mask notifiers are never called without msix,
so devices with backend masking like vhost don't work.
Call mask notifiers explicitly at
startup/cleanup to make it work.
Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>
Tested-by: NAlexander Graf <agraf@suse.de>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

* 'ppc-for-upstream' of git://github.com/agraf/qemu:
  PPC: Depend behavior of cmp instructions only on instruction encoding

The implementation for rldcl tried to always fetch its
parameters from the opcode, even though the opcode was
already passed in in decoded and different forms.

Use the parameters instead, fixing rldcl.
Reported-by: NTorbjorn Granlund <tg@gmplib.org>
Reviewed-by: NAurelien Jarno <aurelien@aurel32.net>
Signed-off-by: NAlexander Graf <agraf@suse.de>

When running an L=1 cmp instruction on a 64bit PPC CPU with SF off, it
still behaves identical to what it does when SF is on. Remove the implicit
difference in the code.

Also, on most 32bit CPUs we should always treat the compare as 32bit
compare, as the CPU will ignore the L bit. This is not true for e500mc,
but that's up for a different patch.
Reported-by: NTorbjorn Granlund <tg@gmplib.org>
Reviewed-by: NRichard Henderson <rth@twiddle.net>
Signed-off-by: NAlexander Graf <agraf@suse.de>

Corner case for INSV instruction when size=32 has not been correctly
implemented. The mask for size should be one bit wider, and preparing the
filter variable should be aware of this case too.

The test for INSV has been extended to include the case that triggers the
bug.
Signed-off-by: NPetar Jovanovic <petar.jovanovic@imgtec.com>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

The emulator needs to check in hflags if DSP unit has been turned off before
it generates code for MUL_PH, MUL_S_PH, MULQ_S_W, and MULQ_RS_W.
Signed-off-by: NPetar Jovanovic <petar.jovanovic@imgtec.com>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

# By Gerd Hoffmann (3) and Hans de Goede (1)
# Via Gerd Hoffmann
* kraxel/usb.82:
  xhci: handle USB_RET_BABBLE
  uhci: Use an intermediate buffer for usb packet data
  usb-host: add usb_host_full_speed_compat
  usb-host: live migration support for the libusb version

Message-id: 1367920207-1404-1-git-send-email-kraxel@redhat.com
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

The qemu guest agent creates a bunch of files with insecure permissions
when started in daemon mode. For example:

  -rw-rw-rw- 1 root root /var/log/qemu-ga.log
  -rw-rw-rw- 1 root root /var/run/qga.state
  -rw-rw-rw- 1 root root /var/log/qga-fsfreeze-hook.log

In addition, at least all files created with the "guest-file-open" QMP
command, and all files created with shell output redirection (or
otherwise) by utilities invoked by the fsfreeze hook script are affected.

For now mask all file mode bits for "group" and "others" in
become_daemon().

Temporarily, for compatibility reasons, stick with the 0666 file-mode in
case of files newly created by the "guest-file-open" QMP call. Do so
without changing the umask temporarily.
Signed-off-by: NLaszlo Ersek <lersek@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Commit 32993698 (vhost: disable on tap link down) tries to disable the vhost
also when the peer's link is down. But the check was not done properly, the
vhost were only started when:

1) peer's link is not down
2) virtio-net has already been started.

Since == have a higher precedence than &&, place a brace to make sure both the
conditions were met then does the check. This fixes the crash when doing a savem
after set the link off which let qemu crash and complains:

virtio_net_save: Assertion `!n->vhost_started' failed.

Cc: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: NJason Wang <jasowang@redhat.com>
Message-id: 1366972060-21606-1-git-send-email-jasowang@redhat.com
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

# By Eduardo Habkost (6) and others
# Via Andreas Färber
* afaerber/qom-cpu:
  target-i386: n270 can MOVBE
  target-i386: Introduce generic CPUID feature compat function
  target-i386: Change CPUID model of 486 to 8
  target-i386: Emulate X86CPU subclasses for global properties
  qdev: Introduce qdev_prop_set_globals_for_type()
  qdev: Let qdev_prop_parse() pass through Error
  target-i386: Add "filtered-features" property to X86CPU
  target-i386: Introduce X86CPU::filtered_features field
  target-i386: Add "feature-words" property to X86CPU
  target-i386: Use FeatureWord loop on filter_features_for_kvm()
  target-i386: Add ECX information to FeatureWordInfo

Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Due to various unfortunate reasons we cannot reliable detect a guest
cancelling a packet as soon as it happens, instead we detect cancels
with some delay.

When packets are handled async, and we directly pass the guest memory for
the packet to the usb-device as iovec, this means that the usb-device can
write to guest-memory which the guest has already re-used for other purposes
-> not good!

This patch fixes this by adding an intermediate buffer and writing back not
only the result, but also the data, of async completed packets when scanning
the schedule.
Signed-off-by: NHans de Goede <hdegoede@redhat.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Alloes to pass through usb2 devices on usb1 host controllers if possible.
Brings the libusb implementation to feature-parity with the linux usbfs
code, so the usb-host implementation in 1.5 (libusb) doesn't regress
compared to 1.4 (usbfs).
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

# By Marcelo Tosatti
# Via Gleb Natapov
* qemu-kvm/uq/master:
  kvmvapic: add ioport read accessor

Message-id: cover.1367844188.git.gleb@redhat.com
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

The Atom core (cpu name "n270" in QEMU speak) supports MOVBE. This is
needed when booting 3.8 and later linux kernels built with the MATOM
target because we require MOVBE in order to boot properly now.
Signed-off-by: NBorislav Petkov <bp@suse.de>
[ehabkost: added compat code to disable MOVBE on pc-*-1.4 and older]
Signed-off-by: NEduardo Habkost <ehabkost@redhat.com>
Signed-off-by: NAndreas Färber <afaerber@suse.de>

Introduce x86_cpu_compat_set_features(), that can be used to set/unset
feature bits on specific CPU models for machine-type compatibility.
Signed-off-by: NEduardo Habkost <ehabkost@redhat.com>
Signed-off-by: NAndreas Färber <afaerber@suse.de>

* 's390-for-upstream' of git://github.com/agraf/qemu:
  s390: update s390-ccw.img
  S390: BIOS boot from given device
  S390: Add virtio-blk boot
  S390: Merging s390_ipl_cpu and s390_ipl_reset
  S390: BIOS create link to src folder for .img file
  S390: BIOS check for file

This changes the model number of 486 to 8 (DX4) which matches the
feature set presented, and actually has the CPUID instruction.

This adds a compatibility property, to keep model=0 on pc-*-1.4 and older.
Signed-off-by: NH. Peter Anvin <hpa@zytor.com>
[AF: Add compat_props entry]
Tested-by: NEduardo Habkost <ehabkost@redhat.com>
Reviewed-by: NEduardo Habkost <ehabkost@redhat.com>
Signed-off-by: NAndreas Färber <afaerber@suse.de>

After initializing the object from its x86_def_t and before setting any
additional -cpu arguments, set any global properties for the designated
subclass <name>-{i386,x86_64}-cpu.
Reviewed-by: NEduardo Habkost <ehabkost@redhat.com>
Signed-off-by: NAndreas Färber <afaerber@suse.de>

Reuse it in qdev_prop_set_globals().
Reviewed-by: NEduardo Habkost <ehabkost@redhat.com>
[AF: Renamed from qdev_prop_set_custom_globals()]
Signed-off-by: NAndreas Färber <afaerber@suse.de>

Move error reporting to callers.
Reviewed-by: NEduardo Habkost <ehabkost@redhat.com>
Signed-off-by: NAndreas Färber <afaerber@suse.de>

This property will contain all the features that were removed from the
CPU because they are not supported by the host.

This way, libvirt or other management tools can emulate the
check/enforce behavior by checking if filtered-properties is all zeroes,
before starting the guest.

Example output where some features were missing:

  $ qemu-system-x86_64 -enable-kvm -cpu Haswell,check -S \
    -qmp unix:/tmp/m,server,nowait
  warning: host doesn't support requested feature: CPUID.01H:ECX.fma [bit 12]
  warning: host doesn't support requested feature: CPUID.01H:ECX.movbe [bit 22]
  warning: host doesn't support requested feature: CPUID.01H:ECX.tsc-deadline [bit 24]
  warning: host doesn't support requested feature: CPUID.01H:ECX.xsave [bit 26]
  warning: host doesn't support requested feature: CPUID.01H:ECX.avx [bit 28]
  warning: host doesn't support requested feature: CPUID.07H:EBX.fsgsbase [bit 0]
  warning: host doesn't support requested feature: CPUID.07H:EBX.bmi1 [bit 3]
  warning: host doesn't support requested feature: CPUID.07H:EBX.hle [bit 4]
  warning: host doesn't support requested feature: CPUID.07H:EBX.avx2 [bit 5]
  warning: host doesn't support requested feature: CPUID.07H:EBX.smep [bit 7]
  warning: host doesn't support requested feature: CPUID.07H:EBX.bmi2 [bit 8]
  warning: host doesn't support requested feature: CPUID.07H:EBX.erms [bit 9]
  warning: host doesn't support requested feature: CPUID.07H:EBX.invpcid [bit 10]
  warning: host doesn't support requested feature: CPUID.07H:EBX.rtm [bit 11]
  [...]
  $ ./QMP/qmp --path=/tmp/m \
    qom-get --path=/machine/icc-bridge/icc/child[0] \
            --property=filtered-features
  item[0].cpuid-register: EDX
  item[0].cpuid-input-eax: 2147483658
  item[0].features: 0
  item[1].cpuid-register: EAX
  item[1].cpuid-input-eax: 1073741825
  item[1].features: 0
  item[2].cpuid-register: EDX
  item[2].cpuid-input-eax: 3221225473
  item[2].features: 0
  item[3].cpuid-register: ECX
  item[3].cpuid-input-eax: 2147483649
  item[3].features: 0
  item[4].cpuid-register: EDX
  item[4].cpuid-input-eax: 2147483649
  item[4].features: 0
  item[5].cpuid-register: EBX
  item[5].cpuid-input-eax: 7
  item[5].features: 4025
  item[5].cpuid-input-ecx: 0
  item[6].cpuid-register: ECX
  item[6].cpuid-input-eax: 1
  item[6].features: 356519936
  item[7].cpuid-register: EDX
  item[7].cpuid-input-eax: 1
  item[7].features: 0

Example output when no feature is missing:

  $ qemu-system-x86_64 -enable-kvm -cpu Nehalem,enforce -S \
    -qmp unix:/tmp/m,server,nowait
  [...]
  $ ./QMP/qmp --path=/tmp/m \
    qom-get --path=/machine/icc-bridge/icc/child[0] \
            --property=filtered-features
  item[0].cpuid-register: EDX
  item[0].cpuid-input-eax: 2147483658
  item[0].features: 0
  item[1].cpuid-register: EAX
  item[1].cpuid-input-eax: 1073741825
  item[1].features: 0
  item[2].cpuid-register: EDX
  item[2].cpuid-input-eax: 3221225473
  item[2].features: 0
  item[3].cpuid-register: ECX
  item[3].cpuid-input-eax: 2147483649
  item[3].features: 0
  item[4].cpuid-register: EDX
  item[4].cpuid-input-eax: 2147483649
  item[4].features: 0
  item[5].cpuid-register: EBX
  item[5].cpuid-input-eax: 7
  item[5].features: 0
  item[5].cpuid-input-ecx: 0
  item[6].cpuid-register: ECX
  item[6].cpuid-input-eax: 1
  item[6].features: 0
  item[7].cpuid-register: EDX
  item[7].cpuid-input-eax: 1
  item[7].features: 0
Signed-off-by: NEduardo Habkost <ehabkost@redhat.com>
Reviewed-by: NEric Blake <eblake@redhat.com>
Signed-off-by: NAndreas Färber <afaerber@suse.de>

This field will contain the feature bits that were filtered out because
of missing host support.
Signed-off-by: NEduardo Habkost <ehabkost@redhat.com>
Reviewed-by: NEric Blake <eblake@redhat.com>
Signed-off-by: NAndreas Färber <afaerber@suse.de>

This property will be useful for libvirt, as libvirt already has logic
based on low-level feature bits (not feature names), so it will be
really easy to convert the current libvirt logic to something using the
"feature-words" property.

The property will have two main use cases:
 - Checking host capabilities, by checking the features of the "host"
   CPU model
 - Checking which features are enabled on each CPU model

Example output:

  $ ./QMP/qmp --path=/tmp/m \
    qom-get --path=/machine/icc-bridge/icc/child[0] \
            --property=feature-words
  item[0].cpuid-register: EDX
  item[0].cpuid-input-eax: 2147483658
  item[0].features: 0
  item[1].cpuid-register: EAX
  item[1].cpuid-input-eax: 1073741825
  item[1].features: 0
  item[2].cpuid-register: EDX
  item[2].cpuid-input-eax: 3221225473
  item[2].features: 0
  item[3].cpuid-register: ECX
  item[3].cpuid-input-eax: 2147483649
  item[3].features: 101
  item[4].cpuid-register: EDX
  item[4].cpuid-input-eax: 2147483649
  item[4].features: 563346425
  item[5].cpuid-register: EBX
  item[5].cpuid-input-eax: 7
  item[5].features: 0
  item[5].cpuid-input-ecx: 0
  item[6].cpuid-register: ECX
  item[6].cpuid-input-eax: 1
  item[6].features: 2155880449
  item[7].cpuid-register: EDX
  item[7].cpuid-input-eax: 1
  item[7].features: 126614521
Signed-off-by: NEduardo Habkost <ehabkost@redhat.com>
Reviewed-by: NEric Blake <eblake@redhat.com>
Signed-off-by: NAndreas Färber <afaerber@suse.de>

Instead of open-coding the filtering code for each feature word, change
the existing code to use the feature_word_info array, that has exactly
the same CPUID eax/ecx/register values for each feature word.
Signed-off-by: NEduardo Habkost <ehabkost@redhat.com>
Reviewed-by: NEric Blake <eblake@redhat.com>
Signed-off-by: NAndreas Färber <afaerber@suse.de>

FEAT_7_0_EBX uses ECX as input, so we have to take that into account
when reporting feature word values.
Signed-off-by: NEduardo Habkost <ehabkost@redhat.com>
Signed-off-by: NAndreas Färber <afaerber@suse.de>

Now that we have boot device selection support, update the firmware
blob accordingly.
Signed-off-by: NAlexander Graf <agraf@suse.de>

Use the passed device, if there is no device, use the first applicable device.
Signed-off-by: NDominik Dingel <dingel@linux.vnet.ibm.com>
Signed-off-by: NAlexander Graf <agraf@suse.de>

If no kernel IPL entry is specified, boot the bios and pass if available
device information for the first boot device (as given by the boot index).

The provided information will be used in the next commit from the BIOS.
Signed-off-by: NDominik Dingel <dingel@linux.vnet.ibm.com>
Signed-off-by: NAlexander Graf <agraf@suse.de>

There is no use in have this splitted in two functions.
Signed-off-by: NDominik Dingel <dingel@linux.vnet.ibm.com>
Signed-off-by: NAlexander Graf <agraf@suse.de>

For *.img files, there will be a link created directly to the src folder,
like for all other blobs.
Signed-off-by: NDominik Dingel <dingel@linux.vnet.ibm.com>
Signed-off-by: NAlexander Graf <agraf@suse.de>

Add a check if the BIOS blob exists before trying to load.
Signed-off-by: NDominik Dingel <dingel@linux.vnet.ibm.com>
Signed-off-by: NAlexander Graf <agraf@suse.de>

Normally, the "tap" device is polled by QEMU if a guest NIC can
receive packets. If a guest NIC is stopped during transfer (rmmod or
ifdown), it may still have packets in a queue which have to be send
to the guest before QEMU enables polling of a "tap" interface via
tap_update_fd_handler().

However the spapr_llan device was missing the qemu_flush_queued_packets()
call so the tap_send_completed() callback was never called and therefore
"tap" interface polling was not enabled ever.

The patch fixes this problem.
Signed-off-by: NAlexey Kardashevskiy <aik@ozlabs.ru>
Signed-off-by: NAlexander Graf <agraf@suse.de>

We should sync params->ram_size after we fixup memory size on
a alignment boundary. Otherwise Guest would exceed the actual
memory region.
Signed-off-by: NTiejun Chen <tiejun.chen@windriver.com>
Signed-off-by: NAlexander Graf <agraf@suse.de>

Recent Linux kernels save and restore the PPR across exceptions
so we need to handle it.
Signed-off-by: NAnton Blanchard <anton@au1.ibm.com>
Signed-off-by: NAlexander Graf <agraf@suse.de>

Invalid and privileged SPR warnings currently print the wrong
address. While fixing that, also make it clear that we are
printing both the decimal and hexadecimal SPR number.

Before:

  Trying to read invalid spr 896 380 at 0000000000000714

After:

  Trying to read invalid spr 896 (0x380) at 0000000000000710
Signed-off-by: NAnton Blanchard <anton@au1.ibm.com>
Signed-off-by: NAlexander Graf <agraf@suse.de>

When running -cpu on a POWER7 system with PR KVM, we mask out the 1TB
MMU capability from the MMU type mask, but not the AMR bit.

This leads to us having a new MMU type that we don't check for in our
MMU management functions.

Add the new type, so that we don't have to worry about breakage there.
We're not going to use the TCG MMU management in that case anyway.

The long term fix for this will be to move all these MMU management
functions to class callbacks.
Signed-off-by: NAlexander Graf <agraf@suse.de>

Minor SLOF fixes which are required for libvirtd to function properly:
* vio-vscsi: vscsi-report-luns can return 0
* vio-vscsi: added a proper lun parser
* SLOF: vio-vscsi: fixed bug with reported luns
Signed-off-by: NAlexey Kardashevskiy <aik@ozlabs.ru>
Signed-off-by: NAlexander Graf <agraf@suse.de>