rtl8139: support byte read to TxStatus registers

Some drivers (such as win7) use byte read for TxStatus registers, so we need to
support this to let guest driver behave correctly.

For writing, only double-word access is allowed by spec.

Signed-off-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
net: move compute_mcast_idx() to net.h

Reduce duplicated codes.

Signed-off-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
rtl8139: correctly check the opmode

According to the spec, only when opmode is "Config. Register Write
Enable" could driver write to CONFIG0,1,3,4 and bits 13,12,8 of BMCR.

Currently, we allow modifying to those registers also when 8139 is in
"Auto-load" mode and "93C46 (93C56) Programming" mode. This patch
fixes this.

Signed-off-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
rtl8139: do the network/host communication only in normal operating mode

According the spec, the card works in network/host communication mode only when
both EEM1 and EEM0 are unset in 93C46 Command Register (normal op
mode). So this patch check these bits before trying to receive packets.

As some guest driver (such as linux, see cp_init_hw() in 8139cp.c)
allocate rx ring after the recevier were enabled, this would cause our
emulation codes tries to dma into guest memory when the rx descriptor
is not properly configured. This patch fixes this.

Signed-off-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Merge upstream master into qemu-linaro
gdbstub: Synchronize CPU state unconditionally in gdb_set_cpu_pc

Synchronize the CPU state via cpu_sychronize_state() unconditionally
in gdb_set_cpu_pc() rather than only in some of the target ifdef
ladder cases.

We can divide the CPUs into three categories:
 * non-KVM targets: no change of behaviour since we will use the
   kvm-stub.c no-op function.
 * i386 and s390: no change of behaviour since they were already
   calling this function
 * PPC (in KVM mode): this fixes an error: failing to synchronise
   was accidental and probably a bug.

This also paves the way for other targets (specifically ARM) which
can add KVM support in future without having to add another target
specific change to this bit of code.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
linux-headers/asm-arm: Update ARM KVM headers

Update the ARM KVM headers to the version in
git://github.com/virtualopensystems/linux-kvm-arm kvm-a15-v7
(commit 827ee5b). There are no conflicting or required changes
in the non-ARM-specific KVM headers so those are left untouched.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
arm: kvm: Fix register sync and some GDB support

The register copies between the kernel and QEMU did not properly
consider QEMUs mode of putting all current registers in a given array
regardless of the mode and at the same time having banked registers for
the same registers. With this commit we should be sure to be in sync
always.

Also introduces a little bit of GDB support. QEMU does indeed translate
virtual addresses to physical by reading guest memory directly in order
to access guest memory for debugging, so guest LPAE support with GDB
would rely on having the LPAE page table format supported in QEMU.

Signed-off-by: Christoffer Dall <c.dall@virtualopensystems.com>
ARM: Remove unnecessary subpage workarounds

In the ARM per-CPU peripherals (GIC, private timers, SCU, etc),
remove workarounds for subpage memory region read/write functions
being passed offsets from the start of the page rather than the
start of the region. Following commit 5312bd8b3 the masking off
of high bits of the address offset is now harmless but unnecessary.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Andreas Färber <afaerber@suse.de>
hw/pxa2xx_dma.c: drop target_phys_addr_t usage in device state

Pxa2xx DMA controller is a 32-bit device and it has no knowledge of system's
physical address size, so it should not use target_phys_addr_t in it's state.
Convert variables descr, src and dest from type target_phys_addr_t to uint32_t,
use VMSTATE_UINT32 instead of VMSTATE_UINTTL for these variables.

We can do this safely because:
1) pxa2xx actually has 32-bit physical address size;
2) rest of the code in file never assumes descr, src and dest variables to have
size different from uint32_t;
3) we shouldn't have used VMSTATE_UINTTL in the first place because this macro
is for target_ulong type (which can be different from target_phys_addr_t).

Signed-off-by: Igor Mitsyanko <i.mitsyanko@samsung.com>
Reviewed-by: Andreas Färber <afaerber@suse.de>
Reviewed-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
hw/pxa2xx_lcd.c: drop target_phys_addr_t usage in device state

Pxa2xx LCD controller is intended to work with 32-bit bus and it has no knowledge
of system's physical address size, so it should not use target_phys_addr_t in it's
state. Convert three variables in DMAChannel state from target_phys_addr_t to uint32_t,
use VMSTATE_UINT32 instead of VMSTATE_UINTTL for these variables.
We can do this safely because:
1) pxa2xx has 32-bit physical address;
2) rest of the code in file never assumes converted variables to have any size
different from uint32_t;
3) we shouldn't have used VMSTATE_UINTTL in the first place because this macro
is for target_ulong type (which can be different from target_phys_addr_t).

Signed-off-by: Igor Mitsyanko <i.mitsyanko@samsung.com>
Reviewed-by: Andreas Färber <afaerber@suse.de>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
hw/pxa2xx.c: Fix handling of pxa2xx_i2c variable offset within region

The pxa2xx I2C controller can have its registers at an arbitrary offset
within the MemoryRegion it creates. We use this to create two controllers,
one which covers a region of size 0x10000 with registers starting at an
offset 0x1600 into that region, and a second one which covers a region
of size just 0x100 with the registers starting at the base of the region.

The implementation of this offsetting uses two qdev properties, "offset"
(which sets the offset which must be subtracted from the address to
get the offset into the actual register bank) and "size", which is the
size of the MemoryRegion. We were actually using "offset" for two
purposes: firstly the required one of handling the registers not being
at the base of the MemoryRegion, and secondly as a workaround for a
deficiency of QEMU. Until commit 5312bd8b3, if a MemoryRegion was mapped
at a non-page boundary, the address passed into the read and write
functions would be the offset from the start of the page, not the
offset from the start of the MemoryRegion. So when calculating the value
to set the "offset" qdev property we included a rounding to a page
boundary.

Following commit 5312bd8b3 MemoryRegion read/write functions are now
correctly passed the offset from the base of the region, and our
workaround now means we're subtracting too much from addresses, resulting
in warnings like "pxa2xx_i2c_read: Bad register 0xffffff90".
The fix for this is simply to remove the rounding to a page boundary;
this allows us to slightly simplify the expression since
  base - (base & (~region_size)) == base & region_size

The qdev property "offset" itself must remain because it is still
performing its primary job of handling register banks not being at
the base of the MemoryRegion.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Andreas Färber <afaerber@suse.de>
pci: fix double free of romfile property

The qdev property release function frees any string properties.  This was
resulting in a double free during hot unplug.

It manifests in network devices because block devices have a NULL romfile
property by default.

Cc: Michael Tsirkin <mst@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
Merge remote-tracking branch 'kraxel/seabios-1.6.3.2' into staging

* kraxel/seabios-1.6.3.2:
  Update seabios to 1.6.3.2
  Add seabios build scripts to roms/
Fix large memory chunks allocation with tcg_malloc.

An attempt to allocate a large memory chunk after a small one resulted in
circular links in list of pools.  It caused the same memory being
allocated twice for different arrays.

Now pools for large memory chunks are kept in separate list and are
freed during pool reset because current allocator can not reuse them.

Signed-off-by: Kirill Batuzov <batuzovk@ispras.ru>
Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
vmstate: fix varrays with uint32_t indexes

VMSTATE_VARRAY_UINT32() is used in hw/ds1225y.c, and we checked
VMS_VARRAY_UINT32 bit of field->flags in vmstate_load_state(),
but we don't check this bit in vmstate_save_state().

Signed-off-by: Amos Kong <akong@redhat.com>
Acked-by: Juan Quintela <quintela@redhat.com>
Acked-by: Hervé Poussineau <hpoussin@reactos.org>
Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
Merge branch 'ppc-for-upstream' of git://repo.or.cz/qemu/agraf

* 'ppc-for-upstream' of git://repo.or.cz/qemu/agraf:
  PPC: Fix openpic with relative memregions
  pseries: Configure PCI bridge using properties
  PPC: KVM: Synchronize regs on CPU dump
  kvm: Comparison with ioctl number macros needs to be unsigned
  ppc: Correctly define POWERPC_INSNS2_DEFAULT
  pseries: Add support for level interrupts to XICS
  PPC: Fix large page support in TCG
  PPC: Add PIR register to POWER7 CPU
  pseries: Remove PCI device from PCI host bridge code
  pseries: Remove unused constant from PCI code
  pseries: Update SLOF firmware image
  PPC64: Add support for ldbrx and stdbrx instructions
  pseries: Don't try to munmap() a malloc()ed TCE table
  ppc: Add missing 'static' to spin_rw_ops
  PPC: 405: Fix ppc405ep initialization
  Bad zero comparison for sas_ss_flags on powerpc
Merge branch 'malta' of git://qemu.weilnetz.de/qemu

* 'malta' of git://qemu.weilnetz.de/qemu:
  malta: Fix display for LED array
  malta: Use symbolic hardware addresses
  malta: Always allocate flash memory
  malta: Clean allocation of bios region alias
Merge branch 'target-arm.for-upstream' of git://git.linaro.org/people/pmaydell/qemu-arm

* 'target-arm.for-upstream' of git://git.linaro.org/people/pmaydell/qemu-arm:
  target-arm: Decode SETEND correctly in Thumb
  target-arm: Clear IT bits when taking exceptions in v7M
  target-arm: Fix typo in ARM946 cp15 c5 handling
softfloat: fix for C99

C99 appears to consider compound literals as non-constants, and complains
when they are used in static initializers.  Switch to ordinary initializer
syntax.

Signed-off-by: Avi Kivity <avi@redhat.com>
Acked-by: Andreas Färber <afaerber@suse.de>
Reported-by: Andreas Färber <andreas.faerber@web.de>
Signed-off-by: Blue Swirl <blauwirbel@gmail.com>