* agraf/ppc-for-upstream: (29 commits)
  spapr: Use DeviceClass::fw_name for device tree CPU node
  target-ppc: Fill in OpenFirmware names for some PowerPCCPU families
  target-ppc: dump-guest-memory support
  dump-guest-memory: Check for the correct return value
  target-ppc: Use #define for max slb entries
  target-ppc: Check for error on address translation in memsave command
  target-ppc: Update slb array with correct index values.
  spapr-pci: enable irqfd for INTx
  xics-kvm: enable irqfd for MSI
  xics: Implement H_XIRR_X
  xics: Implement H_IPOLL
  xics-kvm: Support for in-kernel XICS interrupt controller
  xics: add cpu_setup callback
  xics: split to xics and xics-common
  xics: add missing const specifiers to TypeInfo
  xics: convert init() to realize()
  xics: add pre_save/post_load dispatchers
  xics: replace fprintf with error_report
  spapr: move cpu_setup after kvmppc_set_papr
  xics: move reset and cpu_setup
  ...

Message-id: 1382736474-32128-1-git-send-email-agraf@suse.de
Signed-off-by: NAnthony Liguori <anthony@codemonkey.ws>

* kraxel/audio.2:
  audio: honor QEMU_AUDIO_TIMER_PERIOD instead of waking up every *nano* second

Message-id: 1382622110-19460-1-git-send-email-kraxel@redhat.com
Signed-off-by: NAnthony Liguori <anthony@codemonkey.ws>

* kraxel/usb.91:
  usb-hcd-xhci: Update endpoint context dequeue pointer for streams too
  usb-hcd-xhci: Report completion of active transfer with CC_STOPPED on ep stop
  usb-hcd-xhci: Remove unused cancelled member from XHCITransfer
  usb-hcd-xhci: Remove unused sstreamsm member from XHCIStreamContext
  usb-host-libusb: Detach kernel drivers earlier
  usb-host-libusb: Configuration 0 may be a valid configuration
  usb-host-libusb: Fix reset handling

Message-id: 1382620267-18065-1-git-send-email-kraxel@redhat.com
Signed-off-by: NAnthony Liguori <anthony@codemonkey.ws>

* luiz/queue/qmp:
  monitor: eliminate monitor_event_state_lock

Message-id: 1382121003-5211-1-git-send-email-lcapitulino@redhat.com
Signed-off-by: NAnthony Liguori <anthony@codemonkey.ws>

* kraxel/e820.1:
  e820: pass high memory too.

Message-id: 1382008179-5968-1-git-send-email-kraxel@redhat.com
Signed-off-by: NAnthony Liguori <anthony@codemonkey.ws>

pci, pc, acpi fixes, enhancements

This includes some pretty big changes:
- pci master abort support by Marcel
- pci IRQ API rework by Marcel
- acpi generation support by myself

Everything has gone through several revisions, latest versions have been on
list for a while without any more comments, tested by several
people.

Please pull for 1.7.
Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>

# gpg: Signature made Tue 15 Oct 2013 07:33:48 AM CEST using RSA key ID D28D5469
# gpg: Can't check signature: public key not found

* mst/tags/for_anthony: (39 commits)
  ssdt-proc: update generated file
  ssdt: fix PBLK length
  i386: ACPI table generation code from seabios
  pc: use new api to add builtin tables
  acpi: add interface to access user-installed tables
  hpet: add API to find it
  pvpanic: add API to access io port
  ich9: APIs for pc guest info
  piix: APIs for pc guest info
  acpi/piix: add macros for acpi property names
  i386: define pc guest info
  loader: allow adding ROMs in done callbacks
  i386: add bios linker/loader
  loader: use file path size from fw_cfg.h
  acpi: ssdt pcihp: updat generated file
  acpi: pre-compiled ASL files
  acpi: add rules to compile ASL source
  i386: add ACPI table files from seabios
  q35: expose mmcfg size as a property
  q35: use macro for MCFG property name
  ...

Message-id: 1381818560-18367-1-git-send-email-mst@redhat.com
Signed-off-by: NAnthony Liguori <anthony@codemonkey.ws>

Commit 9b8c6924 (since reverted) broke the ability to boot the kernel
as the value returned by unassigned_mem_read returned non-zero and left
the kernel looping forever waiting for it to change (see
integrator_led_set in the kernel code).

Relying on a varying implementation detail is incorrect anyway so this
introduces a basic stub of a memory region for the debug/LED section
on the integrator board.
Signed-off-by: NAlex Bennée <alex@bennee.com>
Message-id: 1382451366-9539-1-git-send-email-alex.bennee@linaro.org
[PMM: removed three unused fields from struct IntegratorDebugState]
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

The compare_u64 function was not sorting the KVM cpreg_list in the
right way due to the wrong returned value.  Since we are comparing
two 64bit values we can't simply return their difference if the
returned type is int.
Signed-off-by: NAlvise Rigo <a.rigo@virtualopensystems.com>
Message-id: 1381513125-26802-2-git-send-email-a.rigo@virtualopensystems.com
[PMM: fixed coding style, indent and commit message formatting]
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Both KVM and TCG populate the cpreg_list with 64 bit register IDs,
but in the TCG side the cpreg_list is sorted using the 32 bit ID
version while in the kvm side the 64 bit ID version is used.  This
patch makes the sorting of the cpreg_list consistent between KVM and
TCG.
Signed-off-by: NAlvise Rigo <a.rigo@virtualopensystems.com>
Message-id: 1381513125-26802-1-git-send-email-a.rigo@virtualopensystems.com
[PMM: fixed indent, coding style and commit message formatting]
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Added Vector Base Address remapping on ARM v7.
Signed-off-by: NNathan Rossi <nathan.rossi@xilinx.com>
Signed-off-by: NPeter Crosthwaite <peter.crosthwaite@xilinx.com>
[PMM: removed spurious mask of value with 1<<31]
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Now that arm_load_kernel doesn't insist on a kernel filename
being present, we can remove some unnecessary conditionals
in board models.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Message-id: 1379980897-21277-3-git-send-email-peter.maydell@linaro.org

Typically ARM boards will have some kind of flash which might contain
a boot ROM; it's therefore a valid use case to provide only an
image for the boot ROM and not require QEMU's internal boot loader
at all. Remove the fatal error if -kernel isn't specified.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Message-id: 1379980897-21277-2-git-send-email-peter.maydell@linaro.org

Instead of relying on cpu_model, obtain the device tree node label
per CPU. Use DeviceClass::fw_name as source.

Whenever DeviceClass::fw_name is unknown, default to "PowerPC,UNKNOWN".

As a consequence, spapr_fixup_cpu_dt() can operate on each CPU's fw_name,
obsoleting sPAPREnvironment::cpu_model, and spapr_create_fdt_skel() can
drop its cpu_model argument.
Signed-off-by: NPrerna Saxena <prerna@linux.vnet.ibm.com>
Signed-off-by: NAndreas Färber <afaerber@suse.de>
Signed-off-by: NAlexander Graf <agraf@suse.de>

Set the expected values for POWER7, POWER7+, POWER8 and POWER5+.
Note that POWER5+ and POWER7+ are intentionally lacking the '+', so the
lack of a POWER7P family constitutes no problem.
Signed-off-by: NAndreas Färber <afaerber@suse.de>
Signed-off-by: NAlexander Graf <agraf@suse.de>

This patch add support for dumping guest memory using dump-guest-memory
monitor command.

Before patch:

(qemu) dump-guest-memory testcrash
this feature or command is not currently supported
(qemu)

After patch:

(qemu) dump-guest-memory testcrash
(qemu)

crash was able to read the file

crash> bt
PID: 0      TASK: c000000000c0d0d0  CPU: 0   COMMAND: "swapper/0"

 R0:  0000000028000084    R1:  c000000000cafa50    R2:  c000000000cb05b0
 R3:  0000000000000000    R4:  c000000000bc4cb0    R5:  0000000000000000
 R6:  001efe93b8000000    R7:  0000000000000000    R8:  0000000000000000
 R9:  b000000000001032    R10: 0000000000000001    R11: 0001eb2117e00d55
....
...

NOTE: Currently crash tools doesn't look at ELF notes in the dump on ppc64.
Signed-off-by: NAneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
Signed-off-by: NAlexander Graf <agraf@suse.de>

We should check for error with s->note_size
Signed-off-by: NAneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
Signed-off-by: NAlexander Graf <agraf@suse.de>

Instead of opencoding 64 use MAX_SLB_ENTRIES. We don't update the kernel
header here.
Signed-off-by: NAneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
Signed-off-by: NAlexander Graf <agraf@suse.de>

When we translate the virtual address to physical check for error.
Signed-off-by: NAneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
Signed-off-by: NAlexander Graf <agraf@suse.de>

Without this, a value of rb=0 and rs=0 results in replacing the 0th
index. This can be observed when using gdb remote debugging support.

(gdb) x/10i do_fork
   0xc000000000085330 <do_fork>:        Cannot access memory at address 0xc000000000085330
(gdb)

This is because when we do the slb sync via kvm_cpu_synchronize_state,
we overwrite the slb entry (0th entry) for 0xc000000000085330
Signed-off-by: NAneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
Signed-off-by: NAlexander Graf <agraf@suse.de>

This enables IRQFD for LSI (level triggered INTx interrupts) by adding
a spapr_route_intx_pin_to_irq() callback to the sPAPR PCI host bus. This
callback is called to know the global interrupt number to link resampling fd
with IRQFD's fd in KVM.
Signed-off-by: NAlexey Kardashevskiy <aik@ozlabs.ru>
Signed-off-by: NAlexander Graf <agraf@suse.de>

This enables IRQFD support for sPAPR. The feature decreases the latency
of interrupt handling.

To enable IRQFD for MSI, this sets kvm_gsi_direct_mapping to true which
enables direct MSI mapping.

To enable IRQFD for LSI (level triggered INTx interrupts), a PCI host bus
callback is required. The patch for that is coming next.
Signed-off-by: NAlexey Kardashevskiy <aik@ozlabs.ru>
Signed-off-by: NAlexander Graf <agraf@suse.de>

This implements H_XIRR_X hypercall in addition to H_XIRR as
it is mandatory for PAPR+ and there is no way for the guest to
detect whether it is supported or not so just add it.

As the Partition Adjunct Option is not supported at the moment,
the CPPR parameter of the hypercall is ignored.
Signed-off-by: NBenjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: NAlexey Kardashevskiy <aik@ozlabs.ru>
Signed-off-by: NAlexander Graf <agraf@suse.de>

This adds support for the H_IPOLL hypercall which the guest
uses to poll for a pending interrupt. This hypercall is
mandatory for PAPR+ and there is no way for the guest to
detect whether it is supported or not so just add it.
Signed-off-by: NBenjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: NAlexey Kardashevskiy <aik@ozlabs.ru>
Acked-by: NAlexander Graf <agraf@suse.de>
Signed-off-by: NAlexander Graf <agraf@suse.de>

Recent (host) kernels support emulating the PAPR defined "XICS" interrupt
controller system within KVM.  This patch allows qemu to initialize and
configure the in-kernel XICS, and keep its state in sync with qemu's XICS
state as necessary.

This should give considerable performance improvements.  e.g. on a simple
IPI ping-pong test between hardware threads, using qemu XICS gives us
around 5,000 irqs/second, whereas the in-kernel XICS gives us around
70,000 irqs/s on the same hardware configuration.
Signed-off-by: NDavid Gibson <david@gibson.dropbear.id.au>
[Mike Qiu <qiudayu@linux.vnet.ibm.com>: fixed mistype which caused ics_set_kvm_state() to fail]
Signed-off-by: NAlexey Kardashevskiy <aik@ozlabs.ru>
Reviewed-by: NAlexander Graf <agraf@suse.de>
Signed-off-by: NAlexander Graf <agraf@suse.de>

This adds a cpu_setup callback to the XICS device class (as XICS-KVM
will do it different), xics_cpu_setup() will call it if it is set.
Signed-off-by: NAlexey Kardashevskiy <aik@ozlabs.ru>
Signed-off-by: NAlexander Graf <agraf@suse.de>

The upcoming XICS-KVM support will use bits of emulated XICS code.
So this introduces new level of hierarchy - "xics-common" class. Both
emulated XICS and XICS-KVM will inherit from it and override class
callbacks when required.

The new "xics-common" class implements:
1. replaces static "nr_irqs" and "nr_servers" properties with
the dynamic ones and adds callbacks to be executed when properties
are set.
2. xics_cpu_setup() callback renamed to xics_common_cpu_setup() as
it is a common part for both XICS'es
3. xics_reset() renamed to xics_common_reset() for the same reason.

The emulated XICS changes:
1. the part of xics_realize() which creates ICPs is moved to
the "nr_servers" property callback as realize() is too late to
create/initialize devices and instance_init() is too early to create
devices as the number of child devices comes via the "nr_servers"
property.
2. added ics_initfn() which does a little part of what xics_realize() did.
Signed-off-by: NAlexey Kardashevskiy <aik@ozlabs.ru>
Reviewed-by: NAlexander Graf <agraf@suse.de>
Signed-off-by: NAlexander Graf <agraf@suse.de>

This adds missing const specifiers to ICS and ICP TypeInfo's.
Signed-off-by: NAlexey Kardashevskiy <aik@ozlabs.ru>
Reviewed-by: NAndreas Färber <afaerber@suse.de>
Signed-off-by: NAlexander Graf <agraf@suse.de>

This fixes XICS according new QOM rules.

This converts ICS's init() callbacks to realize().

This converts legacy qdev_init_nofail() to property_set(realized).
Signed-off-by: NAlexey Kardashevskiy <aik@ozlabs.ru>
Reviewed-by: NAndreas Färber <afaerber@suse.de>
Signed-off-by: NAlexander Graf <agraf@suse.de>

The upcoming support of in-kernel XICS will redefine migration callbacks
for both ICS and ICP so classes and callback pointers are added.
Signed-off-by: NAlexey Kardashevskiy <aik@ozlabs.ru>
Signed-off-by: NAlexander Graf <agraf@suse.de>

This replaces old-style fprintf with new style error_report.
Signed-off-by: NAlexey Kardashevskiy <aik@ozlabs.ru>
Reviewed-by: NAndreas Färber <afaerber@suse.de>
Acked-by: NDavid Gibson <david@gibson.dropbear.id.au>
Signed-off-by: NAlexander Graf <agraf@suse.de>

This moves the xics_cpu_setup() call after kvmppc_set_papr()
in order to get VCPUs initialized as this is required by upcoming
XICS-KVM.
Signed-off-by: NAlexey Kardashevskiy <aik@ozlabs.ru>
Acked-by: NDavid Gibson <david@gibson.dropbear.id.au>
Signed-off-by: NAlexander Graf <agraf@suse.de>

This simple change makes following patches nicer.
Signed-off-by: NAlexey Kardashevskiy <aik@ozlabs.ru>
Acked-by: NDavid Gibson <david@gibson.dropbear.id.au>
Signed-off-by: NAlexander Graf <agraf@suse.de>

Recent PowerKVM allows the kernel to intercept some RTAS calls from the
guest directly.  This is used to implement the more efficient in-kernel
XICS for example.  qemu is still responsible for assigning the RTAS token
numbers however, and needs to tell the kernel which RTAS function name is
assigned to a given token value.  This patch adds a convenience wrapper for
the KVM_PPC_RTAS_DEFINE_TOKEN ioctl() which is used for this purpose.
Signed-off-by: NDavid Gibson <david@gibson.dropbear.id.au>
Signed-off-by: NAlexey Kardashevskiy <aik@ozlabs.ru>
Acked-by: NDavid Gibson <david@gibson.dropbear.id.au>
Signed-off-by: NAlexander Graf <agraf@suse.de>

On the real hardware, RTAS is called in real mode and therefore
top 4 bits of the address passed in the call are ignored.
So does the patch.

This converts h_rtas() to use existing rtas_ld() handlers.

This fixed rtas_ld()/rtas_st() to ignore top 4 bits.
Signed-off-by: NAlexey Kardashevskiy <aik@ozlabs.ru>
Signed-off-by: NAlexander Graf <agraf@suse.de>

PAPR+ says that no "ibm,purr" tells the guest that H_PURR is not
supported. However some guests still try calling H_PURR on POWER7 unless
the property is present and equal to 0. This adds the property for CPUs
supporting the PURR special register.
Signed-off-by: NBenjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: NAlexey Kardashevskiy <aik@ozlabs.ru>
Signed-off-by: NAlexander Graf <agraf@suse.de>

At the moment the size of the buffer is set to 64K which is
enough for approximately 150 VCPUs which is not the limit.

This increases the buffer up to 256K which allows having
a tree for approximately 600 VCPUs which is way beyond the real
number we need.

As only the real size of the tree is copied to the guest, there
will be no impact on existing configurations.
Signed-off-by: NAlexey Kardashevskiy <aik@ozlabs.ru>
Signed-off-by: NAlexander Graf <agraf@suse.de>

Commit 2345f1c0 was supposed to render L2CR writes into noops. Instead,
it made them illegal instruction traps which apparently didn't confuse
XNU, but can easily confuse other OSs.

Fix it up by actually doing nothing when we write to L2CR.
Reported-by: NJulio Guerra <guerr@julio.in>
Signed-off-by: NAlexander Graf <agraf@suse.de>
Tested-by: NJulio Guerra <guerr@julio.in>

The Load Vector Element (lve*x) and Store Vector Element (stve*x)
instructions not only byte-swap in Little Endian mode, they also
invert the element that is accessed. For example, the RTL for
lvehx contains this:

     eb <-- EA[60:63]
     if Big-Endian byte ordering then
         VRT[8*eb:8*eb+15] <-- MEM(EA,2)
     else
         VRT[112-(8*eb):127-(8*eb)] <-- MEM(EA,2)

This patch adds the element inversion, as described in the last line
of the RTL.
Signed-off-by: NTom Musta <tommusta@gmail.com>
Reviewed-by: NAnton Blanchard <anton@samba.org>
Signed-off-by: NAlexander Graf <agraf@suse.de>

The CFAR, DAR and DSISR registers are currently missing from the
dictionary of registers that may be printed in the QEMU console.
These are interesting registers when debugging.  With this patch,
the following commands work properly:

     (qemu) print $cfar
     (qemu) print $dar
     (qemu) print $dsisr
Signed-off-by: NTom Musta <tommusta@gmail.com>
Reviewed-by: NAnton Blanchard <anton@samba.org>
Signed-off-by: NAlexander Graf <agraf@suse.de>

Try loading the kernel as little endian if it fails big endian.
Signed-off-by: NBenjamin Herrenschmidt <benh@kernel.crashing.org>
Reviewed-by: NAnton Blanchard <anton@samba.org>
Signed-off-by: NAlexander Graf <agraf@suse.de>