Commit graph

3870 commits

Author SHA1 Message Date
Paolo Bonzini 4964bdcc29
configure: add --disable-tcg configure option
This lets you build without TCG (hardware accelerationor qtest only). When
this flag is passed to configure, it will automatically filter out the target
list to only those that support KVM or Xen or HAX.

Backports commit b3f6ea7e55e8228d6f84d5cee7cb11cae917ba95 from qemu
2018-03-03 21:35:30 -05:00
Yang Zhong d70c141675
tcg: move page_size_init() function
translate-all.c will be disabled if tcg is disabled in the build,
so page_size_init() function and related variables will be moved
to exec.c file.

Backports commit a0be0c585f5dcc4d50a37f6a20d3d625c5ef3a2c from qemu
2018-03-03 21:30:08 -05:00
Thomas Huth cf5d583ef0
cpu: Introduce a wrapper for tlb_flush() that can be used in common code
Commit 1f5c00cfdb8114c ("qom/cpu: move tlb_flush to cpu_common_reset")
moved the call to tlb_flush() from the target-specific reset handlers
into the common code qom/cpu.c file, and protected the call with
"#ifdef CONFIG_SOFTMMU" to avoid that it is called for linux-user
only targets. But since qom/cpu.c is common code, CONFIG_SOFTMMU is
*never* defined here, so the tlb_flush() was simply never executed
anymore. Fix it by introducing a wrapper for tlb_flush() in a file
that is re-compiled for each target, i.e. in translate-all.c.

Backports commit 2cd53943115be5118b5b2d4b80ee0a39c94c4f73 from qemu
2018-03-03 21:24:55 -05:00
Paolo Bonzini f944cf4255
target/i386: simplify handling of conforming code segments on interrupt
Move the handling of conforming code segments before the handling
of stack switch.

Because dpl == cpl after the new "if", it's now unnecessary to check
the C bit when testing dpl < cpl. Furthermore, dpl > cpl is checked
slightly above the modified code, so the final "else" is unreachable
and we can remove it.

Backports commit 1110bfe6f5600017258fa6578f9c17ec25b32277 from qemu
2018-03-03 21:19:48 -05:00
Wu Xiang a8de2d4748
target/i386: fix interrupt CPL error when using ist in x86-64
In do_interrupt64(), when interrupt stack table(ist) is enabled
and the the target code segment is conforming(e2 & DESC_C_MASK), the
old implementation always set new CPL to 0, and SS.RPL to 0.

This is incorrect for when CPL3 code access a CPL0 conforming code
segment, the CPL should remain unchanged. Otherwise higher privileged
code can be compromised.

The patch fix this for always set dpl = cpl when the target code segment
is conforming, and modify the last parameter `flags`, which contains
correct new CPL, in cpu_x86_load_seg_cache().

Backports commit e95e9b88ba5f4a6c17f4d0c3a3a6bf3f648bb328 from qemu
2018-03-03 21:18:22 -05:00
Lioncash 0ef338aa71
Fix building for multi-arch targets 2018-03-03 21:14:08 -05:00
Emilio G. Cota f66e74d65b
tcg: consistently access cpu->tb_jmp_cache atomically
Some code paths can lead to atomic accesses racing with memset()
on cpu->tb_jmp_cache, which can result in torn reads/writes
and is undefined behaviour in C11.

These torn accesses are unlikely to show up as bugs, but from code
inspection they seem possible. For example, tb_phys_invalidate does:
/* remove the TB from the hash list */
h = tb_jmp_cache_hash_func(tb->pc);
CPU_FOREACH(cpu) {
if (atomic_read(&cpu->tb_jmp_cache[h]) == tb) {
atomic_set(&cpu->tb_jmp_cache[h], NULL);
}
}
Here atomic_set might race with a concurrent memset (such as the
ones scheduled via "unsafe" async work, e.g. tlb_flush_page) and
therefore we might end up with a torn pointer (or who knows what,
because we are under undefined behaviour).

This patch converts parallel accesses to cpu->tb_jmp_cache to use
atomic primitives, thereby bringing these accesses back to defined
behaviour. The price to pay is to potentially execute more instructions
when clearing cpu->tb_jmp_cache, but given how infrequently they happen
and the small size of the cache, the performance impact I have measured
is within noise range when booting debian-arm.

Note that under "safe async" work (e.g. do_tb_flush) we could use memset
because no other vcpus are running. However I'm keeping these accesses
atomic as well to keep things simple and to avoid confusing analysis
tools such as ThreadSanitizer.

Backports commit f3ced3c59287dabc253f83f0c70aa4934470c15e from qemu
2018-03-03 21:12:36 -05:00
Emilio G. Cota 1a4e5da043
gen-icount: use tcg_ctx.tcg_env instead of cpu_env
We are relying on cpu_env being defined as a global, yet most
targets (i.e. all but arm/a64) have it defined as a local variable.
Luckily all of them use the same "cpu_env" name, but really
compilation shouldn't break if the name of that local variable
changed.

Fix it by using tcg_ctx.tcg_env, which all targets set in their
translate_init function. This change also helps paving the way
for the upcoming "translation loop common to all targets" work.

Backports commit 53f6672bcf57d82b794a2cc3a3469be7d35c8653 from qemu
2018-03-03 21:08:58 -05:00
Laurent Vivier 8a7f7242cc
target/m68k: add fmovem
Backports commit a1e58ddcb3eed7ec4a158512b9dae46f90492c1b from qemu
2018-03-03 21:05:56 -05:00
Laurent Vivier 50b639098c
target/m68k: add explicit single and double precision operations (part 2)
Add fsabs, fdabs, fsneg, fdneg, fsmove and fdmove.

The value is converted using the new floatx80_round() function.

Backports commit 77bdb2292492fafc4bc0fbb4d8c44fdd0ef1fa8e from qemu
2018-03-03 21:02:52 -05:00
Laurent Vivier 1d5e30f30c
target/m68k: add fsglmul and fsgldiv
fsglmul and fsgldiv truncate data to single precision before computing
results.

Backports commit 2f77995cebc8027851b8ea8f02c097fb8cdf668a from qemu
2018-03-03 20:59:20 -05:00
Laurent Vivier 4e8e8572c3
softfloat: define floatx80_round()
Add a function to round a floatx80 to the defined precision
(floatx80_rounding_precision)

Backports commit 0f72129281765ed64d26353284059f2bdcde7a23 from qemu
2018-03-03 20:57:27 -05:00
Laurent Vivier 20b610390d
target/m68k: add explicit single and double precision operations
Add fssqrt, fdsqrt, fsadd, fdadd, fssub, fdsub, fsmul, fdmul,
fsdiv, fddiv.

The precision is managed using set_floatx80_rounding_precision().

Backports commit a51b6bc38bb9b73a40e9486b52be12c810c6f2d9 from qemu
2018-03-03 20:55:41 -05:00
Laurent Vivier 0b62df7f30
target/m68k: add fmovecr
fmovecr moves a floating point constant from the
FPU ROM to a floating point register.

Backports commit 9d403660d91229922c2786e81c23cc9dd8e644f1 from qemu
2018-03-03 20:51:21 -05:00
Laurent Vivier ed3e8ab460
target/m68k: add fscc.
use DisasCompare with FPU conditions in fscc and fbcc.

Backports commit dd337bf86214e2436833d9442c995df95b136190 from qemu
2018-03-03 20:43:08 -05:00
Greg Kurz a125b35f1f
qapi: add explicit null to string input and output visitors
This may be used for deprecated object properties that are kept for
backwards compatibility.

Backports commit a733371214b68881d84725a3c71f60e2faf3b8e2 from qemu
2018-03-03 20:32:50 -05:00
KONRAD Frederic 18020c2c79
cputlb: cleanup get_page_addr_code to use VICTIM_TLB_HIT
This replaces env1 and page_index variables by env and index
so we can use VICTIM_TLB_HIT macro later.

Backports commit 3416343255cbe01fbe12e5e36cd4bb5042425b27 from qemu
2018-03-03 19:54:13 -05:00
Laurent Vivier f7ef6b49a8
target-m68k: add FPCR and FPSR
Backports commit ba62494483ab51ee31c70952b6ce5171a31860b1 from qemu
2018-03-03 19:51:31 -05:00
Laurent Vivier 1c6b1e2b9f
target-m68k: use floatx80 internally
Coldfire uses float64, but 680x0 use floatx80.
This patch introduces the use of floatx80 internally
and enables 680x0 80bits FPU.

Backports commit f83311e4764f1f25a8abdec2b32c64483be1759b from qemu
2018-03-03 19:35:17 -05:00
Laurent Vivier 92555a1134
target-m68k: initialize FPU registers
on reset, set FP registers to NaN and control registers to 0

Backports commit f4a6ce5155aab2a7ed7b9032a72187b37b3bfffe from qemu
2018-03-03 18:51:37 -05:00
Laurent Vivier d92621522a
target-m68k: move fmove CR to a function
Move code of fmove to/from control register to a function

Backports commit 860b9ac779615fe9315cd58165652052ac165a92 from qemu
2018-03-03 18:49:49 -05:00
Marc-André Lureau ca25248ecd
object: add uint property setter/getter
Backports commit 3152779cd63ba41331ef41659406f65b03e7911a from qemu
2018-03-03 18:43:17 -05:00
Marc-André Lureau fef464c4cb
qapi: update the qobject visitor to use QNUM_U64
Switch to use QNum/uint where appropriate to remove i64 limitation.

The input visitor will cast i64 input to u64 for compatibility
reasons (existing json QMP client already use negative i64 for large
u64, and expect an implicit cast in qemu).

Note: before the patch, uint64_t values above INT64_MAX are sent over
json QMP as negative values, e.g. UINT64_MAX is sent as -1. After the
patch, they are sent unmodified. Clearly a bug fix, but we have to
consider compatibility issues anyway. libvirt should cope fine,
because its parsing of unsigned integers accepts negative values
modulo 2^64. There's hope that other clients will, too.

Backports commit 5923f85fb82df7c8c60a89458a5ae856045e5ab1 from qemu
2018-03-03 18:40:51 -05:00
Marc-André Lureau 6ca6050206
qnum: add uint type
In order to store integer values between INT64_MAX and UINT64_MAX, add
a uint64_t internal representation.

Backports commit 61a8f418b26a2d974e38e4ae55020aca8d402d88 from qemu
2018-03-03 18:37:56 -05:00
Marc-André Lureau a57d8a5b50
qapi: Remove visit_start_alternate() parameter promote_int
Before the previous commit, parameter promote_int = true made
visit_start_alternate() with an input visitor avoid QTYPE_QINT
variants and create QTYPE_QFLOAT variants instead. This was used
where QTYPE_QINT variants were invalid.

The previous commit fused QTYPE_QINT with QTYPE_QFLOAT, rendering
promote_int useless and unused.

Backports commit 60390d2dc85ffade8981ca41e02335cb07353a6d from qemu
2018-03-03 18:34:35 -05:00
Lioncash a6623ce754
qapi: Update scripts to commit 01b2ffcedd94ad7b42bc870e4c6936c87ad03429 2018-03-03 18:32:12 -05:00
Marc-André Lureau dd77730d49
qapi: merge QInt and QFloat in QNum
We would like to use a same QObject type to represent numbers, whether
they are int, uint, or floats. Getters will allow some compatibility
between the various types if the number fits other representations.

Add a few more tests while at it.

Backports commit 01b2ffcedd94ad7b42bc870e4c6936c87ad03429 from qemu
2018-03-03 18:16:28 -05:00
Marc-André Lureau f1dbfe6be6
qapi: Clean up qobject_input_type_number() control flow
Use the more common pattern to error out.

Backports commit 58634047b7deeab36e4b07c4744e44d698975561 from qemu
2018-03-03 17:40:45 -05:00
Markus Armbruster d70f3bfc6b
qobject-input-visitor: Document full_name_nth()
Backports commit 6c02258e143700314ebf268dae47eb23db17d1cf from qemu
2018-03-03 17:39:09 -05:00
Markus Armbruster 0d433af617
qobject-input-visitor: Catch misuse of end_struct vs. end_list
Backports commit 8b2e41d733850ec6a67a85743138e023cbb8921b from qemu
2018-03-03 17:38:16 -05:00
Markus Armbruster e9174563be
qapi: Document intended use of @name within alternate visits
Backports commit ed0ba0f47e8cb6d924db0a54090bbb7b095fe9ea from qemu
2018-03-03 17:37:12 -05:00
Markus Armbruster 5ab0d5af81
qapi: New QAPI_CLONE_MEMBERS()
QAPI_CLONE() returns a newly allocated QAPI object. Inconvenient when
we want to clone into an existing object. QAPI_CLONE_MEMBERS() does
exactly that.

Backports commit 4626a19c86c30d96cedbac2bd44ef8103303cb37 from qemu
2018-03-03 17:36:02 -05:00
Eric Blake 734778da93
qobject: Add helper macros for common scalar insertions
Rather than making lots of callers wrap a scalar in a QInt, QString,
or QBool, provide helper macros that do the wrapping automatically.

Update the Coccinelle script to make mass conversions easy, although
the conversion itself will be done as a separate patches to ease
review and backport efforts.

Backports commit a92c21591b5bb9543996538f14854ca6b528318b from qemu
2018-03-03 17:33:30 -05:00
Markus Armbruster 09efe97bfd
qapi: Fix string input visitor regression for empty lists
Visiting a list when input is the empty string should result in an
empty list, not an error. Noticed when commit 3d089ce belatedly added
tests, but simply accepted as weird then. It's actually a regression:
broken in commit 74f24cb, v2.7.0. Fix it, and throw in another test
case for empty string.

Backports commit d2788227c6185c72d88ef3127e9fed41686f8e39 from qemu
2018-03-03 17:30:42 -05:00
Markus Armbruster 247a511c4a
qapi: Factor out common part of qobject input visitor creation
Backports commit abe81bc21a6996c62e66ed2d051373c0df24f870 from qemu
2018-03-03 17:26:27 -05:00
Marc-André Lureau c4e0911f95
object: fix potential leak in getters
If the property is not of the requested type, the getters will leak a
QObject.

Backports commit 560f19f162529d691619ac69ed032321c7f5f1fb from qemu
2018-03-03 17:22:32 -05:00
Richard Henderson 42bb73fa96
target/arm: Exit after clearing aarch64 interrupt mask
Exit to cpu loop so we reevaluate cpu_arm_hw_interrupts.

Backports commit 8da54b2507c1cabf60c2de904cf0383b23239231 from qemu
2018-03-03 17:19:40 -05:00
Richard Henderson dd1473f582
tcg: Increase hit rate of lookup_tb_ptr
We can call tb_htable_lookup even when the tb_jmp_cache is completely
empty. Therefore, un-nest most of the code dependent on tb != NULL
from the read from the cache.

This improves the hit rate of lookup_tb_ptr; for instance, when booting
and immediately shutting down debian-arm, the hit rate improves from
93.2% to 99.4%.

Backports commit b97a879de980e99452063851597edb98e7e8039c from qemu
2018-03-03 17:16:23 -05:00
Richard Henderson 9ec975448b
tcg/arm: Use ldr (literal) for goto_tb
The new placement of the TB means that we can use one insn
to load the goto_tb destination directly from the TB.

Backports commit 308714e6bc945389c64faf1b9213e2c0d3f03391 from qemu
2018-03-03 17:14:27 -05:00
Richard Henderson c99edca63b
tcg/arm: Try pc-relative addresses for movi
Backports commit 9c39b94f1448770e7e573e9516d2483816785d1b from qemu
2018-03-03 17:13:31 -05:00
Richard Henderson a5133ccaa1
tcg/arm: Remove limit on code buffer size
Since we're no longer using a direct branch, we have no
limit on the branch distance.

Backports commit acb0b292b6d0f49972dc98f742e79ed53973e438 from qemu
2018-03-03 17:11:47 -05:00
Richard Henderson 68275ba6f3
tcg/arm: Use indirect branch for goto_tb
Backports commit 3fb53fb4d12f2e7833bd1659e6013237b130ef20 from qemu
2018-03-03 17:11:18 -05:00
Richard Henderson 9a85cb0a26
tcg/aarch64: Use ADR in tcg_out_movi
The new placement of the TB means that we can use one insn
to load the return value for exit_tb returning the TB pointer.

Backports commit cc74d332ff9a78684374847375ef63fc4bd10436 from qemu
2018-03-03 17:09:42 -05:00
Emilio G. Cota f50e6cfa11
translate-all: consolidate tb init in tb_gen_code
We are partially initializing tb in tb_alloc. Instead, fully
initialize it in tb_gen_code, which is tb_alloc's only caller.

This saves an unnecessary write to tb->cflags.

Backports commit 2b48e10f888059a98043b4816769fa2a326a1d2c from qemu
2018-03-03 17:08:21 -05:00
Emilio G. Cota d3ada2feb5
tcg: allocate TB structs before the corresponding translated code
Allocating an arbitrarily-sized array of tbs results in either
(a) a lot of memory wasted or (b) unnecessary flushes of the code
cache when we run out of TB structs in the array.

An obvious solution would be to just malloc a TB struct when needed,
and keep the TB array as an array of pointers (recall that tb_find_pc()
needs the TB array to run in O(log n)).

Perhaps a better solution, which is implemented in this patch, is to
allocate TB's right before the translated code they describe. This
results in some memory waste due to padding to have code and TBs in
separate cache lines--for instance, I measured 4.7% of padding in the
used portion of code_gen_buffer when booting aarch64 Linux on a
host with 64-byte cache lines. However, it can allow for optimizations
in some host architectures, since TCG backends could safely assume that
the TB and the corresponding translated code are very close to each
other in memory. See this message by rth for a detailed explanation:

https://lists.gnu.org/archive/html/qemu-devel/2017-03/msg05172.html
Subject: Re: GSoC 2017 Proposal: TCG performance enhancements

Backports commit 6e3b2bfd6af488a896f7936e99ef160f8f37e6f2 from qemu
2018-03-03 17:05:49 -05:00
Emilio G. Cota 8e58c67968
util: add cacheinfo
Add helpers to gather cache info from the host at init-time.

For now, only export the host's I/D cache line sizes, which we
will use to improve cache locality to avoid false sharing.

Backports commit b255b2c8a5484742606e8760870ba3e14d0c9605 from qemu
2018-03-03 16:58:28 -05:00
Laurent Vivier da4d407317
target-m68k: define ext_opsize
Backports commit 69e698220f68a17ce9584b068f68ed09e527a6ad from qemu
2018-03-03 15:05:55 -05:00
Laurent Vivier 409369a7ce
target-m68k: move FPU helpers to fpu_helper.c
Backports commit c88f8107b14456d514b00571b0675cb532e82cad from qemu
2018-03-03 15:04:05 -05:00
Laurent Vivier 199c62ea01
softfloat: define 680x0 specific values
Backports commit e5b0cbe8e8744b57faf0c62d023525cd466f5ab8 from qemu
2018-03-03 15:01:16 -05:00
Laurent Vivier 68c9ab9b77
target/m68k: fix V flag for CC_OP_SUBx
V flag for subtraction is:

v = (res ^ src1) & (src1 ^ src2)

(see COMPUTE_CCR() in target/m68k/helper.c)

But gen_flush_flags() uses:

v = (res ^ src2) & (src1 ^ src2)

The problem has been found with the following program:

.global _start
_start:
move.l #-2147483648,%d0
subq.l #1,%d0
jvc 1f
move.l #1,%d1
move.l #1,%d0
trap #0
1:
move.l #0,%d1
move.l #1,%d0
trap #0

It works fine (exit(1)) on real hardware, and with "-singlestep".

"-singlestep" uses gen_helper_flush_flags(), whereas
without "-singlestep", V flag is computed directly in
gen_flush_flags().

This patch updates gen_flush_flags() to have the same result
as with gen_helper_flush_flags().

Backports commit 043b936ef6fe53396b3c6b8f5562ea3e238a071d from qemu
2018-03-03 14:59:20 -05:00