120845 Commits

Author SHA1 Message Date
Vitaly Kuznetsov
45f519950d docs/system: Add recommendations to Hyper-V enlightenments doc
While hyperv.rst already has all currently implemented Hyper-V
enlightenments documented, it may be unclear what is the recommended set to
achieve the best result. Add the corresponding section to the doc.

Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
Link: https://lore.kernel.org/r/20240917160051.2637594-5-vkuznets@redhat.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-10-17 12:30:21 +02:00
Vitaly Kuznetsov
d3177e2e43 target/i386: Make sure SynIC state is really updated before KVM_RUN
'hyperv_synic' test from KVM unittests was observed to be flaky on certain
hardware (hangs sometimes). Debugging shows that the problem happens in
hyperv_sint_route_new() when the test tries to set up a new SynIC
route. The function bails out on:

 if (!synic->sctl_enabled) {
         goto cleanup;
 }

but the test writes to HV_X64_MSR_SCONTROL just before it starts
establishing SINT routes. Further investigation shows that
synic_update() (called from async_synic_update()) happens after the SINT
setup attempt and not before. Apparently, the comment before
async_safe_run_on_cpu() in kvm_hv_handle_exit() does not correctly describe
the guarantees async_safe_run_on_cpu() gives. In particular, async worked
added to a CPU is actually processed from qemu_wait_io_event() which is not
always called before KVM_RUN, i.e. kvm_cpu_exec() checks whether an exit
request is pending for a CPU and if not, keeps running the vCPU until it
meets an exit it can't handle internally. Hyper-V specific MSR writes are
not automatically trigger an exit.

Fix the issue by simply raising an exit request for the vCPU where SynIC
update was queued. This is not a performance critical path as SynIC state
does not get updated so often (and async_safe_run_on_cpu() is a big hammer
anyways).

Reported-by: Jan Richter <jarichte@redhat.com>
Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
Link: https://lore.kernel.org/r/20240917160051.2637594-4-vkuznets@redhat.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-10-17 12:30:21 +02:00
Vitaly Kuznetsov
7d7b9c7655 target/i386: Exclude 'hv-syndbg' from 'hv-passthrough'
Windows with Hyper-V role enabled doesn't boot with 'hv-passthrough' when
no debugger is configured, this significantly limits the usefulness of the
feature as there's no support for subtracting Hyper-V features from CPU
flags at this moment (e.g. "-cpu host,hv-passthrough,-hv-syndbg" does not
work). While this is also theoretically fixable, 'hv-syndbg' is likely
very special and unneeded in the default set. Genuine Hyper-V doesn't seem
to enable it either.

Introduce 'skip_passthrough' flag to 'kvm_hyperv_properties' and use it as
one-off to skip 'hv-syndbg' when enabling features in 'hv-passthrough'
mode. Note, "-cpu host,hv-passthrough,hv-syndbg" can still be used if
needed.

As both 'hv-passthrough' and 'hv-syndbg' are debug features, the change
should not have any effect on production environments.

Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
Link: https://lore.kernel.org/r/20240917160051.2637594-3-vkuznets@redhat.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-10-17 12:30:21 +02:00
Vitaly Kuznetsov
bbf3810f2c target/i386: Fix conditional CONFIG_SYNDBG enablement
Putting HYPERV_FEAT_SYNDBG entry under "#ifdef CONFIG_SYNDBG" in
'kvm_hyperv_properties' array is wrong: as HYPERV_FEAT_SYNDBG is not
the highest feature number, the result is an empty (zeroed) entry in
the array (and not a skipped entry!). hyperv_feature_supported() is
designed to check that all CPUID bits are set but for a zeroed
feature in 'kvm_hyperv_properties' it returns 'true' so QEMU considers
HYPERV_FEAT_SYNDBG as always supported, regardless of whether KVM host
actually supports it.

To fix the issue, leave HYPERV_FEAT_SYNDBG's definition in
'kvm_hyperv_properties' array, there's nothing wrong in having it defined
even when 'CONFIG_SYNDBG' is not set. Instead, put "hv-syndbg" CPU property
under '#ifdef CONFIG_SYNDBG' to alter the existing behavior when the flag
is silently skipped in !CONFIG_SYNDBG builds.

Leave an 'assert' sentinel in hyperv_feature_supported() making sure there
are no 'holes' or improperly defined features in 'kvm_hyperv_properties'.

Fixes: d8701185f40c ("hw: hyperv: Initial commit for Synthetic Debugging device")
Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
Link: https://lore.kernel.org/r/20240917160051.2637594-2-vkuznets@redhat.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-10-17 12:30:21 +02:00
Gao Shiyuan
b5151ace58 target/i386: Add support save/load HWCR MSR
KVM commit 191c8137a939 ("x86/kvm: Implement HWCR support")
introduced support for emulating HWCR MSR.

Add support for QEMU to save/load this MSR for migration purposes.

Signed-off-by: Gao Shiyuan <gaoshiyuan@baidu.com>
Signed-off-by: Wang Liang <wangliang44@baidu.com>
Link: https://lore.kernel.org/r/20241009095109.66843-1-gaoshiyuan@baidu.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-10-17 12:30:21 +02:00
Chao Gao
10eaf9c0fb target/i386: Add more features enumerated by CPUID.7.2.EDX
Following 5 bits in CPUID.7.2.EDX are supported by KVM. Add their
supports in QEMU. Each of them indicates certain bits of IA32_SPEC_CTRL
are supported. Those bits can control CPU speculation behavior which can
be used to defend against side-channel attacks.

bit0: intel-psfd
  if 1, indicates bit 7 of the IA32_SPEC_CTRL MSR is supported. Bit 7 of
  this MSR disables Fast Store Forwarding Predictor without disabling
  Speculative Store Bypass

bit1: ipred-ctrl
  If 1, indicates bits 3 and 4 of the IA32_SPEC_CTRL MSR are supported.
  Bit 3 of this MSR enables IPRED_DIS control for CPL3. Bit 4 of this
  MSR enables IPRED_DIS control for CPL0/1/2

bit2: rrsba-ctrl
  If 1, indicates bits 5 and 6 of the IA32_SPEC_CTRL MSR are supported.
  Bit 5 of this MSR disables RRSBA behavior for CPL3. Bit 6 of this MSR
  disables RRSBA behavior for CPL0/1/2

bit3: ddpd-u
  If 1, indicates bit 8 of the IA32_SPEC_CTRL MSR is supported. Bit 8 of
  this MSR disables Data Dependent Prefetcher.

bit4: bhi-ctrl
  if 1, indicates bit 10 of the IA32_SPEC_CTRL MSR is supported. Bit 10
  of this MSR enables BHI_DIS_S behavior.

Signed-off-by: Chao Gao <chao.gao@intel.com>
Link: https://lore.kernel.org/r/20240919051011.118309-1-chao.gao@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-10-17 12:30:21 +02:00
Xiaoyao Li
87c88db314 target/i386: Make invtsc migratable when user sets tsc-khz explicitly
When user sets tsc-frequency explicitly, the invtsc feature is actually
migratable because the tsc-frequency is supposed to be fixed during the
migration.

See commit d99569d9d856 ("kvm: Allow invtsc migration if tsc-khz
is set explicitly") for referrence.

Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Link: https://lore.kernel.org/r/20240814075431.339209-10-xiaoyao.li@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-10-17 12:30:21 +02:00
Xiaoyao Li
5ab639141b target/i386: Construct CPUID 2 as stateful iff times > 1
When times == 1, the CPUID leaf 2 is not stateful.

Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Link: https://lore.kernel.org/r/20240814075431.339209-6-xiaoyao.li@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-10-17 12:30:21 +02:00
Xiaoyao Li
7dddc3bb87 target/i386: Enable fdp-excptn-only and zero-fcs-fds
- CPUID.(EAX=07H,ECX=0H):EBX[bit 6]: x87 FPU Data Pointer updated only
  on x87 exceptions if 1.

- CPUID.(EAX=07H,ECX=0H):EBX[bit 13]: Deprecates FPU CS and FPU DS
  values if 1. i.e., X87 FCS and FDS are always zero.

Define names for them so that they can be exposed to guest with -cpu host.

Also define the bit field MACROs so that named cpu models can add it as
well in the future.

Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Link: https://lore.kernel.org/r/20240814075431.339209-3-xiaoyao.li@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-10-17 12:30:21 +02:00
Xiaoyao Li
00c8a933d9 target/i386: Don't construct a all-zero entry for CPUID[0xD 0x3f]
Currently, QEMU always constructs a all-zero CPUID entry for
CPUID[0xD 0x3f].

It's meaningless to construct such a leaf as the end of leaf 0xD. Rework
the logic of how subleaves of 0xD are constructed to get rid of such
all-zero value of subleaf 0x3f.

Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Link: https://lore.kernel.org/r/20240814075431.339209-2-xiaoyao.li@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-10-17 12:30:20 +02:00
Peter Maydell
08ae519ab8 Remove some target-specific endianness knowledge from target/.
For MIPS, propagate endianness at the board level, using QOM property.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEE+qvnXhKRciHc/Wuy4+MsLN6twN4FAmcOihcACgkQ4+MsLN6t
 wN4VaRAAor+5gUJiV0OOMQVfP8e1o9ssKcYy9m31zLeii1Iq2M/2oz6YK4OjdQDe
 oJ8VRJvBPKC2Bpi14TfKsSGaP8CGNO/hdxcMi71pjHZC+bjHt5Uv0U/7T4XCBWuV
 N+85juN1PTc4cci4FkGIXaPB1YWL00L56BDCzja0uhLF4+Xe2eYGVrPXeFCkN/3I
 Ky7jHlB/dgzc47kTXvg5snCee2egDFf/x4igwZj6+gWJyo+jubRpwoOqKbK2M0Nd
 VvNpBVFNGZMP3Fn9lh45uDOuRWGu6zSIPBVkjoFc+wdGsFsITIMrZ3h46UffsGTJ
 F1j6Zsq6hoLbaNRRjZ6OsN6u683oo1lknmWauD62LrjXcX0RlRwRFbMD0AjedR8t
 6+YHg5LlwGg6r/AOtEe28ggXZohB2vjr2V0MJm1x/XgLYhFHoN3//jxn22oOHj4p
 0z3+eDc3Se8JNRV6jPMHbbuTqZqZjRgVFbYN3aMbdoXYzhpYnrPj6f7WQL2smiAW
 C2vdswrubQWKou1wcn6rbg0nnMRVTh+GxrtZ3mkgaxNzgNFxsrX8YubMsh77XUcr
 mnCGj1tE3hp40xsuSk6yZXY3ZZiTyZasvO1wq4gWOI9le0Zmq+d335F9+IVJ8RlP
 YhA+MY5aeomsixVRdmrPrgOfanQiHXv02lsbperU8QFfGRhf2Y8=
 =Qydb
 -----END PGP SIGNATURE-----

Merge tag 'single-binary-20241015' of https://github.com/philmd/qemu into staging

Remove some target-specific endianness knowledge from target/.

For MIPS, propagate endianness at the board level, using QOM property.

# -----BEGIN PGP SIGNATURE-----
#
# iQIzBAABCAAdFiEE+qvnXhKRciHc/Wuy4+MsLN6twN4FAmcOihcACgkQ4+MsLN6t
# wN4VaRAAor+5gUJiV0OOMQVfP8e1o9ssKcYy9m31zLeii1Iq2M/2oz6YK4OjdQDe
# oJ8VRJvBPKC2Bpi14TfKsSGaP8CGNO/hdxcMi71pjHZC+bjHt5Uv0U/7T4XCBWuV
# N+85juN1PTc4cci4FkGIXaPB1YWL00L56BDCzja0uhLF4+Xe2eYGVrPXeFCkN/3I
# Ky7jHlB/dgzc47kTXvg5snCee2egDFf/x4igwZj6+gWJyo+jubRpwoOqKbK2M0Nd
# VvNpBVFNGZMP3Fn9lh45uDOuRWGu6zSIPBVkjoFc+wdGsFsITIMrZ3h46UffsGTJ
# F1j6Zsq6hoLbaNRRjZ6OsN6u683oo1lknmWauD62LrjXcX0RlRwRFbMD0AjedR8t
# 6+YHg5LlwGg6r/AOtEe28ggXZohB2vjr2V0MJm1x/XgLYhFHoN3//jxn22oOHj4p
# 0z3+eDc3Se8JNRV6jPMHbbuTqZqZjRgVFbYN3aMbdoXYzhpYnrPj6f7WQL2smiAW
# C2vdswrubQWKou1wcn6rbg0nnMRVTh+GxrtZ3mkgaxNzgNFxsrX8YubMsh77XUcr
# mnCGj1tE3hp40xsuSk6yZXY3ZZiTyZasvO1wq4gWOI9le0Zmq+d335F9+IVJ8RlP
# YhA+MY5aeomsixVRdmrPrgOfanQiHXv02lsbperU8QFfGRhf2Y8=
# =Qydb
# -----END PGP SIGNATURE-----
# gpg: Signature made Tue 15 Oct 2024 16:28:23 BST
# gpg:                using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE
# gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <f4bug@amsat.org>" [full]
# Primary key fingerprint: FAAB E75E 1291 7221 DCFD  6BB2 E3E3 2C2C DEAD C0DE

* tag 'single-binary-20241015' of https://github.com/philmd/qemu: (33 commits)
  hw/mips: Have mips_cpu_create_with_clock() take an endianness argument
  hw/mips/cps: Set the vCPU 'cpu-big-endian' property
  target/mips: Expose MIPSCPU::is_big_endian property
  target/mips: Use tcg_constant_tl() instead of tcg_gen_movi_tl()
  target/mips: Use gen_op_addr_addi() when possible
  target/mips: Have gen_addiupc() expand $pc during translation
  target/mips: Replace MO_TE by mo_endian()
  target/mips: Introduce mo_endian() helper
  target/mips: Remove unused MEMOP_IDX() macro
  target/mips: Rename unused sysemu argument of OP_LD_ATOMIC()
  target/mips: Explode MO_TExx -> MO_TE | MO_xx
  target/mips: Factor mo_endian_rev() out of MXU code
  target/mips: Convert mips16e decr_and_load/store() macros to functions
  target/mips: Replace MO_TE by  mo_endian_env() in get_pte()
  target/mips: Introduce mo_endian_env() helper
  target/mips: Rename cpu_is_bigendian() -> disas_is_bigendian()
  target/mips: Declare mips_env_is_bigendian() in 'internal.h'
  hw/xtensa/xtfpga: Remove TARGET_BIG_ENDIAN #ifdef'ry
  target/ppc: Use tcg_constant_tl() instead of tcg_gen_movi_tl()
  target/tricore: Use tcg_constant_tl() instead of tcg_gen_movi_tl()
  ...

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2024-10-16 20:22:08 +01:00
Yufei Li
c3c9c21285
Add comparison hooks for RISCV (#78)
* Add comparison hooks for RISCV
2024-10-16 12:03:00 +02:00
Marc-André Lureau
01fff50626 ui/dbus: fix filtering all update messages
Filtering pending messages when a new scanout is given shouldn't discard
pending cursor changes, for example.

Since filtering happens in a different thread, use atomic set/get.

Fixes: fa88b85dea ("ui/dbus: filter out pending messages when scanout")

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Message-ID: <20241008125028.1177932-6-marcandre.lureau@redhat.com>
(cherry picked from commit cf59889781297a5618f1735a5f31402caa806b42)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2024-10-16 11:16:00 +03:00
Marc-André Lureau
e1324ec946 ui/win32: fix potential use-after-free with dbus shared memory
DisplaySurface may be free before the pixman image is freed, since the
image is refcounted and used by different objects, including pending
dbus messages.

Furthermore, setting the destroy function in
create_displaysurface_from() isn't appropriate, as it may not be used,
and may be overriden as in ramfb.

Set the destroy function when the shared handle is set, use the HANDLE
directly for destroy data, using a single common helper
qemu_pixman_win32_image_destroy().

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Message-ID: <20241008125028.1177932-5-marcandre.lureau@redhat.com>
(cherry picked from commit 330ef31deb2e5461cff907488b710f5bd9cd2327)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2024-10-16 11:15:04 +03:00
Marc-André Lureau
9391f419c7 ui/dbus: fix leak on message filtering
A filter function that wants to drop a message should return NULL, in
which case it must also unref the message itself.

Fixes: fa88b85de ("ui/dbus: filter out pending messages when scanout")

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Message-ID: <20241008125028.1177932-4-marcandre.lureau@redhat.com>
(cherry picked from commit 244d52ff736fefc3dd364ed091720aa896af306d)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2024-10-16 11:14:35 +03:00
Marc-André Lureau
6d03242a7e hw/audio/hda: fix memory leak on audio setup
When SET_STREAM_FORMAT is called, we should clear the existing setup.

Factor out common function to close a stream.

Direct leak of 144 byte(s) in 3 object(s) allocated from:
    #0 0x7f91d38f7350 in calloc (/lib64/libasan.so.8+0xf7350) (BuildId: a4ad7eb954b390cf00f07fa10952988a41d9fc7a)
    #1 0x7f91d2ab7871 in g_malloc0 (/lib64/libglib-2.0.so.0+0x64871) (BuildId: 36b60dbd02e796145a982d0151ce37202ec05649)
    #2 0x562fa2f447ee in timer_new_full /home/elmarco/src/qemu/include/qemu/timer.h:538
    #3 0x562fa2f4486f in timer_new /home/elmarco/src/qemu/include/qemu/timer.h:559
    #4 0x562fa2f448a9 in timer_new_ns /home/elmarco/src/qemu/include/qemu/timer.h:577
    #5 0x562fa2f47955 in hda_audio_setup ../hw/audio/hda-codec.c:490
    #6 0x562fa2f4897e in hda_audio_command ../hw/audio/hda-codec.c:605

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Message-ID: <20241008125028.1177932-3-marcandre.lureau@redhat.com>
(cherry picked from commit 6d6e23361fc732e4fe36a8bc5873b85f264ed53a)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2024-10-16 11:14:24 +03:00
Marc-André Lureau
2787ca0e0a hw/audio/hda: free timer on exit
Fixes: 280c1e1cd ("audio/hda: create millisecond timers that handle IO")

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Message-ID: <20241008125028.1177932-2-marcandre.lureau@redhat.com>
(cherry picked from commit f27206ceedbe2efae37c8d143c5eb2db05251508)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2024-10-16 11:14:04 +03:00
Philippe Mathieu-Daudé
e376c2d87c hw/loongarch/fw_cfg: Build in common_ss[]
Nothing in LoongArch fw_cfg.c requires target specific definitions.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Song Gao <gaosong@loongson.cn>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-Id: <20240927213254.17552-3-philmd@linaro.org>
Signed-off-by: Song Gao <gaosong@loongson.cn>
2024-10-16 16:06:07 +08:00
Philippe Mathieu-Daudé
25d92888b2 hw/loongarch/virt: Remove unnecessary 'cpu.h' inclusion
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Song Gao <gaosong@loongson.cn>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-Id: <20240927213254.17552-2-philmd@linaro.org>
Signed-off-by: Song Gao <gaosong@loongson.cn>
2024-10-16 16:03:13 +08:00
Bibo Mao
4521167f57 target/loongarch: Avoid bits shift exceeding width of bool type
Variable env->cf[i] is defined as bool type, it is treated as int type
with shift operation. However the max possible width is 56 for the shift
operation, exceeding the width of int type. And there is existing api
read_fcc() which is converted to u64 type with bitwise shift, it can be
used to dump fp registers into coredump note segment.

Resolves: Coverity CID 1561133
Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20240914064645.2099169-1-maobibo@loongson.cn>
Signed-off-by: Song Gao <gaosong@loongson.cn>
2024-10-16 15:56:42 +08:00
Bibo Mao
e1ecdc630d hw/loongarch/virt: Add FDT table support with acpi ged pm register
ACPI ged is used for power management on LoongArch virt platform, in
general it is parsed from acpi table. However if system boot directly from
elf kernel, no UEFI bios is provided and acpi table cannot be used also.

Here acpi ged pm register is exposed with FDT table, it is compatbile
with syscon method in FDT table, only that acpi ged pm register is accessed
with 8-bit mode, rather with 32-bit mode.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Song Gao <gaosong@loongson.cn>
Tested-by: Song Gao <gaosong@loongson.cn>
Message-Id: <20240918014206.2165821-3-maobibo@loongson.cn>
Signed-off-by: Song Gao <gaosong@loongson.cn>
2024-10-16 15:56:42 +08:00
Bibo Mao
edafc90ba4 acpi: ged: Add macro for acpi sleep control register
Macro definition is added for acpi sleep control register, ged emulation
driver can use the macro , also it can be used in FDT table if ged is
exposed with FDT table.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Message-Id: <20240918014206.2165821-2-maobibo@loongson.cn>
Signed-off-by: Song Gao <gaosong@loongson.cn>
2024-10-16 15:56:42 +08:00
Peter Maydell
10e3edd9b3 hw/char/pl011: Use correct masks for IBRD and FBRD
In commit b88cfee90268cad we defined masks for the IBRD and FBRD
integer and fractional baud rate divider registers, to prevent the
guest from writing invalid values which could cause division-by-zero.
Unfortunately we got the mask values the wrong way around: the FBRD
register is six bits and the IBRD register is 16 bits, not
vice-versa.

You would only run into this bug if you programmed the UART to a baud
rate of less than 9600, because for 9600 baud and above the IBRD
value will fit into 6 bits, as per the table in
 https://developer.arm.com/documentation/ddi0183/g/programmers-model/register-descriptions/fractional-baud-rate-register--uartfbrd

The only visible effects would be that the value read back from
the register by the guest would be truncated, and we would
print an incorrect baud rate in the debug logs.

Cc: qemu-stable@nongnu.org
Fixes: b88cfee90268 ("hw/char/pl011: Avoid division-by-zero in pl011_get_baudrate()")
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2610
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Gavin Shan <gshan@redhat.com>
Message-id: 20241007144732.2491331-1-peter.maydell@linaro.org
(cherry picked from commit cd247eae16ab1b9ce97fd34c000c1b883feeda45)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2024-10-15 20:33:06 +03:00
Alexandra Diupina
460ddd62fa hw/intc/arm_gicv3_cpuif: Add cast to match the documentation
The result of 1 << regbit with regbit==31 has a 1 in the 32nd bit.
When cast to uint64_t (for further bitwise OR), the 32 most
significant bits will be filled with 1s. However, the documentation
states that the upper 32 bits of ICH_AP[0/1]R<n>_EL2 are reserved.

Add an explicit cast to match the documentation.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Cc: qemu-stable@nongnu.org
Fixes: c3f21b065a ("hw/intc/arm_gicv3_cpuif: Support vLPIs")
Signed-off-by: Alexandra Diupina <adiupina@astralinux.ru>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
(cherry picked from commit 3db74afec3ca87f81fbdf5918ed1e21d837fbfab)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2024-10-15 19:40:40 +03:00
Alexandra Diupina
6fecfc5978 hw/intc/arm_gicv3: Add cast to match the documentation
The result of 1 << regbit with regbit==31 has a 1 in the 32nd bit.
When cast to uint64_t (for further bitwise OR), the 32 most
significant bits will be filled with 1s. However, the documentation
states that the upper 32 bits of ICC_AP[0/1]R<n>_EL2 are reserved.

Add an explicit cast to match the documentation.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Cc: qemu-stable@nongnu.org
Fixes: 28cca59c46 ("hw/intc/arm_gicv3: Add NMI handling CPU interface registers")
Signed-off-by: Alexandra Diupina <adiupina@astralinux.ru>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
(cherry picked from commit 12dc8f6eca1ead876142fd3d6731cf3da1295f2a)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2024-10-15 19:40:19 +03:00
Alexandra Diupina
c5f652a053 hw/intc/arm_gicv3: Add cast to match the documentation
The result of 1 << regbit with regbit==31 has a 1 in the 32nd bit.
When cast to uint64_t (for further bitwise OR), the 32 most
significant bits will be filled with 1s. However, the documentation
states that the upper 32 bits of ICH_AP[0/1]R<n>_EL2 are reserved.

Add an explicit cast to match the documentation.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Cc: qemu-stable@nongnu.org
Fixes: d2c0c6aab6 ("hw/intc/arm_gicv3: Handle icv_nmiar1_read() for icc_nmiar1_read()")
Signed-off-by: Alexandra Diupina <adiupina@astralinux.ru>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
(cherry picked from commit e0c0ea6eca4f210a52b9742817586cc97b1ee434)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2024-10-15 19:39:58 +03:00
Philippe Mathieu-Daudé
3e8f019be7 hw/mips: Have mips_cpu_create_with_clock() take an endianness argument
mips_cpu_create_with_clock() creates a vCPU. Pass it the vCPU
endianness requested by argument. Update the board call sites.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Jiaxun Yang <jiaxun.yang@flygoat.com>
Tested-by: Jiaxun Yang <jiaxun.yang@flygoat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20241010215015.44326-17-philmd@linaro.org>
2024-10-15 12:21:06 -03:00
Philippe Mathieu-Daudé
805659a895 hw/mips/cps: Set the vCPU 'cpu-big-endian' property
Have the CPS expose a 'cpu-big-endian' property so it can
set it to the vCPUs it creates.
Note, since the number of vCPUs created is dynamic, we can
not use QOM aliases.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Jiaxun Yang <jiaxun.yang@flygoat.com>
Tested-by: Jiaxun Yang <jiaxun.yang@flygoat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20241010215015.44326-16-philmd@linaro.org>
2024-10-15 12:21:06 -03:00
Philippe Mathieu-Daudé
d70e58958d target/mips: Expose MIPSCPU::is_big_endian property
Add the "big-endian" property and set the CP0C0_BE bit in CP0_Config0.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Jiaxun Yang <jiaxun.yang@flygoat.com>
Tested-by: Jiaxun Yang <jiaxun.yang@flygoat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20241010215015.44326-15-philmd@linaro.org>
2024-10-15 12:21:06 -03:00
Philippe Mathieu-Daudé
35845cf8fe target/mips: Use tcg_constant_tl() instead of tcg_gen_movi_tl()
Directly use tcg_constant_tl() for constant integer, this
save a call to tcg_gen_movi_tl(), often saving a temp register.

Most of the places found using the following Coccinelle spatch script:

  @@
  identifier tmp;
  constant val;
  @@
  *    TCGv tmp = tcg_temp_new();
       ...
  *    tcg_gen_movi_tl(tmp, val);

  @@
  identifier tmp;
  int val;
  @@
  *    TCGv tmp = tcg_temp_new();
       ...
  *    tcg_gen_movi_i64(tmp, val);

Suggested-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20241004202621.4321-2-philmd@linaro.org>
2024-10-15 12:21:04 -03:00
Philippe Mathieu-Daudé
d0b24b7f50 target/mips: Use gen_op_addr_addi() when possible
Replace tcg_gen_movi_tl() + gen_op_addr_add() by a single
gen_op_addr_addi() call.

gen_op_addr_addi() calls tcg_gen_addi_tl() which might
optimize if the immediate is zero.

Suggested-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20241010215015.44326-13-philmd@linaro.org>
2024-10-15 12:18:10 -03:00
Philippe Mathieu-Daudé
de0029664f target/mips: Have gen_addiupc() expand $pc during translation
Suggested-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20241010215015.44326-12-philmd@linaro.org>
2024-10-15 12:18:10 -03:00
Philippe Mathieu-Daudé
2803e24694 target/mips: Replace MO_TE by mo_endian()
Replace compile-time MO_TE evaluation by runtime mo_endian() one,
which expand target endianness from DisasContext.

Mechanical change using:

  $ sed -i -e 's/MO_TE/mo_endian(ctx)/' \
     $(git grep -l MO_TE target/mips)

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Jiaxun Yang <jiaxun.yang@flygoat.com>
Tested-by: Jiaxun Yang <jiaxun.yang@flygoat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20241010215015.44326-11-philmd@linaro.org>
2024-10-15 12:18:09 -03:00
Philippe Mathieu-Daudé
96ccd8534f target/mips: Introduce mo_endian() helper
Introduce mo_endian() which returns the endian MemOp
corresponding to the vCPU DisasContext.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Jiaxun Yang <jiaxun.yang@flygoat.com>
Tested-by: Jiaxun Yang <jiaxun.yang@flygoat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20241010215015.44326-10-philmd@linaro.org>
2024-10-15 12:16:28 -03:00
Philippe Mathieu-Daudé
d74fbe0fbd target/mips: Remove unused MEMOP_IDX() macro
MEMOP_IDX() is unused since commit 948f88661c6 ("target/mips:
Use cpu_*_data_ra for msa load/store"), remove it.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20241014232235.51988-1-philmd@linaro.org>
2024-10-15 12:16:28 -03:00
Philippe Mathieu-Daudé
a6f8e0ae5a target/mips: Rename unused sysemu argument of OP_LD_ATOMIC()
In commit 6d0cad12594 ("target/mips: Finish conversion to
tcg_gen_qemu_{ld,st}_*") we renamed the argument of the user
definition. Rename the system part for coherency. Since the
argument is ignored, prefix with 'ignored_'.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20241010215015.44326-9-philmd@linaro.org>
2024-10-15 12:16:28 -03:00
Philippe Mathieu-Daudé
89b59d8699 target/mips: Explode MO_TExx -> MO_TE | MO_xx
Extract the implicit MO_TE definition in order to replace
it by runtime variable in the next commit.

Mechanical change using:

  $ for n in UW UL UQ UO SW SL SQ; do \
      sed -i -e "s/MO_TE$n/MO_TE | MO_$n/" \
           $(git grep -l MO_TE$n target/mips); \
    done

manually remove superfluous parenthesis in nanoMIPS gen_save().

Reviewed-by: Jiaxun Yang <jiaxun.yang@flygoat.com>
Tested-by: Jiaxun Yang <jiaxun.yang@flygoat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20241010215015.44326-8-philmd@linaro.org>
2024-10-15 12:16:25 -03:00
Philippe Mathieu-Daudé
e9c26e7740 target/mips: Factor mo_endian_rev() out of MXU code
Instead of swapping the reversed target endianness
using MO_BSWAP, directly return the correct endianness.

Suggested-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20241010215015.44326-7-philmd@linaro.org>
2024-10-15 12:13:59 -03:00
Philippe Mathieu-Daudé
54821ff6e9 target/mips: Convert mips16e decr_and_load/store() macros to functions
Functions are easier to rework than macros. Besides,
there is no gain here in inlining these.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Jiaxun Yang <jiaxun.yang@flygoat.com>
Tested-by: Jiaxun Yang <jiaxun.yang@flygoat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20241010215015.44326-6-philmd@linaro.org>
2024-10-15 12:13:59 -03:00
Philippe Mathieu-Daudé
2cf8226fcd target/mips: Replace MO_TE by mo_endian_env() in get_pte()
Replace compile-time MO_TE evaluation by runtime mo_endian_env()
one, which expand target endianness from vCPU env.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Jiaxun Yang <jiaxun.yang@flygoat.com>
Tested-by: Jiaxun Yang <jiaxun.yang@flygoat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20241010215015.44326-5-philmd@linaro.org>
2024-10-15 12:13:59 -03:00
Philippe Mathieu-Daudé
3e10be7579 target/mips: Introduce mo_endian_env() helper
Introduce mo_endian_env() which returns the endian
MemOp corresponding to the vCPU env.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Jiaxun Yang <jiaxun.yang@flygoat.com>
Tested-by: Jiaxun Yang <jiaxun.yang@flygoat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20241010215015.44326-4-philmd@linaro.org>
2024-10-15 12:13:59 -03:00
Philippe Mathieu-Daudé
e99072b6ec target/mips: Rename cpu_is_bigendian() -> disas_is_bigendian()
Methods using the 'cpu_' prefix usually take a (Arch)CPUState
argument. Since this method takes a DisasContext argument,
rename it as disas_is_bigendian().

Suggested-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20241010215015.44326-3-philmd@linaro.org>
2024-10-15 12:13:59 -03:00
Philippe Mathieu-Daudé
5375bc1674 target/mips: Declare mips_env_is_bigendian() in 'internal.h'
In order to re-use cpu_is_bigendian(), declare it on "internal.h"
after renaming it as mips_env_is_bigendian().

Reviewed-by: Jiaxun Yang <jiaxun.yang@flygoat.com>
Tested-by: Jiaxun Yang <jiaxun.yang@flygoat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20241010215015.44326-2-philmd@linaro.org>
2024-10-15 12:13:59 -03:00
Philippe Mathieu-Daudé
dc696c6c34 hw/xtensa/xtfpga: Remove TARGET_BIG_ENDIAN #ifdef'ry
Move code evaluation from preprocessor to compiler so
both if() ladders are processed. Mostly style change.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-Id: <20240930073450.33195-8-philmd@linaro.org>
2024-10-15 12:13:59 -03:00
Philippe Mathieu-Daudé
cebf9b0da2 target/ppc: Use tcg_constant_tl() instead of tcg_gen_movi_tl()
Directly use tcg_constant_tl() for constant integer,
this save a call to tcg_gen_movi_tl() and a temp register.

Inspired-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20241004202621.4321-4-philmd@linaro.org>
2024-10-15 12:13:59 -03:00
Philippe Mathieu-Daudé
96ce24da68 target/tricore: Use tcg_constant_tl() instead of tcg_gen_movi_tl()
Directly use tcg_constant_tl() for constant integer,
this save a call to tcg_gen_movi_tl().

Inspired-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20241004202621.4321-3-philmd@linaro.org>
2024-10-15 12:13:59 -03:00
Philippe Mathieu-Daudé
e01e1c7e2e target/tricore: Use explicit little-endian LD/ST API
The TriCore architecture uses little endianness. Directly use
the little-endian LD/ST API.

Mechanical change using:

  $ end=le; \
    for acc in uw w l q tul; do \
      sed -i -e "s/ld${acc}_p(/ld${acc}_${end}_p(/" \
             -e "s/st${acc}_p(/st${acc}_${end}_p(/" \
        $(git grep -wlE '(ld|st)t?u?[wlq]_p' target/tricore/); \
    done

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20241004163042.85922-15-philmd@linaro.org>
2024-10-15 12:13:59 -03:00
Philippe Mathieu-Daudé
2a99b2af2c target/loongarch: Use explicit little-endian LD/ST API
The LoongArch architecture uses little endianness. Directly
use the little-endian LD/ST API.

Mechanical change using:

  $ end=le; \
    for acc in uw w l q tul; do \
      sed -i -e "s/ld${acc}_p(/ld${acc}_${end}_p(/" \
             -e "s/st${acc}_p(/st${acc}_${end}_p(/" \
        $(git grep -wlE '(ld|st)t?u?[wlq]_p' target/loongarch/); \
    done

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20241004163042.85922-13-philmd@linaro.org>
2024-10-15 12:13:59 -03:00
Philippe Mathieu-Daudé
eed4e3d4c6 linux-user/i386: Use explicit little-endian LD/ST API
The x86 architecture uses little endianness. Directly use
the little-endian LD/ST API.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-Id: <20241003234211.53644-4-philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
2024-10-15 12:13:59 -03:00
Philippe Mathieu-Daudé
186f19cf46 target/avr: Use explicit little-endian LD/ST API
The AVR architecture uses little endianness. Directly use
the little-endian LD/ST API.

Mechanical change using:

  $ end=le; \
    for acc in uw w l q tul; do \
      sed -i -e "s/ld${acc}_p(/ld${acc}_${end}_p(/" \
             -e "s/st${acc}_p(/st${acc}_${end}_p(/" \
        $(git grep -wlE '(ld|st)t?u?[wlq]_p' target/avr/); \
    done

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20241004163042.85922-11-philmd@linaro.org>
2024-10-15 12:13:59 -03:00