Commit graph

3058 commits

Author SHA1 Message Date
Richard Henderson 1c096b8fa2
target-i386: Fix inhibit irq mask handling
The patch in 7f0b714 was too simplistic, in that we wound up setting
the flag and then resetting it immediately in gen_eob.

Fixes the reported boot problem with Windows XP.

Backports commit f083d92c03e7a0741d2a9eba774a60d5a3ca772f from qemu
2018-02-21 21:24:50 -05:00
Richard Henderson c7d5d85979
target-i386: Use gen_nop_modrm for prefetch instructions
Backports commit 26317698ef3be5942c5ee5630997dbc98431c5f6 from qemu
2018-02-21 21:22:52 -05:00
Paolo Bonzini 55c2a21fe8
target-i386: Fix addr16 prefix
While ADDSEG will only be false in 16-bit mode for LEA, it can be
false even in other cases when 16-bit addresses are obtained via
the 67h prefix in 32-bit mode. In this case, gen_lea_v_seg forgets
to add a nonzero FS or GS base if CS/DS/ES/SS are all zero. This
case is pretty rare but happens when booting Windows 95/98, and
this patch fixes it.

The bug is visible since commit d6a291498, but it was introduced
together with gen_lea_v_seg and it probably could be reproduced
with a "addr16 gs movsb" instruction as early as in commit
ca2f29f555805d07fb0b9ebfbbfc4e3656530977.

Backports commit e2e02a820741ec4d96b8f313b06a2a7ed5e94fbd from qemu
2018-02-21 21:21:26 -05:00
Richard Henderson 085a3c9aab
target-i386: Fix SMSW for 64-bit mode
In non-64-bit modes, the instruction always stores 16 bits.
But in 64-bit mode, when the destination is a register, the
instruction can write 32 or 64 bits.

Backports commit a657f79e32422634415c09f3f15c73d610297af5 from qemu
2018-02-21 21:19:33 -05:00
Paolo Bonzini a233d7b13e
target-i386: Fix SMSW and LMSW from/to register
SMSW and LMSW accept register operands, but commit 1906b2a ("target-i386:
Rearrange processing of 0F 01", 2016-02-13) did not account for that.

Backports commit 880f8486503b32a29b653a3c0b3cfc5432012f38 from qemu
2018-02-21 21:17:45 -05:00
Paolo Bonzini bdf1189046
target-i386: Avoid repeated calls to the bnd_jmp helper
Two flags were tested the wrong way.

Backports commit 8b33e82b863d1c6fce7e69a41f6c96a8e15b73fb from qemu
2018-02-21 21:13:37 -05:00
Fam Zheng f7bff04b7b
exec: Introduce AddressSpaceDispatch.mru_section
Under heavy workloads the lookup will likely end up with the same
MemoryRegionSection from last time. Using a pointer to cache the result,
like ram_list.mru_block, significantly reduces cost of
address_space_translate.

During address space topology update, as->dispatch will be reallocated
so the pointer is invalidated automatically.

Perf reports a visible drop on the cpu usage, because phys_page_find is
not called. Before:

2.35% qemu-system-x86_64 [.] phys_page_find
0.97% qemu-system-x86_64 [.] address_space_translate_internal
0.95% qemu-system-x86_64 [.] address_space_translate
0.55% qemu-system-x86_64 [.] address_space_lookup_region

After:

0.97% qemu-system-x86_64 [.] address_space_translate_internal
0.97% qemu-system-x86_64 [.] address_space_lookup_region
0.84% qemu-system-x86_64 [.] address_space_translate

Backports commit 729633c2bc30496073431584eb6e304776b4ebd4 from qemu
2018-02-21 21:10:16 -05:00
Fam Zheng f642465dc4
exec: Factor out section_covers_addr
This will be shared by the next patch.

Also add a comment explaining the unobvious condition on "size.hi".

Backports commit 29cb533d8cbff1330717619780c2f1dfe764e003 from qemu
2018-02-21 21:08:08 -05:00
Daniel P. Berrange eddfb13c2c
qom: Change object property iterator API contract
Currently the ObjectProperty iterator API works as follows:

ObjectPropertyIterator *iter;

iter = object_property_iter_init(obj);
while ((prop = object_property_iter_next(iter))) {
...
}
object_property_iter_free(iter);

This has the benefit that the ObjectPropertyIterator struct
can be opaque, but has the downside that callers need to
explicitly call a free function. It is also not in keeping
with iterator style used elsewhere in QEMU/GLib2.

This patch changes the API to use stack allocation instead:

ObjectPropertyIterator iter;

object_property_iter_init(&iter, obj);
while ((prop = object_property_iter_next(&iter))) {
...
}

Backports commit 7746abd8e9ee9db20c0b0fdb19504f163ba3cbea from qemu
2018-02-21 21:03:58 -05:00
Daniel P. Berrange b97ab59f08
qom: Allow properties to be registered against classes
When there are many instances of a given class, registering
properties against the instance is wasteful of resources. The
majority of objects have a statically defined list of possible
properties, so most of the properties are easily registerable
against the class. Only those properties which are conditionally
registered at runtime need be recorded against the klass.

Registering properties against classes also makes it possible
to provide static introspection of QOM - currently introspection
is only possible after creating an instance of a class, which
severely limits its usefulness.

This impl only supports simple scalar properties. It does not
attempt to allow child object / link object properties against
the class. There are ways to support those too, but it would
make this patch more complicated, so it is left as an exercise
for the future.

There is no equivalent to object_property_del() provided, since
classes must be immutable once they are defined.

Backports commit 16bf7f522a2ff68993f80631ed86254c71eaf5d4 from qemu
2018-02-21 21:00:56 -05:00
Pavel Fedin 825bc2fb04
qom: Replace object property list with GHashTable
ARM GICv3 systems with large number of CPUs create lots of IRQ pins. Since
every pin is represented as a property, number of these properties becomes
very large. Every property add first makes sure there's no duplicates.
Traversing the list becomes very slow, therefore QEMU initialization takes
significant time (several seconds for e. g. 16 CPUs).

This patch replaces list with GHashTable, making lookup very fast. The only
drawback is that object_child_foreach() and object_child_foreach_recursive()
cannot add or remove properties during traversal, since GHashTableIter does
not have modify-safe version. However, the code seems not to modify objects
via these functions.

Backports commit b604a854e843505007c59d68112c654556102a20 from qemu
2018-02-21 13:35:10 -05:00
Lioncash 4b79ff71b4
glib_compat: backport hashtable iterator interfaces 2018-02-21 13:18:44 -05:00
Markus Armbruster 9bc51db79d
memory: Fix bad error handling in memory_region_init_ram_ptr()
Commit ef701d7 screwed up handling of out-of-memory conditions.
Before the commit, we report the error and exit(1), in one place.  The
commit lifts the error handling up the call chain some, to three
places.  Fine.  Except it uses &error_abort in these places, changing
the behavior from exit(1) to abort(), and thus undoing the work of
commit 3922825 "exec: Don't abort when we can't allocate guest
memory".

The previous two commits fixed one of the three places, another one
was fixed in commit 33e0eb5.  This commit fixes the third one.

Backports commit 0bdaa3a429c6d07cd437b442a1f15f70be1addaa from qemu
2018-02-21 11:24:38 -05:00
Pavel Fedin 0201c71145
Merge memory_region_init_reservation() into memory_region_init_io()
Just specifying ops = NULL in some cases can be more convenient than having
two functions.

Backports commit 6d6d2abf2c2e52c0f404d0a31a963e945b0cc7ad from qemu
2018-02-21 11:23:00 -05:00
Paolo Bonzini 7a1ce36785
memory: fix refcount leak in memory_region_present
memory_region_present() leaks a reference to a MemoryRegion in the
case "mr == container".  While fixing it, avoid reference counting
altogether for memory_region_present(), by using RCU only.

The return value could in principle be already invalid immediately
after memory_region_present returns, but presumably the caller knows
that and it's using memory_region_present to probe for devices that
are unpluggable, or something like that.  The RCU critical section
is needed anyway, because it protects as->current_map.

Backports commit c6742b14fe7352059cd4954a356a8105757af31b from qemu
2018-02-21 11:17:19 -05:00
Paolo Bonzini f9315cde1c
memory: do not add a reference to the owner of aliased regions
Very often the owner of the aliased region is the same as the owner of the alias
region itself.  When this happens, the reference count can never go back to 0 and
the owner is leaked.  This is for example breaking hot-unplug of virtio-pci
devices (the device cannot be plugged back again with the same id).

Another common use for alias is to transform the system I/O address space
into an MMIO regions; in this case the aliased region never dies, so there
is no problem.  Otherwise the owner is always the same for aliasing
and aliased region.

I checked all calls to memory_region_init_alias introduced after commit
dfde4e6 (memory: add ref/unref calls, 2013-05-06) and they do not need the
reference in order to keep the owner of the aliased region alive.

Backports commit 52c91dac6bd891656f297dab76da51fc8bc61309 from qemu
2018-02-21 11:10:49 -05:00
Lioncash 10bf76861b
exec: Remove unnecessary return in qemu_ram_remap 2018-02-21 09:51:23 -05:00
Fam Zheng fa7d3e6cdb
memory: Drop MemoryRegion.ram_addr
All references to mr->ram_addr are replaced by
memory_region_get_ram_addr(mr) (except for a few assertions that are
replaced with mr->ram_block).

Backports commit 8e41fb63c5bf29ecabe0cee1239bf6230f19978a from qemu
2018-02-21 08:53:08 -05:00
Fam Zheng 2c1a72635d
memory: Implement memory_region_get_ram_addr with mr->ram_block
Backports commit 7ebb2745acbb8d910eab07dc5f0aa01a4457703c from qemu
2018-02-21 08:53:08 -05:00
Fam Zheng 4b8c428494
memory: Move assignment to ram_block to memory_region_init_*
We don't force "const" qualifiers with pointers in QEMU, but it's still
good to keep a clean function interface. Assigning to mr->ram_block is
in this sense ugly - one initializer mutating its owning object's state.

Move it to memory_region_init_*, where mr->ram_addr is assigned.

Backports commit 0a75601853c00f3729fa62c49ec0d4bb1e3d9bc1 from qemu
2018-02-21 08:53:08 -05:00
Gonglei aa80edbef0
exec: Return RAMBlock pointer from allocating functions
Previously we return RAMBlock.offset; now return the pointer to the
whole structure.

ram_block_add returns void now, error is completely passed with errp.

Backports commit 528f46af6ecd1e300db18684969104d4067b867b from qemu
2018-02-21 08:52:57 -05:00
Ralf-Philipp Weinmann 893b9f7f96
target-arm: Only trap SRS from S-EL1 if specified mode is MON
Commit cbc0326b6fb9 caused SRS instructions executed from Secure
EL1 to trap to EL3 even if the specified mode was not monitor mode.

According to the ARMv8 Architecture reference manual [F6.1.203], ALL
of the following conditions need to be met for SRS to trap to EL3:
* It is executed at Secure PL1.
* The specified mode is monitor mode.
* EL3 is using AArch64.

Correct the condition governing the trap to EL3 to check the
specified mode.

Backports commit ba63cf47a93041137a94e86b7d0cd87fc896949b from qemu
2018-02-21 02:49:28 -05:00
Paolo Bonzini 7f23f7004d
target-arm: implement BE32 mode in system emulation
System emulation only has a little-endian target; BE32 mode
is implemented by adjusting the low bits of the address
for every byte and halfword load and store. 64-bit accesses
flip the low and high words.

Backports commit e334bd3190f6c4ca12f1d40d316dc471c70009ab from qemu
2018-02-21 02:47:22 -05:00
Paolo Bonzini aa5be4d6ca
target-arm: implement setend
Since this is not a high-performance path, just use a helper to
flip the E bit and force a lookup in the hash table since the
flags have changed.

Backports commit 9886ecdf31165de2d4b8bccc1a220bd6ac8bc192 from qemu
2018-02-21 02:39:13 -05:00
Peter Crosthwaite 902170741a
target-arm: introduce tbflag for endianness
Introduce a tbflags for endianness, set based upon the CPUs current
endianness. This in turn propagates through to the disas endianness
flag.

Backports commit 91cca2cda9823b1e7a049cb308a05104b5076cba from qemu
2018-02-21 02:35:34 -05:00
Peter Crosthwaite 50a3c7f2ee
target-arm: a64: Add endianness support
Set the dc->mo_endianness flag for AA64 and use it in all ldst ops.

Backports commit aa6489da4e297fb3ffcbc09b50afd700395b6386 from qemu
2018-02-21 02:31:50 -05:00
Paolo Bonzini 9ab3d105fd
target-arm: introduce disas flag for endianness
Introduce a disas flag for setting the CPU data endianness. This allows
control of the endianness from the CPU state rather than hard-coding it
to TARGET_WORDS_BIGENDIAN.

Backports commit dacf0a2ff7d39ab12bd90f2f5496a3889facd54a from qemu
2018-02-21 02:20:50 -05:00
Peter Crosthwaite e5cfcc3221
target-arm: implement SCTLR.EE
Implement SCTLR.EE bit which controls data endianess for exceptions
and page table translations. SCTLR.EE is mirrored to the CPSR.E bit
on exception entry.

Backports commit 73462dddf670c32c45c8ea359658092b0365b2d4 from qemu
2018-02-21 02:14:56 -05:00
Peter Crosthwaite 38f4a833a4
arm: cpu: handle BE32 user-mode as BE
endian with address manipulations on subword accesses (to give the
illusion of BE). But user-mode cannot tell the difference and is
already implemented as straight BE. So handle the difference in the
endianess query, where USER mode is BE and system is not.

Backports commit b2e62d9a7b9a2eb10e451a57813bad168376e122 from qemu
2018-02-21 02:12:39 -05:00
Peter Crosthwaite 1457b73a13
target-arm: cpu: Move cpu_is_big_endian to header
There is a CPU data endianness test that is used to drive the
virtio_big_endian test.

Move this up to the header so it can be more generally used for endian
tests. The KVM specific cpu_syncronize_state call is left behind in the
virtio specific function.

Rename it arm_cpu-data_is_big_endian() to more accurately capture that
this is for data accesses only.

Backports commit ed50ff7875d61a75517c92deb0444d73fbbca878 from qemu
2018-02-21 02:10:48 -05:00
Paolo Bonzini ec15ee10d0
target-arm: implement SCTLR.B, drop bswap_code
bswap_code is a CPU property of sorts ("is the iside endianness the
opposite way round to TARGET_WORDS_BIGENDIAN?") but it is not the
actual CPU state involved here which is SCTLR.B (set for BE32
binaries, clear for BE8).

Replace bswap_code with SCTLR.B, and pass that to arm_ld*_code.
The next patches will make data fetches honor both SCTLR.B and
CPSR.E appropriately.

Backports commit f9fd40ebe4f55e0048e002925b8d65e66d56e7a7 from qemu
2018-02-21 02:08:05 -05:00
Peter Maydell 64a9bec68a
target-arm: Correct handling of writes to CPSR mode bits from gdb in usermode
In helper.c the expression
(env->uncached_cpsr & CPSR_M) != CPSR_USER
is always true; the right hand side was supposed to be ARM_CPU_MODE_USR
(an error in commit cb01d391).

Since the incorrect expression was always true, this just meant that
commit cb01d391 had no effect.

However simply changing the RHS here would reveal a logic error: if
the mode is USR we wish to completely ignore the attempt to set the
mode bits, which means that we must clear the CPSR_M bits from mask
to avoid the uncached_cpsr bits being updated at the end of the
function.

Move the condition into the correct place in the code, fix its RHS
constant, and add a comment about the fact that we must be doing a
gdbstub write if we're in user mode.

Backports commit 8c4f0eb94cc65ee32a12feba88d0b32e3665d5ea from qemu
2018-02-21 01:57:34 -05:00
Lluís Vilanova d111e2df2d
typedefs: Add CPUState
Backports commit b23197f9cf2f221a6cc6272d36852f4f70cf9c1b from qemu
2018-02-21 01:55:22 -05:00
Lioncash 1c04024688
tcg: Make cpu_regs_sparc a TCGv array 2018-02-21 01:50:28 -05:00
Lioncash db114261e3
target-sparc: Cleanup casts and unnessecary alloc/dealloc 2018-02-21 01:44:51 -05:00
Lioncash c0210ac8a6
tcg: Make cpu_wim a TCGv 2018-02-21 01:41:53 -05:00
Lioncash 58c5a28893
tcg: Make cpu_ver a TCGv 2018-02-21 01:40:30 -05:00
Lioncash 2beea0db0d
tcg: Make cpu_ssr a TCGv 2018-02-21 01:39:15 -05:00
Lioncash b09a8626f0
tcg: Make cpu_hver a TCGv 2018-02-21 01:38:07 -05:00
Lioncash e161e9dcb4
tcg: Make cpu_htba a TCGv 2018-02-21 01:35:40 -05:00
Lioncash 577386b246
tcg: Make cpu_hintp a TCGv 2018-02-21 01:34:13 -05:00
Lioncash 2df9744bdb
tcg: Make cpu_stick_cmpr and cpu_hstick_cmpr TCGv 2018-02-21 01:32:59 -05:00
Lioncash 2d9d8c5e01
tcg: Make cpu_tick_cmpr a TCGv 2018-02-21 01:30:00 -05:00
Lioncash e5401deb09
tcg: Make cpu_npc a TCGv 2018-02-21 01:25:40 -05:00
Lioncash 6ccd4479d7
tcg: Make sparc_cpu_pc a TCGv 2018-02-21 01:23:58 -05:00
Lioncash e5a776b495
tcg: Make cpu_fsr a TCGv 2018-02-21 01:22:16 -05:00
Lioncash b51f920404
tcg: Make cpu_gsr a TCGv
Commit 5d4e1a1081d3f1ec2908ff0eaebe312389971ab4
allows making the type concrete. Also fixes a leak with sparc
2018-02-21 01:17:01 -05:00
Lioncash 4da2fd6407
tcg: Make cpu_cond a TCGv
Commit 5d4e1a1081d3f1ec2908ff0eaebe312389971ab4
allows making the type concrete
2018-02-21 01:12:15 -05:00
Lioncash 2f785b11d2
tcg: Make cpu_tbr a TCGv
Commit 5d4e1a1081d3f1ec2908ff0eaebe312389971ab4
allows making the type concrete
2018-02-21 01:12:11 -05:00
Lioncash bbc8517cd2
tcg: Make cpu_y a TCGv
Commit 5d4e1a1081d3f1ec2908ff0eaebe312389971ab4
allows making the type concrete
2018-02-21 01:06:36 -05:00