summaryrefslogtreecommitdiffstats
path: root/target
Commit message (Collapse)AuthorAgeFilesLines
* Merge remote-tracking branch 'remotes/cohuck/tags/s390x-20170421' into stagingPeter Maydell2017-04-212-10/+10
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The first batch of s390x changes for 2.10: - the new compat machine - several cleanups and optimizations - introspection for css ids # gpg: Signature made Fri 21 Apr 2017 08:36:25 BST # gpg: using RSA key 0xDECF6B93C6F02FAF # gpg: Good signature from "Cornelia Huck <huckc@linux.vnet.ibm.com>" # gpg: aka "Cornelia Huck <cornelia.huck@de.ibm.com>" # Primary key fingerprint: C3D0 D66D C362 4FF6 A8C0 18CE DECF 6B93 C6F0 2FAF * remotes/cohuck/tags/s390x-20170421: s390x: Drop useless casts s390x: register I/O adapters per ISC during init s390x/flic: cache flic in s390_get_flic s390x: initialize flic before I/O subsystems s390x: use enum for adapter type and standardize its naming s390x/css: consolidate the devno property for ccw devices s390x/css: provide introspection for virtual subchannel and device busid s390x/css: introduce read-only property type for device ids s390x/pci: make printf always compile in debug output s390x/kvm: make printf always compile in debug output s390x: introduce 2.10 compat machine Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * s390x: Drop useless castsEric Blake2017-04-211-2/+2
| | | | | | | | | | | | | | | | | | | | | | An upcoming Coccinelle cleanup script wanted to reformat the casts present in this file - but on closer look, we don't need the casts at all because C automatically converts void* to any other pointer. Signed-off-by: Eric Blake <eblake@redhat.com> Message-Id: <20170405194741.18956-4-eblake@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
| * s390x/kvm: make printf always compile in debug outputDanil Antonov2017-04-211-8/+8
| | | | | | | | | | | | | | | | | | | | | | Wrapped printf calls inside debug macros (DPRINTF) in `if` statement. This will ensure that printf function will always compile even if debug output is turned off and, in turn, will prevent bitrot of the format strings. Signed-off-by: Danil Antonov <g.danil.anto@gmail.com> Message-Id: <CA+KKJYAhsuTodm3s2rK65hR=-Xi5+Z7Q+M2nJYZQf2wa44HfOg@mail.gmail.com> Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
* | Merge remote-tracking branch 'remotes/armbru/tags/pull-qdev-2017-04-21' into ↵Peter Maydell2017-04-211-10/+0Star
|\ \ | |/ |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | staging qdev patches for 2017-04-21 # gpg: Signature made Fri 21 Apr 2017 06:37:19 BST # gpg: using RSA key 0x3870B400EB918653 # gpg: Good signature from "Markus Armbruster <armbru@redhat.com>" # gpg: aka "Markus Armbruster <armbru@pond.sub.org>" # Primary key fingerprint: 354B C8B3 D7EB 2A6B 6867 4E5F 3870 B400 EB91 8653 * remotes/armbru/tags/pull-qdev-2017-04-21: qdev: remove cannot_destroy_with_object_finalize_yet versatile: remove cannot_destroy_with_object_finalize_yet ppc: remove cannot_destroy_with_object_finalize_yet arm: remove remaining cannot_destroy_with_object_finalize_yet Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * ppc: remove cannot_destroy_with_object_finalize_yetLaurent Vivier2017-04-211-10/+0Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This removes the assert(kvm_enabled()) from kvmppc_host_cpu_initfn() This assert can never be triggered as the function is only registered when KVM is available (see also 4c315c2 "qdev: Protect device-list-properties against broken devices"). So we can remove the cannot_destroy_with_object_finalize_yet from kvmppc_host_cpu_class_init() without fear and beyond reproach. (as it has already be done for i386 with 771a13e "i386: Unset cannot_destroy_with_object_finalize_yet on "host" model" and e435601 "target-i386: Remove assert(kvm_enabled()) from host_x86_cpu_initfn()") Signed-off-by: Laurent Vivier <lvivier@redhat.com> Message-Id: <20170414083717.13641-3-lvivier@redhat.com> Acked-by: Peter Maydell <peter.maydell@linaro.org> Acked-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Markus Armbruster <armbru@redhat.com>
* | arm: Remove workarounds for old M-profile exception return implementationPeter Maydell2017-04-202-49/+2Star
| | | | | | | | | | | | | | | | | | | | | | Now that we've rewritten M-profile exception return so that the magic PC values are not visible to other parts of QEMU, we can delete the special casing of them elsewhere. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <rth@twiddle.net> Message-id: 1491844419-12485-10-git-send-email-peter.maydell@linaro.org
* | arm: Implement M profile exception return properlyPeter Maydell2017-04-202-6/+64
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | On M profile, return from exceptions happen when code in Handler mode executes one of the following function call return instructions: * POP or LDM which loads the PC * LDR to PC * BX register and the new PC value is 0xFFxxxxxx. QEMU tries to implement this by not treating the instruction specially but then catching the attempt to execute from the magic address value. This is not ideal, because: * there are guest visible differences from the architecturally specified behaviour (for instance jumping to 0xFFxxxxxx via a different instruction should not cause an exception return but it will in the QEMU implementation) * we have to account for it in various places (like refusing to take an interrupt if the PC is at a magic value, and making sure that the MPU doesn't deny execution at the magic value addresses) Drop these hacks, and instead implement exception return the way the architecture specifies -- by having the relevant instructions check for the magic value and raise the 'do an exception return' QEMU internal exception immediately. The effect on the generated code is minor: bx lr, old code (and new code for Thread mode): TCG: mov_i32 tmp5,r14 movi_i32 tmp6,$0xfffffffffffffffe and_i32 pc,tmp5,tmp6 movi_i32 tmp6,$0x1 and_i32 tmp5,tmp5,tmp6 st_i32 tmp5,env,$0x218 exit_tb $0x0 set_label $L0 exit_tb $0x7f2aabd61993 x86_64 generated code: 0x7f2aabe87019: mov %ebx,%ebp 0x7f2aabe8701b: and $0xfffffffffffffffe,%ebp 0x7f2aabe8701e: mov %ebp,0x3c(%r14) 0x7f2aabe87022: and $0x1,%ebx 0x7f2aabe87025: mov %ebx,0x218(%r14) 0x7f2aabe8702c: xor %eax,%eax 0x7f2aabe8702e: jmpq 0x7f2aabe7c016 bx lr, new code when in Handler mode: TCG: mov_i32 tmp5,r14 movi_i32 tmp6,$0xfffffffffffffffe and_i32 pc,tmp5,tmp6 movi_i32 tmp6,$0x1 and_i32 tmp5,tmp5,tmp6 st_i32 tmp5,env,$0x218 movi_i32 tmp5,$0xffffffffff000000 brcond_i32 pc,tmp5,geu,$L1 exit_tb $0x0 set_label $L1 movi_i32 tmp5,$0x8 call exception_internal,$0x0,$0,env,tmp5 x86_64 generated code: 0x7fe8fa1264e3: mov %ebp,%ebx 0x7fe8fa1264e5: and $0xfffffffffffffffe,%ebx 0x7fe8fa1264e8: mov %ebx,0x3c(%r14) 0x7fe8fa1264ec: and $0x1,%ebp 0x7fe8fa1264ef: mov %ebp,0x218(%r14) 0x7fe8fa1264f6: cmp $0xff000000,%ebx 0x7fe8fa1264fc: jae 0x7fe8fa126509 0x7fe8fa126502: xor %eax,%eax 0x7fe8fa126504: jmpq 0x7fe8fa122016 0x7fe8fa126509: mov %r14,%rdi 0x7fe8fa12650c: mov $0x8,%esi 0x7fe8fa126511: mov $0x56095dbeccf5,%r10 0x7fe8fa12651b: callq *%r10 which is a difference of one cmp/branch-not-taken. This will be lost in the noise of having to exit generated code and look up the next TB anyway. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <rth@twiddle.net> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 1491844419-12485-9-git-send-email-peter.maydell@linaro.org
* | arm: Track M profile handler mode state in TB flagsPeter Maydell2017-04-203-0/+11
| | | | | | | | | | | | | | | | | | | | | | | | For M profile exception-return handling we'd like to generate different code for some instructions depending on whether we are in Handler mode or Thread mode. This isn't the same as "are we privileged or user", so we need an extra bit in the TB flags to distinguish. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <rth@twiddle.net> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 1491844419-12485-8-git-send-email-peter.maydell@linaro.org
* | arm: Abstract out "are we singlestepping" test to utility functionPeter Maydell2017-04-201-5/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | We now test for "are we singlestepping" in several places and it's not a trivial check because we need to care about both architectural singlestep and QEMU gdbstub singlestep. We're also about to add another place that needs to make this check, so pull the condition out into a function. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <rth@twiddle.net> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 1491844419-12485-7-git-send-email-peter.maydell@linaro.org
* | arm: Move condition-failed codepath generation out of if()Peter Maydell2017-04-201-13/+11Star
| | | | | | | | | | | | | | | | | | | | | | | | | | Move the code to generate the "condition failed" instruction codepath out of the if (singlestepping) {} else {}. This will allow adding support for handling a new is_jmp type which can't be neatly split into "singlestepping case" versus "not singlestepping case". Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <rth@twiddle.net> Message-id: 1491844419-12485-6-git-send-email-peter.maydell@linaro.org
* | arm: Move gen_set_condexec() and gen_set_pc_im() up in the filePeter Maydell2017-04-201-16/+15Star
| | | | | | | | | | | | | | | | | | | | | | Move the utility routines gen_set_condexec() and gen_set_pc_im() up in the file, as we will want to use them from a function placed earlier in the file than their current location. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <rth@twiddle.net> Message-id: 1491844419-12485-5-git-send-email-peter.maydell@linaro.org
* | arm: Factor out "generate right kind of step exception"Peter Maydell2017-04-201-12/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We currently have two places that do: if (dc->ss_active) { gen_step_complete_exception(dc); } else { gen_exception_internal(EXCP_DEBUG); } Factor this out into its own function, as we're about to add a third place that needs the same logic. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <rth@twiddle.net> Message-id: 1491844419-12485-4-git-send-email-peter.maydell@linaro.org
* | arm: Thumb shift operations should not permit interworking branchesPeter Maydell2017-04-201-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In Thumb mode, the only instructions which can cause an interworking branch by writing the PC are BLX, BX, BXJ, LDR, POP and LDM. Unlike ARM mode, data processing instructions which target the PC do not cause interworking branches. When we added support for doing interworking branches on writes to PC from data processing instructions in commit 21aeb3430ce7ba, we accidentally changed a Thumb instruction to have interworking branch behaviour for writes to PC. (MOV, MOVS register-shifted register, encoding T2; this is the standard encoding for LSL/LSR/ASR/ROR (register).) For this encoding, behaviour with Rd == R15 is specified as UNPREDICTABLE, so allowing an interworking branch is within spec, but it's confusing and differs from our handling of this class of UNPREDICTABLE for other Thumb ALU operations. Make it perform a simple (non-interworking) branch like the others. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <rth@twiddle.net> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 1491844419-12485-3-git-send-email-peter.maydell@linaro.org
* | arm: Don't implement BXJ on M-profile CPUsPeter Maydell2017-04-201-1/+6
| | | | | | | | | | | | | | | | | | | | | | For M-profile CPUs, the BXJ instruction does not exist at all, and the encoding should always UNDEF. We were accidentally implementing it to behave like A-profile BXJ; correct the error. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <rth@twiddle.net> Message-id: 1491844419-12485-2-git-send-email-peter.maydell@linaro.org
* | arm/kvm: Remove trailing newlines from error_report()Ishani Chugh2017-04-201-2/+2
| | | | | | | | | | | | | | Signed-off-by: Ishani Chugh <chugh.ishani@research.iiit.ac.in> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Message-id: 1491629987-6826-1-git-send-email-chugh.ishani@research.iiit.ac.in Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* | target/arm: Add assertion about FSC format for syndrome registersPeter Maydell2017-04-201-5/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In tlb_fill() we construct a syndrome register value from a fault status register value which is filled in by arm_tlb_fill(). arm_tlb_fill() returns FSR values which might be in the format used with short-format page descriptors, or the format used with long-format (LPAE) descriptors. The syndrome register always uses LPAE-format FSR status codes. It isn't actually possible to end up delivering a syndrome register value to the guest for a fault which is reported with a short-format FSR (that kind of stage 1 fault will only happen for an AArch32 translation regime which doesn't have a syndrome register, and can never be redirected to an AArch64 or Hyp exception level). Add an assertion which checks this, and adjust the code so that we construct a syndrome with an invalid status code, rather than allowing set bits in the FSR input to randomly corrupt other fields in the syndrome. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Message-id: 1491486152-24304-1-git-send-email-peter.maydell@linaro.org
* | arm: Move excnames[] array into arm_log_exceptions()Peter Maydell2017-04-203-24/+20Star
| | | | | | | | | | | | | | | | | | | | | | | | | | The excnames[] array is defined in internals.h because we used to use it from two different source files for handling logging of AArch32 and AArch64 exception entry. Refactoring means that it's now used only in arm_log_exception() in helper.c, so move the array into that function. Suggested-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 1491821097-5647-1-git-send-email-peter.maydell@linaro.org
* | target/arm: Add missing entries to excnames[] for log stringsPeter Maydell2017-04-202-0/+3
|/ | | | | | | | | | | | | | Recent changes have added new EXCP_ values to ARM but forgot to update the excnames[] array which is used to provide human-readable strings when printing information about the exception for debug logging. Add the missing entries, and add a comment to the list of #defines to help avoid the mistake being repeated in future. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Message-id: 1491486340-25988-1-git-send-email-peter.maydell@linaro.org
* target/i386/misc_helper: wrap BQL around another IRQ generatorAlex Bennée2017-04-101-0/+3
| | | | | | | | Anything that calls into HW emulation must be protected by the BQL. Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <rth@twiddle.net> Acked-by: Eduardo Habkost <ehabkost@redhat.com>
* target-i386: fix "info lapic" segfault on isapcTejaswini Poluri2017-04-021-0/+4
| | | | | | | | | | | Start QEMU with "qemu-system-x86_64 -nographic -M isapc -serial none-monitor stdio" and enter "info lapic" at the monitor prompt ⇒ Segmentation fault Signed-off-by: Tejaswini Poluri <tejaswinipoluri3@gmail.com> Message-Id: <1490685583-16987-1-git-send-email-tejaswinipoluri3@gmail.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* hmp: fix "dump-quest-memory" segfaultIwona Kotlarska2017-03-311-2/+1Star
| | | | | | | | | | | | | | Running QEMU with "qemu-system-x86_64 -M none -nographic -m 256" and executing "dump-guest-memory /dev/null 0 8192" results in segfault. Fix by checking if we have CPU. Signed-off-by: Iwona Kotlarska <iwona260909@gmail.com> Message-Id: <20170330050924.22134-1-iwona260909@gmail.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Marcel Apfelbaum <marcel@redhat.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Fixed up title
* i386: Don't override -cpu options on -cpu host/maxEduardo Habkost2017-03-282-4/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The existing code for "host" and "max" CPU models overrides every single feature in the CPU object at realize time, even the ones that were explicitly enabled or disabled by the user using "feat=on" or "feat=off", while features set using +feat/-feat are kept. This means "-cpu host,+invtsc" works as expected, while "-cpu host,invtsc=on" doesn't. This was a known bug, already documented in a comment inside x86_cpu_expand_features(). What makes this bug worse now is that libvirt 3.0.0 and newer now use "feat=on|off" instead of +feat/-feat when it detects a QEMU version that supports it (see libvirt commit d47db7b16dd5422c7e487c8c8ee5b181a2f9cd66). Change the feature property getter/setter to set a env->user_features field, to keep track of features that were explicitly changed using QOM properties. Then make the max_features code not override user features when handling "-cpu host" and "-cpu max". This will also allow us to remove the plus_features/minus_features hack in the future, but I plan to do that after 2.9.0 is released. Reported-by: Jiri Denemark <jdenemar@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Message-Id: <20170327144815.8043-3-ehabkost@redhat.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com> Tested-by: Jiri Denemark <jdenemar@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
* i386: Replace uint32_t* with FeatureWord on feature getter/setterEduardo Habkost2017-03-281-8/+11
| | | | | | | | | | | | | | | Instead of passing a pointer to the feature property getter and setter functions, pass a FeatureWord enum so they can perform other actions related to the feature flag. This will be used to add a new "user_features" field to keep track of features that were explicitly set by the user. Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Message-Id: <20170327144815.8043-2-ehabkost@redhat.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com> Tested-by: Jiri Denemark <jdenemar@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
* tcg/i386: Check the size of instruction being translatedPranith Kumar2017-03-241-0/+7
| | | | | | | | | | | | | | This fixes the bug: 'user-to-root privesc inside VM via bad translation caching' reported by Jann Horn here: https://bugs.chromium.org/p/project-zero/issues/detail?id=1122 Reviewed-by: Richard Henderson <rth@twiddle.net> CC: Peter Maydell <peter.maydell@linaro.org> CC: Paolo Bonzini <pbonzini@redhat.com> Reported-by: Jann Horn <jannh@google.com> Signed-off-by: Pranith Kumar <bobby.prani@gmail.com> Message-Id: <20170323175851.14342-1-bobby.prani@gmail.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* target/s390x: Fix broken user modeStefan Weil2017-03-231-2/+0Star
| | | | | | | | | | | Returning NULL from get_max_cpu_model results in a SIGSEGV runtime error. Signed-off-by: Stefan Weil <sw@weilnetz.de> Reviewed-by: David Hildenbrand <david@redhat.com> Message-Id: <20170130131517.8092-1-sw@weilnetz.de> Cc: qemu-stable@nongnu.org Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com> Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
* Merge remote-tracking branch 'remotes/yongbok/tags/mips-20170320' into stagingPeter Maydell2017-03-203-73/+79
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | MIPS patches 2017-03-20 Changes: * Fix clang warnings * Fix delay slot detection in gen_msa_branch() * Fix rc4030 interval timer * Fix rc4030 to tranlate memory accesses only when they occur * Fix 4c4030 a mixed declarations and code warning * Update MAINTAINERS file # gpg: Signature made Mon 20 Mar 2017 12:46:01 GMT # gpg: using RSA key 0x2238EB86D5F797C2 # gpg: Good signature from "Yongbok Kim <yongbok.kim@imgtec.com>" # gpg: WARNING: This key is not certified with sufficiently trusted signatures! # gpg: It is not certain that the signature belongs to the owner. # Primary key fingerprint: 8600 4CF5 3415 A5D9 4CFA 2B5C 2238 EB86 D5F7 97C2 * remotes/yongbok/tags/mips-20170320: MAINTAINERS: update for MIPS devices dma/rc4030: fix a mixed declarations and code warning dma/rc4030: translate memory accesses only when they occur dma: rc4030: limit interval timer reload value target/mips: fix delay slot detection in gen_msa_branch() target-mips: replace few LOG_DISAS() with trace points target-mips: replace break by goto cp0_unimplemented target-mips: log bad coprocessor0 register accesses with LOG_UNIMP target-mips: remove old & unuseful comments target-mips: fix compiler warnings (clang 5) Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * target/mips: fix delay slot detection in gen_msa_branch()Yongbok Kim2017-03-201-1/+1
| | | | | | | | | | | | | | | | | | | | It is unnecessary to test R6 from delay/forbidden slot check in gen_msa_branch(). https://bugs.launchpad.net/qemu/+bug/1663287 Reported-by: Brian Campbell <bacam@z273.org.uk> Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
| * target-mips: replace few LOG_DISAS() with trace pointsPhilippe Mathieu-Daudé2017-03-202-14/+16
| | | | | | | | | | | | Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Yongbok Kim <yongbok.kim@imgtec.com> Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
| * target-mips: replace break by goto cp0_unimplementedPhilippe Mathieu-Daudé2017-03-201-44/+44
| | | | | | | | | | | | | | | | | | | | | | | | | | this fixes many warnings like: target/mips/translate.c:6253:13: warning: Value stored to 'rn' is never read rn = "invalid sel"; ^ ~~~~~~~~~~~~~ Reported-by: Clang Static Analyzer Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Yongbok Kim <yongbok.kim@imgtec.com> Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
| * target-mips: log bad coprocessor0 register accesses with LOG_UNIMPPhilippe Mathieu-Daudé2017-03-201-6/+6
| | | | | | | | | | | | Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Yongbok Kim <yongbok.kim@imgtec.com> Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
| * target-mips: remove old & unuseful commentsPhilippe Mathieu-Daudé2017-03-201-4/+0Star
| | | | | | | | | | | | Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Yongbok Kim <yongbok.kim@imgtec.com> Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
| * target-mips: fix compiler warnings (clang 5)Philippe Mathieu-Daudé2017-03-201-4/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | static code analyzer complain: target/mips/helper.c:453:5: warning: Function call argument is an uninitialized value qemu_log_mask(CPU_LOG_MMU, ^~~~~~~~~~~~~~~~~~~~~~~~~~ 'physical' and 'prot' are uninitialized if 'ret' is not TLBRET_MATCH. Reported-by: Clang Static Analyzer Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Yongbok Kim <yongbok.kim@imgtec.com> Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
* | arm: Fix APSR writes via M profile MSRPeter Maydell2017-03-202-5/+24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Our implementation of writes to the APSR for M-profile via the MSR instruction was badly broken. First and worst, we had the sense wrong on the test of bit 2 of the SYSm field -- this is supposed to request an APSR write if bit 2 is 0 but we were doing it if bit 2 was 1. This bug was introduced in commit 58117c9bb429cd, so hasn't been in a QEMU release. Secondly, the choice of exactly which parts of APSR should be written is defined by bits in the 'mask' field. We were not passing these through from instruction decode, making it impossible to check them in the helper. Pass the mask bits through from the instruction decode to the helper function and process them appropriately; fix the wrong sense of the SYSm bit 2 check. Invalid mask values and invalid combinations of mask and register number are UNPREDICTABLE; we choose to treat them as if the mask values were valid. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1487616072-9226-5-git-send-email-peter.maydell@linaro.org Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
* | arm: Enforce should-be-1 bits in MRS decodingPeter Maydell2017-03-201-0/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | The MRS instruction requires that bits [19..16] are all 1s, and for A/R profile also that bits [7..0] are all 0s. At this point in the decode tree we have checked all of the rest of the instruction but were allowing these to be any value. If these bits are not set then the result is architecturally UNPREDICTABLE, but choosing to UNDEF is more helpful to the user and avoids unexpected odd behaviour if the encodings are used for some purpose in future architecture versions. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Message-id: 1487616072-9226-4-git-send-email-peter.maydell@linaro.org
* | arm: Don't decode MRS(banked) or MSR(banked) for M profilePeter Maydell2017-03-201-2/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | M profile doesn't have the MSR(banked) and MRS(banked) instructions and uses the encodings for different kinds of M-profile MRS/MSR. Guard the relevant bits of the decode logic to make sure we don't accidentally fall into them by accident on M-profile. (The bit being checked for this (bit 5) is part of the SYSm field on M-profile, but since no currently allocated system registers have encodings with bit 5 of SYSm set, this hasn't been a problem in practice.) Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Message-id: 1487616072-9226-3-git-send-email-peter.maydell@linaro.org
* | arm: HVC and SMC encodings don't exist for M profilePeter Maydell2017-03-201-0/+3
|/ | | | | | | | | | M profile doesn't have the HVC or SMC encodings, so make them always UNDEF rather than generating calls to helper functions that assume A/R profile. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Message-id: 1487616072-9226-2-git-send-email-peter.maydell@linaro.org
* Merge remote-tracking branch 'remotes/xtensa/tags/20170317-xtensa' into stagingPeter Maydell2017-03-181-13/+36
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | target/xtensa fixes for 2.9: - fix build failure when FDT support is not enabled; - correctly pass command line arguments to semihosting guests. # gpg: Signature made Fri 17 Mar 2017 18:14:01 GMT # gpg: using RSA key 0x51F9CC91F83FA044 # gpg: Good signature from "Max Filippov <filippov@cadence.com>" # gpg: aka "Max Filippov <max.filippov@cogentembedded.com>" # gpg: aka "Max Filippov <jcmvbkbc@gmail.com>" # Primary key fingerprint: 2B67 854B 98E5 327D CDEB 17D8 51F9 CC91 F83F A044 * remotes/xtensa/tags/20170317-xtensa: target/xtensa: fix semihosting argc/argv implementation target/xtensa: xtfpga: load DTB only when FDT support is enabled Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * target/xtensa: fix semihosting argc/argv implementationMax Filippov2017-03-111-13/+36
| | | | | | | | | | | | | | | | | | So far xtensa provides fixed dummy argc/argv for the corresponding semihosting calls. Now that there are semihosting_get_argc and semihosting_get_arg, use them to pass actual command line arguments to guest. Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
* | makefile: merge GENERATED_HEADERS & GENERATED_SOURCES variablesDaniel P. Berrange2017-03-161-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The only functional difference between the GENERATED_HEADERS and GENERATED_SOURCES variables is that 'Makefile' has a dependancy on GENERATED_HEADERS, causing generated header files to be created immediatey at the start of the build process. There is no reason why this early creation should be restricted to the .h files, and not include .c files too. Merge both of the variables into a single GENERATED_FILES variable to make it clear it is for any type of generated file. Signed-off-by: Daniel P. Berrange <berrange@redhat.com> Reviewed-by: Fam Zheng <famz@redhat.com> Message-id: 20170228122901.24520-2-berrange@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
* | Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into stagingPeter Maydell2017-03-143-0/+16
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * "x" monitor command fix for KVM (Christian) * MemoryRegion name documentation (David) * mem-prealloc optimization (Jitendra) * -icount/MTTCG fixes (me) * "info mtree" niceness (Peter) * NBD drop_sync buffer overflow (Vladimir/Eric) * small cleanups and bugfixes (Li, Lin, Suramya, Thomas) * fix for "-device kvmclock" w/TCG (Eduardo) * debug output before crashing on KVM_{GET,SET}_MSRS (Eduardo) # gpg: Signature made Tue 14 Mar 2017 13:42:05 GMT # gpg: using RSA key 0xBFFBD25F78C7AE83 # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * remotes/bonzini/tags/for-upstream: nbd/client: fix drop_sync [CVE-2017-2630] memory: info mtree check mr range overflow icount: process QEMU_CLOCK_VIRTUAL timers in vCPU thread main-loop: remove now unnecessary optimization cpus: define QEMUTimerListNotifyCB for QEMU system emulation qemu-timer: do not include sysemu/cpus.h from util/qemu-timer.h qemu-timer: fix off-by-one target/nios2: take BQL around interrupt check scsi: mptsas: fix the wrong reading size in fetch request util: Removed unneeded header from path.c configure: add the missing help output for optional features scripts/dump-guest-memory.py: fix int128_get64 on recent gcc kvmclock: Don't crash QEMU if KVM is disabled kvm: Print MSR information if KVM_{GET,SET}_MSRS failed exec: add cpu_synchronize_state to cpu_memory_rw_debug mem-prealloc: reduce large guest start-up and migration time. docs: Add a note about mixing bootindex with "-boot order" memory_region: Fix name comments Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | qemu-timer: do not include sysemu/cpus.h from util/qemu-timer.hPaolo Bonzini2017-03-141-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | This dependency is the wrong way, and we will need util/qemu-timer.h from sysemu/cpus.h in the next patch. Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| * | target/nios2: take BQL around interrupt checkPaolo Bonzini2017-03-141-0/+3
| | | | | | | | | | | | | | | | | | The interrupt controller does not have its own locking. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| * | kvm: Print MSR information if KVM_{GET,SET}_MSRS failedEduardo Habkost2017-03-141-0/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When a KVM_{GET,SET}_MSRS ioctl() fails, it is difficult to find out which MSR caused the problem. Print an error message for debugging, before we trigger the (ret == cpu->kvm_msr_buf->nmsrs) assert. Suggested-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Message-Id: <20170309194634.28457-1-ehabkost@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* | | target/arm/arm-powerctl: Fix psci info return valuesAndrew Jones2017-03-141-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The power state spec section 5.1.5 AFFINITY_INFO defines the affinity info return values as 0 ON 1 OFF 2 ON_PENDING I grepped QEMU for power_state to ensure that no assumptions of OFF=0 were being made. Signed-off-by: Andrew Jones <drjones@redhat.com> Message-id: 20170303123232.4967-1-drjones@redhat.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* | | target/arm: implement armv8 PMUSERENR (user-mode enable bits)Andrew Baumann2017-03-141-8/+71
|/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | In armv8, this register implements more than a single bit, with fine-grained enables for read access to event counters, cycles counters, and write access to the software increment. This change implements those checks using custom access functions for the relevant registers. Signed-off-by: Andrew Baumann <Andrew.Baumann@microsoft.com> Message-id: 20170228215801.10472-2-Andrew.Baumann@microsoft.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> [PMM: move a couple of access functions to be only compiled ifndef CONFIG_USER_ONLY to avoid compiler warnings] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* | target/ppc: fix cpu_ov setting for 32-bitNikunj A Dadhania2017-03-141-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | A bug was introduced in following commit: dc0ad84 target/ppc: update overflow flags for add/sub As for 32-bit ppc target extracting bit 63 for overflow is not correct. Made it dependent on TARGET_LOG_BITS. This had broken booting MacOS 9.2.1 image Reported-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Signed-off-by: Nikunj A Dadhania <nikunj@linux.vnet.ibm.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Tested-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
* | target/ppc: Fix wrong number of UAMR registerThomas Huth2017-03-141-1/+1
| | | | | | | | | | | | | | | | | | The SPR UAMR has the number 13, and not 12. (Fortunately it seems like Linux is not using this register yet - only the privileged version with number 29 ... that's why nobody noticed this problem yet) Signed-off-by: Thomas Huth <thuth@redhat.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* | Merge remote-tracking branch 'remotes/ehabkost/tags/x86-pull-request' into ↵Peter Maydell2017-03-133-1/+38
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | staging x86: Haswell TSX blacklist fix for 2.9 # gpg: Signature made Fri 10 Mar 2017 18:45:08 GMT # gpg: using RSA key 0x2807936F984DC5A6 # gpg: Good signature from "Eduardo Habkost <ehabkost@redhat.com>" # Primary key fingerprint: 5A32 2FD5 ABC4 D3DB ACCF D1AA 2807 936F 984D C5A6 * remotes/ehabkost/tags/x86-pull-request: i386: Change stepping of Haswell to non-blacklisted value i386/kvm: Blacklist TSX on known broken hosts i386: host_vendor_fms() helper function Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | i386: Change stepping of Haswell to non-blacklisted valueEduardo Habkost2017-03-101-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | glibc blacklists TSX on Haswell CPUs with model==60 and stepping < 4. To make the Haswell CPU model more useful, make those guests actually use TSX by changing CPU stepping to 4. References: * glibc commit 2702856bf45c82cf8e69f2064f5aa15c0ceb6359 https://sourceware.org/git/?p=glibc.git;a=commit;h=2702856bf45c82cf8e69f2064f5aa15c0ceb6359 Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Message-Id: <20170309181212.18864-4-ehabkost@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
| * | i386/kvm: Blacklist TSX on known broken hostsEduardo Habkost2017-03-101-0/+17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Some Intel CPUs are known to have a broken TSX implementation. A microcode update from Intel disabled TSX on those CPUs, but GET_SUPPORTED_CPUID might be reporting it as supported if the hosts were not updated yet. Manually fixup the GET_SUPPORTED_CPUID data to ensure we will never enable TSX when running on those hosts. Reference: * glibc commit 2702856bf45c82cf8e69f2064f5aa15c0ceb6359: https://sourceware.org/git/?p=glibc.git;a=commit;h=2702856bf45c82cf8e69f2064f5aa15c0ceb6359 Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Message-Id: <20170309181212.18864-3-ehabkost@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
generated by cgit v1.2.3-55-g7522 (git 2.39.0) at 2024-12-22 21:58:39 +0100