Fix some of the nasty TCG race conditions and crashes by implementing
cpu_exit() as setting a flag which is checked at the start of each TB.
This avoids crashes if a thread or signal handler calls cpu_exit()
while the execution thread is itself modifying the TB graph (which
may happen in system emulation mode as well as in linux-user mode
with a multithreaded guest binary).

This fixes the crashes seen in LP:668799; however there are another
class of crashes described in LP:1098729 which stem from the fact
that in linux-user with a multithreaded guest all threads will
use and modify the same global TCG date structures (including the
generated code buffer) without any kind of locking. This means that
multithreaded guest binaries are still in the "unsupported"
category.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Reviewed-by: NRichard Henderson <rth@twiddle.net>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

If tcg_qemu_tb_exec() returns a value whose low bits don't indicate a
link to an indexed next TB, this means that the TB execution never
started (eg because the instruction counter hit zero).  In this case the
guest PC has to be reset to the address of the start of the TB.
Refactor the cpu-exec code to make all tcg_qemu_tb_exec() calls pass
through a wrapper function which does this restoration if necessary.

Note that the apparent change in cpu_exec_nocache() from calling
cpu_pc_from_tb() with the old TB to calling it with the TB returned by
do_tcg_qemu_tb_exec() is safe, because in the nocache case we can
guarantee that the TB we try to execute is not linked to any others,
so the only possible returned TB is the one we started at. That is,
we should arguably previously have included in cpu_exec_nocache() an
assert(next_tb & ~TB_EXIT_MASK) == tb), since the API requires restore
from next_tb but we were using tb.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Reviewed-by: NRichard Henderson <rth@twiddle.net>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

Introduce ENV_OFFSET macros which can be used in non-target-specific
code that needs to generate TCG instructions which reference CPUState
fields given the cpu_env register that TCG targets set up with a
pointer to the CPUArchState struct.
Signed-off-by: NAndreas Färber <afaerber@suse.de>
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Reviewed-by: NRichard Henderson <rth@twiddle.net>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

Document tcg_qemu_tb_exec(). In particular, its return value is a
combination of a pointer to the next translation block and some
extra information in the low two bits. Provide some #defines for
the values passed in these bits to improve code clarity.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Reviewed-by: NRichard Henderson <rth@twiddle.net>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

Fix build breakage by 803d805b:
make tcg_out_addsub2() always available.
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

Add some helpful messages that show the rx descriptor pointer moving as packets
are rxed.
Signed-off-by: NPeter Crosthwaite <peter.crosthwaite@xilinx.com>
Message-id: 1ef2eb34dade64d589a69a2bcfd5aaddb7d50164.1360901435.git.peter.crosthwaite@xilinx.com
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

This doesn't happen in the real hardware. The Zynq TRM explicitly states that
this bit has no effect on the rx descriptor pointer ("The receive queue
pointer register is unaffected").
Signed-off-by: NPeter Crosthwaite <peter.crosthwaite@xilinx.com>
Message-id: 06fdf92b78ee62d8965779bafd29c8df1a5d2718.1360901435.git.peter.crosthwaite@xilinx.com
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Bits in the ISR were continually mirroring their corresponding TX/RX SR bits.
This is incorrect. The ISR bits are only ever set at the time their
corresponding event occurs.
Signed-off-by: NPeter Crosthwaite <peter.crosthwaite@xilinx.com>
Message-id: cedfb6d108318846480b416a6041023ea5a353d6.1360901435.git.peter.crosthwaite@xilinx.com
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

The gem_receive() function replicates the logic for whether or not the device
can rx. Just call the actual gem_can_receive() function in place.
Signed-off-by: NPeter Crosthwaite <peter.crosthwaite@xilinx.com>
Message-id: bf7f93969f3e01fbc76d68d2955307fdbad11bb1.1360901435.git.peter.crosthwaite@xilinx.com
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

The device needs to check for queued RX packets when the RX path is re-enabled.
Signed-off-by: NPeter Crosthwaite <peter.crosthwaite@xilinx.com>
Message-id: 1fa8c88a3b7c654886d0a7484c2463cd4c2a2781.1360901435.git.peter.crosthwaite@xilinx.com
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Currently, M25P80 uses an object property to differentiate between flash parts.
Changed this over to use QOM sub-classes - the actual names of the different parts
are used to create a set of dynamic classes which passes the part info as class
data. The object no longer needs to search the known_devices table for itself,
instead it just gets its info from its own class.

Kept the intermediate class definition private to m25p80.c for the moment, as
the expectation is parts will only be added as new entries in the table. We can
factor out the TYPE_M25P80 abstraction into a header on a demand basis.
Signed-off-by: NPeter Crosthwaite <peter.crosthwaite@xilinx.com>
Message-id: e24e156d-ff96-4901-997a-e31178b08bee@VA3EHSMHS021.ehs.local
Reviewed-by: NAndreas Färber <afaerber@suse.de>
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

The Xilinx Zynq device has two SDHCI controllers. Added to the machine model.
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NPeter Crosthwaite <peter.crosthwaite@xilinx.com>
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Allows for repeating of -sd arguments in the same way as -pflash and -mtdblock.
Acked-by: NIgor Mitsyanko <i.mitsyanko@samsung.com>
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NPeter Crosthwaite <peter.crosthwaite@xilinx.com>
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Device model for standard SD Host Controller Interface (SDHCI) compliant with
version 2.00 of SD association specification.
Signed-off-by: NPeter Crosthwaite <peter.crosthwaite@xilinx.com>
Signed-off-by: NIgor Mitsyanko <i.mitsyanko@samsung.com>
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Split the SCU in a9mpcore out into its own object definition. mpcore is now
just a container for the mpcore components.
Signed-off-by: NPeter Crosthwaite <peter.crosthwaite@xilinx.com>
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

This field was write only and thus unused. Removed.
Signed-off-by: NPeter Crosthwaite <peter.crosthwaite@xilinx.com>
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

In QEMU emulation, there is no functional difference between the ARM mpcore
private timers and watchdogs. Removed all the distinction between the two from
arm_mptimer.c and converted it to be just the mptimer. a9mpcore and arm11mpcore
just instantiate the same mptimer object twice to get both timer and WDT.

If in the future we want to make the WDT functionally different then we can use
either QOM hierarchy to derive WDT from from mptimer, or we can add a property
"is-wdt" or some such.
Signed-off-by: NPeter Crosthwaite <peter.crosthwaite@xilinx.com>
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

To conform with QEMU coding style.
Signed-off-by: NPeter Crosthwaite <peter.crosthwaite@xilinx.com>
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Trivial find replace on type names "timerblock" and "arm_mptimer_state" to
conform with QEMU coding style.
Signed-off-by: NPeter Crosthwaite <peter.crosthwaite@xilinx.com>
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

The code for handling the default "unknown command state" case in
pflash_read in pflash_cfi01.c comments "reset state & treat it as
a read". However the code doesn't actually do this. Moving the
default case to the top of the switch so it can fall through into
the read case brings this file into line with pflash_cfi02 and
makes the code behave as the comments suggest.

The pflash_cfi01 code has always had this bug -- it was presumably
introduced when the original author copied the cfi02 code and
rearranged the order of the switch statement without noticing
that the default case relied on the fall-through.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Reviewed-by: NPeter Crosthwaite <peter.crosthwaite@xilinx.com>
Tested-by: NPeter Crosthwaite <peter.crosthwaite@xilinx.com>
Message-id: 1358777318-7579-3-git-send-email-peter.maydell@linaro.org

The Intel flash command set requires that a read operation after
doing a 'single byte write' command returns the status register;
add this case to pflash_read() so we return the correct information.
Similarly, the case for the 0x28 flavour of block erase was missing.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Reviewed-by: NPeter Crosthwaite <peter.crosthwaite@xilinx.com>
Tested-by: NPeter Crosthwaite <peter.crosthwaite@xilinx.com>
Message-id: 1358777318-7579-2-git-send-email-peter.maydell@linaro.org

The proper mapping between 24 hours and 12 hours modes is:
0       12 AM
1-11    1-11 AM
12      12 PM
13-23   1-11 PM
Fix code accordingly.
Signed-off-by: NAntoine Mathys <barsamin@gmail.com>
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

These correspond very closely to the insns that we're emulating.
Signed-off-by: NRichard Henderson <rth@twiddle.net>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

# By Jan Kiszka
# Via Jan Kiszka
* kiszka/queues/slirp:
  slirp: Properly initialize pollfds_idx of new sockets

Older glib doesn't implement g_poll(). Most notably the glib version in use
on SLE11 is on 2.18 which is hit by this.

We do want to use g_poll() in the source however. So on older systems, just
wrap it with functions that do exist on older versions.
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>
Signed-off-by: NAlexander Graf <agraf@suse.de>
Message-id: 1361835970-2889-1-git-send-email-agraf@suse.de
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Switch the default for qemu_log logging output from "/tmp/qemu.log"
to stderr. This is an incompatible change in some sense, but logging
is mostly used for debugging purposes so it shouldn't affect production
use. The previous behaviour can be obtained by adding "-D /tmp/qemu.log"
to the command line.

This change requires us to:
 * update all the documentation/help text (we take the opportunity
   to smooth out minor inconsistencies between the phrasing in
   linux-user/bsd-user/system help messages)
 * make linux-user and bsd-user defer to qemu-log for the default
   logging destination rather than overriding it themselves
 * ensure that all logfile closing is done via qemu_log_close()
   and that that function doesn't close stderr
as well as the obvious change to the behaviour of do_qemu_set_log()
when no logfile name has been specified.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Reviewed-by: NStefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: NMarkus Armbruster <armbru@redhat.com>
Message-id: 1361901160-28729-1-git-send-email-peter.maydell@linaro.org
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Signed-off-by: NHu Tao <hutao@cn.fujitsu.com>
Message-id: 1361759268-16314-1-git-send-email-hutao@cn.fujitsu.com
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

The GDK_KEY_XXX symbols are new in GTK3 and only the most
recent GTK2 releases. Most versions of GTK2 have simply
used GDK_XXX
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>
Message-id: 1361805646-6425-14-git-send-email-berrange@redhat.com
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

The gtk_widget_get_realized method only arrived in GTK 2.20,
so defined a compat macro for earlier GTK
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>
Message-id: 1361805646-6425-13-git-send-email-berrange@redhat.com
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Add a arg to configure to switch from GTK2 (default) to
GTK3 (optional) build for QEMU.

  ./configure --with-gtkabi=3.0

will choose GTK3, while

  ./configure --with-gtkabi=2.0

will choose GTK2 (and remains the current default)
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>
Message-id: 1361805646-6425-12-git-send-email-berrange@redhat.com
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

The x_keymap.o file is required by both GTK and SDL builds,
so it must be explicitly listed as a GTK dep to ensure the
linker works when SDL is disabled
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>
Message-id: 1361805646-6425-11-git-send-email-berrange@redhat.com
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

In GTK3 the 'expose-event' signal has been replaced by a new
'draw' signal. The only difference is that the latter will
pre-create the cairo drawing context & set the clip mask.
Since the drawing code is already structured in a nice way,
we can just wire up the 'gd_draw_event' method to the 'draw'
signal in GTK3
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>
Message-id: 1361805646-6425-10-git-send-email-berrange@redhat.com
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

The gtk_widget_size_request method has been replaced by
the gtk_widget_get_preferred_size method in GTK3. Conditionally
call the new method in GTK3
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>
Message-id: 1361805646-6425-9-git-send-email-berrange@redhat.com
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

In GTK3 the gdk_display_warp_pointer method is deprecated.
Instead we should use gdk_device_warp on the GdkDevice
instead associated with the event being processed.
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>
Message-id: 1361805646-6425-8-git-send-email-berrange@redhat.com
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

The gtk_menu_append method has long been deprecated in favour
of the gtk_menu_shell_append method. The former is now entirely
gone in GTK3, so switch all code to the latter which works on
both GTK2 and GTK3
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>
Message-id: 1361805646-6425-7-git-send-email-berrange@redhat.com
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

The GtkVBox class is deprecated, in favour of just using the
GtkBox class directly. Eventually even GtkBox will be
deprecated in favour of GtkGrid, but that is a bigger fix
which can wait.
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>
Message-id: 1361805646-6425-6-git-send-email-berrange@redhat.com
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

On GTK3 there is support for multiple pointer devices, so
rather than using  gdk_pointer_grab / gdk_pointer_ungrab
we should iterate over all devices, grabbing each one in
turn
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>
Message-id: 1361805646-6425-5-git-send-email-berrange@redhat.com
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

On GTK3 there is support for multiple keyboard devices, so
rather than using  gdk_keyboard_grab / gdk_keyboard_ungrab
we should iterate over all devices, grabbing each one in
turn
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>
Message-id: 1361805646-6425-4-git-send-email-berrange@redhat.com
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

The gdk_drawable_get_screen and gdk_drawable_get_display
methods don't exist in GDK3. Fortunately, even on GTK2
they are not required - we can call the equivalent
gtk_widget_get_screen/gtk_widget_get_display methods
which have existed since GTK 2.2
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>
Message-id: 1361805646-6425-3-git-send-email-berrange@redhat.com
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

GTK3 lacks the gdk_drawable_get_size method, so we create a
stub impl which gets the get_width/get_height mehtods instead
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>
Message-id: 1361805646-6425-2-git-send-email-berrange@redhat.com
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>