Since commit fd4bab10 PC is restored in case of exception through code
retranslation. While it is clearly the thing to do in case it is not
not known if an helper is going to trigger an exception or not
(e.g. for load/store, FPU, etc.), it just make things slower when the
exception is already known at translation time.

Partially revert this commit and save PC in the TCG code. Set bstate to
BS_BRANCH to not generate TCG exit code. Micro-optimize the sleep
helper. Make all the exception helpers to call raise_exception and mark
it as noreturn.
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

gen_clr_t() and gen_set_t() have very few callers and can be remplaced
by a single line. Remove them.
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

It's possible swap the two 16-bit words of a 32-bit register using a
rotation. If the TCG target doesn't implement rotation, the replacement
code is similar to the previously implemented code.
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

The register being 32 bit long, after a shift to the right by 16 bits,
the upper 16 bit are already cleared. There is no need to call ext16u
to clear them.
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

addv and subv helpers implementation is directly copied from the SH4
manual and looks quite complex. It is however possible to explain it
without branches, and is therefore possible to implement it with TCG.
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

Now that setcond is available, the addc and subc can easily be
implemented using TCG.
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

There is no need to add a SH4 specific pickNaNMulAdd() to softfloat as
SH4 is always returning a default NaN.
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

Unconditional gen_check_loop_end at the end of disas_xtensa_insn
can emit tcg_gen_goto_tb with slot id already used in the TB (e.g. when
TB ends at LEND with a branch).
Signed-off-by: NMax Filippov <jcmvbkbc@gmail.com>
Cc: qemu-stable <qemu-stable@nongnu.org>
Signed-off-by: Nmalc <av1474@comtv.ru>

extui opcode only uses lowermost op1 bit for sa4.
Reported-by: Nmalc <av1474@comtv.ru>
Signed-off-by: NMax Filippov <jcmvbkbc@gmail.com>
Cc: qemu-stable <qemu-stable@nongnu.org>
Signed-off-by: Nmalc <av1474@comtv.ru>

Commit e31b0a7c fixed copy propagation on
32-bit host by restricting the copy between different types. This was the
wrong fix.

The real problem is that the all temps states should be reset at the end
of a basic block. This was done by adding such operations in the switch,
but brcond2 was forgotten (that's why the crash was only observed on 32-bit
hosts).

Fix that by looking at the TCG_OPF_BB_END instead. We need to keep the case
for op_set_label as temps might be modified through another path.

Cc: Blue Swirl <blauwirbel@gmail.com>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

Implements all of the COP2 instructions except for the S<cond>
family of comparisons.  The documentation is unclear for those.
Signed-off-by: NRichard Henderson <rth@twiddle.net>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

this will prevent some of the compilation errors with debugging
enabled from creeping back in.
Signed-off-by: NRichard Henderson <rth@twiddle.net>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

The macro uses the DisasContext.  Pass it around as needed.
Signed-off-by: NRichard Henderson <rth@twiddle.net>
Acked-by: NAurelien Jarno <aurelien@aurel32.net>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

Used by MIPS_DEBUG, when enabled.
Signed-off-by: NRichard Henderson <rth@twiddle.net>
Acked-by: NAurelien Jarno <aurelien@aurel32.net>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

Drop the private reimplementation of ctz32() from pflash_cfi0[12]
in favour of using the standard version from host-utils.h.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Reviewed-by: NStefan Weil <sw@weilnetz.de>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

pflash_cfi01 announces a version number of 1.1, which implies
"Protection Register Information" and "Burst Read information"
sections, which are not provided.

Decrease the version number to 1.0 so that only the "Protection
Register Information" section is needed.

Set the number of protection fields (0x3f) to 0x01, as 0x00 means 256
protections field, which makes the CFI table bigger than the current
implementation, causing some kernels to fail to read it.
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

Given the copy propagation breakage on 32-bit hosts has been fixed
commit e31b0a7c can be reverted.

Cc: Blue Swirl <blauwirbel@gmail.com>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

set_label is effectively the end of a basic block, as no optimization
can be made accross it. It was treated as such in the liveness analysis
code, but as a special case.

Mark it with TCG_OPF_BB_END flag so that this information can be used
by other parts of the TCG code, and remove the special case in the liveness
analysis code.

Cc: Blue Swirl <blauwirbel@gmail.com>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

On x86, it is possible to move a constant value to memory. Add code to
handle a constant argument to load/store ops.
Reviewed-by: NRichard Henderson <rth@twiddle.net>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

There was a missing include of qemu-log and a variable name in a printf was out
of date.
Signed-off-by: NChris Wulff <crwulff@gmail.com>
Signed-off-by: NPeter A. G. Crosthwaite <peter.crosthwaite@petalogix.com>

These names were incorrect. Fixed to match to actual link names
Signed-off-by: NPeter A. G. Crosthwaite <peter.crosthwaite@petalogix.com>

Assert that the ethernet and dma controller are sucessfully linked to their
peers.
Signed-off-by: NPeter A. G. Crosthwaite <peter.crosthwaite@petalogix.com>

The "frequency" qdev prop matches the "clock-frequency" property in Xilinx EDK.
Renamed "frequency" -> "clock-frequency" accordingly.
Signed-off-by: NPeter A. G. Crosthwaite <peter.crosthwaite@petalogix.com>

Signed-off-by: NPeter A. G. Crosthwaite <peter.crosthwaite@petalogix.com>

Fixes an error in a61e4b07Signed-off-by: NPeter A. G. Crosthwaite <peter.crosthwaite@petalogix.com>

For architectures which don't set HAS_AUDIO_CHOICE, improve the
'-soundhw help' message so that it doesn't simply print an empty
list, implying no sound support at all.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: Nmalc <av1474@comtv.ru>

* kiszka/queues/slirp:
  slirp: Implement TFTP Blocksize option
  slirp: Remove unused return value of tftp_send_next_block
  slirp: Handle more than 65535 blocks in TFTP transfers
  slirp: improve TFTP performance
  slirp: Fix error reported by static code analysis
  slirp: Remove wrong type casts ins debug statements

* kwolf/for-anthony:
  block: Don't forget to delete temporary file
  Don't require encryption password for 'qemu-img info' command
  qemu-img: Add json output option to the info command.
  qapi: Add SnapshotInfo and ImageInfo.
  ahci: properly reset PxCMD on HBA reset
  block: fix block tray status
  vdi: Fix warning from clang
  block/curl: Fix wrong free statement
  ide: Fix error messages from static code analysis (no real error)
  ATAPI: STARTSTOPUNIT only eject/load media if powercondition is 0
  sheepdog: fix savevm and loadvm

* stefanha/trivial-patches:
  configure: fix seccomp check
  arch_init.c: add missing '%' symbols before PRIu64 in debug printfs
  kvm: Fix warning from static code analysis
  qapi: Fix enumeration typo error
  console: Clean up bytes per pixel calculation
  Fix copy&paste typos in documentation comments
  linux-user: Remove #if 0'd cpu_get_real_ticks() definition
  ui: Fix spelling in comment (ressource -> resource)
  Spelling fixes in comments and macro names (ressource -> resource)
  Fix spelling (licenced -> licensed) in GPL
  Spelling fixes in comments and documentation
  srp: Don't use QEMU_PACKED for single elements of a structured type

* spice/spice.v60:
  hw/qxl: support client monitor configuration via device
  qxl: add trace-event for QXL_IO_LOG
  hw/qxl: tracing fixes
  qxl: better cleanup for surface destroy
  qxl: Ignore set_client_capabilities pre/post migrate
  qxl: dont update invalid area
  spice: send updates only for changed screen content
  spice: add screen mirror
  spice: split qemu_spice_create_update
  spice: switch to queue for vga mode updates

* stefanha/net:
  net: EAGAIN handling for net/socket.c TCP
  net: EAGAIN handling for net/socket.c UDP
  net: asynchronous send/receive infrastructure for net/socket.c
  net: broadcast hub packets if at least one port can receive
  net: fix usbnet_receive() packet drops
  net: clean up usbnet_receive()
  net: add -netdev options to man page
  net: do not report queued packets as sent
  net: add receive_disabled logic to iov delivery path
  eepro100: Fix network hang when rx buffers run out
  xen: flush queue when getting an event
  e1000: flush queue whenever can_receive can go from false to true
  net: notify iothread after flushing queue

* qemu-kvm/uq/master:
  kvm: Rename irqchip_inject_ioctl to irq_set_ioctl
  kvm: Stop flushing coalesced MMIO on vmexit
  VGA: Flush coalesced MMIO on related MMIO/PIO accesses
  memory: Flush coalesced MMIO on mapping and state changes
  memory: Fold memory_region_update_topology into memory_region_transaction_commit
  memory: Use transaction_begin/commit also for single-step operations
  memory: Flush coalesced MMIO on selected region access
  kvm-all.c: Move init of irqchip_inject_ioctl out of kvm_irqchip_create()
  update-linux-headers.sh: Don't hard code list of architectures

This reverts commit 66d5499b.

This commit broke --target-list="x86_64-softmmu" and the fix isn't immediatley
obvious.
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

cpu_physical_memory_write_rom(), despite the name, can also be used to
write images into RAM - and will often be used that way if the machine
uses load_image_targphys() into RAM addresses.

However, cpu_physical_memory_write_rom(), unlike cpu_physical_memory_rw()
doesn't invalidate any cached TBs which might be affected by the region
written.

This was breaking reset (under full emu) on the pseries machine - we loaded
our firmware image into RAM, and while executing it rewrite the code at
the entry point (correctly causing a TB invalidate/refresh).  When we
reset the firmware image was reloaded, but the TB from the rewrite was
still active and caused us to get an illegal instruction trap.

This patch fixes the bug by duplicating the tb invalidate code from
cpu_physical_memory_rw() in cpu_physical_memory_write_rom().
Signed-off-by: NDavid Gibson <david@gibson.dropbear.id.au>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

tcp_chr_connect(), unlike for example udp_chr_update_read_handler() does
not check if the fd it is using is valid (>= 0) before passing it to
qemu_set_fd_handler2().  If using e.g. a TCP serial port, which is not
initially connected, this can result in -1 being passed to FD_ISSET, which
has undefined behaviour.  On x86 it seems to harmlessly return 0, but on
PowerPC, it causes a fortify buffer overflow error to be thrown.

This patch fixes this by putting an extra test in tcp_chr_connect(), and
also adds an assert qemu_set_fd_handler2() to catch other such errors on
all platforms, rather than just some.
Signed-off-by: NDavid Gibson <david@gibson.dropbear.id.au>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

    commit c3767ed0
    qemu-char: (Re-)connect for tcp_chr_write() unconnected writing

Has no hope of working because tcp_chr_connect() does not actually connect.

455aa1e0 just fixes the SEGV with server() but the attempt to connect a client
socket is still completely broken.

This patch reverts both.
Reported-by: NRichard W.M. Jones <rjones@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

We have debugcon these days to listen on those ports that receive debug
messages. Also drop the others that have no effect anymore.
Signed-off-by: NJan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

It allows to disable memory merge support (KSM on Linux), which is
enabled by default otherwise.
Signed-off-by: NLuiz Capitulino <lcapitulino@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Now that CONFIG_TCG_PASS_AREG0 is enabled for all targets,
remove dead code and support for !CONFIG_TCG_PASS_AREG0 case.

Remove dyngen-exec.h and all references to it. Although included by
hw/spapr_hcall.c, it does not seem to use it.

Remove unused HELPER_CFLAGS.
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>
Reviewed-by: NRichard Henderson <rth@twiddle.net>