All of lore.kernel.org
 help / color / mirror / Atom feed
* [Qemu-devel] [PATCH v2 00/23] SMM improvements (chipset and TCG parts)
@ 2015-06-03 17:08 Paolo Bonzini
  2015-06-03 17:08 ` [Qemu-devel] [PATCH v2 01/23] target-i386: introduce cpu_get_mem_attrs Paolo Bonzini
                   ` (24 more replies)
  0 siblings, 25 replies; 49+ messages in thread
From: Paolo Bonzini @ 2015-06-03 17:08 UTC (permalink / raw)
  To: qemu-devel; +Cc: lersek, kraxel, mst

These are the patches that I would like to send a pull request
as soon as possible.  KVM support still needs to wait for the
kernel code to be committed.

I asked Michael to let me send a pull request for this instead
of going through the PC tree; this is to let him take a final
look at the patches.

Paolo

Gerd Hoffmann (6):
  q35: fix ESMRAMC default
  q35: add config space wmask for SMRAM and ESMRAMC
  q35: implement SMRAM.D_LCK
  q35: add test for SMRAM.D_LCK
  q35: implement TSEG
  ich9: implement SMI_LOCK

Paolo Bonzini (17):
  target-i386: introduce cpu_get_mem_attrs
  target-i386: Use correct memory attributes for memory accesses
  target-i386: Use correct memory attributes for ioport accesses
  target-i386: mask NMIs on entry to SMM
  target-i386: set G=1 in SMM big real mode selectors
  target-i386: wake up processors that receive an SMI
  pflash_cfi01: change big-endian property to BIT type
  pflash_cfi01: change to new-style MMIO accessors
  pflash_cfi01: add secure property
  vl: allow full-blown QemuOpts syntax for -global
  qom: add object_property_add_const_link
  vl: run "late" notifiers immediately
  target-i386: create a separate AddressSpace for each CPU
  hw/i386: add a separate region that tracks the SMRAME bit
  target-i386: use memory API to implement SMRAM
  hw/i386: remove smram_update
  q35: implement high SMRAM

 bsd-user/main.c           |   4 -
 hw/acpi/ich9.c            |   4 +-
 hw/block/pflash_cfi01.c   | 204 +++++++++++-----------------
 hw/i386/pc.c              |  21 ---
 hw/isa/lpc_ich9.c         |  19 +++
 hw/pci-host/pam.c         |  20 ---
 hw/pci-host/piix.c        |  44 +++---
 hw/pci-host/q35.c         | 142 +++++++++++++++++---
 include/exec/memattrs.h   |   4 +-
 include/hw/acpi/ich9.h    |   1 +
 include/hw/i386/ich9.h    |   6 +
 include/hw/i386/pc.h      |   1 -
 include/hw/pci-host/pam.h |   4 -
 include/hw/pci-host/q35.h |  36 +++--
 include/qom/object.h      |  18 +++
 linux-user/main.c         |   4 -
 qdev-monitor.c            |  18 ++-
 qemu-options.hx           |   7 +-
 qom/object.c              |  16 +++
 target-i386/Makefile.objs |   2 -
 target-i386/cpu-qom.h     |   3 +
 target-i386/cpu.c         |  47 ++++++-
 target-i386/cpu.h         |  40 ++++--
 target-i386/helper.c      | 135 ++++++++++++++++---
 target-i386/helper.h      |  12 +-
 target-i386/ioport-user.c |  60 ---------
 target-i386/kvm.c         |   2 +-
 target-i386/machine.c     |   3 +
 target-i386/misc_helper.c |  59 ++++++--
 target-i386/seg_helper.c  |  12 +-
 target-i386/smm_helper.c  | 333 ++++++++++++++++++++++++----------------------
 target-i386/svm_helper.c  | 230 ++++++++++++++++----------------
 target-i386/translate.c   |  12 +-
 tests/Makefile            |   3 +
 tests/q35-test.c          |  91 +++++++++++++
 vl.c                      |   6 +
 36 files changed, 989 insertions(+), 634 deletions(-)
 delete mode 100644 target-i386/ioport-user.c
 create mode 100644 tests/q35-test.c

-- 
2.4.1

^ permalink raw reply	[flat|nested] 49+ messages in thread

* [Qemu-devel] [PATCH v2 01/23] target-i386: introduce cpu_get_mem_attrs
  2015-06-03 17:08 [Qemu-devel] [PATCH v2 00/23] SMM improvements (chipset and TCG parts) Paolo Bonzini
@ 2015-06-03 17:08 ` Paolo Bonzini
  2015-06-03 17:08 ` [Qemu-devel] [PATCH v2 02/23] target-i386: Use correct memory attributes for memory accesses Paolo Bonzini
                   ` (23 subsequent siblings)
  24 siblings, 0 replies; 49+ messages in thread
From: Paolo Bonzini @ 2015-06-03 17:08 UTC (permalink / raw)
  To: qemu-devel; +Cc: lersek, kraxel, mst

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 include/exec/memattrs.h | 4 +++-
 target-i386/cpu.h       | 5 +++++
 target-i386/helper.c    | 3 ++-
 target-i386/kvm.c       | 2 +-
 4 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/include/exec/memattrs.h b/include/exec/memattrs.h
index 96dc440..f8537a8 100644
--- a/include/exec/memattrs.h
+++ b/include/exec/memattrs.h
@@ -29,7 +29,9 @@ typedef struct MemTxAttrs {
      * "didn't specify" if necessary.
      */
     unsigned int unspecified:1;
-    /* ARM/AMBA TrustZone Secure access */
+    /* ARM/AMBA: TrustZone Secure access
+     * x86: System Management Mode access
+     */
     unsigned int secure:1;
     /* Memory access is usermode (unprivileged) */
     unsigned int user:1;
diff --git a/target-i386/cpu.h b/target-i386/cpu.h
index 4ee12ca..64c2783 100644
--- a/target-i386/cpu.h
+++ b/target-i386/cpu.h
@@ -1292,6 +1292,11 @@ static inline void cpu_load_efer(CPUX86State *env, uint64_t val)
     }
 }
 
+static inline MemTxAttrs cpu_get_mem_attrs(CPUX86State *env)
+{
+    return ((MemTxAttrs) { .secure = (env->hflags & HF_SMM_MASK) != 0 });
+}
+
 /* fpu_helper.c */
 void cpu_set_mxcsr(CPUX86State *env, uint32_t val);
 void cpu_set_fpuc(CPUX86State *env, uint16_t val);
diff --git a/target-i386/helper.c b/target-i386/helper.c
index 4f1ddf7..62e801b 100644
--- a/target-i386/helper.c
+++ b/target-i386/helper.c
@@ -771,7 +771,8 @@ do_check_protect_pse36:
     page_offset = vaddr & (page_size - 1);
     paddr = pte + page_offset;
 
-    tlb_set_page(cs, vaddr, paddr, prot, mmu_idx, page_size);
+    tlb_set_page_with_attrs(cs, vaddr, paddr, cpu_get_mem_attrs(env),
+                            prot, mmu_idx, page_size);
     return 0;
  do_fault_rsvd:
     error_code |= PG_ERROR_RSVD_MASK;
diff --git a/target-i386/kvm.c b/target-i386/kvm.c
index a26d25a..009bf74 100644
--- a/target-i386/kvm.c
+++ b/target-i386/kvm.c
@@ -2259,7 +2259,7 @@ MemTxAttrs kvm_arch_post_run(CPUState *cpu, struct kvm_run *run)
     }
     cpu_set_apic_tpr(x86_cpu->apic_state, run->cr8);
     cpu_set_apic_base(x86_cpu->apic_state, run->apic_base);
-    return MEMTXATTRS_UNSPECIFIED;
+    return cpu_get_mem_attrs(env);
 }
 
 int kvm_arch_process_async_events(CPUState *cs)
-- 
2.4.1

^ permalink raw reply related	[flat|nested] 49+ messages in thread

* [Qemu-devel] [PATCH v2 02/23] target-i386: Use correct memory attributes for memory accesses
  2015-06-03 17:08 [Qemu-devel] [PATCH v2 00/23] SMM improvements (chipset and TCG parts) Paolo Bonzini
  2015-06-03 17:08 ` [Qemu-devel] [PATCH v2 01/23] target-i386: introduce cpu_get_mem_attrs Paolo Bonzini
@ 2015-06-03 17:08 ` Paolo Bonzini
  2015-06-03 17:08 ` [Qemu-devel] [PATCH v2 03/23] target-i386: Use correct memory attributes for ioport accesses Paolo Bonzini
                   ` (22 subsequent siblings)
  24 siblings, 0 replies; 49+ messages in thread
From: Paolo Bonzini @ 2015-06-03 17:08 UTC (permalink / raw)
  To: qemu-devel; +Cc: lersek, kraxel, mst

These include page table walks, SVM accesses and SMM state save accesses.

The bulk of the patch is obtained with

   sed -i 's/\(\<[a-z_]*_phys\(_notdirty\)\?\>(cs\)->as,/x86_\1,/'

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target-i386/cpu.h        |  12 ++
 target-i386/helper.c     | 132 +++++++++++++++++----
 target-i386/seg_helper.c |  12 +-
 target-i386/smm_helper.c | 298 +++++++++++++++++++++++------------------------
 target-i386/svm_helper.c | 230 ++++++++++++++++++------------------
 5 files changed, 394 insertions(+), 290 deletions(-)

diff --git a/target-i386/cpu.h b/target-i386/cpu.h
index 64c2783..9f57fe9 100644
--- a/target-i386/cpu.h
+++ b/target-i386/cpu.h
@@ -1105,6 +1105,18 @@ int x86_cpu_handle_mmu_fault(CPUState *cpu, vaddr addr,
                              int is_write, int mmu_idx);
 void x86_cpu_set_a20(X86CPU *cpu, int a20_state);
 
+#ifndef CONFIG_USER_ONLY
+uint8_t x86_ldub_phys(CPUState *cs, hwaddr addr);
+uint32_t x86_lduw_phys(CPUState *cs, hwaddr addr);
+uint32_t x86_ldl_phys(CPUState *cs, hwaddr addr);
+uint64_t x86_ldq_phys(CPUState *cs, hwaddr addr);
+void x86_stb_phys(CPUState *cs, hwaddr addr, uint8_t val);
+void x86_stl_phys_notdirty(CPUState *cs, hwaddr addr, uint32_t val);
+void x86_stw_phys(CPUState *cs, hwaddr addr, uint32_t val);
+void x86_stl_phys(CPUState *cs, hwaddr addr, uint32_t val);
+void x86_stq_phys(CPUState *cs, hwaddr addr, uint64_t val);
+#endif
+
 static inline bool hw_local_breakpoint_enabled(unsigned long dr7, int index)
 {
     return (dr7 >> (index * 2)) & 1;
diff --git a/target-i386/helper.c b/target-i386/helper.c
index 62e801b..5480a96 100644
--- a/target-i386/helper.c
+++ b/target-i386/helper.c
@@ -565,7 +565,7 @@ int x86_cpu_handle_mmu_fault(CPUState *cs, vaddr addr,
 
             pml4e_addr = ((env->cr[3] & ~0xfff) + (((addr >> 39) & 0x1ff) << 3)) &
                 env->a20_mask;
-            pml4e = ldq_phys(cs->as, pml4e_addr);
+            pml4e = x86_ldq_phys(cs, pml4e_addr);
             if (!(pml4e & PG_PRESENT_MASK)) {
                 goto do_fault;
             }
@@ -574,12 +574,12 @@ int x86_cpu_handle_mmu_fault(CPUState *cs, vaddr addr,
             }
             if (!(pml4e & PG_ACCESSED_MASK)) {
                 pml4e |= PG_ACCESSED_MASK;
-                stl_phys_notdirty(cs->as, pml4e_addr, pml4e);
+                x86_stl_phys_notdirty(cs, pml4e_addr, pml4e);
             }
             ptep = pml4e ^ PG_NX_MASK;
             pdpe_addr = ((pml4e & PG_ADDRESS_MASK) + (((addr >> 30) & 0x1ff) << 3)) &
                 env->a20_mask;
-            pdpe = ldq_phys(cs->as, pdpe_addr);
+            pdpe = x86_ldq_phys(cs, pdpe_addr);
             if (!(pdpe & PG_PRESENT_MASK)) {
                 goto do_fault;
             }
@@ -589,7 +589,7 @@ int x86_cpu_handle_mmu_fault(CPUState *cs, vaddr addr,
             ptep &= pdpe ^ PG_NX_MASK;
             if (!(pdpe & PG_ACCESSED_MASK)) {
                 pdpe |= PG_ACCESSED_MASK;
-                stl_phys_notdirty(cs->as, pdpe_addr, pdpe);
+                x86_stl_phys_notdirty(cs, pdpe_addr, pdpe);
             }
             if (pdpe & PG_PSE_MASK) {
                 /* 1 GB page */
@@ -604,7 +604,7 @@ int x86_cpu_handle_mmu_fault(CPUState *cs, vaddr addr,
             /* XXX: load them when cr3 is loaded ? */
             pdpe_addr = ((env->cr[3] & ~0x1f) + ((addr >> 27) & 0x18)) &
                 env->a20_mask;
-            pdpe = ldq_phys(cs->as, pdpe_addr);
+            pdpe = x86_ldq_phys(cs, pdpe_addr);
             if (!(pdpe & PG_PRESENT_MASK)) {
                 goto do_fault;
             }
@@ -617,7 +617,7 @@ int x86_cpu_handle_mmu_fault(CPUState *cs, vaddr addr,
 
         pde_addr = ((pdpe & PG_ADDRESS_MASK) + (((addr >> 21) & 0x1ff) << 3)) &
             env->a20_mask;
-        pde = ldq_phys(cs->as, pde_addr);
+        pde = x86_ldq_phys(cs, pde_addr);
         if (!(pde & PG_PRESENT_MASK)) {
             goto do_fault;
         }
@@ -635,11 +635,11 @@ int x86_cpu_handle_mmu_fault(CPUState *cs, vaddr addr,
         /* 4 KB page */
         if (!(pde & PG_ACCESSED_MASK)) {
             pde |= PG_ACCESSED_MASK;
-            stl_phys_notdirty(cs->as, pde_addr, pde);
+            x86_stl_phys_notdirty(cs, pde_addr, pde);
         }
         pte_addr = ((pde & PG_ADDRESS_MASK) + (((addr >> 12) & 0x1ff) << 3)) &
             env->a20_mask;
-        pte = ldq_phys(cs->as, pte_addr);
+        pte = x86_ldq_phys(cs, pte_addr);
         if (!(pte & PG_PRESENT_MASK)) {
             goto do_fault;
         }
@@ -655,7 +655,7 @@ int x86_cpu_handle_mmu_fault(CPUState *cs, vaddr addr,
         /* page directory entry */
         pde_addr = ((env->cr[3] & ~0xfff) + ((addr >> 20) & 0xffc)) &
             env->a20_mask;
-        pde = ldl_phys(cs->as, pde_addr);
+        pde = x86_ldl_phys(cs, pde_addr);
         if (!(pde & PG_PRESENT_MASK)) {
             goto do_fault;
         }
@@ -676,13 +676,13 @@ int x86_cpu_handle_mmu_fault(CPUState *cs, vaddr addr,
 
         if (!(pde & PG_ACCESSED_MASK)) {
             pde |= PG_ACCESSED_MASK;
-            stl_phys_notdirty(cs->as, pde_addr, pde);
+            x86_stl_phys_notdirty(cs, pde_addr, pde);
         }
 
         /* page directory entry */
         pte_addr = ((pde & ~0xfff) + ((addr >> 10) & 0xffc)) &
             env->a20_mask;
-        pte = ldl_phys(cs->as, pte_addr);
+        pte = x86_ldl_phys(cs, pte_addr);
         if (!(pte & PG_PRESENT_MASK)) {
             goto do_fault;
         }
@@ -737,7 +737,7 @@ do_check_protect_pse36:
         if (is_dirty) {
             pte |= PG_DIRTY_MASK;
         }
-        stl_phys_notdirty(cs->as, pte_addr, pte);
+        x86_stl_phys_notdirty(cs, pte_addr, pte);
     }
 
     /* the page can be put in the TLB */
@@ -789,7 +789,7 @@ do_check_protect_pse36:
         error_code |= PG_ERROR_I_D_MASK;
     if (env->intercept_exceptions & (1 << EXCP0E_PAGE)) {
         /* cr2 is not modified in case of exceptions */
-        stq_phys(cs->as,
+        x86_stq_phys(cs,
                  env->vm_vmcb + offsetof(struct vmcb, control.exit_info_2),
                  addr);
     } else {
@@ -828,13 +828,13 @@ hwaddr x86_cpu_get_phys_page_debug(CPUState *cs, vaddr addr)
             }
             pml4e_addr = ((env->cr[3] & ~0xfff) + (((addr >> 39) & 0x1ff) << 3)) &
                 env->a20_mask;
-            pml4e = ldq_phys(cs->as, pml4e_addr);
+            pml4e = x86_ldq_phys(cs, pml4e_addr);
             if (!(pml4e & PG_PRESENT_MASK)) {
                 return -1;
             }
             pdpe_addr = ((pml4e & PG_ADDRESS_MASK) +
                          (((addr >> 30) & 0x1ff) << 3)) & env->a20_mask;
-            pdpe = ldq_phys(cs->as, pdpe_addr);
+            pdpe = x86_ldq_phys(cs, pdpe_addr);
             if (!(pdpe & PG_PRESENT_MASK)) {
                 return -1;
             }
@@ -849,14 +849,14 @@ hwaddr x86_cpu_get_phys_page_debug(CPUState *cs, vaddr addr)
         {
             pdpe_addr = ((env->cr[3] & ~0x1f) + ((addr >> 27) & 0x18)) &
                 env->a20_mask;
-            pdpe = ldq_phys(cs->as, pdpe_addr);
+            pdpe = x86_ldq_phys(cs, pdpe_addr);
             if (!(pdpe & PG_PRESENT_MASK))
                 return -1;
         }
 
         pde_addr = ((pdpe & PG_ADDRESS_MASK) +
                     (((addr >> 21) & 0x1ff) << 3)) & env->a20_mask;
-        pde = ldq_phys(cs->as, pde_addr);
+        pde = x86_ldq_phys(cs, pde_addr);
         if (!(pde & PG_PRESENT_MASK)) {
             return -1;
         }
@@ -869,7 +869,7 @@ hwaddr x86_cpu_get_phys_page_debug(CPUState *cs, vaddr addr)
             pte_addr = ((pde & PG_ADDRESS_MASK) +
                         (((addr >> 12) & 0x1ff) << 3)) & env->a20_mask;
             page_size = 4096;
-            pte = ldq_phys(cs->as, pte_addr);
+            pte = x86_ldq_phys(cs, pte_addr);
         }
         if (!(pte & PG_PRESENT_MASK)) {
             return -1;
@@ -879,7 +879,7 @@ hwaddr x86_cpu_get_phys_page_debug(CPUState *cs, vaddr addr)
 
         /* page directory entry */
         pde_addr = ((env->cr[3] & ~0xfff) + ((addr >> 20) & 0xffc)) & env->a20_mask;
-        pde = ldl_phys(cs->as, pde_addr);
+        pde = x86_ldl_phys(cs, pde_addr);
         if (!(pde & PG_PRESENT_MASK))
             return -1;
         if ((pde & PG_PSE_MASK) && (env->cr[4] & CR4_PSE_MASK)) {
@@ -888,7 +888,7 @@ hwaddr x86_cpu_get_phys_page_debug(CPUState *cs, vaddr addr)
         } else {
             /* page directory entry */
             pte_addr = ((pde & ~0xfff) + ((addr >> 10) & 0xffc)) & env->a20_mask;
-            pte = ldl_phys(cs->as, pte_addr);
+            pte = x86_ldl_phys(cs, pte_addr);
             if (!(pte & PG_PRESENT_MASK)) {
                 return -1;
             }
@@ -1277,3 +1277,95 @@ void x86_cpu_exec_exit(CPUState *cs)
 
     env->eflags = cpu_compute_eflags(env);
 }
+
+#ifndef CONFIG_USER_ONLY
+uint8_t x86_ldub_phys(CPUState *cs, hwaddr addr)
+{
+    X86CPU *cpu = X86_CPU(cs);
+    CPUX86State *env = &cpu->env;
+
+    return address_space_ldub(cs->as, addr,
+                              cpu_get_mem_attrs(env),
+                              NULL);
+}
+
+uint32_t x86_lduw_phys(CPUState *cs, hwaddr addr)
+{
+    X86CPU *cpu = X86_CPU(cs);
+    CPUX86State *env = &cpu->env;
+
+    return address_space_lduw(cs->as, addr,
+                              cpu_get_mem_attrs(env),
+                              NULL);
+}
+
+uint32_t x86_ldl_phys(CPUState *cs, hwaddr addr)
+{
+    X86CPU *cpu = X86_CPU(cs);
+    CPUX86State *env = &cpu->env;
+
+    return address_space_ldl(cs->as, addr,
+                             cpu_get_mem_attrs(env),
+                             NULL);
+}
+
+uint64_t x86_ldq_phys(CPUState *cs, hwaddr addr)
+{
+    X86CPU *cpu = X86_CPU(cs);
+    CPUX86State *env = &cpu->env;
+
+    return address_space_ldq(cs->as, addr,
+                             cpu_get_mem_attrs(env),
+                             NULL);
+}
+
+void x86_stb_phys(CPUState *cs, hwaddr addr, uint8_t val)
+{
+    X86CPU *cpu = X86_CPU(cs);
+    CPUX86State *env = &cpu->env;
+
+    address_space_stb(cs->as, addr, val,
+                      cpu_get_mem_attrs(env),
+                      NULL);
+}
+
+void x86_stl_phys_notdirty(CPUState *cs, hwaddr addr, uint32_t val)
+{
+    X86CPU *cpu = X86_CPU(cs);
+    CPUX86State *env = &cpu->env;
+
+    address_space_stl_notdirty(cs->as, addr, val,
+                               cpu_get_mem_attrs(env),
+                               NULL);
+}
+
+void x86_stw_phys(CPUState *cs, hwaddr addr, uint32_t val)
+{
+    X86CPU *cpu = X86_CPU(cs);
+    CPUX86State *env = &cpu->env;
+
+    address_space_stw(cs->as, addr, val,
+                      cpu_get_mem_attrs(env),
+                      NULL);
+}
+
+void x86_stl_phys(CPUState *cs, hwaddr addr, uint32_t val)
+{
+    X86CPU *cpu = X86_CPU(cs);
+    CPUX86State *env = &cpu->env;
+
+    address_space_stl(cs->as, addr, val,
+                      cpu_get_mem_attrs(env),
+                      NULL);
+}
+
+void x86_stq_phys(CPUState *cs, hwaddr addr, uint64_t val)
+{
+    X86CPU *cpu = X86_CPU(cs);
+    CPUX86State *env = &cpu->env;
+
+    address_space_stq(cs->as, addr, val,
+                      cpu_get_mem_attrs(env),
+                      NULL);
+}
+#endif
diff --git a/target-i386/seg_helper.c b/target-i386/seg_helper.c
index 2bc757a..8a4271e 100644
--- a/target-i386/seg_helper.c
+++ b/target-i386/seg_helper.c
@@ -1144,7 +1144,7 @@ static void handle_even_inj(CPUX86State *env, int intno, int is_int,
                             int error_code, int is_hw, int rm)
 {
     CPUState *cs = CPU(x86_env_get_cpu(env));
-    uint32_t event_inj = ldl_phys(cs->as, env->vm_vmcb + offsetof(struct vmcb,
+    uint32_t event_inj = x86_ldl_phys(cs, env->vm_vmcb + offsetof(struct vmcb,
                                                           control.event_inj));
 
     if (!(event_inj & SVM_EVTINJ_VALID)) {
@@ -1158,11 +1158,11 @@ static void handle_even_inj(CPUX86State *env, int intno, int is_int,
         event_inj = intno | type | SVM_EVTINJ_VALID;
         if (!rm && exception_has_error_code(intno)) {
             event_inj |= SVM_EVTINJ_VALID_ERR;
-            stl_phys(cs->as, env->vm_vmcb + offsetof(struct vmcb,
+            x86_stl_phys(cs, env->vm_vmcb + offsetof(struct vmcb,
                                              control.event_inj_err),
                      error_code);
         }
-        stl_phys(cs->as,
+        x86_stl_phys(cs,
                  env->vm_vmcb + offsetof(struct vmcb, control.event_inj),
                  event_inj);
     }
@@ -1240,11 +1240,11 @@ static void do_interrupt_all(X86CPU *cpu, int intno, int is_int,
 #if !defined(CONFIG_USER_ONLY)
     if (env->hflags & HF_SVMI_MASK) {
         CPUState *cs = CPU(cpu);
-        uint32_t event_inj = ldl_phys(cs->as, env->vm_vmcb +
+        uint32_t event_inj = x86_ldl_phys(cs, env->vm_vmcb +
                                       offsetof(struct vmcb,
                                                control.event_inj));
 
-        stl_phys(cs->as,
+        x86_stl_phys(cs,
                  env->vm_vmcb + offsetof(struct vmcb, control.event_inj),
                  event_inj & ~SVM_EVTINJ_VALID);
     }
@@ -1339,7 +1339,7 @@ bool x86_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
             int intno;
             /* FIXME: this should respect TPR */
             cpu_svm_check_intercept_param(env, SVM_EXIT_VINTR, 0);
-            intno = ldl_phys(cs->as, env->vm_vmcb
+            intno = x86_ldl_phys(cs, env->vm_vmcb
                              + offsetof(struct vmcb, control.int_vector));
             qemu_log_mask(CPU_LOG_TB_IN_ASM,
                           "Servicing virtual hardware INT=0x%02x\n", intno);
diff --git a/target-i386/smm_helper.c b/target-i386/smm_helper.c
index c62f468..b9971b6 100644
--- a/target-i386/smm_helper.c
+++ b/target-i386/smm_helper.c
@@ -60,83 +60,83 @@ void do_smm_enter(X86CPU *cpu)
     for (i = 0; i < 6; i++) {
         dt = &env->segs[i];
         offset = 0x7e00 + i * 16;
-        stw_phys(cs->as, sm_state + offset, dt->selector);
-        stw_phys(cs->as, sm_state + offset + 2, (dt->flags >> 8) & 0xf0ff);
-        stl_phys(cs->as, sm_state + offset + 4, dt->limit);
-        stq_phys(cs->as, sm_state + offset + 8, dt->base);
+        x86_stw_phys(cs, sm_state + offset, dt->selector);
+        x86_stw_phys(cs, sm_state + offset + 2, (dt->flags >> 8) & 0xf0ff);
+        x86_stl_phys(cs, sm_state + offset + 4, dt->limit);
+        x86_stq_phys(cs, sm_state + offset + 8, dt->base);
     }
 
-    stq_phys(cs->as, sm_state + 0x7e68, env->gdt.base);
-    stl_phys(cs->as, sm_state + 0x7e64, env->gdt.limit);
+    x86_stq_phys(cs, sm_state + 0x7e68, env->gdt.base);
+    x86_stl_phys(cs, sm_state + 0x7e64, env->gdt.limit);
 
-    stw_phys(cs->as, sm_state + 0x7e70, env->ldt.selector);
-    stq_phys(cs->as, sm_state + 0x7e78, env->ldt.base);
-    stl_phys(cs->as, sm_state + 0x7e74, env->ldt.limit);
-    stw_phys(cs->as, sm_state + 0x7e72, (env->ldt.flags >> 8) & 0xf0ff);
+    x86_stw_phys(cs, sm_state + 0x7e70, env->ldt.selector);
+    x86_stq_phys(cs, sm_state + 0x7e78, env->ldt.base);
+    x86_stl_phys(cs, sm_state + 0x7e74, env->ldt.limit);
+    x86_stw_phys(cs, sm_state + 0x7e72, (env->ldt.flags >> 8) & 0xf0ff);
 
-    stq_phys(cs->as, sm_state + 0x7e88, env->idt.base);
-    stl_phys(cs->as, sm_state + 0x7e84, env->idt.limit);
+    x86_stq_phys(cs, sm_state + 0x7e88, env->idt.base);
+    x86_stl_phys(cs, sm_state + 0x7e84, env->idt.limit);
 
-    stw_phys(cs->as, sm_state + 0x7e90, env->tr.selector);
-    stq_phys(cs->as, sm_state + 0x7e98, env->tr.base);
-    stl_phys(cs->as, sm_state + 0x7e94, env->tr.limit);
-    stw_phys(cs->as, sm_state + 0x7e92, (env->tr.flags >> 8) & 0xf0ff);
+    x86_stw_phys(cs, sm_state + 0x7e90, env->tr.selector);
+    x86_stq_phys(cs, sm_state + 0x7e98, env->tr.base);
+    x86_stl_phys(cs, sm_state + 0x7e94, env->tr.limit);
+    x86_stw_phys(cs, sm_state + 0x7e92, (env->tr.flags >> 8) & 0xf0ff);
 
-    stq_phys(cs->as, sm_state + 0x7ed0, env->efer);
+    x86_stq_phys(cs, sm_state + 0x7ed0, env->efer);
 
-    stq_phys(cs->as, sm_state + 0x7ff8, env->regs[R_EAX]);
-    stq_phys(cs->as, sm_state + 0x7ff0, env->regs[R_ECX]);
-    stq_phys(cs->as, sm_state + 0x7fe8, env->regs[R_EDX]);
-    stq_phys(cs->as, sm_state + 0x7fe0, env->regs[R_EBX]);
-    stq_phys(cs->as, sm_state + 0x7fd8, env->regs[R_ESP]);
-    stq_phys(cs->as, sm_state + 0x7fd0, env->regs[R_EBP]);
-    stq_phys(cs->as, sm_state + 0x7fc8, env->regs[R_ESI]);
-    stq_phys(cs->as, sm_state + 0x7fc0, env->regs[R_EDI]);
+    x86_stq_phys(cs, sm_state + 0x7ff8, env->regs[R_EAX]);
+    x86_stq_phys(cs, sm_state + 0x7ff0, env->regs[R_ECX]);
+    x86_stq_phys(cs, sm_state + 0x7fe8, env->regs[R_EDX]);
+    x86_stq_phys(cs, sm_state + 0x7fe0, env->regs[R_EBX]);
+    x86_stq_phys(cs, sm_state + 0x7fd8, env->regs[R_ESP]);
+    x86_stq_phys(cs, sm_state + 0x7fd0, env->regs[R_EBP]);
+    x86_stq_phys(cs, sm_state + 0x7fc8, env->regs[R_ESI]);
+    x86_stq_phys(cs, sm_state + 0x7fc0, env->regs[R_EDI]);
     for (i = 8; i < 16; i++) {
-        stq_phys(cs->as, sm_state + 0x7ff8 - i * 8, env->regs[i]);
+        x86_stq_phys(cs, sm_state + 0x7ff8 - i * 8, env->regs[i]);
     }
-    stq_phys(cs->as, sm_state + 0x7f78, env->eip);
-    stl_phys(cs->as, sm_state + 0x7f70, cpu_compute_eflags(env));
-    stl_phys(cs->as, sm_state + 0x7f68, env->dr[6]);
-    stl_phys(cs->as, sm_state + 0x7f60, env->dr[7]);
+    x86_stq_phys(cs, sm_state + 0x7f78, env->eip);
+    x86_stl_phys(cs, sm_state + 0x7f70, cpu_compute_eflags(env));
+    x86_stl_phys(cs, sm_state + 0x7f68, env->dr[6]);
+    x86_stl_phys(cs, sm_state + 0x7f60, env->dr[7]);
 
-    stl_phys(cs->as, sm_state + 0x7f48, env->cr[4]);
-    stq_phys(cs->as, sm_state + 0x7f50, env->cr[3]);
-    stl_phys(cs->as, sm_state + 0x7f58, env->cr[0]);
+    x86_stl_phys(cs, sm_state + 0x7f48, env->cr[4]);
+    x86_stq_phys(cs, sm_state + 0x7f50, env->cr[3]);
+    x86_stl_phys(cs, sm_state + 0x7f58, env->cr[0]);
 
-    stl_phys(cs->as, sm_state + 0x7efc, SMM_REVISION_ID);
-    stl_phys(cs->as, sm_state + 0x7f00, env->smbase);
+    x86_stl_phys(cs, sm_state + 0x7efc, SMM_REVISION_ID);
+    x86_stl_phys(cs, sm_state + 0x7f00, env->smbase);
 #else
-    stl_phys(cs->as, sm_state + 0x7ffc, env->cr[0]);
-    stl_phys(cs->as, sm_state + 0x7ff8, env->cr[3]);
-    stl_phys(cs->as, sm_state + 0x7ff4, cpu_compute_eflags(env));
-    stl_phys(cs->as, sm_state + 0x7ff0, env->eip);
-    stl_phys(cs->as, sm_state + 0x7fec, env->regs[R_EDI]);
-    stl_phys(cs->as, sm_state + 0x7fe8, env->regs[R_ESI]);
-    stl_phys(cs->as, sm_state + 0x7fe4, env->regs[R_EBP]);
-    stl_phys(cs->as, sm_state + 0x7fe0, env->regs[R_ESP]);
-    stl_phys(cs->as, sm_state + 0x7fdc, env->regs[R_EBX]);
-    stl_phys(cs->as, sm_state + 0x7fd8, env->regs[R_EDX]);
-    stl_phys(cs->as, sm_state + 0x7fd4, env->regs[R_ECX]);
-    stl_phys(cs->as, sm_state + 0x7fd0, env->regs[R_EAX]);
-    stl_phys(cs->as, sm_state + 0x7fcc, env->dr[6]);
-    stl_phys(cs->as, sm_state + 0x7fc8, env->dr[7]);
-
-    stl_phys(cs->as, sm_state + 0x7fc4, env->tr.selector);
-    stl_phys(cs->as, sm_state + 0x7f64, env->tr.base);
-    stl_phys(cs->as, sm_state + 0x7f60, env->tr.limit);
-    stl_phys(cs->as, sm_state + 0x7f5c, (env->tr.flags >> 8) & 0xf0ff);
-
-    stl_phys(cs->as, sm_state + 0x7fc0, env->ldt.selector);
-    stl_phys(cs->as, sm_state + 0x7f80, env->ldt.base);
-    stl_phys(cs->as, sm_state + 0x7f7c, env->ldt.limit);
-    stl_phys(cs->as, sm_state + 0x7f78, (env->ldt.flags >> 8) & 0xf0ff);
-
-    stl_phys(cs->as, sm_state + 0x7f74, env->gdt.base);
-    stl_phys(cs->as, sm_state + 0x7f70, env->gdt.limit);
-
-    stl_phys(cs->as, sm_state + 0x7f58, env->idt.base);
-    stl_phys(cs->as, sm_state + 0x7f54, env->idt.limit);
+    x86_stl_phys(cs, sm_state + 0x7ffc, env->cr[0]);
+    x86_stl_phys(cs, sm_state + 0x7ff8, env->cr[3]);
+    x86_stl_phys(cs, sm_state + 0x7ff4, cpu_compute_eflags(env));
+    x86_stl_phys(cs, sm_state + 0x7ff0, env->eip);
+    x86_stl_phys(cs, sm_state + 0x7fec, env->regs[R_EDI]);
+    x86_stl_phys(cs, sm_state + 0x7fe8, env->regs[R_ESI]);
+    x86_stl_phys(cs, sm_state + 0x7fe4, env->regs[R_EBP]);
+    x86_stl_phys(cs, sm_state + 0x7fe0, env->regs[R_ESP]);
+    x86_stl_phys(cs, sm_state + 0x7fdc, env->regs[R_EBX]);
+    x86_stl_phys(cs, sm_state + 0x7fd8, env->regs[R_EDX]);
+    x86_stl_phys(cs, sm_state + 0x7fd4, env->regs[R_ECX]);
+    x86_stl_phys(cs, sm_state + 0x7fd0, env->regs[R_EAX]);
+    x86_stl_phys(cs, sm_state + 0x7fcc, env->dr[6]);
+    x86_stl_phys(cs, sm_state + 0x7fc8, env->dr[7]);
+
+    x86_stl_phys(cs, sm_state + 0x7fc4, env->tr.selector);
+    x86_stl_phys(cs, sm_state + 0x7f64, env->tr.base);
+    x86_stl_phys(cs, sm_state + 0x7f60, env->tr.limit);
+    x86_stl_phys(cs, sm_state + 0x7f5c, (env->tr.flags >> 8) & 0xf0ff);
+
+    x86_stl_phys(cs, sm_state + 0x7fc0, env->ldt.selector);
+    x86_stl_phys(cs, sm_state + 0x7f80, env->ldt.base);
+    x86_stl_phys(cs, sm_state + 0x7f7c, env->ldt.limit);
+    x86_stl_phys(cs, sm_state + 0x7f78, (env->ldt.flags >> 8) & 0xf0ff);
+
+    x86_stl_phys(cs, sm_state + 0x7f74, env->gdt.base);
+    x86_stl_phys(cs, sm_state + 0x7f70, env->gdt.limit);
+
+    x86_stl_phys(cs, sm_state + 0x7f58, env->idt.base);
+    x86_stl_phys(cs, sm_state + 0x7f54, env->idt.limit);
 
     for (i = 0; i < 6; i++) {
         dt = &env->segs[i];
@@ -145,15 +145,15 @@ void do_smm_enter(X86CPU *cpu)
         } else {
             offset = 0x7f2c + (i - 3) * 12;
         }
-        stl_phys(cs->as, sm_state + 0x7fa8 + i * 4, dt->selector);
-        stl_phys(cs->as, sm_state + offset + 8, dt->base);
-        stl_phys(cs->as, sm_state + offset + 4, dt->limit);
-        stl_phys(cs->as, sm_state + offset, (dt->flags >> 8) & 0xf0ff);
+        x86_stl_phys(cs, sm_state + 0x7fa8 + i * 4, dt->selector);
+        x86_stl_phys(cs, sm_state + offset + 8, dt->base);
+        x86_stl_phys(cs, sm_state + offset + 4, dt->limit);
+        x86_stl_phys(cs, sm_state + offset, (dt->flags >> 8) & 0xf0ff);
     }
-    stl_phys(cs->as, sm_state + 0x7f14, env->cr[4]);
+    x86_stl_phys(cs, sm_state + 0x7f14, env->cr[4]);
 
-    stl_phys(cs->as, sm_state + 0x7efc, SMM_REVISION_ID);
-    stl_phys(cs->as, sm_state + 0x7ef8, env->smbase);
+    x86_stl_phys(cs, sm_state + 0x7efc, SMM_REVISION_ID);
+    x86_stl_phys(cs, sm_state + 0x7ef8, env->smbase);
 #endif
     /* init SMM cpu state */
 
@@ -200,91 +200,91 @@ void helper_rsm(CPUX86State *env)
 
     sm_state = env->smbase + 0x8000;
 #ifdef TARGET_X86_64
-    cpu_load_efer(env, ldq_phys(cs->as, sm_state + 0x7ed0));
-
-    env->gdt.base = ldq_phys(cs->as, sm_state + 0x7e68);
-    env->gdt.limit = ldl_phys(cs->as, sm_state + 0x7e64);
-
-    env->ldt.selector = lduw_phys(cs->as, sm_state + 0x7e70);
-    env->ldt.base = ldq_phys(cs->as, sm_state + 0x7e78);
-    env->ldt.limit = ldl_phys(cs->as, sm_state + 0x7e74);
-    env->ldt.flags = (lduw_phys(cs->as, sm_state + 0x7e72) & 0xf0ff) << 8;
-
-    env->idt.base = ldq_phys(cs->as, sm_state + 0x7e88);
-    env->idt.limit = ldl_phys(cs->as, sm_state + 0x7e84);
-
-    env->tr.selector = lduw_phys(cs->as, sm_state + 0x7e90);
-    env->tr.base = ldq_phys(cs->as, sm_state + 0x7e98);
-    env->tr.limit = ldl_phys(cs->as, sm_state + 0x7e94);
-    env->tr.flags = (lduw_phys(cs->as, sm_state + 0x7e92) & 0xf0ff) << 8;
-
-    env->regs[R_EAX] = ldq_phys(cs->as, sm_state + 0x7ff8);
-    env->regs[R_ECX] = ldq_phys(cs->as, sm_state + 0x7ff0);
-    env->regs[R_EDX] = ldq_phys(cs->as, sm_state + 0x7fe8);
-    env->regs[R_EBX] = ldq_phys(cs->as, sm_state + 0x7fe0);
-    env->regs[R_ESP] = ldq_phys(cs->as, sm_state + 0x7fd8);
-    env->regs[R_EBP] = ldq_phys(cs->as, sm_state + 0x7fd0);
-    env->regs[R_ESI] = ldq_phys(cs->as, sm_state + 0x7fc8);
-    env->regs[R_EDI] = ldq_phys(cs->as, sm_state + 0x7fc0);
+    cpu_load_efer(env, x86_ldq_phys(cs, sm_state + 0x7ed0));
+
+    env->gdt.base = x86_ldq_phys(cs, sm_state + 0x7e68);
+    env->gdt.limit = x86_ldl_phys(cs, sm_state + 0x7e64);
+
+    env->ldt.selector = x86_lduw_phys(cs, sm_state + 0x7e70);
+    env->ldt.base = x86_ldq_phys(cs, sm_state + 0x7e78);
+    env->ldt.limit = x86_ldl_phys(cs, sm_state + 0x7e74);
+    env->ldt.flags = (x86_lduw_phys(cs, sm_state + 0x7e72) & 0xf0ff) << 8;
+
+    env->idt.base = x86_ldq_phys(cs, sm_state + 0x7e88);
+    env->idt.limit = x86_ldl_phys(cs, sm_state + 0x7e84);
+
+    env->tr.selector = x86_lduw_phys(cs, sm_state + 0x7e90);
+    env->tr.base = x86_ldq_phys(cs, sm_state + 0x7e98);
+    env->tr.limit = x86_ldl_phys(cs, sm_state + 0x7e94);
+    env->tr.flags = (x86_lduw_phys(cs, sm_state + 0x7e92) & 0xf0ff) << 8;
+
+    env->regs[R_EAX] = x86_ldq_phys(cs, sm_state + 0x7ff8);
+    env->regs[R_ECX] = x86_ldq_phys(cs, sm_state + 0x7ff0);
+    env->regs[R_EDX] = x86_ldq_phys(cs, sm_state + 0x7fe8);
+    env->regs[R_EBX] = x86_ldq_phys(cs, sm_state + 0x7fe0);
+    env->regs[R_ESP] = x86_ldq_phys(cs, sm_state + 0x7fd8);
+    env->regs[R_EBP] = x86_ldq_phys(cs, sm_state + 0x7fd0);
+    env->regs[R_ESI] = x86_ldq_phys(cs, sm_state + 0x7fc8);
+    env->regs[R_EDI] = x86_ldq_phys(cs, sm_state + 0x7fc0);
     for (i = 8; i < 16; i++) {
-        env->regs[i] = ldq_phys(cs->as, sm_state + 0x7ff8 - i * 8);
+        env->regs[i] = x86_ldq_phys(cs, sm_state + 0x7ff8 - i * 8);
     }
-    env->eip = ldq_phys(cs->as, sm_state + 0x7f78);
-    cpu_load_eflags(env, ldl_phys(cs->as, sm_state + 0x7f70),
+    env->eip = x86_ldq_phys(cs, sm_state + 0x7f78);
+    cpu_load_eflags(env, x86_ldl_phys(cs, sm_state + 0x7f70),
                     ~(CC_O | CC_S | CC_Z | CC_A | CC_P | CC_C | DF_MASK));
-    env->dr[6] = ldl_phys(cs->as, sm_state + 0x7f68);
-    env->dr[7] = ldl_phys(cs->as, sm_state + 0x7f60);
+    env->dr[6] = x86_ldl_phys(cs, sm_state + 0x7f68);
+    env->dr[7] = x86_ldl_phys(cs, sm_state + 0x7f60);
 
-    cpu_x86_update_cr4(env, ldl_phys(cs->as, sm_state + 0x7f48));
-    cpu_x86_update_cr3(env, ldq_phys(cs->as, sm_state + 0x7f50));
-    cpu_x86_update_cr0(env, ldl_phys(cs->as, sm_state + 0x7f58));
+    cpu_x86_update_cr4(env, x86_ldl_phys(cs, sm_state + 0x7f48));
+    cpu_x86_update_cr3(env, x86_ldq_phys(cs, sm_state + 0x7f50));
+    cpu_x86_update_cr0(env, x86_ldl_phys(cs, sm_state + 0x7f58));
 
     for (i = 0; i < 6; i++) {
         offset = 0x7e00 + i * 16;
         cpu_x86_load_seg_cache(env, i,
-                               lduw_phys(cs->as, sm_state + offset),
-                               ldq_phys(cs->as, sm_state + offset + 8),
-                               ldl_phys(cs->as, sm_state + offset + 4),
-                               (lduw_phys(cs->as, sm_state + offset + 2) &
+                               x86_lduw_phys(cs, sm_state + offset),
+                               x86_ldq_phys(cs, sm_state + offset + 8),
+                               x86_ldl_phys(cs, sm_state + offset + 4),
+                               (x86_lduw_phys(cs, sm_state + offset + 2) &
                                 0xf0ff) << 8);
     }
 
-    val = ldl_phys(cs->as, sm_state + 0x7efc); /* revision ID */
+    val = x86_ldl_phys(cs, sm_state + 0x7efc); /* revision ID */
     if (val & 0x20000) {
-        env->smbase = ldl_phys(cs->as, sm_state + 0x7f00) & ~0x7fff;
+        env->smbase = x86_ldl_phys(cs, sm_state + 0x7f00) & ~0x7fff;
     }
 #else
-    cpu_x86_update_cr0(env, ldl_phys(cs->as, sm_state + 0x7ffc));
-    cpu_x86_update_cr3(env, ldl_phys(cs->as, sm_state + 0x7ff8));
-    cpu_load_eflags(env, ldl_phys(cs->as, sm_state + 0x7ff4),
+    cpu_x86_update_cr0(env, x86_ldl_phys(cs, sm_state + 0x7ffc));
+    cpu_x86_update_cr3(env, x86_ldl_phys(cs, sm_state + 0x7ff8));
+    cpu_load_eflags(env, x86_ldl_phys(cs, sm_state + 0x7ff4),
                     ~(CC_O | CC_S | CC_Z | CC_A | CC_P | CC_C | DF_MASK));
-    env->eip = ldl_phys(cs->as, sm_state + 0x7ff0);
-    env->regs[R_EDI] = ldl_phys(cs->as, sm_state + 0x7fec);
-    env->regs[R_ESI] = ldl_phys(cs->as, sm_state + 0x7fe8);
-    env->regs[R_EBP] = ldl_phys(cs->as, sm_state + 0x7fe4);
-    env->regs[R_ESP] = ldl_phys(cs->as, sm_state + 0x7fe0);
-    env->regs[R_EBX] = ldl_phys(cs->as, sm_state + 0x7fdc);
-    env->regs[R_EDX] = ldl_phys(cs->as, sm_state + 0x7fd8);
-    env->regs[R_ECX] = ldl_phys(cs->as, sm_state + 0x7fd4);
-    env->regs[R_EAX] = ldl_phys(cs->as, sm_state + 0x7fd0);
-    env->dr[6] = ldl_phys(cs->as, sm_state + 0x7fcc);
-    env->dr[7] = ldl_phys(cs->as, sm_state + 0x7fc8);
-
-    env->tr.selector = ldl_phys(cs->as, sm_state + 0x7fc4) & 0xffff;
-    env->tr.base = ldl_phys(cs->as, sm_state + 0x7f64);
-    env->tr.limit = ldl_phys(cs->as, sm_state + 0x7f60);
-    env->tr.flags = (ldl_phys(cs->as, sm_state + 0x7f5c) & 0xf0ff) << 8;
-
-    env->ldt.selector = ldl_phys(cs->as, sm_state + 0x7fc0) & 0xffff;
-    env->ldt.base = ldl_phys(cs->as, sm_state + 0x7f80);
-    env->ldt.limit = ldl_phys(cs->as, sm_state + 0x7f7c);
-    env->ldt.flags = (ldl_phys(cs->as, sm_state + 0x7f78) & 0xf0ff) << 8;
-
-    env->gdt.base = ldl_phys(cs->as, sm_state + 0x7f74);
-    env->gdt.limit = ldl_phys(cs->as, sm_state + 0x7f70);
-
-    env->idt.base = ldl_phys(cs->as, sm_state + 0x7f58);
-    env->idt.limit = ldl_phys(cs->as, sm_state + 0x7f54);
+    env->eip = x86_ldl_phys(cs, sm_state + 0x7ff0);
+    env->regs[R_EDI] = x86_ldl_phys(cs, sm_state + 0x7fec);
+    env->regs[R_ESI] = x86_ldl_phys(cs, sm_state + 0x7fe8);
+    env->regs[R_EBP] = x86_ldl_phys(cs, sm_state + 0x7fe4);
+    env->regs[R_ESP] = x86_ldl_phys(cs, sm_state + 0x7fe0);
+    env->regs[R_EBX] = x86_ldl_phys(cs, sm_state + 0x7fdc);
+    env->regs[R_EDX] = x86_ldl_phys(cs, sm_state + 0x7fd8);
+    env->regs[R_ECX] = x86_ldl_phys(cs, sm_state + 0x7fd4);
+    env->regs[R_EAX] = x86_ldl_phys(cs, sm_state + 0x7fd0);
+    env->dr[6] = x86_ldl_phys(cs, sm_state + 0x7fcc);
+    env->dr[7] = x86_ldl_phys(cs, sm_state + 0x7fc8);
+
+    env->tr.selector = x86_ldl_phys(cs, sm_state + 0x7fc4) & 0xffff;
+    env->tr.base = x86_ldl_phys(cs, sm_state + 0x7f64);
+    env->tr.limit = x86_ldl_phys(cs, sm_state + 0x7f60);
+    env->tr.flags = (x86_ldl_phys(cs, sm_state + 0x7f5c) & 0xf0ff) << 8;
+
+    env->ldt.selector = x86_ldl_phys(cs, sm_state + 0x7fc0) & 0xffff;
+    env->ldt.base = x86_ldl_phys(cs, sm_state + 0x7f80);
+    env->ldt.limit = x86_ldl_phys(cs, sm_state + 0x7f7c);
+    env->ldt.flags = (x86_ldl_phys(cs, sm_state + 0x7f78) & 0xf0ff) << 8;
+
+    env->gdt.base = x86_ldl_phys(cs, sm_state + 0x7f74);
+    env->gdt.limit = x86_ldl_phys(cs, sm_state + 0x7f70);
+
+    env->idt.base = x86_ldl_phys(cs, sm_state + 0x7f58);
+    env->idt.limit = x86_ldl_phys(cs, sm_state + 0x7f54);
 
     for (i = 0; i < 6; i++) {
         if (i < 3) {
@@ -293,18 +293,18 @@ void helper_rsm(CPUX86State *env)
             offset = 0x7f2c + (i - 3) * 12;
         }
         cpu_x86_load_seg_cache(env, i,
-                               ldl_phys(cs->as,
+                               x86_ldl_phys(cs,
                                         sm_state + 0x7fa8 + i * 4) & 0xffff,
-                               ldl_phys(cs->as, sm_state + offset + 8),
-                               ldl_phys(cs->as, sm_state + offset + 4),
-                               (ldl_phys(cs->as,
+                               x86_ldl_phys(cs, sm_state + offset + 8),
+                               x86_ldl_phys(cs, sm_state + offset + 4),
+                               (x86_ldl_phys(cs,
                                          sm_state + offset) & 0xf0ff) << 8);
     }
-    cpu_x86_update_cr4(env, ldl_phys(cs->as, sm_state + 0x7f14));
+    cpu_x86_update_cr4(env, x86_ldl_phys(cs, sm_state + 0x7f14));
 
-    val = ldl_phys(cs->as, sm_state + 0x7efc); /* revision ID */
+    val = x86_ldl_phys(cs, sm_state + 0x7efc); /* revision ID */
     if (val & 0x20000) {
-        env->smbase = ldl_phys(cs->as, sm_state + 0x7ef8) & ~0x7fff;
+        env->smbase = x86_ldl_phys(cs, sm_state + 0x7ef8) & ~0x7fff;
     }
 #endif
     env->hflags &= ~HF_SMM_MASK;
diff --git a/target-i386/svm_helper.c b/target-i386/svm_helper.c
index 429d029..f1fabf5 100644
--- a/target-i386/svm_helper.c
+++ b/target-i386/svm_helper.c
@@ -87,13 +87,13 @@ static inline void svm_save_seg(CPUX86State *env, hwaddr addr,
 {
     CPUState *cs = CPU(x86_env_get_cpu(env));
 
-    stw_phys(cs->as, addr + offsetof(struct vmcb_seg, selector),
+    x86_stw_phys(cs, addr + offsetof(struct vmcb_seg, selector),
              sc->selector);
-    stq_phys(cs->as, addr + offsetof(struct vmcb_seg, base),
+    x86_stq_phys(cs, addr + offsetof(struct vmcb_seg, base),
              sc->base);
-    stl_phys(cs->as, addr + offsetof(struct vmcb_seg, limit),
+    x86_stl_phys(cs, addr + offsetof(struct vmcb_seg, limit),
              sc->limit);
-    stw_phys(cs->as, addr + offsetof(struct vmcb_seg, attrib),
+    x86_stw_phys(cs, addr + offsetof(struct vmcb_seg, attrib),
              ((sc->flags >> 8) & 0xff) | ((sc->flags >> 12) & 0x0f00));
 }
 
@@ -103,11 +103,11 @@ static inline void svm_load_seg(CPUX86State *env, hwaddr addr,
     CPUState *cs = CPU(x86_env_get_cpu(env));
     unsigned int flags;
 
-    sc->selector = lduw_phys(cs->as,
+    sc->selector = x86_lduw_phys(cs,
                              addr + offsetof(struct vmcb_seg, selector));
-    sc->base = ldq_phys(cs->as, addr + offsetof(struct vmcb_seg, base));
-    sc->limit = ldl_phys(cs->as, addr + offsetof(struct vmcb_seg, limit));
-    flags = lduw_phys(cs->as, addr + offsetof(struct vmcb_seg, attrib));
+    sc->base = x86_ldq_phys(cs, addr + offsetof(struct vmcb_seg, base));
+    sc->limit = x86_ldl_phys(cs, addr + offsetof(struct vmcb_seg, limit));
+    flags = x86_lduw_phys(cs, addr + offsetof(struct vmcb_seg, attrib));
     sc->flags = ((flags & 0xff) << 8) | ((flags & 0x0f00) << 12);
 }
 
@@ -141,32 +141,32 @@ void helper_vmrun(CPUX86State *env, int aflag, int next_eip_addend)
     env->vm_vmcb = addr;
 
     /* save the current CPU state in the hsave page */
-    stq_phys(cs->as, env->vm_hsave + offsetof(struct vmcb, save.gdtr.base),
+    x86_stq_phys(cs, env->vm_hsave + offsetof(struct vmcb, save.gdtr.base),
              env->gdt.base);
-    stl_phys(cs->as, env->vm_hsave + offsetof(struct vmcb, save.gdtr.limit),
+    x86_stl_phys(cs, env->vm_hsave + offsetof(struct vmcb, save.gdtr.limit),
              env->gdt.limit);
 
-    stq_phys(cs->as, env->vm_hsave + offsetof(struct vmcb, save.idtr.base),
+    x86_stq_phys(cs, env->vm_hsave + offsetof(struct vmcb, save.idtr.base),
              env->idt.base);
-    stl_phys(cs->as, env->vm_hsave + offsetof(struct vmcb, save.idtr.limit),
+    x86_stl_phys(cs, env->vm_hsave + offsetof(struct vmcb, save.idtr.limit),
              env->idt.limit);
 
-    stq_phys(cs->as,
+    x86_stq_phys(cs,
              env->vm_hsave + offsetof(struct vmcb, save.cr0), env->cr[0]);
-    stq_phys(cs->as,
+    x86_stq_phys(cs,
              env->vm_hsave + offsetof(struct vmcb, save.cr2), env->cr[2]);
-    stq_phys(cs->as,
+    x86_stq_phys(cs,
              env->vm_hsave + offsetof(struct vmcb, save.cr3), env->cr[3]);
-    stq_phys(cs->as,
+    x86_stq_phys(cs,
              env->vm_hsave + offsetof(struct vmcb, save.cr4), env->cr[4]);
-    stq_phys(cs->as,
+    x86_stq_phys(cs,
              env->vm_hsave + offsetof(struct vmcb, save.dr6), env->dr[6]);
-    stq_phys(cs->as,
+    x86_stq_phys(cs,
              env->vm_hsave + offsetof(struct vmcb, save.dr7), env->dr[7]);
 
-    stq_phys(cs->as,
+    x86_stq_phys(cs,
              env->vm_hsave + offsetof(struct vmcb, save.efer), env->efer);
-    stq_phys(cs->as,
+    x86_stq_phys(cs,
              env->vm_hsave + offsetof(struct vmcb, save.rflags),
              cpu_compute_eflags(env));
 
@@ -179,30 +179,30 @@ void helper_vmrun(CPUX86State *env, int aflag, int next_eip_addend)
     svm_save_seg(env, env->vm_hsave + offsetof(struct vmcb, save.ds),
                  &env->segs[R_DS]);
 
-    stq_phys(cs->as, env->vm_hsave + offsetof(struct vmcb, save.rip),
+    x86_stq_phys(cs, env->vm_hsave + offsetof(struct vmcb, save.rip),
              env->eip + next_eip_addend);
-    stq_phys(cs->as,
+    x86_stq_phys(cs,
              env->vm_hsave + offsetof(struct vmcb, save.rsp), env->regs[R_ESP]);
-    stq_phys(cs->as,
+    x86_stq_phys(cs,
              env->vm_hsave + offsetof(struct vmcb, save.rax), env->regs[R_EAX]);
 
     /* load the interception bitmaps so we do not need to access the
        vmcb in svm mode */
-    env->intercept = ldq_phys(cs->as, env->vm_vmcb + offsetof(struct vmcb,
+    env->intercept = x86_ldq_phys(cs, env->vm_vmcb + offsetof(struct vmcb,
                                                       control.intercept));
-    env->intercept_cr_read = lduw_phys(cs->as, env->vm_vmcb +
+    env->intercept_cr_read = x86_lduw_phys(cs, env->vm_vmcb +
                                        offsetof(struct vmcb,
                                                 control.intercept_cr_read));
-    env->intercept_cr_write = lduw_phys(cs->as, env->vm_vmcb +
+    env->intercept_cr_write = x86_lduw_phys(cs, env->vm_vmcb +
                                         offsetof(struct vmcb,
                                                  control.intercept_cr_write));
-    env->intercept_dr_read = lduw_phys(cs->as, env->vm_vmcb +
+    env->intercept_dr_read = x86_lduw_phys(cs, env->vm_vmcb +
                                        offsetof(struct vmcb,
                                                 control.intercept_dr_read));
-    env->intercept_dr_write = lduw_phys(cs->as, env->vm_vmcb +
+    env->intercept_dr_write = x86_lduw_phys(cs, env->vm_vmcb +
                                         offsetof(struct vmcb,
                                                  control.intercept_dr_write));
-    env->intercept_exceptions = ldl_phys(cs->as, env->vm_vmcb +
+    env->intercept_exceptions = x86_ldl_phys(cs, env->vm_vmcb +
                                          offsetof(struct vmcb,
                                                   control.intercept_exceptions
                                                   ));
@@ -210,35 +210,35 @@ void helper_vmrun(CPUX86State *env, int aflag, int next_eip_addend)
     /* enable intercepts */
     env->hflags |= HF_SVMI_MASK;
 
-    env->tsc_offset = ldq_phys(cs->as, env->vm_vmcb +
+    env->tsc_offset = x86_ldq_phys(cs, env->vm_vmcb +
                                offsetof(struct vmcb, control.tsc_offset));
 
-    env->gdt.base  = ldq_phys(cs->as, env->vm_vmcb + offsetof(struct vmcb,
+    env->gdt.base  = x86_ldq_phys(cs, env->vm_vmcb + offsetof(struct vmcb,
                                                       save.gdtr.base));
-    env->gdt.limit = ldl_phys(cs->as, env->vm_vmcb + offsetof(struct vmcb,
+    env->gdt.limit = x86_ldl_phys(cs, env->vm_vmcb + offsetof(struct vmcb,
                                                       save.gdtr.limit));
 
-    env->idt.base  = ldq_phys(cs->as, env->vm_vmcb + offsetof(struct vmcb,
+    env->idt.base  = x86_ldq_phys(cs, env->vm_vmcb + offsetof(struct vmcb,
                                                       save.idtr.base));
-    env->idt.limit = ldl_phys(cs->as, env->vm_vmcb + offsetof(struct vmcb,
+    env->idt.limit = x86_ldl_phys(cs, env->vm_vmcb + offsetof(struct vmcb,
                                                       save.idtr.limit));
 
     /* clear exit_info_2 so we behave like the real hardware */
-    stq_phys(cs->as,
+    x86_stq_phys(cs,
              env->vm_vmcb + offsetof(struct vmcb, control.exit_info_2), 0);
 
-    cpu_x86_update_cr0(env, ldq_phys(cs->as,
+    cpu_x86_update_cr0(env, x86_ldq_phys(cs,
                                      env->vm_vmcb + offsetof(struct vmcb,
                                                              save.cr0)));
-    cpu_x86_update_cr4(env, ldq_phys(cs->as,
+    cpu_x86_update_cr4(env, x86_ldq_phys(cs,
                                      env->vm_vmcb + offsetof(struct vmcb,
                                                              save.cr4)));
-    cpu_x86_update_cr3(env, ldq_phys(cs->as,
+    cpu_x86_update_cr3(env, x86_ldq_phys(cs,
                                      env->vm_vmcb + offsetof(struct vmcb,
                                                              save.cr3)));
-    env->cr[2] = ldq_phys(cs->as,
+    env->cr[2] = x86_ldq_phys(cs,
                           env->vm_vmcb + offsetof(struct vmcb, save.cr2));
-    int_ctl = ldl_phys(cs->as,
+    int_ctl = x86_ldl_phys(cs,
                        env->vm_vmcb + offsetof(struct vmcb, control.int_ctl));
     env->hflags2 &= ~(HF2_HIF_MASK | HF2_VINTR_MASK);
     if (int_ctl & V_INTR_MASKING_MASK) {
@@ -250,10 +250,10 @@ void helper_vmrun(CPUX86State *env, int aflag, int next_eip_addend)
     }
 
     cpu_load_efer(env,
-                  ldq_phys(cs->as,
+                  x86_ldq_phys(cs,
                            env->vm_vmcb + offsetof(struct vmcb, save.efer)));
     env->eflags = 0;
-    cpu_load_eflags(env, ldq_phys(cs->as,
+    cpu_load_eflags(env, x86_ldq_phys(cs,
                                   env->vm_vmcb + offsetof(struct vmcb,
                                                           save.rflags)),
                     ~(CC_O | CC_S | CC_Z | CC_A | CC_P | CC_C | DF_MASK));
@@ -267,21 +267,21 @@ void helper_vmrun(CPUX86State *env, int aflag, int next_eip_addend)
     svm_load_seg_cache(env, env->vm_vmcb + offsetof(struct vmcb, save.ds),
                        R_DS);
 
-    env->eip = ldq_phys(cs->as,
+    env->eip = x86_ldq_phys(cs,
                         env->vm_vmcb + offsetof(struct vmcb, save.rip));
 
-    env->regs[R_ESP] = ldq_phys(cs->as,
+    env->regs[R_ESP] = x86_ldq_phys(cs,
                                 env->vm_vmcb + offsetof(struct vmcb, save.rsp));
-    env->regs[R_EAX] = ldq_phys(cs->as,
+    env->regs[R_EAX] = x86_ldq_phys(cs,
                                 env->vm_vmcb + offsetof(struct vmcb, save.rax));
-    env->dr[7] = ldq_phys(cs->as,
+    env->dr[7] = x86_ldq_phys(cs,
                           env->vm_vmcb + offsetof(struct vmcb, save.dr7));
-    env->dr[6] = ldq_phys(cs->as,
+    env->dr[6] = x86_ldq_phys(cs,
                           env->vm_vmcb + offsetof(struct vmcb, save.dr6));
 
     /* FIXME: guest state consistency checks */
 
-    switch (ldub_phys(cs->as,
+    switch (x86_ldub_phys(cs,
                       env->vm_vmcb + offsetof(struct vmcb, control.tlb_ctl))) {
     case TLB_CONTROL_DO_NOTHING:
         break;
@@ -300,12 +300,12 @@ void helper_vmrun(CPUX86State *env, int aflag, int next_eip_addend)
     }
 
     /* maybe we need to inject an event */
-    event_inj = ldl_phys(cs->as, env->vm_vmcb + offsetof(struct vmcb,
+    event_inj = x86_ldl_phys(cs, env->vm_vmcb + offsetof(struct vmcb,
                                                  control.event_inj));
     if (event_inj & SVM_EVTINJ_VALID) {
         uint8_t vector = event_inj & SVM_EVTINJ_VEC_MASK;
         uint16_t valid_err = event_inj & SVM_EVTINJ_VALID_ERR;
-        uint32_t event_inj_err = ldl_phys(cs->as, env->vm_vmcb +
+        uint32_t event_inj_err = x86_ldl_phys(cs, env->vm_vmcb +
                                           offsetof(struct vmcb,
                                                    control.event_inj_err));
 
@@ -372,7 +372,7 @@ void helper_vmload(CPUX86State *env, int aflag)
 
     qemu_log_mask(CPU_LOG_TB_IN_ASM, "vmload! " TARGET_FMT_lx
                   "\nFS: %016" PRIx64 " | " TARGET_FMT_lx "\n",
-                  addr, ldq_phys(cs->as, addr + offsetof(struct vmcb,
+                  addr, x86_ldq_phys(cs, addr + offsetof(struct vmcb,
                                                           save.fs.base)),
                   env->segs[R_FS].base);
 
@@ -382,18 +382,18 @@ void helper_vmload(CPUX86State *env, int aflag)
     svm_load_seg(env, addr + offsetof(struct vmcb, save.ldtr), &env->ldt);
 
 #ifdef TARGET_X86_64
-    env->kernelgsbase = ldq_phys(cs->as, addr + offsetof(struct vmcb,
+    env->kernelgsbase = x86_ldq_phys(cs, addr + offsetof(struct vmcb,
                                                  save.kernel_gs_base));
-    env->lstar = ldq_phys(cs->as, addr + offsetof(struct vmcb, save.lstar));
-    env->cstar = ldq_phys(cs->as, addr + offsetof(struct vmcb, save.cstar));
-    env->fmask = ldq_phys(cs->as, addr + offsetof(struct vmcb, save.sfmask));
+    env->lstar = x86_ldq_phys(cs, addr + offsetof(struct vmcb, save.lstar));
+    env->cstar = x86_ldq_phys(cs, addr + offsetof(struct vmcb, save.cstar));
+    env->fmask = x86_ldq_phys(cs, addr + offsetof(struct vmcb, save.sfmask));
 #endif
-    env->star = ldq_phys(cs->as, addr + offsetof(struct vmcb, save.star));
-    env->sysenter_cs = ldq_phys(cs->as,
+    env->star = x86_ldq_phys(cs, addr + offsetof(struct vmcb, save.star));
+    env->sysenter_cs = x86_ldq_phys(cs,
                                 addr + offsetof(struct vmcb, save.sysenter_cs));
-    env->sysenter_esp = ldq_phys(cs->as, addr + offsetof(struct vmcb,
+    env->sysenter_esp = x86_ldq_phys(cs, addr + offsetof(struct vmcb,
                                                  save.sysenter_esp));
-    env->sysenter_eip = ldq_phys(cs->as, addr + offsetof(struct vmcb,
+    env->sysenter_eip = x86_ldq_phys(cs, addr + offsetof(struct vmcb,
                                                  save.sysenter_eip));
 }
 
@@ -412,7 +412,7 @@ void helper_vmsave(CPUX86State *env, int aflag)
 
     qemu_log_mask(CPU_LOG_TB_IN_ASM, "vmsave! " TARGET_FMT_lx
                   "\nFS: %016" PRIx64 " | " TARGET_FMT_lx "\n",
-                  addr, ldq_phys(cs->as,
+                  addr, x86_ldq_phys(cs,
                                  addr + offsetof(struct vmcb, save.fs.base)),
                   env->segs[R_FS].base);
 
@@ -426,18 +426,18 @@ void helper_vmsave(CPUX86State *env, int aflag)
                  &env->ldt);
 
 #ifdef TARGET_X86_64
-    stq_phys(cs->as, addr + offsetof(struct vmcb, save.kernel_gs_base),
+    x86_stq_phys(cs, addr + offsetof(struct vmcb, save.kernel_gs_base),
              env->kernelgsbase);
-    stq_phys(cs->as, addr + offsetof(struct vmcb, save.lstar), env->lstar);
-    stq_phys(cs->as, addr + offsetof(struct vmcb, save.cstar), env->cstar);
-    stq_phys(cs->as, addr + offsetof(struct vmcb, save.sfmask), env->fmask);
+    x86_stq_phys(cs, addr + offsetof(struct vmcb, save.lstar), env->lstar);
+    x86_stq_phys(cs, addr + offsetof(struct vmcb, save.cstar), env->cstar);
+    x86_stq_phys(cs, addr + offsetof(struct vmcb, save.sfmask), env->fmask);
 #endif
-    stq_phys(cs->as, addr + offsetof(struct vmcb, save.star), env->star);
-    stq_phys(cs->as,
+    x86_stq_phys(cs, addr + offsetof(struct vmcb, save.star), env->star);
+    x86_stq_phys(cs,
              addr + offsetof(struct vmcb, save.sysenter_cs), env->sysenter_cs);
-    stq_phys(cs->as, addr + offsetof(struct vmcb, save.sysenter_esp),
+    x86_stq_phys(cs, addr + offsetof(struct vmcb, save.sysenter_esp),
              env->sysenter_esp);
-    stq_phys(cs->as, addr + offsetof(struct vmcb, save.sysenter_eip),
+    x86_stq_phys(cs, addr + offsetof(struct vmcb, save.sysenter_eip),
              env->sysenter_eip);
 }
 
@@ -515,7 +515,7 @@ void helper_svm_check_intercept_param(CPUX86State *env, uint32_t type,
     case SVM_EXIT_MSR:
         if (env->intercept & (1ULL << (SVM_EXIT_MSR - SVM_EXIT_INTR))) {
             /* FIXME: this should be read in at vmrun (faster this way?) */
-            uint64_t addr = ldq_phys(cs->as, env->vm_vmcb +
+            uint64_t addr = x86_ldq_phys(cs, env->vm_vmcb +
                                      offsetof(struct vmcb,
                                               control.msrpm_base_pa));
             uint32_t t0, t1;
@@ -541,7 +541,7 @@ void helper_svm_check_intercept_param(CPUX86State *env, uint32_t type,
                 t1 = 0;
                 break;
             }
-            if (ldub_phys(cs->as, addr + t1) & ((1 << param) << t0)) {
+            if (x86_ldub_phys(cs, addr + t1) & ((1 << param) << t0)) {
                 helper_vmexit(env, type, param);
             }
         }
@@ -567,13 +567,13 @@ void helper_svm_check_io(CPUX86State *env, uint32_t port, uint32_t param,
 
     if (env->intercept & (1ULL << (SVM_EXIT_IOIO - SVM_EXIT_INTR))) {
         /* FIXME: this should be read in at vmrun (faster this way?) */
-        uint64_t addr = ldq_phys(cs->as, env->vm_vmcb +
+        uint64_t addr = x86_ldq_phys(cs, env->vm_vmcb +
                                  offsetof(struct vmcb, control.iopm_base_pa));
         uint16_t mask = (1 << ((param >> 4) & 7)) - 1;
 
-        if (lduw_phys(cs->as, addr + port / 8) & (mask << (port & 7))) {
+        if (x86_lduw_phys(cs, addr + port / 8) & (mask << (port & 7))) {
             /* next env->eip */
-            stq_phys(cs->as,
+            x86_stq_phys(cs,
                      env->vm_vmcb + offsetof(struct vmcb, control.exit_info_2),
                      env->eip + next_eip_addend);
             helper_vmexit(env, SVM_EXIT_IOIO, param | (port << 16));
@@ -590,17 +590,17 @@ void helper_vmexit(CPUX86State *env, uint32_t exit_code, uint64_t exit_info_1)
     qemu_log_mask(CPU_LOG_TB_IN_ASM, "vmexit(%08x, %016" PRIx64 ", %016"
                   PRIx64 ", " TARGET_FMT_lx ")!\n",
                   exit_code, exit_info_1,
-                  ldq_phys(cs->as, env->vm_vmcb + offsetof(struct vmcb,
+                  x86_ldq_phys(cs, env->vm_vmcb + offsetof(struct vmcb,
                                                    control.exit_info_2)),
                   env->eip);
 
     if (env->hflags & HF_INHIBIT_IRQ_MASK) {
-        stl_phys(cs->as,
+        x86_stl_phys(cs,
                  env->vm_vmcb + offsetof(struct vmcb, control.int_state),
                  SVM_INTERRUPT_SHADOW_MASK);
         env->hflags &= ~HF_INHIBIT_IRQ_MASK;
     } else {
-        stl_phys(cs->as,
+        x86_stl_phys(cs,
                  env->vm_vmcb + offsetof(struct vmcb, control.int_state), 0);
     }
 
@@ -614,50 +614,50 @@ void helper_vmexit(CPUX86State *env, uint32_t exit_code, uint64_t exit_info_1)
     svm_save_seg(env, env->vm_vmcb + offsetof(struct vmcb, save.ds),
                  &env->segs[R_DS]);
 
-    stq_phys(cs->as, env->vm_vmcb + offsetof(struct vmcb, save.gdtr.base),
+    x86_stq_phys(cs, env->vm_vmcb + offsetof(struct vmcb, save.gdtr.base),
              env->gdt.base);
-    stl_phys(cs->as, env->vm_vmcb + offsetof(struct vmcb, save.gdtr.limit),
+    x86_stl_phys(cs, env->vm_vmcb + offsetof(struct vmcb, save.gdtr.limit),
              env->gdt.limit);
 
-    stq_phys(cs->as, env->vm_vmcb + offsetof(struct vmcb, save.idtr.base),
+    x86_stq_phys(cs, env->vm_vmcb + offsetof(struct vmcb, save.idtr.base),
              env->idt.base);
-    stl_phys(cs->as, env->vm_vmcb + offsetof(struct vmcb, save.idtr.limit),
+    x86_stl_phys(cs, env->vm_vmcb + offsetof(struct vmcb, save.idtr.limit),
              env->idt.limit);
 
-    stq_phys(cs->as,
+    x86_stq_phys(cs,
              env->vm_vmcb + offsetof(struct vmcb, save.efer), env->efer);
-    stq_phys(cs->as,
+    x86_stq_phys(cs,
              env->vm_vmcb + offsetof(struct vmcb, save.cr0), env->cr[0]);
-    stq_phys(cs->as,
+    x86_stq_phys(cs,
              env->vm_vmcb + offsetof(struct vmcb, save.cr2), env->cr[2]);
-    stq_phys(cs->as,
+    x86_stq_phys(cs,
              env->vm_vmcb + offsetof(struct vmcb, save.cr3), env->cr[3]);
-    stq_phys(cs->as,
+    x86_stq_phys(cs,
              env->vm_vmcb + offsetof(struct vmcb, save.cr4), env->cr[4]);
 
-    int_ctl = ldl_phys(cs->as,
+    int_ctl = x86_ldl_phys(cs,
                        env->vm_vmcb + offsetof(struct vmcb, control.int_ctl));
     int_ctl &= ~(V_TPR_MASK | V_IRQ_MASK);
     int_ctl |= env->v_tpr & V_TPR_MASK;
     if (cs->interrupt_request & CPU_INTERRUPT_VIRQ) {
         int_ctl |= V_IRQ_MASK;
     }
-    stl_phys(cs->as,
+    x86_stl_phys(cs,
              env->vm_vmcb + offsetof(struct vmcb, control.int_ctl), int_ctl);
 
-    stq_phys(cs->as, env->vm_vmcb + offsetof(struct vmcb, save.rflags),
+    x86_stq_phys(cs, env->vm_vmcb + offsetof(struct vmcb, save.rflags),
              cpu_compute_eflags(env));
-    stq_phys(cs->as, env->vm_vmcb + offsetof(struct vmcb, save.rip),
+    x86_stq_phys(cs, env->vm_vmcb + offsetof(struct vmcb, save.rip),
              env->eip);
-    stq_phys(cs->as,
+    x86_stq_phys(cs,
              env->vm_vmcb + offsetof(struct vmcb, save.rsp), env->regs[R_ESP]);
-    stq_phys(cs->as,
+    x86_stq_phys(cs,
              env->vm_vmcb + offsetof(struct vmcb, save.rax), env->regs[R_EAX]);
-    stq_phys(cs->as,
+    x86_stq_phys(cs,
              env->vm_vmcb + offsetof(struct vmcb, save.dr7), env->dr[7]);
-    stq_phys(cs->as,
+    x86_stq_phys(cs,
              env->vm_vmcb + offsetof(struct vmcb, save.dr6), env->dr[6]);
-    stb_phys(cs->as, env->vm_vmcb + offsetof(struct vmcb, save.cpl),
+    x86_stb_phys(cs, env->vm_vmcb + offsetof(struct vmcb, save.cpl),
              env->hflags & HF_CPL_MASK);
 
     /* Reload the host state from vm_hsave */
@@ -668,32 +668,32 @@ void helper_vmexit(CPUX86State *env, uint32_t exit_code, uint64_t exit_info_1)
     cs->interrupt_request &= ~CPU_INTERRUPT_VIRQ;
     env->tsc_offset = 0;
 
-    env->gdt.base  = ldq_phys(cs->as, env->vm_hsave + offsetof(struct vmcb,
+    env->gdt.base  = x86_ldq_phys(cs, env->vm_hsave + offsetof(struct vmcb,
                                                        save.gdtr.base));
-    env->gdt.limit = ldl_phys(cs->as, env->vm_hsave + offsetof(struct vmcb,
+    env->gdt.limit = x86_ldl_phys(cs, env->vm_hsave + offsetof(struct vmcb,
                                                        save.gdtr.limit));
 
-    env->idt.base  = ldq_phys(cs->as, env->vm_hsave + offsetof(struct vmcb,
+    env->idt.base  = x86_ldq_phys(cs, env->vm_hsave + offsetof(struct vmcb,
                                                        save.idtr.base));
-    env->idt.limit = ldl_phys(cs->as, env->vm_hsave + offsetof(struct vmcb,
+    env->idt.limit = x86_ldl_phys(cs, env->vm_hsave + offsetof(struct vmcb,
                                                        save.idtr.limit));
 
-    cpu_x86_update_cr0(env, ldq_phys(cs->as,
+    cpu_x86_update_cr0(env, x86_ldq_phys(cs,
                                      env->vm_hsave + offsetof(struct vmcb,
                                                               save.cr0)) |
                        CR0_PE_MASK);
-    cpu_x86_update_cr4(env, ldq_phys(cs->as,
+    cpu_x86_update_cr4(env, x86_ldq_phys(cs,
                                      env->vm_hsave + offsetof(struct vmcb,
                                                               save.cr4)));
-    cpu_x86_update_cr3(env, ldq_phys(cs->as,
+    cpu_x86_update_cr3(env, x86_ldq_phys(cs,
                                      env->vm_hsave + offsetof(struct vmcb,
                                                               save.cr3)));
     /* we need to set the efer after the crs so the hidden flags get
        set properly */
-    cpu_load_efer(env, ldq_phys(cs->as, env->vm_hsave + offsetof(struct vmcb,
+    cpu_load_efer(env, x86_ldq_phys(cs, env->vm_hsave + offsetof(struct vmcb,
                                                          save.efer)));
     env->eflags = 0;
-    cpu_load_eflags(env, ldq_phys(cs->as,
+    cpu_load_eflags(env, x86_ldq_phys(cs,
                                   env->vm_hsave + offsetof(struct vmcb,
                                                            save.rflags)),
                     ~(CC_O | CC_S | CC_Z | CC_A | CC_P | CC_C | DF_MASK |
@@ -708,33 +708,33 @@ void helper_vmexit(CPUX86State *env, uint32_t exit_code, uint64_t exit_info_1)
     svm_load_seg_cache(env, env->vm_hsave + offsetof(struct vmcb, save.ds),
                        R_DS);
 
-    env->eip = ldq_phys(cs->as,
+    env->eip = x86_ldq_phys(cs,
                         env->vm_hsave + offsetof(struct vmcb, save.rip));
-    env->regs[R_ESP] = ldq_phys(cs->as, env->vm_hsave +
+    env->regs[R_ESP] = x86_ldq_phys(cs, env->vm_hsave +
                                 offsetof(struct vmcb, save.rsp));
-    env->regs[R_EAX] = ldq_phys(cs->as, env->vm_hsave +
+    env->regs[R_EAX] = x86_ldq_phys(cs, env->vm_hsave +
                                 offsetof(struct vmcb, save.rax));
 
-    env->dr[6] = ldq_phys(cs->as,
+    env->dr[6] = x86_ldq_phys(cs,
                           env->vm_hsave + offsetof(struct vmcb, save.dr6));
-    env->dr[7] = ldq_phys(cs->as,
+    env->dr[7] = x86_ldq_phys(cs,
                           env->vm_hsave + offsetof(struct vmcb, save.dr7));
 
     /* other setups */
-    stq_phys(cs->as, env->vm_vmcb + offsetof(struct vmcb, control.exit_code),
+    x86_stq_phys(cs, env->vm_vmcb + offsetof(struct vmcb, control.exit_code),
              exit_code);
-    stq_phys(cs->as, env->vm_vmcb + offsetof(struct vmcb, control.exit_info_1),
+    x86_stq_phys(cs, env->vm_vmcb + offsetof(struct vmcb, control.exit_info_1),
              exit_info_1);
 
-    stl_phys(cs->as,
+    x86_stl_phys(cs,
              env->vm_vmcb + offsetof(struct vmcb, control.exit_int_info),
-             ldl_phys(cs->as, env->vm_vmcb + offsetof(struct vmcb,
+             x86_ldl_phys(cs, env->vm_vmcb + offsetof(struct vmcb,
                                               control.event_inj)));
-    stl_phys(cs->as,
+    x86_stl_phys(cs,
              env->vm_vmcb + offsetof(struct vmcb, control.exit_int_info_err),
-             ldl_phys(cs->as, env->vm_vmcb + offsetof(struct vmcb,
+             x86_ldl_phys(cs, env->vm_vmcb + offsetof(struct vmcb,
                                               control.event_inj_err)));
-    stl_phys(cs->as,
+    x86_stl_phys(cs,
              env->vm_vmcb + offsetof(struct vmcb, control.event_inj), 0);
 
     env->hflags2 &= ~HF2_GIF_MASK;
-- 
2.4.1

^ permalink raw reply related	[flat|nested] 49+ messages in thread

* [Qemu-devel] [PATCH v2 03/23] target-i386: Use correct memory attributes for ioport accesses
  2015-06-03 17:08 [Qemu-devel] [PATCH v2 00/23] SMM improvements (chipset and TCG parts) Paolo Bonzini
  2015-06-03 17:08 ` [Qemu-devel] [PATCH v2 01/23] target-i386: introduce cpu_get_mem_attrs Paolo Bonzini
  2015-06-03 17:08 ` [Qemu-devel] [PATCH v2 02/23] target-i386: Use correct memory attributes for memory accesses Paolo Bonzini
@ 2015-06-03 17:08 ` Paolo Bonzini
  2015-06-03 17:08 ` [Qemu-devel] [PATCH v2 04/23] target-i386: mask NMIs on entry to SMM Paolo Bonzini
                   ` (21 subsequent siblings)
  24 siblings, 0 replies; 49+ messages in thread
From: Paolo Bonzini @ 2015-06-03 17:08 UTC (permalink / raw)
  To: qemu-devel; +Cc: lersek, kraxel, mst

In order to do this, stop using the cpu_in*/out* helpers, and instead
access address_space_io directly.

cpu_in* and cpu_out* remain for usage in the monitor, in qtest, and
in Xen.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target-i386/Makefile.objs |  2 --
 target-i386/helper.h      | 12 +++++-----
 target-i386/ioport-user.c | 60 -----------------------------------------------
 target-i386/misc_helper.c | 59 ++++++++++++++++++++++++++++++++++++----------
 target-i386/translate.c   | 12 +++++-----
 5 files changed, 58 insertions(+), 87 deletions(-)
 delete mode 100644 target-i386/ioport-user.c

diff --git a/target-i386/Makefile.objs b/target-i386/Makefile.objs
index 027b94e..7a1df2c 100644
--- a/target-i386/Makefile.objs
+++ b/target-i386/Makefile.objs
@@ -5,5 +5,3 @@ obj-y += gdbstub.o
 obj-$(CONFIG_SOFTMMU) += machine.o arch_memory_mapping.o arch_dump.o
 obj-$(CONFIG_KVM) += kvm.o
 obj-$(call lnot,$(CONFIG_KVM)) += kvm-stub.o
-obj-$(CONFIG_LINUX_USER) += ioport-user.o
-obj-$(CONFIG_BSD_USER) += ioport-user.o
diff --git a/target-i386/helper.h b/target-i386/helper.h
index 8eb0145..74308f4 100644
--- a/target-i386/helper.h
+++ b/target-i386/helper.h
@@ -86,12 +86,12 @@ DEF_HELPER_1(wrmsr, void, env)
 DEF_HELPER_2(check_iob, void, env, i32)
 DEF_HELPER_2(check_iow, void, env, i32)
 DEF_HELPER_2(check_iol, void, env, i32)
-DEF_HELPER_2(outb, void, i32, i32)
-DEF_HELPER_1(inb, tl, i32)
-DEF_HELPER_2(outw, void, i32, i32)
-DEF_HELPER_1(inw, tl, i32)
-DEF_HELPER_2(outl, void, i32, i32)
-DEF_HELPER_1(inl, tl, i32)
+DEF_HELPER_3(outb, void, env, i32, i32)
+DEF_HELPER_2(inb, tl, env, i32)
+DEF_HELPER_3(outw, void, env, i32, i32)
+DEF_HELPER_2(inw, tl, env, i32)
+DEF_HELPER_3(outl, void, env, i32, i32)
+DEF_HELPER_2(inl, tl, env, i32)
 
 DEF_HELPER_3(svm_check_intercept_param, void, env, i32, i64)
 DEF_HELPER_3(vmexit, void, env, i32, i64)
diff --git a/target-i386/ioport-user.c b/target-i386/ioport-user.c
deleted file mode 100644
index f7636e0..0000000
--- a/target-i386/ioport-user.c
+++ /dev/null
@@ -1,60 +0,0 @@
-/*
- *  qemu user ioport functions
- *
- *  Copyright (c) 2003-2008 Fabrice Bellard
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, see <http://www.gnu.org/licenses/>.
- */
-
-#include <stdio.h>
-
-#include "qemu.h"
-#include "qemu-common.h"
-#include "exec/ioport.h"
-
-void cpu_outb(pio_addr_t addr, uint8_t val)
-{
-    fprintf(stderr, "outb: port=0x%04"FMT_pioaddr", data=%02"PRIx8"\n",
-            addr, val);
-}
-
-void cpu_outw(pio_addr_t addr, uint16_t val)
-{
-    fprintf(stderr, "outw: port=0x%04"FMT_pioaddr", data=%04"PRIx16"\n",
-            addr, val);
-}
-
-void cpu_outl(pio_addr_t addr, uint32_t val)
-{
-    fprintf(stderr, "outl: port=0x%04"FMT_pioaddr", data=%08"PRIx32"\n",
-            addr, val);
-}
-
-uint8_t cpu_inb(pio_addr_t addr)
-{
-    fprintf(stderr, "inb: port=0x%04"FMT_pioaddr"\n", addr);
-    return 0;
-}
-
-uint16_t cpu_inw(pio_addr_t addr)
-{
-    fprintf(stderr, "inw: port=0x%04"FMT_pioaddr"\n", addr);
-    return 0;
-}
-
-uint32_t cpu_inl(pio_addr_t addr)
-{
-    fprintf(stderr, "inl: port=0x%04"FMT_pioaddr"\n", addr);
-    return 0;
-}
diff --git a/target-i386/misc_helper.c b/target-i386/misc_helper.c
index 4aaf1e4..52c5d65 100644
--- a/target-i386/misc_helper.c
+++ b/target-i386/misc_helper.c
@@ -18,38 +18,71 @@
  */
 
 #include "cpu.h"
-#include "exec/ioport.h"
 #include "exec/helper-proto.h"
 #include "exec/cpu_ldst.h"
+#include "exec/address-spaces.h"
 
-void helper_outb(uint32_t port, uint32_t data)
+void helper_outb(CPUX86State *env, uint32_t port, uint32_t data)
 {
-    cpu_outb(port, data & 0xff);
+#ifdef CONFIG_USER_ONLY
+    fprintf(stderr, "outb: port=0x%04x, data=%02x\n", port, data);
+#else
+    address_space_stb(&address_space_io, port, data,
+                      cpu_get_mem_attrs(env), NULL);
+#endif
 }
 
-target_ulong helper_inb(uint32_t port)
+target_ulong helper_inb(CPUX86State *env, uint32_t port)
 {
-    return cpu_inb(port);
+#ifdef CONFIG_USER_ONLY
+    fprintf(stderr, "inb: port=0x%04x\n", port);
+    return 0;
+#else
+    return address_space_ldub(&address_space_io, port,
+                              cpu_get_mem_attrs(env), NULL);
+#endif
 }
 
-void helper_outw(uint32_t port, uint32_t data)
+void helper_outw(CPUX86State *env, uint32_t port, uint32_t data)
 {
-    cpu_outw(port, data & 0xffff);
+#ifdef CONFIG_USER_ONLY
+    fprintf(stderr, "outw: port=0x%04x, data=%04x\n", port, data);
+#else
+    address_space_stw(&address_space_io, port, data,
+                      cpu_get_mem_attrs(env), NULL);
+#endif
 }
 
-target_ulong helper_inw(uint32_t port)
+target_ulong helper_inw(CPUX86State *env, uint32_t port)
 {
-    return cpu_inw(port);
+#ifdef CONFIG_USER_ONLY
+    fprintf(stderr, "inw: port=0x%04x\n", port);
+    return 0;
+#else
+    return address_space_lduw(&address_space_io, port,
+                              cpu_get_mem_attrs(env), NULL);
+#endif
 }
 
-void helper_outl(uint32_t port, uint32_t data)
+void helper_outl(CPUX86State *env, uint32_t port, uint32_t data)
 {
-    cpu_outl(port, data);
+#ifdef CONFIG_USER_ONLY
+    fprintf(stderr, "outw: port=0x%04x, data=%08x\n", port, data);
+#else
+    address_space_stl(&address_space_io, port, data,
+                      cpu_get_mem_attrs(env), NULL);
+#endif
 }
 
-target_ulong helper_inl(uint32_t port)
+target_ulong helper_inl(CPUX86State *env, uint32_t port)
 {
-    return cpu_inl(port);
+#ifdef CONFIG_USER_ONLY
+    fprintf(stderr, "inl: port=0x%04x\n", port);
+    return 0;
+#else
+    return address_space_ldl(&address_space_io, port,
+                             cpu_get_mem_attrs(env), NULL);
+#endif
 }
 
 void helper_into(CPUX86State *env, int next_eip_addend)
diff --git a/target-i386/translate.c b/target-i386/translate.c
index 305ce50..58b1959 100644
--- a/target-i386/translate.c
+++ b/target-i386/translate.c
@@ -631,13 +631,13 @@ static void gen_helper_in_func(TCGMemOp ot, TCGv v, TCGv_i32 n)
 {
     switch (ot) {
     case MO_8:
-        gen_helper_inb(v, n);
+        gen_helper_inb(v, cpu_env, n);
         break;
     case MO_16:
-        gen_helper_inw(v, n);
+        gen_helper_inw(v, cpu_env, n);
         break;
     case MO_32:
-        gen_helper_inl(v, n);
+        gen_helper_inl(v, cpu_env, n);
         break;
     default:
         tcg_abort();
@@ -648,13 +648,13 @@ static void gen_helper_out_func(TCGMemOp ot, TCGv_i32 v, TCGv_i32 n)
 {
     switch (ot) {
     case MO_8:
-        gen_helper_outb(v, n);
+        gen_helper_outb(cpu_env, v, n);
         break;
     case MO_16:
-        gen_helper_outw(v, n);
+        gen_helper_outw(cpu_env, v, n);
         break;
     case MO_32:
-        gen_helper_outl(v, n);
+        gen_helper_outl(cpu_env, v, n);
         break;
     default:
         tcg_abort();
-- 
2.4.1

^ permalink raw reply related	[flat|nested] 49+ messages in thread

* [Qemu-devel] [PATCH v2 04/23] target-i386: mask NMIs on entry to SMM
  2015-06-03 17:08 [Qemu-devel] [PATCH v2 00/23] SMM improvements (chipset and TCG parts) Paolo Bonzini
                   ` (2 preceding siblings ...)
  2015-06-03 17:08 ` [Qemu-devel] [PATCH v2 03/23] target-i386: Use correct memory attributes for ioport accesses Paolo Bonzini
@ 2015-06-03 17:08 ` Paolo Bonzini
  2015-06-03 17:08 ` [Qemu-devel] [PATCH v2 05/23] target-i386: set G=1 in SMM big real mode selectors Paolo Bonzini
                   ` (20 subsequent siblings)
  24 siblings, 0 replies; 49+ messages in thread
From: Paolo Bonzini @ 2015-06-03 17:08 UTC (permalink / raw)
  To: qemu-devel; +Cc: lersek, kraxel, mst

QEMU is not blocking NMIs on entry to SMM.  Implementing this has to
cover a few corner cases, because:

- NMIs can then be enabled by an IRET instruction and there
is no mechanism to _set_ the "NMIs masked" flag on exit from SMM:
"A special case can occur if an SMI handler nests inside an NMI handler
and then another NMI occurs. [...] When the processor enters SMM while
executing an NMI handler, the processor saves the SMRAM state save map
but does not save the attribute to keep NMI interrupts disabled.

- However, there is some hidden state, because "If NMIs were blocked
before the SMI occurred [and no IRET is executed while in SMM], they
are blocked after execution of RSM."  This is represented by the new
HF2_SMM_INSIDE_NMI_MASK bit.  If it is zero, NMIs are _unblocked_
on exit from RSM.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target-i386/cpu.h        | 20 +++++++++++---------
 target-i386/smm_helper.c |  9 +++++++++
 2 files changed, 20 insertions(+), 9 deletions(-)

diff --git a/target-i386/cpu.h b/target-i386/cpu.h
index 9f57fe9..4510ae7 100644
--- a/target-i386/cpu.h
+++ b/target-i386/cpu.h
@@ -180,15 +180,17 @@
 
 /* hflags2 */
 
-#define HF2_GIF_SHIFT        0 /* if set CPU takes interrupts */
-#define HF2_HIF_SHIFT        1 /* value of IF_MASK when entering SVM */
-#define HF2_NMI_SHIFT        2 /* CPU serving NMI */
-#define HF2_VINTR_SHIFT      3 /* value of V_INTR_MASKING bit */
-
-#define HF2_GIF_MASK          (1 << HF2_GIF_SHIFT)
-#define HF2_HIF_MASK          (1 << HF2_HIF_SHIFT)
-#define HF2_NMI_MASK          (1 << HF2_NMI_SHIFT)
-#define HF2_VINTR_MASK        (1 << HF2_VINTR_SHIFT)
+#define HF2_GIF_SHIFT            0 /* if set CPU takes interrupts */
+#define HF2_HIF_SHIFT            1 /* value of IF_MASK when entering SVM */
+#define HF2_NMI_SHIFT            2 /* CPU serving NMI */
+#define HF2_VINTR_SHIFT          3 /* value of V_INTR_MASKING bit */
+#define HF2_SMM_INSIDE_NMI_SHIFT 4 /* CPU serving SMI nested inside NMI */
+
+#define HF2_GIF_MASK            (1 << HF2_GIF_SHIFT)
+#define HF2_HIF_MASK            (1 << HF2_HIF_SHIFT)
+#define HF2_NMI_MASK            (1 << HF2_NMI_SHIFT)
+#define HF2_VINTR_MASK          (1 << HF2_VINTR_SHIFT)
+#define HF2_SMM_INSIDE_NMI_MASK (1 << HF2_SMM_INSIDE_NMI_SHIFT)
 
 #define CR0_PE_SHIFT 0
 #define CR0_MP_SHIFT 1
diff --git a/target-i386/smm_helper.c b/target-i386/smm_helper.c
index b9971b6..6207c3a 100644
--- a/target-i386/smm_helper.c
+++ b/target-i386/smm_helper.c
@@ -52,6 +52,11 @@ void do_smm_enter(X86CPU *cpu)
     log_cpu_state_mask(CPU_LOG_INT, CPU(cpu), CPU_DUMP_CCOP);
 
     env->hflags |= HF_SMM_MASK;
+    if (env->hflags2 & HF2_NMI_MASK) {
+        env->hflags2 |= HF2_SMM_INSIDE_NMI_MASK;
+    } else {
+        env->hflags2 |= HF2_NMI_MASK;
+    }
     cpu_smm_update(env);
 
     sm_state = env->smbase + 0x8000;
@@ -307,6 +312,10 @@ void helper_rsm(CPUX86State *env)
         env->smbase = x86_ldl_phys(cs, sm_state + 0x7ef8) & ~0x7fff;
     }
 #endif
+    if ((env->hflags2 & HF2_SMM_INSIDE_NMI_MASK) == 0) {
+        env->hflags2 &= ~HF2_NMI_MASK;
+    }
+    env->hflags2 &= ~HF2_SMM_INSIDE_NMI_MASK;
     env->hflags &= ~HF_SMM_MASK;
     cpu_smm_update(env);
 
-- 
2.4.1

^ permalink raw reply related	[flat|nested] 49+ messages in thread

* [Qemu-devel] [PATCH v2 05/23] target-i386: set G=1 in SMM big real mode selectors
  2015-06-03 17:08 [Qemu-devel] [PATCH v2 00/23] SMM improvements (chipset and TCG parts) Paolo Bonzini
                   ` (3 preceding siblings ...)
  2015-06-03 17:08 ` [Qemu-devel] [PATCH v2 04/23] target-i386: mask NMIs on entry to SMM Paolo Bonzini
@ 2015-06-03 17:08 ` Paolo Bonzini
  2015-06-03 17:08 ` [Qemu-devel] [PATCH v2 06/23] target-i386: wake up processors that receive an SMI Paolo Bonzini
                   ` (19 subsequent siblings)
  24 siblings, 0 replies; 49+ messages in thread
From: Paolo Bonzini @ 2015-06-03 17:08 UTC (permalink / raw)
  To: qemu-devel; +Cc: lersek, kraxel, mst

Because the limit field's bits 31:20 is 1, G should be 1.
VMX actually enforces this, let's do it for completeness
in QEMU as well.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target-i386/smm_helper.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/target-i386/smm_helper.c b/target-i386/smm_helper.c
index 6207c3a..5617a14 100644
--- a/target-i386/smm_helper.c
+++ b/target-i386/smm_helper.c
@@ -177,22 +177,22 @@ void do_smm_enter(X86CPU *cpu)
     cpu_x86_load_seg_cache(env, R_CS, (env->smbase >> 4) & 0xffff, env->smbase,
                            0xffffffff,
                            DESC_P_MASK | DESC_S_MASK | DESC_W_MASK |
-                           DESC_A_MASK);
+                           DESC_G_MASK | DESC_A_MASK);
     cpu_x86_load_seg_cache(env, R_DS, 0, 0, 0xffffffff,
                            DESC_P_MASK | DESC_S_MASK | DESC_W_MASK |
-                           DESC_A_MASK);
+                           DESC_G_MASK | DESC_A_MASK);
     cpu_x86_load_seg_cache(env, R_ES, 0, 0, 0xffffffff,
                            DESC_P_MASK | DESC_S_MASK | DESC_W_MASK |
-                           DESC_A_MASK);
+                           DESC_G_MASK | DESC_A_MASK);
     cpu_x86_load_seg_cache(env, R_SS, 0, 0, 0xffffffff,
                            DESC_P_MASK | DESC_S_MASK | DESC_W_MASK |
-                           DESC_A_MASK);
+                           DESC_G_MASK | DESC_A_MASK);
     cpu_x86_load_seg_cache(env, R_FS, 0, 0, 0xffffffff,
                            DESC_P_MASK | DESC_S_MASK | DESC_W_MASK |
-                           DESC_A_MASK);
+                           DESC_G_MASK | DESC_A_MASK);
     cpu_x86_load_seg_cache(env, R_GS, 0, 0, 0xffffffff,
                            DESC_P_MASK | DESC_S_MASK | DESC_W_MASK |
-                           DESC_A_MASK);
+                           DESC_G_MASK | DESC_A_MASK);
 }
 
 void helper_rsm(CPUX86State *env)
-- 
2.4.1

^ permalink raw reply related	[flat|nested] 49+ messages in thread

* [Qemu-devel] [PATCH v2 06/23] target-i386: wake up processors that receive an SMI
  2015-06-03 17:08 [Qemu-devel] [PATCH v2 00/23] SMM improvements (chipset and TCG parts) Paolo Bonzini
                   ` (4 preceding siblings ...)
  2015-06-03 17:08 ` [Qemu-devel] [PATCH v2 05/23] target-i386: set G=1 in SMM big real mode selectors Paolo Bonzini
@ 2015-06-03 17:08 ` Paolo Bonzini
  2015-06-03 17:08 ` [Qemu-devel] [PATCH v2 07/23] pflash_cfi01: change big-endian property to BIT type Paolo Bonzini
                   ` (18 subsequent siblings)
  24 siblings, 0 replies; 49+ messages in thread
From: Paolo Bonzini @ 2015-06-03 17:08 UTC (permalink / raw)
  To: qemu-devel; +Cc: lersek, kraxel, mst

An SMI should definitely wake up a processor in halted state!
This lets OVMF boot with SMM on multiprocessor systems, although
it halts very soon after that with a "CpuIndex != BspIndex"
assertion failure.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target-i386/cpu.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/target-i386/cpu.c b/target-i386/cpu.c
index 3305e09..523d0cd 100644
--- a/target-i386/cpu.c
+++ b/target-i386/cpu.c
@@ -2941,7 +2941,9 @@ static bool x86_cpu_has_work(CPUState *cs)
            (cs->interrupt_request & (CPU_INTERRUPT_NMI |
                                      CPU_INTERRUPT_INIT |
                                      CPU_INTERRUPT_SIPI |
-                                     CPU_INTERRUPT_MCE));
+                                     CPU_INTERRUPT_MCE)) ||
+           ((cs->interrupt_request & CPU_INTERRUPT_SMI) &&
+            !(env->hflags & HF_SMM_MASK));
 }
 
 static Property x86_cpu_properties[] = {
-- 
2.4.1

^ permalink raw reply related	[flat|nested] 49+ messages in thread

* [Qemu-devel] [PATCH v2 07/23] pflash_cfi01: change big-endian property to BIT type
  2015-06-03 17:08 [Qemu-devel] [PATCH v2 00/23] SMM improvements (chipset and TCG parts) Paolo Bonzini
                   ` (5 preceding siblings ...)
  2015-06-03 17:08 ` [Qemu-devel] [PATCH v2 06/23] target-i386: wake up processors that receive an SMI Paolo Bonzini
@ 2015-06-03 17:08 ` Paolo Bonzini
  2015-06-03 17:08 ` [Qemu-devel] [PATCH v2 08/23] pflash_cfi01: change to new-style MMIO accessors Paolo Bonzini
                   ` (17 subsequent siblings)
  24 siblings, 0 replies; 49+ messages in thread
From: Paolo Bonzini @ 2015-06-03 17:08 UTC (permalink / raw)
  To: qemu-devel; +Cc: lersek, kraxel, mst

Make this consistent with the secure property, added in the next patch.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/block/pflash_cfi01.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/hw/block/pflash_cfi01.c b/hw/block/pflash_cfi01.c
index d282695..7507a15 100644
--- a/hw/block/pflash_cfi01.c
+++ b/hw/block/pflash_cfi01.c
@@ -64,6 +64,8 @@ do {                                                        \
 #define TYPE_CFI_PFLASH01 "cfi.pflash01"
 #define CFI_PFLASH01(obj) OBJECT_CHECK(pflash_t, (obj), TYPE_CFI_PFLASH01)
 
+#define PFLASH_BE		0
+
 struct pflash_t {
     /*< private >*/
     SysBusDevice parent_obj;
@@ -75,7 +77,7 @@ struct pflash_t {
     uint8_t bank_width;
     uint8_t device_width; /* If 0, device width not specified. */
     uint8_t max_device_width;  /* max device width in bytes */
-    uint8_t be;
+    uint32_t features;
     uint8_t wcycle; /* if 0, the flash is read normally */
     int ro;
     uint8_t cmd;
@@ -773,7 +775,8 @@ static void pflash_cfi01_realize(DeviceState *dev, Error **errp)
 
     memory_region_init_rom_device(
         &pfl->mem, OBJECT(dev),
-        pfl->be ? &pflash_cfi01_ops_be : &pflash_cfi01_ops_le, pfl,
+        pfl->features & (1 << PFLASH_BE) ? &pflash_cfi01_ops_be : &pflash_cfi01_ops_le,
+        pfl,
         pfl->name, total_len, &local_err);
     if (local_err) {
         error_propagate(errp, local_err);
@@ -925,7 +928,7 @@ static Property pflash_cfi01_properties[] = {
     DEFINE_PROP_UINT8("width", struct pflash_t, bank_width, 0),
     DEFINE_PROP_UINT8("device-width", struct pflash_t, device_width, 0),
     DEFINE_PROP_UINT8("max-device-width", struct pflash_t, max_device_width, 0),
-    DEFINE_PROP_UINT8("big-endian", struct pflash_t, be, 0),
+    DEFINE_PROP_BIT("big-endian", struct pflash_t, features, PFLASH_BE, 0),
     DEFINE_PROP_UINT16("id0", struct pflash_t, ident0, 0),
     DEFINE_PROP_UINT16("id1", struct pflash_t, ident1, 0),
     DEFINE_PROP_UINT16("id2", struct pflash_t, ident2, 0),
@@ -975,7 +978,7 @@ pflash_t *pflash_cfi01_register(hwaddr base,
     qdev_prop_set_uint32(dev, "num-blocks", nb_blocs);
     qdev_prop_set_uint64(dev, "sector-length", sector_len);
     qdev_prop_set_uint8(dev, "width", bank_width);
-    qdev_prop_set_uint8(dev, "big-endian", !!be);
+    qdev_prop_set_bit(dev, "big-endian", !!be);
     qdev_prop_set_uint16(dev, "id0", id0);
     qdev_prop_set_uint16(dev, "id1", id1);
     qdev_prop_set_uint16(dev, "id2", id2);
-- 
2.4.1

^ permalink raw reply related	[flat|nested] 49+ messages in thread

* [Qemu-devel] [PATCH v2 08/23] pflash_cfi01: change to new-style MMIO accessors
  2015-06-03 17:08 [Qemu-devel] [PATCH v2 00/23] SMM improvements (chipset and TCG parts) Paolo Bonzini
                   ` (6 preceding siblings ...)
  2015-06-03 17:08 ` [Qemu-devel] [PATCH v2 07/23] pflash_cfi01: change big-endian property to BIT type Paolo Bonzini
@ 2015-06-03 17:08 ` Paolo Bonzini
  2015-06-04  6:19   ` Peter Crosthwaite
  2015-06-03 17:08 ` [Qemu-devel] [PATCH v2 09/23] pflash_cfi01: add secure property Paolo Bonzini
                   ` (16 subsequent siblings)
  24 siblings, 1 reply; 49+ messages in thread
From: Paolo Bonzini @ 2015-06-03 17:08 UTC (permalink / raw)
  To: qemu-devel; +Cc: lersek, kraxel, mst

This is a required step to implement read_with_attrs and write_with_attrs.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/block/pflash_cfi01.c | 96 ++++++-------------------------------------------
 1 file changed, 10 insertions(+), 86 deletions(-)

diff --git a/hw/block/pflash_cfi01.c b/hw/block/pflash_cfi01.c
index 7507a15..0b3667a 100644
--- a/hw/block/pflash_cfi01.c
+++ b/hw/block/pflash_cfi01.c
@@ -650,101 +650,25 @@ static void pflash_write(pflash_t *pfl, hwaddr offset,
 }
 
 
-static uint32_t pflash_readb_be(void *opaque, hwaddr addr)
-{
-    return pflash_read(opaque, addr, 1, 1);
-}
-
-static uint32_t pflash_readb_le(void *opaque, hwaddr addr)
-{
-    return pflash_read(opaque, addr, 1, 0);
-}
-
-static uint32_t pflash_readw_be(void *opaque, hwaddr addr)
+static uint64_t pflash_mem_read(void *opaque, hwaddr addr, unsigned len)
 {
     pflash_t *pfl = opaque;
+    bool be = !!(pfl->features & (1 << PFLASH_BE));
 
-    return pflash_read(pfl, addr, 2, 1);
+    return pflash_read(pfl, addr, len, be);
 }
 
-static uint32_t pflash_readw_le(void *opaque, hwaddr addr)
+static void pflash_mem_write(void *opaque, hwaddr addr, uint64_t value, unsigned len)
 {
     pflash_t *pfl = opaque;
+    bool be = !!(pfl->features & (1 << PFLASH_BE));
 
-    return pflash_read(pfl, addr, 2, 0);
+    pflash_write(pfl, addr, value, len, be);
 }
 
-static uint32_t pflash_readl_be(void *opaque, hwaddr addr)
-{
-    pflash_t *pfl = opaque;
-
-    return pflash_read(pfl, addr, 4, 1);
-}
-
-static uint32_t pflash_readl_le(void *opaque, hwaddr addr)
-{
-    pflash_t *pfl = opaque;
-
-    return pflash_read(pfl, addr, 4, 0);
-}
-
-static void pflash_writeb_be(void *opaque, hwaddr addr,
-                             uint32_t value)
-{
-    pflash_write(opaque, addr, value, 1, 1);
-}
-
-static void pflash_writeb_le(void *opaque, hwaddr addr,
-                             uint32_t value)
-{
-    pflash_write(opaque, addr, value, 1, 0);
-}
-
-static void pflash_writew_be(void *opaque, hwaddr addr,
-                             uint32_t value)
-{
-    pflash_t *pfl = opaque;
-
-    pflash_write(pfl, addr, value, 2, 1);
-}
-
-static void pflash_writew_le(void *opaque, hwaddr addr,
-                             uint32_t value)
-{
-    pflash_t *pfl = opaque;
-
-    pflash_write(pfl, addr, value, 2, 0);
-}
-
-static void pflash_writel_be(void *opaque, hwaddr addr,
-                             uint32_t value)
-{
-    pflash_t *pfl = opaque;
-
-    pflash_write(pfl, addr, value, 4, 1);
-}
-
-static void pflash_writel_le(void *opaque, hwaddr addr,
-                             uint32_t value)
-{
-    pflash_t *pfl = opaque;
-
-    pflash_write(pfl, addr, value, 4, 0);
-}
-
-static const MemoryRegionOps pflash_cfi01_ops_be = {
-    .old_mmio = {
-        .read = { pflash_readb_be, pflash_readw_be, pflash_readl_be, },
-        .write = { pflash_writeb_be, pflash_writew_be, pflash_writel_be, },
-    },
-    .endianness = DEVICE_NATIVE_ENDIAN,
-};
-
-static const MemoryRegionOps pflash_cfi01_ops_le = {
-    .old_mmio = {
-        .read = { pflash_readb_le, pflash_readw_le, pflash_readl_le, },
-        .write = { pflash_writeb_le, pflash_writew_le, pflash_writel_le, },
-    },
+static const MemoryRegionOps pflash_cfi01_ops = {
+    .read = pflash_mem_read,
+    .write = pflash_mem_write,
     .endianness = DEVICE_NATIVE_ENDIAN,
 };
 
@@ -775,7 +699,7 @@ static void pflash_cfi01_realize(DeviceState *dev, Error **errp)
 
     memory_region_init_rom_device(
         &pfl->mem, OBJECT(dev),
-        pfl->features & (1 << PFLASH_BE) ? &pflash_cfi01_ops_be : &pflash_cfi01_ops_le,
+        &pflash_cfi01_ops,
         pfl,
         pfl->name, total_len, &local_err);
     if (local_err) {
-- 
2.4.1

^ permalink raw reply related	[flat|nested] 49+ messages in thread

* [Qemu-devel] [PATCH v2 09/23] pflash_cfi01: add secure property
  2015-06-03 17:08 [Qemu-devel] [PATCH v2 00/23] SMM improvements (chipset and TCG parts) Paolo Bonzini
                   ` (7 preceding siblings ...)
  2015-06-03 17:08 ` [Qemu-devel] [PATCH v2 08/23] pflash_cfi01: change to new-style MMIO accessors Paolo Bonzini
@ 2015-06-03 17:08 ` Paolo Bonzini
  2015-06-03 17:08 ` [Qemu-devel] [PATCH v2 10/23] vl: allow full-blown QemuOpts syntax for -global Paolo Bonzini
                   ` (15 subsequent siblings)
  24 siblings, 0 replies; 49+ messages in thread
From: Paolo Bonzini @ 2015-06-03 17:08 UTC (permalink / raw)
  To: qemu-devel; +Cc: lersek, kraxel, mst

When this property is set, MMIO accesses are only allowed with the
MEMTXATTRS_SECURE attribute.  This is used for secure access to UEFI
variables stored in flash.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/block/pflash_cfi01.c | 111 +++++++++++++++++++++++++++++-------------------
 1 file changed, 67 insertions(+), 44 deletions(-)

diff --git a/hw/block/pflash_cfi01.c b/hw/block/pflash_cfi01.c
index 0b3667a..965995a 100644
--- a/hw/block/pflash_cfi01.c
+++ b/hw/block/pflash_cfi01.c
@@ -65,6 +65,7 @@ do {                                                        \
 #define CFI_PFLASH01(obj) OBJECT_CHECK(pflash_t, (obj), TYPE_CFI_PFLASH01)
 
 #define PFLASH_BE		0
+#define PFLASH_SECURE		1
 
 struct pflash_t {
     /*< private >*/
@@ -237,12 +238,57 @@ static uint32_t pflash_devid_query(pflash_t *pfl, hwaddr offset)
     return resp;
 }
 
+static uint32_t pflash_data_read(pflash_t *pfl, hwaddr offset,
+                                 int width, int be)
+{
+    uint8_t *p;
+    uint32_t ret;
+
+    p = pfl->storage;
+    switch (width) {
+    case 1:
+        ret = p[offset];
+        DPRINTF("%s: data offset " TARGET_FMT_plx " %02x\n",
+                __func__, offset, ret);
+        break;
+    case 2:
+        if (be) {
+            ret = p[offset] << 8;
+            ret |= p[offset + 1];
+        } else {
+            ret = p[offset];
+            ret |= p[offset + 1] << 8;
+        }
+        DPRINTF("%s: data offset " TARGET_FMT_plx " %04x\n",
+                __func__, offset, ret);
+        break;
+    case 4:
+        if (be) {
+            ret = p[offset] << 24;
+            ret |= p[offset + 1] << 16;
+            ret |= p[offset + 2] << 8;
+            ret |= p[offset + 3];
+        } else {
+            ret = p[offset];
+            ret |= p[offset + 1] << 8;
+            ret |= p[offset + 2] << 16;
+            ret |= p[offset + 3] << 24;
+        }
+        DPRINTF("%s: data offset " TARGET_FMT_plx " %08x\n",
+                __func__, offset, ret);
+        break;
+    default:
+        DPRINTF("BUG in %s\n", __func__);
+        abort();
+    }
+    return ret;
+}
+
 static uint32_t pflash_read (pflash_t *pfl, hwaddr offset,
                              int width, int be)
 {
     hwaddr boff;
     uint32_t ret;
-    uint8_t *p;
 
     ret = -1;
 
@@ -259,43 +305,7 @@ static uint32_t pflash_read (pflash_t *pfl, hwaddr offset,
         /* fall through to read code */
     case 0x00:
         /* Flash area read */
-        p = pfl->storage;
-        switch (width) {
-        case 1:
-            ret = p[offset];
-            DPRINTF("%s: data offset " TARGET_FMT_plx " %02x\n",
-                    __func__, offset, ret);
-            break;
-        case 2:
-            if (be) {
-                ret = p[offset] << 8;
-                ret |= p[offset + 1];
-            } else {
-                ret = p[offset];
-                ret |= p[offset + 1] << 8;
-            }
-            DPRINTF("%s: data offset " TARGET_FMT_plx " %04x\n",
-                    __func__, offset, ret);
-            break;
-        case 4:
-            if (be) {
-                ret = p[offset] << 24;
-                ret |= p[offset + 1] << 16;
-                ret |= p[offset + 2] << 8;
-                ret |= p[offset + 3];
-            } else {
-                ret = p[offset];
-                ret |= p[offset + 1] << 8;
-                ret |= p[offset + 2] << 16;
-                ret |= p[offset + 3] << 24;
-            }
-            DPRINTF("%s: data offset " TARGET_FMT_plx " %08x\n",
-                    __func__, offset, ret);
-            break;
-        default:
-            DPRINTF("BUG in %s\n", __func__);
-        }
-
+        ret = pflash_data_read(pfl, offset, width, be);
         break;
     case 0x10: /* Single byte program */
     case 0x20: /* Block erase */
@@ -650,25 +660,37 @@ static void pflash_write(pflash_t *pfl, hwaddr offset,
 }
 
 
-static uint64_t pflash_mem_read(void *opaque, hwaddr addr, unsigned len)
+static MemTxResult pflash_mem_read_with_attrs(void *opaque, hwaddr addr, uint64_t *value,
+                                              unsigned len, MemTxAttrs attrs)
 {
     pflash_t *pfl = opaque;
     bool be = !!(pfl->features & (1 << PFLASH_BE));
 
-    return pflash_read(pfl, addr, len, be);
+    if ((pfl->features & (1 << PFLASH_SECURE)) && !attrs.secure) {
+        *value = pflash_data_read(opaque, addr, len, be);
+    } else {
+        *value = pflash_read(opaque, addr, len, be);
+    }
+    return MEMTX_OK;
 }
 
-static void pflash_mem_write(void *opaque, hwaddr addr, uint64_t value, unsigned len)
+static MemTxResult pflash_mem_write_with_attrs(void *opaque, hwaddr addr, uint64_t value,
+                                               unsigned len, MemTxAttrs attrs)
 {
     pflash_t *pfl = opaque;
     bool be = !!(pfl->features & (1 << PFLASH_BE));
 
-    pflash_write(pfl, addr, value, len, be);
+    if ((pfl->features & (1 << PFLASH_SECURE)) && !attrs.secure) {
+        return MEMTX_ERROR;
+    } else {
+        pflash_write(opaque, addr, value, len, be);
+        return MEMTX_OK;
+    }
 }
 
 static const MemoryRegionOps pflash_cfi01_ops = {
-    .read = pflash_mem_read,
-    .write = pflash_mem_write,
+    .read_with_attrs = pflash_mem_read_with_attrs,
+    .write_with_attrs = pflash_mem_write_with_attrs,
     .endianness = DEVICE_NATIVE_ENDIAN,
 };
 
@@ -853,6 +875,7 @@ static Property pflash_cfi01_properties[] = {
     DEFINE_PROP_UINT8("device-width", struct pflash_t, device_width, 0),
     DEFINE_PROP_UINT8("max-device-width", struct pflash_t, max_device_width, 0),
     DEFINE_PROP_BIT("big-endian", struct pflash_t, features, PFLASH_BE, 0),
+    DEFINE_PROP_BIT("secure", struct pflash_t, features, PFLASH_SECURE, 0),
     DEFINE_PROP_UINT16("id0", struct pflash_t, ident0, 0),
     DEFINE_PROP_UINT16("id1", struct pflash_t, ident1, 0),
     DEFINE_PROP_UINT16("id2", struct pflash_t, ident2, 0),
-- 
2.4.1

^ permalink raw reply related	[flat|nested] 49+ messages in thread

* [Qemu-devel] [PATCH v2 10/23] vl: allow full-blown QemuOpts syntax for -global
  2015-06-03 17:08 [Qemu-devel] [PATCH v2 00/23] SMM improvements (chipset and TCG parts) Paolo Bonzini
                   ` (8 preceding siblings ...)
  2015-06-03 17:08 ` [Qemu-devel] [PATCH v2 09/23] pflash_cfi01: add secure property Paolo Bonzini
@ 2015-06-03 17:08 ` Paolo Bonzini
  2015-06-03 17:08 ` [Qemu-devel] [PATCH v2 11/23] qom: add object_property_add_const_link Paolo Bonzini
                   ` (14 subsequent siblings)
  24 siblings, 0 replies; 49+ messages in thread
From: Paolo Bonzini @ 2015-06-03 17:08 UTC (permalink / raw)
  To: qemu-devel; +Cc: lersek, kraxel, mst

-global does not work for drivers that have a dot in their name, such as
cfi.pflash01.  This is just a parsing limitation, because such globals
can be declared easily inside a -readconfig file.

To allow this usage, support the full QemuOpts key/value syntax for -global
too, for example "-global driver=cfi.pflash01,property=secure,value=on".
The two formats do not conflict, because the key/value syntax does not have
a period before the first equal sign.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 qdev-monitor.c  | 18 +++++++++++-------
 qemu-options.hx |  7 ++++++-
 2 files changed, 17 insertions(+), 8 deletions(-)

diff --git a/qdev-monitor.c b/qdev-monitor.c
index 1d87f57..9f17c81 100644
--- a/qdev-monitor.c
+++ b/qdev-monitor.c
@@ -822,15 +822,19 @@ int qemu_global_option(const char *str)
     QemuOpts *opts;
     int rc, offset;
 
-    rc = sscanf(str, "%63[^.].%63[^=]%n", driver, property, &offset);
-    if (rc < 2 || str[offset] != '=') {
-        error_report("can't parse: \"%s\"", str);
+    rc = sscanf(str, "%63[^.=].%63[^=]%n", driver, property, &offset);
+    if (rc == 2 && str[offset] == '=') {
+        opts = qemu_opts_create(&qemu_global_opts, NULL, 0, &error_abort);
+        qemu_opt_set(opts, "driver", driver, &error_abort);
+        qemu_opt_set(opts, "property", property, &error_abort);
+        qemu_opt_set(opts, "value", str + offset + 1, &error_abort);
+        return 0;
+    }
+
+    opts = qemu_opts_parse(&qemu_global_opts, str, false);
+    if (!opts) {
         return -1;
     }
 
-    opts = qemu_opts_create(&qemu_global_opts, NULL, 0, &error_abort);
-    qemu_opt_set(opts, "driver", driver, &error_abort);
-    qemu_opt_set(opts, "property", property, &error_abort);
-    qemu_opt_set(opts, "value", str + offset + 1, &error_abort);
     return 0;
 }
diff --git a/qemu-options.hx b/qemu-options.hx
index c74b064..5f0edce 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -171,11 +171,13 @@ Set parameter @var{arg} for item @var{id} of type @var{group}\n"
 ETEXI
 
 DEF("global", HAS_ARG, QEMU_OPTION_global,
-    "-global driver.prop=value\n"
+    "-global driver.property=value\n"
+    "-global driver=driver,property=property,value=value\n"
     "                set a global default for a driver property\n",
     QEMU_ARCH_ALL)
 STEXI
 @item -global @var{driver}.@var{prop}=@var{value}
+@itemx -global driver=@var{driver},property=@var{property},value=@var{value}
 @findex -global
 Set default value of @var{driver}'s property @var{prop} to @var{value}, e.g.:
 
@@ -186,6 +188,9 @@ qemu-system-i386 -global ide-drive.physical_block_size=4096 -drive file=file,if=
 In particular, you can use this to set driver properties for devices which are 
 created automatically by the machine model. To create a device which is not 
 created automatically and set properties on it, use -@option{device}.
+
+The two syntaxes are equivalent.  The longer one works for drivers whose name
+contains a dot.
 ETEXI
 
 DEF("boot", HAS_ARG, QEMU_OPTION_boot,
-- 
2.4.1

^ permalink raw reply related	[flat|nested] 49+ messages in thread

* [Qemu-devel] [PATCH v2 11/23] qom: add object_property_add_const_link
  2015-06-03 17:08 [Qemu-devel] [PATCH v2 00/23] SMM improvements (chipset and TCG parts) Paolo Bonzini
                   ` (9 preceding siblings ...)
  2015-06-03 17:08 ` [Qemu-devel] [PATCH v2 10/23] vl: allow full-blown QemuOpts syntax for -global Paolo Bonzini
@ 2015-06-03 17:08 ` Paolo Bonzini
  2015-06-04  6:33   ` Peter Crosthwaite
  2015-06-03 17:08 ` [Qemu-devel] [PATCH v2 12/23] vl: run "late" notifiers immediately Paolo Bonzini
                   ` (13 subsequent siblings)
  24 siblings, 1 reply; 49+ messages in thread
From: Paolo Bonzini @ 2015-06-03 17:08 UTC (permalink / raw)
  To: qemu-devel; +Cc: lersek, kraxel, mst

Suggested-by: Eduardo Habkost <ehabkost@redhat.com>
Acked-by: Andreas Faerber <afaerber@suse.de>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 include/qom/object.h | 18 ++++++++++++++++++
 qom/object.c         | 16 ++++++++++++++++
 2 files changed, 34 insertions(+)

diff --git a/include/qom/object.h b/include/qom/object.h
index d2d7748..0505f20 100644
--- a/include/qom/object.h
+++ b/include/qom/object.h
@@ -1290,6 +1290,24 @@ void object_property_add_alias(Object *obj, const char *name,
                                Error **errp);
 
 /**
+ * object_property_add_const_link:
+ * @obj: the object to add a property to
+ * @name: the name of the property
+ * @target: the object to be referred by the link
+ * @errp: if an error occurs, a pointer to an area to store the error
+ *
+ * Add an unmodifiable link for a property on an object.  This function will
+ * add a property of type link<TYPE> where TYPE is the type of @target.
+ *
+ * The caller must ensure that @target stays alive as long as
+ * this property exists.  In the case @target is a child of @obj,
+ * this will be the case.  Otherwise, the caller is responsible for
+ * taking a reference.
+ */
+void object_property_add_const_link(Object *obj, const char *name,
+                                    Object *target, Error **errp);
+
+/**
  * object_property_set_description:
  * @obj: the object owning the property
  * @name: the name of the property
diff --git a/qom/object.c b/qom/object.c
index b8dff43..96abd34 100644
--- a/qom/object.c
+++ b/qom/object.c
@@ -1266,6 +1266,22 @@ out:
     g_free(full_type);
 }
 
+void object_property_add_const_link(Object *obj, const char *name,
+                                    Object *target, Error **errp)
+{
+    char *link_type;
+    ObjectProperty *op;
+
+    link_type = g_strdup_printf("link<%s>", object_get_typename(target));
+    op = object_property_add(obj, name, link_type,
+                             object_get_child_property, NULL,
+                             NULL, target, errp);
+    if (op != NULL) {
+        op->resolve = object_resolve_child_property;
+    }
+    g_free(link_type);
+}
+
 gchar *object_get_canonical_path_component(Object *obj)
 {
     ObjectProperty *prop = NULL;
-- 
2.4.1

^ permalink raw reply related	[flat|nested] 49+ messages in thread

* [Qemu-devel] [PATCH v2 12/23] vl: run "late" notifiers immediately
  2015-06-03 17:08 [Qemu-devel] [PATCH v2 00/23] SMM improvements (chipset and TCG parts) Paolo Bonzini
                   ` (10 preceding siblings ...)
  2015-06-03 17:08 ` [Qemu-devel] [PATCH v2 11/23] qom: add object_property_add_const_link Paolo Bonzini
@ 2015-06-03 17:08 ` Paolo Bonzini
  2015-06-04  6:39   ` Peter Crosthwaite
  2015-06-03 17:08 ` [Qemu-devel] [PATCH v2 13/23] target-i386: create a separate AddressSpace for each CPU Paolo Bonzini
                   ` (12 subsequent siblings)
  24 siblings, 1 reply; 49+ messages in thread
From: Paolo Bonzini @ 2015-06-03 17:08 UTC (permalink / raw)
  To: qemu-devel; +Cc: lersek, kraxel, mst

If a machine_init_done notifier is added late, as part of a hot-plugged
device, run it immediately.
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 vl.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/vl.c b/vl.c
index 0707cfa..00def69 100644
--- a/vl.c
+++ b/vl.c
@@ -2498,14 +2498,20 @@ static void qemu_run_exit_notifiers(void)
     notifier_list_notify(&exit_notifiers, NULL);
 }
 
+static bool machine_init_done;
+
 void qemu_add_machine_init_done_notifier(Notifier *notify)
 {
     notifier_list_add(&machine_init_done_notifiers, notify);
+    if (machine_init_done) {
+        notify->notify(notify, NULL);
+    }
 }
 
 static void qemu_run_machine_init_done_notifiers(void)
 {
     notifier_list_notify(&machine_init_done_notifiers, NULL);
+    machine_init_done = true;
 }
 
 static const QEMUOption *lookup_opt(int argc, char **argv,
-- 
2.4.1

^ permalink raw reply related	[flat|nested] 49+ messages in thread

* [Qemu-devel] [PATCH v2 13/23] target-i386: create a separate AddressSpace for each CPU
  2015-06-03 17:08 [Qemu-devel] [PATCH v2 00/23] SMM improvements (chipset and TCG parts) Paolo Bonzini
                   ` (11 preceding siblings ...)
  2015-06-03 17:08 ` [Qemu-devel] [PATCH v2 12/23] vl: run "late" notifiers immediately Paolo Bonzini
@ 2015-06-03 17:08 ` Paolo Bonzini
  2015-06-03 17:58   ` Peter Crosthwaite
  2015-06-03 17:08 ` [Qemu-devel] [PATCH v2 14/23] hw/i386: add a separate region that tracks the SMRAME bit Paolo Bonzini
                   ` (11 subsequent siblings)
  24 siblings, 1 reply; 49+ messages in thread
From: Paolo Bonzini @ 2015-06-03 17:08 UTC (permalink / raw)
  To: qemu-devel; +Cc: lersek, kraxel, mst

Different CPUs can be in SMM or not at the same time, thus they
will see different things where the chipset places SMRAM.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target-i386/cpu-qom.h |  1 +
 target-i386/cpu.c     | 14 ++++++++++++++
 2 files changed, 15 insertions(+)

diff --git a/target-i386/cpu-qom.h b/target-i386/cpu-qom.h
index 31a0c1e..39cd878 100644
--- a/target-i386/cpu-qom.h
+++ b/target-i386/cpu-qom.h
@@ -111,6 +111,7 @@ typedef struct X86CPU {
     /* in order to simplify APIC support, we leave this pointer to the
        user */
     struct DeviceState *apic_state;
+    struct MemoryRegion *cpu_as_root;
 } X86CPU;
 
 static inline X86CPU *x86_env_get_cpu(CPUX86State *env)
diff --git a/target-i386/cpu.c b/target-i386/cpu.c
index 523d0cd..23b57a9 100644
--- a/target-i386/cpu.c
+++ b/target-i386/cpu.c
@@ -44,6 +44,7 @@
 #include "hw/qdev-properties.h"
 #include "hw/cpu/icc_bus.h"
 #ifndef CONFIG_USER_ONLY
+#include "exec/address-spaces.h"
 #include "hw/xen/xen.h"
 #include "hw/i386/apic_internal.h"
 #endif
@@ -2811,6 +2812,18 @@ static void x86_cpu_realizefn(DeviceState *dev, Error **errp)
 #endif
 
     mce_init(cpu);
+
+#ifndef CONFIG_USER_ONLY
+    if (tcg_enabled()) {
+        cpu->cpu_as_root = g_new(MemoryRegion, 1);
+        cs->as = g_new(AddressSpace, 1);
+        memory_region_init_alias(cpu->cpu_as_root, OBJECT(cpu), "memory",
+                                 get_system_memory(), 0, ~0ull);
+        memory_region_set_enabled(cpu->cpu_as_root, true);
+        address_space_init(cs->as, cpu->cpu_as_root, "CPU");
+    }
+#endif
+
     qemu_init_vcpu(cs);
 
     /* Only Intel CPUs support hyperthreading. Even though QEMU fixes this
@@ -2834,6 +2847,7 @@ static void x86_cpu_realizefn(DeviceState *dev, Error **errp)
     cpu_reset(cs);
 
     xcc->parent_realize(dev, &local_err);
+
 out:
     if (local_err != NULL) {
         error_propagate(errp, local_err);
-- 
2.4.1

^ permalink raw reply related	[flat|nested] 49+ messages in thread

* [Qemu-devel] [PATCH v2 14/23] hw/i386: add a separate region that tracks the SMRAME bit
  2015-06-03 17:08 [Qemu-devel] [PATCH v2 00/23] SMM improvements (chipset and TCG parts) Paolo Bonzini
                   ` (12 preceding siblings ...)
  2015-06-03 17:08 ` [Qemu-devel] [PATCH v2 13/23] target-i386: create a separate AddressSpace for each CPU Paolo Bonzini
@ 2015-06-03 17:08 ` Paolo Bonzini
  2015-06-03 17:08 ` [Qemu-devel] [PATCH v2 15/23] target-i386: use memory API to implement SMRAM Paolo Bonzini
                   ` (10 subsequent siblings)
  24 siblings, 0 replies; 49+ messages in thread
From: Paolo Bonzini @ 2015-06-03 17:08 UTC (permalink / raw)
  To: qemu-devel; +Cc: lersek, kraxel, mst

This region is exported at /machine/smram.  It is "empty" if
SMRAME=0 and points to SMRAM if SMRAME=1.  The CPU will
enable/disable it as it enters or exits SMRAM.

While touching nearby code, the existing memory region setup was
slightly inconsistent.  The smram_region is *disabled* in order to open
SMRAM (because the smram_region shows the low VRAM instead of the RAM
at 0xa0000).  Because SMRAM is closed at startup, the smram_region must
be enabled when creating the i440fx or q35 devices.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/pci-host/piix.c        | 17 ++++++++++++++++-
 hw/pci-host/q35.c         | 17 +++++++++++++++--
 include/hw/pci-host/q35.h |  1 +
 3 files changed, 32 insertions(+), 3 deletions(-)

diff --git a/hw/pci-host/piix.c b/hw/pci-host/piix.c
index 723836f..0e439c5 100644
--- a/hw/pci-host/piix.c
+++ b/hw/pci-host/piix.c
@@ -105,6 +105,7 @@ struct PCII440FXState {
     MemoryRegion *ram_memory;
     PAMMemoryRegion pam_regions[13];
     MemoryRegion smram_region;
+    MemoryRegion smram, low_smram;
     uint8_t smm_enabled;
 };
 
@@ -139,6 +140,8 @@ static void i440fx_update_memory_mappings(PCII440FXState *d)
                    pd->config[I440FX_PAM + ((i + 1) / 2)]);
     }
     smram_update(&d->smram_region, pd->config[I440FX_SMRAM], d->smm_enabled);
+    memory_region_set_enabled(&d->smram,
+                              pd->config[I440FX_SMRAM] & SMRAM_G_SMRAME);
     memory_region_transaction_commit();
 }
 
@@ -346,11 +349,23 @@ PCIBus *i440fx_init(PCII440FXState **pi440fx_state,
     pc_pci_as_mapping_init(OBJECT(f), f->system_memory,
                            f->pci_address_space);
 
+    /* if *disabled* show SMRAM to all CPUs */
     memory_region_init_alias(&f->smram_region, OBJECT(d), "smram-region",
                              f->pci_address_space, 0xa0000, 0x20000);
     memory_region_add_subregion_overlap(f->system_memory, 0xa0000,
                                         &f->smram_region, 1);
-    memory_region_set_enabled(&f->smram_region, false);
+    memory_region_set_enabled(&f->smram_region, true);
+
+    /* smram, as seen by SMM CPUs */
+    memory_region_init(&f->smram, OBJECT(d), "smram", 1ull << 32);
+    memory_region_set_enabled(&f->smram, true);
+    memory_region_init_alias(&f->low_smram, OBJECT(d), "smram-low",
+                             f->system_memory, 0xa0000, 0x20000);
+    memory_region_set_enabled(&f->low_smram, true);
+    memory_region_add_subregion(&f->smram, 0xa0000, &f->low_smram);
+    object_property_add_const_link(qdev_get_machine(), "smram",
+                                   OBJECT(&f->smram), &error_abort);
+
     init_pam(dev, f->ram_memory, f->system_memory, f->pci_address_space,
              &f->pam_regions[0], PAM_BIOS_BASE, PAM_BIOS_SIZE);
     for (i = 0; i < 12; ++i) {
diff --git a/hw/pci-host/q35.c b/hw/pci-host/q35.c
index c8827cc..72f7331 100644
--- a/hw/pci-host/q35.c
+++ b/hw/pci-host/q35.c
@@ -270,6 +270,8 @@ static void mch_update_smram(MCHPCIState *mch)
     memory_region_transaction_begin();
     smram_update(&mch->smram_region, pd->config[MCH_HOST_BRIDGE_SMRAM],
                     mch->smm_enabled);
+    memory_region_set_enabled(&mch->smram,
+                              pd->config[MCH_HOST_BRIDGE_SMRAM] & SMRAM_G_SMRAME);
     memory_region_transaction_commit();
 }
 
@@ -399,13 +401,24 @@ static void mch_realize(PCIDevice *d, Error **errp)
     pc_pci_as_mapping_init(OBJECT(mch), mch->system_memory,
                            mch->pci_address_space);
 
-    /* smram */
+    /* if *disabled* show SMRAM to all CPUs */
     cpu_smm_register(&mch_set_smm, mch);
     memory_region_init_alias(&mch->smram_region, OBJECT(mch), "smram-region",
                              mch->pci_address_space, 0xa0000, 0x20000);
     memory_region_add_subregion_overlap(mch->system_memory, 0xa0000,
                                         &mch->smram_region, 1);
-    memory_region_set_enabled(&mch->smram_region, false);
+    memory_region_set_enabled(&mch->smram_region, true);
+
+    /* smram, as seen by SMM CPUs */
+    memory_region_init(&mch->smram, OBJECT(mch), "smram", 1ull << 32);
+    memory_region_set_enabled(&mch->smram, true);
+    memory_region_init_alias(&mch->low_smram, OBJECT(mch), "smram-low",
+                             mch->system_memory, 0xa0000, 0x20000);
+    memory_region_set_enabled(&mch->low_smram, true);
+    memory_region_add_subregion(&mch->smram, 0xa0000, &mch->low_smram);
+    object_property_add_const_link(qdev_get_machine(), "smram",
+				   OBJECT(&mch->smram), &error_abort);
+
     init_pam(DEVICE(mch), mch->ram_memory, mch->system_memory,
              mch->pci_address_space, &mch->pam_regions[0],
              PAM_BIOS_BASE, PAM_BIOS_SIZE);
diff --git a/include/hw/pci-host/q35.h b/include/hw/pci-host/q35.h
index 96d4cdc..4c9eacc 100644
--- a/include/hw/pci-host/q35.h
+++ b/include/hw/pci-host/q35.h
@@ -53,6 +53,7 @@ typedef struct MCHPCIState {
     MemoryRegion *address_space_io;
     PAMMemoryRegion pam_regions[13];
     MemoryRegion smram_region;
+    MemoryRegion smram, low_smram;
     PcPciInfo pci_info;
     uint8_t smm_enabled;
     ram_addr_t below_4g_mem_size;
-- 
2.4.1

^ permalink raw reply related	[flat|nested] 49+ messages in thread

* [Qemu-devel] [PATCH v2 15/23] target-i386: use memory API to implement SMRAM
  2015-06-03 17:08 [Qemu-devel] [PATCH v2 00/23] SMM improvements (chipset and TCG parts) Paolo Bonzini
                   ` (13 preceding siblings ...)
  2015-06-03 17:08 ` [Qemu-devel] [PATCH v2 14/23] hw/i386: add a separate region that tracks the SMRAME bit Paolo Bonzini
@ 2015-06-03 17:08 ` Paolo Bonzini
  2015-06-04  7:19   ` Peter Crosthwaite
  2015-06-03 17:08 ` [Qemu-devel] [PATCH v2 16/23] hw/i386: remove smram_update Paolo Bonzini
                   ` (9 subsequent siblings)
  24 siblings, 1 reply; 49+ messages in thread
From: Paolo Bonzini @ 2015-06-03 17:08 UTC (permalink / raw)
  To: qemu-devel; +Cc: lersek, kraxel, mst

Remove cpu_smm_register and cpu_smm_update.  Instead, each CPU
address space gets an extra region which is an alias of
/machine/smram.  This extra region is enabled or disabled
as the CPU enters/exits SMM.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 bsd-user/main.c           |  4 ----
 hw/i386/pc.c              | 21 ---------------------
 hw/pci-host/pam.c         | 18 ++----------------
 hw/pci-host/piix.c        | 28 ++++++++--------------------
 hw/pci-host/q35.c         | 22 ++++++----------------
 include/hw/i386/pc.h      |  1 -
 include/hw/pci-host/pam.h |  5 +----
 include/hw/pci-host/q35.h |  1 -
 linux-user/main.c         |  4 ----
 target-i386/cpu-qom.h     |  4 +++-
 target-i386/cpu.c         | 33 +++++++++++++++++++++++++++++++--
 target-i386/cpu.h         |  3 ++-
 target-i386/machine.c     |  3 +++
 target-i386/smm_helper.c  | 14 ++++++++++++--
 14 files changed, 68 insertions(+), 93 deletions(-)

diff --git a/bsd-user/main.c b/bsd-user/main.c
index 5bfaf5c..ba0b998 100644
--- a/bsd-user/main.c
+++ b/bsd-user/main.c
@@ -108,10 +108,6 @@ void cpu_list_unlock(void)
 /***********************************************************/
 /* CPUX86 core interface */
 
-void cpu_smm_update(CPUX86State *env)
-{
-}
-
 uint64_t cpu_get_tsc(CPUX86State *env)
 {
     return cpu_get_real_ticks();
diff --git a/hw/i386/pc.c b/hw/i386/pc.c
index 1eb1db0..43bc505 100644
--- a/hw/i386/pc.c
+++ b/hw/i386/pc.c
@@ -163,27 +163,6 @@ uint64_t cpu_get_tsc(CPUX86State *env)
     return cpu_get_ticks();
 }
 
-/* SMM support */
-
-static cpu_set_smm_t smm_set;
-static void *smm_arg;
-
-void cpu_smm_register(cpu_set_smm_t callback, void *arg)
-{
-    assert(smm_set == NULL);
-    assert(smm_arg == NULL);
-    smm_set = callback;
-    smm_arg = arg;
-}
-
-void cpu_smm_update(CPUX86State *env)
-{
-    if (smm_set && smm_arg && CPU(x86_env_get_cpu(env)) == first_cpu) {
-        smm_set(!!(env->hflags & HF_SMM_MASK), smm_arg);
-    }
-}
-
-
 /* IRQ handling */
 int cpu_get_pic_interrupt(CPUX86State *env)
 {
diff --git a/hw/pci-host/pam.c b/hw/pci-host/pam.c
index 8272de3..99d7af9 100644
--- a/hw/pci-host/pam.c
+++ b/hw/pci-host/pam.c
@@ -31,26 +31,12 @@
 #include "sysemu/sysemu.h"
 #include "hw/pci-host/pam.h"
 
-void smram_update(MemoryRegion *smram_region, uint8_t smram,
-                  uint8_t smm_enabled)
+void smram_update(MemoryRegion *smram_region, uint8_t smram)
 {
-    bool smram_enabled;
-
-    smram_enabled = ((smm_enabled && (smram & SMRAM_G_SMRAME)) ||
-                        (smram & SMRAM_D_OPEN));
+    bool smram_enabled = (smram & SMRAM_D_OPEN);
     memory_region_set_enabled(smram_region, !smram_enabled);
 }
 
-void smram_set_smm(uint8_t *host_smm_enabled, int smm, uint8_t smram,
-                   MemoryRegion *smram_region)
-{
-    uint8_t smm_enabled = (smm != 0);
-    if (*host_smm_enabled != smm_enabled) {
-        *host_smm_enabled = smm_enabled;
-        smram_update(smram_region, smram, *host_smm_enabled);
-    }
-}
-
 void init_pam(DeviceState *dev, MemoryRegion *ram_memory,
               MemoryRegion *system_memory, MemoryRegion *pci_address_space,
               PAMMemoryRegion *mem, uint32_t start, uint32_t size)
diff --git a/hw/pci-host/piix.c b/hw/pci-host/piix.c
index 0e439c5..a91ad73 100644
--- a/hw/pci-host/piix.c
+++ b/hw/pci-host/piix.c
@@ -106,7 +106,6 @@ struct PCII440FXState {
     PAMMemoryRegion pam_regions[13];
     MemoryRegion smram_region;
     MemoryRegion smram, low_smram;
-    uint8_t smm_enabled;
 };
 
 
@@ -139,23 +138,12 @@ static void i440fx_update_memory_mappings(PCII440FXState *d)
         pam_update(&d->pam_regions[i], i,
                    pd->config[I440FX_PAM + ((i + 1) / 2)]);
     }
-    smram_update(&d->smram_region, pd->config[I440FX_SMRAM], d->smm_enabled);
+    smram_update(&d->smram_region, pd->config[I440FX_SMRAM]);
     memory_region_set_enabled(&d->smram,
                               pd->config[I440FX_SMRAM] & SMRAM_G_SMRAME);
     memory_region_transaction_commit();
 }
 
-static void i440fx_set_smm(int val, void *arg)
-{
-    PCII440FXState *d = arg;
-    PCIDevice *pd = PCI_DEVICE(d);
-
-    memory_region_transaction_begin();
-    smram_set_smm(&d->smm_enabled, val, pd->config[I440FX_SMRAM],
-                  &d->smram_region);
-    memory_region_transaction_commit();
-}
-
 
 static void i440fx_write_config(PCIDevice *dev,
                                 uint32_t address, uint32_t val, int len)
@@ -175,12 +163,13 @@ static int i440fx_load_old(QEMUFile* f, void *opaque, int version_id)
     PCII440FXState *d = opaque;
     PCIDevice *pd = PCI_DEVICE(d);
     int ret, i;
+    uint8_t smm_enabled;
 
     ret = pci_device_load(pd, f);
     if (ret < 0)
         return ret;
     i440fx_update_memory_mappings(d);
-    qemu_get_8s(f, &d->smm_enabled);
+    qemu_get_8s(f, &smm_enabled);
 
     if (version_id == 2) {
         for (i = 0; i < PIIX_NUM_PIRQS; i++) {
@@ -208,7 +197,10 @@ static const VMStateDescription vmstate_i440fx = {
     .post_load = i440fx_post_load,
     .fields = (VMStateField[]) {
         VMSTATE_PCI_DEVICE(parent_obj, PCII440FXState),
-        VMSTATE_UINT8(smm_enabled, PCII440FXState),
+        /* Used to be smm_enabled, which was basically always zero because
+         * SeaBIOS hardly uses SMM.  SMRAM is now handled by CPU code.
+         */
+        VMSTATE_UNUSED(1),
         VMSTATE_END_OF_LIST()
     }
 };
@@ -300,11 +292,7 @@ static void i440fx_pcihost_realize(DeviceState *dev, Error **errp)
 
 static void i440fx_realize(PCIDevice *dev, Error **errp)
 {
-    PCII440FXState *d = I440FX_PCI_DEVICE(dev);
-
     dev->config[I440FX_SMRAM] = 0x02;
-
-    cpu_smm_register(&i440fx_set_smm, d);
 }
 
 PCIBus *i440fx_init(PCII440FXState **pi440fx_state,
@@ -360,7 +348,7 @@ PCIBus *i440fx_init(PCII440FXState **pi440fx_state,
     memory_region_init(&f->smram, OBJECT(d), "smram", 1ull << 32);
     memory_region_set_enabled(&f->smram, true);
     memory_region_init_alias(&f->low_smram, OBJECT(d), "smram-low",
-                             f->system_memory, 0xa0000, 0x20000);
+                             f->ram_memory, 0xa0000, 0x20000);
     memory_region_set_enabled(&f->low_smram, true);
     memory_region_add_subregion(&f->smram, 0xa0000, &f->low_smram);
     object_property_add_const_link(qdev_get_machine(), "smram",
diff --git a/hw/pci-host/q35.c b/hw/pci-host/q35.c
index 72f7331..40a3c4d 100644
--- a/hw/pci-host/q35.c
+++ b/hw/pci-host/q35.c
@@ -268,24 +268,12 @@ static void mch_update_smram(MCHPCIState *mch)
     PCIDevice *pd = PCI_DEVICE(mch);
 
     memory_region_transaction_begin();
-    smram_update(&mch->smram_region, pd->config[MCH_HOST_BRIDGE_SMRAM],
-                    mch->smm_enabled);
+    smram_update(&mch->smram_region, pd->config[MCH_HOST_BRIDGE_SMRAM]);
     memory_region_set_enabled(&mch->smram,
                               pd->config[MCH_HOST_BRIDGE_SMRAM] & SMRAM_G_SMRAME);
     memory_region_transaction_commit();
 }
 
-static void mch_set_smm(int smm, void *arg)
-{
-    MCHPCIState *mch = arg;
-    PCIDevice *pd = PCI_DEVICE(mch);
-
-    memory_region_transaction_begin();
-    smram_set_smm(&mch->smm_enabled, smm, pd->config[MCH_HOST_BRIDGE_SMRAM],
-                    &mch->smram_region);
-    memory_region_transaction_commit();
-}
-
 static void mch_write_config(PCIDevice *d,
                               uint32_t address, uint32_t val, int len)
 {
@@ -331,7 +319,10 @@ static const VMStateDescription vmstate_mch = {
     .post_load = mch_post_load,
     .fields = (VMStateField[]) {
         VMSTATE_PCI_DEVICE(parent_obj, MCHPCIState),
-        VMSTATE_UINT8(smm_enabled, MCHPCIState),
+        /* Used to be smm_enabled, which was basically always zero because
+         * SeaBIOS hardly uses SMM.  SMRAM is now handled by CPU code.
+         */
+        VMSTATE_UNUSED(1),
         VMSTATE_END_OF_LIST()
     }
 };
@@ -402,7 +393,6 @@ static void mch_realize(PCIDevice *d, Error **errp)
                            mch->pci_address_space);
 
     /* if *disabled* show SMRAM to all CPUs */
-    cpu_smm_register(&mch_set_smm, mch);
     memory_region_init_alias(&mch->smram_region, OBJECT(mch), "smram-region",
                              mch->pci_address_space, 0xa0000, 0x20000);
     memory_region_add_subregion_overlap(mch->system_memory, 0xa0000,
@@ -413,7 +403,7 @@ static void mch_realize(PCIDevice *d, Error **errp)
     memory_region_init(&mch->smram, OBJECT(mch), "smram", 1ull << 32);
     memory_region_set_enabled(&mch->smram, true);
     memory_region_init_alias(&mch->low_smram, OBJECT(mch), "smram-low",
-                             mch->system_memory, 0xa0000, 0x20000);
+                             mch->ram_memory, 0xa0000, 0x20000);
     memory_region_set_enabled(&mch->low_smram, true);
     memory_region_add_subregion(&mch->smram, 0xa0000, &mch->low_smram);
     object_property_add_const_link(qdev_get_machine(), "smram",
diff --git a/include/hw/i386/pc.h b/include/hw/i386/pc.h
index 27bd748..88cbff5 100644
--- a/include/hw/i386/pc.h
+++ b/include/hw/i386/pc.h
@@ -210,7 +210,6 @@ void pc_nic_init(ISABus *isa_bus, PCIBus *pci_bus);
 void pc_pci_device_init(PCIBus *pci_bus);
 
 typedef void (*cpu_set_smm_t)(int smm, void *arg);
-void cpu_smm_register(cpu_set_smm_t callback, void *arg);
 
 void ioapic_init_gsi(GSIState *gsi_state, const char *parent_name);
 
diff --git a/include/hw/pci-host/pam.h b/include/hw/pci-host/pam.h
index 4d03e4b..80dd605 100644
--- a/include/hw/pci-host/pam.h
+++ b/include/hw/pci-host/pam.h
@@ -86,10 +86,7 @@ typedef struct PAMMemoryRegion {
     unsigned current;
 } PAMMemoryRegion;
 
-void smram_update(MemoryRegion *smram_region, uint8_t smram,
-                  uint8_t smm_enabled);
-void smram_set_smm(uint8_t *host_smm_enabled, int smm, uint8_t smram,
-                   MemoryRegion *smram_region);
+void smram_update(MemoryRegion *smram_region, uint8_t smram);
 void init_pam(DeviceState *dev, MemoryRegion *ram, MemoryRegion *system,
               MemoryRegion *pci, PAMMemoryRegion *mem, uint32_t start, uint32_t size);
 void pam_update(PAMMemoryRegion *mem, int idx, uint8_t val);
diff --git a/include/hw/pci-host/q35.h b/include/hw/pci-host/q35.h
index 4c9eacc..17adeaa 100644
--- a/include/hw/pci-host/q35.h
+++ b/include/hw/pci-host/q35.h
@@ -55,7 +55,6 @@ typedef struct MCHPCIState {
     MemoryRegion smram_region;
     MemoryRegion smram, low_smram;
     PcPciInfo pci_info;
-    uint8_t smm_enabled;
     ram_addr_t below_4g_mem_size;
     ram_addr_t above_4g_mem_size;
     uint64_t pci_hole64_size;
diff --git a/linux-user/main.c b/linux-user/main.c
index 3f32db0..6989b82 100644
--- a/linux-user/main.c
+++ b/linux-user/main.c
@@ -215,10 +215,6 @@ void cpu_list_unlock(void)
 /***********************************************************/
 /* CPUX86 core interface */
 
-void cpu_smm_update(CPUX86State *env)
-{
-}
-
 uint64_t cpu_get_tsc(CPUX86State *env)
 {
     return cpu_get_real_ticks();
diff --git a/target-i386/cpu-qom.h b/target-i386/cpu-qom.h
index 39cd878..7a4fddd 100644
--- a/target-i386/cpu-qom.h
+++ b/target-i386/cpu-qom.h
@@ -23,6 +23,7 @@
 #include "qom/cpu.h"
 #include "cpu.h"
 #include "qapi/error.h"
+#include "qemu/notify.h"
 
 #ifdef TARGET_X86_64
 #define TYPE_X86_CPU "x86_64-cpu"
@@ -111,7 +112,8 @@ typedef struct X86CPU {
     /* in order to simplify APIC support, we leave this pointer to the
        user */
     struct DeviceState *apic_state;
-    struct MemoryRegion *cpu_as_root;
+    struct MemoryRegion *cpu_as_root, *cpu_as_mem, *smram;
+    Notifier machine_done;
 } X86CPU;
 
 static inline X86CPU *x86_env_get_cpu(CPUX86State *env)
diff --git a/target-i386/cpu.c b/target-i386/cpu.c
index 23b57a9..cb20c40 100644
--- a/target-i386/cpu.c
+++ b/target-i386/cpu.c
@@ -2751,6 +2751,21 @@ static void x86_cpu_apic_realize(X86CPU *cpu, Error **errp)
     object_property_set_bool(OBJECT(cpu->apic_state), true, "realized",
                              errp);
 }
+
+static void x86_cpu_machine_done(Notifier *n, void *unused)
+{
+    X86CPU *cpu = container_of(n, X86CPU, machine_done);
+    MemoryRegion *smram =
+        (MemoryRegion *) object_resolve_path("/machine/smram", NULL);
+
+    if (smram) {
+        cpu->smram = g_new(MemoryRegion, 1);
+        memory_region_init_alias(cpu->smram, OBJECT(cpu), "smram",
+                                 smram, 0, 1ull << 32);
+        memory_region_set_enabled(cpu->smram, false);
+        memory_region_add_subregion_overlap(cpu->cpu_as_root, 0, cpu->smram, 1);
+    }
+}
 #else
 static void x86_cpu_apic_realize(X86CPU *cpu, Error **errp)
 {
@@ -2815,12 +2830,26 @@ static void x86_cpu_realizefn(DeviceState *dev, Error **errp)
 
 #ifndef CONFIG_USER_ONLY
     if (tcg_enabled()) {
+        cpu->cpu_as_mem = g_new(MemoryRegion, 1);
         cpu->cpu_as_root = g_new(MemoryRegion, 1);
         cs->as = g_new(AddressSpace, 1);
-        memory_region_init_alias(cpu->cpu_as_root, OBJECT(cpu), "memory",
-                                 get_system_memory(), 0, ~0ull);
+
+        /* Outer container... */
+        memory_region_init(cpu->cpu_as_root, OBJECT(cpu), "memory", ~0ull);
         memory_region_set_enabled(cpu->cpu_as_root, true);
+
+        /* ... with two regions inside: normal system memory with low
+         * priority, and...
+         */
+        memory_region_init_alias(cpu->cpu_as_mem, OBJECT(cpu), "memory",
+                                 get_system_memory(), 0, ~0ull);
+        memory_region_add_subregion_overlap(cpu->cpu_as_root, 0, cpu->cpu_as_mem, 0);
+        memory_region_set_enabled(cpu->cpu_as_mem, true);
         address_space_init(cs->as, cpu->cpu_as_root, "CPU");
+
+        /* ... SMRAM with higher priority, linked from /machine/smram.  */
+        cpu->machine_done.notify = x86_cpu_machine_done;
+        qemu_add_machine_init_done_notifier(&cpu->machine_done);
     }
 #endif
 
diff --git a/target-i386/cpu.h b/target-i386/cpu.h
index 4510ae7..df6e885 100644
--- a/target-i386/cpu.h
+++ b/target-i386/cpu.h
@@ -1157,7 +1157,6 @@ void cpu_x86_update_cr3(CPUX86State *env, target_ulong new_cr3);
 void cpu_x86_update_cr4(CPUX86State *env, uint32_t new_cr4);
 
 /* hw/pc.c */
-void cpu_smm_update(CPUX86State *env);
 uint64_t cpu_get_tsc(CPUX86State *env);
 
 #define TARGET_PAGE_BITS 12
@@ -1323,7 +1322,9 @@ void cpu_vmexit(CPUX86State *nenv, uint32_t exit_code, uint64_t exit_info_1);
 /* seg_helper.c */
 void do_interrupt_x86_hardirq(CPUX86State *env, int intno, int is_hw);
 
+/* smm_helper.c */
 void do_smm_enter(X86CPU *cpu);
+void cpu_smm_update(X86CPU *cpu);
 
 void cpu_report_tpr_access(CPUX86State *env, TPRAccess access);
 
diff --git a/target-i386/machine.c b/target-i386/machine.c
index cd1ddd2..69d86cb 100644
--- a/target-i386/machine.c
+++ b/target-i386/machine.c
@@ -372,6 +372,9 @@ static int cpu_post_load(void *opaque, int version_id)
     }
     tlb_flush(cs, 1);
 
+    if (tcg_enabled()) {
+        cpu_smm_update(cpu);
+    }
     return 0;
 }
 
diff --git a/target-i386/smm_helper.c b/target-i386/smm_helper.c
index 5617a14..02e24b9 100644
--- a/target-i386/smm_helper.c
+++ b/target-i386/smm_helper.c
@@ -40,6 +40,16 @@ void helper_rsm(CPUX86State *env)
 #define SMM_REVISION_ID 0x00020000
 #endif
 
+void cpu_smm_update(X86CPU *cpu)
+{
+    CPUX86State *env = &cpu->env;
+    bool smm_enabled = (env->hflags & HF_SMM_MASK);
+
+    if (cpu->smram) {
+        memory_region_set_enabled(cpu->smram, smm_enabled);
+    }
+}
+
 void do_smm_enter(X86CPU *cpu)
 {
     CPUX86State *env = &cpu->env;
@@ -57,7 +67,7 @@ void do_smm_enter(X86CPU *cpu)
     } else {
         env->hflags2 |= HF2_NMI_MASK;
     }
-    cpu_smm_update(env);
+    cpu_smm_update(cpu);
 
     sm_state = env->smbase + 0x8000;
 
@@ -317,7 +327,7 @@ void helper_rsm(CPUX86State *env)
     }
     env->hflags2 &= ~HF2_SMM_INSIDE_NMI_MASK;
     env->hflags &= ~HF_SMM_MASK;
-    cpu_smm_update(env);
+    cpu_smm_update(cpu);
 
     qemu_log_mask(CPU_LOG_INT, "SMM: after RSM\n");
     log_cpu_state_mask(CPU_LOG_INT, CPU(cpu), CPU_DUMP_CCOP);
-- 
2.4.1

^ permalink raw reply related	[flat|nested] 49+ messages in thread

* [Qemu-devel] [PATCH v2 16/23] hw/i386: remove smram_update
  2015-06-03 17:08 [Qemu-devel] [PATCH v2 00/23] SMM improvements (chipset and TCG parts) Paolo Bonzini
                   ` (14 preceding siblings ...)
  2015-06-03 17:08 ` [Qemu-devel] [PATCH v2 15/23] target-i386: use memory API to implement SMRAM Paolo Bonzini
@ 2015-06-03 17:08 ` Paolo Bonzini
  2015-06-03 17:08 ` [Qemu-devel] [PATCH v2 17/23] q35: implement high SMRAM Paolo Bonzini
                   ` (8 subsequent siblings)
  24 siblings, 0 replies; 49+ messages in thread
From: Paolo Bonzini @ 2015-06-03 17:08 UTC (permalink / raw)
  To: qemu-devel; +Cc: lersek, kraxel, mst

It's easier to inline it now that most of its work is done by the CPU
(rather than the chipset) through /machine/smram and the memory API.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/pci-host/pam.c         | 6 ------
 hw/pci-host/piix.c        | 3 ++-
 hw/pci-host/q35.c         | 3 ++-
 include/hw/pci-host/pam.h | 1 -
 4 files changed, 4 insertions(+), 9 deletions(-)

diff --git a/hw/pci-host/pam.c b/hw/pci-host/pam.c
index 99d7af9..17d826c 100644
--- a/hw/pci-host/pam.c
+++ b/hw/pci-host/pam.c
@@ -31,12 +31,6 @@
 #include "sysemu/sysemu.h"
 #include "hw/pci-host/pam.h"
 
-void smram_update(MemoryRegion *smram_region, uint8_t smram)
-{
-    bool smram_enabled = (smram & SMRAM_D_OPEN);
-    memory_region_set_enabled(smram_region, !smram_enabled);
-}
-
 void init_pam(DeviceState *dev, MemoryRegion *ram_memory,
               MemoryRegion *system_memory, MemoryRegion *pci_address_space,
               PAMMemoryRegion *mem, uint32_t start, uint32_t size)
diff --git a/hw/pci-host/piix.c b/hw/pci-host/piix.c
index a91ad73..f1712b8 100644
--- a/hw/pci-host/piix.c
+++ b/hw/pci-host/piix.c
@@ -138,7 +138,8 @@ static void i440fx_update_memory_mappings(PCII440FXState *d)
         pam_update(&d->pam_regions[i], i,
                    pd->config[I440FX_PAM + ((i + 1) / 2)]);
     }
-    smram_update(&d->smram_region, pd->config[I440FX_SMRAM]);
+    memory_region_set_enabled(&d->smram_region,
+                              !(pd->config[I440FX_SMRAM] & SMRAM_D_OPEN));
     memory_region_set_enabled(&d->smram,
                               pd->config[I440FX_SMRAM] & SMRAM_G_SMRAME);
     memory_region_transaction_commit();
diff --git a/hw/pci-host/q35.c b/hw/pci-host/q35.c
index 40a3c4d..236d3f5 100644
--- a/hw/pci-host/q35.c
+++ b/hw/pci-host/q35.c
@@ -268,7 +268,8 @@ static void mch_update_smram(MCHPCIState *mch)
     PCIDevice *pd = PCI_DEVICE(mch);
 
     memory_region_transaction_begin();
-    smram_update(&mch->smram_region, pd->config[MCH_HOST_BRIDGE_SMRAM]);
+    memory_region_set_enabled(&mch->smram_region,
+                              !(pd->config[MCH_HOST_BRIDGE_SMRAM] & SMRAM_D_OPEN));
     memory_region_set_enabled(&mch->smram,
                               pd->config[MCH_HOST_BRIDGE_SMRAM] & SMRAM_G_SMRAME);
     memory_region_transaction_commit();
diff --git a/include/hw/pci-host/pam.h b/include/hw/pci-host/pam.h
index 80dd605..6116c63 100644
--- a/include/hw/pci-host/pam.h
+++ b/include/hw/pci-host/pam.h
@@ -86,7 +86,6 @@ typedef struct PAMMemoryRegion {
     unsigned current;
 } PAMMemoryRegion;
 
-void smram_update(MemoryRegion *smram_region, uint8_t smram);
 void init_pam(DeviceState *dev, MemoryRegion *ram, MemoryRegion *system,
               MemoryRegion *pci, PAMMemoryRegion *mem, uint32_t start, uint32_t size);
 void pam_update(PAMMemoryRegion *mem, int idx, uint8_t val);
-- 
2.4.1

^ permalink raw reply related	[flat|nested] 49+ messages in thread

* [Qemu-devel] [PATCH v2 17/23] q35: implement high SMRAM
  2015-06-03 17:08 [Qemu-devel] [PATCH v2 00/23] SMM improvements (chipset and TCG parts) Paolo Bonzini
                   ` (15 preceding siblings ...)
  2015-06-03 17:08 ` [Qemu-devel] [PATCH v2 16/23] hw/i386: remove smram_update Paolo Bonzini
@ 2015-06-03 17:08 ` Paolo Bonzini
  2015-06-04 12:50   ` Michael S. Tsirkin
  2015-06-03 17:08 ` [Qemu-devel] [PATCH v2 18/23] q35: fix ESMRAMC default Paolo Bonzini
                   ` (7 subsequent siblings)
  24 siblings, 1 reply; 49+ messages in thread
From: Paolo Bonzini @ 2015-06-03 17:08 UTC (permalink / raw)
  To: qemu-devel; +Cc: lersek, kraxel, mst

When H_SMRAME is 1, low memory at 0xa0000 is left alone by
SMM, and instead the chipset maps the 0xa0000-0xbffff window at
0xfeda0000-0xfedbffff.  This affects both the "non-SMM" view controlled
by D_OPEN and the SMM view controlled by G_SMRAME, so add two new
MemoryRegions and toggle the enabled/disabled state of all four
in mch_update_smram.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/pci-host/q35.c         | 35 +++++++++++++++++++++++++++++++----
 include/hw/pci-host/q35.h | 16 ++++++++--------
 2 files changed, 39 insertions(+), 12 deletions(-)

diff --git a/hw/pci-host/q35.c b/hw/pci-host/q35.c
index 236d3f5..92804fe 100644
--- a/hw/pci-host/q35.c
+++ b/hw/pci-host/q35.c
@@ -266,12 +266,29 @@ static void mch_update_pam(MCHPCIState *mch)
 static void mch_update_smram(MCHPCIState *mch)
 {
     PCIDevice *pd = PCI_DEVICE(mch);
+    bool h_smrame = (pd->config[MCH_HOST_BRIDGE_ESMRAMC] & MCH_HOST_BRIDGE_ESMRAMC_H_SMRAME);
 
     memory_region_transaction_begin();
-    memory_region_set_enabled(&mch->smram_region,
-                              !(pd->config[MCH_HOST_BRIDGE_SMRAM] & SMRAM_D_OPEN));
-    memory_region_set_enabled(&mch->smram,
-                              pd->config[MCH_HOST_BRIDGE_SMRAM] & SMRAM_G_SMRAME);
+
+    if (pd->config[MCH_HOST_BRIDGE_SMRAM] & SMRAM_D_OPEN) {
+        /* Hide (!) low SMRAM if H_SMRAME = 1 */
+        memory_region_set_enabled(&mch->smram_region, h_smrame);
+        /* Show high SMRAM if H_SMRAME = 1 */
+        memory_region_set_enabled(&mch->open_high_smram, h_smrame);
+    } else {
+        /* Hide high SMRAM and low SMRAM */
+        memory_region_set_enabled(&mch->smram_region, true);
+        memory_region_set_enabled(&mch->open_high_smram, false);
+    }
+
+    if (pd->config[MCH_HOST_BRIDGE_SMRAM] & SMRAM_G_SMRAME) {
+        memory_region_set_enabled(&mch->low_smram, !h_smrame);
+        memory_region_set_enabled(&mch->high_smram, h_smrame);
+    } else {
+        memory_region_set_enabled(&mch->low_smram, false);
+        memory_region_set_enabled(&mch->high_smram, false);
+    }
+
     memory_region_transaction_commit();
 }
 
@@ -400,6 +417,12 @@ static void mch_realize(PCIDevice *d, Error **errp)
                                         &mch->smram_region, 1);
     memory_region_set_enabled(&mch->smram_region, true);
 
+    memory_region_init_alias(&mch->open_high_smram, OBJECT(mch), "smram-open-high",
+                             mch->ram_memory, 0xa0000, 0x20000);
+    memory_region_add_subregion_overlap(mch->system_memory, 0xfeda0000,
+                                        &mch->open_high_smram, 1);
+    memory_region_set_enabled(&mch->open_high_smram, false);
+
     /* smram, as seen by SMM CPUs */
     memory_region_init(&mch->smram, OBJECT(mch), "smram", 1ull << 32);
     memory_region_set_enabled(&mch->smram, true);
@@ -407,6 +430,10 @@ static void mch_realize(PCIDevice *d, Error **errp)
                              mch->ram_memory, 0xa0000, 0x20000);
     memory_region_set_enabled(&mch->low_smram, true);
     memory_region_add_subregion(&mch->smram, 0xa0000, &mch->low_smram);
+    memory_region_init_alias(&mch->high_smram, OBJECT(mch), "smram-high",
+                             mch->ram_memory, 0xa0000, 0x20000);
+    memory_region_set_enabled(&mch->high_smram, true);
+    memory_region_add_subregion(&mch->smram, 0xfeda0000, &mch->high_smram);
     object_property_add_const_link(qdev_get_machine(), "smram",
 				   OBJECT(&mch->smram), &error_abort);
 
diff --git a/include/hw/pci-host/q35.h b/include/hw/pci-host/q35.h
index 17adeaa..0fff6a2 100644
--- a/include/hw/pci-host/q35.h
+++ b/include/hw/pci-host/q35.h
@@ -52,8 +52,8 @@ typedef struct MCHPCIState {
     MemoryRegion *system_memory;
     MemoryRegion *address_space_io;
     PAMMemoryRegion pam_regions[13];
-    MemoryRegion smram_region;
-    MemoryRegion smram, low_smram;
+    MemoryRegion smram_region, open_high_smram;
+    MemoryRegion smram, low_smram, high_smram;
     PcPciInfo pci_info;
     ram_addr_t below_4g_mem_size;
     ram_addr_t above_4g_mem_size;
@@ -127,7 +127,7 @@ typedef struct Q35PCIHost {
 #define MCH_HOST_BRIDGE_PAM_MASK               ((uint8_t)0x3)
 
 #define MCH_HOST_BRIDGE_SMRAM                  0x9d
-#define MCH_HOST_BRIDGE_SMRAM_SIZE             1
+#define MCH_HOST_BRIDGE_SMRAM_SIZE             2
 #define MCH_HOST_BRIDGE_SMRAM_DEFAULT          ((uint8_t)0x2)
 #define MCH_HOST_BRIDGE_SMRAM_D_OPEN           ((uint8_t)(1 << 6))
 #define MCH_HOST_BRIDGE_SMRAM_D_CLS            ((uint8_t)(1 << 5))
@@ -141,11 +141,11 @@ typedef struct Q35PCIHost {
 #define MCH_HOST_BRIDGE_UPPER_SYSTEM_BIOS_END  0x100000
 
 #define MCH_HOST_BRIDGE_ESMRAMC                0x9e
-#define MCH_HOST_BRIDGE_ESMRAMC_H_SMRAME       ((uint8_t)(1 << 6))
-#define MCH_HOST_BRIDGE_ESMRAMC_E_SMERR        ((uint8_t)(1 << 5))
-#define MCH_HOST_BRIDGE_ESMRAMC_SM_CACHE       ((uint8_t)(1 << 4))
-#define MCH_HOST_BRIDGE_ESMRAMC_SM_L1          ((uint8_t)(1 << 3))
-#define MCH_HOST_BRIDGE_ESMRAMC_SM_L2          ((uint8_t)(1 << 2))
+#define MCH_HOST_BRIDGE_ESMRAMC_H_SMRAME       ((uint8_t)(1 << 7))
+#define MCH_HOST_BRIDGE_ESMRAMC_E_SMERR        ((uint8_t)(1 << 6))
+#define MCH_HOST_BRIDGE_ESMRAMC_SM_CACHE       ((uint8_t)(1 << 5))
+#define MCH_HOST_BRIDGE_ESMRAMC_SM_L1          ((uint8_t)(1 << 4))
+#define MCH_HOST_BRIDGE_ESMRAMC_SM_L2          ((uint8_t)(1 << 3))
 #define MCH_HOST_BRIDGE_ESMRAMC_TSEG_SZ_MASK   ((uint8_t)(0x3 << 1))
 #define MCH_HOST_BRIDGE_ESMRAMC_TSEG_SZ_1MB    ((uint8_t)(0x0 << 1))
 #define MCH_HOST_BRIDGE_ESMRAMC_TSEG_SZ_2MB    ((uint8_t)(0x1 << 1))
-- 
2.4.1

^ permalink raw reply related	[flat|nested] 49+ messages in thread

* [Qemu-devel] [PATCH v2 18/23] q35: fix ESMRAMC default
  2015-06-03 17:08 [Qemu-devel] [PATCH v2 00/23] SMM improvements (chipset and TCG parts) Paolo Bonzini
                   ` (16 preceding siblings ...)
  2015-06-03 17:08 ` [Qemu-devel] [PATCH v2 17/23] q35: implement high SMRAM Paolo Bonzini
@ 2015-06-03 17:08 ` Paolo Bonzini
  2015-06-04 12:51   ` Michael S. Tsirkin
  2015-06-03 17:08 ` [Qemu-devel] [PATCH v2 19/23] q35: add config space wmask for SMRAM and ESMRAMC Paolo Bonzini
                   ` (6 subsequent siblings)
  24 siblings, 1 reply; 49+ messages in thread
From: Paolo Bonzini @ 2015-06-03 17:08 UTC (permalink / raw)
  To: qemu-devel; +Cc: lersek, kraxel, mst

From: Gerd Hoffmann <kraxel@redhat.com>

The cache bits in ESMRAMC are hardcoded to 1 (=disabled) according to
the q35 mch specs.  Add and use a define with this default.

While being at it also update the SMRAM default to use the name (no code
change, just makes things a bit more readable).

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/pci-host/q35.c         | 1 +
 include/hw/pci-host/q35.h | 7 ++++++-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/hw/pci-host/q35.c b/hw/pci-host/q35.c
index 92804fe..93bec84 100644
--- a/hw/pci-host/q35.c
+++ b/hw/pci-host/q35.c
@@ -354,6 +354,7 @@ static void mch_reset(DeviceState *qdev)
                  MCH_HOST_BRIDGE_PCIEXBAR_DEFAULT);
 
     d->config[MCH_HOST_BRIDGE_SMRAM] = MCH_HOST_BRIDGE_SMRAM_DEFAULT;
+    d->config[MCH_HOST_BRIDGE_ESMRAMC] = MCH_HOST_BRIDGE_ESMRAMC_DEFAULT;
 
     mch_update(mch);
 }
diff --git a/include/hw/pci-host/q35.h b/include/hw/pci-host/q35.h
index 0fff6a2..d3c7bbb 100644
--- a/include/hw/pci-host/q35.h
+++ b/include/hw/pci-host/q35.h
@@ -128,7 +128,6 @@ typedef struct Q35PCIHost {
 
 #define MCH_HOST_BRIDGE_SMRAM                  0x9d
 #define MCH_HOST_BRIDGE_SMRAM_SIZE             2
-#define MCH_HOST_BRIDGE_SMRAM_DEFAULT          ((uint8_t)0x2)
 #define MCH_HOST_BRIDGE_SMRAM_D_OPEN           ((uint8_t)(1 << 6))
 #define MCH_HOST_BRIDGE_SMRAM_D_CLS            ((uint8_t)(1 << 5))
 #define MCH_HOST_BRIDGE_SMRAM_D_LCK            ((uint8_t)(1 << 4))
@@ -139,6 +138,8 @@ typedef struct Q35PCIHost {
 #define MCH_HOST_BRIDGE_SMRAM_C_END            0xc0000
 #define MCH_HOST_BRIDGE_SMRAM_C_SIZE           0x20000
 #define MCH_HOST_BRIDGE_UPPER_SYSTEM_BIOS_END  0x100000
+#define MCH_HOST_BRIDGE_SMRAM_DEFAULT           \
+    MCH_HOST_BRIDGE_SMRAM_C_BASE_SEG
 
 #define MCH_HOST_BRIDGE_ESMRAMC                0x9e
 #define MCH_HOST_BRIDGE_ESMRAMC_H_SMRAME       ((uint8_t)(1 << 7))
@@ -151,6 +152,10 @@ typedef struct Q35PCIHost {
 #define MCH_HOST_BRIDGE_ESMRAMC_TSEG_SZ_2MB    ((uint8_t)(0x1 << 1))
 #define MCH_HOST_BRIDGE_ESMRAMC_TSEG_SZ_8MB    ((uint8_t)(0x2 << 1))
 #define MCH_HOST_BRIDGE_ESMRAMC_T_EN           ((uint8_t)1)
+#define MCH_HOST_BRIDGE_ESMRAMC_DEFAULT \
+    (MCH_HOST_BRIDGE_ESMRAMC_SM_CACHE | \
+     MCH_HOST_BRIDGE_ESMRAMC_SM_L1 |    \
+     MCH_HOST_BRIDGE_ESMRAMC_SM_L2)
 
 /* D1:F0 PCIE* port*/
 #define MCH_PCIE_DEV                           1
-- 
2.4.1

^ permalink raw reply related	[flat|nested] 49+ messages in thread

* [Qemu-devel] [PATCH v2 19/23] q35: add config space wmask for SMRAM and ESMRAMC
  2015-06-03 17:08 [Qemu-devel] [PATCH v2 00/23] SMM improvements (chipset and TCG parts) Paolo Bonzini
                   ` (17 preceding siblings ...)
  2015-06-03 17:08 ` [Qemu-devel] [PATCH v2 18/23] q35: fix ESMRAMC default Paolo Bonzini
@ 2015-06-03 17:08 ` Paolo Bonzini
  2015-06-04 12:51   ` Michael S. Tsirkin
  2015-06-03 17:08 ` [Qemu-devel] [PATCH v2 20/23] q35: implement SMRAM.D_LCK Paolo Bonzini
                   ` (5 subsequent siblings)
  24 siblings, 1 reply; 49+ messages in thread
From: Paolo Bonzini @ 2015-06-03 17:08 UTC (permalink / raw)
  To: qemu-devel; +Cc: lersek, kraxel, mst

From: Gerd Hoffmann <kraxel@redhat.com>

Not all bits in SMRAM and ESMRAMC can be changed by the guest.
Add wmask defines accordingly and set them in mch_reset().

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/pci-host/q35.c         | 2 ++
 include/hw/pci-host/q35.h | 9 +++++++++
 2 files changed, 11 insertions(+)

diff --git a/hw/pci-host/q35.c b/hw/pci-host/q35.c
index 93bec84..ce101e2 100644
--- a/hw/pci-host/q35.c
+++ b/hw/pci-host/q35.c
@@ -355,6 +355,8 @@ static void mch_reset(DeviceState *qdev)
 
     d->config[MCH_HOST_BRIDGE_SMRAM] = MCH_HOST_BRIDGE_SMRAM_DEFAULT;
     d->config[MCH_HOST_BRIDGE_ESMRAMC] = MCH_HOST_BRIDGE_ESMRAMC_DEFAULT;
+    d->wmask[MCH_HOST_BRIDGE_SMRAM] = MCH_HOST_BRIDGE_SMRAM_WMASK;
+    d->wmask[MCH_HOST_BRIDGE_ESMRAMC] = MCH_HOST_BRIDGE_ESMRAMC_WMASK;
 
     mch_update(mch);
 }
diff --git a/include/hw/pci-host/q35.h b/include/hw/pci-host/q35.h
index d3c7bbb..01b8492 100644
--- a/include/hw/pci-host/q35.h
+++ b/include/hw/pci-host/q35.h
@@ -140,6 +140,11 @@ typedef struct Q35PCIHost {
 #define MCH_HOST_BRIDGE_UPPER_SYSTEM_BIOS_END  0x100000
 #define MCH_HOST_BRIDGE_SMRAM_DEFAULT           \
     MCH_HOST_BRIDGE_SMRAM_C_BASE_SEG
+#define MCH_HOST_BRIDGE_SMRAM_WMASK             \
+    (MCH_HOST_BRIDGE_SMRAM_D_OPEN |             \
+     MCH_HOST_BRIDGE_SMRAM_D_CLS |              \
+     MCH_HOST_BRIDGE_SMRAM_D_LCK |              \
+     MCH_HOST_BRIDGE_SMRAM_G_SMRAME)
 
 #define MCH_HOST_BRIDGE_ESMRAMC                0x9e
 #define MCH_HOST_BRIDGE_ESMRAMC_H_SMRAME       ((uint8_t)(1 << 7))
@@ -156,6 +161,10 @@ typedef struct Q35PCIHost {
     (MCH_HOST_BRIDGE_ESMRAMC_SM_CACHE | \
      MCH_HOST_BRIDGE_ESMRAMC_SM_L1 |    \
      MCH_HOST_BRIDGE_ESMRAMC_SM_L2)
+#define MCH_HOST_BRIDGE_ESMRAMC_WMASK               \
+    (MCH_HOST_BRIDGE_ESMRAMC_H_SMRAME |             \
+     MCH_HOST_BRIDGE_ESMRAMC_TSEG_SZ_MASK |         \
+     MCH_HOST_BRIDGE_ESMRAMC_T_EN)
 
 /* D1:F0 PCIE* port*/
 #define MCH_PCIE_DEV                           1
-- 
2.4.1

^ permalink raw reply related	[flat|nested] 49+ messages in thread

* [Qemu-devel] [PATCH v2 20/23] q35: implement SMRAM.D_LCK
  2015-06-03 17:08 [Qemu-devel] [PATCH v2 00/23] SMM improvements (chipset and TCG parts) Paolo Bonzini
                   ` (18 preceding siblings ...)
  2015-06-03 17:08 ` [Qemu-devel] [PATCH v2 19/23] q35: add config space wmask for SMRAM and ESMRAMC Paolo Bonzini
@ 2015-06-03 17:08 ` Paolo Bonzini
  2015-06-04 12:51   ` Michael S. Tsirkin
  2015-06-03 17:08 ` [Qemu-devel] [PATCH v2 21/23] q35: add test for SMRAM.D_LCK Paolo Bonzini
                   ` (4 subsequent siblings)
  24 siblings, 1 reply; 49+ messages in thread
From: Paolo Bonzini @ 2015-06-03 17:08 UTC (permalink / raw)
  To: qemu-devel; +Cc: lersek, kraxel, mst

From: Gerd Hoffmann <kraxel@redhat.com>

Once the SMRAM.D_LCK bit has been set by the guest several bits in SMRAM
and ESMRAMC become readonly until the next machine reset.  Implement
this by updating the wmask accordingly when the guest sets the lock bit.
As the lock it itself is locked down too we don't need to worry about
the guest clearing the lock bit.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/pci-host/q35.c         | 8 +++++++-
 include/hw/pci-host/q35.h | 3 +++
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/hw/pci-host/q35.c b/hw/pci-host/q35.c
index ce101e2..2f37c29 100644
--- a/hw/pci-host/q35.c
+++ b/hw/pci-host/q35.c
@@ -268,6 +268,13 @@ static void mch_update_smram(MCHPCIState *mch)
     PCIDevice *pd = PCI_DEVICE(mch);
     bool h_smrame = (pd->config[MCH_HOST_BRIDGE_ESMRAMC] & MCH_HOST_BRIDGE_ESMRAMC_H_SMRAME);
 
+    /* implement SMRAM.D_LCK */
+    if (pd->config[MCH_HOST_BRIDGE_SMRAM] & MCH_HOST_BRIDGE_SMRAM_D_LCK) {
+        pd->config[MCH_HOST_BRIDGE_SMRAM] &= ~MCH_HOST_BRIDGE_SMRAM_D_OPEN;
+        pd->wmask[MCH_HOST_BRIDGE_SMRAM] = MCH_HOST_BRIDGE_SMRAM_WMASK_LCK;
+        pd->wmask[MCH_HOST_BRIDGE_ESMRAMC] = MCH_HOST_BRIDGE_ESMRAMC_WMASK_LCK;
+    }
+
     memory_region_transaction_begin();
 
     if (pd->config[MCH_HOST_BRIDGE_SMRAM] & SMRAM_D_OPEN) {
@@ -297,7 +304,6 @@ static void mch_write_config(PCIDevice *d,
 {
     MCHPCIState *mch = MCH_PCI_DEVICE(d);
 
-    /* XXX: implement SMRAM.D_LOCK */
     pci_default_write_config(d, address, val, len);
 
     if (ranges_overlap(address, len, MCH_HOST_BRIDGE_PAM0,
diff --git a/include/hw/pci-host/q35.h b/include/hw/pci-host/q35.h
index 01b8492..113cbe8 100644
--- a/include/hw/pci-host/q35.h
+++ b/include/hw/pci-host/q35.h
@@ -145,6 +145,8 @@ typedef struct Q35PCIHost {
      MCH_HOST_BRIDGE_SMRAM_D_CLS |              \
      MCH_HOST_BRIDGE_SMRAM_D_LCK |              \
      MCH_HOST_BRIDGE_SMRAM_G_SMRAME)
+#define MCH_HOST_BRIDGE_SMRAM_WMASK_LCK         \
+    MCH_HOST_BRIDGE_SMRAM_D_CLS
 
 #define MCH_HOST_BRIDGE_ESMRAMC                0x9e
 #define MCH_HOST_BRIDGE_ESMRAMC_H_SMRAME       ((uint8_t)(1 << 7))
@@ -165,6 +167,7 @@ typedef struct Q35PCIHost {
     (MCH_HOST_BRIDGE_ESMRAMC_H_SMRAME |             \
      MCH_HOST_BRIDGE_ESMRAMC_TSEG_SZ_MASK |         \
      MCH_HOST_BRIDGE_ESMRAMC_T_EN)
+#define MCH_HOST_BRIDGE_ESMRAMC_WMASK_LCK     0
 
 /* D1:F0 PCIE* port*/
 #define MCH_PCIE_DEV                           1
-- 
2.4.1

^ permalink raw reply related	[flat|nested] 49+ messages in thread

* [Qemu-devel] [PATCH v2 21/23] q35: add test for SMRAM.D_LCK
  2015-06-03 17:08 [Qemu-devel] [PATCH v2 00/23] SMM improvements (chipset and TCG parts) Paolo Bonzini
                   ` (19 preceding siblings ...)
  2015-06-03 17:08 ` [Qemu-devel] [PATCH v2 20/23] q35: implement SMRAM.D_LCK Paolo Bonzini
@ 2015-06-03 17:08 ` Paolo Bonzini
  2015-06-04 12:52   ` Michael S. Tsirkin
  2015-06-03 17:08 ` [Qemu-devel] [PATCH v2 22/23] q35: implement TSEG Paolo Bonzini
                   ` (3 subsequent siblings)
  24 siblings, 1 reply; 49+ messages in thread
From: Paolo Bonzini @ 2015-06-03 17:08 UTC (permalink / raw)
  To: qemu-devel; +Cc: lersek, kraxel, mst

From: Gerd Hoffmann <kraxel@redhat.com>

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 tests/Makefile   |  3 ++
 tests/q35-test.c | 91 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 94 insertions(+)
 create mode 100644 tests/q35-test.c

diff --git a/tests/Makefile b/tests/Makefile
index 729b969..f4721d0 100644
--- a/tests/Makefile
+++ b/tests/Makefile
@@ -174,6 +174,8 @@ gcov-files-i386-y += hw/usb/dev-storage.c
 check-qtest-i386-y += tests/usb-hcd-xhci-test$(EXESUF)
 gcov-files-i386-y += hw/usb/hcd-xhci.c
 check-qtest-i386-y += tests/pc-cpu-test$(EXESUF)
+check-qtest-i386-y += tests/q35-test$(EXESUF)
+gcov-files-i386-y += hw/pci-host/q35.c
 check-qtest-i386-$(CONFIG_LINUX) += tests/vhost-user-test$(EXESUF)
 check-qtest-x86_64-y = $(check-qtest-i386-y)
 gcov-files-i386-y += i386-softmmu/hw/timer/mc146818rtc.c
@@ -389,6 +391,7 @@ tests/usb-hcd-uhci-test$(EXESUF): tests/usb-hcd-uhci-test.o $(libqos-usb-obj-y)
 tests/usb-hcd-ehci-test$(EXESUF): tests/usb-hcd-ehci-test.o $(libqos-usb-obj-y)
 tests/usb-hcd-xhci-test$(EXESUF): tests/usb-hcd-xhci-test.o $(libqos-usb-obj-y)
 tests/pc-cpu-test$(EXESUF): tests/pc-cpu-test.o
+tests/smram-test$(EXESUF): tests/smram-test.o $(libqos-pc-obj-y)
 tests/vhost-user-test$(EXESUF): tests/vhost-user-test.o qemu-char.o qemu-timer.o $(qtest-obj-y)
 tests/qemu-iotests/socket_scm_helper$(EXESUF): tests/qemu-iotests/socket_scm_helper.o
 tests/test-qemu-opts$(EXESUF): tests/test-qemu-opts.o libqemuutil.a libqemustub.a
diff --git a/tests/q35-test.c b/tests/q35-test.c
new file mode 100644
index 0000000..812abe5
--- /dev/null
+++ b/tests/q35-test.c
@@ -0,0 +1,91 @@
+/*
+ * QTest testcase for Q35 northbridge
+ *
+ * Copyright (c) 2015 Red Hat, Inc.
+ *
+ * Author: Gerd Hoffmann <kraxel@redhat.com>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ */
+
+#include <glib.h>
+#include <string.h>
+#include "libqtest.h"
+#include "libqos/pci.h"
+#include "libqos/pci-pc.h"
+#include "qemu/osdep.h"
+#include "hw/pci-host/q35.h"
+
+static void smram_set_bit(QPCIDevice *pcidev, uint8_t mask, bool enabled)
+{
+    uint8_t smram;
+
+    smram = qpci_config_readb(pcidev, MCH_HOST_BRIDGE_SMRAM);
+    if (enabled) {
+        smram |= mask;
+    } else {
+        smram &= ~mask;
+    }
+    qpci_config_writeb(pcidev, MCH_HOST_BRIDGE_SMRAM, smram);
+}
+
+static bool smram_test_bit(QPCIDevice *pcidev, uint8_t mask)
+{
+    uint8_t smram;
+
+    smram = qpci_config_readb(pcidev, MCH_HOST_BRIDGE_SMRAM);
+    return smram & mask;
+}
+
+static void test_smram_lock(void)
+{
+    QPCIBus *pcibus;
+    QPCIDevice *pcidev;
+    QDict *response;
+
+    pcibus = qpci_init_pc();
+    g_assert(pcibus != NULL);
+
+    pcidev = qpci_device_find(pcibus, 0);
+    g_assert(pcidev != NULL);
+
+    /* check open is settable */
+    smram_set_bit(pcidev, MCH_HOST_BRIDGE_SMRAM_D_OPEN, false);
+    g_assert(smram_test_bit(pcidev, MCH_HOST_BRIDGE_SMRAM_D_OPEN) == false);
+    smram_set_bit(pcidev, MCH_HOST_BRIDGE_SMRAM_D_OPEN, true);
+    g_assert(smram_test_bit(pcidev, MCH_HOST_BRIDGE_SMRAM_D_OPEN) == true);
+
+    /* lock, check open is cleared & not settable */
+    smram_set_bit(pcidev, MCH_HOST_BRIDGE_SMRAM_D_LCK, true);
+    g_assert(smram_test_bit(pcidev, MCH_HOST_BRIDGE_SMRAM_D_OPEN) == false);
+    smram_set_bit(pcidev, MCH_HOST_BRIDGE_SMRAM_D_OPEN, true);
+    g_assert(smram_test_bit(pcidev, MCH_HOST_BRIDGE_SMRAM_D_OPEN) == false);
+
+    /* reset */
+    response = qmp("{'execute': 'system_reset', 'arguments': {} }");
+    g_assert(response);
+    g_assert(!qdict_haskey(response, "error"));
+    QDECREF(response);
+
+    /* check open is settable again */
+    smram_set_bit(pcidev, MCH_HOST_BRIDGE_SMRAM_D_OPEN, false);
+    g_assert(smram_test_bit(pcidev, MCH_HOST_BRIDGE_SMRAM_D_OPEN) == false);
+    smram_set_bit(pcidev, MCH_HOST_BRIDGE_SMRAM_D_OPEN, true);
+    g_assert(smram_test_bit(pcidev, MCH_HOST_BRIDGE_SMRAM_D_OPEN) == true);
+}
+
+int main(int argc, char **argv)
+{
+    int ret;
+
+    g_test_init(&argc, &argv, NULL);
+
+    qtest_add_func("/q35/smram/lock", test_smram_lock);
+
+    qtest_start("-M q35");
+    ret = g_test_run();
+    qtest_end();
+
+    return ret;
+}
-- 
2.4.1

^ permalink raw reply related	[flat|nested] 49+ messages in thread

* [Qemu-devel] [PATCH v2 22/23] q35: implement TSEG
  2015-06-03 17:08 [Qemu-devel] [PATCH v2 00/23] SMM improvements (chipset and TCG parts) Paolo Bonzini
                   ` (20 preceding siblings ...)
  2015-06-03 17:08 ` [Qemu-devel] [PATCH v2 21/23] q35: add test for SMRAM.D_LCK Paolo Bonzini
@ 2015-06-03 17:08 ` Paolo Bonzini
  2015-06-04 12:53   ` Michael S. Tsirkin
  2015-06-03 17:08 ` [Qemu-devel] [PATCH v2 23/23] ich9: implement SMI_LOCK Paolo Bonzini
                   ` (2 subsequent siblings)
  24 siblings, 1 reply; 49+ messages in thread
From: Paolo Bonzini @ 2015-06-03 17:08 UTC (permalink / raw)
  To: qemu-devel; +Cc: lersek, kraxel, mst

From: Gerd Hoffmann <kraxel@redhat.com>

TSEG provides larger amounts of SMRAM than the 128 KB available with
legacy SMRAM and high SMRAM.

Route access to tseg into nowhere when enabled, for both cpus and
busmaster dma, and add tseg window to smram region, so cpus can access
it in smm mode.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/pci-host/q35.c         | 72 ++++++++++++++++++++++++++++++++++++++++++++++-
 include/hw/pci-host/q35.h |  1 +
 2 files changed, 72 insertions(+), 1 deletion(-)

diff --git a/hw/pci-host/q35.c b/hw/pci-host/q35.c
index 2f37c29..9fb1b20 100644
--- a/hw/pci-host/q35.c
+++ b/hw/pci-host/q35.c
@@ -198,6 +198,28 @@ static const TypeInfo q35_host_info = {
  * MCH D0:F0
  */
 
+static uint64_t tseg_blackhole_read(void *ptr, hwaddr reg, unsigned size)
+{
+    return 0xffffffff;
+}
+
+static void tseg_blackhole_write(void *opaque, hwaddr addr, uint64_t val,
+                                 unsigned width)
+{
+    /* nothing */
+}
+
+static const MemoryRegionOps tseg_blackhole_ops = {
+    .read = tseg_blackhole_read,
+    .write = tseg_blackhole_write,
+    .endianness = DEVICE_NATIVE_ENDIAN,
+    .valid.min_access_size = 1,
+    .valid.max_access_size = 4,
+    .impl.min_access_size = 4,
+    .impl.max_access_size = 4,
+    .endianness = DEVICE_LITTLE_ENDIAN,
+};
+
 /* PCIe MMCFG */
 static void mch_update_pciexbar(MCHPCIState *mch)
 {
@@ -267,6 +289,7 @@ static void mch_update_smram(MCHPCIState *mch)
 {
     PCIDevice *pd = PCI_DEVICE(mch);
     bool h_smrame = (pd->config[MCH_HOST_BRIDGE_ESMRAMC] & MCH_HOST_BRIDGE_ESMRAMC_H_SMRAME);
+    uint32_t tseg_size;
 
     /* implement SMRAM.D_LCK */
     if (pd->config[MCH_HOST_BRIDGE_SMRAM] & MCH_HOST_BRIDGE_SMRAM_D_LCK) {
@@ -296,6 +319,39 @@ static void mch_update_smram(MCHPCIState *mch)
         memory_region_set_enabled(&mch->high_smram, false);
     }
 
+    if (pd->config[MCH_HOST_BRIDGE_ESMRAMC] & MCH_HOST_BRIDGE_ESMRAMC_T_EN) {
+        switch (pd->config[MCH_HOST_BRIDGE_ESMRAMC] &
+                MCH_HOST_BRIDGE_ESMRAMC_TSEG_SZ_MASK) {
+        case MCH_HOST_BRIDGE_ESMRAMC_TSEG_SZ_1MB:
+            tseg_size = 1024 * 1024;
+            break;
+        case MCH_HOST_BRIDGE_ESMRAMC_TSEG_SZ_2MB:
+            tseg_size = 1024 * 1024 * 2;
+            break;
+        case MCH_HOST_BRIDGE_ESMRAMC_TSEG_SZ_8MB:
+            tseg_size = 1024 * 1024 * 8;
+            break;
+        default:
+            tseg_size = 0;
+            break;
+        }
+    } else {
+        tseg_size = 0;
+    }
+    memory_region_del_subregion(mch->system_memory, &mch->tseg_blackhole);
+    memory_region_set_enabled(&mch->tseg_blackhole, tseg_size);
+    memory_region_set_size(&mch->tseg_blackhole, tseg_size);
+    memory_region_add_subregion_overlap(mch->system_memory,
+                                        mch->below_4g_mem_size - tseg_size,
+                                        &mch->tseg_blackhole, 1);
+
+    memory_region_set_enabled(&mch->tseg_window, tseg_size);
+    memory_region_set_size(&mch->tseg_window, tseg_size);
+    memory_region_set_address(&mch->tseg_window,
+                              mch->below_4g_mem_size - tseg_size);
+    memory_region_set_alias_offset(&mch->tseg_window,
+                                   mch->below_4g_mem_size - tseg_size);
+
     memory_region_transaction_commit();
 }
 
@@ -443,9 +499,23 @@ static void mch_realize(PCIDevice *d, Error **errp)
                              mch->ram_memory, 0xa0000, 0x20000);
     memory_region_set_enabled(&mch->high_smram, true);
     memory_region_add_subregion(&mch->smram, 0xfeda0000, &mch->high_smram);
+
+    memory_region_init_io(&mch->tseg_blackhole, OBJECT(mch),
+                          &tseg_blackhole_ops, NULL,
+                          "tseg-blackhole", 0);
+    memory_region_set_enabled(&mch->tseg_blackhole, false);
+    memory_region_add_subregion_overlap(mch->system_memory,
+                                        mch->below_4g_mem_size,
+                                        &mch->tseg_blackhole, 1);
+
+    memory_region_init_alias(&mch->tseg_window, OBJECT(mch), "tseg-window",
+                             mch->ram_memory, mch->below_4g_mem_size, 0);
+    memory_region_set_enabled(&mch->tseg_window, false);
+    memory_region_add_subregion(&mch->smram, mch->below_4g_mem_size,
+                                &mch->tseg_window);
+
     object_property_add_const_link(qdev_get_machine(), "smram",
 				   OBJECT(&mch->smram), &error_abort);
-
     init_pam(DEVICE(mch), mch->ram_memory, mch->system_memory,
              mch->pci_address_space, &mch->pam_regions[0],
              PAM_BIOS_BASE, PAM_BIOS_SIZE);
diff --git a/include/hw/pci-host/q35.h b/include/hw/pci-host/q35.h
index 113cbe8..dbe6dc0 100644
--- a/include/hw/pci-host/q35.h
+++ b/include/hw/pci-host/q35.h
@@ -54,6 +54,7 @@ typedef struct MCHPCIState {
     PAMMemoryRegion pam_regions[13];
     MemoryRegion smram_region, open_high_smram;
     MemoryRegion smram, low_smram, high_smram;
+    MemoryRegion tseg_blackhole, tseg_window;
     PcPciInfo pci_info;
     ram_addr_t below_4g_mem_size;
     ram_addr_t above_4g_mem_size;
-- 
2.4.1

^ permalink raw reply related	[flat|nested] 49+ messages in thread

* [Qemu-devel] [PATCH v2 23/23] ich9: implement SMI_LOCK
  2015-06-03 17:08 [Qemu-devel] [PATCH v2 00/23] SMM improvements (chipset and TCG parts) Paolo Bonzini
                   ` (21 preceding siblings ...)
  2015-06-03 17:08 ` [Qemu-devel] [PATCH v2 22/23] q35: implement TSEG Paolo Bonzini
@ 2015-06-03 17:08 ` Paolo Bonzini
  2015-06-04 12:53   ` Michael S. Tsirkin
  2015-06-03 17:41 ` [Qemu-devel] [PATCH v2 00/23] SMM improvements (chipset and TCG parts) Laszlo Ersek
  2015-06-04 12:54 ` Michael S. Tsirkin
  24 siblings, 1 reply; 49+ messages in thread
From: Paolo Bonzini @ 2015-06-03 17:08 UTC (permalink / raw)
  To: qemu-devel; +Cc: lersek, kraxel, mst

From: Gerd Hoffmann <kraxel@redhat.com>

Add write mask for the smi enable register, so we can disable write
access to certain bits.  Open all bits on reset.  Disable write access
to GBL_SMI_EN when SMI_LOCK (in ich9 lpc pci config space) is set.
Write access to SMI_LOCK itself is disabled too.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/acpi/ich9.c         |  4 +++-
 hw/isa/lpc_ich9.c      | 19 +++++++++++++++++++
 include/hw/acpi/ich9.h |  1 +
 include/hw/i386/ich9.h |  6 ++++++
 4 files changed, 29 insertions(+), 1 deletion(-)

diff --git a/hw/acpi/ich9.c b/hw/acpi/ich9.c
index 84e5bb8..ec0e008 100644
--- a/hw/acpi/ich9.c
+++ b/hw/acpi/ich9.c
@@ -94,7 +94,8 @@ static void ich9_smi_writel(void *opaque, hwaddr addr, uint64_t val,
     ICH9LPCPMRegs *pm = opaque;
     switch (addr) {
     case 0:
-        pm->smi_en = val;
+        pm->smi_en &= ~pm->smi_en_wmask;
+        pm->smi_en |= (val & pm->smi_en_wmask);
         break;
     }
 }
@@ -198,6 +199,7 @@ static void pm_reset(void *opaque)
          * support SMM mode. */
         pm->smi_en |= ICH9_PMIO_SMI_EN_APMC_EN;
     }
+    pm->smi_en_wmask = ~0;
 
     acpi_update_sci(&pm->acpi_regs, pm->irq);
 }
diff --git a/hw/isa/lpc_ich9.c b/hw/isa/lpc_ich9.c
index dba7585..0269cfe 100644
--- a/hw/isa/lpc_ich9.c
+++ b/hw/isa/lpc_ich9.c
@@ -410,12 +410,28 @@ static void ich9_lpc_rcba_update(ICH9LPCState *lpc, uint32_t rbca_old)
     }
 }
 
+/* config:GEN_PMCON* */
+static void
+ich9_lpc_pmcon_update(ICH9LPCState *lpc)
+{
+    uint16_t gen_pmcon_1 = pci_get_word(lpc->d.config + ICH9_LPC_GEN_PMCON_1);
+    uint16_t wmask;
+
+    if (gen_pmcon_1 & ICH9_LPC_GEN_PMCON_1_SMI_LOCK) {
+        wmask = pci_get_word(lpc->d.wmask + ICH9_LPC_GEN_PMCON_1);
+        wmask &= ~ICH9_LPC_GEN_PMCON_1_SMI_LOCK;
+        pci_set_word(lpc->d.wmask + ICH9_LPC_GEN_PMCON_1, wmask);
+        lpc->pm.smi_en_wmask &= ~1;
+    }
+}
+
 static int ich9_lpc_post_load(void *opaque, int version_id)
 {
     ICH9LPCState *lpc = opaque;
 
     ich9_lpc_pmbase_update(lpc);
     ich9_lpc_rcba_update(lpc, 0 /* disabled ICH9_LPC_RBCA_EN */);
+    ich9_lpc_pmcon_update(lpc);
     return 0;
 }
 
@@ -438,6 +454,9 @@ static void ich9_lpc_config_write(PCIDevice *d,
     if (ranges_overlap(addr, len, ICH9_LPC_PIRQE_ROUT, 4)) {
         pci_bus_fire_intx_routing_notifier(lpc->d.bus);
     }
+    if (ranges_overlap(addr, len, ICH9_LPC_GEN_PMCON_1, 8)) {
+        ich9_lpc_pmcon_update(lpc);
+    }
 }
 
 static void ich9_lpc_reset(DeviceState *qdev)
diff --git a/include/hw/acpi/ich9.h b/include/hw/acpi/ich9.h
index c2d3dba..77cc65c 100644
--- a/include/hw/acpi/ich9.h
+++ b/include/hw/acpi/ich9.h
@@ -39,6 +39,7 @@ typedef struct ICH9LPCPMRegs {
     MemoryRegion io_smi;
 
     uint32_t smi_en;
+    uint32_t smi_en_wmask;
     uint32_t smi_sts;
 
     qemu_irq irq;      /* SCI */
diff --git a/include/hw/i386/ich9.h b/include/hw/i386/ich9.h
index f4e522c..a2cc15c 100644
--- a/include/hw/i386/ich9.h
+++ b/include/hw/i386/ich9.h
@@ -152,6 +152,12 @@ Object *ich9_lpc_find(void);
 #define ICH9_LPC_PIRQ_ROUT_MASK                 Q35_MASK(8, 3, 0)
 #define ICH9_LPC_PIRQ_ROUT_DEFAULT              0x80
 
+#define ICH9_LPC_GEN_PMCON_1                    0xa0
+#define ICH9_LPC_GEN_PMCON_1_SMI_LOCK           (1 << 4)
+#define ICH9_LPC_GEN_PMCON_2                    0xa2
+#define ICH9_LPC_GEN_PMCON_3                    0xa4
+#define ICH9_LPC_GEN_PMCON_LOCK                 0xa6
+
 #define ICH9_LPC_RCBA                           0xf0
 #define ICH9_LPC_RCBA_BA_MASK                   Q35_MASK(32, 31, 14)
 #define ICH9_LPC_RCBA_EN                        0x1
-- 
2.4.1

^ permalink raw reply related	[flat|nested] 49+ messages in thread

* Re: [Qemu-devel] [PATCH v2 00/23] SMM improvements (chipset and TCG parts)
  2015-06-03 17:08 [Qemu-devel] [PATCH v2 00/23] SMM improvements (chipset and TCG parts) Paolo Bonzini
                   ` (22 preceding siblings ...)
  2015-06-03 17:08 ` [Qemu-devel] [PATCH v2 23/23] ich9: implement SMI_LOCK Paolo Bonzini
@ 2015-06-03 17:41 ` Laszlo Ersek
  2015-06-03 17:44   ` Paolo Bonzini
  2015-06-04 12:54 ` Michael S. Tsirkin
  24 siblings, 1 reply; 49+ messages in thread
From: Laszlo Ersek @ 2015-06-03 17:41 UTC (permalink / raw)
  To: Paolo Bonzini; +Cc: mst, qemu-devel, kraxel

On 06/03/15 19:08, Paolo Bonzini wrote:
> These are the patches that I would like to send a pull request
> as soon as possible.  KVM support still needs to wait for the
> kernel code to be committed.
> 
> I asked Michael to let me send a pull request for this instead
> of going through the PC tree; this is to let him take a final
> look at the patches.
> 
> Paolo
> 
> Gerd Hoffmann (6):
>   q35: fix ESMRAMC default
>   q35: add config space wmask for SMRAM and ESMRAMC
>   q35: implement SMRAM.D_LCK
>   q35: add test for SMRAM.D_LCK
>   q35: implement TSEG
>   ich9: implement SMI_LOCK
> 
> Paolo Bonzini (17):
>   target-i386: introduce cpu_get_mem_attrs
>   target-i386: Use correct memory attributes for memory accesses
>   target-i386: Use correct memory attributes for ioport accesses
>   target-i386: mask NMIs on entry to SMM
>   target-i386: set G=1 in SMM big real mode selectors
>   target-i386: wake up processors that receive an SMI
>   pflash_cfi01: change big-endian property to BIT type
>   pflash_cfi01: change to new-style MMIO accessors
>   pflash_cfi01: add secure property
>   vl: allow full-blown QemuOpts syntax for -global
>   qom: add object_property_add_const_link
>   vl: run "late" notifiers immediately
>   target-i386: create a separate AddressSpace for each CPU
>   hw/i386: add a separate region that tracks the SMRAME bit
>   target-i386: use memory API to implement SMRAM
>   hw/i386: remove smram_update
>   q35: implement high SMRAM
> 
>  bsd-user/main.c           |   4 -
>  hw/acpi/ich9.c            |   4 +-
>  hw/block/pflash_cfi01.c   | 204 +++++++++++-----------------
>  hw/i386/pc.c              |  21 ---
>  hw/isa/lpc_ich9.c         |  19 +++
>  hw/pci-host/pam.c         |  20 ---
>  hw/pci-host/piix.c        |  44 +++---
>  hw/pci-host/q35.c         | 142 +++++++++++++++++---
>  include/exec/memattrs.h   |   4 +-
>  include/hw/acpi/ich9.h    |   1 +
>  include/hw/i386/ich9.h    |   6 +
>  include/hw/i386/pc.h      |   1 -
>  include/hw/pci-host/pam.h |   4 -
>  include/hw/pci-host/q35.h |  36 +++--
>  include/qom/object.h      |  18 +++
>  linux-user/main.c         |   4 -
>  qdev-monitor.c            |  18 ++-
>  qemu-options.hx           |   7 +-
>  qom/object.c              |  16 +++
>  target-i386/Makefile.objs |   2 -
>  target-i386/cpu-qom.h     |   3 +
>  target-i386/cpu.c         |  47 ++++++-
>  target-i386/cpu.h         |  40 ++++--
>  target-i386/helper.c      | 135 ++++++++++++++++---
>  target-i386/helper.h      |  12 +-
>  target-i386/ioport-user.c |  60 ---------
>  target-i386/kvm.c         |   2 +-
>  target-i386/machine.c     |   3 +
>  target-i386/misc_helper.c |  59 ++++++--
>  target-i386/seg_helper.c  |  12 +-
>  target-i386/smm_helper.c  | 333 ++++++++++++++++++++++++----------------------
>  target-i386/svm_helper.c  | 230 ++++++++++++++++----------------
>  target-i386/translate.c   |  12 +-
>  tests/Makefile            |   3 +
>  tests/q35-test.c          |  91 +++++++++++++
>  vl.c                      |   6 +
>  36 files changed, 989 insertions(+), 634 deletions(-)
>  delete mode 100644 target-i386/ioport-user.c
>  create mode 100644 tests/q35-test.c
> 

Any changes in v2 that would require me to retest my OVMF stuff?

Thanks
Laszlo

^ permalink raw reply	[flat|nested] 49+ messages in thread

* Re: [Qemu-devel] [PATCH v2 00/23] SMM improvements (chipset and TCG parts)
  2015-06-03 17:41 ` [Qemu-devel] [PATCH v2 00/23] SMM improvements (chipset and TCG parts) Laszlo Ersek
@ 2015-06-03 17:44   ` Paolo Bonzini
  0 siblings, 0 replies; 49+ messages in thread
From: Paolo Bonzini @ 2015-06-03 17:44 UTC (permalink / raw)
  To: Laszlo Ersek; +Cc: mst, qemu-devel, kraxel



On 03/06/2015 19:41, Laszlo Ersek wrote:
> Any changes in v2 that would require me to retest my OVMF stuff?

No, none.  I just tested it too.

Paolo

^ permalink raw reply	[flat|nested] 49+ messages in thread

* Re: [Qemu-devel] [PATCH v2 13/23] target-i386: create a separate AddressSpace for each CPU
  2015-06-03 17:08 ` [Qemu-devel] [PATCH v2 13/23] target-i386: create a separate AddressSpace for each CPU Paolo Bonzini
@ 2015-06-03 17:58   ` Peter Crosthwaite
  2015-06-04  8:02     ` Paolo Bonzini
  0 siblings, 1 reply; 49+ messages in thread
From: Peter Crosthwaite @ 2015-06-03 17:58 UTC (permalink / raw)
  To: Paolo Bonzini
  Cc: Michael S. Tsirkin, Laszlo Ersek,
	qemu-devel@nongnu.org Developers, Gerd Hoffmann

On Wed, Jun 3, 2015 at 10:08 AM, Paolo Bonzini <pbonzini@redhat.com> wrote:
> Different CPUs can be in SMM or not at the same time, thus they
> will see different things where the chipset places SMRAM.
>
> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
> ---
>  target-i386/cpu-qom.h |  1 +
>  target-i386/cpu.c     | 14 ++++++++++++++
>  2 files changed, 15 insertions(+)
>
> diff --git a/target-i386/cpu-qom.h b/target-i386/cpu-qom.h
> index 31a0c1e..39cd878 100644
> --- a/target-i386/cpu-qom.h
> +++ b/target-i386/cpu-qom.h
> @@ -111,6 +111,7 @@ typedef struct X86CPU {
>      /* in order to simplify APIC support, we leave this pointer to the
>         user */
>      struct DeviceState *apic_state;
> +    struct MemoryRegion *cpu_as_root;
>  } X86CPU;
>
>  static inline X86CPU *x86_env_get_cpu(CPUX86State *env)
> diff --git a/target-i386/cpu.c b/target-i386/cpu.c
> index 523d0cd..23b57a9 100644
> --- a/target-i386/cpu.c
> +++ b/target-i386/cpu.c
> @@ -44,6 +44,7 @@
>  #include "hw/qdev-properties.h"
>  #include "hw/cpu/icc_bus.h"
>  #ifndef CONFIG_USER_ONLY
> +#include "exec/address-spaces.h"
>  #include "hw/xen/xen.h"
>  #include "hw/i386/apic_internal.h"
>  #endif
> @@ -2811,6 +2812,18 @@ static void x86_cpu_realizefn(DeviceState *dev, Error **errp)
>  #endif
>
>      mce_init(cpu);
> +
> +#ifndef CONFIG_USER_ONLY
> +    if (tcg_enabled()) {
> +        cpu->cpu_as_root = g_new(MemoryRegion, 1);
> +        cs->as = g_new(AddressSpace, 1);
> +        memory_region_init_alias(cpu->cpu_as_root, OBJECT(cpu), "memory",
> +                                 get_system_memory(), 0, ~0ull);
> +        memory_region_set_enabled(cpu->cpu_as_root, true);
> +        address_space_init(cs->as, cpu->cpu_as_root, "CPU");
> +    }
> +#endif
> +
>      qemu_init_vcpu(cs);
>
>      /* Only Intel CPUs support hyperthreading. Even though QEMU fixes this
> @@ -2834,6 +2847,7 @@ static void x86_cpu_realizefn(DeviceState *dev, Error **errp)
>      cpu_reset(cs);
>
>      xcc->parent_realize(dev, &local_err);
> +

This intentional?

Regards,
Peter

>  out:
>      if (local_err != NULL) {
>          error_propagate(errp, local_err);
> --
> 2.4.1
>
>
>

^ permalink raw reply	[flat|nested] 49+ messages in thread

* Re: [Qemu-devel] [PATCH v2 08/23] pflash_cfi01: change to new-style MMIO accessors
  2015-06-03 17:08 ` [Qemu-devel] [PATCH v2 08/23] pflash_cfi01: change to new-style MMIO accessors Paolo Bonzini
@ 2015-06-04  6:19   ` Peter Crosthwaite
  2015-06-04  8:02     ` Paolo Bonzini
  0 siblings, 1 reply; 49+ messages in thread
From: Peter Crosthwaite @ 2015-06-04  6:19 UTC (permalink / raw)
  To: Paolo Bonzini
  Cc: Michael S. Tsirkin, Laszlo Ersek,
	qemu-devel@nongnu.org Developers, Gerd Hoffmann

On Wed, Jun 3, 2015 at 10:08 AM, Paolo Bonzini <pbonzini@redhat.com> wrote:
> This is a required step to implement read_with_attrs and write_with_attrs.
>
> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
> ---
>  hw/block/pflash_cfi01.c | 96 ++++++-------------------------------------------

Nice stats.

>  1 file changed, 10 insertions(+), 86 deletions(-)
>
> diff --git a/hw/block/pflash_cfi01.c b/hw/block/pflash_cfi01.c
> index 7507a15..0b3667a 100644
> --- a/hw/block/pflash_cfi01.c
> +++ b/hw/block/pflash_cfi01.c
> @@ -650,101 +650,25 @@ static void pflash_write(pflash_t *pfl, hwaddr offset,
>  }
>
>
> -static uint32_t pflash_readb_be(void *opaque, hwaddr addr)
> -{
> -    return pflash_read(opaque, addr, 1, 1);
> -}
> -
> -static uint32_t pflash_readb_le(void *opaque, hwaddr addr)
> -{
> -    return pflash_read(opaque, addr, 1, 0);
> -}
> -
> -static uint32_t pflash_readw_be(void *opaque, hwaddr addr)
> +static uint64_t pflash_mem_read(void *opaque, hwaddr addr, unsigned len)
>  {
>      pflash_t *pfl = opaque;
> +    bool be = !!(pfl->features & (1 << PFLASH_BE));

!!() not needed. Otherwise

Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.om>

>
> -    return pflash_read(pfl, addr, 2, 1);
> +    return pflash_read(pfl, addr, len, be);
>  }
>
> -static uint32_t pflash_readw_le(void *opaque, hwaddr addr)
> +static void pflash_mem_write(void *opaque, hwaddr addr, uint64_t value, unsigned len)
>  {
>      pflash_t *pfl = opaque;
> +    bool be = !!(pfl->features & (1 << PFLASH_BE));
>
> -    return pflash_read(pfl, addr, 2, 0);
> +    pflash_write(pfl, addr, value, len, be);
>  }
>
> -static uint32_t pflash_readl_be(void *opaque, hwaddr addr)
> -{
> -    pflash_t *pfl = opaque;
> -
> -    return pflash_read(pfl, addr, 4, 1);
> -}
> -
> -static uint32_t pflash_readl_le(void *opaque, hwaddr addr)
> -{
> -    pflash_t *pfl = opaque;
> -
> -    return pflash_read(pfl, addr, 4, 0);
> -}
> -
> -static void pflash_writeb_be(void *opaque, hwaddr addr,
> -                             uint32_t value)
> -{
> -    pflash_write(opaque, addr, value, 1, 1);
> -}
> -
> -static void pflash_writeb_le(void *opaque, hwaddr addr,
> -                             uint32_t value)
> -{
> -    pflash_write(opaque, addr, value, 1, 0);
> -}
> -
> -static void pflash_writew_be(void *opaque, hwaddr addr,
> -                             uint32_t value)
> -{
> -    pflash_t *pfl = opaque;
> -
> -    pflash_write(pfl, addr, value, 2, 1);
> -}
> -
> -static void pflash_writew_le(void *opaque, hwaddr addr,
> -                             uint32_t value)
> -{
> -    pflash_t *pfl = opaque;
> -
> -    pflash_write(pfl, addr, value, 2, 0);
> -}
> -
> -static void pflash_writel_be(void *opaque, hwaddr addr,
> -                             uint32_t value)
> -{
> -    pflash_t *pfl = opaque;
> -
> -    pflash_write(pfl, addr, value, 4, 1);
> -}
> -
> -static void pflash_writel_le(void *opaque, hwaddr addr,
> -                             uint32_t value)
> -{
> -    pflash_t *pfl = opaque;
> -
> -    pflash_write(pfl, addr, value, 4, 0);
> -}
> -
> -static const MemoryRegionOps pflash_cfi01_ops_be = {
> -    .old_mmio = {
> -        .read = { pflash_readb_be, pflash_readw_be, pflash_readl_be, },
> -        .write = { pflash_writeb_be, pflash_writew_be, pflash_writel_be, },
> -    },
> -    .endianness = DEVICE_NATIVE_ENDIAN,
> -};
> -
> -static const MemoryRegionOps pflash_cfi01_ops_le = {
> -    .old_mmio = {
> -        .read = { pflash_readb_le, pflash_readw_le, pflash_readl_le, },
> -        .write = { pflash_writeb_le, pflash_writew_le, pflash_writel_le, },
> -    },
> +static const MemoryRegionOps pflash_cfi01_ops = {
> +    .read = pflash_mem_read,
> +    .write = pflash_mem_write,
>      .endianness = DEVICE_NATIVE_ENDIAN,
>  };
>
> @@ -775,7 +699,7 @@ static void pflash_cfi01_realize(DeviceState *dev, Error **errp)
>
>      memory_region_init_rom_device(
>          &pfl->mem, OBJECT(dev),
> -        pfl->features & (1 << PFLASH_BE) ? &pflash_cfi01_ops_be : &pflash_cfi01_ops_le,
> +        &pflash_cfi01_ops,
>          pfl,
>          pfl->name, total_len, &local_err);
>      if (local_err) {
> --
> 2.4.1
>
>
>

^ permalink raw reply	[flat|nested] 49+ messages in thread

* Re: [Qemu-devel] [PATCH v2 11/23] qom: add object_property_add_const_link
  2015-06-03 17:08 ` [Qemu-devel] [PATCH v2 11/23] qom: add object_property_add_const_link Paolo Bonzini
@ 2015-06-04  6:33   ` Peter Crosthwaite
  0 siblings, 0 replies; 49+ messages in thread
From: Peter Crosthwaite @ 2015-06-04  6:33 UTC (permalink / raw)
  To: Paolo Bonzini
  Cc: Michael S. Tsirkin, Laszlo Ersek,
	qemu-devel@nongnu.org Developers, Gerd Hoffmann

On Wed, Jun 3, 2015 at 10:08 AM, Paolo Bonzini <pbonzini@redhat.com> wrote:
> Suggested-by: Eduardo Habkost <ehabkost@redhat.com>
> Acked-by: Andreas Faerber <afaerber@suse.de>
> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>

> ---
>  include/qom/object.h | 18 ++++++++++++++++++
>  qom/object.c         | 16 ++++++++++++++++
>  2 files changed, 34 insertions(+)
>
> diff --git a/include/qom/object.h b/include/qom/object.h
> index d2d7748..0505f20 100644
> --- a/include/qom/object.h
> +++ b/include/qom/object.h
> @@ -1290,6 +1290,24 @@ void object_property_add_alias(Object *obj, const char *name,
>                                 Error **errp);
>
>  /**
> + * object_property_add_const_link:
> + * @obj: the object to add a property to
> + * @name: the name of the property
> + * @target: the object to be referred by the link
> + * @errp: if an error occurs, a pointer to an area to store the error
> + *
> + * Add an unmodifiable link for a property on an object.  This function will
> + * add a property of type link<TYPE> where TYPE is the type of @target.
> + *
> + * The caller must ensure that @target stays alive as long as
> + * this property exists.  In the case @target is a child of @obj,
> + * this will be the case.  Otherwise, the caller is responsible for
> + * taking a reference.
> + */
> +void object_property_add_const_link(Object *obj, const char *name,
> +                                    Object *target, Error **errp);
> +
> +/**
>   * object_property_set_description:
>   * @obj: the object owning the property
>   * @name: the name of the property
> diff --git a/qom/object.c b/qom/object.c
> index b8dff43..96abd34 100644
> --- a/qom/object.c
> +++ b/qom/object.c
> @@ -1266,6 +1266,22 @@ out:
>      g_free(full_type);
>  }
>
> +void object_property_add_const_link(Object *obj, const char *name,
> +                                    Object *target, Error **errp)
> +{
> +    char *link_type;
> +    ObjectProperty *op;
> +
> +    link_type = g_strdup_printf("link<%s>", object_get_typename(target));
> +    op = object_property_add(obj, name, link_type,
> +                             object_get_child_property, NULL,
> +                             NULL, target, errp);
> +    if (op != NULL) {
> +        op->resolve = object_resolve_child_property;
> +    }
> +    g_free(link_type);
> +}
> +
>  gchar *object_get_canonical_path_component(Object *obj)
>  {
>      ObjectProperty *prop = NULL;
> --
> 2.4.1
>
>
>

^ permalink raw reply	[flat|nested] 49+ messages in thread

* Re: [Qemu-devel] [PATCH v2 12/23] vl: run "late" notifiers immediately
  2015-06-03 17:08 ` [Qemu-devel] [PATCH v2 12/23] vl: run "late" notifiers immediately Paolo Bonzini
@ 2015-06-04  6:39   ` Peter Crosthwaite
  2015-06-04  8:03     ` Paolo Bonzini
  0 siblings, 1 reply; 49+ messages in thread
From: Peter Crosthwaite @ 2015-06-04  6:39 UTC (permalink / raw)
  To: Paolo Bonzini
  Cc: Michael S. Tsirkin, Laszlo Ersek,
	qemu-devel@nongnu.org Developers, Gerd Hoffmann

On Wed, Jun 3, 2015 at 10:08 AM, Paolo Bonzini <pbonzini@redhat.com> wrote:
> If a machine_init_done notifier is added late, as part of a hot-plugged
> device, run it immediately.

Blank line?

> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>

> ---
>  vl.c | 6 ++++++
>  1 file changed, 6 insertions(+)
>
> diff --git a/vl.c b/vl.c
> index 0707cfa..00def69 100644
> --- a/vl.c
> +++ b/vl.c
> @@ -2498,14 +2498,20 @@ static void qemu_run_exit_notifiers(void)
>      notifier_list_notify(&exit_notifiers, NULL);
>  }
>
> +static bool machine_init_done;
> +
>  void qemu_add_machine_init_done_notifier(Notifier *notify)
>  {
>      notifier_list_add(&machine_init_done_notifiers, notify);
> +    if (machine_init_done) {
> +        notify->notify(notify, NULL);
> +    }
>  }
>
>  static void qemu_run_machine_init_done_notifiers(void)
>  {
>      notifier_list_notify(&machine_init_done_notifiers, NULL);
> +    machine_init_done = true;
>  }
>
>  static const QEMUOption *lookup_opt(int argc, char **argv,
> --
> 2.4.1
>
>
>

^ permalink raw reply	[flat|nested] 49+ messages in thread

* Re: [Qemu-devel] [PATCH v2 15/23] target-i386: use memory API to implement SMRAM
  2015-06-03 17:08 ` [Qemu-devel] [PATCH v2 15/23] target-i386: use memory API to implement SMRAM Paolo Bonzini
@ 2015-06-04  7:19   ` Peter Crosthwaite
  2015-06-04  8:05     ` Paolo Bonzini
  0 siblings, 1 reply; 49+ messages in thread
From: Peter Crosthwaite @ 2015-06-04  7:19 UTC (permalink / raw)
  To: Paolo Bonzini
  Cc: Michael S. Tsirkin, Laszlo Ersek,
	qemu-devel@nongnu.org Developers, Gerd Hoffmann

On Wed, Jun 3, 2015 at 10:08 AM, Paolo Bonzini <pbonzini@redhat.com> wrote:
> Remove cpu_smm_register and cpu_smm_update.  Instead, each CPU
> address space gets an extra region which is an alias of
> /machine/smram.  This extra region is enabled or disabled
> as the CPU enters/exits SMM.
>

Why is the connectivity from machine->CPU made via a predetermined
canon path? This has come up for me a few times out-of-tree and I have
managed it via links. Can the machine create the smram bus as a
MemoryRegion and in a loop pass it to each CPU via a MemoryRegion *
link?

Regards,
Peter

> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
> ---
>  bsd-user/main.c           |  4 ----
>  hw/i386/pc.c              | 21 ---------------------
>  hw/pci-host/pam.c         | 18 ++----------------
>  hw/pci-host/piix.c        | 28 ++++++++--------------------
>  hw/pci-host/q35.c         | 22 ++++++----------------
>  include/hw/i386/pc.h      |  1 -
>  include/hw/pci-host/pam.h |  5 +----
>  include/hw/pci-host/q35.h |  1 -
>  linux-user/main.c         |  4 ----
>  target-i386/cpu-qom.h     |  4 +++-
>  target-i386/cpu.c         | 33 +++++++++++++++++++++++++++++++--
>  target-i386/cpu.h         |  3 ++-
>  target-i386/machine.c     |  3 +++
>  target-i386/smm_helper.c  | 14 ++++++++++++--
>  14 files changed, 68 insertions(+), 93 deletions(-)
>

^ permalink raw reply	[flat|nested] 49+ messages in thread

* Re: [Qemu-devel] [PATCH v2 13/23] target-i386: create a separate AddressSpace for each CPU
  2015-06-03 17:58   ` Peter Crosthwaite
@ 2015-06-04  8:02     ` Paolo Bonzini
  2015-06-04 12:48       ` Laszlo Ersek
  0 siblings, 1 reply; 49+ messages in thread
From: Paolo Bonzini @ 2015-06-04  8:02 UTC (permalink / raw)
  To: Peter Crosthwaite
  Cc: Michael S. Tsirkin, Laszlo Ersek,
	qemu-devel@nongnu.org Developers, Gerd Hoffmann



On 03/06/2015 19:58, Peter Crosthwaite wrote:
> On Wed, Jun 3, 2015 at 10:08 AM, Paolo Bonzini <pbonzini@redhat.com> wrote:
>> Different CPUs can be in SMM or not at the same time, thus they
>> will see different things where the chipset places SMRAM.
>>
>> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
>> ---
>>  target-i386/cpu-qom.h |  1 +
>>  target-i386/cpu.c     | 14 ++++++++++++++
>>  2 files changed, 15 insertions(+)
>>
>> diff --git a/target-i386/cpu-qom.h b/target-i386/cpu-qom.h
>> index 31a0c1e..39cd878 100644
>> --- a/target-i386/cpu-qom.h
>> +++ b/target-i386/cpu-qom.h
>> @@ -111,6 +111,7 @@ typedef struct X86CPU {
>>      /* in order to simplify APIC support, we leave this pointer to the
>>         user */
>>      struct DeviceState *apic_state;
>> +    struct MemoryRegion *cpu_as_root;
>>  } X86CPU;
>>
>>  static inline X86CPU *x86_env_get_cpu(CPUX86State *env)
>> diff --git a/target-i386/cpu.c b/target-i386/cpu.c
>> index 523d0cd..23b57a9 100644
>> --- a/target-i386/cpu.c
>> +++ b/target-i386/cpu.c
>> @@ -44,6 +44,7 @@
>>  #include "hw/qdev-properties.h"
>>  #include "hw/cpu/icc_bus.h"
>>  #ifndef CONFIG_USER_ONLY
>> +#include "exec/address-spaces.h"
>>  #include "hw/xen/xen.h"
>>  #include "hw/i386/apic_internal.h"
>>  #endif
>> @@ -2811,6 +2812,18 @@ static void x86_cpu_realizefn(DeviceState *dev, Error **errp)
>>  #endif
>>
>>      mce_init(cpu);
>> +
>> +#ifndef CONFIG_USER_ONLY
>> +    if (tcg_enabled()) {
>> +        cpu->cpu_as_root = g_new(MemoryRegion, 1);
>> +        cs->as = g_new(AddressSpace, 1);
>> +        memory_region_init_alias(cpu->cpu_as_root, OBJECT(cpu), "memory",
>> +                                 get_system_memory(), 0, ~0ull);
>> +        memory_region_set_enabled(cpu->cpu_as_root, true);
>> +        address_space_init(cs->as, cpu->cpu_as_root, "CPU");
>> +    }
>> +#endif
>> +
>>      qemu_init_vcpu(cs);
>>
>>      /* Only Intel CPUs support hyperthreading. Even though QEMU fixes this
>> @@ -2834,6 +2847,7 @@ static void x86_cpu_realizefn(DeviceState *dev, Error **errp)
>>      cpu_reset(cs);
>>
>>      xcc->parent_realize(dev, &local_err);
>> +
> 
> This intentional?

It's a remnant from a previous version, but I do prefer having a blank
line before the error recovery part of a function.

Paolo

> Regards,
> Peter
> 
>>  out:
>>      if (local_err != NULL) {
>>          error_propagate(errp, local_err);
>> --
>> 2.4.1
>>
>>
>>

^ permalink raw reply	[flat|nested] 49+ messages in thread

* Re: [Qemu-devel] [PATCH v2 08/23] pflash_cfi01: change to new-style MMIO accessors
  2015-06-04  6:19   ` Peter Crosthwaite
@ 2015-06-04  8:02     ` Paolo Bonzini
  2015-06-04 12:51       ` Laszlo Ersek
  2015-06-09 18:08       ` Richard Henderson
  0 siblings, 2 replies; 49+ messages in thread
From: Paolo Bonzini @ 2015-06-04  8:02 UTC (permalink / raw)
  To: Peter Crosthwaite
  Cc: Michael S. Tsirkin, Laszlo Ersek,
	qemu-devel@nongnu.org Developers, Gerd Hoffmann



On 04/06/2015 08:19, Peter Crosthwaite wrote:
> On Wed, Jun 3, 2015 at 10:08 AM, Paolo Bonzini <pbonzini@redhat.com> wrote:
>> This is a required step to implement read_with_attrs and write_with_attrs.
>>
>> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
>> ---
>>  hw/block/pflash_cfi01.c | 96 ++++++-------------------------------------------
> 
> Nice stats.
> 
>>  1 file changed, 10 insertions(+), 86 deletions(-)
>>
>> diff --git a/hw/block/pflash_cfi01.c b/hw/block/pflash_cfi01.c
>> index 7507a15..0b3667a 100644
>> --- a/hw/block/pflash_cfi01.c
>> +++ b/hw/block/pflash_cfi01.c
>> @@ -650,101 +650,25 @@ static void pflash_write(pflash_t *pfl, hwaddr offset,
>>  }
>>
>>
>> -static uint32_t pflash_readb_be(void *opaque, hwaddr addr)
>> -{
>> -    return pflash_read(opaque, addr, 1, 1);
>> -}
>> -
>> -static uint32_t pflash_readb_le(void *opaque, hwaddr addr)
>> -{
>> -    return pflash_read(opaque, addr, 1, 0);
>> -}
>> -
>> -static uint32_t pflash_readw_be(void *opaque, hwaddr addr)
>> +static uint64_t pflash_mem_read(void *opaque, hwaddr addr, unsigned len)
>>  {
>>      pflash_t *pfl = opaque;
>> +    bool be = !!(pfl->features & (1 << PFLASH_BE));
> 
> !!() not needed. Otherwise

I don't like magic bool-ification...  Is there a coding style item that
forbids this idiom in bool assignments?

Paolo

> Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.om>
> 
>>
>> -    return pflash_read(pfl, addr, 2, 1);
>> +    return pflash_read(pfl, addr, len, be);
>>  }
>>
>> -static uint32_t pflash_readw_le(void *opaque, hwaddr addr)
>> +static void pflash_mem_write(void *opaque, hwaddr addr, uint64_t value, unsigned len)
>>  {
>>      pflash_t *pfl = opaque;
>> +    bool be = !!(pfl->features & (1 << PFLASH_BE));
>>
>> -    return pflash_read(pfl, addr, 2, 0);
>> +    pflash_write(pfl, addr, value, len, be);
>>  }
>>
>> -static uint32_t pflash_readl_be(void *opaque, hwaddr addr)
>> -{
>> -    pflash_t *pfl = opaque;
>> -
>> -    return pflash_read(pfl, addr, 4, 1);
>> -}
>> -
>> -static uint32_t pflash_readl_le(void *opaque, hwaddr addr)
>> -{
>> -    pflash_t *pfl = opaque;
>> -
>> -    return pflash_read(pfl, addr, 4, 0);
>> -}
>> -
>> -static void pflash_writeb_be(void *opaque, hwaddr addr,
>> -                             uint32_t value)
>> -{
>> -    pflash_write(opaque, addr, value, 1, 1);
>> -}
>> -
>> -static void pflash_writeb_le(void *opaque, hwaddr addr,
>> -                             uint32_t value)
>> -{
>> -    pflash_write(opaque, addr, value, 1, 0);
>> -}
>> -
>> -static void pflash_writew_be(void *opaque, hwaddr addr,
>> -                             uint32_t value)
>> -{
>> -    pflash_t *pfl = opaque;
>> -
>> -    pflash_write(pfl, addr, value, 2, 1);
>> -}
>> -
>> -static void pflash_writew_le(void *opaque, hwaddr addr,
>> -                             uint32_t value)
>> -{
>> -    pflash_t *pfl = opaque;
>> -
>> -    pflash_write(pfl, addr, value, 2, 0);
>> -}
>> -
>> -static void pflash_writel_be(void *opaque, hwaddr addr,
>> -                             uint32_t value)
>> -{
>> -    pflash_t *pfl = opaque;
>> -
>> -    pflash_write(pfl, addr, value, 4, 1);
>> -}
>> -
>> -static void pflash_writel_le(void *opaque, hwaddr addr,
>> -                             uint32_t value)
>> -{
>> -    pflash_t *pfl = opaque;
>> -
>> -    pflash_write(pfl, addr, value, 4, 0);
>> -}
>> -
>> -static const MemoryRegionOps pflash_cfi01_ops_be = {
>> -    .old_mmio = {
>> -        .read = { pflash_readb_be, pflash_readw_be, pflash_readl_be, },
>> -        .write = { pflash_writeb_be, pflash_writew_be, pflash_writel_be, },
>> -    },
>> -    .endianness = DEVICE_NATIVE_ENDIAN,
>> -};
>> -
>> -static const MemoryRegionOps pflash_cfi01_ops_le = {
>> -    .old_mmio = {
>> -        .read = { pflash_readb_le, pflash_readw_le, pflash_readl_le, },
>> -        .write = { pflash_writeb_le, pflash_writew_le, pflash_writel_le, },
>> -    },
>> +static const MemoryRegionOps pflash_cfi01_ops = {
>> +    .read = pflash_mem_read,
>> +    .write = pflash_mem_write,
>>      .endianness = DEVICE_NATIVE_ENDIAN,
>>  };
>>
>> @@ -775,7 +699,7 @@ static void pflash_cfi01_realize(DeviceState *dev, Error **errp)
>>
>>      memory_region_init_rom_device(
>>          &pfl->mem, OBJECT(dev),
>> -        pfl->features & (1 << PFLASH_BE) ? &pflash_cfi01_ops_be : &pflash_cfi01_ops_le,
>> +        &pflash_cfi01_ops,
>>          pfl,
>>          pfl->name, total_len, &local_err);
>>      if (local_err) {
>> --
>> 2.4.1
>>
>>
>>

^ permalink raw reply	[flat|nested] 49+ messages in thread

* Re: [Qemu-devel] [PATCH v2 12/23] vl: run "late" notifiers immediately
  2015-06-04  6:39   ` Peter Crosthwaite
@ 2015-06-04  8:03     ` Paolo Bonzini
  0 siblings, 0 replies; 49+ messages in thread
From: Paolo Bonzini @ 2015-06-04  8:03 UTC (permalink / raw)
  To: Peter Crosthwaite
  Cc: Michael S. Tsirkin, Laszlo Ersek,
	qemu-devel@nongnu.org Developers, Gerd Hoffmann



On 04/06/2015 08:39, Peter Crosthwaite wrote:
> On Wed, Jun 3, 2015 at 10:08 AM, Paolo Bonzini <pbonzini@redhat.com> wrote:
>> If a machine_init_done notifier is added late, as part of a hot-plugged
>> device, run it immediately.
> 
> Blank line?

Yes, thanks.

Paolo

>> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
> 
> Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
> 
>> ---
>>  vl.c | 6 ++++++
>>  1 file changed, 6 insertions(+)
>>
>> diff --git a/vl.c b/vl.c
>> index 0707cfa..00def69 100644
>> --- a/vl.c
>> +++ b/vl.c
>> @@ -2498,14 +2498,20 @@ static void qemu_run_exit_notifiers(void)
>>      notifier_list_notify(&exit_notifiers, NULL);
>>  }
>>
>> +static bool machine_init_done;
>> +
>>  void qemu_add_machine_init_done_notifier(Notifier *notify)
>>  {
>>      notifier_list_add(&machine_init_done_notifiers, notify);
>> +    if (machine_init_done) {
>> +        notify->notify(notify, NULL);
>> +    }
>>  }
>>
>>  static void qemu_run_machine_init_done_notifiers(void)
>>  {
>>      notifier_list_notify(&machine_init_done_notifiers, NULL);
>> +    machine_init_done = true;
>>  }
>>
>>  static const QEMUOption *lookup_opt(int argc, char **argv,
>> --
>> 2.4.1
>>
>>
>>

^ permalink raw reply	[flat|nested] 49+ messages in thread

* Re: [Qemu-devel] [PATCH v2 15/23] target-i386: use memory API to implement SMRAM
  2015-06-04  7:19   ` Peter Crosthwaite
@ 2015-06-04  8:05     ` Paolo Bonzini
  0 siblings, 0 replies; 49+ messages in thread
From: Paolo Bonzini @ 2015-06-04  8:05 UTC (permalink / raw)
  To: Peter Crosthwaite
  Cc: Michael S. Tsirkin, Laszlo Ersek,
	qemu-devel@nongnu.org Developers, Gerd Hoffmann



On 04/06/2015 09:19, Peter Crosthwaite wrote:
> > Remove cpu_smm_register and cpu_smm_update.  Instead, each CPU
> > address space gets an extra region which is an alias of
> > /machine/smram.  This extra region is enabled or disabled
> > as the CPU enters/exits SMM.
>
> Why is the connectivity from machine->CPU made via a predetermined
> canon path? This has come up for me a few times out-of-tree and I have
> managed it via links. Can the machine create the smram bus as a
> MemoryRegion and in a loop pass it to each CPU via a MemoryRegion *
> link?

I did it this way because there's only one SMRAM---it's basically a part
of address_space_memory that's usually hidden, and there's only one
address_space_memory.

Also, KVM would not support separate per-CPU SMRAMs, even if they
existed on real hardware, so a single per-machine object made more sense
to me.

Paolo

^ permalink raw reply	[flat|nested] 49+ messages in thread

* Re: [Qemu-devel] [PATCH v2 13/23] target-i386: create a separate AddressSpace for each CPU
  2015-06-04  8:02     ` Paolo Bonzini
@ 2015-06-04 12:48       ` Laszlo Ersek
  0 siblings, 0 replies; 49+ messages in thread
From: Laszlo Ersek @ 2015-06-04 12:48 UTC (permalink / raw)
  To: Paolo Bonzini, Peter Crosthwaite
  Cc: Michael S. Tsirkin, qemu-devel@nongnu.org Developers, Gerd Hoffmann

On 06/04/15 10:02, Paolo Bonzini wrote:
> 
> 
> On 03/06/2015 19:58, Peter Crosthwaite wrote:
>> On Wed, Jun 3, 2015 at 10:08 AM, Paolo Bonzini <pbonzini@redhat.com> wrote:
>>> Different CPUs can be in SMM or not at the same time, thus they
>>> will see different things where the chipset places SMRAM.
>>>
>>> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
>>> ---
>>>  target-i386/cpu-qom.h |  1 +
>>>  target-i386/cpu.c     | 14 ++++++++++++++
>>>  2 files changed, 15 insertions(+)
>>>
>>> diff --git a/target-i386/cpu-qom.h b/target-i386/cpu-qom.h
>>> index 31a0c1e..39cd878 100644
>>> --- a/target-i386/cpu-qom.h
>>> +++ b/target-i386/cpu-qom.h
>>> @@ -111,6 +111,7 @@ typedef struct X86CPU {
>>>      /* in order to simplify APIC support, we leave this pointer to the
>>>         user */
>>>      struct DeviceState *apic_state;
>>> +    struct MemoryRegion *cpu_as_root;
>>>  } X86CPU;
>>>
>>>  static inline X86CPU *x86_env_get_cpu(CPUX86State *env)
>>> diff --git a/target-i386/cpu.c b/target-i386/cpu.c
>>> index 523d0cd..23b57a9 100644
>>> --- a/target-i386/cpu.c
>>> +++ b/target-i386/cpu.c
>>> @@ -44,6 +44,7 @@
>>>  #include "hw/qdev-properties.h"
>>>  #include "hw/cpu/icc_bus.h"
>>>  #ifndef CONFIG_USER_ONLY
>>> +#include "exec/address-spaces.h"
>>>  #include "hw/xen/xen.h"
>>>  #include "hw/i386/apic_internal.h"
>>>  #endif
>>> @@ -2811,6 +2812,18 @@ static void x86_cpu_realizefn(DeviceState *dev, Error **errp)
>>>  #endif
>>>
>>>      mce_init(cpu);
>>> +
>>> +#ifndef CONFIG_USER_ONLY
>>> +    if (tcg_enabled()) {
>>> +        cpu->cpu_as_root = g_new(MemoryRegion, 1);
>>> +        cs->as = g_new(AddressSpace, 1);
>>> +        memory_region_init_alias(cpu->cpu_as_root, OBJECT(cpu), "memory",
>>> +                                 get_system_memory(), 0, ~0ull);
>>> +        memory_region_set_enabled(cpu->cpu_as_root, true);
>>> +        address_space_init(cs->as, cpu->cpu_as_root, "CPU");
>>> +    }
>>> +#endif
>>> +
>>>      qemu_init_vcpu(cs);
>>>
>>>      /* Only Intel CPUs support hyperthreading. Even though QEMU fixes this
>>> @@ -2834,6 +2847,7 @@ static void x86_cpu_realizefn(DeviceState *dev, Error **errp)
>>>      cpu_reset(cs);
>>>
>>>      xcc->parent_realize(dev, &local_err);
>>> +
>>
>> This intentional?
> 
> It's a remnant from a previous version, but I do prefer having a blank
> line before the error recovery part of a function.

(+1. In fact if it's a cascade of several labels, I might insert a blank
line before each label.)

Laszlo

> 
> Paolo
> 
>> Regards,
>> Peter
>>
>>>  out:
>>>      if (local_err != NULL) {
>>>          error_propagate(errp, local_err);
>>> --
>>> 2.4.1
>>>
>>>
>>>

^ permalink raw reply	[flat|nested] 49+ messages in thread

* Re: [Qemu-devel] [PATCH v2 17/23] q35: implement high SMRAM
  2015-06-03 17:08 ` [Qemu-devel] [PATCH v2 17/23] q35: implement high SMRAM Paolo Bonzini
@ 2015-06-04 12:50   ` Michael S. Tsirkin
  0 siblings, 0 replies; 49+ messages in thread
From: Michael S. Tsirkin @ 2015-06-04 12:50 UTC (permalink / raw)
  To: Paolo Bonzini; +Cc: lersek, qemu-devel, kraxel

On Wed, Jun 03, 2015 at 07:08:42PM +0200, Paolo Bonzini wrote:
> When H_SMRAME is 1, low memory at 0xa0000 is left alone by
> SMM, and instead the chipset maps the 0xa0000-0xbffff window at
> 0xfeda0000-0xfedbffff.  This affects both the "non-SMM" view controlled
> by D_OPEN and the SMM view controlled by G_SMRAME, so add two new
> MemoryRegions and toggle the enabled/disabled state of all four
> in mch_update_smram.
> 
> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

Acked-by: Michael S. Tsirkin <mst@redhat.com>

> ---
>  hw/pci-host/q35.c         | 35 +++++++++++++++++++++++++++++++----
>  include/hw/pci-host/q35.h | 16 ++++++++--------
>  2 files changed, 39 insertions(+), 12 deletions(-)
> 
> diff --git a/hw/pci-host/q35.c b/hw/pci-host/q35.c
> index 236d3f5..92804fe 100644
> --- a/hw/pci-host/q35.c
> +++ b/hw/pci-host/q35.c
> @@ -266,12 +266,29 @@ static void mch_update_pam(MCHPCIState *mch)
>  static void mch_update_smram(MCHPCIState *mch)
>  {
>      PCIDevice *pd = PCI_DEVICE(mch);
> +    bool h_smrame = (pd->config[MCH_HOST_BRIDGE_ESMRAMC] & MCH_HOST_BRIDGE_ESMRAMC_H_SMRAME);
>  
>      memory_region_transaction_begin();
> -    memory_region_set_enabled(&mch->smram_region,
> -                              !(pd->config[MCH_HOST_BRIDGE_SMRAM] & SMRAM_D_OPEN));
> -    memory_region_set_enabled(&mch->smram,
> -                              pd->config[MCH_HOST_BRIDGE_SMRAM] & SMRAM_G_SMRAME);
> +
> +    if (pd->config[MCH_HOST_BRIDGE_SMRAM] & SMRAM_D_OPEN) {
> +        /* Hide (!) low SMRAM if H_SMRAME = 1 */
> +        memory_region_set_enabled(&mch->smram_region, h_smrame);
> +        /* Show high SMRAM if H_SMRAME = 1 */
> +        memory_region_set_enabled(&mch->open_high_smram, h_smrame);
> +    } else {
> +        /* Hide high SMRAM and low SMRAM */
> +        memory_region_set_enabled(&mch->smram_region, true);
> +        memory_region_set_enabled(&mch->open_high_smram, false);
> +    }
> +
> +    if (pd->config[MCH_HOST_BRIDGE_SMRAM] & SMRAM_G_SMRAME) {
> +        memory_region_set_enabled(&mch->low_smram, !h_smrame);
> +        memory_region_set_enabled(&mch->high_smram, h_smrame);
> +    } else {
> +        memory_region_set_enabled(&mch->low_smram, false);
> +        memory_region_set_enabled(&mch->high_smram, false);
> +    }
> +
>      memory_region_transaction_commit();
>  }
>  
> @@ -400,6 +417,12 @@ static void mch_realize(PCIDevice *d, Error **errp)
>                                          &mch->smram_region, 1);
>      memory_region_set_enabled(&mch->smram_region, true);
>  
> +    memory_region_init_alias(&mch->open_high_smram, OBJECT(mch), "smram-open-high",
> +                             mch->ram_memory, 0xa0000, 0x20000);
> +    memory_region_add_subregion_overlap(mch->system_memory, 0xfeda0000,
> +                                        &mch->open_high_smram, 1);
> +    memory_region_set_enabled(&mch->open_high_smram, false);
> +
>      /* smram, as seen by SMM CPUs */
>      memory_region_init(&mch->smram, OBJECT(mch), "smram", 1ull << 32);
>      memory_region_set_enabled(&mch->smram, true);
> @@ -407,6 +430,10 @@ static void mch_realize(PCIDevice *d, Error **errp)
>                               mch->ram_memory, 0xa0000, 0x20000);
>      memory_region_set_enabled(&mch->low_smram, true);
>      memory_region_add_subregion(&mch->smram, 0xa0000, &mch->low_smram);
> +    memory_region_init_alias(&mch->high_smram, OBJECT(mch), "smram-high",
> +                             mch->ram_memory, 0xa0000, 0x20000);
> +    memory_region_set_enabled(&mch->high_smram, true);
> +    memory_region_add_subregion(&mch->smram, 0xfeda0000, &mch->high_smram);
>      object_property_add_const_link(qdev_get_machine(), "smram",
>  				   OBJECT(&mch->smram), &error_abort);
>  
> diff --git a/include/hw/pci-host/q35.h b/include/hw/pci-host/q35.h
> index 17adeaa..0fff6a2 100644
> --- a/include/hw/pci-host/q35.h
> +++ b/include/hw/pci-host/q35.h
> @@ -52,8 +52,8 @@ typedef struct MCHPCIState {
>      MemoryRegion *system_memory;
>      MemoryRegion *address_space_io;
>      PAMMemoryRegion pam_regions[13];
> -    MemoryRegion smram_region;
> -    MemoryRegion smram, low_smram;
> +    MemoryRegion smram_region, open_high_smram;
> +    MemoryRegion smram, low_smram, high_smram;
>      PcPciInfo pci_info;
>      ram_addr_t below_4g_mem_size;
>      ram_addr_t above_4g_mem_size;
> @@ -127,7 +127,7 @@ typedef struct Q35PCIHost {
>  #define MCH_HOST_BRIDGE_PAM_MASK               ((uint8_t)0x3)
>  
>  #define MCH_HOST_BRIDGE_SMRAM                  0x9d
> -#define MCH_HOST_BRIDGE_SMRAM_SIZE             1
> +#define MCH_HOST_BRIDGE_SMRAM_SIZE             2
>  #define MCH_HOST_BRIDGE_SMRAM_DEFAULT          ((uint8_t)0x2)
>  #define MCH_HOST_BRIDGE_SMRAM_D_OPEN           ((uint8_t)(1 << 6))
>  #define MCH_HOST_BRIDGE_SMRAM_D_CLS            ((uint8_t)(1 << 5))
> @@ -141,11 +141,11 @@ typedef struct Q35PCIHost {
>  #define MCH_HOST_BRIDGE_UPPER_SYSTEM_BIOS_END  0x100000
>  
>  #define MCH_HOST_BRIDGE_ESMRAMC                0x9e
> -#define MCH_HOST_BRIDGE_ESMRAMC_H_SMRAME       ((uint8_t)(1 << 6))
> -#define MCH_HOST_BRIDGE_ESMRAMC_E_SMERR        ((uint8_t)(1 << 5))
> -#define MCH_HOST_BRIDGE_ESMRAMC_SM_CACHE       ((uint8_t)(1 << 4))
> -#define MCH_HOST_BRIDGE_ESMRAMC_SM_L1          ((uint8_t)(1 << 3))
> -#define MCH_HOST_BRIDGE_ESMRAMC_SM_L2          ((uint8_t)(1 << 2))
> +#define MCH_HOST_BRIDGE_ESMRAMC_H_SMRAME       ((uint8_t)(1 << 7))
> +#define MCH_HOST_BRIDGE_ESMRAMC_E_SMERR        ((uint8_t)(1 << 6))
> +#define MCH_HOST_BRIDGE_ESMRAMC_SM_CACHE       ((uint8_t)(1 << 5))
> +#define MCH_HOST_BRIDGE_ESMRAMC_SM_L1          ((uint8_t)(1 << 4))
> +#define MCH_HOST_BRIDGE_ESMRAMC_SM_L2          ((uint8_t)(1 << 3))
>  #define MCH_HOST_BRIDGE_ESMRAMC_TSEG_SZ_MASK   ((uint8_t)(0x3 << 1))
>  #define MCH_HOST_BRIDGE_ESMRAMC_TSEG_SZ_1MB    ((uint8_t)(0x0 << 1))
>  #define MCH_HOST_BRIDGE_ESMRAMC_TSEG_SZ_2MB    ((uint8_t)(0x1 << 1))
> -- 
> 2.4.1
> 

^ permalink raw reply	[flat|nested] 49+ messages in thread

* Re: [Qemu-devel] [PATCH v2 08/23] pflash_cfi01: change to new-style MMIO accessors
  2015-06-04  8:02     ` Paolo Bonzini
@ 2015-06-04 12:51       ` Laszlo Ersek
  2015-06-09 18:08       ` Richard Henderson
  1 sibling, 0 replies; 49+ messages in thread
From: Laszlo Ersek @ 2015-06-04 12:51 UTC (permalink / raw)
  To: Paolo Bonzini, Peter Crosthwaite
  Cc: Michael S. Tsirkin, qemu-devel@nongnu.org Developers, Gerd Hoffmann

On 06/04/15 10:02, Paolo Bonzini wrote:
> 
> 
> On 04/06/2015 08:19, Peter Crosthwaite wrote:
>> On Wed, Jun 3, 2015 at 10:08 AM, Paolo Bonzini <pbonzini@redhat.com> wrote:
>>> This is a required step to implement read_with_attrs and write_with_attrs.
>>>
>>> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
>>> ---
>>>  hw/block/pflash_cfi01.c | 96 ++++++-------------------------------------------
>>
>> Nice stats.
>>
>>>  1 file changed, 10 insertions(+), 86 deletions(-)
>>>
>>> diff --git a/hw/block/pflash_cfi01.c b/hw/block/pflash_cfi01.c
>>> index 7507a15..0b3667a 100644
>>> --- a/hw/block/pflash_cfi01.c
>>> +++ b/hw/block/pflash_cfi01.c
>>> @@ -650,101 +650,25 @@ static void pflash_write(pflash_t *pfl, hwaddr offset,
>>>  }
>>>
>>>
>>> -static uint32_t pflash_readb_be(void *opaque, hwaddr addr)
>>> -{
>>> -    return pflash_read(opaque, addr, 1, 1);
>>> -}
>>> -
>>> -static uint32_t pflash_readb_le(void *opaque, hwaddr addr)
>>> -{
>>> -    return pflash_read(opaque, addr, 1, 0);
>>> -}
>>> -
>>> -static uint32_t pflash_readw_be(void *opaque, hwaddr addr)
>>> +static uint64_t pflash_mem_read(void *opaque, hwaddr addr, unsigned len)
>>>  {
>>>      pflash_t *pfl = opaque;
>>> +    bool be = !!(pfl->features & (1 << PFLASH_BE));
>>
>> !!() not needed. Otherwise
> 
> I don't like magic bool-ification...  Is there a coding style item that
> forbids this idiom in bool assignments?

(Side remark: in edk2, BOOLEAN is actually UINT8. !!(expr) -- or,
((expr) != 0) -- is a necessity there.)

Thanks
Laszlo


> 
> Paolo
> 
>> Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.om>
>>
>>>
>>> -    return pflash_read(pfl, addr, 2, 1);
>>> +    return pflash_read(pfl, addr, len, be);
>>>  }
>>>
>>> -static uint32_t pflash_readw_le(void *opaque, hwaddr addr)
>>> +static void pflash_mem_write(void *opaque, hwaddr addr, uint64_t value, unsigned len)
>>>  {
>>>      pflash_t *pfl = opaque;
>>> +    bool be = !!(pfl->features & (1 << PFLASH_BE));
>>>
>>> -    return pflash_read(pfl, addr, 2, 0);
>>> +    pflash_write(pfl, addr, value, len, be);
>>>  }
>>>
>>> -static uint32_t pflash_readl_be(void *opaque, hwaddr addr)
>>> -{
>>> -    pflash_t *pfl = opaque;
>>> -
>>> -    return pflash_read(pfl, addr, 4, 1);
>>> -}
>>> -
>>> -static uint32_t pflash_readl_le(void *opaque, hwaddr addr)
>>> -{
>>> -    pflash_t *pfl = opaque;
>>> -
>>> -    return pflash_read(pfl, addr, 4, 0);
>>> -}
>>> -
>>> -static void pflash_writeb_be(void *opaque, hwaddr addr,
>>> -                             uint32_t value)
>>> -{
>>> -    pflash_write(opaque, addr, value, 1, 1);
>>> -}
>>> -
>>> -static void pflash_writeb_le(void *opaque, hwaddr addr,
>>> -                             uint32_t value)
>>> -{
>>> -    pflash_write(opaque, addr, value, 1, 0);
>>> -}
>>> -
>>> -static void pflash_writew_be(void *opaque, hwaddr addr,
>>> -                             uint32_t value)
>>> -{
>>> -    pflash_t *pfl = opaque;
>>> -
>>> -    pflash_write(pfl, addr, value, 2, 1);
>>> -}
>>> -
>>> -static void pflash_writew_le(void *opaque, hwaddr addr,
>>> -                             uint32_t value)
>>> -{
>>> -    pflash_t *pfl = opaque;
>>> -
>>> -    pflash_write(pfl, addr, value, 2, 0);
>>> -}
>>> -
>>> -static void pflash_writel_be(void *opaque, hwaddr addr,
>>> -                             uint32_t value)
>>> -{
>>> -    pflash_t *pfl = opaque;
>>> -
>>> -    pflash_write(pfl, addr, value, 4, 1);
>>> -}
>>> -
>>> -static void pflash_writel_le(void *opaque, hwaddr addr,
>>> -                             uint32_t value)
>>> -{
>>> -    pflash_t *pfl = opaque;
>>> -
>>> -    pflash_write(pfl, addr, value, 4, 0);
>>> -}
>>> -
>>> -static const MemoryRegionOps pflash_cfi01_ops_be = {
>>> -    .old_mmio = {
>>> -        .read = { pflash_readb_be, pflash_readw_be, pflash_readl_be, },
>>> -        .write = { pflash_writeb_be, pflash_writew_be, pflash_writel_be, },
>>> -    },
>>> -    .endianness = DEVICE_NATIVE_ENDIAN,
>>> -};
>>> -
>>> -static const MemoryRegionOps pflash_cfi01_ops_le = {
>>> -    .old_mmio = {
>>> -        .read = { pflash_readb_le, pflash_readw_le, pflash_readl_le, },
>>> -        .write = { pflash_writeb_le, pflash_writew_le, pflash_writel_le, },
>>> -    },
>>> +static const MemoryRegionOps pflash_cfi01_ops = {
>>> +    .read = pflash_mem_read,
>>> +    .write = pflash_mem_write,
>>>      .endianness = DEVICE_NATIVE_ENDIAN,
>>>  };
>>>
>>> @@ -775,7 +699,7 @@ static void pflash_cfi01_realize(DeviceState *dev, Error **errp)
>>>
>>>      memory_region_init_rom_device(
>>>          &pfl->mem, OBJECT(dev),
>>> -        pfl->features & (1 << PFLASH_BE) ? &pflash_cfi01_ops_be : &pflash_cfi01_ops_le,
>>> +        &pflash_cfi01_ops,
>>>          pfl,
>>>          pfl->name, total_len, &local_err);
>>>      if (local_err) {
>>> --
>>> 2.4.1
>>>
>>>
>>>

^ permalink raw reply	[flat|nested] 49+ messages in thread

* Re: [Qemu-devel] [PATCH v2 18/23] q35: fix ESMRAMC default
  2015-06-03 17:08 ` [Qemu-devel] [PATCH v2 18/23] q35: fix ESMRAMC default Paolo Bonzini
@ 2015-06-04 12:51   ` Michael S. Tsirkin
  0 siblings, 0 replies; 49+ messages in thread
From: Michael S. Tsirkin @ 2015-06-04 12:51 UTC (permalink / raw)
  To: Paolo Bonzini; +Cc: lersek, qemu-devel, kraxel

On Wed, Jun 03, 2015 at 07:08:43PM +0200, Paolo Bonzini wrote:
> From: Gerd Hoffmann <kraxel@redhat.com>
> 
> The cache bits in ESMRAMC are hardcoded to 1 (=disabled) according to
> the q35 mch specs.  Add and use a define with this default.
> 
> While being at it also update the SMRAM default to use the name (no code
> change, just makes things a bit more readable).
> 
> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

Reviewed-by: Michael S. Tsirkin <mst@redhat.com>

> ---
>  hw/pci-host/q35.c         | 1 +
>  include/hw/pci-host/q35.h | 7 ++++++-
>  2 files changed, 7 insertions(+), 1 deletion(-)
> 
> diff --git a/hw/pci-host/q35.c b/hw/pci-host/q35.c
> index 92804fe..93bec84 100644
> --- a/hw/pci-host/q35.c
> +++ b/hw/pci-host/q35.c
> @@ -354,6 +354,7 @@ static void mch_reset(DeviceState *qdev)
>                   MCH_HOST_BRIDGE_PCIEXBAR_DEFAULT);
>  
>      d->config[MCH_HOST_BRIDGE_SMRAM] = MCH_HOST_BRIDGE_SMRAM_DEFAULT;
> +    d->config[MCH_HOST_BRIDGE_ESMRAMC] = MCH_HOST_BRIDGE_ESMRAMC_DEFAULT;
>  
>      mch_update(mch);
>  }
> diff --git a/include/hw/pci-host/q35.h b/include/hw/pci-host/q35.h
> index 0fff6a2..d3c7bbb 100644
> --- a/include/hw/pci-host/q35.h
> +++ b/include/hw/pci-host/q35.h
> @@ -128,7 +128,6 @@ typedef struct Q35PCIHost {
>  
>  #define MCH_HOST_BRIDGE_SMRAM                  0x9d
>  #define MCH_HOST_BRIDGE_SMRAM_SIZE             2
> -#define MCH_HOST_BRIDGE_SMRAM_DEFAULT          ((uint8_t)0x2)
>  #define MCH_HOST_BRIDGE_SMRAM_D_OPEN           ((uint8_t)(1 << 6))
>  #define MCH_HOST_BRIDGE_SMRAM_D_CLS            ((uint8_t)(1 << 5))
>  #define MCH_HOST_BRIDGE_SMRAM_D_LCK            ((uint8_t)(1 << 4))
> @@ -139,6 +138,8 @@ typedef struct Q35PCIHost {
>  #define MCH_HOST_BRIDGE_SMRAM_C_END            0xc0000
>  #define MCH_HOST_BRIDGE_SMRAM_C_SIZE           0x20000
>  #define MCH_HOST_BRIDGE_UPPER_SYSTEM_BIOS_END  0x100000
> +#define MCH_HOST_BRIDGE_SMRAM_DEFAULT           \
> +    MCH_HOST_BRIDGE_SMRAM_C_BASE_SEG
>  
>  #define MCH_HOST_BRIDGE_ESMRAMC                0x9e
>  #define MCH_HOST_BRIDGE_ESMRAMC_H_SMRAME       ((uint8_t)(1 << 7))
> @@ -151,6 +152,10 @@ typedef struct Q35PCIHost {
>  #define MCH_HOST_BRIDGE_ESMRAMC_TSEG_SZ_2MB    ((uint8_t)(0x1 << 1))
>  #define MCH_HOST_BRIDGE_ESMRAMC_TSEG_SZ_8MB    ((uint8_t)(0x2 << 1))
>  #define MCH_HOST_BRIDGE_ESMRAMC_T_EN           ((uint8_t)1)
> +#define MCH_HOST_BRIDGE_ESMRAMC_DEFAULT \
> +    (MCH_HOST_BRIDGE_ESMRAMC_SM_CACHE | \
> +     MCH_HOST_BRIDGE_ESMRAMC_SM_L1 |    \
> +     MCH_HOST_BRIDGE_ESMRAMC_SM_L2)
>  
>  /* D1:F0 PCIE* port*/
>  #define MCH_PCIE_DEV                           1
> -- 
> 2.4.1
> 

^ permalink raw reply	[flat|nested] 49+ messages in thread

* Re: [Qemu-devel] [PATCH v2 19/23] q35: add config space wmask for SMRAM and ESMRAMC
  2015-06-03 17:08 ` [Qemu-devel] [PATCH v2 19/23] q35: add config space wmask for SMRAM and ESMRAMC Paolo Bonzini
@ 2015-06-04 12:51   ` Michael S. Tsirkin
  0 siblings, 0 replies; 49+ messages in thread
From: Michael S. Tsirkin @ 2015-06-04 12:51 UTC (permalink / raw)
  To: Paolo Bonzini; +Cc: lersek, qemu-devel, kraxel

On Wed, Jun 03, 2015 at 07:08:44PM +0200, Paolo Bonzini wrote:
> From: Gerd Hoffmann <kraxel@redhat.com>
> 
> Not all bits in SMRAM and ESMRAMC can be changed by the guest.
> Add wmask defines accordingly and set them in mch_reset().
> 
> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

Reviewed-by: Michael S. Tsirkin <mst@redhat.com>

> ---
>  hw/pci-host/q35.c         | 2 ++
>  include/hw/pci-host/q35.h | 9 +++++++++
>  2 files changed, 11 insertions(+)
> 
> diff --git a/hw/pci-host/q35.c b/hw/pci-host/q35.c
> index 93bec84..ce101e2 100644
> --- a/hw/pci-host/q35.c
> +++ b/hw/pci-host/q35.c
> @@ -355,6 +355,8 @@ static void mch_reset(DeviceState *qdev)
>  
>      d->config[MCH_HOST_BRIDGE_SMRAM] = MCH_HOST_BRIDGE_SMRAM_DEFAULT;
>      d->config[MCH_HOST_BRIDGE_ESMRAMC] = MCH_HOST_BRIDGE_ESMRAMC_DEFAULT;
> +    d->wmask[MCH_HOST_BRIDGE_SMRAM] = MCH_HOST_BRIDGE_SMRAM_WMASK;
> +    d->wmask[MCH_HOST_BRIDGE_ESMRAMC] = MCH_HOST_BRIDGE_ESMRAMC_WMASK;
>  
>      mch_update(mch);
>  }
> diff --git a/include/hw/pci-host/q35.h b/include/hw/pci-host/q35.h
> index d3c7bbb..01b8492 100644
> --- a/include/hw/pci-host/q35.h
> +++ b/include/hw/pci-host/q35.h
> @@ -140,6 +140,11 @@ typedef struct Q35PCIHost {
>  #define MCH_HOST_BRIDGE_UPPER_SYSTEM_BIOS_END  0x100000
>  #define MCH_HOST_BRIDGE_SMRAM_DEFAULT           \
>      MCH_HOST_BRIDGE_SMRAM_C_BASE_SEG
> +#define MCH_HOST_BRIDGE_SMRAM_WMASK             \
> +    (MCH_HOST_BRIDGE_SMRAM_D_OPEN |             \
> +     MCH_HOST_BRIDGE_SMRAM_D_CLS |              \
> +     MCH_HOST_BRIDGE_SMRAM_D_LCK |              \
> +     MCH_HOST_BRIDGE_SMRAM_G_SMRAME)
>  
>  #define MCH_HOST_BRIDGE_ESMRAMC                0x9e
>  #define MCH_HOST_BRIDGE_ESMRAMC_H_SMRAME       ((uint8_t)(1 << 7))
> @@ -156,6 +161,10 @@ typedef struct Q35PCIHost {
>      (MCH_HOST_BRIDGE_ESMRAMC_SM_CACHE | \
>       MCH_HOST_BRIDGE_ESMRAMC_SM_L1 |    \
>       MCH_HOST_BRIDGE_ESMRAMC_SM_L2)
> +#define MCH_HOST_BRIDGE_ESMRAMC_WMASK               \
> +    (MCH_HOST_BRIDGE_ESMRAMC_H_SMRAME |             \
> +     MCH_HOST_BRIDGE_ESMRAMC_TSEG_SZ_MASK |         \
> +     MCH_HOST_BRIDGE_ESMRAMC_T_EN)
>  
>  /* D1:F0 PCIE* port*/
>  #define MCH_PCIE_DEV                           1
> -- 
> 2.4.1
> 

^ permalink raw reply	[flat|nested] 49+ messages in thread

* Re: [Qemu-devel] [PATCH v2 20/23] q35: implement SMRAM.D_LCK
  2015-06-03 17:08 ` [Qemu-devel] [PATCH v2 20/23] q35: implement SMRAM.D_LCK Paolo Bonzini
@ 2015-06-04 12:51   ` Michael S. Tsirkin
  0 siblings, 0 replies; 49+ messages in thread
From: Michael S. Tsirkin @ 2015-06-04 12:51 UTC (permalink / raw)
  To: Paolo Bonzini; +Cc: lersek, qemu-devel, kraxel

On Wed, Jun 03, 2015 at 07:08:45PM +0200, Paolo Bonzini wrote:
> From: Gerd Hoffmann <kraxel@redhat.com>
> 
> Once the SMRAM.D_LCK bit has been set by the guest several bits in SMRAM
> and ESMRAMC become readonly until the next machine reset.  Implement
> this by updating the wmask accordingly when the guest sets the lock bit.
> As the lock it itself is locked down too we don't need to worry about
> the guest clearing the lock bit.
> 
> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

Reviewed-by: Michael S. Tsirkin <mst@redhat.com>

> ---
>  hw/pci-host/q35.c         | 8 +++++++-
>  include/hw/pci-host/q35.h | 3 +++
>  2 files changed, 10 insertions(+), 1 deletion(-)
> 
> diff --git a/hw/pci-host/q35.c b/hw/pci-host/q35.c
> index ce101e2..2f37c29 100644
> --- a/hw/pci-host/q35.c
> +++ b/hw/pci-host/q35.c
> @@ -268,6 +268,13 @@ static void mch_update_smram(MCHPCIState *mch)
>      PCIDevice *pd = PCI_DEVICE(mch);
>      bool h_smrame = (pd->config[MCH_HOST_BRIDGE_ESMRAMC] & MCH_HOST_BRIDGE_ESMRAMC_H_SMRAME);
>  
> +    /* implement SMRAM.D_LCK */
> +    if (pd->config[MCH_HOST_BRIDGE_SMRAM] & MCH_HOST_BRIDGE_SMRAM_D_LCK) {
> +        pd->config[MCH_HOST_BRIDGE_SMRAM] &= ~MCH_HOST_BRIDGE_SMRAM_D_OPEN;
> +        pd->wmask[MCH_HOST_BRIDGE_SMRAM] = MCH_HOST_BRIDGE_SMRAM_WMASK_LCK;
> +        pd->wmask[MCH_HOST_BRIDGE_ESMRAMC] = MCH_HOST_BRIDGE_ESMRAMC_WMASK_LCK;
> +    }
> +
>      memory_region_transaction_begin();
>  
>      if (pd->config[MCH_HOST_BRIDGE_SMRAM] & SMRAM_D_OPEN) {
> @@ -297,7 +304,6 @@ static void mch_write_config(PCIDevice *d,
>  {
>      MCHPCIState *mch = MCH_PCI_DEVICE(d);
>  
> -    /* XXX: implement SMRAM.D_LOCK */
>      pci_default_write_config(d, address, val, len);
>  
>      if (ranges_overlap(address, len, MCH_HOST_BRIDGE_PAM0,
> diff --git a/include/hw/pci-host/q35.h b/include/hw/pci-host/q35.h
> index 01b8492..113cbe8 100644
> --- a/include/hw/pci-host/q35.h
> +++ b/include/hw/pci-host/q35.h
> @@ -145,6 +145,8 @@ typedef struct Q35PCIHost {
>       MCH_HOST_BRIDGE_SMRAM_D_CLS |              \
>       MCH_HOST_BRIDGE_SMRAM_D_LCK |              \
>       MCH_HOST_BRIDGE_SMRAM_G_SMRAME)
> +#define MCH_HOST_BRIDGE_SMRAM_WMASK_LCK         \
> +    MCH_HOST_BRIDGE_SMRAM_D_CLS
>  
>  #define MCH_HOST_BRIDGE_ESMRAMC                0x9e
>  #define MCH_HOST_BRIDGE_ESMRAMC_H_SMRAME       ((uint8_t)(1 << 7))
> @@ -165,6 +167,7 @@ typedef struct Q35PCIHost {
>      (MCH_HOST_BRIDGE_ESMRAMC_H_SMRAME |             \
>       MCH_HOST_BRIDGE_ESMRAMC_TSEG_SZ_MASK |         \
>       MCH_HOST_BRIDGE_ESMRAMC_T_EN)
> +#define MCH_HOST_BRIDGE_ESMRAMC_WMASK_LCK     0
>  
>  /* D1:F0 PCIE* port*/
>  #define MCH_PCIE_DEV                           1
> -- 
> 2.4.1
> 

^ permalink raw reply	[flat|nested] 49+ messages in thread

* Re: [Qemu-devel] [PATCH v2 21/23] q35: add test for SMRAM.D_LCK
  2015-06-03 17:08 ` [Qemu-devel] [PATCH v2 21/23] q35: add test for SMRAM.D_LCK Paolo Bonzini
@ 2015-06-04 12:52   ` Michael S. Tsirkin
  0 siblings, 0 replies; 49+ messages in thread
From: Michael S. Tsirkin @ 2015-06-04 12:52 UTC (permalink / raw)
  To: Paolo Bonzini; +Cc: lersek, qemu-devel, kraxel

On Wed, Jun 03, 2015 at 07:08:46PM +0200, Paolo Bonzini wrote:
> From: Gerd Hoffmann <kraxel@redhat.com>
> 
> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

Reviewed-by: Michael S. Tsirkin <mst@redhat.com>

> ---
>  tests/Makefile   |  3 ++
>  tests/q35-test.c | 91 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++
>  2 files changed, 94 insertions(+)
>  create mode 100644 tests/q35-test.c
> 
> diff --git a/tests/Makefile b/tests/Makefile
> index 729b969..f4721d0 100644
> --- a/tests/Makefile
> +++ b/tests/Makefile
> @@ -174,6 +174,8 @@ gcov-files-i386-y += hw/usb/dev-storage.c
>  check-qtest-i386-y += tests/usb-hcd-xhci-test$(EXESUF)
>  gcov-files-i386-y += hw/usb/hcd-xhci.c
>  check-qtest-i386-y += tests/pc-cpu-test$(EXESUF)
> +check-qtest-i386-y += tests/q35-test$(EXESUF)
> +gcov-files-i386-y += hw/pci-host/q35.c
>  check-qtest-i386-$(CONFIG_LINUX) += tests/vhost-user-test$(EXESUF)
>  check-qtest-x86_64-y = $(check-qtest-i386-y)
>  gcov-files-i386-y += i386-softmmu/hw/timer/mc146818rtc.c
> @@ -389,6 +391,7 @@ tests/usb-hcd-uhci-test$(EXESUF): tests/usb-hcd-uhci-test.o $(libqos-usb-obj-y)
>  tests/usb-hcd-ehci-test$(EXESUF): tests/usb-hcd-ehci-test.o $(libqos-usb-obj-y)
>  tests/usb-hcd-xhci-test$(EXESUF): tests/usb-hcd-xhci-test.o $(libqos-usb-obj-y)
>  tests/pc-cpu-test$(EXESUF): tests/pc-cpu-test.o
> +tests/smram-test$(EXESUF): tests/smram-test.o $(libqos-pc-obj-y)
>  tests/vhost-user-test$(EXESUF): tests/vhost-user-test.o qemu-char.o qemu-timer.o $(qtest-obj-y)
>  tests/qemu-iotests/socket_scm_helper$(EXESUF): tests/qemu-iotests/socket_scm_helper.o
>  tests/test-qemu-opts$(EXESUF): tests/test-qemu-opts.o libqemuutil.a libqemustub.a
> diff --git a/tests/q35-test.c b/tests/q35-test.c
> new file mode 100644
> index 0000000..812abe5
> --- /dev/null
> +++ b/tests/q35-test.c
> @@ -0,0 +1,91 @@
> +/*
> + * QTest testcase for Q35 northbridge
> + *
> + * Copyright (c) 2015 Red Hat, Inc.
> + *
> + * Author: Gerd Hoffmann <kraxel@redhat.com>
> + *
> + * This work is licensed under the terms of the GNU GPL, version 2 or later.
> + * See the COPYING file in the top-level directory.
> + */
> +
> +#include <glib.h>
> +#include <string.h>
> +#include "libqtest.h"
> +#include "libqos/pci.h"
> +#include "libqos/pci-pc.h"
> +#include "qemu/osdep.h"
> +#include "hw/pci-host/q35.h"
> +
> +static void smram_set_bit(QPCIDevice *pcidev, uint8_t mask, bool enabled)
> +{
> +    uint8_t smram;
> +
> +    smram = qpci_config_readb(pcidev, MCH_HOST_BRIDGE_SMRAM);
> +    if (enabled) {
> +        smram |= mask;
> +    } else {
> +        smram &= ~mask;
> +    }
> +    qpci_config_writeb(pcidev, MCH_HOST_BRIDGE_SMRAM, smram);
> +}
> +
> +static bool smram_test_bit(QPCIDevice *pcidev, uint8_t mask)
> +{
> +    uint8_t smram;
> +
> +    smram = qpci_config_readb(pcidev, MCH_HOST_BRIDGE_SMRAM);
> +    return smram & mask;
> +}
> +
> +static void test_smram_lock(void)
> +{
> +    QPCIBus *pcibus;
> +    QPCIDevice *pcidev;
> +    QDict *response;
> +
> +    pcibus = qpci_init_pc();
> +    g_assert(pcibus != NULL);
> +
> +    pcidev = qpci_device_find(pcibus, 0);
> +    g_assert(pcidev != NULL);
> +
> +    /* check open is settable */
> +    smram_set_bit(pcidev, MCH_HOST_BRIDGE_SMRAM_D_OPEN, false);
> +    g_assert(smram_test_bit(pcidev, MCH_HOST_BRIDGE_SMRAM_D_OPEN) == false);
> +    smram_set_bit(pcidev, MCH_HOST_BRIDGE_SMRAM_D_OPEN, true);
> +    g_assert(smram_test_bit(pcidev, MCH_HOST_BRIDGE_SMRAM_D_OPEN) == true);
> +
> +    /* lock, check open is cleared & not settable */
> +    smram_set_bit(pcidev, MCH_HOST_BRIDGE_SMRAM_D_LCK, true);
> +    g_assert(smram_test_bit(pcidev, MCH_HOST_BRIDGE_SMRAM_D_OPEN) == false);
> +    smram_set_bit(pcidev, MCH_HOST_BRIDGE_SMRAM_D_OPEN, true);
> +    g_assert(smram_test_bit(pcidev, MCH_HOST_BRIDGE_SMRAM_D_OPEN) == false);
> +
> +    /* reset */
> +    response = qmp("{'execute': 'system_reset', 'arguments': {} }");
> +    g_assert(response);
> +    g_assert(!qdict_haskey(response, "error"));
> +    QDECREF(response);
> +
> +    /* check open is settable again */
> +    smram_set_bit(pcidev, MCH_HOST_BRIDGE_SMRAM_D_OPEN, false);
> +    g_assert(smram_test_bit(pcidev, MCH_HOST_BRIDGE_SMRAM_D_OPEN) == false);
> +    smram_set_bit(pcidev, MCH_HOST_BRIDGE_SMRAM_D_OPEN, true);
> +    g_assert(smram_test_bit(pcidev, MCH_HOST_BRIDGE_SMRAM_D_OPEN) == true);
> +}
> +
> +int main(int argc, char **argv)
> +{
> +    int ret;
> +
> +    g_test_init(&argc, &argv, NULL);
> +
> +    qtest_add_func("/q35/smram/lock", test_smram_lock);
> +
> +    qtest_start("-M q35");
> +    ret = g_test_run();
> +    qtest_end();
> +
> +    return ret;
> +}
> -- 
> 2.4.1
> 

^ permalink raw reply	[flat|nested] 49+ messages in thread

* Re: [Qemu-devel] [PATCH v2 22/23] q35: implement TSEG
  2015-06-03 17:08 ` [Qemu-devel] [PATCH v2 22/23] q35: implement TSEG Paolo Bonzini
@ 2015-06-04 12:53   ` Michael S. Tsirkin
  0 siblings, 0 replies; 49+ messages in thread
From: Michael S. Tsirkin @ 2015-06-04 12:53 UTC (permalink / raw)
  To: Paolo Bonzini; +Cc: lersek, qemu-devel, kraxel

On Wed, Jun 03, 2015 at 07:08:47PM +0200, Paolo Bonzini wrote:
> From: Gerd Hoffmann <kraxel@redhat.com>
> 
> TSEG provides larger amounts of SMRAM than the 128 KB available with
> legacy SMRAM and high SMRAM.
> 
> Route access to tseg into nowhere when enabled, for both cpus and
> busmaster dma, and add tseg window to smram region, so cpus can access
> it in smm mode.
> 
> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

Reviewed-by: Michael S. Tsirkin <mst@redhat.com>

> ---
>  hw/pci-host/q35.c         | 72 ++++++++++++++++++++++++++++++++++++++++++++++-
>  include/hw/pci-host/q35.h |  1 +
>  2 files changed, 72 insertions(+), 1 deletion(-)
> 
> diff --git a/hw/pci-host/q35.c b/hw/pci-host/q35.c
> index 2f37c29..9fb1b20 100644
> --- a/hw/pci-host/q35.c
> +++ b/hw/pci-host/q35.c
> @@ -198,6 +198,28 @@ static const TypeInfo q35_host_info = {
>   * MCH D0:F0
>   */
>  
> +static uint64_t tseg_blackhole_read(void *ptr, hwaddr reg, unsigned size)
> +{
> +    return 0xffffffff;
> +}
> +
> +static void tseg_blackhole_write(void *opaque, hwaddr addr, uint64_t val,
> +                                 unsigned width)
> +{
> +    /* nothing */
> +}
> +
> +static const MemoryRegionOps tseg_blackhole_ops = {
> +    .read = tseg_blackhole_read,
> +    .write = tseg_blackhole_write,
> +    .endianness = DEVICE_NATIVE_ENDIAN,
> +    .valid.min_access_size = 1,
> +    .valid.max_access_size = 4,
> +    .impl.min_access_size = 4,
> +    .impl.max_access_size = 4,
> +    .endianness = DEVICE_LITTLE_ENDIAN,
> +};
> +
>  /* PCIe MMCFG */
>  static void mch_update_pciexbar(MCHPCIState *mch)
>  {
> @@ -267,6 +289,7 @@ static void mch_update_smram(MCHPCIState *mch)
>  {
>      PCIDevice *pd = PCI_DEVICE(mch);
>      bool h_smrame = (pd->config[MCH_HOST_BRIDGE_ESMRAMC] & MCH_HOST_BRIDGE_ESMRAMC_H_SMRAME);
> +    uint32_t tseg_size;
>  
>      /* implement SMRAM.D_LCK */
>      if (pd->config[MCH_HOST_BRIDGE_SMRAM] & MCH_HOST_BRIDGE_SMRAM_D_LCK) {
> @@ -296,6 +319,39 @@ static void mch_update_smram(MCHPCIState *mch)
>          memory_region_set_enabled(&mch->high_smram, false);
>      }
>  
> +    if (pd->config[MCH_HOST_BRIDGE_ESMRAMC] & MCH_HOST_BRIDGE_ESMRAMC_T_EN) {
> +        switch (pd->config[MCH_HOST_BRIDGE_ESMRAMC] &
> +                MCH_HOST_BRIDGE_ESMRAMC_TSEG_SZ_MASK) {
> +        case MCH_HOST_BRIDGE_ESMRAMC_TSEG_SZ_1MB:
> +            tseg_size = 1024 * 1024;
> +            break;
> +        case MCH_HOST_BRIDGE_ESMRAMC_TSEG_SZ_2MB:
> +            tseg_size = 1024 * 1024 * 2;
> +            break;
> +        case MCH_HOST_BRIDGE_ESMRAMC_TSEG_SZ_8MB:
> +            tseg_size = 1024 * 1024 * 8;
> +            break;
> +        default:
> +            tseg_size = 0;
> +            break;
> +        }
> +    } else {
> +        tseg_size = 0;
> +    }
> +    memory_region_del_subregion(mch->system_memory, &mch->tseg_blackhole);
> +    memory_region_set_enabled(&mch->tseg_blackhole, tseg_size);
> +    memory_region_set_size(&mch->tseg_blackhole, tseg_size);
> +    memory_region_add_subregion_overlap(mch->system_memory,
> +                                        mch->below_4g_mem_size - tseg_size,
> +                                        &mch->tseg_blackhole, 1);
> +
> +    memory_region_set_enabled(&mch->tseg_window, tseg_size);
> +    memory_region_set_size(&mch->tseg_window, tseg_size);
> +    memory_region_set_address(&mch->tseg_window,
> +                              mch->below_4g_mem_size - tseg_size);
> +    memory_region_set_alias_offset(&mch->tseg_window,
> +                                   mch->below_4g_mem_size - tseg_size);
> +
>      memory_region_transaction_commit();
>  }
>  
> @@ -443,9 +499,23 @@ static void mch_realize(PCIDevice *d, Error **errp)
>                               mch->ram_memory, 0xa0000, 0x20000);
>      memory_region_set_enabled(&mch->high_smram, true);
>      memory_region_add_subregion(&mch->smram, 0xfeda0000, &mch->high_smram);
> +
> +    memory_region_init_io(&mch->tseg_blackhole, OBJECT(mch),
> +                          &tseg_blackhole_ops, NULL,
> +                          "tseg-blackhole", 0);
> +    memory_region_set_enabled(&mch->tseg_blackhole, false);
> +    memory_region_add_subregion_overlap(mch->system_memory,
> +                                        mch->below_4g_mem_size,
> +                                        &mch->tseg_blackhole, 1);
> +
> +    memory_region_init_alias(&mch->tseg_window, OBJECT(mch), "tseg-window",
> +                             mch->ram_memory, mch->below_4g_mem_size, 0);
> +    memory_region_set_enabled(&mch->tseg_window, false);
> +    memory_region_add_subregion(&mch->smram, mch->below_4g_mem_size,
> +                                &mch->tseg_window);
> +
>      object_property_add_const_link(qdev_get_machine(), "smram",
>  				   OBJECT(&mch->smram), &error_abort);
> -
>      init_pam(DEVICE(mch), mch->ram_memory, mch->system_memory,
>               mch->pci_address_space, &mch->pam_regions[0],
>               PAM_BIOS_BASE, PAM_BIOS_SIZE);
> diff --git a/include/hw/pci-host/q35.h b/include/hw/pci-host/q35.h
> index 113cbe8..dbe6dc0 100644
> --- a/include/hw/pci-host/q35.h
> +++ b/include/hw/pci-host/q35.h
> @@ -54,6 +54,7 @@ typedef struct MCHPCIState {
>      PAMMemoryRegion pam_regions[13];
>      MemoryRegion smram_region, open_high_smram;
>      MemoryRegion smram, low_smram, high_smram;
> +    MemoryRegion tseg_blackhole, tseg_window;
>      PcPciInfo pci_info;
>      ram_addr_t below_4g_mem_size;
>      ram_addr_t above_4g_mem_size;
> -- 
> 2.4.1
> 

^ permalink raw reply	[flat|nested] 49+ messages in thread

* Re: [Qemu-devel] [PATCH v2 23/23] ich9: implement SMI_LOCK
  2015-06-03 17:08 ` [Qemu-devel] [PATCH v2 23/23] ich9: implement SMI_LOCK Paolo Bonzini
@ 2015-06-04 12:53   ` Michael S. Tsirkin
  0 siblings, 0 replies; 49+ messages in thread
From: Michael S. Tsirkin @ 2015-06-04 12:53 UTC (permalink / raw)
  To: Paolo Bonzini; +Cc: lersek, qemu-devel, kraxel

On Wed, Jun 03, 2015 at 07:08:48PM +0200, Paolo Bonzini wrote:
> From: Gerd Hoffmann <kraxel@redhat.com>
> 
> Add write mask for the smi enable register, so we can disable write
> access to certain bits.  Open all bits on reset.  Disable write access
> to GBL_SMI_EN when SMI_LOCK (in ich9 lpc pci config space) is set.
> Write access to SMI_LOCK itself is disabled too.
> 
> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

Reviewed-by: Michael S. Tsirkin <mst@redhat.com>

> ---
>  hw/acpi/ich9.c         |  4 +++-
>  hw/isa/lpc_ich9.c      | 19 +++++++++++++++++++
>  include/hw/acpi/ich9.h |  1 +
>  include/hw/i386/ich9.h |  6 ++++++
>  4 files changed, 29 insertions(+), 1 deletion(-)
> 
> diff --git a/hw/acpi/ich9.c b/hw/acpi/ich9.c
> index 84e5bb8..ec0e008 100644
> --- a/hw/acpi/ich9.c
> +++ b/hw/acpi/ich9.c
> @@ -94,7 +94,8 @@ static void ich9_smi_writel(void *opaque, hwaddr addr, uint64_t val,
>      ICH9LPCPMRegs *pm = opaque;
>      switch (addr) {
>      case 0:
> -        pm->smi_en = val;
> +        pm->smi_en &= ~pm->smi_en_wmask;
> +        pm->smi_en |= (val & pm->smi_en_wmask);
>          break;
>      }
>  }
> @@ -198,6 +199,7 @@ static void pm_reset(void *opaque)
>           * support SMM mode. */
>          pm->smi_en |= ICH9_PMIO_SMI_EN_APMC_EN;
>      }
> +    pm->smi_en_wmask = ~0;
>  
>      acpi_update_sci(&pm->acpi_regs, pm->irq);
>  }
> diff --git a/hw/isa/lpc_ich9.c b/hw/isa/lpc_ich9.c
> index dba7585..0269cfe 100644
> --- a/hw/isa/lpc_ich9.c
> +++ b/hw/isa/lpc_ich9.c
> @@ -410,12 +410,28 @@ static void ich9_lpc_rcba_update(ICH9LPCState *lpc, uint32_t rbca_old)
>      }
>  }
>  
> +/* config:GEN_PMCON* */
> +static void
> +ich9_lpc_pmcon_update(ICH9LPCState *lpc)
> +{
> +    uint16_t gen_pmcon_1 = pci_get_word(lpc->d.config + ICH9_LPC_GEN_PMCON_1);
> +    uint16_t wmask;
> +
> +    if (gen_pmcon_1 & ICH9_LPC_GEN_PMCON_1_SMI_LOCK) {
> +        wmask = pci_get_word(lpc->d.wmask + ICH9_LPC_GEN_PMCON_1);
> +        wmask &= ~ICH9_LPC_GEN_PMCON_1_SMI_LOCK;
> +        pci_set_word(lpc->d.wmask + ICH9_LPC_GEN_PMCON_1, wmask);
> +        lpc->pm.smi_en_wmask &= ~1;
> +    }
> +}
> +
>  static int ich9_lpc_post_load(void *opaque, int version_id)
>  {
>      ICH9LPCState *lpc = opaque;
>  
>      ich9_lpc_pmbase_update(lpc);
>      ich9_lpc_rcba_update(lpc, 0 /* disabled ICH9_LPC_RBCA_EN */);
> +    ich9_lpc_pmcon_update(lpc);
>      return 0;
>  }
>  
> @@ -438,6 +454,9 @@ static void ich9_lpc_config_write(PCIDevice *d,
>      if (ranges_overlap(addr, len, ICH9_LPC_PIRQE_ROUT, 4)) {
>          pci_bus_fire_intx_routing_notifier(lpc->d.bus);
>      }
> +    if (ranges_overlap(addr, len, ICH9_LPC_GEN_PMCON_1, 8)) {
> +        ich9_lpc_pmcon_update(lpc);
> +    }
>  }
>  
>  static void ich9_lpc_reset(DeviceState *qdev)
> diff --git a/include/hw/acpi/ich9.h b/include/hw/acpi/ich9.h
> index c2d3dba..77cc65c 100644
> --- a/include/hw/acpi/ich9.h
> +++ b/include/hw/acpi/ich9.h
> @@ -39,6 +39,7 @@ typedef struct ICH9LPCPMRegs {
>      MemoryRegion io_smi;
>  
>      uint32_t smi_en;
> +    uint32_t smi_en_wmask;
>      uint32_t smi_sts;
>  
>      qemu_irq irq;      /* SCI */
> diff --git a/include/hw/i386/ich9.h b/include/hw/i386/ich9.h
> index f4e522c..a2cc15c 100644
> --- a/include/hw/i386/ich9.h
> +++ b/include/hw/i386/ich9.h
> @@ -152,6 +152,12 @@ Object *ich9_lpc_find(void);
>  #define ICH9_LPC_PIRQ_ROUT_MASK                 Q35_MASK(8, 3, 0)
>  #define ICH9_LPC_PIRQ_ROUT_DEFAULT              0x80
>  
> +#define ICH9_LPC_GEN_PMCON_1                    0xa0
> +#define ICH9_LPC_GEN_PMCON_1_SMI_LOCK           (1 << 4)
> +#define ICH9_LPC_GEN_PMCON_2                    0xa2
> +#define ICH9_LPC_GEN_PMCON_3                    0xa4
> +#define ICH9_LPC_GEN_PMCON_LOCK                 0xa6
> +
>  #define ICH9_LPC_RCBA                           0xf0
>  #define ICH9_LPC_RCBA_BA_MASK                   Q35_MASK(32, 31, 14)
>  #define ICH9_LPC_RCBA_EN                        0x1
> -- 
> 2.4.1

^ permalink raw reply	[flat|nested] 49+ messages in thread

* Re: [Qemu-devel] [PATCH v2 00/23] SMM improvements (chipset and TCG parts)
  2015-06-03 17:08 [Qemu-devel] [PATCH v2 00/23] SMM improvements (chipset and TCG parts) Paolo Bonzini
                   ` (23 preceding siblings ...)
  2015-06-03 17:41 ` [Qemu-devel] [PATCH v2 00/23] SMM improvements (chipset and TCG parts) Laszlo Ersek
@ 2015-06-04 12:54 ` Michael S. Tsirkin
  24 siblings, 0 replies; 49+ messages in thread
From: Michael S. Tsirkin @ 2015-06-04 12:54 UTC (permalink / raw)
  To: Paolo Bonzini; +Cc: lersek, qemu-devel, kraxel

On Wed, Jun 03, 2015 at 07:08:25PM +0200, Paolo Bonzini wrote:
> These are the patches that I would like to send a pull request
> as soon as possible.  KVM support still needs to wait for the
> kernel code to be committed.
> 
> I asked Michael to let me send a pull request for this instead
> of going through the PC tree; this is to let him take a final
> look at the patches.
> 
> Paolo

For the PC bits:
Acked-by: Michael S. Tsirkin <mst@redhat.com>


> Gerd Hoffmann (6):
>   q35: fix ESMRAMC default
>   q35: add config space wmask for SMRAM and ESMRAMC
>   q35: implement SMRAM.D_LCK
>   q35: add test for SMRAM.D_LCK
>   q35: implement TSEG
>   ich9: implement SMI_LOCK
> 
> Paolo Bonzini (17):
>   target-i386: introduce cpu_get_mem_attrs
>   target-i386: Use correct memory attributes for memory accesses
>   target-i386: Use correct memory attributes for ioport accesses
>   target-i386: mask NMIs on entry to SMM
>   target-i386: set G=1 in SMM big real mode selectors
>   target-i386: wake up processors that receive an SMI
>   pflash_cfi01: change big-endian property to BIT type
>   pflash_cfi01: change to new-style MMIO accessors
>   pflash_cfi01: add secure property
>   vl: allow full-blown QemuOpts syntax for -global
>   qom: add object_property_add_const_link
>   vl: run "late" notifiers immediately
>   target-i386: create a separate AddressSpace for each CPU
>   hw/i386: add a separate region that tracks the SMRAME bit
>   target-i386: use memory API to implement SMRAM
>   hw/i386: remove smram_update
>   q35: implement high SMRAM
> 
>  bsd-user/main.c           |   4 -
>  hw/acpi/ich9.c            |   4 +-
>  hw/block/pflash_cfi01.c   | 204 +++++++++++-----------------
>  hw/i386/pc.c              |  21 ---
>  hw/isa/lpc_ich9.c         |  19 +++
>  hw/pci-host/pam.c         |  20 ---
>  hw/pci-host/piix.c        |  44 +++---
>  hw/pci-host/q35.c         | 142 +++++++++++++++++---
>  include/exec/memattrs.h   |   4 +-
>  include/hw/acpi/ich9.h    |   1 +
>  include/hw/i386/ich9.h    |   6 +
>  include/hw/i386/pc.h      |   1 -
>  include/hw/pci-host/pam.h |   4 -
>  include/hw/pci-host/q35.h |  36 +++--
>  include/qom/object.h      |  18 +++
>  linux-user/main.c         |   4 -
>  qdev-monitor.c            |  18 ++-
>  qemu-options.hx           |   7 +-
>  qom/object.c              |  16 +++
>  target-i386/Makefile.objs |   2 -
>  target-i386/cpu-qom.h     |   3 +
>  target-i386/cpu.c         |  47 ++++++-
>  target-i386/cpu.h         |  40 ++++--
>  target-i386/helper.c      | 135 ++++++++++++++++---
>  target-i386/helper.h      |  12 +-
>  target-i386/ioport-user.c |  60 ---------
>  target-i386/kvm.c         |   2 +-
>  target-i386/machine.c     |   3 +
>  target-i386/misc_helper.c |  59 ++++++--
>  target-i386/seg_helper.c  |  12 +-
>  target-i386/smm_helper.c  | 333 ++++++++++++++++++++++++----------------------
>  target-i386/svm_helper.c  | 230 ++++++++++++++++----------------
>  target-i386/translate.c   |  12 +-
>  tests/Makefile            |   3 +
>  tests/q35-test.c          |  91 +++++++++++++
>  vl.c                      |   6 +
>  36 files changed, 989 insertions(+), 634 deletions(-)
>  delete mode 100644 target-i386/ioport-user.c
>  create mode 100644 tests/q35-test.c
> 
> -- 
> 2.4.1

^ permalink raw reply	[flat|nested] 49+ messages in thread

* Re: [Qemu-devel] [PATCH v2 08/23] pflash_cfi01: change to new-style MMIO accessors
  2015-06-04  8:02     ` Paolo Bonzini
  2015-06-04 12:51       ` Laszlo Ersek
@ 2015-06-09 18:08       ` Richard Henderson
  2015-06-09 18:47         ` Michael S. Tsirkin
  2015-06-17  7:56         ` Paolo Bonzini
  1 sibling, 2 replies; 49+ messages in thread
From: Richard Henderson @ 2015-06-09 18:08 UTC (permalink / raw)
  To: Paolo Bonzini, Peter Crosthwaite
  Cc: Gerd Hoffmann, Laszlo Ersek, qemu-devel@nongnu.org Developers,
	Michael S. Tsirkin

On 06/04/2015 01:02 AM, Paolo Bonzini wrote:
> 
> 
> On 04/06/2015 08:19, Peter Crosthwaite wrote:
>> On Wed, Jun 3, 2015 at 10:08 AM, Paolo Bonzini <pbonzini@redhat.com> wrote:
>>> This is a required step to implement read_with_attrs and write_with_attrs.
>>>
>>> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
>>> ---
>>>  hw/block/pflash_cfi01.c | 96 ++++++-------------------------------------------
>>
>> Nice stats.
>>
>>>  1 file changed, 10 insertions(+), 86 deletions(-)
>>>
>>> diff --git a/hw/block/pflash_cfi01.c b/hw/block/pflash_cfi01.c
>>> index 7507a15..0b3667a 100644
>>> --- a/hw/block/pflash_cfi01.c
>>> +++ b/hw/block/pflash_cfi01.c
>>> @@ -650,101 +650,25 @@ static void pflash_write(pflash_t *pfl, hwaddr offset,
>>>  }
>>>
>>>
>>> -static uint32_t pflash_readb_be(void *opaque, hwaddr addr)
>>> -{
>>> -    return pflash_read(opaque, addr, 1, 1);
>>> -}
>>> -
>>> -static uint32_t pflash_readb_le(void *opaque, hwaddr addr)
>>> -{
>>> -    return pflash_read(opaque, addr, 1, 0);
>>> -}
>>> -
>>> -static uint32_t pflash_readw_be(void *opaque, hwaddr addr)
>>> +static uint64_t pflash_mem_read(void *opaque, hwaddr addr, unsigned len)
>>>  {
>>>      pflash_t *pfl = opaque;
>>> +    bool be = !!(pfl->features & (1 << PFLASH_BE));
>>
>> !!() not needed. Otherwise
> 
> I don't like magic bool-ification...

I don't like !! just as much.  If you don't like implicit conversion, then use
!= 0.

> Is there a coding style item that
> forbids this idiom in bool assignments?

No.  Indeed, nothing in coding style about bool at all.


r~

^ permalink raw reply	[flat|nested] 49+ messages in thread

* Re: [Qemu-devel] [PATCH v2 08/23] pflash_cfi01: change to new-style MMIO accessors
  2015-06-09 18:08       ` Richard Henderson
@ 2015-06-09 18:47         ` Michael S. Tsirkin
  2015-06-17  7:56         ` Paolo Bonzini
  1 sibling, 0 replies; 49+ messages in thread
From: Michael S. Tsirkin @ 2015-06-09 18:47 UTC (permalink / raw)
  To: Richard Henderson
  Cc: Paolo Bonzini, Peter Crosthwaite, Laszlo Ersek,
	qemu-devel@nongnu.org Developers, Gerd Hoffmann

On Tue, Jun 09, 2015 at 11:08:31AM -0700, Richard Henderson wrote:
> On 06/04/2015 01:02 AM, Paolo Bonzini wrote:
> > 
> > 
> > On 04/06/2015 08:19, Peter Crosthwaite wrote:
> >> On Wed, Jun 3, 2015 at 10:08 AM, Paolo Bonzini <pbonzini@redhat.com> wrote:
> >>> This is a required step to implement read_with_attrs and write_with_attrs.
> >>>
> >>> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
> >>> ---
> >>>  hw/block/pflash_cfi01.c | 96 ++++++-------------------------------------------
> >>
> >> Nice stats.
> >>
> >>>  1 file changed, 10 insertions(+), 86 deletions(-)
> >>>
> >>> diff --git a/hw/block/pflash_cfi01.c b/hw/block/pflash_cfi01.c
> >>> index 7507a15..0b3667a 100644
> >>> --- a/hw/block/pflash_cfi01.c
> >>> +++ b/hw/block/pflash_cfi01.c
> >>> @@ -650,101 +650,25 @@ static void pflash_write(pflash_t *pfl, hwaddr offset,
> >>>  }
> >>>
> >>>
> >>> -static uint32_t pflash_readb_be(void *opaque, hwaddr addr)
> >>> -{
> >>> -    return pflash_read(opaque, addr, 1, 1);
> >>> -}
> >>> -
> >>> -static uint32_t pflash_readb_le(void *opaque, hwaddr addr)
> >>> -{
> >>> -    return pflash_read(opaque, addr, 1, 0);
> >>> -}
> >>> -
> >>> -static uint32_t pflash_readw_be(void *opaque, hwaddr addr)
> >>> +static uint64_t pflash_mem_read(void *opaque, hwaddr addr, unsigned len)
> >>>  {
> >>>      pflash_t *pfl = opaque;
> >>> +    bool be = !!(pfl->features & (1 << PFLASH_BE));
> >>
> >> !!() not needed. Otherwise
> > 
> > I don't like magic bool-ification...
> 
> I don't like !! just as much.  If you don't like implicit conversion, then use
> != 0.
> > Is there a coding style item that
> > forbids this idiom in bool assignments?
> 
> No.  Indeed, nothing in coding style about bool at all.
> 
> 
> r~

Looks like it's a matter of taste.
FWIW I like !! or implicit conversions, and dislike != 0 as too verbose :)

-- 
MST

^ permalink raw reply	[flat|nested] 49+ messages in thread

* Re: [Qemu-devel] [PATCH v2 08/23] pflash_cfi01: change to new-style MMIO accessors
  2015-06-09 18:08       ` Richard Henderson
  2015-06-09 18:47         ` Michael S. Tsirkin
@ 2015-06-17  7:56         ` Paolo Bonzini
  2015-06-17  8:22           ` Markus Armbruster
  1 sibling, 1 reply; 49+ messages in thread
From: Paolo Bonzini @ 2015-06-17  7:56 UTC (permalink / raw)
  To: Richard Henderson, Peter Crosthwaite
  Cc: Gerd Hoffmann, Laszlo Ersek, qemu-devel@nongnu.org Developers,
	Michael S. Tsirkin



On 09/06/2015 20:08, Richard Henderson wrote:
> > > +    bool be = !!(pfl->features & (1 << PFLASH_BE));
> > >
> > > !!() not needed. Otherwise
> > 
> > I don't like magic bool-ification...
> 
> I don't like !! just as much.  If you don't like implicit conversion, then use
> != 0.

Fair enough, let's add to the coding still that we don't like !!.

Paolo

^ permalink raw reply	[flat|nested] 49+ messages in thread

* Re: [Qemu-devel] [PATCH v2 08/23] pflash_cfi01: change to new-style MMIO accessors
  2015-06-17  7:56         ` Paolo Bonzini
@ 2015-06-17  8:22           ` Markus Armbruster
  0 siblings, 0 replies; 49+ messages in thread
From: Markus Armbruster @ 2015-06-17  8:22 UTC (permalink / raw)
  To: Paolo Bonzini
  Cc: Peter Crosthwaite, Michael S. Tsirkin,
	qemu-devel@nongnu.org Developers, Gerd Hoffmann, Laszlo Ersek,
	Richard Henderson

Paolo Bonzini <pbonzini@redhat.com> writes:

> On 09/06/2015 20:08, Richard Henderson wrote:
>> > > +    bool be = !!(pfl->features & (1 << PFLASH_BE));
>> > >
>> > > !!() not needed. Otherwise
>> > 
>> > I don't like magic bool-ification...
>> 
>> I don't like !! just as much.  If you don't like implicit conversion, then use
>> != 0.
>
> Fair enough, let's add to the coding still that we don't like !!.

$ git-grep '!!' | wc -l
369
$ git-grep -l '!!' | wc -l
170

Adding arbitrary rules to CODING_STYLE is one thing, adding rules that
are widely violated in existing code and not flagged by checkpatch.pl is
quite another.

^ permalink raw reply	[flat|nested] 49+ messages in thread

end of thread, other threads:[~2015-06-17  8:23 UTC | newest]

Thread overview: 49+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2015-06-03 17:08 [Qemu-devel] [PATCH v2 00/23] SMM improvements (chipset and TCG parts) Paolo Bonzini
2015-06-03 17:08 ` [Qemu-devel] [PATCH v2 01/23] target-i386: introduce cpu_get_mem_attrs Paolo Bonzini
2015-06-03 17:08 ` [Qemu-devel] [PATCH v2 02/23] target-i386: Use correct memory attributes for memory accesses Paolo Bonzini
2015-06-03 17:08 ` [Qemu-devel] [PATCH v2 03/23] target-i386: Use correct memory attributes for ioport accesses Paolo Bonzini
2015-06-03 17:08 ` [Qemu-devel] [PATCH v2 04/23] target-i386: mask NMIs on entry to SMM Paolo Bonzini
2015-06-03 17:08 ` [Qemu-devel] [PATCH v2 05/23] target-i386: set G=1 in SMM big real mode selectors Paolo Bonzini
2015-06-03 17:08 ` [Qemu-devel] [PATCH v2 06/23] target-i386: wake up processors that receive an SMI Paolo Bonzini
2015-06-03 17:08 ` [Qemu-devel] [PATCH v2 07/23] pflash_cfi01: change big-endian property to BIT type Paolo Bonzini
2015-06-03 17:08 ` [Qemu-devel] [PATCH v2 08/23] pflash_cfi01: change to new-style MMIO accessors Paolo Bonzini
2015-06-04  6:19   ` Peter Crosthwaite
2015-06-04  8:02     ` Paolo Bonzini
2015-06-04 12:51       ` Laszlo Ersek
2015-06-09 18:08       ` Richard Henderson
2015-06-09 18:47         ` Michael S. Tsirkin
2015-06-17  7:56         ` Paolo Bonzini
2015-06-17  8:22           ` Markus Armbruster
2015-06-03 17:08 ` [Qemu-devel] [PATCH v2 09/23] pflash_cfi01: add secure property Paolo Bonzini
2015-06-03 17:08 ` [Qemu-devel] [PATCH v2 10/23] vl: allow full-blown QemuOpts syntax for -global Paolo Bonzini
2015-06-03 17:08 ` [Qemu-devel] [PATCH v2 11/23] qom: add object_property_add_const_link Paolo Bonzini
2015-06-04  6:33   ` Peter Crosthwaite
2015-06-03 17:08 ` [Qemu-devel] [PATCH v2 12/23] vl: run "late" notifiers immediately Paolo Bonzini
2015-06-04  6:39   ` Peter Crosthwaite
2015-06-04  8:03     ` Paolo Bonzini
2015-06-03 17:08 ` [Qemu-devel] [PATCH v2 13/23] target-i386: create a separate AddressSpace for each CPU Paolo Bonzini
2015-06-03 17:58   ` Peter Crosthwaite
2015-06-04  8:02     ` Paolo Bonzini
2015-06-04 12:48       ` Laszlo Ersek
2015-06-03 17:08 ` [Qemu-devel] [PATCH v2 14/23] hw/i386: add a separate region that tracks the SMRAME bit Paolo Bonzini
2015-06-03 17:08 ` [Qemu-devel] [PATCH v2 15/23] target-i386: use memory API to implement SMRAM Paolo Bonzini
2015-06-04  7:19   ` Peter Crosthwaite
2015-06-04  8:05     ` Paolo Bonzini
2015-06-03 17:08 ` [Qemu-devel] [PATCH v2 16/23] hw/i386: remove smram_update Paolo Bonzini
2015-06-03 17:08 ` [Qemu-devel] [PATCH v2 17/23] q35: implement high SMRAM Paolo Bonzini
2015-06-04 12:50   ` Michael S. Tsirkin
2015-06-03 17:08 ` [Qemu-devel] [PATCH v2 18/23] q35: fix ESMRAMC default Paolo Bonzini
2015-06-04 12:51   ` Michael S. Tsirkin
2015-06-03 17:08 ` [Qemu-devel] [PATCH v2 19/23] q35: add config space wmask for SMRAM and ESMRAMC Paolo Bonzini
2015-06-04 12:51   ` Michael S. Tsirkin
2015-06-03 17:08 ` [Qemu-devel] [PATCH v2 20/23] q35: implement SMRAM.D_LCK Paolo Bonzini
2015-06-04 12:51   ` Michael S. Tsirkin
2015-06-03 17:08 ` [Qemu-devel] [PATCH v2 21/23] q35: add test for SMRAM.D_LCK Paolo Bonzini
2015-06-04 12:52   ` Michael S. Tsirkin
2015-06-03 17:08 ` [Qemu-devel] [PATCH v2 22/23] q35: implement TSEG Paolo Bonzini
2015-06-04 12:53   ` Michael S. Tsirkin
2015-06-03 17:08 ` [Qemu-devel] [PATCH v2 23/23] ich9: implement SMI_LOCK Paolo Bonzini
2015-06-04 12:53   ` Michael S. Tsirkin
2015-06-03 17:41 ` [Qemu-devel] [PATCH v2 00/23] SMM improvements (chipset and TCG parts) Laszlo Ersek
2015-06-03 17:44   ` Paolo Bonzini
2015-06-04 12:54 ` Michael S. Tsirkin

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.