For AArch32 exceptions, the only information provided about
the cause of an exception is the individual exception type (data
abort, undef, etc), which we store in cs->exception_index. For
AArch64, the CPU provides much more detail about the cause of
the exception, which can be found in the syndrome register.
Create a set of fields in CPUARMState which must be filled in
whenever an exception is raised, so that exception entry can
correctly fill in the syndrome register for the guest.
This includes the information which in AArch32 appears in
the DFAR and IFAR (fault address registers) and the DFSR
and IFSR (fault status registers) for data aborts and
prefetch aborts, since if we end up taking the MMU fault
to AArch64 rather than AArch32 this will need to end up
in different system registers.

This patch does a refactoring which moves the setting of the
AArch32 DFAR/DFSR/IFAR/IFSR from the point where the exception
is raised to the point where it is taken. (This is no change
for cores with an MMU, retains the existing clearly incorrect
behaviour for ARM946 of trashing the MP access permissions
registers which share the c5_data and c5_insn state fields,
and has no effect for v7M because we don't implement its
MPU fault status or address registers.)

As a side effect of the cleanup we fix a bug in the AArch64
linux-user mode code where we were passing a 64 bit fault
address through the 32 bit c6_data/c6_insn fields: it now
goes via the always-64-bit exception.vaddress.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Reviewed-by: NPeter Crosthwaite <peter.crosthwaite@xilinx.com>

Implement the DAIF system register which is a view of the
DAIF bits in PSTATE. To avoid needing a readfn, we widen
the daif field in CPUARMState to uint64_t.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Reviewed-by: NPeter Crosthwaite <peter.crosthwaite@xilinx.com>

Currently cpu.h defines a mixture of functions and types needed by
the rest of QEMU and those needed only by files within target-arm/.
Split the latter out into a new header so they aren't needlessly
exposed further than required.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Reviewed-by: NPeter Crosthwaite <peter.crosthwaite@xilinx.com>

* remotes/rth/tcg-aarch-6-5: (25 commits)
  tcg-aarch64: Use tcg_out_mov in preference to tcg_out_movr
  tcg-aarch64: Prefer unsigned offsets before signed offsets for ldst
  tcg-aarch64: Introduce tcg_out_insn_3312, _3310, _3313
  tcg-aarch64: Merge aarch64_ldst_get_data/type into tcg_out_op
  tcg-aarch64: Introduce tcg_out_insn_3507
  tcg-aarch64: Support stores of zero
  tcg-aarch64: Implement TCG_TARGET_HAS_new_ldst
  tcg-aarch64: Pass qemu_ld/st arguments directly
  tcg-aarch64: Use TCGMemOp in qemu_ld/st
  tcg-aarch64: Use ADR to pass the return address to the ld/st helpers
  tcg-aarch64: Use tcg_out_call for qemu_ld/st
  tcg-aarch64: Avoid add with zero in tlb load
  tcg-aarch64: Implement tcg_register_jit
  tcg-aarch64: Introduce tcg_out_insn_3314
  tcg-aarch64: Reuse LR in translated code
  tcg-aarch64: Use CBZ and CBNZ
  tcg-aarch64: Create tcg_out_brcond
  tcg-aarch64: Use symbolic names for branches
  tcg-aarch64: Use adrp in tcg_out_movi
  tcg-aarch64: Special case small constants in tcg_out_movi
  ...
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

It's the more canonical interface.
Reviewed-by: NClaudio Fontana <claudio.fontana@huawei.com>
Signed-off-by: NRichard Henderson <rth@twiddle.net>

The assembler seems to prefer them, perhaps we should too.
Reviewed-by: NClaudio Fontana <claudio.fontana@huawei.com>
Signed-off-by: NRichard Henderson <rth@twiddle.net>

Replace aarch64_ldst_op_data with AArch64LdstType, as it wasn't encoded
for the proper shift for the field and was confusing.

Merge aarch64_ldst_op_data, AArch64LdstType, and a few stray opcode bits
into a single I3312_* argument, eliminating some magic numbers from the
helper functions.
Reviewed-by: NClaudio Fontana <claudio.fontana@huawei.com>
Signed-off-by: NRichard Henderson <rth@twiddle.net>

Reviewed-by: NClaudio Fontana <claudio.fontana@huawei.com>
Signed-off-by: NRichard Henderson <rth@twiddle.net>

Cleaning up the implementation of REV and REV16 at the same time.
Reviewed-by: NClaudio Fontana <claudio.fontana@huawei.com>
Signed-off-by: NRichard Henderson <rth@twiddle.net>

Reviewed-by: NClaudio Fontana <claudio.fontana@huawei.com>
Signed-off-by: NRichard Henderson <rth@twiddle.net>

Reviewed-by: NClaudio Fontana <claudio.fontana@huawei.com>
Signed-off-by: NRichard Henderson <rth@twiddle.net>

Instead of passing them the "args" array.
Reviewed-by: NClaudio Fontana <claudio.fontana@huawei.com>
Signed-off-by: NRichard Henderson <rth@twiddle.net>

Making the bswap conditional on the memop instead of a compile-time test.
Reviewed-by: NClaudio Fontana <claudio.fontana@huawei.com>
Signed-off-by: NRichard Henderson <rth@twiddle.net>

Reviewed-by: NClaudio Fontana <claudio.fontana@huawei.com>
Signed-off-by: NRichard Henderson <rth@twiddle.net>

In some cases, a direct branch will be in range.
Reviewed-by: NClaudio Fontana <claudio.fontana@huawei.com>
Signed-off-by: NRichard Henderson <rth@twiddle.net>

Some guest env are small enough to reach the tlb with only a 12-bit addition.
Reviewed-by: NClaudio Fontana <claudio.fontana@huawei.com>
Signed-off-by: NRichard Henderson <rth@twiddle.net>

Reviewed-by: NClaudio Fontana <claudio.fontana@huawei.com>
Signed-off-by: NRichard Henderson <rth@twiddle.net>

Combines 4 other inline functions and tidies the prologue.
Reviewed-by: NClaudio Fontana <claudio.fontana@huawei.com>
Signed-off-by: NRichard Henderson <rth@twiddle.net>

It's obviously call-clobbered, but is otherwise unused.
Repurpose it as the TCG temporary.
Reviewed-by: NClaudio Fontana <claudio.fontana@huawei.com>
Signed-off-by: NRichard Henderson <rth@twiddle.net>

A compare and branch against zero happens at the start of
every single TB.
Reviewed-by: NClaudio Fontana <claudio.fontana@huawei.com>
Signed-off-by: NRichard Henderson <rth@twiddle.net>

Rearrange code to put the compare and branch in the same place.
Reviewed-by: NClaudio Fontana <claudio.fontana@huawei.com>
Signed-off-by: NRichard Henderson <rth@twiddle.net>

Reviewed-by: NClaudio Fontana <claudio.fontana@huawei.com>
Signed-off-by: NRichard Henderson <rth@twiddle.net>

Loading an qemu pointer as an immediate happens often.  E.g.

- exit_tb $0x7fa8140013
+ exit_tb $0x7f81ee0013
...
- :  d2800260        mov     x0, #0x13
- :  f2b50280        movk    x0, #0xa814, lsl #16
- :  f2c00fe0        movk    x0, #0x7f, lsl #32
+ :  90ff1000        adrp    x0, 0x7f81ee0000
+ :  91004c00        add     x0, x0, #0x13
Reviewed-by: NClaudio Fontana <claudio.fontana@huawei.com>
Signed-off-by: NRichard Henderson <rth@twiddle.net>

Reviewed-by: NClaudio Fontana <claudio.fontana@huawei.com>
Signed-off-by: NRichard Henderson <rth@twiddle.net>

The subset of logical immediates that we support is quite quick to test,
and such constants are quite common to want to load.
Reviewed-by: NClaudio Fontana <claudio.fontana@huawei.com>
Signed-off-by: NRichard Henderson <rth@twiddle.net>

When profitable, initialize the register with MOVN instead of MOVZ,
before setting the remaining lanes with MOVK.
Reviewed-by: NClaudio Fontana <claudio.fontana@huawei.com>
Signed-off-by: NRichard Henderson <rth@twiddle.net>

Rather than raw constants that could mean anything.
Reviewed-by: NClaudio Fontana <claudio.fontana@huawei.com>
Signed-off-by: NRichard Henderson <rth@twiddle.net>

As opposed to tcg_target_long.
Reviewed-by: NClaudio Fontana <claudio.fontana@huawei.com>
Signed-off-by: NRichard Henderson <rth@twiddle.net>

Since the kernel doesn't pass any info on the reason for the fault,
disassemble the instruction to detect a store.
Reviewed-by: NAlex Bennée <alex.bennee@linaro.org>
Reviewed-by: NClaudio Fontana <claudio.fontana@huawei.com>
Signed-off-by: NRichard Henderson <rth@twiddle.net>

Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

This reverts commit b533f658.

The original code was wrong, because effectively it ignored errors
from kernel, because kernel does not return -1 on error case but
returns -errno, and does not return -EPERM for this particular ioctl.
But in some cases kernel actually returned unsuccessful result,
namely, when the dirty bitmap in requested slot does not exist
it returns -ENOENT.  With new code this condition becomes an
error when it shouldn't be.

Revert that patch instead of fixing it properly this late in the
release process.  I disagree with this approach, but let's make
things move _somewhere_, instead of arguing endlessly whch of
the 2 proposed fixes is better.
Signed-off-by: NMichael Tokarev <mjt@tls.msk.ru>
Message-id: 1397477644-902-1-git-send-email-mjt@msgid.tls.msk.ru
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

acpi: SSDT update

This has a fix by Igor for a regression introduced by
bridge hotplug code.
Expected test files were updated accordingly.
Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>

# gpg: Signature made Mon 14 Apr 2014 13:13:35 BST using RSA key ID D28D5469
# gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>"
# gpg:                 aka "Michael S. Tsirkin <mst@redhat.com>"

* remotes/mst/tags/for_upstream:
  acpi-test: update expected files
  acpi: fix incorrect encoding for 0x{F-1}FFFF
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

The SMART self test counter was incorrectly being reset to zero,
not 1. This had the effect that on every 21st SMART EXECUTE OFFLINE:
 * We would write off the beginning of a dynamically allocated buffer
 * We forgot the SMART history
Fix this.
Signed-off-by: NBenoit Canet <benoit@irqsave.net>
Message-id: 1397336390-24664-1-git-send-email-benoit.canet@irqsave.net
Reviewed-by: NMarkus Armbruster <armbru@redhat.com>
Cc: qemu-stable@nongnu.org
Acked-by: NKevin Wolf <kwolf@redhat.com>
[PMM: tweaked commit message as per suggestions from Markus]
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

commit 58b035c7354afc0c5351ea62264c01d74196ec26
    acpi: fix incorrect encoding for 0x{F-1}FFFF
changes the SSDT, update expected files accordingly.
Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>

Fix typo in build_append_int() which causes integer
truncation when it's in range 0x{F-1}FFFF by packing it
as WordConst instead of required DWordConst.

In partucular this fixes a regression: hotplug in slots 16,17,18 and 19
didn't work, since SSDT had code like this:

                If (And (Arg0, 0x0000))
                {
                    Notify (S80, Arg1)
                }
Signed-off-by: NIgor Mammedov <imammedo@redhat.com>
Reviewed-by: NMichael S. Tsirkin <mst@redhat.com>
Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>
Reviewed-by: NStefan Weil <sw@weilnetz.de>

Since we use the -fstack-protector argument at both compile and
link time in the build, we must check that it works with both
a compile and a link:
 * MacOSX only fails in the compile step, not linking
 * some gcc cross environments only fail at the link stage (if they
   require a libssp and it's not present for some reason)
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Message-id: 1397232832-32301-1-git-send-email-peter.maydell@linaro.org
Tested-by: NAlexey Kardashevskiy <aik@ozlabs.ru>

CVE-2013-4544
Signed-off-by: NDmitry Fleytman <dmitry@daynix.com>
Reported-by: NMichael S. Tsirkin <mst@redhat.com>
Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>
Reviewed-by: NDr. David Alan Gilbert <dgilbert@redhat.com>
Message-id: 1396604722-11902-5-git-send-email-dmitry@daynix.com
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

CVE-2013-4544
Signed-off-by: NDmitry Fleytman <dmitry@daynix.com>
Reported-by: NMichael S. Tsirkin <mst@redhat.com>
Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>
Reviewed-by: NDr. David Alan Gilbert <dgilbert@redhat.com>
Message-id: 1396604722-11902-4-git-send-email-dmitry@daynix.com
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>