aboutsummaryrefslogtreecommitdiff
path: root/target
AgeCommit message (Collapse)Author
2023-07-08target/avr: Fix handling of interrupts above 33.Lucas Dietrich
This commit addresses a bug in the AVR interrupt handling code. The modification involves replacing the usage of the ctz32 function with ctz64 to ensure proper handling of interrupts above 33 in the AVR target. Previously, timers 3, 4, and 5 interrupts were not functioning correctly because most of their interrupt vectors are numbered above 33. Signed-off-by: Lucas Dietrich <ld.adecy@gmail.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Michael Rolnik <mrolnik@gmail.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> (Mjt: updated subject line to have subsytem prefix)
2023-07-07Merge tag 'pull-ppc-20230707-1' of https://gitlab.com/danielhb/qemu into stagingRichard Henderson
ppc patch queue for 2023-07-07: In this last queue for 8.1 we have a lot of fixes and improvements all around: SMT support for powerNV, XIVE fixes, PPC440 cleanups, exception handling cleanups and kvm_pph.h cleanups just to name a few. Thanks everyone in the qemu-ppc community for all the contributions for the next QEMU 8.1 release. # -----BEGIN PGP SIGNATURE----- # # iIwEABYKADQWIQQX6/+ZI9AYAK8oOBk82cqW3gMxZAUCZKgihBYcZGFuaWVsaGI0 # MTNAZ21haWwuY29tAAoJEDzZypbeAzFksr0A/jrvSDSDxB5mR7bo0dNGndLXcdTo # ZGr6k6pcMpr7RDOAAQDVeaw7f8djQ4Aaelk6v1wPs5bYfNY2ElF4NsqHJFX2Cg== # =8lDs # -----END PGP SIGNATURE----- # gpg: Signature made Fri 07 Jul 2023 03:34:44 PM BST # gpg: using EDDSA key 17EBFF9923D01800AF2838193CD9CA96DE033164 # gpg: issuer "danielhb413@gmail.com" # gpg: Good signature from "Daniel Henrique Barboza <danielhb413@gmail.com>" [unknown] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 17EB FF99 23D0 1800 AF28 3819 3CD9 CA96 DE03 3164 * tag 'pull-ppc-20230707-1' of https://gitlab.com/danielhb/qemu: (59 commits) ppc/pnv: Add QME region for P10 target/ppc: Remove pointless checks of CONFIG_USER_ONLY in 'kvm_ppc.h' target/ppc: Restrict 'kvm_ppc.h' to sysemu in cpu_init.c target/ppc: Define TYPE_HOST_POWERPC_CPU in cpu-qom.h target/ppc: Move CPU QOM definitions to cpu-qom.h target/ppc: Reorder #ifdef'ry in kvm_ppc.h target/ppc: Have 'kvm_ppc.h' include 'sysemu/kvm.h' target/ppc: Machine check on invalid real address access on POWER9/10 tests/qtest: Add xscom tests for powernv10 machine ppc/pnv: Set P10 core xscom region size to match hardware ppc/pnv: Log all unimp warnings with similar message ppc440_pcix: Rename QOM type define abd move it to common header ppc4xx_pci: Add define for ppc4xx-host-bridge type name ppc4xx_pci: Rename QOM type name define ppc440_pcix: Stop using system io region for PCI bus ppc440_pcix: Don't use iomem for regs ppc/sam460ex: Remove address_space_mem local variable ppc440: Remove ppc460ex_pcie_init legacy init function ppc440: Add busnum property to PCIe controller model ppc440: Stop using system io region for PCIe buses ... Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2023-07-07target/i386: Add new CPU model GraniteRapidsTao Su
The GraniteRapids CPU model mainly adds the following new features based on SapphireRapids: - PREFETCHITI CPUID.(EAX=7,ECX=1):EDX[bit 14] - AMX-FP16 CPUID.(EAX=7,ECX=1):EAX[bit 21] And adds the following security fix for corresponding vulnerabilities: - MCDT_NO CPUID.(EAX=7,ECX=2):EDX[bit 5] - SBDR_SSDP_NO MSR_IA32_ARCH_CAPABILITIES[bit 13] - FBSDP_NO MSR_IA32_ARCH_CAPABILITIES[bit 14] - PSDP_NO MSR_IA32_ARCH_CAPABILITIES[bit 15] - PBRSB_NO MSR_IA32_ARCH_CAPABILITIES[bit 24] Signed-off-by: Tao Su <tao1.su@linux.intel.com> Tested-by: Xuelian Guo <xuelian.guo@intel.com> Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com> Message-ID: <20230706054949.66556-7-tao1.su@linux.intel.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2023-07-07target/i386: Add few security fix bits in ARCH_CAPABILITIES into ↵Lei Wang
SapphireRapids CPU model SapphireRapids has bit 13, 14 and 15 of MSR_IA32_ARCH_CAPABILITIES enabled, which are related to some security fixes. Add version 2 of SapphireRapids CPU model with those bits enabled also. Signed-off-by: Lei Wang <lei4.wang@intel.com> Signed-off-by: Tao Su <tao1.su@linux.intel.com> Message-ID: <20230706054949.66556-6-tao1.su@linux.intel.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2023-07-07target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIESTao Su
Currently, bit 13, 14, 15 and 24 of MSR_IA32_ARCH_CAPABILITIES are disclosed for fixing security issues, so add those bit definitions. Signed-off-by: Tao Su <tao1.su@linux.intel.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com> Message-ID: <20230706054949.66556-5-tao1.su@linux.intel.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2023-07-07target/i386: Allow MCDT_NO if host supportsTao Su
MCDT_NO bit indicates HW contains the security fix and doesn't need to be mitigated to avoid data-dependent behaviour for certain instructions. It needs no hypervisor support. Treat it as supported regardless of what KVM reports. Signed-off-by: Tao Su <tao1.su@linux.intel.com> Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com> Message-ID: <20230706054949.66556-4-tao1.su@linux.intel.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2023-07-07target/i386: Add support for MCDT_NO in CPUID enumerationTao Su
CPUID.(EAX=7,ECX=2):EDX[bit 5] enumerates MCDT_NO. Processors enumerate this bit as 1 do not exhibit MXCSR Configuration Dependent Timing (MCDT) behavior and do not need to be mitigated to avoid data-dependent behavior for certain instructions. Since MCDT_NO is in a new sub-leaf, add a new CPUID feature word FEAT_7_2_EDX. Also update cpuid_level_func7 by FEAT_7_2_EDX. Signed-off-by: Tao Su <tao1.su@linux.intel.com> Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com> Message-ID: <20230706054949.66556-3-tao1.su@linux.intel.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2023-07-07target/i386: Adjust feature level according to FEAT_7_1_EDXTao Su
If FEAT_7_1_EAX is 0 and FEAT_7_1_EDX is non-zero, as is the case with a Granite Rapids host and '-cpu host,-avx-vnni,-avx512-bf16,-fzrm,-fsrs,-fsrc,-amx-fp16', we can't get CPUID_7_1 leaf even though CPUID_7_1_EDX has non-zero value. Update cpuid_level_func7 according to CPUID_7_1_EDX, otherwise guest may report wrong maximum number sub-leaves in leaf 07H. Fixes: eaaa197d5b11 ("target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration") Cc: qemu-stable@nongnu.org Signed-off-by: Tao Su <tao1.su@linux.intel.com> Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com> Message-ID: <20230706054949.66556-2-tao1.su@linux.intel.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2023-07-07target/ppc: Remove pointless checks of CONFIG_USER_ONLY in 'kvm_ppc.h'Philippe Mathieu-Daudé
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: Greg Kurz <groug@kaod.org> Message-ID: <20230627115124.19632-7-philmd@linaro.org> Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
2023-07-07target/ppc: Restrict 'kvm_ppc.h' to sysemu in cpu_init.cPhilippe Mathieu-Daudé
User emulation shouldn't need any of the KVM prototypes declared in "kvm_ppc.h". Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: Greg Kurz <groug@kaod.org> Message-ID: <20230627115124.19632-6-philmd@linaro.org> Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
2023-07-07target/ppc: Define TYPE_HOST_POWERPC_CPU in cpu-qom.hPhilippe Mathieu-Daudé
TYPE_HOST_POWERPC_CPU is used in various places of cpu_init.c, in order to restrict "kvm_ppc.h" to sysemu, move this QOM-related definition to cpu-qom.h. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: Greg Kurz <groug@kaod.org> Message-ID: <20230627115124.19632-5-philmd@linaro.org> Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
2023-07-07target/ppc: Move CPU QOM definitions to cpu-qom.hPhilippe Mathieu-Daudé
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Cédric Le Goater <clg@kaod.org> Message-ID: <20230627115124.19632-4-philmd@linaro.org> [dhb: keep cpu_list define in target/ppc/cpu.h] Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
2023-07-07target/ppc: Reorder #ifdef'ry in kvm_ppc.hPhilippe Mathieu-Daudé
Keep a single if/else/endif block checking CONFIG_KVM. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Cédric Le Goater <clg@kaod.org> Message-ID: <20230627115124.19632-3-philmd@linaro.org> Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
2023-07-07target/ppc: Have 'kvm_ppc.h' include 'sysemu/kvm.h'Philippe Mathieu-Daudé
"kvm_ppc.h" declares: int kvm_handle_nmi(PowerPCCPU *cpu, struct kvm_run *run); 'struct kvm_run' is declared in "sysemu/kvm.h", include it. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Greg Kurz <groug@kaod.org> Reviewed-by: Cédric Le Goater <clg@kaod.org> Message-ID: <20230627115124.19632-2-philmd@linaro.org> Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
2023-07-07target/ppc: Machine check on invalid real address access on POWER9/10Nicholas Piggin
ppc currently silently accepts invalid real address access. Catch these and turn them into machine checks on POWER9/10 machines. Signed-off-by: Nicholas Piggin <npiggin@gmail.com> Reviewed-by: Cédric Le Goater <clg@kaod.org> Message-ID: <20230703120301.45313-1-npiggin@gmail.com> Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
2023-07-07target/ppc: SMT support for the HID SPRNicholas Piggin
HID is a per-core shared register, skiboot sets this (e.g., setting HILE) on one thread and that must affect all threads of the core. Reviewed-by: Cédric Le Goater <clg@kaod.org> Tested-by: Cédric Le Goater <clg@kaod.org> Signed-off-by: Nicholas Piggin <npiggin@gmail.com> Message-ID: <20230705120631.27670-3-npiggin@gmail.com> Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
2023-07-07target/ppc: Add LPAR-per-core vs per-thread mode flagNicholas Piggin
The Power ISA has the concept of sub-processors: Hardware is allowed to sub-divide a multi-threaded processor into "sub-processors" that appear to privileged programs as multi-threaded processors with fewer threads. POWER9 and POWER10 have two modes, either every thread is a sub-processor or all threads appear as one multi-threaded processor. In the user manuals these are known as "LPAR per thread" / "Thread LPAR", and "LPAR per core" / "1 LPAR", respectively. The practical difference is: in thread LPAR mode, non-hypervisor SPRs are not shared between threads and msgsndp can not be used to message siblings. In 1 LPAR mode, some SPRs are shared and msgsndp is usable. Thrad LPAR allows multiple partitions to run concurrently on the same core, and is a requirement for KVM to run on POWER9/10 (which does not gang-schedule an LPAR on all threads of a core like POWER8 KVM). Traditionally, SMT in PAPR environments including PowerVM and the pseries QEMU machine with KVM acceleration behaves as in 1 LPAR mode. In OPAL systems, Thread LPAR is used. When adding SMT to the powernv machine, it is therefore preferable to emulate Thread LPAR. To account for this difference between pseries and powernv, an LPAR mode flag is added such that SPRs can be implemented as per-LPAR shared, and that becomes either per-thread or per-core depending on the flag. Reviewed-by: Joel Stanley <joel@jms.id.au> Reviewed-by: Cédric Le Goater <clg@kaod.org> Tested-by: Cédric Le Goater <clg@kaod.org> Signed-off-by: Nicholas Piggin <npiggin@gmail.com> Message-ID: <20230705120631.27670-2-npiggin@gmail.com> Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
2023-07-07target: ppc: Use MSR_HVB bit to get the target endianness for memory dumpNarayana Murty N
Currently on PPC64 qemu always dumps the guest memory in Big Endian (BE) format even though the guest running in Little Endian (LE) mode. So crash tool fails to load the dump as illustrated below: Log : $ virsh dump DOMAIN --memory-only dump.file Domain 'DOMAIN' dumped to dump.file $ crash vmlinux dump.file <snip> crash 8.0.2-1.el9 WARNING: endian mismatch: crash utility: little-endian dump.file: big-endian WARNING: machine type mismatch: crash utility: PPC64 dump.file: (unknown) crash: dump.file: not a supported file format <snip> This happens because cpu_get_dump_info() passes cpu->env->has_hv_mode to function ppc_interrupts_little_endian(), the cpu->env->has_hv_mode always set for powerNV even though the guest is not running in hv mode. The hv mode should be taken from msr_mask MSR_HVB bit (cpu->env.msr_mask & MSR_HVB). This patch fixes the issue by passing MSR_HVB value to ppc_interrupts_little_endian() in order to determine the guest endianness. The crash tool also expects guest kernel endianness should match the endianness of the dump. The patch was tested on POWER9 box booted with Linux as host in following cases: Host-Endianess Qemu-Target-Machine Qemu-Generated-Guest Memory-Dump-Format BE powernv(OPAL/PowerNV) LE BE powernv(OPAL/PowerNV) BE LE powernv(OPAL/PowerNV) LE LE powernv(OPAL/PowerNV) BE LE pseries(OPAL/PowerNV/pSeries) KVMHV LE LE pseries TCG LE Fixes: 5609400a4228 ("target/ppc: Set the correct endianness for powernv memory dumps") Signed-off-by: Narayana Murty N <nnmlinux@linux.ibm.com> Reviewed-by: Nicholas Piggin <npiggin@gmail.com> Reviewed-by: Greg Kurz <groug@kaod.org> Reviewed-by: Vaibhav Jain <vaibhav@linux.ibm.com> Message-ID: <20230623072506.34713-1-nnmlinux@linux.ibm.com> Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
2023-07-07target/ppc: Get CPUState in one stepBALATON Zoltan
We can get CPUState from env with env_cpu without going through PowerPCCPU and casting that. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Acked-by: Nicholas Piggin <npiggin@gmail.com> Message-ID: <28424220f37f51ce97f24cadc7538a9c0d16cb45.1686868895.git.balaton@eik.bme.hu> Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
2023-07-07target/ppd: Remove unused defineBALATON Zoltan
Commit 7a3fe174b12d removed usage of POWERPC_SYSCALL_VECTORED, drop the unused define as well. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Nicholas Piggin <npiggin@gmail.com> Message-ID: <50adc24f9d408882128e896d8a81a1a059c41836.1686868895.git.balaton@eik.bme.hu> Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
2023-07-07target/ppc: Remove some more local CPUState variables only used onceBALATON Zoltan
Some helpers only have a CPUState local to call cpu_interrupt_exittb() but we can use env_cpu for that and remove the local. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Acked-by: Nicholas Piggin <npiggin@gmail.com> Message-ID: <aa34e449552c6ab52d48938ccbe762fc06adac01.1686868895.git.balaton@eik.bme.hu> Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
2023-07-07target/ppc: Move common check in exception handlers to a functionBALATON Zoltan
All powerpc exception handlers share some code when handling machine check exceptions. Move this to a common function. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Nicholas Piggin <npiggin@gmail.com> Message-ID: <9cfffaa35aa894086dd092af6b0b26f2d62ff3de.1686868895.git.balaton@eik.bme.hu> Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
2023-07-07target/ppc: Remove unneeded parameter from powerpc_reset_wakeup()BALATON Zoltan
CPUState is rarely needed by this function (only for logging a fatal error) and it's easy to get from the env parameter so passing it separately is not necessary. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Acked-by: Nicholas Piggin <npiggin@gmail.com> Message-ID: <f42761401c708fd6e02f7523d9f709b1972e5863.1686868895.git.balaton@eik.bme.hu> Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
2023-07-07target/ppc: Remove some superfluous parenthesesBALATON Zoltan
Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Acked-by: Nicholas Piggin <npiggin@gmail.com> Message-ID: <8384ed0f7335093012bbd3d28fb2a543a2e7346c.1686868895.git.balaton@eik.bme.hu> Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
2023-07-07target/ppc: Fix icount access for some hypervisor instructionsNicholas Piggin
Several instructions and register access require icount reads and are missing translator_io_start(). Signed-off-by: Nicholas Piggin <npiggin@gmail.com> Acked-by: Richard Henderson <richard.henderson@linaro.org> Message-ID: <20230625103700.8992-1-npiggin@gmail.com> Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
2023-07-07target/ppc: Add TFMR SPR implementation with read and write helpersNicholas Piggin
TFMR is the Time Facility Management Register which is specific to POWER CPUs, and used for the purpose of timebase management (generally by firmware, not the OS). Add helpers for the TFMR register, which will form part of the core timebase facility model in future but for now behaviour is unchanged. Reviewed-by: Cédric Le Goater <clg@kaod.org> Signed-off-by: Nicholas Piggin <npiggin@gmail.com> Message-ID: <20230625120317.13877-3-npiggin@gmail.com> Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
2023-07-07target/ppc: Tidy POWER book4 SPR registrationNicholas Piggin
POWER book4 (implementation-specific) SPRs are sometimes in their own functions, but in other cases are mixed with architected SPRs. Do some spring cleaning on these. Reviewed-by: Cédric Le Goater <clg@kaod.org> Signed-off-by: Nicholas Piggin <npiggin@gmail.com> Message-ID: <20230625120317.13877-2-npiggin@gmail.com> Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
2023-07-07target/ppc: Only generate decodetree files when TCG is enabledPhilippe Mathieu-Daudé
No need to generate TCG-specific decodetree files when TCG is disabled. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Greg Kurz <groug@kaod.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-ID: <20230626140100.67941-1-philmd@linaro.org> Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
2023-07-06target/arm: Avoid over-length shift in arm_cpu_sve_finalize() error casePeter Maydell
If you build QEMU with the clang sanitizer enabled, you can see it fire when running the arm-cpu-features test: $ QTEST_QEMU_BINARY=./build/arm-clang/qemu-system-aarch64 ./build/arm-clang/tests/qtest/arm-cpu-features [...] ../../target/arm/cpu64.c:125:19: runtime error: shift exponent 64 is too large for 64-bit type 'unsigned long long' [...] This happens because the user can specify some incorrect SVE properties that result in our calculating a max_vq of 0. We catch this and error out, but before we do that we calculate vq_mask = MAKE_64BIT_MASK(0, max_vq);$ and the MAKE_64BIT_MASK() call is only valid for lengths that are greater than zero, so we hit the undefined behaviour. Change the logic so that if max_vq is 0 we specifically set vq_mask to 0 without going via MAKE_64BIT_MASK(). This lets us drop the max_vq check from the error-exit logic, because if max_vq is 0 then vq_map must now be 0. The UB only happens in the case where the user passed us an incorrect set of SVE properties, so it's not a big problem in practice. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20230704154332.3014896-1-peter.maydell@linaro.org
2023-07-06target/arm: Define neoverse-v1Peter Maydell
Now that we have implemented support for FEAT_LSE2, we can define a CPU model for the Neoverse-V1, and enable it for the virt and sbsa-ref boards. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20230704130647.2842917-3-peter.maydell@linaro.org Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
2023-07-06target/arm: Suppress more TCG unimplemented features in ID registersPeter Maydell
We already squash the ID register field for FEAT_SPE (the Statistical Profiling Extension) because TCG does not implement it and if we advertise it to the guest the guest will crash trying to look at non-existent system registers. Do the same for some other features which a real hardware Neoverse-V1 implements but which TCG doesn't: * FEAT_TRF (Self-hosted Trace Extension) * Trace Macrocell system register access * Memory mapped trace * FEAT_AMU (Activity Monitors Extension) * FEAT_MPAM (Memory Partitioning and Monitoring Extension) * FEAT_NV (Nested Virtualization) Most of these, like FEAT_SPE, are "introspection/trace" type features which QEMU is unlikely to ever implement. The odd-one-out here is FEAT_NV -- we could implement that and at some point we probably will. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20230704130647.2842917-2-peter.maydell@linaro.org Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
2023-07-06target/xtensa: Assert that interrupt level is within boundsPeter Maydell
In handle_interrupt() we use level as an index into the interrupt_vector[] array. This is safe because we have checked it against env->config->nlevel, but Coverity can't see that (and it is only true because each CPU config sets its XCHAL_NUM_INTLEVELS to something less than MAX_NLEVELS), so it complains about a possible array overrun (CID 1507131) Add an assert() which will make Coverity happy and catch the unlikely case of a mis-set XCHAL_NUM_INTLEVELS in future. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Acked-by: Max Filippov <jcmvbkbc@gmail.com> Message-id: 20230623154135.1930261-1-peter.maydell@linaro.org
2023-07-06target/arm: gdbstub: Guard M-profile code with CONFIG_TCGFabiano Rosas
This code is only relevant when TCG is present in the build. Building with --disable-tcg --enable-xen on an x86 host we get: $ ../configure --target-list=x86_64-softmmu,aarch64-softmmu --disable-tcg --enable-xen $ make -j$(nproc) ... libqemu-aarch64-softmmu.fa.p/target_arm_gdbstub.c.o: in function `m_sysreg_ptr': ../target/arm/gdbstub.c:358: undefined reference to `arm_v7m_get_sp_ptr' ../target/arm/gdbstub.c:361: undefined reference to `arm_v7m_get_sp_ptr' libqemu-aarch64-softmmu.fa.p/target_arm_gdbstub.c.o: in function `arm_gdb_get_m_systemreg': ../target/arm/gdbstub.c:405: undefined reference to `arm_v7m_mrs_control' Signed-off-by: Fabiano Rosas <farosas@suse.de> Message-id: 20230628164821.16771-1-farosas@suse.de Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-07-06target/arm: Handle IC IVAU to improve compatibility with JITsJohn Högberg
Unlike architectures with precise self-modifying code semantics (e.g. x86) ARM processors do not maintain coherency for instruction execution and memory, requiring an instruction synchronization barrier on every core that will execute the new code, and on many models also the explicit use of cache management instructions. While this is required to make JITs work on actual hardware, QEMU has gotten away with not handling this since it does not emulate caches, and unconditionally invalidates code whenever the softmmu or the user-mode page protection logic detects that code has been modified. Unfortunately the latter does not work in the face of dual-mapped code (a common W^X workaround), where one page is executable and the other is writable: user-mode has no way to connect one with the other as that is only known to the kernel and the emulated application. This commit works around the issue by telling software that instruction cache invalidation is required by clearing the CPR_EL0.DIC flag (regardless of whether the emulated processor needs it), and then invalidating code in IC IVAU instructions. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1034 Co-authored-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: John Högberg <john.hogberg@ericsson.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 168778890374.24232.3402138851538068785-1@git.sr.ht [PMM: removed unnecessary AArch64 feature check; moved "clear CTR_EL1.DIC" code up a bit so it's not in the middle of the vfp/neon related tests] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-07-06target/arm: Fix SME full tile indexingRichard Henderson
For the outer product set of insns, which take an entire matrix tile as output, the argument is not a combined tile+column. Therefore using get_tile_rowcol was incorrect, as we extracted the tile number from itself. The test case relies only on assembler support for SME, since no release of GCC recognizes -march=armv9-a+sme yet. Cc: qemu-stable@nongnu.org Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1620 Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20230622151201.1578522-5-richard.henderson@linaro.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> [PMM: dropped now-unneeded changes to sysregs CFLAGS] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-07-06target/arm: Dump ZA[] when activeRichard Henderson
Always print each matrix row whole, one per line, so that we get the entire matrix in the proper shape. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20230622151201.1578522-3-richard.henderson@linaro.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-07-06target/arm: Avoid splitting Zregs across lines in dumpRichard Henderson
Allow the line length to extend to 548 columns. While annoyingly wide, it's still less confusing than the continuations we print. Also, the default VL used by Linux (and max for A64FX) uses only 140 columns. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20230622151201.1578522-2-richard.henderson@linaro.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-07-04target/arm: Add raw_writes ops for register whose write induce TLB maintenanceEric Auger
Some registers whose 'cooked' writefns induce TLB maintenance do not have raw_writefn ops defined. If only the writefn ops is set (ie. no raw_writefn is provided), it is assumed the cooked also work as the raw one. For those registers it is not obvious the tlb_flush works on KVM mode so better/safer setting the raw write. Signed-off-by: Eric Auger <eric.auger@redhat.com> Suggested-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-07-03plugins: force slow path when plugins instrument memory opsAlex Bennée
The lack of SVE memory instrumentation has been an omission in plugin handling since it was introduced. Fortunately we can utilise the probe_* functions to force all all memory access to follow the slow path. We do this by checking the access type and presence of plugin memory callbacks and if set return the TLB_MMIO flag. We have to jump through a few hoops in user mode to re-use the flag but it was the desired effect: ./qemu-system-aarch64 -display none -serial mon:stdio \ -M virt -cpu max -semihosting-config enable=on \ -kernel ./tests/tcg/aarch64-softmmu/memory-sve \ -plugin ./contrib/plugins/libexeclog.so,ifilter=st1w,afilter=0x40001808 -d plugin gives (disas doesn't currently understand st1w): 0, 0x40001808, 0xe54342a0, ".byte 0xa0, 0x42, 0x43, 0xe5", store, 0x40213010, RAM, store, 0x40213014, RAM, store, 0x40213018, RAM And for user-mode: ./qemu-aarch64 \ -plugin contrib/plugins/libexeclog.so,afilter=0x4007c0 \ -d plugin \ ./tests/tcg/aarch64-linux-user/sha512-sve gives: 1..10 ok 1 - do_test(&tests[i]) 0, 0x4007c0, 0xa4004b80, ".byte 0x80, 0x4b, 0x00, 0xa4", load, 0x5500800370, load, 0x5500800371, load, 0x5500800372, load, 0x5500800373, load, 0x5500800374, load, 0x5500800375, load, 0x5500800376, load, 0x5500800377, load, 0x5500800378, load, 0x5500800379, load, 0x550080037a, load, 0x550080037b, load, 0x550080037c, load, 0x550080037d, load, 0x550080037e, load, 0x550080037f, load, 0x5500800380, load, 0x5500800381, load, 0x5500800382, load, 0x5500800383, load, 0x5500800384, load, 0x5500800385, load, 0x5500800386, lo ad, 0x5500800387, load, 0x5500800388, load, 0x5500800389, load, 0x550080038a, load, 0x550080038b, load, 0x550080038c, load, 0x550080038d, load, 0x550080038e, load, 0x550080038f, load, 0x5500800390, load, 0x5500800391, load, 0x5500800392, load, 0x5500800393, load, 0x5500800394, load, 0x5500800395, load, 0x5500800396, load, 0x5500800397, load, 0x5500800398, load, 0x5500800399, load, 0x550080039a, load, 0x550080039b, load, 0x550080039c, load, 0x550080039d, load, 0x550080039e, load, 0x550080039f, load, 0x55008003a0, load, 0x55008003a1, load, 0x55008003a2, load, 0x55008003a3, load, 0x55008003a4, load, 0x55008003a5, load, 0x55008003a6, load, 0x55008003a7, load, 0x55008003a8, load, 0x55008003a9, load, 0x55008003aa, load, 0x55008003ab, load, 0x55008003ac, load, 0x55008003ad, load, 0x55008003ae, load, 0x55008003af (4007c0 is the ld1b in the sha512-sve) Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Cc: Robert Henry <robhenry@microsoft.com> Cc: Aaron Lindsay <aaron@os.amperecomputing.com> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20230630180423.558337-20-alex.bennee@linaro.org>
2023-07-03target/arm: make arm_casq_ptw CONFIG_TCG onlyAlex Bennée
The ptw code is accessed by non-TCG code (specifically arm_pamax and arm_cpu_get_phys_page_attrs_debug) but most of it is really only for TCG emulation. Seeing as we already assert for a non TARGET_AARCH64 build lets extend the test rather than further messing with the ifdef ladder. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20230630180423.558337-19-alex.bennee@linaro.org>
2023-07-01target/nios2 : Explicitly ask for target-endian loads and storesPeter Maydell
When we generate code for guest loads and stores, at the moment they end up being requests for a host-endian access. So for target-system-nios2 (little endian) a load like ldw r3,0(r4) results on an x86 host in the TCG IR qemu_ld_a32_i32 r3,loc2,al+leul,0 but on s390 it is qemu_ld_a32_i32 r3,loc2,al+beul,0 The result is that guests don't work on big-endian hosts. Use the MO_TE* memops rather than the plain ones. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1693 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-Id: <20230623172556.1951974-1-peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2023-07-01target/arm: Use float64_to_int32_modulo for FJCVTZSRichard Henderson
The standard floating point results are provided by the generic routine. We only need handle the extra Z flag result afterward. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20230527141910.1885950-5-richard.henderson@linaro.org>
2023-07-01target/alpha: Use float64_to_int64_modulo for CVTTQRichard Henderson
For the most part we can use the new generic routine, though exceptions need some post-processing to sort invalid from integer overflow. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-Id: <20230527141910.1885950-4-richard.henderson@linaro.org>
2023-06-29Merge tag 'for-upstream' of https://gitlab.com/bonzini/qemu into stagingRichard Henderson
* Make named CPU models usable for qemu-{i386,x86_64} * Fix backwards time with -icount auto # -----BEGIN PGP SIGNATURE----- # # iQFIBAABCAAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAmSdRiQUHHBib256aW5p # QHJlZGhhdC5jb20ACgkQv/vSX3jHroOqcwf9FGAqZ+0V34Y8XeXMu8Es3bFjEKG8 # t3BpVNhTBOYDPvpshnPVx2I29nRT2opc1C4YkjMAv5/1nivj1kDM7hDObOSJQvqy # 5FgTsJYqRtGj+J7uVBrspWZsP8BYeykKmXR6deBOPvCuw5nnLdDQ3dLV2F26lKUu # lsFyEVbi4dzf8+TVuNIXEg7mVBYytjBQwBmmHgeOofeikjq9WEudr49mwJMCHyzl # iXCatnctXGKZYSnp+eHIBiFRdSzjqdgrDRa0ysSqABoBI1pmkhyQKSay6cSjfG4n # gFlqPF/i9RqAWpsQrM1IMGgPK39SrT2dYlHDJV2P/NEQrS6kLh2HoW/ArQ== # =oj3B # -----END PGP SIGNATURE----- # gpg: Signature made Thu 29 Jun 2023 10:51:48 AM CEST # gpg: using RSA key F13338574B662389866C7682BFFBD25F78C7AE83 # gpg: issuer "pbonzini@redhat.com" # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" [undefined] # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" [undefined] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * tag 'for-upstream' of https://gitlab.com/bonzini/qemu: target/i386: emulate 64-bit ring 0 for linux-user if LM feature is set target/i386: ignore CPL0-specific features in user mode emulation target/i386: ignore ARCH_CAPABILITIES features in user mode emulation target/i386: Export MSR_ARCH_CAPABILITIES bits to guests icount: don't adjust virtual time backwards after warp Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2023-06-29target/i386: emulate 64-bit ring 0 for linux-user if LM feature is setPaolo Bonzini
32-bit binaries can run on a long mode processor even if the kernel is 64-bit, of course, and this can have slightly different behavior; for example, SYSCALL is allowed on Intel processors. Allow reporting LM to programs running under user mode emulation, so that "-cpu" can be used with named CPU models even for qemu-i386 and even without disabling LM by hand. Fortunately, most of the runtime code in QEMU has to depend on HF_LMA_MASK or on HF_CS64_MASK (which is anyway false for qemu-i386's 32-bit code segment) rather than TARGET_X86_64, therefore all that is needed is an update of linux-user's ring 0 setup. Fixes: https://gitlab.com/qemu-project/qemu/-/issues/1534 Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2023-06-29target/i386: ignore CPL0-specific features in user mode emulationPaolo Bonzini
Features such as PCID are only accessible through privileged operations, and therefore have no impact on any user-mode operation. Allow reporting them to programs running under user mode emulation, so that "-cpu" can be used with more named CPU models. XSAVES would be similar, but it doesn't make sense to provide it until XSAVEC is implemented. With this change, all CPUs up to Broadwell-v4 can be emulate. Skylake-Client requires XSAVEC, while EPYC also requires SHA-NI, MISALIGNSSE and TOPOEXT. MISALIGNSSE is not hard to implement, but I am not sure it is worth using a precious hflags bit for it. Fixes: https://gitlab.com/qemu-project/qemu/-/issues/1534 Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2023-06-29target/i386: ignore ARCH_CAPABILITIES features in user mode emulationPaolo Bonzini
ARCH_CAPABILITIES is only accessible through a read-only MSR, so it has no impact on any user-mode operation (user-mode cannot read the MSR). So do not bother printing warnings about it in user mode emulation. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2023-06-29target/i386: Export MSR_ARCH_CAPABILITIES bits to guestsPawan Gupta
On Intel CPUs there are certain bits in MSR_ARCH_CAPABILITIES that indicates if the CPU is not affected by a vulnerability. Without these bits guests may try to deploy the mitigation even if the CPU is not affected. Export the bits to guests that indicate immunity to hardware vulnerabilities. Signed-off-by: Pawan Gupta <pawan.kumar.gupta@linux.intel.com> Message-ID: <63d85cc76d4cdc51e6c732478b81d8f13be11e5a.1687551881.git.pawan.kumar.gupta@linux.intel.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2023-06-29Merge tag 'accel-20230628' of https://github.com/philmd/qemu into stagingRichard Henderson
Accelerators patches - MAINTAINERS: Update Roman Bolshakov email address - HAX: Fix a memory leak - HAX/NVMM/WHPX/HVF: Rename per-accel state as AccelCPUState - KVM: Restrict specific fields from ArchCPU - WHPX: Re-enable cross-build gitlab-ci job on case sensitive filesystems - WHPX: Fix error message when setting ProcessorCount fails - exec/memory: Add definitions for memory listener priorities # -----BEGIN PGP SIGNATURE----- # # iQIzBAABCAAdFiEE+qvnXhKRciHc/Wuy4+MsLN6twN4FAmScVtkACgkQ4+MsLN6t # wN7p8A//RXuX9gLFT35zx+5axocU3/XBbCsQWSvzzkYoXxmC/TLxvivO66NPGMc0 # C76b1FJUoLS/u9SyJUeIeYkL0rjkzARUKcRpiJXM21WM6ou8Nkz0kuI4ouowt+4K # i/4chTjxlN5/4PKlHHcX9ZUJ9acVj01zO1BCuj/bVsxO6WMT1kjL+kplVxxFR3aW # tlbYtUT3v4xmp94FfE2Q9lR25z4usrGnmz2rchaadlVc43kmsNcQRx+EoUdi148n # lkViRR90sacYPX586s2yxhPpUdtrXjJmEdX0X00urdPqljkRxekHtyTqG4CRZi+K # hG5NztK7p37GNNXZroL0gpHyr9IX6hZ3o8rmN3IiCOGU6BgQBRUhvvG2sblwcJ1A # SSiBK4RWtgyIGWt4U6PgVj8IAu55JuqT5xR2r34fH/zccxXlp/B13vadGs7TUK15 # oHDUT4GnKL2R29lVFTl95BzsxwaMtbB9w01CLJk8va2T/97eqtFgvJyuVC9vZb0N # 41u2RkinaQZ+hbq9TP1G21zpG0eyucEMIQ6loUd7+G3KJFjFfB4JzE2VDm0Y/OVy # 77cEEQ67wts29fMNSqqPIQCMttDrNj7JqMMknGBQS2iHPgF+B3KjwIjnRaMBt73I # CKPITOJPmb+kvIUsK3KlONdicEG57cBxFBTZW5+P9pJXF5izrAY= # =b9hj # -----END PGP SIGNATURE----- # gpg: Signature made Wed 28 Jun 2023 05:50:49 PM CEST # gpg: using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE # gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <f4bug@amsat.org>" [full] * tag 'accel-20230628' of https://github.com/philmd/qemu: (30 commits) exec/memory: Add symbol for the min value of memory listener priority exec/memory: Add symbol for memory listener priority for device backend exec/memory: Add symbolic value for memory listener priority for accel target/i386/WHPX: Fix error message when fail to set ProcessorCount target/riscv: Restrict KVM-specific fields from ArchCPU target/ppc: Restrict KVM-specific fields from ArchCPU target/arm: Restrict KVM-specific fields from ArchCPU hw/arm/sbsa-ref: Include missing 'sysemu/kvm.h' header hw/intc/arm_gic: Rename 'first_cpu' argument hw/intc/arm_gic: Un-inline GIC*/ITS class_name() helpers accel/kvm: Declare kvm_direct_msi_allowed in stubs accel/kvm: Re-include "exec/memattrs.h" header accel: Rename HVF 'struct hvf_vcpu_state' -> AccelCPUState accel: Rename 'cpu_state' -> 'cs' accel: Inline WHPX get_whpx_vcpu() accel: Rename WHPX 'struct whpx_vcpu' -> AccelCPUState accel: Remove WHPX unreachable error path accel: Inline NVMM get_qemu_vcpu() accel: Rename NVMM 'struct qemu_vcpu' -> AccelCPUState accel: Remove NVMM unreachable error path ... Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2023-06-28exec/memory: Add symbol for the min value of memory listener priorityIsaku Yamahata
Add MEMORY_LISTNER_PRIORITY_MIN for the symbolic value for the min value of the memory listener instead of the hard-coded magic value 0. Add explicit initialization. No functional change intended. Signed-off-by: Isaku Yamahata <isaku.yamahata@intel.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-Id: <29f88477fe82eb774bcfcae7f65ea21995f865f2.1687279702.git.isaku.yamahata@intel.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
generated by cgit v1.2.3 (git 2.26.2) at 2025-03-15 07:41:37 +0000