block: change discard to co_discard

Since coroutine operation is now mandatory, convert both bdrv_discard
implementations to coroutines.  For qcow2, this means taking the lock
around the operation.  raw-posix remains synchronous.

The bdrv_discard callback is then unused and can be eliminated.

Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>

block: change flush to co_flush

Since coroutine operation is now mandatory, convert all bdrv_flush
implementations to coroutines.  For qcow2, this means taking the lock.
Other implementations are simpler and just forward bdrv_flush to the
underlying protocol, so they can avoid the lock.

The bdrv_flush callback is then unused and can be eliminated.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>

block: take lock around bdrv_write implementations

This does the first part of the conversion to coroutines, by
wrapping bdrv_write implementations to take the mutex.

Drivers that implement bdrv_write rather than bdrv_co_writev can
then benefit from asynchronous operation (at least if the underlying
protocol supports it, which is not the case for raw-win32), even
though they still operate with a bounce buffer.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>

block: take lock around bdrv_read implementations

This does the first part of the conversion to coroutines, by
wrapping bdrv_read implementations to take the mutex.

Drivers that implement bdrv_read rather than bdrv_co_readv can
then benefit from asynchronous operation (at least if the underlying
protocol supports it, which is not the case for raw-win32), even
though they still operate with a bounce buffer.

raw-win32 does not need the lock, because it cannot yield.
nbd also doesn't probably, but better be safe.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>

block: add a CoMutex to synchronous read drivers

The big conversion of bdrv_read/write to coroutines caused the two
homonymous callbacks in BlockDriver to become reentrant.  It goes
like this:

1) bdrv_read is now called in a coroutine, and calls bdrv_read or
bdrv_pread.

2) the nested bdrv_read goes through the fast path in bdrv_rw_co_entry;

3) in the common case when the protocol is file, bdrv_co_do_readv calls
bdrv_co_readv_em (and from here goes to bdrv_co_io_em), which yields
until the AIO operation is complete;

4) if bdrv_read had been called from a bottom half, the main loop
is free to iterate again: a device model or another bottom half
can then come and call bdrv_read again.

This applies to all four of read/write/flush/discard.  It would also
apply to is_allocated, but it is not used from within coroutines:
besides qemu-img.c and qemu-io.c, which operate synchronously, the
only user is the monitor.  Copy-on-read will introduce a use in the
block layer, and will require converting it.

The solution is "simply" to convert all drivers to coroutines!  We
just need to add a CoMutex that is taken around affected operations.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>

vmdk: clean up open

Move vmdk_parent_open to vmdk_open.  There's another path how
vmdk_parent_open can be reached:

  vmdk_parse_extents() ->  vmdk_open_sparse() ->  vmdk_open_vmdk4() ->
  vmdk_open_desc_file().

If that can happen, however, the code is bogus.  vmdk_parent_open
reads from bs->file:

    if (bdrv_pread(bs->file, s->desc_offset, desc, DESC_SIZE) != DESC_SIZE) {

but it is always called with s->desc_offset == 0 and with the same
bs->file.  So the data that vmdk_parent_open reads comes always from the
same place, and anyway there is only one place where it can write it,
namely bs->backing_file.

So, if it cannot happen, the patched code is okay.

It is also possible that the recursive call can happen, but only once.  In
that case there would still be a bug in vmdk_open_desc_file setting
s->desc_offset = 0, but the patched code is okay.

Finally, in the case where multiple recursive calls can happen the code
would need to be rewritten anyway.  It is likely that this would anyway
involve adding several parameters to vmdk_parent_open, and calling it from
vmdk_open_vmdk4.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>

vmdk: fix return values of vmdk_parent_open

While vmdk_open_desc_file (touched by the patch) correctly changed -1
to -EINVAL, vmdk_open did not.  Fix it directly in vmdk_parent_open.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>

pc: Fix floppy drives with if=none

Commit 63ffb564 broke floppy devices specified on the command line like
-drive file=...,if=none,id=floppy -global isa-fdc.driveA=floppy because it
relies on drive_get() which works only with -fda/-drive if=floppy.

This patch resembles what we're already doing for IDE, i.e. remember the floppy
device that was created and use that to extract the BlockDriverStates where
needed.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>

qcow2: Fix bdrv_write_compressed error handling

If during allocation of compressed clusters the cluster was already allocated
uncompressed, fail and properly release the l2_table (the latter avoids a
failed assertion).

While at it, make it return some real error numbers instead of -1.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Dong Xu Wang <wdongxu@linux.vnet.ibm.com>

qemu-img: Don't allow preallocation and compression at the same time

Only qcow and qcow2 can do compression at all, and they require unallocated
clusters when writing the compressed data.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>

fdc: Fix floppy port I/O

The floppy device was broken by commit 212ec7ba (fdc: Convert to
isa_register_portio_list). While the old interface provided the port number
relative to the floppy drive's io_base, the new one provides the real port
number, so we need to apply a bitmask now to get the register number.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>

block: add bdrv_co_discard and bdrv_aio_discard support

This similarly adds support for coroutine and asynchronous discard.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>

block: drop redundant bdrv_flush implementation

Block drivers now only need to provide either of .bdrv_co_flush,
.bdrv_aio_flush() or for legacy drivers .bdrv_flush().  Remove
the redundant .bdrv_flush() implementations.

[Paolo Bonzini: change raw driver to bdrv_co_flush]

Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>

block: unify flush implementations

Add coroutine support for flush and apply the same emulation that
we already do for read/write.  bdrv_aio_flush is simplified to always
go through a coroutine.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>

xen_disk: Always set feature-barrier = 1

The synchronous .bdrv_flush callback doesn't exist any more and a device really
shouldn't poke into the block layer internals anyway. All drivers are supposed
to have a correctly working bdrv_flush, so let's just hard-code this.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>

fix memory leak in aio_write_f

Haven't released memory of 'ctx' before return.

Signed-off-by: Alex Jia <ajia@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>

block: rename bdrv_co_rw_bh

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>

add socket_set_block

Cc: MORITA Kazutaka <morita.kazutaka@lab.ntt.co.jp>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>

sheepdog: add coroutine_fn markers

This makes the following patch easier to review.

Cc: MORITA Kazutaka <morita.kazutaka@lab.ntt.co.jp>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>

hw/arm_gic.c: Fix save/load of irq_target array

irq_target array saving/loading is in the wrong loop.
Version bump.

Signed-off-by: Dmitry Koshelev <karaghiozis@gmail.com>
Acked-by: Andreas Färber <afaerber@suse.de>
Signed-off-by: Andrzej Zaborowski <andrew.zaborowski@intel.com>

hw/omap2: Wire up the IRQ for the 2430's fifth GPIO module

The OMAP2430 version of the omap-gpio device has five GPIO modules,
not four like the other OMAP2 versions; wire up the fifth module's
IRQ line correctly.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Andrzej Zaborowski <andrew.zaborowski@intel.com>

hw/9pfs: Fix broken compilation caused by wrong trace events

Commit c572f23a3e7180dbeab5e86583e43ea2afed6271 added trace events
with mismatching format string and arguments.

gcc reports these errors:

In file included from trace.c:2:0:
trace.h: In function ‘trace_v9fs_attach’:
trace.h:2850:9: error: too many arguments for format [-Werror=format-extra-args]
trace.h: In function ‘trace_v9fs_wstat’:
trace.h:3039:9: error: too many arguments for format [-Werror=format-extra-args]
trace.h: In function ‘trace_v9fs_mkdir’:
trace.h:3088:9: error: too many arguments for format [-Werror=format-extra-args]
trace.h: In function ‘trace_v9fs_mkdir_return’:
trace.h:3095:9: error: too many arguments for format [-Werror=format-extra-args]

Fix the format strings and also use %u instead of %d for unsigned values
in the changed strings. There are more minor errors of this kind
which I did not fix because that would make the review more difficult.

v2: Fixed position of } for v9fs_mkdir_return.

Cc: Harsh Prateek Bora <harsh@linux.vnet.ibm.com>
Signed-off-by: Stefan Weil <sw@weilnetz.de>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>

Merge remote-tracking branch 'quintela/migration-pull' into staging

Merge remote-tracking branch 'qemu-kvm-tmp/memory/batch' into staging

Merge remote-tracking branch 'aneesh/for-upstream-6' into staging

Conflicts:
trace-events

migration: make migration-{tcp,unix} consistent

Files are almost identical in functionality, just remove the
differences that make no sense.

Signed-off-by: Juan Quintela <quintela@redhat.com>
Reviewed-by: Anthony Liguori <aliguori@us.ibm.com>

migration: propagate error correctly

unix and tcp outgoing migration have error values, but didn't returned
it.  Make them return the error.  Notice that EINPROGRESS & EWOULDBLOCK
are not considered errors as call will be retry later.

Signed-off-by: Juan Quintela <quintela@redhat.com>
Reviewed-by: Anthony Liguori <aliguori@us.ibm.com>

migration: Don't use callback on file defining it

Signed-off-by: Juan Quintela <quintela@redhat.com>

migration: Make state definitions local

Signed-off-by: Juan Quintela <quintela@redhat.com>

migration: Export a function that tells if the migration has finished correctly

This will allow us to hide the state values.

Signed-off-by: Juan Quintela <quintela@redhat.com>

migration: Pass MigrationState in migration notifiers

Signed-off-by: Juan Quintela <quintela@redhat.com>

migration: Use bandwidth_limit directly

Now that current_migration always exist, there is no reason for
max_throotle variable.

Signed-off-by: Juan Quintela <quintela@redhat.com>

migration: create accessor for current_migration

Signed-off-by: Juan Quintela <quintela@redhat.com>

migration: Move exported functions to the end of the file

This means we can remove the two forward declarations.

Signed-off-by: Juan Quintela <quintela@redhat.com>
Reviewed-by: Anthony Liguori <aliguori@us.ibm.com>

migration: Remove migration cancel() callback

It is used only in one place

Signed-off-by: Juan Quintela <quintela@redhat.com>

migration: Remove get_status() accessor

It is only used inside migration.c, and fields on that struct are
accessed all around the place on that file.

Signed-off-by: Juan Quintela <quintela@redhat.com>

migration: Our release callback was just free

We called it from a single place, and always with state !=
MIG_STATE_ACTIVE.  Just remove the whole callback.  For users of the
notifier, notice that this is exactly the case where they don't care,
we are just freeing the state from previous failed migration (it can't
be a sucessful one, otherwise we would not be running on that machine
in the first place).

Signed-off-by: Juan Quintela <quintela@redhat.com>
Reviewed-by: Anthony Liguori <aliguori@us.ibm.com>

migration: Introduce migrate_fd_completed() for consistency

This function is a bit different of the others that change the state,
in the sense that if migrate_fd_cleanup() returns an error, it set the
status to error, not completed.

Signed-off-by: Juan Quintela <quintela@redhat.com>

migration: Refactor and simplify error checking in migrate_fd_put_ready

Signed-off-by: Juan Quintela <quintela@redhat.com>
Reviewed-by: Anthony Liguori <aliguori@us.ibm.com>

migration: Introduce MIG_STATE_SETUP

Use MIG_STATE_ACTIVE only when migration has really started.  Use this
new state to setup migration parameters.  Change defines for an
anonymous struct.

Signed-off-by: Juan Quintela <quintela@redhat.com>

migration: move migrate_new to do_migrate

Once there, remove all parameters that don't need to be passed to
*start_outgoing_migration() functions

Signed-off-by: Juan Quintela <quintela@redhat.com>
Reviewed-by: Anthony Liguori <aliguori@us.ibm.com>

migration: Make all posible migration functions static

I have to move two functions postions to avoid forward declarations

Signed-off-by: Juan Quintela <quintela@redhat.com>
Reviewed-by: Anthony Liguori <aliguori@us.ibm.com>

migration: Refactor MigrationState creation

Signed-off-by: Juan Quintela <quintela@redhat.com>
Reviewed-by: Anthony Liguori <aliguori@us.ibm.com>

migration: Rename FdMigrationState MigrationState

Signed-off-by: Juan Quintela <quintela@redhat.com>
Reviewed-by: Anthony Liguori <aliguori@us.ibm.com>

migration: Fold MigrationState into FdMigrationState

Signed-off-by: Juan Quintela <quintela@redhat.com>
Reviewed-by: Anthony Liguori <aliguori@us.ibm.com>

migration: Use FdMigrationState instead of MigrationState when possible

Signed-off-by: Juan Quintela <quintela@redhat.com>
Reviewed-by: Anthony Liguori <aliguori@us.ibm.com>

migration: Make *start_outgoing_migration return FdMigrationState

Signed-off-by: Juan Quintela <quintela@redhat.com>
Reviewed-by: Anthony Liguori <aliguori@us.ibm.com>

migration: make *save_live return errors

Make *save_live() return negative values when there is one error, and
updates all callers to check for the error.

Signed-off-by: Juan Quintela <quintela@redhat.com>

migration: use qemu_file_get_error() return value when possible

Signed-off-by: Juan Quintela <quintela@redhat.com>

savevm: Rename has_error to last_error field

Now the field contains the last error name, so rename acordingly.

Signed-off-by: Juan Quintela <quintela@redhat.com>
Reviewed-by: Anthony Liguori <aliguori@us.ibm.com>

migration: rename qemu_file_has_error to qemu_file_get_error

Now the function returned errno, so it is better the new name.

Signed-off-by: Juan Quintela <quintela@redhat.com>
Reviewed-by: Anthony Liguori <aliguori@us.ibm.com>

migration: return real error code

make functions propagate errno, instead of just using -EIO.  Add a
comment about what are the return value of qemu_savevm_state_iterate().

Signed-off-by: Juan Quintela <quintela@redhat.com>

migration: change has_error to contain errno values

We normally already have an errno value.  When not, abuse EIO.

Signed-off-by: Juan Quintela <quintela@redhat.com>

migration: set error if select return one error

Signed-off-by: Juan Quintela <quintela@redhat.com>
Reviewed-by: Anthony Liguori <aliguori@us.ibm.com>

migration: don't "write" when migration is not active

If migration is not active, just ignore writes.

Signed-off-by: Juan Quintela <quintela@redhat.com>

buffered_file: reuse QEMUFile has_error field

Instead of having two has_error fields in QEMUFile & QEMUBufferedFile,
reuse the 1st one.  Notice that the one in buffered_file is only set
after a file operation.

Signed-off-by: Juan Quintela <quintela@redhat.com>
Reviewed-by: Anthony Liguori <aliguori@us.ibm.com>

buffered_file: Use right "opaque"

buffered_close 's' variable is of type QEMUFileBuffered, and
wait_for_unfreeze() expect to receive a MigrationState, that
'coincidentaly' is s->opaque.

Signed-off-by: Juan Quintela <quintela@redhat.com>
Reviewed-by: Anthony Liguori <aliguori@us.ibm.com>

migration: If there is one error, it makes no sense to continue

Once there, add a comment about what each error mean.

Signed-off-by: Juan Quintela <quintela@redhat.com>

migration: add error handling to migrate_fd_put_notify().

Although migrate_fd_put_buffer() sets MIG_STATE_ERROR if it failed,
since migrate_fd_put_notify() isn't checking error of underlying
QEMUFile, those resources are kept open.  This patch checks it and
calls migrate_fd_error() in case of error.

Signed-off-by: Yoshiaki Tamura <tamura.yoshiaki@lab.ntt.co.jp>
Signed-off-by: Juan Quintela <quintela@redhat.com>
Reviewed-by: Anthony Liguori <aliguori@us.ibm.com>

migration: Check that migration is active before cancel it

Signed-off-by: Juan Quintela <quintela@redhat.com>
Reviewed-by: Anthony Liguori <aliguori@us.ibm.com>

migration: simplify state assignmente

Once there, make sure that if we already know that there is one error,
just call migration_fd_cleanup() with the ERROR state.

Signed-off-by: Juan Quintela <quintela@redhat.com>
Reviewed-by: Anthony Liguori <aliguori@us.ibm.com>

ds1225y: Use stdio instead of QEMUFile

QEMUFile * is only intended for migration nowadays.  Using it for
anything else just adds pain and a layer of buffers for no good
reason.

Signed-off-by: Juan Quintela <quintela@redhat.com>
Reviewed-by: Anthony Liguori <aliguori@us.ibm.com>

Revert "savevm: fix corruption in vmstate_subsection_load()."

This reverts commit eb60260de0b050a5e8ab725e84d377d0b44c43ae.

Conflicts:

savevm.c

We changed qemu_peek_byte() prototype, just fixed the rejects.

Signed-off-by: Juan Quintela<quintela@redhat.com>
Reviewed-by: Anthony Liguori <aliguori@us.ibm.com>

savevm: improve subsections detection on load

We add qemu_peek_buffer, that is identical to qemu_get_buffer, just
that it don't update f->buf_index.

We add a paramenter to qemu_peek_byte() to be able to peek more than
one byte.

Once this is done, to see if we have a subsection we look:
- 1st byte is QEMU_VM_SUBSECTION
- 2nd byte is a length, and is bigger than section name
- 3rd element is a string that starts with section_name

So, we shouldn't have false positives (yes, content could still get us
wrong but probabilities are really low).

v2:
- Alex Williamsom found that we could get negative values on index.
- Rework code to fix that part.
- Rewrite qemu_get_buffer() using qemu_peek_buffer()

v3:
- return "done" on error case

v4:
- fix qemu_file_skip() off by one.

Signed-off-by: Juan Quintela <quintela@redhat.com>

savevm: define qemu_get_byte() using qemu_peek_byte()

Signed-off-by: Juan Quintela<quintela@redhat.com>

savevm: some coding style cleanups

This patch will make moving code on next patches and having checkpatch
happy easier.

Signed-off-by: Juan Quintela<quintela@redhat.com>
Reviewed-by: Anthony Liguori <aliguori@us.ibm.com>

savevm: teach qemu_fill_buffer to do partial refills

We will need on next patch to be able to lookahead on next patch

v2: rename "used" to "pending" (Alex Williams)

Signed-off-by: Juan Quintela<quintela@redhat.com>
Reviewed-by: Anthony Liguori <aliguori@us.ibm.com>

runstate: Allow user to migrate twice

It should be a matter of allowing the transition POSTMIGRATE ->
FINISH_MIGRATE, but it turns out that the VM won't do the
transition the second time because it's already stopped.

So this commit also adds vm_stop_force_state() which performs
the transition even if the VM is already stopped.

While there also allow other states to migrate.

Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>

savevm: qemu_savevm_state(): Drop stop VM logic

qemu_savevm_state() has some logic to stop the VM and to (or not to)
resume it. But this seems to be a big noop, as qemu_savevm_state()
is only called by do_savevm() when the VM is already stopped.

So, let's drop qemu_savevm_state()'s stop VM logic.

Reviewed-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Juan Quintela <quintela@redhat.com>
Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>

runstate: Allow to transition from paused to postmigrate

The user may already have paused the VM before starting the
migration process. If s/he does that, then the state will be
'paused' when we finish the migration process. In that case
we want to transition from 'paused' to 'postmigrate' as the
latter is now the real reason why the VM is stopped.

Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>

runstate: Print state transition when invalid

Makes it easier to debug.

Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>

QMP: Fix blockdev-snapshot-sync doc example

Fix wrong command name.

Reported-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>

tcx: convert to memory API

Signed-off-by: Avi Kivity <avi@redhat.com>

tc63963xb: convert to memory API

Signed-off-by: Avi Kivity <avi@redhat.com>

syborg: convert to memory API

Signed-off-by: Avi Kivity <avi@redhat.com>

sun4u: convert to memory API

Signed-off-by: Avi Kivity <avi@redhat.com>

sun4m: convert to memory API

Signed-off-by: Avi Kivity <avi@redhat.com>

strongarm: convert to memory API

Signed-off-by: Avi Kivity <avi@redhat.com>

spitz: convert to memory API

Signed-off-by: Avi Kivity <avi@redhat.com>

spapr: convert to memory API

Signed-off-by: Avi Kivity <avi@redhat.com>

sm501: convert to memory API

Signed-off-by: Avi Kivity <avi@redhat.com>

s390-virtio: convert to memory API

Signed-off-by: Avi Kivity <avi@redhat.com>

realview: convert to memory API

Signed-off-by: Avi Kivity <avi@redhat.com>

r2d: convert to memory API

Signed-off-by: Avi Kivity <avi@redhat.com>

ppcr500_mpc8544ds: convert to memory API

Signed-off-by: Avi Kivity <avi@redhat.com>

pci: simplify memory region registration

The two code paths (for ADDRESS_SPACE_IO and ADDRESS_SPACE_MEM) are
identical.  Unify them.

Signed-off-by: Avi Kivity <avi@redhat.com>

pxa2xx: convert to memory API (part II)

Signed-off-by: Avi Kivity <avi@redhat.com>

pxa2xx: convert to memory API (part I)

Signed-off-by: Avi Kivity <avi@redhat.com>

ppc_prep: convert to memory API

Signed-off-by: Avi Kivity <avi@redhat.com>

ppc_oldworld: convert to memory API

Signed-off-by: Avi Kivity <avi@redhat.com>

i8259: Move to hw library

No target-specific bits remaining, let's move it over.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: Blue Swirl <blauwirbel@gmail.com>

monitor: Restrict pic/irq_info to supporting targets

This allows to drop various stubs and move the i8359 into hwlib.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: Blue Swirl <blauwirbel@gmail.com>

i8259: Fix coding style

No functional changes.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: Blue Swirl <blauwirbel@gmail.com>

i8259: Convert to qdev

This key cleanup step requires to move the IRQ debugging bit from
i8259_set_irq directly to the per-PIC pic_set_irq, to pass the PIC
parameters (I/O base, ELCR address and mask, master/slave mode) as
qdev properties, and to interconnect the PICs with their environment via
GPIO pins.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: Blue Swirl <blauwirbel@gmail.com>

qdev: Add HEX8 property

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Reviewed-by: Andreas Färber <afaerber@suse.de>
Signed-off-by: Blue Swirl <blauwirbel@gmail.com>

i8259: Eliminate PicState2

Introduce a reference to the slave PIC for the few cases we need to
access it without a proper pointer at hand and drop PicState2. We could
even live without slave_pic if we had a better way of modeling the
cascade bus the PICs are attached to (in addition to the ISA bus).

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: Blue Swirl <blauwirbel@gmail.com>

i8259: Replace PicState::pics_state with master flag

This reflects how real PICs indentify their role (in non-buffered mode):
Pass the state of the /SP input on pic_init and use it instead of
pics_state to differentiate between master and slave mode.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: Blue Swirl <blauwirbel@gmail.com>

i8259: PREP: Replace pic_intack_read with pic_read_irq

There is nothing in the i8259 spec that justifies the special
pic_intack_read. At least the Linux PREP kernels configure the PICs
properly so that pic_read_irq returns identical values, and setting
read_reg_select in PIC0 cannot be derived from any special i8259 mode.

So switch ppc_prep to pic_read_irq and drop the now unused PIC code.

CC: Andreas Färber <andreas.faerber@web.de>
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: Blue Swirl <blauwirbel@gmail.com>

i8259: Clean up pic_ioport_read

Drop redundant local address variable.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: Blue Swirl <blauwirbel@gmail.com>

i8259: Fix poll command

This was probably never used so far: According to the spec, polling
means ack'ing the pending IRQ and setting its corresponding bit in isr.
Moreover, we have to signal a pending IRQ via bit 7 of the returned
value, and we must not return a spurious IRQ if none is pending.

This implements the poll command without the help of pic_poll_read which
is left untouched as pic_intack_read is still using it.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: Blue Swirl <blauwirbel@gmail.com>