Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

This patch fixes a bunch of issues in the itd descriptor handling.
Most important fix is to handle transfers which cross page borders
correctly by looking up the address of the next page.  Luckily the
linux uses physically contigous memory so the data used to hits the
correct location even with this bug instead of corrupting guest
memory.  Also the transfer length updates for outgoing transfers wasn't
correct.

While being at it DPRINTFs have been replaced by tracepoints.

The isoch_pause logic has been disabled.  Not clear to me which propose
this serves and I think it is incorrect too as we just skip processing
itds.  Even when no xfer happens we have to clear the active bit.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

This patch adds support for keeping multiple queues going at the same
time.  One slow device will not affect other devices any more.

The patch adds code to manage EHCIQueue structs.  It also does a number
of changes to the state machine:

 * The state machine will never ever stop in EXECUTING any more.
   Instead it will continue with the next queue (aka HORIZONTALQH) when
   the usb device returns USB_RET_ASYNC.
 * The state machine will stop processing when it figures it walks in
   circles (easy to figure now that we have a EHCIQueue struct for each
   QH we've processed).  The bailout logic should not be needed any
   more.  For now it is still in, but will assert() in case it triggers.
 * The state machine will just skip queues with a async USBPacket in
   flight.
 * The state machine will resume processing as soon as the async
   USBPacket is finished.

The patch also takes care to flush the QH struct back to guest memory
when needed, so we don't get stale data when (re-)loading it from guest
memory in FETCHQH state.

It also makes the writeback code to not touch the first three dwords of
the QH struct as the EHCI must not write them.  This actually fixes a
bug where QH chaining changes (next ptr) by the linux ehci driver where
overwritten by the emulated EHCI.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Add a trace point for buffer copies and drop the DPRINTF's.

No change in behavior.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Add a separate tracepoint to log how register values change in response
to a mmio write.  Especially useful for registers which have read-only
or clear-on-write bits in them.

No change in behavior.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Trace usb port operations (attach, detach, reset),
drop a few obsolete DPRINTF's.

No change in behavior.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Add functions to get and set the current state of the state machine,
add tracepoints there to trace state transitions.  Add support for
traceing the queue heads and transfer descriptors as we look at them.

Drop a few DPRINTFs and all DPRINTF_ST lines, they are obsolete now.

No change in behavior.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

This patch starts adding trace support to ehci.  It traces
updates of the status register (USBSTS), mmio access and
controller reset.

It also adds functions to set and clear status register bits
and puts them in use everywhere.

Some DPRINTF's are dropped in favor of the new tracepoints.

No change in behavior.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

The simple backend only supports a maximum of 6 arguments.  Split the
scsi_req_parsed event in two parts to cope with the limit.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Cc: Christoph Hellwig <hch@lst.de>

This abstracts calling the command_complete callback, reducing churn
in the following patches.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Reviewed-by: NChristoph Hellwig <hch@lst.de>

Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Reviewed-by: NChristoph Hellwig <hch@lst.de>

One strategy to limit the startup delay of consistency check when
opening image files is to ensure that the file is marked dirty for as
little time as possible.

QED currently marks the image dirty when the first allocating write
request is issued and clears the dirty bit again when the image is
cleanly closed.  In practice that means the image is marked dirty for
most of a guest's lifetime and prone to being in a dirty state upon
crash or power failure.

It is safe to clear the dirty bit after all allocating write requests
have completed and a flush has been performed.  This patch adds a timer
after the last allocating write request completes.  When the timer fires
it will flush and then clear the dirty bit.  The timer is set to 5
seconds and is cancelled upon arrival of a new allocating write request.
Signed-off-by: NStefan Hajnoczi <stefanha@linux.vnet.ibm.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

This function allows to unlock a ram_ptr give by qemu_get_ram_ptr. After
a call to qemu_put_ram_ptr, the pointer may be unmap from QEMU when
used with Xen.
Signed-off-by: NAnthony PERARD <anthony.perard@citrix.com>
Acked-by: NAlexander Graf <agraf@suse.de>
Signed-off-by: NAlexander Graf <agraf@suse.de>

On IA32 host or IA32 PAE host, at present, generally, we can't create
an HVM guest with more than 2G memory, because generally it's almost
impossible for Qemu to find a large enough and consecutive virtual
address space to map an HVM guest's whole physical address space.
The attached patch fixes this issue using dynamic mapping based on
little blocks of memory.

Each call to qemu_get_ram_ptr makes a call to qemu_map_cache with the
lock option, so mapcache will not unmap these ram_ptr.

Blocks that do not belong to the RAM, but usually to a device ROM or to
a framebuffer, are handled in a separate function. So the whole RAMBlock
can be map.
Signed-off-by: NJun Nakajima <jun.nakajima@intel.com>
Signed-off-by: NAnthony PERARD <anthony.perard@citrix.com>
Signed-off-by: NStefano Stabellini <stefano.stabellini@eu.citrix.com>
Signed-off-by: NAlexander Graf <agraf@suse.de>

This patch adds support for Milkymist's minimal Ethernet MAC v2. It
superseds minimac1.
Signed-off-by: NMichael Walle <michael@walle.cc>
Signed-off-by: NEdgar E. Iglesias <edgar.iglesias@gmail.com>

Signed-off-by: NLluís Vilanova <vilanova@ac.upc.edu>
Signed-off-by: NStefan Hajnoczi <stefanha@linux.vnet.ibm.com>

Trace events cannot use %s in their format strings because trace
backends vary in how they can deference pointers (if at all).  Recording
const char * values is not meaningful if their contents are not recorded
too.

Change grlib trace events that rely on strings so that they communicate
similar information without using strings.

A follow-up patch explains this limitation and updates docs/tracing.txt.
Signed-off-by: NStefan Hajnoczi <stefanha@linux.vnet.ibm.com>

It can be handy to know when the guest locks/unlocks the CD-ROM tray.
This trace event makes that possible.
Signed-off-by: NStefan Hajnoczi <stefanha@linux.vnet.ibm.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

This patch adds support for Milkymist's VGA framebuffer.
Signed-off-by: NMichael Walle <michael@walle.cc>
Signed-off-by: NEdgar E. Iglesias <edgar.iglesias@gmail.com>

This patch adds support for Milkymist's simple UART.
Signed-off-by: NMichael Walle <michael@walle.cc>
Signed-off-by: NEdgar E. Iglesias <edgar.iglesias@gmail.com>

This patch adds support for Milkymist's texture mapping unit. For fast
computation this model needs hardware accelerated 3D graphics support
(OpenGL). There is no graphical output, all computations belong to internal
framebuffers only.
Signed-off-by: NMichael Walle <michael@walle.cc>
Signed-off-by: NEdgar E. Iglesias <edgar.iglesias@gmail.com>

This patch adds support for Milkymist's System Controller core. The model
has the following features:
 - support for shutting down and restarting the board
 - provide two timers and GPIO
 - provide registers for system identification and reading the boards
   capabilities
Signed-off-by: NMichael Walle <michael@walle.cc>
Signed-off-by: NEdgar E. Iglesias <edgar.iglesias@gmail.com>

This patch adds support for Milkymist's SoftUSB core. This model differ
from the real hardware in its functionality. The real hardware consits of a
tiny freely programmable microcontroller which controls the USB ports. For
simplicity reasons, this model emulates only keyboard and mouse input
devices, eg. input events translates directly to the corresponding expected
messages.
Signed-off-by: NMichael Walle <michael@walle.cc>
Signed-off-by: NEdgar E. Iglesias <edgar.iglesias@gmail.com>

This patch adds support for Milkymist's Programmable FPU.
Signed-off-by: NMichael Walle <michael@walle.cc>
Signed-off-by: NEdgar E. Iglesias <edgar.iglesias@gmail.com>

This patch adds support for Milkymist's minimal Ethernet MAC.
Signed-off-by: NMichael Walle <michael@walle.cc>
Signed-off-by: NEdgar E. Iglesias <edgar.iglesias@gmail.com>

This patch adds support for Milkymist's memory card core.
Signed-off-by: NMichael Walle <michael@walle.cc>
Signed-off-by: NEdgar E. Iglesias <edgar.iglesias@gmail.com>

This patch adds support for the Milkymist's High Performance Dynamic Memory
Controller. This is just a dumb model without any functionality. While the
real hardware acts for example as a bridge between software and hardware
for sending SDRAM commans, this model will only eat up these commands and
always returns the expected hardware states, eg. PLL locked etc.
Signed-off-by: NMichael Walle <michael@walle.cc>
Signed-off-by: NEdgar E. Iglesias <edgar.iglesias@gmail.com>

This patch adds support for the Milkymist AC97 compatible sound output and
input core.
Signed-off-by: NMichael Walle <michael@walle.cc>
Signed-off-by: NEdgar E. Iglesias <edgar.iglesias@gmail.com>

This patch adds paio_complete() and paio_cancel() trace events to
complement the paio_submit() event.
Signed-off-by: NStefan Hajnoczi <stefanha@linux.vnet.ibm.com>

Add a trace event for bdrv_aio_flush() to complement the existing
bdrv_aio_readv() and bdrv_aio_writev() events.
Signed-off-by: NStefan Hajnoczi <stefanha@linux.vnet.ibm.com>

This patch add support for a system control block. It is supposed to
act as helper for the emulated program. E.g. shutting down the VM or
printing test results. This model is intended for testing purposes only and
doesn't fit to any real hardware. Therefore, it is not added to any board
by default. Instead a user has to add it explicitly with the '-device'
commandline parameter.
Signed-off-by: NMichael Walle <michael@walle.cc>
Signed-off-by: NEdgar E. Iglesias <edgar.iglesias@gmail.com>

This patch add support for the LatticeMico32 UART.
Signed-off-by: NMichael Walle <michael@walle.cc>
Signed-off-by: NEdgar E. Iglesias <edgar.iglesias@gmail.com>

This patch adds support for the LatticeMico32 system timer.
Signed-off-by: NMichael Walle <michael@walle.cc>
Signed-off-by: NEdgar E. Iglesias <edgar.iglesias@gmail.com>

This patch adds the JTAG UART model. It is accessed through special control
registers and opcodes. Therefore the translation uses callbacks to this
model.
Signed-off-by: NMichael Walle <michael@walle.cc>
Signed-off-by: NEdgar E. Iglesias <edgar.iglesias@gmail.com>

This patch adds the interrupt controller of the lm32. Because the PIC is
accessed through special control registers and opcodes, there are callbacks
from the lm32 translation code to this model.
Signed-off-by: NMichael Walle <michael@walle.cc>
Signed-off-by: NEdgar E. Iglesias <edgar.iglesias@gmail.com>

Leon3 is an open-source VHDL System-On-Chip, well known in space industry (more
information on http://www.gaisler.com).

Leon3 is made of multiple components available in the GrLib VHDL library.
Three devices are implemented: uart, timers and IRQ manager.
You can find code for these peripherals in the grlib_* files.
Signed-off-by: NFabien Chouteau <chouteau@adacore.com>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

This device exposes one parameter:
 - chardev (ptr) : Pointer to a qemu character device

Emulation of GrLib devices is base on the GRLIB IP Core User's Manual:
http://www.gaisler.com/products/grlib/grip.pdfSigned-off-by: NFabien Chouteau <chouteau@adacore.com>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

This device exposes two parameters:
 - set_pil_in        (ptr) : A function to set the pil_in of the SPARC CPU
 - set_pil_in_opaque (ptr) : Opaque argument of the set_pil_in function

Emulation of GrLib devices is base on the GRLIB IP Core User's Manual:
http://www.gaisler.com/products/grlib/grip.pdfSigned-off-by: NFabien Chouteau <chouteau@adacore.com>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

This device exposes three parameters:
 - frequency (uint32) : The system frequency
 - irq-line  (uint32) : IRQ line number for the first timer
                        (others use irq-line + 1, irq-line + 2...)
 - nr-timers (uint32) : Number of timers

Emulation of GrLib devices is base on the GRLIB IP Core User's Manual:
http://www.gaisler.com/products/grlib/grip.pdfSigned-off-by: NFabien Chouteau <chouteau@adacore.com>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>