aboutsummaryrefslogtreecommitdiff
path: root/target
AgeCommit message (Collapse)AuthorFilesLines
2017-04-26target/ppc: Style fixesDavid Gibson1-186/+186
This makes a small step fixing one of many style problems that exist in the older ppc code. This removes spaces between function (or macro) name and the following '('. Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2017-04-26e500,book3s: mfspr 259: Register mapped/aliased SPRG3 user readBernhard Kaindl1-0/+10
This patch registers mfspr 259 for Book3S and e500 family cores following this research: mfspr 259 provides read-only mapped user access to SPRG3(SPR 275) according to: - PowerISA 2.02, Book III (documents implementation starting with POWER4+ @ p20) - IBM PowerPC 970MP RISC Microprocessor User's Manual v2.1, page 48 - Amit Singh: "Mac OS X Internals: A Systems Approach" on 970 and 970FX cores: He demonstrates mfspr 259 reading TLS data from Mac OS X on G5 on page 588 - NXP documents it in the Core Reference Manuals of: e500, e500mc and e5500 - getcpu() of the 32 & 64-bit Book3S Linux vDSOs use it to read the core number mfspr 259 does not appear to be implemented in these cores according to: - 74xx series: MPC7410/MPC7400 and MPC7450 RISC Microprocessor Reference Manuals - 4xx series: PPC440 Processor User's Manual, Revision 1.09 by AMCC - 750 series: IBM PowerPC 750CL RISC Microprocessor User's Manual - e200 series: e200z4 Power Architectureâ Core Reference Manual Implementation: gen_spr_usprg3() is called from init_proc_book3s_common() (covers the 970 and POWER cores) and init_proc_e500() (covers the e500 family) to register spr_read_ureg() in the same way which it already provides the mapped SPR access for SPR_USPRG4-7 in gen_spr_usprgh() for cores which have the same read-only mapped SPRG register access for SPRG4-7. Verified using Linux by pinning a thread to a core and checking sched_getcpu() using qemu-system-ppc64 -M pseries -cpu POWER8 using MTTCG on a x86_64 host. Signed-off-by: Bernhard Kaindl <bernhard.kaindl@thalesgroup.com> Reviewed-by: Stefan Resch <stefan.resch@thalesgroup.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2017-04-26target/ppc: Flush TLB on write to PIDRSuraj Jitindar Singh3-2/+17
The PIDR (process id register) is used to store the id of the currently running process, which is used to select the process table entry used to perform address translation. This means that when we write to this register all the translations in the TLB become outdated as they are for a previously running process. Thus when this register is written to we need to invalidate the TLB entries to ensure stale entries aren't used to to perform translation for the new process, which would result in at best segfaults or alternatively just random memory being accessed. Signed-off-by: Suraj Jitindar Singh <sjitindarsingh@gmail.com> Reviewed-by: David Gibson <david@gibson.dropbear.id.au> [dwg: Fixed compile error for 32-bit targets] Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2017-04-26target/ppc: Fix size of struct PPCElfPrstatusAnton Blanchard1-1/+1
gdb refuses to parse QEMU memory dumps because struct PPCElfPrstatus is the wrong size. Fix it. Signed-off-by: Anton Blanchard <anton@samba.org> Fixes: e62fbc54d459 ("target-ppc: dump-guest-memory support") Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2017-04-26ppc/xics: introduce an 'intc' backlink under PowerPCCPUCédric Le Goater1-0/+1
Today, the ICPState array of the sPAPR machine is indexed with 'cpu_index' of the CPUState. This numbering of CPUs is internal to QEMU and the guest only knows about what is exposed in the device tree, that is the 'cpu_dt_id'. This is why sPAPR uses the helper xics_get_cpu_index_by_dt_id() to do the mapping in a couple of places. To provide a more generic XICS layer, we need to abstract the IRQ 'server' number and remove any assumption made on its nature. It should not be used as a 'cpu_index' for lookups like xics_cpu_setup() and xics_cpu_destroy() do. To reach that goal, we choose to introduce a generic 'intc' backlink under PowerPCCPU, and let the machine core init routine do the ICPState lookup. The resulting object is passed on to xics_cpu_setup() which does the store under PowerPCCPU. The IRQ 'server' number in XICS is now generic. sPAPR uses 'cpu_dt_id' and PowerNV will use 'PIR' number. This also has the benefit of simplifying the sPAPR hcall routines which do not need to do any ICPState lookups anymore. Signed-off-by: Cédric Le Goater <clg@kaod.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2017-04-26target/ppc: Add ibm,processor-radix-AP-encodings for TCGSuraj Jitindar Singh1-0/+20
The ibm,processor-radix-AP-encodings device tree property of the cpu node is used to specify the radix mode supported page sizes of the processor to the guest os. Contained in the top 3 bits of the msb is the actual page size (AP) encoding associated with the corresponding radix mode supported page size. Add this property for a TCG guest, note the TCG code is capable of translating any format so just add the 4 default page sizes. The ibm,processor-radix-AP-encodings device tree property is defined as: One to n cells in ascending order of radix mode supported page sizes encoded as BE ints (32bit on ppc) in the form: 0bxxxyyyyyyyyyyyyyyyyyyyyyyyyyyyyy - 0bxxx -> AP encoding - 0byyyyyyyyyyyyyyyyyyyyyyyyyyyyy -> supported page size encoded as a shift Signed-off-by: Suraj Jitindar Singh <sjitindarsingh@gmail.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2017-04-26target-ppc/kvm: Enable in-kernel TCE acceleration for multi-tceAlexey Kardashevskiy2-0/+20
This enables in-kernel handling of H_PUT_TCE_INDIRECT and H_STUFF_TCE hypercalls. The host kernel support is there since v4.6, in particular d3695aa4f452 ("KVM: PPC: Add support for multiple-TCE hcalls"). H_PUT_TCE is already accelerated and does not need any special enablement. Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2017-04-26target/ppc: Implement H_REGISTER_PROCESS_TABLE H_CALLSuraj Jitindar Singh2-0/+41
The H_REGISTER_PROCESS_TABLE H_CALL is used by a guest to indicate to the hypervisor where in memory its process table is and how translation should be performed using this process table. Provide the implementation of this H_CALL for a guest. We first check for invalid flags, then parse the flags to determine the operation, and then check the other parameters for valid values based on the operation (register new table/deregister table/maintain registration). The process table is then stored in the appropriate location and registered with the hypervisor (if running under KVM), and the LPCR_[UPRT/GTSE] bits are updated as required. Signed-off-by: Suraj Jitindar Singh <sjitindarsingh@gmail.com> Signed-off-by: Sam Bobroff <sam.bobroff@au1.ibm.com> [dwg: Correct missing prototype and uninitialized variable] Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2017-04-26target-ppc: support KVM_CAP_PPC_MMU_RADIX, KVM_CAP_PPC_MMU_HASH_V3Sam Bobroff2-0/+26
Query and cache the value of two new KVM capabilities that indicate KVM's support for new radix and hash modes of the MMU. Signed-off-by: Sam Bobroff <sam.bobroff@au1.ibm.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2017-04-26spapr: Add ibm,processor-radix-AP-encodings to the device treeSam Bobroff3-0/+34
Use the new ioctl, KVM_PPC_GET_RMMU_INFO, to fetch radix MMU information from KVM and present the page encodings in the device tree under ibm,processor-radix-AP-encodings. This provides page size information to the guest which is necessary for it to use radix mode. Signed-off-by: Sam Bobroff <sam.bobroff@au1.ibm.com> [dwg: Compile fix for 32-bit targets, style nit fix] Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2017-04-26target-ppc: kvm: make use of KVM_CREATE_SPAPR_TCE_64Alexey Kardashevskiy2-16/+44
KVM_CAP_SPAPR_TCE capability allows creating TCE tables in KVM which allows having in-kernel acceleration for H_PUT_TCE_xxx hypercalls. However it only supports 32bit DMA windows at zero bus offset. There is a new KVM_CAP_SPAPR_TCE_64 capability which supports 64bit window size, variable page size and bus offset. This makes use of the new capability. The kernel headers are already updated as the kernel support went in to v4.6. Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2017-04-26target/ppc: Improve accuracy of guest HTM availability on P8sSam Bobroff1-2/+6
On Power8 hosts it is currently theoretically possible for QEMU/KVM-HV guests to receive a ibm,pa-features property indicating that HTM support is available when it is not. The situation would occur if the platform firmware of a Power8 host cleared the HTM bit of the ibm,pa-features property. QEMU would query KVM for the availability of HTM, which will return no support, but workaround code in kvm_arch_init_vcpu() would then re-enable it because KVM_HV is in use and the processor is P8. This patch adjusts the workaround in kvm_arch_init_vcpu() so that it does not enable HTM (in the above case) unless the host kernel indicates to the QEMU process, via the auxiliary vector, that userspace can use HTM (via the HWCAP2 bit KVM_FEATURE2_HTM). The reason to use the value from the auxiliary vector is that it is set based only on what the host kernel found in the ibm,pa-features HTM bit at boot time. Signed-off-by: Sam Bobroff <sam.bobroff@au1.ibm.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2017-04-25s390x/misc_helper.c: wrap s390_virtio_hypercall in BQLAurelien Jarno1-0/+2
s390_virtio_hypercall can trigger IO events and interrupts, most notably when using virtio-ccw devices. Reviewed-by: Alexander Graf <agraf@suse.de> Signed-off-by: Aurelien Jarno <aurelien@aurel32.net> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Fixes: 278f5e98c647 ("s390x/misc_helper.c: wrap IO instructions in BQL") Signed-off-by: Alexander Graf <agraf@suse.de>
2017-04-25target-s390x: Mask the SIGP order_code to 8bit.Philipp Kern1-1/+2
According to "CPU Signaling and Response", "Signal-Processor Orders", the order field is bit position 56-63. Without this, the Linux guest kernel is sometimes unable to stop emulation and enters an infinite loop of "XXX unknown sigp: 0xffffffff00000005". Signed-off-by: Philipp Kern <phil@philkern.de> Reviewed-by: Thomas Huth <thuth@tuxfamily.org> [agraf: add comment according to email] Signed-off-by: Alexander Graf <agraf@suse.de>
2017-04-21Merge remote-tracking branch 'remotes/cohuck/tags/s390x-20170421' into stagingPeter Maydell2-10/+10
The first batch of s390x changes for 2.10: - the new compat machine - several cleanups and optimizations - introspection for css ids # gpg: Signature made Fri 21 Apr 2017 08:36:25 BST # gpg: using RSA key 0xDECF6B93C6F02FAF # gpg: Good signature from "Cornelia Huck <huckc@linux.vnet.ibm.com>" # gpg: aka "Cornelia Huck <cornelia.huck@de.ibm.com>" # Primary key fingerprint: C3D0 D66D C362 4FF6 A8C0 18CE DECF 6B93 C6F0 2FAF * remotes/cohuck/tags/s390x-20170421: s390x: Drop useless casts s390x: register I/O adapters per ISC during init s390x/flic: cache flic in s390_get_flic s390x: initialize flic before I/O subsystems s390x: use enum for adapter type and standardize its naming s390x/css: consolidate the devno property for ccw devices s390x/css: provide introspection for virtual subchannel and device busid s390x/css: introduce read-only property type for device ids s390x/pci: make printf always compile in debug output s390x/kvm: make printf always compile in debug output s390x: introduce 2.10 compat machine Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-04-21Merge remote-tracking branch 'remotes/armbru/tags/pull-qdev-2017-04-21' into ↵Peter Maydell1-10/+0
staging qdev patches for 2017-04-21 # gpg: Signature made Fri 21 Apr 2017 06:37:19 BST # gpg: using RSA key 0x3870B400EB918653 # gpg: Good signature from "Markus Armbruster <armbru@redhat.com>" # gpg: aka "Markus Armbruster <armbru@pond.sub.org>" # Primary key fingerprint: 354B C8B3 D7EB 2A6B 6867 4E5F 3870 B400 EB91 8653 * remotes/armbru/tags/pull-qdev-2017-04-21: qdev: remove cannot_destroy_with_object_finalize_yet versatile: remove cannot_destroy_with_object_finalize_yet ppc: remove cannot_destroy_with_object_finalize_yet arm: remove remaining cannot_destroy_with_object_finalize_yet Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-04-21s390x: Drop useless castsEric Blake1-2/+2
An upcoming Coccinelle cleanup script wanted to reformat the casts present in this file - but on closer look, we don't need the casts at all because C automatically converts void* to any other pointer. Signed-off-by: Eric Blake <eblake@redhat.com> Message-Id: <20170405194741.18956-4-eblake@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
2017-04-21s390x/kvm: make printf always compile in debug outputDanil Antonov1-8/+8
Wrapped printf calls inside debug macros (DPRINTF) in `if` statement. This will ensure that printf function will always compile even if debug output is turned off and, in turn, will prevent bitrot of the format strings. Signed-off-by: Danil Antonov <g.danil.anto@gmail.com> Message-Id: <CA+KKJYAhsuTodm3s2rK65hR=-Xi5+Z7Q+M2nJYZQf2wa44HfOg@mail.gmail.com> Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
2017-04-21ppc: remove cannot_destroy_with_object_finalize_yetLaurent Vivier1-10/+0
This removes the assert(kvm_enabled()) from kvmppc_host_cpu_initfn() This assert can never be triggered as the function is only registered when KVM is available (see also 4c315c2 "qdev: Protect device-list-properties against broken devices"). So we can remove the cannot_destroy_with_object_finalize_yet from kvmppc_host_cpu_class_init() without fear and beyond reproach. (as it has already be done for i386 with 771a13e "i386: Unset cannot_destroy_with_object_finalize_yet on "host" model" and e435601 "target-i386: Remove assert(kvm_enabled()) from host_x86_cpu_initfn()") Signed-off-by: Laurent Vivier <lvivier@redhat.com> Message-Id: <20170414083717.13641-3-lvivier@redhat.com> Acked-by: Peter Maydell <peter.maydell@linaro.org> Acked-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Markus Armbruster <armbru@redhat.com>
2017-04-20arm: Remove workarounds for old M-profile exception return implementationPeter Maydell2-49/+2
Now that we've rewritten M-profile exception return so that the magic PC values are not visible to other parts of QEMU, we can delete the special casing of them elsewhere. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <rth@twiddle.net> Message-id: 1491844419-12485-10-git-send-email-peter.maydell@linaro.org
2017-04-20arm: Implement M profile exception return properlyPeter Maydell2-6/+64
On M profile, return from exceptions happen when code in Handler mode executes one of the following function call return instructions: * POP or LDM which loads the PC * LDR to PC * BX register and the new PC value is 0xFFxxxxxx. QEMU tries to implement this by not treating the instruction specially but then catching the attempt to execute from the magic address value. This is not ideal, because: * there are guest visible differences from the architecturally specified behaviour (for instance jumping to 0xFFxxxxxx via a different instruction should not cause an exception return but it will in the QEMU implementation) * we have to account for it in various places (like refusing to take an interrupt if the PC is at a magic value, and making sure that the MPU doesn't deny execution at the magic value addresses) Drop these hacks, and instead implement exception return the way the architecture specifies -- by having the relevant instructions check for the magic value and raise the 'do an exception return' QEMU internal exception immediately. The effect on the generated code is minor: bx lr, old code (and new code for Thread mode): TCG: mov_i32 tmp5,r14 movi_i32 tmp6,$0xfffffffffffffffe and_i32 pc,tmp5,tmp6 movi_i32 tmp6,$0x1 and_i32 tmp5,tmp5,tmp6 st_i32 tmp5,env,$0x218 exit_tb $0x0 set_label $L0 exit_tb $0x7f2aabd61993 x86_64 generated code: 0x7f2aabe87019: mov %ebx,%ebp 0x7f2aabe8701b: and $0xfffffffffffffffe,%ebp 0x7f2aabe8701e: mov %ebp,0x3c(%r14) 0x7f2aabe87022: and $0x1,%ebx 0x7f2aabe87025: mov %ebx,0x218(%r14) 0x7f2aabe8702c: xor %eax,%eax 0x7f2aabe8702e: jmpq 0x7f2aabe7c016 bx lr, new code when in Handler mode: TCG: mov_i32 tmp5,r14 movi_i32 tmp6,$0xfffffffffffffffe and_i32 pc,tmp5,tmp6 movi_i32 tmp6,$0x1 and_i32 tmp5,tmp5,tmp6 st_i32 tmp5,env,$0x218 movi_i32 tmp5,$0xffffffffff000000 brcond_i32 pc,tmp5,geu,$L1 exit_tb $0x0 set_label $L1 movi_i32 tmp5,$0x8 call exception_internal,$0x0,$0,env,tmp5 x86_64 generated code: 0x7fe8fa1264e3: mov %ebp,%ebx 0x7fe8fa1264e5: and $0xfffffffffffffffe,%ebx 0x7fe8fa1264e8: mov %ebx,0x3c(%r14) 0x7fe8fa1264ec: and $0x1,%ebp 0x7fe8fa1264ef: mov %ebp,0x218(%r14) 0x7fe8fa1264f6: cmp $0xff000000,%ebx 0x7fe8fa1264fc: jae 0x7fe8fa126509 0x7fe8fa126502: xor %eax,%eax 0x7fe8fa126504: jmpq 0x7fe8fa122016 0x7fe8fa126509: mov %r14,%rdi 0x7fe8fa12650c: mov $0x8,%esi 0x7fe8fa126511: mov $0x56095dbeccf5,%r10 0x7fe8fa12651b: callq *%r10 which is a difference of one cmp/branch-not-taken. This will be lost in the noise of having to exit generated code and look up the next TB anyway. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <rth@twiddle.net> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 1491844419-12485-9-git-send-email-peter.maydell@linaro.org
2017-04-20arm: Track M profile handler mode state in TB flagsPeter Maydell3-0/+11
For M profile exception-return handling we'd like to generate different code for some instructions depending on whether we are in Handler mode or Thread mode. This isn't the same as "are we privileged or user", so we need an extra bit in the TB flags to distinguish. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <rth@twiddle.net> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 1491844419-12485-8-git-send-email-peter.maydell@linaro.org
2017-04-20arm: Abstract out "are we singlestepping" test to utility functionPeter Maydell1-5/+15
We now test for "are we singlestepping" in several places and it's not a trivial check because we need to care about both architectural singlestep and QEMU gdbstub singlestep. We're also about to add another place that needs to make this check, so pull the condition out into a function. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <rth@twiddle.net> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 1491844419-12485-7-git-send-email-peter.maydell@linaro.org
2017-04-20arm: Move condition-failed codepath generation out of if()Peter Maydell1-13/+11
Move the code to generate the "condition failed" instruction codepath out of the if (singlestepping) {} else {}. This will allow adding support for handling a new is_jmp type which can't be neatly split into "singlestepping case" versus "not singlestepping case". Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <rth@twiddle.net> Message-id: 1491844419-12485-6-git-send-email-peter.maydell@linaro.org
2017-04-20arm: Move gen_set_condexec() and gen_set_pc_im() up in the filePeter Maydell1-16/+15
Move the utility routines gen_set_condexec() and gen_set_pc_im() up in the file, as we will want to use them from a function placed earlier in the file than their current location. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <rth@twiddle.net> Message-id: 1491844419-12485-5-git-send-email-peter.maydell@linaro.org
2017-04-20arm: Factor out "generate right kind of step exception"Peter Maydell1-12/+16
We currently have two places that do: if (dc->ss_active) { gen_step_complete_exception(dc); } else { gen_exception_internal(EXCP_DEBUG); } Factor this out into its own function, as we're about to add a third place that needs the same logic. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <rth@twiddle.net> Message-id: 1491844419-12485-4-git-send-email-peter.maydell@linaro.org
2017-04-20arm: Thumb shift operations should not permit interworking branchesPeter Maydell1-1/+1
In Thumb mode, the only instructions which can cause an interworking branch by writing the PC are BLX, BX, BXJ, LDR, POP and LDM. Unlike ARM mode, data processing instructions which target the PC do not cause interworking branches. When we added support for doing interworking branches on writes to PC from data processing instructions in commit 21aeb3430ce7ba, we accidentally changed a Thumb instruction to have interworking branch behaviour for writes to PC. (MOV, MOVS register-shifted register, encoding T2; this is the standard encoding for LSL/LSR/ASR/ROR (register).) For this encoding, behaviour with Rd == R15 is specified as UNPREDICTABLE, so allowing an interworking branch is within spec, but it's confusing and differs from our handling of this class of UNPREDICTABLE for other Thumb ALU operations. Make it perform a simple (non-interworking) branch like the others. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <rth@twiddle.net> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 1491844419-12485-3-git-send-email-peter.maydell@linaro.org
2017-04-20arm: Don't implement BXJ on M-profile CPUsPeter Maydell1-1/+6
For M-profile CPUs, the BXJ instruction does not exist at all, and the encoding should always UNDEF. We were accidentally implementing it to behave like A-profile BXJ; correct the error. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <rth@twiddle.net> Message-id: 1491844419-12485-2-git-send-email-peter.maydell@linaro.org
2017-04-20arm/kvm: Remove trailing newlines from error_report()Ishani Chugh1-2/+2
Signed-off-by: Ishani Chugh <chugh.ishani@research.iiit.ac.in> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Message-id: 1491629987-6826-1-git-send-email-chugh.ishani@research.iiit.ac.in Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-04-20target/arm: Add assertion about FSC format for syndrome registersPeter Maydell1-5/+18
In tlb_fill() we construct a syndrome register value from a fault status register value which is filled in by arm_tlb_fill(). arm_tlb_fill() returns FSR values which might be in the format used with short-format page descriptors, or the format used with long-format (LPAE) descriptors. The syndrome register always uses LPAE-format FSR status codes. It isn't actually possible to end up delivering a syndrome register value to the guest for a fault which is reported with a short-format FSR (that kind of stage 1 fault will only happen for an AArch32 translation regime which doesn't have a syndrome register, and can never be redirected to an AArch64 or Hyp exception level). Add an assertion which checks this, and adjust the code so that we construct a syndrome with an invalid status code, rather than allowing set bits in the FSR input to randomly corrupt other fields in the syndrome. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Message-id: 1491486152-24304-1-git-send-email-peter.maydell@linaro.org
2017-04-20arm: Move excnames[] array into arm_log_exceptions()Peter Maydell3-24/+20
The excnames[] array is defined in internals.h because we used to use it from two different source files for handling logging of AArch32 and AArch64 exception entry. Refactoring means that it's now used only in arm_log_exception() in helper.c, so move the array into that function. Suggested-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 1491821097-5647-1-git-send-email-peter.maydell@linaro.org
2017-04-20target/arm: Add missing entries to excnames[] for log stringsPeter Maydell2-0/+3
Recent changes have added new EXCP_ values to ARM but forgot to update the excnames[] array which is used to provide human-readable strings when printing information about the exception for debug logging. Add the missing entries, and add a comment to the list of #defines to help avoid the mistake being repeated in future. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Message-id: 1491486340-25988-1-git-send-email-peter.maydell@linaro.org
2017-04-10target/i386/misc_helper: wrap BQL around another IRQ generatorAlex Bennée1-0/+3
Anything that calls into HW emulation must be protected by the BQL. Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <rth@twiddle.net> Acked-by: Eduardo Habkost <ehabkost@redhat.com>
2017-04-02target-i386: fix "info lapic" segfault on isapcTejaswini Poluri1-0/+4
Start QEMU with "qemu-system-x86_64 -nographic -M isapc -serial none-monitor stdio" and enter "info lapic" at the monitor prompt ⇒ Segmentation fault Signed-off-by: Tejaswini Poluri <tejaswinipoluri3@gmail.com> Message-Id: <1490685583-16987-1-git-send-email-tejaswinipoluri3@gmail.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-03-31hmp: fix "dump-quest-memory" segfaultIwona Kotlarska1-2/+1
Running QEMU with "qemu-system-x86_64 -M none -nographic -m 256" and executing "dump-guest-memory /dev/null 0 8192" results in segfault. Fix by checking if we have CPU. Signed-off-by: Iwona Kotlarska <iwona260909@gmail.com> Message-Id: <20170330050924.22134-1-iwona260909@gmail.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Marcel Apfelbaum <marcel@redhat.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Fixed up title
2017-03-28i386: Don't override -cpu options on -cpu host/maxEduardo Habkost2-4/+11
The existing code for "host" and "max" CPU models overrides every single feature in the CPU object at realize time, even the ones that were explicitly enabled or disabled by the user using "feat=on" or "feat=off", while features set using +feat/-feat are kept. This means "-cpu host,+invtsc" works as expected, while "-cpu host,invtsc=on" doesn't. This was a known bug, already documented in a comment inside x86_cpu_expand_features(). What makes this bug worse now is that libvirt 3.0.0 and newer now use "feat=on|off" instead of +feat/-feat when it detects a QEMU version that supports it (see libvirt commit d47db7b16dd5422c7e487c8c8ee5b181a2f9cd66). Change the feature property getter/setter to set a env->user_features field, to keep track of features that were explicitly changed using QOM properties. Then make the max_features code not override user features when handling "-cpu host" and "-cpu max". This will also allow us to remove the plus_features/minus_features hack in the future, but I plan to do that after 2.9.0 is released. Reported-by: Jiri Denemark <jdenemar@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Message-Id: <20170327144815.8043-3-ehabkost@redhat.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com> Tested-by: Jiri Denemark <jdenemar@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2017-03-28i386: Replace uint32_t* with FeatureWord on feature getter/setterEduardo Habkost1-8/+11
Instead of passing a pointer to the feature property getter and setter functions, pass a FeatureWord enum so they can perform other actions related to the feature flag. This will be used to add a new "user_features" field to keep track of features that were explicitly set by the user. Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Message-Id: <20170327144815.8043-2-ehabkost@redhat.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com> Tested-by: Jiri Denemark <jdenemar@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2017-03-24tcg/i386: Check the size of instruction being translatedPranith Kumar1-0/+7
This fixes the bug: 'user-to-root privesc inside VM via bad translation caching' reported by Jann Horn here: https://bugs.chromium.org/p/project-zero/issues/detail?id=1122 Reviewed-by: Richard Henderson <rth@twiddle.net> CC: Peter Maydell <peter.maydell@linaro.org> CC: Paolo Bonzini <pbonzini@redhat.com> Reported-by: Jann Horn <jannh@google.com> Signed-off-by: Pranith Kumar <bobby.prani@gmail.com> Message-Id: <20170323175851.14342-1-bobby.prani@gmail.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-03-23target/s390x: Fix broken user modeStefan Weil1-2/+0
Returning NULL from get_max_cpu_model results in a SIGSEGV runtime error. Signed-off-by: Stefan Weil <sw@weilnetz.de> Reviewed-by: David Hildenbrand <david@redhat.com> Message-Id: <20170130131517.8092-1-sw@weilnetz.de> Cc: qemu-stable@nongnu.org Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com> Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
2017-03-20Merge remote-tracking branch 'remotes/yongbok/tags/mips-20170320' into stagingPeter Maydell3-73/+79
MIPS patches 2017-03-20 Changes: * Fix clang warnings * Fix delay slot detection in gen_msa_branch() * Fix rc4030 interval timer * Fix rc4030 to tranlate memory accesses only when they occur * Fix 4c4030 a mixed declarations and code warning * Update MAINTAINERS file # gpg: Signature made Mon 20 Mar 2017 12:46:01 GMT # gpg: using RSA key 0x2238EB86D5F797C2 # gpg: Good signature from "Yongbok Kim <yongbok.kim@imgtec.com>" # gpg: WARNING: This key is not certified with sufficiently trusted signatures! # gpg: It is not certain that the signature belongs to the owner. # Primary key fingerprint: 8600 4CF5 3415 A5D9 4CFA 2B5C 2238 EB86 D5F7 97C2 * remotes/yongbok/tags/mips-20170320: MAINTAINERS: update for MIPS devices dma/rc4030: fix a mixed declarations and code warning dma/rc4030: translate memory accesses only when they occur dma: rc4030: limit interval timer reload value target/mips: fix delay slot detection in gen_msa_branch() target-mips: replace few LOG_DISAS() with trace points target-mips: replace break by goto cp0_unimplemented target-mips: log bad coprocessor0 register accesses with LOG_UNIMP target-mips: remove old & unuseful comments target-mips: fix compiler warnings (clang 5) Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-03-20arm: Fix APSR writes via M profile MSRPeter Maydell2-5/+24
Our implementation of writes to the APSR for M-profile via the MSR instruction was badly broken. First and worst, we had the sense wrong on the test of bit 2 of the SYSm field -- this is supposed to request an APSR write if bit 2 is 0 but we were doing it if bit 2 was 1. This bug was introduced in commit 58117c9bb429cd, so hasn't been in a QEMU release. Secondly, the choice of exactly which parts of APSR should be written is defined by bits in the 'mask' field. We were not passing these through from instruction decode, making it impossible to check them in the helper. Pass the mask bits through from the instruction decode to the helper function and process them appropriately; fix the wrong sense of the SYSm bit 2 check. Invalid mask values and invalid combinations of mask and register number are UNPREDICTABLE; we choose to treat them as if the mask values were valid. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1487616072-9226-5-git-send-email-peter.maydell@linaro.org Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
2017-03-20arm: Enforce should-be-1 bits in MRS decodingPeter Maydell1-0/+14
The MRS instruction requires that bits [19..16] are all 1s, and for A/R profile also that bits [7..0] are all 0s. At this point in the decode tree we have checked all of the rest of the instruction but were allowing these to be any value. If these bits are not set then the result is architecturally UNPREDICTABLE, but choosing to UNDEF is more helpful to the user and avoids unexpected odd behaviour if the encodings are used for some purpose in future architecture versions. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Message-id: 1487616072-9226-4-git-send-email-peter.maydell@linaro.org
2017-03-20arm: Don't decode MRS(banked) or MSR(banked) for M profilePeter Maydell1-2/+4
M profile doesn't have the MSR(banked) and MRS(banked) instructions and uses the encodings for different kinds of M-profile MRS/MSR. Guard the relevant bits of the decode logic to make sure we don't accidentally fall into them by accident on M-profile. (The bit being checked for this (bit 5) is part of the SYSm field on M-profile, but since no currently allocated system registers have encodings with bit 5 of SYSm set, this hasn't been a problem in practice.) Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Message-id: 1487616072-9226-3-git-send-email-peter.maydell@linaro.org
2017-03-20arm: HVC and SMC encodings don't exist for M profilePeter Maydell1-0/+3
M profile doesn't have the HVC or SMC encodings, so make them always UNDEF rather than generating calls to helper functions that assume A/R profile. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Message-id: 1487616072-9226-2-git-send-email-peter.maydell@linaro.org
2017-03-20target/mips: fix delay slot detection in gen_msa_branch()Yongbok Kim1-1/+1
It is unnecessary to test R6 from delay/forbidden slot check in gen_msa_branch(). https://bugs.launchpad.net/qemu/+bug/1663287 Reported-by: Brian Campbell <bacam@z273.org.uk> Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
2017-03-20target-mips: replace few LOG_DISAS() with trace pointsPhilippe Mathieu-Daudé2-14/+16
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Yongbok Kim <yongbok.kim@imgtec.com> Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
2017-03-20target-mips: replace break by goto cp0_unimplementedPhilippe Mathieu-Daudé1-44/+44
this fixes many warnings like: target/mips/translate.c:6253:13: warning: Value stored to 'rn' is never read rn = "invalid sel"; ^ ~~~~~~~~~~~~~ Reported-by: Clang Static Analyzer Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Yongbok Kim <yongbok.kim@imgtec.com> Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
2017-03-20target-mips: log bad coprocessor0 register accesses with LOG_UNIMPPhilippe Mathieu-Daudé1-6/+6
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Yongbok Kim <yongbok.kim@imgtec.com> Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
2017-03-20target-mips: remove old & unuseful commentsPhilippe Mathieu-Daudé1-4/+0
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Yongbok Kim <yongbok.kim@imgtec.com> Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
2017-03-20target-mips: fix compiler warnings (clang 5)Philippe Mathieu-Daudé1-4/+12
static code analyzer complain: target/mips/helper.c:453:5: warning: Function call argument is an uninitialized value qemu_log_mask(CPU_LOG_MMU, ^~~~~~~~~~~~~~~~~~~~~~~~~~ 'physical' and 'prot' are uninitialized if 'ret' is not TLBRET_MATCH. Reported-by: Clang Static Analyzer Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Yongbok Kim <yongbok.kim@imgtec.com> Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
generated by cgit v1.1 at 2024-07-16 14:33:28 +0000