aboutsummaryrefslogtreecommitdiff
path: root/target
AgeCommit message (Collapse)Author
2023-05-18target/i386: fix avx2 instructions vzeroall and vpermdqXinyu Li
vzeroall: xmm_regs should be used instead of xmm_t0 vpermdq: bit 3 and 7 of imm should be considered Signed-off-by: Xinyu Li <lixinyu20s@ict.ac.cn> Message-Id: <20230510145222.586487-1-lixinyu20s@ict.ac.cn> Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 056d649007bc9fdae9f1d576e77c1316e9a34468) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2023-05-18target/i386: fix operand size for VCOMI/VUCOMI instructionsPaolo Bonzini
Compared to other SSE instructions, VUCOMISx and VCOMISx are different: the single and double precision versions are distinguished through a prefix, however they use no-prefix and 0x66 for SS and SD respectively. Scalar values usually are associated with 0xF2 and 0xF3. Because of these, they incorrectly perform a 128-bit memory load instead of a 32- or 64-bit load. Fix this by writing a custom decoding function. I tested that the reproducer is fixed and the test-avx output does not change. Reported-by: Gabriele Svelto <gsvelto@mozilla.com> Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1637 Fixes: f8d19eec0d53 ("target/i386: reimplement 0x0f 0x28-0x2f, add AVX", 2022-10-18) Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 2b55e479e6fcbb466585fd25077a50c32e10dc3a) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2023-05-18target/arm: Fix vd == vm overlap in sve_ldff1_zRichard Henderson
If vd == vm, copy vm to scratch, so that we can pre-zero the output and still access the gather indicies. Cc: qemu-stable@nongnu.org Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1612 Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20230504104232.1877774-1-richard.henderson@linaro.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> (cherry picked from commit a6771f2f5cbfbf312e2fb5b1627f38a6bf6321d0) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2023-05-17s390x/tcg: Fix LDER instruction formatIlya Leoshkevich
It's RRE, not RXE. Found by running valgrind's none/tests/s390x/bfp-2. Fixes: 86b59624c4aa ("s390x/tcg: Implement LOAD LENGTHENED short HFP to long HFP") Reviewed-by: David Hildenbrand <david@redhat.com> Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com> Message-Id: <20230511134726.469651-1-iii@linux.ibm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Thomas Huth <thuth@redhat.com> (cherry picked from commit 970641de01908dd09b569965e78f13842e5854bc) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2023-05-16target/s390x: Fix EXECUTE of relative branchesIlya Leoshkevich
Fix a problem similar to the one fixed by commit 703d03a4aaf3 ("target/s390x: Fix EXECUTE of relative long instructions"), but now for relative branches. Reported-by: Nina Schoetterl-Glausch <nsg@linux.ibm.com> Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20230426235813.198183-2-iii@linux.ibm.com> Signed-off-by: Thomas Huth <thuth@redhat.com> (cherry picked from commit e8ecdfeb30f087574191cde523e846e023911c8d) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2023-05-15tcg: ppc64: Fix mask generation for vextractdmShivaprasad G Bhat
In function do_extractm() the mask is calculated as dup_const(1 << (element_width - 1)). '1' being signed int works fine for MO_8,16,32. For MO_64, on PPC64 host this ends up becoming 0 on compilation. The vextractdm uses MO_64, and it ends up having mask as 0. Explicitly use 1ULL instead of signed int 1 like its used everywhere else. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1536 Signed-off-by: Shivaprasad G Bhat <sbhat@linux.ibm.com> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Lucas Mateus Castro <lucas.araujo@eldorado.org.br> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Cédric Le Goater <clg@redhat.com> Message-Id: <168319292809.1159309.5817546227121323288.stgit@ltc-boston1.aus.stglabs.ibm.com> Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com> (cherry picked from commit 6a5d81b17201ab8a95539bad94c8a6c08a42e076) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2023-05-14target/arm: Correct AArch64.S2MinTxSZ 32-bit EL1 input size checkPeter Maydell
In check_s2_mmu_setup() we have a check that is attempting to implement the part of AArch64.S2MinTxSZ that is specific to when EL1 is AArch32: if !s1aarch64 then // EL1 is AArch32 min_txsz = Min(min_txsz, 24); Unfortunately we got this wrong in two ways: (1) The minimum txsz corresponds to a maximum inputsize, but we got the sense of the comparison wrong and were faulting for all inputsizes less than 40 bits (2) We try to implement this as an extra check that happens after we've done the same txsz checks we would do for an AArch64 EL1, but in fact the pseudocode is *loosening* the requirements, so that txsz values that would fault for an AArch64 EL1 do not fault for AArch32 EL1, because it does Min(old_min, 24), not Max(old_min, 24). You can see this also in the text of the Arm ARM in table D8-8, which shows that where the implemented PA size is less than 40 bits an AArch32 EL1 is still OK with a configured stage2 T0SZ for a 40 bit IPA, whereas if EL1 is AArch64 then the T0SZ must be big enough to constrain the IPA to the implemented PA size. Because of part (2), we can't do this as a separate check, but have to integrate it into aa64_va_parameters(). Add a new argument to that function to indicate that EL1 is 32-bit. All the existing callsites except the one in get_phys_addr_lpae() can pass 'false', because they are either doing a lookup for a stage 1 regime or else they don't care about the tsz/tsz_oob fields. Cc: qemu-stable@nongnu.org Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1627 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20230509092059.3176487-1-peter.maydell@linaro.org (cherry picked from commit 478dccbb99db0bf8f00537dd0b4d0de88d5cb537) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2023-05-14target/arm: Fix handling of SW and NSW bits for stage 2 walksPeter Maydell
We currently don't correctly handle the VSTCR_EL2.SW and VTCR_EL2.NSW configuration bits. These allow configuration of whether the stage 2 page table walks for Secure IPA and NonSecure IPA should do their descriptor reads from Secure or NonSecure physical addresses. (This is separate from how the translation table base address and other parameters are set: an NS IPA always uses VTTBR_EL2 and VTCR_EL2 for its base address and walk parameters, regardless of the NSW bit, and similarly for Secure.) Provide a new function ptw_idx_for_stage_2() which returns the MMU index to use for descriptor reads, and use it to set up the .in_ptw_idx wherever we call get_phys_addr_lpae(). For a stage 2 walk, wherever we call get_phys_addr_lpae(): * .in_ptw_idx should be ptw_idx_for_stage_2() of the .in_mmu_idx * .in_secure should be true if .in_mmu_idx is Stage2_S This allows us to correct S1_ptw_translate() so that it consistently always sets its (out_secure, out_phys) to the result it gets from the S2 walk (either by calling get_phys_addr_lpae() or by TLB lookup). This makes better conceptual sense because the S2 walk should return us an (address space, address) tuple, not an address that we then randomly assign to S or NS. Our previous handling of SW and NSW was broken, so guest code trying to use these bits to put the s2 page tables in the "other" address space wouldn't work correctly. Cc: qemu-stable@nongnu.org Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1600 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20230504135425.2748672-3-peter.maydell@linaro.org (cherry picked from commit fcc0b0418fff655f20fd0cf86a1bbdc41fd2e7c6) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2023-05-10target/riscv: Restore the predicate() NULL check behaviorBin Meng
When reading a non-existent CSR QEMU should raise illegal instruction exception, but currently it just exits due to the g_assert() check. This actually reverts commit 0ee342256af9205e7388efdf193a6d8f1ba1a617. Some comments are also added to indicate that predicate() must be provided for an implemented CSR. Reported-by: Fei Wu <fei2.wu@intel.com> Signed-off-by: Bin Meng <bmeng@tinylab.org> Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com> Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com> Message-Id: <20230417043054.3125614-1-bmeng@tinylab.org> Signed-off-by: Alistair Francis <alistair.francis@wdc.com> (cherry picked from commit eae04c4c131a8d95087c8568eb2cac1988262f25) (mjt: context edit after ce3af0bbbcdfa "target/riscv: add support for Zcmt extension") Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2023-05-10target/riscv: Fix itrigger when icount is usedLIU Zhiwei
When I boot a ubuntu image, QEMU output a "Bad icount read" message and exit. The reason is that when execute helper_mret or helper_sret, it will cause a call to icount_get_raw_locked (), which needs set can_do_io flag on cpustate. Thus we setting this flag when execute these two instructions. Signed-off-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com> Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn> Acked-by: Alistair Francis <alistair.francis@wdc.com> Message-Id: <20230324064011.976-1-zhiwei_liu@linux.alibaba.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com> (cherry picked from commit df3ac6da476e346a17bad5bc843de1135a269229) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2023-05-10target/arm: Define and use new load_cpu_field_low32()Peter Maydell
In several places in the 32-bit Arm translate.c, we try to use load_cpu_field() to load from a CPUARMState field into a TCGv_i32 where the field is actually 64-bit. This works on little-endian hosts, but gives the wrong half of the register on big-endian. Add a new load_cpu_field_low32() which loads the low 32 bits of a 64-bit field into a TCGv_i32. The new macro includes a compile-time check against accidentally using it on a field of the wrong size. Use it to fix the two places in the code where we were using load_cpu_field() on a 64-bit field. This fixes a bug where on big-endian hosts the guest would crash after executing an ERET instruction, and a more corner case one where some UNDEFs for attempted accesses to MSR banked registers from Secure EL1 might go to the wrong EL. Cc: qemu-stable@nongnu.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20230424153909.1419369-2-peter.maydell@linaro.org (cherry picked from commit 7f3a3d3dc433dc06c0adb480729af80f9c8e3739) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2023-05-10target/arm: Initialize debug capabilities only onceAkihiko Odaki
kvm_arm_init_debug() used to be called several times on a SMP system as kvm_arch_init_vcpu() calls it. Move the call to kvm_arch_init() to make sure it will be called only once; otherwise it will overwrite pointers to memory allocated with the previous call and leak it. Fixes: e4482ab7e3 ("target-arm: kvm - add support for HW assisted debug") Suggested-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Message-id: 20230405153644.25300-1-akihiko.odaki@daynix.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> (cherry picked from commit ad5c6ddea327758daa9f0e6edd916be39dce7dca) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2023-04-27target/i386: Change wrong XFRM value in SGX CPUID leafYang Zhong
The previous patch wrongly replaced FEAT_XSAVE_XCR0_{LO|HI} with FEAT_XSAVE_XSS_{LO|HI} in CPUID(EAX=12,ECX=1):{ECX,EDX}. As a result, SGX enclaves only supported SSE and x87 feature (xfrm=0x3). Fixes: 301e90675c3f ("target/i386: Enable support for XSAVES based features") Signed-off-by: Yang Zhong <yang.zhong@linux.intel.com> Reviewed-by: Yang Weijiang <weijiang.yang@intel.com> Reviewed-by: Kai Huang <kai.huang@intel.com> Message-Id: <20230406064041.420039-1-yang.zhong@linux.intel.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 72497cff896fecf74306ed33626c30e43633cdd6) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2023-04-10target/arm: Copy guarded bit in combine_cacheattrsRichard Henderson
The guarded bit comes from the stage1 walk. Fixes: Coverity CID 1507929 Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20230407185149.3253946-3-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-04-10target/arm: PTE bit GP only applies to stage1Richard Henderson
Only perform the extract of GP during the stage1 walk. Reported-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20230407185149.3253946-2-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-04-09target/ppc: Fix temp usage in gen_op_arith_modwRichard Henderson
Fix a crash writing to 't3', which is now a constant. Instead, write the result of the remu to 't0'. Fixes: 7058ff5231a ("target/ppc: Avoid tcg_const_* in translate.c") Reported-by: Nicholas Piggin <npiggin@gmail.com> Reviewed-by: Anton Johansson <anjo@rev.ng> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> [ clg: amend commit log s/t1/t0/ ] Signed-off-by: Cédric Le Goater <clg@kaod.org>
2023-04-04Merge tag 'pull-loongarch-20230404' of https://gitlab.com/gaosong/qemu into ↵Peter Maydell
staging pull-loongarch-20230404 # -----BEGIN PGP SIGNATURE----- # # iLMEAAEIAB0WIQS4/x2g0v3LLaCcbCxAov/yOSY+3wUCZCwLXQAKCRBAov/yOSY+ # 3zwUA/9d2ddHxGEBTMyF45bzc9JxRF6HoILAwMLsmPWqspPgKdGuviMVewJLt5m8 # V75/BC6Sn9rhdkXALvZMRV6WQ2A16pByUaQtMYAXVsIoV8Mrpvm4GwJD1E0/cy5Q # TwDTzpDfys9WsTVj0QlCPjp0JW+KA7Y6ArMUUCdCz41L2r7mPA== # =ovw7 # -----END PGP SIGNATURE----- # gpg: Signature made Tue 04 Apr 2023 12:34:53 BST # gpg: using RSA key B8FF1DA0D2FDCB2DA09C6C2C40A2FFF239263EDF # gpg: Good signature from "Song Gao <m17746591750@163.com>" [unknown] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: B8FF 1DA0 D2FD CB2D A09C 6C2C 40A2 FFF2 3926 3EDF * tag 'pull-loongarch-20230404' of https://gitlab.com/gaosong/qemu: target/loongarch: Enables plugins to get instruction codes hw/loongarch/virt: Fix virt_to_phys_addr function Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-04-04target/loongarch: Enables plugins to get instruction codestanhongze
Signed-off-by: tanhongze <tanhongze@loongson.cn> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Acked-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20230330124600.1523026-1-tanhongze@loongson.cn> Signed-off-by: Song Gao <gaosong@loongson.cn>
2023-04-03target/arm: Fix generated code for cpreg reads when HSTR is activePeter Maydell
In commit 049edada we added some code to handle HSTR_EL2 traps, which we did as an inline "conditionally branch over a gen_exception_insn()". Unfortunately this fails to take account of the fact that gen_exception_insn() will set s->base.is_jmp to DISAS_NORETURN. That means that at the end of the TB we won't generate the necessary code to handle the "branched over the trap and continued normal execution" codepath. The result is that the TCG main loop thinks that we stopped execution of the TB due to a situation that only happens when icount is enabled, and hits an assertion. Explicitly set is_jmp back to DISAS_NEXT so we generate the correct code for when execution continues past this insn. Note that this only happens for cpreg reads; writes will call gen_lookup_tb() which generates a valid end-of-TB. Fixes: 049edada ("target/arm: Make HSTR_EL2 traps take priority over UNDEF-at-EL1") Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1551 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20230330101900.2320380-1-peter.maydell@linaro.org
2023-04-03target/arm: Fix non-TCG build failure by inlining pauth_ptr_mask()Philippe Mathieu-Daudé
aarch64_gdb_get_pauth_reg() -- although disabled since commit 5787d17a42 ("target/arm: Don't advertise aarch64-pauth.xml to gdb") is still compiled in. It calls pauth_ptr_mask() which is located in target/arm/tcg/pauth_helper.c, a TCG specific helper. To avoid a linking error when TCG is not enabled: Undefined symbols for architecture arm64: "_pauth_ptr_mask", referenced from: _aarch64_gdb_get_pauth_reg in target_arm_gdbstub64.c.o ld: symbol(s) not found for architecture arm64 clang: error: linker command failed with exit code 1 (use -v to see invocation) - Inline pauth_ptr_mask() in aarch64_gdb_get_pauth_reg() (this is the single user), - Rename pauth_ptr_mask_internal() as pauth_ptr_mask() and inline it in "internals.h", Fixes: e995d5cce4 ("target/arm: Implement gdbstub pauth extension") Suggested-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Fabiano Rosas <farosas@suse.de> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-id: 20230328212516.29592-1-philmd@linaro.org [PMM: reinstated doc comment] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-03-28softmmu: Restrict cpu_check_watchpoint / address_matches to TCG accelPhilippe Mathieu-Daudé
Both cpu_check_watchpoint() and cpu_watchpoint_address_matches() are specific to TCG system emulation. Declare them in "tcg-cpu-ops.h" to be sure accessing them from non-TCG code is a compilation error. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-Id: <20230328173117.15226-2-philmd@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2023-03-28target/arm/gdbstub: Only advertise M-profile features if TCG availablePhilippe Mathieu-Daudé
Cortex-M profile is only emulable from TCG accelerator. Restrict the GDBstub features to its availability in order to avoid a link error when TCG is not enabled: Undefined symbols for architecture arm64: "_arm_v7m_get_sp_ptr", referenced from: _m_sysreg_get in target_arm_gdbstub.c.o "_arm_v7m_mrs_control", referenced from: _arm_gdb_get_m_systemreg in target_arm_gdbstub.c.o ld: symbol(s) not found for architecture arm64 clang: error: linker command failed with exit code 1 (use -v to see invocation) Fixes: 7d8b28b8b5 ("target/arm: Implement gdbstub m-profile systemreg and secext") Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Message-id: 20230322142902.69511-3-philmd@linaro.org [PMM: add #include since I cherry-picked this patch from the series] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-03-24target/ppc: Fix helper_pminsn() prototypeCédric Le Goater
GCC13 reports an error: ../target/ppc/excp_helper.c:2625:6: error: conflicting types for ‘helper_pminsn’ due to enum/integer mismatch; have ‘void(CPUPPCState *, powerpc_pm_insn_t)’ {aka ‘void(struct CPUArchState *, powerpc_pm_insn_t)’} [-Werror=enum-int-mismatch] 2625 | void helper_pminsn(CPUPPCState *env, powerpc_pm_insn_t insn) | ^~~~~~~~~~~~~ In file included from /home/legoater/work/qemu/qemu.git/include/qemu/osdep.h:49, from ../target/ppc/excp_helper.c:19: /home/legoater/work/qemu/qemu.git/include/exec/helper-head.h:23:27: note: previous declaration of ‘helper_pminsn’ with type ‘void(CPUArchState *, uint32_t)’ {aka ‘void(CPUArchState *, unsigned int)’} 23 | #define HELPER(name) glue(helper_, name) | ^~~~~~~ Fixes: 7778a575c7 ("ppc: Add P7/P8 Power Management instructions") Signed-off-by: Cédric Le Goater <clg@redhat.com> Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com> Message-Id: <20230321161609.716474-4-clg@kaod.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-03-24target/s390x: Fix float_comp_to_cc() prototypeCédric Le Goater
GCC13 reports an error : ../target/s390x/tcg/fpu_helper.c:123:5: error: conflicting types for ‘float_comp_to_cc’ due to enum/integer mismatch; have ‘int(CPUS390XState *, FloatRelation)’ {aka ‘int(struct CPUArchState *, FloatRelation)’} [-Werror=enum-int-mismatch] 123 | int float_comp_to_cc(CPUS390XState *env, FloatRelation float_compare) | ^~~~~~~~~~~~~~~~ In file included from ../target/s390x/tcg/fpu_helper.c:23: ../target/s390x/s390x-internal.h:302:5: note: previous declaration of ‘float_comp_to_cc’ with type ‘int(CPUS390XState *, int)’ {aka ‘int(struct CPUArchState *, int)’} 302 | int float_comp_to_cc(CPUS390XState *env, int float_compare); | ^~~~~~~~~~~~~~~~ Fixes: 71bfd65c5f ("softfloat: Name compare relation enum") Signed-off-by: Cédric Le Goater <clg@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-Id: <20230321161609.716474-3-clg@kaod.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-03-22*: Add missing includes of qemu/error-report.hRichard Henderson
This had been pulled in via qemu/plugin.h from hw/core/cpu.h, but that will be removed. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-Id: <20230310195252.210956-5-richard.henderson@linaro.org> [AJB: add various additional cases shown by CI] Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20230315174331.2959-15-alex.bennee@linaro.org> Reviewed-by: Emilio Cota <cota@braap.org>
2023-03-21target/arm: Don't advertise aarch64-pauth.xml to gdbPeter Maydell
Unfortunately a bug in older versions of gdb means that they will crash if QEMU sends them the aarch64-pauth.xml. This bug is fixed in gdb commit 1ba3a3222039eb25, and there are plans to backport that to affected gdb release branches, but since the bug affects gdb 9 through 12 it is very widely deployed (for instance by distros). It is not currently clear what the best way to deal with this is; it has been proposed to define a new XML feature name that old gdb will ignore but newer gdb can handle. Since QEMU's 8.0 release is imminent and at least one of our CI runners is now falling over this, disable the pauth XML for the moment. We can follow up with a more considered fix either in time for 8.0 or else for the 8.1 release. Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-03-21target/arm: Add Neoverse-N1 registersChen Baozi
Add implementation defined registers for neoverse-n1 which would be accessed by TF-A. Since there is no DSU in Qemu, CPUCFR_EL1.SCU bit is set to 1 to avoid DSU registers definition. Signed-off-by: Chen Baozi <chenbaozi@phytium.com.cn> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Tested-by: Marcin Juszkiewicz <marcin.juszkiewicz@linaro.org> Message-id: 20230313033936.585669-1-chenbaozi@phytium.com.cn Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-03-20target/s390x/tcg/mem_helper: Remove bad assert() statementThomas Huth
The "assert(!nonfault)" statement can be triggered by running the "mvpg" s390x kvm-unit-test with TCG. According to Richard: "... the assert looks backward. We should only arrive there if nonfault was true for the probe (otherwise the probe would have raised the exception directly). I would think we could just remove the assert." Fixes: 4049431478 ("target/s390x: Fix s390_probe_access for user-only") Suggested-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20230317135737.597570-1-thuth@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: David Hildenbrand <david@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-03-20target/s390x: Update do_unaligned_access() commentIlya Leoshkevich
Relative long instructions now depend on do_unaligned_access() too. Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20230316164428.275147-12-iii@linux.ibm.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-03-20target/s390x: Handle STGRL to non-aligned addressesIlya Leoshkevich
Use MO_ALIGN and let do_unaligned_access() generate a specification exception. Reported-by: Nina Schoetterl-Glausch <nsg@linux.ibm.com> Suggested-by: Nina Schoetterl-Glausch <nsg@linux.ibm.com> Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20230316164428.275147-11-iii@linux.ibm.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-03-20target/s390x: Handle STRL to non-aligned addressesIlya Leoshkevich
Use MO_ALIGN and let do_unaligned_access() generate a specification exception. Reported-by: Nina Schoetterl-Glausch <nsg@linux.ibm.com> Suggested-by: Nina Schoetterl-Glausch <nsg@linux.ibm.com> Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20230316164428.275147-10-iii@linux.ibm.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-03-20target/s390x: Handle CLRL and CLGFRL with non-aligned addressesIlya Leoshkevich
Use MO_ALIGN and let do_unaligned_access() generate a specification exception. Reported-by: Nina Schoetterl-Glausch <nsg@linux.ibm.com> Suggested-by: Nina Schoetterl-Glausch <nsg@linux.ibm.com> Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20230316164428.275147-9-iii@linux.ibm.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-03-20target/s390x: Handle CGRL and CLGRL with non-aligned addressesIlya Leoshkevich
Use MO_ALIGN and let do_unaligned_access() generate a specification exception. Reported-by: Nina Schoetterl-Glausch <nsg@linux.ibm.com> Suggested-by: Nina Schoetterl-Glausch <nsg@linux.ibm.com> Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20230316164428.275147-8-iii@linux.ibm.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-03-20target/s390x: Handle CRL and CGFRL with non-aligned addressesIlya Leoshkevich
Use MO_ALIGN and let do_unaligned_access() generate a specification exception. Reported-by: Nina Schoetterl-Glausch <nsg@linux.ibm.com> Suggested-by: Nina Schoetterl-Glausch <nsg@linux.ibm.com> Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20230316164428.275147-7-iii@linux.ibm.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-03-20target/s390x: Handle LLGFRL from non-aligned addressesIlya Leoshkevich
Use MO_ALIGN and let do_unaligned_access() generate a specification exception. Reported-by: Nina Schoetterl-Glausch <nsg@linux.ibm.com> Suggested-by: Nina Schoetterl-Glausch <nsg@linux.ibm.com> Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20230316164428.275147-6-iii@linux.ibm.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-03-20target/s390x: Handle LRL and LGFRL from non-aligned addressesIlya Leoshkevich
Use MO_ALIGN and let do_unaligned_access() generate a specification exception. Reported-by: Nina Schoetterl-Glausch <nsg@linux.ibm.com> Suggested-by: Nina Schoetterl-Glausch <nsg@linux.ibm.com> Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20230316164428.275147-5-iii@linux.ibm.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-03-20target/s390x: Handle LGRL from non-aligned addressesIlya Leoshkevich
Use MO_ALIGN and let do_unaligned_access() generate a specification exception. Reported-by: Nina Schoetterl-Glausch <nsg@linux.ibm.com> Suggested-by: Nina Schoetterl-Glausch <nsg@linux.ibm.com> Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20230316164428.275147-4-iii@linux.ibm.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-03-20target/s390x: Handle EXECUTE of odd addressesIlya Leoshkevich
Generate a specification exception in the helper before trying to fetch the instruction. Reported-by: Nina Schoetterl-Glausch <nsg@linux.ibm.com> Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20230316164428.275147-3-iii@linux.ibm.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-03-20target/s390x: Handle branching to odd addressesIlya Leoshkevich
Let branching happen and try to generate a new translation block with an odd address. Generate a specification exception in cpu_get_tb_cpu_state(). Reported-by: Harold Grovesteen <h.grovsteen@tx.rr.com> Reported-by: Nina Schoetterl-Glausch <nsg@linux.ibm.com> Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20230316164428.275147-2-iii@linux.ibm.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-03-20target/s390x: Fix EXECUTE of relative long instructionsIlya Leoshkevich
The code uses the wrong base for relative addressing: it should use the target instruction address and not the EXECUTE's address. Fix by storing the target instruction address in the new CPUS390XState member and loading it from the code generated by gen_ri2(). Reported-by: Nina Schoetterl-Glausch <nsg@linux.ibm.com> Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: David Hildenbrand <david@redhat.com> Message-Id: <20230316210751.302423-2-iii@linux.ibm.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-03-20target/s390x: Fix R[NOX]SBG with T=1Ilya Leoshkevich
RXSBG usage in the "filetests" test from the wasmtime testsuite makes tcg_reg_alloc_op() attempt to temp_load() a TEMP_VAL_DEAD temporary, causing an assertion failure: 0x01000a70: ec14 b040 3057 rxsbg %r1, %r4, 0xb0, 0x40, 0x30 OP after optimization and liveness analysis: ---- 0000000001000a70 0000000000000004 0000000000000006 rotl_i64 tmp2,r4,$0x30 dead: 1 2 pref=0xffff and_i64 tmp2,tmp2,$0x800000000000ffff dead: 1 pref=0xffff [xor_i64 tmp3,tmp3,tmp2 dead: 1 2 pref=0xffff] and_i64 cc_dst,tmp3,$0x800000000000ffff sync: 0 dead: 0 1 2 pref=0xffff mov_i64 psw_addr,$0x1000a76 sync: 0 dead: 0 1 pref=0xffff mov_i32 cc_op,$0x6 sync: 0 dead: 0 1 pref=0xffff call lookup_tb_ptr,$0x6,$1,tmp8,env dead: 1 pref=none goto_ptr tmp8 dead: 0 set_label $L0 exit_tb $0x7fffe809d183 ../tcg/tcg.c:3865: tcg fatal error The reason is that tmp3 does not have an initial value, which confuses the register allocator. This also affects the correctness of the results. Fix by assigning R1 to it. Exposed by commit e2e641fa3d5 ("tcg: Change default temp lifetime to TEMP_TB"). Fixes: d6c6372e186e ("target-s390: Implement R[NOX]SBG") Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com> Reviewed-by: David Hildenbrand <david@redhat.com> Message-Id: <20230316172205.281369-2-iii@linux.ibm.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-03-20target/s390x: Implement Early Exception RecognitionIlya Leoshkevich
Generate a specification exception if a reserved bit is set in the PSW mask or if the PSW address is out of bounds dictated by the addressing mode. Reported-by: Nina Schoetterl-Glausch <nsg@linux.ibm.com> Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com> Reviewed-by: David Hildenbrand <david@redhat.com> Message-Id: <20230315020408.384766-3-iii@linux.ibm.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-03-20target/s390x: Fix LPSWIlya Leoshkevich
Currently LPSW does not invert the mask bit 12 and incorrectly copies the BA bit into the address. Fix by generating code similar to what s390_cpu_load_normal() does. Reported-by: Nina Schoetterl-Glausch <nsg@linux.ibm.com> Co-developed-by: Nina Schoetterl-Glausch <nsg@linux.ibm.com> Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com> Reviewed-by: David Hildenbrand <david@redhat.com> Message-Id: <20230315020408.384766-2-iii@linux.ibm.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-03-17Merge tag 'trivial-branch-for-8.0-pull-request' of ↵Peter Maydell
https://gitlab.com/laurent_vivier/qemu into staging Trivial branch pull request 20230317 Fix doc Fix sh4 cpu log output # -----BEGIN PGP SIGNATURE----- # # iQJGBAABCAAwFiEEzS913cjjpNwuT1Fz8ww4vT8vvjwFAmQUdowSHGxhdXJlbnRA # dml2aWVyLmV1AAoJEPMMOL0/L748ylwP/RisLo3XrvNBVuDW/cLh7vhFcaeSqEzH # /RfdJ0DeqreXQYiwqsUS+YrtBARpBwuvBk1RGg46chx3IZJp7fmfLjs0sSSiESsR # kL8tJqRFFdCXmpmUWQqmluiCEBLllq8uDHMaAyXh95V2VRt4vrR8K2x3GW0yrarS # 4BvMdTAJBmjjpXRZ+/NY88EEEqCHgliWTHm+JKLj7II5duUYZO+r0XpCQELFdHig # uEYOupSUm/H4X8VuKuqNG1YGUz9c8X7nYZ+lgKLNH/i8vco+dPSoL4fZvG1ts/NH # kcA+EdGNDJZdvhOUDlvebSIZ9uuVjxy4WD8CIJQ5A2LGSdmv4KUJjQWGBw/r5B/B # e+uhrFnXJPrRSytSohB0iEzlrETBHAzq1yzoc7TYy70SzHtBylR0Xxwxnaq2N9ux # k4wyeXF6toX49RiZ0UmoYO82vtPqg1LOsmYDYWKNzgWbRsTIVJAXuAwBAVIzOgJV # hs93YO3gCaIjh8n/V43VvQzborNhp0xf6Ch7F0cgD1klAAKX1ICX4Mn2Qj7tPmgh # GUsdTpleaFTpsKxgpNP1eU5QYtI9ZcGBhAhsSV9SSnrRsWo1dlppZJkUWEndIHGr # iUnP5OPLtWU5tM2WbVNb3pio/4xrzft3lu4DKH2IecZbBHF11FpK6f9mrlOagAz0 # V/3JSBg10dZQ # =3s21 # -----END PGP SIGNATURE----- # gpg: Signature made Fri 17 Mar 2023 14:17:48 GMT # gpg: using RSA key CD2F75DDC8E3A4DC2E4F5173F30C38BD3F2FBE3C # gpg: issuer "laurent@vivier.eu" # gpg: Good signature from "Laurent Vivier <lvivier@redhat.com>" [full] # gpg: aka "Laurent Vivier <laurent@vivier.eu>" [full] # gpg: aka "Laurent Vivier (Red Hat) <lvivier@redhat.com>" [full] # Primary key fingerprint: CD2F 75DD C8E3 A4DC 2E4F 5173 F30C 38BD 3F2F BE3C * tag 'trivial-branch-for-8.0-pull-request' of https://gitlab.com/laurent_vivier/qemu: docs/sphinx/kerneldoc.py: Honour --enable-werror target/sh4: Honor QEMU_LOG_FILENAME with QEMU_LOG=cpu exec/memory: Fix kernel-doc warning Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-03-16target/sh4: Honor QEMU_LOG_FILENAME with QEMU_LOG=cpuIlya Leoshkevich
When using QEMU_LOG=cpu on sh4, QEMU_LOG_FILENAME is partially ignored. Fix by using qemu_fprintf() instead of qemu_printf() in the respective places. Fixes: 90c84c560067 ("qom/cpu: Simplify how CPUClass:cpu_dump_state() prints") Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Yoshinori Sato <ysato@users.sourceforge.jp> Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-Id: <20230316003411.129462-1-iii@linux.ibm.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2023-03-15Fix build without CONFIG_XEN_EMUMiroslav Rezanina
Upstream commit ddf0fd9ae1 "hw/xen: Support HVM_PARAM_CALLBACK_TYPE_GSI callback" added kvm_xen_maybe_deassert_callback usage to target/i386/kvm/kvm.c file without conditional preprocessing check. This breaks any build not using CONFIG_XEN_EMU. Protect call by conditional preprocessing to allow build without CONFIG_XEN_EMU. Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com> Reviewed-by: David Woodhouse <dwmw@amazon.co.uk> Message-Id: <20230308130557.2420-1-mrezanin@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2023-03-14Merge tag 'pull-tcg-20230313' of https://gitlab.com/rth7680/qemu into stagingPeter Maydell
accel/tcg: Fix NB_MMU_MODES to 16 Balance of the target/ patchset which eliminates tcg_temp_free Balance of the target/ patchset which eliminates tcg_const # -----BEGIN PGP SIGNATURE----- # # iQFRBAABCgA7FiEEekgeeIaLTbaoWgXAZN846K9+IV8FAmQPcb0dHHJpY2hhcmQu # aGVuZGVyc29uQGxpbmFyby5vcmcACgkQZN846K9+IV885AgAjDbg1soRBy0THf0X # CVXmQ4yYyUKAonZBL8Abt9yX01BhLFqEsrju3HiaLNOM9DbwWQ4gdvSrtAZ/K2YG # d6EvC+rJe79pr58MEEhqO4OO1ymp52amRHtEXva4vcKRNuM9WF5by/Hz2PsZyenG # ysaLBdddooA9SJeL7xYBMpKWFgUm3C8NzfaRfCBVcG94er9u8RUi0kx+drmOLw0g # vZ3Hekvi2I8Y5mWqvHeAIOsr8Md9PO3ezWxEteE4qsPNTTRfVD93oSGe9nNCYZTX # wWU51Vfv9GB6hOylAfMRIeCmkjks/gqLOGElsh1MaVovNDTXS5IKV/HgaLaocJHV # 2P81uQ== # =FpIY # -----END PGP SIGNATURE----- # gpg: Signature made Mon 13 Mar 2023 18:55:57 GMT # gpg: using RSA key 7A481E78868B4DB6A85A05C064DF38E8AF7E215F # gpg: issuer "richard.henderson@linaro.org" # gpg: Good signature from "Richard Henderson <richard.henderson@linaro.org>" [full] # Primary key fingerprint: 7A48 1E78 868B 4DB6 A85A 05C0 64DF 38E8 AF7E 215F * tag 'pull-tcg-20230313' of https://gitlab.com/rth7680/qemu: (91 commits) tcg: Drop tcg_const_* tcg: Drop tcg_const_*_vec target/tricore: Use min/max for saturate target/ppc: Avoid tcg_const_* in translate.c target/ppc: Fix gen_tlbsx_booke206 target/ppc: Rewrite trans_ADDG6S target/ppc: Avoid tcg_const_* in power8-pmu-regs.c.inc target/ppc: Avoid tcg_const_* in fp-impl.c.inc target/ppc: Avoid tcg_const_* in vsx-impl.c.inc target/ppc: Avoid tcg_const_* in xxeval target/ppc: Avoid tcg_const_* in vmx-impl.c.inc target/ppc: Avoid tcg_const_i64 in do_vcntmb target/m68k: Use tcg_constant_i32 in gen_ea_mode target/arm: Avoid tcg_const_ptr in handle_rev target/arm: Avoid tcg_const_ptr in handle_vec_simd_sqshrn target/arm: Avoid tcg_const_ptr in disas_simd_zip_trn target/arm: Avoid tcg_const_* in translate-mve.c target/arm: Avoid tcg_const_ptr in gen_sve_{ldr,str} target/arm: Improve trans_BFCI target/arm: Create gen_set_rmode, gen_restore_rmode ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-03-13target/tricore: Use min/max for saturateRichard Henderson
Use tcg_constant_i32 for the bounds. Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2023-03-13target/ppc: Avoid tcg_const_* in translate.cRichard Henderson
All remaining uses are strictly read-only. Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2023-03-13target/ppc: Fix gen_tlbsx_booke206Richard Henderson
Fix incorrect read from rD. Avoid adding 0 when rA == 0. Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
generated by cgit v1.2.3 (git 2.26.2) at 2025-03-14 17:02:43 +0000