[Qemu-devel] [PATCH] target-arm: default empty semihosting cmdline

2015-06-21 Thread Liviu Ionescu
If neither explicit semihosting args nor -kernel are used, 
make SYS_GET_CMDLINE return an empty string.

Signed-off-by: Liviu Ionescu 
---
 target-arm/arm-semi.c | 11 +--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/target-arm/arm-semi.c b/target-arm/arm-semi.c
index 74a67e9..a2a7369 100644
--- a/target-arm/arm-semi.c
+++ b/target-arm/arm-semi.c
@@ -436,12 +436,19 @@ uint32_t do_arm_semihosting(CPUARMState *env)
 size_t input_size;
 size_t output_size;
 int status = 0;
+#if !defined(CONFIG_USER_ONLY)
+const char *cmdline;
+#endif
 GET_ARG(0);
 GET_ARG(1);
 input_size = arg1;
 /* Compute the size of the output string.  */
 #if !defined(CONFIG_USER_ONLY)
-output_size = strlen(semihosting_get_cmdline()) + 1;
+cmdline = semihosting_get_cmdline();
+if (cmdline == NULL) {
+cmdline = ""; /* Default to an empty line. */
+}
+output_size = strlen(cmdline) + 1; /* Count terminating 0. */
 #else
 unsigned int i;
 
@@ -472,7 +479,7 @@ uint32_t do_arm_semihosting(CPUARMState *env)
 
 /* Copy the command-line arguments.  */
 #if !defined(CONFIG_USER_ONLY)
-pstrcpy(output_buffer, output_size, semihosting_get_cmdline());
+pstrcpy(output_buffer, output_size, cmdline);
 #else
 if (output_size == 1) {
 /* Empty command-line.  */
-- 
2.3.2 (Apple Git-55)





Re: [Qemu-devel] [PATCH v1] pci: Don't register a specialized 'config_write' if default behavior is intended

2015-06-21 Thread Marcel Apfelbaum

On 06/17/2015 09:46 PM, Shmulik Ladkani wrote:

Hi,

On Wed, 17 Jun 2015 12:36:14 +0300, marcel.apfelb...@gmail.com wrote:

NOTE:
Not sure if my statement regarding ommitting 'config_write' holds
for the megasas case:
It's parent is TYPE_MEGASAS_BASE whose parent is TYPE_PCI_DEVICE.
Can we assume 'config_write' will be set to
'pci_default_write_config' in this case?

No need to assume here, you can simply add a trace and check.
However, the do_pci_register_device method assigns config_write method
to PCIDevice *instances* using the class method or the default
pci_default_write_config.

Since TYPE_MEGASAS_BASE does not define a config_write method, the
field will remain NULL. Anyway, you are welcomed to run it and
double-check.


Verified; do_pci_register_device indeed sets it to pci_default_write_config.

Thanks,
Shmulik


Cool!

Thanks,
Marcel




[Qemu-devel] [RFC] Cortex-M different revisions

2015-06-21 Thread Liviu Ionescu
while studying the details of cortex-m cores, I ran into the many differences 
between existing revisions, especially for cortex-m3, which are numerous and 
some significative, like stack alignment. for example for m3, the changes from 
r0p0 to r1p0/r1p1 are one full page of details, like "• the NVIC 
Configuration Control register includes the STKALIGN bit,• r1p1 includes 
the new AUXFAULT (Auxiliary Fault) status register...", changes from r2p0 to 
r2p1 include " • The Vector Table Offset Register (VTOR) has been increased 
by two bits to enable more flexible placement of the vector table. ...", etc

at first sight these differences would require special care when implementing 
an accurate emulation.

for this I'm considering extending the naming scheme for cortex-m cores, to 
include the revision, like "cortex-m3-r2p1", which will define the fields in 
CPUID correctly.

as per Joseph Yiu (The Definitive Guide to ARM Cortex-M3 and M4, Third edition, 
p. 765), "The revisions for the Cortex-M3 processor include: r0p0, r1p0, r1p1, 
r2p0, and r2p1. The revisions for the Cortex-M4 processor include: r0p0, r0p1."


any comments? 

Liviu






Re: [Qemu-devel] [PATCH v1] pci: Don't register a specialized 'config_write' if default behavior is intended

2015-06-21 Thread Marcel Apfelbaum

On 06/17/2015 10:17 PM, Shmulik Ladkani wrote:

Hi,

On Wed, 17 Jun 2015 12:37:18 +0300, marcel.apfelb...@gmail.com wrote:

BTW, did you notice a bug here?  If yes, can you elaborate?


No, not a direct bug.
We noticed this while working on related code areas.

There's some history behind this.

In 95d6580 'msi: Invoke msi/msix_write_config from PCI core', the calls
to msi[x]_write_config have been added into pci_default_write_config,
and many specialized 'config_write' methods have been eliminated.

However there was a bug in 95d6580 - the values written to msi/msix
were always 0.
This was recently fixed in d7efb7e
  'pci: avoid losing config updates to MSI/MSIX cap regs'

Got it.



I assume that device authors were either (1) unware of the
generalization, thus kept invoking msi[x]_write_config explicitly, or
(2) trying to overcome the "lost writes".

Anyway, I'm no PCI expert here, but I assume the side-effect invoking
msi[x]_write_config twice (explicitly from the specialized config_write,
then implicitly from pci_default_write_config) isn't desired.

Of course.



Meaning, the suggested patch follows the spirit of 95d6580.
Let me know if my analysis is flawed.

Thank you for the patch, you are completely right.
My 'Reviewed-by' tag is there, I think Michael, the PCI
maintainer, will take it shortly.

Thanks,
Marcel



Regards,
Shmulik






Re: [Qemu-devel] [PATCH v1] pci: Don't register a specialized 'config_write' if default behavior is intended

2015-06-21 Thread Shmulik Ladkani
On Sun, 21 Jun 2015 11:20:18 +0300, marcel.apfelb...@gmail.com wrote:
> Thank you for the patch, you are completely right.
> My 'Reviewed-by' tag is there, I think Michael, the PCI
> maintainer, will take it shortly.

Was already pulled ;-)



Re: [Qemu-devel] [PATCH] hw/arm/virt-acpi-build: Fix table revision and some comments

2015-06-21 Thread Michael S. Tsirkin
On Tue, Jun 09, 2015 at 11:26:18AM +0800, Shannon Zhao wrote:
> From: Shannon Zhao 
> 
> The table revision is not the ACPI spec version. Fix the wrong revision
> and also some comments.
> 
> Signed-off-by: Shannon Zhao 

Reviewed-by: Michael S. Tsirkin 

> ---
>  hw/arm/virt-acpi-build.c | 11 ++-
>  1 file changed, 6 insertions(+), 5 deletions(-)
> 
> diff --git a/hw/arm/virt-acpi-build.c b/hw/arm/virt-acpi-build.c
> index a9373cc..a036a00 100644
> --- a/hw/arm/virt-acpi-build.c
> +++ b/hw/arm/virt-acpi-build.c
> @@ -349,7 +349,7 @@ build_mcfg(GArray *table_data, GArray *linker, 
> VirtGuestInfo *guest_info)
>  mcfg->allocation[0].end_bus_number = (memmap[VIRT_PCIE_ECAM].size
>/ PCIE_MMCFG_SIZE_MIN) - 1;
>  
> -build_header(linker, table_data, (void *)mcfg, "MCFG", len, 5);
> +build_header(linker, table_data, (void *)mcfg, "MCFG", len, 1);
>  }
>  
>  /* GTDT */
> @@ -375,7 +375,7 @@ build_gtdt(GArray *table_data, GArray *linker)
>  
>  build_header(linker, table_data,
>   (void *)(table_data->data + gtdt_start), "GTDT",
> - table_data->len - gtdt_start, 5);
> + table_data->len - gtdt_start, 2);
>  }
>  
>  /* MADT */
> @@ -412,7 +412,7 @@ build_madt(GArray *table_data, GArray *linker, 
> VirtGuestInfo *guest_info,
>  
>  build_header(linker, table_data,
>   (void *)(table_data->data + madt_start), "APIC",
> - table_data->len - madt_start, 5);
> + table_data->len - madt_start, 3);
>  }
>  
>  /* FADT */
> @@ -469,7 +469,7 @@ build_dsdt(GArray *table_data, GArray *linker, 
> VirtGuestInfo *guest_info)
>  g_array_append_vals(table_data, dsdt->buf->data, dsdt->buf->len);
>  build_header(linker, table_data,
>  (void *)(table_data->data + table_data->len - dsdt->buf->len),
> -"DSDT", dsdt->buf->len, 5);
> +"DSDT", dsdt->buf->len, 2);
>  free_aml_allocator();
>  }
>  
> @@ -507,6 +507,7 @@ void virt_acpi_build(VirtGuestInfo *guest_info, 
> AcpiBuildTables *tables)
>   * FADT
>   * GTDT
>   * MADT
> + * MCFG
>   * DSDT
>   */
>  
> @@ -514,7 +515,7 @@ void virt_acpi_build(VirtGuestInfo *guest_info, 
> AcpiBuildTables *tables)
>  dsdt = tables_blob->len;
>  build_dsdt(tables_blob, tables->linker, guest_info);
>  
> -/* FADT MADT GTDT pointed to by RSDT */
> +/* FADT MADT GTDT MCFG pointed to by RSDT */
>  acpi_add_table(table_offsets, tables_blob);
>  build_fadt(tables_blob, tables->linker, dsdt);
>  
> -- 
> 2.0.4
> 



Re: [Qemu-devel] [PATCH] pc: cleanup and convert TMP ACPI device description to AML API

2015-06-21 Thread Michael S. Tsirkin
On Tue, Jun 09, 2015 at 06:40:48AM -0400, Stefan Berger wrote:
> > +
> > +if (misc->tpm_version != TPM_VERSION_UNSPEC) {
> > +dev = aml_device("ISA.TPM");
> > +aml_append(dev, aml_name_decl("_HID",
> > aml_eisaid("PNP0C31")));
> > +aml_append(dev, aml_name_decl("_STA", aml_int(0xF)));
> > +crs = aml_resource_template();
> > +aml_append(crs, aml_memory32_fixed(TPM_TIS_ADDR_BASE,
> > +   TPM_TIS_ADDR_SIZE, AML_READ_WRITE));
> > +aml_append(crs, aml_irq_no_flags(TPM_TIS_IRQ));
> > +aml_append(dev, aml_name_decl("_CRS", crs));
> > +aml_append(scope, dev);
> > +}
> > +
> >  aml_append(sb_scope, scope);
> 
> Once we add the _DSM to it from the link below, it will become longer and 
> maybe
> also more complicated. So I would put it into its own function already?
> http://lists.nongnu.org/archive/html/qemu-devel/2015-05/msg05353.html
> 
> My preference would be to wait until that _DSM has been added to it.
> 

That would make Igor do even more work rewriting code from ASL to C.
This patch shows C isn't harder than DSL so I don't think
we can justify doing the work twice.
I'll apply this as-is for now.

-- 
MST




Re: [Qemu-devel] [PATCH v4 0/9] Extend Microblaze Properties

2015-06-21 Thread Edgar E. Iglesias
On Thu, Jun 18, 2015 at 09:16:21PM -0700, Alistair Francis wrote:
> This patch series extends the MicroBlaze properties
> that I have been working on. It applies on top of my
> original work:
> 'Add Microblaze configuration options'.
> 
> This patch series converts various MicroBlaze PVR registers
> to properties. This then allows the individual Microblaze
> machine reset functions to be removed as well as some other
> dead code.

Thanks Alistair, I've merged this into the mb queue.

Cheers,
Edgar



> 
> V4:
>  - Add some macros
> V3:
>  - Update the pvr register to be a uint8
>  - Add the 8.50.a version to the version_mask
> 
> 
> Alistair Francis (9):
>   target-microblaze: Rename the usefpu variable
>   target-microblaze: Convert use-mmu to a CPU property
>   target-microblaze: Convert dcache-writeback to a CPU property
>   target-microblaze: Convert endi to a CPU property
>   target-microblaze: Convert version_mask to a CPU property
>   target-microblaze: Convert pvr-full to a CPU property
>   ml605_mmu: Move the hardcoded values to the init function
>   s3adsp1800: Remove the hardcoded values from the reset
>   target-microblaze: Remove dead code
> 
>  hw/microblaze/petalogix_ml605_mmu.c  |   23 +++-
>  hw/microblaze/petalogix_s3adsp1800_mmu.c |9 +---
>  target-microblaze/cpu-qom.h  |7 ++-
>  target-microblaze/cpu.c  |   79 +
>  target-microblaze/cpu.h  |8 ++-
>  target-microblaze/helper.c   |6 +-
>  target-microblaze/translate.c|6 +-
>  7 files changed, 95 insertions(+), 43 deletions(-)
> 



[Qemu-devel] [PATCH v1 00/16] Microblaze Queue

2015-06-21 Thread Edgar E. Iglesias
From: "Edgar E. Iglesias" 

This is the stuff in my queue that I plan to merge soonish.

Cheers,
Edgar

Alistair Francis (15):
  target-microblaze: Fix up indentation
  target-microblaze: Preserve the pvr registers during reset
  target-microblaze: Allow the stack protection to be disabled
  target-microblaze: Tidy up the base-vectors property
  target-microblaze: Convert use-fpu to a CPU property
  target-microblaze: Disable stack protection by default
  target-microblaze: Rename the usefpu variable
  target-microblaze: Convert use-mmu to a CPU property
  target-microblaze: Convert dcache-writeback to a CPU property
  target-microblaze: Convert endi to a CPU property
  target-microblaze: Convert version_mask to a CPU property
  target-microblaze: Convert pvr-full to a CPU property
  ml605_mmu: Move the hardcoded values to the init function
  s3adsp1800: Remove the hardcoded values from the reset
  target-microblaze: Remove dead code

Peter Crosthwaite (1):
  microblaze: s3adsp: Instantiate CPU using QOM

 hw/microblaze/petalogix_ml605_mmu.c  |  28 ---
 hw/microblaze/petalogix_s3adsp1800_mmu.c |  17 +---
 target-microblaze/cpu-qom.h  |  14 +++-
 target-microblaze/cpu.c  | 129 ---
 target-microblaze/cpu.h  |  19 +++--
 target-microblaze/helper.c   |  14 ++--
 target-microblaze/op_helper.c|  10 +--
 target-microblaze/translate.c|  14 ++--
 8 files changed, 159 insertions(+), 86 deletions(-)

-- 
1.9.1




[Qemu-devel] [PATCH v1 01/16] microblaze: s3adsp: Instantiate CPU using QOM

2015-06-21 Thread Edgar E. Iglesias
From: Peter Crosthwaite 

Instantiate and realise the CPU directly, rather than using
cpu_mb_init. Microblazes cpu_model argument is a dummy so remove the
default cpu_model set logic.

Reviewed-by: Edgar E. Iglesias 
Signed-off-by: Peter Crosthwaite 
Signed-off-by: Edgar E. Iglesias 
---
 hw/microblaze/petalogix_s3adsp1800_mmu.c | 8 ++--
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/hw/microblaze/petalogix_s3adsp1800_mmu.c 
b/hw/microblaze/petalogix_s3adsp1800_mmu.c
index 84f6e74..4dbbd1e 100644
--- a/hw/microblaze/petalogix_s3adsp1800_mmu.c
+++ b/hw/microblaze/petalogix_s3adsp1800_mmu.c
@@ -62,7 +62,6 @@ static void
 petalogix_s3adsp1800_init(MachineState *machine)
 {
 ram_addr_t ram_size = machine->ram_size;
-const char *cpu_model = machine->cpu_model;
 DeviceState *dev;
 MicroBlazeCPU *cpu;
 DriveInfo *dinfo;
@@ -73,11 +72,8 @@ petalogix_s3adsp1800_init(MachineState *machine)
 qemu_irq irq[32];
 MemoryRegion *sysmem = get_system_memory();
 
-/* init CPUs */
-if (cpu_model == NULL) {
-cpu_model = "microblaze";
-}
-cpu = cpu_mb_init(cpu_model);
+cpu = MICROBLAZE_CPU(object_new(TYPE_MICROBLAZE_CPU));
+object_property_set_bool(OBJECT(cpu), true, "realized", &error_abort);
 
 /* Attach emulated BRAM through the LMB.  */
 memory_region_init_ram(phys_lmb_bram, NULL,
-- 
1.9.1




[Qemu-devel] [PATCH v1 02/16] target-microblaze: Fix up indentation

2015-06-21 Thread Edgar E. Iglesias
From: Alistair Francis 

Fix up the incorrect indentation level in the helper_stackprot() function.

Signed-off-by: Alistair Francis 
Reviewed-by: Peter Crosthwaite 
Reviewed-by: Edgar E. Iglesias 
Signed-off-by: Edgar E. Iglesias 
---
 target-microblaze/op_helper.c | 10 +-
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/target-microblaze/op_helper.c b/target-microblaze/op_helper.c
index a4c8f04..d2b3624 100644
--- a/target-microblaze/op_helper.c
+++ b/target-microblaze/op_helper.c
@@ -468,11 +468,11 @@ void helper_memalign(CPUMBState *env, uint32_t addr, 
uint32_t dr, uint32_t wr,
 void helper_stackprot(CPUMBState *env, uint32_t addr)
 {
 if (addr < env->slr || addr > env->shr) {
-qemu_log("Stack protector violation at %x %x %x\n",
- addr, env->slr, env->shr);
-env->sregs[SR_EAR] = addr;
-env->sregs[SR_ESR] = ESR_EC_STACKPROT;
-helper_raise_exception(env, EXCP_HW_EXCP);
+qemu_log("Stack protector violation at %x %x %x\n",
+ addr, env->slr, env->shr);
+env->sregs[SR_EAR] = addr;
+env->sregs[SR_ESR] = ESR_EC_STACKPROT;
+helper_raise_exception(env, EXCP_HW_EXCP);
 }
 }
 
-- 
1.9.1




[Qemu-devel] [PATCH v1 03/16] target-microblaze: Preserve the pvr registers during reset

2015-06-21 Thread Edgar E. Iglesias
From: Alistair Francis 

Move the Microblaze PVR registers to the end of the CPUMBState
and preserve them during reset. This is similar to what the
QEMU ARM model does with some of it's registers.

This allows the Microblaze PVR registers to only be set once
at realise instead of constantly at reset.

Signed-off-by: Alistair Francis 
Reviewed-by: Peter Crosthwaite 
Reviewed-by: Edgar E. Iglesias 
Signed-off-by: Edgar E. Iglesias 
---
 target-microblaze/cpu.c | 40 ++--
 target-microblaze/cpu.h | 10 ++
 2 files changed, 28 insertions(+), 22 deletions(-)

diff --git a/target-microblaze/cpu.c b/target-microblaze/cpu.c
index 67e3182..95be540 100644
--- a/target-microblaze/cpu.c
+++ b/target-microblaze/cpu.c
@@ -63,13 +63,34 @@ static void mb_cpu_reset(CPUState *s)
 
 mcc->parent_reset(s);
 
-memset(env, 0, sizeof(CPUMBState));
+memset(env, 0, offsetof(CPUMBState, pvr));
 env->res_addr = RES_ADDR_NONE;
 tlb_flush(s, 1);
 
 /* Disable stack protector.  */
 env->shr = ~0;
 
+#if defined(CONFIG_USER_ONLY)
+/* start in user mode with interrupts enabled.  */
+env->sregs[SR_MSR] = MSR_EE | MSR_IE | MSR_VM | MSR_UM;
+#else
+env->sregs[SR_MSR] = 0;
+mmu_init(&env->mmu);
+env->mmu.c_mmu = 3;
+env->mmu.c_mmu_tlb_access = 3;
+env->mmu.c_mmu_zones = 16;
+#endif
+}
+
+static void mb_cpu_realizefn(DeviceState *dev, Error **errp)
+{
+CPUState *cs = CPU(dev);
+MicroBlazeCPUClass *mcc = MICROBLAZE_CPU_GET_CLASS(dev);
+MicroBlazeCPU *cpu = MICROBLAZE_CPU(cs);
+CPUMBState *env = &cpu->env;
+
+qemu_init_vcpu(cs);
+
 env->pvr.regs[0] = PVR0_PVR_FULL_MASK \
| PVR0_USE_BARREL_MASK \
| PVR0_USE_DIV_MASK \
@@ -99,25 +120,8 @@ static void mb_cpu_reset(CPUState *s)
 env->sregs[SR_PC] = cpu->base_vectors;
 
 #if defined(CONFIG_USER_ONLY)
-/* start in user mode with interrupts enabled.  */
-env->sregs[SR_MSR] = MSR_EE | MSR_IE | MSR_VM | MSR_UM;
 env->pvr.regs[10] = 0x0c00; /* Spartan 3a dsp.  */
-#else
-env->sregs[SR_MSR] = 0;
-mmu_init(&env->mmu);
-env->mmu.c_mmu = 3;
-env->mmu.c_mmu_tlb_access = 3;
-env->mmu.c_mmu_zones = 16;
 #endif
-}
-
-static void mb_cpu_realizefn(DeviceState *dev, Error **errp)
-{
-CPUState *cs = CPU(dev);
-MicroBlazeCPUClass *mcc = MICROBLAZE_CPU_GET_CLASS(dev);
-
-cpu_reset(cs);
-qemu_init_vcpu(cs);
 
 mcc->parent_realize(dev, errp);
 }
diff --git a/target-microblaze/cpu.h b/target-microblaze/cpu.h
index d73e1c7..534e1cf 100644
--- a/target-microblaze/cpu.h
+++ b/target-microblaze/cpu.h
@@ -260,16 +260,18 @@ struct CPUMBState {
 #define IFLAGS_TB_MASK  (D_FLAG | IMM_FLAG | DRTI_FLAG | DRTE_FLAG | DRTB_FLAG)
 uint32_t iflags;
 
-struct {
-uint32_t regs[16];
-} pvr;
-
 #if !defined(CONFIG_USER_ONLY)
 /* Unified MMU.  */
 struct microblaze_mmu mmu;
 #endif
 
 CPU_COMMON
+
+/* These fields are preserved on reset.  */
+
+struct {
+uint32_t regs[16];
+} pvr;
 };
 
 #include "cpu-qom.h"
-- 
1.9.1




[Qemu-devel] [PATCH v1 05/16] target-microblaze: Tidy up the base-vectors property

2015-06-21 Thread Edgar E. Iglesias
From: Alistair Francis 

Rename the "xlnx.base-vectors" string to "base-vectors" and
move the base_vectors variable into the cfg struct.

Signed-off-by: Alistair Francis 
Reviewed-by: Peter Crosthwaite 
Signed-off-by: Edgar E. Iglesias 
---
 target-microblaze/cpu-qom.h | 3 ++-
 target-microblaze/cpu.c | 4 ++--
 target-microblaze/helper.c  | 8 
 3 files changed, 8 insertions(+), 7 deletions(-)

diff --git a/target-microblaze/cpu-qom.h b/target-microblaze/cpu-qom.h
index e08adb9..dd04199 100644
--- a/target-microblaze/cpu-qom.h
+++ b/target-microblaze/cpu-qom.h
@@ -56,12 +56,13 @@ typedef struct MicroBlazeCPUClass {
 typedef struct MicroBlazeCPU {
 /*< private >*/
 CPUState parent_obj;
-uint32_t base_vectors;
+
 /*< public >*/
 
 /* Microblaze Configuration Settings */
 struct {
 bool stackprot;
+uint32_t base_vectors;
 } cfg;
 
 CPUMBState env;
diff --git a/target-microblaze/cpu.c b/target-microblaze/cpu.c
index d3dad4a..0f805d3 100644
--- a/target-microblaze/cpu.c
+++ b/target-microblaze/cpu.c
@@ -120,7 +120,7 @@ static void mb_cpu_realizefn(DeviceState *dev, Error **errp)
 env->pvr.regs[10] = 0x0c00; /* Default to spartan 3a dsp family.  */
 env->pvr.regs[11] = PVR11_USE_MMU | (16 << 17);
 
-env->sregs[SR_PC] = cpu->base_vectors;
+env->sregs[SR_PC] = cpu->cfg.base_vectors;
 
 #if defined(CONFIG_USER_ONLY)
 env->pvr.regs[10] = 0x0c00; /* Spartan 3a dsp.  */
@@ -158,7 +158,7 @@ static const VMStateDescription vmstate_mb_cpu = {
 };
 
 static Property mb_properties[] = {
-DEFINE_PROP_UINT32("xlnx.base-vectors", MicroBlazeCPU, base_vectors, 0),
+DEFINE_PROP_UINT32("base-vectors", MicroBlazeCPU, cfg.base_vectors, 0),
 DEFINE_PROP_BOOL("use-stack-protection", MicroBlazeCPU, cfg.stackprot,
  true),
 DEFINE_PROP_END_OF_LIST(),
diff --git a/target-microblaze/helper.c b/target-microblaze/helper.c
index 32896f4..69c3252 100644
--- a/target-microblaze/helper.c
+++ b/target-microblaze/helper.c
@@ -154,7 +154,7 @@ void mb_cpu_do_interrupt(CPUState *cs)
   env->sregs[SR_ESR], env->iflags);
 log_cpu_state_mask(CPU_LOG_INT, cs, 0);
 env->iflags &= ~(IMM_FLAG | D_FLAG);
-env->sregs[SR_PC] = cpu->base_vectors + 0x20;
+env->sregs[SR_PC] = cpu->cfg.base_vectors + 0x20;
 break;
 
 case EXCP_MMU:
@@ -194,7 +194,7 @@ void mb_cpu_do_interrupt(CPUState *cs)
   env->sregs[SR_PC], env->sregs[SR_EAR], env->iflags);
 log_cpu_state_mask(CPU_LOG_INT, cs, 0);
 env->iflags &= ~(IMM_FLAG | D_FLAG);
-env->sregs[SR_PC] = cpu->base_vectors + 0x20;
+env->sregs[SR_PC] = cpu->cfg.base_vectors + 0x20;
 break;
 
 case EXCP_IRQ:
@@ -235,7 +235,7 @@ void mb_cpu_do_interrupt(CPUState *cs)
 env->sregs[SR_MSR] |= t;
 
 env->regs[14] = env->sregs[SR_PC];
-env->sregs[SR_PC] = cpu->base_vectors + 0x10;
+env->sregs[SR_PC] = cpu->cfg.base_vectors + 0x10;
 //log_cpu_state_mask(CPU_LOG_INT, cs, 0);
 break;
 
@@ -254,7 +254,7 @@ void mb_cpu_do_interrupt(CPUState *cs)
 if (cs->exception_index == EXCP_HW_BREAK) {
 env->regs[16] = env->sregs[SR_PC];
 env->sregs[SR_MSR] |= MSR_BIP;
-env->sregs[SR_PC] = cpu->base_vectors + 0x18;
+env->sregs[SR_PC] = cpu->cfg.base_vectors + 0x18;
 } else
 env->sregs[SR_PC] = env->btarget;
 break;
-- 
1.9.1




[Qemu-devel] [PATCH v1 06/16] target-microblaze: Convert use-fpu to a CPU property

2015-06-21 Thread Edgar E. Iglesias
From: Alistair Francis 

Originally the use-fpu PVR bits were manually set for each machine. This
is a hassle and difficult to read, instead set them based on the CPU
properties.

Signed-off-by: Alistair Francis 
Reviewed-by: Peter Crosthwaite 
Signed-off-by: Edgar E. Iglesias 
---
 hw/microblaze/petalogix_ml605_mmu.c |  7 +--
 target-microblaze/cpu-qom.h |  1 +
 target-microblaze/cpu.c | 13 ++---
 target-microblaze/translate.c   | 10 +++---
 4 files changed, 19 insertions(+), 12 deletions(-)

diff --git a/hw/microblaze/petalogix_ml605_mmu.c 
b/hw/microblaze/petalogix_ml605_mmu.c
index 48c264b..05c120a 100644
--- a/hw/microblaze/petalogix_ml605_mmu.c
+++ b/hw/microblaze/petalogix_ml605_mmu.c
@@ -71,9 +71,8 @@ static void machine_cpu_reset(MicroBlazeCPU *cpu)
 env->pvr.regs[10] = 0x0e00; /* virtex 6 */
 /* setup pvr to match kernel setting */
 env->pvr.regs[5] |= PVR5_DCACHE_WRITEBACK_MASK;
-env->pvr.regs[0] |= PVR0_USE_FPU_MASK | PVR0_ENDI;
+env->pvr.regs[0] |= PVR0_ENDI;
 env->pvr.regs[0] = (env->pvr.regs[0] & ~PVR0_VERSION_MASK) | (0x14 << 8);
-env->pvr.regs[2] ^= PVR2_USE_FPU2_MASK;
 env->pvr.regs[4] = 0xc56b8000;
 env->pvr.regs[5] = 0xc56be000;
 }
@@ -95,6 +94,10 @@ petalogix_ml605_init(MachineState *machine)
 
 /* init CPUs */
 cpu = MICROBLAZE_CPU(object_new(TYPE_MICROBLAZE_CPU));
+/* Use FPU but don't use floating point conversion and square
+ * root instructions
+ */
+object_property_set_int(OBJECT(cpu), 1, "use-fpu", &error_abort);
 object_property_set_bool(OBJECT(cpu), true, "realized", &error_abort);
 
 /* Attach emulated BRAM through the LMB.  */
diff --git a/target-microblaze/cpu-qom.h b/target-microblaze/cpu-qom.h
index dd04199..a6474f9 100644
--- a/target-microblaze/cpu-qom.h
+++ b/target-microblaze/cpu-qom.h
@@ -63,6 +63,7 @@ typedef struct MicroBlazeCPU {
 struct {
 bool stackprot;
 uint32_t base_vectors;
+uint8_t usefpu;
 } cfg;
 
 CPUMBState env;
diff --git a/target-microblaze/cpu.c b/target-microblaze/cpu.c
index 0f805d3..b857056 100644
--- a/target-microblaze/cpu.c
+++ b/target-microblaze/cpu.c
@@ -110,12 +110,14 @@ static void mb_cpu_realizefn(DeviceState *dev, Error 
**errp)
 | PVR2_USE_DIV_MASK \
 | PVR2_USE_HW_MUL_MASK \
 | PVR2_USE_MUL64_MASK \
-| PVR2_USE_FPU_MASK \
-| PVR2_USE_FPU2_MASK \
 | PVR2_FPU_EXC_MASK \
 | 0;
 
-env->pvr.regs[0] |= cpu->cfg.stackprot ? PVR0_SPROT_MASK : 0;
+env->pvr.regs[0] |= (cpu->cfg.stackprot ? PVR0_SPROT_MASK : 0) |
+(cpu->cfg.usefpu ? PVR0_USE_FPU_MASK : 0);
+
+env->pvr.regs[2] |= (cpu->cfg.usefpu ? PVR2_USE_FPU_MASK : 0) |
+(cpu->cfg.usefpu > 1 ? PVR2_USE_FPU2_MASK : 0);
 
 env->pvr.regs[10] = 0x0c00; /* Default to spartan 3a dsp family.  */
 env->pvr.regs[11] = PVR11_USE_MMU | (16 << 17);
@@ -161,6 +163,11 @@ static Property mb_properties[] = {
 DEFINE_PROP_UINT32("base-vectors", MicroBlazeCPU, cfg.base_vectors, 0),
 DEFINE_PROP_BOOL("use-stack-protection", MicroBlazeCPU, cfg.stackprot,
  true),
+/* If use-fpu > 0 - FPU is enabled
+ * If use-fpu = 2 - Floating point conversion and square root instructions
+ *  are enabled
+ */
+DEFINE_PROP_UINT8("use-fpu", MicroBlazeCPU, cfg.usefpu, 2),
 DEFINE_PROP_END_OF_LIST(),
 };
 
diff --git a/target-microblaze/translate.c b/target-microblaze/translate.c
index bd10b40..8187700 100644
--- a/target-microblaze/translate.c
+++ b/target-microblaze/translate.c
@@ -1411,15 +1411,11 @@ static void dec_rts(DisasContext *dc)
 
 static int dec_check_fpuv2(DisasContext *dc)
 {
-int r;
-
-r = dc->cpu->env.pvr.regs[2] & PVR2_USE_FPU2_MASK;
-
-if (!r && (dc->tb_flags & MSR_EE_FLAG)) {
+if ((dc->cpu->cfg.usefpu != 2) && (dc->tb_flags & MSR_EE_FLAG)) {
 tcg_gen_movi_tl(cpu_SR[SR_ESR], ESR_EC_FPU);
 t_gen_raise_exception(dc, EXCP_HW_EXCP);
 }
-return r;
+return (dc->cpu->cfg.usefpu == 2) ? 0 : PVR2_USE_FPU2_MASK;
 }
 
 static void dec_fpu(DisasContext *dc)
@@ -1428,7 +1424,7 @@ static void dec_fpu(DisasContext *dc)
 
 if ((dc->tb_flags & MSR_EE_FLAG)
   && (dc->cpu->env.pvr.regs[2] & PVR2_ILL_OPCODE_EXC_MASK)
-  && !((dc->cpu->env.pvr.regs[2] & PVR2_USE_FPU_MASK))) {
+  && (dc->cpu->cfg.usefpu != 1)) {
 tcg_gen_movi_tl(cpu_SR[SR_ESR], ESR_EC_ILLEGAL_OP);
 t_gen_raise_exception(dc, EXCP_HW_EXCP);
 return;
-- 
1.9.1




[Qemu-devel] [PATCH v1 07/16] target-microblaze: Disable stack protection by default

2015-06-21 Thread Edgar E. Iglesias
From: Alistair Francis 

Stack protection is not available when the MMU is enabled.
As the MMU is enabled by default, disable stack protection
by default.

Signed-off-by: Alistair Francis 
Signed-off-by: Edgar E. Iglesias 
---
 target-microblaze/cpu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target-microblaze/cpu.c b/target-microblaze/cpu.c
index b857056..13ae49a 100644
--- a/target-microblaze/cpu.c
+++ b/target-microblaze/cpu.c
@@ -162,7 +162,7 @@ static const VMStateDescription vmstate_mb_cpu = {
 static Property mb_properties[] = {
 DEFINE_PROP_UINT32("base-vectors", MicroBlazeCPU, cfg.base_vectors, 0),
 DEFINE_PROP_BOOL("use-stack-protection", MicroBlazeCPU, cfg.stackprot,
- true),
+ false),
 /* If use-fpu > 0 - FPU is enabled
  * If use-fpu = 2 - Floating point conversion and square root instructions
  *  are enabled
-- 
1.9.1




[Qemu-devel] [PATCH v1 08/16] target-microblaze: Rename the usefpu variable

2015-06-21 Thread Edgar E. Iglesias
From: Alistair Francis 

Rename the usefpu variable to use_fpu.

Signed-off-by: Alistair Francis 
Reviewed-by: Peter Crosthwaite 
Signed-off-by: Edgar E. Iglesias 
---
 target-microblaze/cpu-qom.h   | 2 +-
 target-microblaze/cpu.c   | 8 
 target-microblaze/translate.c | 6 +++---
 3 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/target-microblaze/cpu-qom.h b/target-microblaze/cpu-qom.h
index a6474f9..aa9c032 100644
--- a/target-microblaze/cpu-qom.h
+++ b/target-microblaze/cpu-qom.h
@@ -63,7 +63,7 @@ typedef struct MicroBlazeCPU {
 struct {
 bool stackprot;
 uint32_t base_vectors;
-uint8_t usefpu;
+uint8_t use_fpu;
 } cfg;
 
 CPUMBState env;
diff --git a/target-microblaze/cpu.c b/target-microblaze/cpu.c
index 13ae49a..a6b6fd7 100644
--- a/target-microblaze/cpu.c
+++ b/target-microblaze/cpu.c
@@ -114,10 +114,10 @@ static void mb_cpu_realizefn(DeviceState *dev, Error 
**errp)
 | 0;
 
 env->pvr.regs[0] |= (cpu->cfg.stackprot ? PVR0_SPROT_MASK : 0) |
-(cpu->cfg.usefpu ? PVR0_USE_FPU_MASK : 0);
+(cpu->cfg.use_fpu ? PVR0_USE_FPU_MASK : 0);
 
-env->pvr.regs[2] |= (cpu->cfg.usefpu ? PVR2_USE_FPU_MASK : 0) |
-(cpu->cfg.usefpu > 1 ? PVR2_USE_FPU2_MASK : 0);
+env->pvr.regs[2] |= (cpu->cfg.use_fpu ? PVR2_USE_FPU_MASK : 0) |
+(cpu->cfg.use_fpu > 1 ? PVR2_USE_FPU2_MASK : 0);
 
 env->pvr.regs[10] = 0x0c00; /* Default to spartan 3a dsp family.  */
 env->pvr.regs[11] = PVR11_USE_MMU | (16 << 17);
@@ -167,7 +167,7 @@ static Property mb_properties[] = {
  * If use-fpu = 2 - Floating point conversion and square root instructions
  *  are enabled
  */
-DEFINE_PROP_UINT8("use-fpu", MicroBlazeCPU, cfg.usefpu, 2),
+DEFINE_PROP_UINT8("use-fpu", MicroBlazeCPU, cfg.use_fpu, 2),
 DEFINE_PROP_END_OF_LIST(),
 };
 
diff --git a/target-microblaze/translate.c b/target-microblaze/translate.c
index 8187700..1f5fe9a 100644
--- a/target-microblaze/translate.c
+++ b/target-microblaze/translate.c
@@ -1411,11 +1411,11 @@ static void dec_rts(DisasContext *dc)
 
 static int dec_check_fpuv2(DisasContext *dc)
 {
-if ((dc->cpu->cfg.usefpu != 2) && (dc->tb_flags & MSR_EE_FLAG)) {
+if ((dc->cpu->cfg.use_fpu != 2) && (dc->tb_flags & MSR_EE_FLAG)) {
 tcg_gen_movi_tl(cpu_SR[SR_ESR], ESR_EC_FPU);
 t_gen_raise_exception(dc, EXCP_HW_EXCP);
 }
-return (dc->cpu->cfg.usefpu == 2) ? 0 : PVR2_USE_FPU2_MASK;
+return (dc->cpu->cfg.use_fpu == 2) ? 0 : PVR2_USE_FPU2_MASK;
 }
 
 static void dec_fpu(DisasContext *dc)
@@ -1424,7 +1424,7 @@ static void dec_fpu(DisasContext *dc)
 
 if ((dc->tb_flags & MSR_EE_FLAG)
   && (dc->cpu->env.pvr.regs[2] & PVR2_ILL_OPCODE_EXC_MASK)
-  && (dc->cpu->cfg.usefpu != 1)) {
+  && (dc->cpu->cfg.use_fpu != 1)) {
 tcg_gen_movi_tl(cpu_SR[SR_ESR], ESR_EC_ILLEGAL_OP);
 t_gen_raise_exception(dc, EXCP_HW_EXCP);
 return;
-- 
1.9.1




[Qemu-devel] [PATCH v1 11/16] target-microblaze: Convert endi to a CPU property

2015-06-21 Thread Edgar E. Iglesias
From: Alistair Francis 

Originally the endi PVR bits were manually set for each machine. This
is a hassle and difficult to read, instead set them based on the CPU
properties.

Signed-off-by: Alistair Francis 
Reviewed-by: Edgar E. Iglesias 
Reviewed-by: Peter Crosthwaite 
Signed-off-by: Edgar E. Iglesias 
---
 hw/microblaze/petalogix_ml605_mmu.c | 2 +-
 target-microblaze/cpu-qom.h | 1 +
 target-microblaze/cpu.c | 4 +++-
 target-microblaze/cpu.h | 2 +-
 4 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/hw/microblaze/petalogix_ml605_mmu.c 
b/hw/microblaze/petalogix_ml605_mmu.c
index 995a579..e9adc2f 100644
--- a/hw/microblaze/petalogix_ml605_mmu.c
+++ b/hw/microblaze/petalogix_ml605_mmu.c
@@ -70,7 +70,6 @@ static void machine_cpu_reset(MicroBlazeCPU *cpu)
 
 env->pvr.regs[10] = 0x0e00; /* virtex 6 */
 /* setup pvr to match kernel setting */
-env->pvr.regs[0] |= PVR0_ENDI;
 env->pvr.regs[0] = (env->pvr.regs[0] & ~PVR0_VERSION_MASK) | (0x14 << 8);
 env->pvr.regs[4] = 0xc56b8000;
 env->pvr.regs[5] = 0xc56be000;
@@ -99,6 +98,7 @@ petalogix_ml605_init(MachineState *machine)
 object_property_set_int(OBJECT(cpu), 1, "use-fpu", &error_abort);
 object_property_set_bool(OBJECT(cpu), true, "dcache-writeback",
  &error_abort);
+object_property_set_bool(OBJECT(cpu), true, "endianness", &error_abort);
 object_property_set_bool(OBJECT(cpu), true, "realized", &error_abort);
 
 /* Attach emulated BRAM through the LMB.  */
diff --git a/target-microblaze/cpu-qom.h b/target-microblaze/cpu-qom.h
index 3b6165d..d1d814b 100644
--- a/target-microblaze/cpu-qom.h
+++ b/target-microblaze/cpu-qom.h
@@ -66,6 +66,7 @@ typedef struct MicroBlazeCPU {
 uint8_t use_fpu;
 bool use_mmu;
 bool dcache_writeback;
+bool endi;
 } cfg;
 
 CPUMBState env;
diff --git a/target-microblaze/cpu.c b/target-microblaze/cpu.c
index 92c51a0..8429275 100644
--- a/target-microblaze/cpu.c
+++ b/target-microblaze/cpu.c
@@ -114,7 +114,8 @@ static void mb_cpu_realizefn(DeviceState *dev, Error **errp)
 
 env->pvr.regs[0] |= (cpu->cfg.stackprot ? PVR0_SPROT_MASK : 0) |
 (cpu->cfg.use_fpu ? PVR0_USE_FPU_MASK : 0) |
-(cpu->cfg.use_mmu ? PVR0_USE_MMU_MASK : 0);
+(cpu->cfg.use_mmu ? PVR0_USE_MMU_MASK : 0) |
+(cpu->cfg.endi ? PVR0_ENDI_MASK : 0);
 
 env->pvr.regs[2] |= (cpu->cfg.use_fpu ? PVR2_USE_FPU_MASK : 0) |
 (cpu->cfg.use_fpu > 1 ? PVR2_USE_FPU2_MASK : 0);
@@ -174,6 +175,7 @@ static Property mb_properties[] = {
 DEFINE_PROP_BOOL("use-mmu", MicroBlazeCPU, cfg.use_mmu, true),
 DEFINE_PROP_BOOL("dcache-writeback", MicroBlazeCPU, cfg.dcache_writeback,
  false),
+DEFINE_PROP_BOOL("endianness", MicroBlazeCPU, cfg.endi, false),
 DEFINE_PROP_END_OF_LIST(),
 };
 
diff --git a/target-microblaze/cpu.h b/target-microblaze/cpu.h
index 54e41e8..0f82abd 100644
--- a/target-microblaze/cpu.h
+++ b/target-microblaze/cpu.h
@@ -124,7 +124,7 @@ typedef struct CPUMBState CPUMBState;
 #define PVR0_USE_DCACHE_MASK0x0100
 #define PVR0_USE_MMU_MASK   0x0080
 #define PVR0_USE_BTC   0x0040
-#define PVR0_ENDI  0x0020
+#define PVR0_ENDI_MASK  0x0020
 #define PVR0_FAULT 0x0010
 #define PVR0_VERSION_MASK   0xFF00
 #define PVR0_USER1_MASK 0x00FF
-- 
1.9.1




[Qemu-devel] [PATCH v1 12/16] target-microblaze: Convert version_mask to a CPU property

2015-06-21 Thread Edgar E. Iglesias
From: Alistair Francis 

Originally the version_mask PVR bits were manually set for each
machine. This is a hassle and difficult to read, instead set them
based on the CPU properties.

Signed-off-by: Alistair Francis 
Reviewed-by: Peter Crosthwaite 
Signed-off-by: Edgar E. Iglesias 
---
 hw/microblaze/petalogix_ml605_mmu.c |  2 +-
 target-microblaze/cpu-qom.h |  1 +
 target-microblaze/cpu.c | 54 -
 3 files changed, 55 insertions(+), 2 deletions(-)

diff --git a/hw/microblaze/petalogix_ml605_mmu.c 
b/hw/microblaze/petalogix_ml605_mmu.c
index e9adc2f..609c90b 100644
--- a/hw/microblaze/petalogix_ml605_mmu.c
+++ b/hw/microblaze/petalogix_ml605_mmu.c
@@ -70,7 +70,7 @@ static void machine_cpu_reset(MicroBlazeCPU *cpu)
 
 env->pvr.regs[10] = 0x0e00; /* virtex 6 */
 /* setup pvr to match kernel setting */
-env->pvr.regs[0] = (env->pvr.regs[0] & ~PVR0_VERSION_MASK) | (0x14 << 8);
+env->pvr.regs[0] |= (0x14 << 8);
 env->pvr.regs[4] = 0xc56b8000;
 env->pvr.regs[5] = 0xc56be000;
 }
diff --git a/target-microblaze/cpu-qom.h b/target-microblaze/cpu-qom.h
index d1d814b..7da25fa 100644
--- a/target-microblaze/cpu-qom.h
+++ b/target-microblaze/cpu-qom.h
@@ -67,6 +67,7 @@ typedef struct MicroBlazeCPU {
 bool use_mmu;
 bool dcache_writeback;
 bool endi;
+char *version;
 } cfg;
 
 CPUMBState env;
diff --git a/target-microblaze/cpu.c b/target-microblaze/cpu.c
index 8429275..df3dd89 100644
--- a/target-microblaze/cpu.c
+++ b/target-microblaze/cpu.c
@@ -26,6 +26,43 @@
 #include "hw/qdev-properties.h"
 #include "migration/vmstate.h"
 
+static const struct {
+const char *name;
+uint8_t version_id;
+} mb_cpu_lookup[] = {
+/* These key value are as per MBV field in PVR0 */
+{"5.00.a", 0x01},
+{"5.00.b", 0x02},
+{"5.00.c", 0x03},
+{"6.00.a", 0x04},
+{"6.00.b", 0x06},
+{"7.00.a", 0x05},
+{"7.00.b", 0x07},
+{"7.10.a", 0x08},
+{"7.10.b", 0x09},
+{"7.10.c", 0x0a},
+{"7.10.d", 0x0b},
+{"7.20.a", 0x0c},
+{"7.20.b", 0x0d},
+{"7.20.c", 0x0e},
+{"7.20.d", 0x0f},
+{"7.30.a", 0x10},
+{"7.30.b", 0x11},
+{"8.00.a", 0x12},
+{"8.00.b", 0x13},
+{"8.10.a", 0x14},
+{"8.20.a", 0x15},
+{"8.20.b", 0x16},
+{"8.30.a", 0x17},
+{"8.40.a", 0x18},
+{"8.40.b", 0x19},
+{"8.50.a", 0x1A},
+{"9.0", 0x1B},
+{"9.1", 0x1D},
+{"9.2", 0x1F},
+{"9.3", 0x20},
+{NULL, 0},
+};
 
 static void mb_cpu_set_pc(CPUState *cs, vaddr value)
 {
@@ -88,6 +125,8 @@ static void mb_cpu_realizefn(DeviceState *dev, Error **errp)
 MicroBlazeCPUClass *mcc = MICROBLAZE_CPU_GET_CLASS(dev);
 MicroBlazeCPU *cpu = MICROBLAZE_CPU(cs);
 CPUMBState *env = &cpu->env;
+uint8_t version_code = 0;
+int i = 0;
 
 qemu_init_vcpu(cs);
 
@@ -112,10 +151,22 @@ static void mb_cpu_realizefn(DeviceState *dev, Error 
**errp)
 | PVR2_FPU_EXC_MASK \
 | 0;
 
+for (i = 0; mb_cpu_lookup[i].name && cpu->cfg.version; i++) {
+if (strcmp(mb_cpu_lookup[i].name, cpu->cfg.version) == 0) {
+version_code = mb_cpu_lookup[i].version_id;
+break;
+}
+}
+
+if (!version_code) {
+qemu_log("Invalid MicroBlaze version number: %s\n", cpu->cfg.version);
+}
+
 env->pvr.regs[0] |= (cpu->cfg.stackprot ? PVR0_SPROT_MASK : 0) |
 (cpu->cfg.use_fpu ? PVR0_USE_FPU_MASK : 0) |
 (cpu->cfg.use_mmu ? PVR0_USE_MMU_MASK : 0) |
-(cpu->cfg.endi ? PVR0_ENDI_MASK : 0);
+(cpu->cfg.endi ? PVR0_ENDI_MASK : 0) |
+(version_code << 16);
 
 env->pvr.regs[2] |= (cpu->cfg.use_fpu ? PVR2_USE_FPU_MASK : 0) |
 (cpu->cfg.use_fpu > 1 ? PVR2_USE_FPU2_MASK : 0);
@@ -176,6 +227,7 @@ static Property mb_properties[] = {
 DEFINE_PROP_BOOL("dcache-writeback", MicroBlazeCPU, cfg.dcache_writeback,
  false),
 DEFINE_PROP_BOOL("endianness", MicroBlazeCPU, cfg.endi, false),
+DEFINE_PROP_STRING("version", MicroBlazeCPU, cfg.version),
 DEFINE_PROP_END_OF_LIST(),
 };
 
-- 
1.9.1




[Qemu-devel] [PATCH v1 13/16] target-microblaze: Convert pvr-full to a CPU property

2015-06-21 Thread Edgar E. Iglesias
From: Alistair Francis 

Originally the pvr-full PVR bits were manually set for each machine. This
is a hassle and difficult to read, instead set them based on the CPU
properties.

Signed-off-by: Alistair Francis 
Reviewed-by: Peter Crosthwaite 
Signed-off-by: Edgar E. Iglesias 
---
 target-microblaze/cpu-qom.h | 1 +
 target-microblaze/cpu.c | 7 ---
 target-microblaze/cpu.h | 4 +++-
 target-microblaze/helper.c  | 4 ++--
 4 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/target-microblaze/cpu-qom.h b/target-microblaze/cpu-qom.h
index 7da25fa..34f6273 100644
--- a/target-microblaze/cpu-qom.h
+++ b/target-microblaze/cpu-qom.h
@@ -68,6 +68,7 @@ typedef struct MicroBlazeCPU {
 bool dcache_writeback;
 bool endi;
 char *version;
+uint8_t pvr;
 } cfg;
 
 CPUMBState env;
diff --git a/target-microblaze/cpu.c b/target-microblaze/cpu.c
index df3dd89..ac390ce 100644
--- a/target-microblaze/cpu.c
+++ b/target-microblaze/cpu.c
@@ -130,8 +130,7 @@ static void mb_cpu_realizefn(DeviceState *dev, Error **errp)
 
 qemu_init_vcpu(cs);
 
-env->pvr.regs[0] = PVR0_PVR_FULL_MASK \
-   | PVR0_USE_BARREL_MASK \
+env->pvr.regs[0] = PVR0_USE_BARREL_MASK \
| PVR0_USE_DIV_MASK \
| PVR0_USE_HW_MUL_MASK \
| PVR0_USE_EXC_MASK \
@@ -166,7 +165,8 @@ static void mb_cpu_realizefn(DeviceState *dev, Error **errp)
 (cpu->cfg.use_fpu ? PVR0_USE_FPU_MASK : 0) |
 (cpu->cfg.use_mmu ? PVR0_USE_MMU_MASK : 0) |
 (cpu->cfg.endi ? PVR0_ENDI_MASK : 0) |
-(version_code << 16);
+(version_code << 16) |
+(cpu->cfg.pvr == C_PVR_FULL ? PVR0_PVR_FULL_MASK : 0);
 
 env->pvr.regs[2] |= (cpu->cfg.use_fpu ? PVR2_USE_FPU_MASK : 0) |
 (cpu->cfg.use_fpu > 1 ? PVR2_USE_FPU2_MASK : 0);
@@ -228,6 +228,7 @@ static Property mb_properties[] = {
  false),
 DEFINE_PROP_BOOL("endianness", MicroBlazeCPU, cfg.endi, false),
 DEFINE_PROP_STRING("version", MicroBlazeCPU, cfg.version),
+DEFINE_PROP_UINT8("pvr", MicroBlazeCPU, cfg.pvr, C_PVR_FULL),
 DEFINE_PROP_END_OF_LIST(),
 };
 
diff --git a/target-microblaze/cpu.h b/target-microblaze/cpu.h
index 0f82abd..0dd164f 100644
--- a/target-microblaze/cpu.h
+++ b/target-microblaze/cpu.h
@@ -212,7 +212,9 @@ typedef struct CPUMBState CPUMBState;
 /* MSR Reset value PVR mask */
 #define PVR11_MSR_RESET_VALUE_MASK  0x07FF
 
-
+#define C_PVR_NONE  0
+#define C_PVR_BASIC 1
+#define C_PVR_FULL  2
 
 /* CPU flags.  */
 
diff --git a/target-microblaze/helper.c b/target-microblaze/helper.c
index 5156c12..8257b0e 100644
--- a/target-microblaze/helper.c
+++ b/target-microblaze/helper.c
@@ -58,8 +58,8 @@ int mb_cpu_handle_mmu_fault(CPUState *cs, vaddr address, int 
rw,
 mmu_available = 0;
 if (cpu->cfg.use_mmu) {
 mmu_available = 1;
-if ((env->pvr.regs[0] & PVR0_PVR_FULL_MASK)
-&& (env->pvr.regs[11] & PVR11_USE_MMU) != PVR11_USE_MMU) {
+if ((cpu->cfg.pvr == C_PVR_FULL) &&
+(env->pvr.regs[11] & PVR11_USE_MMU) != PVR11_USE_MMU) {
 mmu_available = 0;
 }
 }
-- 
1.9.1




[Qemu-devel] [PATCH v1 14/16] ml605_mmu: Move the hardcoded values to the init function

2015-06-21 Thread Edgar E. Iglesias
From: Alistair Francis 

Move the hard coded register values to the init function.
This also allows the entire reset function to be deleted, as
PVR registers are now preserved on reset.

The hardcoded PVR0 values can be removed as they are setting
the endianness and stack protection, which is already done
or invalid.

Signed-off-by: Alistair Francis 
Reviewed-by: Peter Crosthwaite 
Signed-off-by: Edgar E. Iglesias 
---
 hw/microblaze/petalogix_ml605_mmu.c | 18 ++
 1 file changed, 6 insertions(+), 12 deletions(-)

diff --git a/hw/microblaze/petalogix_ml605_mmu.c 
b/hw/microblaze/petalogix_ml605_mmu.c
index 609c90b..ed84a37 100644
--- a/hw/microblaze/petalogix_ml605_mmu.c
+++ b/hw/microblaze/petalogix_ml605_mmu.c
@@ -64,17 +64,6 @@
 #define SPI_IRQ 4
 #define UART16550_IRQ   5
 
-static void machine_cpu_reset(MicroBlazeCPU *cpu)
-{
-CPUMBState *env = &cpu->env;
-
-env->pvr.regs[10] = 0x0e00; /* virtex 6 */
-/* setup pvr to match kernel setting */
-env->pvr.regs[0] |= (0x14 << 8);
-env->pvr.regs[4] = 0xc56b8000;
-env->pvr.regs[5] = 0xc56be000;
-}
-
 static void
 petalogix_ml605_init(MachineState *machine)
 {
@@ -205,10 +194,15 @@ petalogix_ml605_init(MachineState *machine)
 }
 }
 
+/* setup PVR to match kernel settings */
+cpu->env.pvr.regs[4] = 0xc56b8000;
+cpu->env.pvr.regs[5] = 0xc56be000;
+cpu->env.pvr.regs[10] = 0x0e00; /* virtex 6 */
+
 microblaze_load_kernel(cpu, MEMORY_BASEADDR, ram_size,
machine->initrd_filename,
BINARY_DEVICE_TREE_FILE,
-   machine_cpu_reset);
+   NULL);
 
 }
 
-- 
1.9.1




[Qemu-devel] [PATCH v1 15/16] s3adsp1800: Remove the hardcoded values from the reset

2015-06-21 Thread Edgar E. Iglesias
From: Alistair Francis 

Remove the hardcoded values from the machine specific reset
function, as the same values are already set in the standard
MicroBlaze reset.

This also allows the entire reset function to be deleted, as
PVR registers are now preserved on reset.

Signed-off-by: Alistair Francis 
Reviewed-by: Edgar E. Iglesias 
Reviewed-by: Peter Crosthwaite 
Signed-off-by: Edgar E. Iglesias 
---
 hw/microblaze/petalogix_s3adsp1800_mmu.c | 9 +
 1 file changed, 1 insertion(+), 8 deletions(-)

diff --git a/hw/microblaze/petalogix_s3adsp1800_mmu.c 
b/hw/microblaze/petalogix_s3adsp1800_mmu.c
index 4dbbd1e..0c2140c 100644
--- a/hw/microblaze/petalogix_s3adsp1800_mmu.c
+++ b/hw/microblaze/petalogix_s3adsp1800_mmu.c
@@ -51,13 +51,6 @@
 #define ETHLITE_IRQ 1
 #define UARTLITE_IRQ3
 
-static void machine_cpu_reset(MicroBlazeCPU *cpu)
-{
-CPUMBState *env = &cpu->env;
-
-env->pvr.regs[10] = 0x0c00; /* spartan 3a dsp family.  */
-}
-
 static void
 petalogix_s3adsp1800_init(MachineState *machine)
 {
@@ -128,7 +121,7 @@ petalogix_s3adsp1800_init(MachineState *machine)
 microblaze_load_kernel(cpu, ddr_base, ram_size,
machine->initrd_filename,
BINARY_DEVICE_TREE_FILE,
-   machine_cpu_reset);
+   NULL);
 }
 
 static QEMUMachine petalogix_s3adsp1800_machine = {
-- 
1.9.1




[Qemu-devel] [PATCH v1 16/16] target-microblaze: Remove dead code

2015-06-21 Thread Edgar E. Iglesias
From: Alistair Francis 

This code is already being run in the mb_cpu_realizefn()
function. As PVR registers are preserved on reset this
code is not required.

Signed-off-by: Alistair Francis 
Reviewed-by: Edgar E. Iglesias 
Reviewed-by: Peter Crosthwaite 
Signed-off-by: Edgar E. Iglesias 
---
 target-microblaze/cpu.c | 4 
 1 file changed, 4 deletions(-)

diff --git a/target-microblaze/cpu.c b/target-microblaze/cpu.c
index ac390ce..c592bf7 100644
--- a/target-microblaze/cpu.c
+++ b/target-microblaze/cpu.c
@@ -179,10 +179,6 @@ static void mb_cpu_realizefn(DeviceState *dev, Error 
**errp)
 
 env->sregs[SR_PC] = cpu->cfg.base_vectors;
 
-#if defined(CONFIG_USER_ONLY)
-env->pvr.regs[10] = 0x0c00; /* Spartan 3a dsp.  */
-#endif
-
 mcc->parent_realize(dev, errp);
 }
 
-- 
1.9.1




Re: [Qemu-devel] [RFC] Cortex-M different revisions

2015-06-21 Thread Peter Maydell
On 21 June 2015 at 09:17, Liviu Ionescu  wrote:
> while studying the details of cortex-m cores, I ran into the
> many differences between existing revisions, especially for
> cortex-m3, which are numerous and some significative, like
> stack alignment. for example for m3, the changes from r0p0 to
> r1p0/r1p1 are one full page of details

Our usual approach is "implement a recent revision". We don't
attempt to accurately emulate the foibles of earlier revs,
and definitely don't try to emulate the errata. Similarly,
we often emulate to an "architecturally correct" level
rather than "match the IMPDEF behaviour of a particular
implementation".

> for this I'm considering extending the naming scheme for
> cortex-m cores, to include the revision, like "cortex-m3-r2p1",
> which will define the fields in CPUID correctly.

I think these should probably be cpu object properties, if
we do them at all. Non-buggy guest code should not care whether
it is running on an r2p1 or an r2p0, so mostly trying to provide
lots of rev/patchlevel variations just means we get an accumulation
of very similar CPUs, which we then don't actually emulate
to a level of accuracy that would mean they make a difference
to the guest.

Do you have real-world guest code that breaks?

thanks
-- PMM



Re: [Qemu-devel] [PULL 24/34] target-s390x: implement TRANSLATE AND TEST instruction

2015-06-21 Thread Aurelien Jarno
On 2015-06-20 23:06, Paolo Bonzini wrote:
> 
> 
> On 05/06/2015 01:41, Alexander Graf wrote:
> > From: Aurelien Jarno 
> > 
> > It is part of the basic zArchitecture instructions. Allow it to be call
> > from EXECUTE.
> > 
> > Reviewed-by: Richard Henderson 
> > Signed-off-by: Aurelien Jarno 
> > Signed-off-by: Alexander Graf 
> > ---
> >  target-s390x/helper.h  |  1 +
> >  target-s390x/insn-data.def |  2 ++
> >  target-s390x/mem_helper.c  | 24 
> >  target-s390x/translate.c   | 10 ++
> >  4 files changed, 37 insertions(+)
> > 
> > diff --git a/target-s390x/helper.h b/target-s390x/helper.h
> > index cb0b421..48b015e 100644
> > --- a/target-s390x/helper.h
> > +++ b/target-s390x/helper.h
> > @@ -77,6 +77,7 @@ DEF_HELPER_FLAGS_3(sqxb, TCG_CALL_NO_WG, i64, env, i64, 
> > i64)
> >  DEF_HELPER_FLAGS_1(cvd, TCG_CALL_NO_RWG_SE, i64, s32)
> >  DEF_HELPER_FLAGS_4(unpk, TCG_CALL_NO_WG, void, env, i32, i64, i64)
> >  DEF_HELPER_FLAGS_4(tr, TCG_CALL_NO_WG, void, env, i32, i64, i64)
> > +DEF_HELPER_4(trt, i32, env, i32, i64, i64)
> >  DEF_HELPER_4(cksm, i64, env, i64, i64, i64)
> >  DEF_HELPER_FLAGS_5(calc_cc, TCG_CALL_NO_RWG_SE, i32, env, i32, i64, i64, 
> > i64)
> >  DEF_HELPER_FLAGS_2(sfpc, TCG_CALL_NO_RWG, void, env, i64)
> > diff --git a/target-s390x/insn-data.def b/target-s390x/insn-data.def
> > index a12939d..e401754 100644
> > --- a/target-s390x/insn-data.def
> > +++ b/target-s390x/insn-data.def
> > @@ -759,6 +759,8 @@
> >  
> >  /* TRANSLATE */
> >  C(0xdc00, TR,  SS_a,  Z,   la1, a2, 0, 0, tr, 0)
> > +/* TRANSLATE AND TEST */
> > +C(0xdd00, TRT, SS_a,  Z,   la1, a2, 0, 0, trt, 0)
> >  
> >  /* UNPACK */
> >  /* Really format SS_b, but we pack both lengths into one argument
> > diff --git a/target-s390x/mem_helper.c b/target-s390x/mem_helper.c
> > index 0e8cd0f..e19e1aa 100644
> > --- a/target-s390x/mem_helper.c
> > +++ b/target-s390x/mem_helper.c
> > @@ -509,6 +509,9 @@ uint32_t HELPER(ex)(CPUS390XState *env, uint32_t cc, 
> > uint64_t v1,
> >  case 0xc00:
> >  helper_tr(env, l, get_address(env, 0, b1, d1),
> >get_address(env, 0, b2, d2));
> 
> Missing break here.

Good catch, I'll send a patch to fix that. Thanks.

Aurelien

-- 
Aurelien Jarno  GPG: 4096R/1DDD8C9B
aurel...@aurel32.net http://www.aurel32.net



Re: [Qemu-devel] [RFC] Cortex-M different revisions

2015-06-21 Thread Liviu Ionescu

> On 21 Jun 2015, at 17:09, Peter Maydell  wrote:
> 
> Non-buggy guest code should not care whether
> it is running on an r2p1 or an r2p0,

probably not, but code developed on an emulated r2 might very well break on a 
physical r0. 

> I think these should probably be cpu object properties, ...
> we get an accumulation
> of very similar CPUs, which we then don't actually emulate
> to a level of accuracy that would mean they make a difference
> to the guest.

I was considering to differentiate them only by cpu->midr, this should be easy.

later, when implementing accurate exception handling, I would need just to test 
the midr bits; I'm not sure it is worth to define properties for these things 
alone.

> Do you have real-world guest code that breaks?

yes, early M3 cores (for example the venerable STM32F1xx devices) have such 
issues that need to be addressed, usually at RTOS level, otherwise faults are 
raised.

I cannot confirm (because it was quite a while ago when I had to deal with 
these issues) that it is possible to write code that works an all versions 
without checking the actual version and acting differently.

my cortex-mcu object is now prepared for dealing with different versions, but 
for the moment I'll postpone extending the list of cpu's until really needed.


regards,

Liviu






[Qemu-devel] [PATCH] target-s390x: fix EXECUTE instruction executing TRT

2015-06-21 Thread Aurelien Jarno
A break is missing in the EXECUTE instruction, when executing the
TRANSLATE AND TEST instruction.

Reported-by: Paolo Bonzini 
Signed-off-by: Aurelien Jarno 
Cc: Alexander Graf 
Cc: Richard Henderson 
---
 target-s390x/mem_helper.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/target-s390x/mem_helper.c b/target-s390x/mem_helper.c
index 9f0eb1e..6f8bd79 100644
--- a/target-s390x/mem_helper.c
+++ b/target-s390x/mem_helper.c
@@ -482,6 +482,7 @@ uint32_t HELPER(ex)(CPUS390XState *env, uint32_t cc, 
uint64_t v1,
 case 0xc00:
 helper_tr(env, l, get_address(env, 0, b1, d1),
   get_address(env, 0, b2, d2));
+break;
 case 0xd00:
 cc = helper_trt(env, l, get_address(env, 0, b1, d1),
 get_address(env, 0, b2, d2));
-- 
2.1.4




Re: [Qemu-devel] [PATCH v5] i386: Introduce ARAT CPU feature

2015-06-21 Thread Jan Kiszka
On 2015-06-18 22:21, Eduardo Habkost wrote:
> On Sun, Jun 07, 2015 at 11:15:08AM +0200, Jan Kiszka wrote:
>> From: Jan Kiszka 
>>
>> ARAT signals that the APIC timer does not stop in power saving states.
>> As our APICs are emulated, it's fine to expose this feature to guests,
>> at least when asking for KVM host features or with CPU types that
>> include the flag. The exact model number that introduced the feature is
>> not known, but reports can be found that it's at least available since
>> Sandy Bridge.
>>
>> Signed-off-by: Jan Kiszka 
> 
> The code looks good now, but: what are the real consequences of
> enabling/disabling the flag? What exactly guests use it for?
> 
> Isn't this going to make guests have additional expectations about the
> APIC timer that may be broken when live-migrating or pausing the VM?

ARAT only refers to stopping of the timer in certain power states (which
we do not even emulate IIRC). In that case, the OS is under risk of
sleeping forever, thus need to look for a different wakeup source.
Live-migration or VM pausing are external effects on all timers of the
guest, not only the APIC. However, none of them cause a wakeup miss -
provided the host decides to resume the guest eventually.

Jan



signature.asc
Description: OpenPGP digital signature


Re: [Qemu-devel] [RFC] Cortex-M different revisions

2015-06-21 Thread Peter Maydell
On 21 June 2015 at 15:42, Liviu Ionescu  wrote:
>
>> On 21 Jun 2015, at 17:09, Peter Maydell  wrote:
>>
>> Non-buggy guest code should not care whether
>> it is running on an r2p1 or an r2p0,
>
> probably not, but code developed on an emulated r2 might
> very well break on a physical r0.

There's lots of code that will run on QEMU but break on
real hardware. Emulation is not a substitute for testing
on the real thing.

> I was considering to differentiate them only by cpu->midr, this should be 
> easy.
>
> later, when implementing accurate exception handling, I would need
> just to test the midr bits; I'm not sure it is worth to define
> properties for these things alone.

If you want to emulate them then please use properties. Tagging
things off the MIDR is not something we do for any other
CPU property.

>> Do you have real-world guest code that breaks?
>
> yes, early M3 cores (for example the venerable STM32F1xx devices)
> have such issues that need to be addressed, usually at RTOS level,
> otherwise faults are raised.
>
> I cannot confirm (because it was quite a while ago when I had to
> deal with these issues) that it is possible to write code that works
> an all versions without checking the actual version and acting
> differently.

It should be -- just write to the architecture's specifications,
not to the variations between specific revisions.

-- PMM



Re: [Qemu-devel] [RFC] Cortex-M different revisions

2015-06-21 Thread Liviu Ionescu

> On 21 Jun 2015, at 23:58, Peter Maydell  wrote:
> 
> There's lots of code that will run on QEMU but break on
> real hardware.

no doubt about it.

however, this shouldn't be the rule, if the efforts are reasonable, I see no 
reasons for not improving the emulation quality and make code that breaks on 
real hardware break on qemu too.

>> I cannot confirm (because it was quite a while ago when I had to
>> deal with these issues) that it is possible to write code that works
>> an all versions without checking the actual version and acting
>> differently.
> 
> It should be -- just write to the architecture's specifications,
> not to the variations between specific revisions.

I'll investigate when these details will become relevant, probably when my 
branch will be ready for running some RTOS tests. 

regards,

Liviu




[Qemu-devel] [PATCH 0/2] m68k: 680x0 processors family support

2015-06-21 Thread Laurent Vivier
I carry this series for several years now.

I was reluctant to merge it with the mainstream because
I was sure it was breaking Coldfire support.

But with the kernel provided by Greg Ungerer I was able
to check and correct the support of ColdFire family
in my tree.

This series allows:
- to start a ColdFire semi-hosted kernel (m68k-softmmu)
- chroot or start a container of debian etch-m68k (m68k-linux-user)

I have another series providing privileged instructions and
allowing to boot a 680x0 debian kernel (Macintosh Quadra 800),
but this one needs more work (and love). Based on this work,
we will also be able to boot a NextStation (Bryce Lanham, GSoC)

This work is based on the work of Andreas Schwab.

Laurent Vivier (2):
  m68k: Add compatibility with 680x0 processors family
  m68k: Implement 680x0 processors family 96 bit FPU

 configure  |2 +-
 cpu-exec.c |6 -
 disas.c|4 +
 fpu/softfloat-specialize.h |   48 +-
 fpu/softfloat.c|   38 +-
 gdb-xml/m68k-fp.xml|   21 +
 include/fpu/softfloat.h|   11 +-
 target-m68k/cpu.c  |   67 +-
 target-m68k/cpu.h  |   76 +-
 target-m68k/helper.c   | 1691 ++--
 target-m68k/helper.h   |  100 +-
 target-m68k/m68k-qreg.h|   11 -
 target-m68k/op_helper.c|  182 ++-
 target-m68k/qregs.def  |6 +-
 target-m68k/translate.c| 3682 +++-
 15 files changed, 5013 insertions(+), 932 deletions(-)
 create mode 100644 gdb-xml/m68k-fp.xml
 delete mode 100644 target-m68k/m68k-qreg.h

-- 
2.4.3




[Qemu-devel] [PATCH 2/2] m68k: Implement 680x0 processors family 96 bit FPU

2015-06-21 Thread Laurent Vivier
Signed-off-by: Laurent Vivier 
---
 configure  |   2 +-
 fpu/softfloat-specialize.h |  48 ++-
 fpu/softfloat.c|  38 +-
 gdb-xml/m68k-fp.xml|  21 +
 include/fpu/softfloat.h|  11 +-
 target-m68k/cpu.c  |   9 +
 target-m68k/cpu.h  |  38 +-
 target-m68k/helper.c   | 868 +-
 target-m68k/helper.h   |  44 +++
 target-m68k/qregs.def  |   5 +-
 target-m68k/translate.c| 930 -
 11 files changed, 1967 insertions(+), 47 deletions(-)
 create mode 100644 gdb-xml/m68k-fp.xml

diff --git a/configure b/configure
index 4a66b2e..a282979 100755
--- a/configure
+++ b/configure
@@ -5211,7 +5211,7 @@ case "$target_name" in
   ;;
   m68k)
 bflt="yes"
-gdb_xml_files="cf-core.xml cf-fp.xml"
+gdb_xml_files="cf-core.xml cf-fp.xml m68k-fp.xml"
   ;;
   microblaze|microblazeel)
 TARGET_ARCH=microblaze
diff --git a/fpu/softfloat-specialize.h b/fpu/softfloat-specialize.h
index 6dd41d8..1f8d5ea 100644
--- a/fpu/softfloat-specialize.h
+++ b/fpu/softfloat-specialize.h
@@ -113,7 +113,7 @@ const float16 float16_default_nan = const_float16(0xFE00);
 #if defined(TARGET_SPARC)
 const float32 float32_default_nan = const_float32(0x7FFF);
 #elif defined(TARGET_PPC) || defined(TARGET_ARM) || defined(TARGET_ALPHA) || \
-  defined(TARGET_XTENSA) || defined(TARGET_S390X)
+  defined(TARGET_XTENSA) || defined(TARGET_S390X) || defined(TARGET_M68K)
 const float32 float32_default_nan = const_float32(0x7FC0);
 #elif SNAN_BIT_IS_ONE
 const float32 float32_default_nan = const_float32(0x7FBF);
@@ -127,7 +127,7 @@ const float32 float32_default_nan = 
const_float32(0xFFC0);
 #if defined(TARGET_SPARC)
 const float64 float64_default_nan = const_float64(LIT64( 0x7FFF ));
 #elif defined(TARGET_PPC) || defined(TARGET_ARM) || defined(TARGET_ALPHA) || \
-  defined(TARGET_S390X)
+  defined(TARGET_S390X) || defined(TARGET_M68K)
 const float64 float64_default_nan = const_float64(LIT64( 0x7FF8 ));
 #elif SNAN_BIT_IS_ONE
 const float64 float64_default_nan = const_float64(LIT64(0x7FF7));
@@ -138,7 +138,10 @@ const float64 float64_default_nan = const_float64(LIT64( 
0xFFF8 ));
 /*
 | The pattern for a default generated extended double-precision NaN.
 **/
-#if SNAN_BIT_IS_ONE
+#if defined(TARGET_M68K)
+#define floatx80_default_nan_high 0x7FFF
+#define floatx80_default_nan_low  LIT64(0x4000)
+#elif SNAN_BIT_IS_ONE
 #define floatx80_default_nan_high 0x7FFF
 #define floatx80_default_nan_low  LIT64(0xBFFF)
 #else
@@ -150,6 +153,21 @@ const floatx80 floatx80_default_nan
 = make_floatx80_init(floatx80_default_nan_high, floatx80_default_nan_low);
 
 /*
+| The pattern for a default generated extended double-precision inf.
+**/
+
+#if defined(TARGET_M68K)
+#define floatx80_default_inf_high 0x7FFF
+#define floatx80_default_inf_low  LIT64(0x)
+#else
+#define floatx80_default_inf_high 0x7FFF
+#define floatx80_default_inf_low  LIT64(0x8000)
+#endif
+
+const floatx80 floatx80_default_inf
+= make_floatx80_init(floatx80_default_inf_high, floatx80_default_inf_low);
+
+/*
 | The pattern for a default generated quadruple-precision NaN.  The `high' and
 | `low' values hold the most- and least-significant bits, respectively.
 **/
@@ -475,6 +493,26 @@ static int pickNaN(flag aIsQNaN, flag aIsSNaN, flag 
bIsQNaN, flag bIsSNaN,
 return 1;
 }
 }
+#elif defined(TARGET_M68K)
+static int pickNaN(flag aIsQNaN, flag aIsSNaN, flag bIsQNaN, flag bIsSNaN,
+   flag aIsLargerSignificand)
+{
+/* If either operand, but not both operands, of an operation is a
+ * nonsignaling NAN, then that NAN is returned as the result. If both
+ * operands are nonsignaling NANs, then the destination operand
+ * nonsignaling NAN is returned as the result.
+ */
+
+if (aIsSNaN) {
+return 0;
+} else if (bIsSNaN) {
+return 1;
+} else if (bIsQNaN) {
+return 1;
+} else {
+return 0;
+}
+}
 #else
 static int pickNaN(flag aIsQNaN, flag aIsSNaN, flag bIsQNaN, flag bIsSNaN,
 flag aIsLargerSignificand)
@@ -974,7 +1012,9 @@ int floatx80_is_signaling_nan( floatx80 a )
 floatx80 floatx80_maybe_silence_nan( floatx80 a )
 {
 if (floatx80_is_signaling_nan(a)) {
-#if SNAN_BIT_IS_ONE
+#if defined(TARGET_M68K)
+a.low |= LIT64(0x4000);
+#elif SNAN_BIT_IS_ONE

[Qemu-devel] [PATCH 1/2] m68k: Add compatibility with 680x0 processors family

2015-06-21 Thread Laurent Vivier
This patch adds all non-privileged instructions of the 680x0 family.
The FPU is not modified and we always use the ColdFire FPU emulation,
so some 680x0 FPU instructions are missing.

Signed-off-by: Laurent Vivier 
---
 cpu-exec.c  |6 -
 disas.c |4 +
 target-m68k/cpu.c   |   58 +-
 target-m68k/cpu.h   |   38 +-
 target-m68k/helper.c|  823 +
 target-m68k/helper.h|   56 +-
 target-m68k/m68k-qreg.h |   11 -
 target-m68k/op_helper.c |  182 +++-
 target-m68k/qregs.def   |1 +
 target-m68k/translate.c | 2332 +--
 10 files changed, 2836 insertions(+), 675 deletions(-)
 delete mode 100644 target-m68k/m68k-qreg.h

diff --git a/cpu-exec.c b/cpu-exec.c
index 2ffeb6e..e6c512e 100644
--- a/cpu-exec.c
+++ b/cpu-exec.c
@@ -183,12 +183,6 @@ static inline tcg_target_ulong cpu_tb_exec(CPUState *cpu, 
uint8_t *tb_ptr)
 if (qemu_loglevel_mask(CPU_LOG_TB_CPU)) {
 #if defined(TARGET_I386)
 log_cpu_state(cpu, CPU_DUMP_CCOP);
-#elif defined(TARGET_M68K)
-/* ??? Should not modify env state for dumping.  */
-cpu_m68k_flush_flags(env, env->cc_op);
-env->cc_op = CC_OP_FLAGS;
-env->sr = (env->sr & 0xffe0) | env->cc_dest | (env->cc_x << 4);
-log_cpu_state(cpu, 0);
 #else
 log_cpu_state(cpu, 0);
 #endif
diff --git a/disas.c b/disas.c
index 44a019a..cee0b3a 100644
--- a/disas.c
+++ b/disas.c
@@ -193,6 +193,7 @@ static int print_insn_od_target(bfd_vma pc, 
disassemble_info *info)
 arm  - bit 0 = thumb, bit 1 = reverse endian, bit 2 = A64
 ppc  - bits 0:15 specify (optionally) the machine instruction set;
bit 16 indicates little endian.
+m68k - 1 means 680x0 family, otherwise coldfire
 other targets - unused
  */
 void target_disas(FILE *out, CPUArchState *env, target_ulong code,
@@ -269,6 +270,9 @@ void target_disas(FILE *out, CPUArchState *env, 
target_ulong code,
 print_insn = print_insn_ppc;
 #elif defined(TARGET_M68K)
 print_insn = print_insn_m68k;
+if (flags) {
+s.info.mach = bfd_mach_m68040;
+}
 #elif defined(TARGET_MIPS)
 #ifdef TARGET_WORDS_BIGENDIAN
 print_insn = print_insn_big_mips;
diff --git a/target-m68k/cpu.c b/target-m68k/cpu.c
index 4cfb725..4c6760b 100644
--- a/target-m68k/cpu.c
+++ b/target-m68k/cpu.c
@@ -54,7 +54,7 @@ static void m68k_cpu_reset(CPUState *s)
 env->sr = 0x2700;
 #endif
 m68k_switch_sp(env);
-/* ??? FP regs should be initialized to NaN.  */
+
 env->cc_op = CC_OP_FLAGS;
 /* TODO: We should set PC from the interrupt vector.  */
 env->pc = 0;
@@ -90,6 +90,55 @@ static void m5206_cpu_initfn(Object *obj)
 m68k_set_feature(env, M68K_FEATURE_CF_ISA_A);
 }
 
+static void m68000_cpu_initfn(Object *obj)
+{
+M68kCPU *cpu = M68K_CPU(obj);
+CPUM68KState *env = &cpu->env;
+
+m68k_set_feature(env, M68K_FEATURE_M68000);
+m68k_set_feature(env, M68K_FEATURE_USP);
+m68k_set_feature(env, M68K_FEATURE_WORD_INDEX);
+}
+
+static void m68020_cpu_initfn(Object *obj)
+{
+M68kCPU *cpu = M68K_CPU(obj);
+CPUM68KState *env = &cpu->env;
+
+m68k_set_feature(env, M68K_FEATURE_M68000);
+m68k_set_feature(env, M68K_FEATURE_USP);
+m68k_set_feature(env, M68K_FEATURE_WORD_INDEX);
+m68k_set_feature(env, M68K_FEATURE_QUAD_MULDIV);
+m68k_set_feature(env, M68K_FEATURE_BRAL);
+m68k_set_feature(env, M68K_FEATURE_BCCL);
+m68k_set_feature(env, M68K_FEATURE_BITFIELD);
+m68k_set_feature(env, M68K_FEATURE_EXT_FULL);
+m68k_set_feature(env, M68K_FEATURE_SCALED_INDEX);
+m68k_set_feature(env, M68K_FEATURE_LONG_MULDIV);
+m68k_set_feature(env, M68K_FEATURE_FPU);
+m68k_set_feature(env, M68K_FEATURE_CAS);
+}
+#define m68030_cpu_initfn m68020_cpu_initfn
+#define m68040_cpu_initfn m68020_cpu_initfn
+
+static void m68060_cpu_initfn(Object *obj)
+{
+M68kCPU *cpu = M68K_CPU(obj);
+CPUM68KState *env = &cpu->env;
+
+m68k_set_feature(env, M68K_FEATURE_M68000);
+m68k_set_feature(env, M68K_FEATURE_USP);
+m68k_set_feature(env, M68K_FEATURE_WORD_INDEX);
+m68k_set_feature(env, M68K_FEATURE_BRAL);
+m68k_set_feature(env, M68K_FEATURE_BCCL);
+m68k_set_feature(env, M68K_FEATURE_BITFIELD);
+m68k_set_feature(env, M68K_FEATURE_EXT_FULL);
+m68k_set_feature(env, M68K_FEATURE_SCALED_INDEX);
+m68k_set_feature(env, M68K_FEATURE_LONG_MULDIV);
+m68k_set_feature(env, M68K_FEATURE_FPU);
+m68k_set_feature(env, M68K_FEATURE_CAS);
+}
+
 static void m5208_cpu_initfn(Object *obj)
 {
 M68kCPU *cpu = M68K_CPU(obj);
@@ -140,6 +189,11 @@ typedef struct M68kCPUInfo {
 } M68kCPUInfo;
 
 static const M68kCPUInfo m68k_cpus[] = {
+{ .name = "m68000", .instance_init = m68000_cpu_initfn },
+{ .name = "m68020", .instance_init = m68020_cpu_initfn },
+{ .name = "m68030", .instance_init = m68030_cpu_initfn },
+{ .name = "m68040", .instance_init = m68040_cpu_initfn },
+{ .name = "m68060", .instance_init = m68

Re: [Qemu-devel] [PATCH v2 3/3] m68k: fix usp processing on interrupt entry and exception exit

2015-06-21 Thread Greg Ungerer
Hi Laurent,

On 20/06/15 05:35, Laurent Vivier wrote:
> Le 19/06/2015 15:43, g...@uclinux.org a écrit :
>> From: Greg Ungerer 
>>
>> The action to potentially switch sp register is not occurring at the correct
>> point in the interrupt entry or exception exit sequences.
>>
>> For the interrupt entry case the sp on entry is used to create the stack
>> exception frame - but this may well be the user stack pointer, since we
>> haven't done the switch yet. Re-order the flow to switch the sp regs then
>> use the current sp to create the exception frame.
>>
>> For the return from exception case the code is unwinding the sp after
>> switching sp registers. But it should always unwind the supervisor sp
>> first, then carry out any required sp switch.
>>
>> Note that these problems don't effect operation unless the user sp bit is
>> set in the CACR register. Only a single sp is used in the default power up
>> state. Previously Linux only used this single sp mode. But modern versions
>> of Linux use the user sp mode now, so we need correct behavior for Linux
>> to work.
>>
>> Signed-off-by: Greg Ungerer 
>> Reviewed-by: Peter Crosthwaite 
>> ---
>>  target-m68k/op_helper.c | 7 +++
>>  1 file changed, 3 insertions(+), 4 deletions(-)
> 
> Reviewed-by: Laurent Vivier 

Thanks for the reviews.

Regards
Greg






[Qemu-devel] [PATCH v4 2/3] target-i386: reserve RCRB mmio space in ACPI DSDT table

2015-06-21 Thread Paulo Alcantara
This block is mapped into memory space, using the Root Complex Base
Address (RCBA) register of the PCI-to-LPC bridge. Accesses in this space
must be limited to 32-(DW) bit quantities. Burst accesses are not
allowed.

All Chipset Configuration Registers are located in this 16KiB space.

Signed-off-by: Paulo Alcantara 
---
v1 -> v2:
  * s/PDRC/CCR/ for clarity and match ICH9 spec
  * remove unnecessary OperationRegion for RCRB

v2 -> v3: (no changes)

v3 -> v4:
  * quote RCRB description from ICH9 spec to commit log
  * fix indentation issue in _CRS() method declaration
  * create hw/i386/ich9-cc.h for chipset configuration register values
and use them in ASL
---
 hw/i386/q35-acpi-dsdt.dsl |  16 
 include/hw/i386/ich9-cc.h |  31 +++
 tests/acpi-test-data/q35/DSDT | Bin 7666 -> 7723 bytes
 3 files changed, 47 insertions(+)
 create mode 100644 include/hw/i386/ich9-cc.h

diff --git a/hw/i386/q35-acpi-dsdt.dsl b/hw/i386/q35-acpi-dsdt.dsl
index 16eaca3..512c220 100644
--- a/hw/i386/q35-acpi-dsdt.dsl
+++ b/hw/i386/q35-acpi-dsdt.dsl
@@ -114,6 +114,22 @@ DefinitionBlock (
 }
 }
 
+#include "hw/i386/ich9-cc.h"
+
+/
+ * Chipset Configuration Registers
+ /
+Scope(\_SB.PCI0) {
+Device (CCR) {
+Name (_HID, EISAID("PNP0C02"))
+Name (_UID, 1)
+
+Name (_CRS, ResourceTemplate() {
+Memory32Fixed(ReadWrite, RCBA_BASE_ADDR, RCRB_SIZE)
+})
+}
+}
+
 #include "acpi-dsdt-hpet.dsl"
 
 
diff --git a/include/hw/i386/ich9-cc.h b/include/hw/i386/ich9-cc.h
new file mode 100644
index 000..675fb7f
--- /dev/null
+++ b/include/hw/i386/ich9-cc.h
@@ -0,0 +1,31 @@
+/*
+ * QEMU ICH9 Chipset Configuration Registers
+ *
+ * Copyright (c) 2015 Paulo Alcantara 
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to 
deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING 
FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+#ifndef HW_ICH9_CC_H
+#define HW_ICH9_CC_H
+
+#define RCBA_BASE_ADDR0xfed1c000
+#define RCRB_SIZE 0x4000
+
+#endif /* HW_ICH9_CC_H */
diff --git a/tests/acpi-test-data/q35/DSDT b/tests/acpi-test-data/q35/DSDT
index 
4723e5954dccb00995ccaf521b7daf6bf15cf1d4..f3bda7b54ea6d669b1498d9380e7781207fb6e49
 100644
GIT binary patch
delta 81
zcmexlz1oJ$CDxbTJfnq$UVN}qe1Nm3L3ERjvvW{9N4$rp3y|j(F#wU_n7HzBWz

[Qemu-devel] [PATCH v4 1/3] ich9: add TCO interface emulation

2015-06-21 Thread Paulo Alcantara
This interface provides some registers within a 32-byte range and can be
acessed through PCI-to-LPC bridge interface (PMBASE + 0x60).

It's commonly used as a watchdog timer to detect system lockups through
SMIs that are generated -- if TCO_EN bit is set -- on every timeout. If
NO_REBOOT bit is not set in GCS (General Control and Status register),
the system will be resetted upon second timeout if TCO_RLD register
wasn't previously written to prevent timeout.

This patch adds support to TCO watchdog logic and few other features
like mapping NMIs to SMIs (NMI2SMI_EN bit), system intruder detection,
etc. are not implemented yet.

Signed-off-by: Paulo Alcantara 
---
v1 -> v2:
  * add migration support for TCO I/O device state
  * wake up only when total time expired instead of every 0.6s
  * some cleanup suggested by Paolo Bonzini

v2 -> v3:
  * set SECOND_TO_STS and BOOT_STS bits in TCO2_STS instead
  * improve handling of TCO_LOCK bit in TCO1_CNT register

v3 -> v4:
  * fix some conflicts in hw/acpi/ich9.c after rebasing against master
  * remove meaningless "use_tco" field from TCOIORegs structure
  * add a object property named "enable_tco" and only enable TCO support
on pc-q35-2.4 and later
---
 hw/acpi/Makefile.objs  |   2 +-
 hw/acpi/ich9.c |  55 +-
 hw/acpi/tco.c  | 279 +
 hw/i386/pc_q35.c   |   4 +-
 hw/isa/lpc_ich9.c  |  15 ++-
 include/hw/acpi/ich9.h |   7 +-
 include/hw/acpi/tco.h  |  98 +
 include/hw/boards.h|   3 +-
 include/hw/i386/ich9.h |  10 +-
 include/hw/i386/pc.h   |   1 +
 10 files changed, 466 insertions(+), 8 deletions(-)
 create mode 100644 hw/acpi/tco.c
 create mode 100644 include/hw/acpi/tco.h

diff --git a/hw/acpi/Makefile.objs b/hw/acpi/Makefile.objs
index 29d46d8..3db1f07 100644
--- a/hw/acpi/Makefile.objs
+++ b/hw/acpi/Makefile.objs
@@ -1,4 +1,4 @@
-common-obj-$(CONFIG_ACPI_X86) += core.o piix4.o ich9.o pcihp.o
+common-obj-$(CONFIG_ACPI_X86) += core.o piix4.o ich9.o pcihp.o tco.o
 common-obj-$(CONFIG_ACPI_CPU_HOTPLUG) += cpu_hotplug.o
 common-obj-$(CONFIG_ACPI_MEMORY_HOTPLUG) += memory_hotplug.o
 common-obj-$(CONFIG_ACPI) += acpi_interface.o
diff --git a/hw/acpi/ich9.c b/hw/acpi/ich9.c
index 8a64ffb..d3d9953 100644
--- a/hw/acpi/ich9.c
+++ b/hw/acpi/ich9.c
@@ -30,6 +30,7 @@
 #include "qemu/timer.h"
 #include "sysemu/sysemu.h"
 #include "hw/acpi/acpi.h"
+#include "hw/acpi/tco.h"
 #include "sysemu/kvm.h"
 #include "exec/address-spaces.h"
 
@@ -92,8 +93,16 @@ static void ich9_smi_writel(void *opaque, hwaddr addr, 
uint64_t val,
 unsigned width)
 {
 ICH9LPCPMRegs *pm = opaque;
+TCOIORegs *tr = &pm->tco_regs;
+uint64_t tco_en;
+
 switch (addr) {
 case 0:
+tco_en = pm->smi_en & ICH9_PMIO_SMI_EN_TCO_EN;
+/* once TCO_LOCK bit is set, TCO_EN bit cannot be overwritten */
+if (tr->tco.cnt1 & TCO_LOCK) {
+val = (val & ~ICH9_PMIO_SMI_EN_TCO_EN) | tco_en;
+}
 pm->smi_en &= ~pm->smi_en_wmask;
 pm->smi_en |= (val & pm->smi_en_wmask);
 break;
@@ -159,6 +168,25 @@ static const VMStateDescription vmstate_memhp_state = {
 }
 };
 
+static bool vmstate_test_use_tco(void *opaque)
+{
+ICH9LPCPMRegs *s = opaque;
+return s->enable_tco;
+}
+
+static const VMStateDescription vmstate_tco_io_state = {
+.name = "ich9_pm/tco",
+.version_id = 1,
+.minimum_version_id = 1,
+.minimum_version_id_old = 1,
+.needed = vmstate_test_use_tco,
+.fields  = (VMStateField[]) {
+VMSTATE_STRUCT(tco_regs, ICH9LPCPMRegs, 1, vmstate_tco_io_sts,
+   TCOIORegs),
+VMSTATE_END_OF_LIST()
+}
+};
+
 const VMStateDescription vmstate_ich9_pm = {
 .name = "ich9_pm",
 .version_id = 1,
@@ -179,6 +207,10 @@ const VMStateDescription vmstate_ich9_pm = {
 .subsections = (const VMStateDescription*[]) {
 &vmstate_memhp_state,
 NULL
+},
+.subsections = (const VMStateDescription*[]) {
+&vmstate_tco_io_state,
+NULL
 }
 };
 
@@ -209,7 +241,7 @@ static void pm_powerdown_req(Notifier *n, void *opaque)
 acpi_pm1_evt_power_down(&pm->acpi_regs);
 }
 
-void ich9_pm_init(PCIDevice *lpc_pci, ICH9LPCPMRegs *pm,
+void ich9_pm_init(PCIDevice *lpc_pci, ICH9LPCPMRegs *pm, bool enable_tco,
   qemu_irq sci_irq)
 {
 memory_region_init(&pm->io, OBJECT(lpc_pci), "ich9-pm", ICH9_PMIO_SIZE);
@@ -231,6 +263,11 @@ void ich9_pm_init(PCIDevice *lpc_pci, ICH9LPCPMRegs *pm,
   "acpi-smi", 8);
 memory_region_add_subregion(&pm->io, ICH9_PMIO_SMI_EN, &pm->io_smi);
 
+pm->enable_tco = enable_tco;
+if (pm->enable_tco) {
+acpi_pm_tco_init(&pm->tco_regs, &pm->io);
+}
+
 pm->irq = sci_irq;
 qemu_register_reset(pm_reset, pm);
 pm->powerdown_notifier.notify = pm_powerdown_req;
@@ -351,6 +388,18 @@ out:
 error_propagate(errp, local_err);
 }
 
+static b

[Qemu-devel] [PATCH v4 3/3] tests: add testcase for TCO watchdog emulation

2015-06-21 Thread Paulo Alcantara
This patch adds a testcase that covers the following:
  1) TCO default values
  2) first and second TCO timeout
  3) watch and validate ticks counter through TCO_RLD register
  4) maximum supported TCO timeout (0x3ff)
  5) watchdog actions (pause/reset/shutdown/none) upon second TCO
 timeout
  6) set and get of TCO control and status bits

Signed-off-by: Paulo Alcantara 
---
v1 -> v2:
  * some cleanup
  * add test for TCO_LOCK bit

v2 -> v3:
  * add tests for TCO control & status bits
  * fix check of SECOND_TO_STS bit (it's set in TCO2_STS reg)

v3 -> v4:
  * add more description to commit log
  * use RCBA_BASE_ADDR macro defintion from hw/i386/ich9-cc.h instead
---
 tests/Makefile   |   2 +
 tests/tco-test.c | 475 +++
 2 files changed, 477 insertions(+)
 create mode 100644 tests/tco-test.c

diff --git a/tests/Makefile b/tests/Makefile
index 4de40de..2b26ae7 100644
--- a/tests/Makefile
+++ b/tests/Makefile
@@ -150,6 +150,7 @@ check-qtest-i386-y += tests/i440fx-test$(EXESUF)
 check-qtest-i386-y += tests/fw_cfg-test$(EXESUF)
 check-qtest-i386-y += tests/drive_del-test$(EXESUF)
 check-qtest-i386-y += tests/wdt_ib700-test$(EXESUF)
+check-qtest-i386-y += tests/tco-test$(EXESUF)
 gcov-files-i386-y += hw/watchdog/watchdog.c hw/watchdog/wdt_ib700.c
 check-qtest-i386-y += $(check-qtest-pci-y)
 gcov-files-i386-y += $(gcov-files-pci-y)
@@ -367,6 +368,7 @@ tests/eepro100-test$(EXESUF): tests/eepro100-test.o
 tests/vmxnet3-test$(EXESUF): tests/vmxnet3-test.o
 tests/ne2000-test$(EXESUF): tests/ne2000-test.o
 tests/wdt_ib700-test$(EXESUF): tests/wdt_ib700-test.o
+tests/tco-test$(EXESUF): tests/tco-test.o $(libqos-pc-obj-y)
 tests/virtio-balloon-test$(EXESUF): tests/virtio-balloon-test.o
 tests/virtio-blk-test$(EXESUF): tests/virtio-blk-test.o $(libqos-virtio-obj-y)
 tests/virtio-net-test$(EXESUF): tests/virtio-net-test.o $(libqos-pc-obj-y)
diff --git a/tests/tco-test.c b/tests/tco-test.c
new file mode 100644
index 000..e48dfe2
--- /dev/null
+++ b/tests/tco-test.c
@@ -0,0 +1,475 @@
+/*
+ * QEMU ICH9 TCO emulation tests
+ *
+ * Copyright (c) 2015 Paulo Alcantara 
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to 
deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING 
FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+#include 
+#include 
+#include 
+#include 
+
+#include "libqtest.h"
+#include "libqos/pci.h"
+#include "libqos/pci-pc.h"
+#include "hw/pci/pci_regs.h"
+#include "hw/i386/ich9.h"
+#include "hw/i386/ich9-cc.h"
+#include "hw/acpi/ich9.h"
+#include "hw/acpi/tco.h"
+
+#define PM_IO_BASE_ADDR 0xb000
+
+enum {
+TCO_RLD_DEFAULT = 0x,
+TCO_DAT_IN_DEFAULT  = 0x00,
+TCO_DAT_OUT_DEFAULT = 0x00,
+TCO1_STS_DEFAULT= 0x,
+TCO2_STS_DEFAULT= 0x,
+TCO1_CNT_DEFAULT= 0x,
+TCO2_CNT_DEFAULT= 0x0008,
+TCO_MESSAGE1_DEFAULT= 0x00,
+TCO_MESSAGE2_DEFAULT= 0x00,
+TCO_WDCNT_DEFAULT   = 0x00,
+TCO_TMR_DEFAULT = 0x0004,
+SW_IRQ_GEN_DEFAULT  = 0x03,
+};
+
+#define TCO_SECS_TO_TICKS(secs) (((secs) * 10) / 6)
+#define TCO_TICKS_TO_SECS(ticks)(((ticks) * 6) / 10)
+
+typedef struct {
+const char *args;
+QPCIDevice *dev;
+void *lpc_base;
+void *tco_io_base;
+} TestData;
+
+static void test_init(TestData *d)
+{
+QPCIBus *bus;
+QTestState *qs;
+char *s;
+
+s = g_strdup_printf("-machine q35 %s", !d->args ? "" : d->args);
+qs = qtest_start(s);
+qtest_irq_intercept_in(qs, "ioapic");
+g_free(s);
+
+bus = qpci_init_pc();
+d->dev = qpci_device_find(bus, QPCI_DEVFN(0x1f, 0x00));
+g_assert(d->dev != NULL);
+
+/* map PCI-to-LPC bridge interface BAR */
+d->lpc_base = qpci_iomap(d->dev, 0, NULL);
+
+qpci_device_enable(d->dev);
+
+g_assert(d->lpc_base != NULL);
+
+/* set ACPI PM I/O space base address */
+qpci_config_writel(d->dev, (uintptr_t)d->lpc_base + ICH9_LPC_PMBASE,
+   PM_IO_BASE_ADDR | 0x1);
+/* enable ACPI I/O */
+qpci

Re: [Qemu-devel] [PATCH qemu v7 13/14] spapr_pci/spapr_pci_vfio: Support Dynamic DMA Windows (DDW)

2015-06-21 Thread David Gibson
On Fri, Jun 19, 2015 at 08:49:00AM +0200, Markus Armbruster wrote:
> David Gibson  writes:
> 
> > On Thu, Jun 18, 2015 at 09:35:44PM +1000, Alexey Kardashevskiy wrote:
> >> On 05/05/2015 10:49 PM, David Gibson wrote:
> >> >On Sat, Apr 25, 2015 at 10:24:43PM +1000, Alexey Kardashevskiy wrote:
> >> >>This adds support for Dynamic DMA Windows (DDW) option defined by
> >> >>the SPAPR specification which allows to have additional DMA window(s)
> >> >>
> >> >>This implements DDW for emulated and VFIO devices. As all TCE root 
> >> >>regions
> >> >>are mapped at 0 and 64bit long (and actual tables are child regions),
> >> >>this replaces memory_region_add_subregion() with _overlap() to make
> >> >>QEMU memory API happy.
> >> >>
> >> >>This reserves RTAS token numbers for DDW calls.
> >> >>
> >> >>This implements helpers to interact with VFIO kernel interface.
> >> >>
> >> >>This changes the TCE table migration descriptor to support dynamic
> >> >>tables as from now on, PHB will create as many stub TCE table objects
> >> >>as PHB can possibly support but not all of them might be initialized at
> >> >>the time of migration because DDW might or might not be requested by
> >> >>the guest.
> >> >>
> >> >>The "ddw" property is enabled by default on a PHB but for compatibility
> >> >>the pseries-2.3 machine and older disable it.
> >> >>
> >> >>This implements DDW for VFIO. The host kernel support is required.
> >> >>This adds a "levels" property to PHB to control the number of levels
> >> >>in the actual TCE table allocated by the host kernel, 0 is the default
> >> >>value to tell QEMU to calculate the correct value. Current hardware
> >> >>supports up to 5 levels.
> >> >>
> >> >>The existing linux guests try creating one additional huge DMA window
> >> >>with 64K or 16MB pages and map the entire guest RAM to. If succeeded,
> >> >>the guest switches to dma_direct_ops and never calls TCE hypercalls
> >> >>(H_PUT_TCE,...) again. This enables VFIO devices to use the entire RAM
> >> >>and not waste time on map/unmap later.
> >> >>
> >> >>This adds 4 RTAS handlers:
> >> >>* ibm,query-pe-dma-window
> >> >>* ibm,create-pe-dma-window
> >> >>* ibm,remove-pe-dma-window
> >> >>* ibm,reset-pe-dma-window
> >> >>These are registered from type_init() callback.
> >> >>
> >> >>These RTAS handlers are implemented in a separate file to avoid polluting
> >> >>spapr_iommu.c with PCI.
> >> >>
> >> >>Signed-off-by: Alexey Kardashevskiy 
> >> >
> >> >Reviewed-by: David Gibson 
> >> 
> >> I saw this and decided there are no more coments but I was wrong :)
> >
> > Right.  Note that if I add a Reviewed-by but also make comments, then
> > those comments are seeking clarification and maybe suggesting later
> > cleanups, but I think the problems are small enough that the patch is
> > still ready to go as it is.
> 
> You can help the recipient of your comments by putting your R-by behind
> the last comment.

Noted for future reference.

> Wouldn't be necessary if people never left reams of quoted material
> at the end of their replies, but that's a pipe dream :)

I do usually try to trim quoted material - looks like I forgot this
time though.

-- 
David Gibson| I'll have my music baroque, and my code
david AT gibson.dropbear.id.au  | minimalist, thank you.  NOT _the_ _other_
| _way_ _around_!
http://www.ozlabs.org/~dgibson


pgpGDWmuHHDqH.pgp
Description: PGP signature


Re: [Qemu-devel] [PATCH v2 3/4] numa: Store boot memory address range in node_info

2015-06-21 Thread David Gibson
On Fri, Jun 19, 2015 at 10:40:23AM +0530, Bharata B Rao wrote:
> Store memory address range information of boot memory  in address
> range list of numa_info.
> 
> This helps to have a common NUMA node lookup by address function that
> works for both boot time memory and hotplugged memory.
> 
> Signed-off-by: Bharata B Rao 

Reviewed-by: David Gibson 

-- 
David Gibson| I'll have my music baroque, and my code
david AT gibson.dropbear.id.au  | minimalist, thank you.  NOT _the_ _other_
| _way_ _around_!
http://www.ozlabs.org/~dgibson


pgpludZpYD4pU.pgp
Description: PGP signature


Re: [Qemu-devel] [PATCH v8 0/3] spapr_pci: PCI DT node creation in QEMU

2015-06-21 Thread David Gibson
On Thu, Jun 18, 2015 at 04:50:26PM +0530, Nikunj A Dadhania wrote:
> The patch series creates PCI device tree(DT) nodes in QEMU. The new
> hotplug code needs the device node creation in QEMU. While during
> boot, nodes were created in SLOF. It makes more sense to consolidate
> the code to one place for better maintainability.
> 
> New slof.bin is already there in spapr-next

Merged into spapr-next, thanks.

-- 
David Gibson| I'll have my music baroque, and my code
david AT gibson.dropbear.id.au  | minimalist, thank you.  NOT _the_ _other_
| _way_ _around_!
http://www.ozlabs.org/~dgibson


pgp7zAJ9GZU3J.pgp
Description: PGP signature


Re: [Qemu-devel] [PATCH qemu v8 06/14] spapr_iommu: Introduce "enabled" state for TCE table

2015-06-21 Thread David Gibson
On Thu, Jun 18, 2015 at 09:37:28PM +1000, Alexey Kardashevskiy wrote:
> Currently TCE tables are created once at start and their size never
> changes. We are going to change that by introducing a Dynamic DMA windows
> support where DMA configuration may change during the guest execution.
> 
> This changes spapr_tce_new_table() to create an empty stub object. Only
> LIOBN is assigned by the time of creation. It still will be called once
> at the owner object (VIO or PHB) creation.
> 
> This introduces an "enabled" state for TCE table objects with two
> helper functions - spapr_tce_table_enable()/spapr_tce_table_disable().
> spapr_tce_table_enable() receives TCE table parameters and allocates
> a guest view of the TCE table (in the user space or KVM).
> spapr_tce_table_disable() disposes the table.
> 
> Follow up patches will disable+enable tables on reset (system reset
> or DDW reset).
> 
> No visible change in behaviour is expected except the actual table
> will be reallocated every reset. We might optimize this later.
> 
> The other way to implement this would be dynamically create/remove
> the TCE table QOM objects but this would make migration impossible
> as migration expects all QOM objects to exist at the receiver
> so we have to have TCE table objects created when migration begins.
> 
> spapr_tce_table_do_enable() is separated from from spapr_tce_table_enable()
> as later it will be called at the sPAPRTCETable post-migration stage when
> it has all the properties set after the migration.
> 
> Signed-off-by: Alexey Kardashevskiy 
> ---
> Changes:
> v8:
> * add missing unparent_object() to spapr_tce_table_unrealize() (parenting
> is made by memory_region_init_iommu)

Um.. I don't see an unparent_object() in spapr_tce_table_unrealize().
Or anywhere else.  I don't actually know where it's necessary, but
this seems to contracdict your changelog regardless.

-- 
David Gibson| I'll have my music baroque, and my code
david AT gibson.dropbear.id.au  | minimalist, thank you.  NOT _the_ _other_
| _way_ _around_!
http://www.ozlabs.org/~dgibson


pgpndohri9GaJ.pgp
Description: PGP signature


Re: [Qemu-devel] [PATCH qemu v8 05/14] spapr_iommu: Move table allocation to helpers

2015-06-21 Thread David Gibson
On Thu, Jun 18, 2015 at 09:37:27PM +1000, Alexey Kardashevskiy wrote:
> At the moment presence of vfio-pci devices on a bus affect the way
> the guest view table is allocated. If there is no vfio-pci on a PHB
> and the host kernel supports KVM acceleration of H_PUT_TCE, a table
> is allocated in KVM. However, if there is vfio-pci and we do yet not
> KVM acceleration for these, the table has to be allocated by
> the userspace. At the moment the table is allocated once at boot time
> but next patches will reallocate it.
> 
> This moves kvmppc_create_spapr_tce/g_malloc0 and their counterparts
> to helpers.
> 
> Signed-off-by: Alexey Kardashevskiy 

Reviewed-by: David Gibson 

-- 
David Gibson| I'll have my music baroque, and my code
david AT gibson.dropbear.id.au  | minimalist, thank you.  NOT _the_ _other_
| _way_ _around_!
http://www.ozlabs.org/~dgibson


pgpQZYF3MlLrO.pgp
Description: PGP signature


[Qemu-devel] [PATCH v2 1/5] vhost-user: Add ability to know vhost-user backend disconnection

2015-06-21 Thread Tetsuya Mukawa
Current QEMU cannot detect vhost-user backend disconnection. The
patch adds ability to know it.
To know disconnection, add watcher to detect G_IO_HUP event. When
G_IO_HUP event is detected, the disconnected socket will be read
to cause a CHR_EVENT_CLOSED.

Signed-off-by: Tetsuya Mukawa 
---
 net/vhost-user.c | 18 ++
 1 file changed, 18 insertions(+)

diff --git a/net/vhost-user.c b/net/vhost-user.c
index b51bc04..8b7749a 100644
--- a/net/vhost-user.c
+++ b/net/vhost-user.c
@@ -19,6 +19,7 @@ typedef struct VhostUserState {
 NetClientState nc;
 CharDriverState *chr;
 VHostNetState *vhost_net;
+int watch;
 } VhostUserState;
 
 typedef struct VhostUserChardevProps {
@@ -112,12 +113,27 @@ static void net_vhost_link_down(VhostUserState *s, bool 
link_down)
 }
 }
 
+static gboolean net_vhost_user_watch(GIOChannel *chan, GIOCondition cond,
+   void *opaque)
+{
+VhostUserState *s = opaque;
+uint8_t buf[1];
+
+/* We don't actually want to read anything, but CHR_EVENT_CLOSED will be
+ * raised as a side-effect of the read.
+ */
+qemu_chr_fe_read_all(s->chr, buf, sizeof(buf));
+
+return FALSE;
+}
+
 static void net_vhost_user_event(void *opaque, int event)
 {
 VhostUserState *s = opaque;
 
 switch (event) {
 case CHR_EVENT_OPENED:
+s->watch = qemu_chr_fe_add_watch(s->chr, G_IO_HUP, 
net_vhost_user_watch, s);
 vhost_user_start(s);
 net_vhost_link_down(s, false);
 error_report("chardev \"%s\" went up", s->nc.info_str);
@@ -125,6 +141,8 @@ static void net_vhost_user_event(void *opaque, int event)
 case CHR_EVENT_CLOSED:
 net_vhost_link_down(s, true);
 vhost_user_stop(s);
+g_source_remove(s->watch);
+s->watch = 0;
 error_report("chardev \"%s\" went down", s->nc.info_str);
 break;
 }
-- 
2.1.4




[Qemu-devel] [PATCH v2 0/5] Add feature to start QEMU without vhost-user backend

2015-06-21 Thread Tetsuya Mukawa
Hi guys,

Here are patches to add feature to start QEMU without vhost-user backend.
Currently, if we want to use vhost-user backend, the backend must start before
QEMU. Also, if QEMU or the backend is closed unexpectedly, there is no way to
recover without restarting both applications. Practically, it's not useful.

This patch series adds following features.
 - QEMU can start before the backend.
 - QEMU or the backend can restart anytime.
   connectivity will be recovered automatically, when app starts again.
   (if QEMU is server, QEMU just wait reconnection)
   while lost connection, link status of virtio-net device is down,
   so virtio-net driver on the guest can know it

To work like above, the patch introduces flags to specify features vhost-user
backend will support.

Here are examples.
('backend_features' is the new flags. Each bit of the flag represents
VIRTIO_NET_F_* in linux/virtio_net.h)

* QEMU is configured as vhost-user client.
 -chardev socket,id=chr0,path=/tmp/sock,reconnect=3 \
 -netdev 
vhost-user,id=net0,chardev=chr0,vhostforce,backend-features=0x68000 \
 -device virtio-net-pci,netdev=net0 \

* QEMU is configured as vhost-user server.
 -chardev socket,id=chr0,path=/tmp/sock,server,nowait \
 -netdev 
vhost-user,id=net0,chardev=chr0,vhostforce,backend-features=0x68000 \
 -device virtio-net-pci,netdev=net0 \

When virtio-net device is configured by virtio-net driver, QEMU should know
vhost-user backend features. But if QEMU starts without the backend, QEMU cannot
know it. So above the feature values specified by user will be used as features
the backend will support.

When connection between QEMU and the backend is established, QEMU checkes 
feature
values of the backend to make sure the expected features are provided.
If it doesn't, the connection will be closed by QEMU.

Regards,
Tetsuya

--
Changes
--
- v2 changes from v1 patch
   - Rebase to latest master.
   - Change user interface to be able to specify each feature by UINT64.
   - Replace backend_* to backend-* in qapi schema.
   - Use close(2) interface for opended socket instead of using shutdown(2)
 interface.
   - Split 2nd patch of v1 into 2nd and 3rd patch of v2.
   - Fix commit title and body.
   - Add comment, and fix indent.
   - Use {} even for single statement if bodies.
   - Use PRIx64 instead of %lx.


- v1 changes from RFC patch
  The last patch of this series was changed like below.
   - Rebase to latest master.
   - Remove needless has_backend_feature variable.
   - Change user interface to be able to specify each feature by name.
   - Add (Since 2.4) to schema file.
   - Fix commit title and body.

Tetsuya Mukawa (5):
  vhost-user: Add ability to know vhost-user backend disconnection
  qemu-char: Add qemu_chr_disconnect to close a fd accepted by listen fd
  vhost-user: Shutdown vhost-user connection when wrong messages are
passed
  vhost-user: Enable 'nowait' and 'reconnect' option
  vhost-user: Add new option to specify vhost-user backend supports

 hw/net/vhost_net.c |  6 +-
 hw/net/virtio-net.c| 15 +++
 hw/scsi/vhost-scsi.c   |  2 +-
 hw/virtio/vhost-user.c | 24 ---
 hw/virtio/vhost.c  |  3 ++-
 include/hw/virtio/vhost.h  |  3 ++-
 include/hw/virtio/virtio-net.h |  1 +
 include/net/net.h  |  3 +++
 include/net/vhost_net.h|  1 +
 include/sysemu/char.h  |  7 +++
 net/net.c  |  9 +
 net/tap.c  |  1 +
 net/vhost-user.c   | 43 --
 qapi-schema.json   | 12 ++--
 qemu-char.c|  8 
 qemu-options.hx|  3 ++-
 16 files changed, 125 insertions(+), 16 deletions(-)

-- 
2.1.4




[Qemu-devel] [PATCH v2 2/5] qemu-char: Add qemu_chr_disconnect to close a fd accepted by listen fd

2015-06-21 Thread Tetsuya Mukawa
The patch introduces qemu_chr_disconnect(). The function is used for
closing a fd accepted by listen fd. Though we already have qemu_chr_delete(),
but it closes not only accepted fd but also listen fd. This new function
is used when we still want to keep listen fd.

Signed-off-by: Tetsuya Mukawa 
---
 include/sysemu/char.h | 7 +++
 qemu-char.c   | 8 
 2 files changed, 15 insertions(+)

diff --git a/include/sysemu/char.h b/include/sysemu/char.h
index 832b7fe..141edbd 100644
--- a/include/sysemu/char.h
+++ b/include/sysemu/char.h
@@ -70,6 +70,7 @@ struct CharDriverState {
 IOReadHandler *chr_read;
 void *handler_opaque;
 void (*chr_close)(struct CharDriverState *chr);
+void (*chr_disconnect)(struct CharDriverState *chr);
 void (*chr_accept_input)(struct CharDriverState *chr);
 void (*chr_set_echo)(struct CharDriverState *chr, bool echo);
 void (*chr_set_fe_open)(struct CharDriverState *chr, int fe_open);
@@ -124,6 +125,12 @@ CharDriverState *qemu_chr_new_from_opts(QemuOpts *opts,
  */
 CharDriverState *qemu_chr_new(const char *label, const char *filename,
   void (*init)(struct CharDriverState *s));
+/**
+ * @qemu_chr_disconnect:
+ *
+ * Close a fd accpeted by character backend.
+ */
+void qemu_chr_disconnect(CharDriverState *chr);
 
 /**
  * @qemu_chr_delete:
diff --git a/qemu-char.c b/qemu-char.c
index d0c1564..122632b 100644
--- a/qemu-char.c
+++ b/qemu-char.c
@@ -3836,6 +3836,13 @@ void qemu_chr_fe_release(CharDriverState *s)
 s->avail_connections++;
 }
 
+void qemu_chr_disconnect(CharDriverState *chr)
+{
+if (chr->chr_disconnect) {
+chr->chr_disconnect(chr);
+}
+}
+
 void qemu_chr_delete(CharDriverState *chr)
 {
 QTAILQ_REMOVE(&chardevs, chr, next);
@@ -4154,6 +4161,7 @@ static CharDriverState 
*qmp_chardev_open_socket(ChardevSocket *sock,
 chr->chr_write = tcp_chr_write;
 chr->chr_sync_read = tcp_chr_sync_read;
 chr->chr_close = tcp_chr_close;
+chr->chr_disconnect = tcp_chr_disconnect;
 chr->get_msgfds = tcp_get_msgfds;
 chr->set_msgfds = tcp_set_msgfds;
 chr->chr_add_client = tcp_chr_add_client;
-- 
2.1.4




[Qemu-devel] [PATCH v2 3/5] vhost-user: Shutdown vhost-user connection when wrong messages are passed

2015-06-21 Thread Tetsuya Mukawa
When wrong vhost-user message are passed, the connection should be shutdown.

Signed-off-by: Tetsuya Mukawa 
---
 hw/virtio/vhost-user.c | 18 +++---
 1 file changed, 11 insertions(+), 7 deletions(-)

diff --git a/hw/virtio/vhost-user.c b/hw/virtio/vhost-user.c
index d6f2163..2215c39 100644
--- a/hw/virtio/vhost-user.c
+++ b/hw/virtio/vhost-user.c
@@ -183,6 +183,7 @@ static int vhost_user_write(struct vhost_dev *dev, 
VhostUserMsg *msg,
 static int vhost_user_call(struct vhost_dev *dev, unsigned long int request,
 void *arg)
 {
+CharDriverState *chr = dev->opaque;
 VhostUserMsg msg;
 VhostUserRequest msg_request;
 struct vhost_vring_file *file = 0;
@@ -242,7 +243,7 @@ static int vhost_user_call(struct vhost_dev *dev, unsigned 
long int request,
 if (!fd_num) {
 error_report("Failed initializing vhost-user memory map, "
 "consider using -object memory-backend-file share=on");
-return -1;
+goto close;
 }
 
 msg.size = sizeof(m.memory.nregions);
@@ -289,7 +290,7 @@ static int vhost_user_call(struct vhost_dev *dev, unsigned 
long int request,
 break;
 default:
 error_report("vhost-user trying to send unhandled ioctl");
-return -1;
+goto close;
 break;
 }
 
@@ -305,33 +306,36 @@ static int vhost_user_call(struct vhost_dev *dev, 
unsigned long int request,
 if (msg_request != msg.request) {
 error_report("Received unexpected msg type."
 " Expected %d received %d", msg_request, msg.request);
-return -1;
+goto close;
 }
 
 switch (msg_request) {
 case VHOST_USER_GET_FEATURES:
 if (msg.size != sizeof(m.u64)) {
 error_report("Received bad msg size.");
-return -1;
+goto close;
 }
 *((__u64 *) arg) = msg.u64;
 break;
 case VHOST_USER_GET_VRING_BASE:
 if (msg.size != sizeof(m.state)) {
 error_report("Received bad msg size.");
-return -1;
+goto close;
 }
 msg.state.index -= dev->vq_index;
 memcpy(arg, &msg.state, sizeof(struct vhost_vring_state));
 break;
 default:
 error_report("Received unexpected msg type.");
-return -1;
-break;
+goto close;
 }
 }
 
 return 0;
+
+close:
+qemu_chr_disconnect(chr);
+return -1;
 }
 
 static int vhost_user_init(struct vhost_dev *dev, void *opaque)
-- 
2.1.4




[Qemu-devel] [PATCH v2 5/5] vhost-user: Add new option to specify vhost-user backend supports

2015-06-21 Thread Tetsuya Mukawa
This patch adds 'backend_features' option for vhost-user backends.
If this option is specified, QEMU assumes vhost-user backends support
the features specified by user, and QEMU can start without vhost-user
backend.

Here are examples.
* QEMU is configured as vhost-user client.
 -chardev socket,id=chr0,path=/tmp/sock,reconnect=3 \
 -netdev vhost-user,id=net0,chardev=chr0,vhostforce,backend-features=0x68000 \
 -device virtio-net-pci,netdev=net0 \

* QEMU is configured as vhost-user server.
 -chardev socket,id=chr0,path=/tmp/sock,server,nowait \
 -netdev vhost-user,id=net0,chardev=chr0,vhostforce,backend-features=0x68000 \
 -device virtio-net-pci,netdev=net0 \

To know vhost-user backend features that the backend expects, please
specify 0x as backend-features, then invoke QEMU and check error log
like below.

  Lack of backend features. Expected 0x, but receives 0x68000

Above log indicates the backend features QEMU should be passed.

Signed-off-by: Tetsuya Mukawa 
---
 hw/net/vhost_net.c |  6 +-
 hw/net/virtio-net.c| 15 +++
 hw/scsi/vhost-scsi.c   |  2 +-
 hw/virtio/vhost-user.c |  6 ++
 hw/virtio/vhost.c  |  3 ++-
 include/hw/virtio/vhost.h  |  3 ++-
 include/hw/virtio/virtio-net.h |  1 +
 include/net/net.h  |  3 +++
 include/net/vhost_net.h|  1 +
 net/net.c  |  9 +
 net/tap.c  |  1 +
 net/vhost-user.c   | 19 +--
 qapi-schema.json   | 12 ++--
 qemu-options.hx|  3 ++-
 14 files changed, 75 insertions(+), 9 deletions(-)

diff --git a/hw/net/vhost_net.c b/hw/net/vhost_net.c
index 9bd360b..b9425ea 100644
--- a/hw/net/vhost_net.c
+++ b/hw/net/vhost_net.c
@@ -162,8 +162,12 @@ struct vhost_net *vhost_net_init(VhostNetOptions *options)
 net->dev.vqs = net->vqs;
 net->dev.vq_index = net->nc->queue_index;
 
+if (options->backend_features) {
+net->dev.backend_features = options->backend_features;
+}
+
 r = vhost_dev_init(&net->dev, options->opaque,
-   options->backend_type);
+   options->backend_type, options->backend_features);
 if (r < 0) {
 goto fail;
 }
diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
index d728233..7138f4e 100644
--- a/hw/net/virtio-net.c
+++ b/hw/net/virtio-net.c
@@ -363,6 +363,18 @@ static int peer_has_ufo(VirtIONet *n)
 return n->has_ufo;
 }
 
+static uint64_t peer_backend_features(VirtIONet *n)
+{
+if (!peer_has_vnet_hdr(n)) {
+return 0;
+}
+
+n->backend_features =
+qemu_backend_features(qemu_get_queue(n->nic)->peer);
+
+return n->backend_features;
+}
+
 static void virtio_net_set_mrg_rx_bufs(VirtIONet *n, int mergeable_rx_bufs,
int version_1)
 {
@@ -467,6 +479,9 @@ static uint64_t virtio_net_get_features(VirtIODevice *vdev, 
uint64_t features)
 
 if (!get_vhost_net(nc->peer)) {
 virtio_add_feature(&features, VIRTIO_F_VERSION_1);
+if (peer_backend_features(n)) {
+features = peer_backend_features(n);
+}
 return features;
 }
 return vhost_net_get_features(get_vhost_net(nc->peer), features);
diff --git a/hw/scsi/vhost-scsi.c b/hw/scsi/vhost-scsi.c
index 1c389c4..1d7957c 100644
--- a/hw/scsi/vhost-scsi.c
+++ b/hw/scsi/vhost-scsi.c
@@ -246,7 +246,7 @@ static void vhost_scsi_realize(DeviceState *dev, Error 
**errp)
 s->dev.backend_features = 0;
 
 ret = vhost_dev_init(&s->dev, (void *)(uintptr_t)vhostfd,
- VHOST_BACKEND_TYPE_KERNEL);
+ VHOST_BACKEND_TYPE_KERNEL, 0);
 if (ret < 0) {
 error_setg(errp, "vhost-scsi: vhost initialization failed: %s",
strerror(-ret));
diff --git a/hw/virtio/vhost-user.c b/hw/virtio/vhost-user.c
index 2215c39..3caa1a0 100644
--- a/hw/virtio/vhost-user.c
+++ b/hw/virtio/vhost-user.c
@@ -315,6 +315,12 @@ static int vhost_user_call(struct vhost_dev *dev, unsigned 
long int request,
 error_report("Received bad msg size.");
 goto close;
 }
+if (dev->backend_features != (dev->backend_features & msg.u64)) {
+error_report("Lack of backend features. "
+"Expected 0x%llx, but receives 0x%" PRIx64,
+dev->backend_features, msg.u64);
+goto close;
+}
 *((__u64 *) arg) = msg.u64;
 break;
 case VHOST_USER_GET_VRING_BASE:
diff --git a/hw/virtio/vhost.c b/hw/virtio/vhost.c
index a6dcc79..bbfc336 100644
--- a/hw/virtio/vhost.c
+++ b/hw/virtio/vhost.c
@@ -901,7 +901,8 @@ static void vhost_virtqueue_cleanup(struct vhost_virtqueue 
*vq)
 }
 
 int vhost_dev_init(struct vhost_dev *hdev, void *opaque,
-   VhostBackendType backend_type)
+   VhostBackend

[Qemu-devel] [PATCH v2 4/5] vhost-user: Enable 'nowait' and 'reconnect' option

2015-06-21 Thread Tetsuya Mukawa
The patch enables 'nowait' option for server mode, and 'reconnect'
option for client mode.

Signed-off-by: Tetsuya Mukawa 
---
 net/vhost-user.c | 6 ++
 1 file changed, 6 insertions(+)

diff --git a/net/vhost-user.c b/net/vhost-user.c
index 8b7749a..58cd5dc 100644
--- a/net/vhost-user.c
+++ b/net/vhost-user.c
@@ -26,6 +26,8 @@ typedef struct VhostUserChardevProps {
 bool is_socket;
 bool is_unix;
 bool is_server;
+bool is_nowait;
+bool is_reconnect;
 } VhostUserChardevProps;
 
 VHostNetState *vhost_user_get_vhost_net(NetClientState *nc)
@@ -186,6 +188,10 @@ static int net_vhost_chardev_opts(void *opaque,
 props->is_unix = true;
 } else if (strcmp(name, "server") == 0) {
 props->is_server = true;
+} else if ((strcmp(name, "wait") == 0) && (strcmp(value, "off")) == 0) {
+props->is_nowait = true;
+} else if (strcmp(name, "reconnect") == 0) {
+props->is_reconnect = true;
 } else {
 error_setg(errp,
"vhost-user does not support a chardev with option %s=%s",
-- 
2.1.4




Re: [Qemu-devel] [PATCH qemu v8 07/14] spapr_iommu: Remove vfio_accel flag from sPAPRTCETable

2015-06-21 Thread David Gibson
On Thu, Jun 18, 2015 at 09:37:29PM +1000, Alexey Kardashevskiy wrote:
> sPAPRTCETable has a vfio_accel flag which is passed to
> kvmppc_create_spapr_tce() and controls whether to create a guest view
> table in KVM as this depends on the host kernel ability to accelerate
> H_PUT_TCE for VFIO devices. We would set this flag at the moment
> when sPAPRTCETable is created in spapr_tce_new_table() and
> use when the table is allocated in spapr_tce_table_realize().
> 
> Now we explicitly enable/disable DMA windows via spapr_tce_table_enable()
> and spapr_tce_table_disable() and can pass this flag directly without
> caching it in sPAPRTCETable.
> 
> This removes the flag. This should cause no behavioural change.
> 
> Signed-off-by: Alexey Kardashevskiy 

Reviewed-by: David Gibson 

-- 
David Gibson| I'll have my music baroque, and my code
david AT gibson.dropbear.id.au  | minimalist, thank you.  NOT _the_ _other_
| _way_ _around_!
http://www.ozlabs.org/~dgibson


pgpY8tQGl8ypa.pgp
Description: PGP signature


Re: [Qemu-devel] [PATCH qemu v8 10/14] spapr_vfio_pci: Remove redundant spapr-pci-vfio-host-bridge

2015-06-21 Thread David Gibson
On Thu, Jun 18, 2015 at 09:37:32PM +1000, Alexey Kardashevskiy wrote:
> sPAPRTCETable is handling 2 TCE tables already:
> 
> 1) guest view of the TCE table - emulated devices use only this table;
> 
> 2) hardware IOMMU table - VFIO PCI devices use it for actual work but
> it does not replace 1) and it is not visible to the guest.
> The initialization of this table is driven by vfio-pci device,
> DMA map/unmap requests are handled via MemoryListener so there is very
> little to do in spapr-pci-vfio-host-bridge.
> 
> This moves VFIO bits to the generic spapr-pci-host-bridge which allows
> putting emulated and VFIO devices on the same PHB. It is still possible
> to create multiple PHBs and avoid sharing PHB resouces for emulated and
> VFIO devices.
> 
> If there is no VFIO-PCI device attaches, no special ioctls will be called.
> If there are some VFIO-PCI devices attached, PHB may refuse to attach
> another VFIO-PCI device if a VFIO container on the host kernel side
> does not support container sharing.
> 
> This changes spapr-pci-host-bridge to support properties of
> spapr-pci-vfio-host-bridge. This makes spapr-pci-vfio-host-bridge type
> equal to spapr-pci-host-bridge except it has an additional "iommu"
> property for backward compatibility reasons.
> 
> This moves PCI device lookup from spapr_phb_vfio_eeh_set_option() to
> rtas_ibm_set_eeh_option() as we need to know if the device is "vfio-pci"
> and decide whether to call spapr_phb_vfio_eeh_set_option() or not.
> 
> Signed-off-by: Alexey Kardashevskiy 
> Reviewed-by: David Gibson 

I like the idea of merging the two PHB classes.

But.. what if you hotplug a VFIO device on to a PHB that previously
didn't have one.  I don't see anything here that will update has_vfio
and copy the existing TCE tables into VFIO.

[snip]
> @@ -1185,6 +1161,11 @@ static void spapr_phb_realize(DeviceState *dev, Error 
> **errp)
>  uint64_t msi_window_size = 4096;
>  sPAPRTCETable *tcet;
>  
> +if ((sphb->iommugroupid != -1) &&
> +object_dynamic_cast(OBJECT(sphb), TYPE_SPAPR_PCI_VFIO_HOST_BRIDGE)) {
> +error_report("Warning: iommugroupid shall not be used");

That's a rather cryptic error message.  How about
   "Warning: iommugroupid is deprecated and will be ignored"

-- 
David Gibson| I'll have my music baroque, and my code
david AT gibson.dropbear.id.au  | minimalist, thank you.  NOT _the_ _other_
| _way_ _around_!
http://www.ozlabs.org/~dgibson


pgp8juAWVublN.pgp
Description: PGP signature


Re: [Qemu-devel] [PATCH qemu v8 11/14] spapr_pci: Enable vfio-pci hotplug

2015-06-21 Thread David Gibson
On Thu, Jun 18, 2015 at 09:37:33PM +1000, Alexey Kardashevskiy wrote:
> sPAPR IOMMU is managing two copies of an TCE table:
> 1) a guest view of the table - this is what emulated devices use and
> this is where H_GET_TCE reads from;
> 2) a hardware TCE table - only present if there is at least one vfio-pci
> device on a PHB; it is updated via a memory listener on a PHB address
> space which forwards map/unmap requests to vfio-pci IOMMU host driver.
> 
> At the moment presence of vfio-pci devices on a bus affect the way
> the guest view table is allocated. If there is no vfio-pci on a PHB
> and the host kernel supports KVM acceleration of H_PUT_TCE, a table
> is allocated in KVM. However, if there is vfio-pci and we do yet not
> support KVM acceleration for these, the table has to be allocated
> by the userspace.
> 
> When vfio-pci device is hotplugged and there were no vfio-pci devices
> already, the guest view table could have been allocated by KVM which
> means that H_PUT_TCE is handled by the host kernel and since we
> do not support vfio-pci in KVM, the hardware table will not be updated.
> 
> This reallocates the guest view table in QEMU if the first vfio-pci
> device has just been plugged. spapr_tce_realloc_userspace() handles this.
> 
> This replays all the mappings to make sure that the tables are in sync.
> This will not have a visible effect though as for a new device
> the guest kernel will allocate-and-map new addresses and therefore
> existing mappings from emulated devices will not be used by vfio-pci
> devices.
> 
> This adds calls to spapr_phb_dma_capabilities_update() in PCI hotplug
> hooks .
> 
> Signed-off-by: Alexey Kardashevskiy 

Reviewed-by: David Gibson 

Please ignore comment about hotplug I made on the previous patch, not
having read this one.

-- 
David Gibson| I'll have my music baroque, and my code
david AT gibson.dropbear.id.au  | minimalist, thank you.  NOT _the_ _other_
| _way_ _around_!
http://www.ozlabs.org/~dgibson


pgpFEIF1EWzmf.pgp
Description: PGP signature


[Qemu-devel] [Bug 1467240] [NEW] Regression - bridged networking broken for Mac OS X guest

2015-06-21 Thread Jonathan Liu
Public bug reported:

Using the instructions at
http://www.contrib.andrew.cmu.edu/~somlo/OSXKVM/ for running Mac OS X
Snow Leopard under QEMU, bridged networking is broken when using QEMU
git. The result is that Mac OS X is unable to obtain an IP address using
DHCP. It works in the latest stable release - QEMU 2.3.0.

Replace "-netdev user,id=hub0port0" with "-netdev
bridge,br=br0,id=hub0port0" when testing bridged networking.

Bisecting the git repository shows the following bad commit:
commit a90a7425cf592a3afeff3eaf32f543b83050ee5c
Author: Fam Zheng 
Date:   Thu Jun 4 14:45:17 2015 +0800

tap: Drop tap_can_send

This callback is called by main loop before polling s->fd, if it returns
false, the fd will not be polled in this iteration.

This is redundant with checks inside read callback. After this patch,
the data will be sent to peer when it arrives. If the device can't
receive, it will be queued to incoming_queue, and when the device status
changes, this queue will be flushed.

Signed-off-by: Fam Zheng 
Message-id: 1433400324-7358-7-git-send-email-f...@redhat.com
Signed-off-by: Stefan Hajnoczi 

** Affects: qemu
 Importance: Undecided
 Status: New

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1467240

Title:
  Regression - bridged networking broken for Mac OS X guest

Status in QEMU:
  New

Bug description:
  Using the instructions at
  http://www.contrib.andrew.cmu.edu/~somlo/OSXKVM/ for running Mac OS X
  Snow Leopard under QEMU, bridged networking is broken when using QEMU
  git. The result is that Mac OS X is unable to obtain an IP address
  using DHCP. It works in the latest stable release - QEMU 2.3.0.

  Replace "-netdev user,id=hub0port0" with "-netdev
  bridge,br=br0,id=hub0port0" when testing bridged networking.

  Bisecting the git repository shows the following bad commit:
  commit a90a7425cf592a3afeff3eaf32f543b83050ee5c
  Author: Fam Zheng 
  Date:   Thu Jun 4 14:45:17 2015 +0800

  tap: Drop tap_can_send

  This callback is called by main loop before polling s->fd, if it returns
  false, the fd will not be polled in this iteration.

  This is redundant with checks inside read callback. After this patch,
  the data will be sent to peer when it arrives. If the device can't
  receive, it will be queued to incoming_queue, and when the device status
  changes, this queue will be flushed.

  Signed-off-by: Fam Zheng 
  Message-id: 1433400324-7358-7-git-send-email-f...@redhat.com
  Signed-off-by: Stefan Hajnoczi 

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1467240/+subscriptions