summary refs log tree commit diff stats
path: root/target/i386 (follow)
Commit message (Collapse)AuthorAgeFilesLines
* i386: switch boards to "default y"Paolo Bonzini2024-05-031-0/+1
| | | | | | | | | | | Some targets use "default y" for boards to filter out those that require TCG. For consistency we are switching all other targets to do the same. Continue with i386. No changes to generated config-devices.mak files, other than adding CONFIG_I386 to the x86_64-softmmu target. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* Kconfig: kvm: allow building without any boardPaolo Bonzini2024-05-031-0/+2
| | | | | | | | | | | | | | | KVM code might have to call functions on the PCIDevice that is passed to kvm_arch_fixup_msi_route(). This fails in the case where --without-default-devices is used and no board is configured. While this is not really a useful configuration, and therefore setting up stubs for CONFIG_PCI is overkill, failing the build is impolite. Just include the PCI subsystem if kvm_arch_fixup_msi_route() requires it, as is the case for ARM and x86. Reported-by: Philippe Mathieu-Daudé <philmd@linaro.org> Tested-by: Fabiano Rosas <farosas@suse.de> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* target/i386: Give IRQs a chance when resetting HF_INHIBIT_IRQ_MASKRuihan Li2024-05-031-4/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When emulated with QEMU, interrupts will never come in the following loop. However, if the NOP instruction is uncommented, interrupts will fire as normal. loop: cli call do_sti jmp loop do_sti: sti # nop ret This behavior is different from that of a real processor. For example, if KVM is enabled, interrupts will always fire regardless of whether the NOP instruction is commented or not. Also, the Intel Software Developer Manual states that after the STI instruction is executed, the interrupt inhibit should end as soon as the next instruction (e.g., the RET instruction if the NOP instruction is commented) is executed. This problem is caused because the previous code may choose not to end the TB even if the HF_INHIBIT_IRQ_MASK has just been reset (e.g., in the case where the STI instruction is immediately followed by the RET instruction), so that IRQs may not have a change to trigger. This commit fixes the problem by always terminating the current TB to give IRQs a chance to trigger when HF_INHIBIT_IRQ_MASK is reset. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Ruihan Li <lrh2000@pku.edu.cn> Message-ID: <20240415064518.4951-4-lrh2000@pku.edu.cn> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* target/i386/cpu: Remove "x86" prefix from the CPU listThomas Huth2024-04-291-1/+1
| | | | | | | | | | | | | | | | Printing an "x86" in front of each CPU name is not helpful at all: It is confusing for the users since they don't know whether they have to specify these letters for the "-cpu" parameter, too, and it also takes some precious space in the dense output of the CPU entries. Let's simply remove this now and use two spaces at the beginning of the lines for the indentation of the entries instead, like most other target architectures are doing it for their CPU help output already. Signed-off-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Michael Tokarev <mjt@tls.msk.ru> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
* accel/hvf: Use accel-specific per-vcpu @dirty fieldPhilippe Mathieu-Daudé2024-04-262-3/+3
| | | | | | | | | | | HVF has a specific use of the CPUState::vcpu_dirty field (CPUState::vcpu_dirty is not used by common code). To make this field accel-specific, add and use a new @dirty variable in the AccelCPUState structure. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20240424174506.326-4-philmd@linaro.org>
* accel/nvmm: Use accel-specific per-vcpu @dirty fieldPhilippe Mathieu-Daudé2024-04-261-10/+11
| | | | | | | | | | | NVMM has a specific use of the CPUState::vcpu_dirty field (CPUState::vcpu_dirty is not used by common code). To make this field accel-specific, add and use a new @dirty variable in the AccelCPUState structure. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20240424174506.326-3-philmd@linaro.org>
* accel/whpx: Use accel-specific per-vcpu @dirty fieldPhilippe Mathieu-Daudé2024-04-261-11/+12
| | | | | | | | | | | WHPX has a specific use of the CPUState::vcpu_dirty field (CPUState::vcpu_dirty is not used by common code). To make this field accel-specific, add and use a new @dirty variable in the AccelCPUState structure. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20240424174506.326-2-philmd@linaro.org>
* target/i386: Include missing 'exec/exec-all.h' headerPhilippe Mathieu-Daudé2024-04-261-0/+1
| | | | | | | | | The XRSTOR instruction ends calling tlb_flush(), declared in "exec/exec-all.h". Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20231211212003.21686-13-philmd@linaro.org>
* target: Define TCG_GUEST_DEFAULT_MO in 'cpu-param.h'Philippe Mathieu-Daudé2024-04-262-3/+3
| | | | | | | | | | | | | | | | | | | accel/tcg/ files requires the following definitions: - TARGET_LONG_BITS - TARGET_PAGE_BITS - TARGET_PHYS_ADDR_SPACE_BITS - TCG_GUEST_DEFAULT_MO The first 3 are defined in "cpu-param.h". The last one in "cpu.h", with a bunch of definitions irrelevant for TCG. By moving the TCG_GUEST_DEFAULT_MO definition to "cpu-param.h", we can simplify various accel/tcg includes. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Acked-by: Nicholas Piggin <npiggin@gmail.com> Message-Id: <20231211212003.21686-4-philmd@linaro.org>
* Merge tag 'hw-misc-20240425' of https://github.com/philmd/qemu into stagingRichard Henderson2024-04-254-102/+113
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Misc HW patch queue - Script to compare machines compat_props[] (Maksim) - Introduce 'module' CPU topology level (Zhao) - Various cleanups (Thomas, Zhao, Inès, Bernhard) # -----BEGIN PGP SIGNATURE----- # # iQIzBAABCAAdFiEE+qvnXhKRciHc/Wuy4+MsLN6twN4FAmYqN3wACgkQ4+MsLN6t # wN4hTw/9FHsItnEkme/864DRPSP7A9mCGa+JfzJmsL8oUb9fBjXXKm+lNchMLu3B # uvzfXB2Ea24yf5vyrldo0XlU3i/4GDvqXTI6YFYqBvitGICauYBu+6n2NZh2Y/Pn # zZCcVo167o0q7dHu2WSrZ6cSUchsF2C80HjuS07QaN2YZ7QMuN1+uqTjCQ/JHQWA # MH4xHh7cXdfCbbv8iNhMWn6sa+Bw/UyfRcc2W6w9cF5Q5cuuTshgDyd0JBOzkM1i # Mcul7TuKrSiLUeeeqfTjwtw3rtbNfkelV3ycgvgECFAlzPSjF5a6d/EGdO2zo3T/ # aFZnQBYrb4U0SzsmfXFHW7cSylIc1Jn2CCuZZBIvdVcu8TGDD5XsgZbGoCfKdWxp # l67qbQJy1Mp3LrRzygJIaxDOfE8fhhRrcIxfK/GoTHaCkqeFRkGjTeiDTVBqAES2 # zs6kUYZyG/xGaa2tsMu+HbtSO5EEqPC2QCdHayY3deW42Kwjj/HFV50Ya8YgYSVp # gEAjTDOle2dDjlkYud+ymTJz7LnGb3G7q0EZRI9DWolx/bu+uZGQqTSRRre4qFQY # SgN576hsFGN4NdM7tyJWiiqD/OC9ZeqUx3gGBtmI52Q6obBCE9hcow0fPs55Tk95 # 1YzPrt/3IoPI5ZptCoA8DFiysQ46OLtpIsQO9YcrpJmxWyLDSr0= # =tm+U # -----END PGP SIGNATURE----- # gpg: Signature made Thu 25 Apr 2024 03:59:08 AM PDT # gpg: using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE # gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <f4bug@amsat.org>" [full] * tag 'hw-misc-20240425' of https://github.com/philmd/qemu: (22 commits) hw/core: Support module-id in numa configuration hw/core: Introduce module-id as the topology subindex hw/core/machine: Support modules in -smp hw/core/machine: Introduce the module as a CPU topology level hw/i386/pc_sysfw: Remove unused parameter from pc_isa_bios_init() hw/misc : Correct 5 spaces indents in stm32l4x5_exti hw/xtensa: Include missing 'exec/cpu-common.h' in 'bootparam.h' hw/elf_ops: Rename elf_ops.h -> elf_ops.h.inc hw/cxl/cxl-cdat: Make cxl_doe_cdat_init() return boolean hw/cxl/cxl-cdat: Make ct3_build_cdat() return boolean hw/cxl/cxl-cdat: Make ct3_load_cdat() return boolean hw: Add a Kconfig switch for the TYPE_CPU_CLUSTER device hw: Fix problem with the A*MPCORE switches in the Kconfig files hw/riscv/virt: Replace sprintf by g_strdup_printf hw/misc/imx: Replace sprintf() by snprintf() hw/misc/applesmc: Simplify DeviceReset handler target/i386: Move APIC related code to cpu-apic.c hw/core: Remove check on NEED_CPU_H in tcg-cpu-ops.h scripts: add script to compare compatibility properties python/qemu/machine: add method to retrieve QEMUMachine::binary field ... Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
| * target/i386: Move APIC related code to cpu-apic.cPhilippe Mathieu-Daudé2024-04-254-102/+113
| | | | | | | | | | | | | | | | | | | | Move APIC related code split in cpu-sysemu.c and monitor.c to cpu-apic.c. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Zhao Liu <zhao1.liu@intel.com> Message-Id: <20240321154838.95771-4-philmd@linaro.org>
* | hw, target: Add ResetType argument to hold and exit phase methodsPeter Maydell2024-04-251-2/+2
|/ | | | | | | | | | | | | | | | | | | | | | | | | We pass a ResetType argument to the Resettable class enter phase method, but we don't pass it to hold and exit, even though the callsites have it readily available. This means that if a device cared about the ResetType it would need to record it in the enter phase method to use later on. Pass the type to all three of the phase methods to avoid having to do that. Commit created with for dir in hw target include; do \ spatch --macro-file scripts/cocci-macro-file.h \ --sp-file scripts/coccinelle/reset-type.cocci \ --keep-comments --smpl-spacing --in-place \ --include-headers --dir $dir; done and no manual edits. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Luc Michel <luc.michel@amd.com> Message-id: 20240412160809.1260625-5-peter.maydell@linaro.org
* target/i386/translate.c: always write 32-bits for SGDT and SIDTMark Cave-Ayland2024-04-231-6/+8
| | | | | | | | | | | | | | | | | | | | | | | | | The various Intel CPU manuals claim that SGDT and SIDT can write either 24-bits or 32-bits depending upon the operand size, but this is incorrect. Not only do the Intel CPU manuals give contradictory information between processor revisions, but this information doesn't even match real-life behaviour. In fact, tests on real hardware show that the CPU always writes 32-bits for SGDT and SIDT, and this behaviour is required for at least OS/2 Warp and WFW 3.11 with Win32s to function correctly. Remove the masking applied due to the operand size for SGDT and SIDT so that the TCG behaviour matches the behaviour on real hardware. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2198 -- MCA: Whilst I don't have a copy of OS/2 Warp handy, I've confirmed that this patch fixes the issue in WFW 3.11 with Win32s. For more technical information I highly recommend the excellent write-up at https://www.os2museum.com/wp/sgdtsidt-fiction-and-reality/. Message-ID: <20240419195147.434894-1-mark.cave-ayland@ilande.co.uk> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* target/i386/cpu: Merge the warning and error messages for AMD HT checkZhao Liu2024-04-231-3/+3
| | | | | | | | | | | | | | | | | | Currently, the difference between warn_report_once() and error_report_once() is the former has the "warning:" prefix, while the latter does not have a similar level prefix. At the meantime, considering that there is no error handling logic here, and the purpose of error_report_once() is only to prompt the user with an abnormal message, there is no need to use an error-level message here, and instead we can just use a warning. Therefore, downgrade the message in error_report_once() to warning, and merge it into the previous warn_report_once(). Signed-off-by: Zhao Liu <zhao1.liu@intel.com> Message-ID: <20240327103951.3853425-4-zhao1.liu@linux.intel.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* target/i386/cpu: Consolidate the use of warn_report_once()Zhao Liu2024-04-231-8/+5
| | | | | | | | | | | | | | The difference between error_printf() and error_report() is the latter may contain more information, such as the name of the program ("qemu-system-x86_64"). Thus its variant error_report_once() and warn_report()'s variant warn_report_once() can be used here to print the information only once without a static local variable "ht_warned". Signed-off-by: Zhao Liu <zhao1.liu@intel.com> Message-ID: <20240327103951.3853425-3-zhao1.liu@linux.intel.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* target/i386/host-cpu: Consolidate the use of warn_report_once()Zhao Liu2024-04-231-7/+4
| | | | | | | | Use warn_report_once() to get rid of the static local variable "warned". Signed-off-by: Zhao Liu <zhao1.liu@intel.com> Message-ID: <20240327103951.3853425-2-zhao1.liu@linux.intel.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* hw/i386/sev: Use legacy SEV VM types for older machine typesMichael Roth2024-04-231-0/+1
| | | | | | | | | | | | | Newer 9.1 machine types will default to using the KVM_SEV_INIT2 API for creating SEV/SEV-ES going forward. However, this API results in guest measurement changes which are generally not expected for users of these older guest types and can cause disruption if they switch to a newer QEMU/kernel version. Avoid this by continuing to use the older KVM_SEV_INIT/KVM_SEV_ES_INIT APIs for older machine types. Signed-off-by: Michael Roth <michael.roth@amd.com> Message-ID: <20240409230743.962513-4-michael.roth@amd.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* i386/sev: Add 'legacy-vm-type' parameter for SEV guest objectsMichael Roth2024-04-231-1/+17
| | | | | | | | | | | | | | | | | | | | | | | | | | | QEMU will currently automatically make use of the KVM_SEV_INIT2 API for initializing SEV and SEV-ES guests verses the older KVM_SEV_INIT/KVM_SEV_ES_INIT interfaces. However, the older interfaces will silently avoid sync'ing FPU/XSAVE state to the VMSA prior to encryption, thus relying on behavior and measurements that assume the related fields to be allow zero. With KVM_SEV_INIT2, this state is now synced into the VMSA, resulting in measurements changes and, theoretically, behaviorial changes, though the latter are unlikely to be seen in practice. To allow a smooth transition to the newer interface, while still providing a mechanism to maintain backward compatibility with VMs created using the older interfaces, provide a new command-line parameter: -object sev-guest,legacy-vm-type=true,... and have it default to false. Signed-off-by: Michael Roth <michael.roth@amd.com> Message-ID: <20240409230743.962513-2-michael.roth@amd.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* target/i386: SEV: use KVM_SEV_INIT2 if possiblePaolo Bonzini2024-04-232-4/+39
| | | | | | | | | | | | | | | | | | | | | Implement support for the KVM_X86_SEV_VM and KVM_X86_SEV_ES_VM virtual machine types, and the KVM_SEV_INIT2 function of KVM_MEMORY_ENCRYPT_OP. These replace the KVM_SEV_INIT and KVM_SEV_ES_INIT functions, and have several advantages: - sharing the initialization sequence with SEV-SNP and TDX - allowing arguments including the set of desired VMSA features - protection against invalid use of KVM_GET/SET_* ioctls for guests with encrypted state If the KVM_X86_SEV_VM and KVM_X86_SEV_ES_VM types are not supported, fall back to KVM_SEV_INIT and KVM_SEV_ES_INIT (which use the default x86 VM type). Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* target/i386: Implement mc->kvm_type() to get VM typePaolo Bonzini2024-04-233-0/+65
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | KVM is introducing a new API to create confidential guests, which will be used by TDX and SEV-SNP but is also available for SEV and SEV-ES. The API uses the VM type argument to KVM_CREATE_VM to identify which confidential computing technology to use. Since there are no other expected uses of VM types, delegate mc->kvm_type() for x86 boards to the confidential-guest-support object pointed to by ms->cgs. For example, if a sev-guest object is specified to confidential-guest-support, like, qemu -machine ...,confidential-guest-support=sev0 \ -object sev-guest,id=sev0,... it will check if a VM type KVM_X86_SEV_VM or KVM_X86_SEV_ES_VM is supported, and if so use them together with the KVM_SEV_INIT2 function of the KVM_MEMORY_ENCRYPT_OP ioctl. If not, it will fall back to KVM_SEV_INIT and KVM_SEV_ES_INIT. This is a preparatory work towards TDX and SEV-SNP support, but it will also enable support for VMSA features such as DebugSwap, which are only available via KVM_SEV_INIT2. Co-developed-by: Xiaoyao Li <xiaoyao.li@intel.com> Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* target/i386: introduce x86-confidential-guestPaolo Bonzini2024-04-234-4/+77
| | | | | | | | Introduce a common superclass for x86 confidential guest implementations. It will extend ConfidentialGuestSupportClass with a method that provides the VM type to be passed to KVM_CREATE_VM. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* KVM: remove kvm_arch_cpu_check_are_resettablePaolo Bonzini2024-04-231-5/+0
| | | | | | | | | | Board reset requires writing a fresh CPU state. As far as KVM is concerned, the only thing that blocks reset is that CPU state is encrypted; therefore, kvm_cpus_are_resettable() can simply check if that is the case. Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* KVM: track whether guest state is encryptedPaolo Bonzini2024-04-231-0/+1
| | | | | | | | | | | | | | | | | | | So far, KVM has allowed KVM_GET/SET_* ioctls to execute even if the guest state is encrypted, in which case they do nothing. For the new API using VM types, instead, the ioctls will fail which is a safer and more robust approach. The new API will be the only one available for SEV-SNP and TDX, but it is also usable for SEV and SEV-ES. In preparation for that, require architecture-specific KVM code to communicate the point at which guest state is protected (which must be after kvm_cpu_synchronize_post_init(), though that might change in the future in order to suppor migration). From that point, skip reading registers so that cpu->vcpu_dirty is never true: if it ever becomes true, kvm_arch_put_registers() will fail miserably. Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* i386/sev: Switch to use confidential_guest_kvm_init()Xiaoyao Li2024-04-235-93/+69
| | | | | | | | | | | | | Use confidential_guest_kvm_init() instead of calling SEV specific sev_kvm_init(). This allows the introduction of multiple confidential-guest-support subclasses for different x86 vendors. As a bonus, stubs are not needed anymore since there is no direct call from target/i386/kvm/kvm.c to SEV code. Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com> Message-Id: <20240229060038.606591-1-xiaoyao.li@intel.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* target/i386: Export RFDS bit to guestsPawan Gupta2024-04-231-2/+2
| | | | | | | | | | | | | | | | Register File Data Sampling (RFDS) is a CPU side-channel vulnerability that may expose stale register value. CPUs that set RFDS_NO bit in MSR IA32_ARCH_CAPABILITIES indicate that they are not vulnerable to RFDS. Similarly, RFDS_CLEAR indicates that CPU is affected by RFDS, and has the microcode to help mitigate RFDS. Make RFDS_CLEAR and RFDS_NO bits available to guests. Signed-off-by: Pawan Gupta <pawan.kumar.gupta@linux.intel.com> Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com> Reviewed-by: Zhao Liu <zhao1.liu@intel.com> Message-ID: <9a38877857392b5c2deae7e7db1b170d15510314.1710341348.git.pawan.kumar.gupta@linux.intel.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* target/i386: Add new CPU model SierraForestTao Su2024-04-231-0/+126
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | According to table 1-2 in Intel Architecture Instruction Set Extensions and Future Features (rev 051) [1], SierraForest has the following new features which have already been virtualized: - CMPCCXADD CPUID.(EAX=7,ECX=1):EAX[bit 7] - AVX-IFMA CPUID.(EAX=7,ECX=1):EAX[bit 23] - AVX-VNNI-INT8 CPUID.(EAX=7,ECX=1):EDX[bit 4] - AVX-NE-CONVERT CPUID.(EAX=7,ECX=1):EDX[bit 5] Add above features to new CPU model SierraForest. Comparing with GraniteRapids CPU model, SierraForest bare-metal removes the following features: - HLE CPUID.(EAX=7,ECX=0):EBX[bit 4] - RTM CPUID.(EAX=7,ECX=0):EBX[bit 11] - AVX512F CPUID.(EAX=7,ECX=0):EBX[bit 16] - AVX512DQ CPUID.(EAX=7,ECX=0):EBX[bit 17] - AVX512_IFMA CPUID.(EAX=7,ECX=0):EBX[bit 21] - AVX512CD CPUID.(EAX=7,ECX=0):EBX[bit 28] - AVX512BW CPUID.(EAX=7,ECX=0):EBX[bit 30] - AVX512VL CPUID.(EAX=7,ECX=0):EBX[bit 31] - AVX512_VBMI CPUID.(EAX=7,ECX=0):ECX[bit 1] - AVX512_VBMI2 CPUID.(EAX=7,ECX=0):ECX[bit 6] - AVX512_VNNI CPUID.(EAX=7,ECX=0):ECX[bit 11] - AVX512_BITALG CPUID.(EAX=7,ECX=0):ECX[bit 12] - AVX512_VPOPCNTDQ CPUID.(EAX=7,ECX=0):ECX[bit 14] - LA57 CPUID.(EAX=7,ECX=0):ECX[bit 16] - TSXLDTRK CPUID.(EAX=7,ECX=0):EDX[bit 16] - AMX-BF16 CPUID.(EAX=7,ECX=0):EDX[bit 22] - AVX512_FP16 CPUID.(EAX=7,ECX=0):EDX[bit 23] - AMX-TILE CPUID.(EAX=7,ECX=0):EDX[bit 24] - AMX-INT8 CPUID.(EAX=7,ECX=0):EDX[bit 25] - AVX512_BF16 CPUID.(EAX=7,ECX=1):EAX[bit 5] - fast zero-length MOVSB CPUID.(EAX=7,ECX=1):EAX[bit 10] - fast short CMPSB, SCASB CPUID.(EAX=7,ECX=1):EAX[bit 12] - AMX-FP16 CPUID.(EAX=7,ECX=1):EAX[bit 21] - PREFETCHI CPUID.(EAX=7,ECX=1):EDX[bit 14] - XFD CPUID.(EAX=0xD,ECX=1):EAX[bit 4] - EPT_PAGE_WALK_LENGTH_5 VMX_EPT_VPID_CAP(0x48c)[bit 7] Add all features of GraniteRapids CPU model except above features to SierraForest CPU model. SierraForest doesn’t support TSX and RTM but supports TAA_NO. When RTM is not enabled in host, KVM will not report TAA_NO. So, just don't include TAA_NO in SierraForest CPU model. [1] https://cdrdv2.intel.com/v1/dl/getContent/671368 Reviewed-by: Zhao Liu <zhao1.liu@intel.com> Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com> Signed-off-by: Tao Su <tao1.su@linux.intel.com> Message-ID: <20240320021044.508263-1-tao1.su@linux.intel.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* target/i386: Introduce Icelake-Server-v7 to enable TSXZhenzhong Duan2024-04-231-0/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | When start L2 guest with both L1/L2 using Icelake-Server-v3 or above, QEMU reports below warning: "warning: host doesn't support requested feature: MSR(10AH).taa-no [bit 8]" Reason is QEMU Icelake-Server-v3 has TSX feature disabled but enables taa-no bit. It's meaningless that TSX isn't supported but still claim TSX is secure. So L1 KVM doesn't expose taa-no to L2 if TSX is unsupported, then starting L2 triggers the warning. Fix it by introducing a new version Icelake-Server-v7 which has both TSX and taa-no features. Then guest can use TSX securely when it see taa-no. This matches the production Icelake which supports TSX and isn't susceptible to TSX Async Abort (TAA) vulnerabilities, a.k.a, taa-no. Ideally, TSX should have being enabled together with taa-no since v3, but for compatibility, we'd better to add v7 to enable it. Fixes: d965dc35592d ("target/i386: Add ARCH_CAPABILITIES related bits into Icelake-Server CPU model") Tested-by: Xiangfei Ma <xiangfeix.ma@intel.com> Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com> Message-ID: <20240320093138.80267-2-zhenzhong.duan@intel.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* i386/kvm: Move architectural CPUID leaf generation to separate helperSean Christopherson2024-04-231-206/+211
| | | | | | | | | | | | | | Move the architectural (for lack of a better term) CPUID leaf generation to a separate helper so that the generation code can be reused by TDX, which needs to generate a canonical VM-scoped configuration. For now this is just a cleanup, so keep the function static. Signed-off-by: Sean Christopherson <sean.j.christopherson@intel.com> Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com> Message-ID: <20240229063726.610065-23-xiaoyao.li@intel.com> Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* kvm: add support for guest physical bitsGerd Hoffmann2024-04-181-8/+42
| | | | | | | | | | | | | | | | | | Query kvm for supported guest physical address bits, in cpuid function 80000008, eax[23:16]. Usually this is identical to host physical address bits. With NPT or EPT being used this might be restricted to 48 (max 4-level paging address space size) even if the host cpu supports more physical address bits. When set pass this to the guest, using cpuid too. Guest firmware can use this to figure how big the usable guest physical address space is, so PCI bar mapping are actually reachable. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com> Reviewed-by: Zhao Liu <zhao1.liu@intel.com> Message-ID: <20240318155336.156197-2-kraxel@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* target/i386: add guest-phys-bits cpu propertyGerd Hoffmann2024-04-182-0/+30
| | | | | | | | | | Allows to set guest-phys-bits (cpuid leaf 80000008, eax[23:16]) via -cpu $model,guest-phys-bits=$nr. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-ID: <20240318155336.156197-3-kraxel@redhat.com> Reviewed-by: Zhao Liu <zhao1.liu@intel.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* target/i386: Preserve DisasContextBase.insn_start across rewindRichard Henderson2024-04-091-0/+3
| | | | | | | | | | When aborting translation of the current insn, restore the previous value of insn_start. Acked-by: Paolo Bonzini <pbonzini@redhat.com> Tested-by: Jørgen Hansen <Jorgen.Hansen@wdc.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
* accel/hvf: Un-inline hvf_arch_supports_guest_debug()Philippe Mathieu-Daudé2024-04-021-1/+1
| | | | | | | | | | See previous commit and commit 9de9fa5cf2 ("Avoid using inlined functions with external linkage") for rationale. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20240313184954.42513-3-philmd@linaro.org>
* target/i386/tcg: Enable page walking from MMIO memoryGregory Price2024-03-261-27/+30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | CXL emulation of interleave requires read and write hooks due to requirement for subpage granularity. The Linux kernel stack now enables using this memory as conventional memory in a separate NUMA node. If a process is deliberately forced to run from that node $ numactl --membind=1 ls the page table walk on i386 fails. Useful part of backtrace: (cpu=cpu@entry=0x555556fd9000, fmt=fmt@entry=0x555555fe3378 "cpu_io_recompile: could not find TB for pc=%p") at ../../cpu-target.c:359 (retaddr=0, addr=19595792376, attrs=..., xlat=<optimized out>, cpu=0x555556fd9000, out_offset=<synthetic pointer>) at ../../accel/tcg/cputlb.c:1339 (cpu=0x555556fd9000, full=0x7fffee0d96e0, ret_be=ret_be@entry=0, addr=19595792376, size=size@entry=8, mmu_idx=4, type=MMU_DATA_LOAD, ra=0) at ../../accel/tcg/cputlb.c:2030 (cpu=cpu@entry=0x555556fd9000, p=p@entry=0x7ffff56fddc0, mmu_idx=<optimized out>, type=type@entry=MMU_DATA_LOAD, memop=<optimized out>, ra=ra@entry=0) at ../../accel/tcg/cputlb.c:2356 (cpu=cpu@entry=0x555556fd9000, addr=addr@entry=19595792376, oi=oi@entry=52, ra=ra@entry=0, access_type=access_type@entry=MMU_DATA_LOAD) at ../../accel/tcg/cputlb.c:2439 at ../../accel/tcg/ldst_common.c.inc:301 at ../../target/i386/tcg/sysemu/excp_helper.c:173 (err=0x7ffff56fdf80, out=0x7ffff56fdf70, mmu_idx=0, access_type=MMU_INST_FETCH, addr=18446744072116178925, env=0x555556fdb7c0) at ../../target/i386/tcg/sysemu/excp_helper.c:578 (cs=0x555556fd9000, addr=18446744072116178925, size=<optimized out>, access_type=MMU_INST_FETCH, mmu_idx=0, probe=<optimized out>, retaddr=0) at ../../target/i386/tcg/sysemu/excp_helper.c:604 Avoid this by plumbing the address all the way down from x86_cpu_tlb_fill() where is available as retaddr to the actual accessors which provide it to probe_access_full() which already handles MMIO accesses. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2180 Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2220 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Suggested-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Gregory Price <gregory.price@memverge.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> Message-ID: <20240307155304.31241-2-Jonathan.Cameron@huawei.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
* target/i386: Revert monitor_puts() in do_inject_x86_mce()Tao Su2024-03-201-1/+1
| | | | | | | | | | | | | | monitor_puts() doesn't check the monitor pointer, but do_inject_x86_mce() may have a parameter with NULL monitor pointer. Revert monitor_puts() in do_inject_x86_mce() to fix, then the fact that we send the same message to monitor and log is again more obvious. Fixes: bf0c50d4aa85 (monitor: expose monitor_puts to rest of code) Reviwed-by: Xiaoyao Li <xiaoyao.li@intel.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Tao Su <tao1.su@linux.intel.com> Message-ID: <20240320083640.523287-1-tao1.su@linux.intel.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* target/i386: fix direction of "32-bit MMU" testPaolo Bonzini2024-03-182-2/+2
| | | | | | | | | | | | | The low bit of MMU indices for x86 TCG indicates whether the processor is in 32-bit mode and therefore linear addresses have to be masked to 32 bits. However, the index was computed incorrectly, leading to possible conflicts in the TLB for any address above 4G. Analyzed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Fixes: b1661801c18 ("target/i386: Fix physical address truncation", 2024-02-28) Cc: qemu-stable@nongnu.org Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2206 Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* Merge tag 'pull-error-2024-03-12' of https://repo.or.cz/qemu/armbru into stagingPeter Maydell2024-03-121-9/+25
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Error reporting patches for 2024-03-12 # -----BEGIN PGP SIGNATURE----- # # iQJGBAABCAAwFiEENUvIs9frKmtoZ05fOHC0AOuRhlMFAmXwWOYSHGFybWJydUBy # ZWRoYXQuY29tAAoJEDhwtADrkYZT+voP/jAEyPfbtwggKLHjSCkHchn/uUziLJ2o # //i7+ZV9soCizAEkW+AkIR17PsMCaRsa8W4AULLn+ZaDJNy1Vlj2WYIkgeFm/rba # AWfNXywIg7dLnj0Hd98nz13hPuP52hO9vpakPhcua9L6mmk1htdqbbGIFIIfbQhp # e6FM+sBEW44uGcZx+N0wMEpKF0F7RId/jzH4mfP35WE7CLaAr2EfTXFaadAM636e # QsrM8wuiNAPQeyXz14gxYTWAnnMGglM5WQ4hoxSGN0y8c007gvff5vMKc7vapn4/ # DdiYJqpq/DIWaiGL0Fl8Cpry3WrQ8UY0st745kCLF/f9nlL0GvnBGdLdUaap7lQZ # A/C1sDKNubAGwzcw643AhV73QHc9f5kDBdWIj5wj3k5DQmBmgKACzGs1edDVVB+2 # OaStqZZ/V9Q5gljjh6PiHEptTjPhsaftX7GGjbhXTJUDFB9GONSCEVwAdZZxJ0Pm # 6cQLtcIMtcjL4xXNz6niVZkxGT/zu4kqbZ01LudIqEQAnULwRiVpyjkCmReSAOPP # eBtkCQtn7WPlz4N3ZiV2+a1p4/e88KH9wvxF+XvPEJjgsdeUmxX44f82ouLPJzvE # fOXE11tRr41u9m+UmoinVo581CKYGlkRJlNQWQwFOmnXoKP2nPZzADxraihkCR5p # wT0Hz9uwJs94 # =6FSf # -----END PGP SIGNATURE----- # gpg: Signature made Tue 12 Mar 2024 13:30:14 GMT # gpg: using RSA key 354BC8B3D7EB2A6B68674E5F3870B400EB918653 # gpg: issuer "armbru@redhat.com" # gpg: Good signature from "Markus Armbruster <armbru@redhat.com>" [full] # gpg: aka "Markus Armbruster <armbru@pond.sub.org>" [full] # Primary key fingerprint: 354B C8B3 D7EB 2A6B 6867 4E5F 3870 B400 EB91 8653 * tag 'pull-error-2024-03-12' of https://repo.or.cz/qemu/armbru: target/loongarch: Fix query-cpu-model-expansion to reject props target: Improve error reporting for CpuModelInfo member @props target/i386: Fix query-cpu-model-expansion to reject props target: Simplify type checks for CpuModelInfo member @props Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * target: Improve error reporting for CpuModelInfo member @propsMarkus Armbruster2024-03-121-5/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | query-cpu-model-comparison, query-cpu-model-baseline, and query-cpu-model-expansion take CpuModelInfo arguments. Errors in @props members of these arguments are reported for 'props', without further context. For instance, s390x rejects {"execute": "query-cpu-model-comparison", "arguments": {"modela": {"name": "z13", "props": {}}, "modelb": {"name": "z14", "props": []}}} with {"error": {"class": "GenericError", "desc": "Invalid parameter type for 'props', expected: object"}} This is unusual; the common QAPI unmarshaling machinery would complain about 'modelb.props'. Our hand-written code to visit the @props member neglects to provide the context. Tweak it so it provides it. The command above now fails with {"error": {"class": "GenericError", "desc": "Invalid parameter type for 'modelb.props', expected: dict"}} Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-ID: <20240305145919.2186971-4-armbru@redhat.com> Acked-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
| * target/i386: Fix query-cpu-model-expansion to reject propsMarkus Armbruster2024-03-121-8/+23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | CpuModelInfo member @props is semantically a mapping from name to value, and syntactically a JSON object on the wire. This translates to QDict in C. Since the QAPI schema language lacks the means to express 'object', we use 'any' instead. This is QObject in C. Commands taking a CpuModelInfo argument need to check the QObject is a QDict. The i386 version of qmp_query_cpu_model_expansion() fails to check. Instead, @props is silently ignored when it's not an object. For instance, {"execute": "query-cpu-model-expansion", "arguments": {"type": "full", "model": {"name": "qemu64", "props": null}}} succeeds. Fix by refactoring the code to match the other targets. Now the command fails as it should: {"error": {"class": "GenericError", "desc": "Invalid parameter type for 'props', expected: object"}} Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-ID: <20240305145919.2186971-3-armbru@redhat.com>
* | target/i386/hvf: Use CPUState typedefPhilippe Mathieu-Daudé2024-03-127-49/+52
| | | | | | | | | | | | | | | | | | | | | | | | QEMU coding style recommend using structure typedefs: https://www.qemu.org/docs/master/devel/style.html#typedefs Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Zhao Liu <zhao1.liu@intel.com> Message-ID: <20240129164514.73104-14-philmd@linaro.org> [thuth: Break long lines to avoid checkpatch.pl errors] Signed-off-by: Thomas Huth <thuth@redhat.com>
* | target: Replace CPU_GET_CLASS(cpu -> obj) in cpu_reset_hold() handlerPhilippe Mathieu-Daudé2024-03-121-7/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Since CPU() macro is a simple cast, the following are equivalent: Object *obj; CPUState *cs = CPU(obj) In order to ease static analysis when running scripts/coccinelle/cpu_env.cocci from the previous commit, replace: - CPU_GET_CLASS(cpu); + CPU_GET_CLASS(obj); Most code use the 'cs' variable name for CPUState handle. Replace few 's' -> 'cs' to unify cpu_reset_hold() style. No logical change in this patch. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Acked-by: Richard Henderson <richard.henderson@linaro.org> Message-ID: <20240129164514.73104-7-philmd@linaro.org> Signed-off-by: Thomas Huth <thuth@redhat.com>
* | bulk: Call in place single use cpu_env()Philippe Mathieu-Daudé2024-03-122-16/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Avoid CPUArchState local variable when cpu_env() is used once. Mechanical patch using the following Coccinelle spatch script: @@ type CPUArchState; identifier env; expression cs; @@ { - CPUArchState *env = cpu_env(cs); ... when != env - env + cpu_env(cs) ... when != env } Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-ID: <20240129164514.73104-5-philmd@linaro.org> Signed-off-by: Thomas Huth <thuth@redhat.com>
* | bulk: Access existing variables initialized to &S->F when availablePhilippe Mathieu-Daudé2024-03-121-1/+1
|/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | When a variable is initialized to &struct->field, use it in place. Rationale: while this makes the code more concise, this also helps static analyzers. Mechanical change using the following Coccinelle spatch script: @@ type S, F; identifier s, m, v; @@ S *s; ... F *v = &s->m; <+... - &s->m + v ...+> Inspired-by: Zhao Liu <zhao1.liu@intel.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20240129164514.73104-2-philmd@linaro.org> Acked-by: Fabiano Rosas <farosas@suse.de> Reviewed-by: Zhao Liu <zhao1.liu@intel.com> Reviewed-by: Anthony PERARD <anthony.perard@citrix.com> [thuth: Dropped hunks that need a rebase, and fixed sizeof() in pmu_realize()] Signed-off-by: Thomas Huth <thuth@redhat.com>
* Merge tag 'hw-misc-20240309' of https://github.com/philmd/qemu into stagingPeter Maydell2024-03-091-0/+1
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Misc HW patch queue - hmp: Shorter 'info qtree' output (Zoltan) - qdev: Add a granule_mode property (Eric) - Some ERRP_GUARD() fixes (Zhao) - Doc & style fixes in docs/interop/firmware.json (Thomas) - hw/xen: Housekeeping (Phil) - hw/ppc/mac99: Change timebase frequency 25 -> 100 MHz (Mark) - hw/intc/apic: Memory leak fix (Paolo) - hw/intc/grlib_irqmp: Ensure ncpus value is in range (Clément) - hw/m68k/mcf5208: Add support for reset (Angelo) - hw/i386/pc: Housekeeping (Phil) - hw/core/smp: Remove/deprecate parameter=0,1 adapting test-smp-parse (Zhao) # -----BEGIN PGP SIGNATURE----- # # iQIzBAABCAAdFiEE+qvnXhKRciHc/Wuy4+MsLN6twN4FAmXstpMACgkQ4+MsLN6t # wN6XBw//dNItFhf1YX+Au4cNoQVDgHE9RtzEIGOnwcL1CgrA9rAQQfLRE5KWM6sN # 1qiPh+T6SPxtiQ2rw4AIpsI7TXjO72b/RDWpUUSwnfH39eC77pijkxIK+i9mYI9r # p0sPjuP6OfolUFYeSbYX+DmNZh1ONPf27JATJQEf0st8dyswn7lTQvJEaQ97kwxv # UKA0JD5l9LZV8Zr92cgCzlrfLcbVblJGux9GYIL09yN78yqBuvTm77GBC/rvC+5Q # fQC5PQswJZ0+v32AXIfSysMp2R6veo4By7VH9Lp51E/u9jpc4ZbcDzxzaJWE6zOR # fZ01nFzou1qtUfZi+MxNiDR96LP6YoT9xFdGYfNS6AowZn8kymCs3eo7M9uvb+rN # A2Sgis9rXcjsR4e+w1YPBXwpalJnLwB0QYhEOStR8wo1ceg7GBG6zHUJV89OGzsA # KS8X0aV1Ulkdm/2H6goEhzrcC6FWLg8pBJpfKK8JFWxXNrj661xM0AAFVL9we356 # +ymthS2x/RTABSI+1Lfsoo6/SyXoimFXJJWA82q9Yzoaoq2gGMWnfwqxfix6JrrA # PuMnNP5WNvh04iWcNz380P0psLVteHWcVfTRN3JvcJ9iJ2bpjcU1mQMJtvSF9wBn # Y8kiJTUmZCu3br2e5EfxmypM/h8y29VD/1mxPk8Dtcq3gjx9AU4= # =juZH # -----END PGP SIGNATURE----- # gpg: Signature made Sat 09 Mar 2024 19:20:51 GMT # gpg: using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE # gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <f4bug@amsat.org>" [full] # Primary key fingerprint: FAAB E75E 1291 7221 DCFD 6BB2 E3E3 2C2C DEAD C0DE * tag 'hw-misc-20240309' of https://github.com/philmd/qemu: (43 commits) hw/m68k/mcf5208: add support for reset tests/unit/test-smp-parse: Test "parameter=0" SMP configurations tests/unit/test-smp-parse: Test smp_props.has_clusters tests/unit/test-smp-parse: Test the full 7-levels topology hierarchy tests/unit/test-smp-parse: Test "drawers" and "books" combination case tests/unit/test-smp-parse: Test "drawers" parameter in -smp tests/unit/test-smp-parse: Test "books" parameter in -smp tests/unit/test-smp-parse: Make test cases aware of the book/drawer tests/unit/test-smp-parse: Bump max_cpus to 4096 tests/unit/test-smp-parse: Use CPU number macros in invalid topology case tests/unit/test-smp-parse: Drop the unsupported "dies=1" case hw/core/machine-smp: Calculate total CPUs once in machine_parse_smp_config() hw/core/machine-smp: Deprecate unsupported "parameter=1" SMP configurations hw/core/machine-smp: Remove deprecated "parameter=0" SMP configurations docs/interop/firmware.json: Fix doc for FirmwareFlashMode docs/interop/firmware.json: Align examples hw/intc/grlib_irqmp: abort realize when ncpus value is out of range mac_newworld: change timebase frequency from 100MHz to 25MHz for mac99 machine hmp: Add option to info qtree to omit details qdev: Add a granule_mode property ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * target/i386/sev: Fix missing ERRP_GUARD() for error_prepend()Zhao Liu2024-03-091-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | As the comment in qapi/error, passing @errp to error_prepend() requires ERRP_GUARD(): * = Why, when and how to use ERRP_GUARD() = * * Without ERRP_GUARD(), use of the @errp parameter is restricted: ... * - It should not be passed to error_prepend(), error_vprepend() or * error_append_hint(), because that doesn't work with &error_fatal. * ERRP_GUARD() lifts these restrictions. * * To use ERRP_GUARD(), add it right at the beginning of the function. * @errp can then be used without worrying about the argument being * NULL or &error_fatal. ERRP_GUARD() could avoid the case when @errp is the pointer of error_fatal, the user can't see this additional information, because exit() happens in error_setg earlier than information is added [1]. The sev_inject_launch_secret() passes @errp to error_prepend(), and as an APIs defined in target/i386/sev.h, it is necessary to protect its @errp with ERRP_GUARD(). To avoid the issue like [1] said, add missing ERRP_GUARD() at the beginning of this function. [1]: Issue description in the commit message of commit ae7c80a7bd73 ("error: New macro ERRP_GUARD()"). Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: Marcelo Tosatti <mtosatti@redhat.com> Signed-off-by: Zhao Liu <zhao1.liu@intel.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Message-ID: <20240229143914.1977550-17-zhao1.liu@linux.intel.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
* | vmbus: Print a warning when enabled without the recommended set of featuresMaciej S. Szmigiero2024-03-084-0/+18
|/ | | | | | | | | | | | | | | Some Windows versions crash at boot or fail to enable the VMBus device if they don't see the expected set of Hyper-V features (enlightenments). Since this provides poor user experience let's warn user if the VMBus device is enabled without the recommended set of Hyper-V features. The recommended set is the minimum set of Hyper-V features required to make the VMBus device work properly in Windows Server versions 2016, 2019 and 2022. Acked-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Maciej S. Szmigiero <maciej.szmigiero@oracle.com>
* Merge tag 'for-upstream' of https://gitlab.com/bonzini/qemu into stagingPeter Maydell2024-02-285-45/+92
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * target/i386: Fix physical address truncation on 32-bit PAE * Remove globals for options -no-fd-bootchk and -win2k-hack # -----BEGIN PGP SIGNATURE----- # # iQFIBAABCAAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAmXebwQUHHBib256aW5p # QHJlZGhhdC5jb20ACgkQv/vSX3jHroPozAf/Vgc9u6C+8PcPDrol6qxjI+EOHLNy # 7M3/OFpUkwLXuOSawb6syYxHpLS38fKRcsb2ninngUmbRWA6p+KNUizlAFMj7op5 # wJmtdamCwCwXXaw20SfWxx2Ih0JS7FQsRsU94HTOdaDB17C9+hBcYwcggsOAXCmq # gyVenEF1mov2A4jLMhdVIRX784AAoEP+QAuhBKQBrQwRLCTTyNdHl7jXdB9w+2sh # KafokoFLcozJHz/tN3AhRKy6zjPugJyQmJwBRuj9tstCILtXpvf/ZE/3pUq5l3ZY # A6dCI0zWAlGNTkpKRXsMFozNIVP2htnyidy29XHptlY5acfjtQ++rMu3BQ== # =WY4H # -----END PGP SIGNATURE----- # gpg: Signature made Tue 27 Feb 2024 23:23:48 GMT # gpg: using RSA key F13338574B662389866C7682BFFBD25F78C7AE83 # gpg: issuer "pbonzini@redhat.com" # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" [full] # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" [full] # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * tag 'for-upstream' of https://gitlab.com/bonzini/qemu: ide, vl: turn -win2k-hack into a property on IDE devices ide: collapse parameters to ide_init_drive target/i386: leave the A20 bit set in the final NPT walk target/i386: remove unnecessary/wrong application of the A20 mask target/i386: Fix physical address truncation target/i386: use separate MMU indexes for 32-bit accesses target/i386: introduce function to query MMU indices target/i386: check validity of VMCB addresses target/i386: mask high bits of CR3 in 32-bit mode vl, pc: turn -no-fd-bootchk into a machine property Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * target/i386: leave the A20 bit set in the final NPT walkPaolo Bonzini2024-02-281-5/+7
| | | | | | | | | | | | | | | | | | | | | | | | The A20 mask is only applied to the final memory access. Nested page tables are always walked with the raw guest-physical address. Unlike the previous patch, in this one the masking must be kept, but it was done too early. Cc: qemu-stable@nongnu.org Fixes: 4a1e9d4d11c ("target/i386: Use atomic operations for pte updates", 2022-10-18) Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| * target/i386: remove unnecessary/wrong application of the A20 maskPaolo Bonzini2024-02-281-13/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If ptw_translate() does a MMU_PHYS_IDX access, the A20 mask is already applied in get_physical_address(), which is called via probe_access_full() and x86_cpu_tlb_fill(). If ptw_translate() on the other hand does a MMU_NESTED_IDX access, the A20 mask must not be applied to the address that is looked up in the nested page tables; it must be applied only to the addresses that hold the NPT entries (which is achieved via MMU_PHYS_IDX, per the previous paragraph). Therefore, we can remove A20 masking from the computation of the page table entry's address, and let get_physical_address() or mmu_translate() apply it when they know they are returning a host-physical address. Cc: qemu-stable@nongnu.org Fixes: 4a1e9d4d11c ("target/i386: Use atomic operations for pte updates", 2022-10-18) Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| * target/i386: Fix physical address truncationPaolo Bonzini2024-02-283-8/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The address translation logic in get_physical_address() will currently truncate physical addresses to 32 bits unless long mode is enabled. This is incorrect when using physical address extensions (PAE) outside of long mode, with the result that a 32-bit operating system using PAE to access memory above 4G will experience undefined behaviour. The truncation code was originally introduced in commit 33dfdb5 ("x86: only allow real mode to access 32bit without LMA"), where it applied only to translations performed while paging is disabled (and so cannot affect guests using PAE). Commit 9828198 ("target/i386: Add MMU_PHYS_IDX and MMU_NESTED_IDX") rearranged the code such that the truncation also applied to the use of MMU_PHYS_IDX and MMU_NESTED_IDX. Commit 4a1e9d4 ("target/i386: Use atomic operations for pte updates") brought this truncation into scope for page table entry accesses, and is the first commit for which a Windows 10 32-bit guest will reliably fail to boot if memory above 4G is present. The truncation code however is not completely redundant. Even though the maximum address size for any executed instruction is 32 bits, helpers for operations such as BOUND, FSAVE or XSAVE may ask get_physical_address() to translate an address outside of the 32-bit range, if invoked with an argument that is close to the 4G boundary. Likewise for processor accesses, for example TSS or IDT accesses, when EFER.LMA==0. So, move the address truncation in get_physical_address() so that it applies to 32-bit MMU indexes, but not to MMU_PHYS_IDX and MMU_NESTED_IDX. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2040 Fixes: 4a1e9d4d11c ("target/i386: Use atomic operations for pte updates", 2022-10-18) Cc: qemu-stable@nongnu.org Co-developed-by: Michael Brown <mcb30@ipxe.org> Signed-off-by: Michael Brown <mcb30@ipxe.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| * target/i386: use separate MMU indexes for 32-bit accessesPaolo Bonzini2024-02-283-15/+33
| | | | | | | | | | | | | | | | | | | | | | Accesses from a 32-bit environment (32-bit code segment for instruction accesses, EFER.LMA==0 for processor accesses) have to mask away the upper 32 bits of the address. While a bit wasteful, the easiest way to do so is to use separate MMU indexes. These days, QEMU anyway is compiled with a fixed value for NB_MMU_MODES. Split MMU_USER_IDX, MMU_KSMAP_IDX and MMU_KNOSMAP_IDX in two. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>