When we trigger a system reset, the in-kernel openpic controller should also
get reset. This happens through a write to the GCR.RESET register which is
the same mechanism a guest would use to manually reset the device.
Signed-off-by: NAlexander Graf <agraf@suse.de>

The openpic emulation code maintains an allowable-CPU's bitmap
("destmask") for each IRQ source which is calculated from the IDR
register value whenever the guest OS writes to it.  However, if the
guest OS relies on the system to set the IDR register to a default
value at reset, and does not write IDR, then destmask does not get
updated, and interrupts do not get propagated to the guest.
Additionally, if an IRQ source is marked as critical, the source's
internal "output" and "nomask" fields are not correctly reset when the
PIC is reset.

Fix both these issues by calling write_IRQreg_idr from within
openpic_reset, instead of simply setting the IDR register to the
specified idr_reset value.
Signed-off-by: NPaul Janzen <pcj@pauljanzen.org>
Signed-off-by: NAlexander Graf <agraf@suse.de>

This patch moves the definition of openpic_reset after the various
register read/write functions. No functional change.  It is in
preparation for using the register read/write functions in
openpic_reset.
Signed-off-by: NPaul Janzen <pcj@pauljanzen.org>
Signed-off-by: NAlexander Graf <agraf@suse.de>

Signed-off-by: NBharata B Rao <bharata@linux.vnet.ibm.com>
Reviewed-by: NAlexander Graf <agraf@suse.de>
Signed-off-by: NGreg Kurz <gkurz@linux.vnet.ibm.com>
Signed-off-by: NAlexander Graf <agraf@suse.de>

POWER7, POWER7+ and POWER8 families use the ILE bit of the LPCR
special purpose register to decide the endianness to use when
entering interrupt handlers. When running a Linux guest, this
provides a hint on the endianness used by the kernel. And when
it comes to dumping a guest, the information is needed to write
ELF headers using the kernel endianness.
Suggested-by: NBenjamin Herrenschmidt <benh@kernel.crashing.org>
Reviewed-by: NAlexander Graf <agraf@suse.de>
Signed-off-by: NGreg Kurz <gkurz@linux.vnet.ibm.com>
[agraf: change subject line]
Signed-off-by: NAlexander Graf <agraf@suse.de>

Fix ppc64 arch specific dump code to support all combinations of little/big
endian hosts/guests. FWIW the current code is broken for altivec registers
when guest and host have a different endianness: these 128-bit registers
are written to guest memory as a two 64-bit entities and we should also swap
them.

Unit testing was done with the following program provided by Tom Musta:

#include <stdio.h>
#include <stdint.h>
#include <stdlib.h>

int main(int argc, char** argv)
{

__uint128_t v = ((__uint128_t)0x0001020304050607ull << 64) |
0x08090a0b0c0d0e0full;

register void * vptr asm ("r11");
vptr = &v;

for(;;)
asm volatile ("lvx 30,0,11" );
}

When sending SIGABRT to this program and examining the core file, we get:

- ppc64  : 00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f
- ppc64le: 0f 0e 0d 0c 0b 0a 09 08 07 06 05 04 03 02 01 00

We expect to find the very same layout in the QEMU dump since they are
real core files. This is what we get:

- ppc64 host, ppc64 guest   : 00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f
- ppc64 host, ppc64le guest : 0f 0e 0d 0c 0b 0a 09 08 07 06 05 04 03 02 01 00
- x86_64 host, ppc64 guest  : 00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f
- x86_64 host, ppc64le guest: 0f 0e 0d 0c 0b 0a 09 08 07 06 05 04 03 02 01 00

We introduce a NoteFuncArg type to avoid adding extra arguments to all note
functions.
Signed-off-by: NBharata B Rao <bharata@linux.vnet.ibm.com>
[ rebased on top of current master branch,
  introduced NoteFuncArg,
  use new cpu_to_dump{16,32,64} endian helpers,
  fix altivec support,
  Greg Kurz <gkurz@linux.vnet.ibm.com> ]
Reviewed-by: NAlexander Graf <agraf@suse.de>
Signed-off-by: NGreg Kurz <gkurz@linux.vnet.ibm.com>
Signed-off-by: NAlexander Graf <agraf@suse.de>

Make DumpState and endian conversion routines available for arch-specific dump
code by moving into dump.h. DumpState will be needed by arch-specific dump
code to access target endian information from DumpState->ArchDumpInfo. Also
break the dependency of dump.h from stubs/dump.c by creating a separate
dump-arch.h.

This patch doesn't change any functionality.
Signed-off-by: NBharata B Rao <bharata@linux.ibm.com>
[ rebased on top of current master branch,
  renamed endian helpers to cpu_to_dump{16,32,64},
  pass a DumpState * argument to endian helpers,
  Greg Kurz <gkurz@linux.vnet.ibm.com> ]
Signed-off-by: NGreg Kurz <gkurz@linux.vnet.ibm.com>
[agraf: fix to apply]
Signed-off-by: NAlexander Graf <agraf@suse.de>

Currently the macio DMA routines assume that all DMA requests are for read/write
block transfers. This is not always the case for ATAPI, for example when
requesting a TOC where the response is generated directly in the IDE buffer.

Detect these non-block ATAPI DMA transfers (where no lba is specified in the
command) and copy the results directly into RAM as indicated by the DBDMA
descriptor. This fixes CDROM access under MorphOS.
Signed-off-by: NMark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Signed-off-by: NAlexander Graf <agraf@suse.de>

This adds a "ibm,chip-id" property for CPU nodes which should be the same
for all cores in the same CPU socket. The recent guest kernels use this
information to associate threads with sockets.

Refer to the kernel commit 256f2d4b463d3030ebc8d2b54f427543814a2bdc
for more details.
Signed-off-by: NAlexey Kardashevskiy <aik@ozlabs.ru>
Signed-off-by: NAlexander Graf <agraf@suse.de>

This allows guests to have a different timebase origin from the host.

This is needed for migration, where a guest can migrate from one host
to another and the two hosts might have a different timebase origin.
However, the timebase seen by the guest must not go backwards, and
should go forwards only by a small amount corresponding to the time
taken for the migration.

This is only supported for recent POWER hardware which has the TBU40
(timebase upper 40 bits) register. That includes POWER6, 7, 8 but not
970.

This adds kvm_access_one_reg() to access a special register which is not
in env->spr. This requires kvm_set_one_reg/kvm_get_one_reg patch.

The feature must be present in the host kernel.

This bumps vmstate_spapr::version_id and enables new vmstate_ppc_timebase
only for it. Since the vmstate_spapr::minimum_version_id remains
unchanged, migration from older QEMU is supported but without
vmstate_ppc_timebase.
Signed-off-by: NAlexey Kardashevskiy <aik@ozlabs.ru>
Signed-off-by: NAlexander Graf <agraf@suse.de>

Almost all platforms QEMU emulates have some sort of firmware they can load
to expose a guest environment that closely resembles the way it would look
like on real hardware.

This patch introduces such a firmware on our e500 platforms. U-boot is the
default firmware for most of these systems and as such our preferred choice.

For backwards compatibility reasons (and speed and simplicity) we skip u-boot
when you use -kernel and don't pass in -bios. For all other combinations like
-kernel and -bios or no -kernel you get u-boot as firmware.

This allows you to modify the boot environment, execute a networked boot through
the e1000 emulation and execute u-boot payloads.
Signed-off-by: NAlexander Graf <agraf@suse.de>

This adds a special build of u-boot tailored for the e500 platforms we
emulate. It is based on the current version of upstream u-boot which
contains all the code necessary to drive our QEMU provided machines.
Signed-off-by: NAlexander Graf <agraf@suse.de>

We want to move to a model where firmware loads our kernel. To achieve
this we need to be able to tell firmware where the kernel lies.

Let's copy the mechanism we already use for -M pseries and expose the
kernel load address and size through the device tree.
Signed-off-by: NAlexander Graf <agraf@suse.de>

The dcbtls instruction is able to lock data inside the L1 cache.

Unfortunately we don't emulate any caches, so we have to tell the guest
that its locking attempt failed.

However, by implementing the instruction we at least don't give the
guest a program exception which it definitely does not expect.
Signed-off-by: NAlexander Graf <agraf@suse.de>

There are 2 L1 cache control registers - one for data (L1CSR0) and
one for instructions (L1CSR1).

Emulate both of them well enough to give the guest the illusion that
it could actually do anything about its caches.
Signed-off-by: NAlexander Graf <agraf@suse.de>

In addition to the L1 data cache configuration register L1CFG0 there is
also another one for the L1 instruction cache called L1CFG1.

Emulate that one with the same values as the data one.
Signed-off-by: NAlexander Graf <agraf@suse.de>

The L1CFG0 register on e200 and e500 is "User RO" according to the
specifications. So let's make it user readable and world unwritable.
Signed-off-by: NAlexander Graf <agraf@suse.de>

We're missing SPR definitions for GIVORs. Add them to the list of SPRs.
Signed-off-by: NAlexander Graf <agraf@suse.de>

Our pre-e500mc e500 CPU types didn't get instanciated with SVR information,
even though those systems do support the SVR register.

Spawn them with the SVR tag so that they don't get confused when someone tries
to read SPR_SVR.
Signed-off-by: NAlexander Graf <agraf@suse.de>

When QEMU gets compiled with --enable-debug-tcg we can check for temporary
leakage. Implement the necessary target code for this and fail emulation
when we hit a leakage.

This hopefully ensures that we don't get new leaks.
Signed-off-by: NAlexander Graf <agraf@suse.de>

We want to make sure that every instruction cleans up after itself and
clears every temporary it allocated.

While checking whether this is already the case, I came across a few
cases where it isn't. This patch fixes every translation I found that
doesn't free their allocated temporaries.
Signed-off-by: NAlexander Graf <agraf@suse.de>

This patch adds pci pin to irq_num routing callback.
This callback is called from pci_device_route_intx_to_irq to
find which pci device maps to which irq.
This fix is required for pci-device passthrough using vfio.

Also without this patch we gets below prints

"
  PCI: Bug - unimplemented PCI INTx routing (e500-pcihost)
  qemu-system-ppc64: PCI: Bug - unimplemented PCI INTx routing (e500-pcihost) "

and Legacy interrupt does not work with pci device passthrough.
Signed-off-by: NBharat Bhushan <Bharat.Bhushan@freescale.com>
Acked-by: NMichael S. Tsirkin <mst@redhat.com>
[agraf: remove double semicolon]
Signed-off-by: NAlexander Graf <agraf@suse.de>

- Use PCI_NUM_PINS rather than hardcoding
 - use "pin" wherever possible
Signed-off-by: NBharat Bhushan <Bharat.Bhushan@freescale.com>
Signed-off-by: NAlexander Graf <agraf@suse.de>

When we select a CPU type that does not support 1TB segments, we should
not expose 1TB just because KVM supports 1TB segments. User configuration
always wins over feature availability.
Signed-off-by: NAlexander Graf <agraf@suse.de>

This patch refactors the PowerPC Advanced Encryption Standard (AES) instructions
to use the common AES tables (include/qemu/aes.h).

Specifically:
    - vsbox is recoded to use the AES_sbox table.
    - vcipher, vcipherlast and vncipherlast are all recoded to use the optimized
      AES_t[ed][0-4] tables.
    - vncipher is recoded to use a combination of InvS-Box, InvShiftRows and
      InvMixColumns tables.  It was not possible to use AES_Td[0-4] due to a
      slight difference in how PowerPC implements vncipher.
Signed-off-by: NTom Musta <tommusta@gmail.com>
Reviewed-by: NRichard Henderson <rth@twiddle.net>
Signed-off-by: NAlexander Graf <agraf@suse.de>

This patch refactors the ARM cryptographic instructions to use the
(newly) added common tables from include/qemu/aes.h.
Signed-off-by: NTom Musta <tommusta@gmail.com>
Reviewed-by: NRichard Henderson <rth@twiddle.net>
Signed-off-by: NAlexander Graf <agraf@suse.de>

This patch eliminates the (now) redundant copy of the Advanced Encryption Standard (AES)
ShiftRows and InvShiftRows tables; the code is updated to use the common tables declared in
include/qemu/aes.h.
Signed-off-by: NTom Musta <tommusta@gmail.com>
Reviewed-by: NRichard Henderson <rth@twiddle.net>
Signed-off-by: NAlexander Graf <agraf@suse.de>

This patch adds the table implementation of the Advanced Encryption Standard (AES)
InvMixColumns transformation.

The patch is intentionally asymmetrical -- the MixColumns table is not added because
there is no known use for it at this time.
Signed-off-by: NTom Musta <tommusta@gmail.com>
Reviewed-by: NRichard Henderson <rth@twiddle.net>
Signed-off-by: NAlexander Graf <agraf@suse.de>

This patch adds tables that implement the Advanced Encryption Standard (AES) ShiftRows
and InvShiftRows transformations.  These are commonly used in instruction models.
Signed-off-by: NTom Musta <tommusta@gmail.com>
Reviewed-by: NRichard Henderson <rth@twiddle.net>
Signed-off-by: NAlexander Graf <agraf@suse.de>

This patch adds tables for the S-Box and InvS-Box transformations commonly used by various
Advanced Encription Standard (AES) instruction models.
Signed-off-by: NTom Musta <tommusta@gmail.com>
Reviewed-by: NRichard Henderson <rth@twiddle.net>
Signed-off-by: NAlexander Graf <agraf@suse.de>

At the moment XICS does not support interrupts reuse so sPAPR PHB
implements this. sPAPRPHBState holds array of 32 spapr_pci_msi to
describe PCI config address, first MSI and number of MSIs. Once
allocated for a device, QEMU tries reusing this config until the number
of MSIs changes.

Existing SPAPR guests call ibm,change-msi in a loop until the handler
returns the requested number of vectors.

Recently introduced check for the maximum number of MSI/MSIX vectors
supported by a device only works for a device which is new for PHB's
MSI cache. If it is already there, the check is not performed which
leads to new IRQ block allocation. This happens during PCI hotplug
even when the user hot plug the same device which he just hot unplugged.

This moves the check earlier.
Signed-off-by: NAlexey Kardashevskiy <aik@ozlabs.ru>
Signed-off-by: NAlexander Graf <agraf@suse.de>

Add emulation of the PowerPC Decimal Floating Point Shift Significand
Left Immediate (dscli[q][.]) and DFP Shift Significant Right Immediate
(dscri[q][.]) instructions.
Signed-off-by: NTom Musta <tommusta@gmail.com>
Signed-off-by: NAlexander Graf <agraf@suse.de>

Add emulation of the PowerPC Decimal Floating Point Insert Biased
Exponent instructions diex[q][.].
Signed-off-by: NTom Musta <tommusta@gmail.com>
Signed-off-by: NAlexander Graf <agraf@suse.de>

Add emulation of the PowerPC Decimal Floating Point Extract
Biased Exponent instructions dxex[q][.].
Signed-off-by: NTom Musta <tommusta@gmail.com>
Signed-off-by: NAlexander Graf <agraf@suse.de>

Add emulation of the PowerPC Decimal Floating Point Encode Binary
Coded Decimal to Densely Packed Decimal instructions denbcd[q][.].
Signed-off-by: NTom Musta <tommusta@gmail.com>
Signed-off-by: NAlexander Graf <agraf@suse.de>

Add emulation of the Power PC Decimal Floating Point Decode
Densely Packed Decimal to Binary Coded Decimal instructions
ddedpd[q][.].
Signed-off-by: NTom Musta <tommusta@gmail.com>
Signed-off-by: NAlexander Graf <agraf@suse.de>

Add emulation of the PowerPC Decimal Floating Point Convert to Fixed
instructions dctfix[q][.].
Signed-off-by: NTom Musta <tommusta@gmail.com>
Signed-off-by: NAlexander Graf <agraf@suse.de>

Add emulation of the PowerPC Decimal Floating Point Convert to
Fixed instructions dctfix[q][.].
Signed-off-by: NTom Musta <tommusta@gmail.com>
Signed-off-by: NAlexander Graf <agraf@suse.de>

Add emulation of the PowerPC Round to DFP Short (drsp[.]) and Round to
DFP Long (drdpq[.]) instructions.
Signed-off-by: NTom Musta <tommusta@gmail.com>
Signed-off-by: NAlexander Graf <agraf@suse.de>

Add emulation of the PowerPC Convert to DFP Long (dctdp[.]) and
Convert to DFP Extended (dctqpq[.]) instructions.
Signed-off-by: NTom Musta <tommusta@gmail.com>
Signed-off-by: NAlexander Graf <agraf@suse.de>