aboutsummaryrefslogtreecommitdiff
path: root/target
AgeCommit message (Collapse)Author
2024-08-20target/sparc: Restrict STQF to sparcv9Richard Henderson
Prior to sparcv9, the same encoding was STDFQ. Cc: qemu-stable@nongnu.org Fixes: 06c060d9e5b ("target/sparc: Move simple fp load/store to decodetree") Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20240816072311.353234-2-richard.henderson@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-08-20target/mips: Load PTE as DATAPhilippe Mathieu-Daudé
PTE is not CODE so load it as normal DATA access. Fixes: 074cfcb4da ("Implement hardware page table walker for MIPS32") Suggested-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-ID: <20240814090452.2591-4-philmd@linaro.org>
2024-08-20target/mips: Use correct MMU index in get_pte()Philippe Mathieu-Daudé
When refactoring page_table_walk_refill() in commit 4e999bf419 we missed the indirect call to cpu_mmu_index() in get_pte(): page_table_walk_refill() -> get_pte() -> cpu_ld[lq]_code() -> cpu_mmu_index() Since we don't mask anymore the modes in hflags, cpu_mmu_index() can return UM or SM, while we only expect KM or ERL. Fix by propagating ptw_mmu_idx to get_pte(), and use the cpu_ld/st_code_mmu() API with the correct MemOpIdx. Reported-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com> Reported-by: Waldemar Brodkorb <wbx@uclibc-ng.org> Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2470 Fixes: 4e999bf419 ("target/mips: Pass ptw_mmu_idx down from mips_cpu_tlb_fill") Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-ID: <20240814090452.2591-3-philmd@linaro.org>
2024-08-20target/mips: Pass page table entry size as MemOp to get_pte()Philippe Mathieu-Daudé
In order to simplify the next commit, pass the PTE size as MemOp. Rename: native_shift -> native_op directory_shift -> directory_mop leaf_shift -> leaf_mop Suggested-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20240814090452.2591-2-philmd@linaro.org>
2024-08-15target/s390x: fix build warning (gcc-12 -fsanitize=thread)Pierrick Bouvier
Found on debian stable. ../target/s390x/tcg/translate.c: In function ‘get_mem_index’: ../target/s390x/tcg/translate.c:398:1: error: control reaches end of non-void function [-Werror=return-type] 398 | } Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Acked-by: Ilya Leoshkevich <iii@linux.ibm.com> Message-ID: <20240814224132.897098-4-pierrick.bouvier@linaro.org> Signed-off-by: Thomas Huth <thuth@redhat.com>
2024-08-15Merge tag 'for-upstream' of https://gitlab.com/bonzini/qemu into stagingRichard Henderson
* fix RAPL computations # -----BEGIN PGP SIGNATURE----- # # iQFIBAABCAAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAma83sIUHHBib256aW5p # QHJlZGhhdC5jb20ACgkQv/vSX3jHroO4OAf/SCiETP35wStOQ1MDfQoW9BUltlyS # 0bHJ9fiVPUs8iVXoUOY83P33dBYLpkAutmdw38pxD9JDH99wM5e4Etgks1GxLjtj # aDWMyxskguVKxR0iT92jcM7kFZKYqzssIoXrPFq7cC4LYw9t5wOEUnPxRXBphlao # 1lLdkJlDzHsU/K+VSAdB81T/Og+E6BpcBZTLD9EONUvcqHSiGp65omNf+dPporkO # U2egOFqcbhH6+jdQoRwBeXvGnIny8nHLVyOEbZWygeZqfo2PWR5PQ3DqOR7sj5RT # w9DIxtkpMdHWT1D/+8etDnb3XWYRnZNLhK5B3w4HpZUcBecyxmcXj6nxXA== # =Uvzx # -----END PGP SIGNATURE----- # gpg: Signature made Thu 15 Aug 2024 02:43:46 AM AEST # gpg: using RSA key F13338574B662389866C7682BFFBD25F78C7AE83 # gpg: issuer "pbonzini@redhat.com" # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" [full] # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" [full] * tag 'for-upstream' of https://gitlab.com/bonzini/qemu: target/i386: Fix arguments for vmsr_read_thread_stat() Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2024-08-14target/i386: Fix arguments for vmsr_read_thread_stat()Anthony Harivel
Snapshot of the stat utime and stime for each thread, taken before and after the pause, must be stored in separate locations Signed-off-by: Anthony Harivel <aharivel@redhat.com> Link: https://lore.kernel.org/r/20240807124320.1741124-2-aharivel@redhat.com Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-08-14Merge tag 'for-upstream' of https://gitlab.com/bonzini/qemu into stagingRichard Henderson
* fix --static compilation of hexagon * fix incorrect application of REX to MMX operands * fix crash on module load * update Italian translation # -----BEGIN PGP SIGNATURE----- # # iQFIBAABCAAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAma7kZ4UHHBib256aW5p # QHJlZGhhdC5jb20ACgkQv/vSX3jHroOy7QgAriuxfgw3Yvu9UPPfEZT5V9p5XfDf # LceO3C6OABIkFoGSO8WK5dWfQy3oYbrwEXX/l/PW1lUc2DFrSUo9YtIfjelRkxoC # 0EAAbV5A+xCLYmujFqBSe/6usRj82uKjSET1KK1aCam7ONZLNZf2yb4OwdShvLSN # MPgtBOrwznR1qh3KJtLB6YSRC0Rie1hOxbXFpx1AklXYnIiqUdMjXOHSjs+Amva0 # VczuqwjtVdNDTPqbZlCXatPtZ8nwYeEOD2jOqgjAoEwwabZ1fFGDCNXlqEDLSdTm # Cc+IZPYU5a8+tVfH0DYEMgMSkRhDUqVZ/076L+pRi+Q8ClxWV8fKsf5qKw== # =jJtu # -----END PGP SIGNATURE----- # gpg: Signature made Wed 14 Aug 2024 03:02:22 AM AEST # gpg: using RSA key F13338574B662389866C7682BFFBD25F78C7AE83 # gpg: issuer "pbonzini@redhat.com" # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" [full] # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" [full] * tag 'for-upstream' of https://gitlab.com/bonzini/qemu: po: update Italian translation module: Prevent crash by resetting local_err in module_load_qom_all() target/i386: Assert MMX and XMM registers in range target/i386: Use unit not type in decode_modrm target/i386: Do not apply REX to MMX operands target/hexagon: don't look for static glib Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2024-08-13target/i386: Assert MMX and XMM registers in rangeRichard Henderson
The mmx assert would fire without the fix for #2495. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Link: https://lore.kernel.org/r/20240812025844.58956-4-richard.henderson@linaro.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-08-13target/arm: Fix usage of MMU indexes when EL3 is AArch32Peter Maydell
Our current usage of MMU indexes when EL3 is AArch32 is confused. Architecturally, when EL3 is AArch32, all Secure code runs under the Secure PL1&0 translation regime: * code at EL3, which might be Mon, or SVC, or any of the other privileged modes (PL1) * code at EL0 (Secure PL0) This is different from when EL3 is AArch64, in which case EL3 is its own translation regime, and EL1 and EL0 (whether AArch32 or AArch64) have their own regime. We claimed to be mapping Secure PL1 to our ARMMMUIdx_EL3, but didn't do anything special about Secure PL0, which meant it used the same ARMMMUIdx_EL10_0 that NonSecure PL0 does. This resulted in a bug where arm_sctlr() incorrectly picked the NonSecure SCTLR as the controlling register when in Secure PL0, which meant we were spuriously generating alignment faults because we were looking at the wrong SCTLR control bits. The use of ARMMMUIdx_EL3 for Secure PL1 also resulted in the bug that we wouldn't honour the PAN bit for Secure PL1, because there's no equivalent _PAN mmu index for it. We could fix this in one of two ways: * The most straightforward is to add new MMU indexes EL30_0, EL30_3, EL30_3_PAN to correspond to "Secure PL1&0 at PL0", "Secure PL1&0 at PL1", and "Secure PL1&0 at PL1 with PAN". This matches how we use indexes for the AArch64 regimes, and preserves propirties like being able to determine the privilege level from an MMU index without any other information. However it would add two MMU indexes (we can share one with ARMMMUIdx_EL3), and we are already using 14 of the 16 the core TLB code permits. * The more complicated approach is the one we take here. We use the same MMU indexes (E10_0, E10_1, E10_1_PAN) for Secure PL1&0 than we do for NonSecure PL1&0. This saves on MMU indexes, but means we need to check in some places whether we're in the Secure PL1&0 regime or not before we interpret an MMU index. The changes in this commit were created by auditing all the places where we use specific ARMMMUIdx_ values, and checking whether they needed to be changed to handle the new index value usage. Note for potential stable backports: taking also the previous (comment-change-only) commit might make the backport easier. Cc: qemu-stable@nongnu.org Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2326 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Tested-by: Bernhard Beschow <shentey@gmail.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20240809160430.1144805-3-peter.maydell@linaro.org
2024-08-13target/arm: Update translation regime comment for new featuresPeter Maydell
We have a long comment describing the Arm architectural translation regimes and how we map them to QEMU MMU indexes. This comment has got a bit out of date: * FEAT_SEL2 allows Secure EL2 and corresponding new regimes * FEAT_RME introduces Realm state and its translation regimes * We now model the Cortex-R52 so that is no longer a hypothetical * We separated Secure Stage 2 and NonSecure Stage 2 MMU indexes * We have an MMU index per physical address spacea Add the missing pieces so that the list of architectural translation regimes matches the Arm ARM, and the list and count of QEMU MMU indexes in the comment matches the enum. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Tested-by: Bernhard Beschow <shentey@gmail.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20240809160430.1144805-2-peter.maydell@linaro.org
2024-08-13target/arm: Clear high SVE elements in handle_vec_simd_wshliRichard Henderson
AdvSIMD instructions are supposed to zero bits beyond 128. Affects SSHLL, USHLL, SSHLL2, USHLL2. Cc: qemu-stable@nongnu.org Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20240717060903.205098-15-richard.henderson@linaro.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2024-08-13target/i386: Use unit not type in decode_modrmRichard Henderson
Rather that enumerating the types that can produce MMX operands, examine the unit. No functional change. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Link: https://lore.kernel.org/r/20240812025844.58956-3-richard.henderson@linaro.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-08-13target/i386: Do not apply REX to MMX operandsRichard Henderson
Cc: qemu-stable@nongnu.org Fixes: b3e22b2318a ("target/i386: add core of new i386 decoder") Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2495 Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Link: https://lore.kernel.org/r/20240812025844.58956-2-richard.henderson@linaro.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-08-13target/hexagon: don't look for static glibAlyssa Ross
When cross compiling QEMU configured with --static, I've been getting configure errors like the following: Build-time dependency glib-2.0 found: NO ../target/hexagon/meson.build:303:15: ERROR: Dependency lookup for glib-2.0 with method 'pkgconfig' failed: Could not generate libs for glib-2.0: Package libpcre2-8 was not found in the pkg-config search path. Perhaps you should add the directory containing `libpcre2-8.pc' to the PKG_CONFIG_PATH environment variable Package 'libpcre2-8', required by 'glib-2.0', not found This happens because --static sets the prefer_static Meson option, but my build machine doesn't have a static libpcre2. I don't think it makes sense to insist that native dependencies are static, just because I want the non-native QEMU binaries to be static. Signed-off-by: Alyssa Ross <hi@alyssa.is> Link: https://lore.kernel.org/r/20240805104921.4035256-1-hi@alyssa.is Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-08-09target/arm: Fix BTI versus CF_PCRELRichard Henderson
With pcrel, we cannot check the guarded page bit at translation time, as different mappings of the same physical page may or may not have the GP bit set. Instead, add a couple of helpers to check the page at runtime, after all other filters that might obviate the need for the check. The set_btype_for_br call must be moved after the gen_a64_set_pc call to ensure the current pc can still be computed. Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20240802003028.795476-1-richard.henderson@linaro.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2024-08-07target/hexagon: switch to dc set_props() listBrian Cain
Define a hexagon_cpu_properties list to match the idiom used by other targets. Signed-off-by: Brian Cain <bcain@quicinc.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Taylor Simpson <ltaylorsimpson@gmail.com>
2024-08-07target/hexagon: define a v66 CPUBrian Cain
For now, v66 behavior is the same as other CPUs. Signed-off-by: Brian Cain <bcain@quicinc.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Taylor Simpson <ltaylorsimpson@gmail.com>
2024-08-07target/hexagon/idef-parser: Remove self-assignmentAnton Johansson
The self assignment is clearly useless, and @1.last_column does not have to be set for an expression with only a single token, so remove it. Reported-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Anton Johansson <anjo@rev.ng> Reviewed-by: Brian Cain <bcain@quicinc.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-Id: <20230713120853.27023-1-anjo@rev.ng> Signed-off-by: Brian Cain <bcain@quicinc.com>
2024-08-07Hexagon: lldb read/write predicate registers p0/p1/p2/p3Taylor Simpson
hexagon-core.xml only exposes register p3_0 which is an alias that aggregates the predicate registers. It is more convenient for users to interact directly with the predicate registers. Tested with lldb downloaded from this location https://github.com/llvm/llvm-project/releases/download/llvmorg-18.1.4/clang+llvm-18.1.4-x86_64-linux-gnu-ubuntu-18.04.tar.xz BEFORE: (lldb) reg read p3_0 p3_0 = 0x00000000 (lldb) reg read p0 error: Invalid register name 'p0'. (lldb) reg write p1 0xf error: Register not found for 'p1'. AFTER: (lldb) reg read p3_0 p3_0 = 0x00000000 (lldb) reg read p0 p0 = 0x00 (lldb) reg read -s 1 Predicate Registers: p0 = 0x00 p1 = 0x00 p2 = 0x00 p3 = 0x00 (lldb) reg write p1 0xf (lldb) reg read p3_0 p3_0 = 0x00000f00 (lldb) reg write p3_0 0xff00ff00 (lldb) reg read -s 1 Predicate Registers: p0 = 0x00 p1 = 0xff p2 = 0x00 p3 = 0xff Signed-off-by: Taylor Simpson <ltaylorsimpson@gmail.com> Reviewed-by: Brian Cain <bcain@quicinc.com> Reviewed-by: Matheus Tavares Bernardino <quic_mathbern@quicinc.com> Message-Id: <20240613182209.140082-1-ltaylorsimpson@gmail.com> Signed-off-by: Brian Cain <bcain@quicinc.com>
2024-08-07Hexagon: fix F2_conv_* instructions for negative zeroMatheus Tavares Bernardino
The implementation for these instructions handles -0 as an invalid float point value, whereas the Hexagon hardware considers it the same as +0 (which is valid). Let's fix that and add a regression test. Signed-off-by: Matheus Tavares Bernardino <quic_mathbern@quicinc.com> Reviewed-by: Brian Cain <bcain@quicinc.com> Reviewed-by: Taylor Simpson <ltaylorsimpson@gmail.com> Signed-off-by: Brian Cain <bcain@quicinc.com>
2024-08-06target/riscv: Add asserts for out-of-bound accessAtish Patra
Coverity complained about the possible out-of-bounds access with counter_virt/counter_virt_prev because these two arrays are accessed with privilege mode. However, these two arrays are accessed only when virt is enabled. Thus, the privilege mode can't be M mode. Add the asserts anyways to detect any wrong usage of these arrays in the future. Suggested-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Atish Patra <atishp@rivosinc.com> Fixes: Coverity CID 1558459 Fixes: Coverity CID 1558462 Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-ID: <20240724-fixes-v1-1-4a64596b0d64@rivosinc.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2024-08-06target/riscv: Relax fld alignment requirementLIU Zhiwei
According to the risc-v specification: "FLD and FSD are only guaranteed to execute atomically if the effective address is naturally aligned and XLEN≥64." We currently implement fld as MO_ATOM_IFALIGN when XLEN < 64, which does not violate the rules. But it will hide some problems. So relax it to MO_ATOM_NONE. Signed-off-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-ID: <20240802072417.659-4-zhiwei_liu@linux.alibaba.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2024-08-06target/riscv: Add MXLEN check for F/D/Q applies to zama16bLIU Zhiwei
Zama16b loads and stores of no more than MXLEN bits defined in the F, D, and Q extensions. Signed-off-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-ID: <20240802072417.659-3-zhiwei_liu@linux.alibaba.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2024-08-06target/riscv: Remove redundant insn length check for zama16bLIU Zhiwei
Compressed encodings also applies to zama16b. https://github.com/riscv/riscv-isa-manual/pull/1557 Suggested-by: Alistair Francis <alistair.francis@wdc.com> Signed-off-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-ID: <20240802072417.659-2-zhiwei_liu@linux.alibaba.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2024-08-06Merge tag 'for-upstream' of https://gitlab.com/bonzini/qemu into stagingRichard Henderson
* target/i386: SEV: fix incorrect property name * target/i386: tcg: fix VSIB decode with XMM/YMM{4,12} # -----BEGIN PGP SIGNATURE----- # # iQFIBAABCAAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAmawwjoUHHBib256aW5p # QHJlZGhhdC5jb20ACgkQv/vSX3jHroO+kgf/SIOaF14Ozw6w33zddDiuK969ouNR # 00hC17p0acVl3KwmbXBJp2CXtc4TcZwLEg6y2KrActEVg2CaFFjGx9wJUnTGOL/D # 3Nhp3ipsExv+rFQuQvV9k/BeAVG0G9YoTZtQJVQvLPL/LYJ76h2JlVamjr9rsuKy # hsVeHX6Xl6ad6mtM1hSFBonJzfGK08rKQPTnALfB0raFLmSHWleg9Xzs0r1YiuO2 # SsGVr0NF369pZA2U0Y/tcw0RIRIikXfVYTX5+o9H6RzEqbqaOh3j9upLYSWym6LN # cedTxjNFJdxZReR/VE1kAys3s2pE8k+yiQIBGzfwo4fN6hukJZGCtwrVmw== # =2tkB # -----END PGP SIGNATURE----- # gpg: Signature made Mon 05 Aug 2024 10:14:50 PM AEST # gpg: using RSA key F13338574B662389866C7682BFFBD25F78C7AE83 # gpg: issuer "pbonzini@redhat.com" # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" [full] # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" [full] * tag 'for-upstream' of https://gitlab.com/bonzini/qemu: target/i386: Fix VSIB decode target/i386: SEV: fix mismatch in vcek-disabled property name Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2024-08-05target/i386: Fix VSIB decodeRichard Henderson
With normal SIB, index == 4 indicates no index. With VSIB, there is no exception for VR4/VR12. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2474 Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Link: https://lore.kernel.org/r/20240805003130.1421051-3-richard.henderson@linaro.org Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-08-03hvf: arm: Fix hvf_sysreg_read_cp() callAkihiko Odaki
Changed val from uint64_t to a pointer to uint64_t in hvf_sysreg_read, but didn't change its usage in hvf_sysreg_read_cp call. Fixes: e9e640148c ("hvf: arm: Raise an exception for sysreg by default") Reported-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20240802-hvf-v1-1-e2c0292037e5@daynix.com> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2024-08-02target/i386: SEV: fix mismatch in vcek-disabled property namePaolo Bonzini
The vcek-disabled property of the sev-snp-guest object is misspelled vcek-required (which I suppose would use the opposite polarity) in the call to object_class_property_add_bool(). Fix it. Reported-by: Zixi Chen <zixchen@redhat.com> Reviewed-by: Pankaj Gupta <pankaj.gupta@amd.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-08-01target/xtensa: Correct assert condition in handle_interrupt()Peter Maydell
In commit ad18376b90c8101 we added an assert that the level value was in-bounds for the array we're about to index into. However, the assert condition is wrong -- env->config->interrupt_vector is an array of uint32_t, so we should bounds check the index against ARRAY_SIZE(...), not against sizeof(). Resolves: Coverity CID 1507131 Fixes: ad18376b90c8101 ("target/xtensa: Assert that interrupt level is within bounds") Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Acked-by: Max Filippov <jcmvbkbc@gmail.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-id: 20240731172246.3682311-1-peter.maydell@linaro.org
2024-08-01target/arm: Handle denormals correctly for FMOPA (widening)Peter Maydell
The FMOPA (widening) SME instruction takes pairs of half-precision floating point values, widens them to single-precision, does a two-way dot product and accumulates the results into a single-precision destination. We don't quite correctly handle the FPCR bits FZ and FZ16 which control flushing of denormal inputs and outputs. This is because at the moment we pass a single float_status value to the helper function, which then uses that configuration for all the fp operations it does. However, because the inputs to this operation are float16 and the outputs are float32 we need to use the fp_status_f16 for the float16 input widening but the normal fp_status for everything else. Otherwise we will apply the flushing control FPCR.FZ16 to the 32-bit output rather than the FPCR.FZ control, and incorrectly flush a denormal output to zero when we should not (or vice-versa). (In commit 207d30b5fdb5b we tried to fix the FZ handling but didn't get it right, switching from "use FPCR.FZ for everything" to "use FPCR.FZ16 for everything".) Pass the CPU env to the sme_fmopa_h helper instead of an fp_status pointer, and have the helper pass an extra fp_status into the f16_dotadd() function so that we can use the right status for the right parts of this operation. Cc: qemu-stable@nongnu.org Fixes: 207d30b5fdb5 ("target/arm: Use FPST_F16 for SME FMOPA (widening)") Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2373 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
2024-07-31target/i386: Clean up error cases for vmsr_read_thread_stat()Anthony Harivel
Fix leaking memory of file handle in case of error Erase unused "pid = -1" Add clearer error_report Should fix Coverity CID 1558557. Signed-off-by: Anthony Harivel <aharivel@redhat.com> Link: https://lore.kernel.org/r/20240726102632.1324432-3-aharivel@redhat.com Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-07-31target/i386: Fix typo that assign same value twiceAnthony Harivel
Should fix: CID 1558553 Signed-off-by: Anthony Harivel <aharivel@redhat.com> Link: https://lore.kernel.org/r/20240726102632.1324432-2-aharivel@redhat.com Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-07-31target/i386/cpu: Mask off SGX/SGX_LC feature words for non-PC machineZhao Liu
Only PC machine supports SGX, so mask off SGX related feature words for non-PC machine (microvm). Signed-off-by: Zhao Liu <zhao1.liu@intel.com> Link: https://lore.kernel.org/r/20240730045544.2516284-5-zhao1.liu@intel.com Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-07-31target/i386/cpu: Add dependencies of CPUID 0x12 leavesZhao Liu
As SDM stated, CPUID 0x12 leaves depend on CPUID_7_0_EBX_SGX (SGX feature word). Since FEAT_SGX_12_0_EAX, FEAT_SGX_12_0_EBX and FEAT_SGX_12_1_EAX define multiple feature words, add the dependencies of those registers to report the warning to user if SGX is absent. Signed-off-by: Zhao Liu <zhao1.liu@intel.com> Link: https://lore.kernel.org/r/20240730045544.2516284-4-zhao1.liu@intel.com Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-07-31target/i386/cpu: Explicitly express SGX_LC and SGX feature words dependencyZhao Liu
At present, cpu_x86_cpuid() silently masks off SGX_LC if SGX is absent. This is not proper because the user is not told about the dependency between the two. So explicitly define the dependency between SGX_LC and SGX feature words, so that user could get a warning when SGX_LC is enabled but SGX is absent. Signed-off-by: Zhao Liu <zhao1.liu@intel.com> Link: https://lore.kernel.org/r/20240730045544.2516284-3-zhao1.liu@intel.com Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-07-31target/i386/cpu: Remove unnecessary SGX feature words checksZhao Liu
CPUID.0x7.0.ebx and CPUID.0x7.0.ecx leaves have been expressed as the feature word lists, and the Host capability support has been checked in x86_cpu_filter_features(). Therefore, such checks on SGX feature "words" are redundant, and the follow-up adjustments to those feature "words" will not actually take effect. Remove unnecessary SGX feature words related checks. Signed-off-by: Zhao Liu <zhao1.liu@intel.com> Link: https://lore.kernel.org/r/20240730045544.2516284-2-zhao1.liu@intel.com Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-07-31target/i386: Change unavail from u32 to u64Xiong Zhang
The feature word 'r' is a u64, and "unavail" is a u32, the operation 'r &= ~unavail' clears the high 32 bits of 'r'. This causes many vmx cases in kvm-unit-tests to fail. Changing 'unavail' from u32 to u64 fixes this issue. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2442 Fixes: 0b2757412cb1 ("target/i386: drop AMD machine check bits from Intel CPUID") Signed-off-by: Xiong Zhang <xiong.y.zhang@linux.intel.com> Link: https://lore.kernel.org/r/20240730082927.250180-1-xiong.y.zhang@linux.intel.com Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-07-30Merge tag 'pull-target-arm-20240730' of ↵Richard Henderson
https://git.linaro.org/people/pmaydell/qemu-arm into staging target-arm queue: * hw/char/bcm2835_aux: Fix assert when receive FIFO fills up * hw/arm/smmuv3: Assert input to oas2bits() is valid * target/arm/kvm: Set PMU for host only when available * target/arm/kvm: Do not silently remove PMU * hvf: arm: Properly disable PMU * hvf: arm: Do not advance PC when raising an exception * hw/misc/bcm2835_property: several minor bugfixes * target/arm: Don't assert for 128-bit tile accesses when SVL is 128 * target/arm: Fix UMOPA/UMOPS of 16-bit values * target/arm: Ignore SMCR_EL2.LEN and SVCR_EL2.LEN if EL2 is not enabled * system/physmem: Where we assume we have a RAM MR, assert it * sh4, i386, m68k, xtensa, tricore, arm: fix minor Coverity issues # -----BEGIN PGP SIGNATURE----- # # iQJNBAABCAA3FiEE4aXFk81BneKOgxXPPCUl7RQ2DN4FAmaotMAZHHBldGVyLm1h # eWRlbGxAbGluYXJvLm9yZwAKCRA8JSXtFDYM3rsAEACIzQDAMKWy8DlB8o4W+a/l # yqGijQ5e0JdAifEA2rsDbnaIs/kqDzVxBc0dgIXDxETe5LVZHB742q4vMbaSpSb2 # P8xuL0Q7NRpcIN4THPwLxW0wED+asaJc2TeyImPQRTRhLgk6yn+/4hpqQRkT0mxe # oxxN8bnx9RssqHZ6pQCv5HYNLex3a7dljXlbjWr4KpRRFSMls1cxPSphsK1aZ1xV # 3NXh/vgHcM0LquwxdF0uaPdPGQ1SyZb5KZ9khd0o4cpDivkns/hXQpyJ45nHsypK # kG/TbFQsXPorprWCqBDOXY9rCM6eBDuK89mClKA34EzukIFlSMfIgxfezCzNIXaU # o/cJCGpSzZnCdvZagEWDzkdryE3QFmmpBFRs8mcS3sb+/gm0O8YyMoCrdV87O3c5 # Y/NY1adOKTVf8FLlT3jR93k4pT6wiqIQND13fN3EbnUqfrGpocSyMD0VsYBj/gij # PHPBFHAwCEDKVZSq6SViXdkS15arqL2V2mnOogeY1v0jTj2YRG3FyjrPOatg6tF5 # 3MoUBjTAp9ENtYHAY6mCr2vAYw6l1xZTKUwkXiO/i8rc4XQQ+A3AHhQLtWdu2K5+ # dv1E7QKur5O6FDmJxB5s/vGppfnkSUD6EEvViNSCj+hX0U9SyT80e/KClMehgJqQ # +oME+fRoBHj1DUw4qasWsg== # =NNxN # -----END PGP SIGNATURE----- # gpg: Signature made Tue 30 Jul 2024 07:39:12 PM AEST # gpg: using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE # gpg: issuer "peter.maydell@linaro.org" # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [full] # gpg: aka "Peter Maydell <pmaydell@gmail.com>" [full] # gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" [full] # gpg: aka "Peter Maydell <peter@archaic.org.uk>" [unknown] * tag 'pull-target-arm-20240730' of https://git.linaro.org/people/pmaydell/qemu-arm: (21 commits) system/physmem: Where we assume we have a RAM MR, assert it target/sh4: Avoid shift into sign bit in update_itlb_use() target/i386: Remove dead assignment to ss in do_interrupt64() target/m68k: avoid shift into sign bit in dump_address_map() target/xtensa: Make use of 'segment' in pptlb helper less confusing target/tricore: Use unsigned types for bitops in helper_eq_b() target/arm: Ignore SMCR_EL2.LEN and SVCR_EL2.LEN if EL2 is not enabled target/arm: Avoid shifts by -1 in tszimm_shr() and tszimm_shl() target/arm: Fix UMOPA/UMOPS of 16-bit values target/arm: Don't assert for 128-bit tile accesses when SVL is 128 hw/misc/bcm2835_property: Reduce scope of variables in mbox push function hw/misc/bcm2835_property: Restrict scope of start_num, number, otp_row hw/misc/bcm2835_property: Avoid overflow in OTP access properties hw/misc/bcm2835_property: Fix handling of FRAMEBUFFER_SET_PALETTE hvf: arm: Do not advance PC when raising an exception hvf: arm: Properly disable PMU hvf: arm: Raise an exception for sysreg by default target/arm/kvm: Do not silently remove PMU target/arm/kvm: Set PMU for host only when available hw/arm/smmuv3: Assert input to oas2bits() is valid ... Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2024-07-30Merge tag 's390x-20240730' of https://github.com/davidhildenbrand/qemu into ↵Richard Henderson
staging s390x updates: - fixup for a s390x-only query-cpu-model-expansion extension # -----BEGIN PGP SIGNATURE----- # # iQJFBAABCAAvFiEEG9nKrXNcTDpGDfzKTd4Q9wD/g1oFAmaonmkRHGRhdmlkQHJl # ZGhhdC5jb20ACgkQTd4Q9wD/g1pCQBAAiHHoKssyl5xdEWid92OnpEK499xngBBS # zRJAZVmidnuTRbaAd0bB4rfwO13KKCwvWwKCjFG9tkH4QFTdXKnDzoLWTjy9Ytg3 # jB6L91sbMgySPBlXEqVkFh8WIkpVhcd9FVfSddw4QTnunyGAxTVNIhZFgBdVLXH3 # 2MLOd33FgkwiK+9gBKPccI/VBTmE2UX2EYrJ7gJOdB3AA5dSQxgQ4dxJEHaN/CcV # jHXLJ6Mcu6sz/qBxiiFcQvbepLSG3odBcuETL/pKcrk/H2YPKT6hIiWPNGFcVD0H # P36+rYo5Sr5KWOFbK4p8PPPnyDqYoOzmhwKTf+uO7sEHSSwiPexYJp6um6onTD3m # MNXl+5jahTePWdKXlJ6+j1DG0uKJnFobaj6P1HM3f37Douq/7fyxrcDuySLEdrSD # CutaQkdhr55WAlVPtmO3EuUc8eYxEGN4aEWSwtw9KWewF/vgq63Zos+p02Fi1mfN # gP8Fmz29gLAMkq57Y85zyMM2rYjfmE9Nt8Zzmnod2O9xuohwg7liqvVDfLo88g7X # czHSG0+O8TwXaanWIGAA4jgpfsNjxu7Qkx+jiB1uqLafj/wok/dOu5Teq3WU5t+i # vEHyI3CCfCH5q+ifNwe5vPQi4b1rZ0sT/cnYBpOhIs4Jroys1D3XXc0pHMJFJ7mz # CKka4wDf6aM= # =wSbp # -----END PGP SIGNATURE----- # gpg: Signature made Tue 30 Jul 2024 06:03:53 PM AEST # gpg: using RSA key 1BD9CAAD735C4C3A460DFCCA4DDE10F700FF835A # gpg: issuer "david@redhat.com" # gpg: Good signature from "David Hildenbrand <david@redhat.com>" [undefined] # gpg: aka "David Hildenbrand <davidhildenbrand@gmail.com>" [full] # gpg: aka "David Hildenbrand <hildenbr@in.tum.de>" [unknown] # gpg: WARNING: The key's User ID is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 1BD9 CAAD 735C 4C3A 460D FCCA 4DDE 10F7 00FF 835A * tag 's390x-20240730' of https://github.com/davidhildenbrand/qemu: target/s390x: move @deprecated-props to CpuModelExpansion Info Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2024-07-29target/s390x: move @deprecated-props to CpuModelExpansion InfoCollin Walling
CpuModelInfo is used both as command argument and in command returns. Its @deprecated-props array does not make any sense in arguments, and is silently ignored. We actually want it only as return value of query-cpu-model-expansion. Move it from CpuModelInfo to CpuModelExpansionType, and document its dependence on expansion type property. This was identified late during review [1] and we have to fix it up while it's not part of an official QEMU release yet. [1] https://lore.kernel.org/qemu-devel/20240719181741.35146-1-walling@linux.ibm.com/ Message-ID: <20240726203646.20279-1-walling@linux.ibm.com> Fixes: eed0e8ffa38f ("target/s390x: filter deprecated properties based on model expansion type") Signed-off-by: Collin Walling <walling@linux.ibm.com> [ david: - add "Fixes", adjust description, reference v3 instead - make property s390x-only and non-optional - fixup "populate" vs. "populated" ] Signed-off-by: David Hildenbrand <david@redhat.com>
2024-07-29target/sh4: Avoid shift into sign bit in update_itlb_use()Peter Maydell
In update_itlb_use() the variables or_mask and and_mask are uint8_t, which means that in expressions like "and_mask << 24" the usual C arithmetic conversions will result in the shift being done as a signed int type, and so we will shift into the sign bit. For QEMU this isn't undefined behaviour because we use -fwrapv; but we can avoid it anyway by using uint32_t types for or_mask and and_mask. Resolves: Coverity CID 1547628 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Yoshinori Sato <ysato@users.sourceforge.jp> Message-id: 20240723172431.1757296-1-peter.maydell@linaro.org
2024-07-29target/i386: Remove dead assignment to ss in do_interrupt64()Peter Maydell
Coverity points out that in do_interrupt64() in the "to inner privilege" codepath we set "ss = 0", but because we also set "new_stack = 1" there, later in the function we will always override that value of ss with "ss = 0 | dpl". Remove the unnecessary initialization of ss, which allows us to reduce the scope of the variable to only where it is used. Borrow a comment from helper_lcall_protected() that explains what "0 | dpl" means here. Resolves: Coverity CID 1527395 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-id: 20240723162525.1585743-1-peter.maydell@linaro.org
2024-07-29target/m68k: avoid shift into sign bit in dump_address_map()Peter Maydell
Coverity complains (CID 1547592) that in dump_address_map() we take a value stored in a signed integer variable 'i' and shift it by enough to shift into the sign bit when we construct the value 'logical'. This isn't a bug for QEMU because we use -fwrapv semantics, but we can make Coverity happy by using an unsigned type for the loop variables i, j, k in this function. While we're changing the declaration of the variables, put them in the for() loops so their scope is the minimum required (a style now permitted by our coding style guide). Resolves: Coverity CID 1547592 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-id: 20240723154207.1483665-1-peter.maydell@linaro.org
2024-07-29target/xtensa: Make use of 'segment' in pptlb helper less confusingPeter Maydell
Coverity gets confused about the use of the 'segment' variable in the pptlb helper function: it thinks that we can take a code path where we first initialize it: unsigned segment = XTENSA_MPU_PROBE_B; // 0x40000000 and then use that value as a shift count: } else if (nhits == 1 && (env->sregs[MPUENB] & (1u << segment))) { In fact this isn't possible, beacuse xtensa_mpu_lookup() is passed '&segment', and it uses that as an output value, which it will always set if it returns nonzero. But the way the code is currently written is confusing to a human reader as well as to Coverity. Instead of initializing 'segment' at the top of the function with a value that's only used in the "nhits == 0" code path, use the constant value directly in that code path, and don't initialize segment. This matches the way we use xtensa_mpu_lookup() in its other callsites in get_physical_addr_mpu(). Resolves: Coverity CID 1547589 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Acked-by: Max Filippov <jcmvbkbc@gmail.com> Message-id: 20240723151454.1396826-1-peter.maydell@linaro.org
2024-07-29target/tricore: Use unsigned types for bitops in helper_eq_b()Peter Maydell
Coverity points out that in helper_eq_b() we have an int32_t 'msk' and we end up shifting into its sign bit. This is OK for QEMU because we use -fwrapv to give this well defined semantics, but when you look at what this function is doing it's doing bit operations, so we should be using an unsigned variable anyway. This also matches the return type of the function. Make 'ret' and 'msk' uint32_t. Resolves: Coverity CID 1547758 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20240723151042.1396610-1-peter.maydell@linaro.org
2024-07-29target/arm: Ignore SMCR_EL2.LEN and SVCR_EL2.LEN if EL2 is not enabledPeter Maydell
When determining the current vector length, the SMCR_EL2.LEN and SVCR_EL2.LEN settings should only be considered if EL2 is enabled (compare the pseudocode CurrentSVL and CurrentNSVL which call EL2Enabled()). We were checking against ARM_FEATURE_EL2 rather than calling arm_is_el2_enabled(), which meant that we would look at SMCR_EL2/SVCR_EL2 when in Secure EL1 or Secure EL0 even if Secure EL2 was not enabled. Use the correct check in sve_vqm1_for_el_sm(). Cc: qemu-stable@nongnu.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20240722172957.1041231-5-peter.maydell@linaro.org
2024-07-29target/arm: Avoid shifts by -1 in tszimm_shr() and tszimm_shl()Peter Maydell
The function tszimm_esz() returns a shift amount, or possibly -1 in certain cases that correspond to unallocated encodings in the instruction set. We catch these later in the trans_ functions (generally with an "a-esz < 0" check), but before we do the decodetree-generated code will also call tszimm_shr() or tszimm_sl(), which will use the tszimm_esz() return value as a shift count without checking that it is not negative, which is undefined behaviour. Avoid the UB by checking the return value in tszimm_shr() and tszimm_shl(). Cc: qemu-stable@nongnu.org Resolves: Coverity CID 1547617, 1547694 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20240722172957.1041231-4-peter.maydell@linaro.org
2024-07-29target/arm: Fix UMOPA/UMOPS of 16-bit valuesPeter Maydell
The UMOPA/UMOPS instructions are supposed to multiply unsigned 8 or 16 bit elements and accumulate the products into a 64-bit element. In the Arm ARM pseudocode, this is done with the usual infinite-precision signed arithmetic. However our implementation doesn't quite get it right, because in the DEF_IMOP_64() macro we do: sum += (NTYPE)(n >> 0) * (MTYPE)(m >> 0); where NTYPE and MTYPE are uint16_t or int16_t. In the uint16_t case, the C usual arithmetic conversions mean the values are converted to "int" type and the multiply is done as a 32-bit multiply. This means that if the inputs are, for example, 0xffff and 0xffff then the result is 0xFFFE0001 as an int, which is then promoted to uint64_t for the accumulation into sum; this promotion incorrectly sign extends the multiply. Avoid the incorrect sign extension by casting to int64_t before the multiply, so we do the multiply as 64-bit signed arithmetic, which is a type large enough that the multiply can never overflow into the sign bit. (The equivalent 8-bit operations in DEF_IMOP_32() are fine, because the 8-bit multiplies can never overflow into the sign bit of a 32-bit integer.) Cc: qemu-stable@nongnu.org Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2372 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20240722172957.1041231-3-peter.maydell@linaro.org
2024-07-29target/arm: Don't assert for 128-bit tile accesses when SVL is 128Peter Maydell
For an instruction which accesses a 128-bit element tile when the SVL is also 128 (for example MOV z0.Q, p0/M, ZA0H.Q[w0,0]), we will assert in get_tile_rowcol(): qemu-system-aarch64: ../../tcg/tcg-op.c:926: tcg_gen_deposit_z_i32: Assertion `len > 0' failed. This happens because we calculate len = ctz32(streaming_vec_reg_size(s)) - esz;$ but if the SVL and the element size are the same len is 0, and the deposit operation asserts. In this case the ZA storage contains exactly one 128 bit element ZA tile, and the horizontal or vertical slice is just that tile. This means that regardless of the index value in the Ws register, we always access that tile. (In pseudocode terms, we calculate (index + offset) MOD 1, which is 0.) Special case the len == 0 case to avoid hitting the assertion in tcg_gen_deposit_z_i32(). Cc: qemu-stable@nongnu.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20240722172957.1041231-2-peter.maydell@linaro.org
generated by cgit v1.2.3 (git 2.26.2) at 2024-12-01 10:14:18 +0000