aboutsummaryrefslogtreecommitdiff
path: root/target
AgeCommit message (Collapse)Author
2018-01-25accel/tcg: add size paremeter in tlb_fill()Laurent Vivier
The MC68040 MMU provides the size of the access that triggers the page fault. This size is set in the Special Status Word which is written in the stack frame of the access fault exception. So we need the size in m68k_cpu_unassigned_access() and m68k_cpu_handle_mmu_fault(). To be able to do that, this patch modifies the prototype of handle_mmu_fault handler, tlb_fill() and probe_write(). do_unassigned_access() already includes a size parameter. This patch also updates handle_mmu_fault handlers and tlb_fill() of all targets (only parameter, no code change). Signed-off-by: Laurent Vivier <laurent@vivier.eu> Reviewed-by: David Hildenbrand <david@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20180118193846.24953-2-laurent@vivier.eu>
2018-01-25target/m68k: fix TCG variable double freeLaurent Vivier
t64 is also unconditionally freed after the switch () { ... } Signed-off-by: Laurent Vivier <laurent@vivier.eu> Reviewed-by: Thomas Huth <huth@tuxfamily.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20180119114444.7590-1-laurent@vivier.eu>
2018-01-24Merge remote-tracking branch 'remotes/xtensa/tags/20180122-xtensa' into stagingPeter Maydell
target/xtensa updates: - make mini-bootloader independent of the initial CPU state; - add noMMU XTFPGA variants; - add two noMMU cores: de212 and sample_controller; - fix issues reported by coverity against xtensa translator and disassembler. # gpg: Signature made Mon 22 Jan 2018 20:00:01 GMT # gpg: using RSA key 0x51F9CC91F83FA044 # gpg: Good signature from "Max Filippov <filippov@cadence.com>" # gpg: aka "Max Filippov <max.filippov@cogentembedded.com>" # gpg: aka "Max Filippov <jcmvbkbc@gmail.com>" # Primary key fingerprint: 2B67 854B 98E5 327D CDEB 17D8 51F9 CC91 F83F A044 * remotes/xtensa/tags/20180122-xtensa: target/xtensa: disas/xtensa: fix coverity warnings target/xtensa: add sample_controller core target/xtensa: allow different default CPU for MMU/noMMU target/xtensa: add de212 core hw/xtensa/xtfpga: support noMMU cores hw/xtensa/xtfpga: extract flash configuration hw/xtensa: extract xtensa_create_memory_regions target/xtensa: fix default sysrom/sysram addresses hw/xtensa/xtfpga: clean up function/structure names hw/xtensa/xtfpga: rewrite mini bootloader Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-01-23Merge remote-tracking branch 'remotes/cohuck/tags/s390x-20180122' into stagingPeter Maydell
Various fixes/improvements, and support for the new 81/82 facility bits. # gpg: Signature made Mon 22 Jan 2018 11:54:46 GMT # gpg: using RSA key 0xDECF6B93C6F02FAF # gpg: Good signature from "Cornelia Huck <conny@cornelia-huck.de>" # gpg: aka "Cornelia Huck <huckc@linux.vnet.ibm.com>" # gpg: aka "Cornelia Huck <cornelia.huck@de.ibm.com>" # gpg: aka "Cornelia Huck <cohuck@kernel.org>" # gpg: aka "Cornelia Huck <cohuck@redhat.com>" # Primary key fingerprint: C3D0 D66D C362 4FF6 A8C0 18CE DECF 6B93 C6F0 2FAF * remotes/cohuck/tags/s390x-20180122: s390x/kvm: provide stfle.81 s390x/kvm: Handle bpb feature linux-headers: update s390x/tcg: fixup TEST PROTECTION s390x: fix storage attributes migration for non-small guests hw/s390x: Replace fprintf(stderr, "*\n" with qemu_log_mask() s390x/sclp: fix missing be conversion s390x/tcg: implement TEST PROTECTION s390x/sclp: fixup highest CPU address Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-01-22target/xtensa: disas/xtensa: fix coverity warningsMax Filippov
Coverity warnings CID 1385146, 1385148 1385149 and 1385150 point that xtensa_opcode_num_operands and xtensa_format_num_slots may return -1 even when xtensa_opcode_decode and xtensa_format_decode succeed. In that case unsigned counters used to iterate through operands/slots will not do the right thing. Make counters and loop bounds signed to fix the warnings. Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
2018-01-22target/xtensa: add sample_controller coreMax Filippov
The sample_controller core is a simple noMMU general purpose core, modern analog of de212. It is used as a default core in the xtensa port of Zephyr. Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
2018-01-22target/xtensa: allow different default CPU for MMU/noMMUMax Filippov
Define default core for noMMU configurations and use that core as machine default with noMMU XTFPGA machines. This is done to avoid offering non-working configuration (MMU core on a noMMU machine) as a default. Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
2018-01-22s390x/kvm: provide stfle.81Christian Borntraeger
stfle.81 (ppa15) is a transparent facility that can be passed to the guest without the need to implement hypervisor support. As this feature can be provided by firmware we add it to all full models. Cc: qemu-stable@nongnu.org Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com> Message-Id: <20180118085628.40798-4-borntraeger@de.ibm.com> Reviewed-by: Halil Pasic <pasic@linux.vnet.ibm.com> Reviewed-by: David Hildenbrand <david@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Cornelia Huck <cohuck@redhat.com>
2018-01-22s390x/kvm: Handle bpb featureChristian Borntraeger
We need to handle the bpb control on reset and migration. Normally stfle.82 is transparent (and the normal guest part works without hypervisor activity). To prevent any issues we require full host kernel support for this feature. Cc: qemu-stable@nongnu.org Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com> Message-Id: <20180118085628.40798-3-borntraeger@de.ibm.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: David Hildenbrand <david@redhat.com> [CH: 'Branch Prediction Blocking' -> 'Branch prediction blocking'] Signed-off-by: Cornelia Huck <cohuck@redhat.com>
2018-01-22s390x/tcg: fixup TEST PROTECTIONDavid Hildenbrand
CC == 2 can only happen due to a protection exception, not if memory is not available (PGM_ADDRESSING). So all PGM_ADDRESSING exceptions have to be forwarded to the guest. Since the initial definition of TEST PROTECTION, we now read globals (e.g. PSW mask), so we have to correctly mark the instruction (otherwise, e.g. booting fedora 27 fails). Also, the architecture explicitly specifies which exceptions are forwarded to the guest, this makes the code a little nicer. Signed-off-by: David Hildenbrand <david@redhat.com> Message-Id: <20180112125452.8569-1-david@redhat.com> Signed-off-by: Cornelia Huck <cohuck@redhat.com>
2018-01-22s390x/tcg: implement TEST PROTECTIONDavid Hildenbrand
Linux uses TEST PROTECTION to sense for available memory locations. Let's implement what we can for now (just as for the other instructions, excluding AR mode and special protection mechanisms). Signed-off-by: David Hildenbrand <david@redhat.com> Message-Id: <20171218224616.21030-2-david@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Cornelia Huck <cohuck@redhat.com>
2018-01-20target/ppc: add support for hypervisor doorbells on book3s CPUsCédric Le Goater
The hypervisor doorbells are used by skiboot and Linux on POWER9 processors to wake up secondaries. This adds processor control support to the Server architecture by reusing the Embedded support. They are very similar, only the bits definition of the CPU identifier differ. Still to be done is message broadcast to all threads of the same processor. Signed-off-by: Cédric Le Goater <clg@kaod.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2018-01-20target-ppc: optimize cmp translationpbonzini@redhat.com
We know that only one bit (in addition to SO) is going to be set in the condition register, so do two movconds instead of three setconds, three shifts and two ORs. For ppc64-linux-user, the code size reduction is around 5% and the performance improvement slightly less than 10%. For softmmu, the improvement is around 5%. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2018-01-20target/ppc: msgsnd and msgclr instructions need hypervisor privilegeCédric Le Goater
Signed-off-by: Cédric Le Goater <clg@kaod.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2018-01-20target/ppc: fix doorbell and hypervisor doorbell definitionsCédric Le Goater
commit f03a1af581b9 ("ppc: Fix POWER7 and POWER8 exception definitions") introduced definitions for the server doorbell exceptions by reusing the embedded definitions but this adds complexity in the powerpc_excp() routine. Let's introduce specific definitions for the Server doorbells exception. Signed-off-by: Cédric Le Goater <clg@kaod.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2018-01-18Merge remote-tracking branch 'remotes/ehabkost/tags/x86-pull-request' into ↵Peter Maydell
staging x86 queue, 2018-01-17 Highlight: new CPU models that expose CPU features that guests can use to mitigate CVE-2017-5715 (Spectre variant #2). # gpg: Signature made Thu 18 Jan 2018 02:00:03 GMT # gpg: using RSA key 0x2807936F984DC5A6 # gpg: Good signature from "Eduardo Habkost <ehabkost@redhat.com>" # Primary key fingerprint: 5A32 2FD5 ABC4 D3DB ACCF D1AA 2807 936F 984D C5A6 * remotes/ehabkost/tags/x86-pull-request: i386: Add EPYC-IBPB CPU model i386: Add new -IBRS versions of Intel CPU models i386: Add FEAT_8000_0008_EBX CPUID feature word i386: Add spec-ctrl CPUID bit i386: Add support for SPEC_CTRL MSR i386: Change X86CPUDefinition::model_id to const char* target/i386: add clflushopt to "Skylake-Server" cpu model pc: add 2.12 machine types Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-01-17i386: Add EPYC-IBPB CPU modelEduardo Habkost
EPYC-IBPB is a copy of the EPYC CPU model with just CPUID_8000_0008_EBX_IBPB added. Cc: Jiri Denemark <jdenemar@redhat.com> Cc: Tom Lendacky <thomas.lendacky@amd.com> Cc: Brijesh Singh <brijesh.singh@amd.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Message-Id: <20180109154519.25634-7-ehabkost@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2018-01-17i386: Add new -IBRS versions of Intel CPU modelsEduardo Habkost
The new MSR IA32_SPEC_CTRL MSR was introduced by a recent Intel microcode updated and can be used by OSes to mitigate CVE-2017-5715. Unfortunately we can't change the existing CPU models without breaking existing setups, so users need to explicitly update their VM configuration to use the new *-IBRS CPU model if they want to expose IBRS to guests. The new CPU models are simple copies of the existing CPU models, with just CPUID_7_0_EDX_SPEC_CTRL added and model_id updated. Cc: Jiri Denemark <jdenemar@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Message-Id: <20180109154519.25634-6-ehabkost@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2018-01-17i386: Add FEAT_8000_0008_EBX CPUID feature wordEduardo Habkost
Add the new feature word and the "ibpb" feature flag. Based on a patch by Paolo Bonzini. Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Message-Id: <20180109154519.25634-5-ehabkost@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2018-01-17i386: Add spec-ctrl CPUID bitEduardo Habkost
Add the feature name and a CPUID_7_0_EDX_SPEC_CTRL macro. Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Message-Id: <20180109154519.25634-4-ehabkost@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2018-01-17i386: Add support for SPEC_CTRL MSRPaolo Bonzini
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Message-Id: <20180109154519.25634-3-ehabkost@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2018-01-17i386: Change X86CPUDefinition::model_id to const char*Eduardo Habkost
It is valid to have a 48-character model ID on CPUID, however the definition of X86CPUDefinition::model_id is char[48], which can make the compiler drop the null terminator from the string. If a CPU model happens to have 48 bytes on model_id, "-cpu help" will print garbage and the object_property_set_str() call at x86_cpu_load_def() will read data outside the model_id array. We could increase the array size to 49, but this would mean the compiler would not issue a warning if a 49-char string is used by mistake for model_id. To make things simpler, simply change model_id to be const char*, and validate the string length using an assert() on x86_register_cpudef_type(). Reported-by: "Dr. David Alan Gilbert" <dgilbert@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Message-Id: <20180109154519.25634-2-ehabkost@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2018-01-17target/i386: add clflushopt to "Skylake-Server" cpu modelHaozhong Zhang
CPUID_7_0_EBX_CLFLUSHOPT is missed in current "Skylake-Server" cpu model. Add it to "Skylake-Server" cpu model on pc-i440fx-2.12 and pc-q35-2.12. Keep it disabled in "Skylake-Server" cpu model on older machine types. Signed-off-by: Haozhong Zhang <haozhong.zhang@intel.com> Message-Id: <20171219033730.12748-3-haozhong.zhang@intel.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2018-01-17target-ppc: Fix booke206 tlbwe TLB instructionLuc MICHEL
When overwritting a valid TLB entry with a new one, the previous page were not flushed in QEMU TLB, leading to incoherent mapping. This commit fixes this. Signed-off-by: Luc MICHEL <luc.michel@git.antfield.fr> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2018-01-17target/ppc: add support for POWER9 HILECédric Le Goater
Signed-off-by: Cédric Le Goater <clg@kaod.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2018-01-17target/ppc: Clarify compat mode max_threads valueDavid Gibson
We recently had some discussions that were sidetracked for a while, because nearly everyone misapprehended the purpose of the 'max_threads' field in the compatiblity modes table. It's all about guest expectations, not host expectations or support (that's handled elsewhere). In an attempt to avoid a repeat of that confusion, rename the field to 'max_vthreads' and add an explanatory comment. Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Reviewed-by: Laurent Vivier <lvivier@redhat.com> Reviewed-by: Greg Kurz <groug@kaod.org> Reviewed-by: Jose Ricardo Ziviani <joserz@linux.vnet.ibm.com>
2018-01-17ppc: Change Power9 compat table to support at most 8 threads/coreJose Ricardo Ziviani
Increases the max smt mode to 8 for Power9. That's because KVM supports smt emulation in this platform so QEMU should allow users to use it as well. Today if we try to pass -smp ...,threads=8, QEMU will silently truncate it to smt4 mode and may cause a crash if we try to perform a cpu hotplug. Signed-off-by: Jose Ricardo Ziviani <joserz@linux.vnet.ibm.com> [dwg: Added an explanatory comment] Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2018-01-17target/ppc: Clean up probing of VMX, VSX and DFP availability on KVMDavid Gibson
When constructing the "host" cpu class we modify whether the VMX and VSX vector extensions and DFP (Decimal Floating Point) are available based on whether KVM can support those instructions. This can depend on policy in the host kernel as well as on the actual host cpu capabilities. However, the way we probe for this is not very nice: we explicitly check the host's device tree. That works in practice, but it's not really correct, since the device tree is a property of the host kernel's platform which we don't really know about. We get away with it because the only modern POWER platforms happen to encode VMX, VSX and DFP availability in the device tree in the same way. Arguably we should have an explicit KVM capability for this, but we haven't needed one so far. Barring specific KVM policies which don't yet exist, each of these instruction classes will be available in the guest if and only if they're available in the qemu userspace process. We can determine that from the ELF AUX vector we're supplied with. Once reworked like this, there are no more callers for kvmppc_get_vmx() and kvmppc_get_dfp() so remove them. Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Reviewed-by: Greg Kurz <groug@kaod.org>
2018-01-17target/ppc: Yet another fix for KVM-HV HPTE accessorsAlexey Kardashevskiy
As stated in the 1ad9f0a464fe commit log, the returned entries are not a whole PTEG. It was not a problem before 1ad9f0a464fe as it would read a single record assuming it contains a whole PTEG but now the code tries reading the entire PTEG and "if ((n - i) < invalid)" produces negative values which then are converted to size_t for memset() and that throws seg fault. This fixes the math. While here, fix the last @i increment as well. Fixes: 1ad9f0a464fe "target/ppc: Fix KVM-HV HPTE accessors" Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2018-01-16Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into stagingPeter Maydell
* QemuMutex tracing improvements (Alex) * ram_addr_t optimization (David) * SCSI fixes (Fam, Stefan, me) * do {} while (0) fixes (Eric) * KVM fix for PMU (Jan) * memory leak fixes from ASAN (Marc-André) * migration fix for HPET, icount, loadvm (Maria, Pavel) * hflags fixes (me, Tao) * block/iscsi uninitialized variable (Peter L.) * full support for GMainContexts in character devices (Peter Xu) * more boot-serial-test (Thomas) * Memory leak fix (Zhecheng) # gpg: Signature made Tue 16 Jan 2018 14:15:45 GMT # gpg: using RSA key 0xBFFBD25F78C7AE83 # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * remotes/bonzini/tags/for-upstream: (51 commits) scripts/analyse-locks-simpletrace.py: script to analyse lock times util/qemu-thread-*: add qemu_lock, locked and unlock trace events cpu: flush TB cache when loading VMState block/iscsi: fix initialization of iTask in iscsi_co_get_block_status find_ram_offset: Align ram_addr_t allocation on long boundaries find_ram_offset: Add comments and tracing cpu_physical_memory_sync_dirty_bitmap: Another alignment fix checkpatch: Enforce proper do/while (0) style maint: Fix macros with broken 'do/while(0); ' usage tests: Avoid 'do/while(false); ' in vhost-user-bridge chardev: Clean up previous patch indentation chardev: Use goto/label instead of do/break/while(0) mips: Tweak location of ';' in macros net: Drop unusual use of do { } while (0); irq: fix memory leak cpus: unify qemu_*_wait_io_event icount: fixed saving/restoring of icount warp timers scripts/qemu-gdb/timers.py: new helper to dump timer state scripts/qemu-gdb: add simple tcg lock status helper target-i386: update hflags on Hypervisor.framework ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-01-16maint: Fix macros with broken 'do/while(0); ' usageEric Blake
The point of writing a macro embedded in a 'do { ... } while (0)' loop (particularly if the macro has multiple statements or would otherwise end with an 'if' statement) is so that the macro can be used as a drop-in statement with the caller supplying the trailing ';'. Although our coding style frowns on brace-less 'if': if (cond) statement; else something else; that is the classic case where failure to use do/while(0) wrapping would cause the 'else' to pair with any embedded 'if' in the macro rather than the intended outer 'if'. But conversely, if the macro includes an embedded ';', then the same brace-less coding style would now have two statements, making the 'else' a syntax error rather than pairing with the outer 'if'. Thus, even though our coding style with required braces is not impacted, ending a macro with ';' makes our code harder to port to projects that use brace-less styles. The change should have no semantic impact. I was not able to fully compile-test all of the changes (as some of them are examples of the ugly bit-rotting debug print statements that are completely elided by default, and I didn't want to recompile with the necessary -D witnesses - cleaning those up is left as a bite-sized task for another day); I did, however, audit that for all files touched, all callers of the changed macros DID supply a trailing ';' at the callsite, and did not appear to be used as part of a brace-less conditional. Found mechanically via: $ git grep -B1 'while (0);' | grep -A1 \\\\ Signed-off-by: Eric Blake <eblake@redhat.com> Acked-by: Cornelia Huck <cohuck@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Message-Id: <20171201232433.25193-7-eblake@redhat.com> Reviewed-by: Juan Quintela <quintela@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-01-16mips: Tweak location of ';' in macrosEric Blake
It is more typical to provide the ';' by the caller of a macro than to embed it in the macro itself; this is because syntax highlight engines can get confused if a macro is called without a semicolon before the closing '}'. Signed-off-by: Eric Blake <eblake@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20171201232433.25193-3-eblake@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-01-16irq: fix memory leaklinzhecheng
entry is moved from list but is not freed. Signed-off-by: linzhecheng <linzhecheng@huawei.com> Message-Id: <20171225024704.19540-1-linzhecheng@huawei.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-01-16target-i386: update hflags on Hypervisor.frameworkPaolo Bonzini
This ensures that x86_cpu_dump_state shows registers with the correct size. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-01-16target/i386: hax: Move x86_update_hflags.Tao Wu
x86_update_hflags reference env->efer which is updated in hax_get_msrs, so it has to be called after hax_get_msrs. This fix the bug that sometimes dump_state show 32 bits regs even in 64 bits mode. Signed-off-by: Tao Wu <lepton@google.com> Message-Id: <20180110195056.85403-3-lepton@google.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-01-16target/i386: hax: change to use x86_update_hflagsTao Wu
Change to use x86_update_hflags instead of keeping another copy at hax side. This also fix bug like HF_CPL_MASK should be SS.DPL, not CS.DPL. Signed-off-by: Tao Wu <lepton@google.com> Message-Id: <20180110195056.85403-2-lepton@google.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-01-16target/i386: move hflags update code to a functionTao Wu
We will share the same code for hax/kvm. Signed-off-by: Tao Wu <lepton@google.com> Message-Id: <20180110195056.85403-1-lepton@google.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-01-16target/arm: Add fp16 support to vfp_expand_immRichard Henderson
Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20180110063337.21538-3-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-01-16target/arm: Split out vfp_expand_immRichard Henderson
Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20180110063337.21538-2-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-01-16target/arm: Handle page table walk load failures correctlyPeter Maydell
Instead of ignoring the response from address_space_ld*() (indicating an attempt to read a page table descriptor from an invalid physical address), use it to report the failure correctly. Since this is another couple of locations where we need to decide the value of the ARMMMUFaultInfo ea bit based on a MemTxResult, we factor out that operation into a helper function. Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-01-16get_phys_addr_pmsav7: Support AP=0b111 for v7MPeter Maydell
For PMSAv7, the v7A/R Arm ARM defines that setting AP to 0b111 is an UNPREDICTABLE reserved combination. However, for v7M this value is documented as having the same behaviour as 0b110: read-only for both privileged and unprivileged. Accept this value on an M profile core rather than treating it as a guest error and a no-access page. Reported-by: Andy Gross <andy.gross@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 1512742402-31669-1-git-send-email-peter.maydell@linaro.org
2018-01-12target/xtensa: Remove duplicate typedef of DisasContextPeter Maydell
Some older versions of gcc complain if a typedef is defined twice: target/xtensa/translate.c:81: error: redefinition of typedef 'DisasContext' target/xtensa/cpu.h:339: note: previous declaration of 'DisasContext' was here Remove the now-redundant typedef from the definition of the struct in translate.c. Reported-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1515762528-22818-1-git-send-email-peter.maydell@linaro.org
2018-01-12i386/cpu/kvm: look at PMU's CPUID before setting MSRsJan Dakinevich
Certain PMU-related MSRs are not supported for CPUs with PMU architecture below version 2. KVM rejects any access to them (see intel_is_valid_msr_idx routine in KVM), and QEMU fails on the following assertion: kvm_put_msrs: Assertion `ret == cpu->kvm_msr_buf->nmsrs' failed. QEMU also could fail if KVM exposes less fixed counters then 3. It could happen if host system run inside another hypervisor, which is tweaking PMU-related CPUID. To prevent possible fail, number of fixed counters now is obtained in the same way as number of GP counters. Reviewed-by: Roman Kagan <rkagan@virtuozzo.com> Signed-off-by: Jan Dakinevich <jan.dakinevich@virtuozzo.com> Message-Id: <1514383466-7257-1-git-send-email-jan.dakinevich@virtuozzo.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-01-11target/xtensa: add de212 coreMax Filippov
DE212 is a noMMU core supported in linux. Import this core to provide true noMMU configuration for xtensa linux to run on QEMU. Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
2018-01-11target/xtensa: fix default sysrom/sysram addressesMax Filippov
noMMU configs had wrong sysrom and sysram base addresses, fix them. Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
2018-01-11Merge remote-tracking branch ↵Peter Maydell
'remotes/pmaydell/tags/pull-target-arm-20180111' into staging target-arm queue: * add aarch64_be linux-user target * Virt: ACPI: fix qemu assert due to re-assigned table data address * imx_fec: various bug fixes and cleanups * hw/timer/pxa2xx_timer: replace hw_error() -> qemu_log_mask() * hw/sd/pxa2xx_mmci: add read/write() trace events * linux-user/arm/nwfpe: Check coprocessor number for FPA emulation * target/arm: Make disas_thumb2_insn() generate its own UNDEF exceptions * hw/intc/arm_gicv3: Make reserved register addresses RAZ/WI * hw/intc/arm_gic: reserved register addresses are RAZ/WI # gpg: Signature made Thu 11 Jan 2018 13:37:25 GMT # gpg: using RSA key 0x3C2525ED14360CDE # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" # gpg: aka "Peter Maydell <pmaydell@gmail.com>" # gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" # Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83 15CF 3C25 25ED 1436 0CDE * remotes/pmaydell/tags/pull-target-arm-20180111: (26 commits) hw/intc/arm_gic: reserved register addresses are RAZ/WI hw/intc/arm_gicv3: Make reserved register addresses RAZ/WI target/arm: Make disas_thumb2_insn() generate its own UNDEF exceptions linux-user/arm/nwfpe: Check coprocessor number for FPA emulation hw/sd/pxa2xx_mmci: add read/write() trace events hw/timer/pxa2xx_timer: replace hw_error() -> qemu_log_mask() imx_fec: Reserve full FSL_IMX25_FEC_SIZE page for the register file imx_fec: Fix a typo in imx_enet_receive() imx_fec: Use correct length for packet size imx_fec: Add support for multiple Tx DMA rings imx_fec: Emulate SHIFT16 in ENETx_RACC imx_fec: Use MIN instead of explicit ternary operator imx_fec: Use ENET_FTRL to determine truncation length imx_fec: Move Tx frame buffer away from the stack imx_fec: Change queue flushing heuristics imx_fec: Refactor imx_eth_enable_rx() imx_fec: Do not link to netdev Virt: ACPI: fix qemu assert due to re-assigned table data address target/arm: Fix stlxp for aarch64_be linux-user: Activate armeb handler registration ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-01-11target/arm: Make disas_thumb2_insn() generate its own UNDEF exceptionsPeter Maydell
Refactor disas_thumb2_insn() so that it generates the code for raising an UNDEF exception for invalid insns, rather than returning a flag which the caller must check to see if it needs to generate the UNDEF code. This brings the function in to line with the behaviour of disas_thumb_insn() and disas_arm_insn(). Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 1513080506-17703-1-git-send-email-peter.maydell@linaro.org
2018-01-11target/arm: Fix stlxp for aarch64_beMichael Weiser
ldxp loads two consecutive doublewords from memory regardless of CPU endianness. On store, stlxp currently assumes to work with a 128bit value and consequently switches order in big-endian mode. With this change it packs the doublewords in reverse order in anticipation of the 128bit big-endian store operation interposing them so they end up in memory in the right order. This makes it work for both MTTCG and !MTTCG. It effectively implements the ARM ARM STLXP operation pseudo-code: data = if BigEndian() then el1:el2 else el2:el1; With this change an aarch64_be Linux 4.14.4 kernel succeeds to boot up in system emulation mode. Signed-off-by: Michael Weiser <michael.weiser@gmx.de> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-01-11Merge remote-tracking branch 'remotes/dgibson/tags/ppc-for-2.12-20180111' ↵Peter Maydell
into staging ppc patch queue 2018-01-11 This pull request supersedes ppc-for-2.12-20180108 and several before it. The earlier pull request included a patch which exposed a bug in the ARM TCG backend. I've pulled that out and will repost once the ARM bug is fixed (a patch has been posted by Richard Henderson). Higlights from this series: * SLOF update * Several new devices for embedded platforms * Fix to correctly set compatiblity mode for hotplugged CPUs * dtc compile fix for older MacOS versions # gpg: Signature made Thu 11 Jan 2018 04:58:11 GMT # gpg: using RSA key 0x6C38CACA20D9B392 # gpg: Good signature from "David Gibson <david@gibson.dropbear.id.au>" # gpg: aka "David Gibson (Red Hat) <dgibson@redhat.com>" # gpg: aka "David Gibson (ozlabs.org) <dgibson@ozlabs.org>" # gpg: aka "David Gibson (kernel.org) <dwg@kernel.org>" # Primary key fingerprint: 75F4 6586 AE61 A66C C44E 87DC 6C38 CACA 20D9 B392 * remotes/dgibson/tags/ppc-for-2.12-20180111: spapr: Correct compatibility mode setting for hotplugged CPUs hw/ppc: Remove the deprecated spapr-pci-vfio-host-bridge device Update dtc to fix compilation problem on Mac OS 10.6 target/ppc: more use of the PPC_*() macros ppc/pnv: change powernv_ prefix to pnv_ for overall naming consistency hw/ide: Emulate SiI3112 SATA controller spapr_pci: use warn_report() ppc4xx_i2c: Implement basic I2C functions sm501: Add some more unimplemented registers sm501: Add panel hardware cursor registers also to read function pseries: Update SLOF firmware image to qemu-slof-20171214 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-01-11Merge remote-tracking branch 'remotes/mcayland/tags/qemu-sparc-signed' into ↵Peter Maydell
staging qemu-sparc update # gpg: Signature made Tue 09 Jan 2018 22:12:22 GMT # gpg: using RSA key 0x5BC2C56FAE0F321F # gpg: Good signature from "Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>" # Primary key fingerprint: CC62 1AB9 8E82 200D 915C C9C4 5BC2 C56F AE0F 321F * remotes/mcayland/tags/qemu-sparc-signed: (25 commits) sun4u_iommu: add trace event for IOMMU translations sun4u_iommu: convert from IOMMU_DPRINTF to trace-events sun4u_iommu: update to reflect IOMMU is no longer part of the APB device sun4u: split IOMMU device out from apb.c to sun4u_iommu.c apb: QOMify IOMMU sun4m: remove include/hw/sparc/sun4m.h and all references to it sun4m: move IOMMU declarations from sun4m.h to sun4m_iommu.h sun4m: move sun4m_iommu.c from hw/dma to hw/sparc sun4u: switch from EBUS_DPRINTF() macro to trace-events sparc64: introduce trace-events for hw/sparc64 apb: replace OBIO interrupt numbers in pci_pbmA_map_irq() with constants ebus: wire up OBIO interrupts to APB pbm via qdev GPIOs apb: remove busA property from PBMPCIBridge state apb: split pci_pbm_map_irq() into separate functions for bus A and bus B apb: remove pci_apb_init() and instantiate APB device using qdev apb: move the two secondary PCI bridges objects into APBState apb: use gpios to wire up the apb device to the SPARC CPU IRQs apb: return APBState from pci_apb_init() rather than PCIBus apb: APB QOMify tidy-up sun4u: move initialisation of all ISABus devices into ebus_realize() ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
generated by cgit v1.2.3 (git 2.26.2) at 2025-01-12 13:21:21 +0000