[Qemu-devel] [PATCH RFC 0/4] Mac OS 9 compatibility improvements

[Qemu-devel] [PATCH RFC 0/4] Mac OS 9 compatibility improvements

[Cormac O'Brien]

This patchset greatly improves QEMU's ability to run Mac OS 9 on the mac99
machine, allowing progress past the bootloader and partial progress through
the load screen.

Signed-off-by: Cormac O'Brien <cormac@c-obrien.org>
---
Alexander Graf (3):
  PPC: Allow Rc bit to be set on mtspr
  PPC: Fix lsxw bounds checks
  PPC: mac99: Always add USB controller

Cormac O'Brien (1):
  PPC: fix CUDA packet header size

 hw/input/adb.c          |  2 +-
 hw/misc/macio/cuda.c    | 54 ++++++++++++++++++++++++++++---------------------
 hw/ppc/mac_newworld.c   |  3 ++-
 target-ppc/mem_helper.c |  5 +++--
 target-ppc/translate.c  |  2 +-
 5 files changed, 38 insertions(+), 28 deletions(-)

-- 
2.5.0

[Qemu-devel] [PATCH 1/4] PPC: Allow Rc bit to be set on mtspr

[Cormac O'Brien]

From: Alexander Graf <agraf@suse.de>

According to the ISA setting the Rc bit on mtspr is undefined behavior.
Real 750 hardware simply ignores the bit and doesn't touch cr0 though.

Unfortunately, Mac OS 9 relies on this fact and executes a few mtspr
instructions (to set XER for example) with Rc set.

So let's handle the bit the same way hardware does and ignore it.

Signed-off-by: Alexander Graf <agraf@suse.de>
---
 target-ppc/translate.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target-ppc/translate.c b/target-ppc/translate.c
index 84c5cea..fc3251e 100644
--- a/target-ppc/translate.c
+++ b/target-ppc/translate.c
@@ -9884,7 +9884,7 @@ GEN_HANDLER(mtcrf, 0x1F, 0x10, 0x04, 0x00000801, PPC_MISC),
 GEN_HANDLER(mtmsrd, 0x1F, 0x12, 0x05, 0x001EF801, PPC_64B),
 #endif
 GEN_HANDLER(mtmsr, 0x1F, 0x12, 0x04, 0x001FF801, PPC_MISC),
-GEN_HANDLER(mtspr, 0x1F, 0x13, 0x0E, 0x00000001, PPC_MISC),
+GEN_HANDLER(mtspr, 0x1F, 0x13, 0x0E, 0x00000000, PPC_MISC),
 GEN_HANDLER(dcbf, 0x1F, 0x16, 0x02, 0x03C00001, PPC_CACHE),
 GEN_HANDLER(dcbi, 0x1F, 0x16, 0x0E, 0x03E00001, PPC_CACHE),
 GEN_HANDLER(dcbst, 0x1F, 0x16, 0x01, 0x03E00001, PPC_CACHE),
-- 
2.5.0

[Qemu-devel] [PATCH 2/4] PPC: Fix lsxw bounds checks

[Cormac O'Brien]

From: Alexander Graf <agraf@suse.de>

The lsxw instruction checks whether the desired string actually fits
into all defined registers. Unfortunately it does the calculation wrong,
resulting in illegal instruction traps for loads that really should fit.

Fix it up, making Mac OS happier.

Signed-off-by: Alexander Graf <agraf@suse.de>
---
 target-ppc/mem_helper.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/target-ppc/mem_helper.c b/target-ppc/mem_helper.c
index 6d37dae..7e1f234 100644
--- a/target-ppc/mem_helper.c
+++ b/target-ppc/mem_helper.c
@@ -100,8 +100,9 @@ void helper_lswx(CPUPPCState *env, target_ulong addr, uint32_t reg,
                  uint32_t ra, uint32_t rb)
 {
     if (likely(xer_bc != 0)) {
-        if (unlikely((ra != 0 && reg < ra && (reg + xer_bc) > ra) ||
-                     (reg < rb && (reg + xer_bc) > rb))) {
+        int num_used_regs = (xer_bc + 3) / 4;
+        if (unlikely((ra != 0 && reg < ra && (reg + num_used_regs) > ra) ||
+                     (reg < rb && (reg + num_used_regs) > rb))) {
             helper_raise_exception_err(env, POWERPC_EXCP_PROGRAM,
                                        POWERPC_EXCP_INVAL |
                                        POWERPC_EXCP_INVAL_LSWX);
-- 
2.5.0

[Qemu-devel] [PATCH 3/4] PPC: mac99: Always add USB controller

[Cormac O'Brien]

From: Alexander Graf <agraf@suse.de>

The mac99 machines always have a USB controller. Usually not having one around
doesn't hurt quite as much, but Mac OS 9 really really wants one or it crashes
on bootup.

So always add OHCI to make it happy.

Signed-off-by: Alexander Graf <agraf@suse.de>
---
 hw/ppc/mac_newworld.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/hw/ppc/mac_newworld.c b/hw/ppc/mac_newworld.c
index 77d5c81..7f3b703 100644
--- a/hw/ppc/mac_newworld.c
+++ b/hw/ppc/mac_newworld.c
@@ -371,12 +371,13 @@ static void ppc_core99_init(MachineState *machine)
         /* 970 gets a U3 bus */
         pci_bus = pci_pmac_u3_init(pic, get_system_memory(), get_system_io());
         machine_arch = ARCH_MAC99_U3;
-        machine->usb |= defaults_enabled() && !machine->usb_disabled;
     } else {
         pci_bus = pci_pmac_init(pic, get_system_memory(), get_system_io());
         machine_arch = ARCH_MAC99;
     }
 
+    machine->usb |= defaults_enabled() && !machine->usb_disabled;
+
     /* Timebase Frequency */
     if (kvm_enabled()) {
         tbfreq = kvmppc_get_tbfreq();
-- 
2.5.0

[Qemu-devel] [PATCH RFC 4/4] PPC: fix CUDA packet header size

[Cormac O'Brien]

Change the CUDA packet model to use a three-byte header as in real hardware.
Also add handlers for CUDA_COMBINED_FORMAT_IIC and CUDA_GET_SET_IIC.

Signed-off-by: Cormac O'Brien <cormac@c-obrien.org>
---
 hw/input/adb.c       |  2 +-
 hw/misc/macio/cuda.c | 54 ++++++++++++++++++++++++++++++----------------------
 2 files changed, 32 insertions(+), 24 deletions(-)

diff --git a/hw/input/adb.c b/hw/input/adb.c
index a18eea2..4834234 100644
--- a/hw/input/adb.c
+++ b/hw/input/adb.c
@@ -84,7 +84,7 @@ int adb_request(ADBBusState *s, uint8_t *obuf, const uint8_t *buf, int len)
             return adc->devreq(d, obuf, buf, len);
         }
     }
-    return ADB_RET_NOTPRESENT;
+    return 0; //ADB_RET_NOTPRESENT;
 }
 
 /* XXX: move that to cuda ? */
diff --git a/hw/misc/macio/cuda.c b/hw/misc/macio/cuda.c
index f3984e3..753b5f3 100644
--- a/hw/misc/macio/cuda.c
+++ b/hw/misc/macio/cuda.c
@@ -480,7 +480,7 @@ static void cuda_adb_poll(void *opaque)
 static void cuda_receive_packet(CUDAState *s,
                                 const uint8_t *data, int len)
 {
-    uint8_t obuf[16];
+    uint8_t obuf[16] = { CUDA_PACKET, 0, data[0] };
     int autopoll;
     uint32_t ti;
 
@@ -497,23 +497,16 @@ static void cuda_receive_packet(CUDAState *s,
                 timer_del(s->adb_poll_timer);
             }
         }
-        obuf[0] = CUDA_PACKET;
-        obuf[1] = data[1];
-        cuda_send_packet_to_host(s, obuf, 2);
+        //obuf[1] = data[1];
+        cuda_send_packet_to_host(s, obuf, 3);
         break;
     case CUDA_SET_TIME:
         ti = (((uint32_t)data[1]) << 24) + (((uint32_t)data[2]) << 16) + (((uint32_t)data[3]) << 8) + data[4];
         s->tick_offset = ti - (qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) / get_ticks_per_sec());
-        obuf[0] = CUDA_PACKET;
-        obuf[1] = 0;
-        obuf[2] = 0;
         cuda_send_packet_to_host(s, obuf, 3);
         break;
     case CUDA_GET_TIME:
         ti = s->tick_offset + (qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) / get_ticks_per_sec());
-        obuf[0] = CUDA_PACKET;
-        obuf[1] = 0;
-        obuf[2] = 0;
         obuf[3] = ti >> 24;
         obuf[4] = ti >> 16;
         obuf[5] = ti >> 8;
@@ -524,23 +517,36 @@ static void cuda_receive_packet(CUDAState *s,
     case CUDA_SET_DEVICE_LIST:
     case CUDA_SET_AUTO_RATE:
     case CUDA_SET_POWER_MESSAGES:
-        obuf[0] = CUDA_PACKET;
-        obuf[1] = 0;
-        cuda_send_packet_to_host(s, obuf, 2);
+        cuda_send_packet_to_host(s, obuf, 3);
         break;
     case CUDA_POWERDOWN:
-        obuf[0] = CUDA_PACKET;
-        obuf[1] = 0;
-        cuda_send_packet_to_host(s, obuf, 2);
+        cuda_send_packet_to_host(s, obuf, 3);
         qemu_system_shutdown_request();
         break;
     case CUDA_RESET_SYSTEM:
-        obuf[0] = CUDA_PACKET;
-        obuf[1] = 0;
-        cuda_send_packet_to_host(s, obuf, 2);
+        cuda_send_packet_to_host(s, obuf, 3);
         qemu_system_reset_request();
         break;
+    case CUDA_COMBINED_FORMAT_IIC:
+        obuf[0] = ERROR_PACKET;
+        obuf[1] = 0x5;
+        obuf[2] = CUDA_PACKET;
+        obuf[3] = data[0];
+        cuda_send_packet_to_host(s, obuf, 4);
+        break;
+    case CUDA_GET_SET_IIC:
+        if (len == 4) {
+            cuda_send_packet_to_host(s, obuf, 3);
+        } else {
+            obuf[0] = ERROR_PACKET;
+            obuf[1] = 0x2;
+            obuf[2] = CUDA_PACKET;
+            obuf[3] = data[0];
+            cuda_send_packet_to_host(s, obuf, 4);
+        }
+        break;
     default:
+        cuda_send_packet_to_host(s, obuf, 3);
         break;
     }
 }
@@ -560,19 +566,21 @@ static void cuda_receive_packet_from_host(CUDAState *s,
     switch(data[0]) {
     case ADB_PACKET:
         {
-            uint8_t obuf[ADB_MAX_OUT_LEN + 2];
+            uint8_t obuf[ADB_MAX_OUT_LEN + 3];
             int olen;
-            olen = adb_request(&s->adb_bus, obuf + 2, data + 1, len - 1);
-            if (olen > 0) {
+            olen = adb_request(&s->adb_bus, obuf + 3, data + 1, len - 1);
+            if (olen >= 0) {
                 obuf[0] = ADB_PACKET;
                 obuf[1] = 0x00;
+                obuf[2] = data[1];
             } else {
                 /* error */
                 obuf[0] = ADB_PACKET;
                 obuf[1] = -olen;
+                obuf[2] = data[1];
                 olen = 0;
             }
-            cuda_send_packet_to_host(s, obuf, olen + 2);
+            cuda_send_packet_to_host(s, obuf, olen + 3);
         }
         break;
     case CUDA_PACKET:
-- 
2.5.0

Re: [Qemu-devel] [PATCH RFC 0/4] Mac OS 9 compatibility improvements

[Mark Cave-Ayland]

On 22/08/15 16:32, Cormac O'Brien wrote:

> This patchset greatly improves QEMU's ability to run Mac OS 9 on the mac99
> machine, allowing progress past the bootloader and partial progress through
> the load screen.
> 
> Signed-off-by: Cormac O'Brien <cormac@c-obrien.org>
> ---
> Alexander Graf (3):
>   PPC: Allow Rc bit to be set on mtspr
>   PPC: Fix lsxw bounds checks
>   PPC: mac99: Always add USB controller
> 
> Cormac O'Brien (1):
>   PPC: fix CUDA packet header size
> 
>  hw/input/adb.c          |  2 +-
>  hw/misc/macio/cuda.c    | 54 ++++++++++++++++++++++++++++---------------------
>  hw/ppc/mac_newworld.c   |  3 ++-
>  target-ppc/mem_helper.c |  5 +++--
>  target-ppc/translate.c  |  2 +-
>  5 files changed, 38 insertions(+), 28 deletions(-)

Hi Cormac,

I can confirm here that in combination with an updated OpenBIOS then the
patchset gets qemu-system-ppc -M mac99 to the OS 9 loading screen, which
is great progress!

When booting OS 9 with this patchset I do see the following output on
the console:

Trying to write invalid spr 0 (0x000) at 00f113c0
Trying to read invalid spr 0 (0x000) at 00f113c8
Trying to write privileged spr 955 (0x3bb) at 00f164b8
Trying to write invalid spr 959 (0x3bf) at 00f16520
Trying to read invalid spr 959 (0x3bf) at 00f16528
Trying to write privileged spr 955 (0x3bb) at 00f164b8
Trying to write invalid spr 959 (0x3bf) at 00f16520
Trying to read invalid spr 959 (0x3bf) at 00f16528

I suspect that this could be similar to commit 1ca448b in that OS 9 is
trying to read/write undefined bits, but someone with more PPC knowledge
should be able to confirm whether or not this is harmless or whether an
additional patch is required.


ATB,

Mark.

Re: [Qemu-devel] [PATCH RFC 4/4] PPC: fix CUDA packet header size

[Mark Cave-Ayland]

On 22/08/15 16:32, Cormac O'Brien wrote:

> Change the CUDA packet model to use a three-byte header as in real hardware.
> Also add handlers for CUDA_COMBINED_FORMAT_IIC and CUDA_GET_SET_IIC.

I think it would make sense to split this patch into 2 - one for the
CUDA packet changes, and another to add the *_IIC handlers.

> Signed-off-by: Cormac O'Brien <cormac@c-obrien.org>
> ---
>  hw/input/adb.c       |  2 +-
>  hw/misc/macio/cuda.c | 54 ++++++++++++++++++++++++++++++----------------------
>  2 files changed, 32 insertions(+), 24 deletions(-)
> 
> diff --git a/hw/input/adb.c b/hw/input/adb.c
> index a18eea2..4834234 100644
> --- a/hw/input/adb.c
> +++ b/hw/input/adb.c
> @@ -84,7 +84,7 @@ int adb_request(ADBBusState *s, uint8_t *obuf, const uint8_t *buf, int len)
>              return adc->devreq(d, obuf, buf, len);
>          }
>      }
> -    return ADB_RET_NOTPRESENT;
> +    return 0; //ADB_RET_NOTPRESENT;

Does this need another constant defined rather than just using 0?

>  }
>  
>  /* XXX: move that to cuda ? */
> diff --git a/hw/misc/macio/cuda.c b/hw/misc/macio/cuda.c
> index f3984e3..753b5f3 100644
> --- a/hw/misc/macio/cuda.c
> +++ b/hw/misc/macio/cuda.c
> @@ -480,7 +480,7 @@ static void cuda_adb_poll(void *opaque)
>  static void cuda_receive_packet(CUDAState *s,
>                                  const uint8_t *data, int len)
>  {
> -    uint8_t obuf[16];
> +    uint8_t obuf[16] = { CUDA_PACKET, 0, data[0] };
>      int autopoll;
>      uint32_t ti;
>  
> @@ -497,23 +497,16 @@ static void cuda_receive_packet(CUDAState *s,
>                  timer_del(s->adb_poll_timer);
>              }
>          }
> -        obuf[0] = CUDA_PACKET;
> -        obuf[1] = data[1];
> -        cuda_send_packet_to_host(s, obuf, 2);
> +        //obuf[1] = data[1];
> +        cuda_send_packet_to_host(s, obuf, 3);
>          break;
>      case CUDA_SET_TIME:
>          ti = (((uint32_t)data[1]) << 24) + (((uint32_t)data[2]) << 16) + (((uint32_t)data[3]) << 8) + data[4];
>          s->tick_offset = ti - (qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) / get_ticks_per_sec());
> -        obuf[0] = CUDA_PACKET;
> -        obuf[1] = 0;
> -        obuf[2] = 0;
>          cuda_send_packet_to_host(s, obuf, 3);
>          break;
>      case CUDA_GET_TIME:
>          ti = s->tick_offset + (qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) / get_ticks_per_sec());
> -        obuf[0] = CUDA_PACKET;
> -        obuf[1] = 0;
> -        obuf[2] = 0;
>          obuf[3] = ti >> 24;
>          obuf[4] = ti >> 16;
>          obuf[5] = ti >> 8;
> @@ -524,23 +517,36 @@ static void cuda_receive_packet(CUDAState *s,
>      case CUDA_SET_DEVICE_LIST:
>      case CUDA_SET_AUTO_RATE:
>      case CUDA_SET_POWER_MESSAGES:
> -        obuf[0] = CUDA_PACKET;
> -        obuf[1] = 0;
> -        cuda_send_packet_to_host(s, obuf, 2);
> +        cuda_send_packet_to_host(s, obuf, 3);
>          break;
>      case CUDA_POWERDOWN:
> -        obuf[0] = CUDA_PACKET;
> -        obuf[1] = 0;
> -        cuda_send_packet_to_host(s, obuf, 2);
> +        cuda_send_packet_to_host(s, obuf, 3);
>          qemu_system_shutdown_request();
>          break;
>      case CUDA_RESET_SYSTEM:
> -        obuf[0] = CUDA_PACKET;
> -        obuf[1] = 0;
> -        cuda_send_packet_to_host(s, obuf, 2);
> +        cuda_send_packet_to_host(s, obuf, 3);
>          qemu_system_reset_request();
>          break;
> +    case CUDA_COMBINED_FORMAT_IIC:
> +        obuf[0] = ERROR_PACKET;
> +        obuf[1] = 0x5;
> +        obuf[2] = CUDA_PACKET;
> +        obuf[3] = data[0];
> +        cuda_send_packet_to_host(s, obuf, 4);
> +        break;
> +    case CUDA_GET_SET_IIC:
> +        if (len == 4) {
> +            cuda_send_packet_to_host(s, obuf, 3);
> +        } else {
> +            obuf[0] = ERROR_PACKET;
> +            obuf[1] = 0x2;
> +            obuf[2] = CUDA_PACKET;
> +            obuf[3] = data[0];
> +            cuda_send_packet_to_host(s, obuf, 4);
> +        }
> +        break;
>      default:
> +        cuda_send_packet_to_host(s, obuf, 3);
>          break;
>      }
>  }
> @@ -560,19 +566,21 @@ static void cuda_receive_packet_from_host(CUDAState *s,
>      switch(data[0]) {
>      case ADB_PACKET:
>          {
> -            uint8_t obuf[ADB_MAX_OUT_LEN + 2];
> +            uint8_t obuf[ADB_MAX_OUT_LEN + 3];
>              int olen;
> -            olen = adb_request(&s->adb_bus, obuf + 2, data + 1, len - 1);
> -            if (olen > 0) {
> +            olen = adb_request(&s->adb_bus, obuf + 3, data + 1, len - 1);
> +            if (olen >= 0) {
>                  obuf[0] = ADB_PACKET;
>                  obuf[1] = 0x00;
> +                obuf[2] = data[1];
>              } else {
>                  /* error */
>                  obuf[0] = ADB_PACKET;
>                  obuf[1] = -olen;
> +                obuf[2] = data[1];
>                  olen = 0;
>              }
> -            cuda_send_packet_to_host(s, obuf, olen + 2);
> +            cuda_send_packet_to_host(s, obuf, olen + 3);
>          }
>          break;
>      case CUDA_PACKET:
> 

With some further testing, it seems that this breaks darwinppc-602.iso
and OS X 10.2 on -M g3beige causing it to panic somewhere in the
AppleCuda module. I think splitting the patch as mentioned above would
help narrow down whether its the CUDA packet or the *_IIC changes in
particular which cause the issue.

Note that the source code for the AppleCuda module can be found at
http://www.opensource.apple.com/source/AppleCuda/AppleCuda-100.0.3/
which should further help too.


ATB,

Mark.

Re: [Qemu-devel] [PATCH RFC 0/4] Mac OS 9 compatibility improvements

[Alexander Graf]

On 22.08.15 08:32, Cormac O'Brien wrote:
> This patchset greatly improves QEMU's ability to run Mac OS 9 on the mac99
> machine, allowing progress past the bootloader and partial progress through
> the load screen.
> 
> Signed-off-by: Cormac O'Brien <cormac@c-obrien.org>

You don't need to SoB your cover letter ;).

Thanks, applied patches 1-3 to ppc-next.


Alex

Re: [Qemu-devel] [PATCH RFC 0/4] Mac OS 9 compatibility improvements

[Alexander Graf]

On 22.08.15 08:32, Cormac O'Brien wrote:
> This patchset greatly improves QEMU's ability to run Mac OS 9 on the mac99
> machine, allowing progress past the bootloader and partial progress through
> the load screen.
> 
> Signed-off-by: Cormac O'Brien <cormac@c-obrien.org>

Sorry, I just realized that you didn't put your own SoB on the patches.
I've removed them from my queue again.

Please resend with your SoB after my initial SoB. Every patch that goes
through your hands needs to be signed off by you :).


Alex

Re: [Qemu-devel] [Qemu-ppc] [PATCH RFC 0/4] Mac OS 9 compatibility improvements

[Stewart Smith]

Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> writes:
> I can confirm here that in combination with an updated OpenBIOS then the
> patchset gets qemu-system-ppc -M mac99 to the OS 9 loading screen, which
> is great progress!
>
> When booting OS 9 with this patchset I do see the following output on
> the console:
>
> Trying to write invalid spr 0 (0x000) at 00f113c0
> Trying to read invalid spr 0 (0x000) at 00f113c8
> Trying to write privileged spr 955 (0x3bb) at 00f164b8
> Trying to write invalid spr 959 (0x3bf) at 00f16520
> Trying to read invalid spr 959 (0x3bf) at 00f16528
> Trying to write privileged spr 955 (0x3bb) at 00f164b8
> Trying to write invalid spr 959 (0x3bf) at 00f16520
> Trying to read invalid spr 959 (0x3bf) at 00f16528

>From http://www.freescale.com/files/32bit/doc/data_sheet/MPC604.pdf it
looks like the 955 and 959 are SPRs for the Performance Monitor,
specifically SDA and SIA, Sampled Data/Instructian Address.

Some more info:
http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=528812
and probably around some processor manuals.