When we're done with one interrupt, we need to search for the next pending
interrupt in the queue. This search has grown quite big now that we have
more than 256 possible irq lines.

So let's memorize how many interrupts we have pending in our bitmaps, so
that we can always bail out in the usual case - the one where we're all done.
Signed-off-by: NAlexander Graf <agraf@suse.de>

This patch removes all remaining occurences of spaces before function
parameter indicating parenthesis.
Signed-off-by: NAlexander Graf <agraf@suse.de>

The MSI-X vector tables are usually stored in little endian in memory,
so let's mark the accessors as such.

This fixes MSI-X on e500 for me.
Signed-off-by: NAlexander Graf <agraf@suse.de>
Acked-by: NMichael S. Tsirkin <mst@redhat.com>

The new PCI host bridge device needs to identify itself as PCI host bridge.
Declare it as such.
Signed-off-by: NAlexander Graf <agraf@suse.de>

Now that our interrupt controller supports MSIs, let's expose that feature
to the guest through the device tree!
Signed-off-by: NAlexander Graf <agraf@suse.de>

The OpenPIC allows MSI access through shared MSI registers. Implement
them for the MPC8544 MPIC, so we can support MSIs.
Signed-off-by: NAlexander Graf <agraf@suse.de>

Now that we can properly distinguish between openpic model differences,
let's move brr1 out of the raven code path.
Signed-off-by: NAlexander Graf <agraf@suse.de>

This patch converts the OpenPIC device to qdev. Along the way it
renames the "openpic" target to "raven" and the "mpic" target to
"fsl_mpic_20", to better reflect the actual models they implement.

This way we have a generic OpenPIC device now that can handle
different flavors of the OpenPIC specification.
Signed-off-by: NAlexander Graf <agraf@suse.de>

The current openpic emulation contains half-ready code for bypass mode.
Remove it, so that when someone wants to finish it they can start from a
clean state.
Signed-off-by: NAlexander Graf <agraf@suse.de>

Rename the openpic_t struct to OpenPICState, so it adheres better to
the current coding style rules.
Signed-off-by: NAlexander Graf <agraf@suse.de>

The openpic code has its own bitmap code to access bits inside of a
bitmap. However, that is overkill when we simply want to check for a
bit inside of a uint32_t.

So instead, let's use normal bit masks and C builtin shifts and ands.
Signed-off-by: NAlexander Graf <agraf@suse.de>

The openpic source irqs are carrying around a type indicator that
is never accessed by anything. Remove it.
Signed-off-by: NAlexander Graf <agraf@suse.de>

The only difference between the "openpic" and "mpic" memory api subregion
descriptors is the endianness. Unify them as openpic accessors with explicit
endianness markers in their names.
Signed-off-by: NAlexander Graf <agraf@suse.de>

The openpic and mpic reset handlers are almost identical. Combine
them and extract the differences into state variables.
Signed-off-by: NAlexander Graf <agraf@suse.de>

The openpic and mpic timer handling code is basically the same.
Merge them.
Signed-off-by: NAlexander Graf <agraf@suse.de>

The IRQ raise mechanisms of the OpenPIC and MPIC controllers is identical,
just that the MPIC one can also raise critical interrupts.

Combine those two and check for critical raise capability during runtime.
Signed-off-by: NAlexander Graf <agraf@suse.de>

The "openpic" controller is currently using one big region and does
subregion dispatching manually. Move this to the memory api.
Signed-off-by: NAlexander Graf <agraf@suse.de>

The MPIC source irq handler suddenly became identical to the standard
OpenPIC source irq handler. Combine them into the same function.
Signed-off-by: NAlexander Graf <agraf@suse.de>

The openpic code was still using the old mmio memory api. Convert it to
be a generic memory api user and clean up some code that becomes redundant
that way.
Signed-off-by: NAlexander Graf <agraf@suse.de>

MPIC interrupt numbers in Linux (device tree) and in QEMU are different,
because QEMU takes the sparseness of the IRQ number space into account.

Remove that cleverness and instead assume a flat number space. This makes
the code easier to understand, because we are actually aligned with Linux
on the view of our worlds.
Signed-off-by: NAlexander Graf <agraf@suse.de>

The openpic code had a few WIP bits left that nobody reanimated within
the last few years. Remove that code.
Signed-off-by: NAlexander Graf <agraf@suse.de>
Acked-by: NHervé Poussineau <hpoussin@reactos.org>

The PAPR specification requires that every bus or device mediated by the
IOMMU have a unique Logical IO Bus Number (LIOBN).  This patch adds a check
to enforce this, which will help catch errors in configuration earlier.
Signed-off-by: NDavid Gibson <david@gibson.dropbear.id.au>
Signed-off-by: NAlexander Graf <agraf@suse.de>

PCI Root complex have TYPE-1 configuration header while PCI endpoint
have type-0 configuration header. The type-1 configuration header have
a BAR (BAR0). In Freescale PCI controller BAR0 is used for mapping pci
address space to CCSR address space. This can used for 2 purposes: 1)
for MSI interrupt generation 2) Allow CCSR registers access when configured
as PCI endpoint, which I am not sure is a use case with QEMU-KVM guest.

What I observed is that when guest read the size of BAR0 of host controller
configuration header (TYPE1 header) then it always reads it as 0. When
looking into the QEMU hw/ppce500_pci.c, I do not find the PCI controller
device registering BAR0. I do not find any other controller also doing so
may they do not use BAR0.

There are two issues when BAR0 is not there (which I can think of):
1) There should be BAR0 emulated for PCI Root complex (TYPE1 header) and
when reading the size of BAR0, it should give size as per real h/w.

2) Do we need this BAR0 inbound address translation?
        When BAR0 is of non-zero size then it will be configured for PCI
address space to local address(CCSR) space translation on inbound access.
The primary use case is for MSI interrupt generation. The device is
configured with an address offsets in PCI address space, which will be
translated to MSI interrupt generation MPIC registers. Currently I do
not understand the MSI interrupt generation mechanism in QEMU and also
IIRC we do not use QEMU MSI interrupt mechanism on e500 guest machines.
But this BAR0 will be used when using MSI on e500.

I can see one more issue, There are ATMUs emulated in hw/ppce500_pci.c,
but i do not see these being used for address translation.
So far that works because pci address space and local address space are 1:1
mapped. BAR0 inbound translation + ATMU translation will complete the address
translation of inbound traffic.
Signed-off-by: NBharat Bhushan <bharat.bhushan@freescale.com>
[agraf: fix double variable assignment w/o read]
Signed-off-by: NAlexander Graf <agraf@suse.de>

All devices are also placed under CCSR memory region.
The CCSR memory region is exported to pci device. The MSI interrupt
generation is the main reason to export the CCSR region to PCI device.
This put the requirement to move mpic under CCSR region, but logically
all devices should be under CCSR. So this patch places all emulated
devices under ccsr region.
Signed-off-by: NBharat Bhushan <bharat.bhushan@freescale.com>
Signed-off-by: NAlexander Graf <agraf@suse.de>

Now that we have implemented PAPR compatible NVRAM interfaces in qemu, this
updates the SLOF firmware to actually initialize and use the NVRAM as a
PAPR guest firmware is expected to do.

This SLOF update also includes an ugly but useful workaround for a bug in
the SLES11 installer which caused it to fail under KVM.
Signed-off-by: NDavid Gibson <david@gibson.dropbear.id.au>
Signed-off-by: NAlexander Graf <agraf@suse.de>

The PAPR specification requires a certain amount of NVRAM, accessed via
RTAS, which we don't currently implement in qemu.  This patch addresses
this deficiency, implementing the NVRAM as a VIO device, with some glue to
instantiate it automatically based on a machine option.

The machine option specifies a drive id, which is used to back the NVRAM,
making it persistent.  If nothing is specified, the driver instead simply
allocates space for the NVRAM, which will not be persistent
Signed-off-by: NDavid Gibson <david@gibson.dropbear.id.au>
Signed-off-by: NAlexander Graf <agraf@suse.de>

Currently the XICS irq controller code has a per-irq state structure which
amongst other things includes whether the interrupt is level or message
triggered - this is configured by the platform code, and is not directly
visible to the guest.  This leads to a slightly awkward construct at reset
time where we need to reset everything in the state structure _except_ the
lsi/msi flag, which needs to retain the information given at platform init
time.

More importantly this flag will make matching the qemu state to the KVM
state for the upcoming in-kernel XICS implementation more awkward.  This
patch, therefore, removes this flag from the per-irq state structure,
instead adding a parallel array giving the lsi/msi configuration per irq.
Signed-off-by: NDavid Gibson <david@gibson.dropbear.id.au>
Signed-off-by: NAlexander Graf <agraf@suse.de>

This patch adds tracing / debugging calls to the XICS interrupt controller
implementation used on the pseries machine.
Signed-off-by: NBen Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: NDavid Gibson <david@gibson.dropbear.id.au>
Signed-off-by: NAlexander Graf <agraf@suse.de>

Kernel-based RTAS calls will not have a qemu handler, but will
still be registered in qemu in order to be assigned a token
number and appear in the device-tree.

Let's test for the name being NULL rather than the handler
when deciding to skip an entry while building the device-tree
Signed-off-by: NBenjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: NDavid Gibson <david@gibson.dropbear.id.au>
Signed-off-by: NAlexander Graf <agraf@suse.de>

The kernel will soon be able to service some RTAS calls. However the
choice of tokens will still be up to userspace. To support this have
spapr_rtas_register() return the token that is allocated for an
RTAS call, that allows the calling code to tell the kernel what the
token value is.
Signed-off-by: NMichael Ellerman <michael@ellerman.id.au>
Signed-off-by: NBenjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: NDavid Gibson <david@gibson.dropbear.id.au>
Signed-off-by: NAlexander Graf <agraf@suse.de>

Currently the lowest "real" irq number for the XICS irq controller (as
opposed to numbers reserved for IPIs and other special purposes) is
hard coded as 16 in two places - in xics_system_init() and in spapr.c.

As well as being generally bad practice, we're going to need to change this
number soon to fit in with the in-kernel XICS implementation.  This patch
adds a #define for this number to avoid future breakage.
Signed-off-by: NMichael Ellerman <michael@ellerman.id.au>
Signed-off-by: NBen Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: NDavid Gibson <david@gibson.dropbear.id.au>
Signed-off-by: NAlexander Graf <agraf@suse.de>

Currently in the reset code for the XICS interrupt controller, we
initialize the pending_priority field to 0 (most favored, by XICS
convention).  This is incorrect, since there is no pending interrupt, it
should be set to least favored - 0xff.  At the moment our XICS
implementation doesn't get hurt by this edge case, but it does confuse the
upcoming kernel XICS implementation.
Signed-off-by: NDavid Gibson <david@gibson.dropbear.id.au>
Signed-off-by: NAlexander Graf <agraf@suse.de>

* afaerber/qom-cpu:
  target-i386: Postpone cpuid_level update to realize time
  target-i386: Use define for cpuid vendor string size
  target-i386: Separate feature string parsing from CPU model lookup
  target-i386/cpu.c: Coding style fixes
  qdev: qdev_create(): use error_report() instead of hw_error()
  sysemu.h: Include qemu-types.h instead of qemu-common.h
  Create qemu-types.h for struct typedefs
  qlist.h: Do not include qemu-common.h
  qga/channel-posix.c: Include headers it needs
  qapi/qmp-registry.c: Include headers it needs
  ui/vnc-palette.c: Include headers it needs
  user: Rename qemu-types.h to qemu-user-types.h
  user: Move *-user/qemu-types.h to main directory
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

* stefanha/trivial-patches:
  pc_sysfw: Plug memory leak on pc_fw_add_pflash_drv() error path
  qemu-options: Fix space at EOL
  Fix spelling in comments and documentation
  Clean up pci_drive_hot_add()'s use of BlockInterfaceType
  arm: a9mpcore: remove un-used ptimer_iomem field
  target-sparc: Remove t0, t1 from CPUSPARCState
  target-m68k: Remove t1 from CPUM68KState
  target-alpha: Remove t0, t1 from CPUAlphaState
  s390x: Spelling fixes (endianess -> endianness, occured -> occurred)
  Fix comments (adress -> address, layed -> laid, wierd -> weird)
  Fix spelling (prefered -> preferred)
  configure: Remove stray debug output
  sd: Send debug printfery to stderr not stdout

Conflicts:
	configure

Resolve spelling conflict in configure.
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

* kraxel/acpi.1:
  acpi: drop debug port
  q35: update lpc pci config space according to configured devices
  apci: switch piix4 pci hotplug to memory api
  acpi: remove acpi_gpe_blk
  apci: switch piix4 gpe to memory api
  acpi: fix piix4 smbus mapping
  acpi: switch smbus to memory api
  acpi: cleanup ich9 memory region
  apci: switch ich9 smi to memory api
  apci: switch ich9 gpe to memory api
  acpi: cleanup vt82c686 memory region
  acpi: cleanup piix4 memory region
  apci: switch evt to memory api
  apci: switch cnt to memory api
  apci: switch timer to memory api
  apci: switch vt82c686 to memory api
  apci: switch ich9 to memory api
  apci: switch piix4 to memory api

Conflicts:
	hw/lpc_ich9.c

Resolved merge conflict due to apm_init adding an argument.
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

* aneesh/for-upstream:
  virtfs-proxy-helper: use setresuid and setresgid
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

* kraxel/usb.74:
  usb-tablet: Allow connecting to ehci
  ehci: Lower timer freq when the periodic schedule is idle
  usb: Allow overriding of usb_desc at the device level
  usb: Don't allow USB_RET_ASYNC for interrupt packets
  usb: Call wakeup when data becomes available for all devices with int eps
  add pc-1.4
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Default to 'cc' as our compiler, rather than 'gcc'. We used to have
to insist on gcc when we still kept the CPU env in a fixed global
register, but this is no longer necessary and we will now compile OK
on clang as well as gcc.  Using 'cc' should generally result in us
using the most standard and maintained system compiler for the
platform.  (For instance on newer MacOS X 'gcc' exists but is an
elderly compiler provided mostly for legacy reasons, and 'cc'
(which is clang) is definitely the better choice.) On Linux there
will generally be no user-visible change since cc will be gcc.

This changeover necessitates a slight reworking of how we set the
'cc' variable, because GNU cross toolchains generally provide a
'${cross_prefix}gcc' but not a '${cross_prefix}cc'.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

The Linux syscalls underlying pread() and pwrite() take a 64 bit
offset on all architectures, even if some of them name the syscall
"pread/pwrite" rather than "pread64/pwrite64" for historical reasons.
So move the four QEMU target architectures (arm, i386, sparc,
unicore32) which were defining TARGET_NR_pread/pwrite to define
TARGET_NR_pread64/pwrite64 instead, and drop the TARGET_NR_pread/pwrite
implementation code completely.

(Based on examination of the kernel sources for the four architectures
this patch affects.)
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

Use movcond for all sorts of conditional moves, ABS, CLAMPS, MIN/MAX
opcodes.
Signed-off-by: NMax Filippov <jcmvbkbc@gmail.com>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>