aboutsummaryrefslogtreecommitdiff
path: root/target
AgeCommit message (Collapse)Author
2024-01-26target/arm: Fix A64 scalar SQSHRN and SQRSHRNPeter Maydell
In commit 1b7bc9b5c8bf374dd we changed handle_vec_simd_sqshrn() so that instead of starting with a 0 value and depositing in each new element from the narrowing operation, it instead started with the raw result of the narrowing operation of the first element. This is fine in the vector case, because the deposit operations for the second and subsequent elements will always overwrite any higher bits that might have been in the first element's result value in tcg_rd. However in the scalar case we only go through this loop once. The effect is that for a signed narrowing operation, if the result is negative then we will now return a value where the bits above the first element are incorrectly 1 (because the narrowfn returns a sign-extended result, not one that is truncated to the element size). Fix this by using an extract operation to get exactly the correct bits of the output of the narrowfn for element 1, instead of a plain move. Cc: qemu-stable@nongnu.org Fixes: 1b7bc9b5c8bf374dd3 ("target/arm: Avoid tcg_const_ptr in handle_vec_simd_sqshrn") Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2089 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20240123153416.877308-1-peter.maydell@linaro.org
2024-01-26target/arm: Move GTimer definitions to new 'gtimer.h' headerPhilippe Mathieu-Daudé
Move Arm A-class Generic Timer definitions to the new "target/arm/gtimer.h" header so units in hw/ which don't need access to ARMCPU internals can use them without having to include the huge "cpu.h". Suggested-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20240118200643.29037-20-philmd@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2024-01-26target/arm: Move e2h_access() helper aroundPhilippe Mathieu-Daudé
e2h_access() was added in commit bb5972e439 ("target/arm: Add VHE timer register redirection and aliasing") close to the generic_timer_cp_reginfo[] array, but isn't used until vhe_reginfo[] definition. Move it closer to the other e2h helpers. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20240118200643.29037-19-philmd@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2024-01-26target/arm: Move ARM_CPU_IRQ/FIQ definitions to 'cpu-qom.h' headerPhilippe Mathieu-Daudé
The ARM_CPU_IRQ/FIQ definitions are used to index the GPIO IRQ created calling qdev_init_gpio_in() in ARMCPU instance_init() handler. To allow non-ARM code to raise interrupt on ARM cores, move they to 'target/arm/cpu-qom.h' which is non-ARM specific and can be included by any hw/ file. File list to include the new header generated using: $ git grep -wEl 'ARM_CPU_(\w*IRQ|FIQ)' Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20240118200643.29037-18-philmd@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2024-01-26target/arm: Expose M-profile register bank index definitionsPhilippe Mathieu-Daudé
The ARMv7M QDev container accesses the QDev SysTickState by its secure/non-secure bank index. In order to make the "hw/intc/armv7m_nvic.h" header target-agnostic in the next commit, first move the M-profile bank index definitions to "target/arm/cpu-qom.h". Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20240118200643.29037-16-philmd@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2024-01-26target/arm: Declare ARM_CPU_TYPE_NAME/SUFFIX in 'cpu-qom.h'Philippe Mathieu-Daudé
Missed in commit 2d56be5a29 ("target: Declare FOO_CPU_TYPE_NAME/SUFFIX in 'cpu-qom.h'"). See it for more details. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20240118200643.29037-12-philmd@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2024-01-26target/arm: Expose arm_cpu_mp_affinity() in 'multiprocessing.h' headerPhilippe Mathieu-Daudé
Declare arm_cpu_mp_affinity() prototype in the new "target/arm/multiprocessing.h" header so units in hw/arm/ can use it without having to include the huge target-specific "cpu.h". File list to include the new header generated using: $ git grep -lw arm_cpu_mp_affinity Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20240118200643.29037-11-philmd@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2024-01-26target/arm: Create arm_cpu_mp_affinityRichard Henderson
Wrapper to return the mp affinity bits from the cpu. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20240118200643.29037-10-philmd@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2024-01-26target/arm: Rename arm_cpu_mp_affinityRichard Henderson
Rename to arm_build_mp_affinity. This frees up the name for other usage, and emphasizes that the cpu object is not involved. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20240118200643.29037-9-philmd@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2024-01-26target/arm/cpregs: Include missing 'kvm-consts.h' headerPhilippe Mathieu-Daudé
target/arm/cpregs.h uses the CP_REG_ARCH_* definitions from "target/arm/kvm-consts.h". Include it in order to avoid when refactoring unrelated headers: target/arm/cpregs.h:191:18: error: use of undeclared identifier 'CP_REG_ARCH_MASK' if ((kvmid & CP_REG_ARCH_MASK) == CP_REG_ARM64) { ^ Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20240118200643.29037-8-philmd@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2024-01-26target/arm/cpregs: Include missing 'hw/registerfields.h' headerPhilippe Mathieu-Daudé
target/arm/cpregs.h uses the FIELD() macro defined in "hw/registerfields.h". Include it in order to avoid when refactoring unrelated headers: target/arm/cpregs.h:347:30: error: expected identifier FIELD(HFGRTR_EL2, AFSR0_EL1, 0, 1) ^ Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20240118200643.29037-7-philmd@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2024-01-26target/arm/cpu-features: Include missing 'hw/registerfields.h' headerPhilippe Mathieu-Daudé
target/arm/cpu-features.h uses the FIELD_EX32() macro defined in "hw/registerfields.h". Include it in order to avoid when refactoring unrelated headers: target/arm/cpu-features.h:44:12: error: call to undeclared function 'FIELD_EX32'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] return FIELD_EX32(id->id_isar0, ID_ISAR0, DIVIDE) != 0; ^ Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20240118200643.29037-6-philmd@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2024-01-26target/arm: Fix VNCR fault detection logicPeter Maydell
In arm_deliver_fault() we check for whether the fault is caused by a data abort due to an access to a FEAT_NV2 sysreg in the memory pointed to by the VNCR. Unfortunately part of the condition checks the wrong argument to the function, meaning that it would spuriously trigger, resulting in some instruction aborts being taken to the wrong EL and reported incorrectly. Use the right variable in the condition. Fixes: 674e5345275d425 ("target/arm: Report VNCR_EL2 based faults correctly") Reported-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Tested-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> Message-id: 20240116165605.2523055-1-peter.maydell@linaro.org
2024-01-26target/xtensa: fix OOB TLB entry accessMax Filippov
r[id]tlb[01], [iw][id]tlb opcodes use TLB way index passed in a register by the guest. The host uses 3 bits of the index for ITLB indexing and 4 bits for DTLB, but there's only 7 entries in the ITLB array and 10 in the DTLB array, so a malicious guest may trigger out-of-bound access to these arrays. Change split_tlb_entry_spec return type to bool to indicate whether TLB way passed to it is valid. Change get_tlb_entry to return NULL in case invalid TLB way is requested. Add assertion to xtensa_tlb_get_entry that requested TLB way and entry indices are valid. Add checks to the [rwi]tlb helpers that requested TLB way is valid and return 0 or do nothing when it's not. Cc: qemu-stable@nongnu.org Fixes: b67ea0cd7441 ("target-xtensa: implement memory protection options") Signed-off-by: Max Filippov <jcmvbkbc@gmail.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20231215120307.545381-1-jcmvbkbc@gmail.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2024-01-21target/hexagon: reduce scope of def_regnum, remove dead assignmentBrian Cain
This is intended to address a coverity finding: CID 1527408. Signed-off-by: Brian Cain <bcain@quicinc.com> Reviewed-by: Matheus Tavares Bernardino <quic_mathbern@quicinc.com> Message-Id: <20240114234453.4114587-1-bcain@quicinc.com>
2024-01-21Hexagon (target/hexagon) Remove old dectree.pyTaylor Simpson
Now that we are using QEMU decodetree.py, remove the old decoder Signed-off-by: Taylor Simpson <ltaylorsimpson@gmail.com> Reviewed-by: Brian Cain <bcain@quicinc.com> Message-Id: <20240115221443.365287-4-ltaylorsimpson@gmail.com> Signed-off-by: Brian Cain <bcain@quicinc.com>
2024-01-21Hexagon (target/hexagon) Use QEMU decodetree (16-bit instructions)Taylor Simpson
Section 10.3 of the Hexagon V73 Programmer's Reference Manual A duplex is encoded as a 32-bit instruction with bits [15:14] set to 00. The sub-instructions that comprise a duplex are encoded as 13-bit fields in the duplex. Create a decoder for each subinstruction class (a, l1, l2, s1, s2). Extend gen_trans_funcs.py to handle all instructions rather than filter by instruction class. There is a g_assert_not_reached() in decode_insns() in decode.c to verify we never try to use the old decoder on 16-bit instructions. Signed-off-by: Taylor Simpson <ltaylorsimpson@gmail.com> Reviewed-by: Brian Cain <bcain@quicinc.com> Message-Id: <20240115221443.365287-3-ltaylorsimpson@gmail.com> Signed-off-by: Brian Cain <bcain@quicinc.com>
2024-01-21Hexagon (target/hexagon) Use QEMU decodetree (32-bit instructions)Taylor Simpson
The Decodetree Specification can be found here https://www.qemu.org/docs/master/devel/decodetree.html Covers all 32-bit instructions, including HVX We generate separate decoders for each instruction class. The reason will be more apparent in the next patch in this series. We add 2 new scripts gen_decodetree.py Generate the input to decodetree.py gen_trans_funcs.py Generate the trans_* functions used by the output of decodetree.py Since the functions generated by decodetree.py take DisasContext * as an argument, we add the argument to a couple of functions that didn't need it previously. We also set the insn field in DisasContext during decode because it is used by the trans_* functions. There is a g_assert_not_reached() in decode_insns() in decode.c to verify we never try to use the old decoder on 32-bit instructions Signed-off-by: Taylor Simpson <ltaylorsimpson@gmail.com> Reviewed-by: Brian Cain <bcain@quicinc.com> Message-Id: <20240115221443.365287-2-ltaylorsimpson@gmail.com> Signed-off-by: Brian Cain <bcain@quicinc.com>
2024-01-21Hexagon (target/hexagon) Remove dead functions from hex_common.pyTaylor Simpson
These functions are no longer used after making the generators object oriented. Signed-off-by: Taylor Simpson <ltaylorsimpson@gmail.com> Reviewed-by: Brian Cain <bcain@quicinc.com> Message-Id: <20231210220712.491494-10-ltaylorsimpson@gmail.com> Signed-off-by: Brian Cain <bcain@quicinc.com>
2024-01-21Hexagon (target/hexagon) Remove unused WRITES_PRED_REG attributeTaylor Simpson
This is the only remaining use of the is_written function. We will remove it in the subsequent commit. Signed-off-by: Taylor Simpson <ltaylorsimpson@gmail.com> Reviewed-by: Brian Cain <bcain@quicinc.com> Message-Id: <20231210220712.491494-9-ltaylorsimpson@gmail.com> Signed-off-by: Brian Cain <bcain@quicinc.com>
2024-01-21Hexagon (target/hexagon) Make generators object oriented - gen_analyze_funcsTaylor Simpson
This patch conflicts with https://lists.gnu.org/archive/html/qemu-devel/2023-11/msg00729.html If that series goes in first, we'll rework this patch and vice versa. Signed-off-by: Taylor Simpson <ltaylorsimpson@gmail.com> Reviewed-by: Brian Cain <bcain@quicinc.com> Message-Id: <20231210220712.491494-8-ltaylorsimpson@gmail.com> Signed-off-by: Brian Cain <bcain@quicinc.com>
2024-01-21Hexagon (target/hexagon) Make generators object oriented - gen_op_regsTaylor Simpson
Reviewed-by: Brian Cain <bcain@quicinc.com> Signed-off-by: Taylor Simpson <ltaylorsimpson@gmail.com> Message-Id: <20231210220712.491494-7-ltaylorsimpson@gmail.com> Signed-off-by: Brian Cain <bcain@quicinc.com>
2024-01-21Hexagon (target/hexagon) Make generators object oriented - gen_idef_parser_funcsTaylor Simpson
Signed-off-by: Taylor Simpson <ltaylorsimpson@gmail.com> Reviewed-by: Brian Cain <bcain@quicinc.com> Message-Id: <20231210220712.491494-6-ltaylorsimpson@gmail.com> Signed-off-by: Brian Cain <bcain@quicinc.com>
2024-01-21Hexagon (target/hexagon) Make generators object oriented - gen_helper_funcsTaylor Simpson
Signed-off-by: Taylor Simpson <ltaylorsimpson@gmail.com> Reviewed-by: Brian Cain <bcain@quicinc.com> Message-Id: <20231210220712.491494-5-ltaylorsimpson@gmail.com> Signed-off-by: Brian Cain <bcain@quicinc.com>
2024-01-21Hexagon (target/hexagon) Make generators object oriented - gen_helper_protosTaylor Simpson
Signed-off-by: Taylor Simpson <ltaylorsimpson@gmail.com> Reviewed-by: Brian Cain <bcain@quicinc.com> Message-Id: <20231210220712.491494-4-ltaylorsimpson@gmail.com> Signed-off-by: Brian Cain <bcain@quicinc.com>
2024-01-21Hexagon (target/hexagon) Make generators object oriented - gen_tcg_funcsTaylor Simpson
The generators are generally a bunch of Python if-then-else statements based on the regtype and regid. Encapsulate regtype/regid into a class hierarchy. Clients lookup the register and invoke methods. This has several advantages for making the code easier to read, understand, and maintain - The class name makes it more clear what the operand does - All the methods for a given type of operand are together - Don't need hex_common.bad_register If a regtype/regid is missing, the lookup in hex_common.get_register will fail - We can remove the functions in hex_common that use regtype/regid (e.g., is_read) This patch creates the class hierarchy in hex_common and converts gen_tcg_funcs.py. The other scripts will be converted in subsequent patches in this series. Signed-off-by: Taylor Simpson <ltaylorsimpson@gmail.com> Reviewed-by: Brian Cain <bcain@quicinc.com> Message-Id: <20231210220712.491494-3-ltaylorsimpson@gmail.com> Signed-off-by: Brian Cain <bcain@quicinc.com>
2024-01-21Hexagon (target/hexagon) Clean up handling of modifier registersTaylor Simpson
Currently, the register number (MuN) for modifier registers is the modifier register number rather than the index into hex_gpr. This patch changes MuN to the hex_gpr index, which is consistent with the handling of control registers. Note that HELPER(fcircadd) needs the CS register corresponding to the modifier register specified in the instruction. We create a TCGv variable "CS" to hold the value to pass to the helper. Reviewed-by: Brian Cain <bcain@quicinc.com> Signed-off-by: Taylor Simpson <ltaylorsimpson@gmail.com> Message-Id: <20231210220712.491494-2-ltaylorsimpson@gmail.com> Signed-off-by: Brian Cain <bcain@quicinc.com>
2024-01-21Hexagon (target/hexagon) Fix shadow variable when idef-parser is offTaylor Simpson
Adding -Werror=shadow=compatible-local causes Hexagon not to build when idef-parser is off. The "label" variable in CHECK_NOSHUF_PRED shadows a variable in the surrounding code. Signed-off-by: Taylor Simpson <ltaylorsimpson@gmail.com> Reviewed-by: Brian Cain <bcain@quicinc.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-Id: <20231130183955.54314-1-ltaylorsimpson@gmail.com> Signed-off-by: Brian Cain <bcain@quicinc.com>
2024-01-19Merge tag 'hw-cpus-20240119' of https://github.com/philmd/qemu into stagingPeter Maydell
HW core patch queue . Deprecate unmaintained SH-4 models (Samuel) . HPET: Convert DPRINTF calls to trace events (Daniel) . Implement buffered block writes in Intel PFlash (Gerd) . Ignore ELF loadable segments with zero size (Bin) . ESP/NCR53C9x: PCI DMA fixes (Mark) . PIIX: Simplify Xen PCI IRQ routing (Bernhard) . Restrict CPU 'start-powered-off' property to sysemu (Phil) . target/alpha: Only build sys_helper.c on system emulation (Phil) . target/xtensa: Use generic instruction breakpoint API & add test (Max) . Restrict icount to system emulation (Phil) . Do not set CPUState TCG-specific flags in non-TCG accels (Phil) . Cleanup TCG tb_invalidate API (Phil) . Correct LoongArch/KVM include path (Bibo) . Do not ignore throttle errors in crypto backends (Phil) . MAINTAINERS updates (Raphael, Zhao) # -----BEGIN PGP SIGNATURE----- # # iQIzBAABCAAdFiEE+qvnXhKRciHc/Wuy4+MsLN6twN4FAmWqXbkACgkQ4+MsLN6t # wN6VVBAAkP/Bs2JfQYobPZVV868wceM97KeUJMXP2YWf6dSLpHRCQN5KtuJcACM9 # y3k3R7nMeVJSGmzl/1gF1G9JhjoCLoVLX/ejeBppv4Wq//9sEdggaQfdCwkhWw2o # IK/gPjTZpimE7Er4hPlxmuhSRuM1MX4duKFRRfuZpE7XY14Y7/Hk12VIG7LooO0x # 2Sl8CaU0DN7CWmRVDoUkwVx7JBy28UVarRDsgpBim7oKmjjBFnCJkH6B6NJXEiYr # z1BmIcHa87S09kG1ek+y8aZpG9iPC7nUWjPIQyJGhnfrnBuO7hQHwCLIjHHp5QBR # BoMr8YQNTI34/M/D8pBfg96LrGDjkQOfwRyRddkMP/jJcNPMAPMNGbfVaIrfij1e # T+jFF4gQenOvy1XKCY3Uk/a11P3tIRFBEeOlzzQg4Aje9W2MhUNwK2HTlRfBbrRr # V30R764FDmHlsyOu6/E3jqp4GVCgryF1bglPOBjVEU5uytbQTP8jshIpGVnxBbF+ # OpFwtsoDbsousNKVcO5+B0mlHcB9Ru9h11M5/YD/jfLMk95Ga90JGdgYpqQ5tO5Y # aqQhKfCKbfgKuKhysxpsdWAwHZzVrlSf+UrObF0rl2lMXXfcppjCqNaw4QJ0oedc # DNBxTPcCE2vWhUzP3A60VH7jLh4nLaqSTrxxQKkbx+Je1ERGrxs= # =KmQh # -----END PGP SIGNATURE----- # gpg: Signature made Fri 19 Jan 2024 11:32:09 GMT # gpg: using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE # gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <f4bug@amsat.org>" [full] # Primary key fingerprint: FAAB E75E 1291 7221 DCFD 6BB2 E3E3 2C2C DEAD C0DE * tag 'hw-cpus-20240119' of https://github.com/philmd/qemu: (36 commits) configure: Add linux header compile support for LoongArch MAINTAINERS: Update hw/core/cpu.c entry MAINTAINERS: Update Raphael Norwitz email hw/elf_ops: Ignore loadable segments with zero size hw/scsi/esp-pci: set DMA_STAT_BCMBLT when BLAST command issued hw/scsi/esp-pci: synchronise setting of DMA_STAT_DONE with ESP completion interrupt hw/scsi/esp-pci: generate PCI interrupt from separate ESP and PCI sources hw/scsi/esp-pci: use correct address register for PCI DMA transfers target/riscv: Rename tcg_cpu_FOO() to include 'riscv' target/i386: Rename tcg_cpu_FOO() to include 'x86' hw/s390x: Rename cpu_class_init() to include 'sclp' hw/core/cpu: Rename cpu_class_init() to include 'common' accel: Rename accel_init_ops_interfaces() to include 'system' cpus: Restrict 'start-powered-off' property to system emulation system/watchpoint: Move TCG specific code to accel/tcg/ system/replay: Restrict icount to system emulation hw/pflash: implement update buffer for block writes hw/pflash: use ldn_{be,le}_p and stn_{be,le}_p hw/pflash: refactor pflash_data_write() hw/i386/pc_piix: Make piix_intx_routing_notifier_xen() more device independent ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2024-01-19Merge tag 'for-upstream' of https://gitlab.com/bonzini/qemu into stagingPeter Maydell
* vga: implement odd/even and byte/word/doubleword modes more accurately * vga: implement horizontal pel panning * KVM: add class property to configure KVM device node to use * fix various bugs in x86 TCG PC-relative translation * properly align huge pages on LoongArch * cleanup patches # -----BEGIN PGP SIGNATURE----- # # iQFIBAABCAAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAmWo8wkUHHBib256aW5p # QHJlZGhhdC5jb20ACgkQv/vSX3jHroMhHAf+KiYvN/gxrYnpSS7IfbFqx6MtQrwW # Hj9QsfgRF2sThRu6BveLMG7REwEtwFh7lMhUbiyR/mzuYN9cMmHDw4OE62WRrL86 # 3PAtzAaJ/Lzd8Qp4K4un+ZrFZvq8a83HvGRRTaF9wO6/9EwpqmqMTbrNlSSA08Gy # mnfXGEt0oYitJ3JUH0MI8y6EOh1mkIhEfGPeyJaGDZVW/m4ob+QIauNOOozYN7r6 # QK+2OU0HeJC5CIzi2o5kq5U0AydVO1iAp7OBxtclYaaSvRyhlpEmbdTIKCzzPlUx # vZthxbU2PgzUbME8fraUcd7GzT64++QOLDxNyZNEL8PCCcd0lRQ0EEukgA== # =Uz0X # -----END PGP SIGNATURE----- # gpg: Signature made Thu 18 Jan 2024 09:44:41 GMT # gpg: using RSA key F13338574B662389866C7682BFFBD25F78C7AE83 # gpg: issuer "pbonzini@redhat.com" # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" [full] # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" [full] # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * tag 'for-upstream' of https://gitlab.com/bonzini/qemu: tests/tcg: Don't #include <inttypes.h> in aarch64/system/vtimer.c qemu/osdep: Add huge page aligned support on LoongArch platform remove unnecessary casts from uintptr_t target/i386: pcrel: store low bits of physical address in data[0] target/i386: fix incorrect EIP in PC-relative translation blocks target/i386: Do not re-compute new pc with CF_PCREL io_uring: move LuringState typedef to block/aio.h Add class property to configure KVM device node to use vga: sort-of implement word and double-word access modes vga: use latches in odd/even mode too vga: reindent memory access code vga: optimize horizontal pel panning in 256-color modes vga: implement horizontal pel panning in graphics modes vga: mask addresses in non-VESA modes to 256k vga: introduce VGADisplayParams vga: use common endian swap macros Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2024-01-19target/riscv: Rename tcg_cpu_FOO() to include 'riscv'Philippe Mathieu-Daudé
The tcg_cpu_FOO() names are riscv specific, so rename them as riscv_tcg_cpu_FOO() (as other names in this file) to ease navigating the code. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-ID: <20240111120221.35072-6-philmd@linaro.org>
2024-01-19target/i386: Rename tcg_cpu_FOO() to include 'x86'Philippe Mathieu-Daudé
The tcg_cpu_FOO() names are x86 specific, so rename them as x86_tcg_cpu_FOO() (as other names in this file) to ease navigating the code. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Michael Tokarev <mjt@tls.msk.ru> Message-ID: <20240111120221.35072-5-philmd@linaro.org>
2024-01-19target/arm: Ensure icount is enabled when emulating INST_RETIREDPhilippe Mathieu-Daudé
pmu_init() register its event checking the pm_event::supported() handler. For INST_RETIRED, the event is only registered and the bit enabled in the PMU Common Event Identification register when icount is enabled as ICOUNT_PRECISE. PMU events are TCG-only, hardware accelerators handle them directly. Unfortunately we register the events in non-TCG builds, leading to linking error such: ld: Undefined symbols: _icount_to_ns, referenced from: _instructions_ns_per in target_arm_helper.c.o clang: error: linker command failed with exit code 1 (use -v to see invocation) As a kludge, give a hint to the compiler by asserting the pm_event::get_count() and pm_event::ns_per_count() handler will only be called under this icount mode. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20231208113529.74067-5-philmd@linaro.org>
2024-01-19system/cpu-timers: Introduce ICountMode enumeratorPhilippe Mathieu-Daudé
Rather than having to lookup for what the 0, 1, 2, ... icount values are, use a enum definition. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-ID: <20231208113529.74067-4-philmd@linaro.org>
2024-01-19target/alpha: Only build sys_helper.c on system emulationPhilippe Mathieu-Daudé
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20231207105426.49339-3-philmd@linaro.org>
2024-01-19target/alpha: Extract clk_helper.c from sys_helper.cPhilippe Mathieu-Daudé
Except helper_load_pcc(), all helpers from sys_helper.c are system-emulation specific. In preparation of restricting sys_helper.c to system emulation, extract helper_load_pcc() to clk_helper.c. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20231207105426.49339-2-philmd@linaro.org>
2024-01-19target/xtensa: use generic instruction breakpoint infrastructureMax Filippov
Don't embed ibreak exception generation into TB and don't invalidate TB on ibreak address change. Add CPUBreakpoint pointers to xtensa CPUArchState, use cpu_breakpoint_insert/cpu_breakpoint_remove_by_ref to manage ibreak breakpoints and provide TCGCPUOps::debug_check_breakpoint callback that recognizes valid instruction breakpoints. Signed-off-by: Max Filippov <jcmvbkbc@gmail.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-ID: <20231130171920.3798954-2-jcmvbkbc@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-01-19accel: Do not set CPUState::tcg_cflags in non-TCG accelsPhilippe Mathieu-Daudé
'tcg_cflags' is specific to TCG. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20231130075958.21285-1-philmd@linaro.org>
2024-01-18Merge tag 'pull-target-arm-20240118' of ↵Peter Maydell
https://git.linaro.org/people/pmaydell/qemu-arm into staging target-arm queue: * docs/devel/docs: Document .hx file syntax * arm_pamax() no longer needs to do feature propagation * docs/system/arm/virt.rst: Improve 'highmem' option docs * STM32L4x5 Implement SYSCFG and EXTI devices * hw/timer: fix systick trace message * hw/arm/virt: Consolidate valid CPU types * load_elf: fix iterator's type for elf file processing # -----BEGIN PGP SIGNATURE----- # # iQJNBAABCAA3FiEE4aXFk81BneKOgxXPPCUl7RQ2DN4FAmWpHM4ZHHBldGVyLm1h # eWRlbGxAbGluYXJvLm9yZwAKCRA8JSXtFDYM3pZxD/sGIXvTeoOCsum7OFpArKoQ # J+wcy74pO526IDzjudgtwP8kFW09oVblMPgrt/68F9LY4Oa7sDNAZX/Xqlhs/hdJ # SVbOXArRmyLvgLpn8KVii9xk9iI/olMGt0S6KcXAErdgFud+JcCevbS0D5fAF4Ua # /G/4ldnwr+WcYUA5IIoi02ymSBm5VNeH2bKu0MPS3xpizjzgOFxWTBYwq3zkZYWD # w5GjH9+F+IC67CiAlCLvuQBqpGLdRwFBttU05hLtGXuSlnvS+FtJTooI7gGD17CR # 2wTa7qF716qDN1lNSIvxA6t8/dWNMIYCZYdlxJml476WzP3jECpth2WFWqE0G3yg # Orr7sFVB8X6JmtlR34srW6e3CZA3t+4FIWqcdELFLi5IQtJeer90jqQ9xwx4SttJ # nsHdy5M8txWSa61yAaDTXMID/smVlC7sWTKJrR9kV7v5+b9OPQ/R8k0mCODl5Aer # mzAVuCvUQVYK3j7fzprGrlldla57s3v78OAhqACLgKflK0+aJSJjglulPrSMK1z5 # bRPS5jLZjFwEi2VaLVg3LPJiBMDj1s/wAl0ycfCQSv2oEzvmpkw+Ar1HDc2NFe+d # 9dunbdhAZJMwh+ABIg7iMj+l0ncOXDa4DS+6BnjRxfECCa172u3viq1HATkLLAFI # GTkcJ5hIQzNEeg9ob0MDIg== # =Rfpe # -----END PGP SIGNATURE----- # gpg: Signature made Thu 18 Jan 2024 12:42:54 GMT # gpg: using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE # gpg: issuer "peter.maydell@linaro.org" # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [ultimate] # gpg: aka "Peter Maydell <pmaydell@gmail.com>" [ultimate] # gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" [ultimate] # gpg: aka "Peter Maydell <peter@archaic.org.uk>" [ultimate] # Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83 15CF 3C25 25ED 1436 0CDE * tag 'pull-target-arm-20240118' of https://git.linaro.org/people/pmaydell/qemu-arm: load_elf: fix iterator's type for elf file processing hw/arm/virt: Consolidate valid CPU types hw/timer: fix systick trace message tests/qtest: Add STM32L4x5 SYSCFG QTest testcase hw/arm: Connect STM32L4x5 SYSCFG to STM32L4x5 SoC hw/misc: Implement STM32L4x5 SYSCFG tests/qtest: Add STM32L4x5 EXTI QTest testcase hw/arm: Connect STM32L4x5 EXTI to STM32L4x5 SoC hw/misc: Implement STM32L4x5 EXTI docs/system/arm/virt.rst: Improve 'highmem' option docs target/arm: arm_pamax() no longer needs to do feature propagation docs/devel/docs: Document .hx file syntax Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2024-01-18remove unnecessary casts from uintptr_tPaolo Bonzini
uintptr_t, or unsigned long which is equivalent on Linux I32LP64 systems, is an unsigned type and there is no need to further cast to __u64 which is another unsigned integer type; widening casts from unsigned integers zero-extend the value. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-01-18target/i386: pcrel: store low bits of physical address in data[0]Paolo Bonzini
For PC-relative translation blocks, env->eip changes during the execution of a translation block, Therefore, QEMU must be able to recover an instruction's PC just from the TranslationBlock struct and the instruction data with. Because a TB will not span two pages, QEMU stores all the low bits of EIP in the instruction data and replaces them in x86_restore_state_to_opc. Bits 12 and higher (which may vary between executions of a PCREL TB, since these only use the physical address in the hash key) are kept unmodified from env->eip. The assumption is that these bits of EIP, unlike bits 0-11, will not change as the translation block executes. Unfortunately, this is incorrect when the CS base is not aligned to a page. Then the linear address of the instructions (i.e. the one with the CS base addred) indeed will never span two pages, but bits 12+ of EIP can actually change. For example, if CS base is 0x80262200 and EIP = 0x6FF4, the first instruction in the translation block will be at linear address 0x802691F4. Even a very small TB will cross to EIP = 0x7xxx, while the linear addresses will remain comfortably within a single page. The fix is simply to use the low bits of the linear address for data[0], since those don't change. Then x86_restore_state_to_opc uses tb->cs_base to compute a temporary linear address (referring to some unknown instruction in the TB, but with the correct values of bits 12 and higher); the low bits are replaced with data[0], and EIP is obtained by subtracting again the CS base. Huge thanks to Mark Cave-Ayland for the image and initial debugging, and to Gitlab user @kjliew for help with bisecting another occurrence of (hopefully!) the same bug. It should be relatively easy to write a testcase that performs MMIO on an EIP with different bits 12+ than the first instruction of the translation block; any help is welcome. Fixes: e3a79e0e878 ("target/i386: Enable TARGET_TB_PCREL", 2022-10-11) Cc: qemu-stable@nongnu.org Cc: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Cc: Richard Henderson <richard.henderson@linaro.org> Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1759 Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1964 Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2012 Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-01-18target/i386: fix incorrect EIP in PC-relative translation blocksguoguangyao
The PCREL patches introduced a bug when updating EIP in the !CF_PCREL case. Using s->pc in func gen_update_eip_next() solves the problem. Cc: qemu-stable@nongnu.org Fixes: b5e0d5d22fbf ("target/i386: Fix 32-bit wrapping of pc/eip computation") Signed-off-by: guoguangyao <guoguangyao18@mails.ucas.ac.cn> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-ID: <20240115020804.30272-1-guoguangyao18@mails.ucas.ac.cn> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-01-18target/i386: Do not re-compute new pc with CF_PCRELRichard Henderson
With PCREL, we have a page-relative view of EIP, and an approximation of PC = EIP+CSBASE that is good enough to detect page crossings. If we try to recompute PC after masking EIP, we will mess up that approximation and write a corrupt value to EIP. We already handled masking properly for PCREL, so the fix in b5e0d5d2 was only needed for the !PCREL path. Cc: qemu-stable@nongnu.org Fixes: b5e0d5d22fbf ("target/i386: Fix 32-bit wrapping of pc/eip computation") Reported-by: Michael Tokarev <mjt@tls.msk.ru> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-ID: <20240101230617.129349-1-richard.henderson@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-01-16Merge tag 'hppa-fixes-8.2-pull-request' of ↵Peter Maydell
https://github.com/hdeller/qemu-hppa into staging target/hppa qemu v8.2 regression fixes There were some regressions introduced with Qemu v8.2 on the hppa/hppa64 target, e.g.: - 32-bit HP-UX crashes on B160L (32-bit) machine - NetBSD boot failure due to power button in page zero - NetBSD FPU detection failure - OpenBSD 7.4 boot failure This patch series fixes those known regressions and additionally: - allows usage of the max. 3840MB of memory (instead of 3GB), - adds support for the qemu --nodefaults option (to debug other devices) This patch set will not fix those known (non-regression) bugs: - HP-UX and NetBSD still fail to boot on the new 64-bit C3700 machine - Linux kernel will still fail to boot on C3700 as long as kernel modules are used. Changes v2->v3: - Added comment about Figures H-10 and H-11 in the parisc2.0 spec in patch which calculate PDC address translation if PSW.W=0 - Introduce and use hppa_set_ior_and_isr() - Use drive_get_max_bus(IF_SCSI), nd_table[] and serial_hd() to check if default devices should be created - Added Tested-by and Reviewed-by tags Changes v1->v2: - fix OpenBSD boot with SeaBIOS v15 instead of v14 - commit message enhancements suggested by BALATON Zoltan - use uint64_t for ram_max in patch #1 # -----BEGIN PGP SIGNATURE----- # # iHUEABYKAB0WIQS86RI+GtKfB8BJu973ErUQojoPXwUCZaImPQAKCRD3ErUQojoP # X2C5AP9fbIkCni45JU6KC6OmFsCbAReRQCPwLO+MzR8/us2ywgD+PsGxSBk8ASxM # nqtv3J9JC3i+XSnbtwLV+qChnO+IXwc= # =FAMY # -----END PGP SIGNATURE----- # gpg: Signature made Sat 13 Jan 2024 05:57:17 GMT # gpg: using EDDSA key BCE9123E1AD29F07C049BBDEF712B510A23A0F5F # gpg: Good signature from "Helge Deller <deller@gmx.de>" [unknown] # gpg: aka "Helge Deller <deller@kernel.org>" [unknown] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 4544 8228 2CD9 10DB EF3D 25F8 3E5F 3D04 A7A2 4603 # Subkey fingerprint: BCE9 123E 1AD2 9F07 C049 BBDE F712 B510 A23A 0F5F * tag 'hppa-fixes-8.2-pull-request' of https://github.com/hdeller/qemu-hppa: target/hppa: Update SeaBIOS-hppa to version 15 target/hppa: Fix IOR and ISR on error in probe target/hppa: Fix IOR and ISR on unaligned access trap target/hppa: Export function hppa_set_ior_and_isr() target/hppa: Avoid accessing %gr0 when raising exception hw/hppa: Move software power button address back into PDC target/hppa: Fix PDC address translation on PA2.0 with PSW.W=0 hw/pci-host/astro: Add missing astro & elroy registers for NetBSD hw/hppa/machine: Disable default devices with --nodefaults option hw/hppa/machine: Allow up to 3840 MB total memory Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2024-01-15target/arm: arm_pamax() no longer needs to do feature propagationPeter Maydell
In arm_pamax(), we need to cope with the virt board calling this function on a CPU object which has been inited but not realize. We used to do propagation of feature-flag implications (such as "V7VE implies LPAE") at realize, so we have some code in arm_pamax() which manually checks for both V7VE and LPAE feature flags. In commit b8f7959f28c4f36 we moved the feature propagation for almost all features from realize to post-init. That means that now when the virt board calls arm_pamax(), the feature propagation has been done. So we can drop the manual propagation handling and check only for the feature we actually care about, which is ARM_FEATURE_LPAE. Retain the comment that the virt board is calling this function with a not completely realized CPU object, because that is a potential beartrap for later changes which is worth calling out. (Note that b8f7959f28c4f36 actually fixed a bug in the arm_pamax() handling: arm_pamax() was missing a check for ARM_FEATURE_V8, so it incorrectly thought that the qemu-system-arm 'max' CPU did not have LPAE and turned off 'highmem' support in the virt board. Following b8f7959f28c4f36 qemu-system-arm 'max' is treated the same as 'cortex-a15' and other v7 LPAE CPUs, because the generic feature propagation code does correctly propagate V8 -> V7VE -> LPAE.) Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20240109143804.1118307-1-peter.maydell@linaro.org
2024-01-13target/hppa: Fix IOR and ISR on error in probeHelge Deller
Put correct values (depending on CPU arch) into IOR and ISR on fault. Signed-off-by: Helge Deller <deller@gmx.de> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
2024-01-13target/hppa: Fix IOR and ISR on unaligned access trapHelge Deller
Put correct values (depending on CPU arch) into IOR and ISR on fault. Signed-off-by: Helge Deller <deller@gmx.de> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
2024-01-13target/hppa: Export function hppa_set_ior_and_isr()Helge Deller
Move functionality to set IOR and ISR on fault into own function. This will be used by follow-up patches. Signed-off-by: Helge Deller <deller@gmx.de> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
2024-01-13target/hppa: Avoid accessing %gr0 when raising exceptionHelge Deller
The value of unwind_breg may reference register %r0, but we need to avoid accessing gr0 directly and use the value 0 instead. At runtime I've seen unwind_breg being zero with the Linux kernel when rfi is used to jump to smp_callin(). Signed-off-by: Helge Deller <deller@gmx.de> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Tested-by: Bruno Haible <bruno@clisp.org>
2024-01-13target/hppa: Fix PDC address translation on PA2.0 with PSW.W=0Helge Deller
Fix the address translation for PDC space on PA2.0 if PSW.W=0. Basically, for any address in the 32-bit PDC range from 0xf0000000 to 0xf1000000 keep the lower 32-bits and just set the upper 32-bits to 0xfffffff0. This mapping fixes the emulated power button in PDC space for 32- and 64-bit machines and is how the physical C3700 machine seems to map PDC. Figures H-10 and H-11 in the parisc2.0 spec [1] show that the 32-bit region will be mapped somewhere into a higher and bigger 64-bit PDC space. The start and end of this 64-bit space is defined by the physical address bits. But the figures don't specifiy where exactly the mapping will start inside that region. Tests on a real HP C3700 regarding the address of the power button indicate, that the lower 32-bits will stay the same though. [1] https://parisc.wiki.kernel.org/images-parisc/7/73/Parisc2.0.pdf Signed-off-by: Helge Deller <deller@gmx.de> Tested-by: Bruno Haible <bruno@clisp.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
generated by cgit v1.2.3 (git 2.26.2) at 2025-02-23 05:25:04 +0000