Commit Graph

285 Commits

Author SHA1 Message Date
Richard Henderson
086c407784 target-i386: do not call helper to compute ZF/SF
ZF, SF and PF can always be computed from CC_DST except in the
CC_OP_EFLAGS case (and CC_OP_DYNAMIC, which just resolves to CC_OP_EFLAGS
in gen_compute_eflags).  Use setcond to compute ZF and SF.

We could also use a table lookup to compute PF.

Reviewed-by: Blue Swirl <blauwirbel@gmail.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Richard Henderson <rth@twiddle.net>
2013-02-18 15:03:57 -08:00
Richard Henderson
b666265b20 target-i386: Move CC discards to set_cc_op
This gets us universal coverage, rather than scattering discards
around at various places.  As a bonus, we do not emit redundant
discards e.g. between sequential logic insns.

Signed-off-by: Richard Henderson <rth@twiddle.net>
2013-02-18 15:03:56 -08:00
Richard Henderson
ccfcdd09bf target-i386: no need to flush out cc_op before gen_eob
This makes code more similar to the other callers of gen_eob, especially
loopz/loopnz/jcxz.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Richard Henderson <rth@twiddle.net>
2013-02-18 15:03:56 -08:00
Richard Henderson
d229edce1c target-i386: do not compute eflags multiple times consecutively
After calling gen_compute_eflags, leave the computed value in cc_reg_src
and set cc_op to CC_OP_EFLAGS.  The next few patches will remove anyway
most calls to gen_compute_eflags.

As a result of this change it is more natural to remove the register
argument from gen_compute_eflags and change all the callers.

Reviewed-by: Blue Swirl <blauwirbel@gmail.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Richard Henderson <rth@twiddle.net>
2013-02-18 15:03:56 -08:00
Paolo Bonzini
1608ecca95 target-i386: add helper functions to get other flags
Introduce new functions to extract PF, SF, OF, ZF in addition to CF.
These provide single entry points for optimizing accesses to a single
flag.

Reviewed-by: Blue Swirl <blauwirbel@gmail.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Richard Henderson <rth@twiddle.net>
2013-02-18 15:03:56 -08:00
Richard Henderson
773cdfccb8 target-i386: Use gen_update_cc_op everywhere
All of the conditional calls to gen_op_set_cc_op go away, and
gen_op_set_cc_op itself gets inlined into its only remaining caller.

Signed-off-by: Richard Henderson <rth@twiddle.net>
2013-02-18 15:03:56 -08:00
Richard Henderson
e207582f66 target-i386: Don't clobber s->cc_op in gen_update_cc_op
Use a dirty flag to know whether env->cc_op is up to date,
rather than forcing s->cc_op to DYNAMIC and losing info.

Signed-off-by: Richard Henderson <rth@twiddle.net>
2013-02-18 15:03:56 -08:00
Richard Henderson
3ca51d07da target-i386: Introduce set_cc_op
This will provide a good hook into which we can consolidate
all of the cc variable discards.

Signed-off-by: Richard Henderson <rth@twiddle.net>
2013-02-18 15:03:56 -08:00
Richard Henderson
fee71888a2 target-i386: Name the cc_op enumeration
Signed-off-by: Richard Henderson <rth@twiddle.net>
2013-02-18 15:03:56 -08:00
Paolo Bonzini
c7b3c87397 target-i386: factor gen_op_set_cc_op/tcg_gen_discard_tl around computing flags
Before computing flags we need to store the cc_op to memory.  Move this
to gen_compute_eflags_c and gen_compute_eflags rather than doing it all
over the place.

Alo, after computing the flags in cpu_cc_src we are in EFLAGS mode.
Set s->cc_op and discard cpu_cc_dst in gen_compute_eflags, rather than
doing it all over the place.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Richard Henderson <rth@twiddle.net>
2013-02-18 15:03:56 -08:00
Paolo Bonzini
5bdb91b0dd target-i386: use gen_jcc1 to compile loopz
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Richard Henderson <rth@twiddle.net>
2013-02-18 15:03:56 -08:00
Paolo Bonzini
6fa38ed219 target-i386: clean up sahf
Discard CC_DST and set s->cc_op immediately after computing EFLAGS.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Richard Henderson <rth@twiddle.net>
2013-02-18 15:03:56 -08:00
Paolo Bonzini
f5847c912d target-i386: compute eflags outside rcl/rcr helper
Always compute EFLAGS first since it is needed whenever
the shift is non-zero, i.e. most of the time.  This makes it possible
to remove some writes of CC_OP_EFLAGS to cpu_cc_op and more importantly
removes cases where s->cc_op becomes CC_OP_DYNAMIC.  Also, we can
remove cc_tmp and just modify cc_src from within the helper.

Finally, always follow gen_compute_eflags(cpu_cc_src) by setting s->cc_op
and discarding cpu_cc_dst.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Richard Henderson <rth@twiddle.net>
2013-02-18 15:03:56 -08:00
Paolo Bonzini
0ff6addd92 target-i386: move eflags computation closer to gen_op_set_cc_op
This ensures the invariant that cpu_cc_op matches s->cc_op when calling
the helpers.  The next patches need this because gen_compute_eflags and
gen_compute_eflags_c will take care of setting cpu_cc_op.

Always compute EFLAGS first since it is needed whenever the shift is
non-zero, i.e. most of the time.  This makes it possible to remove some
writes of CC_OP_EFLAGS to cpu_cc_op and more importantly removes cases
where s->cc_op becomes CC_OP_DYNAMIC.  These are slow and we want to
avoid them: CC_OP_EFLAGS is quite efficient once we paid the initial
cost of computing the flags.

Finally, always follow gen_compute_eflags(cpu_cc_src) by setting s->cc_op
and discarding cpu_cc_dst.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Richard Henderson <rth@twiddle.net>
2013-02-18 15:03:55 -08:00
Paolo Bonzini
52320e15db target-i386: move carry computation for inc/dec closer to gen_op_set_cc_op
This ensures the invariant that cpu_cc_op matches s->cc_op when calling
the helpers.  The next patches need this because gen_compute_eflags and
gen_compute_eflags_c will take care of setting cpu_cc_op.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Richard Henderson <rth@twiddle.net>
2013-02-18 15:03:55 -08:00
Paolo Bonzini
b27fc131fe target-i386: drop cc_op argument of gen_jcc1
As in the gen_repz_scas/gen_repz_cmps case, delay setting
CC_OP_DYNAMIC in gen_jcc until after code generation.  All of
gen_jcc1/is_fast_jcc/gen_setcc_slow_T0 now work on s->cc_op, which makes
things a bit easier to follow and to patch.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Richard Henderson <rth@twiddle.net>
2013-02-18 15:03:55 -08:00
Paolo Bonzini
91642ff806 target-i386: factor setting of s->cc_op handling for string functions
Set it to the appropriate CC_OP_SUBx constant in gen_scas/gen_cmps.
In the repz case it can be overridden to CC_OP_DYNAMIC after generating
the code.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Richard Henderson <rth@twiddle.net>
2013-02-18 15:03:55 -08:00
Paolo Bonzini
d824df34e8 target-i386: introduce gen_ext_tl
Introduce a function that abstracts extracting an 8, 16, 32 or 64-bit value
with or without sign, generalizing gen_extu and gen_exts.

Reviewed-by: Blue Swirl <blauwirbel@gmail.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Richard Henderson <rth@twiddle.net>
2013-02-18 15:03:55 -08:00
Paolo Bonzini
93ab25d7d1 target-i386: use OT_* consistently
Reviewed-by: Blue Swirl <blauwirbel@gmail.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Richard Henderson <rth@twiddle.net>
2013-02-18 15:03:55 -08:00
Peter Maydell
24537a0191 qemu-log: Rename the public-facing cpu_set_log function to qemu_set_log
Rename the public-facing function cpu_set_log to qemu_set_log. This
requires us to rename the internal-only qemu_set_log() to
do_qemu_set_log().

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Andreas Färber <afaerber@suse.de>
Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
2013-02-16 10:44:44 +00:00
Paolo Bonzini
022c62cbbc exec: move include files to include/exec/
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2012-12-19 08:31:31 +01:00
Paolo Bonzini
76cad71136 build: kill libdis, move disassemblers to disas/
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2012-12-19 08:29:06 +01:00
Evgeny Voevodin
ab1103def4 TCG: Use gen_opc_instr_start from context instead of global variable.
Signed-off-by: Evgeny Voevodin <e.voevodin@samsung.com>
Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
2012-12-08 14:24:43 +00:00
Evgeny Voevodin
c9c99c22d5 TCG: Use gen_opc_icount from context instead of global variable.
Signed-off-by: Evgeny Voevodin <e.voevodin@samsung.com>
Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
2012-12-08 14:24:42 +00:00
Evgeny Voevodin
25983cad31 TCG: Use gen_opc_pc from context instead of global variable.
Signed-off-by: Evgeny Voevodin <e.voevodin@samsung.com>
Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
2012-12-08 14:24:42 +00:00
Evgeny Voevodin
92414b31e7 TCG: Use gen_opc_buf from context instead of global variable.
Signed-off-by: Evgeny Voevodin <e.voevodin@samsung.com>
Reviewed-by: Richard Henderson <rth@twiddle.net>
Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
2012-11-17 13:53:36 +00:00
Evgeny Voevodin
efd7f48600 TCG: Use gen_opc_ptr from context instead of global variable.
Signed-off-by: Evgeny Voevodin <e.voevodin@samsung.com>
Reviewed-by: Richard Henderson <rth@twiddle.net>
Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
2012-11-17 13:53:27 +00:00
Blue Swirl
0af10c86ed target-i386: avoid using cpu_single_env
Pass around CPUArchState instead of using global cpu_single_env.

Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
Reviewed-by: Andreas Färber <afaerber@suse.de>
2012-11-10 13:49:21 +00:00
Blue Swirl
f4359b9ffe disas: avoid using cpu_single_env
Pass around CPUArchState instead of using global cpu_single_env.

Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
Acked-by: Richard Henderson <rth@twiddle.net>
Acked-by: Aurelien Jarno <aurelien@aurel32.net>
Acked-by: Guan Xuetao <gxt@mprc.pku.edu.cn>
2012-11-10 13:49:20 +00:00
malc
8b4a3df808 Fix popcnt in long mode
Thanks to Andriy Gapon for initial problem report.

Signed-off-by: malc <av1474@comtv.ru>
2012-10-14 14:55:09 +04:00
H. Peter Anvin
a9321a4d49 x86: Implement SMEP and SMAP
This patch implements Supervisor Mode Execution Prevention (SMEP) and
Supervisor Mode Access Prevention (SMAP) for x86.  The purpose of the
patch, obviously, is to help kernel developers debug the support for
those features.

A fair bit of the code relates to the handling of CPUID features.  The
CPUID code probably would get greatly simplified if all the feature
bit words were unified into a single vector object, but in the
interest of producing a minimal patch for SMEP/SMAP, and because I had
very limited time for this project, I followed the existing style.

[ v2: don't change the definition of the qemu64 CPU shorthand, since
  that breaks loading old snapshots.  Per Anthony Liguori this can be
  fixed once the CPU feature set is snapshot.

  Change the coding style slightly to conform to checkpatch.pl. ]

Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2012-10-01 08:04:22 -05:00
Richard Henderson
fdefe51c28 Emit debug_insn for CPU_LOG_TB_OP_OPT as well.
For all targets that currently call tcg_gen_debug_insn_start,
add CPU_LOG_TB_OP_OPT to the condition that gates it.

This is useful for comparing optimization dumps, when the
pre-optimization dump is merely noise.

Signed-off-by: Richard Henderson <rth@twiddle.net>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
2012-09-27 21:38:50 +02:00
Matthew Ogilvie
5c73b757e3 target-i386/translate.c: mov to/from crN/drN: ignore mod bits
> This instruction is always treated as a register-to-register (MOD = 11)
> instruction, regardless of the encoding of the MOD field in the MODR/M
> byte.

Also, Microport UNIX System V/386 v 2.1 (ca 1987) runs fine on
real Intel 386 and 486 CPU's (at least), but does not run in qemu without
this patch.

Signed-off-by: Matthew Ogilvie <mmogilvi_qemu@miniinfo.net>
Signed-off-by: malc <av1474@comtv.ru>
2012-08-24 07:44:37 +04:00
Blue Swirl
92fc4b586f x86: switch to AREG0 free mode
Add an explicit CPUX86State parameter instead of relying on AREG0.

Remove temporary wrappers and switch to AREG0 free mode.

Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
2012-08-14 19:01:26 +00:00
Blue Swirl
2999a0b200 x86: avoid AREG0 in segmentation helpers
Add an explicit CPUX86State parameter instead of relying on AREG0.

Rename remains of op_helper.c to seg_helper.c.

Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
2012-08-14 19:01:26 +00:00
Blue Swirl
4a7443be52 x86: avoid AREG0 for misc helpers
Add an explicit CPUX86State parameter instead of relying on AREG0.

Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
2012-08-14 19:01:26 +00:00
Blue Swirl
608badfc66 x86: avoid AREG0 for SMM helpers
Add an explicit CPUX86State parameter instead of relying on AREG0.

Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
2012-08-14 19:01:25 +00:00
Blue Swirl
052e80d5e0 x86: avoid AREG0 for SVM helpers
Add an explicit CPUX86State parameter instead of relying on AREG0.

Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
2012-08-14 19:01:25 +00:00
Blue Swirl
7923057bae x86: avoid AREG0 for integer helpers
Add an explicit CPUX86State parameter instead of relying on AREG0.

Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
2012-08-14 19:01:25 +00:00
Blue Swirl
f0967a1add x86: avoid AREG0 for condition code helpers
Add an explicit CPUX86State parameter instead of relying on AREG0.

Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
2012-08-14 19:01:25 +00:00
Blue Swirl
d3eb5eaeb5 x86: avoid AREG0 for FPU helpers
Make FPU helpers take a parameter for CPUState instead
of relying on global env.

Introduce temporary wrappers for FPU load and store ops. Remove
wrappers for non-AREG0 code. Don't call unconverted helpers
directly.

Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
2012-08-14 19:01:25 +00:00
Vitaly Chipounov
7162ab21fe x86: Fixed incorrect segment base address addition in 64-bits mode
According to the Intel manual
"Intel® 64 and IA-32 Architectures Software Developer’s Manual
Volume 3", "3.4.4 Segment Loading Instructions in IA-32e Mode":

"When in compatibility mode, FS and GS overrides operate as defined by
32-bit mode behavior regardless of the value loaded into the upper 32
linear-address bits of the hidden descriptor register base field.
Compatibility mode ignores the upper 32 bits when calculating an effective address."

However, the code misses the 64-bit mode case, where an instruction with
address and segment size override would be translated incorrectly. For example,
inc dword ptr gs:260h[ebx*4] gets incorrectly translated to:

(uint32_t)(gs.base + ebx * 4 + 0x260)
instead of
gs.base + (uint32_t)(ebx * 4 + 0x260)

Signed-off-by: Vitaly Chipounov <vitaly.chipounov@epfl.ch>
Reviewed-by: Max Filippov <jcmvbkbc@gmail.com>
Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
2012-07-29 08:45:57 +00:00
Peter Maydell
bedc2ac1a7 target-i386: make it clearer that op table accesses don't overrun
Rephrase some of the expressions used to select an entry
in the SSE op table arrays so that it's clearer that they
don't overrun the op table array size.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Stefan Weil <sw@weilnetz.de>
Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
2012-07-07 09:06:15 +00:00
Peter Maydell
96d7073fb0 target-i386: Remove confusing X86_64_DEF macro
The X86_64_DEF macro is a confusing way of making some terms
in a conditional only appear if TARGET_X86_64 is defined. We
only use it in two places, and in both cases this is for making
the same test, so abstract that check out into a function
where we can use a more conventional #ifdef.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
2012-07-07 09:05:54 +00:00
Peter Maydell
a87dacc89a target-i386: Remove unused macros
Commit 11f8cdb removed all the uses of the X86_64_ONLY
macro. The BUGGY_64() macro has been unused for a long time:
it originally marked some ops which couldn't be enabled
because of issues with the pre-TCG code generation scheme.
Remove the now-unnecessary definitions of both macros.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Stefan Weil <sw@weilnetz.de>
Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
2012-07-07 09:05:45 +00:00
Stefan Weil
11f8cdbc64 target-i386: Fix compilation with --enable-debug
commit c4baa0503d improved SSE table
type safety which now raises compiler errors when latest QEMU was
configured with --enable-debug.

Fix this by splitting the SSE tables even further to separate
helper functions with different signatures.

Instead of crashing by calling address 0, the code now jumps to
label illegal_op.

Signed-off-by: Stefan Weil <sw@weilnetz.de>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
2012-07-05 18:55:57 +00:00
Blue Swirl
c4baa0503d x86: improve SSE table type safety
SSE function tables could easily be corrupted because of use
of void pointers.

Introduce function pointer types and helper variables in order
to improve type safety.

Split sse_op_table3 according to types used.

Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
2012-06-28 20:28:08 +00:00
Blue Swirl
77b2bc2c09 x86: avoid AREG0 for exceptions
Add an explicit CPUX86State parameter instead of relying on AREG0.

Merge raise_exception_env() to raise_exception(), likewise with
raise_exception_err_env() and raise_exception_err().

Introduce cpu_svm_check_intercept_param() and cpu_vmexit()
as wrappers.

Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
2012-06-28 20:28:08 +00:00
Andreas Färber
317ac6201a target-i386: Don't overuse CPUState
Scripted conversion:
  sed -i "s/CPUState/CPUX86State/g" target-i386/*.[hc]
  sed -i "s/#define CPUX86State/#define CPUState/" target-i386/cpu.h

Signed-off-by: Andreas Färber <afaerber@suse.de>
Acked-by: Anthony Liguori <aliguori@us.ibm.com>
2012-03-14 22:20:25 +01:00
Aurelien Jarno
20f8bd483c target-i386: fix compilation with --enable-debug-tcg
Commit 2355c16e74 introduced a new ldmxcsr
helper taking an i32 argument, but the helper is actually passed a long.
Fix that by truncating the long to i32.

Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
2012-01-13 16:01:40 +01:00
Aurelien Jarno
2355c16e74 target-i386: fix SSE rounding and flush to zero
SSE rounding and flush to zero control has never been implemented. However
given that softfloat-native was using a single state for FPU and SSE and
given that glibc is setting both FPU and SSE state in fesetround(), this
was working correctly up to the switch to softfloat.

Fix that by adding an update_sse_status() function similar to
update_fpu_status(), and callin git on write to mxcsr.

Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
2012-01-11 09:55:28 +01:00
Andreas Gustafsson
f7e80adf3c target-i386: fix cmpxchg instruction emulation
When the i386 cmpxchg instruction is executed with a memory operand
and the comparison result is "unequal", do the memory write before
changing the accumulator instead of the other way around, because
otherwise the new accumulator value will incorrectly be used in the
comparison when the instruction is restarted after a page fault.

This bug was originally reported on 2010-04-25 as
https://bugs.launchpad.net/qemu/+bug/569760

Signed-off-by: Andreas Gustafsson <gson@gson.org>
2011-12-12 00:46:32 +04:00
Jan Kiszka
86ce7a5e7e target-i386: Remove redundant word mask in port out instructions
T0 was already masked to 16 bits when loading it.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Reviewed-by: Richard Henderson <rth@twiddle.net>
Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
2011-10-01 06:21:45 +00:00
Stefan Weil
782ea2c759 target-i386: Remove data type CCTable
Remove also two assert statements which were the last remaining users.

Signed-off-by: Stefan Weil <weil@mail.berlios.de>
Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
2011-09-21 10:49:01 +01:00
Richard Henderson
8278604134 target-i386: Compute all flag data inside %cl != 0 test.
The (x << (cl - 1)) quantity is only used if CL != 0.  Move the
computation of that quantity nearer its use.

This avoids the creation of undefined TCG operations when the
constant propagation optimization proves that CL == 0, and thus
CL-1 is outside the range [0-wordsize).

Signed-off-by: Richard Henderson <rth@twiddle.net>
Signed-off-by: malc <av1474@comtv.ru>
2011-09-08 18:10:16 +04:00
Blue Swirl
2b41f10e18 Remove exec-all.h include directives
Most exec-all.h include directives are now useless, remove them.

Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
2011-06-26 18:25:35 +00:00
Martin Simmons
8001c294f8 target-i386: Make x86 mfence and lfence illegal without SSE2
While trying to use qemu -cpu pentium3 to test for incorrect uses of certain
SSE2 instructions, I found that QEMU allowed the mfence and lfence
instructions to be executed even though Pentium 3 doesn't support them.

According to the processor specs (and experience on a real Pentium 3), these
instructions are only available with SSE2, but QEMU is checking for SSE.  The
check for the related sfence instruction is correct (it works with SSE).

This trival patch fixes the test.

Signed-off-by: Martin Simmons <martin@lispworks.com>
Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
2011-06-08 09:04:29 +01:00
Stefan Weil
e87b7cb0f0 Remove unused function parameters from gen_pc_load and rename the function
Function gen_pc_load was introduced in commit
d2856f1ad4.
The only reason for parameter searched_pc was
a debug statement in target-i386/translate.c.

Parameter puc was needed by target-sparc until
commit d7da2a1040.

Remove searched_pc from the debug statement and remove both
parameters from the parameter list of gen_pc_load.

As the function name gen_pc_load was also misleading,
it is now called restore_state_to_opc. This new name
was suggested by Peter Maydell, thanks.

v2: Remove last parameter, too, and rename the function.

v3: Fix [] typo in target-arm/translate.c.
    Fix wrong SHA1 object name in commit message (copy+paste error).

Cc: Aurelien Jarno <aurelien@aurel32.net>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Stefan Weil <weil@mail.berlios.de>
2011-04-20 10:33:59 +02:00
Stefan Weil
4b4a72e556 Fix conversions from pointer to tcg_target_long
tcg_gen_exit_tb takes a parameter of type tcg_target_long,
so the type casts of pointer to long should be replaced by
type casts of pointer to tcg_target_long (suggested by Blue Swirl).

These changes are needed for build environments where
sizeof(long) != sizeof(void *), especially for w64.

Signed-off-by: Stefan Weil <weil@mail.berlios.de>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
2011-04-10 00:45:16 +02:00
Richard Henderson
c832e3de64 target-i386: Use deposit operation.
Use this for assignment to the low byte or low word of a register.

Acked-by: Aurelien Jarno <aurelien@aurel32.net>
Signed-off-by: Richard Henderson <rth@twiddle.net>
Signed-off-by: Edgar E. Iglesias <edgar.iglesias@gmail.com>
2011-01-20 12:16:12 +01:00
Jun Koi
728d803baa target-i386: use gen_update_cc_op()
This patch simplifies target-i386/translate.c a bit by replacing some
code with gen_update_cc_op()

Signed-off-by: Jun Koi <junkoi2004@gmail.com>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
2010-07-25 17:04:07 +02:00
Jun Koi
5779406a24 use symbol for DisasContext->is_jmp
This patch replaces constant value assigned for (DisasContext
*)->is_jmp with DISAS_TB_JUMP.

Signed-off-by: Jun Koi <junkoi2004@gmail.com>
Signed-off-by: Edgar E. Iglesias <edgar.iglesias@gmail.com>
2010-07-24 14:34:15 +02:00
Andi Kleen
c045af25a5 Add more boundary checking to sse3/4 parsing
ssse3 uses tables with only two entries per op, but it is indexed
with b1 which can contain variables upto 3. This happens when ssse3
or sse4 are used with REP* prefixes.

Add boundary checking for this case.

Signed-off-by: Andi Kleen <ak@linux.intel.com>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
2010-07-02 01:53:37 +02:00
Richard Henderson
7418027ea4 target-i386: fix xchg rax,r8
We were ignoring REX_B while special-casing NOP, i.e. xchg eax,eax.

Signed-off-by: Richard Henderson <rth@twiddle.net>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
2010-07-01 23:45:28 +02:00
Paolo Bonzini
8c0e6340fb target-i386: fix decoding of negative 4-byte displacements
Negative four byte displacements need to be sign-extended after
c086b783eb.  Do so.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Acked-by: Richard Henderson  <rth@twiddle.net>
Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
2010-06-04 19:48:53 +00:00
Richard Henderson
6e9cc3ed0e target-i386: Remove duplicate CPU log.
The proper logging for -d cpu is done in generic code.

Signed-off-by: Richard Henderson <rth@twiddle.net>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
2010-05-05 12:20:05 +02:00
Blue Swirl
7f5b7d3e2c x86: remove dead assignments, spotted by clang analyzer
Value stored is never read.

Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
2010-04-25 18:58:25 +00:00
Paolo Bonzini
1a7ff92218 remove TARGET_* defines from translate-all.c
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
2010-04-08 21:34:12 +02:00
TeLeMan
2e21e7491f target-i386: fix commit c22549204a
The commit c22549204a led movntps &
movntdq to be translated incorrectly.

Signed-off-by: TeLeMan <geleman@gmail.com>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
2010-03-13 11:35:55 +01:00
Aurelien Jarno
b16f827bdf target-i386: fix SIB decoding with index = 4
A SIB byte with an index of 4 means "no scaled index", even if the scale
value is not 0. In 64-bit mode, if REX.X is used, an index of 4 selects
%r12. This is correctly handled by the computation of the index variable,
which includes the index bits, and also the REX.X prefix:

    index = ((code >> 3) & 7) | REX_X(s);

Thanks to Avi Kivity, Jamie Lokier and Malc for the analysis of the
problem and the initial patch.

Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
2010-03-10 08:43:43 +01:00
malc
41b1e61f51 target-i386: Fix long jumps/calls in long mode with REX.W set
Signed-off-by: malc <av1474@comtv.ru>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
2010-03-06 19:20:04 +01:00
Aurelien Jarno
c22549204a target-i386: fix lddqu SSE instruction
This instruction load data from memory to register and not the reverse.

Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
2010-03-06 18:33:53 +01:00
Paolo Bonzini
5e398dd2f0 remove two dead assignments in target-i386/translate.c
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
2010-02-05 18:13:14 +00:00
Amit Shah
d7209371b1 x86: translate.c: remove dead assignment
clang-analyzer points out a redundant assignment.

Signed-off-by: Amit Shah <amit.shah@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2010-01-13 17:14:15 -06:00
Aurelien Jarno
995963852c target-i386: Fix "call im" on x86_64 when executing 32-bit code
Similarly to what is done in 32938e127f
for "jmp im", trunc the immediate to 32-bit when not running in 64-bit
mode.

Reported-by: Kevin O'Connor <kevin@koconnor.net>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
2010-01-03 03:14:41 +01:00
Andre Przywara
31501a714b target-i386: implement lzcnt emulation
lzcnt is a AMD Phenom/Barcelona added instruction returning the
number of leading zero bits in a word.
As this is similar to the "bsr" instruction, reuse the existing
code. There need to be some more changes, though, as lzcnt always
returns a valid value (in opposite to bsr, which has a special
case when the operand is 0).
lzcnt is guarded by the ABM CPUID bit (Fn8000_0001:ECX_5).

Signed-off-by: Andre Przywara <andre.przywara@amd.com>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
2009-10-23 17:10:36 +02:00
Laurent Desnogues
49d9fdcca6 target-i386: fix ARPL
The arpl implementation in target-i386/translate.c uses cpu_A0
temporary across a brcond op.  This patch fixes that issue.

Signed-off-by: Laurent Desnogues <laurent.desnogues@gmail.com>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
2009-10-06 22:01:00 +02:00
Kevin Wolf
09d85fb843 target-i386: Fix exceptions for fxsave/fxrstor
This patch corrects the following aspects of exception generation in
fxsave/fxrstor:

* Generate #GP if the operand is not aligned to a 16 byte boundary
* Generate #UD if the LOCK prefix is used
* For CR0.EM = 1 #NM is generated, not #UD

Signed-off-by: Kevin Wolf <mail@kevin-wolf.de>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
2009-10-04 23:10:22 +02:00
Andre Przywara
1b050077d2 target-i386: add RDTSCP support
RDTSCP reads the time stamp counter and atomically also the content
of a 32-bit MSR, which can be freely set by the OS. This allows CPU
local data to be queried by userspace.
Linux uses this to allow a fast implementation of the getcpu()
syscall, which uses the vsyscall page to avoid a context switch.
AMD CPUs since K8RevF and Intel CPUs since Nehalem support this
instruction.
RDTSCP is guarded by the RDTSCP CPUID bit (Fn8000_0001:EDX[27]).

Signed-off-by: Andre Przywara <andre.przywara@amd.com>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
2009-10-04 14:46:34 +02:00
Andre Przywara
d9f4bb27db target-i386: add SSE4a instruction support
This adds support for the AMD Phenom/Barcelona's SSE4a instructions.
Those include insertq and extrq, which are doing shift and mask on
XMM registers, in two versions (immediate shift/length values and
stored in another XMM register).
Additionally it implements movntss, movntsd, which are scalar
non-temporal stores (avoiding cache trashing). These are implemented
as normal stores, though.
SSE4a is guarded by the SSE4A CPUID bit (Fn8000_0001:ECX[6]).

Signed-off-by: Andre Przywara <andre.przywara@amd.com>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
2009-10-04 14:09:41 +02:00
Andre Przywara
ccd59d09a9 target-i386: add lock mov cr0 = cr8
AMD CPUs featuring a shortcut to access CR8 even from 32-bit mode.
If you use the LOCK prefix with "mov CR0", it accesses CR8 instead.
This behavior is guarded by the CR8_LEGACY CPUID bit
(Fn8000_0001:ECX[1]).

Signed-off-by: Andre Przywara <andre.przywara@amd.com>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
2009-10-04 14:04:40 +02:00
Laurent Desnogues
cc739bb0c4 x86: use globals for CPU registers
Use globals for the 8 or 16 CPU registers on i386 and x86_64.

Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
2009-09-30 22:53:05 +02:00
Aurelien Jarno
bedda79c1e target-i386: kill a tmp register
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
2009-09-27 00:57:41 +02:00
Aurelien Jarno
5b207c007c target-i386: use subfi instead of sub with a non-freed constant
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
2009-09-27 00:57:28 +02:00
Blue Swirl
72cf2d4f0e Fix sys-queue.h conflict for good
Problem: Our file sys-queue.h is a copy of the BSD file, but there are
some additions and it's not entirely compatible. Because of that, there have
been conflicts with system headers on BSD systems. Some hacks have been
introduced in the commits 15cc923584,
f40d753718,
96555a96d7 and
3990d09adf but the fixes were fragile.

Solution: Avoid the conflict entirely by renaming the functions and the
file. Revert the previous hacks.

Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
2009-09-12 07:36:22 +00:00
Juan Quintela
e2542fe2bc rename WORDS_BIGENDIAN to HOST_WORDS_BIGENDIAN
Signed-off-by: Juan Quintela <quintela@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2009-07-27 14:09:21 -05:00
Blue Swirl
8167ee8839 Update to a hopefully more future proof FSF address
Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
2009-07-16 20:47:01 +00:00
Jan Kiszka
a23978077b x86: Add support for resume flag
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
2009-05-22 10:50:37 -05:00
Paul Brook
5561650587 Include assert.h from qemu-common.h
Include assert.h from qemu-common.h and remove other direct uses.
cpu-all.h still need to include it because of the dyngen-exec.h hacks

Signed-off-by: Paul Brook <paul@codesourcery.com>
2009-05-13 20:54:26 +01:00
Blue Swirl
001faf3269 Replace gcc variadic macro extension with C99 version
Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
2009-05-13 17:53:17 +00:00
aurel32
1b530a6dfc Add new command line option -singlestep for tcg single stepping.
This replaces a compile time option for some targets and adds
this feature to targets which did not have a compile time option.

Add monitor command to enable or disable single step mode.

Modify monitor command "info status" to display single step mode.

Signed-off-by: Stefan Weil <weil@mail.berlios.de>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>

git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@7004 c046a42c-6fe2-441c-8c8c-71466251a162
2009-04-05 20:08:59 +00:00
malc
8cd6345d00 Immediate versions of ro[lr]
git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@6968 c046a42c-6fe2-441c-8c8c-71466251a162
2009-04-02 22:54:35 +00:00
aurel32
8777643e48 target-i386: use the new bswap* TCG ops
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>

git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@6836 c046a42c-6fe2-441c-8c8c-71466251a162
2009-03-13 09:35:41 +00:00
aurel32
66896cb803 tcg: rename bswap_i32/i64 functions
Rename bswap_i32 into bswap32_i32 and bswap_i64 into bswap64_i64

Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>

git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@6829 c046a42c-6fe2-441c-8c8c-71466251a162
2009-03-13 09:34:48 +00:00
aliguori
8fec2b8c45 global s/loglevel & X/qemu_loglevel_mask(X)/ (Eduardo Habkost)
These are references to 'loglevel' that aren't on a simple 'if (loglevel &
X) qemu_log()' statement.

Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>



git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@6340 c046a42c-6fe2-441c-8c8c-71466251a162
2009-01-15 22:36:53 +00:00
aliguori
93fcfe39a0 Convert references to logfile/loglevel to use qemu_log*() macros
This is a large patch that changes all occurrences of logfile/loglevel
global variables to use the new qemu_log*() macros.

Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>



git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@6338 c046a42c-6fe2-441c-8c8c-71466251a162
2009-01-15 22:34:14 +00:00
aurel32
fad6cb1a56 Update FSF address in GPL/LGPL boilerplate
The attached patch updates the FSF address in the GPL/LGPL boilerplate
in most GPL/LGPLed files, and also in COPYING.LIB.

Signed-off-by: Stuart Brady <stuart.brady@gmail.com>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>

git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@6162 c046a42c-6fe2-441c-8c8c-71466251a162
2009-01-04 22:05:52 +00:00
malc
f60d2728cc Fix smsw for x86_64 guest and bigendian host case
git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@6009 c046a42c-6fe2-441c-8c8c-71466251a162
2008-12-13 15:51:14 +00:00
aurel32
32938e127f target-i386: Fix jmp im on x86_64 when executing 32-bit code
When running grub-install (32-bit) on an x86_64 Linux system in qemu, it
hangs on a pagefault forever, because an integer overflow occurs on the
IP on "jmp im". This patch masks overflows for 32 bit IPs on a 64 bit
system, just like it is done for 16 bit IPs already.

Using this patch, x86_64 openSUSE installation works again.

Signed-off-by: Alexander Graf <agraf@suse.de>
Signed-off-by: Kevin Wolf <kwolf@suse.de>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>

git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5963 c046a42c-6fe2-441c-8c8c-71466251a162
2008-12-10 15:02:16 +00:00
aurel32
0b97134b29 target-i386: fix CVE-2007-1322
The icebp instruction can be abused to terminate the emulation,
resulting in denial of service.

Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>

git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5921 c046a42c-6fe2-441c-8c8c-71466251a162
2008-12-07 18:15:36 +00:00