When we're running in non-64bit mode with qemu-system-x86_64 we can
still end up with virtual addresses that are above the 32bit boundary
if a segment offset is set up.

GNU Hurd does exactly that. It sets the segment offset to 0x80000000 and
puts its EIP value to 0x8xxxxxxx to access low memory.

This doesn't hit us when we enable paging, as there we just mask away the
unused bits. But with real mode, we assume that vaddr == paddr which is
wrong in this case. Real hardware wraps the virtual address around at the
32bit boundary. So let's do the same.

This fixes booting GNU Hurd in qemu-system-x86_64 for me.
Reported-by: NMichael Tokarev <mjt@tls.msk.ru>
Signed-off-by: NAlexander Graf <agraf@suse.de>
Reviewed-by: NRichard Henderson <rth@twiddle.net>
Signed-off-by: NMichael Tokarev <mjt@tls.msk.ru>

This improves readability and simplifies the code.

Cc: Riku Voipio <riku.voipio@iki.fi>
Signed-off-by: NStefan Weil <sw@weilnetz.de>
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NMichael Tokarev <mjt@tls.msk.ru>

This improves readability and simplifies the code.

Cc: Dmitry Solodkiy <d.solodkiy@samsung.com>
Cc: Evgeny Voevodin <e.voevodin@samsung.com>
Cc: Igor Mitsyanko <i.mitsyanko@gmail.com>
Cc: Maksim Kozlov <m.kozlov@samsung.com>
Signed-off-by: NStefan Weil <sw@weilnetz.de>
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NMichael Tokarev <mjt@tls.msk.ru>

This improves readability and simplifies the code.

Cc: Andreas Färber <andreas.faerber@web.de>
Cc: Anthony Liguori <aliguori@amazon.com>
Signed-off-by: NStefan Weil <sw@weilnetz.de>
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NMichael Tokarev <mjt@tls.msk.ru>

This improves readability and simplifies the code.

Cc: Anthony Liguori <aliguori@amazon.com>
Cc: Gerd Hoffmann <kraxel@redhat.com>
Cc: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: NStefan Weil <sw@weilnetz.de>
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NMichael Tokarev <mjt@tls.msk.ru>

I also removed two hyphens in the same comment.
Signed-off-by: NStefan Weil <sw@weilnetz.de>
Reviewed-by: NJia Liu <proljc@gmail.com>
Signed-off-by: NMichael Tokarev <mjt@tls.msk.ru>

The memory region can be included by value instead of by reference in the
device state.
Signed-off-by: NStefan Weil <sw@weilnetz.de>
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Reviewed-by: NPeter Crosthwaite <peter.crosthwaite@xilinx.com>
Signed-off-by: NMichael Tokarev <mjt@tls.msk.ru>

The recent VSX patches broken compilation of QEMU when configurated
with --enable-debug, as it was treating "target long" TCG variables
as "i64" which is not true for 32bit targets.

This patch fixes all the places that the compiler has found to use
the correct variable type and if necessary manually cast.
Reported-by: NStefan Weil <sw@weilnetz.de>
Signed-off-by: NAlexander Graf <agraf@suse.de>
Reviewed-by: NAurelien Jarno <aurelien@aurel32.net>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

Patch queue for s390 - 2013-12-18

This covers mostly minor bug fixes and implements the SIGP START
hypercall which allows to start a remote CPU without changing its
state.

Cornelia Huck (1):
      s390x/kvm: Fix diagnose handling.

Thomas Huth (7):
      s390x/kvm: Removed duplicated SIGP defines
      s390x/kvm: Removed s390_store_status stub
      s390x/kvm: Fix coding style in handle_sigp()
      s390x/kvm: Implemented SIGP START
      s390x/kvm: Simplified the calculation of the SIGP order code
      s390x/kvm: Fixed condition code for unknown SIGP orders
      s390x/ioinst: CHSC has to set a condition code

* tag 'signed-s390-for-upstream' of git://github.com/agraf/qemu:
  s390x/ioinst: CHSC has to set a condition code
  s390x/kvm: Fixed condition code for unknown SIGP orders
  s390x/kvm: Simplified the calculation of the SIGP order code
  s390x/kvm: Implemented SIGP START
  s390x/kvm: Fix coding style in handle_sigp()
  s390x/kvm: Removed s390_store_status stub
  s390x/kvm: Removed duplicated SIGP defines
  s390x/kvm: Fix diagnose handling.

Reviewed-by: NEdgar E. Iglesias <edgar.iglesias@gmail.com>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

Reviewed-by: NRichard Henderson <rth@twiddle.net>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

The comments apply to 8-bit stores, not 8-byte stores.
Reviewed-by: NRichard Henderson <rth@twiddle.net>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

Patch queue for ppc - 2013-12-20

Alexander Graf (3):
      PPC: Use default pci bus name for grackle and heathrow
      roms: Flush icache when writing roms to guest memory
      PPC: Add VSX to hflags

Alexey Kardashevskiy (5):
      powerpc: add PVR mask support
      target-ppc: move POWER7+ to a separate family
      spapr-rtas: replace return code constants with macros
      spapr-rtas: add ibm, (get|set)-system-parameter
      spapr: make sure RMA is in first mode of first memory node

Greg Kurz (1):
      target-ppc: add stubs for KVM breakpoints

Paolo Bonzini (1):
      spapr: tie spapr-nvram to -pflash

Paul Mackerras (1):
      spapr: limit numa memory regions by ram size

Peter Crosthwaite (2):
      device_tree: s/qemu_devtree/qemu_fdt globally
      device_tree: qemu_fdt_setprop: Rename val_array arg

Tom Musta (19):
      Declare and Enable VSX
      Add MSR VSX and Associated Exception
      Add VSX Instruction Decoders
      Add VSR to Global Registers
      Add lxvd2x
      Add stxvd2x
      Add xxpermdi
      Add lxsdx
      Add lxvdsx
      Add lxvw4x
      Add stxsdx
      Add stxvw4x
      Add VSX Scalar Move Instructions
      Add VSX Vector Move Instructions
      Add Power7 VSX Logical Instructions
      Add xxmrgh/xxmrgl
      Add xxsel
      Add xxspltw
      Add xxsldwi

* agraf/tags/signed-ppc-for-upstream: (32 commits)
  spapr: limit numa memory regions by ram size
  spapr: make sure RMA is in first mode of first memory node
  device_tree: qemu_fdt_setprop: Rename val_array arg
  device_tree: s/qemu_devtree/qemu_fdt globally
  PPC: Add VSX to hflags
  Add xxsldwi
  Add xxspltw
  Add xxsel
  Add xxmrgh/xxmrgl
  Add Power7 VSX Logical Instructions
  Add VSX Vector Move Instructions
  Add VSX Scalar Move Instructions
  roms: Flush icache when writing roms to guest memory
  spapr: tie spapr-nvram to -pflash
  PPC: Use default pci bus name for grackle and heathrow
  spapr-rtas: add ibm, (get|set)-system-parameter
  spapr-rtas: replace return code constants with macros
  target-ppc: move POWER7+ to a separate family
  Add stxvw4x
  Add stxsdx
  ...

This makes sure that all NUMA memory blocks reside within RAM or
have zero length.
Reviewed-by: NThomas Huth <thuth@linux.vnet.ibm.com>
Signed-off-by: NAlexey Kardashevskiy <aik@ozlabs.ru>
Signed-off-by: NAlexander Graf <agraf@suse.de>

The SPAPR specification says that the RMA starts at the LPAR's logical
address 0 and is the first logical memory block reported in
the LPAR’s device tree.

So SLOF only maps the first block and that block needs to span
the full RMA.

This makes sure that the RMA area is where SLOF expects it.
Reviewed-by: NThomas Huth <thuth@linux.vnet.ibm.com>
Signed-off-by: NAlexey Kardashevskiy <aik@ozlabs.ru>
Signed-off-by: NAlexander Graf <agraf@suse.de>

Looking at the implementation, this doesn't really have a lot to do
with arrays. Its just a pointer to a buffer and is passed through
to the wrapped fn (qemu_fdt_setprop) unchanged. So rename to make it
consistent with libfdt, which in the wrapped function just calls it
"val".
Signed-off-by: NPeter Crosthwaite <peter.crosthwaite@xilinx.com>
Signed-off-by: NAlexander Graf <agraf@suse.de>

The qemu_devtree API is a wrapper around the fdt_ set of APIs.
Rename accordingly.
Signed-off-by: NPeter Crosthwaite <peter.crosthwaite@xilinx.com>
[agraf: also convert hw/arm/virt.c]
Signed-off-by: NAlexander Graf <agraf@suse.de>

We generate different code depending on whether MSR_VSX is set or
clear, so it needs to be part of our hflags too which indicate whether
we're still in the same translation block cache bucket.
Signed-off-by: NAlexander Graf <agraf@suse.de>

This patch adds the VSX Shift Left Double by Word Immediate
(xxsldwi) instruction.
Signed-off-by: NTom Musta <tommusta@gmail.com>
Signed-off-by: NAlexander Graf <agraf@suse.de>

This patch adds the VSX Splat Word (xxsplatw) instruction.

This is the first instruction to use the UIM immediate field
and consequently a decoder is also added.

V2: reworked implementation per Richard Henderson's comments.
Signed-off-by: NTom Musta <tommusta@gmail.com>
Reviewed-by: NRichard Henderson <rth@twiddle.net>
Signed-off-by: NAlexander Graf <agraf@suse.de>

This patch adds the VSX Select (xxsel) instruction.

The xxsel instruction has four VSR operands.  Thus the xC
instruction decoder is added.

The xxsel instruction is massively overloaded in the opcode
table since only bits 26 and 27 are opcode bits.  This
overloading is done in matrix fashion with two macros
(GEN_XXSEL_ROW and GEN_XX_SEL).

V2: (1) eliminated unecessary XXSEL macro  (2) tighter implementation
using tcg_gen_andc_i64.
Signed-off-by: NTom Musta <tommusta@gmail.com>
Reviewed-by: NRichard Henderson <rth@twiddle.net>
Signed-off-by: NAlexander Graf <agraf@suse.de>

This patch adds the VSX Merge High Word and VSX Merge Low Word
instructions.

V2: Now implemented using deposit (per Richard Henderson's comment)
Signed-off-by: NTom Musta <tommusta@gmail.com>
Reviewed-by: NRichard Henderson <rth@twiddle.net>
Signed-off-by: NAlexander Graf <agraf@suse.de>

This patch adds the VSX logical instructions that are defined
by the Version 2.06 Power ISA (aka Power7):

   - xxland
   - xxlandc
   - xxlor
   - xxlxor
   - xxlnor
Signed-off-by: NTom Musta <tommusta@gmail.com>
Reviewed-by: NRichard Henderson <rth@twiddle.net>
Signed-off-by: NAlexander Graf <agraf@suse.de>

This patch adds the vector move instructions:

  - xvabsdp - Vector Absolute Value Double-Precision
  - xvnabsdp - Vector Negative Absolute Value Double-Precision
  - xvnegdp - Vector Negate Double-Precision
  - xvcpsgndp - Vector Copy Sign Double-Precision
  - xvabssp - Vector Absolute Value Single-Precision
  - xvnabssp - Vector Negative Absolute Value Single-Precision
  - xvnegsp - Vector Negate Single-Precision
  - xvcpsgnsp - Vector Copy Sign Single-Precision

V3: Per Paolo Bonzini's suggestion, used a temporary for the
sign mask and andc.
Signed-off-by: NTom Musta <tommusta@gmail.com>
Signed-off-by: NAlexander Graf <agraf@suse.de>

This patch adds the VSX scalar move instructions:

  - xsabsdp (Scalar Absolute Value Double-Precision)
  - xsnabspd (Scalar Negative Absolute Value Double-Precision)
  - xsnegdp (Scalar Negate Double-Precision)
  - xscpsgndp (Scalar Copy Sign Double-Precision)

A common generator macro (VSX_SCALAR_MOVE) is added since these
instructions vary only slightly from each other.

Macros to support VSX XX2 and XX3 form opcodes are also added.
These macros handle the overloading of "opcode 2" space (instruction
bits 26:30) caused by AX and BX bits (29 and 30, respectively).

V3: Per feedback from Paolo Bonzini, moved the sign mask into a
temporary and used andc.
Signed-off-by: NTom Musta <tommusta@gmail.com>
Signed-off-by: NAlexander Graf <agraf@suse.de>

We use the rom infrastructure to write firmware and/or initial kernel
blobs into guest address space. So we're basically emulating the cache
off phase on very early system bootup.

That phase is usually responsible for clearing the instruction cache for
anything it writes into cachable memory, to ensure that after reboot we
don't happen to execute stale bits from the instruction cache.

So we need to invalidate the icache every time we write a rom into guest
address space. We do not need to do this for every DMA since the guest
expects it has to flush the icache manually in that case.

This fixes random reboot issues on e5500 (booke ppc) for me.
Signed-off-by: NAlexander Graf <agraf@suse.de>

spapr-nvram's drive property is currently connected to a non-existent
"-machine nvram=<drivename>" option.  Instead, tie it to -pflash like
other non-volatile RAM devices.  This provides the following possibilities
for adding a backend for the sPAPR non-volatile RAM:

* -pflash filename

* -drive if=pflash,file=filename,format=raw,...

* -drive if=none,file=filename,format=raw,id=foo,... -global spapr-nvram.drive=foo
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NAlexander Graf <agraf@suse.de>

There's no good reason to call our bus "pci" rather than let the default
bus name take over ("pci.0").

The big downside to calling it different from anyone else is that tools
that pass -device get confused. They are looking for a bus "pci.0" rather
than "pci".

To make life easier for everyone, let's just drop the name override.
Signed-off-by: NAlexander Graf <agraf@suse.de>

This adds very basic handlers for ibm,get-system-parameter and
ibm,set-system-parameter RTAS calls.

The only parameter handled at the moment is
"platform-processor-diagnostics-run-mode" which is always disabled and
does not support changing. This is expected to make
"ppc64_cpu --run-mode=1" happy.
Signed-off-by: NAlexey Kardashevskiy <aik@ozlabs.ru>
[agraf: s/papameter/parameter/g]
Signed-off-by: NAlexander Graf <agraf@suse.de>

Signed-off-by: NAlexey Kardashevskiy <aik@ozlabs.ru>
Signed-off-by: NAlexander Graf <agraf@suse.de>

So far POWER7+ was a part of POWER7 family. However it has a different
PVR base value so in order to support PVR masks, it needs a separate
family class.

This adds a new family class, PVR base and mask values and moves
Power7+ v2.1 CPU to a new family. The class init function is copied
from the POWER7 family.

This defines a firmware name for the new family as "PowerPC,POWER7+"
instead of previously used "PowerPC,POWER7" from the POWER7 family.
The reason for that is that the Sapphire firmware (a h0st firmware)
uses "PowerPC,POWER7+" already and since no specification defines
exactly the CPU nodes naming in the device tree, we better stay
in sync with the host firmware.
Signed-off-by: NAlexey Kardashevskiy <aik@ozlabs.ru>
Signed-off-by: NAlexander Graf <agraf@suse.de>

This patch adds the Store VSX Vector Word*4 Indexed (stxvw4x)
instruction.
Signed-off-by: NTom Musta <tommusta@gmail.com>
Reviewed-by: NRichard Henderson <rth@twiddle.net>
Reviewed-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NAlexander Graf <agraf@suse.de>

This patch adds the Store VSX Scalar Doubleword Indexed (stxsdx)
instruction.
Signed-off-by: NTom Musta <tommusta@gmail.com>
Reviewed-by: NRichard Henderson <rth@twiddle.net>
Reviewed-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NAlexander Graf <agraf@suse.de>

This patch adds the Load VSX Vector Word*4 Indexed (lxvw4x)
instruction.

V2: changed to use deposit_i64 per Richard Henderson's review.
Signed-off-by: NTom Musta <tommusta@gmail.com>
Reviewed-by: NRichard Henderson <rth@twiddle.net>
Reviewed-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NAlexander Graf <agraf@suse.de>

This patch adds the Load VSX Vector Doubleword & Splat Indexed
(lxvdsx) instruction.
Signed-off-by: NTom Musta <tommusta@gmail.com>
Reviewed-by: NRichard Henderson <rth@twiddle.net>
Reviewed-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NAlexander Graf <agraf@suse.de>

This patch adds the Load VSX Scalar Doubleowrd Indexed (lxsdx)
instruction.

The lower 8 bytes of the target register are undefined; this
implementation leaves those bytes unaltered.
Signed-off-by: NTom Musta <tommusta@gmail.com>
Reviewed-by: NRichard Henderson <rth@twiddle.net>
Reviewed-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NAlexander Graf <agraf@suse.de>

This patch adds the xxpermdi instruction.  The instruction
uses bits 22, 23, 29 and 30 for non-opcode fields (DM, AX
and BX).  This results in overloading of the opcode table
with aliases, which can be seen in the GEN_XX3FORM_DM
macro.
Signed-off-by: NTom Musta <tommusta@gmail.com>
Signed-off-by: NAnton Blanchard <anton@samba.org>
Signed-off-by: NAlexander Graf <agraf@suse.de>

This patch adds the stxvd2x instruction.
Signed-off-by: NTom Musta <tommusta@gmail.com>
Signed-off-by: NAnton Blanchard <anton@samba.org>
Signed-off-by: NAlexander Graf <agraf@suse.de>

This patch adds the lxvd2x instruction.
Signed-off-by: NTom Musta <tommusta@gmail.com>
Signed-off-by: NAnton Blanchard <anton@samba.org>
Signed-off-by: NAlexander Graf <agraf@suse.de>

This patch adds VSX VSRs to the the list of global register indices.
More specifically, it adds the lower halves of the first 32 VSRs to
the list of global register indices.  The upper halves of the first
32 VSRs are already defined via cpu_fpr[].  And the second 32 VSRs
are already defined via the cpu_avrh[] and cpu_avrl[] arrays.
Signed-off-by: NTom Musta <tommusta@gmail.com>
Signed-off-by: NAnton Blanchard <anton@samba.org>
Signed-off-by: NAlexander Graf <agraf@suse.de>