In the decode of ARM B and BL insns, swap the order of the
"append 2 implicit zeros to imm24" and the sign extend, and
use the new sextract32() utility function to do the latter.
This avoids a direct dependency on the undefined C behaviour
of shifting into the sign bit of an integer.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Reviewed-by: NRichard Henderson <rth@twiddle.net>
Message-id: 1378391908-22137-2-git-send-email-peter.maydell@linaro.org

Make the 'any' CPU for target-arm available only in linux-user mode.
The ARM target provides a CPU named "any", which turns on support for
all user-level instruction set extensions we know about. This is
intended for linux-user emulation mode, where it is the default CPU type.
It makes no sense to try to use this for system emulation, since we don't
initialize it with any system-level information like feature register
values or implementation specific cp15 registers. (Unsurprisingly, some
boards won't boot at all, though you might get lucky in some cases where
the guest doesn't happen to prod things that aren't there.)

Prevent users from making this command line error by removing the
CPU definition from the softmmu build.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Reviewed-by: NAndreas Färber <afaerber@suse.de>
Message-id: 1378213995-12945-1-git-send-email-peter.maydell@linaro.org

A Malta board can support up to 2GiB of RAM. Since the unmapped kseg0/1
regions are only 512MiB large & the latter 256MiB of those are taken up
by the IO region, access to RAM beyond 256MiB must be done through a
mapped region. In the case of a Linux guest this means we need to use
highmem.

The mainline Linux kernel does not support highmem for Malta at this
time, however this can be tested using the linux-mti-3.8 kernel branch
available from:

  git://git.linux-mips.org/pub/scm/linux-mti.git

You should be able to boot a Linux kernel built from the linux-mti-3.8
branch, with CONFIG_HIGHMEM enabled, using 2GiB RAM by passing "-m 2G"
to QEMU and appending the following kernel parameters:

  mem=256m@0x0 mem=256m@0x90000000 mem=1536m@0x20000000

Note that the upper half of the physical address space of a Malta
mirrors the lower half (hence the 2GiB limit) except that the IO region
(0x10000000-0x1fffffff in the lower half) is not mirrored in the upper
half. That is, physical addresses 0x90000000-0x9fffffff access RAM
rather than the IO region, resulting in a physical address space
resembling the following:

  0x00000000 -> 0x0fffffff  RAM
  0x10000000 -> 0x1fffffff  I/O
  0x20000000 -> 0x7fffffff  RAM
  0x80000000 -> 0x8fffffff  RAM (mirror of 0x00000000 -> 0x0fffffff)
  0x90000000 -> 0x9fffffff  RAM
  0xa0000000 -> 0xffffffff  RAM (mirror of 0x20000000 -> 0x7fffffff)

The second mem parameter provided to the kernel above accesses the
second 256MiB of RAM through the upper half of the physical address
space, making use of the aliasing described above in order to avoid
the IO region and use the whole 2GiB RAM.

The memory setup may be seen as 'backwards' in this commit since the
'real' memory is mapped in the upper half of the physical address space
and the lower half contains the aliases. On real hardware it would be
typical to see the upper half of the physical address space as the alias
since the bus addresses generated match the lower half of the physical
address space. However since the memory accessible in the upper half of
the physical address space is uninterrupted by the IO region it is
easiest to map the RAM as a whole there, and functionally it makes no
difference to the target code.

Due to the requirements of accessing the second 256MiB of RAM through
a mapping to the upper half of the physical address space it is usual
for the bootloader to indicate a maximum of 256MiB memory to a kernel.
This allows kernels which do not support such access to boot on systems
with more than 256MiB of RAM. It is also the behaviour assumed by Linux.
QEMUs small generated bootloader is modified to provide this behaviour.
Signed-off-by: NPaul Burton <paul.burton@imgtec.com>
Signed-off-by: NYongbok Kim <yongbok.kim@imgtec.com>
Reviewed-by: NAurelien Jarno <aurelien@aurel32.net>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

# By Jan Kiszka (2) and others
# Via Paolo Bonzini
* bonzini/iommu-for-anthony:
  exec: do tcg_commit only when tcg_enabled
  Revert "memory: Return -1 again on reads from unsigned regions"
  memory: Provide separate handling of unassigned io ports accesses
  exec: check offset_within_address_space for register subpage
  exec: fix writing to MMIO area with non-power-of-two length

Message-id: 1378401455-583-1-git-send-email-pbonzini@redhat.com

Signed-off-by: Nliguang <lig.fnst@cn.fujitsu.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

This reverts commit 9b8c6924.

The commit was wrong: We only return -1 on invalid accesses, not on
valid but unbacked ones. This broke various corner cases.

Cc: qemu-stable@nongnu.org
Signed-off-by: NJan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

Accesses to unassigned io ports shall return -1 on read and be ignored
on write. Ensure these properties via dedicated ops, decoupling us from
the memory core's handling of unassigned accesses.

Cc: qemu-stable@nongnu.org
Signed-off-by: NJan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

If offset_within_address_space falls in a page, then we register a
subpage. So check offset_within_address_space rather than
offset_within_region.

Cc: qemu-stable@nongnu.org
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Richard Henderson <rth@twiddle.net>
Cc: "Andreas Färber" <afaerber@suse.de>
Cc: Peter Maydell <peter.maydell@linaro.org>
Cc: Blue Swirl <blauwirbel@gmail.com>
Signed-off-by: NHu Tao <hutao@cn.fujitsu.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

The problem is introduced by commit 23326164 (exec: Support 64-bit
operations in address_space_rw, 2013-07-08).  Before that commit,
memory_access_size would only return 1/2/4.

Since alignment is already handled above, reduce l to the largest
power of two that is smaller than l.

Cc: qemu-stable@nongnu.org
Reported-by: NOleksii Shevchuk <alxchk@gmail.com>
Tested-by: NOleksii Shevchuk <alxchk@gmail.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

This makes get_maintainers.pl behave a little better.
Reported-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NAnthony Liguori <anthony@codemonkey.ws>

QOM CPUState refactorings / X86CPU

* Conversion of global CPU list to QTAILQ - preparing for CPU hot-unplug
* Document X86CPU magic numbers for CPUID cache info

# gpg: Signature made Tue 03 Sep 2013 10:59:22 AM CDT using RSA key ID 3E7E013F
# gpg: Can't check signature: public key not found

# By Andreas Färber (3) and Eduardo Habkost (1)
# Via Andreas Färber
* afaerber/tags/qom-cpu-for-anthony:
  target-i386: Use #defines instead of magic numbers for CPUID cache info
  cpu: Replace qemu_for_each_cpu()
  cpu: Use QTAILQ for CPU list
  a15mpcore: Use qemu_get_cpu() for generic timers

# By Max Reitz (11) and others
# Via Kevin Wolf
* kwolf/for-anthony: (26 commits)
  qemu-iotests: Overlapping cluster allocations
  qcow2_check: Mark image consistent
  qcow2-refcount: Repair shared refcount blocks
  qcow2-refcount: Repair OFLAG_COPIED errors
  qcow2-refcount: Move OFLAG_COPIED checks
  qcow2: Employ metadata overlap checks
  qcow2: Metadata overlap checks
  qcow2: Add corrupt bit
  qemu-iotests: Snapshotting zero clusters
  qcow2-refcount: Snapshot update for zero clusters
  option: Add assigned flag to QEMUOptionParameter
  gluster: Abort on AIO completion failure
  block: Remove old raw driver
  switch raw block driver from "raw.o" to "raw_bsd.o"
  raw_bsd: register bdrv_raw
  raw_bsd: add raw_create_options
  raw_bsd: introduce "special members"
  raw_bsd: add raw_create()
  raw_bsd: emit debug events in bdrv_co_readv() and bdrv_co_writev()
  add skeleton for BSD licensed "raw" BlockDriver
  ...

Message-id: 1378111792-20436-1-git-send-email-kwolf@redhat.com
Signed-off-by: NAnthony Liguori <anthony@codemonkey.ws>

# By Stefan Weil (6) and others
# Via Michael Tokarev
* mjt/trivial-patches:
  aio / timers: use g_usleep() not sleep()
  adlib: sort offsets in portio registration
  qmp: fix integer usage in examples
  tci: Remove function tcg_out64 (fix broken build)
  target-arm: Report unimplemented opcodes (LOG_UNIMP)
  pflash_cfi02.c: fix debug macro
  configure: Remove unneeded redirections of stderr (pkg-config --exists)
  configure: Remove unneeded redirections of stderr (pkg-config --cflags, --libs)
  configure: Don't write .pyc files by default (python -B)
  curl: qemu_bh_new() can never return NULL
  slirp/arp_table.c: Avoid shifting into sign bit of signed integers
  configure: disable clang -Wstring-plus-int warning
  rdma: silly ipv6 bugfix
  misc: Fix some typos in names and comments
  slirp: Port redirection option behave differently on Linux and Windows

Message-id: 1378119695-14568-1-git-send-email-mjt@msgid.tls.msk.ru
Signed-off-by: NAnthony Liguori <anthony@codemonkey.ws>

# By Gerd Hoffmann (10) and Marcel Apfelbaum (1)
# Via Gerd Hoffmann
* kraxel/usb.88:
  usb/dev-hid: Modified usb-tablet category from Misc to Input
  Revert "usb-hub: report status changes only once"
  usb-hub: add tracepoint for status reports
  usb: parallelize usb3 streams
  uas: add property for request logging
  xhci: reset port when disabling slot
  xhci: emulate intr endpoint intervals correctly
  xhci: fix endpoint interval calculation
  xhci: add port to slot_address tracepoint
  xhci: add tracepoint for endpoint state changes
  xhci: remove leftover debug printf

Message-id: 1378117055-29620-1-git-send-email-kraxel@redhat.com
Signed-off-by: NAnthony Liguori <anthony@codemonkey.ws>

pc,pci,virtio fixes and cleanups

This includes pc and pci cleanups and enhancements,
and a virtio bugfix for level interrupts.
Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>

# gpg: Signature made Sun 01 Sep 2013 03:15:36 AM CDT using RSA key ID D28D5469
# gpg: Can't check signature: public key not found

# By Michael S. Tsirkin (3) and others
# Via Michael S. Tsirkin
* mst/tags/for_anthony:
  virtio_pci: fix level interrupts with irqfd
  pc: reduce duplication, fix PIIX descriptions
  hw: Clean up bogus default boot order
  pci: add config space access traces
  pc: fix regression for 64 bit PCI memory
  pci: Introduce helper to retrieve a PCI device's DMA address space

Message-id: 1378023590-11109-1-git-send-email-mst@redhat.com
Signed-off-by: NAnthony Liguori <anthony@codemonkey.ws>

QOM device refactorings

* Fix QOM and ISA documentation errors
* Extend object_initialize() et al. to check the instance size

# gpg: Signature made Fri 30 Aug 2013 02:19:48 PM CDT using RSA key ID 3E7E013F
# gpg: Can't check signature: public key not found

# By Andreas Färber (14) and others
# Via Andreas Färber
* afaerber/tags/qom-devices-for-anthony:
  isa: Fix documentation of isa_register_portio_list()
  qom: Assert instance size in object_initialize_with_type()
  qom: Pass available size to object_initialize()
  qdev: Pass size to qbus_create_inplace()
  virtio-mmio: Pass size to virtio_mmio_bus_new()
  virtio-ccw: Pass size to virtio_ccw_bus_new()
  s390-virtio-bus: Pass size to virtio_s390_bus_new()
  virtio-pci: Pass size to virtio_pci_bus_new()
  usb: Pass size to usb_bus_new()
  scsi: Pass size to scsi_bus_new()
  pci: Pass size to pci_bus_new_inplace()
  ide: Pass size to ide_bus_new()
  ipack: Pass size to ipack_bus_new_inplace()
  intel-hda: Pass size to hda_codec_bus_init()
  qom: Fix object_initialize_with_type() argument name in documentation
  virtio: Remove unnecessary OBJECT() casts
  object: Fix typo in qom/object.h

This is an attempt to make the CPUID cache topology code clearer, by
replacing the magic numbers in the code with #defines, and moving all
the cache information to the same place in the file.

I took care of comparing the assembly output of compiling
target-i386/cpu.c before and after applying this change, to make sure
not a single bit was changed on cpu_x86_cpuid() before and after
applying this patch (unfortunately I had to manually check existing
differences, because of __LINE__ expansions on
object_class_dynamic_cast_assert() calls).

This even keeps the code bug-compatible with the previous version: today
the cache information returned on AMD cache information leaves (CPUID
0x80000005 & 0x80000006) do not match the information returned on CPUID
leaves 2 and 4. The L2 cache information on CPUID leaf 2 also doesn't
match the information on CPUID leaf 2. The new constants should make it
easier to eventually fix those inconsistencies. All inconsistencies I
have found are documented in code comments.
Signed-off-by: NEduardo Habkost <ehabkost@redhat.com>
Reviewed-by: Nliguang <lig.fnst@cn.fujitsu.com>
Signed-off-by: NAndreas Färber <afaerber@suse.de>

It was introduced to loop over CPUs from target-independent code, but
since commit 182735ef target-independent
CPUState is used.

A loop can be considered more efficient than function calls in a loop,
and CPU_FOREACH() hides implementation details just as well, so use that
instead.
Suggested-by: NMarkus Armbruster <armbru@redhat.com>
Acked-by: NMichael S. Tsirkin <mst@redhat.com>
Signed-off-by: NAndreas Färber <afaerber@suse.de>

Introduce CPU_FOREACH(), CPU_FOREACH_SAFE() and CPU_NEXT() shorthand
macros.
Signed-off-by: NAndreas Färber <afaerber@suse.de>

This simplifies the loop and aids with refactoring of CPU list.
Requested-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NAndreas Färber <afaerber@suse.de>

* 'tcg-next' of git://github.com/rth7680/qemu: (29 commits)
  tcg-i386: Make use of zero-extended memory helper routines
  tcg: Introduce zero and sign-extended versions of load helpers
  exec: Split softmmu_defs.h
  target: Include softmmu_exec.h where forgotten
  exec: Rename USUFFIX to LSUFFIX
  tcg-i386: Don't perform GETPC adjustment in TCG code
  exec: Reorganize the GETRA/GETPC macros
  configure: Allow x32 as a host
  tcg-i386: Adjust tcg_out_tlb_load for x32
  tcg-i386: Use intptr_t appropriately
  tcg: Fix jit debug for x32
  tcg: Use appropriate types in tcg_reg_alloc_call
  tcg: Change tcg_out_ld/st offset to intptr_t
  tcg: Change tcg_gen_exit_tb argument to uintptr_t
  tcg: Use uintptr_t in TCGHelperInfo
  tcg: Change relocation offsets to intptr_t
  tcg: Change memory offsets to intptr_t
  tcg: Change frame pointer offsets to intptr_t
  tcg: Define TCG_ptr properly
  tcg: Define TCG_TYPE_PTR properly
  ...

* 'ppc-for-upstream' of git://github.com/agraf/qemu:
  PPC: spapr: iommu: rework traces
  spapr: add "stop-self" RTAS call required to support hot CPU unplug
  PPC: KVM: Compile fix for qemu_notify_event
  pseries: Add H_SET_MODE hcall to change guest exception endianness
  xics: move registration of global state to realize()
  spapr-pci: rework MSI/MSIX
  target-ppc: Use #define instead of opencoding SLB valid bit
  spapr-pci: fix config space access to support bridges
  target-ppc: fix bit extraction for FPBF and FPL
  ppc405_boards: Don't enforce presence of firmware for qtest
  ppc405_uc: Disable debug output
  ppc405_boards: Disable debug output
  ppc: virtex_ml507: QEMU_OPTION_dtb support for this machine.
  disas/ppc.c: Fix little endian disassembly
  target-ppc: POWER7 supports the MSR_LE bit
  target-ppc: USE LPCR_ILE to control exception endian on POWER7
  pseries: Fix stalls on hypervisor virtual console
  PPC: E500: Generate device tree on reset

On MIPS ext8s and ext16s ops are implemented with a dedicated
instruction only on MIPS32R2, otherwise the same kind of implementation
than at TCG level (shift left followed by shift right) is used.

Change that by only implementing the ext8s and ext16s ops on MIPS32R2 so
that optimizations can be done by the optimizer. Use an inline version to
avoid having to test again for MIPS32R2 instructions. Keep the shift
implementation for the ld/st routines.
Reviewed-by: NRichard Henderson <rth@twiddle.net>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

Use an inline version for the bswap16 and bswap32 ops to avoid
testing for MIPS32R2 instructions availability, as these ops are
only available in that case.
Reviewed-by: NRichard Henderson <rth@twiddle.net>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

Now that TCG supports enabling and disabling ops at runtime, it's
possible to detect the available host instructions at runtime, and
enable the corresponding ops accordingly.

Unfortunately it's not easy to probe for available instructions on
MIPS, the information is partially available in /proc/cpuinfo, and
not available in AUXV. This patch therefore probes for the instructions
by trying to execute them and by catching a possible SIGILL signal.
Reviewed-by: NRichard Henderson <rth@twiddle.net>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

For 8 and 16-bit unsigned loads, rely on the zero-extension
from the helper and use a smaller 32-bit move insn.
Reviewed-by: NAurelien Jarno <aurelien@aurel32.net>
Signed-off-by: NRichard Henderson <rth@twiddle.net>

Reviewed-by: NAurelien Jarno <aurelien@aurel32.net>
Signed-off-by: NRichard Henderson <rth@twiddle.net>

The _cmmu helpers can be moved to exec-all.h.  The helpers that are
used from TCG will shortly need access to tcg_target_long so move
their declarations into tcg.h.

This requires minor include adjustments to all TCG backends.
Reviewed-by: NAurelien Jarno <aurelien@aurel32.net>
Signed-off-by: NRichard Henderson <rth@twiddle.net>

Several targets forgot to include softmmu_exec.h, which would
break them with a header cleanup to follow.
Reviewed-by: NAurelien Jarno <aurelien@aurel32.net>
Signed-off-by: NRichard Henderson <rth@twiddle.net>

In a following patch, there will be confusion between multiple "unsigned"
suffixes; rename this one so as to imply "load".
Reviewed-by: NAurelien Jarno <aurelien@aurel32.net>
Signed-off-by: NRichard Henderson <rth@twiddle.net>

Since we now perform it inside the helper, no need to do it here.
This also lets us perform a tail-call from the store slow path to
the helper.
Reviewed-by: NAurelien Jarno <aurelien@aurel32.net>
Signed-off-by: NRichard Henderson <rth@twiddle.net>

Always define GETRA; use __builtin_extract_return_addr, rather than
having a special case for s390.  Split GETPC_ADJ out of GETPC; use 2
universally, rather than having a special case for arm.

Rename GETPC_LDST to GETRA_LDST to indicate that it does not
contain the GETPC_ADJ value.  Likewise with GETPC_EXT to GETRA_EXT.

Perform the GETPC_ADJ adjustment inside helper_ret_ld/st.  This will
allow backends to pass along the "true" return address rather than
the massaged GETPC value.  In the meantime, double application of
GETPC_ADJ does not hurt, since the call insn in all ISAs is at least
4 bytes long.
Reviewed-by: NAurelien Jarno <aurelien@aurel32.net>
Signed-off-by: NRichard Henderson <rth@twiddle.net>

Reviewed-by: NAurelien Jarno <aurelien@aurel32.net>
Signed-off-by: NRichard Henderson <rth@twiddle.net>

Reviewed-by: NAurelien Jarno <aurelien@aurel32.net>
Signed-off-by: NRichard Henderson <rth@twiddle.net>

Reviewed-by: NAurelien Jarno <aurelien@aurel32.net>
Signed-off-by: NRichard Henderson <rth@twiddle.net>

Reviewed-by: NAurelien Jarno <aurelien@aurel32.net>
Signed-off-by: NRichard Henderson <rth@twiddle.net>

Reviewed-by: NAurelien Jarno <aurelien@aurel32.net>
Signed-off-by: NRichard Henderson <rth@twiddle.net>

Reviewed-by: NAurelien Jarno <aurelien@aurel32.net>
Signed-off-by: NRichard Henderson <rth@twiddle.net>

And update all users.
Reviewed-by: NAurelien Jarno <aurelien@aurel32.net>
Signed-off-by: NRichard Henderson <rth@twiddle.net>

Reviewed-by: NAurelien Jarno <aurelien@aurel32.net>
Signed-off-by: NRichard Henderson <rth@twiddle.net>