[Qemu-devel] [PATCH 0/2] Add pc-testdev to qemu v4

[Qemu-devel] [PATCH 0/2] Add pc-testdev to qemu v4

[Lucas Meneghel Rodrigues]

These two patches introduce:

 1) A ISA debugexit port device, that when written, causes qemu
    to exit with the exit code passed as parameter.
 2) A port of the existing testdev present on qemu-kvm to qemu

I took Gerd's recent patch and modified it to include the access-size
property, as well as fixed problems pointed in previous reviews of
the test device itself.

I did notice that with the new test device, a lot of the
kvm-unit-tests are failing. The same tests are passing fine
under qemu-kvm, meaning there are some bugs we need to address.

Example:

qemu-kvm:

$ x86_64-softmmu/qemu-system-x86_64 -device testdev -serial stdio -kernel /path/to/kvm/unittests/pcid.flat
VNC server running on `127.0.0.1:5900'
enabling apic
CPUID consistency: PASS
Test on PCID when disabled: PASS
Test on INVPCID when disabled: PASS
3 tests, 0 failures
$ echo $?
0

qemu:

$ x86_64-softmmu/qemu-system-x86_64 -device pc-testdev -serial stdio -device isa-debugexit,iobase=0xf4,access-size=4 -kernel /path/to/kvm/unittests/pcid.flat
VNC server running on `127.0.0.1:5900'
enabling apic
CPUID consistency: PASS
Test on PCID when disabled: FAIL
Test on INVPCID when disabled: PASS
3 tests, 1 failures
$ echo $?
3

Gerd Hoffmann (1):
  add isa-debug-exit device

Lucas Meneghel Rodrigues (1):
  hw: Add test device for unittests execution v5

 hw/debugexit.c        |   73 +++++++++++++++++++++++
 hw/i386/Makefile.objs |    3 +-
 hw/pc-testdev.c       |  156 +++++++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 231 insertions(+), 1 deletion(-)
 create mode 100644 hw/debugexit.c
 create mode 100644 hw/pc-testdev.c

-- 
1.7.10.4

[Qemu-devel] [PATCH 1/2] add isa-debug-exit device

[Lucas Meneghel Rodrigues]

From: Gerd Hoffmann <kraxel@redhat.com>

When present it makes qemu exit on any write.
Mapped to port 0x501 by default.

Without this patch Anthony doesn't allow me to
remove the bochs bios debug ports because his
test suite uses this.

Changes from v1: Add access_size property to the
device, needed for kvm-unit-tests.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
---
 hw/debugexit.c        |   73 +++++++++++++++++++++
 hw/i386/Makefile.objs |    2 +-
 hw/pc-testdev.c       |  167 +++++++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 241 insertions(+), 1 deletion(-)
 create mode 100644 hw/debugexit.c
 create mode 100644 hw/pc-testdev.c

diff --git a/hw/debugexit.c b/hw/debugexit.c
new file mode 100644
index 0000000..dfe1b2d
--- /dev/null
+++ b/hw/debugexit.c
@@ -0,0 +1,73 @@
+/*
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 or
+ * (at your option) version 3 of the License.
+ */
+
+#include "hw.h"
+#include "isa.h"
+
+#define TYPE_ISA_DEBUG_EXIT_DEVICE "isa-debug-exit"
+#define ISA_DEBUG_EXIT_DEVICE(obj) \
+     OBJECT_CHECK(ISADebugExitState, (obj), TYPE_ISA_DEBUG_EXIT_DEVICE)
+
+typedef struct ISADebugExitState {
+    ISADevice parent_obj;
+
+    uint32_t iobase;
+    uint8_t access_size;
+    MemoryRegion io;
+} ISADebugExitState;
+
+static void debug_exit_write(void *opaque, hwaddr addr, uint64_t val,
+                             unsigned width)
+{
+    exit((val << 1) | 1);
+}
+
+static const MemoryRegionOps debug_exit_ops = {
+    .write = debug_exit_write,
+    .valid.min_access_size = 1,
+    .valid.max_access_size = 1,
+    .endianness = DEVICE_LITTLE_ENDIAN,
+};
+
+static int debug_exit_initfn(ISADevice *dev)
+{
+    ISADebugExitState *isa = ISA_DEBUG_EXIT_DEVICE(dev);
+
+    memory_region_init_io(&isa->io, &debug_exit_ops, isa,
+                          TYPE_ISA_DEBUG_EXIT_DEVICE, isa->access_size);
+    memory_region_add_subregion(isa_address_space_io(dev),
+                                isa->iobase, &isa->io);
+    return 0;
+}
+
+static Property debug_exit_properties[] = {
+    DEFINE_PROP_HEX32("iobase", ISADebugExitState, iobase, 0x501),
+    DEFINE_PROP_UINT8("access-size", ISADebugExitState, access_size, 1),
+    DEFINE_PROP_END_OF_LIST(),
+};
+
+static void debug_exit_class_initfn(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    ISADeviceClass *ic = ISA_DEVICE_CLASS(klass);
+    ic->init = debug_exit_initfn;
+    dc->props = debug_exit_properties;
+}
+
+static TypeInfo debug_exit_info = {
+    .name          = TYPE_ISA_DEBUG_EXIT_DEVICE,
+    .parent        = TYPE_ISA_DEVICE,
+    .instance_size = sizeof(ISADebugExitState),
+    .class_init    = debug_exit_class_initfn,
+};
+
+static void debug_exit_register_types(void)
+{
+    type_register_static(&debug_exit_info);
+}
+
+type_init(debug_exit_register_types)
diff --git a/hw/i386/Makefile.objs b/hw/i386/Makefile.objs
index 0d3f6a8..56aaa9d 100644
--- a/hw/i386/Makefile.objs
+++ b/hw/i386/Makefile.objs
@@ -3,7 +3,7 @@ obj-y += apic_common.o apic.o kvmvapic.o
 obj-y += sga.o ioapic_common.o ioapic.o piix_pci.o
 obj-y += vmport.o
 obj-y += pci-hotplug.o smbios.o wdt_ib700.o
-obj-y += debugcon.o multiboot.o
+obj-y += debugcon.o debugexit.o multiboot.o
 obj-y += pc_piix.o
 obj-y += pc_sysfw.o
 obj-y += lpc_ich9.o q35.o pc_q35.o
diff --git a/hw/pc-testdev.c b/hw/pc-testdev.c
new file mode 100644
index 0000000..b652956
--- /dev/null
+++ b/hw/pc-testdev.c
@@ -0,0 +1,167 @@
+/*
+ * QEMU x86 ISA testdev
+ *
+ * Copyright (c) 2012 Avi Kivity, Gerd Hoffmann, Marcelo Tosatti
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+/*
+ * This device is used to test KVM features specific to the x86 port, such
+ * as emulation, power management, interrupt routing, among others. It's meant
+ * to be used like:
+ *
+ * qemu-system-x86_64 -device pc-testdev -serial stdio \
+ * -device isa-debugexit,iobase=0xf4,access-size=2 \
+ * -kernel /home/lmr/Code/virt-test.git/kvm/unittests/msr.flat
+ *
+ * Where msr.flat is one of the KVM unittests, present on a separate repo,
+ * git://git.kernel.org/pub/scm/virt/kvm/kvm-unit-tests.git
+*/
+
+#include <sys/mman.h>
+#include "hw.h"
+#include "qdev.h"
+#include "isa.h"
+#include "exec-memory.h"
+
+typedef struct PCTestdev {
+    ISADevice dev;
+    MemoryRegion iomem;
+    uint32_t ioport_data;
+} PCTestdev;
+
+#define TYPE_TESTDEV "pc-testdev"
+#define TESTDEV(obj) \
+     OBJECT_CHECK(struct PCTestdev, (obj), TYPE_TESTDEV)
+
+static void test_device_irq_line(void *opaque, uint32_t addr, uint32_t data)
+{
+    struct PCTestdev *dev = opaque;
+    qemu_set_irq(isa_get_irq(&dev->dev, addr - 0x2000), !!data);
+}
+
+static void test_device_ioport_write(void *opaque, uint32_t addr, uint32_t data)
+{
+    struct PCTestdev *dev = opaque;
+    dev->ioport_data = data;
+}
+
+static uint32_t test_device_ioport_read(void *opaque, uint32_t addr)
+{
+    struct PCTestdev *dev = opaque;
+    return dev->ioport_data;
+}
+
+static void test_device_flush_page(void *opaque, uint32_t addr, uint32_t data)
+{
+    hwaddr len = 4096;
+    void *a = cpu_physical_memory_map(data & ~0xffful, &len, 0);
+
+    mprotect(a, 4096, PROT_NONE);
+    mprotect(a, 4096, PROT_READ|PROT_WRITE);
+    cpu_physical_memory_unmap(a, len, 0, 0);
+}
+
+static char *iomem_buf;
+
+static uint32_t test_iomem_readb(void *opaque, hwaddr addr)
+{
+    return iomem_buf[addr];
+}
+
+static uint32_t test_iomem_readw(void *opaque, hwaddr addr)
+{
+    return *(uint16_t*)(iomem_buf + addr);
+}
+
+static uint32_t test_iomem_readl(void *opaque, hwaddr addr)
+{
+    return *(uint32_t*)(iomem_buf + addr);
+}
+
+static void test_iomem_writeb(void *opaque, hwaddr addr, uint32_t val)
+{
+    iomem_buf[addr] = val;
+}
+
+static void test_iomem_writew(void *opaque, hwaddr addr, uint32_t val)
+{
+    *(uint16_t*)(iomem_buf + addr) = val;
+}
+
+static void test_iomem_writel(void *opaque, hwaddr addr, uint32_t val)
+{
+    *(uint32_t*)(iomem_buf + addr) = val;
+}
+
+static const MemoryRegionOps test_iomem_ops = {
+    .old_mmio = {
+        .read = { test_iomem_readb, test_iomem_readw, test_iomem_readl, },
+        .write = { test_iomem_writeb, test_iomem_writew, test_iomem_writel, },
+    },
+    .endianness = DEVICE_LITTLE_ENDIAN,
+};
+
+static const MemoryRegionPortio test_dev_portio_list[] = {
+    { 0xe0, 1, 1, .read = test_device_ioport_read, .write = test_device_ioport_write, },
+    { 0xe0, 1, 2, .read = test_device_ioport_read, .write = test_device_ioport_write, },
+    { 0xe0, 1, 4, .read = test_device_ioport_read, .write = test_device_ioport_write, },
+    { 0xe4, 1, 4, .write = test_device_flush_page, },
+    { 0x2000, 24, 1, .write = test_device_irq_line, },
+    PORTIO_END_OF_LIST(),
+};
+
+static int init_test_device(ISADevice *isa)
+{
+    struct PCTestdev *dev = DO_UPCAST(struct PCTestdev, dev, isa);
+
+    PortioList *test_dev_port_list = g_new(PortioList, 1);
+    portio_list_init(test_dev_port_list, test_dev_portio_list,
+                     NULL, "pc-testdev");
+    portio_list_add(test_dev_port_list, get_system_io(), 0x0);
+
+    iomem_buf = g_malloc0(0x10000);
+    memory_region_init_io(&dev->iomem, &test_iomem_ops, dev,
+                          "pc-testdev", 0x10000);
+    memory_region_add_subregion(isa_address_space(&dev->dev), 0xff000000,
+                                                  &dev->iomem);
+    return 0;
+}
+
+static void testdev_class_init(ObjectClass *klass, void *data)
+{
+    ISADeviceClass *k = ISA_DEVICE_CLASS(klass);
+
+    k->init = init_test_device;
+}
+
+static TypeInfo testdev_info = {
+    .name           = "pc-testdev",
+    .parent         = TYPE_ISA_DEVICE,
+    .instance_size  = sizeof(struct PCTestdev),
+    .class_init     = testdev_class_init,
+};
+
+static void testdev_register_types(void)
+{
+    type_register_static(&testdev_info);
+}
+
+type_init(testdev_register_types)
-- 
1.7.10.4

Re: [Qemu-devel] [PATCH 1/2] add isa-debug-exit device

[Gerd Hoffmann]

  Hi,

>  hw/pc-testdev.c       |  167 +++++++++++++++++++++++++++++++++++++++++++++++++

That should have been in patch 2/2 I guess?

cheers,
  Gerd

Re: [Qemu-devel] [PATCH 1/2] add isa-debug-exit device

[Lucas Meneghel]

On 12/13/2012 12:28 PM, Gerd Hoffmann wrote:
>    Hi,
>
>>   hw/pc-testdev.c       |  167 +++++++++++++++++++++++++++++++++++++++++++++++++
>
> That should have been in patch 2/2 I guess?

Oops, rebase error :( Will re-spin and re-send.

Thanks!

> cheers,
>    Gerd
>

[Qemu-devel] [PATCH 2/2] hw: Add test device for unittests execution v5

[Lucas Meneghel Rodrigues]

Add a test device which supports the kvmctl ioports,
so one can run the KVM unittest suite.

Intended Usage:

qemu-system-x86_64\
-device pc-testdev -serial stdio \
-device isa-debugexit,iobase=0xf4,access-size=4 \
-kernel /path/to/kvm/unittests/msr.flat

Where msr.flat is one of the KVM unittests, present on a
separate repo,

git://git.kernel.org/pub/scm/virt/kvm/kvm-unit-tests.git

Changes from v4:
* Pass iomem_buf as an opaque, as requested by Blue
* Ported to new MMIO schema, as requested by Jan

Changes from v3:
* Ported all register_ioport functions to memory API

Changes from v2:

* Rename struct testdev to PCTestdev
* Embed ioport_data into PCTestdev struct
* Porting most register_ioport functions to memory API

Changes from v1:

* Removed unused testdev member
* Renamed device to a less generic name, pc-testdev

Initial changes from initial attempt:

* Removed port 0xf1, since now kvm-unit-tests use
  serial
* Removed exit code port 0xf4, since that can be
  replaced by

-device isa-debugexit,iobase=0xf4,access-size=4

* Removed ram size port 0xd1, since guest memory
  size can be retrieved from firmware, there's a
  patch for kvm-unit-tests including an API to
  retrieve that value.

CC: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Alexander Graf <agraf@suse.de>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
Signed-off-by: Lucas Meneghel Rodrigues <lmr@redhat.com>
---
 hw/i386/Makefile.objs |    1 +
 hw/pc-testdev.c       |   55 ++++++++++++++++++++-----------------------------
 2 files changed, 23 insertions(+), 33 deletions(-)

diff --git a/hw/i386/Makefile.objs b/hw/i386/Makefile.objs
index 56aaa9d..1ac5fc5 100644
--- a/hw/i386/Makefile.objs
+++ b/hw/i386/Makefile.objs
@@ -12,5 +12,6 @@ obj-$(CONFIG_XEN_PCI_PASSTHROUGH) += xen-host-pci-device.o
 obj-$(CONFIG_XEN_PCI_PASSTHROUGH) += xen_pt.o xen_pt_config_init.o xen_pt_msi.o
 obj-y += kvm/
 obj-$(CONFIG_SPICE) += qxl.o qxl-logger.o qxl-render.o
+obj-y += pc-testdev.o
 
 obj-y := $(addprefix ../,$(obj-y))
diff --git a/hw/pc-testdev.c b/hw/pc-testdev.c
index b652956..75889e7 100644
--- a/hw/pc-testdev.c
+++ b/hw/pc-testdev.c
@@ -41,10 +41,13 @@
 #include "isa.h"
 #include "exec-memory.h"
 
+#define IOMEM_LEN    0x10000
+
 typedef struct PCTestdev {
     ISADevice dev;
     MemoryRegion iomem;
     uint32_t ioport_data;
+    char iomem_buf[IOMEM_LEN];
 } PCTestdev;
 
 #define TYPE_TESTDEV "pc-testdev"
@@ -74,48 +77,35 @@ static void test_device_flush_page(void *opaque, uint32_t addr, uint32_t data)
     hwaddr len = 4096;
     void *a = cpu_physical_memory_map(data & ~0xffful, &len, 0);
 
-    mprotect(a, 4096, PROT_NONE);
-    mprotect(a, 4096, PROT_READ|PROT_WRITE);
+    /* We might not be able to get the full page, only mprotect what we actually
+       have mapped */
+    mprotect(a, len, PROT_NONE);
+    mprotect(a, len, PROT_READ|PROT_WRITE);
     cpu_physical_memory_unmap(a, len, 0, 0);
 }
 
-static char *iomem_buf;
-
-static uint32_t test_iomem_readb(void *opaque, hwaddr addr)
-{
-    return iomem_buf[addr];
-}
-
-static uint32_t test_iomem_readw(void *opaque, hwaddr addr)
-{
-    return *(uint16_t*)(iomem_buf + addr);
-}
-
-static uint32_t test_iomem_readl(void *opaque, hwaddr addr)
+static uint64_t test_iomem_read(void *opaque, hwaddr addr, unsigned len)
 {
-    return *(uint32_t*)(iomem_buf + addr);
-}
-
-static void test_iomem_writeb(void *opaque, hwaddr addr, uint32_t val)
-{
-    iomem_buf[addr] = val;
-}
+    struct PCTestdev *dev = opaque;
+    uint64_t ret = 0;
+    memcpy(&ret, &dev->iomem_buf[addr], len);
+    ret = le64_to_cpu(ret);
 
-static void test_iomem_writew(void *opaque, hwaddr addr, uint32_t val)
-{
-    *(uint16_t*)(iomem_buf + addr) = val;
+    return ret;
 }
 
-static void test_iomem_writel(void *opaque, hwaddr addr, uint32_t val)
+static void test_iomem_write(void *opaque, hwaddr addr, uint64_t val,
+                             unsigned len)
 {
-    *(uint32_t*)(iomem_buf + addr) = val;
+    struct PCTestdev *dev = opaque;
+    val = cpu_to_le64(val);
+    memcpy(&dev->iomem_buf[addr], &val, len);
+    dev->iomem_buf[addr] = val;
 }
 
 static const MemoryRegionOps test_iomem_ops = {
-    .old_mmio = {
-        .read = { test_iomem_readb, test_iomem_readw, test_iomem_readl, },
-        .write = { test_iomem_writeb, test_iomem_writew, test_iomem_writel, },
-    },
+    .read = test_iomem_read,
+    .write = test_iomem_write,
     .endianness = DEVICE_LITTLE_ENDIAN,
 };
 
@@ -137,9 +127,8 @@ static int init_test_device(ISADevice *isa)
                      NULL, "pc-testdev");
     portio_list_add(test_dev_port_list, get_system_io(), 0x0);
 
-    iomem_buf = g_malloc0(0x10000);
     memory_region_init_io(&dev->iomem, &test_iomem_ops, dev,
-                          "pc-testdev", 0x10000);
+                          "pc-testdev", IOMEM_LEN);
     memory_region_add_subregion(isa_address_space(&dev->dev), 0xff000000,
                                                   &dev->iomem);
     return 0;
-- 
1.7.10.4

[Qemu-devel] [PATCH 0/2] Add pc-testdev to qemu v4

[Lucas Meneghel Rodrigues]

These two patches introduce:

 1) A ISA debugexit port device, that when written, causes qemu
    to exit with the exit code passed as parameter.
 2) A port of the existing testdev present on qemu-kvm to qemu

I took Gerd's recent patch and modified it to include the access-size
property, as well as fixed problems pointed in previous reviews of
the test device itself.

I did notice that with the new test device, a lot of the
kvm-unit-tests are failing. The same tests are passing fine
under qemu-kvm, meaning there are some bugs we need to address.

Example:

qemu-kvm:

$ x86_64-softmmu/qemu-system-x86_64 -device testdev -serial stdio -kernel /path/to/kvm/unittests/pcid.flat
VNC server running on `127.0.0.1:5900'
enabling apic
CPUID consistency: PASS
Test on PCID when disabled: PASS
Test on INVPCID when disabled: PASS
3 tests, 0 failures
$ echo $?
0

qemu:

$ x86_64-softmmu/qemu-system-x86_64 -device pc-testdev -serial stdio -device isa-debugexit,iobase=0xf4,access-size=4 -kernel /path/to/kvm/unittests/pcid.flat
VNC server running on `127.0.0.1:5900'
enabling apic
CPUID consistency: PASS
Test on PCID when disabled: FAIL
Test on INVPCID when disabled: PASS
3 tests, 1 failures
$ echo $?
3

Gerd Hoffmann (1):
  add isa-debug-exit device

Lucas Meneghel Rodrigues (1):
  hw: Add test device for unittests execution v5

 hw/debugexit.c        |   73 +++++++++++++++++++++++
 hw/i386/Makefile.objs |    3 +-
 hw/pc-testdev.c       |  156 +++++++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 231 insertions(+), 1 deletion(-)
 create mode 100644 hw/debugexit.c
 create mode 100644 hw/pc-testdev.c

-- 
1.7.10.4

[Qemu-devel] [PATCH 1/2] add isa-debug-exit device

[Lucas Meneghel Rodrigues]

From: Gerd Hoffmann <kraxel@redhat.com>

When present it makes qemu exit on any write.
Mapped to port 0x501 by default.

Without this patch Anthony doesn't allow me to
remove the bochs bios debug ports because his
test suite uses this.

Changes from v1: Add access_size property to the
device, needed for kvm-unit-tests.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
---
 hw/debugexit.c        |   73 +++++++++++++++++++++
 hw/i386/Makefile.objs |    2 +-
 hw/pc-testdev.c       |  167 +++++++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 241 insertions(+), 1 deletion(-)
 create mode 100644 hw/debugexit.c
 create mode 100644 hw/pc-testdev.c

diff --git a/hw/debugexit.c b/hw/debugexit.c
new file mode 100644
index 0000000..dfe1b2d
--- /dev/null
+++ b/hw/debugexit.c
@@ -0,0 +1,73 @@
+/*
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 or
+ * (at your option) version 3 of the License.
+ */
+
+#include "hw.h"
+#include "isa.h"
+
+#define TYPE_ISA_DEBUG_EXIT_DEVICE "isa-debug-exit"
+#define ISA_DEBUG_EXIT_DEVICE(obj) \
+     OBJECT_CHECK(ISADebugExitState, (obj), TYPE_ISA_DEBUG_EXIT_DEVICE)
+
+typedef struct ISADebugExitState {
+    ISADevice parent_obj;
+
+    uint32_t iobase;
+    uint8_t access_size;
+    MemoryRegion io;
+} ISADebugExitState;
+
+static void debug_exit_write(void *opaque, hwaddr addr, uint64_t val,
+                             unsigned width)
+{
+    exit((val << 1) | 1);
+}
+
+static const MemoryRegionOps debug_exit_ops = {
+    .write = debug_exit_write,
+    .valid.min_access_size = 1,
+    .valid.max_access_size = 1,
+    .endianness = DEVICE_LITTLE_ENDIAN,
+};
+
+static int debug_exit_initfn(ISADevice *dev)
+{
+    ISADebugExitState *isa = ISA_DEBUG_EXIT_DEVICE(dev);
+
+    memory_region_init_io(&isa->io, &debug_exit_ops, isa,
+                          TYPE_ISA_DEBUG_EXIT_DEVICE, isa->access_size);
+    memory_region_add_subregion(isa_address_space_io(dev),
+                                isa->iobase, &isa->io);
+    return 0;
+}
+
+static Property debug_exit_properties[] = {
+    DEFINE_PROP_HEX32("iobase", ISADebugExitState, iobase, 0x501),
+    DEFINE_PROP_UINT8("access-size", ISADebugExitState, access_size, 1),
+    DEFINE_PROP_END_OF_LIST(),
+};
+
+static void debug_exit_class_initfn(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    ISADeviceClass *ic = ISA_DEVICE_CLASS(klass);
+    ic->init = debug_exit_initfn;
+    dc->props = debug_exit_properties;
+}
+
+static TypeInfo debug_exit_info = {
+    .name          = TYPE_ISA_DEBUG_EXIT_DEVICE,
+    .parent        = TYPE_ISA_DEVICE,
+    .instance_size = sizeof(ISADebugExitState),
+    .class_init    = debug_exit_class_initfn,
+};
+
+static void debug_exit_register_types(void)
+{
+    type_register_static(&debug_exit_info);
+}
+
+type_init(debug_exit_register_types)
diff --git a/hw/i386/Makefile.objs b/hw/i386/Makefile.objs
index 0d3f6a8..56aaa9d 100644
--- a/hw/i386/Makefile.objs
+++ b/hw/i386/Makefile.objs
@@ -3,7 +3,7 @@ obj-y += apic_common.o apic.o kvmvapic.o
 obj-y += sga.o ioapic_common.o ioapic.o piix_pci.o
 obj-y += vmport.o
 obj-y += pci-hotplug.o smbios.o wdt_ib700.o
-obj-y += debugcon.o multiboot.o
+obj-y += debugcon.o debugexit.o multiboot.o
 obj-y += pc_piix.o
 obj-y += pc_sysfw.o
 obj-y += lpc_ich9.o q35.o pc_q35.o
diff --git a/hw/pc-testdev.c b/hw/pc-testdev.c
new file mode 100644
index 0000000..b652956
--- /dev/null
+++ b/hw/pc-testdev.c
@@ -0,0 +1,167 @@
+/*
+ * QEMU x86 ISA testdev
+ *
+ * Copyright (c) 2012 Avi Kivity, Gerd Hoffmann, Marcelo Tosatti
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+/*
+ * This device is used to test KVM features specific to the x86 port, such
+ * as emulation, power management, interrupt routing, among others. It's meant
+ * to be used like:
+ *
+ * qemu-system-x86_64 -device pc-testdev -serial stdio \
+ * -device isa-debugexit,iobase=0xf4,access-size=2 \
+ * -kernel /home/lmr/Code/virt-test.git/kvm/unittests/msr.flat
+ *
+ * Where msr.flat is one of the KVM unittests, present on a separate repo,
+ * git://git.kernel.org/pub/scm/virt/kvm/kvm-unit-tests.git
+*/
+
+#include <sys/mman.h>
+#include "hw.h"
+#include "qdev.h"
+#include "isa.h"
+#include "exec-memory.h"
+
+typedef struct PCTestdev {
+    ISADevice dev;
+    MemoryRegion iomem;
+    uint32_t ioport_data;
+} PCTestdev;
+
+#define TYPE_TESTDEV "pc-testdev"
+#define TESTDEV(obj) \
+     OBJECT_CHECK(struct PCTestdev, (obj), TYPE_TESTDEV)
+
+static void test_device_irq_line(void *opaque, uint32_t addr, uint32_t data)
+{
+    struct PCTestdev *dev = opaque;
+    qemu_set_irq(isa_get_irq(&dev->dev, addr - 0x2000), !!data);
+}
+
+static void test_device_ioport_write(void *opaque, uint32_t addr, uint32_t data)
+{
+    struct PCTestdev *dev = opaque;
+    dev->ioport_data = data;
+}
+
+static uint32_t test_device_ioport_read(void *opaque, uint32_t addr)
+{
+    struct PCTestdev *dev = opaque;
+    return dev->ioport_data;
+}
+
+static void test_device_flush_page(void *opaque, uint32_t addr, uint32_t data)
+{
+    hwaddr len = 4096;
+    void *a = cpu_physical_memory_map(data & ~0xffful, &len, 0);
+
+    mprotect(a, 4096, PROT_NONE);
+    mprotect(a, 4096, PROT_READ|PROT_WRITE);
+    cpu_physical_memory_unmap(a, len, 0, 0);
+}
+
+static char *iomem_buf;
+
+static uint32_t test_iomem_readb(void *opaque, hwaddr addr)
+{
+    return iomem_buf[addr];
+}
+
+static uint32_t test_iomem_readw(void *opaque, hwaddr addr)
+{
+    return *(uint16_t*)(iomem_buf + addr);
+}
+
+static uint32_t test_iomem_readl(void *opaque, hwaddr addr)
+{
+    return *(uint32_t*)(iomem_buf + addr);
+}
+
+static void test_iomem_writeb(void *opaque, hwaddr addr, uint32_t val)
+{
+    iomem_buf[addr] = val;
+}
+
+static void test_iomem_writew(void *opaque, hwaddr addr, uint32_t val)
+{
+    *(uint16_t*)(iomem_buf + addr) = val;
+}
+
+static void test_iomem_writel(void *opaque, hwaddr addr, uint32_t val)
+{
+    *(uint32_t*)(iomem_buf + addr) = val;
+}
+
+static const MemoryRegionOps test_iomem_ops = {
+    .old_mmio = {
+        .read = { test_iomem_readb, test_iomem_readw, test_iomem_readl, },
+        .write = { test_iomem_writeb, test_iomem_writew, test_iomem_writel, },
+    },
+    .endianness = DEVICE_LITTLE_ENDIAN,
+};
+
+static const MemoryRegionPortio test_dev_portio_list[] = {
+    { 0xe0, 1, 1, .read = test_device_ioport_read, .write = test_device_ioport_write, },
+    { 0xe0, 1, 2, .read = test_device_ioport_read, .write = test_device_ioport_write, },
+    { 0xe0, 1, 4, .read = test_device_ioport_read, .write = test_device_ioport_write, },
+    { 0xe4, 1, 4, .write = test_device_flush_page, },
+    { 0x2000, 24, 1, .write = test_device_irq_line, },
+    PORTIO_END_OF_LIST(),
+};
+
+static int init_test_device(ISADevice *isa)
+{
+    struct PCTestdev *dev = DO_UPCAST(struct PCTestdev, dev, isa);
+
+    PortioList *test_dev_port_list = g_new(PortioList, 1);
+    portio_list_init(test_dev_port_list, test_dev_portio_list,
+                     NULL, "pc-testdev");
+    portio_list_add(test_dev_port_list, get_system_io(), 0x0);
+
+    iomem_buf = g_malloc0(0x10000);
+    memory_region_init_io(&dev->iomem, &test_iomem_ops, dev,
+                          "pc-testdev", 0x10000);
+    memory_region_add_subregion(isa_address_space(&dev->dev), 0xff000000,
+                                                  &dev->iomem);
+    return 0;
+}
+
+static void testdev_class_init(ObjectClass *klass, void *data)
+{
+    ISADeviceClass *k = ISA_DEVICE_CLASS(klass);
+
+    k->init = init_test_device;
+}
+
+static TypeInfo testdev_info = {
+    .name           = "pc-testdev",
+    .parent         = TYPE_ISA_DEVICE,
+    .instance_size  = sizeof(struct PCTestdev),
+    .class_init     = testdev_class_init,
+};
+
+static void testdev_register_types(void)
+{
+    type_register_static(&testdev_info);
+}
+
+type_init(testdev_register_types)
-- 
1.7.10.4