Xtensa updates for 2.3:

- fix cross-page opcode handling;
- move window overflow exception generation decision to translation phase;
- don't generate dead code after privilege, window overflow or coprocessor
  exception;
- add monitor command 'info opcount' for dumping TCG opcode counters.

# gpg: Signature made Wed 17 Dec 2014 02:57:01 GMT using RSA key ID F83FA044
# gpg: Good signature from "Max Filippov <max.filippov@cogentembedded.com>"
# gpg:                 aka "Max Filippov <jcmvbkbc@gmail.com>"

* remotes/xtensa/tags/20141217-xtensa:
  target-xtensa: don't generate dead code
  target-xtensa: record available window in TB flags
  target-xtensa: test cross-page opcode
  target-xtensa: fix translation for opcodes crossing page boundary
  tcg: add separate monitor command to dump opcode counters
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

* remotes/lalrae/tags/mips-20141216: (30 commits)
  target-mips: remove excp_names[] from linux-user as it is unused
  disas/mips: disable unused mips16_to_32_reg_map[]
  disas/mips: remove unused mips_msa_control_names_numeric[32]
  target-mips: convert single case switch into if statement
  target-mips: Fix DisasContext's ulri member initialization
  target-mips: Use local float status pointer across MSA macros
  target-mips: Add missing calls to synchronise SoftFloat status
  linux-user: Use the 5KEf processor for 64-bit emulation
  target-mips: Also apply the CP0.Status mask to MTTC0
  target-mips: gdbstub: Clean up FPU register handling
  target-mips: Correct 32-bit address space wrapping
  target-mips: Tighten ISA level checks
  target-mips: Fix CP0.Config3.ISAOnExc write accesses
  target-mips: Output CP0.Config2-5 in the register dump
  target-mips: Fix the 64-bit case for microMIPS MOVE16 and MOVEP
  target-mips: Correct the writes to Status and Cause registers via gdbstub
  target-mips: Correct the handling of writes to CP0.Status for MIPSr6
  target-mips: Correct MIPS16/microMIPS branch size calculation
  target-mips: Restore the order of helpers
  target-mips: Remove unused `FLOAT_OP' macro
  ...
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Don't generate TCG operations when privilege, register window or
coprocessor checks fail.
Signed-off-by: NMax Filippov <jcmvbkbc@gmail.com>
Reviewed-by: NRichard Henderson <rth@twiddle.net>

Record last valid 4-register window pane number in TB flags so that a
window overflow exception throw point is known at the translation time.
Signed-off-by: NMax Filippov <jcmvbkbc@gmail.com>
Reviewed-by: NRichard Henderson <rth@twiddle.net>

Alter cross-page TB test to also test cross-page opcode.
Signed-off-by: NMax Filippov <jcmvbkbc@gmail.com>

If TB ends with an opcode that crosses page boundary and the following
page is not executable then EPC1 for the code fetch exception wrongly
points at the beginning of the TB. Always treat instruction that crosses
page boundary as a separate TB.

Cc: qemu-stable@nongnu.org
Signed-off-by: NMax Filippov <jcmvbkbc@gmail.com>

Currently 'info jit' outputs half of the information to monitor and the
rest to qemu log. Dumping opcode counts to monitor as a part of 'info
jit' command doesn't sound useful. Add new monitor command 'info
opcount' that only dumps opcode counters.
Signed-off-by: NMax Filippov <jcmvbkbc@gmail.com>
Reviewed-by: NRichard Henderson <rth@twiddle.net>
Reviewed-by: NAlex Bennée <alex.bennee@linaro.org>

Running barebox on qemu-system-mips* with '-d unimp' overloads
stderr by very very many mips_cpu_handle_mmu_fault() messages:

  mips_cpu_handle_mmu_fault address=b80003fd ret 0 physical 00000000180003fd prot 3
  mips_cpu_handle_mmu_fault address=a0800884 ret 0 physical 0000000000800884 prot 3
  mips_cpu_handle_mmu_fault pc a080cd80 ad b80003fd rw 0 mmu_idx 0

So it's very difficult to find LOG_UNIMP message.

The mips_cpu_handle_mmu_fault() messages appear on enabling ANY
logging! It's not very handy.

Adding separate log category for *_cpu_handle_mmu_fault()
logging fixes the problem.
Signed-off-by: NAntony Pavlov <antonynpavlov@gmail.com>
Acked-by: NAlexander Graf <agraf@suse.de>
Reviewed-by: NRichard Henderson <rth@twiddle.net>
Message-id: 1418489298-1184-1-git-send-email-antonynpavlov@gmail.com
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

misc spice updates.

# gpg: Signature made Tue 16 Dec 2014 14:03:07 GMT using RSA key ID D3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
# gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
# gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

* remotes/spice/tags/pull-spice-20141216-1:
  spice: fix memory leak
  spice: remove spice-experimental.h include
  spice: do not require TCP ports
  spice: rework mirror allocation, add no-resize fast path
  spice: reduce refresh rate in native mode
  spice: use bottom half instead of refresh timer for cursor updates
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Migration pull for 2.3.  Mostly moving the code to the migration/
directory, and updating MAINTAINERS.

I've also folded my other MAINTAINERS update patches into this, as
they're small by themselves.

# gpg: Signature made Tue 16 Dec 2014 12:21:24 GMT using RSA key ID 854083B6
# gpg: Good signature from "Amit Shah <amit@amitshah.net>"
# gpg:                 aka "Amit Shah <amit@kernel.org>"
# gpg:                 aka "Amit Shah <amitshah@gmx.net>"

* remotes/amit-migration/tags/for-2.3-2:
  MAINTAINERS: Update for migrated migration code
  Split the QEMU buffered file code out
  Split struct QEMUFile out
  Remove migration- pre/post fixes off files in migration/ dir
  Start migrating migration code into a migration directory
  qmp-command.hx: add missing docs for migration capabilites
  cpu: verify that block->host is set
  cpu: assert host pointer offset within block
  exec: add wrapper for host pointer access
  MAINTAINERS: add include files to virtio-serial entry
  MAINTAINERS: add entry for virtio-rng
  MAINTAINERS: migration: add vmstate static checker files
  MAINTAINERS: Add myself to migration maintainers
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

If errors happen for middle items of channel_list,
qmp_query_spice_channels() returns NULL, and the variable
cur_item going out of scope leaks the storage it points to.

The flag is a compatibility thing for older spice-server
versions. Meanwhile our minimum spice version requirement is
new enough that we should never ever see this error, and if we
do something went very seriously wrong. Let's using assert()
instead of returning NULL to avoid a memory leak.
Suggested-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NGonglei <arei.gonglei@huawei.com>
Reviewed-by: NEric Blake <eblake@redhat.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Nothing seems to be using functions from spice-experimental.h (better
that way). Let's remove its inclusion.
Signed-off-by: NMarc-André Lureau <marcandre.lureau@gmail.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

It is possible to use Spice server without TCP port.  On local VM,
qemu (and libvirt) can add new clients thanks to QMP add_client command.
Signed-off-by: NMarc-André Lureau <marcandre.lureau@gmail.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Add fast path to qemu_spice_display_switch in case old and new
displaysurface have identical size (happens with display panning
and page flipping).  We just swap the backing store then and don't
go through the whole process of deleting and creating the primary
surface.

To simplify the code a bit move mirror surface allocation to
qemu_spice_display_switch().
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Now that cursor updates are out of the way qxl needs the refresh timer
only when when running in vga mode, for dirty bitmap checking.  In
native qxl mode the guest will notify us, so we don't need to poll and
can use the idle interval (one refresh wakeup every few seconds).

Cc: Marc-André Lureau <marcandre.lureau@gmail.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Calling directly doesn't work due to the qxl-render code running in
spice server thread context.  Meanwhile bottom half scheduling is
thread-safe though, so we can use that to kick a cursor update in
main i/o thread context.

Cc: Marc-André Lureau <marcandre.lureau@gmail.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Signed-off-by: NLeon Alrae <leon.alrae@imgtec.com>
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>

This array is used by print_mips16_insn_arg() which is guarded by #if 0.
Therefore doing the same with the array as it generates clang warnings.
Signed-off-by: NLeon Alrae <leon.alrae@imgtec.com>

Signed-off-by: NLeon Alrae <leon.alrae@imgtec.com>
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>

Signed-off-by: NLeon Alrae <leon.alrae@imgtec.com>
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>

Set DisasContext's ulri member to 0 or 1 as with other bool members.
Signed-off-by: NMaciej W. Rozycki <macro@codesourcery.com>
Reviewed-by: NLeon Alrae <leon.alrae@imgtec.com>
Signed-off-by: NLeon Alrae <leon.alrae@imgtec.com>

Reduce line wrapping throughout MSA helper macros by using a local float
status pointer rather than referring to the float status through the
environment each time.  No functional change.
Signed-off-by: NMaciej W. Rozycki <macro@codesourcery.com>
Reviewed-by: NLeon Alrae <leon.alrae@imgtec.com>
Signed-off-by: NLeon Alrae <leon.alrae@imgtec.com>

Add missing calls to synchronise the SoftFloat status with the CP1.FSCR:

+ for the rounding and flush-to-zero modes upon processor reset,

+ for the flush-to-zero mode on FSCR updates through the GDB stub.

Refactor code accordingly and remove the redundant RESTORE_ROUNDING_MODE
macro.
Signed-off-by: NThomas Schwinge <thomas@codesourcery.com>
Signed-off-by: NMaciej W. Rozycki <macro@codesourcery.com>
Reviewed-by: NLeon Alrae <leon.alrae@imgtec.com>
Signed-off-by: NLeon Alrae <leon.alrae@imgtec.com>

Replace the 20Kc original MIPS64 ISA processor used for 64-bit user
emulation with the 5KEf processor that implements the MIPS64r2 ISA,
complementing the choice of the 24Kf processor for 32-bit emulation.
Signed-off-by: NMaciej W. Rozycki <macro@codesourcery.com>
Reviewed-by: NLeon Alrae <leon.alrae@imgtec.com>
Signed-off-by: NLeon Alrae <leon.alrae@imgtec.com>

Make CP0.Status writes made with the MTTC0 instruction respect this
register's mask just like all the other places.  Also preserve the
current values of masked out bits.
Signed-off-by: NMaciej W. Rozycki <macro@codesourcery.com>
Reviewed-by: NLeon Alrae <leon.alrae@imgtec.com>
Signed-off-by: NLeon Alrae <leon.alrae@imgtec.com>

Rewrite the FPU register access parts of `mips_cpu_gdb_read_register'
and `mips_cpu_gdb_write_register' for consistency between each other.
Signed-off-by: NMaciej W. Rozycki <macro@codesourcery.com>
Reviewed-by: NLeon Alrae <leon.alrae@imgtec.com>
Signed-off-by: NLeon Alrae <leon.alrae@imgtec.com>

Make sure the address space is unconditionally wrapped on 32-bit
processors, that is ones that do not implement at least the MIPS III
ISA.

Also make MIPS16 SAVE and RESTORE instructions use address calculation
rather than plain arithmetic operations for stack pointer manipulation
so that their semantics for stack accesses follows the architecture
specification.  That in particular applies to user software run on
64-bit processors with the CP0.Status.UX bit clear where the address
space is wrapped to 32 bits.
Signed-off-by: NMaciej W. Rozycki <macro@codesourcery.com>
Reviewed-by: NLeon Alrae <leon.alrae@imgtec.com>
Signed-off-by: NLeon Alrae <leon.alrae@imgtec.com>

Tighten ISA level checks down to MIPS II that many of our instructions
are missing.  Also make sure any 64-bit instruction enables are only
applied to 64-bit processors, that is ones that implement at least the
MIPS III ISA.
Signed-off-by: NMaciej W. Rozycki <macro@codesourcery.com>
Reviewed-by: NLeon Alrae <leon.alrae@imgtec.com>
Signed-off-by: NLeon Alrae <leon.alrae@imgtec.com>

Fix CP0.Config3.ISAOnExc write accesses on microMIPS processors.  This
bit is mandatory for any processor that implements the microMIPS
instruction set.  This bit is r/w for processors that implement both the
standard MIPS and the microMIPS instruction set.  This bit is r/o and
hardwired to 1 if only the microMIPS instruction set is implemented.

There is no other bit ever writable in CP0.Config3 so defining a
corresponding `CP0_Config3_rw_bitmask' member in `CPUMIPSState' is I
think an overkill.  Therefore make the ability to write the bit rely on
the presence of ASE_MICROMIPS set in the instruction flags.

The read-only case of the microMIPS instruction set being implemented
only can be added when we add support for such a configuration.  We do
not currently have such support, we have no instruction flag that would
control the presence of the standard MIPS instruction set nor any
associated code in instruction decoding.

This change is needed to boot a microMIPS Linux kernel successfully,
otherwise it hangs early on as interrupts are enabled and then the
exception handler invoked loops as its first instruction is interpreted
in the wrong execution mode and triggers another exception right away.
And then over and over again.

We already check the current setting of the CP0.Config3.ISAOnExc in
`set_hflags_for_handler' to set the ISA bit correctly on the exception
handler entry so it is the ability to set it that is missing only.
Signed-off-by: NMaciej W. Rozycki <macro@codesourcery.com>
Reviewed-by: NLeon Alrae <leon.alrae@imgtec.com>
Signed-off-by: NLeon Alrae <leon.alrae@imgtec.com>

Include CP0.Config2 through CP0.Config5 registers in the register dump
produced with the `info registers' monitor command.  Align vertically
with the registers already output.
Signed-off-by: NMaciej W. Rozycki <macro@codesourcery.com>
Signed-off-by: NLeon Alrae <leon.alrae@imgtec.com>

Fix microMIPS MOVE16 and MOVEP instructions on 64-bit processors by
using register addition operations.

This copies the approach taken with MIPS16 MOVE instructions (I8_MOV32R
and I8_MOVR32 opcodes) and follows the observation that OPC_ADDU expands
to tcg_gen_mov_tl whenever `rt' is 0 and `rs' is not, therefore copying
`rs' to `rd' verbatim.  This is not the case with OPC_ADDIU where a
sign-extension from bit #31 is made, unless in the uninteresting case of
`rs' being 0, losing the upper 32 bits of the value copied for any
proper 64-bit values.

This also serves as an optimization as one op is produced in generated
code rather than two (again, unless `rs' is 0, where it doesn't change
anything).
Signed-off-by: NMaciej W. Rozycki <macro@codesourcery.com>
Reviewed-by: NLeon Alrae <leon.alrae@imgtec.com>
Signed-off-by: NLeon Alrae <leon.alrae@imgtec.com>

Make writes to CP0.Status and CP0.Cause have the same effect as
executing corresponding MTC0 instructions would in Kernel Mode.  Also
ignore writes in the user emulation mode.

Currently for requests from the GDB stub we write all the bits across
both registers, ignoring any read-only locations, and do not synchronise
the environment to evaluate side effects.  We also write these registers
in the user emulation mode even though a real kernel presents them as
read only.
Signed-off-by: NMaciej W. Rozycki <macro@codesourcery.com>
Signed-off-by: NLeon Alrae <leon.alrae@imgtec.com>

Correct these issues with the handling of CP0.Status for MIPSr6:

* only ignore the bit pattern of 0b11 on writes to CP0.Status.KSU, that
  is for processors that do implement Supervisor Mode, let the bit
  pattern be written to CP0.Status.UM:R0 freely (of course the value
  written to read-only CP0.Status.R0 will be discarded anyway); this is
  in accordance to the relevant architecture specification[1],

* check the newly written pattern rather than the current contents of
  CP0.Status for the KSU bits being 0b11,

* use meaningful macro names to refer to CP0.Status bits rather than
  magic numbers.

References:

[1] "MIPS Architecture For Programmers, Volume III: MIPS64 / microMIPS64
    Privileged Resource Architecture", MIPS Technologies, Inc., Document
    Number: MD00091, Revision 6.00, March 31, 2014, Table 9.45 "Status
    Register Field Descriptions", pp. 210-211.
Signed-off-by: NMaciej W. Rozycki <macro@codesourcery.com>
Reviewed-by: NLeon Alrae <leon.alrae@imgtec.com>
Signed-off-by: NLeon Alrae <leon.alrae@imgtec.com>

Correct MIPS16/microMIPS branch size calculation in PC adjustment
needed:

- to set the value of CP0.ErrorEPC at the entry to the reset exception,

- for the purpose of branch reexecution in the context of device I/O.

Follow the approach taken in `exception_resume_pc' for ordinary, Debug
and NMI exceptions.

MIPS16 and microMIPS branches can be 2 or 4 bytes in size and that has
to be reflected in calculation.  Original MIPS ISA branches, which is
where this code originates from, are always 4 bytes long, just as all
original MIPS ISA instructions.
Signed-off-by: NNathan Froyd <froydnj@codesourcery.com>
Signed-off-by: NMaciej W. Rozycki <macro@codesourcery.com>
Reviewed-by: NLeon Alrae <leon.alrae@imgtec.com>
Signed-off-by: NLeon Alrae <leon.alrae@imgtec.com>

Restore the order of helpers that used to be: unary operations (generic,
then MIPS-specific), binary operations (generic, then MIPS-specific),
compare operations.  At one point FMA operations were inserted at a
random place in the file, disregarding the preexisting order, and later
on even more operations sprinkled across the file.  Revert the mess by
moving FMA operations to a new ternary class inserted after the binary
class and move the misplaced unary and binary operations to where they
belong.
Signed-off-by: NMaciej W. Rozycki <macro@codesourcery.com>
Signed-off-by: NLeon Alrae <leon.alrae@imgtec.com>

Remove the `FLOAT_OP' macro, unused since commit
b6d96bed [Use temporary registers for
the MIPS FPU emulation.].
Signed-off-by: NMaciej W. Rozycki <macro@codesourcery.com>
Signed-off-by: NLeon Alrae <leon.alrae@imgtec.com>

Move the call to `update_fcr31' in `helper_float_cvtw_s' after the
exception flag check, for consistency with the remaining helpers that do
it last too.
Signed-off-by: NMaciej W. Rozycki <macro@codesourcery.com>
Signed-off-by: NLeon Alrae <leon.alrae@imgtec.com>

Signed-off-by: NMaciej W. Rozycki <macro@codesourcery.com>
Signed-off-by: NLeon Alrae <leon.alrae@imgtec.com>

Signed-off-by: NMaciej W. Rozycki <macro@codesourcery.com>
Signed-off-by: NLeon Alrae <leon.alrae@imgtec.com>

Signed-off-by: NMaciej W. Rozycki <macro@codesourcery.com>
Signed-off-by: NLeon Alrae <leon.alrae@imgtec.com>