Contains:
- Device detection in higher subchannel sets
Signed-off-by: NCornelia Huck <cornelia.huck@de.ibm.com>

If no bootdevice was specified, we try to autodetect a suitable IPL
device. Current code only searched in subchannel set 0; extend this
search to higher subchannel sets as well.
Signed-off-by: NAlexander Yarygin <yarygin@linux.vnet.ibm.com>
Reviewed-by: NDavid Hildenbrand <dahi@linux.vnet.ibm.com>
Reviewed-by: NCornelia Huck <cornelia.huck@de.ibm.com>
Signed-off-by: NCornelia Huck <cornelia.huck@de.ibm.com>

For read event mask, we assumed that the layout of the sccb was

|sccb header|event buffer header|receive mask|...|

The correct layout, however, is

|sccb header|receive mask|...|

as in-buffer and

|sccb header|event buffer header|...|

as out-buffer.

Fix this: This makes selective read work.
Reviewed-by: NDavid Hildenbrand <dahi@linux.vnet.ibm.com>
Signed-off-by: NCornelia Huck <cornelia.huck@de.ibm.com>

When executing the start function, we should start with a clear state
regarding subchannel and device status; it is easy to forget updating one
of them after the ccw has been processed.

Note that we don't need to care about resetting the various control
fields: They are cleared by tsch(), and if they were still pending,
we wouldn't be able to execute the start function in the first
place.

Also note that we don't want to clear cstat/dstat if a suspended
subchannel is resumed.

This fixes a bug where we would continue to present channel-program
check in cstat even though later ccw requests for the subchannel
finished without error (i.e. cstat should be 0).

Cc: qemu-stable@nongnu.org
Signed-off-by: NCornelia Huck <cornelia.huck@de.ibm.com>
Reviewed-by: NDavid Hildenbrand <dahi@linux.vnet.ibm.com>

For selective read event, we need to check if any event is requested
that is not active instead of whether none of the requested events is
active.
Reviewed-by: NDavid Hildenbrand <dahi@linux.vnet.ibm.com>
Reviewed-by: NEric Farman <farman@linux.vnet.ibm.com>
Signed-off-by: NCornelia Huck <cornelia.huck@de.ibm.com>

Type-0 ccws need to have a count > 0 for any command other than TIC.
Generate a channel-program check if this is not the case.
Reviewed-by: NMatthew Rosato <mjrosato@linux.vnet.ibm.com>
Signed-off-by: NCornelia Huck <cornelia.huck@de.ibm.com>

In CCW-0 format TIC command 4 highest bits are ignored in the subchannel.
In CCW-1 format the TIC command 4 highest bits must be 0.
To convert TIC from CCW-0 to CCW-1 we clear the 4 highest bits
to guarantee compatibility.
Signed-off-by: NPierre Morel <pmorel@linux.vnet.ibm.com>
Reviewed-by: NCornelia Huck <cornelia.huck@de.ibm.com>
Signed-off-by: NCornelia Huck <cornelia.huck@de.ibm.com>

Block layer patches

# gpg: Signature made Fri 04 Sep 2015 20:45:33 BST using RSA key ID C88F2FD6
# gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>"

* remotes/kevin/tags/for-upstream:
  quorum: validate vote threshold against num_children even if read-pattern is fifo
  qcow2: reorder fields in Qcow2CachedTable to reduce padding
  docs: document how to configure the qcow2 L2/refcount caches
  qcow2: add option to clean unused cache entries after some time
  qcow2: mark the memory as no longer needed after qcow2_cache_empty()
  iotests: Warn if python subprocess is killed
  iotests: Do not suppress segfaults in bash tests
  iotests: Respect -nodefaults in tests 41 and 55
  iotests: More options for VM.add_drive()
  qemu-img: Fix crash in amend invocation
  block/raw-posix: Use raw_normalize_devicepath()
  qemu-iotests: s390x: fix test 130
  qemu-iotests: s390x: fix test 049, reject negative sizes in QemuOpts
  qemu-iotests: s390x: fix test 041 and 055
  qemu-iotests: disable default qemu devices for cross-platform compatibility
  qemu-iotests: qemu machine type support
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

target-arm queue:
 * cleanup to use g_new() and friends
 * support semihosting in A64
 * add SMBIOS support to mach-virt
 * remove hw_error() usages
 * fix bug in the AArch32:AArch64 register mapping
 * add a second PCI memory window in highmem on virt board
 * fix bug in arm_excp_unmasked()
 * add i.MX31 SoC
 * remove restriction on handling affinity values in virt board

# gpg: Signature made Mon 07 Sep 2015 10:40:48 BST using RSA key ID 14360CDE
# gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>"
# gpg:                 aka "Peter Maydell <pmaydell@gmail.com>"
# gpg:                 aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>"

* remotes/pmaydell/tags/pull-target-arm-20150907: (27 commits)
  arm/virt: Add full-sized CPU affinity handling
  target-arm: Refactor CPU affinity handling
  i.MX: Add i2C devices to i.MX31 SOC
  i.MX: Add qtest support for I2C device emulator.
  i.MX: Add the i.MX25 PDK platform
  i.MX: Add SOC support for i.MX25
  i.MX: Add FEC Ethernet Emulator
  i.MX: Add I2C controller emulator
  i.MX: KZM: use standalone i.MX31 SOC support
  i.MX: Add SOC support for i.MX31
  target-arm: Fix arm_excp_unmasked() function
  hw/arm/virt: Add high MMIO PCI region, 512G in size
  target-arm: Fix AArch32:AArch64 general-purpose register mapping
  arm: Remove hw_error() usages.
  arm: cpu: assert() on no-EL2 virt IRQ error condition.
  smbios: implement smbios support for mach-virt
  smbios: add smbios 3.0 support
  target-arm: Wire up HLT 0xf000 as the A64 semihosting instruction
  target-arm/arm-semi.c: SYS_EXIT on A64 takes a parameter block
  target-arm/arm-semi.c: Implement A64 specific SyncCacheRange call
  ...
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

At least with KVM, currently there's no reason why QEMU would not be
capable of handling Aff3 != 0. This commit fixes up FDT creation in such
a case.
Signed-off-by: NPavel Fedin <p.fedin@samsung.com>
Message-id: eef5a86e6d9a313780dbc23b35fcb65df42a3e9e.1441366248.git.p.fedin@samsung.com
[PMM: folded two overlong lines]
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Introduces reusable definitions for CPU affinity masks/shifts and gets rid
of hardcoded magic numbers.
Signed-off-by: NPavel Fedin <p.fedin@samsung.com>
Message-id: 7e6def4d0d91ae64615cdd2035b94d408d0a23c6.1441366248.git.p.fedin@samsung.com
[PMM: folded overlong line]
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Signed-off-by: NJean-Christophe Dubois <jcd@tribudubois.net>
Reviewed-by: NPeter Crosthwaite <crosthwaite.peter@gmail.com>
Message-id: fb20e6bf5cf946c4530b2cfb55c7e37f5a0fc051.1441057361.git.jcd@tribudubois.net
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

This is using a ds1338 RTC chip on the I2C bus. This RTC chip is
not present on the real 3DS PDK board.
Signed-off-by: NJean-Christophe Dubois <jcd@tribudubois.net>
Acked-by: NPeter Crosthwaite <crosthwaite.peter@gmail.com>
Message-id: 05601683a2a95c881cbc9f22651a044d969bd0ae.1441057361.git.jcd@tribudubois.net
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Tested by booting a minimal Linux system on the emulated platform
Tested by booting the Xvisor hypervisor on the emulated platform
Signed-off-by: NJean-Christophe Dubois <jcd@tribudubois.net>
Reviewed-by: NPeter Crosthwaite <crosthwaite.peter@gmail.com>
Message-id: d27347300d253509d921bc27a6d0a14db877478b.1441057361.git.jcd@tribudubois.net
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

    For now we support the following devices:
      * CPU: ARM926
      * Interrupt Controller: AVIC
      * CCM
      * UART x 5
      * EPIT x 2
      * GPT x 4
      * FEC
      * I2C x 3
Signed-off-by: NJean-Christophe Dubois <jcd@tribudubois.net>
Reviewed-by: NPeter Crosthwaite <crosthwaite.peter@gmail.com>
Message-id: 62218bfa90f9101f79098e768c3d58bd92dcb7f3.1441057361.git.jcd@tribudubois.net
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

This is based on mcf_fec.c FEC implementation for Coldfire

  * A generic PHY was added (borrowwed from LAN9118)
  * The buffer management is also modified as buffers are
    slightly different between Coldfire and i.MX
Signed-off-by: NJean-Christophe Dubois <jcd@tribudubois.net>
Reviewed-by: NPeter Crosthwaite <peter.crosthwaite@xilinx.com>
Message-id: fb314f8a120aa49f8f6ad886f312c649b484fb5a.1441057361.git.jcd@tribudubois.net
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

The slave mode is not implemented.
Signed-off-by: NJean-Christophe Dubois <jcd@tribudubois.net>
Reviewed-by: NPeter Crosthwaite <peter.crosthwaite@xilinx.com>
Message-id: 508dbf2ebe26ec383d3a12a1db5a7890ac8acf20.1441057361.git.jcd@tribudubois.net
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Convert the KZM board to use the i.MX31 SoC defintition instead of
redefining the entire SoC on the machine level. Major rewrite of the
machine init code.

While touching the memory map comment de-indent to the correct level
of indentation.

This obsoletes the legacy i.MX device device creation helpers which are removed.

Tested by booting a minimal Linux system on the emulated platform
Signed-off-by: NJean-Christophe Dubois <jcd@tribudubois.net>
Reviewed-by: NPeter Crosthwaite <crosthwaite.peter@gmail.com>
Message-id: 5e783561f092e1c939562fdff001f1ab1194b07f.1441057361.git.jcd@tribudubois.net
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

For now we support the following devices:
  * CPU: ARM1136
  * Interrupt Controller: AVIC
  * CCM
  * UART x 2
  * EPIT x 2
  * GPT
Signed-off-by: NJean-Christophe Dubois <jcd@tribudubois.net>
Reviewed-by: NPeter Crosthwaite <peter.crosthwaite@xilinx.com>
Message-id: f146d819594e41568daec42a1d0f440cdfe3df76.1441057361.git.jcd@tribudubois.net
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

There is an error in arm_excp_unmasked() function:
bitwise operator & is used with integer and bool operands
causing an incorrect zeroed result.
The patch fixes it.
Signed-off-by: NSergey Sorokin <afarallax@yandex.ru>
Message-id: 1441209238-16881-1-git-send-email-afarallax@yandex.ru
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

This large region is necessary for some devices like ivshmem and video cards
32-bit kernels can be built without LPAE support. In this case such a kernel
will not be able to use PCI controller which has windows in high addresses.
In order to work around the problem, "highmem" option is introduced. It
defaults to on on, but can be manually set to off in order to be able to run
those old 32-bit guests.
Signed-off-by: NPavel Fedin <p.fedin@samsung.com>
Reviewed-by: NAlexander Graf <agraf@suse.de>
Reviewed-by: NIgor Mammedov <imammedo@redhat.com>
Reviewed-by: NShannon Zhao <shannon.zhao@linaro.org>
[PMM: Added missing ULL suffixes and a comment to the a15memmap[] entry]
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

There is an error in functions aarch64_sync_32_to_64() and
aarch64_sync_64_to_32() with mapping of registers between AArch32 and
AArch64.  This commit fixes the mapping to match the v8 ARM ARM
section D1.20.1 (table D1-77).
Signed-off-by: NSergey Sorokin <afarallax@yandex.ru>
Message-id: 1440796451-15276-1-git-send-email-afarallax@yandex.ru
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
[PMM: tidied commit message a bit]
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

All of these hw_errors are fatal and indicate something wrong with
QEMU implementation.

Convert to g_assert_not_reached.
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NPeter Crosthwaite <crosthwaite.peter@gmail.com>
Message-id: 169194d09017e5725535d31a1507d454c0043706.1440842587.git.crosthwaite.peter@gmail.com
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Replace the hw_error() for no-EL2 VIRQ with an assert.
Signed-off-by: NPeter Crosthwaite <crosthwaite.peter@gmail.com>
Message-id: 93b6acdee6cafe8ff0422a294a5640c3d35f0e17.1440842587.git.crosthwaite.peter@gmail.com
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

This patch generates smbios tables for ARM mach-virt. Also add
CONFIG_SMBIOS=y for ARM default config.
Acked-by: NGabriel Somlo <somlo@cmu.edu>
Tested-by: NGabriel Somlo <somlo@cmu.edu>
Reviewed-by: NLaszlo Ersek <lersek@redhat.com>
Reviewed-by: NShannon Zhao <shannon.zhao@linaro.org>
Tested-by: NLeif Lindholm <leif.lindholm@linaro.org>
Signed-off-by: NWei Huang <wei@redhat.com>
Message-id: 1440615870-9518-3-git-send-email-wei@redhat.com
[PMM: Added missing braces around an if().]
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

This patch adds support for SMBIOS 3.0 entry point. When caller invokes
smbios_set_defaults(), it can specify entry point as 2.1 or 3.0. Then
smbios_get_tables() will return the entry point table in right format.
Acked-by: NGabriel Somlo <somlo@cmu.edu>
Tested-by: NGabriel Somlo <somlo@cmu.edu>
Tested-by: NLeif Lindholm <leif.lindholm@linaro.org>
Signed-off-by: NWei Huang <wei@redhat.com>
Reviewed-by: NLaszlo Ersek <lersek@redhat.com>
Message-id: 1440615870-9518-2-git-send-email-wei@redhat.com
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

For the A64 instruction set, the semihosting call instruction
is 'HLT 0xf000'. Wire this up to call do_arm_semihosting()
if semihosting is enabled.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Reviewed-by: NChristopher Covington <christopher.covington@linaro.org>
Tested-by: NChristopher Covington <cov@codeaurora.org>
Message-id: 1439483745-28752-10-git-send-email-peter.maydell@linaro.org

The A64 semihosting API changes the interface for SYS_EXIT so
that instead of taking a single exception type in a register,
it takes a parameter block containing the exception type and
a sub-code. Implement this.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Tested-by: NChristopher Covington <cov@codeaurora.org>
Message-id: 1439483745-28752-9-git-send-email-peter.maydell@linaro.org

The A64 semihosting ABI defines a new call SyncCacheRange
for doing a 'clean D-cache and invalidate I-cache' sequence.
Since QEMU doesn't implement caches, we can implement this as a nop.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Reviewed-by: NChristopher Covington <christopher.covington@linaro.org>
Tested-by: NChristopher Covington <cov@codeaurora.org>
Message-id: 1439483745-28752-8-git-send-email-peter.maydell@linaro.org

The 64-bit A64 semihosting API has some pervasive changes from
the 32-bit version:
 * all parameter blocks are arrays of 64-bit values, not 32-bit
 * the semihosting call number is passed in W0
 * the return value is a 64-bit value in X0

Implement the necessary handling for this widening.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Reviewed-by: NChristopher Covington <christopher.covington@linaro.org>
Tested-by: NChristopher Covington <cov@codeaurora.org>
Message-id: 1439483745-28752-7-git-send-email-peter.maydell@linaro.org

Add support for getting and setting 64-bit values in the
softmmu semihosting support functions. This will be needed
for 64-bit ARM semihosting.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Tested-by: NChristopher Covington <cov@codeaurora.org>
Message-id: 1439483745-28752-6-git-send-email-peter.maydell@linaro.org

Factor out a repeated pattern in the semihosting code:

    gdb_do_syscall(arm_semi_cb, "system,%s", arg0, (int)arg1+1);
    /* arm_semi_cb sets env->regs[0] to the syscall return value */
    return env->regs[0];

For A64 the return value will go in a different register; pull
the sequence out into its own function that passes the return
value in a static variable rather than overloading regs[0]
for the purpose, so the code will work on both A32/T32 and A64.

Note that the lack-of-synchronization bug noted in the FIXME
comment is not introduced by this commit, but was already present.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Reviewed-by: NChristopher Covington <christopher.covington@linaro.org>
Tested-by: NChristopher Covington <cov@codeaurora.org>
Message-id: 1439483745-28752-5-git-send-email-peter.maydell@linaro.org

Implement a variant of the existing gdb_do_syscall() which
takes a va_list.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Tested-by: NChristopher Covington <cov@codeaurora.org>
Message-id: 1439483745-28752-4-git-send-email-peter.maydell@linaro.org

Print semihosting debugging information before the
do_arm_semihosting() call so that angel_SWIreason_ReportException,
which causes the function to not return, gets the same debug prints as
other semihosting calls. Also print out the semihosting call number.
Signed-off-by: NChristopher Covington <christopher.covington@linaro.org>
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Tested-by: NChristopher Covington <cov@codeaurora.org>
Message-id: 1439483745-28752-3-git-send-email-peter.maydell@linaro.org

A spurious trailing "\n" in the gdb syscall format string used
for SYS_WRITE0 meant that gdb would reject the remote syscall,
with the effect that the output from the guest was silently dropped.
Remove the newline so that gdb accepts the packet.

Cc: qemu-stable@nongnu.org
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

g_new(T, n) is neater than g_malloc(sizeof(T) * n).  It's also safer,
for two reasons.  One, it catches multiplication overflowing size_t.
Two, it returns T * rather than void *, which lets the compiler catch
more type errors.

This commit only touches allocations with size arguments of the form
sizeof(T).

Coccinelle semantic patch:

    @@
    type T;
    @@
    -g_malloc(sizeof(T))
    +g_new(T, 1)
    @@
    type T;
    @@
    -g_try_malloc(sizeof(T))
    +g_try_new(T, 1)
    @@
    type T;
    @@
    -g_malloc0(sizeof(T))
    +g_new0(T, 1)
    @@
    type T;
    @@
    -g_try_malloc0(sizeof(T))
    +g_try_new0(T, 1)
    @@
    type T;
    expression n;
    @@
    -g_malloc(sizeof(T) * (n))
    +g_new(T, n)
    @@
    type T;
    expression n;
    @@
    -g_try_malloc(sizeof(T) * (n))
    +g_try_new(T, n)
    @@
    type T;
    expression n;
    @@
    -g_malloc0(sizeof(T) * (n))
    +g_new0(T, n)
    @@
    type T;
    expression n;
    @@
    -g_try_malloc0(sizeof(T) * (n))
    +g_try_new0(T, n)
    @@
    type T;
    expression p, n;
    @@
    -g_realloc(p, sizeof(T) * (n))
    +g_renew(T, p, n)
    @@
    type T;
    expression p, n;
    @@
    -g_try_realloc(p, sizeof(T) * (n))
    +g_try_renew(T, p, n)
    @@
    type T;
    expression n;
    @@
    -(T *)g_new(T, n)
    +g_new(T, n)
    @@
    type T;
    expression n;
    @@
    -(T *)g_new0(T, n)
    +g_new0(T, n)
    @@
    type T;
    expression p, n;
    @@
    -(T *)g_renew(T, p, n)
    +g_renew(T, p, n)
Signed-off-by: NMarkus Armbruster <armbru@redhat.com>
Reviewed-by: NEric Blake <eblake@redhat.com>
Message-id: 1440524394-15640-1-git-send-email-armbru@redhat.com
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Block patches from 2015-08-24 until 2015-09-04.

# gpg: Signature made Fri Sep  4 21:02:10 2015 CEST using RSA key ID E838ACAD
# gpg: Good signature from "Max Reitz <mreitz@redhat.com>"

* mreitz/tags/pull-block-for-kevin-2015-09-04:
  quorum: validate vote threshold against num_children even if read-pattern is fifo
  qcow2: reorder fields in Qcow2CachedTable to reduce padding
  docs: document how to configure the qcow2 L2/refcount caches
  qcow2: add option to clean unused cache entries after some time
  qcow2: mark the memory as no longer needed after qcow2_cache_empty()
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

We need to use threshold to check if too many write operation fails.
If threshold is larger than num children, we always get write error
event even if all write operations success.
Signed-off-by: NWen Congyang <wency@cn.fujitsu.com>
Message-id: 55962F72.3060003@cn.fujitsu.com
Reviewed-by: NAlberto Garcia <berto@igalia.com>
Reviewed-by: NMax Reitz <mreitz@redhat.com>
Signed-off-by: NMax Reitz <mreitz@redhat.com>

Changing the current ordering saves 8 bytes per cache entry in x86_64.
Signed-off-by: NAlberto Garcia <berto@igalia.com>
Reviewed-by: NMax Reitz <mreitz@redhat.com>
Reviewed-by: NEric Blake <eblake@redhat.com>
Reviewed-by: NKevin Wolf <kwolf@redhat.com>
Message-id: 0bd55291211df3dfb514d0e7d2031dd5c4f9f807.1438690126.git.berto@igalia.com
Signed-off-by: NMax Reitz <mreitz@redhat.com>

QEMU has options to configure the size of the L2 and refcount
caches for the qcow2 format. However, choosing the right sizes for
a particular disk image is not a straightforward operation since
the ratio between the cache size and the allocated disk space is
not obvious and depends on the size of the cluster and the refcount
entries.

This document attempts to give an overview of both caches and how to
configure their sizes.
Signed-off-by: NAlberto Garcia <berto@igalia.com>
Reviewed-by: NMax Reitz <mreitz@redhat.com>
Message-id: 55de928e139b1ba3f3d40fe9c6c88f30b1f36410.1438690126.git.berto@igalia.com
Signed-off-by: NMax Reitz <mreitz@redhat.com>