SSE function tables could easily be corrupted because of use
of void pointers.

Introduce function pointer types and helper variables in order
to improve type safety.

Split sse_op_table3 according to types used.
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

Add an explicit CPUX86State parameter instead of relying on AREG0.

Merge raise_exception_env() to raise_exception(), likewise with
raise_exception_err_env() and raise_exception_err().

Introduce cpu_svm_check_intercept_param() and cpu_vmexit()
as wrappers.
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

Scripted conversion:
  sed -i "s/CPUState/CPUX86State/g" target-i386/*.[hc]
  sed -i "s/#define CPUX86State/#define CPUState/" target-i386/cpu.h
Signed-off-by: NAndreas Färber <afaerber@suse.de>
Acked-by: NAnthony Liguori <aliguori@us.ibm.com>

Commit 2355c16e introduced a new ldmxcsr
helper taking an i32 argument, but the helper is actually passed a long.
Fix that by truncating the long to i32.
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

SSE rounding and flush to zero control has never been implemented. However
given that softfloat-native was using a single state for FPU and SSE and
given that glibc is setting both FPU and SSE state in fesetround(), this
was working correctly up to the switch to softfloat.

Fix that by adding an update_sse_status() function similar to
update_fpu_status(), and callin git on write to mxcsr.
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

When the i386 cmpxchg instruction is executed with a memory operand
and the comparison result is "unequal", do the memory write before
changing the accumulator instead of the other way around, because
otherwise the new accumulator value will incorrectly be used in the
comparison when the instruction is restarted after a page fault.

This bug was originally reported on 2010-04-25 as
https://bugs.launchpad.net/qemu/+bug/569760Signed-off-by: NAndreas Gustafsson <gson@gson.org>

T0 was already masked to 16 bits when loading it.
Signed-off-by: NJan Kiszka <jan.kiszka@siemens.com>
Reviewed-by: NRichard Henderson <rth@twiddle.net>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

Remove also two assert statements which were the last remaining users.
Signed-off-by: NStefan Weil <weil@mail.berlios.de>
Signed-off-by: NStefan Hajnoczi <stefanha@linux.vnet.ibm.com>

The (x << (cl - 1)) quantity is only used if CL != 0.  Move the
computation of that quantity nearer its use.

This avoids the creation of undefined TCG operations when the
constant propagation optimization proves that CL == 0, and thus
CL-1 is outside the range [0-wordsize).
Signed-off-by: NRichard Henderson <rth@twiddle.net>
Signed-off-by: Nmalc <av1474@comtv.ru>

Most exec-all.h include directives are now useless, remove them.
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

While trying to use qemu -cpu pentium3 to test for incorrect uses of certain
SSE2 instructions, I found that QEMU allowed the mfence and lfence
instructions to be executed even though Pentium 3 doesn't support them.

According to the processor specs (and experience on a real Pentium 3), these
instructions are only available with SSE2, but QEMU is checking for SSE.  The
check for the related sfence instruction is correct (it works with SSE).

This trival patch fixes the test.
Signed-off-by: NMartin Simmons <martin@lispworks.com>
Signed-off-by: NStefan Hajnoczi <stefanha@linux.vnet.ibm.com>

Function gen_pc_load was introduced in commit
d2856f1a.
The only reason for parameter searched_pc was
a debug statement in target-i386/translate.c.

Parameter puc was needed by target-sparc until
commit d7da2a10.

Remove searched_pc from the debug statement and remove both
parameters from the parameter list of gen_pc_load.

As the function name gen_pc_load was also misleading,
it is now called restore_state_to_opc. This new name
was suggested by Peter Maydell, thanks.

v2: Remove last parameter, too, and rename the function.

v3: Fix [] typo in target-arm/translate.c.
    Fix wrong SHA1 object name in commit message (copy+paste error).

Cc: Aurelien Jarno <aurelien@aurel32.net>
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NStefan Weil <weil@mail.berlios.de>

tcg_gen_exit_tb takes a parameter of type tcg_target_long,
so the type casts of pointer to long should be replaced by
type casts of pointer to tcg_target_long (suggested by Blue Swirl).

These changes are needed for build environments where
sizeof(long) != sizeof(void *), especially for w64.
Signed-off-by: NStefan Weil <weil@mail.berlios.de>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

Use this for assignment to the low byte or low word of a register.
Acked-by: NAurelien Jarno <aurelien@aurel32.net>
Signed-off-by: NRichard Henderson <rth@twiddle.net>
Signed-off-by: NEdgar E. Iglesias <edgar.iglesias@gmail.com>

This patch simplifies target-i386/translate.c a bit by replacing some
code with gen_update_cc_op()
Signed-off-by: NJun Koi <junkoi2004@gmail.com>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

This patch replaces constant value assigned for (DisasContext
*)->is_jmp with DISAS_TB_JUMP.
Signed-off-by: NJun Koi <junkoi2004@gmail.com>
Signed-off-by: NEdgar E. Iglesias <edgar.iglesias@gmail.com>

ssse3 uses tables with only two entries per op, but it is indexed
with b1 which can contain variables upto 3. This happens when ssse3
or sse4 are used with REP* prefixes.

Add boundary checking for this case.
Signed-off-by: NAndi Kleen <ak@linux.intel.com>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

We were ignoring REX_B while special-casing NOP, i.e. xchg eax,eax.
Signed-off-by: NRichard Henderson <rth@twiddle.net>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

Negative four byte displacements need to be sign-extended after
c086b783.  Do so.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Acked-by: NRichard Henderson  <rth@twiddle.net>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

The proper logging for -d cpu is done in generic code.
Signed-off-by: NRichard Henderson <rth@twiddle.net>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

Value stored is never read.
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

The commit c2254920 led movntps &
movntdq to be translated incorrectly.
Signed-off-by: NTeLeMan <geleman@gmail.com>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

A SIB byte with an index of 4 means "no scaled index", even if the scale
value is not 0. In 64-bit mode, if REX.X is used, an index of 4 selects
%r12. This is correctly handled by the computation of the index variable,
which includes the index bits, and also the REX.X prefix:

    index = ((code >> 3) & 7) | REX_X(s);

Thanks to Avi Kivity, Jamie Lokier and Malc for the analysis of the
problem and the initial patch.
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

Signed-off-by: Nmalc <av1474@comtv.ru>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

This instruction load data from memory to register and not the reverse.
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

clang-analyzer points out a redundant assignment.
Signed-off-by: NAmit Shah <amit.shah@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Similarly to what is done in 32938e12
for "jmp im", trunc the immediate to 32-bit when not running in 64-bit
mode.
Reported-by: NKevin O'Connor <kevin@koconnor.net>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

lzcnt is a AMD Phenom/Barcelona added instruction returning the
number of leading zero bits in a word.
As this is similar to the "bsr" instruction, reuse the existing
code. There need to be some more changes, though, as lzcnt always
returns a valid value (in opposite to bsr, which has a special
case when the operand is 0).
lzcnt is guarded by the ABM CPUID bit (Fn8000_0001:ECX_5).
Signed-off-by: NAndre Przywara <andre.przywara@amd.com>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

The arpl implementation in target-i386/translate.c uses cpu_A0
temporary across a brcond op.  This patch fixes that issue.
Signed-off-by: NLaurent Desnogues <laurent.desnogues@gmail.com>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

This patch corrects the following aspects of exception generation in
fxsave/fxrstor:

* Generate #GP if the operand is not aligned to a 16 byte boundary
* Generate #UD if the LOCK prefix is used
* For CR0.EM = 1 #NM is generated, not #UD
Signed-off-by: NKevin Wolf <mail@kevin-wolf.de>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

RDTSCP reads the time stamp counter and atomically also the content
of a 32-bit MSR, which can be freely set by the OS. This allows CPU
local data to be queried by userspace.
Linux uses this to allow a fast implementation of the getcpu()
syscall, which uses the vsyscall page to avoid a context switch.
AMD CPUs since K8RevF and Intel CPUs since Nehalem support this
instruction.
RDTSCP is guarded by the RDTSCP CPUID bit (Fn8000_0001:EDX[27]).
Signed-off-by: NAndre Przywara <andre.przywara@amd.com>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

This adds support for the AMD Phenom/Barcelona's SSE4a instructions.
Those include insertq and extrq, which are doing shift and mask on
XMM registers, in two versions (immediate shift/length values and
stored in another XMM register).
Additionally it implements movntss, movntsd, which are scalar
non-temporal stores (avoiding cache trashing). These are implemented
as normal stores, though.
SSE4a is guarded by the SSE4A CPUID bit (Fn8000_0001:ECX[6]).
Signed-off-by: NAndre Przywara <andre.przywara@amd.com>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

AMD CPUs featuring a shortcut to access CR8 even from 32-bit mode.
If you use the LOCK prefix with "mov CR0", it accesses CR8 instead.
This behavior is guarded by the CR8_LEGACY CPUID bit
(Fn8000_0001:ECX[1]).
Signed-off-by: NAndre Przywara <andre.przywara@amd.com>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

Use globals for the 8 or 16 CPU registers on i386 and x86_64.
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

Problem: Our file sys-queue.h is a copy of the BSD file, but there are
some additions and it's not entirely compatible. Because of that, there have
been conflicts with system headers on BSD systems. Some hacks have been
introduced in the commits 15cc9235,
f40d7537,
96555a96 and
3990d09a but the fixes were fragile.

Solution: Avoid the conflict entirely by renaming the functions and the
file. Revert the previous hacks.
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

Signed-off-by: NJuan Quintela <quintela@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>