Early ppc64 CPUs include a hack to partially simulate the ppc32 segment
registers, by translating writes to them into writes to the SLB.  This is
not used by any current Linux kernel, but it is used by the openbios used
in the qemu mac99 model.

Commit 81762d6d, cleaning up the SLB
handling introduced a bug in this code, breaking the openbios currently in
qemu.  Specifically, there was an off by one error bitshuffling the
register format used by mtsr into the format needed for the SLB load,
causing the flag bits to end up in the wrong place.  This caused the
storage keys to be wrong under openbios, meaning that the translation code
incorrectly thought a legitimate access was a permission violation.

This patch fixes the bug, at the same time it fixes some build bug in the
MMU debugging code (only exposed when DEBUG_MMU is enabled).
Signed-off-by: NDavid Gibson <david@gibson.dropbear.id.au>
Signed-off-by: NAlexander Graf <agraf@suse.de>

A few pieces of the pSeries emulation code have variables which are set
but never used, which causes warnings on gcc 4.6.  This patch removes
these instances.
Signed-off-by: NDavid Gibson <david@gibson.dropbear.id.au>
Signed-off-by: NAlexander Graf <agraf@suse.de>

ulong is undefined for w32 (and maybe other) compilations.
Replace it by uintptr_t (which also fixes compilation for w64
and is a better choice for pointer to integer conversions).

Cc: Aurelien Jarno <aurelien@aurel32.net>
Signed-off-by: NStefan Weil <weil@mail.berlios.de>
Reviewed-by: NAurelien Jarno <aurelien@aurel32.net>
Signed-off-by: NAlexander Graf <agraf@suse.de>

AHCI provides two ways of reading/writing data:

 1) NCQ
 2) ATA commands with the LBA in the command FIS

In the second code path, we didn't handle any LBAs that were bigger than
16 bits, so whenever a guest that used high LBA numbers wanted to access
data, the LBA got truncated down to 16 bits, giving the guest garbage.

This patch adds support for LBAs higher than 16 bits. I've tested that it
works just fine with SeaBIOS and Linux guests. This patch also unbreaks
the often reported grub errors people have seen with AHCI.
Signed-off-by: NAlexander Graf <agraf@suse.de>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

No users of bdrv_get_type_hint() left.  bdrv_set_type_hint() can make
the media removable by side effect.  Make that explicit.
Signed-off-by: NMarkus Armbruster <armbru@redhat.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

DriveInfo is closely tied to -drive, and like -drive, it mixes
information about host and guest part of the block device.  Unlike
DriveInfo, BlockDriverState should be about the host part only.

One of the remaining guest bits there is the "type hint".  -drive
option media sets it, and qdevs "ide-drive", "scsi-disk" and non-qdev
IF_XEN devices check it to pick HD vs. CD.

Communicate -drive option media via new DriveInfo member media_cd
instead.
Signed-off-by: NMarkus Armbruster <armbru@redhat.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

query-block's specification documents response member "type" with
values "hd", "cdrom", "floppy", "unknown".

Its value is unreliable: a block device used as floppy has type
"floppy" if created with if=floppy, but type "hd" if created with
if=none.

That's because with if=none, the type is at best a declaration of
intent: the drive can be connected to any guest device.  Its type is
really the guest device's business.  Reporting it here is wrong.

No known user of QMP uses "type".  It's unlikely that any unknown
users exist, because its value is useless unless you know how the
block device was created.  But then you also know the true value.

Fixing the broken value risks breaking (hypothetical!) clients that
somehow rely on the current behavior.  Not fixing the value risks
breaking (hypothetical!) clients that rely on the value to be
accurate.  Can't entirely avoid hypothetical lossage.  Change the
value to be always "unknown".

This makes "info block" always report "type=unknown".  Pointless.
Change it to not report the type.
Signed-off-by: NMarkus Armbruster <armbru@redhat.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

ide-hd has to suppress the default CD-ROM, or else you can't put one
on secondary master without -nodefaults.

Unlike legacy scsi-disk, scsi-cd suppresses default CD-ROM.
Signed-off-by: NMarkus Armbruster <armbru@redhat.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

A "scsi-disk" is either a hard disk or a CD-ROM, depending on the
associated BlockDriverState's type hint.  Unclean; disk vs. CD belongs
to the guest part, not the host part.

Have separate qdevs "scsi-hd" and "scsi-cd" to model disk vs. CD in
the guest part.

Keep scsi-disk for backward compatibility.

Don't copy scsi-disk property removable to scsi-cd.  It's not used and
always zero(!) there.
Signed-off-by: NMarkus Armbruster <armbru@redhat.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

An "ide-drive" is either a hard disk or a CD-ROM, depending on the
associated BlockDriverState's type hint.  Unclean; disk vs. CD belongs
to the guest part, not the host part.

Have separate qdevs "ide-hd" and "ide-cd" to model disk vs. CD in
the guest part.

Keep ide-drive for backward compatibility.

"ide-disk" would perhaps be a nicer name than "ide-hd", but there's
already "scsi-disk", which is like "ide-drive", and will be likewise
split in the next commit.  {ide,scsi}-{hd,cd} is the best consistent
set of names I could find within the backward compatibility
straightjacket.
Signed-off-by: NMarkus Armbruster <armbru@redhat.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

The .bdrv_truncate() operation resizes images and growing is easy to
implement in QED.  Simply check that the new size is valid and then
update the image_size header field to reflect the new size.
Signed-off-by: NStefan Hajnoczi <stefanha@linux.vnet.ibm.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

I run qemu-img under profiler and realized, that most of CPU time is
consumed by is_not_zero() function. I had made a couple of optimizations
on it and got the following output for `time qemu-img convert -O qcow2
volume.qcow2 snapshot.qcow2`:

Original qemu-img:
real 0m56.159s
user 0m34.670s
sys  0m12.079s

Patched qemu-img:
real 0m34.805s
user 0m18.445s
sys  0m12.552s
Signed-off-by: NDmitry Konishchev <konishchev@gmail.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

One strategy to limit the startup delay of consistency check when
opening image files is to ensure that the file is marked dirty for as
little time as possible.

QED currently marks the image dirty when the first allocating write
request is issued and clears the dirty bit again when the image is
cleanly closed.  In practice that means the image is marked dirty for
most of a guest's lifetime and prone to being in a dirty state upon
crash or power failure.

It is safe to clear the dirty bit after all allocating write requests
have completed and a flush has been performed.  This patch adds a timer
after the last allocating write request completes.  When the timer fires
it will flush and then clear the dirty bit.  The timer is set to 5
seconds and is cancelled upon arrival of a new allocating write request.
Signed-off-by: NStefan Hajnoczi <stefanha@linux.vnet.ibm.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

Block drivers may use timers for flushing metadata to disk or
reconnecting to a network drive.  Stub out the following functions in
qemu-tool.c:

QEMUTimer *qemu_new_timer_ns(QEMUClock *clock, int scale,
                             QEMUTimerCB *cb, void *opaque)
void qemu_free_timer(QEMUTimer *ts)
void qemu_del_timer(QEMUTimer *ts)
void qemu_mod_timer(QEMUTimer *ts, int64_t expire_time)
int64_t qemu_get_clock_ns(QEMUClock *clock)

They will result in timers never firing when linked against qemu-tool.o.
Signed-off-by: NStefan Hajnoczi <stefanha@linux.vnet.ibm.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

If ahci_dma_set_inactive is called a while there is still a pending BH
from a previous run, we will crash on the second run of
ahci_check_cmd_bh as it overwrites AHCIDevice::check_bh. Avoid this
broken and redundant duplicate registration.
Signed-off-by: NJan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

Signed-off-by: NJes Sorensen <Jes.Sorensen@redhat.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

These printfs aren't really debug messages, but clearly indicate a bug if they
ever become effective. Noone uses DEBUG_IDE, let's re-enable the check
unconditionally and make it an assertion instead of printfs in the device
emulation.
Signed-off-by: NKevin Wolf <kwolf@redhat.com>
Reviewed-by: NStefan Hajnoczi <stefanha@linux.vnet.ibm.com>

cppcheck report:
hw/xen_disk.c:309: style:
 Variable 'len' is assigned a value that is never used

Cc: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: NStefan Weil <weil@mail.berlios.de>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

Signed-off-by: NJes Sorensen <Jes.Sorensen@redhat.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

A thread should only be counted as idle when it really is waiting for new
requests. Without this patch, sometimes too few threads are started as busy
threads are counted as idle.

Not sure if it makes a difference in practice outside some artificial
qemu-io/qemu-img tests, but I think the change makes sense in any case.
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

Add \n.
Signed-off-by: NAndrea Arcangeli <aarcange@redhat.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

Fix regression of 667bb59d: ahci_init initializes ahci.mem, so we have to
move bar registration after it.
Signed-off-by: NJan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

target-ppc/cpu.h now needs ffs(), too, so ffs() must be declared
before this file is included.

Moving the declaration from qemu-common.h to qemu-os-win32.h
(which is included in qemu-common.h early) fixes the compiler
warning for w32.

Cc: Aurelien Jarno <aurelien@aurel32.net>
Signed-off-by: NStefan Weil <weil@mail.berlios.de>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

Signed-off-by: NMichael Tokarev <mjt@tls.msk.ru>
Acked-by: NAlexander Graf <agraf@suse.de>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

Include the list of available targets in the --help output
for the --target-list= option.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Acked-by: NStefan Weil <weil@mail.berlios.de>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

Fix compilation with gcc-4.6, based on a patch from Stefan
Weil <weil@mail.berlios.de>.
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

cppcheck report:
target-lm32/translate.c:587: style:
    Variable 't0' is assigned a value that is never used
target-lm32/translate.c:588: style:
    Variable 'l1' is assigned a value that is never used

Remove both variables. Please check whether that is the correct solution.

Cc: Michael Walle <michael@walle.cc>
Cc: Edgar E. Iglesias <edgar.iglesias@gmail.com>
Signed-off-by: NStefan Weil <weil@mail.berlios.de>
Acked-by: NMichael Walle <michael@walle.cc>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

Correct handling of NaNs for VFP VMLA, VMLS, VNMLS and VNMLA requires that
we implement the set of negations and additions specified by the ARM ARM;
plausible looking simplifications like turning (-A + B) into (B - A) or
computing (A + B) rather than (B + A) result in selecting the wrong NaN or
returning a NaN with the wrong sign bit.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

Phillip Merensky reported that the special keys (e.g. Ctrl-Alt-f for full
screen) did not work correctly if -alt-grab is used.

BUG: 696530

Review of ui/sdl.c:sdl_refresh indicates that this is the intended behaviour,
so we should update the documentation to match the actual behaviour, as
suggested by Phillip in the bug report.
Signed-off-by: NBrad Hards <bradh@frogmouth.net>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

* 'ppc-next' of git://repo.or.cz/qemu/agraf:
  PPC: Qdev'ify e500 pci
  PPC MPC7544DS: Use new TLB helper function
  PPC: Implement e500 (FSL) MMU
  PPC: Add another 64 bits to instruction feature mask
  PPC: Add GS MSR definition
  PPC: Make MPC8544DS emulation work w/o KVM
  PPC: Make MPC8544DS obey -cpu switch
  Fix off-by-one error in sizing pSeries hcall table
  ppc64: Fix out-of-tree builds
  kvm: ppc: warn user on PAGE_SIZE mismatch
  kvm: ppc: detect old headers
  monitor: add PPC BookE SPRs
  kvm: ppc: fixes for KVM_SET_SREGS on init
  ppc64: Don't try to build sPAPR RTAS on Darwin
  Place pseries vty devices at addresses more similar to existing machines
  Make pSeries 'model' property more closely resemble real hardware
  pseries: Increase maximum CPUs to 256

Fix wrong number of bits used when sign extending the branch offset of BPcc
instructions.
Reported-by: NArtyom Tarasenko <atar4qemu@gmail.com>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

Use TCG local to work around TCG register flush due to a branch.

Thanks to Artyom Tarasenko, Igor Kovalenko and Aurelien Jarno.
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

Conflicts:
	cpu-all.h

The e500 PCI controller isn't qdev'ified yet. This leads to severe issues
when running with -drive.

To be able to use a virtio disk with an e500 VM, let's convert the PCI
controller over to qdev.
Reviewed-by: NPaul Brook <paul@codesourcery.com>
Signed-off-by: NAlexander Graf <agraf@suse.de>

Now that we have some nice helpers that can find us a TLB entry, let's
use that on the machine initialization code, so we don't need to know
about the internals of the TLB array.
Signed-off-by: NAlexander Graf <agraf@suse.de>

Most of the code to support e500 style MMUs is already in place, but
we're missing on some of the special TLB0-TLB1 handling code and slightly
different TLB modification.

This patch adds support for the FSL style MMU.
Signed-off-by: NAlexander Graf <agraf@suse.de>

To enable quick runtime detection of instruction groups to the currently
selected CPU emulation, we have a feature mask of what exactly the respective
instruction supports.

This feature mask is 64 bits long and we just successfully exceeded those 64
bits. To add more features, we need to think of something.

The easiest solution that came to my mind was to simply add another 64 bits
that we can also match on. Since the comparison is only done on start of the
qemu process to generate an internal opcode calling table, we should be fine
on any performance penalties here.
Signed-off-by: NAlexander Graf <agraf@suse.de>

The BookE specification defines MSR bit 28 as Guest State. Add it
to the list of MSR macros.
Signed-off-by: NAlexander Graf <agraf@suse.de>