aboutsummaryrefslogtreecommitdiff
path: root/target/i386
AgeCommit message (Collapse)Author
2024-05-07target/i386: move BSWAP to new decoderPaolo Bonzini
Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-05-07target/i386: move remaining conditional operations to new decoderPaolo Bonzini
Move long-displacement Jcc, SETcc and CMOVcc to the new decoder. While filling in the tables makes the code seem longer, the new emitters are all just one line of code. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-05-07target/i386: merge and enlarge a few ranges for call to disas_insn_newPaolo Bonzini
Since new opcodes are not going to be added in translate.c, round the case labels that call to disas_insn_new(), including whole sets of eight opcodes when possible. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-05-07target/i386: move C0-FF opcodes to new decoder (except for x87)Paolo Bonzini
The shift instructions are rewritten instead of reusing code from the old decoder. Rotates use CC_OP_ADCOX more extensively and generally rely more on the optimizer, so that the code generators are shared between the immediate-count and variable-count cases. In particular, this makes gen_RCL and gen_RCR pretty efficient for the count == 1 case, which becomes (apart from a few extra movs) something like: (compute_cc_all if needed) // save old value for OF calculation mov cc_src2, T0 // the bulk of RCL is just this! deposit T0, cc_src, T0, 1, TARGET_LONG_BITS - 1 // compute carry shr cc_dst, cc_src2, length - 1 and cc_dst, cc_dst, 1 // compute overflow xor cc_src2, cc_src2, T0 extract cc_src2, cc_src2, length - 1, 1 32-bit MUL and IMUL are also slightly more efficient on 64-bit hosts. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-05-07target/i386: generalize gen_movl_seg_T0Paolo Bonzini
In the new decoder it is sometimes easier to put the segment in T1 instead of T0, usually because another operand was loaded by common code in T0. Genrealize gen_movl_seg_T0 to allow using any source. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-05-07target/i386: move 60-BF opcodes to new decoderPaolo Bonzini
Compared to the old decoder, the main differences in translation are for the little-used ARPL instruction. IMUL is adjusted a bit to share more code to produce flags, but is otherwise very similar. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-05-07target/i386: allow instructions with more than one immediatePaolo Bonzini
While keeping decode->immediate for convenience and for 4-operand instructions, store the immediate in X86DecodedOp as well. This enables instructions with more than one immediate such as ENTER. It can also be used for far calls and jumps. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-05-07target/i386: extract gen_far_call/jmp, reordering temporariesPaolo Bonzini
Extract the code into new functions, and swap T0/T1 so that T0 corresponds to the first immediate in the instruction stream. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-05-07target/i386: move 00-5F opcodes to new decoderPaolo Bonzini
Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-05-07target/i386: reintroduce debugging mechanismPaolo Bonzini
Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-05-07target/i386: cleanup *gen_eob*Paolo Bonzini
Create a new wrapper for syscall/sysret, and do not go through multiple layers of wrappers. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-05-07target/i386: clarify the "reg" argument of functions returning CCPreparePaolo Bonzini
Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-05-07target/i386: do not use s->T0 and s->T1 as scratch registers for CCPreparePaolo Bonzini
Instead of using s->T0 or s->T1, create a scratch register when computing the C, NC, L or LE conditions. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-05-07target/i386: extend cc_* when using them to compute flagsPaolo Bonzini
Instead of using s->tmp0 or s->tmp4 as the result, just extend the cc_* registers in place. It is harmless and, if multiple setcc instructions are used, the optimizer will be able to remove the redundant ones. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-05-07target/i386: pull cc_op update to callers of gen_jmp_rel{,_csize}Paolo Bonzini
gen_update_cc_op must be called before control flow splits. Doing it in gen_jmp_rel{,_csize} may hide bugs, instead assert that cc_op is clean---even if that means a few more calls to gen_update_cc_op(). With this new invariant, setting cc_op to CC_OP_DYNAMIC is unnecessary since the caller should have done it. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-05-07target/i386: cleanup cc_op changes for REP/REPZ/REPNZPaolo Bonzini
gen_update_cc_op must be called before control flow splits. Do it where the jump on ECX!=0 is translated. On the other hand, remove the call before gen_jcc1, which takes care of it already, and explain why REPZ/REPNZ need not use CC_OP_DYNAMIC---the translation block ends before any control-flow-dependent cc_op could be observed. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-05-07target/i386: cc_op is not dynamic in gen_jcc1Paolo Bonzini
Resetting cc_op to CC_OP_DYNAMIC should be done at control flow junctions, which is not the case here. This translation block is ending and the only effect of calling set_cc_op() would be a discard of s->cc_srcT. This discard is useless (it's a temporary, not a global) and in fact prevents gen_prepare_cc from returning s->cc_srcT. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-05-07target/i386: remove mask from CCPreparePaolo Bonzini
With the introduction of TSTEQ and TSTNE the .mask field is always -1, so remove all the now-unnecessary code. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-05-07target/i386: use TSTEQ/TSTNE to check flagsPaolo Bonzini
The new conditions obviously come in handy when testing individual bits of EFLAGS, and they make it possible to remove the .mask field of CCPrepare. Lowering to shift+and is done by the optimizer if necessary. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-05-07target/i386: use TSTEQ/TSTNE to test low bitsPaolo Bonzini
When testing the sign bit or equality to zero of a partial register, it is useful to use a single TSTEQ or TSTNE operation. It can also be used to test the parity flag, using bit 0 of the population count. Do not do this for target_ulong-sized values however; the optimizer would produce a comparison against zero anyway, and it avoids shifts by 64 which are undefined behavior. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-05-07target/i386: Fix CPUID encoding of Fn8000001E_ECXBabu Moger
Observed the following failure while booting the SEV-SNP guest and the guest fails to boot with the smp parameters: "-smp 192,sockets=1,dies=12,cores=8,threads=2". qemu-system-x86_64: sev_snp_launch_update: SNP_LAUNCH_UPDATE ret=-5 fw_error=22 'Invalid parameter' qemu-system-x86_64: SEV-SNP: CPUID validation failed for function 0x8000001e, index: 0x0. provided: eax:0x00000000, ebx: 0x00000100, ecx: 0x00000b00, edx: 0x00000000 expected: eax:0x00000000, ebx: 0x00000100, ecx: 0x00000300, edx: 0x00000000 qemu-system-x86_64: SEV-SNP: failed update CPUID page Reason for the failure is due to overflowing of bits used for "Node per processor" in CPUID Fn8000001E_ECX. This field's width is 3 bits wide and can hold maximum value 0x7. With dies=12 (0xB), it overflows and spills over into the reserved bits. In the case of SEV-SNP, this causes CPUID enforcement failure and guest fails to boot. The PPR documentation for CPUID_Fn8000001E_ECX [Node Identifiers] ================================================================= Bits Description 31:11 Reserved. 10:8 NodesPerProcessor: Node per processor. Read-only. ValidValues: Value Description 0h 1 node per processor. 7h-1h Reserved. 7:0 NodeId: Node ID. Read-only. Reset: Fixed,XXh. ================================================================= As in the spec, the valid value for "node per processor" is 0 and rest are reserved. Looking back at the history of decoding of CPUID_Fn8000001E_ECX, noticed that there were cases where "node per processor" can be more than 1. It is valid only for pre-F17h (pre-EPYC) architectures. For EPYC or later CPUs, the linux kernel does not use this information to build the L3 topology. Also noted that the CPUID Function 0x8000001E_ECX is available only when TOPOEXT feature is enabled. This feature is enabled only for EPYC(F17h) or later processors. So, previous generation of processors do not not enumerate 0x8000001E_ECX leaf. There could be some corner cases where the older guests could enable the TOPOEXT feature by running with -cpu host, in which case legacy guests might notice the topology change. To address those cases introduced a new CPU property "legacy-multi-node". It will be true for older machine types to maintain compatibility. By default, it will be false, so new decoding will be used going forward. The documentation is taken from Preliminary Processor Programming Reference (PPR) for AMD Family 19h Model 11h, Revision B1 Processors 55901 Rev 0.25 - Oct 6, 2022. Cc: qemu-stable@nongnu.org Fixes: 31ada106d891 ("Simplify CPUID_8000_001E for AMD") Link: https://bugzilla.kernel.org/show_bug.cgi?id=206537 Reviewed-by: Zhao Liu <zhao1.liu@intel.com> Signed-off-by: Babu Moger <babu.moger@amd.com> Message-ID: <0ee4b0a8293188a53970a2b0e4f4ef713425055e.1714757834.git.babu.moger@amd.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-05-06Merge tag 'accel-20240506' of https://github.com/philmd/qemu into stagingRichard Henderson
Accelerator patches - Extract page-protection definitions to page-protection.h - Rework in accel/tcg in preparation of extracting TCG fields from CPUState - More uses of get_task_state() in user emulation - Xen refactors in preparation for adding multiple map caches (Juergen & Edgar) - MAINTAINERS updates (Aleksandar and Bin) # -----BEGIN PGP SIGNATURE----- # # iQIzBAABCAAdFiEE+qvnXhKRciHc/Wuy4+MsLN6twN4FAmY40CAACgkQ4+MsLN6t # wN5drxAA1oIsuUzpAJmlMIxZwlzbICiuexgn/HH9DwWNlrarKo7V1l4YB8jd9WOg # IKuj7c39kJKsDEB8BXApYwcly+l7DYdnAAI8Z7a+eN+ffKNl/0XBaLjsGf58RNwY # fb39/cXWI9ZxKxsHMSyjpiu68gOGvZ5JJqa30Fr+eOGuug9Fn/fOe1zC6l/dMagy # Dnym72stpD+hcsN5sVwohTBIk+7g9og1O/ctRx6Q3ZCOPz4p0+JNf8VUu43/reaR # 294yRK++JrSMhOVFRzP+FH1G25NxiOrVCFXZsUTYU+qPDtdiKtjH1keI/sk7rwZ7 # U573lesl7ewQFf1PvMdaVf0TrQyOe6kUGr9Mn2k8+KgjYRAjTAQk8V4Ric/+xXSU # 0rd7Cz7lyQ8jm0DoOElROv+lTDQs4dvm3BopF3Bojo4xHLHd3SFhROVPG4tvGQ3H # 72Q5UPR2Jr2QZKiImvPceUOg0z5XxoN6KRUkSEpMFOiTRkbwnrH59z/qPijUpe6v # 8l5IlI9GjwkL7pcRensp1VC6e9KC7F5Od1J/2RLDw3UQllMQXqVw2bxD3CEtDRJL # QSZoS4d1jUCW4iAYdqh/8+2cOIPiCJ4ai5u7lSdjrIJkRErm32FV/pQLZauoHlT5 # eTPUgzDoRXVgI1X1slTpVXlEEvRNbhZqSkYLkXr80MLn5hTafo0= # =3Qkg # -----END PGP SIGNATURE----- # gpg: Signature made Mon 06 May 2024 05:42:08 AM PDT # gpg: using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE # gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <f4bug@amsat.org>" [full] * tag 'accel-20240506' of https://github.com/philmd/qemu: (28 commits) MAINTAINERS: Update my email address MAINTAINERS: Update Aleksandar Rikalo email system: Pass RAM MemoryRegion and is_write in xen_map_cache() xen: mapcache: Break out xen_map_cache_init_single() xen: mapcache: Break out xen_invalidate_map_cache_single() xen: mapcache: Refactor xen_invalidate_map_cache_entry_unlocked xen: mapcache: Refactor xen_replace_cache_entry_unlocked xen: mapcache: Break out xen_ram_addr_from_mapcache_single xen: mapcache: Refactor xen_remap_bucket for multi-instance xen: mapcache: Refactor xen_map_cache for multi-instance xen: mapcache: Refactor lock functions for multi-instance xen: let xen_ram_addr_from_mapcache() return -1 in case of not found entry system: let qemu_map_ram_ptr() use qemu_ram_ptr_length() user: Use get_task_state() helper user: Declare get_task_state() once in 'accel/tcg/vcpu-state.h' user: Forward declare TaskState type definition accel/tcg: Move @plugin_mem_cbs from CPUState to CPUNegativeOffsetState accel/tcg: Restrict cpu_plugin_mem_cbs_enabled() to TCG accel/tcg: Restrict qemu_plugin_vcpu_exit_hook() to TCG plugins accel/tcg: Update CPUNegativeOffsetState::can_do_io field documentation ... Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2024-05-06Merge tag 'for-upstream' of https://gitlab.com/bonzini/qemu into stagingRichard Henderson
* target/i386: Introduce SapphireRapids-v3 to add missing features * switch boards to "default y" * allow building emulators without any board * configs: list "implied" device groups in the default configs * remove unnecessary declarations from typedefs.h * target/i386: Give IRQs a chance when resetting HF_INHIBIT_IRQ_MASK # -----BEGIN PGP SIGNATURE----- # # iQFIBAABCAAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAmY1ILsUHHBib256aW5p # QHJlZGhhdC5jb20ACgkQv/vSX3jHroNtIwf+MEehq2HudZvsK1M8FrvNmkB/AssO # x4tqL8DlTus23mQDBu9+rANTB93ManJdK9ybtf6NfjEwK+R8RJslLVnuy/qT+aQX # PD208L88fjZg17G8uyawwvD1VmqWzHFSN14ShmKzqB2yPXXo/1cJ30w78DbD50yC # 6rw/xbC5j195CwE2u8eBcIyY4Hh2PUYEE4uyHbYVr57cMjfmmA5Pg4I4FJrpLrF3 # eM2Avl/4pIbsW3zxXVB8QbAkgypxZErk3teDK1AkPJnlnBYM1jGKbt/GdKe7vcHR # V/o+7NlcbS3oHVItQ2gP3m91stjFq+NhixaZpa0VlmuqayBa3xNGl0G6OQ== # =ZbNW # -----END PGP SIGNATURE----- # gpg: Signature made Fri 03 May 2024 10:36:59 AM PDT # gpg: using RSA key F13338574B662389866C7682BFFBD25F78C7AE83 # gpg: issuer "pbonzini@redhat.com" # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" [full] # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" [full] * tag 'for-upstream' of https://gitlab.com/bonzini/qemu: (46 commits) qga/commands-posix: fix typo in qmp_guest_set_user_password migration: do not include coroutine_int.h kvm: move target-dependent interrupt routing out of kvm-all.c pci: remove some types from typedefs.h tcg: remove CPU* types from typedefs.h display: remove GraphicHwOps from typedefs.h qapi/machine: remove types from typedefs.h monitor: remove MonitorDef from typedefs.h migration: remove PostcopyDiscardState from typedefs.h lockable: remove QemuLockable from typedefs.h intc: remove PICCommonState from typedefs.h qemu-option: remove QemuOpt from typedefs.h net: remove AnnounceTimer from typedefs.h numa: remove types from typedefs.h qdev-core: remove DeviceListener from typedefs.h fw_cfg: remove useless declarations from typedefs.h build: do not build virtio-vga-gl if virgl/opengl not available bitmap: Use g_try_new0/g_new0/g_renew target/i386: Introduce SapphireRapids-v3 to add missing features docs: document new convention for Kconfig board symbols ... Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2024-05-06accel/tcg: Access tcg_cflags with getter / setterPhilippe Mathieu-Daudé
Access the CPUState::tcg_cflags via tcg_cflags_has() and tcg_cflags_set() helpers. Mechanical change using the following Coccinelle spatch script: @@ expression cpu; expression flags; @@ - cpu->tcg_cflags & flags + tcg_cflags_has(cpu, flags) @@ expression cpu; expression flags; @@ - (tcg_cflags_has(cpu, flags)) + tcg_cflags_has(cpu, flags) @@ expression cpu; expression flags; @@ - cpu->tcg_cflags |= flags; + tcg_cflags_set(cpu, flags); Then manually moving the declarations, and adding both tcg_cflags_has() and tcg_cflags_set() definitions. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20240427155714.53669-15-philmd@linaro.org>
2024-05-06exec/cpu: Extract page-protection definitions to page-protection.hPhilippe Mathieu-Daudé
Extract page-protection definitions from "exec/cpu-all.h" to "exec/page-protection.h". The list of files requiring the new header was generated using: $ git grep -wE \ 'PAGE_(READ|WRITE|EXEC|RWX|VALID|ANON|RESERVED|TARGET_.|PASSTHROUGH)' Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Acked-by: Nicholas Piggin <npiggin@gmail.com> Acked-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20240427155714.53669-3-philmd@linaro.org>
2024-05-03Merge tag 'accel-sh4-ui-20240503' of https://github.com/philmd/qemu into stagingRichard Henderson
- Fix NULL dereference in NVMM & WHPX init_vcpu() - Move user emulation headers "exec/user" to "user" - Fix SH-4 ADDV / SUBV opcodes - Drop Cocoa compatility on macOS <= 10.12 - Update Anthony PERARD email # -----BEGIN PGP SIGNATURE----- # # iQIzBAABCAAdFiEE+qvnXhKRciHc/Wuy4+MsLN6twN4FAmY1BE4ACgkQ4+MsLN6t # wN73jg//dbdHQU+4oM7BgTduDZn1ulKz5DtNEJawRP6vxIcSQ+Co2Yd+gdLOSXNI # 2BaoiOQ8cyDEHj1Uud3WVB0GsQYvHrqgXcjeHpX6yFFCZNyRvzEXizJPHKCtq+4e # XQFtfTFftlJdaKCLqyDqVnrVNRacFPm7kinrEQbTSmglAhwnyu3GwsokDAYiJTqp # g0n6mX/pWVEMDNY1HrDsk2Q/pyIZFmzhtuRyXRvi/bh8/BnmMCpySG+2463dnu1O # xIGr2w8ldc+mKn2w2k3wYKDnUHz/NhOkE86tL/ZxIgjCzeenZXwXNdzM+cuAmOZX # L9KIu5io6bTevYVwwHhd5/N6MCqVEhoRmsUQfF0CIkIzxXbyF14M89YHXZo3YJAd # n2uoJ7i6hF/4Pt6Uqlg09+vEk7onwrobnTPnbKHEKNWHNOMKXpq1CBxxcVz2qe24 # +CTAAOOhHqaTjODPSexzHZDZYxugCy1XSqps9AFF1HqUcmsPCL/PQ75YGTJJO0oF # 0V1Yvzjhin26AQS9SglIeXnHxYC26Cg2mXnUpVbryWnG888r0XAGpRl+FEuXK7Ln # /dGuCIWTozypSkG9304IlxlYsOoXhL11NZqINW+W/Tor3dMRQhWUQcHqv98Jl4Ad # rnpzZ0Dhd9ityZdbI0CCMZZZLY5dw1Rq5q407GTJr1CDU4PJBh0= # =N8q0 # -----END PGP SIGNATURE----- # gpg: Signature made Fri 03 May 2024 08:35:42 AM PDT # gpg: using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE # gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <f4bug@amsat.org>" [full] * tag 'accel-sh4-ui-20240503' of https://github.com/philmd/qemu: ui/cocoa.m: Drop old macOS-10.12-and-earlier compat ifdefs target/sh4: Rename TCGv variables as manual for SUBV opcode target/sh4: Rename TCGv variables as manual for ADDV opcode target/sh4: Fix SUBV opcode target/sh4: Fix ADDV opcode MAINTAINERS: Update my email address plugins: Update stale comment plugins/api: Only include 'exec/ram_addr.h' with system emulation coverity: Update user emulation regexp user: Move 'thunk.h' from 'exec/user' to 'user' user: Move 'abitypes.h' from 'exec/user' to 'user' exec: Include missing license in 'exec/cpu-common.h' accel/whpx: Fix NULL dereference in whpx_init_vcpu() accel/nvmm: Fix NULL dereference in nvmm_init_vcpu() Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2024-05-03target/i386: Introduce SapphireRapids-v3 to add missing featuresLei Wang
Add the missing features(ss, tsc-adjust, cldemote, movdiri, movdir64b) in the SapphireRapids-v3 CPU model. Signed-off-by: Lei Wang <lei4.wang@intel.com> Message-ID: <20240424072912.43188-1-lei4.wang@intel.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-05-03i386: switch boards to "default y"Paolo Bonzini
Some targets use "default y" for boards to filter out those that require TCG. For consistency we are switching all other targets to do the same. Continue with i386. No changes to generated config-devices.mak files, other than adding CONFIG_I386 to the x86_64-softmmu target. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-05-03accel/whpx: Fix NULL dereference in whpx_init_vcpu()Philippe Mathieu-Daudé
When mechanically moving the @dirty field to AccelCPUState in commit 9ad49538c7, we neglected cpu->accel is still NULL when we want to dereference it. Fixes: 9ad49538c7 ("accel/whpx: Use accel-specific per-vcpu @dirty field") Reported-by: Volker Rümelin <vr_qemu@t-online.de> Suggested-by: Volker Rümelin <vr_qemu@t-online.de> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20240429091918.27429-2-philmd@linaro.org>
2024-05-03accel/nvmm: Fix NULL dereference in nvmm_init_vcpu()Philippe Mathieu-Daudé
When mechanically moving the @dirty field to AccelCPUState in commit 79f1926b2d, we neglected cpu->accel is still NULL when we want to dereference it. Reported-by: Volker Rümelin <vr_qemu@t-online.de> Suggested-by: Volker Rümelin <vr_qemu@t-online.de> Fixes: 79f1926b2d ("accel/nvmm: Use accel-specific per-vcpu @dirty field") Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20240429091918.27429-3-philmd@linaro.org>
2024-05-03Kconfig: kvm: allow building without any boardPaolo Bonzini
KVM code might have to call functions on the PCIDevice that is passed to kvm_arch_fixup_msi_route(). This fails in the case where --without-default-devices is used and no board is configured. While this is not really a useful configuration, and therefore setting up stubs for CONFIG_PCI is overkill, failing the build is impolite. Just include the PCI subsystem if kvm_arch_fixup_msi_route() requires it, as is the case for ARM and x86. Reported-by: Philippe Mathieu-Daudé <philmd@linaro.org> Tested-by: Fabiano Rosas <farosas@suse.de> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-05-03target/i386: Give IRQs a chance when resetting HF_INHIBIT_IRQ_MASKRuihan Li
When emulated with QEMU, interrupts will never come in the following loop. However, if the NOP instruction is uncommented, interrupts will fire as normal. loop: cli call do_sti jmp loop do_sti: sti # nop ret This behavior is different from that of a real processor. For example, if KVM is enabled, interrupts will always fire regardless of whether the NOP instruction is commented or not. Also, the Intel Software Developer Manual states that after the STI instruction is executed, the interrupt inhibit should end as soon as the next instruction (e.g., the RET instruction if the NOP instruction is commented) is executed. This problem is caused because the previous code may choose not to end the TB even if the HF_INHIBIT_IRQ_MASK has just been reset (e.g., in the case where the STI instruction is immediately followed by the RET instruction), so that IRQs may not have a change to trigger. This commit fixes the problem by always terminating the current TB to give IRQs a chance to trigger when HF_INHIBIT_IRQ_MASK is reset. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Ruihan Li <lrh2000@pku.edu.cn> Message-ID: <20240415064518.4951-4-lrh2000@pku.edu.cn> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-04-29target/i386/cpu: Remove "x86" prefix from the CPU listThomas Huth
Printing an "x86" in front of each CPU name is not helpful at all: It is confusing for the users since they don't know whether they have to specify these letters for the "-cpu" parameter, too, and it also takes some precious space in the dense output of the CPU entries. Let's simply remove this now and use two spaces at the beginning of the lines for the indentation of the entries instead, like most other target architectures are doing it for their CPU help output already. Signed-off-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Michael Tokarev <mjt@tls.msk.ru> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2024-04-26accel/hvf: Use accel-specific per-vcpu @dirty fieldPhilippe Mathieu-Daudé
HVF has a specific use of the CPUState::vcpu_dirty field (CPUState::vcpu_dirty is not used by common code). To make this field accel-specific, add and use a new @dirty variable in the AccelCPUState structure. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20240424174506.326-4-philmd@linaro.org>
2024-04-26accel/nvmm: Use accel-specific per-vcpu @dirty fieldPhilippe Mathieu-Daudé
NVMM has a specific use of the CPUState::vcpu_dirty field (CPUState::vcpu_dirty is not used by common code). To make this field accel-specific, add and use a new @dirty variable in the AccelCPUState structure. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20240424174506.326-3-philmd@linaro.org>
2024-04-26accel/whpx: Use accel-specific per-vcpu @dirty fieldPhilippe Mathieu-Daudé
WHPX has a specific use of the CPUState::vcpu_dirty field (CPUState::vcpu_dirty is not used by common code). To make this field accel-specific, add and use a new @dirty variable in the AccelCPUState structure. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20240424174506.326-2-philmd@linaro.org>
2024-04-26target/i386: Include missing 'exec/exec-all.h' headerPhilippe Mathieu-Daudé
The XRSTOR instruction ends calling tlb_flush(), declared in "exec/exec-all.h". Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20231211212003.21686-13-philmd@linaro.org>
2024-04-26target: Define TCG_GUEST_DEFAULT_MO in 'cpu-param.h'Philippe Mathieu-Daudé
accel/tcg/ files requires the following definitions: - TARGET_LONG_BITS - TARGET_PAGE_BITS - TARGET_PHYS_ADDR_SPACE_BITS - TCG_GUEST_DEFAULT_MO The first 3 are defined in "cpu-param.h". The last one in "cpu.h", with a bunch of definitions irrelevant for TCG. By moving the TCG_GUEST_DEFAULT_MO definition to "cpu-param.h", we can simplify various accel/tcg includes. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Acked-by: Nicholas Piggin <npiggin@gmail.com> Message-Id: <20231211212003.21686-4-philmd@linaro.org>
2024-04-25Merge tag 'hw-misc-20240425' of https://github.com/philmd/qemu into stagingRichard Henderson
Misc HW patch queue - Script to compare machines compat_props[] (Maksim) - Introduce 'module' CPU topology level (Zhao) - Various cleanups (Thomas, Zhao, Inès, Bernhard) # -----BEGIN PGP SIGNATURE----- # # iQIzBAABCAAdFiEE+qvnXhKRciHc/Wuy4+MsLN6twN4FAmYqN3wACgkQ4+MsLN6t # wN4hTw/9FHsItnEkme/864DRPSP7A9mCGa+JfzJmsL8oUb9fBjXXKm+lNchMLu3B # uvzfXB2Ea24yf5vyrldo0XlU3i/4GDvqXTI6YFYqBvitGICauYBu+6n2NZh2Y/Pn # zZCcVo167o0q7dHu2WSrZ6cSUchsF2C80HjuS07QaN2YZ7QMuN1+uqTjCQ/JHQWA # MH4xHh7cXdfCbbv8iNhMWn6sa+Bw/UyfRcc2W6w9cF5Q5cuuTshgDyd0JBOzkM1i # Mcul7TuKrSiLUeeeqfTjwtw3rtbNfkelV3ycgvgECFAlzPSjF5a6d/EGdO2zo3T/ # aFZnQBYrb4U0SzsmfXFHW7cSylIc1Jn2CCuZZBIvdVcu8TGDD5XsgZbGoCfKdWxp # l67qbQJy1Mp3LrRzygJIaxDOfE8fhhRrcIxfK/GoTHaCkqeFRkGjTeiDTVBqAES2 # zs6kUYZyG/xGaa2tsMu+HbtSO5EEqPC2QCdHayY3deW42Kwjj/HFV50Ya8YgYSVp # gEAjTDOle2dDjlkYud+ymTJz7LnGb3G7q0EZRI9DWolx/bu+uZGQqTSRRre4qFQY # SgN576hsFGN4NdM7tyJWiiqD/OC9ZeqUx3gGBtmI52Q6obBCE9hcow0fPs55Tk95 # 1YzPrt/3IoPI5ZptCoA8DFiysQ46OLtpIsQO9YcrpJmxWyLDSr0= # =tm+U # -----END PGP SIGNATURE----- # gpg: Signature made Thu 25 Apr 2024 03:59:08 AM PDT # gpg: using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE # gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <f4bug@amsat.org>" [full] * tag 'hw-misc-20240425' of https://github.com/philmd/qemu: (22 commits) hw/core: Support module-id in numa configuration hw/core: Introduce module-id as the topology subindex hw/core/machine: Support modules in -smp hw/core/machine: Introduce the module as a CPU topology level hw/i386/pc_sysfw: Remove unused parameter from pc_isa_bios_init() hw/misc : Correct 5 spaces indents in stm32l4x5_exti hw/xtensa: Include missing 'exec/cpu-common.h' in 'bootparam.h' hw/elf_ops: Rename elf_ops.h -> elf_ops.h.inc hw/cxl/cxl-cdat: Make cxl_doe_cdat_init() return boolean hw/cxl/cxl-cdat: Make ct3_build_cdat() return boolean hw/cxl/cxl-cdat: Make ct3_load_cdat() return boolean hw: Add a Kconfig switch for the TYPE_CPU_CLUSTER device hw: Fix problem with the A*MPCORE switches in the Kconfig files hw/riscv/virt: Replace sprintf by g_strdup_printf hw/misc/imx: Replace sprintf() by snprintf() hw/misc/applesmc: Simplify DeviceReset handler target/i386: Move APIC related code to cpu-apic.c hw/core: Remove check on NEED_CPU_H in tcg-cpu-ops.h scripts: add script to compare compatibility properties python/qemu/machine: add method to retrieve QEMUMachine::binary field ... Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2024-04-25hw, target: Add ResetType argument to hold and exit phase methodsPeter Maydell
We pass a ResetType argument to the Resettable class enter phase method, but we don't pass it to hold and exit, even though the callsites have it readily available. This means that if a device cared about the ResetType it would need to record it in the enter phase method to use later on. Pass the type to all three of the phase methods to avoid having to do that. Commit created with for dir in hw target include; do \ spatch --macro-file scripts/cocci-macro-file.h \ --sp-file scripts/coccinelle/reset-type.cocci \ --keep-comments --smpl-spacing --in-place \ --include-headers --dir $dir; done and no manual edits. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Luc Michel <luc.michel@amd.com> Message-id: 20240412160809.1260625-5-peter.maydell@linaro.org
2024-04-25target/i386: Move APIC related code to cpu-apic.cPhilippe Mathieu-Daudé
Move APIC related code split in cpu-sysemu.c and monitor.c to cpu-apic.c. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Zhao Liu <zhao1.liu@intel.com> Message-Id: <20240321154838.95771-4-philmd@linaro.org>
2024-04-23target/i386/translate.c: always write 32-bits for SGDT and SIDTMark Cave-Ayland
The various Intel CPU manuals claim that SGDT and SIDT can write either 24-bits or 32-bits depending upon the operand size, but this is incorrect. Not only do the Intel CPU manuals give contradictory information between processor revisions, but this information doesn't even match real-life behaviour. In fact, tests on real hardware show that the CPU always writes 32-bits for SGDT and SIDT, and this behaviour is required for at least OS/2 Warp and WFW 3.11 with Win32s to function correctly. Remove the masking applied due to the operand size for SGDT and SIDT so that the TCG behaviour matches the behaviour on real hardware. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2198 -- MCA: Whilst I don't have a copy of OS/2 Warp handy, I've confirmed that this patch fixes the issue in WFW 3.11 with Win32s. For more technical information I highly recommend the excellent write-up at https://www.os2museum.com/wp/sgdtsidt-fiction-and-reality/. Message-ID: <20240419195147.434894-1-mark.cave-ayland@ilande.co.uk> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-04-23target/i386/cpu: Merge the warning and error messages for AMD HT checkZhao Liu
Currently, the difference between warn_report_once() and error_report_once() is the former has the "warning:" prefix, while the latter does not have a similar level prefix. At the meantime, considering that there is no error handling logic here, and the purpose of error_report_once() is only to prompt the user with an abnormal message, there is no need to use an error-level message here, and instead we can just use a warning. Therefore, downgrade the message in error_report_once() to warning, and merge it into the previous warn_report_once(). Signed-off-by: Zhao Liu <zhao1.liu@intel.com> Message-ID: <20240327103951.3853425-4-zhao1.liu@linux.intel.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-04-23target/i386/cpu: Consolidate the use of warn_report_once()Zhao Liu
The difference between error_printf() and error_report() is the latter may contain more information, such as the name of the program ("qemu-system-x86_64"). Thus its variant error_report_once() and warn_report()'s variant warn_report_once() can be used here to print the information only once without a static local variable "ht_warned". Signed-off-by: Zhao Liu <zhao1.liu@intel.com> Message-ID: <20240327103951.3853425-3-zhao1.liu@linux.intel.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-04-23target/i386/host-cpu: Consolidate the use of warn_report_once()Zhao Liu
Use warn_report_once() to get rid of the static local variable "warned". Signed-off-by: Zhao Liu <zhao1.liu@intel.com> Message-ID: <20240327103951.3853425-2-zhao1.liu@linux.intel.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-04-23hw/i386/sev: Use legacy SEV VM types for older machine typesMichael Roth
Newer 9.1 machine types will default to using the KVM_SEV_INIT2 API for creating SEV/SEV-ES going forward. However, this API results in guest measurement changes which are generally not expected for users of these older guest types and can cause disruption if they switch to a newer QEMU/kernel version. Avoid this by continuing to use the older KVM_SEV_INIT/KVM_SEV_ES_INIT APIs for older machine types. Signed-off-by: Michael Roth <michael.roth@amd.com> Message-ID: <20240409230743.962513-4-michael.roth@amd.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-04-23i386/sev: Add 'legacy-vm-type' parameter for SEV guest objectsMichael Roth
QEMU will currently automatically make use of the KVM_SEV_INIT2 API for initializing SEV and SEV-ES guests verses the older KVM_SEV_INIT/KVM_SEV_ES_INIT interfaces. However, the older interfaces will silently avoid sync'ing FPU/XSAVE state to the VMSA prior to encryption, thus relying on behavior and measurements that assume the related fields to be allow zero. With KVM_SEV_INIT2, this state is now synced into the VMSA, resulting in measurements changes and, theoretically, behaviorial changes, though the latter are unlikely to be seen in practice. To allow a smooth transition to the newer interface, while still providing a mechanism to maintain backward compatibility with VMs created using the older interfaces, provide a new command-line parameter: -object sev-guest,legacy-vm-type=true,... and have it default to false. Signed-off-by: Michael Roth <michael.roth@amd.com> Message-ID: <20240409230743.962513-2-michael.roth@amd.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-04-23target/i386: SEV: use KVM_SEV_INIT2 if possiblePaolo Bonzini
Implement support for the KVM_X86_SEV_VM and KVM_X86_SEV_ES_VM virtual machine types, and the KVM_SEV_INIT2 function of KVM_MEMORY_ENCRYPT_OP. These replace the KVM_SEV_INIT and KVM_SEV_ES_INIT functions, and have several advantages: - sharing the initialization sequence with SEV-SNP and TDX - allowing arguments including the set of desired VMSA features - protection against invalid use of KVM_GET/SET_* ioctls for guests with encrypted state If the KVM_X86_SEV_VM and KVM_X86_SEV_ES_VM types are not supported, fall back to KVM_SEV_INIT and KVM_SEV_ES_INIT (which use the default x86 VM type). Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-04-23target/i386: Implement mc->kvm_type() to get VM typePaolo Bonzini
KVM is introducing a new API to create confidential guests, which will be used by TDX and SEV-SNP but is also available for SEV and SEV-ES. The API uses the VM type argument to KVM_CREATE_VM to identify which confidential computing technology to use. Since there are no other expected uses of VM types, delegate mc->kvm_type() for x86 boards to the confidential-guest-support object pointed to by ms->cgs. For example, if a sev-guest object is specified to confidential-guest-support, like, qemu -machine ...,confidential-guest-support=sev0 \ -object sev-guest,id=sev0,... it will check if a VM type KVM_X86_SEV_VM or KVM_X86_SEV_ES_VM is supported, and if so use them together with the KVM_SEV_INIT2 function of the KVM_MEMORY_ENCRYPT_OP ioctl. If not, it will fall back to KVM_SEV_INIT and KVM_SEV_ES_INIT. This is a preparatory work towards TDX and SEV-SNP support, but it will also enable support for VMSA features such as DebugSwap, which are only available via KVM_SEV_INIT2. Co-developed-by: Xiaoyao Li <xiaoyao.li@intel.com> Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-04-23target/i386: introduce x86-confidential-guestPaolo Bonzini
Introduce a common superclass for x86 confidential guest implementations. It will extend ConfidentialGuestSupportClass with a method that provides the VM type to be passed to KVM_CREATE_VM. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>