summary refs log tree commit diff stats
path: root/include/hw/core/cpu.h (follow)
Commit message (Collapse)AuthorAgeFilesLines
* physmem: Destroy all CPU AddressSpaces on unrealizePeter Maydell2025-10-031-1/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When we unrealize a CPU object (which happens on vCPU hot-unplug), we should destroy all the AddressSpace objects we created via calls to cpu_address_space_init() when the CPU was realized. Commit 24bec42f3d6eae added a function to do this for a specific AddressSpace, but did not add any places where the function was called. Since we always want to destroy all the AddressSpaces on unrealize, regardless of the target architecture, we don't need to try to keep track of how many are still undestroyed, or make the target architecture code manually call a destroy function for each AS it created. Instead we can adjust the function to always completely destroy the whole cpu->ases array, and arrange for it to be called during CPU unrealize as part of the common code. Without this fix, AddressSanitizer will report a leak like this from a run where we hot-plugged and then hot-unplugged an x86 KVM vCPU: Direct leak of 416 byte(s) in 1 object(s) allocated from: #0 0x5b638565053d in calloc (/data_nvme1n1/linaro/qemu-from-laptop/qemu/build/x86-tgts-asan/qemu-system-x86_64+0x1ee153d) (BuildId: c1cd6022b195142106e1bffeca23498c2b752bca) #1 0x7c28083f77b1 in g_malloc0 (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x637b1) (BuildId: 1eb6131419edb83b2178b682829a6913cf682d75) #2 0x5b6386999c7c in cpu_address_space_init /data_nvme1n1/linaro/qemu-from-laptop/qemu/build/x86-tgts-asan/../../system/physmem.c:797:25 #3 0x5b638727f049 in kvm_cpu_realizefn /data_nvme1n1/linaro/qemu-from-laptop/qemu/build/x86-tgts-asan/../../target/i386/kvm/kvm-cpu.c:102:5 #4 0x5b6385745f40 in accel_cpu_common_realize /data_nvme1n1/linaro/qemu-from-laptop/qemu/build/x86-tgts-asan/../../accel/accel-common.c:101:13 #5 0x5b638568fe3c in cpu_exec_realizefn /data_nvme1n1/linaro/qemu-from-laptop/qemu/build/x86-tgts-asan/../../hw/core/cpu-common.c:232:10 #6 0x5b63874a2cd5 in x86_cpu_realizefn /data_nvme1n1/linaro/qemu-from-laptop/qemu/build/x86-tgts-asan/../../target/i386/cpu.c:9321:5 #7 0x5b6387a0469a in device_set_realized /data_nvme1n1/linaro/qemu-from-laptop/qemu/build/x86-tgts-asan/../../hw/core/qdev.c:494:13 #8 0x5b6387a27d9e in property_set_bool /data_nvme1n1/linaro/qemu-from-laptop/qemu/build/x86-tgts-asan/../../qom/object.c:2375:5 #9 0x5b6387a2090b in object_property_set /data_nvme1n1/linaro/qemu-from-laptop/qemu/build/x86-tgts-asan/../../qom/object.c:1450:5 #10 0x5b6387a35b05 in object_property_set_qobject /data_nvme1n1/linaro/qemu-from-laptop/qemu/build/x86-tgts-asan/../../qom/qom-qobject.c:28:10 #11 0x5b6387a21739 in object_property_set_bool /data_nvme1n1/linaro/qemu-from-laptop/qemu/build/x86-tgts-asan/../../qom/object.c:1520:15 #12 0x5b63879fe510 in qdev_realize /data_nvme1n1/linaro/qemu-from-laptop/qemu/build/x86-tgts-asan/../../hw/core/qdev.c:276:12 Cc: qemu-stable@nongnu.org Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2517 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: David Hildenbrand <david@redhat.com> Link: https://lore.kernel.org/r/20250929144228.1994037-4-peter.maydell@linaro.org Signed-off-by: Peter Xu <peterx@redhat.com>
* include/hw/core/cpu: Invert the indexing into CPUTLBDescFastRichard Henderson2025-09-231-1/+10
| | | | | | | | | | | | | | | | This array is within CPUNegativeOffsetState, which means the last element of the array has an offset from env with the smallest magnitude. This can be encoded into fewer bits when generating TCG fast path memory references. When we changed the NB_MMU_MODES to be a global constant, rather than a per-target value, we pessimized the code generated for targets which use only a few mmu indexes. By inverting the array index, we counteract that. Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
* include/hw/core/cpu: Introduce cpu_tlb_fastRichard Henderson2025-09-231-0/+7
| | | | | | | | Encapsulate access to cpu->neg.tlb.f[] in a function. Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
* include/hw/core/cpu: Introduce MMUIdxMapRichard Henderson2025-09-231-3/+3
| | | | | | | | | Use a typedef instead of uint16_t directly when describing sets of mmu indexes. Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
* bsd-user, linux-user: introduce qemu_process_cpu_eventsPaolo Bonzini2025-09-171-0/+9
| | | | | | | | | Add a user-mode emulation version of the function. More will be added later, for now it is just process_queued_cpu_work. Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* treewide: rename qemu_wait_io_event/qemu_wait_io_event_commonPaolo Bonzini2025-09-171-1/+1
| | | | | | | | Do so before extending it to the user-mode emulators, where there is no such thing as an "I/O thread". Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* accel: use atomic accesses for exit_requestPaolo Bonzini2025-09-171-0/+9
| | | | | | | | | | | | | | | CPU threads write exit_request as a "note to self" that they need to go out to a slow path. This write happens out of the BQL and can be a data race with another threads' cpu_exit(); use atomic accesses consistently. While at it, change the source argument from int ("1") to bool ("true"). Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Peter Xu <peterx@redhat.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* cpus: document that qemu_cpu_kick() can be used for BQL-less operationPaolo Bonzini2025-09-171-1/+2
| | | | | Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* cpu-common: use atomic access for interrupt_requestPaolo Bonzini2025-09-171-1/+0
| | | | | | | | | | | | | Writes to interrupt_request used non-atomic accesses, but there are a few cases where the access was not protected by the BQL. Now that there is a full set of helpers, it's easier to guarantee that interrupt_request accesses are fully atomic, so just drop the requirement instead of fixing them. Reviewed-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* add cpu_test_interrupt()/cpu_set_interrupt() helpers and use them tree wideIgor Mammedov2025-08-291-0/+22
| | | | | | | | | | | | | | | | The helpers form load-acquire/store-release pair and ensure that appropriate barriers are in place in case checks happen outside of BQL. Use them to replace open-coded checkers/setters across the code, to make sure that barriers are not missed. Helpers also make code a bit more readable. Signed-off-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: Peter Xu <peterx@redhat.com> Reviewed-by: Jason J. Herne <jjherne@linux.ibm.com> Link: https://lore.kernel.org/r/20250821155603.2422553-1-imammedo@redhat.com Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* user-exec: ensure interrupt_request is not usedPaolo Bonzini2025-08-291-0/+1
| | | | | | | | cpu_interrupt() is not called anymore except by ARM but even there it is dead code; disentangling the various cpregs accessors from user-mode emulation is a work in progress. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* cpus: Document CPUState::vcpu_dirty fieldPhilippe Mathieu-Daudé2025-07-041-1/+2
| | | | | | | | Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Zhao Liu <zhao1.liu@intel.com> Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com> Message-Id: <20250703173248.44995-18-philmd@linaro.org>
* plugins: Add enforcement of QEMU_PLUGIN_CB flags in register R/W callbacksRowan Hart2025-07-021-0/+1
| | | | | | | | | | | | | | | | This patch adds functionality to enforce the requested QEMU_PLUGIN_CB_ flags level passed when registering a callback function using the plugins API. Each time a callback is about to be invoked, a thread-local variable will be updated with the level that callback requested. Then, called API functions (in particular, the register read and write API) will call qemu_plugin_get_cb_flags() to check the level is at least the level they require. Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Signed-off-by: Rowan Hart <rowanbhart@gmail.com> Message-ID: <20250624175351.440780-4-rowanbhart@gmail.com> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-ID: <20250627112512.1880708-8-alex.bennee@linaro.org>
* hw/core/cpu: Move CacheType to general cpu.hZhao Liu2025-06-101-0/+6
| | | | | | | | | | | | | I386 has already defined cache types in target/i386/cpu.h. Move CacheType to hw/core/cpu.h, so that ARM and other architectures could use it. Cc: Alireza Sanaee <alireza.sanaee@huawei.com> Signed-off-by: Zhao Liu <zhao1.liu@intel.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20250605132722.3597593-1-zhao1.liu@intel.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
* target/migration: Inline VMSTATE_CPU()Philippe Mathieu-Daudé2025-05-081-12/+0
| | | | | | | | | | | | VMSTATE_CPU() is only used in 4 places and doesn't provide much, directly inline it using VMSTATE_STRUCT(). This removes the last COMPILING_PER_TARGET in "hw/core/cpu.h". Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Acked-by: Peter Xu <peterx@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20250429085148.11876-1-philmd@linaro.org>
* qemu: Convert target_name() to TargetInfo APIPhilippe Mathieu-Daudé2025-04-251-2/+0
| | | | | | | | | | | | | Have target_name() be a target-agnostic method, dispatching to a per-target TargetInfo singleton structure. By default a stub singleton is used. No logical change expected. Inspired-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20250424222112.36194-3-philmd@linaro.org>
* gdbstub: Allow gdb_core_xml_file to be set at runtimePeter Maydell2025-04-251-0/+5
| | | | | | | | | | | | | | | | | Currently the CPUClass:gdb_core_xml_file setting is a simple 'const char *' which the CPU class must set to a fixed string. Allow the CPU class to instead set a new method gdb_get_core_xml_file() which returns this string. This will allow Arm CPUs to use different XML files for AArch32 vs AArch64 without having to have an extra AArch64-specific class type purely to give somewhere to set cc->gdb_core_xml_file differently. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Acked-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20250317142819.900029-3-peter.maydell@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
* hw/core/cpu: gdb_arch_name string should not be freedPeter Maydell2025-04-251-1/+2
| | | | | | | | | | | | | | | | | The documentation for the CPUClass::gdb_arch_name method claims that the returned string should be freed with g_free(). This is not correct: in commit a650683871ba728 we changed this method to instead return a simple constant string, but forgot to update the documentation. Make the documentation match the new semantics. Fixes: a650683871ba728 ("hw/core/cpu: Return static value with gdb_arch_name()") Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20250317142819.900029-2-peter.maydell@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
* cpus: Introduce CPUClass::list_cpus() callbackPhilippe Mathieu-Daudé2025-04-251-0/+2
| | | | | | | | | | | | | | Some targets define cpu_list to a method listing their CPUs on stdout. In order to make list_cpus() generic, introduce the CPUClass::list_cpus() callback. When no callback is registered, list_cpus() defaults to the cpu_list definition. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Zhao Liu <zhao1.liu@intel.com> Message-Id: <20250324185837.46506-2-philmd@linaro.org>
* tcg: Move qemu_tcg_mttcg_enabled() to 'system/tcg.h'Philippe Mathieu-Daudé2025-04-231-9/+0
| | | | | | | | | | | | | qemu_tcg_mttcg_enabled() is specific to 1/ TCG and 2/ system emulation. Move the prototype declaration to "system/tcg.h", reducing 'mttcg_enabled' variable scope. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-ID: <20250403220420.78937-17-philmd@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
* exec/cpu-all: remove this headerPierrick Bouvier2025-04-231-1/+1
| | | | | | | Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-ID: <20250325045915.994760-16-pierrick.bouvier@linaro.org>
* hw/core/cpu: Remove CPUClass::mmu_index()Philippe Mathieu-Daudé2025-04-231-2/+0
| | | | | | | | | | All targets have been converted to TCGCPUOps::mmu_index(), remove the now unused CPUClass::mmu_index(). Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-ID: <20250401080938.32278-24-philmd@linaro.org>
* hw/core/cpu: Update CPUClass::mmu_index docstringPhilippe Mathieu-Daudé2025-04-231-2/+1
| | | | | | | | | | | | Since commits 32a8ea12fab..90b7022e698 (target: "Split out TARGET_env_mmu_index"), target's memory_rw_debug() callbacks use the target's TARGET_env_mmu_index(), not the generic CPUClass::mmu_index() callback. Update the documentation. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-ID: <20250401080938.32278-2-philmd@linaro.org>
* include/hw/core: Drop ifndef CONFIG_USER_ONLY from cpu.hRichard Henderson2025-04-231-10/+0
| | | | | | | | We were hiding a number of declarations from user-only, although it hurts nothing to allow them. Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
* include/exec: Split out watchpoint.hRichard Henderson2025-04-231-30/+0
| | | | | | | | | | Relatively few objects in qemu care about watchpoints, so split out to a new header. Removes an instance of CONFIG_USER_ONLY from hw/core/cpu.h. Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
* hw/core/cpu: Use size_t for memory_rw_debug len argumentRichard Henderson2025-03-311-1/+1
| | | | | | | | | | Match the prototype of cpu_memory_rw_debug(). Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20250325224403.4011975-4-richard.henderson@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
* cpus: Remove CPUClass::has_work() handlerPhilippe Mathieu-Daudé2025-03-091-2/+1
| | | | | | | | | | | | | | | All handlers have been converted to SysemuCPUOps::has_work(). Remove CPUClass::has_work along with cpu_common_has_work() and simplify cpu_has_work(), making SysemuCPUOps::has_work handler mandatory. Note, since cpu-common.c is in meson's common_ss[] source set, we must define cpu_exec_class_post_init() in cpu-target.c (which is in the specific_ss[] source set) to have CONFIG_USER_ONLY defined. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-Id: <20250125170125.32855-25-philmd@linaro.org>
* cpus: Un-inline cpu_has_work()Philippe Mathieu-Daudé2025-03-091-5/+1
| | | | | | | | In order to expand cpu_has_work(), un-inline it. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20250125170125.32855-3-philmd@linaro.org>
* cpus: Restrict cpu_has_work() to system emulationPhilippe Mathieu-Daudé2025-03-091-14/+14
| | | | | | | | | This method is not used on user emulation, because there is always work to do there. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20250125170125.32855-2-philmd@linaro.org>
* cpus: Prefer cached CpuClass over CPU_GET_CLASS() macroPhilippe Mathieu-Daudé2025-03-091-7/+3
| | | | | | | | | | CpuState caches its CPUClass since commit 6fbdff87062 ("cpu: cache CPUClass in CPUState for hot code paths"), use it. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20250122093028.52416-5-philmd@linaro.org>
* cpus: Register VMState per user / system emulationPhilippe Mathieu-Daudé2025-03-091-0/+2
| | | | | | | | | | Simplify cpu-target.c by extracting mixed vmstate code into the cpu_vmstate_register() / cpu_vmstate_unregister() helpers, implemented in cpu-user.c and cpu-system.c. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20250123234415.59850-20-philmd@linaro.org>
* cpus: Restrict cpu_get_memory_mapping() to system emulationPhilippe Mathieu-Daudé2025-03-061-2/+2
| | | | | | Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20250121142341.17001-5-philmd@linaro.org>
* gdbstub: Clarify no more than @gdb_num_core_regs can be accessedPhilippe Mathieu-Daudé2025-03-061-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Both CPUClass::gdb_read_register() and CPUClass::gdb_write_register() handlers are called from common gdbstub code, and won't be called with register index over CPUClass::gdb_num_core_regs: int gdb_read_register(CPUState *cpu, GByteArray *buf, int reg) { CPUClass *cc = CPU_GET_CLASS(cpu); if (reg < cc->gdb_num_core_regs) { return cc->gdb_read_register(cpu, buf, reg); } ... } static int gdb_write_register(CPUState *cpu, uint8_t *mem_buf, int reg) { CPUClass *cc = CPU_GET_CLASS(cpu); if (reg < cc->gdb_num_core_regs) { return cc->gdb_write_register(cpu, mem_buf, reg); } ... } Clarify that in CPUClass docstring, and remove unreachable code on the microblaze and openrisc implementations. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20250122093028.52416-3-philmd@linaro.org>
* cpu: Remove nr_cores from struct CPUStateXiaoyao Li2025-01-101-2/+0
| | | | | | | | | There is no user of it now, remove it. Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com> Reviewed-by: Zhao Liu <zhao1.liu@intel.com> Link: https://lore.kernel.org/r/20241219110125.1266461-9-xiaoyao.li@intel.com Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* Revert "hw/acpi: Make CPUs ACPI `presence` conditional during vCPU hot-unplug"Igor Mammedov2024-11-261-1/+0
| | | | | | | | | | | | | | | | | | | | | | | This reverts commit 2d6cfbaf174b91dfa9a50065f7494634afb39c23. The patch is supposed to be part of ARM CPU hotplug series and has not value on its own without it. The series however is still in RFC stage and outside of scope 9.2 release. On top of that it introduces not needed callback that pokes directly into CPU state without any need for that. Instead properties and AML generator option should be used to configure static platform depended vCPU presence state. Drop the patch so that corrected version could be posted along with ARM CPU hotplug series and properly reviewed in relevant context. That also helps us to keep history cleaner with new patch being against original code vs a string of fixups on top of current mess. Signed-off-by: Igor Mammedov <imammedo@redhat.com> Message-Id: <20241112170258.2996640-4-imammedo@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
* Revert "hw/acpi: Update ACPI `_STA` method with QOM vCPU ACPI Hotplug states"Igor Mammedov2024-11-261-1/+0
| | | | | | | | | | | This reverts commit bf1ecc8dad6061914730a2a2d57af6b37c3a4f8d which broke cpu hotplug in x86 after migration to older QEMU Fixes: bf1ecc8dad606 (w/acpi: Update ACPI `_STA` method with QOM vCPU ACPI Hotplug states) Signed-off-by: Igor Mammedov <imammedo@redhat.com> Message-Id: <20241112170258.2996640-3-imammedo@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
* hw/acpi: Update ACPI `_STA` method with QOM vCPU ACPI Hotplug statesSalil Mehta2024-11-041-0/+1
| | | | | | | | | | | | | | | | | | Reflect the QOM vCPUs ACPI CPU hotplug states in the `_STA.Present` and and `_STA.Enabled` bits when the guest kernel evaluates the ACPI `_STA` method during initialization, as well as when vCPUs are hot-plugged or hot-unplugged. If the CPU is present then the its `enabled` status can be fetched using architecture-specific code [1]. Reference: [1] Example implementation of architecture-specific hook to fetch CPU `enabled status Link: https://github.com/salil-mehta/qemu/commit/c0b416b11e5af6505e558866f0eb6c9f3709173e Signed-off-by: Salil Mehta <salil.mehta@huawei.com> Message-Id: <20241103102419.202225-4-salil.mehta@huawei.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
* hw/acpi: Make CPUs ACPI `presence` conditional during vCPU hot-unplugSalil Mehta2024-11-041-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | On most architectures, during vCPU hot-plug and hot-unplug actions, the firmware or VMM/QEMU can update the OS on vCPU status by toggling the ACPI method `_STA.Present` bit. However, certain CPU architectures prohibit [1] modifications to a CPU’s `presence` status after the kernel has booted. This limitation [2][3] exists because many per-CPU components, such as interrupt controllers and various per-CPU features tightly integrated with CPUs, may not support reconfiguration once the kernel is initialized. Often, these components cannot be powered down, as they may belong to an `always-on` power domain. As a result, some architectures require all CPUs to remain `_STA.Present` after system initialization. Therefore, it is essential to mirror the exact QOM vCPU status through ACPI for the Guest kernel. For this, we should determine—via architecture-specific code[4]—whether vCPUs must always remain present and whether the associated `AcpiCpuStatus::cpu` object should remain valid, even following a vCPU hot-unplug operation. References: [1] Check comment 5 in the bugzilla entry Link: https://bugzilla.tianocore.org/show_bug.cgi?id=4481#c5 [2] KVMForum 2023 Presentation: Challenges Revisited in Supporting Virt CPU Hotplug on architectures that don’t Support CPU Hotplug (like ARM64) a. Kernel Link: https://kvm-forum.qemu.org/2023/KVM-forum-cpu-hotplug_7OJ1YyJ.pdf b. Qemu Link: https://kvm-forum.qemu.org/2023/Challenges_Revisited_in_Supporting_Virt_CPU_Hotplug_-__ii0iNb3.pdf [3] KVMForum 2020 Presentation: Challenges in Supporting Virtual CPU Hotplug on SoC Based Systems (like ARM64) Link: https://kvmforum2020.sched.com/event/eE4m [4] Example implementation of architecture-specific CPU persistence hook Link: https://github.com/salil-mehta/qemu/commit/c0b416b11e5af6505e558866f0eb6c9f3709173e Signed-off-by: Salil Mehta <salil.mehta@huawei.com> Message-Id: <20241103102419.202225-2-salil.mehta@huawei.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
* include: Move QemuLockCnt APIs to their own headerPeter Maydell2024-10-151-0/+1
| | | | | | | | | | | | | | | | | | | | | | Currently the QemuLockCnt data structure and associated functions are in the include/qemu/thread.h header. Move them to their own qemu/lockcnt.h. The main reason for doing this is that it means we can autogenerate the documentation comments into the docs/devel documentation. The copyright/author in the new header is drawn from lockcnt.c, since the header changes were added in the same commit as lockcnt.c; since neither thread.h nor lockcnt.c state an explicit license, the standard default of GPL-2-or-later applies. We include the new header (and the .c file, which was accidentally omitted previously) in the "RCU" part of MAINTAINERS, since that is where the lockcnt.rst documentation is categorized. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Acked-by: Paolo Bonzini <pbonzini@redhat.com> Message-id: 20240816132212.3602106-7-peter.maydell@linaro.org
* accel/tcg: Add TCGCPUOps.tlb_fill_alignRichard Henderson2024-10-131-2/+2
| | | | | | | | | | | | | | | | | Add a new callback to handle softmmu paging. Return the page details directly, instead of passing them indirectly to tlb_set_page. Handle alignment simultaneously with paging so that faults are handled with target-specific priority. Route all calls of the two hooks through a tlb_fill_align function local to cputlb.c. As yet no targets implement the new hook. As yet cputlb.c does not use the new alignment check. Reviewed-by: Helge Deller <deller@gmx.de> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
* plugins: save value during memory accessesPierrick Bouvier2024-09-191-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | Different code paths handle memory accesses: - tcg generated code - load/store helpers - atomic helpers This value is saved in cpu->neg.plugin_mem_value_{high,low}. Values are written only for accessed word size (upper bits are not set). Atomic operations are doing read/write at the same time, so we generate two memory callbacks instead of one, to allow plugins to access distinct values. For now, we can have access only up to 128 bits, thus split this in two 64 bits words. When QEMU will support wider operations, we'll be able to reconsider this. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Message-Id: <20240724194708.1843704-2-pierrick.bouvier@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20240916085400.1046925-5-alex.bennee@linaro.org>
* physmem: Add helper function to destroy CPU AddressSpaceSalil Mehta2024-07-221-0/+1
| | | | | | | | | | | | | | | | | | Virtual CPU Hot-unplug leads to unrealization of a CPU object. This also involves destruction of the CPU AddressSpace. Add common function to help destroy the CPU AddressSpace. Signed-off-by: Salil Mehta <salil.mehta@huawei.com> Tested-by: Vishnu Pajjuri <vishnu@os.amperecomputing.com> Reviewed-by: Gavin Shan <gshan@redhat.com> Tested-by: Xianglai Li <lixianglai@loongson.cn> Tested-by: Miguel Luis <miguel.luis@oracle.com> Reviewed-by: Shaoqin Huang <shahuang@redhat.com> Tested-by: Zhao Liu <zhao1.liu@intel.com> Acked-by: Igor Mammedov <imammedo@redhat.com> Message-Id: <20240716111502.202344-7-salil.mehta@huawei.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
* Merge tag 'for-upstream' of https://gitlab.com/bonzini/qemu into stagingRichard Henderson2024-07-171-0/+6
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * target/i386/tcg: fixes for seg_helper.c * SEV: Don't allow automatic fallback to legacy KVM_SEV_INIT, but also don't use it by default * scsi: honor bootindex again for legacy drives * hpet, utils, scsi, build, cpu: miscellaneous bugfixes # -----BEGIN PGP SIGNATURE----- # # iQFIBAABCAAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAmaWoP0UHHBib256aW5p # QHJlZGhhdC5jb20ACgkQv/vSX3jHroOqfggAg3jxUp6B8dFTEid5aV6qvT4M6nwD # TAYcAl5kRqTOklEmXiPCoA5PeS0rbr+5xzWLAKgkumjCVXbxMoYSr0xJHVuDwQWv # XunUm4kpxJBLKK3uTGAIW9A21thOaA5eAoLIcqu2smBMU953TBevMqA7T67h22rp # y8NnZWWdyQRH0RAaWsCBaHVkkf+DuHSG5LHMYhkdyxzno+UWkTADFppVhaDO78Ba # Egk49oMO+G6of4+dY//p1OtAkAf4bEHePKgxnbZePInJrkgHzr0TJWf9gERWFzdK # JiM0q6DeqopZm+vENxS+WOx7AyDzdN0qOrf6t9bziXMg0Rr2Z8bu01yBCQ== # =cZhV # -----END PGP SIGNATURE----- # gpg: Signature made Wed 17 Jul 2024 02:34:05 AM AEST # gpg: using RSA key F13338574B662389866C7682BFFBD25F78C7AE83 # gpg: issuer "pbonzini@redhat.com" # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" [full] # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" [full] * tag 'for-upstream' of https://gitlab.com/bonzini/qemu: target/i386/tcg: save current task state before loading new one target/i386/tcg: use X86Access for TSS access target/i386/tcg: check for correct busy state before switching to a new task target/i386/tcg: Compute MMU index once target/i386/tcg: Introduce x86_mmu_index_{kernel_,}pl target/i386/tcg: Reorg push/pop within seg_helper.c target/i386/tcg: use PUSHL/PUSHW for error code target/i386/tcg: Allow IRET from user mode to user mode with SMAP target/i386/tcg: Remove SEG_ADDL target/i386/tcg: fix POP to memory in long mode hpet: fix HPET_TN_SETVAL for high 32-bits of the comparator hpet: fix clamping of period docs: Update description of 'user=username' for '-run-with' qemu/timer: Add host ticks function for LoongArch scsi: fix regression and honor bootindex again for legacy drives hw/scsi/lsi53c895a: bump instruction limit in scripts processing to fix regression disas: Fix build against Capstone v6 cpu: Free queued CPU work Revert "qemu-char: do not operate on sources from finalize callbacks" i386/sev: Don't allow automatic fallback to legacy KVM_SEV*_INIT Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
| * cpu: Free queued CPU workAkihiko Odaki2024-07-161-0/+6
| | | | | | | | | | | | | | | | | | | | Running qemu-system-aarch64 -M virt -nographic and terminating it will result in a LeakSanitizer error due to remaining queued CPU work so free it. Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Link: https://lore.kernel.org/r/20240714-cpu-v1-1-19c2f8de2055@daynix.com Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* | system/cpus: Add cpu_pause() functionNicholas Piggin2024-07-161-0/+8
|/ | | | | | | | | | | | | | | This factors the CPU pause function from pause_all_vcpus() into a new cpu_pause() function, similarly to cpu_resume(). cpu_resume() is moved to keep it next to cpu_pause(). Cc: Philippe Mathieu-Daudé <philmd@linaro.org> Cc: Peter Xu <peterx@redhat.com> Cc: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Nicholas Piggin <npiggin@gmail.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Peter Xu <peterx@redhat.com> Message-ID: <20240712120247.477133-17-npiggin@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
* cpu: move Qemu[Thread|Cond] setup into common codeAlex Bennée2024-06-041-0/+4
| | | | | | | | | | | | | | | Aside from the round robin threads this is all common code. By moving the halt_cond setup we also no longer need hacks to work around the race between QOM object creation and thread creation. It is a little ugly to free stuff up for the round robin thread but better it deal with its own specialises than making the other accelerators jump through hoops. Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Message-ID: <20240530194250.1801701-3-alex.bennee@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
* hw/core: expand on the alignment of CPUStateAlex Bennée2024-06-041-4/+10
| | | | | | | | | | Make the relationship between CPUState, ArchCPU and cpu_env a bit clearer in the kdoc comments. Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Message-ID: <20240530194250.1801701-2-alex.bennee@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
* Merge tag 'accel-20240506' of https://github.com/philmd/qemu into stagingRichard Henderson2024-05-061-27/+11
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Accelerator patches - Extract page-protection definitions to page-protection.h - Rework in accel/tcg in preparation of extracting TCG fields from CPUState - More uses of get_task_state() in user emulation - Xen refactors in preparation for adding multiple map caches (Juergen & Edgar) - MAINTAINERS updates (Aleksandar and Bin) # -----BEGIN PGP SIGNATURE----- # # iQIzBAABCAAdFiEE+qvnXhKRciHc/Wuy4+MsLN6twN4FAmY40CAACgkQ4+MsLN6t # wN5drxAA1oIsuUzpAJmlMIxZwlzbICiuexgn/HH9DwWNlrarKo7V1l4YB8jd9WOg # IKuj7c39kJKsDEB8BXApYwcly+l7DYdnAAI8Z7a+eN+ffKNl/0XBaLjsGf58RNwY # fb39/cXWI9ZxKxsHMSyjpiu68gOGvZ5JJqa30Fr+eOGuug9Fn/fOe1zC6l/dMagy # Dnym72stpD+hcsN5sVwohTBIk+7g9og1O/ctRx6Q3ZCOPz4p0+JNf8VUu43/reaR # 294yRK++JrSMhOVFRzP+FH1G25NxiOrVCFXZsUTYU+qPDtdiKtjH1keI/sk7rwZ7 # U573lesl7ewQFf1PvMdaVf0TrQyOe6kUGr9Mn2k8+KgjYRAjTAQk8V4Ric/+xXSU # 0rd7Cz7lyQ8jm0DoOElROv+lTDQs4dvm3BopF3Bojo4xHLHd3SFhROVPG4tvGQ3H # 72Q5UPR2Jr2QZKiImvPceUOg0z5XxoN6KRUkSEpMFOiTRkbwnrH59z/qPijUpe6v # 8l5IlI9GjwkL7pcRensp1VC6e9KC7F5Od1J/2RLDw3UQllMQXqVw2bxD3CEtDRJL # QSZoS4d1jUCW4iAYdqh/8+2cOIPiCJ4ai5u7lSdjrIJkRErm32FV/pQLZauoHlT5 # eTPUgzDoRXVgI1X1slTpVXlEEvRNbhZqSkYLkXr80MLn5hTafo0= # =3Qkg # -----END PGP SIGNATURE----- # gpg: Signature made Mon 06 May 2024 05:42:08 AM PDT # gpg: using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE # gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <f4bug@amsat.org>" [full] * tag 'accel-20240506' of https://github.com/philmd/qemu: (28 commits) MAINTAINERS: Update my email address MAINTAINERS: Update Aleksandar Rikalo email system: Pass RAM MemoryRegion and is_write in xen_map_cache() xen: mapcache: Break out xen_map_cache_init_single() xen: mapcache: Break out xen_invalidate_map_cache_single() xen: mapcache: Refactor xen_invalidate_map_cache_entry_unlocked xen: mapcache: Refactor xen_replace_cache_entry_unlocked xen: mapcache: Break out xen_ram_addr_from_mapcache_single xen: mapcache: Refactor xen_remap_bucket for multi-instance xen: mapcache: Refactor xen_map_cache for multi-instance xen: mapcache: Refactor lock functions for multi-instance xen: let xen_ram_addr_from_mapcache() return -1 in case of not found entry system: let qemu_map_ram_ptr() use qemu_ram_ptr_length() user: Use get_task_state() helper user: Declare get_task_state() once in 'accel/tcg/vcpu-state.h' user: Forward declare TaskState type definition accel/tcg: Move @plugin_mem_cbs from CPUState to CPUNegativeOffsetState accel/tcg: Restrict cpu_plugin_mem_cbs_enabled() to TCG accel/tcg: Restrict qemu_plugin_vcpu_exit_hook() to TCG plugins accel/tcg: Update CPUNegativeOffsetState::can_do_io field documentation ... Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
| * accel/tcg: Move @plugin_mem_cbs from CPUState to CPUNegativeOffsetStatePhilippe Mathieu-Daudé2024-05-061-6/+7
| | | | | | | | | | | | | | | | | | @plugin_mem_cbs is accessed by tcg generated code, move it to CPUNegativeOffsetState. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20240429213050.55177-4-philmd@linaro.org>
| * accel/tcg: Restrict cpu_plugin_mem_cbs_enabled() to TCGPhilippe Mathieu-Daudé2024-05-061-17/+0
| | | | | | | | | | | | | | | | | | So far cpu_plugin_mem_cbs_enabled() is only called from TCG, so reduce it to accel/tcg/. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <5f59c754-44e5-4743-a2dd-87ef8e13eadf@linaro.org>