Commit graph

2790 commits

Author SHA1 Message Date
Peter Maydell fbfeca93b3
armv7m: Check exception return consistency
Implement the exception return consistency checks
described in the v7M pseudocode ExceptionReturn().

Inspired by a patch from Michael Davidsaver's series, but
this is a reimplementation from scratch based on the
ARM ARM pseudocode.

Backports commit aa488fe3bb5460c6675800ccd80f6dccbbd70159 from qemu
2018-03-02 19:59:18 -05:00
Peter Maydell 0736054d6d
armv7m: Extract "exception taken" code into functions
Extract the code from the tail end of arm_v7m_do_interrupt() which
enters the exception handler into a pair of utility functions
v7m_exception_taken() and v7m_push_stack(), which correspond roughly
to the pseudocode PushStack() and ExceptionTaken().

This also requires us to move the arm_v7m_load_vector() utility
routine up so we can call it.

Handling illegal exception returns has some cases where we want to
take a UsageFault either on an existing stack frame or with a new
stack frame but with a specific LR value, so we want to be able to
call these without having to go via arm_v7m_cpu_do_interrupt().

Backports commit 39ae2474e337247e5930e8be783b689adc9f6215 from qemu
2018-03-02 19:54:46 -05:00
Michael Davidsaver 5b9f53bd27
armv7m: Simpler and faster exception start
All the places in armv7m_cpu_do_interrupt() which pend an
exception in the NVIC are doing so for synchronous
exceptions. We know that we will always take some
exception in this case, so we can just acknowledge it
immediately, rather than returning and then immediately
being called again because the NVIC has raised its outbound
IRQ line.

Backports commit a25dc805e2e63a55029e787a52335e12dabf07dc from qemu
2018-03-02 19:52:01 -05:00
Peter Maydell 43ba76cb28
armv7m: Fix condition check for taking exceptions
The M profile condition for when we can take a pending exception or
interrupt is not the same as that for A/R profile. The code
originally copied from the A/R profile version of the
cpu_exec_interrupt function only worked by chance for the
very simple case of exceptions being masked by PRIMASK.
Replace it with a call to a function in the NVIC code that
correctly compares the priority of the pending exception
against the current execution priority of the CPU.

Backports commit 7ecdaa4a9635f1ded0dfa9218c25273b6d4dcd44 from qemu
2018-03-02 19:50:05 -05:00
Peter Maydell 5470bd1763
armv7m: Remove unused armv7m_nvic_acknowledge_irq() return value
Having armv7m_nvic_acknowledge_irq() return the new value of
env->v7m.exception and its one caller assign the return value
back to env->v7m.exception is pointless. Just make the return
type void instead.

Backports commit a5d8235545e98c1ce02560d5f4f57552d937efe9 from qemu
2018-03-02 19:36:07 -05:00
Peter Maydell 50c956db7e
arm: Implement HFNMIENA support for M profile MPU
Implement HFNMIENA support for the M profile MPU. This bit controls
whether the MPU is treated as enabled when executing at execution
priorities of less than zero (in NMI, HardFault or with the FAULTMASK
bit set).

Doing this requires us to use a different MMU index for "running
at execution priority < 0", because we will have different
access permissions for that case versus the normal case.

Backports commit 3bef7012560a7f0ea27b265105de5090ba117514 from qemu
2018-03-02 19:33:24 -05:00
Michael Davidsaver 611a711f7b
arm: add MPU support to M profile CPUs
The M series MPU is almost the same as the already implemented R
profile MPU (v7 PMSA). So all we need to implement here is the MPU
register interface in the system register space.

This implementation has the same restriction as the R profile MPU
that it doesn't permit regions to be sized down smaller than 1K.

We also do not yet implement support for MPU_CTRL.HFNMIENA; this
bit should if zero disable use of the MPU when running HardFault,
NMI or with FAULTMASK set to 1 (ie at an execution priority of
less than zero) -- if the MPU is enabled we don't treat these
cases any differently.

Backports commit 29c483a506070e8f554c77d22686f405e30b9114 from qemu
2018-03-02 19:30:20 -05:00
Michael Davidsaver 09d69209a0
armv7m: Classify faults as MemManage or BusFault
General logic is that operations stopped by the MPU are MemManage,
and those which go through the MPU and are caught by the unassigned
handle are BusFault. Distinguish these by looking at the
exception.fsr values, and set the CFSR bits and (if appropriate)
fill in the BFAR or MMFAR with the exception address.

Backports commit 5dd0641d234e355597be62e5279d8a519c831625 from qemu
2018-03-02 19:28:21 -05:00
Peter Maydell 9bc3050c51
arm: All M profile cores are PMSA
All M profile CPUs are PMSA, so set the feature bit.
(We haven't actually implemented the M profile MPU register
interface yet, but setting this feature bit gives us closer
to correct behaviour for the MPU-disabled case.)

Backports commit 790a11503cfb5e1dcd031ea2212bbebae4ca3cec from qemu
2018-03-02 19:26:41 -05:00
Michael Davidsaver 4d8ae4a2b2
armv7m: Implement M profile default memory map
Add support for the M profile default memory map which is used
if the MPU is not present or disabled.

The main differences in behaviour from implementing this
correctly are that we set the PAGE_EXEC attribute on
the right regions of memory, such that device regions
are not executable.

Backports commit 3a00d560bcfca7ad04327062c1986a016c104b1f from qemu
2018-03-02 19:25:02 -05:00
Michael Davidsaver 7c845dabe8
armv7m: Improve "-d mmu" tracing for PMSAv7 MPU
Improve the "-d mmu" tracing for the PMSAv7 MPU translation
process as an aid in debugging guest MPU configurations:
* fix a missing newline for a guest-error log
* report the region number with guest-error or unimp
logs of bad region register values
* add a log message for the overall result of the lookup
* print "0x" prefix for hex values

Backports commit c9f9f1246d630960bce45881e9c0d27b55be71e2 from qemu
2018-03-02 19:17:05 -05:00
Peter Maydell bfe99e9a0b
arm: Remove unnecessary check on cpu->pmsav7_dregion
Now that we enforce both:
* pmsav7_dregion == 0 implies has_mpu == false
* PMSA with has_mpu == false means SCTLR.M cannot be set
we can remove a check on pmsav7_dregion from get_phys_addr_pmsav7(),
because we can only reach this code path if the MPU is enabled
(and so region_translation_disabled() returned false).

Backports commit e9235c6983b261e04e897e8ff900b2b7a391e644 from qemu
2018-03-02 19:14:50 -05:00
Peter Maydell 349227bb05
arm: Don't let no-MPU PMSA cores write to SCTLR.M
If the CPU is a PMSA config with no MPU implemented, then the
SCTLR.M bit should be RAZ/WI, so that the guest can never
turn on the non-existent MPU.

Backports commit 06312febfb2d35367006ef23608ddd6a131214d4 from qemu
2018-03-02 19:13:37 -05:00
Peter Maydell e564ed6311
arm: Don't clear ARM_FEATURE_PMSA for no-mpu configs
Fix the handling of QOM properties for PMSA CPUs with no MPU:

Allow no-MPU to be specified by either:
* has-mpu = false
* pmsav7_dregion = 0
and make setting one imply the other. Don't clear the PMSA
feature bit in this situation.

Backports commit f50cd31413d8bc9d1eef8edd1f878324543bf65d from qemu
2018-03-02 19:12:20 -05:00
Peter Maydell 6614ba9615
arm: Clean up handling of no-MPU PMSA CPUs
ARM CPUs come in two flavours:
* proper MMU ("VMSA")
* only an MPU ("PMSA")
For PMSA, the MPU may be implemented, or not (in which case there
is default "always acts the same" behaviour, but it isn't guest
programmable).

QEMU is a bit confused about how we indicate this: we have an
ARM_FEATURE_MPU, but it's not clear whether this indicates
"PMSA, not VMSA" or "PMSA and MPU present" , and sometimes we
use it for one purpose and sometimes the other.

Currently trying to implement a PMSA-without-MPU core won't
work correctly because we turn off the ARM_FEATURE_MPU bit
and then a lot of things which should still exist get
turned off too.

As the first step in cleaning this up, rename the feature
bit to ARM_FEATURE_PMSA, which indicates a PMSA CPU (with
or without MPU).

Backports commit 452a095526a0537f16c271516a2200877a272ea8 from qemu
2018-03-02 19:05:31 -05:00
Peter Maydell b50d2da03c
arm: Use different ARMMMUIdx values for M profile
Make M profile use completely separate ARMMMUIdx values from
those that A profile CPUs use. This is a prelude to adding
support for the MPU and for v8M, which together will require
6 MMU indexes which don't map cleanly onto the A profile
uses:
non secure User
non secure Privileged
non secure Privileged, execution priority < 0
secure User
secure Privileged
secure Privileged, execution priority < 0

Backports commit e7b921c2d9efc249f99b9feb0e7dca82c96aa5c4 from qemu
2018-03-02 19:01:42 -05:00
Michael Davidsaver f532e80749
armv7m: Escalate exceptions to HardFault if necessary
The v7M exception architecture requires that if a synchronous
exception cannot be taken immediately (because it is disabled
or at too low a priority) then it should be escalated to
HardFault (and the HardFault exception is then taken).
Implement this escalation logic.

Backports commit a73c98e159d18155445d29b6044be6ad49fd802f from qemu
2018-03-02 18:59:13 -05:00
Peter Maydell b7bf752d3c
arm: Add support for M profile CPUs having different MMU index semantics
The M profile CPU's MPU has an awkward corner case which we
would like to implement with a different MMU index.

We can avoid having to bump the number of MMU modes ARM
uses, because some of our existing MMU indexes are only
used by non-M-profile CPUs, so we can borrow one.
To avoid that getting too confusing, clean up the code
to try to keep the two meanings of the index separate.

Instead of ARMMMUIdx enum values being identical to core QEMU
MMU index values, they are now the core index values with some
high bits set. Any particular CPU always uses the same high
bits (so eventually A profile cores and M profile cores will
use different bits). New functions arm_to_core_mmu_idx()
and core_to_arm_mmu_idx() convert between the two.

In general core index values are stored in 'int' types, and
ARM values are stored in ARMMMUIdx types.

Backports commit 8bd5c82030b2cb09d3eef6b444f1620911cc9fc5 from qemu
2018-03-02 18:59:13 -05:00
Wei Huang 19335c32c9
target/arm: clear PMUVER field of AA64DFR0 when vPMU=off
The PMUv3 driver of linux kernel (in arch/arm64/kernel/perf_event.c)
relies on the PMUVER field of id_aa64dfr0_el1 to decide if PMU support
is present or not. This patch clears the PMUVER field under TCG mode
when vPMU=off. Without it, PMUv3 will init insider guest VMs even
with vPMU=off. This patch also removes a redundant line inside the
if-statement.

Backports commit 2b3ffa929249b15a75d8bde3e8e57a744f52aff0 from qemu
2018-03-02 18:59:12 -05:00
Peter Maydell 4789e49c4d
arm: Use the mmu_idx we're passed in arm_cpu_do_unaligned_access()
When identifying the DFSR format for an alignment fault, use
the mmu index that we are passed, rather than calling cpu_mmu_index()
to get the mmu index for the current CPU state. This doesn't actually
make any difference since the only cases where the current MMU index
differs from the index used for the load are the "unprivileged
load/store" instructions, and in that case the mmu index may
differ but the translation regime is the same (apart from the
"use from Hyp mode" case which is UNPREDICTABLE).
However it's the more logical thing to do.

Backports commit e517d95b63427fae9f03958dbc005c36b4ebf2cf from qemu
2018-03-02 18:59:12 -05:00
Peter Xu fce1b469e5
memory: tune last param of iommu_ops.translate()
This patch converts the old "is_write" bool into IOMMUAccessFlags. The
difference is that "is_write" can only express either read/write, but
sometimes what we really want is "none" here (neither read nor write).
Replay is an good example - during replay, we should not check any RW
permission bits since thats not an actual IO at all.

Backports commit bf55b7afce53718ef96f4e6616da62c0ccac37dd from qemu
2018-03-02 18:59:12 -05:00
Peter Xu 5621c7e09f
exec: abstract address_space_do_translate()
This function is an abstraction helper for address_space_translate() and
address_space_get_iotlb_entry(). It does the lookup of address into
memory region section, then does proper IOMMU translation if necessary.
Refactor the two existing functions to use it.

This fixes vhost when IOMMU is disabled by guest.

Backports commit a764040cc831cfe5b8bf1c80e8341b9bf2de3ce8 from qemu
2018-03-02 18:59:12 -05:00
Nikunj A Dadhania d907423bac
cputlb: handle first atomic write to the page
In case where the conditional write is the first write to the page,
TLB_NOTDIRTY will be set and stop_the_world is triggered. Handle this as
a special case and set the dirty bit. After that fall through to the
actual atomic instruction below.

Backports commit 7f9af1abdcc69fd1d3d8d2be68464329600616d6 from qemu
2018-03-02 18:59:12 -05:00
Aurelien Jarno 00ebbae128
tcg/mips: fix field extraction opcode
The "msb" argument should correspond to (len - 1).

Backports commit 2f5a5f5774d95baacf86c03aa8a77a2d0390f2b2 from qemu
2018-03-02 18:59:12 -05:00
Richard Henderson 69116abafc
tcg: Initialize return value after exit_atomic
Users of tcg_gen_atomic_cmpxchg and do_atomic_op rightfully utilize
the output. Even though this code is dead, it gets translated, and
without the initialization we encounter a tcg_error.

Backports commit 79b1af906245558c30e0a5faf26cb52b63f83cce from qemu
2018-03-02 18:59:11 -05:00
Gerd Hoffmann 108354cc4a
bitmap: add bitmap_copy_and_clear_atomic
Backports commit d6eb1413920affb7be3df9982682dd183a805dd7 from qemu
2018-03-02 18:59:11 -05:00
Peter Maydell b8b70dfcd2
Drop QEMU_GNUC_PREREQ() checks for gcc older than 4.1
We already require gcc 4.1 or newer (for the atomic
support), so the fallback codepaths for older gcc
versions than that are now dead code and we can
just delete them.

NB: clang reports itself as gcc 4.2 (regardless of
clang version), so clang won't be using the fallbacks
either.

Backports commit fa54abb8c298f892639ffc4bc2f61448ac3be4a1 from qemu
2018-03-02 18:59:05 -05:00
Peter Maydell 2935a9af7a
arm: Remove workarounds for old M-profile exception return implementation
Now that we've rewritten M-profile exception return so that the magic
PC values are not visible to other parts of QEMU, we can delete the
special casing of them elsewhere.

Backports commit f4e8e4edda875cab9df91dc4ae9767f7cb1f50aa from qemu
2018-03-02 15:02:14 -05:00
Peter Maydell 44bf8985e5
arm: Implement M profile exception return properly
On M profile, return from exceptions happen when code in Handler mode
executes one of the following function call return instructions:
* POP or LDM which loads the PC
* LDR to PC
* BX register
and the new PC value is 0xFFxxxxxx.

QEMU tries to implement this by not treating the instruction
specially but then catching the attempt to execute from the magic
address value. This is not ideal, because:
* there are guest visible differences from the architecturally
specified behaviour (for instance jumping to 0xFFxxxxxx via a
different instruction should not cause an exception return but it
will in the QEMU implementation)
* we have to account for it in various places (like refusing to take
an interrupt if the PC is at a magic value, and making sure that
the MPU doesn't deny execution at the magic value addresses)

Drop these hacks, and instead implement exception return the way the
architecture specifies -- by having the relevant instructions check
for the magic value and raise the 'do an exception return' QEMU
internal exception immediately.

The effect on the generated code is minor:

bx lr, old code (and new code for Thread mode):
TCG:
mov_i32 tmp5,r14
movi_i32 tmp6,$0xfffffffffffffffe
and_i32 pc,tmp5,tmp6
movi_i32 tmp6,$0x1
and_i32 tmp5,tmp5,tmp6
st_i32 tmp5,env,$0x218
exit_tb $0x0
set_label $L0
exit_tb $0x7f2aabd61993
x86_64 generated code:
0x7f2aabe87019: mov %ebx,%ebp
0x7f2aabe8701b: and $0xfffffffffffffffe,%ebp
0x7f2aabe8701e: mov %ebp,0x3c(%r14)
0x7f2aabe87022: and $0x1,%ebx
0x7f2aabe87025: mov %ebx,0x218(%r14)
0x7f2aabe8702c: xor %eax,%eax
0x7f2aabe8702e: jmpq 0x7f2aabe7c016

bx lr, new code when in Handler mode:
TCG:
mov_i32 tmp5,r14
movi_i32 tmp6,$0xfffffffffffffffe
and_i32 pc,tmp5,tmp6
movi_i32 tmp6,$0x1
and_i32 tmp5,tmp5,tmp6
st_i32 tmp5,env,$0x218
movi_i32 tmp5,$0xffffffffff000000
brcond_i32 pc,tmp5,geu,$L1
exit_tb $0x0
set_label $L1
movi_i32 tmp5,$0x8
call exception_internal,$0x0,$0,env,tmp5
x86_64 generated code:
0x7fe8fa1264e3: mov %ebp,%ebx
0x7fe8fa1264e5: and $0xfffffffffffffffe,%ebx
0x7fe8fa1264e8: mov %ebx,0x3c(%r14)
0x7fe8fa1264ec: and $0x1,%ebp
0x7fe8fa1264ef: mov %ebp,0x218(%r14)
0x7fe8fa1264f6: cmp $0xff000000,%ebx
0x7fe8fa1264fc: jae 0x7fe8fa126509
0x7fe8fa126502: xor %eax,%eax
0x7fe8fa126504: jmpq 0x7fe8fa122016
0x7fe8fa126509: mov %r14,%rdi
0x7fe8fa12650c: mov $0x8,%esi
0x7fe8fa126511: mov $0x56095dbeccf5,%r10
0x7fe8fa12651b: callq *%r10

which is a difference of one cmp/branch-not-taken. This will
be lost in the noise of having to exit generated code and
look up the next TB anyway.

Backports commit 3bb8a96f5348913ee130169504f3642f501b113e from qemu
2018-03-02 14:58:14 -05:00
Peter Maydell cfc1611d6f
arm: Track M profile handler mode state in TB flags
For M profile exception-return handling we'd like to generate different
code for some instructions depending on whether we are in Handler
mode or Thread mode. This isn't the same as "are we privileged
or user", so we need an extra bit in the TB flags to distinguish.

Backports commit 064c379c99b835bdcc478d21a3849507ea07d53a from qemu
2018-03-02 14:54:16 -05:00
Peter Maydell 8233756382
arm: Move condition-failed codepath generation out of if()
Move the code to generate the "condition failed" instruction
codepath out of the if (singlestepping) {} else {}. This
will allow adding support for handling a new is_jmp type
which can't be neatly split into "singlestepping case"
versus "not singlestepping case".

Backports commit f021b2c4627890d82fbcc300db3bd782b37b7f8a from qemu

arm: Abstract out "are we singlestepping" test to utility function

We now test for "are we singlestepping" in several places and
it's not a trivial check because we need to care about both
architectural singlestep and QEMU gdbstub singlestep. We're
also about to add another place that needs to make this check,
so pull the condition out into a function.

Backports commit b636649f5a2e108413dd171edaf320f781f57942 from qemu
2018-03-02 14:52:30 -05:00
Peter Maydell 43d6e73fea
arm: Move gen_set_condexec() and gen_set_pc_im() up in the file
Move the utility routines gen_set_condexec() and gen_set_pc_im()
up in the file, as we will want to use them from a function
placed earlier in the file than their current location.

Backports commit 4d5e8c969a74c86124fc2284ea603cc6dd3c5dfa from qemu
2018-03-02 14:48:36 -05:00
Peter Maydell 23141d7620
arm: Factor out "generate right kind of step exception"
We currently have two places that do:
if (dc->ss_active) {
gen_step_complete_exception(dc);
} else {
gen_exception_internal(EXCP_DEBUG);
}

Factor this out into its own function, as we're about to add
a third place that needs the same logic.

Backports commit 5425415ebba5fa20558e1ef25e1997a6f5ea4c7c from qemu
2018-03-02 14:45:30 -05:00
Peter Maydell ddfe550411
arm: Thumb shift operations should not permit interworking branches
In Thumb mode, the only instructions which can cause an interworking
branch by writing the PC are BLX, BX, BXJ, LDR, POP and LDM. Unlike
ARM mode, data processing instructions which target the PC do not
cause interworking branches.

When we added support for doing interworking branches on writes to
PC from data processing instructions in commit 21aeb3430ce7ba, we
accidentally changed a Thumb instruction to have interworking
branch behaviour for writes to PC. (MOV, MOVS register-shifted
register, encoding T2; this is the standard encoding for
LSL/LSR/ASR/ROR (register).)

For this encoding, behaviour with Rd == R15 is specified as
UNPREDICTABLE, so allowing an interworking branch is within
spec, but it's confusing and differs from our handling of this
class of UNPREDICTABLE for other Thumb ALU operations. Make
it perform a simple (non-interworking) branch like the others.

Backports commit bedb8a6b09c1754c3b9f155750c62dc087706698 from qemu
2018-03-02 14:42:40 -05:00
Peter Maydell 9f938da9e1
arm: Don't implement BXJ on M-profile CPUs
For M-profile CPUs, the BXJ instruction does not exist at all, and
the encoding should always UNDEF. We were accidentally implementing
it to behave like A-profile BXJ; correct the error.

Backports commit 9d7c59c84d4530d05e8702b1c3a31e6da00a397e from qemu
2018-03-02 14:42:04 -05:00
Peter Maydell e9d507a193
target/arm: Add assertion about FSC format for syndrome registers
In tlb_fill() we construct a syndrome register value from a
fault status register value which is filled in by arm_tlb_fill().
arm_tlb_fill() returns FSR values which might be in the format
used with short-format page descriptors, or the format used
with long-format (LPAE) descriptors. The syndrome register
always uses LPAE-format FSR status codes.

It isn't actually possible to end up delivering a syndrome
register value to the guest for a fault which is reported
with a short-format FSR (that kind of stage 1 fault will only
happen for an AArch32 translation regime which doesn't have
a syndrome register, and can never be redirected to an AArch64
or Hyp exception level). Add an assertion which checks this,
and adjust the code so that we construct a syndrome with
an invalid status code, rather than allowing set bits in
the FSR input to randomly corrupt other fields in the syndrome.

Backports commit 65ed2ed90d9d81fd4b639029be850ea5651f919f from qemu
2018-03-02 14:41:07 -05:00
Peter Maydell 1cf80d7536
arm: Move excnames[] array into arm_log_exceptions()
The excnames[] array is defined in internals.h because we used
to use it from two different source files for handling logging
of AArch32 and AArch64 exception entry. Refactoring means that
it's now used only in arm_log_exception() in helper.c, so move
the array into that function.

Backports commit 2c4a7cc5afb1bfc1728a39abd951ddd7714c476e from qemu
2018-03-02 14:39:37 -05:00
Peter Maydell 1af1944903
target/arm: Add missing entries to excnames[] for log strings
Recent changes have added new EXCP_ values to ARM but forgot
to update the excnames[] array which is used to provide
human-readable strings when printing information about the
exception for debug logging. Add the missing entries, and
add a comment to the list of #defines to help avoid the mistake
being repeated in future.

Backports commit 32b81e620ea562d56ab2733421b5da1082b237a2 from qemu
2018-03-02 14:38:23 -05:00
Richard Henderson 13242af398
target/arm: Fix aa64 ldp register writeback
For "ldp x0, x1, [x0]", if the second load is on a second page and
the second page is unmapped, the exception would be raised with x0
already modified. This means the instruction couldn't be restarted.

Backports commit 2d1bbf51c2cb948da4b6fd5f91cf3ecc80b28156 from qemu
2018-03-02 14:35:46 -05:00
Paolo Bonzini c27870520a
exec: revert MemoryRegionCache
MemoryRegionCache did not know about virtio support for IOMMUs (because the
two features were developed at the same time). Revert MemoryRegionCache
to "normal" address_space_* operations for 2.9, as it is simpler than
undoing the virtio patches.

Backports commit 90c4fe5fc517a045e7a7cf2f23472e114042ca29 from qemu
2018-03-02 14:30:41 -05:00
Peter Maydell 008a235b5e
tcg/sparc: Zero extend address argument to ld/st helpers
The C store helper functions take the address argument as a
target_ulong type; if this is 32 bit but the host is 64 bit
then the SPARC calling convention requires that the caller
must zero extend the value. We weren't doing this, which
meant we could pass values to the caller with high bits set
and QEMU would crash if it was compiled with optimizations.
In particular, the i386 BIOS would not start.

Backports commit 5c32be5baf41aec4f4675d2bf24f9948756abf3c from qemu
2018-03-02 14:25:17 -05:00
Peter Maydell 40718df109
tcg/sparc: Zero extend data argument to store helpers
The C store helper functions take the data argument as a uint8_t,
uint16_t, etc depending on the store size. The SPARC calling
convention requires that data types smaller than the register
size must be extended by the caller. We weren't doing this,
which meant that if QEMU was compiled with optimizations enabled
we could end up storing incorrect values to guest memory.
(In particular the i386 guest BIOS would crash on startup.)

Add code to the trampolines that call the store helpers to
do the zero extension as required.

Backports commit 709a340d679d95a0c6cbb9b5f654498f04345b50 from qemu
2018-03-02 14:24:24 -05:00
Eduardo Habkost e71c7b7819
i386: Don't override -cpu options on -cpu host/max
The existing code for "host" and "max" CPU models overrides every
single feature in the CPU object at realize time, even the ones
that were explicitly enabled or disabled by the user using
"feat=on" or "feat=off", while features set using +feat/-feat are
kept.

This means "-cpu host,+invtsc" works as expected, while
"-cpu host,invtsc=on" doesn't.

This was a known bug, already documented in a comment inside
x86_cpu_expand_features(). What makes this bug worse now is that
libvirt 3.0.0 and newer now use "feat=on|off" instead of
+feat/-feat when it detects a QEMU version that supports it (see
libvirt commit d47db7b16dd5422c7e487c8c8ee5b181a2f9cd66).

Change the feature property getter/setter to set a
env->user_features field, to keep track of features that were
explicitly changed using QOM properties. Then make the
max_features code not override user features when handling "-cpu
host" and "-cpu max".

This will also allow us to remove the plus_features/minus_features
hack in the future, but I plan to do that after 2.9.0 is
released.

Backports commit d4a606b38b5d4b3689b86cc1575908e82179ecfb from qemu
2018-03-02 14:22:45 -05:00
Pranith Kumar 31b977ab3e
tcg/i386: Check the size of instruction being translated
This fixes the bug: 'user-to-root privesc inside VM via bad translation
caching' reported by Jann Horn here:
https://bugs.chromium.org/p/project-zero/issues/detail?id=1122

Backports commit 30663fd26c0307e414622c7a8607fbc04f92ec14 from qemu
2018-03-02 14:19:35 -05:00
Paolo Bonzini b750ec2363
configure: remove Cygwin
The Cygwin target is really compiling for native Win32 with -mno-cygwin.
Except, GCC 4.7.0 has finally removed the long deprecated -mno-cygwin
option, and that happened about five years ago.

Let it rest in peace.

Backports commit c8645752ce31cc044ecc5f969a986fdcb6aab590 from qemu
2018-03-02 14:17:41 -05:00
Yongbok Kim ce3aecf263
target/mips: fix delay slot detection in gen_msa_branch()
It is unnecessary to test R6 from delay/forbidden slot check
in gen_msa_branch().

https://bugs.launchpad.net/qemu/+bug/1663287

Backports commit 075a1fe788d36b271ec25507466c30b9a90b5d54 from qemu
2018-03-02 14:15:50 -05:00
Philippe Mathieu-Daudé d17c07b548
target-mips: replace break by goto cp0_unimplemented
this fixes many warnings like:

target/mips/translate.c:6253:13: warning: Value stored to 'rn' is never read
rn = "invalid sel";
^ ~~~~~~~~~~~~~

Backports commit 3570d7f6672836140f0a1ec9bf95dd5ea50a2aaa from qemu
2018-03-02 14:14:57 -05:00
Philippe Mathieu-Daudé 5f78f3cd80
target-mips: log bad coprocessor0 register accesses with LOG_UNIMP
Backports commit 965447eecb6b98d6dfc4dbd97f836093c7e398a0 from qemu
2018-03-02 14:12:29 -05:00
Philippe Mathieu-Daudé e7176e6c85
target-mips: remove old & unuseful comments
Backports commit 989f2aa9af7f05c323761b66c0e299059a19b7b1 from qemu
2018-03-02 14:11:20 -05:00
Philippe Mathieu-Daudé 65c69e6ccb
target-mips: fix compiler warnings (clang 5)
static code analyzer complain:

target/mips/helper.c:453:5: warning: Function call argument is an uninitialized value
qemu_log_mask(CPU_LOG_MMU,
^~~~~~~~~~~~~~~~~~~~~~~~~~

'physical' and 'prot' are uninitialized if 'ret' is not TLBRET_MATCH.

Backports commit def74c0cf05722b2e502d4b4f1219966c5b0cbd3 from qemu
2018-03-02 14:09:55 -05:00
Peter Maydell 78303d4c1b
arm: Fix APSR writes via M profile MSR
Our implementation of writes to the APSR for M-profile via the MSR
instruction was badly broken.

First and worst, we had the sense wrong on the test of bit 2 of the
SYSm field -- this is supposed to request an APSR write if bit 2 is 0
but we were doing it if bit 2 was 1. This bug was introduced in
commit 58117c9bb429cd, so hasn't been in a QEMU release.

Secondly, the choice of exactly which parts of APSR should be written
is defined by bits in the 'mask' field. We were not passing these
through from instruction decode, making it impossible to check them
in the helper.

Pass the mask bits through from the instruction decode to the helper
function and process them appropriately; fix the wrong sense of the
SYSm bit 2 check.

Invalid mask values and invalid combinations of mask and register
number are UNPREDICTABLE; we choose to treat them as if the mask
values were valid.

Backports commit b28b3377d7e9ba35611d454d5a63ef50cab1f8c5 from qemu
2018-03-02 14:08:13 -05:00
Peter Maydell bb5819cbbc
armv7m: R14 should reset to 0xffffffff
For M profile (unlike A profile) the reset value of R14 is specified
as 0xffffffff. (The rationale is that this is an illegal exception
return value, so if guest code tries to return to it it will result
in a helpful exception.)

Registers r0 to r12 and the flags are architecturally UNKNOWN on
reset, so we leave those at zero.

Backports commit 056f43df9168413f304500b69c33158d66efb7cf from qemu
2018-03-02 13:56:36 -05:00
Michael Davidsaver f42f22ec02
armv7m: FAULTMASK should be 0 on reset
For M profile CPUs, FAULTMASK should be 0 on reset, like PRIMASK.
QEMU stores FAULTMASK in the PSTATE F bit, so (as with PRIMASK in the
I bit) we have to clear these to undo the A profile default of 1.

Update the comment accordingly and move it so that it's closer to the
code it's referring to.

Backports commit dc7abe4d65ad39390b2db120f5ad18f8f6576f8b from qemu
2018-03-02 13:55:59 -05:00
Peter Maydell 8a6d746aef
armv7m: Report no-coprocessor faults correctly
For v7M attempts to access a nonexistent coprocessor are reported
differently from plain undefined instructions (as UsageFaults of type
NOCP rather than type UNDEFINSTR). Split them out into a new
EXCP_NOCP so we can report the FSR value correctly.

Backports commit 7517748e3f71a3099e57915fba95c4c308e6d842 from qemu
2018-03-02 13:54:36 -05:00
Peter Maydell fce8138187
armv7m: Report no-coprocessor faults correctly
For v7M attempts to access a nonexistent coprocessor are reported
differently from plain undefined instructions (as UsageFaults of type
NOCP rather than type UNDEFINSTR). Split them out into a new
EXCP_NOCP so we can report the FSR value correctly.

Backports commit 7517748e3f71a3099e57915fba95c4c308e6d842 from qemu
2018-03-02 13:47:14 -05:00
Michael Davidsaver eaa080e232
armv7m: set CFSR.UNDEFINSTR on undefined instructions
When we take an exception for an undefined instruction, set the
appropriate CFSR bit.

Backports commit 81dd9648c69bb89afdd6f4bb3ed6f3efdac96524 from qemu
2018-03-02 13:45:56 -05:00
Michael Davidsaver 2297b8134b
armv7m: honour CCR.STACKALIGN on exception entry
The CCR.STACKALIGN bit controls whether the CPU is supposed to force
8-alignment of the stack pointer on entry to the exception handler.

Backports commit dc858c6633a9af8b80c1509cf6f825e4390d3ad1 from qemu
2018-03-02 13:45:06 -05:00
Peter Maydell 7870bcfcb0
armv7m: add state for v7M CCR, CFSR, HFSR, DFSR, MMFAR, BFAR
Add the structure fields, VMState fields, reset code and macros for
the v7M system control registers CCR, CFSR, HFSR, DFSR, MMFAR and
BFAR.

Backports commit 2c4da50d9477fb830d778bb5d6a11215aa359b44 from qemu
2018-03-02 13:43:55 -05:00
Michael Davidsaver 7f044bf8cc
armv7m: Clear FAULTMASK on return from non-NMI exceptions
FAULTMASK must be cleared on return from all
exceptions other than NMI.

Backports commit a20ee6005564590d33eabec11ed4dc7c432db36b from qemu
2018-03-02 13:41:16 -05:00
Michael Davidsaver cc9458cf59
armv7m: Explicit error for bad vector table
Give an explicit error and abort when a load
from the vector table fails. Architecturally this
should HardFault (which will then immediately
fail to load the HardFault vector and go into Lockup).
Since we don't model Lockup, just report this guest
error via cpu_abort(). This is more helpful than the
previous behaviour of reading a zero, which is the
address of the reset stack pointer and not a sensible
location to jump to.

Backports commit 1b9ea408fca1ce8caae67b792355b023c69c5ac5 from qemu
2018-03-02 13:38:08 -05:00
Michael Davidsaver 703489071f
armv7m: Replace armv7m.hack with unassigned_access handler
For v7m we need to catch attempts to execute from special
addresses at 0xfffffff0 and above. Previously we did this
with the aid of a hacky special purpose lump of memory
in the address space and a check in translate.c for whether
we were translating code at those addresses.

We can implement this more cleanly using a CPU
unassigned access handler which throws the exception
if the unassigned access is for one of the special addresses.

Backports commit 542b3478a00cb7ef51c259255b3ab1e2a7daada2 from qemu
2018-03-02 13:33:31 -05:00
Michael Davidsaver 8828b4e595
armv7m: MRS/MSR: handle unprivileged access
The MRS and MSR instruction handling has a number of flaws:
* unprivileged accesses should only be able to read
CONTROL and the xPSR subfields, and only write APSR
(others RAZ/WI)
* privileged access should not be able to write xPSR
subfields other than APSR
* accesses to unimplemented registers should log as
guest errors, not abort QEMU

Backports commit 58117c9bb429cd9552d998687aa99088eb1d8528 from qemu
2018-03-02 13:29:59 -05:00
Michael Davidsaver 2769c6ada0
armv7m: Fix reads of CONTROL register bit 1
The v7m CONTROL register bit 1 is SPSEL, which indicates
the stack being used. We were storing this information
not in v7m.control but in the separate v7m.other_sp
structure field. Unfortunately, the code handling reads
of the CONTROL register didn't take account of this, and
so if SPSEL was updated by an exception entry or exit then
a subsequent guest read of CONTROL would get the wrong value.

Using a separate structure field doesn't really gain us
anything in efficiency, so drop this unnecessary complexity
in favour of simply storing all the bits in v7m.control.

This is a migration compatibility break for M profile
CPUs only.

Backports commit abc24d86cc0364f402e438fae3acb14289b40734 from qemu
2018-03-02 13:26:38 -05:00
Peter Maydell d8eb259032
arm: Enforce should-be-1 bits in MRS decoding
The MRS instruction requires that bits [19..16] are all 1s, and for
A/R profile also that bits [7..0] are all 0s. At this point in the
decode tree we have checked all of the rest of the instruction but
were allowing these to be any value. If these bits are not set then
the result is architecturally UNPREDICTABLE, but choosing to UNDEF is
more helpful to the user and avoids unexpected odd behaviour if the
encodings are used for some purpose in future architecture versions.

Backports commit 3d54026fb06d1aea7ebb4e9825970b06bebcacac from qemu
2018-03-02 13:09:17 -05:00
Peter Maydell dc44eded51
arm: Don't decode MRS(banked) or MSR(banked) for M profile
M profile doesn't have the MSR(banked) and MRS(banked) instructions
and uses the encodings for different kinds of M-profile MRS/MSR.
Guard the relevant bits of the decode logic to make sure we don't
accidentally fall into them by accident on M-profile.

(The bit being checked for this (bit 5) is part of the SYSm field on
M-profile, but since no currently allocated system registers have
encodings with bit 5 of SYSm set, this hasn't been a problem in
practice.)

Backports commit 43ac65742319ef5ac4461daf43316b189cd21e89 from qemu
2018-03-02 13:08:20 -05:00
Peter Maydell cc2a6a2728
arm: HVC and SMC encodings don't exist for M profile
M profile doesn't have the HVC or SMC encodings, so make them always
UNDEF rather than generating calls to helper functions that assume
A/R profile.

Backports commit 001b3cab51ebfcb13e8dd03ea25bfa3bd0c517a3 from qemu
2018-03-02 13:07:31 -05:00
Dr. David Alan Gilbert 55d79cf4c0
RAMBlocks: qemu_ram_is_shared
Provide a helper to say whether a RAMBlock was created as a
shared mapping.

Backports commit 463a4ac23bcf0f0b65c850fa66f5ae6e43edd243 from qemu
2018-03-02 13:05:35 -05:00
Dr. David Alan Gilbert 5dfbee8930
memory_region: Fix name comments
The 'name' parameter to memory_region_init_* had been marked as debug
only, however vmstate_region_ram uses it as a parameter to
qemu_ram_set_idstr to set RAMBlock names and these form part of the
migration stream.

Backports commit e8f5fe2de125a0bfbefbaa6a69af81f4817cb7a0 from qemu
2018-03-02 13:01:23 -05:00
Andrew Jones 0139cbc2cd
target/arm/arm-powerctl: Fix psci info return values
The power state spec section 5.1.5 AFFINITY_INFO defines the
affinity info return values as

0 ON
1 OFF
2 ON_PENDING

I grepped QEMU for power_state to ensure that no assumptions
of OFF=0 were being made.

Backports commit d5affb0d8677e1a8a8fe03fa25005b669e7cdc02 from qemu
2018-03-02 12:59:49 -05:00
Andrew Baumann 76cd64dd7e
target/arm: implement armv8 PMUSERENR (user-mode enable bits)
In armv8, this register implements more than a single bit, with
fine-grained enables for read access to event counters, cycles
counters, and write access to the software increment. This change
implements those checks using custom access functions for the relevant
registers.

Backports commit 6ecd0b6ba0591ef280ed984103924d4bdca5ac32 from qemu
2018-03-02 12:55:46 -05:00
Eduardo Habkost 9ddce7c01d
i386: Change stepping of Haswell to non-blacklisted value
glibc blacklists TSX on Haswell CPUs with model==60 and
stepping < 4. To make the Haswell CPU model more useful, make
those guests actually use TSX by changing CPU stepping to 4.

References:
* glibc commit 2702856bf45c82cf8e69f2064f5aa15c0ceb6359
https://sourceware.org/git/?p=glibc.git;a=commit;h=2702856bf45c82cf8e69f2064f5aa15c0ceb6359

Backports commit ec56a4a7b07e2943f49da273a31e3195083b1f2e from qemu
2018-03-02 12:53:11 -05:00
Eduardo Habkost f865b17639
i386: host_vendor_fms() helper function
Helper function for code that needs to check the host CPU
vendor/family/model/stepping values.

Backports commit 20271d484069f154fb262507e63adc3a37e885d2 from qemu
2018-03-02 12:51:44 -05:00
Alex Bennée b8caaac110
target/arm/helper: make it clear the EC field is also in hex
..just like the rest of the displayed ESR register. Otherwise people
might scratch their heads if a not obviously hex number is displayed
for the EC field.

Backports commit 6568da459b611845ef55526cd23afc9fa9f4647f from qemu
2018-03-02 12:50:33 -05:00
Paolo Bonzini bc7a9ccfbd
target-i386: defer VMEXIT to do_interrupt
Paths through the softmmu code during code generation now need to be audited
to check for double locking of tb_lock. In particular, VMEXIT can take tb_lock
through cpu_vmexit -> cpu_x86_update_cr4 -> tlb_flush.

To avoid this, split VMEXIT delivery in two parts, similar to what is done with
exceptions. cpu_vmexit only records the VMEXIT exit code and information, and
cc->do_interrupt can then deliver it when it is safe to take the lock.

Backports commit 10cde894b63146139f981857e4eedf756fa53dcb from qemu
2018-03-02 12:49:18 -05:00
Alex Bennée ad548f8110
translate-all: exit cpu_restore_state early if translating
The translation code uses cpu_ld*_code which can trigger a tlb_fill
which if it fails will erroneously attempts a fault resolution. This
never works during translation as the TB being generated hasn't been
added yet. The target should have checked retaddr before calling
cpu_restore_state but for those that have yet to be fixed we do it
here to avoid a recursive tb_lock() under MTTCG's new locking regime

Backports commit d8b2239bcd8872a5c5f7534d1658fc2365caab2d from qemu
2018-03-02 12:46:16 -05:00
Alex Bennée a01496e6d9
target/i386/cpu.h: declare TCG_GUEST_DEFAULT_MO
This suppresses the incorrect warning when forcing MTTCG for x86
guests on x86 hosts. A future patch will still warn when
TARGET_SUPPORT_MTTCG hasn't been defined for the guest (which is still
pending for x86).

Backports commit 72c1701f62e8d44eb24a0583a958edc280105455 from qemu
2018-03-02 12:43:37 -05:00
Markus Armbruster 8a8dc93945
qapi: Improve qobject visitor documentation
Backports commit aa3a982e674b09ae32502940f93ba98b3a8ad50e from qemu
2018-03-02 12:24:21 -05:00
Markus Armbruster 67cb4b0900
qapi: Fix object input visit beyond end of list
Backports commit 1f41a645b65530859bf5984aa08e103bb452b473 from qemu
2018-03-02 12:22:50 -05:00
Markus Armbruster ac1a61af47
qapi: Make input visitors detect unvisited list tails
Fix the design flaw demonstrated in the previous commit: new method
check_list() lets input visitors report that unvisited input remains
for a list, exactly like check_struct() lets them report that
unvisited input remains for a struct or union.

Implement the method for the qobject input visitor (straightforward),
and the string input visitor (less so, due to the magic list syntax
there). The opts visitor's list magic is even more impenetrable, and
all I can do there today is a stub with a FIXME comment. No worse
than before.

Backports commit a4a1c70dc759e5b81627e96564f344ab43ea86eb from qemu
2018-03-02 12:21:04 -05:00
Markus Armbruster e0ee098c4a
qapi: Drop unused non-strict qobject input visitor
The split between tests/test-qobject-input-visitor.c and
tests/test-qobject-input-strict.c now makes less sense than ever. The
next commit will take care of that.

Backports commit 048abb7b20c9f822ad9d4b730bade73b3311a47a from qemu
2018-03-02 12:14:52 -05:00
Markus Armbruster 3e8b0c66a3
qom: Make object_property_set_qobject()'s input visitor strict
Commit 240f64b made all qobject input visitors created outside tests
strict, except for the one in object_property_set_qobject(). That one
was left behind only because Eric couldn't spare the time to figure
out whether making it strict would break anything, with a TODO
comment. Time to resolve it.

Strict makes a difference only for otherwise successful visits of QAPI
structs or unions. Let's examine what the callers of
object_property_set_qobject() visit:

* object_property_set_str(), object_property_set_bool(),
object_property_set_int() visit a QString, QBool, QInt,
respectively. Strictness can't matter.

* qmp_qom_set visits its @value argument. Comes straight from QMP and
can be anything ('any' in the QAPI schema). Strictness matters when
the property's set() method visits a struct or union QAPI type.

No such methods exist, thus switching to strict can't break
anything.

If we acquire such methods in the future, we'll *want* the visitor
to be strict, so that unexpected members get rejected as they should
be.

Switch to strict.

Backports commit 05601ed2de60df0e344d6b783a6bc0c1ff2b5d1f from qemu
2018-03-02 12:10:50 -05:00
Markus Armbruster 2b7daee13b
qapi: Make string input and opts visitor require non-null input
The string input visitor tries to cope with null input. Null input
isn't used anywhere, and isn't covered by tests. Unsurprisingly, it
doesn't fully work: start_list() crashes because it passes the input
via parse_str() to strtoll() unchecked.

Make string_input_visitor_new() assert its argument isn't null, and
drop the code trying to deal with null input.

The opts visitor crashes when you try to actually visit something with
null input. Make opts_visitor_new() assert its argument isn't null,
mostly for clarity.

qobject_input_visitor_new() already asserts its argument isn't null.

Backports commit f332e830e38b3ff3953ef02ac04e409ae53769c5 from qemu
2018-03-02 12:10:07 -05:00
Markus Armbruster 50e3cda49a
qapi: Drop string input visitor method optional()
visit_optional() is to be called only between visit_start_struct() and
visit_end_struct(). Visitors that don't support struct visits,
i.e. don't implement start_struct(), end_struct(), have no use for it.
Clarify documentation.

The string input visitor doesn't support struct visits. Its
parse_optional() is therefore useless. Drop it.

Backports commit a8aec6de2ac1a5e36989fdfba29067b361009b75 from qemu
2018-03-02 12:07:55 -05:00
Markus Armbruster 84e5261cdf
qapi: Improve qobject input visitor error reporting
Error messages refer to nodes of the QObject being visited by name.
Trouble is the names are sometimes less than helpful:

* The name of the root QObject is whatever @name argument got passed
to the visitor, except NULL gets mapped to "null". We commonly pass
NULL. Not good.

Avoiding errors "at the root" mitigates. For instance,
visit_start_struct() can only fail when the visited object is not a
dictionary, and we commonly ensure it is beforehand.

* The name of a QDict's member is the member key. Good enough only
when this happens to be unique.

* The name of a QList's member is "null". Not good.

Improve error messages by referring to nodes by path instead, as
follows:

* The path of the root QObject is whatever @name argument got passed
to the visitor, except NULL gets mapped to "<anonymous>".

* The path of a root QDict's member is the member key.

* The path of a root QList's member is "[%u]", where %u is the list
index, starting at zero.

* The path of a non-root QDict's member is the path of the QDict
concatenated with "." and the member key.

* The path of a non-root QList's member is the path of the QList
concatenated with "[%u]", where %u is the list index.

For example, the incorrect QMP command

{ "execute": "blockdev-add", "arguments": { "node-name": "foo", "driver": "raw", "file": {"driver": "file" } } }

now fails with

{"error": {"class": "GenericError", "desc": "Parameter 'file.filename' is missing"}}

instead of

{"error": {"class": "GenericError", "desc": "Parameter 'filename' is missing"}}

and

{ "execute": "input-send-event", "arguments": { "device": "bar", "events": [ [] ] } }

now fails with

{"error": {"class": "GenericError", "desc": "Invalid parameter type for 'events[0]', expected: object"}}

instead of

{"error": {"class": "GenericError", "desc": "Invalid parameter type for 'null', expected: QDict"}}

Aside: calling the thing "parameter" is suboptimal for QMP, because
the root object is "arguments" there.

The qobject output visitor doesn't have this problem because it should
not fail. Same for dealloc and clone visitors.

The string visitors don't have this problem because they visit just
one value, whose name needs to be passed to the visitor as @name. The
string output visitor shouldn't fail anyway.

The options visitor uses QemuOpts names. Their name space is flat, so
the use of QDict member keys as names is fine. NULL names used with
roots and lists could conceivably result in bad error messages. Left
for another day.

Backports commit a9fc37f6bc3f2ab90585cb16493da9f6dcfbfbcf from qemu
2018-03-02 12:05:53 -05:00
Markus Armbruster a5cf19858d
qapi: Make QObject input visitor set *list reliably
qobject_input_start_struct() sets *list, except when it fails because
qobject_input_get_object() fails, i.e. the input object doesn't exist.

All the other input visitor start_struct(), start_list(),
start_alternate() always set *obj / *list.

Change qobject_input_start_struct() to match.

Backports commit 58561c27669ddf1c6d39ff8ce25837c6f2d9d92c from qemu
2018-03-02 11:31:58 -05:00
Markus Armbruster fdf09c6d12
qapi: Clean up after commit 3d344c2
Drop unused QIV_STACK_SIZE and unused qobject_input_start_struct()
parameter errp.

Backports commit b8874fbfd329b5084463bcacd1418d493a93c383 from qemu
2018-03-02 11:30:38 -05:00
Markus Armbruster d7da652d4e
qapi: Improve a QObject input visitor error message
The QObject input visitor has three error message formats:

* Parameter '%s' is missing
* "Invalid parameter type for '%s', expected: %s"
* "QMP input object member '%s' is unexpected"

The '%s' are member names (or "null", but I'll fix that later).

The last error message calls the thing "QMP input object member"
instead of "parameter". Misleading when the visitor is used on
QObjects that don't come from QMP. Change it to "Parameter '%s' is
unexpected".

Backports commit 910f738b851a263396fc85b2052e47f884ffead3 from qemu
2018-03-02 11:29:02 -05:00
Markus Armbruster d07bcef231
qmp: Eliminate silly QERR_QMP_* macros
The QERR_ macros are leftovers from the days of "rich" error objects.

QERR_QMP_BAD_INPUT_OBJECT, QERR_QMP_BAD_INPUT_OBJECT_MEMBER,
QERR_QMP_EXTRA_MEMBER are used in just one place now, except for one
use that has crept into qobject-input-visitor.c.

Drop these macros, to make the (bad) error messages more visible.

Backports commit 99fb0c53c038105bae68b02a3d9f1cbf7951ba10 from qemu
2018-03-02 11:28:17 -05:00
Yongji Xie 23f5b17a08
memory: Introduce DEVICE_HOST_ENDIAN for ram device
At the moment ram device's memory regions are DEVICE_NATIVE_ENDIAN. It's
incorrect. This memory region is backed by a MMIO area in host, so the
uint64_t data that MemoryRegionOps read from/write to this area should be
host-endian rather than target-endian. Hence, current code does not work
when target and host endianness are different which is the most common case
on PPC64. To fix it, this introduces DEVICE_HOST_ENDIAN for the ram device.

This has been tested on PPC64 BE/LE host/guest in all possible combinations
including TCG.

Backports commit c99a29e702528698c0ce2590f06ca7ff239f7c39 from qemu
2018-03-02 11:24:32 -05:00
Paolo Bonzini 11709d0afa
cpu-exec: remove unnecessary check of cpu->exit_request
The cpu->exit_request check in cpu_loop_exec_tb is unnecessary,
because cpu->tcg_exit_req is always set after cpu->exit_request.
So let the TB exit and we will pick up the exit request later
in cpu_handle_interrupt.

Backports commit 55ac0a9bf4e1b1adfc7d73586a7aa085f58c9851 from qemu
2018-03-02 11:21:35 -05:00
Eduardo Habkost 33ab5f71c9
i386: Reorganize and document CPUID initialization steps
CPU runnability checks and CPU model expansion have slightly
different requirements. Document the steps involved in loading a
CPU model and realizing a CPU, so their requirements and purpose
are clearly defined.

This patch doesn't change any implementation. It just add
comments, rename the x86_cpu_load_features() function for clarity
(so it won't be confused with x86_cpu_load_def()), and move
x86_cpu_filter_features() closer to it.

Backports commit b8d834a00fa3ed4dad7d371e1a00938a126a54a0 from qemu
2018-03-02 10:55:00 -05:00
Eduardo Habkost be606acff9
i386: Rename X86CPU::host_features to X86CPU::max_features
Rename the field and add a small comment to make its purpose
clearer.

Backports commit 44bd8e530661be1d22ae0f461a5c9bdbcc3847ec from qemu
2018-03-02 10:51:40 -05:00
Pranith Kumar ee609fa59f
aarch64: Change ext type to TCGType to fix warnings
To fix the following warnings:

In file included from /users/pranith/qemu/tcg/tcg.c:255:
/users/pranith/qemu/tcg/aarch64/tcg-target.inc.c:879:24: warning: implicit conversion from enumeration type 'TCGMemOp' (aka 'enum TCGMemOp') to different enumeration type 'TCGType' (aka 'enum TCGType')
[-Wenum-conversion]
tcg_out_cmp(s, ext, a, b, b_const);
~~~~~~~~~~~ ^~~
/users/pranith/qemu/tcg/aarch64/tcg-target.inc.c:893:36: warning: implicit conversion from enumeration type 'TCGMemOp' (aka 'enum TCGMemOp') to different enumeration type 'TCGType' (aka 'enum TCGType')
[-Wenum-conversion]
tcg_out_insn(s, 3201, CBZ, ext, a, offset);
~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~
/users/pranith/qemu/tcg/aarch64/tcg-target.inc.c:389:65: note: expanded from macro 'tcg_out_insn'
glue(tcg_out_insn_,FMT)(S, glue(glue(glue(I,FMT),_),OP), ## __VA_ARGS__)
^
/users/pranith/qemu/tcg/aarch64/tcg-target.inc.c:895:37: warning: implicit conversion from enumeration type 'TCGMemOp' (aka 'enum TCGMemOp') to different enumeration type 'TCGType' (aka 'enum TCGType')
[-Wenum-conversion]
tcg_out_insn(s, 3201, CBNZ, ext, a, offset);
~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~
/users/pranith/qemu/tcg/aarch64/tcg-target.inc.c:389:65: note: expanded from macro 'tcg_out_insn'
glue(tcg_out_insn_,FMT)(S, glue(glue(glue(I,FMT),_),OP), ## __VA_ARGS__)
^
/users/pranith/qemu/tcg/aarch64/tcg-target.inc.c:1610:27: warning: implicit conversion from enumeration type 'TCGType' (aka 'enum TCGType') to different enumeration type 'TCGMemOp' (aka 'enum TCGMemOp')
[-Wenum-conversion]
tcg_out_brcond(s, ext, a2, a0, a1, const_args[1], arg_label(args[3]));
~~~~~~~~~~~~~~ ^~~

backports commit dc1eccd661ada3b746ca4438e444993c36a0f04f from qemu
2018-03-02 10:48:56 -05:00
Peter Maydell e141ea5dd2
softfloat: Use correct type in float64_to_uint64_round_to_zero()
In float64_to_uint64_round_to_zero() a typo meant that we were
taking the uint64_t return value from float64_to_uint64() and
putting it into an int64_t variable before returning it as
uint64_t again. Use uint64_t instead of pointlessly casting it
back and forth to int64_t.

Backports commit d000b477f2693dbca97cd8ea751c2e0b71890662 from qemu
2018-03-02 10:44:10 -05:00
Peter Maydell 0c9ef6f4b3
cputlb: Don't assume do_unassigned_access() never returns
In get_page_addr_code(), if the guest PC doesn't correspond to RAM
then we currently run the CPU's do_unassigned_access() hook if it has
one, and otherwise we give up and exit QEMU with a more-or-less
useful message. This code assumes that the do_unassigned_access hook
will never return, because if it does then we'll plough on attempting
to use a non-RAM TLB entry to get a RAM address and will abort() in
qemu_ram_addr_from_host_nofail(). Unfortunately some CPU
implementations of this hook do return: Microblaze, SPARC and the ARM
v7M.

Change the code to call report_bad_exec() if the hook returns, as
well as if it didn't have one. This means we can tidy it up to use
the cpu_unassigned_access() function which wraps the "get the CPU
class and call the hook if it has one" work, since we aren't trying
to distinguish "no hook" from "hook existed and returned" any more.

This brings the handling of this hook into line with the handling
used for data accesses, where "hook returned" is treated the
same as "no hook existed" and gets you the default behaviour.

Backports commit 44d7ce0ef39cb45e13d384574d79799eb3d39834 from qemu
2018-03-02 10:42:35 -05:00
Nick Reilly 4114fb2c0e
Add missing fp_access_check() to aarch64 crypto instructions
The aarch64 crypto instructions for AES and SHA are missing the
check for if the FPU is enabled.

Backports commit a4f5c5b72380deeccd53a6890ea3782f10ca8054 from qemu
2018-03-02 10:39:16 -05:00
Alex Bennée caba238b5a
tcg: enable MTTCG by default for ARM on x86 hosts
This enables the multi-threaded system emulation by default for ARMv7
and ARMv8 guests using the x86_64 TCG backend. This is because on the
guest side:

- The ARM translate.c/translate-64.c have been converted to
- use MTTCG safe atomic primitives
- emit the appropriate barrier ops
- The ARM machine has been updated to
- hold the BQL when modifying shared cross-vCPU state
- defer powerctl changes to async safe work

All the host backends support the barrier and atomic primitives but
need to provide same-or-better support for normal load/store
operations.

Backports commit ca759f9e387db87e1719911f019bc60c74be9ed8 from qemu
2018-03-02 10:32:47 -05:00
Alex Bennée ff0ff28939
target-arm: don't generate WFE/YIELD calls for MTTCG
The WFE and YIELD instructions are really only hints and in TCG's case
they were useful to move the scheduling on from one vCPU to the next. In
the parallel context (MTTCG) this just causes an unnecessary cpu_exit
and contention of the BQL.

Backports commit c22edfebff29f63d793032e4fbd42a035bb73e27 from qemu
2018-03-02 10:27:36 -05:00
Alex Bennée 157efaa8a9
cputlb: tweak qemu_ram_addr_from_host_nofail reporting
This moves the helper function closer to where it is called and updates
the error message to report via error_report instead of the deprecated
fprintf.

Backports commit 857baec1d9e80947f0c1007c3a3d2331d62b4b53 from qemu
2018-03-02 10:24:03 -05:00
Alex Bennée 454932263c
cputlb and arm/sparc targets: convert mmuidx flushes from varg to bitmap
While the vargs approach was flexible the original MTTCG ended up
having munge the bits to a bitmap so the data could be used in
deferred work helpers. Instead of hiding that in cputlb we push the
change to the API to make it take a bitmap of MMU indexes instead.

For ARM some the resulting flushes end up being quite long so to aid
readability I've tended to move the index shifting to a new line so
all the bits being or-ed together line up nicely, for example:

tlb_flush_page_by_mmuidx(other_cs, pageaddr,
(1 << ARMMMUIdx_S1SE1) |
(1 << ARMMMUIdx_S1SE0));

Backports commit 0336cbf8532935d8e23c2aabf3e2ce2c0697b6ac from qemu
2018-03-02 10:12:40 -05:00
Alex Bennée d56a4b0be4
tcg: handle EXCP_ATOMIC exception for system emulation
The patch enables handling atomic code in the guest. This should be
preferably done in cpu_handle_exception(), but the current assumptions
regarding when we can execute atomic sections cause a deadlock.

The current mechanism discards the flags which were set in atomic
execution. We ensure they are properly saved by calling the
cc->cpu_exec_enter/leave() functions around the loop.

As we are running cpu_exec_step_atomic() from the outermost loop we
need to avoid an abort() when single stepping over atomic code since
debug exception longjmp will point to the the setlongjmp in
cpu_exec(). We do this by setting a new jmp_env so that it jumps back
here on an exception.

Backports relevant parts of commit 08e73c48b053566bfe0c994f154f73991cd0ff0e from qemu
2018-03-02 09:56:43 -05:00
Alex Bennée 6760605e1c
tcg: enable thread-per-vCPU
There are a couple of changes that occur at the same time here:

- introduce a single vCPU qemu_tcg_cpu_thread_fn

One of these is spawned per vCPU with its own Thread and Condition
variables. qemu_tcg_rr_cpu_thread_fn is the new name for the old
single threaded function.

- the TLS current_cpu variable is now live for the lifetime of MTTCG
vCPU threads. This is for future work where async jobs need to know
the vCPU context they are operating in.

The user to switch on multi-thread behaviour and spawn a thread
per-vCPU. For a simple test kvm-unit-test like:

./arm/run ./arm/locking-test.flat -smp 4 -accel tcg,thread=multi

Will now use 4 vCPU threads and have an expected FAIL (instead of the
unexpected PASS) as the default mode of the test has no protection when
incrementing a shared variable.

We enable the parallel_cpus flag to ensure we generate correct barrier
and atomic code if supported by the front and backends. This doesn't
automatically enable MTTCG until default_mttcg_enabled() is updated to
check the configuration is supported.

Backports relevant parts of commit 372579427a5040a26dfee78464b50e2bdf27ef26
2018-03-02 09:43:14 -05:00
Alex Bennée 632b853761
tcg: remove global exit_request
There are now only two uses of the global exit_request left.

The first ensures we exit the run_loop when we first start to process
pending work and in the kick handler. This is just as easily done by
setting the first_cpu->exit_request flag.

The second use is in the round robin kick routine. The global
exit_request ensured every vCPU would set its local exit_request and
cause a full exit of the loop. Now the iothread isn't being held while
running we can just rely on the kick handler to push us out as intended.

We lightly re-factor the main vCPU thread to ensure cpu->exit_requests
cause us to exit the main loop and process any IO requests that might
come along. As an cpu->exit_request may legitimately get squashed
while processing the EXCP_INTERRUPT exception we also check
cpu->queued_work_first to ensure queued work is expedited as soon as
possible.

Backports commit e5143e30fb87fbf179029387f83f98a5a9b27f19 from qemu
2018-03-02 09:38:08 -05:00
Alex Bennée 4d90497d14
tcg: rename tcg_current_cpu to tcg_current_rr_cpu
..and make the definition local to cpus. In preparation for MTTCG the
concept of a global tcg_current_cpu will no longer make sense. However
we still need to keep track of it in the single-threaded case to be able
to exit quickly when required.

qemu_cpu_kick_no_halt() moves and becomes qemu_cpu_kick_rr_cpu() to
emphasise its use-case. qemu_cpu_kick now kicks the relevant cpu as
well as qemu_kick_rr_cpu() which will become a no-op in MTTCG.

For the time being the setting of the global exit_request remains.

Backports commit 791158d93b27f22a17c2ada06621831d54f09a2c from qemu

Also atomically sets the unicorn equivalents
2018-03-02 09:28:51 -05:00
Lioncash 18a229a69f
Resolve symbol errors with softfloat 2018-03-02 09:25:05 -05:00
KONRAD Frederic c5730ff194
tcg: add options for enabling MTTCG
We know there will be cases where MTTCG won't work until additional work
is done in the front/back ends to support. It will however be useful to
be able to turn it on.

As a result MTTCG will default to off unless the combination is
supported. However the user can turn it on for the sake of testing.

Backports commit 8d4e9146b3568022ea5730d92841345d41275d66 from qemu
2018-03-02 09:25:01 -05:00
Alex Bennée 8c89344517
tcg: move TCG_MO/BAR types into own file
We'll be using the memory ordering definitions to define values for
both the host and guest. To avoid fighting with circular header
dependencies just move these types into their own minimal header.

Backports commit 20937143145b8f5a4194e5c407731ba38797864e from qemu
2018-03-02 09:08:44 -05:00
Pranith Kumar 616becc2dc
mttcg: translate-all: Enable locking debug in a debug build
Enable tcg lock debug asserts in a debug build by default instead of
relying on DEBUG_LOCKING. None of the other DEBUG_* macros have
asserts, so this patch removes DEBUG_LOCKING and enable these asserts
in a debug build.

Backports commit 6ac3d7e845549f08473f020c1c70f14b8911a67e from qemu
2018-03-02 09:00:58 -05:00
Markus Armbruster 89d8e58718
util/cutils: Change qemu_strtosz*() from int64_t to uint64_t
This will permit its use in parse_option_size().

Backports commit f46bfdbfc8f95cf65d7818ef68a801e063c40332 from qemu
2018-03-02 08:58:55 -05:00
Markus Armbruster 8650d0213c
util/cutils: Return qemu_strtosz*() error and value separately
This makes qemu_strtosz(), qemu_strtosz_mebi() and
qemu_strtosz_metric() similar to qemu_strtoi64(), except negative
values are rejected.

Backports commit f17fd4fdf0df3d2f3444399d04c38d22b9a3e1b7 from qemu
2018-03-02 08:57:16 -05:00
Markus Armbruster 6093e67947
util/cutils: Let qemu_strtosz*() optionally reject trailing crap
Change the qemu_strtosz() & friends to return -EINVAL when @endptr is
null and the conversion doesn't consume the string completely.
Matches how qemu_strtol() & friends work.

Only test_qemu_strtosz_simple() passes a null @endptr. No functional
change there, because its conversion consumes the string.

Simplify callers that use @endptr only to fail when it doesn't point
to '\0' to pass a null @endptr instead.

Backports commit 4fcdf65ae2c00ae69f7625f26ed41f37d77b403c from qemu
2018-03-02 08:54:53 -05:00
Markus Armbruster f9c9eb7334
util/cutils: Drop QEMU_STRTOSZ_DEFSUFFIX_* macros
Writing QEMU_STRTOSZ_DEFSUFFIX_* instead of '*' gains nothing. Get
rid of these eyesores.

Backports commit 17f942560e54f8ee72996bc3276c697503606d7b from qemu
2018-03-02 08:53:15 -05:00
Markus Armbruster 858acd4142
util/cutils: New qemu_strtosz()
Most callers of qemu_strtosz_suffix() pass QEMU_STRTOSZ_DEFSUFFIX_B.
Capture the pattern in new qemu_strtosz().

Inline qemu_strtosz_suffix() into its only remaining caller.

Backports commit 466dea14e677555dd24465aca75d00a3537ad062 from qemu
2018-03-02 08:50:56 -05:00
Markus Armbruster a3358798d6
util/cutils: Rename qemu_strtosz() to qemu_strtosz_MiB()
With qemu_strtosz(), no suffix means mebibytes. It's used rarely.
I'm going to add a similar function where no suffix means bytes.
Rename qemu_strtosz() to qemu_strtosz_MiB() to make the name
qemu_strtosz() available for the new function.

Backports commit e591591b323772eea733de6027f5e8b50692d0ff from qemu
2018-03-02 08:49:26 -05:00
Markus Armbruster f656cd91ec
util/cutils: New qemu_strtosz_metric()
To parse numbers with metric suffixes, we use

qemu_strtosz_suffix_unit(nptr, &eptr, QEMU_STRTOSZ_DEFSUFFIX_B, 1000)

Capture this in a new function for legibility:

qemu_strtosz_metric(nptr, &eptr)

Replace test_qemu_strtosz_suffix_unit() by test_qemu_strtosz_metric().

Rename qemu_strtosz_suffix_unit() to do_strtosz() and give it internal
linkage.

Backports commit d2734d2629266006b0413433778474d5801c60be from qemu
2018-03-02 08:47:40 -05:00
Markus Armbruster fb962d2e74
util/cutils: Clean up control flow around qemu_strtol() a bit
Reorder check_strtox_error() to make it obvious that we always store
through a non-null @endptr.

Transform

if (some error) {
error case ...
err = value for error case;
} else {
normal case ...
err = value for normal case;
}
return err;

to

if (some error) {
error case ...
return value for error case;
}
normal case ...
return value for normal case;

Backports commit 4baef2679e029c76707be1e2ed54bf3dd21693fe from qemu
2018-03-02 08:45:18 -05:00
Markus Armbruster 9236950e61
util/cutils: Clean up variable names around qemu_strtol()
Name same things the same, different things differently.

* qemu_strtol()'s parameter @nptr is called @p in
check_strtox_error(). Rename the latter.

* qemu_strtol()'s parameter @endptr is called @next in
check_strtox_error(). Rename the latter.

* qemu_strtol()'s variable @p is called @endptr in
check_strtox_error(). Rename both to @ep.

* qemu_strtol()'s variable @err is *negative* errno,
check_strtox_error()'s parameter @err is *positive*. Rename the
latter to @libc_errno.

Same for qemu_strtoul(), qemu_strtoi64(), qemu_strtou64(), of course.

Backports commit 717adf960933da0650d995f050d457063d591914 from qemu
2018-03-02 08:41:47 -05:00
Markus Armbruster 41c2e1168f
util/cutils: Rename qemu_strtoll(), qemu_strtoull()
The name qemu_strtoll() suggests conversion to long long, but it
actually converts to int64_t. Rename to qemu_strtoi64().

The name qemu_strtoull() suggests conversion to unsigned long long,
but it actually converts to uint64_t. Rename to qemu_strtou64().

Backports commit b30d188677456b17c1cd68969e08ddc634cef644 from qemu
2018-03-02 08:39:45 -05:00
Markus Armbruster ac34d92d09
util/cutils: Rewrite documentation of qemu_strtol() & friends
Fixes the following documentation bugs:

* Fails to document that null @nptr is safe.

* Fails to document that we return -EINVAL when no conversion could be
performed (commit 47d4be1).

* Confuses long long with int64_t, and unsigned long long with
uint64_t.

* Claims the unsigned conversions can underflow. They can't.

While there, mark problematic assumptions that int64_t is long long,
and uint64_t is unsigned long long with FIXME comments.

Backports commit 4295f879becfbbb9f4330489311586b96915d920 from qemu
2018-03-02 08:37:57 -05:00
Markus Armbruster 9d1937f25d
qdict: Make qdict_get_qlist() safe like qdict_get_qdict()
Commit 89cad9f changed qdict_get_qdict() to return NULL instead of
crash when the key doesn't exist or its value isn't a QDict.
Commit 2d6421a neglected to do the same for qdict_get_qlist().
Correct that, and update the function comments.

qdict_get_obj() is now unused, remove.

Backports commit b25f23e7dbc6bc0dcda010222a4f178669d1aedc from qemu
2018-03-02 08:35:17 -05:00
Bharata B Rao 7fadaf0bc4
softfloat: Add float128_to_uint32_round_to_zero()
float128_to_uint32_round_to_zero() is needed by xscvqpuwz instruction
of PowerPC ISA 3.0.

Backports commit fd425037d25cecaaffdb3831697e0adc10ca2ba3 from qemu
2018-03-02 08:33:09 -05:00
Bharata B Rao 64d32a2237
softfloat: Add float128_to_uint64_round_to_zero()
Implement float128_to_uint64() and use that to implement
float128_to_uint64_round_to_zero()

This is required by xscvqpudz instruction of PowerPC ISA 3.0.

Backports commit 2e6d85683576c970c714c1cc071dca742835b9d4 from qemu
2018-03-02 08:32:02 -05:00
Bharata B Rao 80e522b499
softfloat: Add round-to-odd rounding mode
Power ISA 3.0 introduces a few quadruple precision floating point
instructions that support round-to-odd rounding mode. The
round-to-odd mode is explained as under:

Let Z be the intermediate arithmetic result or the operand of a convert
operation. If Z can be represented exactly in the target format, the
result is Z. Otherwise the result is either Z1 or Z2 whichever is odd.
Here Z1 and Z2 are the next larger and smaller numbers representable
in the target format respectively.

Backports commit 9ee6f678f473007e252934d6acd09c24490d9d42 from qemu
2018-03-02 08:25:00 -05:00
Paul Burton 411ddd16cf
target-mips: Provide function to test if a CPU supports an ISA
Provide a new cpu_supports_isa function which allows callers to
determine whether a CPU supports one of the ISA_ flags, by testing
whether the associated struct mips_def_t sets the ISA flags in its
insn_flags field.

An example use of this is to allow boards which generate bootloader code
to determine the properties of the CPU that will be used, for example
whether the CPU is 64 bit or which architecture revision it implements.

Backports commit bed9e5ceb158c886d548fe59675a6eba18baeaeb from qemu
2018-03-02 08:20:19 -05:00
Paolo Bonzini 37918ba5b0
exec: make address_space_cache_destroy idempotent
Clear cache->mr so that address_space_cache_destroy does nothing
the second time it is called.

Backports commit 91047df38dffa80222179f63fbb74c1dfefa25ed from qemu
2018-03-02 08:16:17 -05:00
Paolo Bonzini e66da21a56
cpu-exec: remove outermost infinite loop
Reorganize the sigsetjmp so that the restart case falls through
to cpu_handle_exception and the execution loop.

Backports commit 4515e58d60dc3aac53dbd5e53e4c3bec126967d8 from qemu
2018-03-02 08:13:43 -05:00
Paolo Bonzini af524401ad
cpu-exec: avoid repeated sigsetjmp on interrupts
The sigsetjmp only needs to be prepared once for the whole execution
of cpu_exec. This patch takes care of the "== 0" side, using a
nested loop so that cpu_handle_interrupt goes straight back to
cpu_handle_exception without doing another sigsetjmp.

Backports commit a42cf3f3f266a97ceb13e8b99bc7b13f7bf4192a from qemu
2018-03-02 08:09:50 -05:00
Paolo Bonzini 28b615a8b7
cpu-exec: avoid cpu_loop_exit in cpu_handle_interrupt
The siglongjmp goes straight back to the beginning of cpu_exec's
outermost loop. We do not need a siglongjmp, we can simply
leave the inner TB execution loop.

Backports commit 209b71b60ef3341246038e1c926c3b704969cdd3 from qemu
2018-03-02 08:03:18 -05:00
Paolo Bonzini b39acfc3c6
cpu-exec: tighten barrier on TCG_EXIT_REQUESTED
This seems to have worked just fine so far on weakly-ordered
architectures, but I don't see anything that prevents the
reordering from:

store 1 to exit_request
store 1 to tcg_exit_req
load tcg_exit_req
store 0 to tcg_exit_req
load exit_request
store 0 to exit_request
store 1 to exit_request
store 1 to tcg_exit_req

to this:

store 1 to exit_request
store 1 to tcg_exit_req
load tcg_exit_req
load exit_request
store 1 to exit_request
store 1 to tcg_exit_req
store 0 to tcg_exit_req
store 0 to exit_request

therefore losing a request. It's possible that other memory barriers
(e.g. in rcu_read_unlock) are hiding it, but better safe than
sorry.

Backports commit a70fe14b7dddcb944fbd6c9f3739cd3a22089af5 from qemu
2018-03-02 08:01:08 -05:00
Wei Huang c9bdf5e6c7
target-arm: Enable vPMU support under TCG mode
This patch contains several fixes to enable vPMU under TCG mode. It
first removes the checking of kvm_enabled() while unsetting
ARM_FEATURE_PMU. With it, the .pmu option can be used to turn on/off vPMU
under TCG mode. Secondly the PMU node of DT table is now created under TCG.
The last fix is to disable the masking of PMUver field of ID_AA64DFR0_EL1.

Backports commit d6f02ce3b8a43ddd8f83553fe754a34b26fb273f from qemu
2018-03-02 07:58:48 -05:00
Wei Huang 5e3349a818
target-arm: Add support for PMU register PMINTENSET_EL1
This patch adds access support for PMINTENSET_EL1.

Backports commit e6ec54571e424bb1d6e50e32fe317c616cde3e05 from qemu
2018-03-02 07:57:40 -05:00
Wei Huang 3b34b7f0f9
target-arm: Add support for AArch64 PMU register PMXEVTYPER_EL0
In order to support Linux perf, which uses PMXEVTYPER register,
this patch adds read/write access support for PMXEVTYPER. The access
is CONSTRAINED UNPREDICTABLE when PMSELR is not 0x1f. Additionally
this patch adds support for PMXEVTYPER_EL0.

Backports commit fdb8665672ded05f650d18f8b62d5c8524b4385b from qemu
2018-03-02 07:53:05 -05:00
Wei Huang 1165020022
target-arm: Add support for PMU register PMSELR_EL0
This patch adds support for AArch64 register PMSELR_EL0. The existing
PMSELR definition is revised accordingly.

Backports commit 6b0407805d46bbeba70f4be426285d0a0e669750 from qemu
2018-03-02 07:39:43 -05:00
Peter Maydell bddeac4430
target/arm: A32, T32: Create Instruction Syndromes for Data Aborts
Add support for generating the ISS (Instruction Specific Syndrome)
for Data Abort exceptions taken from AArch32. These syndromes are
used by hypervisors for example to trap and emulate memory accesses.

This is the equivalent for AArch32 guests of the work done for AArch64
guests in commit aaa1f954d4cab243.

Backports commit 9bb6558a218bf7e466e5ac1100639517d8a30d33 from qemu
2018-03-02 00:37:06 -05:00
Peter Maydell 74d42aa939
target/arm: Abstract out pbit/wbit tests in ARM ldr/str decode
In the ARM ldr/str decode path, rather than directly testing
"insn & (1 << 21)" and "insn & (1 << 24)", abstract these
bits out into wbit and pbit local flags. (We will want to
do more tests against them to determine whether we need to
provide syndrome information.)

Backports commit 63f26fcfda8e19f94ce23336726d14805250a5b6 from qemu
2018-03-02 00:26:58 -05:00
Julian Brown cc217b0c90
arm: Correctly handle watchpoints for BE32 CPUs
In BE32 mode, sub-word size watchpoints can fail to trigger because the
address of the access is adjusted in the opcode helpers before being
compared with the watchpoint registers. This patch reverses the address
adjustment before performing the comparison with the help of a new CPUClass
hook.

This version of the patch augments and tidies up comments a little.

Backports commit 40612000599e52e792d23c998377a0fa429c4036 from qemu
2018-03-02 00:24:33 -05:00
Julian Brown 58059c3a35
Fix Thumb-1 BE32 execution and disassembly.
Thumb-1 code has some issues in BE32 mode (as currently implemented). In
short, since bytes are swapped within words at load time for BE32
executables, this also swaps pairs of adjacent Thumb-1 instructions.

This patch un-swaps those pairs of instructions again, both for execution,
and for disassembly. (The previous version of the patch always read four
bytes in arm_read_memory_func and then extracted the proper two bytes,
in a probably misguided attempt to match the behaviour of actual hardware
as described by e.g. the ARM9TDMI TRM, section 3.3 "Endian effects for
instruction fetches". It's less complicated to just read the correct
two bytes though.)

Backports commit f7478a92dd9ee2276bfaa5b7317140d3f9d6a53b from qemu
2018-03-02 00:20:11 -05:00
Julian Brown 1aedb26670
target/arm: Add cfgend parameter for ARM CPU selection.
Add a new "cfgend" property which selects whether the CPU resets into
big-endian mode or not. This setting affects whether we reset with
SCTLR_B (ARMv6 and earlier) or SCTLR_EE (ARMv7 and later) set.

Backports commit 3a062d5730266b2386eeda68b1a1c6e96451db31 from qemu
2018-03-02 00:18:18 -05:00
Bharata B Rao 4324d1e97e
softfloat: Fix the default qNAN for target-ppc
Currently float128_default_nan() returns 0xFFFF800000000000 in the
higher double word, but it should return 0x7FFF800000000000 which
is the correct higher double word for default qNAN on PowerPC.

Backports commit 5d51eaea84899d88cb161fab3f089168e3812e9e from qemu
2018-03-02 00:15:36 -05:00
Michael S. Tsirkin ad6873ec57
arm: better stub version for MISMATCH_CHECK
stub version of MISMATCH_CHECK is empty so it's easy to misuse for
people not building kvm on arm. Use QEMU_BUILD_BUG_ON similar to the
non-stub version to make it easier to catch bugs.

Backports commit 705ae59fecae341a4b1a45ce48b46de4b1bb3cf4 from qemu
2018-03-02 00:13:45 -05:00
Michael S. Tsirkin 4d1139f83f
arm: add trailing ; after MISMATCH_CHECK
Macro calls without a trailing ; look weird in C, this works as a side
effect of how QEMU_BUILD_BUG_ON is implemented. Fix this up.

Backports commit 1b28762a333bd238611103e9ed2348d7af93b0db from qemu
2018-03-02 00:12:04 -05:00
Michael S. Tsirkin 0455644974
ARRAY_SIZE: check that argument is an array
It's a familiar pattern: some code uses ARRAY_SIZE, then refactoring
changes the argument from an array to a pointer to a dynamically
allocated buffer. Code keeps compiling but any ARRAY_SIZE calls now
return the size of the pointer divided by element size.

Let's add build time checks to ARRAY_SIZE before we allow more
of these in the code-base.

Backports commit ed63ec0d22ccdce3b2222d9a514423b7fbba3a0d from qemu
2018-03-02 00:09:51 -05:00
Michael S. Tsirkin ac013df0a2
compiler: expression version of QEMU_BUILD_BUG_ON
QEMU_BUILD_BUG_ON uses a typedef in order to be safe
to use outside functions, but sometimes it's useful
to have a version that can be used within an expression.
Following what Linux does, introduce QEMU_BUILD_BUG_ON_ZERO
that return zero after checking condition at build time.

Backports commit d757573e69f2ef58a4a7b41f6c55d65fa1e1c5c2 from qemu
2018-03-02 00:07:33 -05:00
Michael S. Tsirkin 634a8094f1
compiler: rework BUG_ON using a struct
There are theoretical concerns that some compilers might not trigger
build failures on attempts to define an array of size (x ? -1 : 1) where
x is a variable and make it a variable sized array instead. Let rewrite
using a struct with a negative bit field size instead as there are no
dynamic bit field sizes. This is similar to what Linux does.

Backports commit f291887e8eef5d37d31484638f6e62401b4b99a2 from qemu
2018-03-02 00:05:07 -05:00
Michael S. Tsirkin 7f9fb3395c
QEMU_BUILD_BUG_ON: use __COUNTER__
Some headers use QEMU_BUILD_BUG_ON. This causes a problem
if the C file including that header happens to have
QEMU_BUILD_BUG_ON at the same line number.

Fix using a widely available extension: __COUNTER__.
If unavailable, provide a stub.

Backports commit 60abf0a5e05134187e274ce5f32524ccf0cae1a6 from qemu
2018-03-02 00:03:44 -05:00
Michael S. Tsirkin beca05eb5f
compiler: drop ; after BUILD_BUG_ON
All users include the trailing ; anyway, let's require that -
it seems cleaner.

Backports commit f29831828441318c7916ae28e6e16e4a1c4a6795 from qemu
2018-03-02 00:01:44 -05:00
Ladi Prosek babf848b82
memory: don't sign-extend 32-bit writes
ldl_p has a signed return type so assigning it to uint64_t implicitly
sign-extends the value. This results in devices with min_access_size = 8
seeing unexpected values passed to their write handlers.

Example: guest performs a 32-bit write of 0x80000000 to an mmio region
and the handler receives 0xFFFFFFFF80000000 in its value argument.

Backports commit 6da67de6803e93cbb7e93ac3497865832f8c00ea from qemu
2018-03-02 00:00:22 -05:00
Peter Maydell 48825c1be2
target/arm: Drop IS_M() macro
We only use the IS_M() macro in two places, and it's a bit of a
namespace grab to put in cpu.h. Drop it in favour of just explicitly
calling arm_feature() in the places where it was used.

Backports commit 531c60a97ab51618b4b9ccef1c5fe00607079706 from qemu
2018-03-01 23:59:09 -05:00
Cao jin f2a5ddf5dc
util/mmap-alloc: refactor a little bit for readability
1st mmap returns *ptr* which aligns to host page size,

| size + align |
------------------------------------------
ptr

input param *align* could be 1M, or 2M, or host page size. After
QEMU_ALIGN_UP, offset will >= 0

2nd mmap use flag MAP_FIXED, then it return ptr+offset, or else fail.
If it success, then we will have something like:

| offset | size |
--------------------------------------
ptr ptr1

*ptr1* is what we really want to return, it equals ptr+offset.

Backports commit 6e4c890e15b23f078650499fbde11760b8eccf10 from qemu
2018-03-01 23:55:15 -05:00
Cao jin 217c14ad3e
util/mmap-alloc: check parameter before using
Backports commit 4a3ecf201a1a49a804e8506df5906e446707c3b1 from qemu
2018-03-01 23:53:45 -05:00
Eduardo Habkost f424e16f24
i386: Remove AMD feature flag aliases from Opteron models
When CPU vendor is set to AMD, the AMD feature alias bits on
CPUID[0x80000001].EDX are already automatically copied from CPUID[1].EDX
on x86_cpu_realizefn(). When CPU vendor is Intel, those bits are
reserved and should be zero. On either case, those bits shouldn't be set
in the CPU model table.

Commit 726a8ff68677d8d5fba17eb0ffb85076bfb598dc removed those
bits from most CPU models, but the Opteron_* entries still have
them. Remove the alias bits from Opteron_* too.

Add an assert() to x86_register_cpudef_type() to ensure we don't
make the same mistake again.

Backports commit 2a923a293df95334fa22634016efdd138f49da7f from qemu
2018-03-01 23:49:04 -05:00
He Chen b37fa358f3
x86: add AVX512_VPOPCNTDQ features
AVX512_VPOPCNTDQ: Vector POPCNT instructions for word and qwords.
variable precision.

Backports commit f77543772dcd38fa438470d9b80bafbd3a3ebbd7 from qemu
2018-03-01 23:44:32 -05:00
Richard Henderson 5c4f79ac62
target-hppa: Add softfloat specializations
Like the original MIPS, HPPA has the MSB of an SNaN set.
However, it has different rules for silencing an SNaN:
(1) msb is cleared and (2) msb-1 must be set if the fraction
is now zero, and (implementation defined) may be set always.
I haven't checked real hardware but chose the set always
alternative because it's easy and within spec.

Backports commit 005fa38d86257d471ac461c066a5409a9f5ebb02 from qemu
2018-03-01 23:42:09 -05:00
Sascha Silbe 11c66029b7
error: error_setg_errno(): errno gets preserved
C11 allows errno to be clobbered by pretty much any library function
call, so in general callers need to take care to save errno before
calling other functions.

However, for error reporting functions this is rather awkward and can
make the code on the caller side more complicated than
necessary. error_setg_errno() already takes care of preserving errno
and some functions rely on that, so just promise that we continue to
do so in the future.

Backports commit 98cb89af4df7e1776ce418ed6167b6e214a64435 from qemu
2018-03-01 23:38:25 -05:00
Peter Maydell aca671b3b1
target-arm: Enable EL2 feature bit on A53 and A57
Enable the ARM_FEATURE_EL2 bit on Cortex-A52 and
Cortex-A57, since this is all now sufficiently implemented
to work with the GICv3. We provide the usual CPU property
to disable it for backwards compatibility with the older
virt boards.

In this commit, we disable the EL2 feature on the
virt and ZynpMP boards, so there is no overall effect.
Another commit will expose a board-level property to
allow the user to enable EL2.

Backports commit c25bd18a04c8bd0f19556d719864b7b08528222d from qemu
2018-03-01 23:36:44 -05:00
Peter Maydell a036c73de8
target/arm/psci.c: If EL2 implemented, start CPUs in EL2
The PSCI spec states that a CPU_ON call should cause the new
CPU to be started in the highest implemented Non-secure
exception level. We were incorrectly starting it at the
exception level of the caller, which happens to be correct
if EL2 is not implemented. Implement the correct logic
as described in the PSCI 1.0 spec section 6.4:
* if EL2 exists and SCR_EL3.HCE is set: start in EL2
* otherwise start in EL1

Backports commit 3f591a20221511c639cc7959755e570801a21cd2 from qemu
2018-03-01 23:34:57 -05:00
Jean-Christophe DUBOIS 0aa0b849c2
ARM: Factor out ARM on/off PSCI control functions
Split ARM on/off function from PSCI support code.

This will allow to reuse these functions in other code.

Backports commit 825482adde1f971cbddf27e15fb4453ab3fae994 from qemu
2018-03-01 23:31:47 -05:00
Peter Maydell 468e2849cd
target/arm: Implement DBGVCR32_EL2 system register
The DBGVCR_EL2 system register is needed to run a 32-bit
EL1 guest under a Linux EL2 64-bit hypervisor. Its only
purpose is to provide AArch64 with access to the state of
the DBGVCR AArch32 register. Since we only have a dummy
DBGVCR, implement a corresponding dummy DBGVCR32_EL2.

Backports commit 4d2ec4da1c2d60c9fd8bad137506870c2f980410 from qemu
2018-03-01 23:02:28 -05:00
Peter Maydell 0db334c0e4
target/arm: Handle VIRQ and VFIQ in arm_cpu_do_interrupt_aarch32()
To run a VM in 32-bit EL1 our AArch32 interrupt handling code
needs to be able to cope with VIRQ and VFIQ exceptions.
These behave like IRQ and FIQ except that we don't need to try
to route them to Monitor mode.

Backports commit 87a4b270348c69a446ebcddc039bfae31b1675cb from qemu
2018-03-01 22:59:08 -05:00
Lioncash ebae552174
mips: Build fix 2018-03-01 22:56:23 -05:00
Thomas Huth b2f1326437
Move target-* CPU file into a target/ folder
We've currently got 18 architectures in QEMU, and thus 18 target-xxx
folders in the root folder of the QEMU source tree. More architectures
(e.g. RISC-V, AVR) are likely to be included soon, too, so the main
folder of the QEMU sources slowly gets quite overcrowded with the
target-xxx folders.
To disburden the main folder a little bit, let's move the target-xxx
folders into a dedicated target/ folder, so that target-xxx/ simply
becomes target/xxx/ instead.

Backports commit fcf5ef2ab52c621a4617ebbef36bf43b4003f4c0 from qemu
2018-03-01 22:50:58 -05:00
Artyom Tarasenko 59ec6876bd
target-sparc: add ST_BLKINIT_ ASIs for UA2005+ CPUs
In OpenSPARC T1+ TWINX ASIs in store instructions are aliased
with Block Initializing Store ASIs.

"UltraSPARC T1 Supplement Draft D2.1, 14 May 2007" describes them
in the chapter "5.9 Block Initializing Store ASIs"

Integer stores of all sizes are allowed with these ASIs.

Backports commit 3390537b5df4014e24a30f9bdcfa05c2bd0cd6d8 from qemu
2018-03-01 22:29:21 -05:00
Artyom Tarasenko a6981c9b91
target-sparc: store the UA2005 entries in sun4u format
According to chapter 13.3 of the
UltraSPARC T1 Supplement to the UltraSPARC Architecture 2005,
only the sun4u format is available for data-access loads.

Store UA2005 entries in the sun4u format to simplify processing.

Backports commit 7285fba083de3f14f6e98abb4469173b56da9480 from qemu
2018-03-01 22:28:12 -05:00
Artyom Tarasenko aa24403d8a
target-sparc: implement UA2005 ASI_MMU (0x21)
Backports commit 7dd8c0760ee197420273a7dfeab13bf54f6bbd8d from qemu
2018-03-01 22:25:39 -05:00
Artyom Tarasenko aac6955197
target-sparc: add more registers to dump_mmu
Backports commit d00a2334433483d1751d94aabdf47985a68010d3 from qemu
2018-03-01 22:23:46 -05:00
Artyom Tarasenko 49e61dc62f
target-sparc: implement auto-demapping for UA2005 CPUs
Backports commit 70f44d2f4bce44fa04426def3290306fa8064b91 from qemu
2018-03-01 22:23:06 -05:00
Artyom Tarasenko b20b29fc8e
target-sparc: allow 256M sized pages
Backports commit 70f44d2f4bce44fa04426def3290306fa8064b91 from qem#u
2018-03-01 22:22:50 -05:00
Lioncash 92730d9626
target-sparc: simplify ultrasparc_tsb_pointer 2018-03-01 22:18:25 -05:00
Artyom Tarasenko 76d1612dcb
target-sparc: implement UA2005 TSB Pointers
Backports commit 15f746cedc6db2cc8fc7bcfe7692e02263caeeca from qemu
2018-03-01 21:31:47 -05:00
Artyom Tarasenko f3d96d19e5
target-sparc: use SparcV9MMU type for sparc64 I/D-MMUs
Backports commit 96df2bc99f9bdaf7a2f13550111f219b72b73708 from qemu
2018-03-01 21:28:43 -05:00
Artyom Tarasenko c61e580b2d
target-sparc: replace the last tlb entry when no free entries left
Implement the behavior described in the chapter 13.9.11 of
UltraSPARC T1™ Supplement to the UltraSPARC Architecture 2005:

"If a TLB Data-In replacement is attempted with all TLB
entries locked and valid, the last TLB entry (entry 63) is
replaced."

Backports commit 4797a6851975c1239df440c5f01d8566e63717bb from qemu
2018-03-01 21:26:05 -05:00
Artyom Tarasenko c43a89b2bc
target-sparc: ignore writes to UA2005 CPU mondo queue register
Backports commit 2f1b52920205863024cc86007e88557f4c2c898e from qemu
2018-03-01 21:25:28 -05:00
Artyom Tarasenko 0c5a21230f
target-sparc: allow priveleged ASIs in hyperprivileged mode
Backports commit 7cd39ef234a7e2eea45a08cd15f920da5f1ba008 from qemu
2018-03-01 21:24:10 -05:00
Artyom Tarasenko 3a5a9dd6cd
target-sparc: use direct address translation in hyperprivileged mode
Please note that QEMU doesn't impelement Real->Physical address
translation. The "Real Address" is always the "Physical Address".

Backports commit 84f8f5876628963e67f66edde8a71208c4274ac8 from qemu
2018-03-01 21:24:09 -05:00
Artyom Tarasenko f07be0ac3f
target-sparc: fix immediate UA2005 traps
Backports commit 5c65df364af0a2cc60af318e5a3011ae5fce293a from qemu
2018-03-01 21:24:09 -05:00
Artyom Tarasenko 2f2bde32bf
target-sparc: implement UA2005 rdhpstate and wrhpstate instructions
Backports commit f7f17ef75c9c90db63c44d11dc16fc085ca2c474 from qemu
2018-03-01 21:24:09 -05:00
Artyom Tarasenko 0a124b2199
target-sparc: implement UA2005 GL register
Backports commit cbc3a6a4cc675516328a2b0d3602355d68b6302d from qemu
2018-03-01 21:24:09 -05:00
Artyom Tarasenko 05e80b59af
target-sparc: implement UA2005 hypervisor traps
Backports commit 6e040755f12eba34d2fa3d56b18de32d63fea631 from qemu
2018-03-01 21:24:09 -05:00
Artyom Tarasenko 8710ef1128
target-sparc: hypervisor mode takes over nucleus mode
Accordinf to UA2005, 9.3.3 "Address Space Identifiers",

"In hyperprivileged mode, all instruction fetches and loads and stores with implicit
ASIs use a physical address, regardless of the value of TL".

Backports commit 9a10756d1204c3528e47892195349bf882069846 from qemu
2018-03-01 21:24:08 -05:00
Artyom Tarasenko 204a4dc1d3
target-sparc: implement UltraSPARC-T1 Strand status ASR
Backports commit b8e31b3cc6315bc5c6ec686c363c088c4fb1d0ea from qemu
2018-03-01 21:24:08 -05:00
Artyom Tarasenko 2f329af7ef
target-sparc: implement UA2005 scratchpad registers
Backports commit 4ec3e34654990868ad73a5a452a46d7f9f9dd378 from qemu
2018-03-01 21:24:08 -05:00
Artyom Tarasenko ec74c31ebf
target-sparc: simplify replace_tlb_entry by using TTE_PGSIZE
Backports commit e4d06ca74b751e486ca2a57f586fd4b858a13085 from qemu
2018-03-01 21:24:08 -05:00
Artyom Tarasenko 926247a35e
target-sparc: on UA2005 don't deliver Interrupt_level_n IRQs in hypervisor mode
As described in Chapter 5.7.6 of the UltraSPARC Architecture 2005,
outstanding disrupting exceptions that are destined for privileged mode can only
cause a trap when the virtual processor is in nonprivileged or privileged mode and
PSTATE.ie = 1. At all other times, they are held pending.

Backports commit 1a2aefae6627170fdee689b394a65f76080c068a from qemu
2018-03-01 21:24:08 -05:00
Artyom Tarasenko f486053ae0
target-sparc: add UltraSPARC T1 TLB #defines
Backports commit 5b5352b2f41e460f213a515e087c24dac1322f49 from qemu
2018-03-01 21:24:08 -05:00
Artyom Tarasenko b3f7d376cc
target-sparc: add UA2005 TTE bit #defines
Backports commit c2c7f864df16ed6ef7ef21d255c5593dbeaec261 from qemu
2018-03-01 21:24:07 -05:00
Artyom Tarasenko c1c88e147d
target-sparc: use explicit mmu register pointers
Use explicit register pointers while accessing D/I-MMU registers.
Call cpu_unassigned_access on access to missing registers.

Backports commit 20395e63375358bf6dd147057aaf998abf7abdb9 from qemu
2018-03-01 21:24:07 -05:00
Artyom Tarasenko be8357f8b5
target-sparc: store cpu super- and hypervisor flags in TB
Backports commit c9b459aab8c5775a21dd913fc8820b736181e7be from qemu
2018-03-01 21:24:00 -05:00
Artyom Tarasenko 96af2cfb58
target-sparc: ignore MMU-faults if MMU is disabled in hypervisor mode
while IMMU/DMMU is disabled
- ignore MMU-faults in hypervisorv mode or if CPU doesn't have hypervisor
- signal TT_INSN_REAL_TRANSLATION_MISS/TT_DATA_REAL_TRANSLATION_MISS otherwise

Backports commit 1ceca928538a3633b74a7dc718a05ce6767f2f76 from qemu
2018-03-01 20:25:32 -05:00
Lioncash d905278b86
Make unicorn happy with TLB execution 2018-03-01 20:13:37 -05:00
Alex Bennée e3e57ca08e
cputlb: drop flush_global flag from tlb_flush
We have never has the concept of global TLB entries which would avoid
the flush so we never actually use this flag. Drop it and make clear
that tlb_flush is the sledge-hammer it has always been.

Backports commit  d10eb08f5d8389c814b554d01aa2882ac58221bf from qemu
2018-03-01 19:36:04 -05:00
Alex Bennée 7e2cc86ad2
cpu_common_reset: wrap TCG specific code in tcg_enabled()
Both the cpu->tb_jmp_cache and SoftMMU TLB structures are only used
when running TCG code so we might as well skip them for anything else.

Backports commit ba7d3d1858c257e39b47f7f12fa2016ffd960b11 from qemu
2018-03-01 19:29:57 -05:00
Alex Bennée 780ed8722e
qom/cpu: move tlb_flush to cpu_common_reset
It is a common thing amongst the various cpu reset functions want to
flush the SoftMMU's TLB entries. This is done either by calling
tlb_flush directly or by way of a general memset of the CPU
structure (sometimes both).

This moves the tlb_flush call to the common reset function and
additionally ensures it is only done for the CONFIG_SOFTMMU case and
when tcg is enabled.

In some target cases we add an empty end_of_reset_fields structure to the
target vCPU structure so have a clear end point for any memset which
is resetting value in the structure before CPU_COMMON (where the TLB
structures are).

While this is a nice clean-up in general it is also a precursor for
changes coming to cputlb for MTTCG where the clearing of entries
can't be done arbitrarily across vCPUs. Currently the cpu_reset
function is usually called from the context of another vCPU as the
architectural power up sequence is run. By using the cputlb API
functions we can ensure the right behaviour in the future.

Backports commit 1f5c00cfdb8114c1e3a13426588ceb64f82c9ddb from qemu
2018-03-01 19:21:07 -05:00
Laurent Vivier 770989f36f
target-m68k: increment/decrement with SP
On 680x0 family only.

Address Register indirect With postincrement:

When using the stack pointer (A7) with byte size data, the register
is incremented by two.

Address Register indirect With predecrement:

When using the stack pointer (A7) with byte size data, the register
is decremented by two.

Backports commit 727d937b59f1f722f983e20f9cd23b0e7ef60165 from qemu
2018-03-01 19:16:22 -05:00
Laurent Vivier 6ff83aadab
target-m68k: CAS doesn't need aligned access
Backports commit b19578f42872aefef891e5804359af8d935a5487 from qemu
2018-03-01 19:15:20 -05:00
Laurent Vivier 636bf36272
target-m68k: manage pre-dec et post-inc in CAS
In these cases we must update the address register after
the operation.

Backports commit 308feb935249ad745ef763707e1db69bc10ba789 from qemu
2018-03-01 19:14:35 -05:00
Laurent Vivier 1197d778cc
target-m68k: fix gen_flush_flags()
gen_flush_flags() is setting unconditionally cc_op_synced to 1
and s->cc_op to CC_OP_FLAGS, whereas env->cc_op can be set
to something else by a previous tcg fragment.

We fix that by not setting cc_op_synced to 1
(except for gen_helper_flush_flags() that updates env->cc_op)

FIX: https://github.com/vivier/qemu-m68k/issues/19

Backports commit 695576db2daaf2bdc63e7f6d36038b61caed622a from qemu
2018-03-01 19:13:35 -05:00
Laurent Vivier b3c3cf84a5
target-m68k: fix bit operation with immediate value
M680x0 bit operations with an immediate value use 9 bits of the 16bit
value, while coldfire ones use only 8 bits.

Backports commit fe53c2be8c12da345bd788b949e0b2360e4b3db3 from qemu
2018-03-01 19:12:20 -05:00
Richard Henderson 6f5081314b
target-m68k: Implement bfffo
Backports commit a45f1763cc501861ea4f5eed06e6f58aa681a082 from qemu
2018-03-01 19:10:59 -05:00
Richard Henderson 797e5d44e9
target-m68k: Implement bitfield ops for memory
Backports commit f2224f2c9a9ed63edaed77ae21ffb1e501d7f247 from qemu
2018-03-01 19:07:06 -05:00
Richard Henderson 4f481b2c5a
target-m68k: Implement bitfield ops for registers
Backports commit ac815f46a325b5dabe2ebd6561e4244767c0a603 from qemu
2018-03-01 18:58:47 -05:00
Doug Evans 7bd3170ea5
target/i386: Fix bad patch application to translate.c
In commit c52ab08aee6f7d4717fc6b517174043126bd302f,
the patch snippet for the "syscall" insn got applied to "iret".

Backports commit 410e98146ffde201ab4c778823ac8beaa74c4c3f from qemu
2018-03-01 18:52:10 -05:00
Richard Henderson 4bec129626
tcg/i386: Handle ctpop opcode
Backports commit 993508e43e6d180e9ba9b747a9657eac69aec5bb from qemu
2018-03-01 18:49:43 -05:00
Richard Henderson 3a0fba32f3
tcg/ppc: Handle ctpop opcode
Backports commit 33e75fb9c8cc44165c8dad9093762ba728cc7596 from qemu
2018-03-01 18:46:43 -05:00
Richard Henderson 6d4fc1319a
tcg/ppc: Handle ctz and clz opcodes
Backports commit d0b07481fabb4dc4ed05d56d09718758f5f7a136 from qemu
2018-03-01 18:44:54 -05:00
Richard Henderson ff3512a045
tcg: Use ctpop to generate ctz if needed
Particularly when andc is also available, this is two insns
shorter than using clz to compute ctz.

Backports commit 14e99210f6c6cede461a54b2e0f9b4cd55175f00 from qemu
2018-03-01 18:39:20 -05:00
Richard Henderson 5ca8ac1aeb
qemu/host-utils.h: Reduce the operation count in the fallback ctpop
Backports commit 7bdcecb7b2d79c292d1256f7d6cf0f1da50d381f from qemu
2018-03-01 18:35:51 -05:00
Richard Henderson 8a62878523
target-i386: Use ctpop helper
Backports commit 4885c3c49531995d67e54907d01d5aa1350faaaf from qemu
2018-03-01 18:34:10 -05:00
Richard Henderson d072ea48e7
target-sparc: Use ctpop helper
Backports commit 08da3180dca8d41881b321d43944d97a838792fa from qemu
2018-03-01 18:28:54 -05:00
Richard Henderson 5f6e7bbdbd
tcg: Add opcode for ctpop
The number of actual invocations of ctpop itself does not warrent
an opcode, but it is very helpful for POWER7 to use in generating
an expansion for ctz.

Backports commit a768e4e99247911f00c5c0267c12d4e207d5f6cc from qemu
2018-03-01 18:26:41 -05:00
Richard Henderson 01b3c6273a
target-arm: Use clrsb helper
Backports commit bc21dbcc1203ae6bb536f832c46a3b5e22a73451 from qemu
2018-03-01 18:16:56 -05:00
Richard Henderson fff7ca4617
tcg: Add helpers for clrsb
The number of actual invocations does not warrent an opcode,
and the backends generating it. But at least we can eliminate
redundant helpers.

Backports commit 086920c2c8008f125fd38781072fa25c3ad158ea from qemu
2018-03-01 18:14:11 -05:00
Richard Henderson 246d891668
tcg/i386: Handle ctz and clz opcodes
Backports commit bbf25f90ba802a286fd72be9175a860ae5fec726 from qemu
2018-03-01 16:56:08 -05:00
Richard Henderson 73ab332185
tcg/i386: Allow bmi2 shiftx to have non-matching operands
Previously we could not have different constraints for different ISA levels,
which prevented us from eliding the matching constraint for shifts.

We do now have to make sure that the operands match for constant shifts.
We can also handle some small left shifts via lea.

Backports commit 6a5aed4bdc7078838a8098336588d56c9ce09d1d from qemu
2018-03-01 16:45:04 -05:00
Richard Henderson 9e3feebbfb
tcg/i386: Hoist common arguments in tcg_out_op
Backports commit 42d5b514928a8a0d2f55a4c243d1333f9675815b from qemu
2018-03-01 16:42:30 -05:00
Richard Henderson 142ca07077
tcg/i386: Fuly convert tcg_target_op_def
Use a switch instead of searching a table. Share constraints between
32-bit and 64-bit, when at all possible.

Backports commit cd26449a505f808e479af4fdd539e05767e09c06 from qemu
2018-03-01 16:32:31 -05:00
Richard Henderson 54ca83b900
tcg/s390: Handle clz opcode
Backports commit ce411066f4886cf3a4981fc0a070042a221a5fc8 from qemu
2018-03-01 16:24:29 -05:00
Richard Henderson a90e026c18
tcg/mips: Handle clz opcode
Backports commit 2a1d9d41aedd722d674b2a94d9b7dbea61469cac from qemu
2018-03-01 16:22:52 -05:00
Richard Henderson 303fc987ed
tcg/arm: Handle ctz and clz opcodes
Backports commit cc0fec8a4d2a8546fe236a09bfd80150af9cbe6b from qemu
2018-03-01 16:20:46 -05:00
Richard Henderson 2b87ddda35
tcg/aarch64: Handle ctz and clz opcodes
Backports commit 53c76c19904983d2c81e4f5e77027c241918a479 from qemu
2018-03-01 16:19:34 -05:00
Richard Henderson 22ebc5fcee
target-i386: Use clz and ctz opcodes
Backports commit e5143c90883cd32a432eb793cdcce6bee747834a from qemu
2018-03-01 16:17:42 -05:00
Richard Henderson 9cde8bfc44
target-arm: Use clz opcode
Backports commit 7539a012f614b724426ac9360238f3281d928a3f from qemu
2018-03-01 16:13:26 -05:00
Richard Henderson 9b2752b0a9
target-mips: Use clz opcode
Backports commit 1a0196c5c7f197fad7b079074d587b3204bcfb0f from qemu
2018-03-01 16:08:19 -05:00
Richard Henderson 2cf34e1b55
tcg: Add clz and ctz opcodes
Backports commit 0e28d0063bbd9e59a981ea2d20f82f30c5d956a8 from qemu
2018-03-01 16:04:11 -05:00
Richard Henderson b4b173615c
tcg: Allow an operand to be matching or a constant
This allows an output operand to match an input operand
only when the input operand needs a register.

Backports commit 17280ff4a5f264e01e55ae514ee6d3586f9577b2 from qemu
2018-03-01 15:49:05 -05:00
Richard Henderson 3f38611159
tcg: Pass the opcode width to target_parse_constraint
This will let us choose how to interpret a given constraint
depending on whether the opcode is 32- or 64-bit. Which will
let us share more constraint combinations between opcodes.

At the same time, change the interface to return the advanced
pointer instead of passing it in/out by reference.

Backports commit 069ea736b50b75fdec99c9b8cc603b97bd98419e from qemu
2018-03-01 15:45:40 -05:00
Richard Henderson b8c93597b4
tcg: Transition flat op_defs array to a target callback
This will allow the target to tailor the constraints to the
auto-detected ISA extensions.

Backports commit f69d277ece43c42c7ab0144c2ff05ba740f6706b from qemu
2018-03-01 15:40:11 -05:00
Richard Henderson 551ef0a9f7
tcg: Add markup for output requires new register
This is the same concept as, and same markup as, the
early clobber markup in gcc.

Backports commit 82790a870992bd87d5fd9e607f40859dcf4f82ac from qemu
2018-03-01 15:24:58 -05:00
Richard Henderson 199b3859c4
tcg/optimize: Fold movcond 0/1 into setcond
Backports commit 333b21b809fc80ce67c8f6a7d1c7cc66437d9791 from qemu
2018-03-01 14:41:38 -05:00
Richard Henderson b62743947f
target-mips: Use the new extract op
Use extract for EXT and DEXT.

Backports commit 6eebb7a438236fcf3fdadb013921ac597aaea911 fromq qemu
2018-03-01 14:39:20 -05:00
Richard Henderson e5acbeb86e
target-i386: Use new deposit and extract ops
A couple of places where it was easy to identify a right-shift
followed by an extract or and-with-immediate, and the obvious
sign-extract from a high byte register.

Backports commit 04fc2f1c8fc030a11e08e81bb926392c0991282a from qemu
2018-03-01 14:38:17 -05:00
Richard Henderson ce3c153bd8
target-arm: Use new deposit and extract ops
Use the new primitives for UBFX and SBFX.

Backports commits 59a71b4c5b4ef2ef6425b9e21c972dd5bf450275 and 86c9ab277615af4e0389eb80a83073873ff96c86 from qemu
2018-03-01 14:09:17 -05:00
Richard Henderson f0781470b4
tcg/s390: Support deposit into zero
Since we can no longer use matching constraints, this does
mean we must handle that data movement by hand.

Backports commit 752b1be94757de906b9c24ebc8f5e6aa54b96b23 from qemu
2018-03-01 13:47:20 -05:00
Richard Henderson a7462cc7bf
tcg/s390: Implement field extraction opcodes
Backports commit b0bf5fe82df93c180f69d439af59f1f546632f13 from qemu
2018-03-01 13:45:33 -05:00
Richard Henderson ab8871ea82
tcg/s390: Implement field extraction opcodes
Backports commit b0bf5fe82df93c180f69d439af59f1f546632f13 from qemu
2018-03-01 13:43:46 -05:00
Richard Henderson 348802286c
tcg/s390: Expose host facilities to tcg-target.h
This lets us expose facilities to TCG_TARGET_HAS_* defines
directly, rather than hiding behind function calls.

Backports commit b2c98d9d392c87c9b9e975d30f79924719d9cbbe from qemu
2018-03-01 13:43:00 -05:00
Richard Henderson db41c6f1d0
tcg/ppc: Implement field extraction opcodes
Backports commit c05021c3c8d6c976e4677d3010b9ef01488a4434 from qemu
2018-03-01 13:38:42 -05:00
Richard Henderson b10a4a9ee6
tcg/mips: Implement field extraction opcodes
Backports commit befbb3ced5869003ee2e806c4f36e306918d2374 from qemu
2018-03-01 13:37:24 -05:00
Richard Henderson 7a7a5c640d
tcg/i386: Implement field extraction opcodes
Backports commit 78fdbfb94616f0391834d2eccabd16ea29e37da5 from qemu
2018-03-01 13:35:41 -05:00
Richard Henderson cabb6f71a0
tcg/arm: Implement field extraction opcodes
Backports commit ec903af18418e0870af84f6036d7aca1e6a5dc0a from qemu
2018-03-01 13:33:55 -05:00
Richard Henderson c4f56ec541
tcg/arm: Move isa detection to tcg-target.h
This allows us to use this detection within the TCG_TARGET_HAS_*
macros, instead of requiring a function call into tcg-target.inc.c.

Backports commit 40b2ccb156534f5d5f1d110a6ce008d87ee10af1 from qemu
2018-03-01 13:32:39 -05:00
Richard Henderson fbea4130fc
tcg/aarch64: Implement field extraction opcodes
Backports commit e2179f94a17bf0933df29ce1b4f6bc93cbe7dbd3 from qemu
2018-03-01 13:30:55 -05:00
Richard Henderson 9f2fcaaf27
tcg: Add deposit_z expander
While we don't require a new opcode, it is handy to have an expander
that knows the first source is zero.

Backports commit 07cc68d52852bf47dea7c402b46ddd28248d4212 from qemu
2018-03-01 13:29:24 -05:00
Richard Henderson 8e0585dcb1
tcg: Add field extraction primitives
Adds tcg_gen_extract_* and tcg_gen_sextract_* for extraction of
fixed position bitfields, much like we already have for deposit.

Backports commit 7ec8bab3deae643b1ce579c2d65a244f30708330 from qemu
2018-03-01 13:21:30 -05:00
Jason Wang 29932d0719
memory: handle alias in memory_region_is_iommu()
Backports commit 12d37882f0c0def5dee1c21be5d8fea9c21baada from qemu
2018-03-01 13:06:18 -05:00
Jason Wang fdca6292a1
exec: introduce address_space_get_iotlb_entry()
This patch introduces a helper to query the iotlb entry for a
possible iova. This will be used by later device IOTLB API to enable
the capability for a dataplane (e.g vhost) to query the IOTLB.

Backports commit 052c8fa9983f553fdfa0d61034774070dd639c2b from qemu
2018-03-01 13:05:08 -05:00
Richard Henderson efad2631d2
translate-all: Avoid -Werror=switch-bool
gcc 5.3.0 diagnoses

translate-all.c: In function ‘alloc_code_gen_buffer’:
translate-all.c:756:17: error: switch condition has boolean value
switch (buf2 != MAP_FAILED) {
^

Backports commit f68808c7494b38764e1895a9852b994638b86536 from qemu
2018-03-01 13:01:50 -05:00
Jin Guojie 4ed2a37f6d
tcg-mips: Adjust qemu_ld/st for mips64
Backports commit f0d703314ecb0415d51425727ed73ad2c6e3238a from qemu
2018-03-01 13:01:05 -05:00
Jin Guojie 25b4e11814
tcg-mips: Adjust calling conventions for mips64
Backports commit 999b941633cabf2487d9bc77ce382b3fde3cd66d from qemu
2018-03-01 12:53:42 -05:00
Jin Guojie 3de761976c
tcg-mips: Adjust prologue for mips64
Take stack frame parameters out from the function body.

Backports commit 0973b1cff8b66f3561befb1f467b2ab4d1a7d55a from qemu
2018-03-01 12:51:36 -05:00
Jin Guojie b55b7403a8
tcg-mips: Adjust load/store functions for mips64
tcg_out_ldst: using a generic ALIAS_PADD to avoid ifdefs
tcg_out_ld: generates LD or LW
tcg_out_st: generates SD or SW

Backports commit 32b69707df3365aadaad1d058044a7704397ec62 from qemu
2018-03-01 12:50:12 -05:00
Jin Guojie 022ff3580e
tcg-mips: Adjust move functions for mips64
tcg_out_mov: using OPC_OR as most mips assemblers do;
tcg_out_movi: extended to 64-bit immediate.

Backports commit 2294d05dab503d11664e73712c7f250fd0bf9e3b from qemu
2018-03-01 12:49:19 -05:00
Jin Guojie 00ccf9cec7
tcg-mips: Add bswap32u and bswap64
Without the mips32r2 instructions to perform swapping, bswap is quite large,
dominating the size of each reverse-endian qemu_ld/qemu_st operation.

Create two subroutines in the prologue block. The subroutines require extra
reserved registers (TCG_TMP[2, 3]). Using these within qemu_ld means that
we need not place additional restrictions on the qemu_ld outputs.

Backports commit 7f54eaa3b78d71cb57e45a719980f9b5ff06d21c from qemu
2018-03-01 12:47:45 -05:00
Jin Guojie 397db1b046
tcg-mips: Support 64-bit opcodes
Bulk patch adding 64-bit opcodes into tcg_out_op. Note that
mips64 is as yet neither complete nor enabled.

Backports commit 0119b1927d531f3fac22b9b4da01dafc23644973 from qemu
2018-03-01 12:46:18 -05:00
Jin Guojie 286f3a9f70
tcg-mips: Add mips64 opcodes
Since the mips manual tables are in octal, reorg all of the opcodes
into that format for clarity. Note that the 64-bit opcodes are as
yet unused.

Backports commit 57a701fc2b34902310d4dbd1411088055616938a from qemu
2018-03-01 12:36:20 -05:00
Jin Guojie d2aa49e9d3
tcg-mips: Move bswap code to a subroutine
Without the mips32r2 instructions to perform swapping, bswap is quite large,
dominating the size of each reverse-endian qemu_ld/qemu_st operation.

Create a subroutine in the prologue block. The subroutine requires extra
reserved registers (TCG_TMP[2, 3]). Using these within qemu_ld means that
we need not place additional restrictions on the qemu_ld outputs.

Backports commit bb08afe9f0aee1a3f5c23508e2511b882ca31e1b from qemu
2018-03-01 12:35:20 -05:00
Laurent Vivier 5d4a5e9ba7
target-m68k: free TCG variables that are not
This is a cleanup patch. It adds call to tcg_temp_free()
when it is missing.

Backports commit 2b5e2170678af36df48ab4b05dff81fe40b41a65 from qemu
2018-03-01 12:27:43 -05:00
Laurent Vivier 74beed5a4d
target-m68k: add rol/ror/roxl/roxr instructions
Backports commit 0194cf31cfc84516d10eca354146673150e10410 from qemu
2018-03-01 12:21:02 -05:00
Richard Henderson cf9424d60d
target-m68k: Inline shifts
Also manage word and byte operands and fix the computation of
overflow in the case of M68000 arithmetic shifts.

Backports commit 367790cce8e14131426f5190dfd7d1bdbf656e4d from qemu
2018-03-01 12:11:10 -05:00
Richard Henderson 0c00b036be
target-m68k: Do not cpu_abort on undefined insns
Report this properly via exception and, importantly, allow
the disassembler the chance to tell us what insn is not handled.

Backports commit 72d2e4b6a437f11f97d3138f6b2ec177b78210c7 from qemu
2018-03-01 12:02:39 -05:00
Laurent Vivier 90b0b6d867
target-m68k: Implement 680x0 movem
680x0 movem can load/store words and long words and can use more
addressing modes. Coldfire can only use long words with (Ax) and
(d16,Ax) addressing modes.

Backports commit 7b542eb96d7d5d9266a9c0425f05d49c8e6df2f9 from qemu
2018-03-01 12:01:46 -05:00
Laurent Vivier 2d318da080
target-m68k: add cas/cas2 ops
Implement CAS using cmpxchg.
Implement CAS2 using helper and either cmpxchg when
the 32bit addresses are consecutive, or with
parallel_cpus+cpu_loop_exit_atomic() otherwise.

Backports commit 14f944063affbcc7bd6df42b060793dbfee8a822 from qemu
2018-03-01 11:56:26 -05:00
Laurent Vivier f602f9d40c
target-m68k: add abcd/sbcd/nbcd
Backports commit fb5543d820018a46b713911e7653594be727ca98 from qemu
2018-03-01 11:51:49 -05:00
Laurent Vivier 90b87b3580
target-m68k: add 680x0 divu/divs variants
Update helper to set the throwing location in case of div-by-0.
Cleanup divX.w and add quad word variants of divX.l.

Backports commit 0ccb9c1d8128a020720d5c6abf99a470742a1b94 from qemu
2018-03-01 11:42:30 -05:00
Laurent Vivier 77b8b2f3b8
target-m68k: add 680x0 divu/divs variants
Update helper to set the throwing location in case of div-by-0.
Cleanup divX.w and add quad word variants of divX.l.

Backports commit 0ccb9c1d8128a020720d5c6abf99a470742a1b94 from qemu
2018-03-01 11:38:53 -05:00
Laurent Vivier f3990e8f87
target-m68k: add 64bit mull
Backports commit 8be95defd6ab10d2c9f986879a0afa82417cb8e5 from qemu
2018-03-01 11:32:59 -05:00
Laurent Vivier e1c7d37556
target-m68k: add cmpm
Backports commit 817af1c72d227fd5759ef882bef61acee40679b1 from qemu
2018-03-01 11:29:35 -05:00
Richard Henderson e6ca471dda
target-m68k: Split gen_lea and gen_ea
Provide gen_lea_mode and gen_ea_mode, where the mode can be
specified manually, rather than taken from the instruction.

Backports commit f84aab269ddab8509b77408b886e9071bf5c48fb from qemu
2018-03-01 11:27:43 -05:00
Richard Henderson 5541553e8d
target-m68k: Delay autoinc writeback
Backports commit 8a1e52b69d2cd1c633f3c473a213d575931bf46d from qemu
2018-03-01 11:18:36 -05:00
Cédric Le Goater c7ab1e782b
target-arm: Add VBAR support to ARM1176 CPUs
ARM1176 CPUs have TrustZone support and can use the Vector Base
Address Register, but currently, qemu only adds VBAR support to ARMv7
CPUs. Fix this by adding a new feature ARM_FEATURE_VBAR which can used
for ARMv7 and ARM1176 CPUs.

The VBAR feature is always set for ARMv7 because some legacy boards
require it even if this is not architecturally correct.

Backports commit 91db4642f868cf2e591b62d31a19d35b02ea791e from qemu
2018-03-01 11:12:29 -05:00
Peter Maydell 554ad1f34e
target-arm: Log AArch64 exception returns
We already log exception entry; add logging of the AArch64 exception
return path as well.

Backports commit c9b61d9aa1ad234b0961f8add023cdc999cda3da from qemu
2018-03-01 11:08:35 -05:00
Julian Brown 86670028f7
Correct value of ARM Cortex-A8 MVFR1 register.
The value of the MVFR1 (Media and VFP Feature Register 1) register for
the Cortex-A8 appears to be incorrect (according to the TRM, DDI0344K),
with the "full denormal arithmetic" and "propagation of NaN" fields
holding both 0 instead of both 1.

I had a go tracing the history of the use of this value, and it seems
it's always just been wrong in QEMU: maybe it was derived from early
documentation, or guessed based on the use of a "VFP Lite" implementation
in the Cortex-A8.

Depending on the startup/early-boot code in use, this can manifest as
failure to perform denormal arithmetic properly: in our case, selecting
a Cortex-A8 CPU when using QEMU as an instruction-set simulator for
bare-metal GCC testing caused tests using denormal arithmetic to
fail. Problems might be masked (or not occur) when using a full OS kernel
with suitable trap handlers (I'm not sure).

Backports commit 0f1944735b6bac810b067e8a7a5154744536fd59 from qemu
2018-03-01 11:07:08 -05:00
Richard Henderson fcc05dc1ce
tcg/s390: Remove 'R' constraint
Since R0 is reserved, we don't need a special case constraint.

Backports commit e45d4ef6e345831c8d67a5bffe0d057efc20f4ff from qemu
2018-03-01 11:05:57 -05:00
Richard Henderson 7852cc600d
tcg/s390: Fix setcond expansion
We can't use LOAD AND TEST for unsigned data and then expect to
extract the result with ADD LOGICAL WITH CARRY. Fall through to
using COMPARE LOGICAL IMMEDIATE instead.

Backports commit 65839b56b9a740e6b898b5d81afc160502bd2935 from qemu
2018-03-01 11:04:40 -05:00
Kirill A. Shutemov eb489625b5
x86: implement la57 paging mode
The new paging more is extension of IA32e mode with more additional page
table level.

It brings support of 57-bit vitrual address space (128PB) and 52-bit
physical address space (4PB).

The structure of new page table level is identical to pml4.

The feature is enumerated with CPUID.(EAX=07H, ECX=0):ECX[bit 16].

CR4.LA57[bit 12] need to be set when pageing enables to activate 5-level
paging mode.

Backports commit 6c7c3c21f95dd9af8a0691c0dd29b07247984122 from qemu
2018-03-01 11:02:07 -05:00
Doug Evans 7c874b1b2b
target-i386: Fix eflags.TF/#DB handling of syscall/sysret insns
The syscall and sysret instructions behave a bit differently:
TF is checked after the instruction completes.
This allows the o/s to disable #DB at a syscall by adding TF to FMASK.
And then when the sysret is executed the #DB is taken "as if" the
syscall insn just completed.

Backports commit c52ab08aee6f7d4717fc6b517174043126bd302f from qemu
2018-03-01 10:56:22 -05:00
Yi Sun f6e624d97b
target-i386: Add Intel SHA_NI instruction support.
Add SHA_NI feature bit. Its spec can be found at:
https://software.intel.com/sites/default/files/managed/39/c5/325462-sdm-vol-1-2abcd-3abcd.pdf

Backports commit 638cbd452d3a92a2ab18caee73078483d90f64eb from qemu
2018-03-01 10:52:54 -05:00
Paolo Bonzini 81ad780e5e
exec: introduce MemoryRegionCache
Device models often have to perform multiple access to a single
memory region that is known in advance, but would to use "DMA-style"
functions instead of address_space_map/unmap. This can happen
for example when the data has to undergo endianness conversion.
Introduce a new data structure to cache the result of
address_space_translate without forcing usage of a host address
like address_space_map does.

Backports commit 1f4e496e1fc2eb6c8bf377a0f9695930c380bfd3 from qemu
2018-03-01 10:50:30 -05:00
Paolo Bonzini 03a9bbb3d3
exec: introduce address_space_extend_translation
This extracts the common part of address_space_map and
address_space_cache_init into a new function.

Backports commit 715c31ec8e12107f47ac74b464c97e813c76f898 from qemu
2018-03-01 10:06:43 -05:00
Paolo Bonzini 88ad0f4f6e
exec: introduce memory_ldst.inc.c
Templatize the address_space_* and *_phys functions, so that we can add
similar functions in the next patch that work with a lightweight,
cache-like version of address_space_map/unmap.

Backports commit 0ce265ffef87f19f4dd1ff0663e09a63d66ae408 from qemu
2018-03-01 09:59:34 -05:00
Paolo Bonzini f3cc489a72
exec: optimize remaining address_space_* cases
Do them right before the next patch generalizes them into a multi-included
file.

Backports commit 2651efe7f5f9d6dc89c8e54d7d63952b7b22597d from qemu
2018-03-01 09:40:29 -05:00
Richard Henderson 0f94929fa7
target-arm: Fix aarch64 vec_reg_offset
Since CPUARMState.vfp.regs is not 16 byte aligned, the ^ 8 fixup used
for a big-endian host doesn't do what's intended. Fix this by adding
in the vfp.regs offset after computing the inter-register offset.

Backports commit d437262fa8edd0d9fbe038a515dda3dbf7c5bb54 from qemu
2018-03-01 09:36:03 -05:00
Richard Henderson ce9dca9c5e
target-arm: Fix aarch64 disas_ldst_single_struct
We add s->be_data within do_vec_ld/st. Adding it here means that
we have the wrong bits set in SIZE for a big-endian host, leading
to g_assert_not_reached in write_vec_element and read_vec_element.

Backports commit 74b13f92c2428abae41a61c46a5cf47545da5fcb from qemu
2018-03-01 09:34:34 -05:00
Paolo Bonzini 560515941a
target-i386: correctly propagate retaddr into SVM helpers
Commit 2afbdf8 ("target-i386: exception handling for memory helpers",
2015-09-15) changed tlb_fill's cpu_restore_state+raise_exception_err
to raise_exception_err_ra. After this change, the cpu_restore_state
and raise_exception_err's cpu_loop_exit are merged into
raise_exception_err_ra's cpu_loop_exit_restore.

This actually fixed some bugs, but when SVM is enabled there is a
second path from raise_exception_err_ra to cpu_loop_exit. This is
the VMEXIT path, and now cpu_vmexit is called without a
cpu_restore_state before.

The fix is to pass the retaddr to cpu_vmexit (via
cpu_svm_check_intercept_param). All helpers can now use GETPC() to pass
the correct retaddr, too.

Backports commit 823fb688ebc52a7d79c1308acb28c92b56820167 from qemu
2018-03-01 09:31:16 -05:00
Richard Henderson f6a72d4dca
target/sparc: Restore ldstub of odd asis
Fixes the booting of ss20 roms.

Backports commit f61f76cb3ff9fea6ecbcb9696ed82b3e2c5b7364 from qemu
2018-03-01 09:21:44 -05:00
Paolo Bonzini 9404dbf74e
cpu-exec: fix icount out-of-bounds access
When icount is active, tb_add_jump is surprisingly called with an
out of bounds basic block index. I have no idea how that can work,
but it does not seem like a good idea. Clear *last_tb for all
TB_EXIT_ICOUNT_EXPIRED cases, even when all you have to do is
refill icount_extra.

Backports commit d8dea6fbcbed177ca5d23ab77b3834a9437f0e88 from qemu
2018-03-01 09:17:26 -05:00
Richard Henderson 6820964e2f
tcg/aarch64: Fix tcg_out_movi
There were some patterns, like 0x0000_ffff_ffff_00ff, for which we
would select to begin a multi-insn sequence with MOVN, but would
fail to set the 0x0000 lane back from 0xffff.

Backports commit 50b468d42107a2c646b1c566ed17d9ec362c51c4 from qemu
2018-03-01 09:15:34 -05:00
Richard Henderson a03666f2f2
tcg/aarch64: Fix addsub2 for 0+C
When al == xzr, we cannot use addi/subi because that encodes xsp.
Force a zero into the temp register for that (rare) case.

Backports commit 028fbea47713f909d6ea761a457779a82b276247 from qemu
2018-03-01 09:13:54 -05:00
Roman Kapl 337f57dd2c
exec: Add missing rcu_read_unlock
rcu_read_unlock was not called if the address_space_access_valid result is
negative.

This caused (at least) a problem when qemu on PPC/E500+TAP failed to terminate
properly and instead got stuck in a deadlock.

Backports commit 662a97d74f9b34cafe9aeb6d96620a97d768a1fa from qemu
2018-03-01 09:12:27 -05:00
Peter Maydell 488b6cc82b
exec.c: Fix breakpoint invalidation race
A bug (1647683) was reported showing a crash when removing
breakpoints. The reproducer was bisected to 3359baad when tb_flush
was finally made thread safe. While in MTTCG the locking in
breakpoint_invalidate would have prevented any problems, but
currently tb_lock() is a NOP for system emulation.

The race is between a tb_flush from the gdbstub and the
tb_invalidate_phys_addr() in breakpoint_invalidate().

Ideally we'd have actual locking here; for the moment the
simple fix is to do a full tb_flush() for a bp invalidate,
since that is thread-safe even if no lock is taken.

Backports commit a9353fe897ca2687e5b3385ed39e3db3927a90e0 from qemu
2018-03-01 09:10:59 -05:00
Alex Bennée f4c65739f3
target-arm/translate-a64: fix gen_load_exclusive
While testing rth's latest TCG patches with risu I found ldaxp was
broken. Investigating further I found it was broken by 1dd089d0 when
the cmpxchg atomic work was merged. As part of that change the code
attempted to be clever by doing a single 64 bit load and then shuffle
the data around to set the two 32 bit registers.

As I couldn't quite follow the endian magic I've simply partially
reverted the change to the original code gen_load_exclusive code. This
doesn't affect the cmpxchg functionality as that is all done on in
gen_store_exclusive part which is untouched.

I've also restored the comment that was removed (with a slight tweak
to mention cmpxchg).

Backports commit 5460da501a57cd72eda6fec736d76539122e2f99 from qemu
2018-03-01 09:09:16 -05:00
Marc-André Lureau b0e5d04813
qapi: add missing colon-ending for section name
The documentation parser we are going to add expects a section name to
end with ':', otherwise the comment is treated as free-form text body.

Backports commit 5072f7b38b1b9b26b8fbe1a89086386a420aded8 from qemu
2018-03-01 09:07:10 -05:00
Yongbok Kim 8575514f4c
target-mips: fix bad shifts in {dextp|dextpdp}
Fixed issues in the MIPSDSP64 instructions dextp and dextpdp.
Shifting can go out of 32 bit range.

https://bugs.launchpad.net/qemu/+bug/1631625

Backports commit e6e2784cacd4cfec149a7690976b9ff15e541c4d from qemu
2018-03-01 09:04:41 -05:00
Heiher b5468b4b22
target-mips: Fix Loongson multimedia instructions.
Needed to emit FPU exception on Loongson multimedia instructions
executing if Status:CU1 is clear. or FPR changes may be missed
on Linux.

Backports commit b5a587b613f6151c2ce164552579ae64f2ddfd1c from qemu
2018-03-01 09:03:49 -05:00
Heiher 12a8570cbe
target-mips: Fix Loongson multimedia 'or' instruction.
Backports commit bb7cab5f3466540f5603b209c0df2e27a02fbb95 from qemu
2018-03-01 09:03:10 -05:00
Heiher ba39cb4fcb
target-mips: Fix Loongson pandn instruction.
pandn FD, FS, FT
Operation: FD = ((NOT FS) AND FT)

Backports commit 9099a36b4bb81f84004b77f08e58ac2c67eed0e7 from qemu
2018-03-01 09:02:34 -05:00
Laurent Vivier 7055c38183
target-m68k: fix muluw/mulsw
"The multiplier and multiplicand are both word operands, and the result
is a long-word operand."

So compute flags on a long-word result, not on a word result.

Backports commit 4a18cd44f3c905d443c26e26bb9b09932606d1a3 from qemu
2018-03-01 08:59:42 -05:00
Laurent Vivier 527c68f40e
target-m68k: Fix cmpa operand size
"The size of the operation can be specified as word or long.
Word length source operands are sign-extended to 32 bits for
comparison."

So comparison is always done using OS_LONG.

Backports commit 5436c29d78957a6825a93f0eb79dfab388641017 from qemu
2018-03-01 08:58:59 -05:00
Laurent Vivier 69687e1824
target-m68k: fix EXG instruction
opcodes of "EXG Ax,Ay" and "EXG Dx,Dy" have been swapped

Backports commit c090c97d925ce751d8834d5c5a404952598f67c0 from qemu
2018-03-01 08:57:45 -05:00
Bobby Bingham d46e52d9d0
cpu_ldst.h: use correct guest address parameter
In the user emulation code path, tlb_vaddr_to_host erronesously passed
vaddr as the guest address to be translated, instead of addr, the parameter
which actually contained the guest address.

This resulted in incorrect addresses being used when emulating block copy
(mvc/mvpg) and block clear (xc) instructions for the s390x target.

Backports commit c2a85316902e67530da9d6548139fcce73c0cac6 from qemu
2018-03-01 08:56:37 -05:00
Ed Maste 6deaf98a8b
Fix FreeBSD (10.x) build after 7dc9ae43
Include sys/user.h for declaration of 'struct kinfo_proc'.
Add -lutil to qemu-ga link for kinfo_getproc.

Backports commit a7764f1548ef9946af30a8f96be9cef10761f0c1 from qemu
2018-03-01 08:55:43 -05:00
Luwei Kang 57533d1adc
x86: add AVX512_4VNNIW and AVX512_4FMAPS features
The spec can be found in Intel Software Developer Manual or in
Instruction Set Extensions Programming Reference.

Backports commit 95ea69fb46266aaa46d0c8b7f0ba8c4903dbe4e3 from qemu
2018-03-01 08:51:09 -05:00
Alex Bennée 1e4154af83
exec.c: ensure all AddressSpaceDispatch updates under RCU
The memory_dispatch field is meant to be protected by RCU so we should
use the correct primitives when accessing it. This race was flagged up
by the ThreadSanitizer.

Backports commit f35e44e7645edbb08e35b111c10c2fc57e2905c7 from qemu
2018-03-01 08:44:19 -05:00
Joseph Myers 7ff441826c
tcg: correct 32-bit tcg_gen_ld8s_i64 sign-extension
The version of tcg_gen_ld8s_i64 for 32-bit systems does a load into
the low part of the return value - then attempts a sign extension into
the high part, but wrongly sets the high part to a sign extension of
itself rather than of the low part. This results in TCG internal
errors from the use of the uninitialized high part (in some GCC tests
of AArch64 NEON shift intrinsics, in particular). This patch corrects
the sign-extension logic, making it match other functions such as
tcg_gen_ld16s_i64.

Backports commit 3ff91d7e85176f8b4b131163d7fd801757a2c949 from qemu
2018-03-01 08:41:23 -05:00
Peter Maydell f9c5c1a604
tcg/tcg.h: Improve documentation of TCGv_i32 etc types
The typedefs we use for the TCGv_i32, TCGv_i64 and TCGv_ptr
types are somewhat confusing, because we define them as
pointers to structs, but the structs themselves are never
defined. Explain in the comments a bit more clearly why
this is OK and what is going on under the hood.

Backports commit a40d4701bc9f6e6a3bbfb7b4fbe756a5b72b5df1 from qemu
2018-03-01 08:40:35 -05:00
Richard Henderson f5a35908da
tcg: Add tcg_gen_mulsu2_{i32,i64,tl}
This multiply has one signed input and one unsigned input,
producing the full double-width result.

Backports commit 5087abfb7dfd1d368ae6939420057036b4d8e509 from qemu
2018-03-01 08:39:37 -05:00
Richard Henderson f9d91a81b5
target-sparc: Use tcg_gen_atomic_cmpxchg_tl
Backports commit 5a7267b6a9e94c264ca77a7ca5a239e70dac81da from qemu
2018-03-01 08:34:35 -05:00
Richard Henderson 47313adedd
target-sparc: Use tcg_gen_atomic_xchg_tl
Backports commit da1bcae65288bdd51e0a7203d1e6c9cde1be5b3d from qemu
2018-03-01 08:32:10 -05:00
Richard Henderson 6b09040e23
target-sparc: Remove MMU_MODE*_SUFFIX
The functions that these generate are no longer used.

Backports commit 47b2696b975b794c6fa7b9fa8ae4699e749d662c from qemu
2018-03-01 08:30:27 -05:00
Richard Henderson 00fc847229
target-sparc: Allow 4-byte alignment on fp mem ops
The cpu is allowed to require stricter alignment on these 8- and 16-byte
operations, and the OS is required to fix up the accesses as necessary,
so the previous code was not wrong.

However, we can easily handle this misalignment for all direct 8-byte
operations and for direct 16-byte loads.

We must retain 16-byte alignment for 16-byte stores, so that we don't have
to probe for writability of a second page before performing the first of
two 8-byte stores. We also retain 8-byte alignment for no-fault loads,
since they are rare and it's not worth extending the helpers for this.

Backports commit cb21b4da6cca1bb4e3f5fefb698fb9e4d00c8f66 from qemu
2018-03-01 08:29:11 -05:00
Richard Henderson eec264526e
target-sparc: Implement ldqf and stqf inline
At the same time, fix a problem with stqf_asi, when
a write might access two pages.

Backports commit f939ffe5a022a8798824e2720ed5a14186fca6b6 from qemu
2018-03-01 08:20:36 -05:00
Richard Henderson 3a25695841
target-sparc: Remove asi helper code handled inline
Now that we never call out to helpers when direct accesses can
handle an asi, remove the corresponding code in those helpers.
For ldda, this removes the entire helper.

Backports commit 918d9a2c9d36378a3cf6636018900a4731c83b9d from qemu
2018-03-01 08:14:31 -05:00
Richard Henderson 15c8bf0b42
target-sparc: Implement BCOPY/BFILL inline
Backports commit 34810610acbde7a0745be3a88e99f2ef9282260f from qemu
2018-02-28 12:54:10 -05:00
Richard Henderson 3c48eb4aaf
target-sparc: Implement cas_asi/casx_asi inline
Backports commit 7268adebfda6548b8ae6865dc8337f116a5d266d from qemu
2018-02-28 12:47:26 -05:00
Richard Henderson b28b5cd3d3
target-sparc: Implement ldstub_asi inline
Backports commit fbb4bbb62e5603c991b880e25dc4bb30d342b944 from qemu
2018-02-28 12:42:26 -05:00
Richard Henderson adf9faf075
target-sparc: Implement swap_asi inline
Backports commit 4fb554bc6c88eb45270a3ad3cf6e6e2ad476aede from qemu
2018-02-28 12:39:55 -05:00
Richard Henderson ebc292c174
target-sparc: Handle more twinx asis
As used by HelenOS, presumably for ultra 2 and 3,
prior to the sun4v platform and the current twinx names.

Backports commit 34a6e13da70b2c798630a8dbd03d09f201c0198f from qemu
2018-02-28 12:28:08 -05:00
Richard Henderson ecbeea7c56
target-sparc: Use MMU_PHYS_IDX for bypass asis
Backports commit 7f87c90527d7363e8cecf1c6b5ad3d4cc85d3d28 from qemu
2018-02-28 12:26:29 -05:00
Richard Henderson 15eea419e5
target-sparc: Add MMU_PHYS_IDX
It's handy to have a mmu idx for physical addresses, so
that mmu disabled and physical access asis can use the
same path as normal accesses.

Backports commit af7a06bac7d3abb2da48ef3277d2a415772d2ae8 from qemu
2018-02-28 12:24:17 -05:00
Richard Henderson 9e60a8e432
target-sparc: Introduce cpu_raise_exception_ra
Several helpers call helper_raise_exception directly, which requires
in turn that their callers have performed save_state. The new function
allows a TCG return address to be passed in so that we can restore
PC + NPC + flags data from that.

This fixes a bug in the usage of helper_check_align, whose callers had
not been calling save_state. It fixes another bug in which the divide
helpers used GETPC at a level other than the direct callee from TCG.

This allows the translator to avoid save_state prior to SAVE, RESTORE,
and FLUSHW instructions.

Backports commit 2f9d35fc4006122bad33f9ae3e2e51d2263e98ee from qemu
2018-02-28 12:15:06 -05:00
Richard Henderson 62ae2a5102
target-sparc: Use overalignment flags for twinx and block asis
This allows us to enforce 16 and 64-byte alignment
without any extra overhead.

Backports commit 808832277af11dafee5a55da2b9e41d019b879ca from qemu
2018-02-28 12:01:50 -05:00
Alex Bennée da124da4b1
tcg: move locking for tb_invalidate_phys_page_range up
In the linux-user case all things that involve ''l1_map' and PageDesc
tweaks are protected by the memory lock (mmpa_lock). For SoftMMU mode
we previously relied on single threaded behaviour, with MTTCG we now use
the tb_lock().

As a result we need to do a little re-factoring and push the taking of
this lock up the call tree. This requires a slightly different entry for
the SoftMMU and user-mode cases from tb_invalidate_phys_range.

This also means user-mode breakpoint insertion needs to take two locks
but it hadn't taken any previously so this is an improvement.

Backpoirts commit ba051fb5e56d5ff5e4fa672d37954452e58543b2 from qemu
2018-02-28 10:35:41 -05:00
Paolo Bonzini 9d64a89acf
tcg: comment on which functions have to be called with tb_lock held
softmmu requires more functions to be thread-safe, because translation
blocks can be invalidated from e.g. notdirty callbacks. Probably the
same holds for user-mode emulation, it's just that no one has ever
tried to produce a coherent locking there.

This patch will guide the introduction of more tb_lock and tb_unlock
calls for system emulation.

Note that after this patch some (most) of the mentioned functions are
still called outside tb_lock/tb_unlock. The next one will rectify this.

Backports commit 7d7500d99895f888f97397ef32bb536bb0df3b74 from qemu
2018-02-28 10:26:28 -05:00
Alex Bennée 7aab0bd9a6
translate-all: add DEBUG_LOCKING asserts
This adds asserts to check the locking on the various translation
engines structures. There are two sets of structures that are protected
by locks.

The first the l1map and PageDesc structures used to track which
translation blocks are associated with which physical addresses. In
user-mode this is covered by the mmap_lock.

The second case are TB context related structures which are protected by
tb_lock which is also user-mode only.

Currently the asserts do nothing in SoftMMU mode but this will change
for MTTCG.

Backports commit 301e40ed8005306c009978be295ed9a4b725178b from qemu
2018-02-28 08:56:15 -05:00
Alex Bennée 075aaad106
translate_all: DEBUG_FLUSH -> DEBUG_TB_FLUSH
Make the debug define consistent with the others. The flush operation is
all about invalidating TranslationBlocks on flush events.

Also fix up the commenting on the other DEBUG for the benefit of
checkpatch.

Backports commit 955939a2b51f72bea1c200b559ea39985df5a633 from qemu
2018-02-28 08:53:38 -05:00
Anand J 8278af45cd
clean-up: removed duplicate #includes
Some files contain multiple #includes of the same header file.
Removed most of those unnecessary duplicate entries using
scripts/clean-includes.

Backports commit 814bb12a561d36aeb5ae4440ad43d2b0761d76da from qemu
2018-02-28 08:51:56 -05:00
Wei Huang bceed21d23
arm: Add an option to turn on/off vPMU support
This patch adds a pmu=[on/off] option to enable/disable vPMU support
in guest vCPU. It allows virt tools, such as libvirt, to determine the
exsitence of vPMU and configure it. Note this option is only available
for cortex-a57/cortex-53/ host CPUs, but unavailable on ARMv7 and other
processors. Also even though "pmu=" option is available for TCG mode,
setting it doesn't turn PMU on.

Backports commit 929e754d5a621cd53f30e69b766ccf381b58d124 from qemu
2018-02-28 08:49:23 -05:00
Laurent Vivier 5daf91ea48
target-m68k: immediate ops manage word and byte operands
Backports commit 92c62548f69cb4ba739d7d046e9caf9ea75753e4 from qemu
2018-02-28 08:42:22 -05:00
Laurent Vivier f7c29f73b3
target-m68k: cmp manages word and bytes operands
Backports commit ff99b952c8280853801fe14f7ae62d0f87464f7d from qemu
2018-02-28 08:37:46 -05:00
Laurent Vivier fc28e8127f
target-m68k: add/sub manage word and byte operands
Backports commit 8a370c6cb770b618f7eb66628116c25e84588df8 from qemu
2018-02-28 07:18:25 -05:00
Laurent Vivier bc27695926
target-m68k: add addressing modes to neg
Backports commit 227de713e0f4224a82c32991b4e4c4973381426b from qemu
2018-02-28 07:07:28 -05:00
Laurent Vivier 3558b93f11
target-m68k: introduce byte and word cc_ops
Backports commit db3d7945ae7992c91cc5705dccf60fec79b24dc4 from qemu
2018-02-28 06:52:16 -05:00
Laurent Vivier 4e257ffda9
target-m68k: some bit ops cleanup
Backports commit 3c980d2ef664e6d5a1a0c98aca4d11d33b17ca59 from qemu
2018-02-28 01:25:58 -05:00
Laurent Vivier cfab571859
target-m68k: suba/adda can manage word operand
Backports commit 415f4b62eb4629bd3702e6fb8aa51437a92983ff from qemu
2018-02-28 01:20:23 -05:00
Laurent Vivier 99c297efe3
target-m68k: and can manage word and byte operands
Backports commit 52dc23c5956159a79a4e2d4193e44d2c4cf3883c from qemu
2018-02-28 01:19:02 -05:00
Laurent Vivier 41372b0cc9
target-m68k: or can manage word and byte operands
Backports commit 020a4659208a6f9a985881504fd4d3b44ab589be from qemu
2018-02-28 01:15:27 -05:00
Laurent Vivier e140aac281
target-m68k: eor can manage word and byte operands
Backports commit eec37aec85af9f5fd59b534d20c86a775b8e7973 from qemu
2018-02-28 01:05:21 -05:00
Laurent Vivier bc52777b00
target-m68k: add addressing modes to not
Backports commit ea4f2a844132c81f1e6b51fed7019686ce4e3bc5 from qemu
2018-02-28 01:03:38 -05:00
Richard Henderson 549e31cc72
target-m68k: Inline addx, subx, negx
And add opcodes for 680x0

Backports commit a665a820e5d46b1611f409fbc7a540fe1c6bf5c8 from qemu
2018-02-28 01:02:31 -05:00
Laurent Vivier b796f934ff
target-m68k: add dbcc
Backports commit beff27ab3a60d8abab4a166670ca79b3c0970005 from qemu
2018-02-28 00:45:39 -05:00
Laurent Vivier 977c3fe6c4
target-m68k: add addressing modes to scc
Backports commit d5a3cf33f2f65069d2f79a6e349f0d8140f02bb4 from qemu
2018-02-28 00:43:30 -05:00
Laurent Vivier 77b1754376
target-m68k: add exg ops
Backports commit 29cf437da4eeacb46cd7076014d06c85ca47c91d from qemu
2018-02-28 00:37:41 -05:00
Laurent Vivier 56882899be
target-m68k: add linkl
Backports commit c630e436c0ed3adc3a858c328119daf6d1b3357f from qemu
2018-02-28 00:31:27 -05:00
Laurent Vivier 59d6a1a744
target-m68k: add bkpt instruction
Backports commit 71600eda7cc48f03ea306bc69ed7e52ef1d9dd91 from qemu
2018-02-28 00:29:41 -05:00
Emilio G. Cota 22be035e60
target-arm: remove EXCP_STREX + cpu_exclusive_{test, info}
The exception is not emitted anymore; remove it and the associated
TCG variables.

Backports commit 05188cc72f0399e99c92f608a8e7ca4c8e552c4b from qemu
2018-02-28 00:24:20 -05:00
Emilio G. Cota cb92eea81a
target-arm: emulate aarch64's LL/SC using cmpxchg helpers
Emulating LL/SC with cmpxchg is not correct, since it can
suffer from the ABA problem. Portable parallel code, however,
is written assuming only cmpxchg--and not LL/SC--is available.
This means that in practice emulating LL/SC with cmpxchg is
a viable alternative.

The appended emulates LL/SC pairs in aarch64 with cmpxchg helpers.
This works in both user and system mode. In usermode, it avoids
pausing all other CPUs to perform the LL/SC pair. The subsequent
performance and scalability improvement is significant, as the
plots below show. They plot the throughput of atomic_add-bench
compiled for ARM and executed on a 64-core x86 machine.

Hi-res plots: http://imgur.com/a/JVc8Y

atomic_add-bench: 1000000 ops/thread, [0,1] range

18 ++---------+----------+---------+----------+----------+----------+---++
+cmpxchg +-E--+ + + + + + |
16 ++master +-H--+ ++
|| |
14 ++ ++
| | |
12 ++| ++
| | |
10 ++++ ++
8 ++E ++
|+++ |
6 ++ | ++
| | |
4 ++ | ++
| | |
2 +H++E+--- ++
+ | +E++----+E+---+--+E+----++E+------+E+------+E++----+E+---+--+E|
0 ++H-H----H-+-----H----+---------+----------+----------+----------+---++
0 10 20 30 40 50 60
Number of threads

atomic_add-bench: 1000000 ops/thread, [0,2] range

18 ++---------+----------+---------+----------+----------+----------+---++
+cmpxchg +-E--+ + + + + + |
16 ++master +-H--+ ++
| | |
14 ++E ++
| | |
12 ++| ++
|+++ |
10 ++ | ++
8 ++ | ++
| | |
6 ++ | ++
| | |
4 ++ | ++
| +E+--- |
2 +H+ +E+-----+++ +++ +++ ---+E+-----+E+------+++
+++ + +E+---+--+E+----++E+------+E+--- ++++ +++ + +E|
0 ++H-H----H-+-----H----+---------+----------+----------+----------+---++
0 10 20 30 40 50 60
Number of threads

atomic_add-bench: 1000000 ops/thread, [0,128] range

70 ++---------+----------+---------+----------+----------+----------+---++
+cmpxchg +-E--+ + + + + + |
60 ++master +-H--+ +++ ---+E+-----+E+------+E+
| +E+------E-------+E+--- |
| --- +++ |
50 ++ +++--- ++
| -+E+ |
40 ++ +++---- ++
| E- |
| --| |
30 ++ -- +++ ++
| +E+ |
20 ++E+ ++
|E+ |
| |
10 ++ ++
+ + + + + + + |
0 +HH-H----H-+-----H----+---------+----------+----------+----------+---++
0 10 20 30 40 50 60
Number of threads

atomic_add-bench: 1000000 ops/thread, [0,1024] range

160 ++---------+---------+----------+---------+----------+----------+---++
+cmpxchg +-E--+ + + + + + |
140 ++master +-H--+ +++ +++
| -+E+-----+E+-------E|
120 ++ +++ ---- +++
| +++ ----E-- |
100 ++ --E--- +++ ++
| +++ ---- +++ |
80 ++ --E-- ++
| ---- +++ |
| -+E+ |
60 ++ ---- +++ ++
| +E+- |
40 ++ -- ++
| +E+ |
20 +EE+ ++
+++ + + + + + + |
0 +HH-H---H--+-----H---+----------+---------+----------+----------+---++
0 10 20 30 40 50 60
Number of threads

Backports commit 1dd089d0eec060dcd8478735114d98421d414805 from qemu
2018-02-28 00:21:27 -05:00
Emilio G. Cota 3546558f66
target-arm: emulate SWP with atomic_xchg helper
Backports commit cf12bce088f22b92bf62ffa0d7f6a3e951e355a9 from qemu
2018-02-28 00:11:23 -05:00
Emilio G. Cota ec14a00925
target-arm: emulate LL/SC using cmpxchg helpers
Emulating LL/SC with cmpxchg is not correct, since it can
suffer from the ABA problem. Portable parallel code, however,
is written assuming only cmpxchg--and not LL/SC--is available.
This means that in practice emulating LL/SC with cmpxchg is
a viable alternative.

The appended emulates LL/SC pairs in ARM with cmpxchg helpers.
This works in both user and system mode. In usermode, it avoids
pausing all other CPUs to perform the LL/SC pair. The subsequent
performance and scalability improvement is significant, as the
plots below show. They plot the throughput of atomic_add-bench
compiled for ARM and executed on a 64-core x86 machine.

Hi-res plots: http://imgur.com/a/aNQpB

atomic_add-bench: 1000000 ops/thread, [0,1] range

9 ++---------+----------+----------+----------+----------+----------+---++
+cmpxchg +-E--+ + + + + + |
8 +Emaster +-H--+ ++
| | |
7 ++E ++
| | |
6 ++++ ++
| | |
5 ++ | ++
4 ++ | ++
| | |
3 ++ | ++
| | |
2 ++ | ++
|H++E+--- +++ ---+E+------+E+------+E|
1 +++ +E+-----+E+------+E+------+E+------+E+-- +++ +++ ++
++H+ + +++ + +++ ++++ + + + |
0 ++--H----H-+-----H----+----------+----------+----------+----------+---++
0 10 20 30 40 50 60
Number of threads

atomic_add-bench: 1000000 ops/thread, [0,2] range

16 ++---------+----------+---------+----------+----------+----------+---++
+cmpxchg +-E--+ + + + + + |
14 ++master +-H--+ ++
| | |
12 ++| ++
| E |
10 ++| ++
| | |
8 ++++ ++
|E+| |
| | |
6 ++ | ++
| | |
4 ++ | ++
| +E+--- +++ +++ +++ ---+E+------+E|
2 +H+ +E+------E-------+E+-----+E+------+E+------+E+-- +++
+ | + +++ + ++++ + + + |
0 ++H-H----H-+-----H----+---------+----------+----------+----------+---++
0 10 20 30 40 50 60
Number of threads

atomic_add-bench: 1000000 ops/thread, [0,128] range

70 ++---------+----------+---------+----------+----------+----------+---++
+cmpxchg +-E--+ + + + ++++ + |
60 ++master +-H--+ ----E------+E+-------++
| -+E+--- +++ +++ +E|
| +++ ---- +++ ++|
50 ++ +++ ---+E+- ++
| -E--- |
40 ++ ---+++ ++
| +++--- |
| -+E+ |
30 ++ +++---- ++
| +E+ |
20 ++ +++-- ++
| +E+ |
|+E+ |
10 +E+ ++
+ + + + + + + |
0 +HH-H----H-+-----H----+---------+----------+----------+----------+---++
0 10 20 30 40 50 60
Number of threads

atomic_add-bench: 1000000 ops/thread, [0,1024] range

120 ++---------+---------+----------+---------+----------+----------+---++
+cmpxchg +-E--+ + + + + + |
| master +-H--+ ++|
100 ++ ----E+
| +++ ---+E+--- ++|
| --E--- +++ |
80 ++ ---- +++ ++
| ---+E+- |
60 ++ -+E+-- ++
| +++ ---- +++ |
| -+E+- |
40 ++ +++---- ++
| +++ ---+E+ |
| -+E+--- |
20 ++ +E+ ++
|+E+++ |
+E+ + + + + + + |
0 +HH-H---H--+-----H---+----------+---------+----------+----------+---++
0 10 20 30 40 50 60
Number of threads

Backports commit 354161b37c6465a32073eac5f16fa35939af2bb4 from qemu
2018-02-28 00:07:44 -05:00
Richard Henderson fd9933fbd5
target-arm: Rearrange aa32 load and store functions
Stop specializing on TARGET_LONG_BITS == 32; unconditionally allocate
a temp and expand with tcg_gen_extu_i32_tl. Split out gen_aa32_addr,
gen_aa32_frob64, gen_aa32_ld_i32 and gen_aa32_st_i32 as separate interfaces.

Backports commit 7f5616f53896a4e08ad37de3ac50d3a4cc8eff7a from qemu
2018-02-27 23:59:16 -05:00
Emilio G. Cota 3dc16ebca3
target-i386: remove helper_lock()
It's been superseded by the atomic helpers.

The use of the atomic helpers provides a significant performance and scalability
improvement. Below is the result of running the atomic_add-test microbenchmark with:
$ x86_64-linux-user/qemu-x86_64 tests/atomic_add-bench -o 5000000 -r $r -n $n
, where $n is the number of threads and $r is the allowed range for the additions.

The scenarios measured are:
- atomic: implements x86' ADDL with the atomic_add helper (i.e. this patchset)
- cmpxchg: implement x86' ADDL with a TCG loop using the cmpxchg helper
- master: before this patchset

Results sorted in ascending range, i.e. descending degree of contention.
Y axis is Throughput in Mops/s. Tests are run on an AMD machine with 64
Opteron 6376 cores.

atomic_add-bench: 5000000 ops/thread, [0,1] range

25 ++---------+----------+---------+----------+----------+----------+---++
+ atomic +-E--+ + + + + + |
|cmpxchg +-H--+ |
20 +Emaster +-N--+ ++
|| |
|++ |
|| |
15 +++ ++
|N| |
|+| |
10 ++| ++
|+|+ |
| | -+E+------ +++ ---+E+------+E+------+E+-----+E+------+E|
|+E+E+- +++ +E+------+E+-- |
5 ++|+ ++
|+N+H+--- +++ |
++++N+--+H++----+++ + +++ --++H+------+H+------+H++----+H+---+--- |
0 ++---------+-----H----+---H-----+----------+----------+----------+---H+
0 10 20 30 40 50 60
Number of threads

atomic_add-bench: 5000000 ops/thread, [0,2] range

25 ++---------+----------+---------+----------+----------+----------+---++
++atomic +-E--+ + + + + + |
|cmpxchg +-H--+ |
20 ++master +-N--+ ++
|E| |
|++ |
||E |
15 ++| ++
|N|| |
|+|| ---+E+------+E+-----+E+------+E|
10 ++| | ---+E+------+E+-----+E+--- +++ +++
||H+E+--+E+-- |
|+++++ |
| || |
5 ++|+H+-- +++ ++
|+N+ - ---+H+------+H+------ |
+ +N+--+H++----+H+---+--+H+----++H+--- + + +H+---+--+H|
0 ++---------+----------+---------+----------+----------+----------+---++
0 10 20 30 40 50 60
Number of threads

atomic_add-bench: 5000000 ops/thread, [0,8] range

40 ++---------+----------+---------+----------+----------+----------+---++
++atomic +-E--+ + + + + + |
35 +cmpxchg +-H--+ ++
| master +-N--+ ---+E+------+E+------+E+-----+E+------+E|
30 ++| ---+E+-- +++ ++
| | -+E+--- |
25 ++E ---- +++ ++
|+++++ -+E+ |
20 +E+ E-- +++ ++
|H|+++ |
|+| +H+------- |
15 ++H+ ---+++ +H+------ ++
|N++H+-- +++--- +H+------++|
10 ++ +++ - +++ ---+H+ +++ +H+
| | +H+-----+H+------+H+-- |
5 ++| +++ ++
++N+N+--+N++ + + + + + |
0 ++---------+----------+---------+----------+----------+----------+---++
0 10 20 30 40 50 60
Number of threads

atomic_add-bench: 5000000 ops/thread, [0,128] range

160 ++---------+---------+----------+---------+----------+----------+---++
+ atomic +-E--+ + + + + + |
140 +cmpxchg +-H--+ +++ +++ ++
| master +-N--+ E--------E------+E+------++|
120 ++ --| | +++ E+
| -- +++ +++ ++|
100 ++ - ++
| +++- +++ ++|
80 ++ -+E+ -+H+------+H+------H--------++
| ---- ---- +++ H|
| ---+E+-----+E+- ---+H+ ++|
60 ++ +E+--- +++ ---+H+--- ++
| --+++ ---+H+-- |
40 ++ +E+-+H+--- ++
| +H+ |
20 +EE+ ++
+N+ + + + + + + |
0 ++N-N---N--+---------+----------+---------+----------+----------+---++
0 10 20 30 40 50 60
Number of threads

atomic_add-bench: 5000000 ops/thread, [0,1024] range

350 ++---------+---------+----------+---------+----------+----------+---++
+ atomic +-E--+ + + + + + |
300 +cmpxchg +-H--+ +++
| master +-N--+ +++ ||
| +++ | ----E|
250 ++ | ----E---- ++
| ----E--- | ---+H|
200 ++ -+E+--- +++ ---+H+--- ++
| ---- -+H+-- |
| +E+ +++ ---- +++ |
150 ++ ---+++ ---+H+- ++
| --- -+H+-- |
100 ++ ---+E+ ---- +++ ++
| +++ ---+E+-----+H+- |
| -+E+------+H+-- |
50 ++ +E+ ++
+EE+ + + + + + + |
0 ++N-N---N--+---------+----------+---------+----------+----------+---++
0 10 20 30 40 50 60
Number of threads

hi-res: http://imgur.com/a/fMRmq

For master I stopped measuring master after 8 threads, because there is little
point in measuring the well-known performance collapse of a contended lock.

Backports commit 37b995f6e7a1cb6fa378c5cd4217b9dd9e1fc98b from qemu
2018-02-27 23:43:22 -05:00
Emilio G. Cota 9d9b7dedac
target-i386: emulate XCHG using atomic helper
Backports commit ea97ebe89f7a879ea9aba90140e40c29b5cbd653 from qemu
2018-02-27 23:40:20 -05:00
Emilio G. Cota 8f96b6beb9
target-i386: emulate LOCK'ed BTX ops using atomic helpers
Backports commit cfe819d309d472f75fd129faf1d1064a2498326c from qemu
2018-02-27 23:39:21 -05:00
Emilio G. Cota 089965fa8d
target-i386: emulate LOCK'ed XADD using atomic helper
Backports commit f53b01817f95781d2bcc8a82e057d1416601e13b from qemu
2018-02-27 23:06:28 -05:00
Emilio G. Cota f9ed728f27
target-i386: emulate LOCK'ed NEG using cmpxchg helper
Backports commit 8eb8c7385608b99bed6055a22d897ff727a6cb8e from qemu
2018-02-27 23:03:28 -05:00
Emilio G. Cota fedeb0f93e
target-i386: emulate LOCK'ed NOT using atomic helper
Backports commit 2a5fe8ae145ef7a3ab480922116d27efcc97b85d from qemu
2018-02-27 23:00:33 -05:00
Emilio G. Cota 05c94546d5
target-i386: emulate LOCK'ed INC using atomic helper
Backports commit 60e573462fcdb83aa1a41e66a9f31dc8a4364399 from qemu
2018-02-27 22:56:05 -05:00
Emilio G. Cota 7c7b0fe746
target-i386: emulate LOCK'ed OP instructions using atomic helpers
Backports commit a7cee522f3529c2fc85379237b391ea98823271e from qemu
2018-02-27 22:53:46 -05:00
Emilio G. Cota a386368f82
target-i386: emulate LOCK'ed cmpxchg using cmpxchg helpers
The diff here is uglier than necessary. All this does is to turn

FOO

into:

if (s->prefix & PREFIX_LOCK) {
BAR
} else {
FOO
}

where FOO is the original implementation of an unlocked cmpxchg.

Backports commit ae03f8de45427042ecd10b0941a005f21ecc064c from qemu
2018-02-27 22:38:37 -05:00
Richard Henderson b48508a6c1
tcg: Emit barriers with parallel_cpus
Backports commit 91682118aa330aff7e8ef0cc685c32d101f49940 from qemu
2018-02-27 22:28:33 -05:00
Richard Henderson 064543a415
tcg: Add CONFIG_ATOMIC64
Allow qemu to build on 32-bit hosts without 64-bit atomic ops.

Even if we only allow 32-bit hosts to multi-thread emulate 32-bit
guests, we still need some way to handle the 32-bit guest using a
64-bit atomic operation. Do so by dropping back to single-step.

Backports commit df79b996a7b21c6ea7847f7927a2e1a294b86c72 from qemu
2018-02-27 22:25:36 -05:00
Richard Henderson da01e53757
tcg: Add atomic128 helpers
Force the use of cmpxchg16b on x86_64.

Wikipedia suggests that only very old AMD64 (circa 2004) did not have
this instruction. Further, it's required by Windows 8 so no new cpus
will ever omit it.

If we truely care about these, then we could check this at startup time
and then avoid executing paths that use it.

Backports commit 7ebee43ee3e2fcd7b5063058b7ef74bc43216733 from qemu
2018-02-27 21:43:48 -05:00
Richard Henderson 5c0ce1b99c
tcg: Add atomic helpers
Add all of cmpxchg, op_fetch, fetch_op, and xchg.
Handle both endian-ness, and sizes up to 8.
Handle expanding non-atomically, when emulating in serial.

Backports commit c482cb117cc418115ca9c6d21a7a2315414c0a40 from qemu
2018-02-27 15:57:47 -05:00
Richard Henderson 0245f93c02
cputlb: Remove includes from softmmu_template.h
We already include exec/address-spaces.h and exec/memory.h in
cputlb.c; the include of qemu/timer.h appears to be a fossil.

Backports commit 40978428853e2f7b4597ab2a9ffeb187333802dc from qemu
2018-02-27 12:40:43 -05:00
Richard Henderson 5c79851143
cputlb: Tidy some macros
TGT_LE and TGT_BE are not size dependent and do not need to be
redefined. The others are no longer used at all.

Backports commit c86c6e4c80fee4d9423bedb10ba9e9c4aa68f861 from qemu
2018-02-27 12:36:25 -05:00
Richard Henderson 4da1cfb902
cputlb: Move most of iotlb code out of line
Saves 2k code size off of a cold path.

Backports commit 82a45b96a203a7403427183f1afd3d295222ff7d from qemu
2018-02-27 12:34:19 -05:00
Richard Henderson 5df7c9eec7
cputlb: Move probe_write out of softmmu_template.h
Backports commit 3b08f0a92545ba06fbdeaae929a5172480300c33 from qemu
2018-02-27 12:25:24 -05:00
Yongbok Kim 79e4c001a9
softmmu: Add probe_write()
Probe for whether the specified guest write access is permitted.
If it is not permitted then an exception will be taken in the same
way as if this were a real write access (and we will not return).
Otherwise the function will return, and there will be a valid
entry in the TLB for this access.

Backports commit 3b4afc9e75ab1a95f33e41f462921093f8a109c4 from qemu
2018-02-27 12:20:50 -05:00
Richard Henderson 1c9c8d3f10
cputlb: Replace SHIFT with DATA_SIZE
Backports commit dea2198201b3e0151d75b42774c51cf2ffe2ca4b from qemu
2018-02-27 12:00:33 -05:00
Richard Henderson e35aacd5ae
tcg: Add EXCP_ATOMIC
When we cannot emulate an atomic operation within a parallel
context, this exception allows us to stop the world and try
again in a serial context.

Backports commit fdbc2b5722f6092e47181a947c90fd4bdcc1c121 from qemu

Also backports parts of commit 02d57ea115b7669f588371c86484a2e8ebc369be
2018-02-27 11:57:58 -05:00
Richard Henderson d5510a546f
int128: Add int128_make128
Allows Int128 to be used more generally, rather than having to
begin with 64-bit inputs and accumulate.

Backports commit 1edaeee0955fba7d834b7c8f4e372e7eae030745 from qemu
2018-02-27 11:06:33 -05:00
Richard Henderson 9084e5fe1b
int128: Use __int128 if available
Backports commit 0846beb36641e8f0c3ee55a5bb84d468b653c852 from qemu
2018-02-27 11:03:06 -05:00
Richard Henderson 4fdbe94eea
exec: Avoid direct references to Int128 parts
Backports commit 258dfaaad05a5fbe32a142b794e1df3e16501d0e from qemu
2018-02-27 11:01:43 -05:00
Richard Henderson ba1c63572e
atomics: Add __nocheck atomic operations
While the check against sizeof(void *) is appropriate for
normal usage within qemu, there are places in which we want
wider operaions and have checked for their existance.

Backports commit 84bca3927b36fb1d9a2ca85cbbdf9023d2b84678 from qemu
2018-02-27 11:00:20 -05:00
Lioncash a59eef391e
atomic: MSVC compatible equivalents to some functions 2018-02-27 10:56:04 -05:00
Emilio G. Cota c837d76a86
atomics: add atomic_op_fetch variants
This paves the way for upcoming work.

Backports commit 83d0c719f837724d9e3963b078211b2242bdd2a5 from qemu
2018-02-27 10:28:27 -05:00
Emilio G. Cota 102a53aa50
atomics: add atomic_xor
This paves the way for upcoming work.

Backports commit 61696ddbdc74263ddb6869856772cfe355a5d3bd from qemu
2018-02-27 10:23:31 -05:00
Richard Henderson 3fe8d46a15
atomics: Add parameters to macros
Making these functional rather than object macros will
prevent later problems with complex macro expansion.

Backports commit d1a9f2d12fcfc942924956fbe321aedf4226ccb7 from qemu
2018-02-27 10:21:35 -05:00
Richard Henderson 4168095fed
target-m68k: Optimize gen_flush_flags
Backports commit 36f0399d46f2ccf4f6e7451ba46b1e8d0e9ab341 from qemu
2018-02-27 10:19:54 -05:00
Richard Henderson 7403e63f2f
target-m68k: Optimize some comparisons
Backports commit 9d896621c1820fd8f437fac26fd7d2e0921091c3 from qemu
2018-02-27 10:15:20 -05:00
Richard Henderson 672a28173f
target-m68k: Use setcond for scc
Backports commit b459e3eccfae7fe83e30187c391de00bccf4f51d from qemu
2018-02-27 10:11:35 -05:00
Richard Henderson ed6feb9329
target-m68k: Introduce DisasCompare
Backports commit 6a432295d73df91890dc70c4a94dcc4ba88ad1c3 from qemu
2018-02-27 10:08:32 -05:00
Richard Henderson 4e498cc54d
target-m68k: Reorg flags handling
Separate all ccr bits. Continue to batch updates via cc_op.

Backports commit 620c6cf66584bfbee90db84a7e87a6eabf230ca9 from qemu
2018-02-27 10:02:02 -05:00
Richard Henderson 121309a4d0
target-m68k: Reorg flags handling
Separate all ccr bits. Continue to batch updates via cc_op.

Signed-off-by: Richard Henderson <rth@twiddle.net>

Fix gen_logic_cc() to really extend the size of the result.
Fix gen_get_ccr(): update cc_op as it is used by the helper.
Factorize flags computing and src/ccr cleanup

Backports commit 620c6cf66584bfbee90db84a7e87a6eabf230ca9 from qemu
2018-02-27 09:30:32 -05:00
Richard Henderson 61ab9a42cd
target-m68k: Remove incorrect clearing of cc_x
The CF docs certainly doesnt suggest this is true.

Backports commit 18dd87f26bed46f22bb1b9536329c02de500f407 from qemu
2018-02-27 09:21:26 -05:00
Richard Henderson 187c2a9807
target-m68k: Some fixes to SR and flags management
Backports commit 99c514485b1d7922c4ca1ed767fd45525de4701f from qemu
2018-02-27 09:19:21 -05:00
Richard Henderson 9493b29399
target-m68k: Print flags properly
Backports commit 8e394ccabdb1e439aab092de6b9d2f26432e962f from qemu
2018-02-27 09:17:44 -05:00
Laurent Vivier 57ea90a91f
target-m68k: update CPU flags management
Copied from target-i386

Backports commit 9fdb533fb129b19610941bd1e5dd93e7471a18f5 from qemu
2018-02-27 09:15:29 -05:00
Laurent Vivier 125675e334
target-m68k: don't update cc_dest in helpers
Backports commit 91f90d7191f862ab27528dbdf76cee55c77f79cf from qemu
2018-02-27 09:04:51 -05:00
Laurent Vivier 12f9ba3fe4
target-m68k: update move to/from ccr/sr
Backports commit 7c0eb318bdcc3667a861e7b0f140df0b6d9895e2 from qemu
2018-02-27 08:57:05 -05:00
Laurent Vivier b8366d5b31
target-m68k: remove m68k_cpu_exec_enter() and m68k_cpu_exec_exit()
Update cc_op directly from tcg_gen_insn_start() and
restore_state_to_opc()

Copied from target-i386

Backports commit 20a8856eba0980fbe9d2b8ed2b33ecdb9c9fe5ad from qemu
2018-02-27 08:53:02 -05:00
Laurent Vivier a521f4f41d
target-m68k: Replace helper_xflag_lt with setcond
Backports commit f9083519034aaa5ad5cd2c5727bd61c29bf60bc5 from qemu
2018-02-27 08:50:44 -05:00
Laurent Vivier b079255576
target-m68k: allow to update flags with operation on words and bytes
Backports commit 5dbb6784b7e2b833c036b4df58aa07067e35f476 from qemu
2018-02-27 08:47:12 -05:00
Laurent Vivier f069762b61
target-m68k: REG() macro cleanup
Backports commit bcc098b0c23b4dd902ff56987d769bd839677331 from qemu
2018-02-27 08:37:25 -05:00
Laurent Vivier 3d59fe56b3
target-m68k: set PAGE_BITS to 12 for m68k
Backports commit 2b04e85a3401e13cb19b1de197e6c211eaadca4c from qemu
2018-02-27 08:36:09 -05:00
Laurent Vivier 292fc83c86
target-m68k: define operand sizes
Backports commit 7ef25cdd6cee4fa468d6cb913fa064a6689faf7d from qemu
2018-02-27 08:35:13 -05:00
Laurent Vivier 2653165c63
target-m68k: introduce read_imXX() functions
Read a 8, 16 or 32bit immediat constant.

An immediate constant is stored in the instruction opcode and
can be in one or two extension words.

Backports commit 28b68cd79ef01e8b1f5bd26718cd8c09a12c625f from qemu
2018-02-27 08:32:04 -05:00
Laurent Vivier d29cbb70b3
target-m68k: manage scaled index
Scaled index is not supported by 68000, 68008, and 68010.

EA = (bd + PC) + Xn.SIZE*SCALE + od

Ignore it:

M68000 FAMILY PROGRAMMER’S REFERENCE MANUAL
2.4 BRIEF EXTENSION WORD FORMAT COMPATIBILITY

"If the MC68000 were to execute an instruction that
encoded a scaling factor, the scaling factor would be
ignored and would not access the desired memory address.
The earlier microprocessors do not recognize the brief
extension word formats implemented by newer processors.
Although they can detect illegal instructions, they do not
decode invalid encodings of the brief extension word formats
as exceptions."

Backports commit d8633620a112296fcf6a6ae9a1cbba614c0ca502 from qemu
2018-02-27 08:27:20 -05:00
Laurent Vivier fa4a71a1bf
target-m68k: define m680x0 CPUs and features
This patch defines height new features:

- M68K_FEATURE_SCALED_INDEX, scaled address index register
- M68K_FEATURE_LONG_MULDIV, 32bit multiply/divide
- M68K_FEATURE_QUAD_MULDIV, 64bit multiply/divide
- M68K_FEATURE_BCCL, long conditional branches
- M68K_FEATURE_BITFIELD, bit field instructions
- M68K_FEATURE_FPU, FPU instructions
- M68K_FEATURE_CAS, cas instruction
- M68K_FEATURE_BKPT, bkpt instruction

Backports commit f076803bbf6ad1618f493f543faff97f3dd0c970 from qemu
2018-02-27 08:26:06 -05:00
John Paul Adrian Glaubitz 2fd7779aa5
target-m68k: Build the opcode table only once to avoid multithreading issues
Backports commit b208525797b031c1be4121553e21746686318a38 from qemu
2018-02-27 08:14:35 -05:00
Laurent Vivier fd84549b3e
target-m68k: fix DEBUG_DISPATCH
Backports commit a1ff19302007986fa081738e88905a715bd68e2e from qemu
2018-02-27 08:07:21 -05:00
Daniel P. Berrange 83a5bf2d25
qapi: rename QmpOutputVisitor to QObjectOutputVisitor
The QmpOutputVisitor has no direct dependency on QMP. It is
valid to use it anywhere that one wants a QObject. Rename it
to better reflect its functionality as a generic QAPI
to QObject converter.

The commit before previous renamed the files, this one renames C
identifiers.

Backports commit 7d5e199ade76c53ec316ab6779800581bb47c50a from qemu
2018-02-27 08:05:33 -05:00
Daniel P. Berrange 2949a90977
qapi: rename QmpInputVisitor to QObjectInputVisitor
The QmpInputVisitor has no direct dependency on QMP. It is
valid to use it anywhere that one has a QObject. Rename it
to better reflect its functionality as a generic QObject
to QAPI converter.

The previous commit renamed the files, this one renames C identifiers.

Backports commit 09e68369a88d7de0f988972bf28eec1b80cc47f9 from qemu
2018-02-26 15:54:15 -05:00
Daniel P. Berrange 228f122248
qapi: rename *qmp-*-visitor* to *qobject-*-visitor*
The QMP visitors have no direct dependency on QMP. It is
valid to use them anywhere that one has a QObject. Rename them
to better reflect their functionality as a generic QObject
to QAPI converter.

This is the first of three parts: rename the files. The next two
parts will rename C identifiers. The split is necessary to make git
rename detection work.

Backports commit b3db211f3c80bb996a704d665fe275619f728bd4 from qemu
2018-02-26 15:42:37 -05:00
Peter Maydell 1a850bcb19
target-arm: Implement new HLT trap for semihosting
Version 2.0 of the semihosting specification introduces new trap
instructions for AArch32: HLT 0xF000 for A32 and HLT 0x3C for T32.
Implement these (in the same way we implement the existing HLT
semihosting trap for A64).

The old traps via SVC and BKPT are unaffected.

Backports commit 19a6e31c9d2701ef648b70ddcfc3bf64cec8c37e from qemu
2018-02-26 15:28:45 -05:00
Peter Maydell db8b0a82b1
cpu: Support a target CPU having a variable page size
Support target CPUs having a page size which isn't knownn
at compile time. To use this, the CPU implementation should:
* define TARGET_PAGE_BITS_VARY
* not define TARGET_PAGE_BITS
* define TARGET_PAGE_BITS_MIN to the smallest value it
might possibly want for TARGET_PAGE_BITS
* call set_preferred_target_page_bits() in its realize
function to indicate the actual preferred target page
size for the CPU (and report any error from it)

In CONFIG_USER_ONLY, the CPU implementation should continue
to define TARGET_PAGE_BITS appropriately for the guest
OS page size.

Machines which want to take advantage of having the page
size something larger than TARGET_PAGE_BITS_MIN must
set the MachineClass minimum_page_bits field to a value
which they guarantee will be no greater than the preferred
page size for any CPU they create.

Note that changing the target page size by setting
minimum_page_bits is a migration compatibility break
for that machine.

For debugging purposes, attempts to use TARGET_PAGE_SIZE
before it has been finally confirmed will assert.

Backports commit 20bccb82ff3ea09bcb7c4ee226d3160cab15f7da from qemu
2018-02-26 12:29:08 -05:00
Vijaya Kumar K a7229cc08a
translate-all.c: Compute L1 page table properties at runtime
Remove L1 page mapping table properties computing
statically using macros which is dependent on
TARGET_PAGE_BITS. Drop macros V_L1_SIZE, V_L1_SHIFT,
V_L1_BITS macros and replace with variables which are
computed at early stage of VM boot.

Removing dependency can help to make TARGET_PAGE_BITS
dynamic.

Backports commit 66ec9f49399f0a9fa13ee77c472caba0de2773fc from qemu
2018-02-26 11:46:58 -05:00
Vijaya Kumar K 3082b4e4ec
exec.c: Remove static allocation of sub_section of sub_page
Allocate sub_section dynamically. Remove dependency
on TARGET_PAGE_SIZE to make run-time page size detection
for arm platforms.

Backports commit 2615fabd42ea0078dd9e659bdb21a5b7a1f87a9a from qemu
2018-02-26 10:50:04 -05:00
Paolo Bonzini eb75004013
memory: add a per-AddressSpace list of listeners
This speeds up MEMORY_LISTENER_CALL noticeably. Right now,
with many PCI devices you have N regions added to M AddressSpaces
(M = # PCI devices with bus-master enabled) and each call looks
up the whole listener list, with at least M listeners in it.
Because most of the regions in N are BARs, which are also roughly
proportional to M, the whole thing is O(M^3). This changes it
to O(M^2), which is the best we can do without rewriting the
whole thing.

Backports commit 9a54635dcb51a3fcf7507af630168f514a8cd4e7 from qemu
2018-02-26 10:46:50 -05:00
Paolo Bonzini 4b06e8bbb7
memory: eliminate global MemoryListeners
There is none, so just drop the code.

Backports commit d45fa784cd0c111131696808d1168259d66b7519 from qemu
2018-02-26 10:19:28 -05:00
Paolo Bonzini 8734e13a73
tcg: try sti when moving a constant into a dead memory temp
This comes from free from unifying tcg_reg_alloc_mov and
tcg_reg_alloc_movi's handling of TEMP_VAL_CONST. It triggers
often on moves to cc_dst, such as the following translation
of "sub $0x3c,%esp":

before: after:
subl $0x3c,%ebp subl $0x3c,%ebp
movl %ebp,0x10(%r14) movl %ebp,0x10(%r14)
movl $0x3c,%ebx movl $0x3c,0x2c(%r14)
movl %ebx,0x2c(%r14)

Backports commit 0fe4fca4e1a5e06a270127dd80bb753d4dda61c6 from qemu
2018-02-26 10:08:47 -05:00
Paolo Bonzini be00a3e100
target-i386: fix 32-bit addresses in LEA
This was found with test-i386. The issue is that instructions
such as

addr32 lea (%eax), %rax

did not perform a 32-bit extension, because the LEA translation
skipped the gen_lea_v_seg step. That step does not just add
segments, it also takes care of extending from address size to
pointer size.

Backports commit 620abfb004543404bef1953e25da2ad77352941a from qemu
2018-02-26 10:06:08 -05:00
Paolo Bonzini 8b239bd48b
atomic: base mb_read/mb_set on load-acquire and store-release
This introduces load-acquire and store-release operations in QEMU.
For now, just use them as an implementation detail of atomic_mb_read
and atomic_mb_set.

Since docs/atomics.txt documents that atomic_mb_read only synchronizes
with an atomic_mb_set of the same variable, we can use the new implementation
everywhere instead of seq-cst loads and stores.

Backports commit 803cf26a9e019b5d2256a8edeb22e3538c4f3261 from qemu
2018-02-26 10:02:46 -05:00
Paolo Bonzini fd7ef4c184
atomic: introduce smp_mb_acquire and smp_mb_release 2018-02-26 09:58:22 -05:00
Eduardo Habkost b41bb81737
target-i386: Don't use cpu->migratable when filtering features
When explicitly enabling unmigratable flags using "-cpu host"
(e.g. "-cpu host,+invtsc"), the requested feature won't be
enabled because cpu->migratable is true by default.

This is inconsistent with all other CPU models, which don't have
the "migratable" option, making "+invtsc" work without the need
for extra options.

This happens because x86_cpu_filter_features() uses
cpu->migratable as an argument for
x86_cpu_get_supported_feature_word(). This is not useful
because:
2) on "-cpu host" it only makes QEMU disable features that were
explicitly enabled in the command-line;
1) on all the other CPU models, cpu->migratable is already false.

The fix is to just use 'false' as an argument to
x86_cpu_get_supported_feature_word() in
x86_cpu_filter_features().

Note that:

* This won't change anything for people using using
"-cpu host" or "-cpu host,migratable=<on|off>" (with no extra
features) because the x86_cpu_get_supported_feature_word() call
on the cpu->host_features check uses cpu->migratable as
argument.
* This won't change anything for any CPU model except "host"
because they all have cpu->migratable == false (and only "host"
has the "migratable" property that allows it to be changed).
* This will only change things for people using "-cpu host,+<feature>",
where <feature> is a non-migratable feature. The only existing
named non-migratable feature is "invtsc".

In other words, this change will only affect people using
"-cpu host,+invtsc" (that will now get what they asked for: the
invtsc flag will be enabled). All other use cases are unaffected.

Backports commit 46c032f3afcc05a0123914609f1003906ba63fda from qemu
2018-02-26 09:51:14 -05:00
Eduardo Habkost 4096ce0184
target-i386: x86_cpu_load_features() function
When probing for CPU model information, we need to reuse the code
that initializes CPUID fields, but not the remaining side-effects
of x86_cpu_realizefn(). Move that code to a separate function
that can be reused later.

Backports commit 41f3d4d69a423dadb8431fda65d8d7c68c0de0fc from qemu
2018-02-26 09:49:34 -05:00
Eduardo Habkost aa98c8a93f
target-i386: Move warning code outside x86_cpu_filter_features()
x86_cpu_filter_features() will be reused by code that shouldn't
print any warning. Move the warning code to a new
x86_cpu_report_filtered_features() function, and call it from
x86_cpu_realizefn().

Backports commit 8ca30e8673aff9bfcf8f969f8db4266b5f62e49c from qemu
2018-02-26 09:40:11 -05:00
Eduardo Habkost 08bfa41e1b
target-i386: xsave: Add FP and SSE bits to x86_ext_save_areas
Instead of treating the FP and SSE bits as special cases, add
them to the x86_ext_save_areas array. This will simplify the code
that calculates the supported xsave components and the size of
the xsave area.

Backports commit e3c9022b4e2b6a4deb6518361d2bbf33522b9198 from qemu
2018-02-26 09:37:48 -05:00
Eduardo Habkost 54bd827472
target-i386: Register properties for feature aliases manually
Instead of keeping the aliases inside the feature name arrays and
require parsing the strings, just register alias properties
manually. This simplifies the code for property registration and
lookup.

Backports commit 16d2fcaa509b1ca56eb2fcd8fe877279cf65cccc from qemu
2018-02-26 09:34:52 -05:00
Eduardo Habkost b508b9e02a
target-i386: Remove underscores from feat_names arrays
Instead of translating the feature name entries when adding
property names, store the actual property names in the feature
name array.

For reference, here is the full list of functions that use
FeatureWordInfo::feat_names:

* x86_cpu_get_migratable_flags(): not affected, as it just
check for non-NULL values.
* report_unavailable_features(): informative only. It will
start printing feature names with hyphens.
* x86_cpu_list(): informative only. It will start printing
feature names with hyphens
* x86_cpu_register_feature_bit_props(): not affected, as it
was already calling feat2prop(). Now we can remove the
feat2prop() calls safely.

So, the only user-visible effect of this patch are the new names
being used in help and error messages for users.

Backports commit fc7dfd205f3287893c436d932a167bffa30579c8 from qemu
2018-02-26 09:33:15 -05:00
Eduardo Habkost 6d1a7bccb5
target-i386: Disable VME by default with TCG
VME is already disabled automatically when using TCG. So, instead
of pretending it is there when reporting CPU model data on
query-cpu-* QMP commands (making every CPU model to be reported
as not runnable), we can disable it by default on all CPU models
when using TCG.

Do that by adding a tcg_default_props array that will work like
kvm_default_props.

Backports commit 04d99c3c61f4bdc0450dbeb6512b6dd743baca65 from qemu
2018-02-26 08:23:44 -05:00
Eduardo Habkost 594cbeaa06
target-i386: List CPU models using subclass list
Instead of using the builtin_x86_defs array, use the QOM subclass
list to list CPU models on "-cpu ?" and "query-cpu-definitions".

Backports commit ee465a3ef77c2b2975ffa71c72208c05b3f3970d from qemu
2018-02-26 08:17:04 -05:00
Peter Maydell 200771d0ba
target-arm: Add trace events for the generic timers
Backports commit 194cbc492bcc8f3f1868ec97a35146bc99c3c71c from qemu
2018-02-26 08:15:42 -05:00
Peter Maydell 158bfc109a
target-arm: Implement dummy MDCCINT_EL1
MDCCINT_EL1 is part of the DCC debugger communication
channel between the CPU and an attached external debugger.
QEMU doesn't implement this, but since Linux may try
to access this register we need to provide at least
a dummy implementation.

Backports commit 5dbdc4342f479d799a1970dd5fd22e64c9dcd50d from qemu
2018-02-26 08:11:54 -05:00
Peter Maydell f2dcb81b27
Fix masking of PC lower bits when doing exception returns
In commit 9b6a3ea7a699594 store_reg() was changed to mask
both bits 0 and 1 of the new PC value when in ARM mode.
Unfortunately this broke the exception return code paths
when doing a return from ARM mode to Thumb mode: in some
of these we write a new CPSR including new Thumb mode
bit via gen_helper_cpsr_write_eret(), and then use store_reg()
to write the new PC. In this case if the new CPSR specified
Thumb mode then masking bit 1 of the PC is incorrect
(these code paths correspond to the v8 ARM ARM pseudocode
function AArch32.ExceptionReturn(), which always aligns the
new PC appropriately for the new instruction set state).

Instead of using store_reg() in exception-return code paths,
call a new store_pc_exc_ret() which stores the raw new PC
value to env->regs[15], and then mask it appropriately in
the subsequent helper_cpsr_write_eret() where the new
env->thumb state is available.

This fixes a bug introduced by 9b6a3ea7a699594 which caused
crashes/hangs or otherwise bad behaviour for Linux when
userspace was using Thumb.

Backports commit fb0e8e79a9d77ee240dbca036fa8698ce654e5d1 from qemu
2018-02-26 08:09:28 -05:00
Thomas Hanson c69ae10ca7
target-arm: Comments added to identify cases in a switch
3 cases in a switch in disas_exc() require reference to the
ARM ARM spec in order to determine what case they're handling.

Backports commit 957956b3013c8122a749dfe61a41aef8b4100e31 from qemu
2018-02-26 08:05:49 -05:00
Thomas Hanson 00d1803436
target-arm: Code changes to implement overwrite of tag field on PC load
For BR, BLR and RET instructions, if tagged addresses are enabled, the
tag field in the address must be cleared out prior to loading the
address into the PC. Depending on the current EL, it will be set to
either all 0's or all 1's.

Backports commit 6feecb8b941f2d21e5645d0b6e0cdb776998121b from qemu
2018-02-26 08:04:00 -05:00
Thomas Hanson 2af4ca54e9
target-arm: Infrastucture changes to enable handling of tagged address loading into PC
When capturing the current CPU state for the TB, extract the TBI0 and TBI1
values from the correct TCR for the current EL and then add them to the TB
flags field.

Then, at the start of code generation for the block, copy the TBI fields
into the DisasContext structure.

Backports commit 86fb3fa4ed5873b021a362ea26a021f4aeab1bb4 from qemu
2018-02-26 07:58:17 -05:00
Marc-André Lureau be6e25bcc7
qapi: return a 'missing parameter' error
The 'old' dispatch code returned a QERR_MISSING_PARAMETER for missing
parameters, but the qapi qmp_dispatch() code uses
QERR_INVALID_PARAMETER_TYPE.

Improve qapi code to return QERR_MISSING_PARAMETER where
appropriate.

Fix expected error message in iotests.

Backports commit 1382d4abdf9619985e4078e37e49e487cea9935e from qemu
2018-02-26 05:19:53 -05:00
Marc-André Lureau ddc25c8aaf
qapi: assert list entry has a value
This helps to figure out the expectations.

Backports commit eac8e79ff749fc15e1dca4caccf1f38664ab4915 from qemu
2018-02-26 05:15:32 -05:00
Marc-André Lureau bd469af15f
qapi: add assert about root value
qiv->root should not be null, make that clearer with some assert.

Backports commit 5d0cbbcfeb59e1e3f5ee7d26b8a215382f6d9abd from qemu
2018-02-26 05:15:01 -05:00
Marc-André Lureau 1a138915a5
qapi: Fix crash when 'any' or 'null' parameter is missing
Unlike the other visit methods, visit_type_any() and visit_type_null()
neglect to check whether qmp_input_get_object() succeeded. They crash
when it fails. Reproducer:

{ "execute": "qom-set",
"arguments": { "path": "/machine", "property": "rtc-time" } }

Will crash with:

qapi/qapi-visit-core.c:277: visit_type_any: Assertion `!err != !*obj'
failed

Broken in commit 5c678ee. Fix by adding the missing error checks.

Backports commit c489780203f9b22aca5539ec7589b7140bdc951f from qemu
2018-02-26 05:13:54 -05:00
Alex Bennée fbf6fb1e25
atomic.h: fix __SANITIZE_THREAD__ build
Only very modern GCC's actually set this define when building with the
ThreadSanitizer so this little typo slipped though.

Backports commit 23ea7f57949f2f5934f4d5bbc29fe321b3a7067b from qemu
2018-02-26 05:12:17 -05:00
Alex Bennée d4cb954102
cpu: atomically modify cpu->exit_request
ThreadSanitizer picks up potential races although we already use
barriers to ensure things are in the correct order when processing exit
requests. For true C11 defined behaviour across threads we need to use
relaxed atomic_set/atomic_read semantics to reassure tsan.

Backports commit 027d9a7d2911e993cdcbd21c7c35d1dd058f05bb from qemu
2018-02-26 05:11:18 -05:00
Alex Bennée e1cf9ca84a
qom/cpu: atomically clear the tb_jmp_cache
The ThreadSanitizer rightly complains that something initialised with a
normal access is later updated and read atomically.

Backports commit ce7cf6a973f4b614162b9518954d441fa5e32fc6 from qemu
2018-02-26 05:09:05 -05:00
Alex Bennée 12d7e946a1
qom/object: update class cache atomically
The idiom CPU_GET_CLASS(cpu) is fairly extensively used in various
threads and trips of ThreadSanitizer due to the fact it updates
obj->class->object_cast_cache behind the scenes. As this is just a
fast-path cache there is no need to lock updates.

However to ensure defined C11 behaviour across threads we need to use
the plain atomic_read/set primitives and keep the sanitizer happy.

Backports commit b6b3ccfda015dcd5ab50f70c189ee5cc6c622e91 from qemu
2018-02-26 05:06:40 -05:00
Alex Bennée bf72733576
tcg/optimize: move default return out of if statement
This is to appease sanitizer builds which complain that:

"error: control reaches end of non-void function"

Backports commit 550276ae0a88851edda2cb7fcdd64256dbb8e314 from qemu
2018-02-26 05:05:21 -05:00
Alex Bennée 4046235e92
atomic.h: comment on use of atomic_read/set
Add some notes on the use of the relaxed atomic access helpers and their
importance for defined behaviour in C11's multi-threaded memory model.

Backports commit e653bc6b0ff645c25b8a2eb607c18a5c98b59db6 from qemu
2018-02-26 05:03:59 -05:00
Peter Maydell f48d1fe391
target-arm: Correctly handle 'sub pc, pc, 1' for ARMv6
In the ARM v6 architecture, 'sub pc, pc, 1' is not an interworking
branch, so the computed new value is written to r15 as a normal
value. The architecture says that in this case, bits [1:0] of
the value written must be ignored if we are in ARM mode (or
bit [0] ignored if in Thumb mode); this is a change from the
ARMv4/v5 specification that behaviour is UNPREDICTABLE.
Use the correct mask on the PC value when doing a non-interworking
store to PC.

A popular library used on RaspberryPi uses this instruction
as part of a trick to determine whether it is running on
ARMv6 or ARMv7, and we were mishandling the sequence.

Fixes bug: https://bugs.launchpad.net/bugs/1625295

Backports commit 9b6a3ea7a699594162ed3d11e4e04b98568dc5c0 from qemu
2018-02-26 05:02:32 -05:00
Edgar E. Iglesias dedab81d68
target-arm: A64: Fix decoding of iss_sf in disas_ld_lit
Fix the decoding of iss_sf in disas_ld_lit.
The SF (Sixty-Four) field in the ISS (Instruction Specific Syndrome)
is a bit that specifies the width of the register that the
instruction loads to.

If cleared it specifies 32 bits.
If set it specifies 64 bits.

Backports commit 173ff58580b383a7841b18fddb293038c9d40d1c from qemu
2018-02-26 05:01:33 -05:00
Evgeny Yakovlev fa9d708fbd
target-i386: Correct family/model/stepping for Opteron_G3
Current CPU definition for AMD Opteron third generation includes
features like SSE4a and LAHF_LM support in emulated CPUID. These
features are present in K8 rev.E or K10 CPUs and later. However,
current G3 family and model describe 2nd generation K8 cores instead.

This is incorrect but was considered harmless until our tests found a
problem with linux kernels >= 3.10 (and maybe earlier) which specifically
check for Opteron K8 model when parsing CPUID leaf 0x80000001:
http://lxr.free-electrons.com/source/arch/x86/kernel/cpu/amd.c?v=3.16#L552
This code will disable LAHF_LM feature in /proc/cpuinfo if model number
is inconsistent.

This change sets Opteron_G3 family/model/stepping to 16/2/3 which is
a proper Opteron 3rd generation 2350 CPU.

Backports commit 339892d758efb2d0954160d41736a0eac9875d67 from qemu
2018-02-26 04:59:18 -05:00
Eduardo Habkost b7f434373b
target-i386: Report known CPUID[EAX=0xD,ECX=0]:EAX bits as migratable
A regression was introduced by commit 96193c22a "target-i386:
Move xsave component mask to features array": all
CPUID[EAX=0xD,ECX=0]:EAX bits were being reported as unmigratable
because they don't have feature names defined. This broke
"-cpu host" because it enables only migratable features by
default.

This adds a new field to FeatureWordInfo: migratable_flags, which
will make those features be reported as migratable even if they
don't have a property name defined.

Backports commit 6fb2fff75dceed1716e757882a6dfbadd9042407 from qemu
2018-02-26 04:58:05 -05:00
Alex Bennée 33589eb75f
cpus: pass CPUState to run_on_cpu helpers
CPUState is a fairly common pointer to pass to these helpers. This means
if you need other arguments for the async_run_on_cpu case you end up
having to do a g_malloc to stuff additional data into the routine. For
the current users this isn't a massive deal but for MTTCG this gets
cumbersome when the only other parameter is often an address.

This adds the typedef run_on_cpu_func for helper functions which has an
explicit CPUState * passed as the first parameter. All the users of
run_on_cpu and async_run_on_cpu have had their helpers updated to use
CPUState where available.

Backports commit e0eeb4a21a3ca4b296220ce4449d8acef9de9049 from qemu
2018-02-26 04:54:55 -05:00
Felipe Franciosi 0ed8880525
compiler: Swap 'public domain' header for license
As discussed on the list [1], having a comment stating that this file
is "public domain" is arguably wrong and not legally binding. This patch
replaces that comment with a clear GPLv2+ license as proposed in [2].

[1] http://lists.nongnu.org/archive/html/qemu-devel/2016-09/msg06151.html
[2] http://lists.nongnu.org/archive/html/qemu-devel/2016-09/msg06217.html

Worth noting, compiler.h was originally created on 5c026320 by splitting
qemu-common.h. At the time, qemu-common.h was already GPLv2+.

Backports commit cc9d8a3b2c41c22fb09f90f3085e6036c199c3ca from qemu
2018-02-26 04:49:45 -05:00
Eduardo Habkost 49c04d7104
target-i386: Clear KVM CPUID features if KVM is disabled
This will ensure all checks for features[FEAT_KVM] in the code
will be correct in case the KVM CPUID leaf is completely
disabled.

Backports commit aec661de86894e914d2d82431d9cefa9a9a40213 from qemu
2018-02-26 04:47:05 -05:00
Eduardo Habkost f29384c810
target-i386: Move xsave component mask to features array
This will reuse the existing check/enforce logic in
x86_cpu_filter_features() to check the xsave component bits
against GET_SUPPORTED_CPUID.

Backports commit 96193c22ab39ea24f81e386ad7883260ff24f5fd from qemu
2018-02-26 04:45:35 -05:00
Eduardo Habkost 3fb3e6672b
target-i386: xsave: Calculate set of xsave components on realize
Instead of doing complex calculations and calling
kvm_arch_get_supported_cpuid() inside cpu_x86_cpuid(), calculate
the set of required XSAVE components earlier, at realize time.

Backports commit 2ca8a8becc2eeb5262e478ce502f5daa53f3d0bc from qemu
2018-02-26 04:40:41 -05:00
Eduardo Habkost 28f002cbaf
target-i386: xsave: Helper function to calculate xsave area size
Move the xsave area size calculation from cpu_x86_cpuid() inside
its own function. While doing it, change it to use the XSAVE area
struct sizes for the initial size, instead of the magic 0x240
number.

Backports commit 1fda6198e4126af9988754c8824cfc9928649890 from qemu
2018-02-26 04:36:27 -05:00
Eduardo Habkost c35e9eb9af
target-i386: xsave: Simplify CPUID[0xD,0].{EAX,EDX} calculation
Instead of assigning individual bits in a loop, just copy the
values from ena_mask.

Backports commit 8057c621b1b17cbcb35fe67d1a09ada9055873a9 from qemu
2018-02-26 04:35:14 -05:00
Eduardo Habkost c7195afd32
target-i386: xsave: Calculate enabled components only once
Instead of checking both env->features and ena_mask at two
different places in the CPUID code, initialize ena_mask based on
the features that are enabled for the CPU, and then clear
unsupported bits based on kvm_arch_get_supported_cpuid().

The results should be exactly the same, but it will make it
easier to move the mask calculation elsewhare, and reuse
x86_cpu_filter_features() for the kvm_arch_get_supported_cpuid()
check.

Backports commit 4928cd6de6b4211a79f98c8dc39115be1e815c2b from qemu
2018-02-26 04:33:18 -05:00
Eduardo Habkost c3a0cba5b1
target-i386: Don't try to enable PT State xsave component
The code that calculates the set of supported XSAVE components on
CPUID looks at ext_save_areas to find out which components should
be enabled. However, if there are zeroed entries in the
ext_save_areas array, the
((env->features[esa->feature] & esa->bits) == esa->bits)
check will always succeed and QEMU will unconditionally try to
enable the component.

Luckily this never caused any problems because the only missing
entry in ext_save_areas is the PT State component (bit 8), and
KVM currently doesn't support it (so it was cleared on ena_mask).
But the code was still incorrect and would break if KVM starts
returning CPUID[EAX=0xD,ECX=0].EAX[bit 8] as supported on
GET_SUPPORTED_CPUID.

Fix the problem by changing the code to not enable a XSAVE
component if ExtSaveArea::bits is zero.

Backports commit 9646f4927faf68e8690588c2fd6dc9834c440b58 from qemu
2018-02-26 04:30:35 -05:00
Eduardo Habkost 6188c6d6e4
target-i386: Move feature name arrays inside FeatureWordInfo
It makes it easier to guarantee the arrays are the right size,
and to find information when looking at the code.

Backports commit 2d5312da566e4424a807d078da05f92ee7be3eec from qemu
2018-02-26 04:29:47 -05:00