This is a set of patches dealing with kdump support for s390x/kvm.
kdump on s390x uses subcode 1 of diagnose 0x308 to put the hardware
in a defined state. This is different from a full reset, since it
does not touch all CPU registers.
These patches define the cpu resets, the subsystem reset a load
function and also wires up the "nmi" command to issue a RESTART
interrupt as defined in the z/Architecture principles of operation.

This allows recent guest kernels with properly setup userspace
to trigger kdump:
- via guest crash
- via nmi from the host

# gpg: Signature made Fri 30 Aug 2013 07:19:18 AM CDT using RSA key ID B5A61C7C
# gpg: Can't check signature: public key not found

# By Christian Borntraeger (5) and Eugene (jno) Dvurechenski (2)
# Via Christian Borntraeger
* borntraeger/tags/kdump:
  s390: wire up nmi command to raise a RESTART interrupt on S390
  s390: Implement load normal reset
  s390/cpu: split CPU reset into architectured functions
  s390: provide a cpu load normal function
  s390: provide I/O subsystem reset
  s390/kvm: basic implementation of diagnose 308 subcode 6
  s390x/kvm: Fix switch/case indentation for handle_diag

Message-id: 1377810649-47484-1-git-send-email-borntraeger@de.ibm.com

There is the 'nmi' command that is used to trigger a guest dump via kdump feature on x86.
s390 uses RESTART interrupt to trigger kdump.
So, this patch provides a mean to use 'nmi' command on s390 to raise RESTART interrupt.

The CPU to receive the RESTART interrupt is the "default" one.

There is an infrastructure to select the "default" CPU using 'cpu' command.
The 'info cpus' command can be used to see which one is the "default".

In order to wire up the RESTART to 'nmi' command we had to:
1. implement the kvm_s390_cpu_restart function by exporting the existing code
2. implement s390_cpu_restart function as kvm-aware wrapper
3. modify the qmp_inject_nmi function to enable (for s390) the scan for
   "default" CPU and call s390_cpu_restart for it;
3. fix some messages.
Signed-off-by: NEugene (jno) Dvurechenski <jno@linux.vnet.ibm.com>
Signed-off-by: NChristian Borntraeger <borntraeger@de.ibm.com>
Acked-by: NAlexander Graf <agraf@suse.de>

kdump on s390 uses a load normal reset to bring the system in a defined
state by doing a subsystem reset. The issuing CPUs will have an initial
CPU reset, all other CPUs will have a CPU reset as defined in POP (no
register content will change).

Implement this as architectured.
Signed-off-by: NChristian Borntraeger <borntraeger@de.ibm.com>

s390 provides several CPU resets:
- CPU reset, clears interrupts, stop processing, clears TLB, but does
  not touch registers
- initial CPU reset, like CPU reset, but also clears PSW, prefix, FPC,
  timer and control registers. It does not touch gprs, fprs and acrs (!)
- Power on reset: the full monty

wire up CPUClass reset to the full monty, but provide the lesser resets
as part of S390CPUClass.
Signed-off-by: NChristian Borntraeger <borntraeger@de.ibm.com>

Some code needs to perform an IPL-like bootup that mimics the
ESA (31bit) restart. Provide a cpu class method that does so.
Signed-off-by: NChristian Borntraeger <borntraeger@de.ibm.com>
Acked-by: NAlexander Graf <agraf@suse.de>

Provide a function that resets the I/O subsystem.
Signed-off-by: NChristian Borntraeger <borntraeger@de.ibm.com>
Acked-by: NAlexander Graf <agraf@suse.de>

Linux uses a check for subcode 6 to decide if other subcodes are
available. Provide a minimal implementation for subcode 6, as well
as for subcode 5.
Signed-off-by: NEugene (jno) Dvurechenski <jno@linux.vnet.ibm.com>
Reviewed-by: NCornelia Huck <cornelia.huck@de.ibm.com>
Signed-off-by: NChristian Borntraeger <borntraeger@de.ibm.com>
[Move code from kvm.c into misc_helper.c]

This alignes case statements to switch statements in the handle_diag
function as mandated by coding style.
Signed-off-by: NChristian Borntraeger <borntraeger@de.ibm.com>

* qemu-kvm/uq/master:
  kvm-stub: fix compilation
  kvm: shorten the parameter list for get_real_device()
  kvm: i386: fix LAPIC TSC deadline timer save/restore
  kvm-all.c: max_cpus should not exceed KVM vcpu limit
  kvm: Simplify kvm_handle_io
  kvm: x86: fix setting IA32_FEATURE_CONTROL with nested VMX disabled
  kvm: add KVM_IRQFD_FLAG_RESAMPLE support
  kvm: migrate vPMU state
  target-i386: remove tabs from target-i386/cpu.h
  Initialize IA32_FEATURE_CONTROL MSR in reset and migration

Conflicts:
	target-i386/cpu.h
	target-i386/kvm.c

aliguori: fixup trivial conflicts due to whitespace and added cpu
          argument
Signed-off-by: NAnthony Liguori <anthony@codemonkey.ws>

# By Stefan Weil
# Via Stefan Weil
* sweil/mingw:
  gtk: Remove unused include statements which are not portable
  w32: Add an icon resource
  w32: Fix broken out-of-tree builds (missing version.o)

Message-id: 1377607132-21336-1-git-send-email-sw@weilnetz.de
Signed-off-by: NAnthony Liguori <anthony@codemonkey.ws>

pc,pci,virtio fixes and cleanups

This includes pc and pci cleanups, future-proofing of ROM files,
and a virtio bugfix correcting splice on virtio console.
Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>

# gpg: Signature made Mon 26 Aug 2013 01:34:20 AM CDT using RSA key ID D28D5469
# gpg: Can't check signature: public key not found

# By Markus Armbruster (5) and others
# Via Michael S. Tsirkin
* mst/tags/for_anthony:
  virtio: virtqueue_get_avail_bytes: fix desc_pa when loop over the indirect descriptor table
  pc_piix: Kill pc_init1() memory region args
  pc: pc_compat_1_4() now can call pc_compat_1_5()
  pc: Create pc_compat_*() functions
  pc: Kill pc_init_pci_1_0()
  pc: Don't explode QEMUMachineInitArgs into local variables needlessly
  pc: Don't prematurely explode QEMUMachineInitArgs
  ppc: Don't duplicate QEMUMachineInitArgs in PPCE500Params
  ppc: Don't explode QEMUMachineInitArgs into local variables needlessly
  sun4: Don't prematurely explode QEMUMachineInitArgs
  q35: Add PCIe switch to example q35 configuration
  loader: store FW CFG ROM files in RAM
  arch_init: align MR size to target page size
  pc: cleanup 1.4 compat support

Message-id: 1377535318-30491-1-git-send-email-mst@redhat.com

Indeed, remove it entirely and remove the is_tcg_gen_code check
from GETPC_EXT.

Fixes https://bugs.launchpad.net/qemu/+bug/1218098 wherein a call
to a "normal" helper function performed a sequence of tail calls
all the way into the memory helper functions, leading to a stack
frame in which the memory helper function appeared to be called
directly from tcg.
Signed-off-by: NRichard Henderson <rth@twiddle.net>

In get_physical_address() is a qemu_log() call inside an #if 0 block.
When enabled the following build error is hit:

target-mips/helper.c In function ‘get_physical_address’:
target-mips/helper.c:220:13: error: format ‘%x’ expects argument of type ‘unsigned int’, but argument 5 has type ‘hwaddr’ [-Werror=format]

Fix the *physical (hwaddr) formatting by using "%"HWADDR_PRIx instead of
TARGET_FMT_lx.
Signed-off-by: NJames Hogan <james.hogan@imgtec.com>
Cc: Aurelien Jarno <aurelien@aurel32.net>
Signed-off-by: NYongbok Kim <yongbok.kim@imgtec.com>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

Non-KVM targets fail compilation on the uq/master branch.
Fix the prototype of kvm_irqchip_add_irqfd_notifier to match
the one in kvm-all.c.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NGleb Natapov <gleb@redhat.com>

These include files don't exist for MinGW and are not needed for Linux
(and hopefully for other hosts as well), so remove them.
Signed-off-by: NStefan Weil <sw@weilnetz.de>

The QEMU mascot which was already used for the NSIS installer
is now used for all QEMU executables.
Signed-off-by: NStefan Weil <sw@weilnetz.de>

Commit 0b516ef0 added version.o to all
executables, but broke out-of-tree builds: for those builds the pattern
rule %.o: %.rc from rules.mak does not match, so version.o was no longer
built.

Adding explicit build rules fixes this.
Reported-by: NMichael Roth <mdroth@linux.vnet.ibm.com>
Signed-off-by: NStefan Weil <sw@weilnetz.de>
Tested-by: NMichael Roth <mdroth@linux.vnet.ibm.com>

Discontinue the jump-around-jump-to-jump scheme, trading it for a single
immediate move instruction.  The two extra jumps always consume 7 bytes,
whereas the immediate move is either 5 or 7 bytes depending on where the
code_gen_buffer gets located.
Signed-off-by: NRichard Henderson <rth@twiddle.net>

Avoid a loop in the tlb_fill path; the fill will either succeed or
generate an exception.

Inline the slow_ld/st function; it was a complete copy of the main
helper except for the actual cross-page unaligned code, and the
compiler was inlining it anyway.

Add unlikely markers optimizing for the most common case of simple
tlb miss.

Make sure the compiler can optimize away the unaligned paths for a
1 byte access.
Reviewed-by: NAurelien Jarno <aurelien@aurel32.net>
Signed-off-by: NRichard Henderson <rth@twiddle.net>

Allow the code that tcg generates to be less obtuse, passing in
the return address directly instead of computing it in the helper.

Maintain the old entrance point unchanged as an alternate entry point.

Delete the helper_st*_cmmu prototypes; the implementations did not exist.
Signed-off-by: NRichard Henderson <rth@twiddle.net>

Use existing stack space for arguments; don't push/pop.
Use less ifdefs and more C ifs.
Signed-off-by: NRichard Henderson <rth@twiddle.net>

Use a 7 byte lea before the ultimate 10 byte movq.
Signed-off-by: NRichard Henderson <rth@twiddle.net>

No point in splitting the write into 32-bit pieces.
Reviewed-by: NAurelien Jarno <aurelien@aurel32.net>
Signed-off-by: NRichard Henderson <rth@twiddle.net>

Aliasing was forcing s->code_ptr to be re-read after the store.
Keep the pointer in a local variable to help the compiler.
Signed-off-by: NRichard Henderson <rth@twiddle.net>

# By Alex Bligh (32) and others
# Via Stefan Hajnoczi
* stefanha/block: (42 commits)
  win32-aio: drop win32_aio_flush_cb()
  aio-win32: replace incorrect AioHandler->opaque usage with ->e
  aio / timers: remove dummy_io_handler_flush from tests/test-aio.c
  aio / timers: Remove legacy interface
  aio / timers: Switch entire codebase to the new timer API
  aio / timers: Add scripts/switch-timer-api
  aio / timers: Add test harness for AioContext timers
  aio / timers: convert block_job_sleep_ns and co_sleep_ns to new API
  aio / timers: Convert rtc_clock to be a QEMUClockType
  aio / timers: Remove main_loop_timerlist
  aio / timers: Rearrange timer.h & make legacy functions call non-legacy
  aio / timers: Add qemu_clock_get_ms and qemu_clock_get_ms
  aio / timers: Remove legacy qemu_clock_deadline & qemu_timerlist_deadline
  aio / timers: Remove alarm timers
  aio / timers: Add documentation and new format calls
  aio / timers: Use all timerlists in icount warp calculations
  aio / timers: Introduce new API timer_new and friends
  aio / timers: On timer modification, qemu_notify or aio_notify
  aio / timers: Convert mainloop to use timeout
  aio / timers: Convert aio_poll to use AioContext timers' deadline
  ...

Message-id: 1377202298-22896-1-git-send-email-stefanha@redhat.com
Signed-off-by: NAnthony Liguori <anthony@codemonkey.ws>

MAINTAINERS update for stable-0.15

# gpg: Signature made Thu 22 Aug 2013 10:59:31 AM CDT using RSA key ID 3E7E013F
# gpg: Can't check signature: public key not found

# By Andreas Färber
# Via Andreas Färber
* afaerber/tags/0.15-maintainer-for-anthony:
  MAINTAINERS: Take over 0.15 maintenance

virtqueue_get_avail_bytes: when found a indirect desc, we need loop over it.
           /* loop over the indirect descriptor table */
           indirect = 1;
           max = vring_desc_len(desc_pa, i) / sizeof(VRingDesc);
           num_bufs = i = 0;
           desc_pa = vring_desc_addr(desc_pa, i);
But, It init i to 0, then use i to update desc_pa. so we will always get:
desc_pa = vring_desc_addr(desc_pa, 0);
the last two line should swap.

Cc: qemu-stable@nongnu.org
Signed-off-by: NYin Yin <yin.yin@cs2c.com.cn>
Reviewed-by: NStefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>

This gives the dumped blob its correct address during disassembly,
which makes pc-relative insns much easier to interpret.
Signed-off-by: NRichard Henderson <rth@twiddle.net>
Signed-off-by: NEdgar E. Iglesias <edgar.iglesias@gmail.com>

The script massages the output produced for architectures that are
not supported internally by qemu though an external objdump program
for disassembly.
Signed-off-by: NRichard Henderson <rth@twiddle.net>
Signed-off-by: NEdgar E. Iglesias <edgar.iglesias@gmail.com>

The OBJD-[HT] tags will be used by a script to run the hex blob
through objdump --disassemble.
Signed-off-by: NRichard Henderson <rth@twiddle.net>
Signed-off-by: NEdgar E. Iglesias <edgar.iglesias@gmail.com>

get_real_device() has 5 parameters with the last 4 is contained in the first
structure.

This patch removes the last 4 parameters and directly use them from the first
parameter.
Acked-by: NAlex Williamson <alex.williamson@redhat.com>
Signed-off-by: NWei Yang <weiyang@linux.vnet.ibm.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

The io_flush argument to qemu_aio_set_event_notifier() has been removed
since the block layer learnt to drain requests by itself.  Fix the
Windows build for win32-aio.o by updating the
qemu_aio_set_event_notifier() call and dropping win32_aio_flush_cb().
Reviewed-by: NStefan Weil <sw@weilnetz.de>
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>

The AioHandler->opaque field does not exist in aio-win32.c.  The code
that uses it was incorrectly copied from aio-posix.c.  For Windows we
can use AioHandler->e to match against AioContext->notifier.

This patch fixes the Windows build for aio-win32.o.
Reviewed-by: NStefan Weil <sw@weilnetz.de>
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>

Remove dummy_io_handler_flush from tests/test-aio.c as it does
nothing now.
Signed-off-by: NAlex Bligh <alex@alex.org.uk>
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>

Remove the legacy interface from include/qemu/timers.h.

Ensure struct QEMUClock is not exposed at all.
Signed-off-by: NAlex Bligh <alex@alex.org.uk>
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>

This is an autogenerated patch using scripts/switch-timer-api.

Switch the entire code base to using the new timer API.

Note this patch may introduce some line length issues.
Signed-off-by: NAlex Bligh <alex@alex.org.uk>
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>

Add scripts/switch-timer-api to programatically rewrite source
files to use the new timer system.
Signed-off-by: NAlex Bligh <alex@alex.org.uk>
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>

Add a test harness for AioContext timers. The g_source equivalent is
unsatisfactory as it suffers from false wakeups.
Signed-off-by: NAlex Bligh <alex@alex.org.uk>
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>

Convert block_job_sleep_ns and co_sleep_ns to use the new timer
API.
Signed-off-by: NAlex Bligh <alex@alex.org.uk>
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>

Convert rtc_clock to be a QEMUClockType

Move rtc_clock users to use the new API
Signed-off-by: NAlex Bligh <alex@alex.org.uk>
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>