Don't generate handlers for IRQ levels that are not defined for the CPU
or for window overflow/underflow exceptions for configs w/o windowed
registers.
Signed-off-by: NMax Filippov <jcmvbkbc@gmail.com>

Not all CPU configurations may have enough space for handler code
between exception/interrupt vectors. Leave jumps to the handlers at the
vectors, but move all handlers past the vectors area.
Signed-off-by: NMax Filippov <jcmvbkbc@gmail.com>

- FPU2000 defines rfr and wfr opcodes, not rfr.s and wfr.s;
- movcond.s uses incorrect operand in tcg_gen_movcond: in case the
  condition is not satisfied it must not change its argument 0.

Fixes: c04e1692 ("target/xtensa: extract FPU2000 opcode
translators")
Cc: qemu-stable@nongnu.org
Signed-off-by: NMax Filippov <jcmvbkbc@gmail.com>

Failed memory transactions should raise exceptions 14 (for fetch) or 15
(for load/store) with XEA2.

Memory accesses that result in TLB miss followed by an attempt to load
PTE from physical memory which fails should raise InstTLBMiss or
LoadStoreTLBMiss with XEA2.
Signed-off-by: NMax Filippov <jcmvbkbc@gmail.com>

Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NMax Filippov <jcmvbkbc@gmail.com>

This is big-endian core with HiFi2 instructions.
Signed-off-by: NMax Filippov <jcmvbkbc@gmail.com>

- move register counting to xtensa/gdbstub.c
- add symbolic names for register types and flags from GDB and use them
  in register counting and access functions.
Signed-off-by: NMax Filippov <jcmvbkbc@gmail.com>

This fixes communication with gdb in the presence of type-5 (TIE state
mapped on user registers) and type-7 (special case of masked registers)
registers in the xtensa core config.

Cc: qemu-stable@nongnu.org
Signed-off-by: NMax Filippov <jcmvbkbc@gmail.com>

x86 queue, 2018-08-16

Bug fix:
* Some guests may crash when using "-cpu host" due to TOPOEXT,
  disable it by default

Features:
* PV_SEND_IPI feature bit
* Icelake-{Server,Client} CPU models
* New CPUID feature bits: PV_SEND_IPI, WBNOINVD, PCONFIG, ARCH_CAPABILITIES

Documentation:
* docs/qemu-cpu-models.texi

# gpg: Signature made Fri 17 Aug 2018 02:33:09 BST
# gpg:                using RSA key 2807936F984DC5A6
# gpg: Good signature from "Eduardo Habkost <ehabkost@redhat.com>"
# Primary key fingerprint: 5A32 2FD5 ABC4 D3DB ACCF  D1AA 2807 936F 984D C5A6

* remotes/ehabkost/tags/x86-next-pull-request:
  i386: Disable TOPOEXT by default on "-cpu host"
  target-i386: adds PV_SEND_IPI CPUID feature bit
  i386: Add new CPU model Icelake-{Server,Client}
  i386: Add CPUID bit for WBNOINVD
  i386: Add CPUID bit for PCONFIG
  i386: Add CPUID bit and feature words for IA32_ARCH_CAPABILITIES MSR
  i386: Add new MSR indices for IA32_PRED_CMD and IA32_ARCH_CAPABILITIES
  docs: add guidance on configuring CPU models for x86
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

MIPS queue Aug 16, 2018

# gpg: Signature made Thu 16 Aug 2018 18:19:36 BST
# gpg:                using RSA key D4972A8967F75A65
# gpg: Good signature from "Aleksandar Markovic <amarkovic@wavecomp.com>"
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg:          There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 8526 FBF1 5DA3 811F 4A01  DD75 D497 2A89 67F7 5A65

* remotes/amarkovic/tags/mips-queue-aug-2018:
  qemu-doc: Amend MIPS-related items
  linux-user: Add preprocessor availability control to some syscalls
  linux-user: Update MIPS syscall numbers up to kernel 4.18 headers
  elf: Add ELF flags for MIPS machine variants
  elf: Remove duplicate preprocessor constant definition
  target/mips: Check ELPA flag only in some cases of MFHC0 and MTHC0
  target/mips: Don't update BadVAddr register in Debug Mode
  target/mips: Implement CP0 Config1.WR bit functionality
  target/mips: Add CP0 BadInstrX register
  target/mips: Update some CP0 registers bit definitions
  target/mips: Fix two instances of shadow variables
  target/mips: Mark switch fallthroughs with interpretable comments
  target/mips: Avoid case statements formulated by ranges - part 2
  target/mips: Avoid case statements formulated by ranges - part 1
  MAINTAINERS: Update target/mips maintainer's email addresses
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Amend MIPS-related items in qemu-doc.texi
Reviewed-by: NThomas Huth <thuth@redhat.com>
Signed-off-by: NAleksandar Markovic <amarkovic@wavecomp.com>
Signed-off-by: NStefan Markovic <smarkovic@wavecomp.com>

Add ability to target platforms to individually include user-mode
support for system calls from "stat" group of system calls.

This change is related to new nanoMIPS platform in the sense that
it supports a different set of "stat" system calls than any other
target. nanoMIPS does not support structures stat and stat64 at
all. Also, support for certain number of other system calls is
dropped in nanoMIPS (those are most of the time obsoleted system
calls).

Without this patch, build for nanoMIPS would fail.
Reviewed-by: NRichard Henderson <richard.henderson@linaro.org>
Reviewed-by: NAleksandar Markovic <amarkovic@wavecomp.com>
Signed-off-by: NAleksandar Markovic <amarkovic@wavecomp.com>
Signed-off-by: NStefan Markovic <smarkovic@wavecomp.com>

Synchronize content of linux-user/mips/syscall_nr.h and
linux-user/mips64/syscall_nr.h with Linux kernel 4.18 headers.
This adds 9 new syscall numbers, the last being NR_io_pgetevents.
Reviewed-by: NLaurent Vivier <laurent@vivier.eu>
Reviewed-by: NRichard Henderson <richard.henderson@linaro.org>
Signed-off-by: NAleksandar Markovic <amarkovic@wavecomp.com>
Signed-off-by: NStefan Markovic <smarkovic@wavecomp.com>

Add MIPS machine variants ELF flags so that the emulation behavior
can be adjusted if needed.
Reviewed-by: NPhilippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: NLaurent Vivier <laurent@vivier.eu>
Reviewed-by: NRichard Henderson <richard.henderson@linaro.org>
Signed-off-by: NAleksandar Markovic <amarkovic@wavecomp.com>
Signed-off-by: NStefan Markovic <smarkovic@wavecomp.com>

Remove duplicate preprocessor constant definition for EF_MIPS_ARCH.

The duplicate was introduced in commit 45506bdd. It placed the
constant EF_MIPS_ARCH in a better place, however it did not remove
the original. This patch removes the original occurrence.
Reviewed-by: NPhilippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: NRichard Henderson <richard.henderson@linaro.org>
Signed-off-by: NAleksandar Markovic <amarkovic@wavecomp.com>

MFHC0 and MTHC0 used to handle EntryLo0 and EntryLo1 registers only,
and placing ELPA flag checks before switch statement were technically
correct. However, after adding handling more registers, these checks
should be moved to act only in cases of handling EntryLo0 and
EntryLo1.
Reviewed-by: NPhilippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: NAleksandar Markovic <amarkovic@wavecomp.com>
Reviewed-by: NRichard Henderson <richard.henderson@linaro.org>
Signed-off-by: NYongbok Kim <yongbok.kim@mips.com>
Signed-off-by: NAleksandar Markovic <amarkovic@wavecomp.com>
Signed-off-by: NStefan Markovic <smarkovic@wavecomp.com>

BadVAddr should not be updated if (env->hflags & MIPS_HFLAG_DM) is
set.
Reviewed-by: NPhilippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: NRichard Henderson <richard.henderson@linaro.org>
Signed-off-by: NYongbok Kim <yongbok.kim@mips.com>
Signed-off-by: NAleksandar Markovic <amarkovic@wavecomp.com>

Add testing Config1.WR bit into watch exception handling logic.
Reviewed-by: NRichard Henderson <richard.henderson@linaro.org>
Reviewed-by: NAleksandar Markovic <amarkovic@wavecomp.com>
Signed-off-by: NAleksandar Markovic <amarkovic@wavecomp.com>
Signed-off-by: NStefan Markovic <smarkovic@wavecomp.com>

Add CP0 BadInstrX register. This register will be used in nanoMIPS.
Reviewed-by: NAleksandar Markovic <amarkovic@wavecomp.com>
Reviewed-by: NPhilippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: NRichard Henderson <richard.henderson@linaro.org>
Signed-off-by: NStefan Markovic <smarkovic@wavecomp.com>
Signed-off-by: NYongbok Kim <yongbok.kim@mips.com>
Signed-off-by: NAleksandar Markovic <amarkovic@wavecomp.com>

Update CP0 registers Config0, Config1, Config2, Config3,
Config4, and Config5 bit definitions.

Some of these bits will be utilized by upcoming nanoMIPS changes.
Reviewed-by: NPhilippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: NRichard Henderson <richard.henderson@linaro.org>
Signed-off-by: NAleksandar Markovic <amarkovic@wavecomp.com>

Fix two instances of shadow variables. This cleans up entire file
translate.c from shadow variables.
Reviewed-by: NPhilippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: NRichard Henderson <richard.henderson@linaro.org>
Signed-off-by: NAleksandar Markovic <amarkovic@wavecomp.com>
Signed-off-by: NStefan Markovic <smarkovic@wavecomp.com>

Mark switch fallthroughs with comments, in cases fallthroughs
are intentional.

The comments "/* fall through */" are interpreted by compilers and
other tools, and they will not issue warnings in such cases. For gcc,
the warning is turnend on by -Wimplicit-fallthrough. With this patch,
there will be no such warnings in target/mips directory. If such
warning appears in future, it should be checked if it is intentional,
and, if yes, marked with a comment similar to those from this patch.

The comment must be just before next "case", otherwise gcc won't
understand it.
Reviewed-by: NPhilippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: NRichard Henderson <richard.henderson@linaro.org>
Signed-off-by: NAleksandar Markovic <amarkovic@wavecomp.com>
Signed-off-by: NStefan Markovic <smarkovic@wavecomp.com>

Remove "range style" case statements to make code analysis easier.
This patch handles cases when the values in the range in question
were not properly defined.
Reviewed-by: NRichard Henderson <richard.henderson@linaro.org>
Reviewed-by: NAleksandar Markovic <amarkovic@wavecomp.com>
Signed-off-by: NAleksandar Markovic <amarkovic@wavecomp.com>
Signed-off-by: NStefan Markovic <amarkovic@wavecomp.com>

Remove "range style" case statements to make code analysis easier.

This is needed also for some upcoming nanoMIPS-related refactorings.
Reviewed-by: NPhilippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: NRichard Henderson <richard.henderson@linaro.org>
Signed-off-by: NAleksandar Markovic <amarkovic@wavecomp.com>

Update email addresses of Aleksandar Markovic and Paul Burton in the
MAINTAINERS file. Also, add corresponding items in the .mailmap file.
Reviewed-by: NPhilippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: NRichard Henderson <richard.henderson@linaro.org>
Signed-off-by: NAleksandar Markovic <amarkovic@wavecomp.com>

Enabling TOPOEXT is always allowed, but it can't be enabled
blindly by "-cpu host" because it may make guests crash if the
rest of the cache topology information isn't provided or isn't
consistent.

This addresses the bug reported at:
https://bugzilla.redhat.com/show_bug.cgi?id=1613277Signed-off-by: NEduardo Habkost <ehabkost@redhat.com>
Message-Id: <20180809221852.15285-1-ehabkost@redhat.com>
Tested-by: NRichard W.M. Jones <rjones@redhat.com>
Reviewed-by: NBabu Moger <babu.moger@amd.com>
Signed-off-by: NEduardo Habkost <ehabkost@redhat.com>

Adds PV_SEND_IPI CPUID feature bit.

Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Eduardo Habkost <ehabkost@redhat.com>
Cc: Radim Krčmář <rkrcmar@redhat.com>
Cc: Vitaly Kuznetsov <vkuznets@redhat.com>
Signed-off-by: NWanpeng Li <wanpengli@tencent.com>
Message-Id: <1530526971-1812-1-git-send-email-wanpengli@tencent.com>
Signed-off-by: NEduardo Habkost <ehabkost@redhat.com>

New CPU models mostly inherit features from ancestor Skylake, while addin new
features: UMIP, New Instructions ( PCONIFIG (server only), WBNOINVD,
AVX512_VBMI2, GFNI, AVX512_VNNI, VPCLMULQDQ, VAES, AVX512_BITALG),
Intel PT and 5-level paging (Server only). As well as
IA32_PRED_CMD, SSBD support for speculative execution
side channel mitigations.

Note:
For 5-level paging, Guest physical address width can be configured, with
parameter "phys-bits". Unless explicitly specified, we still use its default
value, even for Icelake-Server cpu model.
At present, hold on expose IA32_ARCH_CAPABILITIES to guest, as 1) This MSR
actually presents more than 1 'feature', maintainers are considering expanding current
features presentation of only CPUIDs to MSR bits; 2) a reasonable default value
for MSR_IA32_ARCH_CAPABILITIES needs to settled first. These 2 are actully
beyond Icelake CPU model itself but fundamental. So split these work apart
and do it later.
https://lists.gnu.org/archive/html/qemu-devel/2018-07/msg00774.html
https://lists.gnu.org/archive/html/qemu-devel/2018-07/msg00796.htmlSigned-off-by: NRobert Hoo <robert.hu@linux.intel.com>
Message-Id: <1530781798-183214-6-git-send-email-robert.hu@linux.intel.com>
Signed-off-by: NEduardo Habkost <ehabkost@redhat.com>

WBNOINVD: Write back and do not invalidate cache, enumerated by
CPUID.(EAX=80000008H, ECX=0):EBX[bit 9].
Signed-off-by: NRobert Hoo <robert.hu@linux.intel.com>
Message-Id: <1530781798-183214-5-git-send-email-robert.hu@linux.intel.com>
Signed-off-by: NEduardo Habkost <ehabkost@redhat.com>

PCONFIG: Platform configuration, enumerated by CPUID.(EAX=07H, ECX=0):
EDX[bit18].
Signed-off-by: NRobert Hoo <robert.hu@linux.intel.com>
Message-Id: <1530781798-183214-4-git-send-email-robert.hu@linux.intel.com>
Signed-off-by: NEduardo Habkost <ehabkost@redhat.com>

Support of IA32_PRED_CMD MSR already be enumerated by same CPUID bit as
SPEC_CTRL.

At present, mark CPUID_7_0_EDX_ARCH_CAPABILITIES unmigratable, per Paolo's
comment.
Signed-off-by: NRobert Hoo <robert.hu@linux.intel.com>
Message-Id: <1530781798-183214-3-git-send-email-robert.hu@linux.intel.com>
Signed-off-by: NEduardo Habkost <ehabkost@redhat.com>

IA32_PRED_CMD MSR gives software a way to issue commands that affect the state
of indirect branch predictors. Enumerated by CPUID.(EAX=7H,ECX=0):EDX[26].
IA32_ARCH_CAPABILITIES MSR enumerates architectural features of RDCL_NO and
IBRS_ALL. Enumerated by CPUID.(EAX=07H, ECX=0):EDX[29].

https://software.intel.com/sites/default/files/managed/c5/63/336996-Speculative-Execution-Side-Channel-Mitigations.pdfSigned-off-by: NRobert Hoo <robert.hu@linux.intel.com>
Message-Id: <1530781798-183214-2-git-send-email-robert.hu@linux.intel.com>
Signed-off-by: NEduardo Habkost <ehabkost@redhat.com>

With the recent set of CPU hardware vulnerabilities on x86, it is
increasingly difficult to understand which CPU configurations are
good to use and what flaws they might be vulnerable to.

This doc attempts to help management applications and administrators in
picking sensible CPU configuration on x86 hosts. It outlines which of
the named CPU models are good choices, and describes which extra CPU
flags should be enabled to allow the guest to mitigate hardware flaws.
Signed-off-by: NDaniel P. Berrangé <berrange@redhat.com>
Message-Id: <20180627160103.13634-1-berrange@redhat.com>
Signed-off-by: NEduardo Habkost <ehabkost@redhat.com>

target-arm queue:
 * Fixes for various bugs in SVE instructions
 * Add model of Freescale i.MX6 UltraLite 14x14 EVK Board
 * hw/arm: make bitbanded IO optional on ARMv7-M
 * Add model of Cortex-M0 CPU
 * Add support for loading Intel HEX files to the generic loader
 * imx_spi: Unset XCH when TX FIFO becomes empty
 * aspeed_sdmc: fix various bugs
 * Fix bugs in Arm FP16 instruction support
 * Fix aa64 FCADD and FCMLA decode
 * softfloat: Fix missing inexact for floating-point add
 * hw/arm/mps2-tz: Replace init_sysbus_child() with sysbus_init_child_obj()

# gpg: Signature made Thu 16 Aug 2018 14:33:41 BST
# gpg:                using RSA key 3C2525ED14360CDE
# gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>"
# gpg:                 aka "Peter Maydell <pmaydell@gmail.com>"
# gpg:                 aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>"
# Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83  15CF 3C25 25ED 1436 0CDE

* remotes/pmaydell/tags/pull-target-arm-20180816: (30 commits)
  hw/arm/mps2-tz: Replace init_sysbus_child() with sysbus_init_child_obj()
  softfloat: Fix missing inexact for floating-point add
  target/arm: Fix aa64 FCADD and FCMLA decode
  target/arm: Use FZ not FZ16 for SVE FCVT single-half and double-half
  target/arm: Use fp_status_fp16 for do_fmpa_zpzzz_h
  target/arm: Ignore float_flag_input_denormal from fp_status_f16
  target/arm: Adjust FPCR_MASK for FZ16
  aspeed: add a max_ram_size property to the memory controller
  aspeed_sdmc: Handle ECC training
  aspeed_sdmc: Init status always idle
  aspeed_sdmc: Set 'cache initial sequence' always true
  aspeed_sdmc: Fix saved values
  aspeed_sdmc: Extend number of valid registers
  imx_spi: Unset XCH when TX FIFO becomes empty
  Add QTest testcase for the Intel Hexadecimal
  loader: Implement .hex file loader
  loader: add rom transaction API
  loader: extract rom_free() function
  target/arm: add "cortex-m0" CPU model
  hw/arm: make bitbanded IO optional on ARMv7-M
  ...
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Now that we've got the common sysbus_init_child_obj() function, we do
not need the local init_sysbus_child() anymore.
Signed-off-by: NThomas Huth <thuth@redhat.com>
Message-id: 1534420566-15799-1-git-send-email-thuth@redhat.com
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

For 0x1.0000000000003p+0 + 0x1.ffffffep+14 = 0x1.0001fffp+15
we dropped the sticky bit and so failed to raise inexact.
Reported-by: NLaurent Desnogues <laurent.desnogues@gmail.com>
Signed-off-by: NRichard Henderson <richard.henderson@linaro.org>
Reviewed-by: NLaurent Desnogues <laurent.desnogues@gmail.com>
Tested-by: NLaurent Desnogues <laurent.desnogues@gmail.com>
Message-id: 20180810193129.1556-7-richard.henderson@linaro.org
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

These insns require u=1; failed to include that in the switch
cases.  This probably happened during one of the rebases just
before final commit.

Fixes: d17b7cdcSigned-off-by: NRichard Henderson <richard.henderson@linaro.org>
Reviewed-by: NLaurent Desnogues <laurent.desnogues@gmail.com>
Message-id: 20180810193129.1556-6-richard.henderson@linaro.org
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

We were using the wrong flush-to-zero bit for the non-half input.

Fixes: 46d33d1e
Cc: qemu-stable@nongnu.org (3.0.1)
Reported-by: NLaurent Desnogues <laurent.desnogues@gmail.com>
Signed-off-by: NRichard Henderson <richard.henderson@linaro.org>
Reviewed-by: NLaurent Desnogues <laurent.desnogues@gmail.com>
Tested-by: NLaurent Desnogues <laurent.desnogues@gmail.com>
Message-id: 20180810193129.1556-5-richard.henderson@linaro.org
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

This makes float16_muladd correctly use FZ16 not FZ.

Fixes: 6ceabaad
Cc: qemu-stable@nongnu.org (3.0.1)
Reported-by: NLaurent Desnogues <laurent.desnogues@gmail.com>
Signed-off-by: NRichard Henderson <richard.henderson@linaro.org>
Reviewed-by: NLaurent Desnogues <laurent.desnogues@gmail.com>
Tested-by: NLaurent Desnogues <laurent.desnogues@gmail.com>
Message-id: 20180810193129.1556-4-richard.henderson@linaro.org
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

When FZ is set, input_denormal exceptions are recognized, but this does
not happen with FZ16.  The softfloat code has no way to distinguish
these bits and will raise such exceptions into fp_status_f16.flags,
so ignore them when computing the accumulated flags.

Cc: qemu-stable@nongnu.org (3.0.1)
Reported-by: NLaurent Desnogues <laurent.desnogues@gmail.com>
Signed-off-by: NRichard Henderson <richard.henderson@linaro.org>
Reviewed-by: NLaurent Desnogues <laurent.desnogues@gmail.com>
Tested-by: NLaurent Desnogues <laurent.desnogues@gmail.com>
Message-id: 20180810193129.1556-3-richard.henderson@linaro.org
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>