As Nathan pointed out correctly, the mtmsr instruction does not modify
the high 32 bits of MSR. It also doesn't matter if SF is set or not,
the instruction always behaves the same.

This patch moves it a bit closer to the spec.
Reported-by: NNathan Whitehorn <nwhitehorn@freebsd.org>
Signed-off-by: NAlexander Graf <agraf@suse.de>

There were some changes upstream to account for broken usage of mtmsr, so
before applying the mtmsr patch we need to update OpenBIOS, otherwise the
PPC target would break.
Signed-off-by: NAlexander Graf <agraf@suse.de>

When running a PPC guest with KVM that can do PV operations, we need
to indicate the guest which instructions to use for a hypercall and
that it is running as KVM guest.

This logic was available on openbios based machines already. This patch
also adds said functionality to the mpc8544ds machine.
Signed-off-by: NAlexander Graf <agraf@suse.de>
Acked-by: NScott Wood <scottwood@freescale.com>

During testing, I was generating a vmlinux binary that easily occupied
more than 20MB of RAM. Since the current -kernel code loads the initrd
at a fixed address behind the kernel, we were overwriting kernel data
when the kernel got too big.

To finally get rid of the issue, let's calculate the initrd and cmdline
addresses relative to the kernel size, so we can have kernels and initrds
that are as big as they want to - as long as they fit in RAM.
Signed-off-by: NAlexander Graf <agraf@suse.de>

On at least the PowerPC 601, a direct-store (T=1) with bus unit ID 0x07F
is special-cased as memory-forced I/O controller access. It is supposed
to be checked immediately if T=1, bypassing all protection mechanisms
and acting cache-inhibited and global.
Signed-off-by: NHervé Poussineau <hpoussin@reactos.org>

Simplified by avoiding reindentation. Added explanatory comments.

Cc: Alexander Graf <agraf@suse.de>
Signed-off-by: NAndreas Färber <andreas.faerber@web.de>
Signed-off-by: NAlexander Graf <agraf@suse.de>

When Linux reboots an e500 VM, it writes to a magic register in the
"global-utilities" device indicated by the device tree. We were not
emulating that device so far, rendering the VM reboot-less.

This patch implements that device with only the reboot functionality
implemented and adds it to the device tree. With this patch applied,
I can successfully reboot a -M mpc8544ds VM.
Signed-off-by: NAlexander Graf <agraf@suse.de>
Reviewed-by: NAndreas Färber <andreas.faerber@web.de>

The 9118 ethernet controller interrupt line is active low unless
the IRQ config register is programmed to set both the IRQ_POL
(polarity: active-high) and IRQ_TYPE (type: push-pull) bits:
implement support for inverting the irq output in other configurations.
This also requires that we support setting the bits in the first
place, and that we correctly preserve them across software reset.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NAndrzej Zaborowski <andrew.zaborowski@intel.com>

BeOS and Haiku on i386 use long for 32-bit types, including pid_t.
Using %d with pid_t therefore results in a warning.

Unfortunately POSIX:2008 does not define a PRId* string for pid_t.

In some places pid_t was previously casted to long and %ld hardcoded.
The predecessor of this patch added another upcast for the simpletrace
filename but was not applied to date.

Since new uses of pid_t with %d keep creeping in, let's instead define
an OS-dependent format string and use that consistently.

Cc: Stefan Hajnoczi <stefanha@gmail.com>
Cc: Blue Swirl <blauwirbel@gmail.com>
Cc: Ingo Weinhold <ingo_weinhold@gmx.de>
Cc: Gleb Natapov <gleb@redhat.com>
Signed-off-by: NAndreas Färber <andreas.faerber@web.de>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

Register the smc91c111 reset function as a qdev reset function.
Signed-off-by: NJuha Riihimäki <juha.riihimaki@nokia.com>
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

* 'cocoa-for-upstream' of git://repo.or.cz/qemu/afaerber:
  Darwin: Fix compilation warning regarding the deprecated daemon() function
  cocoa: Avoid warning related to multiple handleEvent: definitions
  cocoa: Revert dependency on VNC
  cocoa: Provide central qemu_main() prototype
  Fix libfdt warnings on Darwin
  configure: Fix check for fdatasync()
  Remove warning in printf due to type mismatch
  Cocoa: avoid displaying window when command-line contains '-h' or '-help'
  Fix compilation warning due to incorrectly specified type
  cocoa: do not create a spurious window for -version

Add command line support for logging to a location other than /tmp/qemu.log.

With logging enabled (command line option -d), the log is written to
the hard-coded path /tmp/qemu.log. This patch adds support for writing
the log to a different location by passing the -D option.
Signed-off-by: NMatthew Fernandez <matthew.fernandez@gmail.com>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

Without this, qemu segfaults when a BH handler first deletes its BH and
then calls another function which involves a nested qemu_bh_poll() call.

This can be reproduced by generating an I/O error (e.g. with blkdebug) on
an IDE device and using rerror/werror=stop to stop the VM. When continuing
the VM, qemu segfaults.
Signed-off-by: NKevin Wolf <kwolf@redhat.com>
Reviewed-by: NStefan Hajnoczi <stefanha@linux.vnet.ibm.com>

Clearing the error status flag was missing for restarting flushes. Now that the
error status is separate from the BM status register, we can simply set it to 0
after restarting the request. This ensures that we never forget to clear a bit.
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

Add support for TRIM sub function of the data set management command,
and wire it up to the qemu discard infrastructure.
Signed-off-by: NChristoph Hellwig <hch@lst.de>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

Replace the is_read flag with a dma_cmd flag to allow the dma and
restart logic to handler other commands like TRIM.
Signed-off-by: NChristoph Hellwig <hch@lst.de>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

Make dma_bdrv_io available for drivers, and pass an explicit I/O function
instead of hardcoding bdrv_aio_readv/bdrv_aio_writev.  This is required
to implement non-READ/WRITE dma commands in the ide driver, e.g. the
upcoming TRIM support.
Signed-off-by: NChristoph Hellwig <hch@lst.de>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

Signed-off-by: NKevin Wolf <kwolf@redhat.com>

When a failed PIO request caused the VM to stop, we still need to transfer the
PIO state even though DRQ=0 at this point.
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

When adding the werror=stop mode, some flags were added to s->status
which are used to determine what kind of operation should be restarted
when the VM is continued.

Unfortunately, it turns out that s->status is in fact a device register
and as such is visible to the guest (some of the abused bits are even
writable for the guest).

For migration we keep on using the old VMState field (renamed to
migration_compat_status) if the status register doesn't use any of the
previously abused bits. If it does, we use a subsection with a clean copy of
the status register.

The error status is always sent in a subsection if there is any error. It can't
use the old field because errors happen even without PCI.
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

If qcow2_cache_put returns an error during cluster allocation and the
allocation fails, it must be removed from the list of in-flight allocations.
Otherwise we'd get a loop in the list when the ACB is used for the next
allocation.

Luckily, this qcow2_cache_put shouldn't fail anyway because the L2 table is
only read, so that qcow2_cache_put doesn't even involve I/O.
Signed-off-by: NKevin Wolf <kwolf@redhat.com>
Reviewed-by: NChristoph Hellwig <hch@lst.de>

Signed-off-by: NDevin Nakamura <devin122@gmail.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

bdrv_aio_* must not call the callback before returning to its caller. In vdi,
this could happen in some error cases. This starts the real requests processing
in a BH to avoid this situation.
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

bdrv_aio_* must not call the callback before returning to its caller. In qcow,
this could happen in some error cases. This starts the real requests processing
in a BH to avoid this situation.
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

bdrv_aio_* must not call the callback before returning to its caller. In qcow2,
this could happen in some error cases. This starts the real requests processing
in a BH to avoid this situation.
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

This patchset enables a new CPU feature SMEP (Supervisor Mode Execution
Protection) in QEMU-KVM. SMEP prevents kernel from executing code in application.
Updated Intel SDM describes this CPU feature. The document will be published soon.

SMEP is identified by CPUID leaf 7 EBX[7], which is 0 before. Get the right value by query KVM kernel module, so that guest can get SMEP through CPUID.
Signed-off-by: NYang, Wei <wei.y.yang@intel.com>
Singed-off-by: NShan, Haitao <haitao.shan@intel.com>
Singed-off-by: NLi, Xin <xin.li@intel.com>
Signed-off-by: NMarcelo Tosatti <mtosatti@redhat.com>

When KVM is running on VIA CPU with host cpu's model, the
feautures of VIA CPU will be passed into kvm guest by calling
the CPUID instruction for Centaur.

Signed-off-by: BrillyWu<brillywu@viatech.com.cn>
Signed-off-by: KaryJin<karyjin@viatech.com.cn>
Signed-off-by: NMarcelo Tosatti <mtosatti@redhat.com>

ccid_initfn() allocates CCIDBus dynamically, but there is no exit
callback to free it.

Fix by getting rid of the allocation.
Signed-off-by: NMarkus Armbruster <armbru@redhat.com>

No flag to configure is required. Instead, added a libcacard.la target that
is not built by default, only when requested explicitly via:

mkdir build
cd build
../configure
make libcacard.la
make install-libcacard

Uses libtool to do actual linking of object files and shared library, and
installing. Tested only under linux, but supposed to work on other systems as
well.

If libtool isn't found you get a message complaining about that, only at build
time (since it is not a default target I did not add a message at configure
time).

New build artifacts:
 .libs subdirectories (at <buildroot> and <buildroot>/libcacard)
 *.lo files (at same locations as the respective o files)

Added %.lo : %.c rule that uses libtool.
Updated clean rule to clean up those artifacts.
Added specific rule to call dtrace with libtool wrapper (note that because of
a current upstream dtrace bug fixed by systemtap b1568fd85 commit the -fPIC flag
isn't actually passed on. still current dtrace+libtool produced object links fine).
If libtool is missing any of the following targets will complain and exit 1:
 any subdir: *.lo
 root and libcacard: libcacard.la, libcacard-instsall

Tested to link and load with all tracing backends.

expire_time must be initialited when the guest activates the
usb scheduler, not at device creation time.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Implement the wakeup callback in the OHCI USBPortOps, so that when
a downstream device wakes up it correctly causes the OHCI controller
to come out of suspend.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

HcPeriodCurrentED is read-only, but Linux writes to it anyway; silently
ignore this rather than printing a warning message.

(Specifically, drivers/usb/host/ohci-hub.c:ohci_rh_resume() writes a
0, in at least kernels 2.6.25 through 2.6.39.)
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Signed-off-by: NBrad Hards <bradh@frogmouth.net>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Signed-off-by: NBrad Hards <bradh@frogmouth.net>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Signed-off-by: NBrad Hards <bradh@frogmouth.net>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

This causes an "Error: tried to detach unattached usb device " to be printed,
this can happen when deleting ie a usb host qdev, which did not
get attached (because a device matching the filter never got plugged in).
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>