Commit graph

1440 commits

Author SHA1 Message Date
Peter Maydell c9bf91049c
all: Clean up includes
Clean up includes so that osdep.h is included first and headers
which it implies are not included manually.

This commit was created with scripts/clean-includes.

Backports commit d38ea87ac54af64ef611de434d07c12dc0399216 from qemu
2018-02-19 01:34:28 -05:00
Peter Maydell 728aabd4c3
qom: Clean up includes
Clean up includes so that osdep.h is included first and headers
which it implies are not included manually.

This commit was created with scripts/clean-includes.

Backports commit 9bbc853bd4fc6e4cbdbfc8d52eab0730d3ba94ba from qemu
2018-02-19 01:31:35 -05:00
Peter Maydell 76d3aa92cc
qobject: Clean up includes
Clean up includes so that osdep.h is included first and headers
which it implies are not included manually.

This commit was created with scripts/clean-includes.

Backports commit f2ad72b30e214d1e3e41dba36f855354dfa81832 from qemu
2018-02-19 01:30:42 -05:00
Peter Maydell 31e4fcdc5b
qapi: Clean up includes
Clean up includes so that osdep.h is included first and headers
which it implies are not included manually.

This commit was created with scripts/clean-includes.

Backports commit cbf21151906c935d4276268b59429c58546462ae from qemu
2018-02-19 01:29:30 -05:00
Peter Maydell 56d213f16c
util: Clean up includes
Clean up includes so that osdep.h is included first and headers
which it implies are not included manually.

This commit was created with scripts/clean-includes.

Backports commit aafd758410015e08b1aa8964d739ba8587ce58dc from qemu
2018-02-19 01:27:55 -05:00
Peter Maydell 61a59665d6
target-arm: Don't report presence of EL2 if it doesn't exist
We already modify the processor feature bits to not report EL3
support to the guest if EL3 isn't enabled for the CPU we're emulating.
Add similar support for not reporting EL2 unless it is enabled.
This is necessary because real world guest code running at EL3
(trusted firmware or bootloaders) will query the ID registers to
determine whether it should start a guest Linux kernel in EL2 or EL3.

Backports commit 3c2f7bb32b4c597925c5c7411307d51f1a56045d from qemu
2018-02-19 01:23:28 -05:00
Edgar E. Iglesias 3ea1b2a84c
target-arm: Implement the S2 MMU inputsize > pamax check
Implement the inputsize > pamax check for Stage 2 translations.
This is CONSTRAINED UNPREDICTABLE and we choose to fault.

Backports commit 3526423e867765568ad95b8094ae8b4042cac215 from qemu
2018-02-19 01:22:00 -05:00
Edgar E. Iglesias 71f370d549
target-arm: Rename check_s2_startlevel to check_s2_mmu_setup
Rename check_s2_startlevel to check_s2_mmu_setup in preparation
for additional checks.

Backports commit a0e966c93a0968d29ef51447d08a6b7be6f4d757 from qemu
2018-02-19 01:16:11 -05:00
Edgar E. Iglesias bab59f6b18
target-arm: Apply S2 MMU startlevel table size check to AArch64
The S2 starting level table size check applies to both AArch32
and AArch64. Move it to common code.

Backports commit 98d68ec289750139258d9cd9ab3f6d7dd10bb762 from qemu
2018-02-19 01:13:35 -05:00
Peter Maydell d3e5003e53
target-arm: Make various system registers visible to EL3
The AArch64 system registers DACR32_EL2, IFSR32_EL2, SPSR_IRQ,
SPSR_ABT, SPSR_UND and SPSR_FIQ are visible and fully functional from
EL3 even if the CPU has no EL2 (unlike some others which are RES0
from EL3 in that configuration). Move them from el2_cp_reginfo[] to
v8_cp_reginfo[] so they are always present.

Backports commit 6a43e0b6e1f6bcd6b11656967422f4217258200a from qemu
2018-02-19 01:11:40 -05:00
Peter Maydell 79ca0b299a
m68k: Clean up includes
Clean up includes so that osdep.h is included first and headers
which it implies are not included manually.

This commit was created with scripts/clean-includes.

Backports commit d8416665774bb6c057cbb3dd67d802e67e7a03ef from qemu
2018-02-19 01:06:05 -05:00
Peter Maydell 4ca19f2cd6
tcg: Clean up includes
Clean up includes so that osdep.h is included first and headers
which it implies are not included manually.

This commit was created with scripts/clean-includes.

Backports commit 757e725b58c57d3ebb66a31fd2210df977a12154 from qemu
2018-02-19 01:04:30 -05:00
Peter Maydell 963b57c8de
x86: Clean up includes
Clean up includes so that osdep.h is included first and headers
which it implies are not included manually.

This commit was created with scripts/clean-includes.

Backports commit b6a0aa053711e27e1a7825c1fca662beb05bee6f from qemu
2018-02-19 01:00:09 -05:00
Peter Maydell 139fb637d6
sparc: Clean up includes
Clean up includes so that osdep.h is included first and headers
which it implies are not included manually.

This commit was created with scripts/clean-includes.

Backports commit db5ebe5f411833b0ce4b6fa86ee00366e32d3968 from qemu
2018-02-19 00:52:41 -05:00
Peter Maydell 293266a9d8
exec: Clean up includes
Clean up includes so that osdep.h is included first and headers
which it implies are not included manually.

This commit was created with scripts/clean-includes.

Backports commit 7b31bbc2e68605ab2f10dc609dd54cf4c7b5f49a from qemu
2018-02-19 00:49:55 -05:00
Peter Maydell 7043ccee92
crypto: Clean up includes
Backports commit 42f7a448dbc5d550b1d7f0ee6b622acccaed1d12 from qemu
2018-02-19 00:47:40 -05:00
Peter Maydell 00cf2aaef2
mips: Clean up includes
Clean up includes so that osdep.h is included first and headers
which it implies are not included manually.

This commit was created with scripts/clean-includes.

Backports commit c684822ad29968af09735148f03a511bc514589d from qemu
2018-02-19 00:45:08 -05:00
Miodrag Dinic 63dad98564
target-mips: Fix ALIGN instruction when bp=0
If executing ALIGN with shift count bp=0 within mips64 emulation,
the result of the operation should be sign extended.

Taken from the official documentation (pseudo code) :

ALIGN:
tmp_rt_hi = unsigned_word(GPR[rt]) << (8*bp)
tmp_rs_lo = unsigned_word(GPR[rs]) >> (8*(4-bp))
tmp = tmp_rt_hi || tmp_rt_lo
GPR[rd] = sign_extend.32(tmp)

Backports commit 51243852af322f0a1103a90c936c43db84def82f from qemu
2018-02-19 00:42:13 -05:00
Aurelien Jarno 2e8c6adc4b
target-mips: silence NaNs for cvt.s.d and cvt.d.s
cvt.s.d and cvt.d.s are FP operations and thus need to convert input
sNaN into corresponding qNaN. Explicitely use the floatXX_maybe_silence_nan
functions for that as the floatXX_to_floatXX functions do not do that.

Backports commit 1aa56f6ee7d2375b0734e98ba69cc41416894bbc from qemu
2018-02-19 00:40:29 -05:00
Dongxue Zhang a0f361c4e3
target-mips/cpu.h: Fix spell error
CP0IntCtl_IPPC1, the last letter should be 'i', not 'one'.

Backports commit 889912999d3f089cb8b6db8763ebec11022768b9 from qemu
2018-02-19 00:38:27 -05:00
Aurelien Jarno 5c1abe1b1b
softfloat: fix return type of roundAndPackFloat16
The roundAndPackFloat16 function should return a float16 value, not a
float32 one. Fix that.

Backports commit 7ceac86f49b564954f5bde477c4281f407be1399 from qemu
2018-02-19 00:36:45 -05:00
Peter Maydell c8220d5aaf
fpu: Replace uint8 typedef with uint8_t
Replace the uint8 softfloat-specific typedef with uint8_t.
This change was made with

find include hw fpu target-* -name '*.[ch]' | xargs sed -i -e 's/\buint8\b/uint8_t/g'

together with manual removal of the typedef definition and
manual fixing of more erroneous uses found via test compilation.

It turns out that the only code using this type is an accidental
use where uint8_t was intended anyway...

Backports commit d341d9f3062c74d74c94ebe6359f067bed8311ba from qemu
2018-02-19 00:34:41 -05:00
Peter Maydell 2eaf79bfd3
fpu: Replace int8 typedef with int8_t
Replace the int8 softfloat-specific typedef with int8_t.
This change was made with

find include hw fpu target-* -name '*.[ch]' | xargs sed -i -e 's/\bint8\b/int8_t/g'

together with manual removal of the typedef definition, and
manual undoing of various mis-hits.

Backports commit 8f506c709adb7d3bed4ebefefe9487c156192a64 from qemu
2018-02-19 00:33:01 -05:00
Peter Maydell 63ac282f1a
fpu: Replace uint32 typedef with uint32_t
Replace the uint32 softfloat-specific typedef with uint32_t.
This change was made with

find include hw fpu target-* -name '*.[ch]' | xargs sed -i -e 's/\buint32\b/uint32_t/g'

together with manual removal of the typedef definition,
manual undoing of various mis-hits, and another couple of
fixes found via test compilation.

All the uses in hw/ were using the wrong type by mistake.

Backports commit 3a87d00910ef64a2eece4aad25d96ea10683fc5c from qemu
2018-02-19 00:29:52 -05:00
Peter Maydell 9712d8a7ac
fpu: Replace int32 typedef with int32_t
Replace the int32 softfloat-specific typedef with int32_t.
This change was made with

find hw include fpu target-* -name '*.[ch]' | xargs sed -i -e 's/\bint32\b/int32_t/g'

together with manual removal of the typedef definition, and
manual undoing of some mis-hits where macro arguments were
being used for token pasting rather than as a type.

The uses in hw/ipmi/ should not have been using this type at all.

Backports commit f4014512cda682a9d0c75310d278d7ae96b0505c from qemu
2018-02-19 00:24:56 -05:00
Peter Maydell df84f0d513
fpu: Replace uint64 typedef with uint64_t
Replace the uint64 softfloat-specific typedef with uint64_t.
This change was made with

find include fpu target-* -name '*.[ch]' | xargs sed -i -e 's/\buint64\b/uint64_t/g'

together with manual removal of the typedef definition, and
manual undoing of some mis-hits where macro arguments were
being used for token pasting rather than as a type.

Note that the target-mips/kvm.c and target-s390x/kvm.c changes are fixing
code that should not have been using the uint64 type in the first place.

Backports commit 182f42fdc219e6481654fcfb73b17e4b4e63b6ff from qemu
2018-02-19 00:16:49 -05:00
Peter Maydell 940106cd69
fpu: Replace int64 typedef with int64_t
Replace the int64 softfloat-specific typedef with int64_t.
This change was made with

find include fpu target-* -name '*.[ch]' | xargs sed -i -e 's/\bint64\b/int64_t/g'

together with manual removal of the typedef definition, and
manual undoing of some mis-hits where macro arguments were
being used for token pasting rather than as a type.

Backports commit f42c222482b651400f0fa417eb174da1c9502c1c from qemu
2018-02-19 00:14:18 -05:00
Huaitong Han e3d01bc57e
target-i386: Add PKU and and OSPKE support
Add PKU and OSPKE CPUID features, including xsave state and
migration support.

Backports commit f74eefe0b98cd7e13825de8e8d9f32e22aed102c from qemu
2018-02-19 00:07:31 -05:00
Haozhong Zhang be65d10c09
target-i386: Add support to migrate vcpu's TSC rate
This patch enables migrating vcpu's TSC rate. If KVM on the
destination machine supports TSC scaling, guest programs will
observe a consistent TSC rate across the migration.

If TSC scaling is not supported on the destination machine, the
migration will not be aborted and QEMU on the destination will
not set vcpu's TSC rate to the migrated value.

If vcpu's TSC rate specified by CPU option 'tsc-freq' on the
destination machine is inconsistent with the migrated TSC rate,
the migration will be aborted.

For backwards compatibility, the migration of vcpu's TSC rate is
disabled on pc-*-2.5 and older machine types.

Backports relevant parts of commit 36f96c4b6bd25f43000c317518ff3df10202bc75 from qemu
2018-02-18 23:59:08 -05:00
Eduardo Habkost 974c3bfdd3
target-i386: Add suffixes to MMReg struct fields
This will ensure we never use the MMX_* and ZMM_* macros with the
wrong struct type.

Backports commit f23a9db6bca5b9a228c77bbcaa06d01510e148b7 from qemu
2018-02-18 23:57:16 -05:00
Eduardo Habkost 0b1f839189
target-i386: Define MMREG_UNION macro
This will simplify the definitions of ZMMReg and MMXReg.

Backports commit 31d414d649b289ff9d1e048c41554298d1094fd3 from qemu
2018-02-18 23:55:29 -05:00
Eduardo Habkost 831fdde7fa
target-i386: Define MMXReg._d field
Add a new field and reorder MMXReg fields, to make MMXReg and
ZMMReg field lists look the same (except for the array sizes).

Backports commit 9253e1a7923e94598419ac9a7df7b8bc6cba65a5 from qemu
2018-02-18 23:54:09 -05:00
Eduardo Habkost 566acb7188
target-i386: Rename XMM_[BWLSDQ] helpers to ZMM_*
They are helpers for the ZMMReg fields, so name them accordingly.

This is just a global search+replace, no other changes are being
introduced.

Backports commit 19cbd87c14ab208858ee1233b790f37cfefed4b9 from qemu
2018-02-18 23:53:16 -05:00
Eduardo Habkost e90dbe6bb9
target-i386: Rename struct XMMReg to ZMMReg
The struct represents a 512-bit register, so name it accordingly.

This is just a global search+replace, no other changes are being
introduced.

Backports commit fa4518741ed69aa7993f9c15bb52eacc375681fc from qemu
2018-02-18 23:46:30 -05:00
Eduardo Habkost 326fa3d207
target-i386: Use a _q array on MMXReg too
Make MMXReg use the same field names used on XMMReg, so we can
try to reuse macros and other code later.

Backports commit 9618f40f06e90c8fa8ae06b56c7404a7cc937e22 from qemu
2018-02-18 23:20:26 -05:00
Eduardo Habkost ea83d22cdf
target-i386/ops_sse.h: Use MMX_Q macro
We have a MMX_Q macro in addition to MMX_{B,W,L}. Use it.

Backports commit 83625474b340c0f1eb2544d7a6e898cc68e868a2 from qemu
2018-02-18 23:16:21 -05:00
Eduardo Habkost baf37a04ad
target-i386: Rename optimize_flags_init()
Rename the function so that the reason for its existence is
clearer: it does x86-specific initialization of TCG structures.

Backports commit 63618b4ed48f0fc2a7a3fd1117e2f0b512248dab from qemu
2018-02-18 22:56:02 -05:00
Peter Maydell 22dadac875
target-arm: Implement FPEXC32_EL2 system register
The AArch64 FPEXC32_EL2 system register is visible at EL2 and EL3,
and allows those exception levels to read and write the FPEXC
register for a lower exception level that is using AArch32.

Backports commit 03fbf20f4da58f41998dc10ec7542f65d37ba759 from qemu
2018-02-18 22:52:54 -05:00
Peter Maydell f4ae64e78a
target-arm: ignore ELR_ELx[1] for exception return to 32-bit ARM mode
The architecture requires that for an exception return to AArch32 the
low bits of ELR_ELx are ignored when the PC is set from them:
* if returning to Thumb mode, ignore ELR_ELx[0]
* if returning to ARM mode, ignore ELR_ELx[1:0]

We were only squashing bit 0; also squash bit 1 if the SPSR T bit
indicates this is a return to ARM code.

Backports commit c1e0371442bf3a7e42ad53c2a3d816ed7099f81d from qemu
2018-02-18 22:50:18 -05:00
Peter Maydell 9826fc4414
target-arm: Implement remaining illegal return event checks
We already implement almost all the checks for the illegal
return events from AArch64 state described in the ARM ARM section
D1.11.2. Add the two missing ones:
* return to EL2 when EL3 is implemented and SCR_EL3.NS is 0
* return to Non-secure EL1 when EL2 is implemented and HCR_EL2.TGE is 1

(We don't implement external debug, so the case of "debug state exit
from EL0 using AArch64 state to EL0 using AArch32 state" doesn't apply
for QEMU.)

Backports commit e393f339af87da7210f6c86902b321df6a2e8bf5 from qemu
2018-02-18 22:47:23 -05:00
Peter Maydell 2ffb545ec3
target-arm: Handle exception return from AArch64 to non-EL0 AArch32
Remove the assumptions that the AArch64 exception return code was
making about a return to AArch32 always being a return to EL0.
This includes pulling out the illegal-SPSR checks so we can apply
them for return to 32 bit as well as return to 64-bit.

Backports commit 3809951bf61605974b91578c582de4da28f8ed07 from qemu
2018-02-18 22:46:50 -05:00
Peter Maydell 134eeeeacc
target-arm: Fix wrong AArch64 entry offset for EL2/EL3 target
The entry offset when taking an exception to AArch64 from a lower
exception level may be 0x400 or 0x600. 0x400 is used if the
implemented exception level immediately lower than the target level
is using AArch64, and 0x600 if it is using AArch32. We were
incorrectly implementing this as checking the exception level
that the exception was taken from. (The two can be different if
for example we take an exception from EL0 to AArch64 EL3; we should
in this case be checking EL2 if EL2 is implemented, and EL1 if
EL2 is not implemented.)

Backports commit 3d6f761713745dfed7d2ccfe98077d213a6a6eba from qemu
2018-02-18 22:43:52 -05:00
Peter Maydell d7c3ba6fa0
target-arm: Pull semihosting handling out to arm_cpu_do_interrupt()
Handling of semihosting calls should depend on the register width
of the calling code, not on that of any higher exception level,
so we need to identify and handle semihosting calls before we
decide whether to deliver the exception as an entry to AArch32
or AArch64. (EXCP_SEMIHOST is also an "internal exception" so
it has no target exception level in the first place.)

This will allow AArch32 EL1 code to use semihosting calls when
running under an AArch64 EL3.

Backports commit 904c04de2e1b425e7bc8c4ce2fae3d652eeed242 from qemu
2018-02-18 22:41:58 -05:00
Peter Maydell 4d0bdc61b6
target-arm: Use a single entry point for AArch64 and AArch32 exceptions
If EL2 or EL3 is present on an AArch64 CPU, then exceptions can be
taken to an exception level which is running AArch32 (if only EL0
and EL1 are present then EL1 must be AArch64 and all exceptions are
taken to AArch64). To support this we need to have a single
implementation of the CPU do_interrupt() method which can handle both
32 and 64 bit exception entry.

Pull the common parts of aarch64_cpu_do_interrupt() and
arm_cpu_do_interrupt() out into a new function which calls
either the AArch32 or AArch64 specific entry code once it has
worked out which one is needed.

We temporarily special-case the handling of EXCP_SEMIHOST to
avoid an assertion in arm_el_is_aa64(); the next patch will
pull all the semihosting handling out to the arm_cpu_do_interrupt()
level (since semihosting semantics depend on the register width
of the calling code, not on that of any higher EL).

Backports commit 966f758c49ff478c4757efa5970ce649161bff92 from qemu
2018-02-18 22:34:31 -05:00
Peter Maydell e1925bb5fb
target-arm: Move aarch64_cpu_do_interrupt() to helper.c
Move the aarch64_cpu_do_interrupt() function to helper.c. We want
to be able to call this from code that isn't AArch64-only, and
the move allows us to avoid awkward #ifdeffery at the callsite.

Backports commit f3a9b6945cbbb23f3a70da14e9ffdf1e60c580a8 from qemu
2018-02-18 22:23:06 -05:00
Peter Maydell c06519a2fd
target-arm: Properly support EL2 and EL3 in arm_el_is_aa64()
Support EL2 and EL3 in arm_el_is_aa64() by implementing the
logic for checking the SCR_EL3 and HCR_EL2 register-width bits
as appropriate to determine the register width of lower exception
levels.

Backports commit 446c81abf8e0572b8d5d23fe056516ac62af278d from qemu
2018-02-18 22:20:51 -05:00
Lioncash f1f3ff39eb
target-arm: Support multiple address spaces in page table walks
If we have a secure address space, use it in page table walks:
when doing the physical accesses to read descriptors, make them
through the correct address space.

(The descriptor reads are the only direct physical accesses
made in target-arm/ for CPUs which might have TrustZone.)

Backports commit 5ce4ff6502fc6ae01a30c3917996c6c41be1d176 from qemu
2018-02-18 22:18:28 -05:00
Peter Maydell d3eb5fb710
target-arm: Implement cpu_get_phys_page_attrs_debug
Implement cpu_get_phys_page_attrs_debug instead of cpu_get_phys_page_debug.

Backports commit 0faea0c7e6b729c64035b3591b184eeeeef6f1d4 from qemu
2018-02-18 22:15:50 -05:00
Peter Maydell f96988503a
target-arm: Implement asidx_from_attrs
Implement the asidx_from_attrs CPU method to return the
Secure or NonSecure address space as appropriate.

(The function is inline so we can use it directly in target-arm
code to be added in later patches.)

Backports commit 017518c1f6ed9939c7f390cb91078f0919b5494c from qemu
2018-02-18 22:11:55 -05:00
Peter Maydell c13497c369
target-arm: Add QOM property for Secure memory region
Add QOM property to the ARM CPU which boards can use to tell us what
memory region to use for secure accesses. Nonsecure accesses
go via the memory region specified with the base CPU class 'memory'
property.

By default, if no secure region is specified it is the same as the
nonsecure region, and if no nonsecure region is specified we will use
address_space_memory.

Backports commit 9e273ef2174d7cd5b14a16d8638812541d3eb6bb from qemu
2018-02-18 22:09:46 -05:00
Peter Crosthwaite fd4e62bc1d
exec: Respect as_translate_internal length clamp
address_space_translate_internal will clamp the *plen length argument
based on the size of the memory region being queried. The iommu walker
logic in addresss_space_translate was ignoring this by discarding the
post fn call value of *plen. Fix by just always using *plen as the
length argument throughout the fn, removing the len local variable.

This fixes a bootloader bug when a single elf section spans multiple
QEMU memory regions.

Backports commit 23820dbfc79d1c9dce090b4c555994f2bb6a69b3 from qemu
2018-02-18 22:04:02 -05:00
Peter Crosthwaite ce997e1caf
qom/cpu: Add MemoryRegion property
Add a MemoryRegion property, which if set is used to construct
the CPU's initial (default) AddressSpace.

Backports commit 6731d864f80938e404dc3e5eb7f6b76b891e3e43 from qemu
2018-02-18 21:54:50 -05:00
Lioncash 6d5f465449
uc: Handle freeing of multiple address spaces 2018-02-18 21:36:50 -05:00
Lioncash 2210c7f486
cpus: Relocate address space initialization
Moves it to qemu_init_vcpu where it belongs
2018-02-18 21:05:04 -05:00
Lioncash 6a7974277a
Move RAMBlock deallocation to reclaim_ramblock
Backports a minor portion of commit 43771539d4666cba16298fc6b0ea63867425277c from qemu
2018-02-18 19:38:51 -05:00
Lioncash aa0ce52b97
exec: Add missing atomic reads 2018-02-18 19:28:02 -05:00
Peter Maydell 5192f806aa
exec.c: Use atomic_rcu_read() to access dispatch in memory_region_section_get_iotlb()
When accessing the dispatch pointer in an AddressSpace within an RCU
critical section we should always use atomic_rcu_read(). Fix an
access within memory_region_section_get_iotlb() which was incorrectly
doing a direct pointer access.

Backports commit 0b8e2c1002afddc8ef3d52fa6fc29e4768429f98 from qemu
2018-02-18 19:22:39 -05:00
Dr. David Alan Gilbert 75701d03ee
qemu_ram_foreach_block: pass up error value, and down the ramblock name
check the return value of the function it calls and error if it's non-0
Fixup qemu_rdma_init_one_block that is the only current caller,
  and rdma_add_block the only function it calls using it.

Pass the name of the ramblock to the function; helps in debugging.

Backports commit e3807054e20fb3b94d18cb751c437ee2f43b6fac from qemu
2018-02-18 19:17:18 -05:00
Paolo Bonzini 71beea204c
exec: avoid possible overwriting of mmaped area in qemu_ram_remap
It is not necessary to munmap an area before remapping it with MAP_FIXED;
if the memory region specified by addr and len overlaps pages of any
existing mapping, then the overlapped part of the existing mapping will
be discarded.

On the other hand, if QEMU does munmap the pages, there is a small
probability that another mmap sneaks in and catches the just-freed
portion of the address space.  In effect, munmap followed by
mmap(MAP_FIXED) is a use-after-free error, and Coverity flags it
as such.  Fix it.

Backports commit f18c69cfc554cf9776eb3c35b7510e17541afacb from qemu
2018-02-18 19:09:37 -05:00
Paolo Bonzini aad1027c96
Revert "exec: Respect as_tranlsate_internal length clamp"
This reverts commit c3c1bb9.
It causes problems with boards that declare memory regions shorter
than the registers they contain.

Backports commit 4025446f0ac6213335c22ec43f3c3d8362ce7286 from qemu
2018-02-18 19:07:44 -05:00
Michael S. Tsirkin 1cc51e4b53
exec: round up size on MR resize
Block size must fundamentally be a multiple of target page size.
Aligning automatically removes need to worry about the alignment
from callers.

Note: the only caller of qemu_ram_resize (acpi) already happens to have
size padded to a power of 2, but we would like to drop the padding in
ACPI core, and don't want to expose target page size knowledge to ACPI

Backports commit 129ddaf31be583fb7c97812e07e028661005ce42 from qemu
2018-02-18 19:02:27 -05:00
Lioncash 024ec1755e
Convert ram_list to RCU
Allow "unlocked" reads of the ram_list by using an RCU-enabled QLIST.

The ramlist mutex is kept.  call_rcu callbacks are run with the iothread
lock taken, but that may change in the future.  Writers still take the
ramlist mutex, but they no longer need to assume that the iothread lock
is taken.

Readers of the list, instead, no longer require either the iothread
or ramlist mutex, but they need to use rcu_read_lock() and
rcu_read_unlock().

One place in arch_init.c was downgrading from write side to read side
like this:

    qemu_mutex_lock_iothread()
    qemu_mutex_lock_ramlist()
    ...
    qemu_mutex_unlock_iothread()
    ...
    qemu_mutex_unlock_ramlist()

and the equivalent idiom is:

    qemu_mutex_lock_ramlist()
    rcu_read_lock()
    ...
    qemu_mutex_unlock_ramlist()
    ...
    rcu_read_unlock()

Backports the write barriers from commit 0dc3f44aca18b1be8b425f3f4feb4b3e8d68de2e in qemu
2018-02-18 18:53:49 -05:00
Mike Day 2b93290eea
exec: convert ram_list to QLIST
QLIST has RCU-friendly primitives, so switch to it.

Backports commit 0d53d9fe8a0dcb849bc7c9836e9e6a287f9aa787 from qemu
2018-02-18 18:49:24 -05:00
Paolo Bonzini 15b3a9358e
exec: fix madvise of NULL pointer
Coverity flags this as "dereference after null check".  Not quite a
dereference, since it will just EFAULT, but still nice to fix.

Backports commit a904c91196a9c5dbd7b9abcd3d40b0824286fb1c from qemu
2018-02-18 18:19:39 -05:00
Peter Maydell e07cd2542c
exec.c: Drop TARGET_HAS_ICE define and checks
The TARGET_HAS_ICE #define is intended to indicate whether a target-*
guest CPU implementation supports the breakpoint handling. However,
all our guest CPUs have that support (the only two which do not
define TARGET_HAS_ICE are unicore32 and openrisc, and in both those
cases the bp support is present and the lack of the #define is just
a bug). So remove the #define entirely: all new guest CPU support
should include breakpoint handling as part of the basic implementation.

Backports commit ec53b45bcd1f74f7a4c31331fa6d50b402cd6d26 from qemu
2018-02-18 18:17:14 -05:00
Amit Shah f64e3d4931
exec: add wrapper for host pointer access
host pointer accesses force pointer math, let's
add a wrapper to make them safer.

Backports relevant parts of commit 1240be24357ee292f8d05aa2abfdba75dd0ca25d from qemu
2018-02-18 18:10:17 -05:00
Paolo Bonzini 0696e7fe19
exec: allows 8-byte accesses in subpage_ops
Otherwise fw_cfg accesses are split into 4-byte ones before they reach the
fw_cfg ops / handlers.

Backports commit ff6cff7554be06e95f8d712f66cd16bd6681c746 from qemu
2018-02-18 18:06:37 -05:00
Paolo Bonzini a06611e45b
exec: skip MMIO regions correctly in cpu_physical_memory_write_rom_internal
Loading the BIOS in the mac99 machine is interesting, because there is a
PROM in the middle of the BIOS region (from 16K to 32K).  Before memory
region accesses were clamped, when QEMU was asked to load a BIOS from
0xfff00000 to 0xffffffff it would put even those 16K from the BIOS file
into the region.  This is weird because those 16K were not actually
visible between 0xfff04000 and 0xfff07fff.  However, it worked.

After clamping was added, this also worked.  In this case, the
cpu_physical_memory_write_rom_internal function split the write in
three parts: the first 16K were copied, the PROM area (second 16K) were
ignored, then the rest was copied.

Problems then started with commit 965eb2f (exec: do not clamp accesses
to MMIO regions, 2015-06-17).  Clamping accesses is not done for MMIO
regions because they can overlap wildly, and MMIO registers can be
expected to perform full-width accesses based only on their address
(with no respect for adjacent registers that could decode to completely
different MemoryRegions).  However, this lack of clamping also applied
to the PROM area!  cpu_physical_memory_write_rom_internal thus failed
to copy the third range above, i.e. only copied the first 16K of the BIOS.

In effect, address_space_translate is expecting _something else_ to do
the clamping for MMIO regions if the incoming length is large.  This
"something else" is memory_access_size in the case of address_space_rw,
so use the same logic in cpu_physical_memory_write_rom_internal.

Backports commit b242e0e0e2969c044a318e56f7988bbd84de1f63 from qemu
2018-02-18 17:57:08 -05:00
Paolo Bonzini 32996e48fc
exec: clamp accesses against the MemoryRegionSection
Because the clamping was done against the MemoryRegion,
address_space_rw was effectively broken if a write spanned
multiple sections that are not linear in underlying memory
(with the memory not being under an IOMMU).

This is visible with the MIPS rc4030 IOMMU, which is implemented
as a series of alias memory regions that point to the actual RAM.

Backports commit e4a511f8cc6f4a46d409fb5c9f72c38ba45f8d83 from qemu
2018-02-18 17:52:58 -05:00
Lioncash 7c21d3059e
memory: Silence unused variable warning 2018-02-18 17:52:03 -05:00
Paolo Bonzini 26ba2e91f6
exec: do not clamp accesses to MMIO regions
It is common for MMIO registers to overlap, for example a 4 byte register
at 0xcf8 (totally random choice... :)) and a 1 byte register at 0xcf9.
If these registers are implemented via separate MemoryRegions, it is
wrong to clamp the accesses as the value written would be truncated.

Hence for these regions the effects of commit 23820db (exec: Respect
as_translate_internal length clamp, 2015-03-16, previously applied as
commit c3c1bb9) must be skipped.

Backports commit 965eb2fcdfe919ecced6c34803535ad32dc1249c from qemu
2018-02-18 17:50:27 -05:00
Peter Crosthwaite b82e711a65
memory: Add address_space_init_shareable()
This will either create a new AS or return a pointer to an
already existing equivalent one, if we have already created
an AS for the specified root memory region.

The motivation is to reuse address spaces as much as possible.
It's going to be quite common that bus masters out in device land
have pointers to the same memory region for their mastering yet
each will need to create its own address space. Let the memory
API implement sharing for them.

Aside from the perf optimisations, this should reduce the amount
of redundant output on info mtree as well.

Thee returned value will be malloced, but the malloc will be
automatically freed when the AS runs out of refs.

Backports commit f0c02d15b57da6f5463e3768aa0cfeedccf4b8f4 from qemu
2018-02-18 00:18:21 -05:00
Peter Maydell 73efe6cda3
exec.c: Use cpu_get_phys_page_attrs_debug
Use cpu_get_phys_page_attrs_debug() when doing virtual-to-physical
conversions in debug related code, so that we can obtain the right
address space index and thus select the correct AddressSpace,
rather than always using cpu->as.

Backports commit 5232e4c798ba7a46261d3157b73d08fc598e7dcb from qemu
2018-02-17 23:26:09 -05:00
Peter Maydell 1dfba71bef
exec.c: Add cpu_get_address_space()
Add a function to return the AddressSpace for a CPU based on
its numerical index. (Callers outside exec.c don't have access
to the CPUAddressSpace struct so can't just fish it out of the
CPUState struct directly.)

Backports commit 651a5bc03705102de519ebf079a40ecc1da991db from qemu
2018-02-17 23:22:23 -05:00
Peter Maydell 2fe995a0da
exec.c: Pass MemTxAttrs to iotlb_to_region so it uses the right AS
Pass the MemTxAttrs for the memory access to iotlb_to_region(); this
allows it to determine the correct AddressSpace to use for the lookup.

Backports commit a54c87b68a0410d0cf6f8b84e42074a5cf463732 from qemu
2018-02-17 23:19:00 -05:00
Peter Maydell 8edd6ffdfd
cputlb.c: Use correct address space when looking up MemoryRegionSection
When looking up the MemoryRegionSection for the new TLB entry in
tlb_set_page_with_attrs(), use cpu_asidx_from_attrs() to determine
the correct address space index for the lookup, and pass it into
address_space_translate_for_iotlb().

Backports commit d7898cda81b6efa6b2d7a749882695cdcf280eaa from qemu
2018-02-17 23:15:22 -05:00
Peter Maydell d23831f4dd
cpu: Add new asidx_from_attrs() method
Add a new method to CPUClass which the memory system core can
use to obtain the correct address space index to use for a memory
access with a given set of transaction attributes, together
with the wrapper function cpu_asidx_from_attrs() which implements
the default behaviour ("always use asidx 0") for CPU classes
which don't provide the method.

Backports commit d7f25a9e6a6b2c69a0be6033903b7d6087bcf47d from qemu
2018-02-17 22:45:32 -05:00
Lioncash 1cc4b92c67
cpu: Add new get_phys_page_attrs_debug() method
Add a new optional method get_phys_page_attrs_debug() to CPUClass.
This is like the existing get_phys_page_debug(), but also returns
the memory transaction attributes to use for the access.
This will be necessary for CPUs which have multiple address
spaces and use the attributes to select the correct address
space.

We provide a wrapper function cpu_get_phys_page_attrs_debug()
which falls back to the existing get_phys_page_debug(), so we
don't need to change every target CPU.

Backports commit 1dc6fb1f5cc5cea5ba01010a19c6acefd0ae4b73 from qemu
2018-02-17 22:43:42 -05:00
Peter Maydell 90c7c1bdb5
exec-all.h: Document tlb_set_page_with_attrs, tlb_set_page
Add documentation comments for tlb_set_page_with_attrs()
and tlb_set_page().

Backports commit 1787cc8ee55143b6071c87e59f08d56e7c22c1eb from qemu
2018-02-17 22:37:58 -05:00
Peter Maydell 51369b67cd
exec.c: Allow target CPUs to define multiple AddressSpaces
Allow multiple calls to cpu_address_space_init(); each
call adds an entry to the cpu->ases array at the specified
index. It is up to the target-specific CPU code to actually use
these extra address spaces.

Since this multiple AddressSpace support won't work with
KVM, add an assertion to avoid confusing failures.

Backports commit 12ebc9a76dd7702aef0a3618717a826c19c34ef4 from qemu
2018-02-17 22:35:13 -05:00
Peter Maydell f1b237236c
exec.c: Don't set cpu->as until cpu_address_space_init
Rather than setting cpu->as unconditionally in cpu_exec_init
(and then having target-i386 override this later), don't set
it until the first call to cpu_address_space_init.

This requires us to initialise the address space for
both TCG and KVM (KVM doesn't need the AS listener but
it does require cpu->as to be set).

For target CPUs which don't set up any address spaces (currently
everything except i386), add the default address_space_memory
in qemu_init_vcpu().

Backports commit 56943e8cc14b7eeeab67d1942fa5d8bcafe3e53f from qemu
2018-02-17 22:24:36 -05:00
Peter Maydell 51aeab661f
hw/arm: Clean up includes
Clean up includes so that osdep.h is included first and headers
which it implies are not included manually.

This commit was created with scripts/clean-includes.

Backports commit 12b167226f2804063cf8d72fe4fdc01764c99e96 from qemu
2018-02-17 21:10:57 -05:00
Peter Maydell cd5c4037ac
target-arm: Clean up includes
Clean up includes so that osdep.h is included first and headers
which it implies are not included manually.

This commit was created with scripts/clean-includes.

Backports commit 74c21bd07491739c6e56bcb1f962e4df730e77f3 from qemu
2018-02-17 21:09:32 -05:00
Juan Quintela 7da263e4ea
target-sparc: Convert to VMStateDescription
Convert the SPARC CPU from cpu_load/save functions to VMStateDescription.
We preserve migration compatibility with the previous version
(required for SPARC32 but not necessarily for SPARC64).

Backports commit df32c8d436d4eb3f40b00647ca0df2bbc7f6bf6f from qemu
2018-02-17 21:06:46 -05:00
Peter Maydell a734ef8156
target-sparc: Split cpu_put_psr into side-effect and no-side-effect parts
For inbound migration we really want to be able to set the PSR without
having any side effects, but cpu_put_psr() calls cpu_check_irqs() which
might try to deliver CPU interrupts. Split cpu_put_psr() into the
no-side-effect and side-effect parts.

This includes reordering the cpu_check_irqs() to the end of cpu_put_psr(),
because that function may actually end up calling cpu_interrupt(), which
does not seem like a good thing to happen in the middle of updating the PSR.

Backports commit 4552a09dd4055c806b7df8c595dc0fb8951834be from qemu
2018-02-17 21:04:15 -05:00
Paolo Bonzini 3dab621825
target-i386: do not duplicate page protection checks
x86_cpu_handle_mmu_fault is currently checking twice for writability
and executability of pages; the first time to decide whether to
trigger a page fault, the second time to compute the "prot" argument
to tlb_set_page_with_attrs.

Reorganize code so that first "prot" is computed, then it is used
to check whether to raise a page fault, then finally PROT_WRITE is
removed if the D bit will have to be set.

Backports commit 76c64d33601a4948d6f72022992574a75b6fab97 from qemu
2018-02-17 20:59:54 -05:00
Alvise Rigo 1e3e75fa44
target-arm: Use the right MMU index in arm_regime_using_lpae_format
arm_regime_using_lpae_format checks whether the LPAE extension is used
for stage 1 translation regimes. MMU indexes not exclusively of a stage 1
regime won't work with this method.

In case of ARMMMUIdx_S12NSE0 or ARMMMUIdx_S12NSE1, offset these values
by ARMMMUIdx_S1NSE0 to get the right index indicating a stage 1
translation regime.

Rename also the function to arm_s1_regime_using_lpae_format and update
the comments to reflect the change.

Backports commit deb2db996cbb9470b39ae1e383791ef34c4eb3c2 from qemu
2018-02-17 20:56:32 -05:00
Markus Armbruster e4976f4597
error: Improve documentation
While there, tighten error_append_hint()'s assertion.

Backports commit f4d0064afcff4c38b379800674938cde8f069dcd from qemu
2018-02-17 20:52:49 -05:00
Markus Armbruster 9398bd49fe
error: Document how to accumulate multiple errors
Backports commit 8d780f43921feb7fd8d0b58f779a22d1265f2378 from qemu
2018-02-17 20:49:12 -05:00
Peter Maydell f336fc39eb
osdep.h: Include glib-compat.h in osdep.h rather than qemu-common.h
Our use of glib is now pervasive across QEMU. Move the include of glib-compat.h
from qemu-common.h to osdep.h so that it is more widely accessible and doesn't
get forgotten by accident. (Failure to include it will result in build failure
on old versions of glib which is likely to be unnoticed by most developers.)

Backports commit 529490e5d664a20d5c4223070dd7c03a0e02b6bd from qemu
2018-02-17 20:47:28 -05:00
Paolo Bonzini 1650af8c8b
memory: try to inline constant-length reads
memcpy can take a large amount of time for small reads and writes.
Handle the common case of reading s/g descriptors from memory (there
is no corresponding "write" case that is as common, because writes
often use address_space_st* functions) by inlining the relevant
parts of address_space_read into the caller.

Backports commit 3cc8f884996584630734a90c9b3c535af81e3c92 from qemu
2018-02-17 20:44:39 -05:00
Paolo Bonzini 712c300639
memory: inline a few small accessors
These are used in the address_space_* fast paths.

Backports commit 1619d1fe737d2af068aefe134386a69b76164794 from qemu
2018-02-17 20:35:28 -05:00
Paolo Bonzini 9a78c61145
memory: extract first iteration of address_space_read and address_space_write
We want to inline the case where there is only one iteration, because
then the compiler can also inline the memcpy. As a start, extract
everything after the first address_space_translate call.

Backports commit a203ac702e0720135fac8b1f2061d119814c1798 from qemu
2018-02-17 20:31:21 -05:00
Paolo Bonzini 0688343929
memory: split address_space_read and address_space_write
Rather than dispatching on is_write for every iteration, make
address_space_rw call one of the two functions. The amount of
duplicate logic is pretty small, and memory_access_is_direct can
be tweaked so that it inlines better in the callers.

Backports commit eb7eeb88628074207dd611472e712af775985e73 from qemu
2018-02-17 20:19:05 -05:00
Paolo Bonzini 077ffc3bd5
memory: avoid unnecessary object_ref/unref
For the common case of DMA into non-hotplugged RAM, it is unnecessary
but expensive to do object_ref/unref. Add back an owner field to
MemoryRegion, so that these memory regions can skip the reference
counting.

Backports commit 612263cf33062f7441a5d0e3b37c65991fdc3210 from qemu
2018-02-17 20:10:25 -05:00
Paolo Bonzini e6b25279f8
memory: reorder MemoryRegion fields
Order fields so that all fields accessed during a RAM read/write fit in
the same cache line.

Backports commit a676854f3447019c7c4b005ab6aece905fccfddd from qemu
2018-02-17 19:48:52 -05:00
Paolo Bonzini 52b3120995
exec: make qemu_ram_ptr_length more similar to qemu_get_ram_ptr
Notably, use qemu_get_ram_block to enjoy the MRU optimization.

Backports commit e81bcda529378f5ed8b9b0b59bb2b24b8ee1c814 from qemu
2018-02-17 19:46:37 -05:00
Eduardo Habkost d52f55b46d
memory: Eliminate memory_region_destructor_ram_from_ptr()
The function is equivalent to memory_region_destructor_ram(), so
it's not needed anymore.

Backports commit fc3e7665d7fe1b2f842441d250d7afec26b8a910 from qemu
2018-02-17 19:39:22 -05:00
Eduardo Habkost 26791ea61b
exec: Eliminate qemu_ram_free_from_ptr()
Replace qemu_ram_free_from_ptr() with qemu_ram_free().

The only difference between qemu_ram_free_from_ptr() and
qemu_ram_free() is that g_free_rcu() is used instead of
call_rcu(reclaim_ramblock). We can safely replace it because:

* RAM blocks allocated by qemu_ram_alloc_from_ptr() always have
RAM_PREALLOC set;
* reclaim_ramblock(block) will do nothing except g_free(block)
if RAM_PREALLOC is set at block->flags.

Backports commit a29ac16632aec6065c72985b9f7eeb1ca6fbef4a from qemu
2018-02-17 19:37:45 -05:00
Sergey Fedorov 587c9f0570
target-arm: Fix and improve AA32 singlestep translation completion code 2018-02-17 19:34:52 -05:00
Andrew Baumann e1701b069f
target-arm: raise exception on misaligned LDREX operands
Qemu does not generally perform alignment checks. However, the ARM ARM
requires implementation of alignment exceptions for a number of cases
including LDREX, and Windows-on-ARM relies on this.

This change adds plumbing to enable alignment checks on loads using
MO_ALIGN, a do_unaligned_access hook to raise the exception (data
abort), and uses the new aligned loads in LDREX (for all but
single-byte loads).

Backports commit 30901475b91ef1f46304404ab4bfe89097f61b96 from qemu
2018-02-17 19:29:29 -05:00
Peter Maydell 3664e1ab8a
sparc: allow CASA with ASI 0xa from user space
LEON3 allows the CASA instruction to be used from user space
if the ASI is set to 0xa (user data).

Backports commit bd4e097a8e30bb63ed7f46553b13f60809c30ac3 from qemu
2018-02-17 19:23:35 -05:00
Markus Armbruster 03dffc1e9c
typedefs: Put them back into alphabetical order
"Please keep this list in alphabetical order" has been more honoured
in the breach than in the observance. Clean up.

While there, drop a redundant struct declaration.

Backports commit 2988cbeaf94203b2cf31c0b3f589aa4ebc0cff34 from qemu
2018-02-17 19:22:23 -05:00
Lioncash c8be425439
translate-all: ensure host page mask is always extended with 1's
Anthony reported that >4GB guests on Xen with 32bit QEMU broke after
commit 4ed023c ("Round up RAMBlock sizes to host page sizes", 2015-11-05).

In that patch sizes are masked against qemu_host_page_size/mask which
are uintptr_t, and thus 32bit on a 32bit QEMU, even though the ram space
might be bigger than 4GB on Xen.

Since ram_addr_t is not available on user-mode emulation targets, ensure
that we get a sign extension when masking away the low bits of the address.
Remove the ~10 year old scary comment that the type of these variables
is probably wrong, with another equally scary comment. The new comment
however does not have "???" in it, which is arguably an improvement.

For completeness use the alignment macros in linux-user and bsd-user
instead of manually doing an &. linux-user and bsd-user are not affected
by the Xen issue, however.

Backports commit 0c2d70c448b7853a91cfa63659aa3cc6630fb9be from qemu
2018-02-17 19:17:19 -05:00
Don Slutz 86436964b5
exec: Stop using memory after free
memory_region_unref(mr) can free memory.

For example I got:

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7f43280d4700 (LWP 4462)]
0x00007f43323283c0 in phys_section_destroy (mr=0x7f43259468b0)
at /home/don/xen/tools/qemu-xen-dir/exec.c:1023
1023 if (mr->subpage) {
(gdb) bt
at /home/don/xen/tools/qemu-xen-dir/exec.c:1023
at /home/don/xen/tools/qemu-xen-dir/exec.c:1034
at /home/don/xen/tools/qemu-xen-dir/exec.c:2205
(gdb) p mr
$1 = (MemoryRegion *) 0x7f43259468b0

And this change prevents this.

Backports commit 55b4e80b047300e1512df02887b7448ba3786b62 from qemu
2018-02-17 19:11:50 -05:00
Stefan Weil 5218799171
oslib-win32: Change return type of function getpagesize
getpagesize on Linux returns an int. Fix QEMU's implementation for
Windows to return an int (instead of size_t), too.

This fixes a compiler warning which was introduced recently
(commit 093e3c42).

Backports commit a28c2f2df7679e3a87789e9fb7ed69331f697297 from qemu
2018-02-17 19:10:37 -05:00
Paolo Bonzini 1918761803
target-sparc: fix 32-bit truncation in fpackfix
This is reported by Coverity. The algorithm description at
ftp://ftp.icm.edu.pl/packages/ggi/doc/hw/sparc/Sparc.pdf suggests
that the 32-bit parts of rs2, after the left shift, is treated
as a 64-bit integer. Bits 32 and above are used to do the
saturating truncation.

Backports commit 12a3567c4099be194b44987ac5d7d65b99bcfab7 from qemu
2018-02-17 19:08:40 -05:00
Leon Alrae 272e412fc9
target-mips: flush QEMU TLB when disabling 64-bit addressing
CP0.Status.KX/SX/UX bits are responsible for enabling access to 64-bit
Kernel/Supervisor/User Segments. If bit is cleared an access to
corresponding segment should generate Address Error Exception.

However, the guest may still be able to access some pages belonging to
the disabled 64-bit segment because we forget to flush QEMU TLB.

This patch fixes it.

Backports commit f93c3a8d0c0c1038dbe1e957eb8ab92671137975 from qemu
2018-02-17 19:06:43 -05:00
James Hogan 8689c6efef
target-mips: Fix exceptions while UX=0
Commit 01f728857941 ("target-mips: Status.UX/SX/KX enable 32-bit address
wrapping") added a new hflag MIPS_HFLAG_AWRAP, which indicates that
64-bit addressing is disallowed in the current mode, so hflag users
don't need to worry about the complexities of working that out, for
example checking both MIPS_HFLAG_KSU and MIPS_HFLAG_UX.

However when exceptions are taken outside of exception level,
mips_cpu_do_interrupt() manipulates the env->hflags directly rather than
using compute_hflags() to update them, and this code wasn't updated
accordingly. As a result, when UX is cleared, MIPS_HFLAG_AWRAP is set,
but it doesn't get cleared on entry back into kernel mode due to an
exception. Kernel mode then cannot access the 64-bit segments resulting
in a nested exception loop. The same applies to errors and debug
exceptions.

Fix by updating mips_cpu_do_interrupt() to clear the MIPS_HFLAG_WRAP
flag when necessary, according to compute_hflags().

Backports commit 7871abb94c2f4adc39f2487f6edf5e69ba872a65 from qemu
2018-02-17 18:57:52 -05:00
Peter Maydell 386e398c56
target-arm: Don't mask out bits [47:40] in LPAE descriptors for v8
In an LPAE format descriptor in ARMv8 the address field extends
up to bit 47, not just bit 39. Correct the masking so we don't
give incorrect results if the output address size is greater
than 40 bits, as it can be for AArch64.

(Note that we don't yet support the new-in-v8 Address Size fault which
should be generated if any translation table entry or TTBR contains
an address with non-zero bits above the most significant bit of the
maximum output address size.)

Backports commit 6109769a8b42bd0c3d5b1601c9b35fe7ea6a603e from qemu
2018-02-17 18:55:32 -05:00
John Clarke 5c57445f08
tcg: Fix highwater check
A simple typo in the variable to use when comparing vs the highwater mark.
Reports are that qemu can in fact segfault occasionally due to this mistake.

Backports commit 644da9b39e477caa80bab69d2847dfcb468f0d33 from qemu
2018-02-17 18:53:18 -05:00
Daniel P. Berrange 3ba8959dfd
qom: Introduce ObjectPropertyIterator struct for iteration
Some users of QOM need to be able to iterate over properties
defined against an object instance. Currently they are just
directly using the QTAIL macros against the object properties
data structure.

This is bad because it exposes them to changes in the data
structure used to store properties, as well as changes in
functionality such as ability to register properties against
the class.

This provides an ObjectPropertyIterator struct which will
insulate the callers from the particular data structure
used to store properties. It can be used thus

ObjectProperty *prop;
ObjectPropertyIterator *iter;

iter = object_property_iter_init(obj);
while ((prop = object_property_iter_next(iter))) {
... do something with prop ...
}
object_property_iter_free(iter);

Backports commit a00c94824126901168bca5b89147f9e334a49e87 from qemu
2018-02-17 18:39:00 -05:00
Sergey Fedorov 5df03a909c
target-arm: Update condexec before arch BP check in AA32 translation
Architectural breakpoint check could raise an exceptions, thus condexec
bits should be updated before calling gen_helper_check_breakpoints().

Backports commit ce8a1b5449cd8c4c2831abb581d3208c3a3745a0 from qemu
2018-02-17 18:35:50 -05:00
Sergey Fedorov b42bfc59f1
target-arm: Update condexec before CP access check in AA32 translation
Coprocessor access instructions are allowed inside IT block.
gen_helper_access_check_cp_reg() can raise an exceptions thus condexec
bits should be updated before.

Backports commit 43bfa4a100687af8d293fef0a197839b51400fca from qemu
2018-02-17 18:33:58 -05:00
Soren Brinkmann 3f4efdd95e
target-arm: Add and use symbolic names for register banks
Add BANK_<cpumode> #defines to index banked registers.

Backports commit 99a99c1fc8e9bfec1656ac5916c53977a93d3581 from qemu
2018-02-17 18:14:14 -05:00
Eric Blake 085a89bef5
error: More error_setg() usage
A few uses of error_set(ERROR_CLASS_GENERIC_ERROR) were missed in
c6bd8c706, or have snuck in since. Nuke them.

Backports commit 455b0fde8c38a0794743e2e7c1a40018b7bee9f6 from qemu
2018-02-17 18:04:00 -05:00
Dr. David Alan Gilbert 60975685ce
qemu_ram_block_by_name
Add a function to find a RAMBlock by name; use it in two
of the places that already open code that loop; we've
got another use later in postcopy.

Backports commit e3dd74934f2d2c8c67083995928ff68e8c1d0030 from qemu
2018-02-17 18:01:16 -05:00
Dr. David Alan Gilbert cc088f84b5
qemu_ram_block_from_host
Postcopy sends RAMBlock names and offsets over the wire (since it can't
rely on the order of ramaddr being the same), and it starts out with
HVA fault addresses from the kernel.

qemu_ram_block_from_host translates a HVA into a RAMBlock, an offset
in the RAMBlock and the global ram_addr_t value.

Rewrite qemu_ram_addr_from_host to use qemu_ram_block_from_host.

Provide qemu_ram_get_idstr since its the actual name text sent on the
wire.

Backports commit 422148d3e56c3c9a07c0cf36c1e0a0b76f09c357 from qemu
2018-02-17 17:54:03 -05:00
Sergey Fedorov 23ece1622c
target-arm: Clean up DISAS_UPDATE usage in AArch32 translation code
AArch32 translation code does not distinguish between DISAS_UPDATE and
DISAS_JUMP. Thus, we cannot use any of them without first updating PC in
CPU state. Furthermore, it is too complicated to update PC in CPU state
before PC gets updated in disas context. So it is hardly possible to
correctly end TB early if is is not likely to be executed before calling
disas_*_insn(), e.g. just after calling breakpoint check helper.

Modify DISAS_UPDATE and DISAS_JUMP usage in AArch32 translation and
apply to them the same semantic as AArch64 translation does:
- DISAS_UPDATE: update PC in CPU state when finishing translation
- DISAS_JUMP: preserve current PC value in CPU state when finishing
translation

This patch fixes a bug in AArch32 breakpoint handling: when
check_breakpoints helper does not generate an exception, ending the TB
early with DISAS_UPDATE couldn't update PC in CPU state and execution
hangs.

Backports commit 577bf808958d06497928c639efaa473bf8c5e099 from qemu
2018-02-17 17:43:21 -05:00
Sergey Fedorov f8c43c69b2
target-arm: Fix gdb singlestep handling in arm_debug_excp_handler()
Do not raise a CPU exception if no CPU breakpoint has fired, since
singlestep is also done by generating a debug internal exception. This
fixes a bug with singlestepping in gdbstub.

Backports commit 5c629f4ff4dc9ae79cc732f59a8df15ede796ff7 from qemu
2018-02-17 17:32:27 -05:00
Eric Blake 6bd4bc814f
qobject: Protect against use-after-free in qobject_decref()
Adding an assertion to qobject_decref() will ensure that a
programming error causing use-after-free will result in
immediate failure (provided no other thread has started
using the memory) instead of silently attempting to wrap
refcnt around and leaving the problem to potentially bite
later at a harder point to diagnose.

Backports commit cc9f60d4a2a4bf2578a9309a18f1c4602c9f5ce7 from qemu
2018-02-17 17:28:27 -05:00
Xiao Guangrong ba067e4411
target-i386: Add clflushopt/clwb/pcommit to TCG_7_0_EBX_FEATURES
Now these instructions are handled by TCG and can be added to the
TCG_7_0_EBX_FEATURES macro.

Backports commit 0c47242b519a224279f13c685aa6e79347f97b85 from qemu
2018-02-17 17:26:53 -05:00
Eduardo Habkost 4a70bfed55
target-i386: tcg: Check right CPUID bits for clflushopt/pcommit
Detect the clflushopt and pcommit instructions and check their
corresponding feature flags, instead of checking CPUID_SSE and
CPUID_CLFLUSH.

Backports commit 891bc821a3ee462b09b1ec436f2891f00ab1f85b from qemu
2018-02-17 17:25:36 -05:00
Eduardo Habkost 6d0dae872d
target-i386: tcg: Accept clwb instruction
Accept the clwb instruction (66 0F AE /6) if its corresponding feature
flag is enabled on CPUID[7].

Backports commit 5e1fac2dba7780e0cb2c022d4b39586af70bea0d from qemu
2018-02-17 17:23:54 -05:00
Paolo Bonzini 479f36ef8e
exec: avoid unnecessary cacheline bounce on ram_list.mru_block
Whenever the MRU cache hits for the list of RAM blocks, qemu_get_ram_block
does an unnecessary write that causes a processor cache line to bounce
from one core to another. This causes a performance hit.

Backports commit 68851b98e5bf6d397498b74f1776801274ab8d48 from qemu
2018-02-17 17:21:04 -05:00
Peter Maydell e1a4e4208f
pc: resizeable ROM blocks
This makes ROM blocks resizeable. This infrastructure is required for other
functionality we have queued.

Backports commit aaf03019175949eda5087329448b8a0033b89479 from qemu
2018-02-17 17:18:38 -05:00
Michael S. Tsirkin dce38dd8eb
memory: add memory_region_set_size
Add API to change MR size.
Will be used internally for RAM resize.

Backports commit e7af4c67300b3f9382e96f7a6741a5992116b2d2 from qemu
2018-02-17 16:02:26 -05:00
Cao jin 73c55b2eb3
qom/object: fix 2 comment typos
Also change the misleading definition of macro OBJECT_CLASS_CHECK

Backports commit b30d80546421c6ea919096b596887f496c80af0a from qemu
2018-02-17 15:38:14 -05:00
Xiao Guangrong 003b2155a1
target-i386: Enable clflushopt/clwb/pcommit instructions
These instructions are used by NVDIMM drivers and the specification is
located at:
https://software.intel.com/sites/default/files/managed/0d/53/319433-022.pdf

There instructions are available on Skylake Server.

Backports commit f7fda280948a5e74aeb076ef346b991ecb173c56 from qemu
2018-02-17 15:34:57 -05:00
Eduardo Habkost b558a66ba2
target-i386: Remove POPCNT from qemu64 and qemu32 CPU models
POPCNT is not available on Penryn and older and on Opteron_G2 and older,
and we want to make the default CPU runnable in most hosts, so it won't
be enabled by default in KVM mode.

We should eventually have all features supported by TCG enabled by
default in TCG mode, but as we don't have a good mechanism today to
ensure we have different defaults in KVM and TCG mode, disable POPCNT in
the qemu64 and qemu32 CPU models entirely.

Backports commit 6aa91e4a0237ddcebb85e3a95e166f3b3cfa42ae from qemu
2018-02-17 15:33:29 -05:00
Eduardo Habkost 716da652e7
target-i386: Remove ABM from qemu64 CPU model
ABM is not available on Sandy Bridge and older, and we want to make the
default CPU runnable in most hosts, so it won't be enabled by default in
KVM mode.

We should eventually have all features supported by TCG enabled by
default in TCG mode, but as we don't have a good mechanism today to
ensure we have different defaults in KVM and TCG mode, disable ABM in
the qemu64 CPU model entirely.

Backports commit 711956722c6764336f8b78a2106e57c55f02f36d from qemu
2018-02-17 15:32:41 -05:00
Eduardo Habkost d108029fb3
target-i386: Remove SSE4a from qemu64 CPU model
SSE4a is not available in any Intel CPU, and we want to make the default
CPU runnable in most hosts, so it doesn't make sense to enable it by
default in KVM mode.

We should eventually have all features supported by TCG enabled by
default in TCG mode, but as we don't have a good mechanism today to
ensure we have different defaults in KVM and TCG mode, disable SSE4a in
the qemu64 CPU model entirely.

Backports commit 0909ad24b2769368716c85f79fbb995dbb7041a9 from qemu
2018-02-17 15:31:59 -05:00
Paolo Bonzini 3907ea1a3b
cpu-exec: Fix compiler warning (-Werror=clobbered)
Reloading of local variables after sigsetjmp is only needed for some
buggy compilers.

The code which should reload these variables causes compiler warnings
with gcc 4.7 when compiler optimizations are enabled:

cpu-exec.c:204:15: error:
variable ‘cpu’ might be clobbered by ‘longjmp’ or ‘vfork’ [-Werror=clobbered]
cpu-exec.c:207:15: error:
variable ‘cc’ might be clobbered by ‘longjmp’ or ‘vfork’ [-Werror=clobbered]
cpu-exec.c:202:28: error:
argument ‘env’ might be clobbered by ‘longjmp’ or ‘vfork’ [-Werror=clobbered]

Now this code is only used for compilers which need it
(and gcc 4.5.x, x > 0 which does not need it but won't give warnings).

There were bug reports for clang and gcc 4.5.0, while gcc 4.5.1
was reported to work fine without the reload code. For clang it
is not clear which versions are affected, so simply keep the status quo
for all clang compilations. This can be improved later.

Backports commit 0448f5f8b816923b198ab6c32286fd1f3b2f3e45 from qemu
2018-02-17 15:24:15 -05:00
Lioncash ad7663551b
memory: call begin, log_start and commit when registering a new listener
This ensures that cpu_reload_memory_map() is called as soon as
tcg_cpu_address_space_init() is called, and before cpu->memory_dispatch
is used. qemu-system-s390x never changes the address spaces after
tcg_cpu_address_space_init() is called, and thus tcg_commit() is never
called. This causes a SIGSEGV.

Because memory_map_init() will now call mem_commit(), we have to
initialize io_mem_* before address_space_memory and friends.

Backports commit 680a4783dc13f1059c03d11da58193d76c19ead6 from qemu
2018-02-17 15:24:15 -05:00
Paolo Bonzini c2c3a800ad
ioport: do not use CPU_LOG_IOPORT
These messages are disabled by default; a perfect usecase for tracepoints,
which in fact already exist. Add the missing information to them and
stop using qemu_log_mask.

Backports commit 6f94b7d97f7e0e486a70fb06b703442e2c04a29a from qemu
2018-02-17 15:24:15 -05:00
Paolo Bonzini 2e6770c643
target-i386: fix pcmpxstrx equal-ordered (strstr) mode
In this mode, referring an invalid element of the source forces the
result to false (table 4-7, last column) but referring an invalid
element of the destination forces the result to true, so the outer
loop should still be run even if some elements of the destination
will be invalid. They will be avoided in the inner loop, which
correctly bounds "i" to validd, but they will still contribute to a
positive outcome of the search.

This fixes tst_strstr in glibc 2.17.

Backports commit 54c54f8b56047d3c2420e1ae06a6a8890c220ac4 from qemu
2018-02-17 15:24:15 -05:00
Eduardo Habkost 9c26efb406
vl.c: Remove periods and exclamation points from error messages
Except for removing periods and exclamation points, no other changes
were made to the error messages (yet).

Backports relevant parts of commit 8afb900030b93122a40ef4a636d02ba888bdce12 from qemu
2018-02-17 15:24:14 -05:00
Eduardo Habkost 7343fe51d1
vl.c: Replace fprintf(stderr) with error_report()
Straightforward replacement, except for qemu_kill_report(), which
printed a common part of its error message first, then the applicable
special part. Print each complete message with a single
error_report() instead.

Multi-line messages were replaced by error_report() followed by
error_printf().

The following changes were made to the error messages:

* The "invalid date format" message was reworded to better fit
the new error_report()+error_printf() pattern.
* On the remaining messages, only the trailing newlines, "qemu:" and
"error:" message prefixes were removed.

Backports relevant parts of commit f61eddcb2bb5cbbdd1d911b7e937db9affc29028 from qemu
2018-02-17 15:24:14 -05:00
Peter Maydell 0ed5787f89
target-arm: Report S/NS status in the CPU debug logs
If this CPU supports EL3, enhance the printing of the current
CPU mode in debug logging to distinguish S from NS modes as
appropriate.

Backports commit 06e5cf7acd1f94ab7c1cd6945974a1f039672940 from qemu
2018-02-17 15:24:14 -05:00
Peter Maydell 78d26764b7
target-arm: Bring AArch64 debug CPU display of PSTATE into line with AArch32
The AArch64 debug CPU display of PSTATE as "PSTATE=200003c5 (flags --C-)"
on the end of the same line as the last of the general purpose registers
is unnecessarily different from the AArch32 display of PSR as
"PSR=200001d3 --C- A svc32" on its own line. Update the AArch64
code to put PSTATE in its own line and in the same format, including
printing the exception level (mode).

Backports commit 08b8e0f527930208a548b424d2ab3103bf3c8c02 from qemu
2018-02-17 15:24:14 -05:00
Yongbok Kim 6212fb2dc7
target-mips: fix updating XContext on mmu exception
Correct updating XContext.Region field on mmu exceptions.
If Config3.CTXTC = 0 then the R field of XContext has to be updated
with the value of bits 63..62 of the virtual address upon a TLB
exception.
Also fixed the below line which overs 80 characters.

Backports commit 60270f85cc93d2d34e45b7679c374b1d771f0eeb from qemu
2018-02-17 15:24:14 -05:00
Yongbok Kim d4213b6389
target-mips: add SIGRIE instruction
Add SIGRIE (Signal Reserved Instruction Exception) for both MIPS and
microMIPS.
The instruction allows to use the 16-bit code field for software use.
This instruction is introduced by and required as of Release 6.

Backports commit bb238210bb096534b68dab15a87c6ff0bef43672 from qemu
2018-02-17 15:24:13 -05:00
Yongbok Kim 4544aa4134
target-mips: Set Config5.XNP for R6 cores
Set Config5.XNP for R6 cores to indicate the extended LL/SC family
of instructions NOT present.

Backports commit 35ac9e342e008e3d47ef18d33a6977fdb99de9cd from qemu
2018-02-17 15:24:13 -05:00
Yongbok Kim 4a9cd8ec0b
target-mips: add PC, XNP reg numbers to RDHWR
Add Performance Counter (4) and XNP (5) register numbers to RDHWR.
Add check_hwrena() to simplify access control checkings.
Add RDHWR support to microMIPS R6.

Backports commit b00c72180c36510bf9b124e190bd520e3b7e1358 from qemu
2018-02-17 15:24:13 -05:00
Yongbok Kim 3b000e4eb3
target-mips: Add enum for BREAK32
Add enum for BREAK32

Backports commit dbd8af9824d0ddc4400f859c2af77543461cba0d from qemu
2018-02-17 15:24:13 -05:00
Leon Alrae b59c9c0e2c
target-mips: update writing to CP0.Status.KX/SX/UX in MIPS Release R6
Implement the relationship between CP0.Status.KX, SX and UX. It should not
be possible to set UX bit if SX is 0, the same applies for setting SX if
KX is 0.

Backports commit 2dcf7908d9e0274c08911400beb7ed14276bb170 from qemu
2018-02-17 15:24:12 -05:00
Leon Alrae cab0efb406
target-mips: implement the CPU wake-up on non-enabled interrupts in R6
In Release 6, the behaviour of WAIT has been modified to make it a
requirement that a processor that has disabled operation as a result of
executing a WAIT will resume operation on arrival of an interrupt even if
interrupts are not enabled.

Backports commit 7540a43a1d9de71fa7a53ccd2bb24a04e2aace41 from qemu
2018-02-17 15:24:12 -05:00
Leon Alrae 5a60450b96
target-mips: move the test for enabled interrupts to a separate function
Backports commit 71ca034a0dee69f77c8ac6ea7d21e5b6a0b0d836 from qemu
2018-02-17 15:24:12 -05:00
Markus Armbruster b9cf91307e
qstring: Make conversion from QObject * accept null
qobject_to_qstring() crashes on null, which is a trap for the unwary.
Return null instead, and simplify a few callers.

Backports commit 7f0278435df1fa845b3bd9556942f89296d4246b from qemu
2018-02-17 15:24:12 -05:00
Markus Armbruster d25b8420d0
qlist: Make conversion from QObject * accept null
qobject_to_qlist() crashes on null, which is a trap for the unwary.
Return null instead.

Backports commit 2d6421a90047a83f6722832405fe09571040ea5b from qemu
2018-02-17 15:24:12 -05:00
Markus Armbruster 218e3ab5d5
qfloat qint: Make conversion from QObject * accept null
qobject_to_qfloat() and qobject_to_qint() crash on null, which is a
trap for the unwary. Return null instead, and simplify a few callers.

Backports commit fcf73f66a67f5e58c18216f8c8651e38cf4d90af from qemu
2018-02-17 15:24:12 -05:00
Markus Armbruster 3f0b32f1ee
qdict: Make conversion from QObject * accept null
qobject_to_qdict() crashes on null, which is a trap for the unwary.
Return null instead, and simplify a few callers.

Backports commit 89cad9f3ec6b30d7550fb5704475fc9c3393a066 from qemu
2018-02-17 15:24:11 -05:00
Markus Armbruster 41ca5bddb8
qbool: Make conversion from QObject * accept null
qobject_to_qbool() crashes on null, which is a trap for the unwary.
Return null instead, and simplify a few callers.

Backports commit 14b6160099f0caf5dc9d62e637b007bc5d719a96 from qemu
2018-02-17 15:24:11 -05:00
Michael S. Tsirkin bdbaeb4b9b
mmap-alloc: fix error handling
Existing callers are checking for MAP_FAILED,
so we should return that on error.

Backports commit 9d4ec9370a36f8a564e1ba05519328c0bd60da13 from qemu
2018-02-17 15:24:11 -05:00
Richard Henderson c01a6dab0a
target-*: Advance pc after recognizing a breakpoint
Some targets already had this within their logic, but make sure
it's present for all targets.

Backports commit 522a0d4e3c0d397ffb45ec400d8cbd426dad9d17 from qemu
2018-02-17 15:24:11 -05:00
Richard Henderson 3ec0adcc07
target-*: Introduce and use cpu_breakpoint_test
Reduce the boilerplate required for each target. At the same time,
move the test for breakpoint after calling tcg_gen_insn_start.

Note that arm and aarch64 do not use cpu_breakpoint_test, but still
move the inline test down after tcg_gen_insn_start.

Backports commit b933066ae03d924a92b2616b4a24e7d91cd5b841 from qemu
2018-02-17 15:24:10 -05:00
Eduardo Habkost 67f13016b3
target-i386: Don't left shift negative constant
Left shift of negative values is undefined behavior. Detected by clang:
qemu/target-i386/translate.c:2423:26: runtime error:
left shift of negative value -8

This changes the code to reverse the sign after the left shift.

Backports commit 712b4243c761cb6ab6a4367a160fd2a42e2d4b76 from qemu
2018-02-17 15:24:10 -05:00
Edgar E. Iglesias 942c18ead7
target-arm: Add support for S1 + S2 MMU translations
Backports commit 9b539263faa5c1b7fce2551092b5c7b6eea92081 from qemu
2018-02-17 15:24:10 -05:00
Edgar E. Iglesias 753a530ac8
target-arm: Route S2 MMU faults to EL2
Backports commit d759a457a144844bff259aafda093b24e92c116d from qemu
2018-02-17 15:24:10 -05:00
Edgar E. Iglesias f779375656
target-arm: Add S2 translation to 32bit S1 PTWs
Add support for applying S2 translation to 32bit S1
page-table walks.

Backports commit a614e69854a2e601716ee44dfe15c09b8b88f620 from qemu
2018-02-17 15:24:10 -05:00
Edgar E. Iglesias 085a94faac
target-arm: Add S2 translation to 64bit S1 PTWs
Add support for applying S2 translation to 64bit S1
page-table walks.

Backports commit 37785977627295162bff58b1f8777d94e20f4c5b from qemu
2018-02-17 15:24:09 -05:00
Edgar E. Iglesias 716f1ac28c
target-arm: Add ARMMMUFaultInfo
Introduce ARMMMUFaultInfo to propagate MMU Fault information
across the MMU translation code path. This is in preparation for
adding Stage-2 translation.

No functional changes.

Backports commit e14b5a23d8c83304559f31397f95d22ada60a19a from qemu
2018-02-17 15:24:09 -05:00
Edgar E. Iglesias 9156b8f3ce
target-arm: Avoid inline for get_phys_addr
Avoid inline for get_phys_addr() to prepare for future recursive use.

Backports commit af51f566ec7106d5e834476e78681a7b354f3c7c from qemu
2018-02-17 15:24:09 -05:00
Edgar E. Iglesias 9f5af4cb22
target-arm: Add support for S2 page-table protection bits
Backports commit 6ab1a5ee1c9d328cacf78805439ed4d3d132decd from qemu
2018-02-17 15:24:09 -05:00
Edgar E. Iglesias bf0313353e
target-arm: Add computation of starting level for S2 PTW
The starting level for S2 pagetable walks is computed
differently from the S1 starting level. Implement the S2
variant.

Backports commit 1853d5a9dcac910322c6cc5b2fddec45fd052d25 from qemu
2018-02-17 15:24:09 -05:00
Edgar E. Iglesias f63705e614
target-arm: lpae: Rename granule_sz to stride
Rename granule_sz to stride to better match the reference manuals.

No functional change.

Backports commit 973a5434825c076995218868b5b3047e5de400c6 from qemu
2018-02-17 15:24:08 -05:00
Edgar E. Iglesias 0323d25f86
target-arm: lpae: Replace tsz with computed inputsize
Remove the tsz variable and introduce inputsize.
This simplifies the code a little and makes it easier to
compare with the reference manuals.

No functional change.

Backports commit 4ca6a051758edf625a17dfc4ce4ab72edabac170 from qemu
2018-02-17 15:24:08 -05:00
Edgar E. Iglesias a33fca93b3
target-arm: Add support for AArch32 S2 negative t0sz
Add support for AArch32 S2 negative t0sz. In preparation for
using 40bit IPAs on AArch32.

Backports commit 4ee38098010240e0b390061fdd0151ff62d80279 from qemu
2018-02-17 15:24:08 -05:00
Edgar E. Iglesias 7be3cda1ea
target-arm: lpae: Move declaration of t0sz and t1sz
Move declaration of t0sz and t1sz to the top of the function
avoiding a mix of code and variable declarations.

No functional change.

Backports commit 1f4c8c18a5b6f4fad13e13b7e3828124c6c8f34d from qemu
2018-02-17 15:24:08 -05:00
Edgar E. Iglesias 0c1c636b96
target-arm: lpae: Make t0sz and t1sz signed integers
Make t0sz and t1sz signed integers to match tsz and to make
it easier to implement support for AArch32 negative t0sz.
t1sz is changed for consistensy.

No functional change.

Backports commit 5c31a10d16c595d6a59e3e7fc1808c3b1d03e02f from qemu
2018-02-17 15:24:07 -05:00
Edgar E. Iglesias 7409da7a4e
target-arm: Add HPFAR_EL2
Backports commit 59e055307392fdf99b86c8cbcd33a7e261dcbdb1 from qemu
2018-02-17 15:24:07 -05:00
Soren Brinkmann 9432e3a285
target-arm: Add support for SPSR_(ABT|UND|IRQ|FIQ)
Backports commit b876452507d0b719cff0b478efafb34ac41db683 from qemu
2018-02-17 15:24:07 -05:00
Peter Maydell 93386e2dd4
target-arm/translate.c: Handle non-executable page-straddling Thumb insns
When the memory we're trying to translate code from is not executable we have
to turn this into a guest fault. In order to report the correct PC for this
fault, and to make sure it is not reported until after any other possible
faults for instructions earlier in execution, we must terminate TBs at
the end of a page, in case the next instruction is in a non-executable page.
This is simple for T16, A32 and A64 instructions, which are always aligned
to their size. However T32 instructions may be 32-bits but only 16-aligned,
so they can straddle a page boundary.

Correct the condition that checks whether the next instruction will touch
the following page, to ensure that if we're 2 bytes before the boundary
and this insn is T32 then we end the TB.

Backports commit 541ebcd401ee47f3c1a3ce503ef5466b75e9d20a from qemu
2018-02-17 15:24:07 -05:00
Peter Maydell 91941f8d3c
target-arm: Fix "no 64-bit EL2" assumption in arm_excp_unmasked()
The code in arm_excp_unmasked() suppresses the ability of PSTATE.AIF
to mask exceptions from a lower EL targeting EL2 or EL3 if the
CPU is 64-bit. This is correct for a target of EL3, but not correct
for targeting EL2. Further, we go to some effort to calculate
scr and hcr values which are not used at all for the 64-bit CPU
case.

Rearrange the code to correctly implement the 64-bit CPU logic
and keep the hcr/scr calculations in the 32-bit CPU codepath.

Backports commit 7cd6de3bb1ca55dfa8f53fb9894803eb33f497b3 from qemu
2018-02-17 15:24:07 -05:00
Eduardo Habkost 828d48d077
target-i386: Use 1UL for bit shift
Fix undefined behavior detected by clang runtime check:

qemu/target-i386/cpu.c:1494:15: runtime error:
left shift of 1 by 31 places cannot be represented in type 'int'

While doing that, add extra parenthesis for clarity.

Backports commit 72370dc1149d7c90d2c2218e0d0658bee23a5bf7 from qemu
2018-02-17 15:24:06 -05:00
Eduardo Habkost feb90cf413
target-i386: Add DE to TCG_FEATURES
Now DE is supported by TCG so it can be enabled in CPUID bits.

Backports commit b6c5a6f021f485fc36bca678b2c867e9b6783924 from qemu
2018-02-17 15:24:06 -05:00
Richard Henderson fcc9dbc103
target-i386: Check CR4[DE] for processing DR4/DR5
Introduce helper_get_dr so that we don't have to put CR4[DE]
into the scarce HFLAGS resource. At the same time, rename
helper_movl_drN_T0 to helper_set_dr and set the helper flags.

Backports commit d0052339236072bbf08c1d600c0906126b1ab258 from qemu
2018-02-17 15:24:06 -05:00
Eduardo Habkost c6bfe2a03d
target-i386: Handle I/O breakpoints
Backports commit 5223a9423c5fb9e32b0c3eaaa2c0bf8c5cfd6866 from qemu
2018-02-17 15:24:06 -05:00
Richard Henderson d1cfcb6d79
target-i386: Optimize setting dr[0-3]
If the debug register is not enabled, we need
do nothing besides update the register.

Backports commit 7525b55051277717329cf64a9e1d5cff840d6f38 from qemu
2018-02-17 15:24:06 -05:00
Richard Henderson 805e0ba7b2
target-i386: Move hw_*breakpoint_* functions
They're only used from bpt_helper.c now.

Backports commit 696ad9e4b27a49a9706010d00b31b17fe1f0d569 from qemu
2018-02-17 15:24:05 -05:00
Eduardo Habkost e88063fa05
target-i386: Ensure bit 10 on DR7 is never cleared
Bit 10 of DR7 is documented as always set to 1, so ensure that's
always the case.

Backports commit 9055330ffbf5ca85f024c29874799d9c8bd17aa9 from qemu
2018-02-17 15:24:05 -05:00
Richard Henderson 77b129a1c6
target-i386: Re-introduce optimal breakpoint removal
Before the last patch, we had an efficient loop that disabled
local breakpoints on task switch. Re-add that, but in a more
general way that handles changes to the global enable bits too.

Backports commit 36eb6e096729f9aade3a6af7dbe4d0a990335d7e from qemu
2018-02-17 15:24:05 -05:00
Richard Henderson 0ad95f8341
target-i386: Introduce cpu_x86_update_dr7
This moves the last of the iteration over breakpoints into
the bpt_helper.c file. This also allows us to make several
breakpoint functions static.

Backports commit 93d00d0fbe4711061834730fb70525d167b6f908 from qemu
2018-02-17 15:24:05 -05:00
Paolo Bonzini c5c44f3a8a
target-i386: allow any alignment for SMBASE
Processors up to the Pentium (says Bochs---I do not have old enough
manuals) require a 32KiB alignment for the SMBASE, but newer processors
do not need that, and Tiano Core will use non-aligned SMBASE values.

Backports commit dd75d4fcb4a82c34d4f466e7fc166162b71ff740 from qemu
2018-02-17 15:24:05 -05:00
Antony Pavlov 924d4599cc
qemu-log: add log category for MMU info
Running barebox on qemu-system-mips* with '-d unimp' overloads
stderr by very very many mips_cpu_handle_mmu_fault() messages:

  mips_cpu_handle_mmu_fault address=b80003fd ret 0 physical 00000000180003fd prot 3
  mips_cpu_handle_mmu_fault address=a0800884 ret 0 physical 0000000000800884 prot 3
  mips_cpu_handle_mmu_fault pc a080cd80 ad b80003fd rw 0 mmu_idx 0

So it's very difficult to find LOG_UNIMP message.

The mips_cpu_handle_mmu_fault() messages appear on enabling ANY
logging! It's not very handy.

Adding separate log category for *_cpu_handle_mmu_fault()
logging fixes the problem.

Backports commit 339aaf5b7f26d1e638641c59a44883b7654bd8ea from qemu
2018-02-17 15:24:05 -05:00
Richard Henderson e9e8833da4
cpu-exec: Add nochain debug flag
Respect it to avoid linking TBs together.

Backports commit 89a82cd4b6a90fe117fa715e2abe51d5c607560c from qemu
2018-02-17 15:24:04 -05:00
Lioncash a2e7d86ccf
tcg/mips: Support r6 SEL{NE, EQ}Z instead of MOVN/MOVZ
Extend MIPS movcond implementation to support the SELNEZ/SELEQZ
instructions introduced in MIPS r6 (where MOVN/MOVZ have been removed).

Whereas the "MOVN/MOVZ rd, rs, rt" instructions have the following
semantics:
rd = [!]rt ? rs : rd

The "SELNEZ/SELEQZ rd, rs, rt" instructions are slightly different:
rd = [!]rt ? rs : 0

First we ensure that if one of the movcond input values is zero that it
comes last (we can swap the input arguments if we invert the condition).
This is so that it can exactly match one of the SELNEZ/SELEQZ
instructions and avoid the need to emit the other one.

Otherwise we emit the opposite instruction first into a temporary
register, and OR that into the result:
SELNEZ/SELEQZ TMP1, v2, c1
SELEQZ/SELNEZ ret, v1, c1
OR ret, ret, TMP1

Which does the following:
ret = cond ? v1 : v2

Backports commit 137d63902faf4960081856db9242cbaf234a23af from qemu
2018-02-17 15:24:04 -05:00
James Hogan e71d19df81
tcg/mips: Support r6 multiply/divide encodings
MIPSr6 adds several new integer multiply, divide, and modulo
instructions, and removes several pre-r6 encodings, along with the HI/LO
registers which were the implicit operands of some of those
instructions. Update TCG to use the new instructions when built for r6.

The new instructions actually map much more directly to the TCG ops, as
they only provide a single 32-bit half of the result and in a normal
general purpose register instead of HI or LO.

The mulu2_i32 and muls2_i32 operations are no longer appropriate for r6,
so they are removed from the TCG opcode table. This is because they
would need to emit two separate host instructions anyway (for the high
and low half of the result), which TCG can arrange automatically for us
in the absense of mulu2_i32/muls2_i32 by splitting it into mul_i32 and
mul*h_i32 TCG ops.

Backports commit bc6d0c22b09a72897d9db4482076f89e7de97400 from qemu
2018-02-17 15:24:04 -05:00
James Hogan 9dac598855
tcg/mips: Support r6 JR encoding
MIPSr6 encodes JR as JALR with zero as the link register, and the pre-r6
JR encoding is removed. Update TCG to use the new encoding when built
for r6.

We still use the old encoding for pre-r6, so as not to confuse return
prediction stack hardware which may detect only particular encodings of
the return instruction.

Backports commit 6e0d096989be52c2b945fc83a9bd15d887bbdb47 from qemu
2018-02-17 15:24:04 -05:00
James Hogan 7f1bc28513
tcg/mips: Add use_mips32r6_instructions definition
Add definition use_mips32r6_instructions to the MIPS TCG backend which
is constant 1 when built for MIPS release 6. This will be used to decide
between pre-R6 and R6 instruction encodings.

Backports commit ce14bd4d469f3a14f6cbfceb6360aee066a60d72 from qemu
2018-02-17 15:24:04 -05:00
James Hogan 9d3a2feea0
tcg-opc.h: Simplify insn_start def
We already have a TLADDR_ARGS definition, so rearrange the order
slightly and use it in the definition of insn_start, instead of
having an #ifdef.

Backports commit c0e40dbdcc291c85faa289a53be60b7b1b7c7598 from qemu
2018-02-17 15:24:03 -05:00
Richard Henderson d167379211
tcg/ppc: Prefer mask over andi.
Prefer the instruction that isn't required to modify cr0.

Backports commit 1e1df962e325e18a5188c4814cd1a10215a48f79 from qemu
2018-02-17 15:24:03 -05:00
Richard Henderson 3c3dee3747
tcg/ppc: Revise goto_tb implementation
Restrict the size of code_gen_buffer to 2GB on ppc64, which
lets us assert that everything is reachable with addis+addi
from tb_ret_addr. This lets us use a max of 4 insns for goto_tb
instead of 7.

Emit the indirect branch portion of goto_tb up front, which
means we only have to update two insns to update any link.
With a 64-bit store, we can update the link atomically, which
may be required in future.

Backports commit 5bfd75a35c11dd3aa61c73d0d2cd88137c31519c from qemu
2018-02-17 15:24:03 -05:00
Richard Henderson 13ad21a21f
tcg/ppc: Adjust exit_tb for change in prologue placement
Changing the prologue to the beginning of the code_gen_buffer
changes the direction of the "return" branch. Need to change
the logic to match.

Backports commit 70f897bdc4ce4101ec008317d43090f532bfb07d from qemu
2018-02-17 15:24:03 -05:00
Michael S. Tsirkin 722c58affb
exec: factor out duplicate mmap code
Anonymous and file-backed RAM allocation are now almost exactly the same.

Reduce code duplication by moving RAM mmap code out of oslib-posix.c and
exec.c.

Backports commit 794e8f301a17953efa78ab7538019ec43c59e82a from qemu
2018-02-17 15:24:03 -05:00
Sergey Fedorov e4e0c75f0f
target-arm: Fix CPU breakpoint handling
A QEMU breakpoint match is not definitely an architectural breakpoint
match. If an exception is generated unconditionally during translation,
it is hardly possible to ignore it in the debug exception handler.

Generate a call to a helper to check CPU breakpoints and raise an
exception only if any breakpoint matches architecturally.

Backports commit 5d98bf8f38c17a348ab6e8af196088cd4953acd0 from qemu
2018-02-17 15:24:02 -05:00
Sergey Fedorov 4706e10887
target-arm: Fix GDB breakpoint handling
GDB breakpoints have higher priority so they have to be checked first.
Should GDB breakpoint match, just return from the debug exception
handler.

Backports commit e63a2d4d9ed73e33a0b7483085808048be8bbcb1 from qemu
2018-02-17 15:24:02 -05:00
Sergey Fedorov cb04e919ab
target-arm: implement arm_debug_target_el()
Implement debug exception routing according to ARM ARM D2.3.1 Pseudocode
description of routing debug exceptions.

Backports commit 81669b8b81eb450d7b89ee5fdd57bdb73d87022d from qemu
2018-02-17 15:24:02 -05:00
Sergey Fedorov 9b5cd0cec1
target-arm: Add MDCR_EL2
Add the MDCR_EL2 register. We don't implement any of
the debug-related traps this register controls yet, so
currently it simply reads back as written.

Backports commit 14cc7b54372995a6ba72c7719372e4f710fc9b5a from qemu
2018-02-17 15:24:02 -05:00
Davorin Mista cc2e6fc4e4
target-arm: Implement AArch64 OSLAR/OSLSR_EL1 sysregs
Added oslar_write function to OSLAR_EL1 sysreg, using a status variable
in ARMCPUState.cp15 struct (oslsr_el1). This variable is also linked
to the newly added read-only OSLSR_EL1 register.

Linux reads from this register during its suspend/resume procedure.

Backports commit 1424ca8d4320427c3e93722b65e19077969808a2 from qemu
2018-02-17 15:24:01 -05:00
Sergey Sorokin 1152631b4b
target-arm: Avoid calling arm_el_is_aa64() function for unimplemented EL
It is incorrect to call arm_el_is_aa64() function for unimplemented EL.
This patch fixes several attempts to do so.

Backports commit 2cde031f5a34996bab32571a26b1a6bcf3e5b5d9 from qemu
2018-02-17 15:24:01 -05:00
Sergey Sorokin 04992f0fb3
target-arm: Break the TB after ISB to execute self-modified code correctly
If any store instruction writes the code inside the same TB
after this store insn, the execution of the TB must be stopped
to execute new code correctly.
As described in ARMv8 manual D3.4.6 self-modifying code must do an
IC invalidation to be valid, and an ISB after it. So it's enough to end
the TB after ISB instruction on the code translation.
Also this TB break is necessary to take any pending interrupts immediately
after an ISB (as required by ARMv8 ARM D1.14.4).

Backports commit 6df99dec9e81838423d723996e96236693fa31fe from qemu
2018-02-17 15:24:01 -05:00
Stefan Weil d1bba24d86
target-arm: Add missing 'static' attribute
Backports commit 82c39f6a8898b028515eddcdbc4ae50959d0af5d from qemu
2018-02-17 15:24:01 -05:00
Richard Henderson a276496ebc
tcg: Adjust CODE_GEN_AVG_BLOCK_SIZE
At present, the "average" guestimate of TB size is way too small, leading
to many unused entries in the pre-allocated TB array. For a guest with 1GB
ram, we're currently allocating 256MB for the array.

Survey arm, alpha, aarch64, ppc, sparc, i686, x86_64 guests running on
x86_64 and ppc64 hosts and select a new average. The size of the array
drops to 81MB with no more flushing than before.

Backports commit 126d89e8cdfa3be15d51f76906eaccbcd0023f98 from qemu
2018-02-17 15:24:01 -05:00
Richard Henderson bdf667fd4e
tcg: Check for overflow via highwater mark
We currently pre-compute an worst case code size for any TB, which
works out to be 122kB. Since the average TB size is near 1kB, this
wastes quite a lot of storage.

Instead, check for overflow in between generating code for each opcode.
The overhead of the check isn't measurable and wastage is minimized.

Backports commit b125f9dc7bd68cd4c57189db4da83b0620b28a72 from qemu
2018-02-17 15:24:00 -05:00
Richard Henderson 71221baf40
tcg: Allocate a guard page after code_gen_buffer
This will catch any overflow of the buffer.

Add a native win32 alternative for alloc_code_gen_buffer;
remove the malloc alternative.

Backports commit f293709c6af7a65a9bcec09cdba7a60183657a3e from qemu
2018-02-17 15:24:00 -05:00
Richard Henderson 19a3c7e03f
tcg: Emit prologue to the beginning of code_gen_buffer
By putting the prologue at the end, we risk overwriting the
prologue should our estimate of maximum TB size. Given the
two different placements of the call to tcg_prologue_init,
move the high water mark computation into tcg_prologue_init.

Backports commit 8163b74938d8b7d12e70597c4553dd0dc49443d5 from qemu
2018-02-17 15:24:00 -05:00
Richard Henderson 532877a366
tcg: Remove tcg_gen_code_search_pc
It's no longer used, so tidy up everything reached by it.

Backports commit 04fe64000162c45d8974da9ca4d266f8d0e67eb7 from qemu
2018-02-17 15:24:00 -05:00
Lioncash f0f8d5764a
target-m68k: Silence unused variable warning 2018-02-17 15:24:00 -05:00
Richard Henderson a5ac288135
tcg: Remove gen_intermediate_code_pc
It is no longer used, so tidy up everything reached by it.
This includes the gen_opc_* arrays, the search_pc parameter
and the inline gen_intermediate_code_internal functions.

Backports commit 4e5e1215156662b2b153255c49d4640d82c5568b from qemu
2018-02-17 15:23:59 -05:00
Richard Henderson 66de6cc37c
tcg: Save insn data and use it in cpu_restore_state_from_tb
We can now restore state without retranslation.

Backports commit fca8a500d519a56abeaedf8073167a61d3c6b9c4 from qemu
2018-02-17 15:23:59 -05:00
Richard Henderson a7cf761caf
tcg: Merge cpu_gen_code into tb_gen_code
As it's only caller, this tidies things a bit.

Backports commit fec88f64bda27846add83e924c8f4def9d94e068 from qemu
2018-02-17 15:23:59 -05:00
Paolo Bonzini 268275f04b
translate: check cflags instead of use_icount global
Backports applicable parts of commit bd79255d2571a3c68820117caf94ea9afe1d527e
2018-02-17 15:23:59 -05:00
Paolo Bonzini cab4c979f0
cpu-exec: add a new CF_USE_ICOUNT cflag
Backports commit 0266359e57987d6be53fbcb885f2dd39c1dae940 from qemu
2018-02-17 15:23:58 -05:00
Pavel Dovgalyuk ac46898b3c
cpu-exec: invalidate nocache translation if they are interrupted
In this case, QEMU might longjmp out of cpu-exec.c and miss the final
cleanup in cpu_exec_nocache.  Do this manually through a new compile
flag.

Backports commit d8a499f17ee5f05407874f29f69f0e3e3198a853 from qemu
2018-02-17 15:23:58 -05:00
Richard Henderson 1cbd175736
tcg: Pass data argument to restore_state_to_opc
The gen_opc_* arrays are already redundant with the data stored in
the insn_start arguments. Transition restore_state_to_opc to use
data from the latter.

Backports commit bad729e272387de7dbfa3ec4319036552fc6c107 from qemu
2018-02-17 15:23:58 -05:00
Lioncash b115c5509d
tcg: Add TCG_MAX_INSNS
Adjust all translators to respect it.

Backports commit 190ce7fbc79fd0883a6170d7f30da59d366e6830 from qemu
2018-02-17 15:23:58 -05:00
Lioncash f8d54a8f3c
Drop unused crypto source files 2018-02-17 15:23:57 -05:00
Richard Henderson 5637099383
target-*: Drop cpu_gen_code define
This symbol no longer exists.

Backports commit dc03246cc377268db63abc8c5663ef571aec2eea from qemu
2018-02-17 15:23:57 -05:00
Richard Henderson 25e0621757
target-sparc: Add npc state to insn_start
Backports commit a3d5ad761cafc669e25f4185e63d8d758a989135 from qemu
2018-02-17 15:23:57 -05:00
Richard Henderson 2c1ae7a408
target-sparc: Remove gen_opc_jump_pc
Since jump_pc[1] is always npc + 4, we can infer after incrementing
that jump_pc[1] == pc + 4. Because of that, we can encode the branch
destination into a single word, and store that in npc.

Backports commit 6c42444f9a53b6af39d46008cb9f650b11e96cb9 from qemu
2018-02-17 15:23:56 -05:00
Richard Henderson b709d15b13
target-sparc: Split out gen_branch_n
Unify three copies of this code from different
branch types. Fix the case when npc == DYNAMIC_PC,
i.e. a branch within a delay slot.

Backports commit 2bf2e019ed0a6349220620240c0ba807846793b9 from qemu
2018-02-17 15:23:56 -05:00
Richard Henderson ee918c940c
target-sparc: Tidy gen_branch_a interface
We always pass pc2 == dc->npc and r_cond == cpu_cond,
and always set is_br afterward. Infer all of that.

Backports commit bfa31b765798139804ce9e5e35c7e142d233df31 from qemu
2018-02-17 15:23:56 -05:00
Richard Henderson f05c35c49c
target-i386: Add cc_op state to insn_start
Backports commit 2066d09516ba34d0d180fdea451436d9babb3308 from qemu
2018-02-17 15:23:56 -05:00
Richard Henderson 500e116581
target-mips: Add delayed branch state to insn_start
Backports commit c20d594e45bc8c4b21be1a7637cba0f279f72879 from qemu
2018-02-17 15:23:56 -05:00
Paolo Bonzini 96e0535c76
target-i386: add ABM to Haswell* and Broadwell* CPU models
ABM is only implemented as a single instruction set by AMD; all AMD
processors support both instructions or neither. Intel considers POPCNT
as part of SSE4.2, and LZCNT as part of BMI1, but Intel also uses AMD's
ABM flag to indicate support for both POPCNT and LZCNT. It has to be
added to Haswell and Broadwell because Haswell, by adding LZCNT, has
completed the ABM.

Tested with "qemu-kvm -cpu Haswell-noTSX,enforce" (and also with older
machine types) on an Haswell-EP machine.

Backports commit becb66673ec30cb604926d247ab9449a60ad8b11 from qemu
2018-02-17 15:23:55 -05:00
Bill Paul 5b14f0ed52
Correctly re-init EFER state during INIT IPI
When doing a re-initialization of a CPU core, the default state is to _not_
have 64-bit long mode enabled. This means the LME (long mode enable) and LMA
(long mode active) bits in the EFER model-specific register should be cleared.

However, the EFER state is part of the CPU environment which is
preserved by do_cpu_init(), so if EFER.LME and EFER.LMA were set at the
time an INIT IPI was received, they will remain set after the init completes.

This is contrary to what the Intel architecture manual describes and what
happens on real hardware, and it leaves the CPU in a weird state that the
guest can't clear.

To fix this, the 'efer' member of the CPUX86State structure has been moved
to an area outside the region preserved by do_cpu_init(), so that it can
be properly re-initialized by x86_cpu_reset().

Backports commit 2188cc52cb363433751f72b991d8fb05fc60e39d from qemu
2018-02-17 15:23:55 -05:00
Lioncash da8e73b887
qom/cpu: Add throttle_thread_scheduled member
Extracts the member out of commit 2adcc85d407c1ab985f5abed808c78dbb84f4773
2018-02-17 15:23:55 -05:00
Peter Crosthwaite 1faea35feb
i386: Rename ELF_MACHINE to be x86 specific
Rename ELF_MACHINE to be I386 specific. This is used as-is by the
multiboot loader.

Linux-user previously used this definition but will not anymore,
falling back to the default bahaviour of using ELF_ARCH as ELF_MACHINE.

This removes another architecture specific definition from the global
namespace.

Backports commit a5e8788f89312f19f54dba0454ee5bf7209b4cd7 from qemu
2018-02-17 15:23:55 -05:00
Peter Crosthwaite 95bcb2f144
mips: Remove ELF_MACHINE from cpu.h
The only generic code relying on this is linux-user, but linux users'
default behaviour of defaulting ELF_MACHINE to ELF_ARCH will handle
this.

The bootloaders can just pass EM_MIPS directly, as that is
architecture specific code.

This removes another architecture specific definition from the global
namespace.

Backports commit 04ce380e9e3fad1dbf4e86ebdf9315573a06b30e from qemu
2018-02-17 15:23:55 -05:00
Peter Crosthwaite 23dc795806
sparc: Remove ELF_MACHINE from cpu.h
The bootloaders can just pass EM_SPARC or EM_SPARCV9 directly, as
they are architecture specific code (to one or the other).

This removes another architecture specific definition from the global
namespace.

Backports commit 77452383e0c45704e2339b58eac29a3730bc18b1 from qemu
2018-02-17 15:23:55 -05:00
Peter Crosthwaite b848c7a51f
m68k: Remove ELF_MACHINE from cpu.h
The only generic code relying on this is linux-user, but linux users'
default behaviour of defaulting ELF_MACHINE to ELF_ARCH will handle
this.

The machine model bootloaders can just pass EM_68K directly, as that
is architecture specific code.

This removes another architecture specific definition from the global
namespace.

Backports commit 45e6b8b61a7bbb71d1fa6c4193b47ba3a1f9f033 from qemu
2018-02-17 15:23:54 -05:00
Peter Crosthwaite 9f8b8ba793
arm: Remove ELF_MACHINE from cpu.h
The only generic code relying on this is linux-user. Linux user
already has a lot of #ifdef TARGET_ customisation so instead, define
ELF_ARCH as either EM_ARM or EM_AARCH64 appropriately.

The armv7m bootloader can just pass EM_ARM directly, as that
is architecture specific code. Note that arm_boot already has its own
logic selecting an arm specific elf machine so this makes V7M more
consistent with arm_boot.

This removes another architecture specific definition from the global
namespace.

Backports commit b597c3f7da17fcb37d394a16a6c0ef0a02846177 from qemu
2018-02-17 15:23:54 -05:00
Pavel Butsykin 96f8d6325a
apic_internal.h: fix formatting and drop unused consts
Fix formatting of local apic definitions and drop unused constant
APIC_INPUT_POLARITY, APIC_SEND_PENDING. Magic numbers in shifts are
replaced with constants defined just above.

Backports commit b6cfc3c2ac5a1025d8fe7d74421a73ec495408f9 from qemu
2018-02-17 15:23:54 -05:00
Pavel Butsykin 79559c82aa
apic_internal.h: rename ESR_ILLEGAL_ADDRESS to APIC_ESR_ILLEGAL_ADDRESS
Added prefix APIC_ for determining the constant of a particular subsystem,
improve the overall readability and match other constant names.

Backports commit a22bf99c5852f369dc620be2c3c93535a5b69a58 from qemu
2018-02-17 15:23:54 -05:00
Pavel Butsykin fcd3e3e449
apic_internal.h: added more constants
These constants are needed for optimal access to
bit fields local apic registers without magic numbers.

Backports commit 6519d187e301c5a14a8c9b32fb93027b04a4336d from qemu
2018-02-17 15:23:54 -05:00
Aurelien Jarno b5f5e2dbc2
tcg/mips: pass oi to tcg_out_tlb_load
Instead of computing mem_index and s_bits in both tcg_out_qemu_ld and
tcg_out_qemu_st function and passing them to tcg_out_tlb_load, directly
pass oi to the tcg_out_tlb_load function and compute mem_index and
s_bits there.

Backports commit 81dfaf1a8f7f95259801da9732472f879023ef77 from qemu
2018-02-17 15:23:54 -05:00
Eric Blake b78bb417eb
error: Copy location information in error_copy()
Commit 1e9b65bb forgot to propagate source information to copied
errors.

Backports commit 88e2ce291595ed8f12636b40523fdb215a9d3374 from qemu
2018-02-17 15:23:53 -05:00
Pavel Dovgaluk 011861cd0e
target-mips: improve exception handling
This patch improves exception handling in MIPS.
Instructions generate several types of exceptions.
When exception is generated, it breaks the execution of the current
translation block. Implementation of the exceptions handling does not
correctly restore icount for the instruction which caused the exception.
In most cases icount will be decreased by the value equal to the size of
TB. This patch passes pointer to the translation block internals to the
exception handler. It allows correct restoring of the icount value.

Backports commit 9c708c7f9fbb813a3fac02f2728e51e62f2f5ffc from qemu
2018-02-17 15:23:53 -05:00
Leon Alrae 2a968bb547
target-mips: correct MTC0 instruction on MIPS64
MTC0 on a 64-bit processor should move entire 64-bit GPR content to CP0
register.

Backports commit d54a299b83a07642c85a22bfe19b69ca4def9ec4 from qemu
2018-02-17 15:23:53 -05:00
Leon Alrae 18dcbc7a64
target-mips: add missing restriction in DAUI instruction
rs cannot be the zero register, Reserved Instruction exception must be
signalled for this case.

Backports commit db77d8523909b32d798cd2c80de422b68f9e5c42 from qemu
2018-02-17 15:23:53 -05:00
Aurelien Jarno 1a441096c0
target-mips: get rid of MIPS_DEBUG
MIPS_DEBUG is a define used to dump the instruction disassembling. It
has to be defined at compile time. In practice I believe it's more
efficient to just look at the instruction disassembly and op dump using
-d in_asm,op. This patch therefore removes the corresponding code, which
clutters translate.c.

Backports commit 9d68ac14dab3f5af33a6b23458941dc6fb261fce from qemu
2018-02-17 15:23:52 -05:00
Aurelien Jarno 0045d99f38
target-mips: get rid of MIPS_DEBUG_SIGN_EXTENSIONS
MIPS_DEBUG_SIGN_EXTENSIONS was used sometimes ago to verify that 32-bit
instructions correctly sign extend their results. It's now not need
anymore, remove it.

Backports commit b307446e04232b3a87e9da04886895a8e5a4a407 from qemu
2018-02-17 15:23:52 -05:00
Alex Smith c48b0f76ee
target-mips: Fix RDHWR on CP0.Count
For RDHWR on the CP0.Count register, env->CP0_Count was being returned.
This value is a delta against the QEMU_CLOCK_VIRTUAL clock, not the
correct current value of CP0.Count. Use cpu_mips_get_count() instead.

Backports commit cdfcad788394ff53e317043e07b8e34f4987c659 from qemu
2018-02-17 15:23:52 -05:00
Petar Jovanovic dfa3d51a0f
target-mips: remove wrong checks for recip.fmt and rsqrt.fmt
Instructions recip.{s|d} and rsqrt.{s|d} do not require 64-bit FPU neither
they require any particular mode for its FPU. This patch removes the checks
that may break a program that uses these instructions.

Backports commit ca6c7803d2beae43299a80f4549d36579881fc0b from qemu
2018-02-17 15:23:52 -05:00
Peter Crosthwaite afb48e9fc5
cputlb: Change tlb_set_dirty() arg to cpu
Change tlb_set_dirty() to accept a CPU instead of an env pointer. This
allows for removal of another CPUArchState usage from prototypes that
need to be QOMified.

Backports commit bcae01e468d961ad9afaf4148329147e4be209ab from qemu
2018-02-17 15:23:52 -05:00
Peter Crosthwaite 2b15db6e12
tcg: split tcg_op_defs to -common
tcg_op_defs (and the _max) are both needed by the TCI disassembler. For
multi-arch, tcg.c will be multiple-compiled (arch-obj) with its symbols
hidden from common code. So split the definition off to new file,
tcg-common.c which will remain a regular obj-y for use by both the TCI
disas as well as the multiple tcg.c's.

Backports commit 7d8f787d9d261d6880b69e35ed682241e3f9242f from qemu
2018-02-17 15:23:51 -05:00
Peter Crosthwaite 7a004907c7
translate-all: Move tcg_handle_interrupt() to -common
Move this function to common code. It has no arch specific
dependencies. Prepares support for multi-arch where the translate-all
interface needs to be virtualised. One less thing to virtualise.

Backports commit 9b68a7754a892d8deb7696cfe609fe2ec3c6034a from qemu
2018-02-17 15:23:51 -05:00
Peter Crosthwaite bf067fcc26
cpu-exec: Migrate some generic fns to cpu-exec-common
The goal is to split the functions such that cpu-exec is CPU specific
content, while cpus-exec-common.c is generic code only. The function
interface to cpu-exec needs to be virtualised to prepare support for
multi-arch and moving these definitions out saves bloating the QOM
interface. So move these definitions out of cpu-exec to a new module,
cpu-exec-common.

Backports commit 5abf9495ca9ff41160260ac274115825c10545cc from qemu
2018-02-17 15:23:51 -05:00
Paolo Bonzini f1a592f4a1
cpu: initialize cpu->exception_index on reset
This unbreaks linux-user (broken by e511b4d, cpu-exec: reset exception_index
correctly, 2014-11-26).

Backports commit f9d8f6673591f30028e281e8ff6d5790adc2de83 from qemu
2018-02-17 15:23:51 -05:00
Lioncash 5e2862b29d
cpu: Add crash_occurred flag into CPUState
CPUState::crash_occurred field inside CPUState marks
that guest crash occurred. This value is added into
cpu common migration subsection.

Backports commit bac05aa9a77af1ca7972c8dc07560f4daa7c2dfc from qemu
2018-02-17 15:23:51 -05:00
Pavel Dovgalyuk 62544c10af
target-i386: exception handling for other helper functions
This patch fixes exception handling for other helper functions.

Backports commit 4054cdec0423c7190bfc733c27c303d513d531ab from qemu
2018-02-17 15:23:51 -05:00
Pavel Dovgalyuk 08f93c3fe6
target-i386: exception handling for seg_helper functions
This patch fixes exception handling for seg_helper functions.

Backports commit 100ec0991958d0c1b61f140e64dbe92991c6dd2c from qemu
2018-02-17 15:23:50 -05:00
Pavel Dovgalyuk 57b96e16af
target-i386: exception handling for memory helpers
This patch fixes exception handling for memory helpers
and removes obsolete PC update from translate.c.

Backports commit 2afbdf84807d673eb682cb78158e11cdacbf4673 from qemu
2018-02-17 15:23:50 -05:00
Pavel Dovgalyuk 837a36b1e8
target-i386: exception handling for div instructions
This patch fixes exception handling for div instructions
and removes obsolete PC update from translate.c.

Backports commit cc33c5d66bb315f77739f761a3f868a7d138c041 from qemu
2018-02-17 15:23:50 -05:00
Pavel Dovgalyuk afe5ed6f49
target-i386: exception handling for FPU instructions
This patch fixes exception handling for FPU instructions
and removes obsolete PC update from translate.c.

Backports commit 6cad09d2f74d7318f737acaa21b3da49a0c9e670 from qemu
2018-02-17 15:23:50 -05:00
Pavel Dovgalyuk 56615596e4
target-i386: introduce new raise_exception functions
This patch introduces new versions of raise_exception functions
that receive TB return address as an argument.

Backports commit 9198009529d06b6489b68a7505942cca3a50893f from qemu
2018-02-17 15:23:50 -05:00
Daniel P. Berrange 4c726ca49b
crypto: move crypto objects out of libqemuutil.la
Future patches will be adding more crypto related APIs which
rely on QOM infrastructure. This creates a problem, because
QOM relies on library constructors to register objects. When
you have a file in a static .a library though which is only
referenced by a constructor the linker is dumb and will drop
that file when linking to the final executable :-( The only
workaround for this is to link the .a library to the executable
using the -Wl,--whole-archive flag, but this creates its own
set of problems because QEMU is relying on lazy linking for
libqemuutil.a. Using --whole-archive majorly increases the
size of final executables as they now contain a bunch of
object code they don't actually use.

The least bad option is to thus not include the crypto objects
in libqemuutil.la, and instead define a crypto-obj-y variable
that is referenced directly by all the executables that need
this code (tools + softmmu, but not qemu-ga). We avoid pulling
entire of crypto-obj-y into the userspace emulators as that
would force them to link to gnutls too, which is not required.

Backports commit fb37726db77b21f3731b90693d2c93ade1777528 from qemu
2018-02-17 15:23:50 -05:00
Paolo Bonzini 195a86283f
exec: make mmap_lock/mmap_unlock globally available
There is some iffy lock hierarchy going on in translate-all.c. To
fix it, we need to take the mmap_lock in cpu-exec.c. Make the
functions globally available.

Backports commit 8fd19e6cfd5b6cdf028c6ac2ff4157ed831ea3a6 from qemu
2018-02-17 15:23:49 -05:00
Paolo Bonzini 62045513bb
tcg: synchronize exit_request and tcg_current_cpu accesses
Synchronize the remaining pair of accesses in cpu_signal. These should
be necessary on Windows as well, at least in theory. Probably
SuspendProcess and ResumeProcess introduce some implicit memory
barrier.

Backports relevant parts of commit aed807c8e2bf009b2c6a35490d4fd4383887221d from qemu
2018-02-17 15:23:49 -05:00
Paolo Bonzini 7f1d59bb83
tcg: synchronize cpu->exit_request and cpu->tcg_exit_req accesses
Backports commit ab096a75cd626dcd4ad34b2a11652df0269bee0d from qemu
2018-02-17 15:23:49 -05:00
Paolo Bonzini 1cfd4190a7
tcg: assign cpu->current_tb in a simpler place
TCG has not been reading cpu->current_tb from signal handlers for years.
The code that synchronized cpu_exec with the signal handler is not
needed anymore.

Backports commit b0a46fa796504c7334202877a68c857e49f7c96c from qemu
2018-02-17 15:23:49 -05:00
Paolo Bonzini 96e5a7ced3
tcg: introduce tcg_current_cpu
This is already useful on Windows in order to remove tls.h, because
accesses to current_cpu are done from a different thread on that
platform. It will be used on POSIX platforms as soon TCG stops using
signals to interrupt the execution of translated code.

Backports commit 9373e63297c43752f9cf085feb7f5aed57d959f8 from qemu
2018-02-17 15:23:49 -05:00
Edgar E. Iglesias 03da6ff6db
target-arm: Add VMPIDR_EL2
Backports commit f0d574d63f4603ec431f16ad535a555bf7548b94 from qemu
2018-02-17 15:23:48 -05:00
Edgar E. Iglesias 2b4c03224b
target-arm: Break out mpidr_read_val()
Break out mpidr_read_val() to allow future sharing of the
code that conditionally sets the M and U bits of MPIDR.

No functional changes.

Backports commit 06a7e6477c129ceaa72bd400cf281d44c456be43 from qemu
2018-02-17 15:23:48 -05:00
Edgar E. Iglesias 766dccbad9
target-arm: Add VPIDR_EL2
Backports commit 731de9e60074620aa7d565f01f989adacd493514 from qemu
2018-02-17 15:23:48 -05:00
Edgar E. Iglesias 2dfdb13786
target-arm: Suppress EPD for S2, EL2 and EL3 translations
Stage-2 translations, EL2 and EL3 regimes don't have the
EPD control.

Backports commit 0c5fbf3b4c1e5210354de71a3dc2ebc8c8a01f31 from qemu
2018-02-17 15:23:48 -05:00
Edgar E. Iglesias f5b3b9f6e9
target-arm: Suppress TBI for S2 translations
Stage-2 MMU translations do not have configurable TBI as
the top byte is always 0 (48-bit IPAs).

Backports commit 1edee4708a0e3163cbf20fac325be456abd960bb from qemu
2018-02-17 15:23:48 -05:00
Edgar E. Iglesias 097325acd6
target-arm: Add VTTBR_EL2
Backports commit b698e9cfd282b228b36d426b75facb83e07a1072 from qemu
2018-02-17 15:23:47 -05:00
Edgar E. Iglesias 4bdafaa2f8
target-arm: Add VTCR_EL2
Backports commit 68e9c2fe65bca7fc1bdc2411923333c3e87544a3 from qemu
2018-02-17 15:23:47 -05:00
Pavel Dovgalyuk 4a05c9ee28
cpu-exec: introduce loop exit with restore function
This patch introduces loop exit function, which also
restores guest CPU state according to the value of host
program counter.

Backports commit 1c3c8af1fb40a481c07749e0448644d9b7700415 from qemu
2018-02-17 15:23:38 -05:00
Pavel Dovgalyuk 28f154129b
softmmu: remove now unused functions
Now that the cpu_ld/st_* function directly call helper_ret_ld/st, we can
drop the old helper_ld/st functions.

Backports commit b8611499b940b1b4db67aa985e3a844437bcbf00 from qemu
2018-02-17 15:23:38 -05:00
Pavel Dovgalyuk 6cdaaf9b1b
softmmu: add helper function to pass through retaddr
This patch introduces several helpers to pass return address
which points to the TB. Correct return address allows correct
restoring of the guest PC and icount. These functions should be used when
helpers embedded into TB invoke memory operations.

Backports commit 282dffc8a4bfe8724548cabb8a26698bde0a6e18 from qemu
2018-02-17 15:23:38 -05:00
Benjamin Herrenschmidt 1722be3e73
tlb: Add ifetch argument to cpu_mmu_index()
This is set to true when the index is for an instruction fetch
translation.

The core get_page_addr_code() sets it, as do the SOFTMMU_CODE_ACCESS
acessors.

All targets ignore it for now, and all other callers pass "false".

This will allow targets who wish to split the mmu index between
instruction and data accesses to do so. A subsequent patch will
do just that for PowerPC.

Backports commit 97ed5ccdee95f0b98bedc601ff979e368583472c from qemu
2018-02-17 15:23:37 -05:00
Markus Armbruster 97ad660361
error: On abort, report where the error was created
This is particularly useful when we abort in error_propagate(),
because there the stack backtrace doesn't lead to where the error was
created. Looks like this:

Unexpected error in parse_block_error_action() at .../qemu/blockdev.c:322:
qemu-system-x86_64: -drive if=none,werror=foo: 'foo' invalid write error action
Aborted (core dumped)

Note: to get this example output, I monkey-patched drive_new() to pass
&error_abort to blockdev_init().

To keep the error handling boiler plate from growing even more, all
error_setFOO() become macros expanding into error_setFOO_internal()
with additional __FILE__, __LINE__, __func__ arguments. Not exactly
pretty, but it works.

The macro trickery breaks down when you take the address of an
error_setFOO(). Fortunately, we do that in just one place: qemu-ga's
Windows VSS provider and requester DLL wants to call
error_setg_win32() through a function pointer "to avoid linking glib
to the DLL". Use error_setg_win32_internal() there. The use of the
function pointer is already wrapped in a macro, so the churn isn't
bad.

Code size increases by some 35KiB for me (0.7%). Tolerable. Could be
less if we passed relative rather than absolute source file names to
the compiler, or forwent reporting __func__.

Backports commit 1e9b65bb1bad51735cab6c861c29b592dccabf0e from qemu
2018-02-17 15:23:37 -05:00
Markus Armbruster 46f398569f
error: Revamp interface documentation
Backports commit edf6f3b3358597d37da0cf636ce3ed8a546d0f26 from qemu
2018-02-17 15:23:37 -05:00
Markus Armbruster eebc32fd75
error: error_set_errno() is unused, drop
Backports commit 4463dcb85c9f992f0c4d93f2142c8d64dcc85c5c from qemu
2018-02-17 15:23:37 -05:00
Markus Armbruster 661e38e3ed
error: Make error_setg() a function
Saves a tiny amount of code at every call site.

Backports commit a9499ddd82a99c66cc72a08e72427c423acfea1c from qemu
2018-02-17 15:23:36 -05:00
Markus Armbruster c2a61848d6
error: De-duplicate code creating Error objects
Duplicated when commit 680d16d added error_set_errno(), and again when
commit 20840d4 added error_set_win32().

Make the original copy in error_set() reusable by factoring out
error_setv(), then rewrite error_set_errno() and error_set_win32() on
top of it.

Backports commit 552375088a832fd5945ede92d01f98977b4eca13 from qemu
2018-02-17 15:23:36 -05:00
Edgar E. Iglesias 191786d055
target-arm: Add AArch64 access to PAR_EL1
Backports commit c96fc9b52d0a318d8026a0bcaba204d319ad91e0 from qemu
2018-02-17 15:23:36 -05:00
Edgar E. Iglesias de83caf623
target-arm: Correct opc1 for AT_S12Exx
Backports commit 7a379c7e68f1b2286602b0beeeb58dcef7c9e760 from qemu
2018-02-17 15:23:36 -05:00
Edgar E. Iglesias fa908ea3d3
target-arm: Log the target EL when taking exceptions
Log the target EL when taking exceptions. This is useful when
debugging guest SW or QEMU itself while transitioning through
the various ELs.

Backports commit dbc29a868cf5b7e6fa7bb2e6c4f188b9470779c5 from qemu
2018-02-17 15:23:36 -05:00
Sergey Sorokin a883d349fe
target-arm: Fix default_exception_el() function for the case when EL3 is not supported
If EL3 is not supported in current configuration,
we should not try to get EL3 bitness.

Backports commit cef9ee706792b1e205fe472b67053a0e82cd058e from qemu
2018-02-17 15:23:36 -05:00
Peter Crosthwaite a249923d4d
qom: Add recursive version of object_child_for_each
Useful for iterating through an entire QOM subtree.

Backports commit d714b8de7747f20fe42e5716d1d44f91e2b891f4 from qemu
2018-02-17 15:23:35 -05:00
Peter Maydell e08c524068
Remove unused qemu_fls function
Nothing uses qemu_fls() any more, so delete it.

Backports commit 10944a19209bb520054569e0f156f50338901264 from qemu
2018-02-17 15:23:35 -05:00
Peter Maydell 400fd62ba7
exec.c: Use pow2floor() rather than hand-calculation
Use pow2floor() to round down to the nearest power of 2,
rather than an inline calculation.

Backports commit 6554f5c03793bb8a3d5dedcebf758a1694fa186c from qemu
2018-02-17 15:23:35 -05:00
Lioncash 9ce672c511
host-util: Add power calculation functions 2018-02-17 15:23:35 -05:00
Lioncash 2a6b6c1082
target-arm: Refactor CPU affinity handling
Introduces reusable definitions for CPU affinity masks/shifts and gets rid
of hardcoded magic numbers.

Backports commit 0f4a9e45ec35811ee250ac232d84d3c6d4fcd7fc from qemu
2018-02-17 15:23:34 -05:00
Sergey Sorokin 02ace69c9d
target-arm: Fix arm_excp_unmasked() function
There is an error in arm_excp_unmasked() function:
bitwise operator & is used with integer and bool operands
causing an incorrect zeroed result.
The patch fixes it.

Backports commit 771842585f3119f69641ed90a97d56eb9ed6f5ae from qemu
2018-02-17 15:23:34 -05:00
Sergey Sorokin 5b40cb8562
target-arm: Fix AArch32:AArch64 general-purpose register mapping
There is an error in functions aarch64_sync_32_to_64() and
aarch64_sync_64_to_32() with mapping of registers between AArch32 and
AArch64. This commit fixes the mapping to match the v8 ARM ARM
section D1.20.1 (table D1-77).

Backports commit 3a9148d0bdcee990fbe86759b9b1f5723c1d7fbc from qemu
2018-02-17 15:23:34 -05:00
Peter Crosthwaite 83aa10f77d
arm: Remove hw_error() usages.
All of these hw_errors are fatal and indicate something wrong with
QEMU implementation.

Convert to g_assert_not_reached.

Backports commit 8f6fd322f6e25995629a1a07b56bc5b91fb947ca from qemu
2018-02-17 15:23:34 -05:00
Peter Maydell 1b88e0e8c8
target-arm: Wire up HLT 0xf000 as the A64 semihosting instruction
For the A64 instruction set, the semihosting call instruction
is 'HLT 0xf000'. Wire this up to call do_arm_semihosting()
if semihosting is enabled.

Backports commit 8012c84ff92a36d05dfe61af9b24dd01a7ea25e4 from qemu
2018-02-17 15:23:34 -05:00
Lioncash f81894dddb
exec: Add semihosting stubs 2018-02-17 15:23:33 -05:00
Peter Maydell cdda3aec7f
target-arm/arm-semi.c: Support widening APIs to 64 bits
The 64-bit A64 semihosting API has some pervasive changes from
the 32-bit version:
* all parameter blocks are arrays of 64-bit values, not 32-bit
* the semihosting call number is passed in W0
* the return value is a 64-bit value in X0

Implement the necessary handling for this widening.

Backports relevant parts of commit faacc041619581c566c21ed87aa1933420731282 from qemu
2018-02-17 15:23:33 -05:00
Christopher Covington eabacd7daf
target-arm: Improve semihosting debug prints
Print semihosting debugging information before the
do_arm_semihosting() call so that angel_SWIreason_ReportException,
which causes the function to not return, gets the same debug prints as
other semihosting calls. Also print out the semihosting call number.

Backports commit 205ace55ffff77964e50af08c99639ec47db53f6 from qemu
2018-02-17 15:23:33 -05:00
Aurelien Jarno 11cfddad05
tcg/i386: use softmmu fast path for unaligned accesses
Softmmu unaligned load/stores currently goes through through the slow
path for two reasons:
  - to support unaligned access on host with strict alignement
  - to correctly handle accesses crossing pages

x86 is only concerned by the second reason. Unaligned accesses are
avoided by compilers, but are not uncommon. We therefore would like
to see them going through the fast path, if they don't cross pages.

For that we can use the fact that two adjacent TLB entries can't contain
the same page. Therefore accessing the TLB entry corresponding to the
first byte, but comparing its content to page address of the last byte
ensures that we don't cross pages. We can do this check without adding
more instructions in the TLB code (but increasing its length by one
byte) by using the LEA instruction to combine the existing move with the
size addition.

On an x86-64 host, this gives a 3% boot time improvement for a powerpc
guest and 4% for an x86-64 guest.

Backports commit 8cc580f6a0d8c0e2f590c1472cf5cd8e51761760 from qemu
2018-02-17 15:23:33 -05:00
Laurent Vivier ea2ee48d9c
s390: fix softmmu compilation
guest_base must be used only in linux-user mode.

Backports commit 090d0bfd948343d522cd20bc634105b5cfe2483b from qemu
2018-02-17 15:23:32 -05:00
Peter Maydell 4071f20ce2
target-arm: Implement AArch64 TLBI operations on IPAs
Implement the AArch64 TLBI operations which take an intermediate
physical address and invalidate stage 2 translations.

Backports commit cea66e91212164e02ad1d245c2371f7e8eb59e7f from qemu
2018-02-17 15:23:32 -05:00
Peter Maydell b318251716
target-arm: Implement missing EL3 TLB invalidate operations
Implement the remaining stage 1 TLB invalidate operations
visible from EL3.

Backports commit 43efaa33faa2bdaed789b9ddaa76b30880e57554 from qemu
2018-02-17 15:23:32 -05:00
Peter Maydell f29d67b43e
target-arm: Implement missing EL2 TLBI operations
Implement the missing TLBI operations that exist only
if EL2 is implemented.

Backports commit 2bfb9d75d37ceab6ef1674f54fca06c74f6978e7 from qemu
2018-02-17 15:23:32 -05:00