aboutsummaryrefslogtreecommitdiff
path: root/target
AgeCommit message (Collapse)Author
2021-02-16exec: Use cpu_untagged_addr in g2h; split out g2h_untaggedRichard Henderson
Use g2h_untagged in contexts that have no cpu, e.g. the binary loaders that operate before the primary cpu is created. As a colollary, target_mmap and friends must use untagged addresses, since they are used by the loaders. Use g2h_untagged on values returned from target_mmap, as the kernel never applies a tag itself. Use g2h_untagged on all pc values. The only current user of tags, aarch64, removes tags from code addresses upon branch, so "pc" is always untagged. Use g2h with the cpu context on hand wherever possible. Use g2h_untagged in lock_user, which will be updated soon. Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20210212184902.1251044-13-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-02-15target/ppc: Drop use of gdb_get_float64() and ldfq_p()Peter Maydell
We used to make a distinction between 'float64'/'float32' types and the 'uint64_t'/'uint32_t' types, requiring special conversion operations to go between them. We've now dropped this distinction as unnecessary, and the 'float*' types remain primarily for documentation purposes when used in places like the function prototypes of TCG helper functions. This means that there's no need for a special gdb_get_float64() function to write a float64 value to the GDB protocol buffer; we can just use gdb_get_reg64(). Similarly, for reading a value out of the GDB buffer into a float64 we can use ldq_p() and need not use ldfq_p(). Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Acked-by: David Gibson <david@gibson.dropbear.id.au> Message-Id: <20210208113428.7181-4-peter.maydell@linaro.org> Message-Id: <20210211122750.22645-13-alex.bennee@linaro.org>
2021-02-15target/m68k: Drop use of gdb_get_float64() and ldfq_p()Peter Maydell
We used to make a distinction between 'float64'/'float32' types and the 'uint64_t'/'uint32_t' types, requiring special conversion operations to go between them. We've now dropped this distinction as unnecessary, and the 'float*' types remain primarily for documentation purposes when used in places like the function prototypes of TCG helper functions. This means that there's no need for a special gdb_get_float64() function to write a float64 value to the GDB protocol buffer; we can just use gdb_get_reg64(). Similarly, for reading a value out of the GDB buffer into a float64 we can use ldq_p() and need not use ldfq_p(). Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Acked-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <20210208113428.7181-3-peter.maydell@linaro.org> Message-Id: <20210211122750.22645-12-alex.bennee@linaro.org>
2021-02-15target/sh4: Drop use of gdb_get_float32() and ldfl_p()Peter Maydell
We used to make a distinction between 'float64'/'float32' types and the 'uint64_t'/'uint32_t' types, requiring special conversion operations to go between them. We've now dropped this distinction as unnecessary, and the 'float*' types remain primarily for documentation purposes when used in places like the function prototypes of TCG helper functions. This means that there's no need for a special gdb_get_float32() function to write a float32 value to the GDB protocol buffer; we can just use gdb_get_reg32(). Similarly, for reading a value out of the GDB buffer into a float32 we can use ldl_p() and need not use ldfl_p(). Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20210208113428.7181-2-peter.maydell@linaro.org> Message-Id: <20210211122750.22645-11-alex.bennee@linaro.org>
2021-02-13Merge remote-tracking branch 'remotes/vivier/tags/m68k-for-6.0-pull-request' ↵Peter Maydell
into staging Pull request m68k-20210212 Move bootinfo headers to include/standard-headers/asm-m68k Add M68K_FEATURE_MSP, M68K_FEATURE_MOVEC, M68K_FEATURE_M68010 Add 68060 CR BUSCR and PCR (unimplemented) CPU types and features cleanup # gpg: Signature made Fri 12 Feb 2021 21:14:28 GMT # gpg: using RSA key CD2F75DDC8E3A4DC2E4F5173F30C38BD3F2FBE3C # gpg: issuer "laurent@vivier.eu" # gpg: Good signature from "Laurent Vivier <lvivier@redhat.com>" [full] # gpg: aka "Laurent Vivier <laurent@vivier.eu>" [full] # gpg: aka "Laurent Vivier (Red Hat) <lvivier@redhat.com>" [full] # Primary key fingerprint: CD2F 75DD C8E3 A4DC 2E4F 5173 F30C 38BD 3F2F BE3C * remotes/vivier/tags/m68k-for-6.0-pull-request: m68k: import bootinfo headers from linux m68k: add MSP detection support for stack pointer swap helpers m68k: MOVEC insn. should generate exception if wrong CR is accessed m68k: add missing BUSCR/PCR CR defines, and BUSCR/PCR/CAAR CR to m68k_move_to/from m68k: improve comments on m68k_move_to/from helpers m68k: cascade m68k_features by m680xx_cpu_initfn() to improve readability m68k: improve cpu instantiation comments Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-02-11m68k: add MSP detection support for stack pointer swap helpersLucien Murray-Pitts
On m68k there are two varities of stack pointers: USP with SSP or ISP/MSP. Only the 68020/30/40 support the MSP register the stack swap helpers don't support this feature. This patch adds this support, as well as comments to CPUM68KState to make it clear how stacks are handled Signed-off-by: Lucien Murray-Pitts <lucienmp.qemu@gmail.com> Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Message-Id: <c61ad2d8b39f3b03b431819b6bf602a1c332b921.1612137712.git.balaton@eik.bme.hu> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2021-02-11m68k: MOVEC insn. should generate exception if wrong CR is accessedLucien Murray-Pitts
Add CPU class detection for each CR type in the m68k_move_to/from helpers, so that it throws and exception if an unsupported register is requested for that CPU class. Reclassified MOVEC insn. as only supported from 68010. Signed-off-by: Lucien Murray-Pitts <lucienmp.qemu@gmail.com> Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Message-Id: <fc0d0187478716f05d990949347071969b743151.1612137712.git.balaton@eik.bme.hu> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2021-02-11m68k: add missing BUSCR/PCR CR defines, and BUSCR/PCR/CAAR CR to ↵Lucien Murray-Pitts
m68k_move_to/from The BUSCR/PCR CR defines were missing for 68060, and the move_to/from helper functions were also missing a decode for the 68060 M68K_CR_CAAR CR register. Added missing defines, and respective decodes for all three CR registers to the helpers. Although this patch defines them, the implementation is empty in this patch and these registers will result in a cpu abort - which is the default prior to this patch. This patch aims to reach full coverage of all CR registers within the helpers. Signed-off-by: Lucien Murray-Pitts <lucienmp.qemu@gmail.com> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <19e5c0fa8baed6479ed0502fd3deb132d19457fb.1612137712.git.balaton@eik.bme.hu> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2021-02-11m68k: improve comments on m68k_move_to/from helpersLucien Murray-Pitts
Add more detailed comments to each case of m68k_move_to/from helpers to list the supported CPUs for that CR as they were wrong in some cases, and missing some cpu classes in other cases. Signed-off-by: Lucien Murray-Pitts <lucienmp.qemu@gmail.com> Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Message-Id: <a8bd70b66e3dbdb7d2ab7a852af71cdbf341d50c.1612137712.git.balaton@eik.bme.hu> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2021-02-11m68k: cascade m68k_features by m680xx_cpu_initfn() to improve readabilityLucien Murray-Pitts
The m680XX_cpu_initfn functions have been rearranged to cascade starting from the base 68000, so that the 68010 then inherits from this, and so on until the 68060. This makes it simpler to track features since in most cases the m68k were product enhancements on each other, with only a few instructions being retired. Because each cpu class inherits the previous CPU class, then for example the 68020 also has the feature 68010, and 68000 and so on upto the 68060. - Added 68010 cpu class, and moved correct features into 68000/68010. - Added m68k_unset_feature to allow removing a feature in the inheritence Signed-off-by: Lucien Murray-Pitts <lucienmp.qemu@gmail.com> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Message-Id: <c652fe7537f8b4fe87a13ecbbc0ea751fb71532f.1612137712.git.balaton@eik.bme.hu> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2021-02-11m68k: improve cpu instantiation commentsLucien Murray-Pitts
Improvement in comments for the instantiation functions. This is to highlight what each cpu class, in the 68000 series, contains in terms of instructions/features. Signed-off-by: Lucien Murray-Pitts <lucienmp.qemu@gmail.com> Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Message-Id: <2dfe32672ee6ddce4b54c6bcfce579d35abeaf51.1612137712.git.balaton@eik.bme.hu> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2021-02-11target/arm: Correctly initialize MDCR_EL2.HPMNDaniel Müller
When working with performance monitoring counters, we look at MDCR_EL2.HPMN as part of the check whether a counter is enabled. This check fails, because MDCR_EL2.HPMN is reset to 0, meaning that no counters are "enabled" for < EL2. That's in violation of the Arm specification, which states that > On a Warm reset, this field [MDCR_EL2.HPMN] resets to the value in > PMCR_EL0.N That's also what a comment in the code acknowledges, but the necessary adjustment seems to have been forgotten when support for more counters was added. This change fixes the issue by setting the reset value to PMCR.N, which is four. Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-02-11target/arm: Set ID_PFR0.DIT to 1 for "max" 32-bit CPURebecca Cran
Enable FEAT_DIT for the "max" 32-bit CPU. Signed-off-by: Rebecca Cran <rebecca@nuviainc.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20210208065700.19454-5-rebecca@nuviainc.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-02-11target/arm: Set ID_AA64PFR0.DIT and ID_PFR0.DIT to 1 for "max" AA64 CPURebecca Cran
Enable FEAT_DIT for the "max" AARCH64 CPU. Signed-off-by: Rebecca Cran <rebecca@nuviainc.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20210208065700.19454-4-rebecca@nuviainc.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-02-11target/arm: Support AA32 DIT by moving PSTATE_SS from cpsr into env->pstateRebecca Cran
cpsr has been treated as being the same as spsr, but it isn't. Since PSTATE_SS isn't in cpsr, remove it and move it into env->pstate. This allows us to add support for CPSR_DIT, adding helper functions to merge SPSR_ELx to and from CPSR. Signed-off-by: Rebecca Cran <rebecca@nuviainc.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20210208065700.19454-3-rebecca@nuviainc.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-02-11target/arm: Add support for FEAT_DIT, Data Independent TimingRebecca Cran
Add support for FEAT_DIT. DIT (Data Independent Timing) is a required feature for ARMv8.4. Since virtual machine execution is largely nondeterministic and TCG is outside of the security domain, it's implemented as a NOP. Signed-off-by: Rebecca Cran <rebecca@nuviainc.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20210208065700.19454-2-rebecca@nuviainc.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-02-11target/arm: Fix SCR RES1 handlingMike Nawrocki
The FW and AW bits of SCR_EL3 are RES1 only in some contexts. Force them to 1 only when there is no support for AArch32 at EL1 or above. The reset value will be 0x30 only if the CPU is AArch64-only; if there is support for AArch32 at EL1 or above, it will be reset to 0. Also adds helper function isar_feature_aa64_aa32_el1 to check if AArch32 is supported at EL1 or above. Signed-off-by: Mike Nawrocki <michael.nawrocki@gtri.gatech.edu> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20210203165552.16306-2-michael.nawrocki@gtri.gatech.edu Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-02-11target/arm: Don't migrate CPUARMState.featuresAaron Lindsay
As feature flags are added or removed, the meanings of bits in the `features` field can change between QEMU versions, causing migration failures. Additionally, migrating the field is not useful because it is a constant function of the CPU being used. Fixes: LP:1914696 Signed-off-by: Aaron Lindsay <aaron@os.amperecomputing.com> Suggested-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Andrew Jones <drjones@redhat.com> Tested-by: Andrew Jones <drjones@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-02-10target/ppc: Add E500 L2CSR0 write helperBin Meng
Per EREF 2.0 [1] chapter 3.11.2: The following bits in L2CSR0 (exists in the e500mc/e5500/e6500 core): - L2FI (L2 cache flash invalidate) - L2FL (L2 cache flush) - L2LFC (L2 cache lock flash clear) when set, a cache operation is initiated by hardware, and these bits will be cleared when the operation is complete. Since we don't model cache in QEMU, let's add a write helper to emulate the cache operations completing instantly. [1] https://www.nxp.com/files-static/32bit/doc/ref_manual/EREFRM.pdf Signed-off-by: Bin Meng <bin.meng@windriver.com> Message-Id: <1612925152-20913-1-git-send-email-bmeng.cn@gmail.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2021-02-10target/ppc: Remove unused MMU definitionsPhilippe Mathieu-Daudé
Remove these confusing and unused definitions. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20210127232401.3525126-1-f4bug@amsat.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2021-02-08target/i386: Expose VMX entry/exit load pkrs control bitsChenyi Qiang
Expose the VMX exit/entry load pkrs control bits in VMX_TRUE_EXIT_CTLS/VMX_TRUE_ENTRY_CTLS MSRs to guest, which supports the PKS in nested VM. Signed-off-by: Chenyi Qiang <chenyi.qiang@intel.com> Message-Id: <20210205083325.13880-3-chenyi.qiang@intel.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-02-08target/i386: Add support for save/load IA32_PKRS MSRChenyi Qiang
PKS introduces MSR IA32_PKRS(0x6e1) to manage the supervisor protection key rights. Page access and writes can be managed via the MSR update without TLB flushes when permissions change. Add the support to save/load IA32_PKRS MSR in guest. Signed-off-by: Chenyi Qiang <chenyi.qiang@intel.com> Message-Id: <20210205083325.13880-2-chenyi.qiang@intel.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-02-08target/i86: implement PKSPaolo Bonzini
Protection Keys for Supervisor-mode pages is a simple extension of the PKU feature that QEMU already implements. For supervisor-mode pages, protection key restrictions come from a new MSR. The MSR has no XSAVE state associated to it. PKS is only respected in long mode. However, in principle it is possible to set the MSR even outside long mode, and in fact even the XSAVE state for PKRU could be set outside long mode using XRSTOR. So do not limit the migration subsections for PKRU and PKRS to long mode. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-02-08target/i386: Fix decoding of certain BMI instructionsDavid Greenaway
This patch fixes a translation bug for a subset of x86 BMI instructions such as the following: c4 e2 f9 f7 c0 shlxq %rax, %rax, %rax Currently, these incorrectly generate an undefined instruction exception when SSE is disabled via CR4, while instructions like "shrxq" work fine. The problem appears to be related to BMI instructions encoded using VEX and with a mandatory prefix of "0x66" (data). Instructions with this data prefix (such as shlxq) are currently rejected. Instructions with other mandatory prefixes (such as shrxq) translate as expected. This patch removes the incorrect check in "gen_sse" that causes the exception to be generated. For the non-BMI cases, the check is redundant: prefixes are already checked at line 3696. Buglink: https://bugs.launchpad.net/qemu/+bug/1748296 Signed-off-by: David Greenaway <dgreenaway@google.com> Message-Id: <20210114063958.1508050-1-dgreenaway@google.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-02-08x86/cpu: Populate SVM CPUID feature bitsWei Huang
Newer AMD CPUs will add CPUID_0x8000000A_EDX[28] bit, which indicates that SVM instructions (VMRUN/VMSAVE/VMLOAD) will trigger #VMEXIT before CPU checking their EAX against reserved memory regions. This change will allow the hypervisor to avoid intercepting #GP and emulating SVM instructions. KVM turns on this CPUID bit for nested VMs. In order to support it, let us populate this bit, along with other SVM feature bits, in FEAT_SVM. Signed-off-by: Wei Huang <wei.huang2@amd.com> Message-Id: <20210126202456.589932-1-wei.huang2@amd.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-02-08target/i386: do not set LM for 32-bit emulation "-cpu host/max"Paolo Bonzini
32-bit targets by definition do not support long mode; therefore, the bit must be masked in the features supported by the accelerator. As a side effect, this avoids setting up the 0x80000008 CPUID leaf for qemu-system-i386 -cpu host which since commit 5a140b255d ("x86/cpu: Use max host physical address if -cpu max option is applied") would have printed this error: qemu-system-i386: phys-bits should be between 32 and 36 (but is 48) Reported-by: Nathan Chancellor <natechancellor@gmail.com> Tested-by: Nathan Chancellor <natechancellor@gmail.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-02-08spapr: Add PEF based confidential guest supportDavid Gibson
Some upcoming POWER machines have a system called PEF (Protected Execution Facility) which uses a small ultravisor to allow guests to run in a way that they can't be eavesdropped by the hypervisor. The effect is roughly similar to AMD SEV, although the mechanisms are quite different. Most of the work of this is done between the guest, KVM and the ultravisor, with little need for involvement by qemu. However qemu does need to tell KVM to allow secure VMs. Because the availability of secure mode is a guest visible difference which depends on having the right hardware and firmware, we don't enable this by default. In order to run a secure guest you need to create a "pef-guest" object and set the confidential-guest-support property to point to it. Note that this just *allows* secure guests, the architecture of PEF is such that the guest still needs to talk to the ultravisor to enter secure mode. Qemu has no direct way of knowing if the guest is in secure mode, and certainly can't know until well after machine creation time. To start a PEF-capable guest, use the command line options: -object pef-guest,id=pef0 -machine confidential-guest-support=pef0 Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Reviewed-by: Greg Kurz <groug@kaod.org>
2021-02-08confidential guest support: Move SEV initialization into arch specific codeDavid Gibson
While we've abstracted some (potential) differences between mechanisms for securing guest memory, the initialization is still specific to SEV. Given that, move it into x86's kvm_arch_init() code, rather than the generic kvm_init() code. Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Reviewed-by: Cornelia Huck <cohuck@redhat.com> Reviewed-by: Greg Kurz <groug@kaod.org>
2021-02-08confidential guest support: Introduce cgs "ready" flagDavid Gibson
The platform specific details of mechanisms for implementing confidential guest support may require setup at various points during initialization. Thus, it's not really feasible to have a single cgs initialization hook, but instead each mechanism needs its own initialization calls in arch or machine specific code. However, to make it harder to have a bug where a mechanism isn't properly initialized under some circumstances, we want to have a common place, late in boot, where we verify that cgs has been initialized if it was requested. This patch introduces a ready flag to the ConfidentialGuestSupport base type to accomplish this, which we verify in qemu_machine_creation_done(). Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: Greg Kurz <groug@kaod.org>
2021-02-08sev: Add Error ** to sev_kvm_init()David Gibson
This allows failures to be reported richly and idiomatically. Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Cornelia Huck <cohuck@redhat.com>
2021-02-08confidential guest support: Rework the "memory-encryption" propertyDavid Gibson
Currently the "memory-encryption" property is only looked at once we get to kvm_init(). Although protection of guest memory from the hypervisor isn't something that could really ever work with TCG, it's not conceptually tied to the KVM accelerator. In addition, the way the string property is resolved to an object is almost identical to how a QOM link property is handled. So, create a new "confidential-guest-support" link property which sets this QOM interface link directly in the machine. For compatibility we keep the "memory-encryption" property, but now implemented in terms of the new property. Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Reviewed-by: Greg Kurz <groug@kaod.org> Reviewed-by: Cornelia Huck <cohuck@redhat.com>
2021-02-08sev: Remove false abstraction of flash encryptionDavid Gibson
When AMD's SEV memory encryption is in use, flash memory banks (which are initialed by pc_system_flash_map()) need to be encrypted with the guest's key, so that the guest can read them. That's abstracted via the kvm_memcrypt_encrypt_data() callback in the KVM state.. except, that it doesn't really abstract much at all. For starters, the only call site is in code specific to the 'pc' family of machine types, so it's obviously specific to those and to x86 to begin with. But it makes a bunch of further assumptions that need not be true about an arbitrary confidential guest system based on memory encryption, let alone one based on other mechanisms: * it assumes that the flash memory is defined to be encrypted with the guest key, rather than being shared with hypervisor * it assumes that that hypervisor has some mechanism to encrypt data into the guest, even though it can't decrypt it out, since that's the whole point * the interface assumes that this encrypt can be done in place, which implies that the hypervisor can write into a confidential guests's memory, even if what it writes isn't meaningful So really, this "abstraction" is actually pretty specific to the way SEV works. So, this patch removes it and instead has the PC flash initialization code call into a SEV specific callback. Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Reviewed-by: Cornelia Huck <cohuck@redhat.com>
2021-02-08confidential guest support: Introduce new confidential guest support classDavid Gibson
Several architectures have mechanisms which are designed to protect guest memory from interference or eavesdropping by a compromised hypervisor. AMD SEV does this with in-chip memory encryption and Intel's TDX can do similar things. POWER's Protected Execution Framework (PEF) accomplishes a similar goal using an ultravisor and new memory protection features, instead of encryption. To (partially) unify handling for these, this introduces a new ConfidentialGuestSupport QOM base class. "Confidential" is kind of vague, but "confidential computing" seems to be the buzzword about these schemes, and "secure" or "protected" are often used in connection to unrelated things (such as hypervisor-from-guest or guest-from-guest security). The "support" in the name is significant because in at least some of the cases it requires the guest to take specific actions in order to protect itself from hypervisor eavesdropping. Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2021-02-05accel: replace struct CpusAccel with AccelOpsClassClaudio Fontana
This will allow us to centralize the registration of the cpus.c module accelerator operations (in accel/accel-softmmu.c), and trigger it automatically using object hierarchy lookup from the new accel_init_interfaces() initialization step, depending just on which accelerators are available in the code. Rename all tcg-cpus.c, kvm-cpus.c, etc to tcg-accel-ops.c, kvm-accel-ops.c, etc, matching the object type names. Signed-off-by: Claudio Fontana <cfontana@suse.de> Message-Id: <20210204163931.7358-18-cfontana@suse.de> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2021-02-05accel: extend AccelState and AccelClass to user-modeClaudio Fontana
Signed-off-by: Claudio Fontana <cfontana@suse.de> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> [claudio: rebased on Richard's splitwx work] Signed-off-by: Claudio Fontana <cfontana@suse.de> Message-Id: <20210204163931.7358-17-cfontana@suse.de> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2021-02-05cpu: tcg_ops: move to tcg-cpu-ops.h, keep a pointer in CPUClassClaudio Fontana
we cannot in principle make the TCG Operations field definitions conditional on CONFIG_TCG in code that is included by both common_ss and specific_ss modules. Therefore, what we can do safely to restrict the TCG fields to TCG-only builds, is to move all tcg cpu operations into a separate header file, which is only included by TCG, target-specific code. This leaves just a NULL pointer in the cpu.h for the non-TCG builds. This also tidies up the code in all targets a bit, having all TCG cpu operations neatly contained by a dedicated data struct. Signed-off-by: Claudio Fontana <cfontana@suse.de> Message-Id: <20210204163931.7358-16-cfontana@suse.de> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2021-02-05cpu: move debug_check_watchpoint to tcg_opsClaudio Fontana
commit 568496c0c0f1 ("cpu: Add callback to check architectural") and commit 3826121d9298 ("target-arm: Implement checking of fired") introduced an ARM-specific hack for cpu_check_watchpoint. Make debug_check_watchpoint optional, and move it to tcg_ops. Signed-off-by: Claudio Fontana <cfontana@suse.de> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20210204163931.7358-15-cfontana@suse.de> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2021-02-05cpu: move adjust_watchpoint_address to tcg_opsClaudio Fontana
commit 40612000599e ("arm: Correctly handle watchpoints for BE32 CPUs") introduced this ARM-specific, TCG-specific hack to adjust the address, before checking it with cpu_check_watchpoint. Make adjust_watchpoint_address optional and move it to tcg_ops. Signed-off-by: Claudio Fontana <cfontana@suse.de> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20210204163931.7358-14-cfontana@suse.de> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2021-02-05cpu: move do_unaligned_access to tcg_opsClaudio Fontana
make it consistently SOFTMMU-only. Signed-off-by: Claudio Fontana <cfontana@suse.de> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> [claudio: make the field presence in cpu.h unconditional, removing the ifdefs] Message-Id: <20210204163931.7358-12-cfontana@suse.de> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2021-02-05cpu: move cc->transaction_failed to tcg_opsClaudio Fontana
Signed-off-by: Claudio Fontana <cfontana@suse.de> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> [claudio: wrap target code around CONFIG_TCG and !CONFIG_USER_ONLY] avoiding its use in headers used by common_ss code (should be poisoned). Note: need to be careful with the use of CONFIG_USER_ONLY, Message-Id: <20210204163931.7358-11-cfontana@suse.de> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2021-02-05cpu: move cc->do_interrupt to tcg_opsClaudio Fontana
Signed-off-by: Claudio Fontana <cfontana@suse.de> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20210204163931.7358-10-cfontana@suse.de> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2021-02-05target/arm: do not use cc->do_interrupt for KVM directlyClaudio Fontana
cc->do_interrupt is in theory a TCG callback used in accel/tcg only, to prepare the emulated architecture to take an interrupt as defined in the hardware specifications, but in reality the _do_interrupt style of functions in targets are also occasionally reused by KVM to prepare the architecture state in a similar way where userspace code has identified that it needs to deliver an exception to the guest. In the case of ARM, that includes: 1) the vcpu thread got a SIGBUS indicating a memory error, and we need to deliver a Synchronous External Abort to the guest to let it know about the error. 2) the kernel told us about a debug exception (breakpoint, watchpoint) but it is not for one of QEMU's own gdbstub breakpoints/watchpoints so it must be a breakpoint the guest itself has set up, therefore we need to deliver it to the guest. So in order to reuse code, the same arm_do_interrupt function is used. This is all fine, but we need to avoid calling it using the callback registered in CPUClass, since that one is now TCG-only. Fortunately this is easily solved by replacing calls to CPUClass::do_interrupt() with explicit calls to arm_do_interrupt(). Signed-off-by: Claudio Fontana <cfontana@suse.de> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Cc: Peter Maydell <peter.maydell@linaro.org> Message-Id: <20210204163931.7358-9-cfontana@suse.de> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2021-02-05cpu: Move debug_excp_handler to tcg_opsEduardo Habkost
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Claudio Fontana <cfontana@suse.de> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20210204163931.7358-8-cfontana@suse.de> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2021-02-05cpu: Move tlb_fill to tcg_opsEduardo Habkost
[claudio: wrapped target code in CONFIG_TCG] Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Claudio Fontana <cfontana@suse.de> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20210204163931.7358-7-cfontana@suse.de> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2021-02-05cpu: Move cpu_exec_* to tcg_opsEduardo Habkost
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> [claudio: wrapped target code in CONFIG_TCG] Signed-off-by: Claudio Fontana <cfontana@suse.de> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20210204163931.7358-6-cfontana@suse.de> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2021-02-05cpu: Move synchronize_from_tb() to tcg_opsEduardo Habkost
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> [claudio: wrapped target code in CONFIG_TCG, reworded comments] Signed-off-by: Claudio Fontana <cfontana@suse.de> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20210204163931.7358-5-cfontana@suse.de> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2021-02-05target/riscv: remove CONFIG_TCG, as it is always TCGClaudio Fontana
for now only TCG is allowed as an accelerator for riscv, so remove the CONFIG_TCG use. Signed-off-by: Claudio Fontana <cfontana@suse.de> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20210204163931.7358-3-cfontana@suse.de> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2021-02-05cpu: Introduce TCGCpuOperations structEduardo Habkost
The TCG-specific CPU methods will be moved to a separate struct, to make it easier to move accel-specific code outside generic CPU code in the future. Start by moving tcg_initialize(). The new CPUClass.tcg_opts field may eventually become a pointer, but keep it an embedded struct for now, to make code conversion easier. Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> [claudio: move TCGCpuOperations inside include/hw/core/cpu.h] Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20210204163931.7358-2-cfontana@suse.de> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2021-01-29Merge remote-tracking branch ↵Peter Maydell
'remotes/pmaydell/tags/pull-target-arm-20210129-1' into staging target-arm queue: * Implement ID_PFR2 * Conditionalize DBGDIDR * rename xlnx-zcu102.canbusN properties * provide powerdown/reset mechanism for secure firmware on 'virt' board * hw/misc: Fix arith overflow in NPCM7XX PWM module * target/arm: Replace magic value by MMU_DATA_LOAD definition * configure: fix preadv errors on Catalina macOS with new XCode * Various configure and other cleanups in preparation for iOS support * hvf: Add hypervisor entitlement to output binaries (needed for Big Sur) * Implement pvpanic-pci device * Convert the CMSDK timer devices to the Clock framework # gpg: Signature made Fri 29 Jan 2021 16:08:02 GMT # gpg: using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE # gpg: issuer "peter.maydell@linaro.org" # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [ultimate] # gpg: aka "Peter Maydell <pmaydell@gmail.com>" [ultimate] # gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" [ultimate] # Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83 15CF 3C25 25ED 1436 0CDE * remotes/pmaydell/tags/pull-target-arm-20210129-1: (46 commits) hw/arm/stellaris: Remove board-creation reset of STELLARIS_SYS arm: Remove frq properties on CMSDK timer, dualtimer, watchdog, ARMSSE arm: Don't set freq properties on CMSDK timer, dualtimer, watchdog, ARMSSE hw/arm/armsse: Use Clock to set system_clock_scale tests/qtest/cmsdk-apb-watchdog-test: Test clock changes hw/watchdog/cmsdk-apb-watchdog: Convert to use Clock input hw/timer/cmsdk-apb-dualtimer: Convert to use Clock input hw/timer/cmsdk-apb-timer: Convert to use Clock input hw/arm/stellaris: Create Clock input for watchdog hw/arm/stellaris: Convert SSYS to QOM device hw/arm/musca: Create and connect ARMSSE Clocks hw/arm/mps2-tz: Create and connect ARMSSE Clocks hw/arm/mps2: Create and connect SYSCLK Clock hw/arm/mps2: Inline CMSDK_APB_TIMER creation hw/arm/armsse: Wire up clocks hw/arm/armsse: Rename "MAINCLK" property to "MAINCLK_FRQ" hw/watchdog/cmsdk-apb-watchdog: Add Clock input hw/timer/cmsdk-apb-dualtimer: Add Clock input hw/timer/cmsdk-apb-timer: Add Clock input hw/timer/cmsdk-apb-timer: Rename CMSDKAPBTIMER struct to CMSDKAPBTimer ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-01-29target/arm: Replace magic value by MMU_DATA_LOAD definitionPhilippe Mathieu-Daudé
cpu_get_phys_page_debug() uses 'DATA LOAD' MMU access type. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20210127232822.3530782-1-f4bug@amsat.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
generated by cgit v1.2.3 (git 2.26.2) at 2024-12-03 22:50:17 +0000