Copy the whole 0x1fe000000 region into 0x1fc00000, independently of the
loaded BIOS size. This fix the MIPS make check tests.
Reported-by: NAndreas Färber <afaerber@suse.de>
Tested-by: NAndreas Färber <afaerber@suse.de>
Cc: Paul Burton <paul.burton@imgtec.com>
Cc: Leon Alrae <leon.alrae@imgtec.com>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

sys_mremap missed 5th argument (new_address), which caused examples that
remap to a specific address to fail.
sys_splice missed 5th and 6th argument which caused different examples to
fail.
This change has an effect on MIPS target only.
Signed-off-by: NPetar Jovanovic <petar.jovanovic@imgtec.com>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

This assignment causes a compiler warning for compilations with the compiler
option -Wunused-but-set-variable (which is included with -Wextra).

Removing it allows using -Wextra for QEMU code without suppressing too many
extra warnings.
Signed-off-by: NStefan Weil <sw@weilnetz.de>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

This change corrects rounding and saturation of Q31 fractional value in
mipsdsp_trunc16_sat16_round(). Overflow detection was incorrect for the
corner case for PRECRQ_RS.PH, and this test case is also part of the change.
Signed-off-by: NPetar Jovanovic <petar.jovanovic@imgtec.com>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

The Linux kernel can be configured to use 64KB pages, but it also
requires initrd to be page aligned. Therefore, to be safe, align the
initrd to 64KB using a new INITRD_PAGE_MASK rather than
TARGET_PAGE_MASK.
Signed-off-by: NJames Hogan <james.hogan@imgtec.com>
Signed-off-by: NLeon Alrae <leon.alrae@imgtec.com>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

The firmware commonly used with MIPS Malta boards (YAMON) reads the
status of the pflash with a 32bit memory access. On real hardware
this results in the status byte being mirrored in the upper 16 bits
of the read value. For example if the status byte is represented by
SS then the hardware reads 0x00SS00SS. The YAMON firmware compares the
status against 32bit values expecting the mirrored value and fails
without it.
Signed-off-by: NPaul Burton <paul.burton@imgtec.com>
Signed-off-by: NLeon Alrae <leon.alrae@imgtec.com>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

The malta contains 2 EEPROMs, one containing SPD data for the SDRAM and
another containing board information such as serial number and MAC
address. These are both exposed via the PIIX4 SMBUS. Generating this
data and providing it to smbus_eeprom_init will allow YAMON to read a
serial number for the board and prevent it from warning that the EEPROM
data is invalid.

We already have the contents of the SPD EEPROM which are exposed via
FPGA I2C accesses, this is provided as part of the SMBUS EEPROM data
too for consistency.
Signed-off-by: NPaul Burton <paul.burton@imgtec.com>
Signed-off-by: NLeon Alrae <leon.alrae@imgtec.com>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

This preserves the final sector of the pflash which is used by YAMON to
hold environment variables. If the endianness of the environment data
is swapped then YAMON will fail to load environment variables from
pflash.
Signed-off-by: NPaul Burton <paul.burton@imgtec.com>
Signed-off-by: NLeon Alrae <leon.alrae@imgtec.com>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

The SPD EEPROM specifies the amount of memory present in the system and
thus its correct contents can only be known at runtime. Calculating
parts of the data on init allows the data to accurately reflect the
amount of target memory present and allow YAMON to boot with an
arbitrary amount of SDRAM.

Where possible the SPD data will favor indicating 2 banks of SDRAM
rather than 1. For example the default 128MB of target memory will be
represented as 2x64MB banks rather than 1x128MB bank. This allows
versions of MIPS BIOS code (such as YAMON 2.22 and older) to boot
despite a bug preventing them from handling a single bank of SDRAM with
the Galileo GT64120 system controller emulated by QEMU.
Signed-off-by: NPaul Burton <paul.burton@imgtec.com>
Signed-off-by: NLeon Alrae <leon.alrae@imgtec.com>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

Rather than modifying the BIOS code at its original location, copy it
for the 0x1fc00000 region & modify the copy. This means the original
ROM code is correctly readable at 0x1e000010 whilst the MIPS revision
is readable at 0x1fc00010.

Additionally the code previously operated on target memory which would
later be overwritten by the BIOS image upon CPU reset if the -bios
argument was used to specify the BIOS image. This led to the written
MIPS revision being lost. Copying using rom_copy when -bios is used
fixes this issue.
Signed-off-by: NPaul Burton <paul.burton@imgtec.com>
Signed-off-by: NLeon Alrae <leon.alrae@imgtec.com>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

If the target is little endian (mipsel) then the BIOS image endianness
is swapped so that the big endian BIOS binaries commonly produced can be
loaded correctly.

When using the -bios argument the BIOS is loaded using
load_image_targphys, however this doesn't perform the load to target
memory immediately. Instead it loads the BIOS file into a struct Rom
which will later be written to target memory upon reset. However the
endianness conversion was being performed before this, on init, and
operating on the target memory which at this point is blank & will later
be overwritten by the (big endian) BIOS image. Correct this by operating
on the data referenced by struct Rom rather than the target memory when
the -bios argument is used.
Signed-off-by: NPaul Burton <paul.burton@imgtec.com>
Signed-off-by: NLeon Alrae <leon.alrae@imgtec.com>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

Signed-off-by: NAndreas Färber <afaerber@suse.de>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

When a branch delay slot contains another branch instruction, the code
generated raises an exception, however since is_branch==1,
handle_delay_slot() doesn't get called immediately. This means
ctx->bstate isn't set to BS_BRANCH, and the decoder continues decoding
until a non-branch instruction is found.

If the first branch was a branch likely instruction then each
instruction after it generates code for the unlikely case, to go to the
next tb starting after the delay slot. This results in multiple goto_tb
tcg ops being generated with the same exit number. When debug is enabled
this hits:

tcg-op.h:2589: tcg_gen_goto_tb: Assertion `(tcg_ctx.goto_tb_issue_mask & (1 << idx)) == 0' failed.

This is fixed by removing is_branch entirely, and calling
handle_delay_slot() if (ctx.hflags & MIPS_HFLAG_BMASK) was set prior to
the current instruction being decoded. This still prevents
handle_delay_slot() being called immediately after a branch but allows
it to still be called after a branch within a delay slot.
Signed-off-by: NJames Hogan <james.hogan@imgtec.com>
Signed-off-by: NYongbok Kim <yongbok.kim@imgtec.com>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

Multiplication of Q15 fractional halfword vectors was incorrect in the
previous implementation of mipsdsp_rndq15_mul_q15_q15. It failed to take
element signs into account. This change fixes it, and it adds a test case
for it.

The change also removes unnecessary cast in the function
mipsdsp_mul_q15_q15_overflowflag21().
Signed-off-by: NPetar Jovanovic <petar.jovanovic@imgtec.com>
Reviewed-by: Richard Henderson  <rth@twiddle.net> 
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

QOM CPUState refactorings

* Fix cpu_memory_rw_debug() breakage in s390x KVM
* Replace final CPUArchState in sysemu/kvm.h
* Introduce model subclasses for XtensaCPU
* Introduce CPUClass::gdb_num[_core]_regs
* Introduce CPUClass::gdb_core_xml_file
* Introduce CPUClass::gdb_{read,write}_register()
* Propagate CPUState further in gdbstub

# gpg: Signature made Fri 26 Jul 2013 05:04:28 PM CDT using RSA key ID 3E7E013F
# gpg: Can't check signature: public key not found

# By Andreas Färber (23) and others
# Via Andreas Färber
* afaerber/tags/qom-cpu-for-anthony: (25 commits)
  cpu: Introduce CPUClass::gdb_core_xml_file for GDB_CORE_XML
  target-cris: Factor out CPUClass::gdb_read_register() hook for v10
  cpu: Introduce CPUClass::gdb_{read,write}_register()
  gdbstub: Replace GET_REG*() macros with gdb_get_reg*() functions
  target-xtensa: Move cpu_gdb_{read,write}_register()
  target-lm32: Move cpu_gdb_{read,write}_register()
  target-s390x: Move cpu_gdb_{read,write}_register()
  target-alpha: Move cpu_gdb_{read,write}_register()
  target-cris: Move cpu_gdb_{read,write}_register()
  target-microblaze: Move cpu_gdb_{read,write}_register()
  target-sh4: Move cpu_gdb_{read,write}_register()
  target-openrisc: Move cpu_gdb_{read,write}_register()
  target-mips: Move cpu_gdb_{read,write}_register()
  target-m68k: Move cpu_gdb_{read,write}_register()
  target-arm: Move cpu_gdb_{read,write}_register()
  target-sparc: Move cpu_gdb_{read,write}_register()
  target-ppc: Move cpu_gdb_{read,write}_register()
  target-i386: Move cpu_gdb_{read,write}_register()
  cpu: Introduce CPUState::gdb_num_regs and CPUClass::gdb_num_core_regs
  gdbstub: Drop dead code in cpu_gdb_{read,write}_register()
  ...

Replace the GDB_CORE_XML define in gdbstub.c with a CPUClass field.
Use first_cpu for qSupported and qXfer:features:read: for now.
Add a stub for xml_builtin.
Signed-off-by: NAndreas Färber <afaerber@suse.de>

Signed-off-by: NAndreas Färber <afaerber@suse.de>

Completes migration of target-specific code to new target-*/gdbstub.c.

Acked-by: Michael Walle <michael@walle.cc> (for lm32)
Acked-by: Max Filippov <jcmvbkbc@gmail.com> (for xtensa)
Signed-off-by: NAndreas Färber <afaerber@suse.de>

This avoids polluting the global namespace with a non-prefixed macro and
makes it obvious in the call sites that we return.

Semi-automatic conversion using, e.g.,
 sed -i 's/GET_REGL(/return gdb_get_regl(mem_buf, /g' target-*/gdbstub.c
followed by manual tweaking for sparc's GET_REGA() and Coding Style.

Acked-by: Michael Walle <michael@walle.cc> (for lm32)
Acked-by: Max Filippov <jcmvbkbc@gmail.com> (for xtensa)
Signed-off-by: NAndreas Färber <afaerber@suse.de>

Acked-by: NMax Filippov <jcmvbkbc@gmail.com>
Signed-off-by: NAndreas Färber <afaerber@suse.de>

Acked-by: NMichael Walle <michael@walle.cc>
Signed-off-by: NAndreas Färber <afaerber@suse.de>

Signed-off-by: NAndreas Färber <afaerber@suse.de>

Signed-off-by: NAndreas Färber <afaerber@suse.de>

Signed-off-by: NAndreas Färber <afaerber@suse.de>

Signed-off-by: NAndreas Färber <afaerber@suse.de>

Signed-off-by: NAndreas Färber <afaerber@suse.de>

Reviewed-by: NJia Liu <proljc@gmail.com>
Signed-off-by: NAndreas Färber <afaerber@suse.de>

Currently the graphics resolution for TCX is fixed at 1024x768, however
other framebuffers are capable of supporting additional resolutions.
Signed-off-by: NMark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
CC: Anthony Liguori <aliguori@us.ibm.com>
CC: Blue Swirl <blauwirbel@gmail.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

# By Kevin Wolf (16) and Ian Main (2)
# Via Kevin Wolf
* kwolf/for-anthony:
  Add tests for sync modes 'TOP' and 'NONE'
  Implement sync modes for drive-backup.
  Implement qdict_flatten()
  blockdev: Split up 'cache' option
  blockdev: Rename 'readonly' option to 'read-only'
  qcow2: Use dashes instead of underscores in options
  blockdev: Rename I/O throttling options for QMP
  QemuOpts: Add qemu_opt_unset()
  block: Allow "driver" option on the top level
  qapi: Anonymous unions
  qapi.py: Maintain a list of union types
  qapi: Add consume argument to qmp_input_get_object()
  qapi: Flat unions with arbitrary discriminator
  qapi: Add visitor for implicit structs
  docs: Document QAPI union types
  qapi-visit.py: Implement 'base' for unions
  qapi-visit.py: Split off generate_visit_struct_fields()
  qapi-types.py: Implement 'base' for unions

Message-id: 1374870032-31672-1-git-send-email-kwolf@redhat.com
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

v3 update:
 - reincluding getrlimit(), it is used by Xen.

v2 update:
 - reincluding setrlimit(), it is used by Xen.
Signed-off-by: NEduardo Otubo <otubo@linux.vnet.ibm.com>
Reviewed-by: NPaolo Bonzini <pbonzini@redhat.com>
Message-id: 1374518017-10424-3-git-send-email-otubo@linux.vnet.ibm.com
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

v2 update:
- set libseccomp 2.1.0 as requirement on configure script.

Since libseccomp 2.0 there's no need to check the architecture type
anymore.
Signed-off-by: NEduardo Otubo <otubo@linux.vnet.ibm.com>
Reviewed-by: NPaolo Bonzini <pbonzini@redhat.com>
Message-id: 1374518017-10424-2-git-send-email-otubo@linux.vnet.ibm.com
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Signed-off-by: NAndreas Färber <afaerber@suse.de>

Signed-off-by: NAndreas Färber <afaerber@suse.de>

Signed-off-by: NAndreas Färber <afaerber@suse.de>

Signed-off-by: NAndreas Färber <afaerber@suse.de>

Signed-off-by: NAndreas Färber <afaerber@suse.de>

Signed-off-by: NAndreas Färber <afaerber@suse.de>

CPUState::gdb_num_regs replaces num_g_regs.
CPUClass::gdb_num_core_regs replaces NUM_CORE_REGS.

Allows building gdb_register_coprocessor() for xtensa, too.

As a side effect this should fix coprocessor register numbering for SMP.

Acked-by: Michael Walle <michael@walle.cc> (for lm32)
Acked-by: Max Filippov <jcmvbkbc@gmail.com> (for xtensa)
Signed-off-by: NAndreas Färber <afaerber@suse.de>

GET_REG*() macros include a return statement, thus no need for break.

Acked-by: Michael Walle <michael@walle.cc> (for lm32)
Signed-off-by: NAndreas Färber <afaerber@suse.de>

Add braces, replace tabs, remove trailing whitespace, drop space before
parenthesis and place break etc. below case statements.
Signed-off-by: NAndreas Färber <afaerber@suse.de>