge remote-tracking branch 'remotes/agraf/tags/signed-ppc-for-upstream' into staging
Peter Maydell [Mon, 21 Sep 2015 16:01:46 +0000 (17:01 +0100)]
Merge remote-tracking branch 'remotes/agraf/tags/signed-ppc-for-upstream' into staging

Patch queue for ppc - 2015-09-20

Highlights this time around:

  - e500: Fix u-boot boot with -M virt by updating to new version
  - e500: fix ATMU reads
  - book3s: Fixes (unaligned exceptions, vector instructions)
  - yet another dbdma ide fix

I'm out taking care of my son for the next 2 months. During that time
please consider David Gibson the interim ppc queue maintainer. I'm sure
Aurelien will be more than happy to help him review patches as well ;-).

# gpg: Signature made Sun 20 Sep 2015 21:51:16 BST using RSA key ID 03FEDC60
# gpg: Good signature from "Alexander Graf <agraf@suse.de>"
# gpg:                 aka "Alexander Graf <alex@csgraf.de>"

* remotes/agraf/tags/signed-ppc-for-upstream:
  target-ppc: fix xscmpodp and xscmpudp decoding
  target-ppc: fix vcipher, vcipherlast, vncipherlast and vpermxor
  PPC: E500: Update u-boot to commit 79c884d7e4
  target-ppc: Fix SRR0 when taking unaligned exceptions
  PPC: e500 pci host: Fix ATMUs register reads
  mac_dbdma: always clear FLUSH bit once DBDMA channel flush is complete
  kvm_ppc: remove kvmppc_timer_hack

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
8 years agoqapi-introspect: Hide type names
Markus Armbruster [Wed, 16 Sep 2015 11:06:29 +0000 (13:06 +0200)]
qapi-introspect: Hide type names

To eliminate the temptation for clients to look up types by name
(which are not ABI), replace all type names by meaningless strings.

Reduces output of query-schema by 13 out of 85KiB.

As a debugging aid, provide option -u to suppress the hiding.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Message-Id: <1442401589-24189-27-git-send-email-armbru@redhat.com>

8 years agoqapi: New QMP command query-qmp-schema for QMP introspection
Markus Armbruster [Wed, 16 Sep 2015 11:06:28 +0000 (13:06 +0200)]
qapi: New QMP command query-qmp-schema for QMP introspection

qapi/introspect.json defines the introspection schema.  It's designed
for QMP introspection, but should do for similar uses, such as QGA.

The introspection schema does not reflect all the rules and
restrictions that apply to QAPI schemata.  A valid QAPI schema has an
introspection value conforming to the introspection schema, but the
converse is not true.

Introspection lowers away a number of schema details, and makes
implicit things explicit:

* The built-in types are declared with their JSON type.

  All integer types are mapped to 'int', because how many bits we use
  internally is an implementation detail.  It could be pressed into
  external interface service as very approximate range information,
  but that's a bad idea.  If we need range information, we better do
  it properly.

* Implicit type definitions are made explicit, and given
  auto-generated names:

  - Array types, named by appending "List" to the name of their
    element type, like in generated C.

  - The enumeration types implicitly defined by simple union types,
    named by appending "Kind" to the name of their simple union type,
    like in generated C.

  - Types that don't occur in generated C.  Their names start with ':'
    so they don't clash with the user's names.

* All type references are by name.

* The struct and union types are generalized into an object type.

* Base types are flattened.

* Commands take a single argument and return a single result.

  Dictionary argument or list result is an implicit type definition.

  The empty object type is used when a command takes no arguments or
  produces no results.

  The argument is always of object type, but the introspection schema
  doesn't reflect that.

  The 'gen': false directive is omitted as implementation detail.

  The 'success-response' directive is omitted as well for now, even
  though it's not an implementation detail, because it's not used by
  QMP.

* Events carry a single data value.

  Implicit type definition and empty object type use, just like for
  commands.

  The value is of object type, but the introspection schema doesn't
  reflect that.

* Types not used by commands or events are omitted.

  Indirect use counts as use.

* Optional members have a default, which can only be null right now

  Instead of a mandatory "optional" flag, we have an optional default.
  No default means mandatory, default null means optional without
  default value.  Non-null is available for optional with default
  (possible future extension).

* Clients should *not* look up types by name, because type names are
  not ABI.  Look up the command or event you're interested in, then
  follow the references.

  TODO Should we hide the type names to eliminate the temptation?

New generator scripts/qapi-introspect.py computes an introspection
value for its input, and generates a C variable holding it.

It can generate awfully long lines.  Marked TODO.

A new test-qmp-input-visitor test case feeds its result for both
tests/qapi-schema/qapi-schema-test.json and qapi-schema.json to a
QmpInputVisitor to verify it actually conforms to the schema.

New QMP command query-qmp-schema takes its return value from that
variable.  Its reply is some 85KiBytes for me right now.

If this turns out to be too much, we have a couple of options:

* We can use shorter names in the JSON.  Not the QMP style.

* Optionally return the sub-schema for commands and events given as
  arguments.

  Right now qmp_query_schema() sends the string literal computed by
  qmp-introspect.py.  To compute sub-schema at run time, we'd have to
  duplicate parts of qapi-introspect.py in C.  Unattractive.

* Let clients cache the output of query-qmp-schema.

  It changes only on QEMU upgrades, i.e. rarely.  Provide a command
  query-qmp-schema-hash.  Clients can have a cache indexed by hash,
  and re-query the schema only when they don't have it cached.  Even
  simpler: put the hash in the QMP greeting.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
8 years agoqapi: Pseudo-type '**' is now unused, drop it
Markus Armbruster [Wed, 16 Sep 2015 11:06:27 +0000 (13:06 +0200)]
qapi: Pseudo-type '**' is now unused, drop it

'gen': false needs to stay for now, because netdev_add is still using
it.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Daniel P. Berrange <berrange@redhat.com>
Message-Id: <1442401589-24189-25-git-send-email-armbru@redhat.com>

8 years agoqapi-schema: Fix up misleading specification of netdev_add
Markus Armbruster [Wed, 16 Sep 2015 11:06:26 +0000 (13:06 +0200)]
qapi-schema: Fix up misleading specification of netdev_add

It doesn't take a 'props' argument, let alone one in the format
"NAME=VALUE,..."

The bogus arguments specification doesn't matter due to 'gen': false.
Clean it up to be incomplete rather than wrong, and document the
incompleteness.

While there, improve netdev_add usage example in the manual: add a
device option to show how it's done.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Daniel P. Berrange <berrange@redhat.com>
Message-Id: <1442401589-24189-24-git-send-email-armbru@redhat.com>

8 years agoqom: Don't use 'gen': false for qom-get, qom-set, object-add
Markus Armbruster [Wed, 16 Sep 2015 11:06:25 +0000 (13:06 +0200)]
qom: Don't use 'gen': false for qom-get, qom-set, object-add

With the previous commit, the generated marshalers just work, and save
us a bit of handwritten code.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Daniel P. Berrange <berrange@redhat.com>
Message-Id: <1442401589-24189-23-git-send-email-armbru@redhat.com>

8 years agoqapi: Introduce a first class 'any' type
Markus Armbruster [Wed, 16 Sep 2015 11:06:24 +0000 (13:06 +0200)]
qapi: Introduce a first class 'any' type

It's first class, because unlike '**', it actually works, i.e. doesn't
require 'gen': false.

'**' will go away next.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Daniel P. Berrange <berrange@redhat.com>
8 years agoqapi: Make output visitor return qnull() instead of NULL
Markus Armbruster [Wed, 16 Sep 2015 11:06:23 +0000 (13:06 +0200)]
qapi: Make output visitor return qnull() instead of NULL

Before commit 1d10b44, it crashed.  Since then, it returns NULL, with
a FIXME comment.  The FIXME is valid: code that assumes QObject *
can't be null exists.  I'm not aware of a way to feed this problematic
return value to code that actually chokes on null in the current code,
but the next few commits will create one, failing "make check".

Commit 481b002 solved a very similar problem by introducing a special
null QObject.  Using this special null QObject is clearly the right
way to resolve this FIXME, so do that, and update the test
accordingly.

However, the patch isn't quite right: it messes up the reference
counting.  After about SIZE_MAX visits, the reference counter
overflows, failing the assertion in qnull_destroy_obj().  Because
that's many orders of magnitude more visits of nulls than we expect,
we take this patch despite its flaws, to get the QMP introspection
stuff in without further delay.  We'll want to fix it for real before
the release.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Daniel P. Berrange <berrange@redhat.com>
Message-Id: <1442401589-24189-21-git-send-email-armbru@redhat.com>

8 years agoqapi: Improve built-in type documentation
Markus Armbruster [Wed, 16 Sep 2015 11:06:22 +0000 (13:06 +0200)]
qapi: Improve built-in type documentation

Clarify how they map to JSON.  Add how they map to C.  Fix the
reference to StringInputVisitor.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Daniel P. Berrange <berrange@redhat.com>
Message-Id: <1442401589-24189-20-git-send-email-armbru@redhat.com>

8 years agoqapi-commands: De-duplicate output marshaling functions
Markus Armbruster [Wed, 16 Sep 2015 11:06:21 +0000 (13:06 +0200)]
qapi-commands: De-duplicate output marshaling functions

gen_marshal_output() uses its parameter name only for name of the
generated function.  Name it after the type being marshaled instead of
its caller, and drop duplicates.

Saves 7 copies of qmp_marshal_output_int() in qemu-ga, and one copy of
qmp_marshal_output_str() in qemu-system-*.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Daniel P. Berrange <berrange@redhat.com>
Message-Id: <1442401589-24189-19-git-send-email-armbru@redhat.com>

8 years agoqapi: De-duplicate parameter list generation
Markus Armbruster [Wed, 16 Sep 2015 11:06:20 +0000 (13:06 +0200)]
qapi: De-duplicate parameter list generation

Generated qapi-event.[ch] lose line breaks.  No change otherwise.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Daniel P. Berrange <berrange@redhat.com>
Message-Id: <1442401589-24189-18-git-send-email-armbru@redhat.com>

8 years agoqapi: Rename qmp_marshal_input_FOO() to qmp_marshal_FOO()
Markus Armbruster [Wed, 16 Sep 2015 11:06:19 +0000 (13:06 +0200)]
qapi: Rename qmp_marshal_input_FOO() to qmp_marshal_FOO()

These functions marshal both input and output.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Daniel P. Berrange <berrange@redhat.com>
Message-Id: <1442401589-24189-17-git-send-email-armbru@redhat.com>

8 years agoqapi-commands: Rearrange code
Markus Armbruster [Wed, 16 Sep 2015 11:06:18 +0000 (13:06 +0200)]
qapi-commands: Rearrange code

Rename gen_marshal_input() to gen_marshal(), because the generated
function marshals both arguments and results.

Rename gen_visitor_input_containers_decl() to gen_marshal_vars(), and
move the other variable declarations there, too.

Rename gen_visitor_input_block() to gen_marshal_input_visit(), and
rearrange its code slightly.

Rename gen_marshal_input_decl() to gen_marshal_proto(), because the
result isn't a full declaration, unlike gen_command_decl()'s.

New gen_marshal_decl() actually returns a full declaration.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Daniel P. Berrange <berrange@redhat.com>
Message-Id: <1442401589-24189-16-git-send-email-armbru@redhat.com>

8 years agoqapi-visit: Rearrange code a bit
Markus Armbruster [Wed, 16 Sep 2015 11:06:17 +0000 (13:06 +0200)]
qapi-visit: Rearrange code a bit

Move gen_visit_decl() to a better place.  Inline
generate_visit_struct_body().

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Daniel P. Berrange <berrange@redhat.com>
Message-Id: <1442401589-24189-15-git-send-email-armbru@redhat.com>

8 years agoqapi: Clean up after recent conversions to QAPISchemaVisitor
Markus Armbruster [Wed, 16 Sep 2015 11:06:16 +0000 (13:06 +0200)]
qapi: Clean up after recent conversions to QAPISchemaVisitor

Generate just 'FOO' instead of 'struct FOO' when possible.

Drop helper functions that are now unused.

Make pep8 and pylint reasonably happy.

Rename generate_FOO() functions to gen_FOO() for consistency.

Use more consistent and sensible variable names.

Consistently use c_ for mapping keys when their value is a C
identifier or type.

Simplify gen_enum() and gen_visit_union()

Consistently use single quotes for C text string literals.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-Id: <1442401589-24189-14-git-send-email-armbru@redhat.com>
Reviewed-by: Daniel P. Berrange <berrange@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
8 years agoqapi: Replace dirty is_c_ptr() by method c_null()
Markus Armbruster [Wed, 16 Sep 2015 11:06:15 +0000 (13:06 +0200)]
qapi: Replace dirty is_c_ptr() by method c_null()

is_c_ptr() looks whether the end of the C text for the type looks like
a pointer.  Works, but is fragile.

We now have a better tool: use QAPISchemaType method c_null().  The
initializers for non-pointers become prettier: 0, false or the
enumeration constant with the value 0 instead of {0}.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Daniel P. Berrange <berrange@redhat.com>
Message-Id: <1442401589-24189-13-git-send-email-armbru@redhat.com>

8 years agoqapi-event: Convert to QAPISchemaVisitor, fixing data with base
Markus Armbruster [Wed, 16 Sep 2015 11:06:14 +0000 (13:06 +0200)]
qapi-event: Convert to QAPISchemaVisitor, fixing data with base

Fixes events whose data is struct with base to include the struct's
base members.  Test case is qapi-schema-test.json's event
__org.qemu_x-command:

    { 'event': '__ORG.QEMU_X-EVENT', 'data': '__org.qemu_x-Struct' }

    { 'struct': '__org.qemu_x-Struct', 'base': '__org.qemu_x-Base',
      'data': { '__org.qemu_x-member2': 'str' } }

    { 'struct': '__org.qemu_x-Base',
      'data': { '__org.qemu_x-member1': '__org.qemu_x-Enum' } }

Patch's effect on generated qapi_event_send___org_qemu_x_event():

    -void qapi_event_send___org_qemu_x_event(const char *__org_qemu_x_member2,
    +void qapi_event_send___org_qemu_x_event(__org_qemu_x_Enum __org_qemu_x_member1,
    +                                        const char *__org_qemu_x_member2,
                                             Error **errp)
     {
         QDict *qmp;
    @@ -224,6 +225,10 @@ void qapi_event_send___org_qemu_x_event(
             goto clean;
         }

    +    visit_type___org_qemu_x_Enum(v, &__org_qemu_x_member1, "__org.qemu_x-member1", &local_err);
    +    if (local_err) {
    +        goto clean;
    +    }
         visit_type_str(v, (char **)&__org_qemu_x_member2, "__org.qemu_x-member2", &local_err);
         if (local_err) {
             goto clean;

Code is generated in a different order now, but that doesn't matter.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Daniel P. Berrange <berrange@redhat.com>
8 years agoqapi-event: Eliminate global variable event_enum_value
Markus Armbruster [Wed, 16 Sep 2015 11:06:13 +0000 (13:06 +0200)]
qapi-event: Eliminate global variable event_enum_value

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Daniel P. Berrange <berrange@redhat.com>
Message-Id: <1442401589-24189-11-git-send-email-armbru@redhat.com>

8 years agoqapi: De-duplicate enum code generation
Markus Armbruster [Wed, 16 Sep 2015 11:06:12 +0000 (13:06 +0200)]
qapi: De-duplicate enum code generation

Duplicated in commit 21cd70d.  Yes, we can't import qapi-types, but
that's no excuse.  Move the helpers from qapi-types.py to qapi.py, and
replace the duplicates in qapi-event.py.

The generated event enumeration type's lookup table becomes
const-correct (see commit 2e4450f), and uses explicit indexes instead
of relying on order (see commit 912ae9c).

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-Id: <1442401589-24189-10-git-send-email-armbru@redhat.com>
Reviewed-by: Daniel P. Berrange <berrange@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
8 years agoqapi-commands: Convert to QAPISchemaVisitor
Markus Armbruster [Wed, 16 Sep 2015 11:06:11 +0000 (13:06 +0200)]
qapi-commands: Convert to QAPISchemaVisitor

Output unchanged apart from reordering and white-space.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Message-Id: <1442401589-24189-9-git-send-email-armbru@redhat.com>
Reviewed-by: Daniel P. Berrange <berrange@redhat.com>
8 years agoqapi-visit: Convert to QAPISchemaVisitor, fixing bugs
Markus Armbruster [Wed, 16 Sep 2015 11:06:10 +0000 (13:06 +0200)]
qapi-visit: Convert to QAPISchemaVisitor, fixing bugs

Fixes flat unions to visit the base's base members (the previous
commit merely added them to the struct).  Same test case.

Patch's effect on visit_type_UserDefFlatUnion():

     static void visit_type_UserDefFlatUnion_fields(Visitor *m, UserDefFlatUnion **obj, Error **errp)
     {
         Error *err = NULL;

    +    visit_type_int(m, &(*obj)->integer, "integer", &err);
    +    if (err) {
    +        goto out;
    +    }
         visit_type_str(m, &(*obj)->string, "string", &err);
         if (err) {
             goto out;

Test cases updated for the bug fix.

Fixes alternates to generate a visitor for their implicit enumeration
type.  None of them are currently used, obviously.  Example:
block-core.json's BlockdevRef now generates
visit_type_BlockdevRefKind().

Code is generated in a different order now, and therefore has got a
few new forward declarations.  Doesn't matter.

The guard QAPI_VISIT_BUILTIN_VISITOR_DECL is renamed to
QAPI_VISIT_BUILTIN.

The previous commit's two ugly special cases exist here, too.  Mark
both TODO.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Daniel P. Berrange <berrange@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
8 years agoqapi-types: Convert to QAPISchemaVisitor, fixing flat unions
Markus Armbruster [Wed, 16 Sep 2015 11:06:09 +0000 (13:06 +0200)]
qapi-types: Convert to QAPISchemaVisitor, fixing flat unions

Fixes flat unions to get the base's base members.  Test case is from
commit 2fc0043, in qapi-schema-test.json:

    { 'union': 'UserDefFlatUnion',
      'base': 'UserDefUnionBase',
      'discriminator': 'enum1',
      'data': { 'value1' : 'UserDefA',
                'value2' : 'UserDefB',
                'value3' : 'UserDefB' } }

    { 'struct': 'UserDefUnionBase',
      'base': 'UserDefZero',
      'data': { 'string': 'str', 'enum1': 'EnumOne' } }

    { 'struct': 'UserDefZero',
      'data': { 'integer': 'int' } }

Patch's effect on UserDefFlatUnion:

     struct UserDefFlatUnion {
         /* Members inherited from UserDefUnionBase: */
    +    int64_t integer;
         char *string;
         EnumOne enum1;
         /* Own members: */
         union { /* union tag is @enum1 */
             void *data;
             UserDefA *value1;
             UserDefB *value2;
             UserDefB *value3;
         };
     };

Flat union visitors remain broken.  They'll be fixed next.

Code is generated in a different order now, but that doesn't matter.

The two guards QAPI_TYPES_BUILTIN_STRUCT_DECL and
QAPI_TYPES_BUILTIN_CLEANUP_DECL are replaced by just
QAPI_TYPES_BUILTIN.

Two ugly special cases for simple unions now stand out like sore
thumbs:

1. The type tag is named 'type' everywhere, except in generated C,
   where it's 'kind'.

2. QAPISchema lowers simple unions to semantically equivalent flat
   unions.  However, the C generated for a simple unions differs from
   the C generated for its equivalent flat union, and we therefore
   need special code to preserve that pointless difference for now.

Mark both TODO.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Daniel P. Berrange <berrange@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
8 years agospice: surface switch fast path requires same format too.
Gerd Hoffmann [Fri, 18 Sep 2015 10:07:18 +0000 (12:07 +0200)]
spice: surface switch fast path requires same format too.

Commit "555e72f spice: rework mirror allocation, add no-resize fast path"
adds a fast path for surface switches which does't go through the full
primary surface destroy and re-recreation in case the new surface is
identical to the old one (page-flip).  It checks the size only though,
but the format must be identical too.  This patch adds the format check.

Commit "0002a51 ui/spice: Support shared surface for most pixman
formats" increases the chance to actually trigger this.

https://bugzilla.redhat.com/show_bug.cgi?id=1247479

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
8 years agotests/qapi-schema: Convert test harness to QAPISchemaVisitor
Markus Armbruster [Wed, 16 Sep 2015 11:06:08 +0000 (13:06 +0200)]
tests/qapi-schema: Convert test harness to QAPISchemaVisitor

The old code prints the result of parsing (list of expression
dictionaries), and partial results of semantic analysis (list of enum
dictionaries, list of struct dictionaries).

The new code prints a trace of a schema visit, i.e. what the back-ends
are going to use.  Built-in and array types are omitted, because
they're boring.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Daniel P. Berrange <berrange@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
8 years agoqapi: New QAPISchemaVisitor
Markus Armbruster [Wed, 16 Sep 2015 11:06:07 +0000 (13:06 +0200)]
qapi: New QAPISchemaVisitor

The visitor will help keeping the code generation code simple and
reasonably separated from QAPISchema details.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-Id: <1442401589-24189-5-git-send-email-armbru@redhat.com>
Reviewed-by: Daniel P. Berrange <berrange@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
8 years agoqapi: QAPISchema code generation helper methods
Markus Armbruster [Wed, 16 Sep 2015 11:06:06 +0000 (13:06 +0200)]
qapi: QAPISchema code generation helper methods

New methods c_name(), c_type(), c_null(), json_type(),
alternate_qtype().

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-Id: <1442401589-24189-4-git-send-email-armbru@redhat.com>
Reviewed-by: Daniel P. Berrange <berrange@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
8 years agoqapi: New QAPISchema intermediate reperesentation
Markus Armbruster [Wed, 16 Sep 2015 11:06:05 +0000 (13:06 +0200)]
qapi: New QAPISchema intermediate reperesentation

The QAPI code generators work with a syntax tree (nested dictionaries)
plus a few symbol tables (also dictionaries) on the side.

They have clearly outgrown these simple data structures.  There's lots
of rummaging around in dictionaries, and information is recomputed on
the fly.  For the work I'm going to do, I want more clearly defined
and more convenient interfaces.

Going forward, I also want less coupling between the back-ends and the
syntax tree, to make messing with the syntax easier.

Create a bunch of classes to represent QAPI schemata.

Have the QAPISchema initializer call the parser, then walk the syntax
tree to create the new internal representation, and finally perform
semantic analysis.

Shortcut: the semantic analysis still relies on existing check_exprs()
to do the actual semantic checking.  All this code needs to move into
the classes.  Mark as TODO.

Simple unions are lowered to flat unions.  Flat unions and structs are
represented as a more general object type.

Catching name collisions in generated code would be nice.  Mark as
TODO.

We generate array types eagerly, even though most of them aren't used.
Mark as TODO.

Nothing uses the new intermediate representation just yet, thus no
change to generated files.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Daniel P. Berrange <berrange@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
8 years agoqapi: Rename class QAPISchema to QAPISchemaParser
Markus Armbruster [Wed, 16 Sep 2015 11:06:04 +0000 (13:06 +0200)]
qapi: Rename class QAPISchema to QAPISchemaParser

I want to name a new class QAPISchema.

While there, make it a new-style class.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Daniel P. Berrange <berrange@redhat.com>
Message-Id: <1442401589-24189-2-git-send-email-armbru@redhat.com>

8 years agotarget-ppc: fix xscmpodp and xscmpudp decoding
Aurelien Jarno [Sun, 13 Sep 2015 21:03:45 +0000 (23:03 +0200)]
target-ppc: fix xscmpodp and xscmpudp decoding

The xscmpodp and xscmpudp instructions only have the AX, BX bits in
there encoding, the lowest bit (usually TX) is marked as an invalid
bit. We therefore can't decode them with GEN_XX2FORM, which decodes
the two lowest bit.

Introduce a new form GEN_XX2FORM, which decodes AX and BX and mark
the lowest bit as invalid.

Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
Reviewed-by: Richard Henderson <rth@twiddle.net>
Tested-by: Richard W.M. Jones <rjones@redhat.com>
Signed-off-by: Alexander Graf <agraf@suse.de>
8 years agotarget-ppc: fix vcipher, vcipherlast, vncipherlast and vpermxor
Aurelien Jarno [Sun, 13 Sep 2015 21:03:44 +0000 (23:03 +0200)]
target-ppc: fix vcipher, vcipherlast, vncipherlast and vpermxor

For vector instructions, the helpers get pointers to the vector register
in arguments. Some operands might point to the same register, including
the operand holding the result.

When emulating instructions which access the vector elements in a
non-linear way, we need to store the result in an temporary variable.

This fixes openssl when emulating a POWER8 CPU.

Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
Reviewed-by: Richard Henderson <rth@twiddle.net>
Signed-off-by: Alexander Graf <agraf@suse.de>
8 years agoPPC: E500: Update u-boot to commit 79c884d7e4
Alexander Graf [Fri, 28 Aug 2015 11:10:17 +0000 (13:10 +0200)]
PPC: E500: Update u-boot to commit 79c884d7e4

The current U-Boot binary in QEMU has a bug where it fails to support
dynamic CCSR addressing. Without this support, u-boot can not boot the
ppce500 machine anymore. This has been fixed upstream in u-boot commit
e834975b.

Update the u-boot blob we carry in QEMU to the latest u-boot upstream,
so that we can successfully run u-boot with the ppce500 machine again.

CC: qemu-stable@nongnu.org
Signed-off-by: Alexander Graf <agraf@suse.de>
Tested-by: Thomas Huth <thuth@redhat.com>
8 years agotarget-ppc: Fix SRR0 when taking unaligned exceptions
Anton Blanchard [Thu, 2 Jul 2015 04:44:06 +0000 (14:44 +1000)]
target-ppc: Fix SRR0 when taking unaligned exceptions

We are setting SRR0 to the instruction before the one causing the
unaligned exception. A quick testcase:

. = 0x100
.globl _start
_start:
/* Cause a 0x600 */
li 3,0x1
stwcx. 3,0,3
1: b 1b

. = 0x600
1: b 1b

Built into something we can load as a BIOS image:

gcc -mbig -c test.S
ld -EB -Ttext 0x0 -o test test.o
objcopy -O binary test test.bin

Run with:

qemu-system-ppc64 -nographic -bios test.bin

Shows an incorrect SRR0 (points at the li):

SRR0 0000000000000100

With the patch we get the correct SRR0:

SRR0 0000000000000104

Signed-off-by: Anton Blanchard <anton@samba.org>
Signed-off-by: Alexander Graf <agraf@suse.de>
8 years agoPPC: e500 pci host: Fix ATMUs register reads
Rudolf Marek [Fri, 14 Aug 2015 11:38:55 +0000 (13:38 +0200)]
PPC: e500 pci host: Fix ATMUs register reads

There is a bug in the register mask when reading
the ATMUs registers. As the result some registers
cannot be read, and read is aliased to the other
registers. Fix it.

Signed-off-by: Rudolf Marek <rudolf.marek@sysgo.com>
Signed-off-by: Alexander Graf <agraf@suse.de>
8 years agomac_dbdma: always clear FLUSH bit once DBDMA channel flush is complete
Mark Cave-Ayland [Sun, 23 Aug 2015 10:50:55 +0000 (11:50 +0100)]
mac_dbdma: always clear FLUSH bit once DBDMA channel flush is complete

The code to flush the DBDMA channel was effectively duplicated in
dbdma_control_write(), except for the fact that the copy executed outside of a
RUN bit transition was broken by not clearing the FLUSH bit once the flush was
complete.

Newer PPC Linux kernels would timeout waiting for the FLUSH bit to clear again
after submitting a FLUSH command. Fix this by always clearing the FLUSH bit
once the channel flush is complete and removing the repeated code.

Reported-by: Aurelien Jarno <aurelien@aurel32.net>
Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
Signed-off-by: Alexander Graf <agraf@suse.de>
8 years agokvm_ppc: remove kvmppc_timer_hack
Paolo Bonzini [Mon, 27 Jul 2015 12:46:02 +0000 (14:46 +0200)]
kvm_ppc: remove kvmppc_timer_hack

QEMU does have an I/O thread now, that can be interrupted at any time
because the VCPU thread runs outside the iothread mutex.

Therefore, the kvmppc_timer_hack is obsolete.  Remove it.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Alexander Graf <agraf@suse.de>
8 years agoMerge remote-tracking branch 'remotes/afaerber/tags/qom-devices-for-peter' into staging
Peter Maydell [Sat, 19 Sep 2015 14:59:52 +0000 (15:59 +0100)]
Merge remote-tracking branch 'remotes/afaerber/tags/qom-devices-for-peter' into staging

QOM infrastructure fixes and device conversions

* QOM API error handling fixes
* Performance improvements for device GPIO property creation
* Remaining conversion of QEMUMachine to QOM

# gpg: Signature made Sat 19 Sep 2015 15:40:44 BST using RSA key ID 3E7E013F
# gpg: Good signature from "Andreas Färber <afaerber@suse.de>"
# gpg:                 aka "Andreas Färber <afaerber@suse.com>"

* remotes/afaerber/tags/qom-devices-for-peter: (21 commits)
  machine: Eliminate QEMUMachine and qemu_register_machine()
  Revert use of DEFINE_MACHINE() for registrations of multiple machines
  Use DEFINE_MACHINE() to register all machines
  mac_world: Break long line
  machine: DEFINE_MACHINE() macro
  exynos4: Declare each QEMUMachine as a separate variable
  exynos4: Use MachineClass instead of exynos4_machines array
  exynos4: Use EXYNOS4210_NCPUS instead of max_cpus on error message
  machine: Set MachineClass::name automatically
  machine: Ensure all TYPE_MACHINE subclasses have the right suffix
  mac99: Use MACHINE_TYPE_NAME to encode class name
  s390: Rename s390-ccw-virtio-2.4 class name to use MACHINE_TYPE_NAME
  s390-virtio: Rename machine class name to use MACHINE_TYPE_NAME
  pseries: Rename machine class names to use MACHINE_TYPE_NAME
  arm: Rename virt machine class to use MACHINE_TYPE_NAME
  vexpress: Rename machine classes to use MACHINE_TYPE_NAME
  vexpress: Don't set name on abstract class
  machine: MACHINE_TYPE_NAME macro
  qdev: Do not use slow [*] expansion for GPIO creation
  qom: Fix invalid error check in property_get_str()
  ...

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
8 years agomachine: Eliminate QEMUMachine and qemu_register_machine()
Eduardo Habkost [Fri, 4 Sep 2015 18:37:09 +0000 (15:37 -0300)]
machine: Eliminate QEMUMachine and qemu_register_machine()

The struct is not used anymore and can be eliminated.

Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Signed-off-by: Andreas Färber <afaerber@suse.de>
8 years agoRevert use of DEFINE_MACHINE() for registrations of multiple machines
Andreas Färber [Sat, 19 Sep 2015 08:49:44 +0000 (10:49 +0200)]
Revert use of DEFINE_MACHINE() for registrations of multiple machines

The script used for converting from QEMUMachine had used one
DEFINE_MACHINE() per machine registered. In cases where multiple
machines are registered from one source file, avoid the excessive
generation of module init functions by reverting this unrolling.

Signed-off-by: Andreas Färber <afaerber@suse.de>
8 years agoUse DEFINE_MACHINE() to register all machines
Eduardo Habkost [Fri, 4 Sep 2015 18:37:08 +0000 (15:37 -0300)]
Use DEFINE_MACHINE() to register all machines

Convert all machines to use DEFINE_MACHINE() instead of QEMUMachine
automatically using a script.

Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
[AF: Style cleanups, convert imx25_pdk machine]
Signed-off-by: Andreas Färber <afaerber@suse.de>
8 years agomac_world: Break long line
Eduardo Habkost [Fri, 4 Sep 2015 18:37:07 +0000 (15:37 -0300)]
mac_world: Break long line

Coding style change only.

Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Signed-off-by: Andreas Färber <afaerber@suse.de>
8 years agomachine: DEFINE_MACHINE() macro
Eduardo Habkost [Fri, 4 Sep 2015 18:37:06 +0000 (15:37 -0300)]
machine: DEFINE_MACHINE() macro

The macro will allow easy registration of a TYPE_MACHINE subclass, using
only the machine name and a MachineClass initialization function as
parameter.

Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Signed-off-by: Andreas Färber <afaerber@suse.de>
8 years agoexynos4: Declare each QEMUMachine as a separate variable
Eduardo Habkost [Fri, 4 Sep 2015 18:37:05 +0000 (15:37 -0300)]
exynos4: Declare each QEMUMachine as a separate variable

This will make the code follow the same pattern used for other machines,
and will make it easier to automatically convert the code to be
QOM-based.

Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Signed-off-by: Andreas Färber <afaerber@suse.de>
8 years agoexynos4: Use MachineClass instead of exynos4_machines array
Eduardo Habkost [Fri, 4 Sep 2015 18:37:04 +0000 (15:37 -0300)]
exynos4: Use MachineClass instead of exynos4_machines array

We don't need a QEMUMachine array to query max_cpus, if we can get the
corresponding MachineClass.

Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Signed-off-by: Andreas Färber <afaerber@suse.de>
8 years agoexynos4: Use EXYNOS4210_NCPUS instead of max_cpus on error message
Eduardo Habkost [Fri, 4 Sep 2015 18:37:03 +0000 (15:37 -0300)]
exynos4: Use EXYNOS4210_NCPUS instead of max_cpus on error message

The code is checking smp_cpus against EXYNOS4210_NCPUS, not against
max_cpus, so use EXYNOS4210_NCPUS in the error message for consistency.

Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Signed-off-by: Andreas Färber <afaerber@suse.de>
8 years agomachine: Set MachineClass::name automatically
Eduardo Habkost [Thu, 20 Aug 2015 21:54:36 +0000 (14:54 -0700)]
machine: Set MachineClass::name automatically

Now all TYPE_MACHINE subclasses use MACHINE_TYPE_NAME to generate the
class name. So instead of requiring each subclass to set
MachineClass::name manually, we can now set it automatically at the
TYPE_MACHINE class_base_init() function.

Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Reviewed-by: Marcel Apfelbaum <marcel@redhat.com>
[AF/ehabkost: Updated for s390-ccw machines]
[AF: Cleanup of intermediate virt and vexpress name handling]
Signed-off-by: Andreas Färber <afaerber@suse.de>
8 years agomachine: Ensure all TYPE_MACHINE subclasses have the right suffix
Eduardo Habkost [Thu, 20 Aug 2015 21:54:35 +0000 (14:54 -0700)]
machine: Ensure all TYPE_MACHINE subclasses have the right suffix

Now that all non-abstract TYPE_MACHINE subclasses have the -machine
suffix, add an assert to ensure this will be always true.

Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Reviewed-by: Marcel Apfelbaum <marcel@redhat.com>
Signed-off-by: Andreas Färber <afaerber@suse.de>
8 years agomac99: Use MACHINE_TYPE_NAME to encode class name
Eduardo Habkost [Thu, 20 Aug 2015 21:54:34 +0000 (14:54 -0700)]
mac99: Use MACHINE_TYPE_NAME to encode class name

It will result in exactly the same class name, but it will make the code
consistent with the other classes.

Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Andreas Färber <afaerber@suse.de>
8 years agos390: Rename s390-ccw-virtio-2.4 class name to use MACHINE_TYPE_NAME
Eduardo Habkost [Thu, 20 Aug 2015 21:54:33 +0000 (14:54 -0700)]
s390: Rename s390-ccw-virtio-2.4 class name to use MACHINE_TYPE_NAME

Machine class names should use the "-machine" suffix to allow
class-name-based machine class lookup to work. Rename the
s390-ccw-virtio-2.4 machine class using the MACHINE_TYPE_NAME macro.

Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
[AF/ehabkost: Updated for 2.5 machine]
Signed-off-by: Andreas Färber <afaerber@suse.de>
8 years agos390-virtio: Rename machine class name to use MACHINE_TYPE_NAME
Eduardo Habkost [Thu, 20 Aug 2015 21:54:32 +0000 (14:54 -0700)]
s390-virtio: Rename machine class name to use MACHINE_TYPE_NAME

Machine class names should use the "-machine" suffix to allow
class-name-based machine class lookup to work. Rename the s390-virtio
machine class using the MACHINE_TYPE_NAME macro.

Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
Acked-by: Cornelia Huck <cornelia.huck@de.ibm.com>
Signed-off-by: Andreas Färber <afaerber@suse.de>
8 years agopseries: Rename machine class names to use MACHINE_TYPE_NAME
Eduardo Habkost [Thu, 20 Aug 2015 21:54:31 +0000 (14:54 -0700)]
pseries: Rename machine class names to use MACHINE_TYPE_NAME

Machine class names should use the "-machine" suffix to allow
class-name-based machine class lookup to work. Rename the the pseries
machine classes using the MACHINE_TYPE_NAME macro.

Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Andreas Färber <afaerber@suse.de>
8 years agoarm: Rename virt machine class to use MACHINE_TYPE_NAME
Eduardo Habkost [Thu, 20 Aug 2015 21:54:30 +0000 (14:54 -0700)]
arm: Rename virt machine class to use MACHINE_TYPE_NAME

Machine class names should use the "-machine" suffix to allow
class-name-based machine class lookup to work. Rename the arm virt
machine class using the MACHINE_TYPE_NAME macro.

Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Andreas Färber <afaerber@suse.de>
8 years agovexpress: Rename machine classes to use MACHINE_TYPE_NAME
Eduardo Habkost [Thu, 20 Aug 2015 21:54:29 +0000 (14:54 -0700)]
vexpress: Rename machine classes to use MACHINE_TYPE_NAME

Machine class names should use the "-machine" suffix to allow
class-name-based machine class lookup to work. Rename the vexpress
machine classes using the MACHINE_TYPE_NAME macro.

Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
[AF: Introduce VEXPRESS_*_MACHINE_NAME]
Signed-off-by: Andreas Färber <afaerber@suse.de>
8 years agovexpress: Don't set name on abstract class
Eduardo Habkost [Thu, 20 Aug 2015 21:54:28 +0000 (14:54 -0700)]
vexpress: Don't set name on abstract class

The MachineClass::name field won't be ever be used on TYPE_VEXPRESS, as
it is an abstract class and the machine class lookup code explicitly
skips abstract classes. We can remove it to make the code simpler.

Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Andreas Färber <afaerber@suse.de>
8 years agomachine: MACHINE_TYPE_NAME macro
Eduardo Habkost [Thu, 20 Aug 2015 21:54:27 +0000 (14:54 -0700)]
machine: MACHINE_TYPE_NAME macro

The macro will be useful to ensure the machine class names follow the
right format to make machine class lookup by class name work correctly.

Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Reviewed-by: Marcel Apfelbaum <marcel@redhat.com>
Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Andreas Färber <afaerber@suse.de>
8 years agotcg/mips: pass oi to tcg_out_tlb_load
Aurelien Jarno [Fri, 10 Jul 2015 20:10:02 +0000 (22:10 +0200)]
tcg/mips: pass oi to tcg_out_tlb_load

Instead of computing mem_index and s_bits in both tcg_out_qemu_ld and
tcg_out_qemu_st function and passing them to tcg_out_tlb_load, directly
pass oi to the tcg_out_tlb_load function and compute mem_index and
s_bits there.

Reviewed-by: Richard Henderson <rth@twiddle.net>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
8 years agotcg/mips: move tcg_out_addsub2
Aurelien Jarno [Fri, 10 Jul 2015 20:04:48 +0000 (22:04 +0200)]
tcg/mips: move tcg_out_addsub2

Somehow the tcg_out_addsub2 function ended-up in the middle of the
qemu_ld/st related functions. Move it with other arithmetics related
functions.

Reviewed-by: Richard Henderson <rth@twiddle.net>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
8 years agotcg/mips: Fix clobbering of qemu_ld inputs
James Hogan [Mon, 14 Sep 2015 10:34:54 +0000 (11:34 +0100)]
tcg/mips: Fix clobbering of qemu_ld inputs

The MIPS TCG backend implements qemu_ld with 64-bit targets using the v0
register (base) as a temporary to load the upper half of the QEMU TLB
comparator (see line 5 below), however this happens before the input
address is used (line 8 to mask off the low bits for the TLB
comparison, and line 12 to add the host-guest offset). If the input
address (addrl) also happens to have been placed in v0 (as in the second
column below), it gets clobbered before it is used.

     addrl in t2              addrl in v0

 1 srl     a0,t2,0x7        srl     a0,v0,0x7
 2 andi    a0,a0,0x1fe0     andi    a0,a0,0x1fe0
 3 addu    a0,a0,s0         addu    a0,a0,s0
 4 lw      at,9136(a0)      lw      at,9136(a0)      set TCG_TMP0 (at)
 5 lw      v0,9140(a0)      lw      v0,9140(a0)      set base (v0)
 6 li      t9,-4093         li      t9,-4093
 7 lw      a0,9160(a0)      lw      a0,9160(a0)      set addend (a0)
 8 and     t9,t9,t2         and     t9,t9,v0         use addrl
 9 bne     at,t9,0x836d8c8  bne     at,t9,0x836d838  use TCG_TMP0
10  nop                      nop
11 bne     v0,t8,0x836d8c8  bne     v0,a1,0x836d838  use base
12  addu   v0,a0,t2          addu   v0,a0,v0         use addrl, addend
13 lw      t0,0(v0)         lw      t0,0(v0)

Fix by using TCG_TMP0 (at) as the temporary instead of v0 (base),
pushing the load on line 5 forward into the delay slot of the low
comparison (line 10). The early load of the addend on line 7 also needs
pushing even further for 64-bit targets, or it will clobber a0 before
we're done with it. The output for 32-bit targets is unaffected.

 srl     a0,v0,0x7
 andi    a0,a0,0x1fe0
 addu    a0,a0,s0
 lw      at,9136(a0)
-lw      v0,9140(a0)      load high comparator
 li      t9,-4093
-lw      a0,9160(a0)      load addend
 and     t9,t9,v0
 bne     at,t9,0x836d838
- nop
+ lw     at,9140(a0)      load high comparator
+lw      a0,9160(a0)      load addend
-bne     v0,a1,0x836d838
+bne     at,a1,0x836d838
  addu   v0,a0,v0
 lw      t0,0(v0)

Cc: qemu-stable@nongnu.org
Reviewed-by: Richard Henderson <rth@twiddle.net>
Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
Signed-off-by: James Hogan <james.hogan@imgtec.com>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
8 years agoqdev: Do not use slow [*] expansion for GPIO creation
Pavel Fedin [Fri, 31 Jul 2015 12:23:22 +0000 (15:23 +0300)]
qdev: Do not use slow [*] expansion for GPIO creation

Expansion of [*] suffix is very slow because index expansion is done using
trial and error strategy, starting every time from zero and retrying with
the next index until insertion succeeds. With large number of already added
properties this process takes huge amount of time (O(n^2) complexity).

Some architectures (like ARM) use very large amount of IRQ pins in interrupt
controller models. This flaw makes machine startup extremely slow
(~20 seconds for ARM64 with 32 CPUs). This patch decreases this time down to
~10 seconds.

Also in qdev_init_gpio_out_named() memset() is now called only once for the
whole array instead of per-cell cleaning

Signed-off-by: Pavel Fedin <p.fedin@samsung.com>
Reviewed-by: Daniel P. Berrange <berrange@redhat.com>
Signed-off-by: Andreas Färber <afaerber@suse.de>
8 years agoqom: Fix invalid error check in property_get_str()
Markus Armbruster [Tue, 25 Aug 2015 18:00:46 +0000 (20:00 +0200)]
qom: Fix invalid error check in property_get_str()

When a function returns a null pointer on error and only on error, you
can do

    if (!foo(foos, errp)) {
        ... handle error ...
    }

instead of the more cumbersome

    Error *err = NULL;

    if (!foo(foos, &err)) {
        error_propagate(errp, err);
        ... handle error ...
    }

A StringProperty's getter, however, may return null on success!  We
then fail to call visit_type_str().

Screwed up in 6a146eb, v1.1.

Fails tests/qom-test in my current, heavily hacked QAPI branch.  No
reproducer for master known (but I didn't look hard).

Cc: Anthony Liguori <anthony@codemonkey.ws>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Cc: qemu-stable@nongnu.org
Signed-off-by: Andreas Färber <afaerber@suse.de>
8 years agoqom: Do not reuse errp after a possible error
Markus Armbruster [Tue, 25 Aug 2015 18:00:45 +0000 (20:00 +0200)]
qom: Do not reuse errp after a possible error

The argument for an Error **errp parameter must point to a null
pointer.  If it doesn't, and an error happens, error_set() fails its
assertion.

Instead of

    foo(foos, errp);
    bar(bars, errp);

you need to do something like

    Error *err = NULL;

    foo(foos, &err);
    if (err) {
        error_propagate(errp, err);
        goto out;
    }

    bar(bars, errp);
out:

Screwed up in commit 0e55884 (v1.3.0): property_get_bool().

Screwed up in commit 1f21772 (v2.1.0): object_property_get_enum() and
object_property_get_uint16List().

Screwed up in commit a8e3fbe (v2.4.0): property_get_enum(),
property_set_enum().

Found by inspection, no actual crashes observed.

Fix them up.

Cc: Anthony Liguori <anthony@codemonkey.ws>
Cc: Hu Tao <hutao@cn.fujitsu.com>
Cc: Daniel P. Berrange <berrange@redhat.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Daniel P. Berrange <berrange@redhat.com>
Cc: qemu-stable@nongnu.org
Signed-off-by: Andreas Färber <afaerber@suse.de>
8 years agococoa: Suppress Cocoa window with -display
Rainer Müller [Wed, 9 Sep 2015 14:08:30 +0000 (16:08 +0200)]
cocoa: Suppress Cocoa window with -display

Do not open a Cocoa window when another display is selected that will be
initialized later. The Cocoa display cannot be selected with -display,
so there is no need to check its argument.

Signed-off-by: Rainer Müller <raimue@codingfarm.de>
Reviewed-by: Andreas Färber <andreas.faerber@web.de>
Message-id: 1441807710-25431-1-git-send-email-raimue@codingfarm.de
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
8 years agoMerge remote-tracking branch 'remotes/jnsnow/tags/ide-pull-request' into staging
Peter Maydell [Fri, 18 Sep 2015 15:57:59 +0000 (16:57 +0100)]
Merge remote-tracking branch 'remotes/jnsnow/tags/ide-pull-request' into staging

# gpg: Signature made Fri 18 Sep 2015 15:59:02 BST using RSA key ID AAFC390E
# gpg: Good signature from "John Snow (John Huston) <jsnow@redhat.com>"

* remotes/jnsnow/tags/ide-pull-request:
  ahci: clean up initial d2h semantics
  ahci: remove cmd_fis argument from write_fis_d2h
  ahci: fix signature generation
  ahci: remove dead reset code
  atapi: abort transfers with 0 byte limits
  ide: fix ATAPI command permissions
  ide-test: add cdrom dma test
  ide-test: add cdrom pio test
  qtest/ahci: export generate_pattern
  qtest/ahci: use generate_pattern everywhere
  ide: unify io_buffer_offset increments

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
8 years agoahci: clean up initial d2h semantics
John Snow [Tue, 1 Sep 2015 20:50:41 +0000 (16:50 -0400)]
ahci: clean up initial d2h semantics

with write_fis_d2h and signature generation tidied up,
let's adjust the initial d2h semantics to make more sense.

The initial d2h is considered delivered if there is guest
memory to save it to.

Signed-off-by: John Snow <jsnow@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 1441140641-17631-5-git-send-email-jsnow@redhat.com

8 years agoahci: remove cmd_fis argument from write_fis_d2h
John Snow [Tue, 1 Sep 2015 20:50:40 +0000 (16:50 -0400)]
ahci: remove cmd_fis argument from write_fis_d2h

It's no longer used. We used to generate a D2H FIS based
upon the command FIS that prompted the update, but in reality,
the D2H FIS is generated purely from register state.

cmd_fis is vestigial, so get rid of it.

Signed-off-by: John Snow <jsnow@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 1441140641-17631-4-git-send-email-jsnow@redhat.com

8 years agoahci: fix signature generation
John Snow [Tue, 1 Sep 2015 20:50:39 +0000 (16:50 -0400)]
ahci: fix signature generation

The initial register device-to-host FIS no longer needs to specially
set certain fields, as these can be handled generically by setting those
fields explicitly with the signatures we want at port reset time.

(1) Signatures are decomposed into their four component registers and
    set upon (AHCI) port reset.
(2) the signature cache register is no longer set manually per-each
    device type, but instead just once during ahci_init_d2h.

Signed-off-by: John Snow <jsnow@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 1441140641-17631-3-git-send-email-jsnow@redhat.com

8 years agoahci: remove dead reset code
John Snow [Tue, 1 Sep 2015 20:50:38 +0000 (16:50 -0400)]
ahci: remove dead reset code

This check is dead due to an earlier conditional.
AHCI does not currently support hotplugging, so
checks to see if devices are present or not are useless.

Remove it.

Reported-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: John Snow <jsnow@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 1441140641-17631-2-git-send-email-jsnow@redhat.com

8 years agoatapi: abort transfers with 0 byte limits
John Snow [Thu, 17 Sep 2015 18:17:05 +0000 (14:17 -0400)]
atapi: abort transfers with 0 byte limits

We're supposed to abort on transfers like this, unless we fill
Word 125 of our IDENTIFY data with a default transfer size, which
we don't currently do.

This is an ATA error, not a SCSI/ATAPI one.
See ATA8-ACS3 sections 7.17.6.49 or 7.21.5.

If we don't do this, QEMU will loop forever trying to transfer
zero bytes, which isn't particularly useful.

Signed-off-by: John Snow <jsnow@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Message-id: 1442253685-23349-2-git-send-email-jsnow@redhat.com

8 years agoide: fix ATAPI command permissions
John Snow [Thu, 17 Sep 2015 18:17:05 +0000 (14:17 -0400)]
ide: fix ATAPI command permissions

We're a little too lenient with what we'll let an ATAPI drive handle.
Clamp down on the IDE command execution table to remove CD_OK permissions
from commands that are not and have never been ATAPI commands.

For ATAPI command validity, please see:
- ATA4 Section 6.5 ("PACKET Command feature set")
- ATA8/ACS Section 4.3 ("The PACKET feature set")
- ACS3 Section 4.3 ("The PACKET feature set")

ACS3 has a historical command validity table in Table B.4
("Historical Command Assignments") that can be referenced to find when
a command was introduced, deprecated, obsoleted, etc.

The only reference for ATAPI command validity is by checking that
version's PACKET feature set section.

ATAPI was introduced by T13 into ATA4, all commands retired prior to ATA4
therefore are assumed to have never been ATAPI commands.

Mandatory commands, as listed in ATA8-ACS3, are:

- DEVICE RESET
- EXECUTE DEVICE DIAGNOSTIC
- IDENTIFY DEVICE
- IDENTIFY PACKET DEVICE
- NOP
- PACKET
- READ SECTOR(S)
- SET FEATURES

Optional commands as listed in ATA8-ACS3, are:

- FLUSH CACHE
- READ LOG DMA EXT
- READ LOG EXT
- WRITE LOG DMA EXT
- WRITE LOG EXT

All other commands are illegal to send to an ATAPI device and should
be rejected by the device.

CD_OK removal justifications:

0x06 WIN_DSM              Defined in ACS2. Not valid for ATAPI.
0x21 WIN_READ_ONCE        Retired in ATA5. Not ATAPI in ATA4.
0x94 WIN_STANDBYNOW2      Retired in ATA4. Did not coexist with ATAPI.
0x95 WIN_IDLEIMMEDIATE2   Retired in ATA4. Did not coexist with ATAPI.
0x96 WIN_STANDBY2         Retired in ATA4. Did not coexist with ATAPI.
0x97 WIN_SETIDLE2         Retired in ATA4. Did not coexist with ATAPI.
0x98 WIN_CHECKPOWERMODE2  Retired in ATA4. Did not coexist with ATAPI.
0x99 WIN_SLEEPNOW2        Retired in ATA4. Did not coexist with ATAPI.
0xE0 WIN_STANDBYNOW1      Not part of ATAPI in ATA4, ACS or ACS3.
0xE1 WIN_IDLEIMMDIATE     Not part of ATAPI in ATA4, ACS or ACS3.
0xE2 WIN_STANDBY          Not part of ATAPI in ATA4, ACS or ACS3.
0xE3 WIN_SETIDLE1         Not part of ATAPI in ATA4, ACS or ACS3.
0xE4 WIN_CHECKPOWERMODE1  Not part of ATAPI in ATA4, ACS or ACS3.
0xE5 WIN_SLEEPNOW1        Not part of ATAPI in ATA4, ACS or ACS3.
0xF8 WIN_READ_NATIVE_MAX  Obsoleted in ACS3. Not ATAPI in ATA4 or ACS.

This patch fixes a divide by zero fault that can be caused by sending
the WIN_READ_NATIVE_MAX command to an ATAPI drive, which causes it to
attempt to use zeroed CHS values to perform sector arithmetic.

Reported-by: Qinghao Tang <luodalongde@gmail.com>
Signed-off-by: John Snow <jsnow@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Message-id: 1441816082-21031-1-git-send-email-jsnow@redhat.com
CC: qemu-stable@nongnu.org
8 years agoide-test: add cdrom dma test
John Snow [Thu, 17 Sep 2015 18:17:05 +0000 (14:17 -0400)]
ide-test: add cdrom dma test

Now, test the DMA functionality of the ATAPI drive.

Signed-off-by: John Snow <jsnow@redhat.com>
Message-id: 1441926555-19471-5-git-send-email-jsnow@redhat.com

8 years agoide-test: add cdrom pio test
John Snow [Thu, 17 Sep 2015 18:17:04 +0000 (14:17 -0400)]
ide-test: add cdrom pio test

Add a simple read test for ATAPI devices,
using the PIO mechanism.

Signed-off-by: John Snow <jsnow@redhat.com>
Message-id: 1441926555-19471-4-git-send-email-jsnow@redhat.com

8 years agoqtest/ahci: export generate_pattern
John Snow [Thu, 17 Sep 2015 18:17:04 +0000 (14:17 -0400)]
qtest/ahci: export generate_pattern

Share the pattern function for ide and ahci test.

Signed-off-by: John Snow <jsnow@redhat.com>
Message-id: 1441926555-19471-3-git-send-email-jsnow@redhat.com

8 years agoqtest/ahci: use generate_pattern everywhere
John Snow [Thu, 17 Sep 2015 18:17:04 +0000 (14:17 -0400)]
qtest/ahci: use generate_pattern everywhere

Fix the pattern generation to actually be interesting,
and make sure all buffers in the ahci-test actually use it.

Signed-off-by: John Snow <jsnow@redhat.com>
Message-id: 1441926555-19471-2-git-send-email-jsnow@redhat.com

8 years agoMerge remote-tracking branch 'remotes/armbru/tags/pull-error-2015-09-18' into staging
Peter Maydell [Fri, 18 Sep 2015 13:41:53 +0000 (14:41 +0100)]
Merge remote-tracking branch 'remotes/armbru/tags/pull-error-2015-09-18' into staging

Error reporting patches

# gpg: Signature made Fri 18 Sep 2015 13:42:49 BST using RSA key ID EB918653
# gpg: Good signature from "Markus Armbruster <armbru@redhat.com>"
# gpg:                 aka "Markus Armbruster <armbru@pond.sub.org>"

* remotes/armbru/tags/pull-error-2015-09-18:
  memory: Fix bad error handling in memory_region_init_ram_ptr()
  loader: Fix memory_region_init_resizeable_ram() error handling
  Fix bad error handling after memory_region_init_ram()
  error: New error_fatal
  MAINTAINERS: Add "Error reporting" entry
  error: Copy location information in error_copy()
  hmp: Allow for error message hints on HMP
  error: only prepend timestamp on stderr

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
8 years agomemory: Fix bad error handling in memory_region_init_ram_ptr()
Markus Armbruster [Fri, 11 Sep 2015 14:51:45 +0000 (16:51 +0200)]
memory: Fix bad error handling in memory_region_init_ram_ptr()

Commit ef701d7 screwed up handling of out-of-memory conditions.
Before the commit, we report the error and exit(1), in one place.  The
commit lifts the error handling up the call chain some, to three
places.  Fine.  Except it uses &error_abort in these places, changing
the behavior from exit(1) to abort(), and thus undoing the work of
commit 3922825 "exec: Don't abort when we can't allocate guest
memory".

The previous two commits fixed one of the three places, another one
was fixed in commit 33e0eb5.  This commit fixes the third one.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-Id: <1441983105-26376-5-git-send-email-armbru@redhat.com>
Reviewed-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
8 years agoloader: Fix memory_region_init_resizeable_ram() error handling
Markus Armbruster [Fri, 11 Sep 2015 14:51:44 +0000 (16:51 +0200)]
loader: Fix memory_region_init_resizeable_ram() error handling

Commit ef701d7 screwed up handling of out-of-memory conditions.
Before the commit, we report the error and exit(1), in one place.  The
commit lifts the error handling up the call chain some, to three
places.  Fine.  Except it uses &error_abort in these places, changing
the behavior from exit(1) to abort(), and thus undoing the work of
commit 3922825 "exec: Don't abort when we can't allocate guest
memory".

The previous commit fixed up uses of memory_region_init_ram().  One of
them was replaced by memory_region_init_resizeable_ram() [sic!] in
commit a166614, so Coccinelle missed it.  Fix it up.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-Id: <1441983105-26376-4-git-send-email-armbru@redhat.com>
Reviewed-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
8 years agoFix bad error handling after memory_region_init_ram()
Markus Armbruster [Fri, 11 Sep 2015 14:51:43 +0000 (16:51 +0200)]
Fix bad error handling after memory_region_init_ram()

Symptom:

    $ qemu-system-x86_64 -m 10000000
    Unexpected error in ram_block_add() at /work/armbru/qemu/exec.c:1456:
    upstream-qemu: cannot set up guest memory 'pc.ram': Cannot allocate memory
    Aborted (core dumped)

Root cause: commit ef701d7 screwed up handling of out-of-memory
conditions.  Before the commit, we report the error and exit(1), in
one place, ram_block_add().  The commit lifts the error handling up
the call chain some, to three places.  Fine.  Except it uses
&error_abort in these places, changing the behavior from exit(1) to
abort(), and thus undoing the work of commit 3922825 "exec: Don't
abort when we can't allocate guest memory".

The three places are:

* memory_region_init_ram()

  Commit 4994653 (right after commit ef701d7) lifted the error
  handling further, through memory_region_init_ram(), multiplying the
  incorrect use of &error_abort.  Later on, imitation of existing
  (bad) code may have created more.

* memory_region_init_ram_ptr()

  The &error_abort is still there.

* memory_region_init_rom_device()

  Doesn't need fixing, because commit 33e0eb5 (soon after commit
  ef701d7) lifted the error handling further, and in the process
  changed it from &error_abort to passing it up the call chain.
  Correct, because the callers are realize() methods.

Fix the error handling after memory_region_init_ram() with a
Coccinelle semantic patch:

    @r@
    expression mr, owner, name, size, err;
    position p;
    @@
            memory_region_init_ram(mr, owner, name, size,
    (
    -                              &error_abort
    +                              &error_fatal
    |
                                   err@p
    )
                                  );
    @script:python@
        p << r.p;
    @@
    print "%s:%s:%s" % (p[0].file, p[0].line, p[0].column)

When the last argument is &error_abort, it gets replaced by
&error_fatal.  This is the fix.

If the last argument is anything else, its position is reported.  This
lets us check the fix is complete.  Four positions get reported:

* ram_backend_memory_alloc()

  Error is passed up the call chain, ultimately through
  user_creatable_complete().  As far as I can tell, it's callers all
  handle the error sanely.

* fsl_imx25_realize(), fsl_imx31_realize(), dp8393x_realize()

  DeviceClass.realize() methods, errors handled sanely further up the
  call chain.

We're good.  Test case again behaves:

    $ qemu-system-x86_64 -m 10000000
    qemu-system-x86_64: cannot set up guest memory 'pc.ram': Cannot allocate memory
    [Exit 1 ]

The next commits will repair the rest of commit ef701d7's damage.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-Id: <1441983105-26376-3-git-send-email-armbru@redhat.com>
Reviewed-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
8 years agoerror: New error_fatal
Markus Armbruster [Fri, 11 Sep 2015 14:51:42 +0000 (16:51 +0200)]
error: New error_fatal

Similar to error_abort, but doesn't report where the error was
created, and terminates the process with exit(1) rather than abort().

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-Id: <1441983105-26376-2-git-send-email-armbru@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
8 years agoMAINTAINERS: Add "Error reporting" entry
Markus Armbruster [Sat, 12 Sep 2015 11:29:56 +0000 (13:29 +0200)]
MAINTAINERS: Add "Error reporting" entry

Error reporting work has been flowing through my tree for a while.
Time for MAINTAINERS to catch up.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-Id: <1442057396-21989-1-git-send-email-armbru@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
8 years agoerror: Copy location information in error_copy()
Eric Blake [Thu, 10 Sep 2015 16:34:50 +0000 (10:34 -0600)]
error: Copy location information in error_copy()

Commit 1e9b65bb forgot to propagate source information to copied
errors.

Signed-off-by: Eric Blake <eblake@redhat.com>
Message-Id: <1441902890-23064-1-git-send-email-eblake@redhat.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
8 years agohmp: Allow for error message hints on HMP
Eric Blake [Thu, 10 Sep 2015 16:19:16 +0000 (10:19 -0600)]
hmp: Allow for error message hints on HMP

Commits 7216ae3d and d2828429 disabled some error message hints,
all because a change to use modern error reporting meant that the
hint would be output prior to the actual error.  Fix this by making
hints a first-class member of Error.

For example, we are now back to the pleasant:

 $ qemu-system-x86_64 --nodefaults -S --vnc :0 --chardev null,id=,
 qemu-system-x86_64: --chardev null,id=,: Parameter 'id' expects an identifier
 Identifiers consist of letters, digits, '-', '.', '_', starting with a letter.

Signed-off-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Message-Id: <1441901956-21991-1-git-send-email-eblake@redhat.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
8 years agoerror: only prepend timestamp on stderr
Stefan Hajnoczi [Mon, 10 Aug 2015 13:15:41 +0000 (14:15 +0100)]
error: only prepend timestamp on stderr

The -msg timestamp=on option prepends a timestamp to error messages.
This is useful on stderr where it allows users to identify when an error
was raised.

Timestamps do not make sense on the monitor since error_report() is
called in response to a synchronous monitor command and the user already
knows "when" the command was issued.  Additionally, the rest of the
monitor conversation lacks timestamps so the error timestamp cannot be
correlated with other activity.

Only prepend timestamps on stderr.  This fixes libvirt's 'drive_del'
processing, which did not expect a timestamp.  Other QEMU monitor
clients are probably equally confused by timestamps on monitor error
messages.

Cc: Markus Armbruster <armbru@redhat.com>
Cc: Seiji Aguchi <seiji.aguchi@hds.com>
Cc: Frank Schreuder <fschreuder@transip.nl>
Cc: Daniel P. Berrange <berrange@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-Id: <1439212541-16997-1-git-send-email-stefanha@redhat.com>
Reviewed-by: Daniel P. Berrange <berrange@redhat.com>
Tested-by: Frank Schreuder <fschreuder@transip.nl>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
8 years agoMerge remote-tracking branch 'remotes/lalrae/tags/mips-20150918' into staging
Peter Maydell [Fri, 18 Sep 2015 11:55:27 +0000 (12:55 +0100)]
Merge remote-tracking branch 'remotes/lalrae/tags/mips-20150918' into staging

MIPS patches 2015-09-18

Changes:
* fixes for rdhwr, tlbwr, mtc0, recip.fmt, rsqrt.fmt and daui instructions
* removal of MIPS_DEBUG code
* use tcg_gen_extrh_i64_i32()
* improve random tlb index generation in cpu_mips_get_random()
* exception handling improvements to correctly restore icount

# gpg: Signature made Fri 18 Sep 2015 12:15:28 BST using RSA key ID 0B29DA6B
# gpg: Good signature from "Leon Alrae <leon.alrae@imgtec.com>"

* remotes/lalrae/tags/mips-20150918:
  target-mips: improve exception handling
  target-mips: correct MTC0 instruction on MIPS64
  target-mips: add missing restriction in DAUI instruction
  target-mips: fix corner case in TLBWR causing QEMU to hang
  pic32: use LCG algorithm for generated random index of TLBWR instruction
  target-mips: get rid of MIPS_DEBUG_SIGN_EXTENSIONS
  target-mips: get rid of MIPS_DEBUG
  target-mips: Fix RDHWR on CP0.Count
  target-mips: remove wrong checks for recip.fmt and rsqrt.fmt
  target-mips: Use tcg_gen_extrh_i64_i32

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>