Commit c643bed9 moved qemu_init_vcpu() calls to common CPUState code.
This causes x86 cpu-add to fail with "KVM: setting VAPIC address failed".

The reason for the failure is that CPUClass::kvm_fd is not yet
initialized in the following call graph:
->x86_cpu_realizefn
 ->x86_cpu_apic_realize
  ->qdev_init
   ->device_set_realized
    ->device_reset (hotplugged == 1)
     ->apic_reset_common
      ->vapic_base_update
       ->kvm_apic_vapic_base_update
This causes attempted KVM vCPU ioctls to fail.

By contrast, in the non-hotplug case the APIC is reset much later, when
the vCPU is already initialized.

As a quick and safe solution, move the qemu_init_vcpu() call back into
the targets' realize functions.
Reported-by: NChen Fan <chen.fan.fnst@cn.fujitsu.com>
Acked-by: Igor Mammedov <imammedo@redhat.com> (for i386)
Tested-by: Jia Liu <proljc@gmail.com> (for openrisc)
Signed-off-by: NAndreas Färber <afaerber@suse.de>

Multiplication of two fractional word elements is not correct when sign
extension/promotion is needed. This change fixes it by adding correct
casts from unsigned to signed values.
In addition, the tests (dpaq_sa_l_w.c and dpsq_sa_l_w.c) have been extended
to trigger the current issue.
Signed-off-by: NPetar Jovanovic <petar.jovanovic@imgtec.com>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

This assignment causes a compiler warning for compilations with the compiler
option -Wunused-but-set-variable (which is included with -Wextra).

Removing it allows using -Wextra for QEMU code without suppressing too many
extra warnings.
Signed-off-by: NStefan Weil <sw@weilnetz.de>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

This change corrects rounding and saturation of Q31 fractional value in
mipsdsp_trunc16_sat16_round(). Overflow detection was incorrect for the
corner case for PRECRQ_RS.PH, and this test case is also part of the change.
Signed-off-by: NPetar Jovanovic <petar.jovanovic@imgtec.com>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

When a branch delay slot contains another branch instruction, the code
generated raises an exception, however since is_branch==1,
handle_delay_slot() doesn't get called immediately. This means
ctx->bstate isn't set to BS_BRANCH, and the decoder continues decoding
until a non-branch instruction is found.

If the first branch was a branch likely instruction then each
instruction after it generates code for the unlikely case, to go to the
next tb starting after the delay slot. This results in multiple goto_tb
tcg ops being generated with the same exit number. When debug is enabled
this hits:

tcg-op.h:2589: tcg_gen_goto_tb: Assertion `(tcg_ctx.goto_tb_issue_mask & (1 << idx)) == 0' failed.

This is fixed by removing is_branch entirely, and calling
handle_delay_slot() if (ctx.hflags & MIPS_HFLAG_BMASK) was set prior to
the current instruction being decoded. This still prevents
handle_delay_slot() being called immediately after a branch but allows
it to still be called after a branch within a delay slot.
Signed-off-by: NJames Hogan <james.hogan@imgtec.com>
Signed-off-by: NYongbok Kim <yongbok.kim@imgtec.com>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

Multiplication of Q15 fractional halfword vectors was incorrect in the
previous implementation of mipsdsp_rndq15_mul_q15_q15. It failed to take
element signs into account. This change fixes it, and it adds a test case
for it.

The change also removes unnecessary cast in the function
mipsdsp_mul_q15_q15_overflowflag21().
Signed-off-by: NPetar Jovanovic <petar.jovanovic@imgtec.com>
Reviewed-by: Richard Henderson  <rth@twiddle.net> 
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

This assignment causes a compiler warning for compilations with the compiler
option -Wunused-but-set-variable (which is included with -Wextra).

Removing it allows using -Wextra for QEMU code without suppressing too many
extra warnings.
Signed-off-by: NStefan Weil <sw@weilnetz.de>
Signed-off-by: NMichael Tokarev <mjt@tls.msk.ru>

Completes migration of target-specific code to new target-*/gdbstub.c.

Acked-by: Michael Walle <michael@walle.cc> (for lm32)
Acked-by: Max Filippov <jcmvbkbc@gmail.com> (for xtensa)
Signed-off-by: NAndreas Färber <afaerber@suse.de>

This avoids polluting the global namespace with a non-prefixed macro and
makes it obvious in the call sites that we return.

Semi-automatic conversion using, e.g.,
 sed -i 's/GET_REGL(/return gdb_get_regl(mem_buf, /g' target-*/gdbstub.c
followed by manual tweaking for sparc's GET_REGA() and Coding Style.

Acked-by: Michael Walle <michael@walle.cc> (for lm32)
Acked-by: Max Filippov <jcmvbkbc@gmail.com> (for xtensa)
Signed-off-by: NAndreas Färber <afaerber@suse.de>

Signed-off-by: NAndreas Färber <afaerber@suse.de>

CPUState::gdb_num_regs replaces num_g_regs.
CPUClass::gdb_num_core_regs replaces NUM_CORE_REGS.

Allows building gdb_register_coprocessor() for xtensa, too.

As a side effect this should fix coprocessor register numbering for SMP.

Acked-by: Michael Walle <michael@walle.cc> (for lm32)
Acked-by: Max Filippov <jcmvbkbc@gmail.com> (for xtensa)
Signed-off-by: NAndreas Färber <afaerber@suse.de>

Change breakpoint_invalidate() argument to CPUState alongside.

Since all targets now assign a softmmu-only field, we can drop helpers
cpu_class_set_{do_unassigned_access,vmsd}() and device_class_set_vmsd().

Prepares for changing cpu_memory_rw_debug() argument to CPUState.

Acked-by: Max Filippov <jcmvbkbc@gmail.com> (for xtensa)
Signed-off-by: NAndreas Färber <afaerber@suse.de>

Prepares for changing cpu_single_step() argument to CPUState.

Acked-by: Michael Walle <michael@walle.cc> (for lm32)
Signed-off-by: NAndreas Färber <afaerber@suse.de>

Where no extra implementation is needed, fall back to CPUClass::set_pc().

Acked-by: Michael Walle <michael@walle.cc> (for lm32)
Signed-off-by: NAndreas Färber <afaerber@suse.de>

This moves setting the Program Counter from gdbstub into target code.
Use vaddr type as upper-bound replacement for target_ulong.
Signed-off-by: NAndreas Färber <afaerber@suse.de>

x86 was using additional CPU_DUMP_* flags, so make that configurable in
CPUClass::reset_dump_flags.

This adds reset logging for alpha, unicore32 and xtensa.

Acked-by: Michael Walle <michael@walle.cc> (for lm32)
Reviewed-by: NRichard Henderson <rth@twiddle.net>
Signed-off-by: NAndreas Färber <afaerber@suse.de>

Since commit 878096ee (cpu: Turn
cpu_dump_{state,statistics}() into CPUState hooks) CPUArchState is no
longer needed.

Add documentation and make the functions available through qemu/log.h
outside NEED_CPU_H to allow use in qom/cpu.c. Moving them to qom/cpu.h
was not yet possible due to convoluted include paths, so that some
devices grow an implicit and unneeded dependency on qom/cpu.h for now.

Acked-by: Michael Walle <michael@walle.cc> (for lm32)
Reviewed-by: NRichard Henderson <rth@twiddle.net>
[AF: Simplified mb_cpu_do_interrupt() and do_interrupt_all() changes]
Signed-off-by: NAndreas Färber <afaerber@suse.de>

Also use bool type while at it.

Prepares for moving singlestep_enabled field to CPUState.
Reviewed-by: NRichard Henderson <rth@twiddle.net>
Signed-off-by: NAndreas Färber <afaerber@suse.de>

Move next_cpu from CPU_COMMON to CPUState.
Move first_cpu variable to qom/cpu.h.

gdbstub needs to use CPUState::env_ptr for now.
cpu_copy() no longer needs to save and restore cpu_next.
Acked-by: NPaolo Bonzini <pbonzini@redhat.com>
[AF: Rebased, simplified cpu_copy()]
Signed-off-by: NAndreas Färber <afaerber@suse.de>

A transition from CPUFooState to FooCPU can be considered safe,
just like FooCPU::env access in the opposite direction.
The only benefit of the FOO_CPU() casts would be protection against
bogus CPUFooState pointers, but then surrounding code would likely
break, too.

This should slightly improve interrupt etc. performance when going from
CPUFooState to FooCPU.
For any additional CPU() casts see 3556c233
(qom: allow turning cast debugging off).
Reported-by: NAnthony Liguori <aliguori@us.ibm.com>
Acked-by: NRichard Henderson <rth@twiddle.net>
Signed-off-by: NAndreas Färber <afaerber@suse.de>

The functions cpu_clone_regs() and cpu_set_tls() are not purely CPU
related -- they are specific to the TLS ABI for a a particular OS.
Move them into the linux-user/ tree where they belong.

target-lm32 had entirely unused implementations, since it has no
linux-user target; just drop them.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Acked-by: NRichard Henderson <rth@twiddle.net>
Signed-off-by: NAndreas Färber <afaerber@suse.de>

Use it for all targets, but be careful not to pass invalid CPUState.
cpu_single_env can be NULL, e.g. on Xen.
Signed-off-by: NAndreas Färber <afaerber@suse.de>

This allows to move the call into CPUState's realizefn.
Therefore move the stub into libqemustub.a.
Reviewed-by: NRichard Henderson <rth@twiddle.net>
Signed-off-by: NAndreas Färber <afaerber@suse.de>

Make cpustats monitor command available unconditionally.

Prepares for changing kvm_handle_internal_error() and kvm_cpu_exec()
arguments to CPUState.
Signed-off-by: NAndreas Färber <afaerber@suse.de>

The current ISA mode needs to be saved in bit 0 of the resume address.
If the current instruction happens to be in a branch delay slot, then
the address of the preceding jump instruction should be stored instead.
exception_resume_pc already does both of these tasks, so it is
made available and reused.

MIPS_HFLAG_BMASK in hflags is cleared, otherwise QEMU may treat the
first instruction of the signal handler as a delay slot instruction.
Signed-off-by: NKwok Cheung Yeung <kcy@codesourcery.com>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

This is a small follow-up change to "fix incorrect behaviour for INSV".

It includes two minor modifications:

- sizefilter is constant so it can be moved inside of the block,
- several lines of the code are replaced with a call to deposit64.

No functional change.
Signed-off-by: NPetar Jovanovic <petar.jovanovic@imgtec.com>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

First we need to clear the bit and then we set the given value.
Instruction ADDSC sets the bit and instruction ADDWC uses this bit.
Signed-off-by: NPetar Jovanovic <petar.jovanovic@imgtec.com>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

This change makes sure that modifications of pos field in the DSPControl
register do not trash other bits in the register. This bug can be triggered
with the additional test case in mips32-dsp/extpdp.c in this commit.

In addition to this, this change corrects incorrect calculation of the mask
for EXTPDP.
Signed-off-by: NPetar Jovanovic <petar.jovanovic@imgtec.com>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

The mask for EXTP instruction when size=31 has not been correctly
calculated.

The test (mips32-dsp/extp.c) has been extended to include the case that
triggers the issue.
Signed-off-by: NPetar Jovanovic <petar.jovanovic@imgtec.com>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

Corner case for INSV instruction when size=32 has not been correctly
implemented. The mask for size should be one bit wider, and preparing the
filter variable should be aware of this case too.

The test for INSV has been extended to include the case that triggers the
bug.
Signed-off-by: NPetar Jovanovic <petar.jovanovic@imgtec.com>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

The emulator needs to check in hflags if DSP unit has been turned off before
it generates code for MUL_PH, MUL_S_PH, MULQ_S_W, and MULQ_RS_W.
Signed-off-by: NPetar Jovanovic <petar.jovanovic@imgtec.com>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

This change corrects and simplifies how discard is calculated for shift
left logical vector instructions. It is used to detect overflow and set bit
22 in the DSPControl register.

The existing tests (shll_ph.c, shll_qb.c) are extended with the corner cases
that expose incorrectness in the previous implementation.
Signed-off-by: NPetar Jovanovic <petar.jovanovic@imgtec.com>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

The operands for MAQ_SA_W.PHL/MAQ_SA_W.PHR must in specified format.
Otherwise, the results are unpredictable. Once the operands were corrected
in the tests (part of this change), a bug in mipsdsp_mul_q15_q15 became
visible.

This change corrects the tests for MAQ_SA_W.PHL/MAQ_SA_W.PHR and fixes
sign-related issue in mipsdsp_mul_q15_q15. It also removes unnecessary
comment.
Signed-off-by: NPetar Jovanovic <petar.jovanovic@imgtec.com>

Fix for rndrashift_short_acc to set correct value to higher 64 bits.
This change also corrects conditions when bit 23 of the DSPControl register
is set.

The existing test files have been extended with several examples that
trigger the issues. One bug/example in the test file for EXTR_RS_W has been
found and reported by Klaus Peichl.
Signed-off-by: NPetar Jovanovic <petar.jovanovic@imgtec.com>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

This removes a global per-target function and thus takes us one step
closer to compiling multiple targets into one executable.

It will also allow to override the interrupt handling for certain CPU
families.
Signed-off-by: NAndreas Färber <afaerber@suse.de>

Move it to qom/cpu.h to avoid issues with include order.

Change pc_acpi_smi_interrupt() opaque to X86CPU.
Signed-off-by: NAndreas Färber <afaerber@suse.de>

Move it to qom/cpu.c to avoid build failures depending on include order
of cpu-qom.h and exec/cpu-all.h.

Change opaques of various ..._irq_handler() functions to the
appropriate CPU type to facilitate using cpu_reset_interrupt().

Fix Coding Style issues while at it (missing braces, indentation).
Signed-off-by: NAndreas Färber <afaerber@suse.de>

Both fields are used in VMState, thus need to be moved together.
Explicitly zero them on reset since they were located before
breakpoints.

Pass PowerPCCPU to kvmppc_handle_halt().
Signed-off-by: NAndreas Färber <afaerber@suse.de>

Signed-off-by: NRichard Henderson <rth@twiddle.net>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

Signed-off-by: NRichard Henderson <rth@twiddle.net>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>