Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5941 c046a42c-6fe2-441c-8c8c-71466251a162

git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5940 c046a42c-6fe2-441c-8c8c-71466251a162

This patch simply implement one register of SH4's SCI := Serial Communication Interface.

R2D evaluation board uses SCI for SPI connection.  So, Linux kernel for R2D with
default configuration causes a QEMU assertion failure when it initializes SPI driver.
This patch avoids it and reduces the kernel config modification work for QEMU.

Completing SCI implementation task is left.  Other board support is desirable to confirm
this task, which uses SCI for a serial terminal.

(Shin-ichiro KAWASAKI)

git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5939 c046a42c-6fe2-441c-8c8c-71466251a162

Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5938 c046a42c-6fe2-441c-8c8c-71466251a162

SH4 manual say that if a floating point instruction is executed while
FD bit in the status register is 1, an exception should be raised. QEMU
presently does not do that, so the kernel does not initialize FP state
for any thread, nor does it save/restore FP state. The most apparent
consequence is that while recent gcc/libc expect double-precision mode
to be set by kernel, they run in single-precision mode, and all FP code
produces wrong values.

This patch fixes this. It also fixes a couple of places where PC was
not updated before handling an exception, although both those places
deal with invalid instruction and don't lead to any user-visible bugs.

(Vladimir Prus)

git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5937 c046a42c-6fe2-441c-8c8c-71466251a162

1. hostregs_helper.h: fix comment
2. translate-all.c: rename dyngen_code(_search_pc) to
   tcg_gen_code(_search_pc)
3. tcg.c:
  - rename dyngen_table_op_count to tcg_table_op_count
  - no need to generate a log of dyngen ops generated
  - rename dyngen_code(_search_pc) to tcg_gen_code(_search_pc)
4. tcg.h: rename dyngen_code(_search_pc) to
   tcg_gen_code(_search_pc)
Signed-off-by: NLaurent Desnogues <laurent.desnogues@gmail.com>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5936 c046a42c-6fe2-441c-8c8c-71466251a162

Main purpose of this is to delete
       *physical = address & 0x1fffffff;
at target-sh4/helper.c:449, using new mmio rule introduced by #5849
This masking is a nice trick to realize P4/A7 duality of SH registers.
But, IMHO, it is logically wrong.

Most of SH4 cpu control registers in P4 area(0xfc000000...0xffffffff) have
one more address called A7 which is usually P4 address with upper 3bits masked.
This is an address only appears in TLB's physical address part.

Current code use trick writing drivers as if they are really in A7
(that's why you see many *_A7 in hw/sh*.c), and using translation P4 to A7.
Signed-off-by: NTakashi YOSHII <takasi-y@ops.dti.ne.jp>
Signed-off-by: NAndrzej Zaborowski <andrew.zaborowski@intel.com>


git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5935 c046a42c-6fe2-441c-8c8c-71466251a162

Fixes to be needed for commit #5849 "Change MMIO callbacks..."
 hw/sh7750.c:
  - Divide region of CPU control registers to avoid overlapping
    to peripheral modules.
  - Delete unused var "icr", which had moved to hw/sh_intc.c.
 hw/sm501.c:
  - Merge non page aligned palette registers into the region of
    control registers.
Signed-off-by: NTakashi YOSHII <takasi-y@ops.dti.ne.jp>
Signed-off-by: NAndrzej Zaborowski <andrew.zaborowski@intel.com>


git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5934 c046a42c-6fe2-441c-8c8c-71466251a162

git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5933 c046a42c-6fe2-441c-8c8c-71466251a162

This patch adds pci support to sh/r2d board.
This is the first user of PCIC support I formerly sent.

PCIC actually is inside of chip with CPU core on SH7751.
But, this code is written as if SH7750 and PCIC are on board.
I care little about physical device boundary, but fitting with qemu's
design.

This patch also adds some BSC (Bus State Controller) registers,
because PCI device driver software have to accesses them.
Signed-off-by: NTakashi YOSHII <takasi-y@ops.dti.ne.jp>
Signed-off-by: NAndrzej Zaborowski <andrew.zaborowski@intel.com>


git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5932 c046a42c-6fe2-441c-8c8c-71466251a162

git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5931 c046a42c-6fe2-441c-8c8c-71466251a162

git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5930 c046a42c-6fe2-441c-8c8c-71466251a162

git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5929 c046a42c-6fe2-441c-8c8c-71466251a162

git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5928 c046a42c-6fe2-441c-8c8c-71466251a162

This patch adds SuperH on-chip PCI controller(PCIC) support.
Signed-off-by: NTakashi YOSHII <takasi-y@ops.dti.ne.jp>
Signed-off-by: NAndrzej Zaborowski <andrew.zaborowski@intel.com>


git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5927 c046a42c-6fe2-441c-8c8c-71466251a162

This adds IRQ controller in FPGA on r2d, and use it for CF.
Signed-off-by: NTakashi YOSHII <takasi-y@ops.dti.ne.jp>
Signed-off-by: NAndrzej Zaborowski <andrew.zaborowski@intel.com>


git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5926 c046a42c-6fe2-441c-8c8c-71466251a162

This patch adds IRL(4bit encoded 15 level interrupt input) support
to SH using qemu_irq as a multi level (!=on/off) signal.
Signed-off-by: NTakashi YOSHII <takasi-y@ops.dti.ne.jp>
Signed-off-by: NAndrzej Zaborowski <andrew.zaborowski@intel.com>


git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5925 c046a42c-6fe2-441c-8c8c-71466251a162

 This patch adds emulation for a CompactFlash on sh4/r2d board.
 The device is CF, but wired to be worked as True-IDE mode, and connected
 directly to SH bus. So, this code is to support generally mmio based
 IDEs which are supported by "pata_platform" driver in linux kernel.
Signed-off-by: NTakashi YOSHII <takasi-y@ops.dti.ne.jp>
Signed-off-by: NAndrzej Zaborowski <andrew.zaborowski@intel.com>


git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5924 c046a42c-6fe2-441c-8c8c-71466251a162

Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5923 c046a42c-6fe2-441c-8c8c-71466251a162

   this patch removes some now unused things after dyngen removal.

1. dyngen-exec.h:  op_param, op _jmp and some associated macros
   are now unused;
2. Makefile.target:  tcg-dyngen is not needed anymore
2. tcg/tcg-op.h, tcg/tcg-opc.h:  gen-op.h is dead
3. tcg.c:
    - INDEX_op_end is now the first op
    - CONFIG_DYNGEN_OP is never defined
4. tcg.h:  dyngen_op not needed anymore
5. exec-all.h:  remove some ASM macros.
Signed-off-by: NLaurent Desnogues <laurent.desnogues@gmail.com>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5922 c046a42c-6fe2-441c-8c8c-71466251a162

The icebp instruction can be abused to terminate the emulation,
resulting in denial of service.
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5921 c046a42c-6fe2-441c-8c8c-71466251a162

The emulated network cards in QEMU allows local users to execute arbitrary
code by writing Ethernet frames with a size larger than the slirp's default
MTU, which triggers a heap-based buffer overflow in the slirp library.
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5920 c046a42c-6fe2-441c-8c8c-71466251a162

This fixes a few things after Paul's improvements for TCG debugging:

  - change TCGv_i64 field name to something different from
    TCGv_i32
  - fix things in tcg that the above change made visible.
Signed-off-by: NLaurent Desnogues <laurent.desnogues@gmail.com>


git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5919 c046a42c-6fe2-441c-8c8c-71466251a162

... which left was enabled by mistake.
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5918 c046a42c-6fe2-441c-8c8c-71466251a162

git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5917 c046a42c-6fe2-441c-8c8c-71466251a162

Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5916 c046a42c-6fe2-441c-8c8c-71466251a162

Silences a warning about possible unitialized use of t0.
Signed-off-by: NAndreas Faerber <andreas.faerber@web.de>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5915 c046a42c-6fe2-441c-8c8c-71466251a162

Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5914 c046a42c-6fe2-441c-8c8c-71466251a162

This fixes the destination and accumulator registers for the smmul
and smmla instructions.
Signed-off-by: NMans Rullgard <mans@mansr.com>
Acked-by: NLaurent Desnogues <laurent.desnogues@gmail.com>
Signed-off-by: NAndrzej Zaborowski <andrew.zaborowski@intel.com>


git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5913 c046a42c-6fe2-441c-8c8c-71466251a162

This fixes the destination and accumulator registers for the usad8
and usada8 instructions.
Signed-off-by: NMans Rullgard <mans@mansr.com>
Signed-off-by: NAndrzej Zaborowski <andrew.zaborowski@intel.com>


git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5912 c046a42c-6fe2-441c-8c8c-71466251a162

Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5911 c046a42c-6fe2-441c-8c8c-71466251a162

Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5910 c046a42c-6fe2-441c-8c8c-71466251a162

Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5909 c046a42c-6fe2-441c-8c8c-71466251a162

 - gen_set_CF_bit31:  use the right value to set carry flag
 - shifter_out_im:  remove a spurious semi-colon
 - add a break for VSHRN, VRSHRN, VQSHRN, VQRSHRN
   size 2 case
 - sbfx, ubfx are v6t2 instructions

The correct cps user mode behaviour is unclear so it's left out from the
commit until ARM decides it.
Signed-off-by: NLaurent Desnogues <laurent.desnogues@gmail.com>
Signed-off-by: NAndrzej Zaborowski <andrew.zaborowski@intel.com>


git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5908 c046a42c-6fe2-441c-8c8c-71466251a162

  - remove macros that are not used
  - remove disass structure is_mem field which value is never used
  - correct a typo in a comment.
Signed-off-by: NLaurent Desnogues <laurent.desnogues@gmail.com>
Signed-off-by: NAndrzej Zaborowski <andrew.zaborowski@intel.com>


git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5907 c046a42c-6fe2-441c-8c8c-71466251a162

Signed-off-by: NJean-Christophe PLAGNIOL-VILLARD <plagnioj@jcrosoft.com>
Signed-off-by: NAndrzej Zaborowski <andrew.zaborowski@intel.com>


git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5906 c046a42c-6fe2-441c-8c8c-71466251a162

git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5905 c046a42c-6fe2-441c-8c8c-71466251a162

Signed-off-by: NJean-Christophe PLAGNIOL-VILLARD <plagnioj@jcrosoft.com>
Signed-off-by: NAndrzej Zaborowski <andrew.zaborowski@intel.com>


git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5904 c046a42c-6fe2-441c-8c8c-71466251a162

Openserver 5.0.5 sends an Inquiry command to the emulated SCSI disk
expecting a response length of 40 bytes. Currently the response to an
Inquiry command is hardcoded to 36 bytes. When receiving a response of
length 36 instead of 40 Openserver panics.

Modifications to original patch based on feedback from Ryan Harper and Paul
Brook. Thanks guys.
Signed-off-by: NJustin Chevrier <address@hidden>
Signed-off-by: NAndrzej Zaborowski <andrew.zaborowski@intel.com>


git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5903 c046a42c-6fe2-441c-8c8c-71466251a162

Basically after each DMA transfer the Openserver driver would issue an
empty (0) SCRIPTS opcode. As the opcode is essentially a NOP it has no
second DWORD and therefore the DSP should only be incremented by 4 bytes
instead of the 8 bytes we currently do.

Here's a snippet of the log:

lsi_scsi: Data ready tag=0x100d9 len=16384
...
lsi_scsi: SCRIPTS dsp=068c5e50 opcode 01000400 arg 07a09000
lsi_scsi: DMA addr=0x07a09000 len=1024
lsi_scsi: SCRIPTS dsp=068c5e58 opcode 00000000 arg 01000400
lsi_scsi: Wrong phase got 1 expected 0

Note the 2nd DWORD after the empty opcode; the next opcode in the DMA
transfer sequence. As can be expected the address after that has the next
DMA address to use.

After the attached patch the DMA transfer is able to complete successfully:

lsi_scsi: SCRIPTS dsp=068c5e50 opcode 01000400 arg 07a0d000
lsi_scsi: DMA addr=0x07a0d000 len=1024
lsi_scsi: SCRIPTS dsp=068c5e5c opcode 01000400 arg 07a0d400
lsi_scsi: DMA addr=0x07a0d400 len=1024
...

Tested againsted Openserver 5.0.5 and Debian ARM.
Signed-off-by: NJustin Chevrier <address@hidden>
Acked-by: NRyan Harper <ryanh@us.ibm.com>
Signed-off-by: NAndrzej Zaborowski <andrew.zaborowski@intel.com>


git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5902 c046a42c-6fe2-441c-8c8c-71466251a162