aboutsummaryrefslogtreecommitdiff
path: root/target
AgeCommit message (Collapse)Author
2018-08-24target/mips: Fix pre-nanoMIPS MT ASE instructions availability controlAleksandar Rikalo
Use bits from configuration registers for availability control of MT ASE instructions, rather than only ISA_MT bit in insn_flags. This is done by adding a field in hflags for MT bit, and adding functions check_mt() and check_cp0_mt(). Reviewed-by: Aleksandar Markovic <amarkovic@wavecomp.com> Signed-off-by: Aleksandar Markovic <amarkovic@wavecomp.com> Signed-off-by: Stefan Markovic <smarkovic@wavecomp.com>
2018-08-24target/mips: Add emulation of nanoMIPS 32-bit branch instructionsStefan Markovic
Add emulation of various flavors of nanoMIPS 32-bit branch instructions. Reviewed-by: Aleksandar Markovic <amarkovic@wavecomp.com> Signed-off-by: Yongbok Kim <yongbok.kim@mips.com> Signed-off-by: Aleksandar Markovic <amarkovic@wavecomp.com> Signed-off-by: Stefan Markovic <smarkovic@wavecomp.com>
2018-08-24target/mips: Implement emulation of nanoMIPS LLWP/SCWP pairAleksandar Rikalo
Implement support for nanoMIPS LLWP/SCWP instructions. Beside adding core functionality of these instructions, this patch adds support for availability control via configuration bit XNP. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Aleksandar Markovic <amarkovic@wavecomp.com> Signed-off-by: Dimitrije Nikolic <dnikolic@wavecomp.com> Signed-off-by: Aleksandar Markovic <amarkovic@wavecomp.com> Signed-off-by: Stefan Markovic <smarkovic@wavecomp.com>
2018-08-24target/mips: Add CP0 Config3 and Config5 fields to DisasContext structureDimitrije Nikolic
Add CP0_Config3 and CP0_Config5 to DisasContext structure. This is needed for implementing availability control of various instructions. Reviewed-by: "Aleksandar Markovic <amarkovic@wavecomp.com>" Signed-off-by: "Aleksandar Markovic <amarkovic@wavecomp.com>"
2018-08-24target/mips: Add emulation of nanoMIPS 32-bit load and store instructionsYongbok Kim
Add emulation of various nanoMIPS load and store instructions. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Aleksandar Markovic <amarkovic@wavecomp.com> Signed-off-by: Yongbok Kim <yongbok.kim@mips.com> Signed-off-by: Aleksandar Markovic <amarkovic@wavecomp.com> Signed-off-by: Stefan Markovic <smarkovic@wavecomp.com>
2018-08-24target/mips: Implement emulation of nanoMIPS EXTW instructionJames Hogan
Implement emulation of nanoMIPS EXTW instruction. EXTW instruction is similar to the MIPS r6 ALIGN instruction, except that it counts the other way and in bits instead of bytes. We therefore generalise gen_align() function into a new gen_align_bits() function (which counts in bits instead of bytes and optimises when bits = size of the word), and implement gen_align() and a new gen_ext() based on that. Since we need to know the word size to check for when the number of bits == the word size, the opc argument is replaced with a wordsz argument (either 32 or 64). Signed-off-by: James Hogan <james.hogan@mips.com> Signed-off-by: Yongbok Kim <yongbok.kim@mips.com> Signed-off-by: Aleksandar Markovic <amarkovic@wavecomp.com> Signed-off-by: Stefan Markovic <smarkovic@wavecomp.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
2018-08-24target/mips: Implement emulation of nanoMIPS ROTX instructionMatthew Fortune
Added a helper for ROTX based on the pseudocode from the architecture spec. This instraction was not present in previous MIPS instruction sets. Signed-off-by: Yongbok Kim <yongbok.kim@mips.com> Signed-off-by: Aleksandar Markovic <amarkovic@wavecomp.com> Signed-off-by: Stefan Markovic <smarkovic@wavecomp.com> Reviewed-by: Aleksandar Markovic <amarkovic@wavecomp.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
2018-08-24target/mips: Add emulation of misc nanoMIPS instructions (p_lsx)Yongbok Kim
Add emulation of nanoMIPS instructions situated in pool p_lsx, and emulation of LSA instruction as well. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Aleksandar Markovic <amarkovic@wavecomp.com> Signed-off-by: Aleksandar Markovic <amarkovic@wavecomp.com> Signed-off-by: Stefan Markovic <smarkovic@wavecomp.com>
2018-08-24target/mips: Add emulation of misc nanoMIPS instructions (pool32axf)Yongbok Kim
Add emulation of misc nanoMIPS instructions situated in pool32axf. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Yongbok Kim <yongbok.kim@mips.com> Signed-off-by: Aleksandar Markovic <amarkovic@wavecomp.com> Signed-off-by: Stefan Markovic <smarkovic@wavecomp.com>
2018-08-24target/mips: Add emulation of misc nanoMIPS instructions (pool32a0)Yongbok Kim
Add emulation of nanoMIPS instructions that are situated in pool32a0. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Aleksandar Markovic <amarkovic@wavecomp.com> Signed-off-by: Aleksandar Markovic <amarkovic@wavecomp.com> Signed-off-by: Stefan Markovic <smarkovic@wavecomp.com>
2018-08-24target/mips: Add emulation of nanoMIPS FP instructionsYongbok Kim
Add emulation of basic floating point arithmetic for nanoMIPS. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Aleksandar Markovic <amarkovic@wavecomp.com> Signed-off-by: Yongbok Kim <yongbok.kim@mips.com> Signed-off-by: Aleksandar Markovic <amarkovic@wavecomp.com> Signed-off-by: Stefan Markovic <smarkovic@wavecomp.com>
2018-08-24target/mips: Add emulation of nanoMIPS 48-bit instructionsYongbok Kim
Add emulation of LI48, ADDIU48, ADDIUGP48, ADDIUPC48, LWPC48, and SWPC48 instructions. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Aleksandar Markovic <amarkovic@wavecomp.com> Signed-off-by: Yongbok Kim <yongbok.kim@mips.com> Signed-off-by: Aleksandar Markovic <amarkovic@wavecomp.com> Signed-off-by: Stefan Markovic <smarkovic@wavecomp.com>
2018-08-24target/mips: Add emulation of nanoMIPS instructions MOVE.P and MOVE.PREVYongbok Kim
Add emulation of nanoMIPS instructions MOVE.P and MOVE.PREV. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Yongbok Kim <yongbok.kim@mips.com> Signed-off-by: Aleksandar Markovic <amarkovic@wavecomp.com> Signed-off-by: Stefan Markovic <smarkovic@wavecomp.com>
2018-08-24target/mips: Add emulation of some common nanoMIPS 32-bit instructionsYongbok Kim
Add emulation of SIGRIE, SYSCALL, BREAK, SDBBP, ADDIU, ADDIUPC, ADDIUGP.W, LWGP, SWGP, ORI, XORI, ANDI, and other instructions. Reviewed-by: Aleksandar Markovic <amarkovic@wavecomp.com> Signed-off-by: Yongbok Kim <yongbok.kim@mips.com> Signed-off-by: Aleksandar Markovic <amarkovic@wavecomp.com> Signed-off-by: Stefan Markovic <smarkovic@wavecomp.com>
2018-08-24target/mips: Add emulation of nanoMIPS 16-bit save and restore instructionsStefan Markovic
Add emulation of SAVE16 and RESTORE.JRC16 instructions. Routines gen_save(), gen_restore(), and gen_adjust_sp() are provided to support this feature. This patch at the same time provides function gen_op_addr_addi(). This function will be used in emulation of some other nanoMIPS instructions. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Yongbok Kim <yongbok.kim@mips.com> Signed-off-by: Aleksandar Markovic <amarkovic@wavecomp.com> Signed-off-by: Stefan Markovic <smarkovic@wavecomp.com>
2018-08-24target/mips: Add emulation of nanoMIPS 16-bit logic instructionsYongbok Kim
Add emulation of NOT16, AND16, XOR16, OR16 instructions. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Yongbok Kim <yongbok.kim@mips.com> Signed-off-by: Aleksandar Markovic <amarkovic@wavecomp.com> Signed-off-by: Stefan Markovic <smarkovic@wavecomp.com>
2018-08-24target/mips: Add emulation of nanoMIPS 16-bit load and store instructionsYongbok Kim
Add emulation of LWXS16, LB16, SB16, LBU16, LH16, SH16, LHU16, LW16, LWSP16, LW4X4, SW4X4, LWGP16, SWSP16, SW16, and SWGP16 instructions. Signed-off-by: Yongbok Kim <yongbok.kim@mips.com> Signed-off-by: Aleksandar Markovic <amarkovic@wavecomp.com> Signed-off-by: Stefan Markovic <smarkovic@wavecomp.com> Reviewed-by: Aleksandar Markovic <amarkovic@wavecomp.com>
2018-08-24target/mips: Add emulation of nanoMIPS 16-bit misc instructionsYongbok Kim
Add emulation of misc nanoMIPS 16-bit instructions. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Yongbok Kim <yongbok.kim@mips.com> Signed-off-by: Aleksandar Markovic <amarkovic@wavecomp.com> Signed-off-by: Stefan Markovic <smarkovic@wavecomp.com>
2018-08-24target/mips: Add emulation of nanoMIPS 16-bit shift instructionsYongbok Kim
Add emulation of nanoMIPS 16-bit shift instructions. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Yongbok Kim <yongbok.kim@mips.com> Signed-off-by: Aleksandar Markovic <amarkovic@wavecomp.com> Signed-off-by: Stefan Markovic <smarkovic@wavecomp.com>
2018-08-24target/mips: Add emulation of nanoMIPS 16-bit branch instructionsStefan Markovic
Add emulation of nanoMIPS 16-bit branch instructions. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Yongbok Kim <yongbok.kim@mips.com> Signed-off-by: Aleksandar Markovic <amarkovic@wavecomp.com> Signed-off-by: Stefan Markovic <smarkovic@wavecomp.com>
2018-08-24target/mips: Add emulation of nanoMIPS 16-bit arithmetic instructionsYongbok Kim
Add emulation of nanoMIPS 16-bit arithmetic instructions. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Yongbok Kim <yongbok.kim@mips.com> Signed-off-by: Aleksandar Markovic <amarkovic@wavecomp.com> Signed-off-by: Stefan Markovic <smarkovic@wavecomp.com>
2018-08-24target/mips: Add nanoMIPS decoding and extraction utilitiesAleksandar Markovic
Add some basic utility functions and macros for nanoMIPS decoding engine. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Yongbok Kim <yongbok.kim@mips.com> Signed-off-by: Aleksandar Markovic <amarkovic@wavecomp.com> Signed-off-by: Stefan Markovic <smarkovic@wavecomp.com>
2018-08-24target/mips: Add placeholder and invocation of decode_nanomips_opc()Aleksandar Markovic
Add empty body and invocation of decode_nanomips_opc() if the bit ISA_NANOMIPS32 is set in ctx->insn_flags. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Yongbok Kim <yongbok.kim@mips.com> Signed-off-by: Aleksandar Markovic <amarkovic@wavecomp.com> Signed-off-by: Stefan Markovic <smarkovic@wavecomp.com>
2018-08-24target/mips: Prevent switching mode related to Config3 ISA bit for nanoMIPSStefan Markovic
Only if Config3.ISA is 3 (microMIPS), the mode should be switched in cpu_state_reset(). Config3.ISA is 1 for nanoMIPS processors, and no mode change should happen. Reviewed-by: Aleksandar Markovic <amarkovic@wavecomp.com> Signed-off-by: Aleksandar Markovic <amarkovic@wavecomp.com>
2018-08-24target/mips: Add nanoMIPS DSP ASE opcodesStefan Markovic
Add nanoMIPS opcodes for DSP ASE instruction pools and instructions. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Aleksandar Markovic <amarkovic@wavecomp.com> Signed-off-by: Stefan Markovic <smarkovic@wavecomp.com>
2018-08-24target/mips: Add nanoMIPS base instruction set opcodesYongbok Kim
Add nanoMIPS opcodes. nanoMIPS instruction are organized by so-called instruction pools. Each pool contains a set of opcodes, that in turn can be instruction opcodes or instruction pool opcodes. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Yongbok Kim <yongbok.kim@mips.com> Signed-off-by: Aleksandar Markovic <amarkovic@wavecomp.com> Signed-off-by: Stefan Markovic <smarkovic@wavecomp.com>
2018-08-24target/mips: Add preprocessor constants for nanoMIPSAleksandar Markovic
Add ISA_NANOMIPS32 and CPU_NANOMIPS32 preprocessor constants. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Yongbok Kim <yongbok.kim@mips.com> Signed-off-by: Aleksandar Markovic <amarkovic@wavecomp.com> Signed-off-by: Stefan Markovic <smarkovic@wavecomp.com>
2018-08-24target/arm: Remove a handful of stray tabsPeter Maydell
Following the bulk conversion of the iwMMXt code, there are just a handful of hard coded tabs in target/arm; fix them. This is a whitespace-only patch. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20180821165215.29069-4-peter.maydell@linaro.org
2018-08-24target/arm: Untabify iwmmxt_helper.cPeter Maydell
Untabify the arm iwmmxt_helper.c. This affects only the iwMMXt code. We've never touched that code in years, so it's not going to get fixed up by our "change when touched" process, and a bulk change is not going to be too disruptive. This commit was produced using Emacs "untabify" (plus one by-hand removal of a space to fix a checkpatch nit); it is a whitespace-only change. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20180821165215.29069-3-peter.maydell@linaro.org
2018-08-24target/arm: Untabify translate.cPeter Maydell
Untabify the arm translate.c. This affects only some lines, mostly comments, in the iwMMXt code. We've never touched that code in years, so it's not going to get fixed up by our "change when touched" process, and a bulk change is not going to be too disruptive. This commit was produced using Emacs "untabify"; it is a whitespace-only change. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20180821165215.29069-2-peter.maydell@linaro.org
2018-08-24target/arm: Clear CPSR.IL and CPSR.J on 32-bit exception entryPeter Maydell
On 32-bit exception entry, CPSR.J must always be set to 0 (see v7A Arm ARM DDI0406C.c B1.8.5). CPSR.IL must also be cleared on 32-bit exception entry (see v8A Arm ARM DDI0487C.a G1.10). Clear these bits. (This fixes a bug which will never be noticed by non-buggy guests.) Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Reviewed-by: Luc Michel <luc.michel@greensocs.com> Message-id: 20180820153020.21478-6-peter.maydell@linaro.org
2018-08-24target/arm: Implement support for taking exceptions to Hyp modePeter Maydell
Implement the necessary support code for taking exceptions to Hyp mode in AArch32. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Reviewed-by: Luc Michel <luc.michel@greensocs.com> Message-id: 20180820153020.21478-5-peter.maydell@linaro.org
2018-08-24target/arm: Factor out code for taking an AArch32 exceptionPeter Maydell
Factor out the code which changes the CPU state so as to actually take an exception to AArch32. We're going to want to use this for handling exception entry to Hyp mode. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Reviewed-by: Luc Michel <luc.michel@greensocs.com> Message-id: 20180820153020.21478-4-peter.maydell@linaro.org
2018-08-24target/arm: Implement AArch32 HCR and HCR2Peter Maydell
The AArch32 HCR and HCR2 registers alias HCR_EL2 bits [31:0] and [63:32]; implement them. Since HCR2 exists in ARMv8 but not ARMv7, we need new regdef arrays for "we have EL3, not EL2, we're ARMv8" and "we have EL2, we're ARMv8" to hold the definitions. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Reviewed-by: Luc Michel <luc.michel@greensocs.com> Message-id: 20180820153020.21478-3-peter.maydell@linaro.org
2018-08-24target/arm: Implement RAZ/WI HACTLR2Peter Maydell
The v8 AArch32 HACTLR2 register maps to bits [63:32] of ACTLR_EL2. We implement ACTLR_EL2 as RAZ/WI, so make HACTLR2 also RAZ/WI. (We put the regdef next to ACTLR_EL2 as a reminder in case we ever make ACTLR_EL2 something other than RAZ/WI). Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Reviewed-by: Luc Michel <luc.michel@greensocs.com> Message-id: 20180820153020.21478-2-peter.maydell@linaro.org
2018-08-24target/arm: Use the float-to-int-scale softfloat routinesRichard Henderson
Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20180814002653.12828-5-richard.henderson@linaro.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-08-24target/arm: Use the int-to-float-scale softfloat routinesRichard Henderson
Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20180814002653.12828-4-richard.henderson@linaro.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-08-23Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into stagingPeter Maydell
* x86 TCG fixes for 64-bit call gates (Andrew) * qumu-guest-agent freeze-hook tweak (Christian) * pm_smbus improvements (Corey) * Move validation to pre_plug for pc-dimm (David) * Fix memory leaks (Eduardo, Marc-André) * synchronization profiler (Emilio) * Convert the CPU list to RCU (Emilio) * LSI support for PPR Extended Message (George) * vhost-scsi support for protection information (Greg) * Mark mptsas as a storage device in the help (Guenter) * checkpatch tweak cherry-picked from Linux (me) * Typos, cleanups and dead-code removal (Julia, Marc-André) * qemu-pr-helper support for old libmultipath (Murilo) * Annotate fallthroughs (me) * MemoryRegionOps cleanup (me, Peter) * Make s390 qtests independent from libqos, which doesn't actually support it (me) * Make cpu_get_ticks independent from BQL (me) * Introspection fixes (Thomas) * Support QEMU_MODULE_DIR environment variable (ryang) # gpg: Signature made Thu 23 Aug 2018 17:46:30 BST # gpg: using RSA key BFFBD25F78C7AE83 # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * remotes/bonzini/tags/for-upstream: (69 commits) KVM: cleanup unnecessary #ifdef KVM_CAP_... target/i386: update MPX flags when CPL changes i2c: pm_smbus: Add the ability to force block transfer enable i2c: pm_smbus: Don't delay host status register busy bit when interrupts are enabled i2c: pm_smbus: Add interrupt handling i2c: pm_smbus: Add block transfer capability i2c: pm_smbus: Make the I2C block read command read-only i2c: pm_smbus: Fix the semantics of block I2C transfers i2c: pm_smbus: Clean up some style issues pc-dimm: assign and verify the "addr" property during pre_plug pc: drop memory region alignment check for 0 util/oslib-win32: indicate alignment for qemu_anon_ram_alloc() pc-dimm: assign and verify the "slot" property during pre_plug ipmi: Use proper struct reference for BT vmstate vhost-scsi: expose 't10_pi' property for VIRTIO_SCSI_F_T10_PI vhost-scsi: unify vhost-scsi get_features implementations vhost-user-scsi: move host_features into VHostSCSICommon cpus: allow cpu_get_ticks out of BQL cpus: protect TimerState writes with a spinlock seqlock: add QemuLockable support ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-08-23KVM: cleanup unnecessary #ifdef KVM_CAP_...Paolo Bonzini
The capability macros are always defined, since they come from kernel headers that are copied into the QEMU tree. Remove the unnecessary #ifdefs. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-08-23target/i386: update MPX flags when CPL changesPaolo Bonzini
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-08-23qom: convert the CPU list to RCUEmilio G. Cota
Iterating over the list without using atomics is undefined behaviour, since the list can be modified concurrently by other threads (e.g. every time a new thread is created in user-mode). Fix it by implementing the CPU list as an RCU QTAILQ. This requires a little bit of extra work to traverse list in reverse order (see previous patch), but other than that the conversion is trivial. Signed-off-by: Emilio G. Cota <cota@braap.org> Message-Id: <20180819091335.22863-12-cota@braap.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-08-23target-i386: fix segment limit check in ljmpAndrew Oates
The current implementation has three bugs, * segment limits are not enforced in protected mode if the L bit is set in the target segment descriptor * segment limits are not enforced in compatibility mode (ljmp to 32-bit code segment in long mode) * #GP(new_cs) is generated rather than #GP(0) Now the segment limits are enforced if we're not in long mode OR the target code segment doesn't have the L bit set. Signed-off-by: Andrew Oates <aoates@google.com> Message-Id: <20180816011903.39816-1-andrew@andrewoates.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-08-23target-i386: Fix lcall/ljmp to call gate in IA-32e modeAndrew Oates
Currently call gates are always treated as 32-bit gates. In IA-32e mode (either compatibility or 64-bit submode), system segment descriptors are always 64-bit. Treating them as 32-bit has the expected unfortunate effect: only the lower 32 bits of the offset are loaded, the stack pointer is truncated, a bad new stack pointer is loaded from the TSS (if switching privilege levels), etc. This change adds support for 64-bit call gate to the lcall and ljmp instructions. Additionally, there should be a check for non-canonical stack pointers, but I've omitted that since there doesn't seem to be checks for non-canonical addresses in this code elsewhere. I've left the raise_exception_err_ra lines unwapped at 80 columns to match the style in the rest of the file. Signed-off-by: Andrew Oates <aoates@google.com> Message-Id: <20180819181725.34098-1-andrew@andrewoates.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-08-23i386: Fix arch_query_cpu_model_expansion() leakEduardo Habkost
Reported by Coverity: Error: RESOURCE_LEAK (CWE-772): [#def439] qemu-2.12.0/target/i386/cpu.c:3179: alloc_fn: Storage is returned from allocation function "qdict_new". qemu-2.12.0/qobject/qdict.c:34:5: alloc_fn: Storage is returned from allocation function "g_malloc0". qemu-2.12.0/qobject/qdict.c:34:5: var_assign: Assigning: "qdict" = "g_malloc0(4120UL)". qemu-2.12.0/qobject/qdict.c:37:5: return_alloc: Returning allocated memory "qdict". qemu-2.12.0/target/i386/cpu.c:3179: var_assign: Assigning: "props" = storage returned from "qdict_new()". qemu-2.12.0/target/i386/cpu.c:3217: leaked_storage: Variable "props" going out of scope leaks the storage it points to. This was introduced by commit b8097deb359b ("i386: Improve query-cpu-model-expansion full mode"). The leak is only theoretical: if ret->model->props is set to props, the qapi_free_CpuModelExpansionInfo() call will free props too in case of errors. The only way for this to not happen is if we enter the default branch of the switch statement, which would never happen because all CpuModelExpansionType values are being handled. It's still worth to change this to make the allocation logic easier to follow and make the Coverity error go away. To make everything simpler, initialize ret->model and ret->model->props earlier in the function. While at it, remove redundant check for !prop because prop is always initialized at the beginning of the function. Fixes: b8097deb359bbbd92592b9670adfe9e245b2d0bd Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Message-Id: <20180816183509.8231-1-ehabkost@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-08-23fix "Missing break in switch" coverity reportsPaolo Bonzini
Many of these are marked as "intentional/fix required" because they just need adding a fall through comment. This is exactly what this patch does, except for target/mips/translate.c where it is easier to duplicate the code, and hw/audio/sb16.c where I consulted the DOSBox sources and decide to just remove the LOG_UNIMP before the fallthrough. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-08-21Merge remote-tracking branch 'remotes/dgibson/tags/ppc-for-3.1-20180821' ↵Peter Maydell
into staging ppc patch queue 2018-08-21 Here's my first ppc & spapr pull request for qemu-3.1. This contains a bunch of things that have accumulated while 3.0 was in freeze. Highlights are: * SLOF firmware update * A number of floating point cleanups from Richard Henderson and Yasmin Beatriz * A new model for assigning irq numbers on spapr, this is an important preliminary step towards implementing the POWER9 "XIVE" interrupt controller # gpg: Signature made Tue 21 Aug 2018 05:32:44 BST # gpg: using RSA key 6C38CACA20D9B392 # gpg: Good signature from "David Gibson <david@gibson.dropbear.id.au>" # gpg: aka "David Gibson (Red Hat) <dgibson@redhat.com>" # gpg: aka "David Gibson (ozlabs.org) <dgibson@ozlabs.org>" # gpg: aka "David Gibson (kernel.org) <dwg@kernel.org>" # Primary key fingerprint: 75F4 6586 AE61 A66C C44E 87DC 6C38 CACA 20D9 B392 * remotes/dgibson/tags/ppc-for-3.1-20180821: (26 commits) ppc: add DBCR based debugging spapr_pci: factorize the use of SPAPR_MACHINE_GET_CLASS() mac_newworld: don't use legacy fw_cfg_init_mem() function mac_oldworld: don't use legacy fw_cfg_init_mem() function 40p: don't use legacy fw_cfg_init_mem() function qemu-doc: mark ppc/prep machine as deprecated hw/ppc: deprecate the machine type 'prep', replaced by '40p' spapr: introduce a IRQ controller backend to the machine hw/ppc/ppc405_uc: Convert away from old_mmio hw/ppc/ppc_boards: Don't use old_mmio for ref405ep_fpga hw/ppc/prep: Remove ifdeffed-out stub of XCSR code spapr: introduce a fixed IRQ number space spapr: Add a pseries-3.1 machine type target/ppc: simplify bcdadd/sub functions xics: don't include "target/ppc/cpu-qom.h" in "hw/ppc/xics.h" vfio/spapr: Allow backing bigger guest IOMMU pages with smaller physical pages target/ppc: bcdsub fix sign when result is zero target/ppc: Use non-arithmetic conversions for fp load/store target/ppc: Honor fpscr_ze semantics and tidy fre, fresqrt target/ppc: Tidy helper_fsqrt ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-08-21Merge remote-tracking branch ↵Peter Maydell
'remotes/vivier2/tags/linux-user-for-3.1-pull-request' into staging linux-user fixes: - netlink fixes (add missing types, fix MSG_TRUNC) - sh4 fix (tcg state) - sparc32plus fix (truncate address space to 32bit) - add x86_64 binfmt data # gpg: Signature made Mon 20 Aug 2018 21:24:40 BST # gpg: using RSA key F30C38BD3F2FBE3C # gpg: Good signature from "Laurent Vivier <lvivier@redhat.com>" # gpg: aka "Laurent Vivier <laurent@vivier.eu>" # gpg: aka "Laurent Vivier (Red Hat) <lvivier@redhat.com>" # Primary key fingerprint: CD2F 75DD C8E3 A4DC 2E4F 5173 F30C 38BD 3F2F BE3C * remotes/vivier2/tags/linux-user-for-3.1-pull-request: linux-user: add QEMU_IFLA_INFO_KIND nested type for tun linux-user: update netlink route types linux-user: introduce QEMU_RTA_* to use with rtattr_type_t linux-user: fix recvmsg()/recvfrom() with netlink and MSG_TRUNC sh4: fix use_icount with linux-user linux-user: fix 32bit g2h()/h2g() qemu-binfmt-conf.sh: add x86_64 target Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-08-21ppc: add DBCR based debuggingRoman Kapl
Add support for DBCR (debug control register) based debugging as used on BookE ppc. So far supports only branch and single-step events, but these are the important ones. GDB in Linux guest can now do single-stepping. Signed-off-by: Roman Kapl <rka@sysgo.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2018-08-21target/ppc: simplify bcdadd/sub functionsYasmin Beatriz
After solving a corner case in bcdsub, this patch simplifies the logic of both bcdadd/sub instructions by removing some unnecessary local flags. This commit also rearranges some if-else conditions in bcdadd to make it easier to read. Signed-off-by: Yasmin Beatriz <yasmins@linux.ibm.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2018-08-21target/ppc: bcdsub fix sign when result is zeroYasmin Beatriz
When the result of bcdsub is equal to zero, the result sign may be set to negative in some cases, and this does not follow the Power ISA specifications as to decimal integer arithmetic instructions. Signed-off-by: Yasmin Beatriz <yasmins@linux.ibm.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>