Commit graph

1057 commits

Author SHA1 Message Date
Peter Crosthwaite a249923d4d
qom: Add recursive version of object_child_for_each
Useful for iterating through an entire QOM subtree.

Backports commit d714b8de7747f20fe42e5716d1d44f91e2b891f4 from qemu
2018-02-17 15:23:35 -05:00
Peter Maydell e08c524068
Remove unused qemu_fls function
Nothing uses qemu_fls() any more, so delete it.

Backports commit 10944a19209bb520054569e0f156f50338901264 from qemu
2018-02-17 15:23:35 -05:00
Peter Maydell 400fd62ba7
exec.c: Use pow2floor() rather than hand-calculation
Use pow2floor() to round down to the nearest power of 2,
rather than an inline calculation.

Backports commit 6554f5c03793bb8a3d5dedcebf758a1694fa186c from qemu
2018-02-17 15:23:35 -05:00
Lioncash 9ce672c511
host-util: Add power calculation functions 2018-02-17 15:23:35 -05:00
Lioncash 2a6b6c1082
target-arm: Refactor CPU affinity handling
Introduces reusable definitions for CPU affinity masks/shifts and gets rid
of hardcoded magic numbers.

Backports commit 0f4a9e45ec35811ee250ac232d84d3c6d4fcd7fc from qemu
2018-02-17 15:23:34 -05:00
Sergey Sorokin 02ace69c9d
target-arm: Fix arm_excp_unmasked() function
There is an error in arm_excp_unmasked() function:
bitwise operator & is used with integer and bool operands
causing an incorrect zeroed result.
The patch fixes it.

Backports commit 771842585f3119f69641ed90a97d56eb9ed6f5ae from qemu
2018-02-17 15:23:34 -05:00
Sergey Sorokin 5b40cb8562
target-arm: Fix AArch32:AArch64 general-purpose register mapping
There is an error in functions aarch64_sync_32_to_64() and
aarch64_sync_64_to_32() with mapping of registers between AArch32 and
AArch64. This commit fixes the mapping to match the v8 ARM ARM
section D1.20.1 (table D1-77).

Backports commit 3a9148d0bdcee990fbe86759b9b1f5723c1d7fbc from qemu
2018-02-17 15:23:34 -05:00
Peter Crosthwaite 83aa10f77d
arm: Remove hw_error() usages.
All of these hw_errors are fatal and indicate something wrong with
QEMU implementation.

Convert to g_assert_not_reached.

Backports commit 8f6fd322f6e25995629a1a07b56bc5b91fb947ca from qemu
2018-02-17 15:23:34 -05:00
Peter Maydell 1b88e0e8c8
target-arm: Wire up HLT 0xf000 as the A64 semihosting instruction
For the A64 instruction set, the semihosting call instruction
is 'HLT 0xf000'. Wire this up to call do_arm_semihosting()
if semihosting is enabled.

Backports commit 8012c84ff92a36d05dfe61af9b24dd01a7ea25e4 from qemu
2018-02-17 15:23:34 -05:00
Lioncash f81894dddb
exec: Add semihosting stubs 2018-02-17 15:23:33 -05:00
Peter Maydell cdda3aec7f
target-arm/arm-semi.c: Support widening APIs to 64 bits
The 64-bit A64 semihosting API has some pervasive changes from
the 32-bit version:
* all parameter blocks are arrays of 64-bit values, not 32-bit
* the semihosting call number is passed in W0
* the return value is a 64-bit value in X0

Implement the necessary handling for this widening.

Backports relevant parts of commit faacc041619581c566c21ed87aa1933420731282 from qemu
2018-02-17 15:23:33 -05:00
Christopher Covington eabacd7daf
target-arm: Improve semihosting debug prints
Print semihosting debugging information before the
do_arm_semihosting() call so that angel_SWIreason_ReportException,
which causes the function to not return, gets the same debug prints as
other semihosting calls. Also print out the semihosting call number.

Backports commit 205ace55ffff77964e50af08c99639ec47db53f6 from qemu
2018-02-17 15:23:33 -05:00
Aurelien Jarno 11cfddad05
tcg/i386: use softmmu fast path for unaligned accesses
Softmmu unaligned load/stores currently goes through through the slow
path for two reasons:
  - to support unaligned access on host with strict alignement
  - to correctly handle accesses crossing pages

x86 is only concerned by the second reason. Unaligned accesses are
avoided by compilers, but are not uncommon. We therefore would like
to see them going through the fast path, if they don't cross pages.

For that we can use the fact that two adjacent TLB entries can't contain
the same page. Therefore accessing the TLB entry corresponding to the
first byte, but comparing its content to page address of the last byte
ensures that we don't cross pages. We can do this check without adding
more instructions in the TLB code (but increasing its length by one
byte) by using the LEA instruction to combine the existing move with the
size addition.

On an x86-64 host, this gives a 3% boot time improvement for a powerpc
guest and 4% for an x86-64 guest.

Backports commit 8cc580f6a0d8c0e2f590c1472cf5cd8e51761760 from qemu
2018-02-17 15:23:33 -05:00
Laurent Vivier ea2ee48d9c
s390: fix softmmu compilation
guest_base must be used only in linux-user mode.

Backports commit 090d0bfd948343d522cd20bc634105b5cfe2483b from qemu
2018-02-17 15:23:32 -05:00
Peter Maydell 4071f20ce2
target-arm: Implement AArch64 TLBI operations on IPAs
Implement the AArch64 TLBI operations which take an intermediate
physical address and invalidate stage 2 translations.

Backports commit cea66e91212164e02ad1d245c2371f7e8eb59e7f from qemu
2018-02-17 15:23:32 -05:00
Peter Maydell b318251716
target-arm: Implement missing EL3 TLB invalidate operations
Implement the remaining stage 1 TLB invalidate operations
visible from EL3.

Backports commit 43efaa33faa2bdaed789b9ddaa76b30880e57554 from qemu
2018-02-17 15:23:32 -05:00
Peter Maydell f29d67b43e
target-arm: Implement missing EL2 TLBI operations
Implement the missing TLBI operations that exist only
if EL2 is implemented.

Backports commit 2bfb9d75d37ceab6ef1674f54fca06c74f6978e7 from qemu
2018-02-17 15:23:32 -05:00
Peter Maydell f0ac6659d3
target-arm: Restrict AArch64 TLB flushes to the MMU indexes they must touch
Now we have the ability to flush the TLB only for specific MMU indexes,
update the AArch64 TLB maintenance instruction implementations to only
flush the parts of the TLB they need to, rather than doing full flushes.

We take the opportunity to remove some duplicate functions (the per-asid
tlb ops work like the non-per-asid ones because we don't support
flushing a TLB only by ASID) and to bring the function names in line
with the architectural TLBI operation names.

Backports commit fd3ed969227f54f08f87d9eb6de2d4e48e99279b from qemu
2018-02-17 15:23:32 -05:00
Peter Maydell 91262f721e
target-arm: Move TLBI ALLE1/ALLE1IS definitions into numeric order
Move the two regdefs for TLBI ALLE1 and TLBI ALLE1IS down so that the
whole set of AArch64 TLBI regdefs is arranged in numeric order.

Backports commit 83ddf975777cc23337b7ef92e83b1b9c949396f3 from qemu
2018-02-17 15:23:31 -05:00
Peter Maydell 6e94bda144
cputlb: Add functions for flushing TLB for a single MMU index
Guest CPU TLB maintenance operations may be sufficiently
specialized to only need to flush TLB entries corresponding
to a particular MMU index. Implement cputlb functions for
this, to avoid the inefficiency of flushing TLB entries
which we don't need to.

Backports commit d7a74a9d4a68e27b3a8ceda17bb95cb0a23d8e4d from qemu
2018-02-17 15:23:31 -05:00
Peter Maydell 86af3f249d
target-arm: Implement AArch32 ATS1H* operations
Implement the AArch32 ATS1H* operations which perform
Hyp mode stage 1 translations.

Backports commit 14db7fe09a2c8d561ff37f98b328409906a560d7 from qemu
2018-02-17 15:23:31 -05:00
Peter Maydell cf386519d2
target-arm: Enable the AArch32 ATS12NSO ops
Apply the correct conditions in the ats_access() function for
the ATS12NSO* address translation operations:
* succeed at EL2 or EL3
* normal UNDEF trap from NS EL1
* trap to EL3 from S EL1 (only possible if EL3 is AArch64)

(This change means they're now available in our EL3-supporting
CPUs when they would previously always UNDEF.)

Backports commit 87562e4f4a2bdd028eef3549ce9cb4e7c83cb0bf from qemu
2018-02-17 15:23:31 -05:00
Peter Maydell 2c4677ee5a
target-arm: Add CP_ACCESS_TRAP_UNCATEGORIZED_EL2, 3
Some coprocessor register access functions need to be able
to report "trap to EL3 with an 'uncategorized' syndrome";
add the necessary CPAccessResult enum and handling for it.

I don't currently know of any registers that need to trap
to EL2 with the 'uncategorized' syndrome, but adding the
_EL2 enum as well is trivial and fills in what would
otherwise be an odd gap in the handling.

Backports commit e76157264da20b85698b09fa5eb8e02e515e232c from qemu
2018-02-17 15:23:31 -05:00
Peter Maydell 355834e80a
target-arm: Wire up AArch64 EL2 and EL3 address translation ops
Wire up the AArch64 EL2 and EL3 address translation operations
(AT S12E1*, AT S12E0*, AT S1E2*, AT S1E3*), and correct some
errors in the ats_write64() function in previously unused code
that would have done the wrong kind of lookup for accesses from
EL3 when SCR.NS==0.

Backports commit 2a47df953202e1f226aa045ea974427c4540a167 from qemu
2018-02-17 15:23:30 -05:00
Peter Maydell f4608ebdd3
target-arm: there is no TTBR1 for 32-bit EL2 stage 1 translations
For EL2 stage 1 translations, there is no TTBR1. We were already
handling this for 64-bit EL2; add the code to take the 'no TTBR1'
code path for 64-bit EL2 as well.

Backports commit d0a2cbceb2aa20d64d53e1c20c7d26a78ade8382 from qemu
2018-02-17 15:23:30 -05:00
Peter Maydell 6681fea032
target-arm: Implement missing ACTLR registers
We already implemented ACTLR_EL1; add the missing ACTLR_EL2 and
ACTLR_EL3, for consistency.

Since we don't currently have any CPUs that need the EL2/EL3
versions to reset to non-zero values, implement as RAZ/WI.

Backports commit 834a6c6920316d39aaf0e68ac936c0a3ad164815 from qemu
2018-02-17 15:23:30 -05:00
Lioncash e621768c48
target-arm: Implement missing AFSR registers
The AFSR registers are implementation dependent auxiliary fault
status registers. We already implemented a RAZ/WI AFSR0_EL1 and
AFSR_EL1; add the missing AFSR{0,1}_EL{2,3} for consistency.

Backports commit 37cd6c2478196623ca28526627ca8c69afe0d654 from qemu
2018-02-17 15:23:30 -05:00
Peter Maydell f1011035f0
target-arm: Implement missing AMAIR registers
The AMAIR registers are for providing auxiliary implementation
defined memory attributes. We already implemented a RAZ/WI
AMAIR_EL1; add the EL2 and EL3 versions for consistency.

Backports commit 2179ef958c81480b841ffa0aab5e265688ffd2b0 from qemu
2018-02-17 15:23:30 -05:00
Peter Maydell 7d1422efc5
target-arm: Add missing MAIR_EL3 and TPIDR_EL3 registers
Add the AArch64 registers MAIR_EL3 and TPIDR_EL3, which are the only
two which we had implemented the 32-bit Secure equivalents of but
not the 64-bit Secure versions.

Backports commit 4cfb8ad896a6f85953038bd913ce3d82d347013d from qemu
2018-02-17 15:23:29 -05:00
Lioncash afaf2a99d3
apic_internal.h: Include cpu.h directly
apic_internal.h relies on cpu.h having been included (for the
X86CPU type); include it directly rather than relying on it
being pulled in via one of the other includes like timer.h.

Backports commit 20fbcfdd58ea47607a5755979d43f8c48ac93f08 from qemu
2018-02-17 15:23:29 -05:00
Peter Maydell d3a00d97bc
qemu-common.h: Move muldiv64() to host-utils.h
Move the muldiv64() function from qemu-common.h to host-utils.h.
This puts it together with all the other arithmetic functions
where we provide a version with __int128_t and a fallback
without, and allows headers which need muldiv64() to avoid
including qemu-common.h.

We don't include host-utils from qemu-common.h, to avoid dragging
more things into qemu-common.h than it already has; in practice
everywhere that needs muldiv64() can get it via qemu/timer.h.

Backports commit 49caffe0cc95a9d0dc344e3328be8197f3536cf8 from qemu
2018-02-17 15:23:29 -05:00
Peter Maydell fa87410077
osdep.h: Add header comment
Add a header comment to osdep.h, explaining what the header is for
and some rules to avoid circular-include difficulties.

Backports commit 03557b9abaee78e9d1ef5cd236d32a7b3e75e6f8 from qemu
2018-02-17 15:23:29 -05:00
Lioncash 9c63994b45
osdep.h: Move some OS header includes and fixups from qemu-common.h
qemu-common.h has some system header includes and fixups for
things that might be missing. This is really an OS dependency
and belongs in osdep.h, so move it across.

Backports commit bfe7e449f14313f646da621288ca2fd12223414f from qemu
2018-02-17 15:23:29 -05:00
Peter Maydell 19cd2a7ca4
qemu-common.h: Move Win32 fixups into os-win32.h
qemu-common.h includes some fixups for things the Win32
headers don't define or define weirdly. These really
belong in os-win32.h, so move them there.

Backports commit 1aad8104f3b69206da1f868639e1f69c26f6d482 from qemu
2018-02-17 15:23:29 -05:00
Peter Maydell d21aec2212
qemu-common.h: Document cutils.c string functions
Add documentation comments for various utility string functions
which we have implemented in util/cutils.c:
 pstrcpy()
 strpadcpy()
 pstrcat()
 strstart()
 stristart()
 qemu_strnlen()
 qemu_strsep()

Backports commit ab6036630865eff8bb12dd51dfa6921b4607fc81 from qemu
2018-02-17 15:23:28 -05:00
Lioncash cef0353be4
qemu-common: Add missing string util functions 2018-02-17 15:23:28 -05:00
Paolo Bonzini 542f162b35
cutils: add strpadcpy()
Backports commit 2a025ae454c361fb03aadf88e8a2f678b80b38e6 from qemu
2018-02-17 15:23:28 -05:00
Peter Maydell 7d5ef87f8c
compiler.h: Use glue() in QEMU_BUILD_BUG_ON define
Rather than rolling custom concatenate-strings macros for the
QEMU_BUILD_BUG_ON macro to use, use the glue() macro we already
have (since it's now available to us in this header).

Backports commit 24134c4e9126bf505b612e901c63a102fc471083 from qemu
2018-02-17 15:23:28 -05:00
Peter Maydell 29a7d89d19
osdep.h: Move some compiler-specific things to compiler.h
osdep.h has a few things which are really compiler specific;
move them to compiler.h, and include compiler.h from osdep.h.

Backports commit 4912086865083a008f4fb73173fd0ddf2206c4d9 from qemu
2018-02-17 15:23:28 -05:00
Peter Maydell c6a4c2fa17
osdep.h: Remove qemu_printf
qemu_printf is an ancient remnant which has been a simple #define to
printf for over a decade, and is used in only a few places. Expand
it out in those places and remove the #define.

Backports commit 71baf787d8fa2a5d186f22d8154069fd212be37f from qemu
2018-02-17 15:23:27 -05:00
Peter Crosthwaite 590c3dbb76
cpu_defs: Simplify CPUTLB padding logic
There was a complicated subtractive arithmetic for determining the
padding on the CPUTLBEntry structure. Simplify this with a union.

Backports commit b4a4b8d0e0767c85946fd8fc404643bf5766351a from qemu
2018-02-17 15:23:27 -05:00
Aurelien Jarno 88f7e01d44
target-mips: simplify LWL/LDL mask generation
The LWL/LDL instructions mask the GPR with a mask depending on the
address alignement. It is currently computed by doing:

mask = 0x7fffffffffffffffull >> (t1 ^ 63)

It's simpler to generate it by doing:

mask = ~(-1 << t1)

It uses one TCG instruction less, and it avoids a 32/64-bit constant
loading which can take a few instructions on RISC hosts.

Backports commit eb02cc3f89013612cb05df23b5441741e902bbd2 from qemu
2018-02-17 15:23:27 -05:00
Yongbok Kim 25a0776958
target-mips: update mips32r5-generic into P5600
As full specification of P5600 is available, mips32r5-generic should
be renamed to P5600 and corrected as its intention.
Correct PRid and detail of configuration.
Features which are not currently supported are described as FIXME.

Fix Config.MM bit location

Backports commit aff2bc6dc6d839caf6df0900437cc2cc9e180605 from qemu
2018-02-17 15:23:27 -05:00
Eduardo Habkost d5c7362e03
pc: Move PCMachineClass, PCMachineState to qemu/typedefs.h
They will be used inside hw/xen/xen.h, which doesn't include
hw/i386/pc.h.

Backports commit 8170dfa077761ed979b45f608cf706253a764f0d from qemu
2018-02-17 15:23:27 -05:00
Eduardo Habkost 952d0f522f
target-i386: Remove x86_cpu_compat_set_features()
The function is not used by PC code anymore and can be removed.

Backports commit e8963e5cecd4bb47ec3a7221ae591f278de6b5d0 from qemu
2018-02-17 15:23:26 -05:00
Peter Maydell 0c3e33ee11
target-arm: Add AArch32 banked register access to secure physical timer
If EL3 is AArch32, then the secure physical timer is accessed via
banking of the registers used for the non-secure physical timer.
Implement this banking.

Note that the access controls for the AArch32 banked registers
remain the same as the physical-timer checks; they are not the
same as the controls on the AArch64 secure timer registers.

Backports commit 9ff9dd3c875956523bb4c19ca712e5d05aab3c65 from qemu
2018-02-17 15:23:26 -05:00
Peter Maydell 6c24603b23
target-arm: Add the AArch64 view of the Secure physical timer
On CPUs with EL3, there are two physical timers, one for Secure and one
for Non-secure. Implement this extra timer and the AArch64 registers
which access it.

Backports commit b4d3978c2fdf944e428a46d2850dbd950b6fbe78 from qemu
2018-02-17 15:23:26 -05:00
Peter Maydell 7a482198b2
target-arm: Add debug check for mismatched cpreg resets
It's easy to accidentally define two cpregs which both try
to reset the same underlying state field (for instance a
clash between an AArch64 EL3 definition and an AArch32
banked register definition). if the two definitions disagree
about the reset value then the result is dependent on which
one happened to be reached last in the hashtable enumeration.

Add a consistency check to detect and assert in these cases:
after reset, we run a second pass where we check that the
reset operation doesn't change the value of the register.

Backports commit 49a661910c1374858602a3002b67115893673c25 from qemu
2018-02-17 15:23:25 -05:00
Lioncash d706680ad6
target-arm: Add the Hypervisor timer
Backports commit b0e66d95e4f587b5818d2760668301ee0871ba5e from qemu
2018-02-17 15:23:25 -05:00
Lioncash ba27ba76a4
target-arm: Pass timeridx as argument to various timer functions
Prepare for adding the Hypervisor timer, no functional change.

Backports commit 0e3eca4c26d6aa4f082db8e63fd81a16df061f3c from qemu
2018-02-17 15:23:25 -05:00
Edgar E. Iglesias 4cbd161ea8
target-arm: Rename and move gt_cnt_reset
Rename gt_cnt_reset to gt_timer_reset as the function really
resets the timers and not the counters. Move the registration
from counter regs to timer regs.

Backports commit d57b9ee84f6b2786f025712609edb259d0de086d from qemu
2018-02-17 15:23:25 -05:00
Edgar E. Iglesias 38639f678c
target-arm: Add CNTHCTL_EL2
Adds control for trapping selected timer and counter accesses to EL2.

Backports commit 0b6440afb807a80c6d64dcc987bcfed87e1ace17 from qemu
2018-02-17 15:23:24 -05:00
Edgar E. Iglesias 1abe79e7cf
target-arm: Add CNTVOFF_EL2
Adds support for the virtual timer offset controlled by EL2.

Backports commit edac4d8a168b9c0c4a765bbc5507e46fa5557b78 from qemu
2018-02-17 15:23:24 -05:00
Paolo Bonzini 208deb0387
memory: allow destroying a non-empty MemoryRegion
This is legal; the MemoryRegion will simply unreference all the
existing subregions and possibly bring them down with it as well.
However, it requires a bit of care to avoid an infinite loop.
Finalizing a memory region cannot trigger an address space update,
but memory_region_del_subregion errs on the side of caution and
might trigger a spurious update: avoid that by resetting mr->enabled
first.

Backports commit 91232d98da2bfe042d4c5744076b488880de3040 from qemu
2018-02-17 15:23:24 -05:00
James Hogan dba4828444
tcg/mips: Fix clobbering of qemu_ld inputs
The MIPS TCG backend implements qemu_ld with 64-bit targets using the v0
register (base) as a temporary to load the upper half of the QEMU TLB
comparator (see line 5 below), however this happens before the input
address is used (line 8 to mask off the low bits for the TLB
comparison, and line 12 to add the host-guest offset). If the input
address (addrl) also happens to have been placed in v0 (as in the second
column below), it gets clobbered before it is used.

addrl in t2 addrl in v0

1 srl a0,t2,0x7 srl a0,v0,0x7
2 andi a0,a0,0x1fe0 andi a0,a0,0x1fe0
3 addu a0,a0,s0 addu a0,a0,s0
4 lw at,9136(a0) lw at,9136(a0) set TCG_TMP0 (at)
5 lw v0,9140(a0) lw v0,9140(a0) set base (v0)
6 li t9,-4093 li t9,-4093
7 lw a0,9160(a0) lw a0,9160(a0) set addend (a0)
8 and t9,t9,t2 and t9,t9,v0 use addrl
9 bne at,t9,0x836d8c8 bne at,t9,0x836d838 use TCG_TMP0
10 nop nop
11 bne v0,t8,0x836d8c8 bne v0,a1,0x836d838 use base
12 addu v0,a0,t2 addu v0,a0,v0 use addrl, addend
13 lw t0,0(v0) lw t0,0(v0)

Fix by using TCG_TMP0 (at) as the temporary instead of v0 (base),
pushing the load on line 5 forward into the delay slot of the low
comparison (line 10). The early load of the addend on line 7 also needs
pushing even further for 64-bit targets, or it will clobber a0 before
we're done with it. The output for 32-bit targets is unaffected.

srl a0,v0,0x7
andi a0,a0,0x1fe0
addu a0,a0,s0
lw at,9136(a0)
-lw v0,9140(a0) load high comparator
li t9,-4093
-lw a0,9160(a0) load addend
and t9,t9,v0
bne at,t9,0x836d838
- nop
+ lw at,9140(a0) load high comparator
+lw a0,9160(a0) load addend
-bne v0,a1,0x836d838
+bne at,a1,0x836d838
addu v0,a0,v0
lw t0,0(v0)

Backports commit 33fca8589cf2aa7bf91564e6a8f26b3ba0910541 from qemu
2018-02-17 15:23:24 -05:00
Markus Armbruster 1b38f5208f
qom: Fix invalid error check in property_get_str()
When a function returns a null pointer on error and only on error, you
can do

if (!foo(foos, errp)) {
... handle error ...
}

instead of the more cumbersome

Error *err = NULL;

if (!foo(foos, &err)) {
error_propagate(errp, err);
... handle error ...
}

A StringProperty's getter, however, may return null on success! We
then fail to call visit_type_str().

Screwed up in 6a146eb, v1.1.

Fails tests/qom-test in my current, heavily hacked QAPI branch. No
reproducer for master known (but I didn't look hard).

Backports commit a479b21c111a87a50203a7413c4e5ec419fc88dd from qemu
2018-02-17 15:23:24 -05:00
Leon Alrae f0bf3c2e3b
target-mips: fix semihosting for microMIPS R6
In semihosting mode the SDBBP 1 instructions should trigger UHI syscall,
but in QEMU this does not happen for recently added microMIPS R6.
Consequently bare metal microMIPS R6 programs supporting UHI will not run.

Backports commit 060ebfef1a09b58fb219b3769b72efb407515bf1 from qemu
2018-02-17 15:23:24 -05:00
Aurelien Jarno 45927edecf
tcg/mips: fix add2
The add2 code in the tcg_out_addsub2 function doesn't take into account
the case where rl == al == bl. In that case we can't compute the carry
after the addition. As it corresponds to a multiplication by 2, the
carry bit is the bit 31.

While this is a corner case, this prevents x86-64 guests to boot on a
MIPS host.

Backports commit c99d69694af4ed15b33e3f7c2e3ef6972c14358d from qemu
2018-02-17 15:23:23 -05:00
Aurelien Jarno 4e68b4167d
tcg/s390x: Mask TCGMemOp appropriately for indexing
Commit 2b7ec66f fixed TCGMemOp masking following the MO_AMASK addition,
but two cases were forgotten in the TCG S390 backend.

Backports commit 3c8691f568f49bf623dcb2850464d4156d95e61b from qemu
2018-02-17 15:23:23 -05:00
Aurelien Jarno 096d1a975d
tcg/mips: Mask TCGMemOp appropriately for indexing
Commit 2b7ec66f fixed TCGMemOp masking following the MO_AMASK addition,
but two cases were forgotten in the TCG MIPS backend.

Backports commit 4214a8cb7c15ec43d4b2a43ebf248b273a0f4d45 from qemu
2018-02-17 15:23:23 -05:00
Aurelien Jarno 8396601082
tcg/mips: fix TLB loading for BE host with 32-bit guests
For 32-bit guest, we load a 32-bit address from the TLB, so there is no
need to compensate for the low or high part. This fixes 32-bit guests on
big-endian hosts.

Backports commit e72c4fb81db52be881c9356f1c60e0a7817d2d32 from qemu
2018-02-17 15:23:23 -05:00
Yongbok Kim 57cf90de18
target-mips: fix offset calculation for Interrupts
Correct computation of vector offsets for EXCP_EXT_INTERRUPT.
For instance, if Cause.IV is 0 the vector offset should be 0x180.

Simplify the finding vector number logic for the Vectored Interrupts.

Backports commit da52a4dfcc4864fd2260ec4eab331f75b1f0240b from qemu
2018-02-17 15:23:23 -05:00
Dmitry Poletaev 58fcf87a7b
target-i386/FPU: a misprint in helper_fistll_ST0
There is a cut-and-paste mistake in the patch
https://lists.gnu.org/archive/html/qemu-devel/2014-11/msg01657.html .
It cause errors in guest work. Here is the bugfix.

Backports commit 178846bdd93994c1acafe4423f99ead8bb24cf38 from qemu
2018-02-17 15:23:22 -05:00
Aurelien Jarno 3cc6b5251e
target-mips: fix page fault address for LWL/LWR/LDL/LDR
When a LWL, LWR, LDL or LDR instruction triggers a page fault, QEMU
currently reports the aligned address in CP0 BadVAddr, while the Windows
NT kernel expects the unaligned address.

This patch adds a byte access with the unaligned address at the
beginning of the LWL/LWR/LDL/LDR instructions to possibly trigger a page
fault and fill the QEMU TLB.

Backports commit 908680c6441ac468f4871d513f42be396ea0d264 from qemu
2018-02-17 15:23:22 -05:00
Leon Alrae b045c2c99a
target-mips: fix logically dead code reported by Coverity
Make use of CMPOP in floating-point compare instructions.

Backports commit 47ada0ad3431b39863918dc80386634693d317b5 from qemu
2018-02-17 15:23:22 -05:00
Leon Alrae 884fe72f54
target-mips: correct DERET instruction
Fix Debug Mode flag clearing, and when DERET is placed between LL and SC
do not make SC fail.

Backports commit fe87c2b36ae9c1c9a5279f3891f3bce1b573baa0 from qemu
2018-02-17 15:23:22 -05:00
Aurelien Jarno 5ee529edd3
target-mips: fix ASID synchronisation for MIPS MT
When syncing the task ASID with EntryHi, correctly or the value instead
of assigning it.

Backports commit 6a973e6b6584221bed89a01e755b88e58b496652 from qemu
2018-02-17 15:23:22 -05:00
Yongbok Kim 6fac3fee4e
target-mips: fix to clear MSACSR.Cause
MSACSR.Cause bits are needed to be cleared before a vector floating-point
instructions.
FEXDO.df, FEXUPL.df and FEXUPR.df were missed out.

Backports commit d4f4f0d5d9e74c19614479592c8bc865d92773d0 from qemu
2018-02-17 15:23:22 -05:00
Yongbok Kim 424b6eee4e
target-mips: fix MIPS64R6-generic configuration
Fix core configuration for MIPS64R6-generic to make it as close as
I6400.
I6400 core has 48-bit of Virtual Address available (SEGBITS).
MIPS SIMD Architecture is available.
Rearrange order of bits to match the specification.

Backports commit 4dc89b782095d7a0b919fafd7b1322b3cb1279f1 from qemu
2018-02-17 15:23:21 -05:00
Radim Krčmář f2d3607831
target-i386: emulate CPUID level of real hardware
W10 insider has a bug where it ignores CPUID level and interprets
CPUID.(EAX=07H, ECX=0H) incorrectly, because CPUID in fact returned
CPUID.(EAX=04H, ECX=0H); this resulted in execution of unsupported
instructions.

While it's a Windows bug, there is no reason to emulate incorrect level.

I used http://instlatx64.atw.hu/ as a source of CPUID and checked that
it matches Penryn Xeon X5472, Westmere Xeon W3520, SandyBridge i5-2540M,
and Haswell i5-4670T.

kvm64 and qemu64 were bumped to 0xD to allow all available features for
them (and to avoid the same Windows bug).

Backports commit 3046bb5debc8153a542acb1df93b2a1a85527a15 from qemu.
2018-02-17 15:23:21 -05:00
Eduardo Habkost 5d96fdb151
target-i386: Haswell-noTSX and Broadwell-noTSX
With the Intel microcode update that removed HLE and RTM, there will be
different kinds of Haswell and Broadwell CPUs out there: some that still
have the HLE and RTM features, and some that don't have the HLE and RTM
features. On both cases people may be willing to use the pc-*-2.3
machine-types.

So, to cover both cases, introduce Haswell-noTSX and Broadwell-noTSX CPU
models, for hosts that have Haswell and Broadwell CPUs without TSX support.

Backports commit a356850b80b3d13b2ef737dad2acb05e6da03753 from qemu
2018-02-17 15:23:21 -05:00
Jan Kiszka 16f8de7b4a
i386: Introduce ARAT CPU feature
ARAT signals that the APIC timer does not stop in power saving states.
As our APICs are emulated, it's fine to expose this feature to guests,
at least when asking for KVM host features or with CPU types that
include the flag. The exact model number that introduced the feature is
not known, but reports can be found that it's at least available since
Sandy Bridge.

Backports commit 28b8e4d0bf93ba176b4b7be819d537383c5a9060 from qemu
2018-02-17 15:23:21 -05:00
Paolo Bonzini d4b9f523d6
target-i386: add Ivy Bridge CPU model
Backports commit 2f9ac42acf4602453d5839221df6cc7cabc3355e from qemu
2018-02-17 15:23:21 -05:00
Paolo Bonzini a866ad9e15
target-i386: add f16c and rdrand to Haswell and Broadwell
Both were added in Ivy Bridge (for which we do not have a CPU model
yet!).

Backports commit 78a611f1936b3eac8ed78a2be2146a742a85212c from qemu
2018-02-17 15:23:21 -05:00
Paolo Bonzini 0a7a60b895
target-i386: add VME to all CPUs
vm86 mode extensions date back to the 486. All models should have
them.

Backports commit b3a4f0b1a072a467d003755ca0e55c5be38387cb from qemu
2018-02-17 15:23:20 -05:00
Pavel Dovgalyuk ee0d7ba219
i386: do not cross the pages boundaries in replay mode
This patch denies crossing the boundary of the pages in the replay mode,
because it can cause an exception. Do it only when boundary is
crossed by the first instruction in the block.
If current instruction already crossed the bound - it's ok,
because an exception hasn't stopped this code.

Backports commit 5b9efc39aee90bbd343793e942bf8f582a0c9e4f from qemu
2018-02-17 15:23:20 -05:00
Pavel Dovgalyuk e73fbde2ce
target-i386: fix icount processing for repz instructions
TCG generates optimized code for i386 repz instructions in single step mode.
It means that when ecx becomes 0, execution of the string instruction breaks
immediately without an additional iteration for ecx==0 (which will only check
ecx and set the flags). Omitting this iteration leads to different
instructions counting in singlestep mode and in normal execution.
This patch disables optimization of this last iteration for icount mode
which should be deterministic.

Backport commit c4d4525c38cd93cc5d1a743976eb25ac571d435f from qemu
2018-02-17 15:23:20 -05:00
Dmitry Poletaev fac60d226a
target-i386: fbld instruction doesn't set minus sign
Backports commit 18b41f95d20ac6dbf918c73e704d4ca1fbc1a62f from qemu
2018-02-17 15:23:20 -05:00
Dmitry Poletaev fff0c621da
target-i386: Wrong conversion infinity from float80 to int32/int64
Backports commit ea32aaf1a72af102b855317b47a22e75ac2965a9 from qemu
2018-02-17 15:23:20 -05:00
Aurelien Jarno a771209389
target-i386: simplify AES emulation
This patch simplifies the AES code, by directly accessing the newly added
S-Box, InvS-Box and InvMixColumns tables instead of recreating them by
using the AES_Te and AES_Td tables.

Backports commit 9551ea6991cfb7c777f7943ad69b30d0a4fadac3 from qemu
2018-02-17 15:23:19 -05:00
Paolo Bonzini 5e9ea14b7e
target-i386: add feature flags for CPUID[EAX=0xd,ECX=1]
These represent xsave-related capabilities of the processor, and KVM may
or may not support them.

Add feature bits so that they are considered by "-cpu ...,enforce", and use
the new feature work instead of calling kvm_arch_get_supported_cpuid.

Bit 3 (XSAVES) is not migratables because it requires saving MSR_IA32_XSS.
Neither KVM nor any commonly available hardware supports it anyway.

Backports commit 0bb0b2d2fe7f645ddaf1f0ff40ac669c9feb4aa1 from qemu

also backports 18cd2c17b5370369a886155c001da0a7f54bbcca
2018-02-17 15:23:19 -05:00
Eduardo Habkost a439a8c701
qom: strdup() target property name on object_property_add_alias()
With this, object_property_add_alias() callers can safely free the
target property name, like what already happens with the 'name' argument
to all object_property_add*() functions.

Backports commit 1590d266d96b3f9b42443d6388dfc38f527ac2d8 from qemu
2018-02-17 15:23:19 -05:00
Peter Maydell 484a9cc21b
target-arm: Fix broken SCTLR_EL3 reset
The SCTLR_EL3 cpreg definition was implicitly resetting the
register state to 0, which is both wrong and clashes with
the reset done via the SCTLR definition (since sctlr[3]
is unioned with sctlr_s). This went unnoticed until recently,
when an unrelated change (commit a903c449b41f105aa) happened to
perturb the order of enumeration through the cpregs hashtable for
reset such that the erroneous reset happened after the correct one
rather than before it. Fix this by marking SCTLR_EL3 as an alias,
so its reset is left up to the AArch32 view.

Backports commit e46e1a74ef482f1ef773e750df9654ef4442ca29 from qemu
2018-02-17 15:23:19 -05:00
Peter Crosthwaite 6279dfc113
cpu: Add wrapper for the set_pc() hook
Add a wrapper around the CPUClass::set_pc() hook.

Backports commit 2991b8904730d663f12ad42e35798ecc22fe151c from qemu
2018-02-17 15:23:19 -05:00
Peter Crosthwaite e51f8c9f6f
cpu-exec: Purge all uses of ENV_GET_CPU()
Remove un-needed usages of ENV_GET_CPU() by converting the APIs to use
CPUState pointers and retrieving the env_ptr as minimally needed.

Scripted conversion for target-* change:

for I in target-*/cpu.h; do
sed -i \
's/\(^int cpu_[^_]*_exec(\)[^ ][^ ]* \*s);$/\1CPUState *cpu);/' \
$I;
done

Backports commit ea3e9847408131abc840240bd61e892d28459452 from qemu
2018-02-17 15:23:18 -05:00
Peter Crosthwaite 9e23308b66
cpu: Change cpu_exec_init() arg to cpu, not env
The callers (most of them in target-foo/cpu.c) to this function all
have the cpu pointer handy. Just pass it to avoid an ENV_GET_CPU() from
core code (in exec.c).

Backports commit 4bad9e392e788a218967167a38ce2ae7a32a6231 from qemu
2018-02-17 15:23:18 -05:00
Peter Crosthwaite 50b6fa93a8
cpu: Change tcg_cpu_exec() arg to cpu, not env
The sole caller of this function navigates the cpu->env_ptr only for
this function to take it back the cpu pointer straight away. Pass in
cpu pointer instead and grab the env pointer locally in the function.
Removes a core code usage of ENV_GET_CPU().

Backports commit 3d57f7893c90d911d786cb2c622b0926fc808b57 from qemu
2018-02-17 15:23:18 -05:00
Peter Crosthwaite 8200453545
translate-all: Change tb_flush() env argument to cpu
All of the core-code usages of this API have the cpu pointer handy so
pass it in. There are only 3 architecture specific usages (2 of which
are commented out) which can just use ENV_GET_CPU() locally to get the
cpu pointer. The reduces core code usage of the CPU env, which brings
us closer to common-obj'ing these core files.

Backports commit bbd77c180d7ff1b04a7661bb878939b2e1d23798 from qemu
2018-02-17 15:23:18 -05:00
Eduardo Habkost 79c95aa18b
cpu: Initialize breakpoint/watchpoint lists in cpu_common_initfn()
One small step in the simplification of cpu_exec_init().

Backports commit 7c39163e389e6e6e16965606fb5a26abcdb6ad73 from qemu
2018-02-17 15:23:18 -05:00
Eduardo Habkost 4e39fabd4d
cpu: No need to zero-initialize CPUState::numa_node
QOM objects are already zero-filled when instantiated, there's no need
to explicitly set numa_node to 0.

Backports commit 199fc85acd0571902eeefef6ea861b8ba4c8201f from qemu
2018-02-17 15:23:18 -05:00
Daniel P. Berrange 2e97ecfbcd
crypto: move built-in AES implementation into crypto/
To prepare for a generic internal cipher API, move the
built-in AES implementation into the crypto/ directory

Backports commit 6f2945cde60545aae7f31ab9d5ef29531efbc94f from qemu
2018-02-17 15:23:17 -05:00
Daniel P. Berrange 5019f39c15
crypto: introduce new module for computing hash digests
Introduce a new crypto/ directory that will (eventually) contain
all the cryptographic related code. This initially defines a
wrapper for initializing gnutls and for computing hashes with
gnutls. The former ensures that gnutls is guaranteed to be
initialized exactly once in QEMU regardless of CLI args. The
block quorum code currently fails to initialize gnutls so it
only works by luck, if VNC server TLS is not requested. The
hash APIs avoids the need to litter the rest of the code with
preprocessor checks and simplifies callers by allocating the
correct amount of memory for the requested hash.

Backports commit ddbb0d09661f5fce21b335ba9aea8202d189b98e from qemu
2018-02-17 15:23:17 -05:00
Aurelien Jarno ba73fd9162
tcg/s390: fix branch target change during code retranslation
Make sure to not modify the branch target. This ensure that the
branch target is not corrupted during partial retranslation.

Backports commit cd3b29b745b0ff393b2d37317837bc726b8dacc8 from qemu
2018-02-17 15:23:17 -05:00
Paolo Bonzini fa2b872b0b
target-i386: avoid overflow in the tsc-frequency property
The TSC frequency fits comfortably in an int when expressed in kHz,
but it may overflow when converted to Hz. In this case,
tsc-frequency returns a negative value because x86_cpuid_get_tsc_freq
does a 32-bit multiplication before assigning to int64_t.

For simplicity just make tsc_khz a 64-bit value.

Backports commit 06ef227e5158cca6710e6c268d6a7f65a5e2811b from qemu
2018-02-17 15:23:17 -05:00
Peter Crosthwaite 13b919f5c8
cpu-all: complete real host page size API
Currently the "host" page size alignment API is really aligning to both
host and target page sizes. There is the qemu_real_page_size which can
be used for the actual host page size but it's missing a mask and ALIGN
macro as provided for qemu_page_size. Complete the API. This allows
system level code that cares about the host page size to use a
consistent alignment interface without having to un-needingly align to
the target page size. This also reduces system level code dependency
on the cpu specific TARGET_PAGE_SIZE.

Backports commit 4e51361d79289aee2985dfed472f8d87bd53a8df from qemu
2018-02-17 15:23:16 -05:00
Paolo Bonzini 6153671333
target-i386: add support for SMBASE MSR and SMIs
Apart from the MSR, the smi field of struct kvm_vcpu_events has to be
translated into the corresponding CPUX86State fields. Also,
memory transaction flags depend on SMM state, so pull it from struct
kvm_run on every exit from KVM to userspace.

Backports relevant parts of commit fc12d72e10828ca6ff75f2ad432b741f07a10cef from qemu
2018-02-17 15:23:16 -05:00
Paolo Bonzini a6ea34ee0c
exec: skip MMIO regions correctly in cpu_physical_memory_write_rom_internal
Loading the BIOS in the mac99 machine is interesting, because there is a
PROM in the middle of the BIOS region (from 16K to 32K). Before memory
region accesses were clamped, when QEMU was asked to load a BIOS from
0xfff00000 to 0xffffffff it would put even those 16K from the BIOS file
into the region. This is weird because those 16K were not actually
visible between 0xfff04000 and 0xfff07fff. However, it worked.

After clamping was added, this also worked. In this case, the
cpu_physical_memory_write_rom_internal function split the write in
three parts: the first 16K were copied, the PROM area (second 16K) were
ignored, then the rest was copied.

Problems then started with commit 965eb2f (exec: do not clamp accesses
to MMIO regions, 2015-06-17). Clamping accesses is not done for MMIO
regions because they can overlap wildly, and MMIO registers can be
expected to perform full-width accesses based only on their address
(with no respect for adjacent registers that could decode to completely
different MemoryRegions). However, this lack of clamping also applied
to the PROM area! cpu_physical_memory_write_rom_internal thus failed
to copy the third range above, i.e. only copied the first 16K of the BIOS.

In effect, address_space_translate is expecting _something else_ to do
the clamping for MMIO regions if the incoming length is large. This
"something else" is memory_access_size in the case of address_space_rw,
so use the same logic in cpu_physical_memory_write_rom_internal.

Backports commit b242e0e0e2969c044a318e56f7988bbd84de1f63 from qemu
2018-02-17 15:23:16 -05:00
Peter Maydell 2f3f2ae092
Stop including qemu-common.h in memory.h
Including qemu-common.h from other header files is generally a bad
idea, because it means it's very easy to end up with a circular
dependency. For instance, if we wanted to include memory.h from
qom/cpu.h we'd end up with this loop:
memory.h -> qemu-common.h -> cpu.h -> cpu-qom.h -> qom/cpu.h -> memory.h

Remove the include from memory.h. This requires us to fix up a few
other files which were inadvertently getting declarations indirectly
through memory.h.

The biggest change is splitting the fprintf_function typedef out
into its own header so other headers can get at it without having
to include qemu-common.h.

Backports commit fba0a593b2809ecdda68650952cf3d3332ac1990 from qemu
2018-02-17 15:23:16 -05:00
Jan Kiszka b93c24ba31
memory: Add global-locking property to memory regions
This introduces the memory region property "global_locking". It is true
by default. By setting it to false, a device model can request BQL-free
dispatching of region accesses to its r/w handlers. The actual BQL
break-up will be provided in a separate patch.

Backports commit 196ea13104f802c508e57180b2a0d2b3418989a3 from qemu
2018-02-17 15:23:16 -05:00
Peter Crosthwaite 92cd41d78e
memory_mapping: Rework cpu related includes
This makes it more consistent with all other core code files, which
either just rely on qemu-common.h inclusion or precede cpu.h with
qemu-common.h.

cpu-all.h should not be included in addition to cpu.h. Remove it.

Backports commit 94beb661bd90bcb477eed6d3b07aced988c40163 from qemu
2018-02-17 15:23:15 -05:00
Peter Crosthwaite 82a22d8f3a
cpu-defs: Move out TB_JMP defines
These are not Architecture specific in any way so move them out of
cpu-defs.h. tb-hash.h is an appropriate place as a leading user and
their strong relationship to TB hashing and caching.

Backports commit 41da4bd6420afd1209c408974920f63ff9c658e1 from qemu
2018-02-17 15:23:15 -05:00
Peter Crosthwaite 09d23c6604
include/exec: Move tb hash functions out
This is one of very few things in exec-all with a genuine CPU
architecture dependency. Move these hashing helpers to a new
header to trim exec-all.h down to a near architecture-agnostic
header.

The defs are only used by cpu-exec and translate-all which are both
arch-obj's so the new tb-hash.h has no core code usage.

Backports commit e1b89321bafea9fb33d87852fc91fee579d17dfe from qemu
2018-02-17 15:23:15 -05:00
Peter Crosthwaite 860e4184df
include/exec: Move standard exceptions to cpu-all.h
These exception indicies are generic and don't have any reliance on the
per-arch cpu.h defs. Move them to cpu-all.h so they can be used by core
code that does not have access to cpu-defs.h.

Backports commit 9e0dc48c9f05505b53cb28f860456a0648e56ddf from qemu
2018-02-17 15:23:15 -05:00
Artyom Tarasenko e1b179a7d3
qemu-common: add VEC_OR macro
Intel C Compiler version 15.0.3.187 Build 20150407 doesn't support
'|' function for non floating-point simd operands.

Define VEC_OR macro which uses _mm_or_si128 supported
both in icc and gcc on x86 platform.

Backports commit 34664507c7f038842f20a2c787915680b1fabba2 from qemu
2018-02-17 15:23:15 -05:00
Peter Crosthwaite a591219ad6
cpu-defs: Move CPU_TEMP_BUF_NLONGS to tcg
The usages of this define are pure TCG and there is no architecture
specific variation of the value. Localise it to the TCG engine to
remove another architecture agnostic piece from cpu-defs.h.

This follows on from a28177820a868eafda8fab007561cc19f41941f4 where
temp_buf was moved out of the CPU_COMMON obsoleting the need for
the super early definition.

Backports commit 6e0b07306d1793e8402dd218d2e38a7377b5fc27 from qemu
2018-02-17 15:23:15 -05:00
Peter Maydell 5c7389680e
target-arm: Implement YIELD insn to yield in ARM and Thumb translators
Implement the YIELD instruction in the ARM and Thumb translators to
actually yield control back to the top level loop rather than being
a simple no-op. (We already do this for A64.)

Backports commit c87e5a61c2b3024116f52f7e68273f864ff7ab82 from qemu
2018-02-17 15:23:14 -05:00
Peter Maydell 8840d8370d
target-arm: Split DISAS_YIELD from DISAS_WFE
Currently we use DISAS_WFE for both WFE and YIELD instructions.
This is functionally correct because at the moment both of them
are implemented as "yield this CPU back to the top level loop so
another CPU has a chance to run". However it's rather confusing
that YIELD ends up calling HELPER(wfe), and if we ever want to
implement real behaviour for WFE and SEV it's likely to trip us up.

Split out the yield codepath to use DISAS_YIELD and a new
HELPER(yield) function, and have HELPER(wfe) call HELPER(yield).

Backports commit 049e24a191c212d9468db84169197887f2c91586 from qemu
2018-02-17 15:23:14 -05:00
Sergey Fedorov bcf57618a8
target-arm: fix write helper for TLBI ALLE1IS
TLBI ALLE1IS is an operation that does invalidate TLB entries on all PEs
in the same Inner Sharable domain, not just on the current CPU. So we
must use tlbiall_is_write() here.

Backports commit 2a6332d968297266dbabf9d33f959e3a5efdd0f9 from qemu
2018-02-17 15:23:14 -05:00
Laurent Vivier 2efa61c249
m68k: remove useless parameter op_size from gen_lea_indexed()
Backports commit a435612616202c837d62626dbe3e33a4e9a95772 from qemu
2018-02-17 15:23:14 -05:00
Laurent Vivier 18e3e405c4
m68k: remove useless file m68k-qreg.h
Unused since:

commit e1f3808e03f73e7a7fa966afbed2455dd052202e

Backports commit bb337ac978b6def085eabf17830d5cc2a1bce6a8 from qemu
2018-02-17 15:23:13 -05:00
Laurent Vivier 12cb26ab6c
m68k: is_mem is useless
Remove is_mem as it is never tested anymore since:

commit bfa50bc2638d877cf2900712b7503be22e8811cb

Backports commit 805167adcb900fa7b2b114d639c418f5313d0b42 from qemu
2018-02-17 15:23:13 -05:00
Soren Brinkmann fd2ac3058f
target-arm: A64: Print ELR when taking exceptions
When taking an exception print the content of the exception link
register. This is useful especially for synchronous exceptions because
in that case this registers holds the address of the instruction that
generated the exception.

Backports commit b21ab1fc217b4a2b8f2f85d16bdd8510a7817a34 from qemu
2018-02-17 15:23:13 -05:00
Yongbok Kim 97719c5dc0
target-mips: add mips32r6-generic CPU definition
Define a new CPU definition supporting MIPS32 Release 6 ISA and
microMIPS32 Release 6 ISA.

Backports commit 4b3bcd016d83cc75f6a495c1db54b6c77f037adc from qemu
2018-02-17 15:23:13 -05:00
Yongbok Kim 76ab1f17fb
target-mips: microMIPS32 R6 POOL16{A, C} instructions
microMIPS32 Release 6 POOL16A/ POOL16C instructions

Backports commit ed7ce6c0f9d4370826557ce33d652beb88ccb3e6 from qemu
2018-02-17 15:23:13 -05:00
Yongbok Kim 6e6ca4dbd4
target-mips: microMIPS32 R6 Major instructions
Add new microMIPS32 Release 6 Major opcode instructions

Backports commit ab39ee452d74855adec91056812b8e1e5166302c from qemu
2018-02-17 15:23:13 -05:00
Yongbok Kim c2550bc28a
target-mips: microMIPS32 R6 POOL32{I, C} instructions
Add new microMIPS32 Release 6 POOL32I/POOL32C type instructions

Backports commit 3b4a5489447e7ed17cc504572cf729833853e7ab from qemu
2018-02-17 15:23:12 -05:00
Yongbok Kim fe7e49dc20
target-mips: microMIPS32 R6 POOL32F instructions
Add new microMIPS32 Release 6 POOL32F instructions

Backports commit 2a24a7badeb6ad3ba72e7984f299623035d564d6 from qemu
2018-02-17 15:23:12 -05:00
Yongbok Kim f816d6c637
target-mips: microMIPS32 R6 POOL32A{XF} instructions
Add new microMIPS32 Release 6 pool32a/pool32axf instructions.

Backports commit e03320958305a68f2bc6a32c87d7ed48303438f9 from qemu
2018-02-17 15:23:12 -05:00
Yongbok Kim 697b234864
target-mips: microMIPS32 R6 branches and jumps
Add new microMIPS32 Release 6 branch and jump instructions.

Backports commit 65935f070aa710cf340e96ae7ee36d2c1d5c8d15 from qemu
2018-02-17 15:23:12 -05:00
Yongbok Kim de26dc6854
target-mips: add microMIPS32 R6 opcode enum
Add microMIPS32 Release 6 opcode enum.
Remove RI checking for pre-R6 reserved opcode.

Backports commit 3a1f426828cd8ffeec1a4fa8ca6ca3ed4f800edb from qemu
2018-02-17 15:23:12 -05:00
Yongbok Kim 5cca75ca10
target-mips: signal RI for removed instructions in microMIPS R6
Signal a Reserved Instruction exception for removed instruction encoding
in microMIPS Release 6.

Backports commit 9e8f441a7e094c0dc33a1c8f521d9e5bcfc1b4da from qemu
2018-02-17 15:23:11 -05:00
Yongbok Kim acede6f50c
target-mips: raise RI exceptions when FIR.PS = 0
64-bit paired-single (PS) floating point data type is optional in the
pre-Release 6.
It has to raise RI exception when PS type is not implemented. (FIR.PS = 0)
(The PS data type is removed in the Release 6.)
Loongson-2E and Loongson-2F don't have any implementation field in
FCSR0(FIR) but do support PS data format, therefore for these cores RI will
not be signalled regardless of PS bit.

Backports commit e29c962804c4dd3fabd44e703aa87eec555ed910 from qemu
2018-02-17 15:23:11 -05:00
Yongbok Kim 90848d778a
target-mips: rearrange gen_compute_compact_branch
The function will be also used for microMIPS Release 6.

Backports commit 6893f07466b045c5faf314ab9e57ef3b4a6f9e49 from qemu
2018-02-17 15:23:11 -05:00
Yongbok Kim 6e32aa7c3c
target-mips: refactor {D}LSA, {D}ALIGN, {D}BITSWAP
Refactor those instructions in order to reuse them for microMIPS32
Release 6.
Rearrange gen_move_low32().

Backports commit 1f1b4c008e250f870719ed38fbd0bcc14322fc01 from qemu
2018-02-17 15:23:11 -05:00
Yongbok Kim 14abf22311
target-mips: remove an unused argument
Remove an unused argument from decode_micromips32_opc()

Backports commit f60eeb0c5ddd8ceb8ca6b3ba032159027afab67a from qemu
2018-02-17 15:23:11 -05:00
Yongbok Kim 9750bc546f
target-mips: add microMIPS TLBINV, TLBINVF
Add microMIPS TLBINV, TLBINVF

Backports commit e60ec06357470db5a0f25901ca19b6237e6da927 from qemu
2018-02-17 15:23:10 -05:00
Yongbok Kim af0e6e9be3
target-mips: fix {RD, WR}PGPR in microMIPS
rt, rs were swapped

Backports commit 1bf5902de03732d4067c4e90171a1741d6542c45 from qemu
2018-02-17 15:23:10 -05:00
Leon Alrae 80341ab1d8
target-mips: remove identical code in different branch
Backports commit ff334767728011218c62f7476232d260cb5b28e6 from qemu
2018-02-17 15:23:10 -05:00
Markus Armbruster b5841191bc
qerror: Move #include out of qerror.h 2018-02-17 15:23:10 -05:00
Markus Armbruster 15553fc60d
qerror: Finally unused, clean up
Remove it except for two things in qerror.h:

* Two #include to be cleaned up separately to avoid cluttering this
patch.

* The QERR_ macros. Mark as obsolete.

Backports commit 4629ed1e98961bbe678db68ef5f4342ff174a6c3 from qemu
2018-02-17 15:23:10 -05:00
Markus Armbruster 76c16a46c7
qerror: Clean up QERR_ macros to expand into a single string
These macros expand into error class enumeration constant, comma,
string. Unclean. Has been that way since commit 13f59ae.

The error class is always ERROR_CLASS_GENERIC_ERROR since the previous
commit.

* Prepend every use of a QERR_ macro by ERROR_CLASS_GENERIC_ERROR, and
delete it from the QERR_ macro. No change after preprocessing.

* Rewrite error_set(ERROR_CLASS_GENERIC_ERROR, ...) into
error_setg(...). Again, no change after preprocessing.

Backports commit c6bd8c706a799eb0fece99f468aaa22b818036f3 from qemu
2018-02-17 15:23:09 -05:00
Markus Armbruster 349447b324
qerror: Eliminate QERR_DEVICE_NOT_FOUND
Error classes other than ERROR_CLASS_GENERIC_ERROR should not be used
in new code. Hiding them in QERR_ macros makes new uses hard to spot.
Fortunately, there's just one such macro left. Eliminate it with this
coccinelle semantic patch:

@@
expression EP, E;
@@
-error_set(EP, QERR_DEVICE_NOT_FOUND, E)
+error_set(EP, ERROR_CLASS_DEVICE_NOT_FOUND, "Device '%s' not found", E)

Backports commit 75158ebbe259f0bd8bf435e8f4827a43ec89c877 from qemu
2018-02-17 15:23:09 -05:00
Eric Blake c749554a75
qobject: Use 'bool' inside qdict
Now that qbool is fixed, let's fix getting and setting a bool
value to a qdict member to also use C99 bool rather than int.

I audited all callers to ensure that the changed return type
will not cause any changed semantics.

Backports commit 34acbc95229f9f841bde83691a5af949c15e105b from qemu
2018-02-17 15:23:09 -05:00
Eric Blake d544d83348
qobject: Use 'bool' for qbool
We require a C99 compiler, so let's use 'bool' instead of 'int'
when dealing with boolean values. There are few enough clients
to fix them all in one pass.

Backports commit fc48ffc39ed1060856475e4320d5896f26c945e8 from qemu
2018-02-17 15:23:09 -05:00
Greg Ungerer 1f6f6b2863
m68k: fix usp processing on interrupt entry and exception exit
The action to potentially switch sp register is not occurring at the correct
point in the interrupt entry or exception exit sequences.

For the interrupt entry case the sp on entry is used to create the stack
exception frame - but this may well be the user stack pointer, since we
haven't done the switch yet. Re-order the flow to switch the sp regs then
use the current sp to create the exception frame.

For the return from exception case the code is unwinding the sp after
switching sp registers. But it should always unwind the supervisor sp
first, then carry out any required sp switch.

Note that these problems don't effect operation unless the user sp bit is
set in the CACR register. Only a single sp is used in the default power up
state. Previously Linux only used this single sp mode. But modern versions
of Linux use the user sp mode now, so we need correct behavior for Linux
to work.

Backports commit 0c8ff723bd29e5c8b2ca989f857ae5c37ec49c4e from qemu
2018-02-17 15:23:09 -05:00
Greg Ungerer 0a0383e2b5
m68k: implement move to/from usp register instruction
Fill out the code support for the move to/from usp instructions. They are
being decoded, but there is no code to support there actions. So add it.

Current versions of Linux running on the ColdFire 5208 use these instructions.

Backports commit 2a8327e8a8288e301a2f01bc3ca2d465a3a4ca78 from qemu
2018-02-17 15:23:09 -05:00
Peter Crosthwaite 63e5f57bb2
target-arm: Add support for Cortex-R5
Introduce a CPU model for the Cortex R5 processor. ARMv7 with MPU,
and both thumb and ARM div instructions.

Also implement dummy ATCM and BTCM. These CPs are defined for R5 but
don't have a lot of meaning in QEMU yet. Raz them so the guest can
proceed if they are read. The TCM registers will return a size of 0,
indicating no TCM.

Backports commit d6a6b13ea1dfeb25c43a648e94cfe4395906f1da from qemu
2018-02-17 15:23:08 -05:00
Peter Crosthwaite 500d37e9b3
target-arm: Implement PMSAv7 MPU
Unified MPU only. Uses ARM architecture major revision to switch
between PMSAv5 and v7 when ARM_FEATURE_MPU is set. PMSA v6 remains
unsupported and is asserted against.

Backports commit f6bda88ff839e2adefe4959b7def420b90703855 from qemu
2018-02-17 15:23:08 -05:00
Peter Crosthwaite 65f70d7a08
target-arm: Add registers for PMSAv7
Define the arm CP registers for PMSAv7 and their accessor functions.
RGNR serves as a shared index that indexes into arrays storing the
DRBAR, DRSR and DRACR registers. DRBAR and friends have to be VMSDd
separately from the CP interface using a new PMSA specific VMSD
subsection.

Backports commit 6cb0b013a1fa421cdfb83257cd33f855cc90649a from qemu
2018-02-17 15:22:43 -05:00
Peter Crosthwaite 7d933a6ba9
target-arm/helper.c: define MPUIR register
Define the MPUIR register for MPU supporting ARMv6 and onwards.
Currently we only support unified MPU.

The size of the unified MPU is defined via the number of "dregions".
So just a single config is added to specify this size. (When split MPU
is implemented we will add an extra iregions config).

Backports commit 3281af8114c6b8ead02f08b58e3c36895c1ea047 from qemu
2018-02-17 15:22:43 -05:00
Sergey Fedorov 07ead14756
target-arm: Do not reset sysregs marked as ALIAS
cp_reg_reset() is called from g_hash_table_foreach() which does not
define a specific ordering of the hash table iteration. Thus doing reset
for registers marked as ALIAS would give an ambiguous result when
resetvalue is different for original and alias registers. Exit
cp_reg_reset() early when passed an alias register. Then clean up alias
register definitions from needless resetvalue and resetfn.

In particular, this fixes a bug in the handling of the PMCR register,
which had different resetvalues for its 32 and 64-bit views.

Backports commit b061a82b8afcc45ce09d770d9c0acdf429401054 from qemu
2018-02-17 15:22:43 -05:00
Aurelio C. Remonda 7ca21d4ab4
target-arm: Add the Cortex-M4 CPU
This patch adds the Cortex-M4 CPU. The M4 is basically the same as
the M3, the main differences being the DSP instructions and an
optional FPU. Only no-FPU cortex-M4 is implemented here, cortex-M4F
is not because the core target-arm code doesn't support the M-profile
FPU model yet.

Backports commit ba890a9b2509a0087bb7eafddae02ea5ecbb7bb4 from qemu
2018-02-17 15:22:43 -05:00
Aurelien Jarno 20c2ed80a2
translate-all: fix watchpoints if retranslation not possible
The tb_check_watchpoint function currently assumes that all memory
access is done either directly through the TCG code or through an
helper which knows its return address. This is obviously wrong as the
helpers use cpu_ldxx/stxx_data functions to access the memory.

Instead of aborting in that case, don't try to retranslate the code, but
assume that the CPU state (and especially the program counter) has been
saved before calling the helper. Then invalidate the TB based on this
address.

Backports commit 8d302e76755b8157373073d7107e31b0b13f80c1 from qemu
2018-02-17 15:22:43 -05:00
Aurelien Jarno 93df793d4d
softmmu: provide tlb_vaddr_to_host function for user mode
To avoid to many #ifdef in target code, provide a tlb_vaddr_to_host for
both user and softmmu modes. In the first case the function always
succeed and just call the g2h function.

Backports commit 2e83c496261c799b0fe6b8e18ac80cdc0a5c97ce from qemu
2018-02-17 15:22:43 -05:00
Peter Maydell 13db196792
target-arm: Correct "preferred return address" for cpreg access exceptions
The architecture defines that when taking an exception trying to
access a coprocessor register, the "preferred return address" for
the exception is the address of the instruction that caused the
exception. Correct an off-by-4 error which meant we were returning
the address after the instruction for traps which happened because
of a failure of a runtime access-check function on an AArch32
register. (Traps caused by translate-time checkable permissions
failures had the correct address, as did traps on AArch64 registers.)

This fixes https://bugs.launchpad.net/qemu/+bug/1463338

Backports commit 3977ee5d7a9f2e3664dd8b233f3224694e23b62b from qemu
2018-02-17 15:22:42 -05:00
Peter Crosthwaite c1554dbd06
arm: helper: rename get_phys_addr_mpu
This get_phys_addr is really for pmsav5. Rename it accordingly.

Backports commit 13689d43646482f7305282de1bdd662c0d2b8b77 from qemu
2018-02-17 15:22:42 -05:00
Peter Crosthwaite 0299851aa0
arm: Add has-mpu property
For processors that support MPUs, add a property to de-feature it. This
is similar to the implementation of the EL3 feature.

The processor definition in init sets ARM_FEATURE_MPU if it can support
an MPU. post_init exposes the property, defaulting to true. If cleared
by the instantiator, ARM_FEATURE_MPU is then removed at realize time.

This is to support R profile processors that may or may-not have an MPU
configured.

Backports commit 8f325f568fbd0158cd413e7d637573ba90b3eaab from qemu
2018-02-17 15:22:42 -05:00
Peter Crosthwaite 6f843a5484
arm: Implement uniprocessor with MP config
Add a boolean for indicating uniprocessors with MP extensions. This
drives the U bit in MPIDR. Prepares support for Cortex-R5.

Backports commit a8e81b319d1ae1224cc7059877dcdf04a5aad59d from qemu
2018-02-17 15:22:42 -05:00
Peter Crosthwaite e8499a8f9b
arm: Refactor get_phys_addr FSR return mechanism
Currently, the return code for get_phys_addr is overloaded for both
success/fail and FSR value return. This doesn't handle the case where
there is an error with a 0 FSR. This case exists in PMSAv7.

So rework get_phys_addr and friends to return a success/failure boolean
return code and populate the FSR via a caller provided uint32_t
pointer.

Backports commit b7cc4e82f04a1c5b218a657f677a2fdd1e1c2889 from qemu
2018-02-17 15:22:42 -05:00
Peter Crosthwaite 4c204e6f3f
arm: helper: Factor out CP regs common to [pv]msa
V6+ PMSA and VMSA share some common registers that are currently
in the VMSA definition block. Split them out into a new def that can
be shared to PMSA.

Backports commit 8e5d75c950a1241f6e1243c37f28cd58f68fedc9 from qemu
2018-02-17 15:22:31 -05:00
Peter Crosthwaite 62ddaba69f
arm: Don't add v7mp registers in MPU systems
These registers are VMSA specific so they should be conditional on
VMSA (i.e. !MPU).

Backports commit 5e5cf9e35f25f9f932a6ce25107c11b67b426a43 from qemu
2018-02-13 14:37:22 -05:00
Peter Crosthwaite 70fae13253
arm: Do not define TLBTR in PMSA systems
If doing a PMSA (MPU) system do not define the VMSA specific TLBTR CP.
The def is done separately from VMSA registers group as it is affected
by both the OMAP/STRONGARM RW errata and the MIDR backgrounding.

Backports commit 8085ce63c5967d200f1241b6c0a189371993c5df from qemu
2018-02-13 14:35:38 -05:00
Pavel Fedin caed2f123d
target-arm: Use the kernel's idea of MPIDR if we're using KVM
When we're using KVM, the kernel's internal idea of the MPIDR
affinity fields must match the values we tell it for the guest
vcpu cluster configuration in the device tree. Since at the moment
the kernel doesn't support letting userspace tell it the correct
affinity fields to use, we must read the kernel's view and
reflect that back in the device tree.

Backports commit eb5e1d3c85dffe677da2550d211f9304a7d5ba3b from qemu
2018-02-13 14:32:46 -05:00
Sergey Fedorov 614ecb2bf2
target-arm: add AArch32 MIDR aliases in ARMv8
According to ARMv8 ARM, there are additional aliases to MIDR system register in
AArch32 state. So add them to the list.

Backports commit ac00c79ff6635ae9fd732ff357ada0d05e795500 from qemu
2018-02-13 14:28:11 -05:00
Sergey Fedorov 113cda90c3
target-arm: Fix REVIDR reset value
According to ARM Cortex-A53/A57 TRM, REVIDR reset value should be zero. So let
REVIDR reset value be specified by CPU model and correct it for Cortex-A53/A57.

Backports commit 13b72b2b9aa7ab7ee129e38e9587acd6a1b9a932 from qemu
2018-02-13 14:24:08 -05:00
Alex Bennée f6d104b33a
target-arm/cpu.h: remove pending_exception
This isn't used by any of the code. In fact it looks like it was never
used as it came in with ARMv7 support.

Backports commit a79e0218e0ae27c9cdd2648bd46e5a916c903cc2 from qemu
2018-02-13 14:24:08 -05:00
Sergey Fedorov 7f53358ec1
target-arm: use extended address bits from supersection short descriptor
Since ARMv7 with LPAE support, a supersection short translation table
descriptor has had extended base address fields which hold bits 39:32 of
translated address. These fields are IMPDEF in ARMv6 and ARMv7 without
LPAE support.

Backports commit 4e42a6ca37e39e56725518851f4388e46bd91129 from qemu
2018-02-13 14:24:08 -05:00
Peter Maydell 84c75286f5
target-arm: Handle "extended small page" descriptors correctly
The old ARMv5-style page table format includes a kind of second level
descriptor named the "extended small page" format, whose primary purpose
is to allow specification of the TEX memory attribute bits on a 4K page.
This exists on ARMv6 and also (as an implementation extension) on XScale
CPUs; it's UNPREDICTABLE on v5.

We were mishandling this in two ways:
(1) we weren't implementing it for v6 (probably never noticed because
Linux will use the new-style v6 page table format there)
(2) we were not correctly setting the page_size, which is 4K, not 1K

The latter bug went unnoticed for years because the only thing which
the page_size affects is which TLB entries get flushed when the guest
does a TLB invalidate on an address in the page, and prior to commit
2f0d8631b7 we were doing a full TLB flush very frequently due to Linux's
habit of writing the SCTLR pointlessly a lot.

(We can assume that after commit 2f0d8631b7 the bug went unnoticed
for a year because nobody's actually using the Zaurus/XScale emulation...)

Report the correct page size for these descriptors, and permit them
on ARMv6 CPUs. This fixes a problem where a kernel image for Zaurus
can boot the kernel OK but gets random segfaults when it tries to
run userspace programs.

Backports commit fc1891c74ae122a9dc7854f38bae7db03cd911e6 from qemu
2018-02-13 14:19:53 -05:00
Leon Alrae 3d72ec65bd
target-mips: enable XPA and LPA features
Enable XPA in MIPS32R5-generic and LPA in MIPS64R6-generic.

Backports commit 6773f9b687e0a8ab4b638ef88d075fb233fb7669 from qemu
2018-02-13 14:14:59 -05:00
Leon Alrae aff700ae6d
target-mips: remove misleading comments in translate_init.c
PABITS are not hardcoded to 36 bits and we do not model 59 PABITS (which is
the architectural limit) in QEMU.

Backports commit 28b027d5b63c7550c7390041d6dd50948c8f55b8 from qemu
2018-02-13 14:05:25 -05:00
Leon Alrae 8743ec8b6d
target-mips: add MTHC0 and MFHC0 instructions
Implement MTHC0 and MFHC0 instructions. In MIPS32 they are used to access
upper word of extended to 64-bits CP0 registers.

In MIPS64, when CP0 destination register specified is the EntryLo0 or
EntryLo1, bits 1:0 of the GPR appear at bits 31:30 of EntryLo0 or
EntryLo1. This is to compensate for RI and XI, which were shifted to bits
63:62 by MTC0 to EntryLo0 or EntryLo1. Therefore creating separate
functions for EntryLo0 and EntryLo1.

Backports commit 5204ea79ea739b557f47fc4db96c94edcb33a5d6 from qemu
2018-02-13 14:03:59 -05:00
Leon Alrae 59865351e0
target-mips: add CP0.PageGrain.ELPA support
CP0.PageGrain.ELPA enables support for large physical addresses. This field
is encoded as follows:
0: Large physical address support is disabled.
1: Large physical address support is enabled.

If this bit is a 1, the following changes occur to coprocessor 0 registers:
- The PFNX field of the EntryLo0 and EntryLo1 registers is writable and
concatenated with the PFN field to form the full page frame number.
- Access to optional COP0 registers with PA extension, LLAddr, TagLo is
defined.

P5600 can operate in 32-bit or 40-bit Physical Address Mode. Therefore if
XPA is disabled (CP0.PageGrain.ELPA = 0) then assume 32-bit Address Mode.
In MIPS64 assume 36 as default PABITS (when CP0.PageGrain.ELPA = 0).

env->PABITS value is constant and indicates maximum PABITS available on
a core, whereas env->PAMask is calculated from env->PABITS and is also
affected by CP0.PageGrain.ELPA.

Backports commit e117f52636d04502fab28bd3abe93347c29f39a5 from qemu
2018-02-13 13:55:53 -05:00
Leon Alrae a13d401fe8
target-mips: support Page Frame Number Extension field
Update tlb->PFN to contain PFN concatenated with PFNX. PFNX is 0 if large
physical address is not supported.

Backports commit cd0d45c40133ef8b409aede5ad8a99aeaf6a70fe from qemu
2018-02-13 13:49:55 -05:00
Leon Alrae 95ed79d9c2
target-mips: extend selected CP0 registers to 64-bits in MIPS32
Extend EntryLo0, EntryLo1, LLAddr and TagLo from 32 to 64 bits in MIPS32.

Introduce gen_move_low32() function which moves low 32 bits from 64-bit
temp to GPR; it sign extends 32-bit value on MIPS64 and truncates on
MIPS32.

Backports commit 284b731a6ae47b9ebabb9613e753c4d83cf75dd3 from qemu
2018-02-13 13:45:29 -05:00
Leon Alrae 907bb26e5f
target-mips: correct MFC0 for CP0.EntryLo in MIPS64
CP0.EntryLo bits 31:30 have to be cleared.

Backports commit b435f3f3d174721382b55bbd0c785ec50c1796a9 from qemu
2018-02-13 13:36:01 -05:00
Leon Alrae 57f57a9de4
target-mips: add ERETNC instruction and Config5.LLB bit
ERETNC is identical to ERET except that an ERETNC will not clear the LLbit
that is set by execution of an LL instruction, and thus when placed between
an LL and SC sequence, will never cause the SC to fail.

Presence of ERETNC is denoted by the Config5.LLB.

Backports commit ce9782f40ac16660ea9437bfaa2c9c34d5ed8110 from qemu
2018-02-13 13:33:37 -05:00
Yongbok Kim 922d30c448
target-mips: Misaligned memory accesses for MSA
MIPS SIMD Architecture vector loads and stores require misalignment support.
MSA Memory access should work as an atomic operation. Therefore, it has to
check validity of all addresses for a vector store access if it is spanning
into two pages.

Separating helper functions for each data format as format is known in
translation.
To use mmu_idx from cpu_mmu_index() instead of calculating it from hflag.
Removing save_cpu_state() call in translation because it is able to use
cpu_restore_state() on fault as GETRA() is passed.

Backports commit adc370a48fd26b92188fa4848dfb088578b1936c from qemu
2018-02-13 13:27:31 -05:00
Yongbok Kim 6d0766f246
target-mips: Misaligned memory accesses for R6
Release 6 requires misaligned memory access support for all ordinary memory
access instructions (for example, LW/SW, LWC1/SWC1).
However misaligned support is not provided for certain special memory accesses
such as atomics (for example, LL/SC).

Backports commit be3a8c53b4f18bcc51a462d977cc61a0f46ebb1c from qemu
2018-02-13 13:11:39 -05:00
Leon Alrae c54458b638
target-mips: add Config5.FRE support allowing Status.FR=0 emulation
This relatively small architectural feature adds the following:

FIR.FREP: Read-only. If FREP=1, then Config5.FRE and Config5.UFE are
available.

Config5.FRE: When enabled all single-precision FP arithmetic instructions,
LWC1/LWXC1/MTC1, SWC1/SWXC1/MFC1 cause a Reserved Instructions
exception.

Config5.UFE: Allows user to write/read Config5.FRE using CTC1/CFC1
instructions.

Enable the feature in MIPS64R6-generic CPU.

Backports commit 7c979afd11b09a16634699dd6344e3ba10c9677e from qemu
2018-02-13 13:05:22 -05:00
Leon Alrae 428ffed744
target-mips: move group of functions above gen_load_fpr32()
Move the "Tests" group of functions so that gen_load_fpr32() and
gen_store_fpr32() can use generate_exception().

Backports commit eab9944c7801525737626fa45cddaf00932dd2c8 from qemu
2018-02-13 12:45:27 -05:00
Paolo Bonzini 91503663e2
target-i386: create a separate AddressSpace for each CPU
Different CPUs can be in SMM or not at the same time, thus they
will see different things where the chipset places SMRAM.

Backports commit 2001d0cd6d55e5efa9956fa8ff8b89034d6a4329 from qemu
2018-02-13 12:36:26 -05:00
Paolo Bonzini fa57438734
target-i386: wake up processors that receive an SMI
An SMI should definitely wake up a processor in halted state!
This lets OVMF boot with SMM on multiprocessor systems, although
it halts very soon after that with a "CpuIndex != BspIndex"
assertion failure.

Backports commit a9bad65d2c1f61af74ce2ff43238d4b20bf81c3a from qemu
2018-02-13 12:32:24 -05:00
Paolo Bonzini d4621935bb
target-i386: set G=1 in SMM big real mode selectors
Because the limit field's bits 31:20 is 1, G should be 1.
VMX actually enforces this, let's do it for completeness
in QEMU as well.

Backports commit b4854f1384176d897747de236f426d020668fa3c from qemu
2018-02-13 12:31:18 -05:00
Paolo Bonzini 1fed54da89
target-i386: mask NMIs on entry to SMM
QEMU is not blocking NMIs on entry to SMM. Implementing this has to
cover a few corner cases, because:

- NMIs can then be enabled by an IRET instruction and there
is no mechanism to _set_ the "NMIs masked" flag on exit from SMM:
"A special case can occur if an SMI handler nests inside an NMI handler
and then another NMI occurs. [...] When the processor enters SMM while
executing an NMI handler, the processor saves the SMRAM state save map
but does not save the attribute to keep NMI interrupts disabled.

- However, there is some hidden state, because "If NMIs were blocked
before the SMI occurred [and no IRET is executed while in SMM], they
are blocked after execution of RSM." This is represented by the new
HF2_SMM_INSIDE_NMI_MASK bit. If it is zero, NMIs are _unblocked_
on exit from RSM.

Backports commit 9982f74bad70479939491b69522da047a3be5a0d from qemu
2018-02-13 12:29:31 -05:00
Paolo Bonzini e57e92feca
target-i386: Use correct memory attributes for ioport accesses
In order to do this, stop using the cpu_in*/out* helpers, and instead
access address_space_io directly.

cpu_in* and cpu_out* remain for usage in the monitor, in qtest, and
in Xen.

Backports commit 3f7d84648607cc0fcb3812bb4b88978e2a7aa24f from qemu
2018-02-13 12:27:43 -05:00
Lioncash 25a58231fc
target-i386: Use correct memory attributes for memory accesses
These include page table walks, SVM accesses and SMM state save accesses.

The bulk of the patch is obtained with

sed -i 's/\(\<[a-z_]*_phys\(_notdirty\)\?\>(cs\)->as,/x86_\1,/'

Backports commit b216aa6c0fcbaa8ff4128969c14594896a5485a4 from qemu
2018-02-13 11:54:12 -05:00
Paolo Bonzini dc80b0893f
target-i386: introduce cpu_get_mem_attrs
Backports commit f794aa4a2fd772a3ec413c4e478cc23857cfee98 from qemu
2018-02-13 11:33:39 -05:00
Paolo Bonzini 88d1506e6a
memory: use mr->ram_addr in "is this RAM?" assertions
mr->terminates alone doesn't guarantee that we are looking at a RAM region.
mr->ram_addr also has to be checked, in order to distinguish RAM and I/O
regions.

So, do the following:

1) add a new define RAM_ADDR_INVALID, and test it in the assertions
instead of mr->terminates

2) IOMMU regions were not setting mr->ram_addr to a bogus value, initialize
it in the instance_init function so that the new assertions would fire
for IOMMU regions as well.

Backports commit ec05ec26f940564b1e07bf88857035ec27e21dd8 from qemu
2018-02-13 11:31:02 -05:00
Stefan Hajnoczi fc7b95d06a
memory: replace cpu_physical_memory_reset_dirty() with test-and-clear
The cpu_physical_memory_reset_dirty() function is sometimes used
together with cpu_physical_memory_get_dirty(). This is not atomic since
two separate accesses to the dirty memory bitmap are made.

Turn cpu_physical_memory_reset_dirty() and
cpu_physical_memory_clear_dirty_range_type() into the atomic
cpu_physical_memory_test_and_clear_dirty().

Backports commit 03eebc9e3246b9b3f5925aa41f7dfd7c1e467875 from qemu
2018-02-13 11:25:45 -05:00
Stefan Hajnoczi 18ccd4b5be
memory: use atomic ops for setting dirty memory bits
Use set_bit_atomic() and bitmap_set_atomic() so that multiple threads
can dirty memory without race conditions.

Backports commit d114875b9a1c21162f69a12d72f69a22e7bab376 from qemu
2018-02-13 11:07:48 -05:00
Paolo Bonzini 6d509f7333
exec: only check relevant bitmaps for cleanliness
Most of the time, not all bitmaps have to be marked as dirty;
do not do anything if the interesting ones are already dirty.
Previously, any clean bitmap would have cause all the bitmaps to be
marked dirty.

In fact, unless running TCG most of the time bitmap operations need
not be done at all, because memory_region_is_logging returns zero.
In this case, skip the call to cpu_physical_memory_range_includes_clean
altogether as well.

With this patch, cpu_physical_memory_set_dirty_range is called
unconditionally, so there need not be anymore a separate call to
xen_modified_memory.

Backports commit e87f7778b64d4a6a78e16c288c7fdc6c15317d5f from qemu
2018-02-13 11:03:26 -05:00
Paolo Bonzini 6bbfcf65e8
memory: do not touch code dirty bitmap unless TCG is enabled
cpu_physical_memory_set_dirty_lebitmap unconditionally syncs the
DIRTY_MEMORY_CODE bitmap. This however is unused unless TCG is
enabled.

Backports commit 9460dee4b2258e3990906fb34099481c8334c267 from qemu
2018-02-13 10:48:14 -05:00
Stefan Hajnoczi 6172e3dc29
bitmap: add atomic test and clear
The new bitmap_test_and_clear_atomic() function clears a range and
returns whether or not the bits were set.

Backports commit 36546e5b803f6e363906607307f27c489441fd15 from qemu
2018-02-13 10:02:12 -05:00
Stefan Hajnoczi 7ff5f05c82
bitmap: add atomic set functions
Use atomic_or() for atomic bitmaps where several threads may set bits at
the same time. This avoids the race condition between threads loading
an element, bitwise ORing, and then storing the element.

When setting all bits in a word we can avoid atomic ops and instead just
use an smp_mb() at the end.

Most bitmap users don't need atomicity so introduce new functions.

Backports commit 9f02cfc84b85929947b32fe1674fbc6a429f332a from qemu
2018-02-13 09:59:30 -05:00
Paolo Bonzini 1b1f82cef7
exec: invert return value of cpu_physical_memory_get_clean, rename
While it is obvious that cpu_physical_memory_get_dirty returns true even if
a single page is dirty, the same is not true for cpu_physical_memory_get_clean;
one would expect that it returns true only if all the pages are clean, but
it actually looks for even one clean page. (By contrast, the caller of that
function, cpu_physical_memory_range_includes_clean, has a good name).

To clarify, rename the function to cpu_physical_memory_all_dirty and return
true if _all_ the pages are dirty. This is the opposite of the previous
meaning, because "all are 1" is the same as "not (any is 0)", so we have to
modify cpu_physical_memory_range_includes_clean as well

Backports commit 72b47e79cef36ed6ffc718f10e21001d7ec2a66f from qemu
2018-02-13 09:54:12 -05:00
Paolo Bonzini c333585a4d
translate-all: make less of tb_invalidate_phys_page_range depend on is_cpu_write_access
is_cpu_write_access is only set if tb_invalidate_phys_page_range is called
from tb_invalidate_phys_page_fast, and hence from notdirty_mem_write.
However:

- the code bitmap can be built directly in tb_invalidate_phys_page_fast
(unconditionally, since is_cpu_write_access would always be passed as 1);

- the virtual address is not needed to mark the page as "not containing
code" (dirty code bitmap = 1), so we can also remove that use of
is_cpu_write_access. For calls of tb_invalidate_phys_page_range
that do not come from notdirty_mem_write, the next call to
notdirty_mem_write will notice that the page does not contain code
anymore, and will fix up the TLB entry.

The parameter needs to remain in order to guard accesses to cpu->mem_io_pc.

Backports commit fc377bcf617a48233a99a9fe0a26247c38b5cb76 from qemu
2018-02-13 09:18:49 -05:00
Lioncash 98e2ffba3a
unicorn_arm: m68k/translate: Build fixes 2018-02-13 09:15:46 -05:00
Paolo Bonzini f578c89e8b
cputlb: remove useless arguments to tlb_unprotect_code_phys, rename
These days modification of the TLB is done in notdirty_mem_write,
so the virtual address and env pointer as unnecessary.

The new name of the function, tlb_unprotect_code, is consistent with
tlb_protect_code.

Backports commit 9564f52da7eb061326956ed9a468935e3352512d from qemu
2018-02-13 09:07:41 -05:00
Paolo Bonzini b5c9645a0f
translate-all: remove unnecessary argument to tb_invalidate_phys_range
The is_cpu_write_access argument is always 0, remove it.

Backports commit 358653391b0c0beaa0e3f9e28304e1918cd223b3 from qemu
2018-02-13 09:04:51 -05:00
Lioncash 72c8e4d264
exec: move functions to translate-all.h
Remove them from the sundry exec-all.h header, since they are only used by
the TCG runtime in exec.c and user-exec.c.

Backports commit 1652b974766401743879d78f796f44b8929b0787 from qemu
2018-02-13 09:01:45 -05:00
Paolo Bonzini c82ea2b20b
memory: track DIRTY_MEMORY_CODE in mr->dirty_log_mask
DIRTY_MEMORY_CODE is only needed for TCG. By adding it directly to
mr->dirty_log_mask, we avoid testing for TCG everywhere a region is
checked for the enabled/disabled state of dirty logging.

Backports commit 677e7805cf95f3b2bca8baf0888d1ebed7f0c606 from qemu
2018-02-13 08:55:42 -05:00
Paolo Bonzini e3d1cef8fb
memory: prepare for multiple bits in the dirty log mask
When the dirty log mask will also cover other bits than DIRTY_MEMORY_VGA,
some listeners may be interested in the overall zero/non-zero value of
the dirty log mask; others may be interested in the value of single bits.

For this reason, always call log_start/log_stop if bits have respectively
appeared or disappeared, and pass the old and new values of the dirty log
mask so that listeners can distinguish the kinds of change.

For example, KVM checks if dirty logging used to be completely disabled
(in log_start) or is now completely disabled (in log_stop). On the
other hand, Xen has to check manually if DIRTY_MEMORY_VGA changed,
since that is the only bit it cares about.

Backports commit b2dfd71c4843a762f2befe702adb249cf55baf66 from qemu
2018-02-13 08:52:23 -05:00
Paolo Bonzini 1551573acc
memory: differentiate memory_region_is_logging and memory_region_get_dirty_log_mask
For now memory regions only track DIRTY_MEMORY_VGA individually, but
this will change soon. To support this, split memory_region_is_logging
in two functions: one that returns a given bit from dirty_log_mask,
and one that returns the entire mask. memory_region_is_logging gets an
extra parameter so that the compiler flags misuse.

While VGA-specific users (including the Xen listener!) will want to keep
checking that bit, KVM and vhost check for "any bit except migration"
(because migration is handled via the global start/stop listener
callbacks).

Backports commit 2d1a35bef0ed96b3f23535e459c552414ccdbafd from qemu
2018-02-13 08:41:44 -05:00
Paolo Bonzini 9847ba46d6
exec: optimize phys_page_set_level
phys_page_set_level is writing zeroes to a struct that has just been
filled in by phys_map_node_alloc. Instead, tell phys_map_node_alloc
whether to fill in the page "as a leaf" or "as a non-leaf".

memcpy is faster than struct assignment, which copies each bitfield
individually. A compiler bug (https://gcc.gnu.org/PR66391), and
small memcpys like this one are special-cased anyway, and optimized
to a register move, so just use the memcpy.

This cuts the cost of phys_page_set_level from 25% to 5% when
booting qboot.

Backports commit db94604b20278c1dc227a04e4c564d80230e6c3f from qemu
2018-02-13 08:38:24 -05:00
Paolo Bonzini 96e7e32972
softmmu: support up to 12 MMU modes
At 8k per TLB (for 64-bit host or target), 8 or more modes
make the TLBs bigger than 64k, and some RISC TCG backends do
not like that. On the affected hosts, cut the TLB size in
half---there is still a measurable speedup on PPC with the
next patch.

Backports commit 1de29aef17a7d70dbc04a7fe51e18942e3ebe313 from qemu
2018-02-13 08:34:52 -05:00
Paolo Bonzini b34c233c2f
tcg: add TCG_TARGET_TLB_DISPLACEMENT_BITS
This will be used to size the TLB when more than 8 MMU modes are
used by the target. Limitations come from the limited size of
the immediate fields (which sometimes, as in the case of Aarch64,
extend to instructions that shift the immediate).

Backports commit 006f8638c62bca2b0caf609485f47fa5e14d8a3c from qemu
2018-02-13 08:28:29 -05:00
Paolo Bonzini e37ed23e7f
translate-all: delete prototype for non-existent function
Missed in commit 3a808cc40

Backports commit b6b099541d6cf3c50b0fb5af916fff0db6508805 from qemu
2018-02-13 08:26:08 -05:00
Eduardo Habkost 79df79434d
target-i386: Fix signedness of MSR_IA32_APICBASE_BASE
Existing definition triggers the following when using clang
-fsanitize=undefined:

hw/intc/apic_common.c:314:55: runtime error: left shift of 1048575 by 12
places cannot be represented in type 'int'

Fix it so we won't try to shift a 1 to the sign bit of a signed integer.

Backports commit 458cf469f4a1cb520b07092f5537c5a6d2389d23 from qemu
2018-02-13 08:17:18 -05:00
Peter Maydell ed58b3afac
target-arm: Remove v8_ prefix from names of non-v8-specific cpreg arrays
The ARMCPRegInfo arrays v8_el3_no_el2_cp_reginfo and v8_el2_cp_reginfo
are actually used on non-v8 CPUs as well. Remove the incorrect v8_
prefix from their names.

Backports commit 4771cd01daaccb2a8929fa04c88c608e378cf814 from qemu
2018-02-13 08:16:23 -05:00
Edgar E. Iglesias 8a8e174981
target-arm: Add TLBI_VAE2{IS}
Backports commit 8742d49d6f2278d353a1623dfa8a5e237dbfd906 from qemu
2018-02-13 08:13:37 -05:00