CPUID.7.0.EBX[1]=1 indicates IA32_TSC_ADJUST MSR 0x3b is supported

Basic design is to emulate the MSR by allowing reads and writes to the
hypervisor vcpu specific locations to store the value of the emulated MSRs.
In this way the IA32_TSC_ADJUST value will be included in all reads to
the TSC MSR whether through rdmsr or rdtsc.

As this is a new MSR that the guest may access and modify its value needs
to be migrated along with the other MRSs. The changes here are specifically
for recognizing when IA32_TSC_ADJUST is enabled in CPUID and code added
for migrating its value.
Signed-off-by: NWill Auld <will.auld@intel.com>
Reviewed-by: NAndreas Färber <afaerber@suse.de>
Signed-off-by: NMarcelo Tosatti <mtosatti@redhat.com>

* kwolf/for-anthony: (43 commits)
  qcow2: Factor out handle_dependencies()
  qcow2: Execute run_dependent_requests() without lock
  qcow2: Enable dirty flag in qcow2_alloc_cluster_link_l2
  qcow2: Allocate l2meta only for cluster allocations
  qcow2: Drop l2meta.cluster_offset
  qcow2: Allocate l2meta dynamically
  qcow2: Introduce Qcow2COWRegion
  qcow2: Round QCowL2Meta.offset down to cluster boundary
  atapi: reset cdrom tray statuses on ide_reset
  qemu-iotests: Test concurrent cluster allocations
  qcow2: Move BLKDBG_EVENT out of the lock
  qemu-io: Add AIO debugging commands
  blkdebug: Implement suspend/resume of AIO requests
  blkdebug: Factor out remove_rule()
  blkdebug: Allow usage without config file
  create new function: qemu_opt_set_number
  use qemu_opts_create_nofail
  introduce qemu_opts_create_nofail function
  qemu-option: qemu_opt_set_bool(): fix code duplication
  qemu-option: qemu_opts_validate(): fix duplicated code
  ...
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

* pmaydell/arm-devs.next:
  hw/ds1338.c: Fix handling of DAY (wday) register.
  hw/ds1338.c: Implement support for the control register.
  hw/ds1338.c: Ensure state is properly initialized.
  hw/ds1338.c: Fix handling of HOURS register.
  hw/ds1338.c: Add definitions for various flags in the RTC registers.
  hw/ds1338.c: Correct bug in conversion to BCD.
  exynos4210/mct: Avoid infinite loop on non incremental timers
  hw/arm_gic: fix target CPUs affected by set enable/pending ops
  xilinx_zynq: Add one variable to avoid overwriting QSPI bus
  hw/arm_gic_common: Correct GICC_PMR reset value for newer GICs
  hw/arm_gic: Fix comparison with priority mask register
  hw/arm_boot, exynos4210, highbank: Fix secondary boot GIC init
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

* kraxel/seabios-e8a76b0:
  seabios: update to e8a76b0f225bba5ba9d63ab227e0a37b3beb1059
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

vfio-pci: fix kvm disabled path

* awilliam/tags/vfio-pci-for-qemu-20121210.0:
  vfio-pci: Don't use kvm_irqchip_in_kernel
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Signed-off-by: NKevin Wolf <kwolf@redhat.com>

There's no reason for run_dependent_requests() to hold s->lock, and a
later patch will require that in fact the lock is not held.

Also, before this patch, run_dependent_requests() not only does what its
name suggests, but also removes the l2meta from the list of in-flight
requests. When changing this, it becomes an one-liner, so just inline it
completely.
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

This is closer to where the dirty flag is really needed, and it avoids
having checks for special cases related to cluster allocation directly
in the writev loop.
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

Even for writes to already allocated clusters, an l2meta is allocated,
though it stays effectively unused. After this patch, only allocating
requests still have one. Each l2meta now describes an in-flight request
that writes to clusters that are not yet hooked up in the L2 table.
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

There's no real reason to have an l2meta for normal requests that don't
allocate anything. Before we can get rid of it, we must return the host
cluster offset in a different way.
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

As soon as delayed COW is introduced, the l2meta struct is needed even
after completion of the request, so it can't live on the stack.
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

This makes it easier to address the areas for which a COW must be
performed. As a nice side effect, the COW code in
qcow2_alloc_cluster_link_l2 becomes really trivial.
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

The offset within the cluster is already present as n_start and this is
what the code uses. QCowL2Meta.offset is only needed at a cluster
granularity.
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

Per the datasheet, the DAY (wday) register is user defined. Implement this.
Signed-off-by: NAntoine Mathys <barsamin@gmail.com>
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Signed-off-by: NAntoine Mathys <barsamin@gmail.com>
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Signed-off-by: NAntoine Mathys <barsamin@gmail.com>
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Per the datasheet, the mapping between 12 and 24 hours modes is:
      0      <->  12   PM
      1-12   <->  1-12 AM
      13-23  <->  1-11 PM
Signed-off-by: NAntoine Mathys <barsamin@gmail.com>
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Signed-off-by: NAntoine Mathys <barsamin@gmail.com>
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Signed-off-by: NAntoine Mathys <barsamin@gmail.com>
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Tray statuses should be also reseted. Some guests may lock the tray
and after reset before any kernel is loaded the tray should be unlocked.

Also if you reset the real computer the tray is closed. We should
do the same in qemu.
Signed-off-by: NPavel Hrdina <phrdina@redhat.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

madvise(DONTNEED) will throw away the contents of the whole page at the
given address, even if the given length is less than the page size.  One
can argue about whether that's the correct behaviour, but that's what it's
done for a long time in Linux at least.

That means that the madvise() in ram_load(), on a setup where
TARGET_PAGE_SIZE is smaller than the host page size, can throw away data
in guest pages adjacent to the one it's actually processing right now,
leading to guest memory corruption on an incoming migration.

This patch therefore, disables the madvise() if the host page size is
larger than TARGET_PAGE_SIZE.  This means we don't get the benefits of that
madvise() in this case, but a more complete fix is more difficult to
accomplish.  This at least fixes the guest memory corruption.
Signed-off-by: NDavid Gibson <david@gibson.dropbear.id.au>
Reported-by: NAlexey Kardashevskiy <aik@ozlabs.ru>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

The code for migrating (or savevm-ing) memory pages starts off by creating
a dirty bitmap and filling it with 1s.  Except, actually, because bit
addresses are 0-based it fills every bit except bit 0 with 1s and puts an
extra 1 beyond the end of the bitmap, potentially corrupting unrelated
memory.  Oops.  This patch fixes it.
Signed-off-by: NDavid Gibson <david@gibson.dropbear.id.au>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

This adds some first tests for qcow2's dependency handling when two
parallel write requests access the same cluster.
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

We want to use these events to suspend requests for testing concurrent
AIO requests. Suspending requests while they are holding the CoMutex is
rather boring for this purpose.
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

This makes the blkdebug suspend/resume functionality available in
qemu-io. Use it like this:

  $ ./qemu-io blkdebug::/tmp/test.qcow2
  qemu-io> break write_aio req_a
  qemu-io> aio_write 0 4k
  qemu-io> blkdebug: Suspended request 'req_a'
  qemu-io> resume req_a
  blkdebug: Resuming request 'req_a'
  qemu-io> wrote 4096/4096 bytes at offset 0
  4 KiB, 1 ops; 0:00:30.71 (133.359788 bytes/sec and 0.0326 ops/sec)
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

This allows more systematic AIO testing. The patch adds three new
operations to blkdebug:

 * Setting a "breakpoint" on a blkdebug event. The next request that
   triggers this breakpoint is suspended and is tagged with a name.
   The breakpoint is removed after a request has triggered it.

 * A suspended request (identified by it's tag) can be resumed

 * It's possible to check whether a suspended request with a given
   tag exists. This can be used for waiting for an event.

Ideally, we would instead tag requests right when they are created and
set breakpoints for individual requests. However, at this point the
block layer doesn't allow this easily, and breakpoints that trigger for
any request already allow a lot of useful testing.
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

The cleanup work to remove a rule depends on the type of the rule. It's
easy for the existing rules as there is no data that must be cleaned up
and is specific to a type yet, but the next patch will change this.
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

As soon as new rules can be set during runtime, as introduced by the
next patch, blkdebug makes sense even without a config file.
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

Signed-off-by: NDong Xu Wang <wdongxu@linux.vnet.ibm.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

We will use qemu_opts_create_nofail function, it can make code
more readable.
Signed-off-by: NDong Xu Wang <wdongxu@linux.vnet.ibm.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

While id is NULL, qemu_opts_create can not fail, so ignore
errors is fine.
Signed-off-by: NDong Xu Wang <wdongxu@linux.vnet.ibm.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

It will set opt->str in qemu_opt_set_bool, without opt->str, there
will be some potential bugs.

These are uses of opt->str, and what happens when it isn't set:

* qemu_opt_get(): returns NULL, which means "not set".  Bug can bite
  when value isn't the default value.

* qemu_opt_parse(): passes NULL to parse_option_bool(), which treats it
  like "on".  Wrong if the value is actually false.  Bug can bite when
  qemu_opts_validate() runs after qemu_opt_set_bool().

* qemu_opt_del(): passes NULL to g_free(), which is just fine.

* qemu_opt_foreach(): passes NULL to the callback, which is unlikely to
  be prepared for it.

* qemu_opts_print(): prints NULL, which crashes on some systems.

* qemu_opts_to_qdict(): passes NULL to qstring_from_str(), which
  crashes.

It also makes qemu_opt_set_bool more readable by using find_desc_by_name
and opts_accepts_any.

It is based on Luiz's patch and uses Markus's comments. Discussions can
be found at:
http://lists.nongnu.org/archive/html/qemu-devel/2012-07/msg02716.htmlSigned-off-by: NDong Xu Wang <wdongxu@linux.vnet.ibm.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

Use opts_accepts_any() and find_desc_by_name().
Signed-off-by: NLuiz Capitulino <lcapitulino@redhat.com>
Signed-off-by: NDong Xu Wang <wdongxu@linux.vnet.ibm.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

The new functions are opts_accepts_any() and find_desc_by_name(), which
are also going to be used by qemu_opts_validate() (see next commit).

This also makes opt_set() slightly more readable.
Signed-off-by: NLuiz Capitulino <lcapitulino@redhat.com>
Signed-off-by: NDong Xu Wang <wdongxu@linux.vnet.ibm.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

Check for a 0 "distance" value to avoid infinite loop when the
expired FCR timer was not programed with auto-increment.

With this change the behavior is coherent with the same type
of code in the exynos4210_gfrc_restart() function in the same
file.

Linux seems to mostly use this timer with auto-increment
which explain why it is not a problem most of the time.

However other OS might have a problem with this if they
don't use the auto-increment feature.
Signed-off-by: NJean-Christophe DUBOIS <jcd@tribudubois.net>
Reviewed-by: NEvgeny Voevodin <e.voevodin@samsung.com>
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Fix a bug on the ARM GIC model where interrupts are not
set pending on the correct target CPUs when they are
triggered by writes to the Interrupt Set Enable or
Set Pending registers.
Signed-off-by: NDaniel Sangorrin <dsl@ertl.jp>
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

commit 7b482bcf xilinx_zynq: added QSPI controller

Adds one QSPI controller, which has two spi buses, one is for
spi0, and another is for spi1. But when initializing the spi1
bus, "dev" has been overwrited by the ssi_create_slave_no_init() function,
so that qdev_get_child_bus() returns NULL and the last two m25p80 flashes
won't be attached to the spi1 bus, but to main-system-bus.

Here we add one variable to avoid overwriting.
Signed-off-by: NLiming Wang <walimisdev@gmail.com>
Reviewed-by: NPeter Crosthwaite <peter.crosthwaite@xilinx.com>
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

The GIC architecture specification for v1 and v2 GICs (as found
on the Cortex-A9 and newer) states that the GICC_PMR reset value
is zero; this differs from the 0xf0 reset value used on 11MPCore.
The NVIC is different again in not having a CPU interface; since
we share the GIC code we must force the priority mask field to
allow through all interrupts.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Reviewed-by: NIgor Mitsyanko <i.mitsyanko@samsung.com>

The GIC spec states that only interrupts with higher priority
than the value in the GICC_PMR priority mask register are
passed through to the processor. We were incorrectly allowing
through interrupts with a priority equal to the specified
value: correct the comparison operation to match the spec.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Reviewed-by: NIgor Mitsyanko <i.mitsyanko@samsung.com>

Fix the code in the secondary CPU boot stubs so that it correctly
initialises the GIC rather than relying on bugs or implementation
dependent aspects of the QEMU GIC implementation:
 * set the GIC_PMR.Priority field to all-ones, so that all
   interrupts are passed through. The default of all-zeroes
   means all interrupts are masked, and QEMU only booted because
   of a bug in the priority masking in our GIC implementation.
 * add a barrier after GIC setup and before WFI to ensure that
   GIC config is complete before we go into a possible low power
   state. This isn't needed with the software GIC model but could
   be required when using KVM and executing this code on the
   real hardware CPU.

Note that of the three secondary stub implementations, only
the common generic one needs to support both v6 and v7 DSB
encodings; highbank and exynos4210 will always be v7 CPUs.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Reviewed-by: NIgor Mitsyanko <i.mitsyanko@samsung.com>