On the real hardware, RTAS is called in real mode and therefore
top 4 bits of the address passed in the call are ignored.
So does the patch.

This converts h_rtas() to use existing rtas_ld() handlers.

This fixed rtas_ld()/rtas_st() to ignore top 4 bits.
Signed-off-by: NAlexey Kardashevskiy <aik@ozlabs.ru>
Signed-off-by: NAlexander Graf <agraf@suse.de>

PAPR+ says that no "ibm,purr" tells the guest that H_PURR is not
supported. However some guests still try calling H_PURR on POWER7 unless
the property is present and equal to 0. This adds the property for CPUs
supporting the PURR special register.
Signed-off-by: NBenjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: NAlexey Kardashevskiy <aik@ozlabs.ru>
Signed-off-by: NAlexander Graf <agraf@suse.de>

At the moment the size of the buffer is set to 64K which is
enough for approximately 150 VCPUs which is not the limit.

This increases the buffer up to 256K which allows having
a tree for approximately 600 VCPUs which is way beyond the real
number we need.

As only the real size of the tree is copied to the guest, there
will be no impact on existing configurations.
Signed-off-by: NAlexey Kardashevskiy <aik@ozlabs.ru>
Signed-off-by: NAlexander Graf <agraf@suse.de>

Commit 2345f1c0 was supposed to render L2CR writes into noops. Instead,
it made them illegal instruction traps which apparently didn't confuse
XNU, but can easily confuse other OSs.

Fix it up by actually doing nothing when we write to L2CR.
Reported-by: NJulio Guerra <guerr@julio.in>
Signed-off-by: NAlexander Graf <agraf@suse.de>
Tested-by: NJulio Guerra <guerr@julio.in>

The Load Vector Element (lve*x) and Store Vector Element (stve*x)
instructions not only byte-swap in Little Endian mode, they also
invert the element that is accessed. For example, the RTL for
lvehx contains this:

     eb <-- EA[60:63]
     if Big-Endian byte ordering then
         VRT[8*eb:8*eb+15] <-- MEM(EA,2)
     else
         VRT[112-(8*eb):127-(8*eb)] <-- MEM(EA,2)

This patch adds the element inversion, as described in the last line
of the RTL.
Signed-off-by: NTom Musta <tommusta@gmail.com>
Reviewed-by: NAnton Blanchard <anton@samba.org>
Signed-off-by: NAlexander Graf <agraf@suse.de>

The CFAR, DAR and DSISR registers are currently missing from the
dictionary of registers that may be printed in the QEMU console.
These are interesting registers when debugging.  With this patch,
the following commands work properly:

     (qemu) print $cfar
     (qemu) print $dar
     (qemu) print $dsisr
Signed-off-by: NTom Musta <tommusta@gmail.com>
Reviewed-by: NAnton Blanchard <anton@samba.org>
Signed-off-by: NAlexander Graf <agraf@suse.de>

Try loading the kernel as little endian if it fails big endian.
Signed-off-by: NBenjamin Herrenschmidt <benh@kernel.crashing.org>
Reviewed-by: NAnton Blanchard <anton@samba.org>
Signed-off-by: NAlexander Graf <agraf@suse.de>

This has reworked USB OHCI and adds support of USB EHCI,
VIRTIO-SCSI and various fixes (IBM VSCSI, VGA and more).

The full list of fixes is:
*  usb-ohci: Convert td-phys every time to td-virt
*  usb-storage: Fix cbwflags field
*  Add -fno-strict-aliasing in global CFLAGS
*  usb: fix various issues found with js2x
*  Move hex64-{decode,encode}-unit to node.fs
*  usb: Use separate in-memory endian swap
*  usb-ohci: collect TDs from done list
*  js2x: more fixes
*  js2x: Fix build of takeover image
*  js2x: use new usb stack
*  usb-ohci: Use proper memory barriers always
*  usb: Fix a couple of warnings
*  Fix $cat-instance-unit
*  Cache phandle of /chosen
*  Use root.fs on qemu as well
*  usb-ehci: Add ehci handshake
*  usb: add mb for write accessors
*  usb-ohci: add missing memory barriers
*  usb-ohci: suspend the controller in exit code path
*  usb-ohci: Add a reset when closing the OHCI
*  usb: Use proper accessors for MMIO and separate in-memory endian swap
*  Use a global definition of sync() and mb()
*  net-snk: Remove exception handling
*  usb: unmap buffers
*  slof: call quiesce on closing of stdin
*  usb-kbd: accept "s" to drop to OF prompt
*  USB storage driver
*  usb-ohci: add Bulk transfer support
*  usb-ehci: Add bulk support
*  usb-core: add usb bulk support
*  USB generic hub device driver
*  usb-ehci: setup new device
*  usb-ehci: Check ehci ports
*  usb-ehci: initialize controller
*  USB keyboard driver
*  usb-core: setup new device
*  usb-core: create dev pool allocation
*  usb-ohci: implement ohci send control
*  usb-core: usb send control
*  usb-core: implement usb_{get,put}_pipe routines
*  usb-ohci: allocate pipe pool
*  usb-ohci: reset, init and check-ports
*  Add standard header stdbool.h
*  usb-slof: forth support routines for C
*  usb-ehci: Add USB EHCI skeleton
*  usb-core: Add register accessor functions
*  Use __builtin_bswap routines for endianness swapping
*  usb-core: hcd registration and query routines
*  usb-core: adding generic dev-hci.fs
*  usb-core: registration and makefiles
*  Add new USB code
*  Remove old usb code
*  vga: fix hcall-invert-screen and hcall-blink-screen
*  Enumerate disk/cdrom aliases for multiple disks or cdroms
*  scsi: unify scsi probing code
*  vscsi: generalizing probe code
*  virtio-scsi: iterate through targets
*  scsi: unify and use make-disk-alias
*  nvram: remove unnecessary prints
*  Add hack to client interface finddevice of "/memory"
*  scsi: Fix cdrom boot crash when no medium present
*  Look for /memory@0, not just /memory
*  Fix instance>qname crashing when displaying instance arguments
*  Fix js2x build
*  scsi-disk: Bound check read-blocks
*  Fix off by one error in scsi-disk get-capacity
*  scsi: fix report-luns handling
*  SLOF: virtio-scsi block driver code
*  scsi: Move bits of vio-vscsi.fs to a common helpers file
*  scsi: Move scsi-disk.fs to a generic place
*  SLOF: virtio-scsi helper routines
*  SLOF: virtio-scsi - add pci device file
*  iso9660: Don't constantly reallocate the read buffer
*  vscsi: Sanitize interface between scsi-disk.fs and vio-vscsi.fs
*  vio-vscsi: Rework vio-vscsi support
*  virtio: Add a virtio-set-qaddr helper
*  disk-label: Allocate 4096 bytes for 4k block devices
*  disk-label: Increase the max size of the PReP boot partition
*  Make load-base a real environment variable
*  vio-vscsi: Switch to using a wildcard "disk" node and make scsi-disk generic
*  Fix disk-label package to use proper instance path
*  Increase size of catpad
*  Fix instance>path to contain unit address for wildcard nodes
*  Fix handling of wildcard nodes in open-dev
*  vio-vscsi: Get CRQ on open and release on close
Signed-off-by: NAlexey Kardashevskiy <aik@ozlabs.ru>
Signed-off-by: NAlexander Graf <agraf@suse.de>

# By Paolo Bonzini (2) and Jan Kiszka (1)
# Via Gleb Natapov
* qemu-kvm/uq/master:
  kvmvapic: Prevent reading beyond the end of guest RAM
  x86: cpuid: reconstruct leaf 0Dh data
  x86: fix migration from pre-version 12

Message-id: 1382108641-4862-1-git-send-email-pbonzini@redhat.com
Signed-off-by: NAnthony Liguori <aliguori@amazon.com>

# By Amos Kong
# Via Stefan Hajnoczi
* stefanha/net:
  net/rtl8139: update network information when macaddr is changed in guest
  net/e1000: update network information when macaddr is changed in guest
  net: update nic info during device reset

Message-id: 1382103314-21608-1-git-send-email-stefanha@redhat.com
Signed-off-by: NAnthony Liguori <aliguori@amazon.com>

# By Fam Zheng (3) and others
# Via Stefan Hajnoczi
* stefanha/block:
  vmdk: fix VMFS extent parsing
  vmdk: Only read cid from image file when opening
  virtio: Remove unneeded memcpy
  block/raw-win32: Always use -errno in hdev_open
  blockdev: fix cdrom read_only flag
  sd: Avoid access to NULL BlockDriverState
  hmp: drop bogus "[not inserted]"

Message-id: 1382105915-27735-1-git-send-email-stefanha@redhat.com
Signed-off-by: NAnthony Liguori <aliguori@amazon.com>

# By Paolo Bonzini (10) and others
# Via Paolo Bonzini
* bonzini/iommu-for-anthony:
  exec: remove qemu_safe_ram_ptr
  icount: make it thread-safe
  icount: document (future) locking rules for icount
  icount: prepare the code for future races in calling qemu_clock_warp
  icount: reorganize icount_warp_rt
  icount: use cpu_get_icount() directly
  timer: add timer_mod_anticipate and timer_mod_anticipate_ns
  timer: extract timer_mod_ns_locked and timerlist_rearm
  timer: make qemu_clock_enable sync between disable and timer's cb
  qemu-thread: add QemuEvent
  timer: protect timers_state's clock with seqlock
  seqlock: introduce read-write seqlock
  vga: Mark relevant portio lists regions as coalesced MMIO flushing
  cirrus: Mark vga io region as coalesced MMIO flushing
  portio: Allow to mark portio lists as coalesced MMIO flushing
  compatfd: switch to QemuThread
  memory: fix 128 arithmetic in info mtree

Message-id: 1382024935-28297-1-git-send-email-pbonzini@redhat.com
Signed-off-by: NAnthony Liguori <aliguori@amazon.com>

# By Peter Maydell (3) and Ákos Kovács (2)
# Via Paolo Bonzini
* bonzini/configure:
  ui/Makefile.objs: delete unnecessary cocoa.o dependency
  default-configs/: CONFIG_GDBSTUB_XML removed
  Makefile.target: CONFIG_NO_* variables removed
  rules.mak: New string testing functions
  rules.mak: New logical functions for handling y/n values

# By Gerd Hoffmann (2) and others
# Via Gerd Hoffmann
* spice/spice.v75:
  spice: fix multihead support
  spice-display: add display channel id to the debug messages.
  Fix VNC SASL authentication when using a QXL device
  spice: replace use of deprecated API

Message-id: 1382006760-19388-1-git-send-email-kraxel@redhat.com
Signed-off-by: NAnthony Liguori <aliguori@amazon.com>

xtensa queue 2013-10-15

# gpg: Signature made Tue 15 Oct 2013 06:27:41 AM PDT using RSA key ID F83FA044
# gpg: Can't check signature: public key not found

# By Max Filippov
# Via Max Filippov
* filippov/tags/20131015-xtensa:
  target-xtensa: add in_asm logging

Message-id: 1381844297-1728-1-git-send-email-jcmvbkbc@gmail.com
Signed-off-by: NAnthony Liguori <aliguori@amazon.com>

The VMFS extent line in description file doesn't have start offset as
FLAT lines does, and it should be defaulted to 0. The flat_offset
variable is initialized to -1, so we need to set it in this case.
Signed-off-by: NFam Zheng <famz@redhat.com>
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>

Previously cid of parent is parsed from image file for every IO request.
We already have L1/L2 cache and don't have assumption that parent image
can be updated behind us, so remove this to get more efficiency.

The parent CID is checked only for once after opening.
Signed-off-by: NFam Zheng <famz@redhat.com>
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>

rtl8139 has same problem as e1000, nic info isn't updated when macaddr
is changed in guest.

This patch updates the nic info when the last bit of macaddr is written.
Signed-off-by: NAmos Kong <akong@redhat.com>
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>

If we change macaddr in guest by 'ifconfig eth0 hw ether 12:12:12:34:35:36',
the mac register of e1000 is already updated, but we don't update
network information in qemu. Therefor, the information in monitor
is wrong.

This patch updates nic info when the second part of macaddr is written.
Signed-off-by: NAmos Kong <akong@redhat.com>
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>

macaddr is reset during device reset, but nic info
isn't updated, this problem exists in e1000 & rtl8139
Signed-off-by: NAmos Kong <akong@redhat.com>
Acked-by: NMichael S. Tsirkin <mst@redhat.com>
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>

Report from valgrind:

==19521== Source and destination overlap in memcpy(0x31d38938, 0x31d38938, 64)
==19521==    at 0x4A0A343: memcpy@@GLIBC_2.14 (in
/usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==19521==    by 0x42774E: virtio_blk_device_init (virtio-blk.c:686)
==19521==    by 0x46EE9E: virtio_device_init (virtio.c:1158)
==19521==    by 0x25405E: device_realize (qdev.c:178)
==19521==    by 0x2559B5: device_set_realized (qdev.c:699)
==19521==    by 0x3A819B: property_set_bool (object.c:1315)
==19521==    by 0x3A6CE0: object_property_set (object.c:803)

Valgrind is right: blk == &s->blks, so it is a memcpy of 64 byte with
source == destination which can be removed.
Reported-by: NDave Airlie <airlied@gmail.com>
Signed-off-by: NStefan Weil <sw@weilnetz.de>
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>

This is not needed since the RAM list is not modified anymore by
qemu_get_ram_ptr.  Replace it with qemu_get_ram_block.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

This lets threads other than the I/O thread use vm_clock even in -icount mode.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

Reviewed-by: NAlex Bligh <alex@alex.org.uk>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

Computing the deadline of all vm_clocks is somewhat expensive and calls
out to qemu-timer.c; two reasons not to do it in the seqlock's write-side
critical section.  This however opens the door for races in setting and
reading vm_clock_warp_start.

To plug them, we need to cover the case where a new deadline slips in
between the call to qemu_clock_deadline_ns_all and the actual modification
of the icount_warp_timer.  Restrict changes to vm_clock_warp_start and
the icount_warp_timer's expiration time, to only move them back (which
would simply cause an early wakeup).

If a vm_clock timer is cancelled while CPUs are idle, this might cause the
icount_warp_timer to fire unnecessarily.  This is not a problem, after it
fires the timer becomes inactive and the next call to timer_mod_anticipate
will be precise.

In addition to this, we must deactivate the icount_warp_timer _before_
checking whether CPUs are idle.  This way, if the "last" CPU becomes idle
during the call to timer_del we will still set up the icount_warp_timer.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

To prepare for future code changes, move the increment of qemu_icount_bias
outside the "if" statement.

Also, hoist outside the if the check for timers that expired due to the
"warping".  The check is redundant when !runstate_is_running(), but
doing it this way helps because the code that increments qemu_icount_bias
will be a critical section.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

This will help later when we will have to place these calls in
a critical section, and thus call a version of cpu_get_icount()
that does not take the lock.
Reviewed-by: NAlex Bligh <alex@alex.org.uk>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

These let a user anticipate the deadline of a timer, atomically with
other sites that call the function.  This helps avoiding complicated
lock hierarchies.
Reviewed-by: NAlex Bligh <alex@alex.org.uk>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

These will be reused in timer_mod_anticipate functions.
Reviewed-by: NAlex Bligh <alex@alex.org.uk>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

After disabling the QemuClock, we should make sure that no QemuTimers
are still in flight. To implement that with light overhead, we resort
to QemuEvent. The caller of disabling will wait on QemuEvent of each
timerlist.

Note, qemu_clock_enable(foo,false) can _not_ be called from timer's cb.
Also, the callers of qemu_clock_enable() should be protected by the BQL.
Signed-off-by: NLiu Ping Fan <pingfank@linux.vnet.ibm.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

This emulates Win32 manual-reset events using futexes or conditional
variables.  Typical ways to use them are with multi-producer,
single-consumer data structures, to test for a complex condition whose
elements come from different threads:

    for (;;) {
        qemu_event_reset(ev);
        ... test complex condition ...
        if (condition is true) {
            break;
        }
        qemu_event_wait(ev);
    }

Or more efficiently (but with some duplication):

    ... evaluate condition ...
    while (!condition) {
        qemu_event_reset(ev);
        ... evaluate condition ...
        if (!condition) {
            qemu_event_wait(ev);
            ... evaluate condition ...
        }
    }

QemuEvent provides a very fast userspace path in the common case when
no other thread is waiting, or the event is not changing state.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

QEMU_CLOCK_VIRTUAL may be read outside BQL. This will make its
foundation, i.e. cpu_clock_offset exposed to race condition.
Using private lock to protect it.

After this patch, reading QEMU_CLOCK_VIRTUAL is thread safe
unless use_icount is true, in which case the existing callers
still rely on the BQL.

Lock rule: private lock innermost, ie BQL->"this lock"
Signed-off-by: NLiu Ping Fan <pingfank@linux.vnet.ibm.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

Seqlock implementation for QEMU. Usage idiom

reader:
    do {
        start = seqlock_read_begin(&sl);
        ...
    } while (seqlock_read_retry(&sl, start));

writer:
    seqlock_write_lock(&sl);
    ...
    seqlock_write_unlock(&sl);

initialization:
    seqlock_init(QemuSeqLock *sl, QemuMutex *mutex)

    mutex could be NULL if the caller will provide its own protection
    for concurrent write sides (typically using the BQL).
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

This allows to remove the explicit qemu_flush_coalesced_mmio_buffer
calls.
Signed-off-by: NJan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

This allows to remove the explicit qemu_flush_coalesced_mmio_buffer
calls - the memory core will invoke them now.
Signed-off-by: NJan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

This will enable us to remove all remaining explicit calls of
qemu_flush_coalesced_mmio_buffer in IO handlers.
Signed-off-by: NJan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

qemu_thread_create already does signal blocking and detaching for us.
Signed-off-by: NJan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

mtree_print_mr() calls int128_get64() in 3 places but only 2 places
handle 2^64 correctly.

This fixes the third call of int128_get64().

Cc: qemu-stable@nongnu.org
Signed-off-by: NAlexey Kardashevskiy <aik@ozlabs.ru>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

On one occasion, hdev_open() returned -1 in case of an unknown error
instead of a proper -errno value. Adjust this to match the behavior of
raw_open() (in raw-win32), which is to return -EINVAL in this case.
Also, change the call to error_setg*() to match the one in raw_open() as
well.
Signed-off-by: NMax Reitz <mreitz@redhat.com>
Reviewed-by: NEric Blake <eblake@redhat.com>
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>

This patch fixes spice display initialization to handle
multihead properly.

spice-core now keeps track of which QemuConsole has a spice
display channel attached to it and which has not.  It also
manages display channel ids.

spice-display looks at all QemuConsoles and will pick up any
graphic console not yet bound to a spice channel (which in practice
are all non-qxl graphic devices).

Result is that
 (a) you'll get a spice client window for each graphical device
     now (first only without this patch), and
 (b) mixing qxl and non-qxl vga cards works properly.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>