summary refs log tree commit diff stats
path: root/target/riscv (follow)
Commit message (Collapse)AuthorAgeFilesLines
* target/riscv: Fix endianness swap on compressed instructionsvhaudiquet2025-10-031-3/+3
| | | | | | | | | | | | | | | | | Three instructions were not using the endianness swap flag, which resulted in a bug on big-endian architectures. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3131 Buglink: https://bugs.launchpad.net/ubuntu/+source/qemu/+bug/2123828 Fixes: e0a3054f18e ("target/riscv: add support for Zcb extension") Signed-off-by: Valentin Haudiquet <valentin.haudiquet@canonical.com> Cc: qemu-stable@nongnu.org Reviewed-by: Anton Johansson <anjo@rev.ng> Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com> Reviewed-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-ID: <20250929115543.1648157-1-valentin.haudiquet@canonical.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
* target/riscv: rvv: Fix vslide1[up|down].vx unexpected result when XLEN=32 ↵Max Chou2025-10-033-20/+66
| | | | | | | | | | | | | | | | | | and SEW=64 When XLEN is 32 and SEW is 64, the original implementation of vslide1up.vx and vslide1down.vx helper functions fills the 32-bit value of rs1 into the first element of the destination vector register (rd), which is a 64-bit element. This commit attempted to resolve the issue by extending the rs1 value to 64 bits during the TCG translation phase to ensure that the helper functions won't lost the higer 32 bits. Signed-off-by: Max Chou <max.chou@sifive.com> Acked-by: Alistair Francis <alistair.francis@wdc.com> Message-ID: <20250124073325.2467664-1-max.chou@sifive.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
* target/riscv: rvv: Modify minimum VLEN according to enabled vector extensionsMax Chou2025-10-031-2/+17
| | | | | | | | | | | | | | | | According to the RISC-V unprivileged specification, the VLEN should be greater or equal to the ELEN. This commit modifies the minimum VLEN based on the vector extensions and introduces a check rule for VLEN and ELEN. Extension Minimum VLEN * V 128 * Zve64[d|f|x] 64 * Zve32[f|x] 32 Signed-off-by: Max Chou <max.chou@sifive.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-ID: <20250923090729.1887406-3-max.chou@sifive.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
* target/riscv: rvv: Replace checking V by checking Zve32xMax Chou2025-10-035-5/+7
| | | | | | | | | | | The Zve32x extension will be applied by the V and Zve* extensions. Therefore we can replace the original V checking with Zve32x checking for both the V and Zve* extensions. Signed-off-by: Max Chou <max.chou@sifive.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-ID: <20250923090729.1887406-2-max.chou@sifive.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
* target/riscv: Fix ssamoswap error handlingJim Shu2025-10-033-0/+62
| | | | | | | | | | | | Follow the RISC-V CFI v1.0 spec [1] to fix the exception type when ssamoswap is disabled by xSSE. [1] RISC-V CFI spec v1.0, ch2.7 Atomic Swap from a Shadow Stack Location Signed-off-by: Jim Shu <jim.shu@sifive.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-ID: <20250924074818.230010-4-jim.shu@sifive.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
* target/riscv: Fix SSP CSR error handling in VU/VS modeJim Shu2025-10-031-0/+2
| | | | | | | | | | | | | In VU/VS mode, accessing $ssp CSR will trigger the virtual instruction exception instead of illegal instruction exception if SSE is disabled via xenvcfg CSRs. This is from RISC-V CFI v1.0 spec ch2.2.4. Shadow Stack Pointer Signed-off-by: Jim Shu <jim.shu@sifive.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-ID: <20250924074818.230010-3-jim.shu@sifive.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
* target/riscv: Fix the mepc when sspopchk triggers the exceptionJim Shu2025-10-031-0/+1
| | | | | | | | | | | When sspopchk is in the middle of TB and triggers the SW check exception, it should update PC from gen_update_pc(). If not, RISC-V mepc CSR will get wrong PC address which is still at the start of TB. Signed-off-by: Jim Shu <jim.shu@sifive.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-ID: <20250924074818.230010-2-jim.shu@sifive.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
* target/riscv: do not use translator_ldl in opcode_atVladimir Isaev2025-10-031-1/+2
| | | | | | | | | | | | | | | | | | opcode_at is used only in semihosting checks to match opcodes with expected pattern. This is not a translator and if we got following assert if page is not in TLB: qemu-system-riscv64: ../accel/tcg/translator.c:363: record_save: Assertion `offset == db->record_start + db->record_len' failed. Fixes: 1f9c4462334f ("target/riscv: Use translator_ld* for everything") Signed-off-by: Vladimir Isaev <vladimir.isaev@syntacore.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-ID: <20250815140633.86920-1-vladimir.isaev@syntacore.com> [ Changes by AF: - Fixup header includes after rebase ] Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
* target/riscv: use riscv_csrr in riscv_csr_readstove2025-10-031-1/+1
| | | | | | | | | | | | | | | | Commit 38c83e8d3a33 ("target/riscv: raise an exception when CSRRS/CSRRC writes a read-only CSR") changed the behavior of riscv_csrrw, which would formerly be treated as read-only if the write mask were set to 0. Fixes an exception being raised when accessing read-only vector CSRs like vtype. Fixes: 38c83e8d3a33 ("target/riscv: raise an exception when CSRRS/CSRRC writes a read-only CSR") Signed-off-by: stove <stove@rivosinc.com> Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com> Message-ID: <20250827203617.79947-1-stove@rivosinc.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
* target/riscv/kvm: Use riscv_cpu_is_32bit() when handling SBI_DBCN regPhilippe Mathieu-Daudé2025-10-031-1/+1
| | | | | | | | | | Use the existing riscv_cpu_is_32bit() helper to check for 32-bit CPU. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Andrew Jones <ajones@ventanamicro.com> Message-ID: <20250924164515.51782-1-philmd@linaro.org> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
* target/riscv: Save stimer and vstimer in CPU vmstateTANG Tiancheng2025-10-031-0/+25
| | | | | | | | | | | | | | | vmstate_riscv_cpu was missing env.stimer and env.vstimer. Without migrating these QEMUTimer fields, active S/VS-mode timer events are lost after snapshot or migration. Add VMSTATE_TIMER_PTR() entries to save and restore them. Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com> Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com> Signed-off-by: TANG Tiancheng <lyndra@linux.alibaba.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-ID: <20250911-timers-v3-4-60508f640050@linux.alibaba.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
* target/riscv: implement MonitorDef HMP APIDaniel Henrique Barboza2025-10-022-0/+149
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The MonitorDef API is related to two HMP monitor commands: 'p' and 'x': (qemu) help p print|p /fmt expr -- print expression value (use $reg for CPU register access) (qemu) help x x /fmt addr -- virtual memory dump starting at 'addr' For x86, one of the few targets that implements it, it is possible to print the PC register value with $pc and use the PC value in the 'x' command as well. Those 2 commands are hooked into get_monitor_def(), called by exp_unary() in hmp.c. The function tries to fetch a reg value in two ways: by reading them directly via a target_monitor_defs array or using a target_get_monitor_def() helper. In RISC-V we have *A LOT* of registers and this number will keep getting bigger, so we're opting out of an array declaration. We're able to retrieve all regs but vregs because the API only fits an uint64_t and vregs have 'vlen' size that are bigger than that. With this patch we can do things such as: - print CSRs and use their val in expressions: (qemu) p $mstatus 0xa000000a0 (qemu) p $mstatus & 0xFF 0xa0 - dump the next 10 insn from virtual memory starting at x1 (ra): (qemu) x/10i $ra 0xffffffff80958aea: a9bff0ef jal ra,-1382 # 0xffffffff80958584 0xffffffff80958aee: 10016073 csrrsi zero,sstatus,2 0xffffffff80958af2: 60a2 ld ra,8(sp) 0xffffffff80958af4: 6402 ld s0,0(sp) 0xffffffff80958af6: 0141 addi sp,sp,16 0xffffffff80958af8: 8082 ret 0xffffffff80958afa: 10016073 csrrsi zero,sstatus,2 0xffffffff80958afe: 8082 ret 0xffffffff80958b00: 1141 addi sp,sp,-16 0xffffffff80958b02: e422 sd s0,8(sp) (qemu) Suggested-by: Dr. David Alan Gilbert <dave@treblig.org> Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-ID: <20250703130815.1592493-1-dbarboza@ventanamicro.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
* include/semihosting/common-semi: extract common_semi APIPierrick Bouvier2025-09-262-10/+13
| | | | | | | | | | | | | | | We transform target/{arm,riscv}/common-semi-target.h headers to proper compilation units, and use them in arm-compat-semi.c. This way, we can include only the declaration header (which is target agnostic), and selectively link the appropriate implementation based on current target. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Message-ID: <20250822150058.18692-8-pierrick.bouvier@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-ID: <20250922093711.2768983-11-alex.bennee@linaro.org>
* target/{arm, riscv}/common-semi-target: eradicate target_ulongPierrick Bouvier2025-09-261-3/+3
| | | | | | | | | | | | We replace mechanically with uint64_t. There is no semantic change, and allows us to extract a proper API from this set of functions. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Message-ID: <20250822150058.18692-7-pierrick.bouvier@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-ID: <20250922093711.2768983-10-alex.bennee@linaro.org>
* target/riscv/common-semi-target: remove sizeof(target_ulong)Pierrick Bouvier2025-09-261-4/+4
| | | | | | | | | | Only riscv64 extends SYS_EXIT, similar to aarch64. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Message-ID: <20250822150058.18692-6-pierrick.bouvier@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-ID: <20250922093711.2768983-9-alex.bennee@linaro.org>
* semihosting/arm-compat-semi: change common_semi_sys_exit_extendedPierrick Bouvier2025-09-261-2/+2
| | | | | | | | | | | | We now check only is sys_exit is extended. This allows to break dependency to TARGET_SYS_EXIT_EXTENDED which will not be available anymore from this code. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Message-ID: <20250822150058.18692-5-pierrick.bouvier@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-ID: <20250922093711.2768983-8-alex.bennee@linaro.org>
* target/riscv: Record misa_ext in TCGTBCPUState.cs_baseRichard Henderson2025-09-242-4/+2
| | | | | | | | | | | | | | The tb_flush within write_misa was incorrect. It assumed that we could adjust the ISA of the current processor and discard all TB and all would be well. But MISA is per vcpu, so globally flushing TB does not mean that the TB matches the MISA of any given vcpu. By recording misa in the tb state, we ensure that the code generated matches the vcpu. Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
* target/riscv: Restrict midelegh access to S-mode hartsJay Chang2025-07-301-2/+5
| | | | | | | | | | | | | | | | | | | | RISC-V AIA Spec states: "For a machine-level environment, extension Smaia encompasses all added CSRs and all modifications to interrupt response behavior that the AIA specifies for a hart, over all privilege levels. For a supervisor-level environment, extension Ssaia is essentially the same as Smaia except excluding the machine-level CSRs and behavior not directly visible to supervisor level." Since midelegh is an AIA machine-mode CSR, add Smaia extension check in aia_smode32 predicate. Reviewed-by: Frank Chang <frank.chang@sifive.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Signed-off-by: Jay Chang <jay.chang@sifive.com> Reviewed-by: Nutty Liu<liujingqi@lanxincomputing.com> Message-ID: <20250701030021.99218-3-jay.chang@sifive.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
* target/riscv: Restrict mideleg/medeleg/medelegh access to S-mode hartsJay Chang2025-07-301-3/+3
| | | | | | | | | | | | | | | | | | | RISC-V Privileged Spec states: "In harts with S-mode, the medeleg and mideleg registers must exist, and setting a bit in medeleg or mideleg will delegate the corresponding trap , when occurring in S-mode or U-mode, to the S-mode trap handler. In harts without S-mode, the medeleg and mideleg registers should not exist." Add smode predicate to ensure these CSRs are only accessible when S-mode is supported. Reviewed-by: Frank Chang <frank.chang@sifive.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Signed-off-by: Jay Chang <jay.chang@sifive.com> Reviewed-by: Nutty Liu<liujingqi@lanxincomputing.com> Message-ID: <20250701030021.99218-2-jay.chang@sifive.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
* target/riscv: Fix exception type when VU accesses supervisor CSRsXu Lu2025-07-301-1/+1
| | | | | | | | | | | | When supervisor CSRs are accessed from VU-mode, a virtual instruction exception should be raised instead of an illegal instruction. Fixes: c1fbcecb3a (target/riscv: Fix csr number based privilege checking) Signed-off-by: Xu Lu <luxu.kernel@bytedance.com> Reviewed-by: Anup Patel <apatel@ventanamicro.com> Reviewed-by: Nutty Liu <liujingqi@lanxincomputing.com> Message-ID: <20250708060720.7030-1-luxu.kernel@bytedance.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
* riscv: Revert "Generate strided vector loads/stores with tcg nodes."Daniel Henrique Barboza2025-07-301-273/+50
| | | | | | | | | | | | | | | | | | This reverts commit 28c12c1f2f50d7f7f1ebfc587c4777ecd50aac5b. As reported in [1] this commit is breaking Linux vector code, and although a simpler reproducer was provided, the fix itself isn't trivial due to the amount and the nature of the changes. And we really do not want to keep Linux broken while we work on it. The revert will fix Linux and will give us time to do a proper fix. [1] https://mail.gnu.org/archive/html/qemu-devel/2025-07/msg02525.html Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com> Tested-by: Eric Biggers <ebiggers@kernel.org> Message-ID: <20250710100525.372985-1-dbarboza@ventanamicro.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
* target/riscv: do not call GETPC() in check_ret_from_m_mode()Daniel Henrique Barboza2025-07-301-6/+9
| | | | | | | | | | | | | | | | | | | | | | GETPC() should always be called from the top level helper, e.g. the first helper that is called by the translation code. We stopped doing that in commit 3157a553ec, and then we introduced problems when unwinding the exceptions being thrown by helper_mret(), as reported by [1]. Call GETPC() at the top level helper and pass the value along. [1] https://gitlab.com/qemu-project/qemu/-/issues/3020 Suggested-by: Richard Henderson <richard.henderson@linaro.org> Fixes: 3157a553ec ("target/riscv: Add Smrnmi mnret instruction") Closes: https://gitlab.com/qemu-project/qemu/-/issues/3020 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com> Reviewed-by: Nutty Liu <liujingqi@lanxincomputing.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-ID: <20250714133739.1248296-1-dbarboza@ventanamicro.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
* target/riscv: Fix pmp range wraparound on zeroVac Chen2025-07-301-3/+4
| | | | | | | | | | | | | | | | | | | | | pmp_is_in_range() prefers to match addresses within the interval [start, end]. To archieve this, pmpaddrX is decremented during the end address update. In TOR mode, a rule is ignored if its start address is greater than or equal to its end address. However, if pmpaddrX is set to 0, this decrement operation causes the calulated end address to wrap around to UINT_MAX. In this scenario, the address guard for this PMP entry would become ineffective. This patch addresses the issue by moving the guard check earlier, preventing the problematic wraparound when pmpaddrX is zero. Signed-off-by: Vac Chen <vacantron@gmail.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-ID: <20250706065554.42953-1-vacantron@gmail.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
* qemu: Declare all load/store helper in 'qemu/bswap.h'Philippe Mathieu-Daudé2025-07-151-1/+0
| | | | | | | | | | | | Restrict "exec/tswap.h" to the tswap*() methods, move the load/store helpers with the other ones declared in "qemu/bswap.h". Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Message-Id: <20250708215320.70426-8-philmd@linaro.org> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
* target: riscv: Add Svrsw60t59b extension supportAlexandre Ghiti2025-07-045-2/+15
| | | | | | | | | | | | The Svrsw60t59b extension allows to free the PTE reserved bits 60 and 59 for software to use. Reviewed-by: Deepak Gupta <debug@rivosinc.com> Signed-off-by: Alexandre Ghiti <alexghiti@rivosinc.com> Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com> Reviewed-by: Nutty Liu<liujingqi@lanxincomputing.com> Message-ID: <20250702-dev-alex-svrsw60b59b_v2-v2-1-504ddf0f8530@rivosinc.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
* target/riscv: Add a property to set vill bit on reserved usage of vsetvli ↵Vasilis Liaskovitis2025-07-045-4/+16
| | | | | | | | | | | | | | | | | | | instruction Usage of vsetvli instruction is reserved if VLMAX is changed when vsetvli rs1 and rd arguments are x0. In this case, if the new property is true, only the vill bit will be set. See https://github.com/riscv/riscv-isa-manual/blob/main/src/v-st-ext.adoc#avl-encoding According to the spec, the above use cases are reserved, and "Implementations may set vill in either case." Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2422 Signed-off-by: Vasilis Liaskovitis <vliaskovitis@suse.com> Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com> Message-ID: <20250618213542.22873-1-vliaskovitis@suse.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
* target/riscv: Fix MEPC/SEPC bit masking for IALIGNCharalampos Mitrodimas2025-07-043-6/+17
| | | | | | | | | | | | | | | | | | | | | | | According to the RISC-V Privileged Architecture specification, the low bit of MEPC/SEPC must always be zero. When IALIGN=32, the two low bits must be zero. This commit fixes the behavior of MEPC/SEPC CSR reads and writes, and the implicit reads by MRET/SRET instructions to properly mask the lowest bit(s) based on whether the C extension is enabled: - When C extension is enabled (IALIGN=16): mask bit 0 - When C extension is disabled (IALIGN=32): mask bits [1:0] Previously, when vectored mode bits from STVEC (which sets bit 0 for vectored mode) were written to MEPC, the bits would not be cleared correctly, causing incorrect behavior on MRET. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2855 Signed-off-by: Charalampos Mitrodimas <charmitro@posteo.net> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com> Message-ID: <20250703182157.281320-2-charmitro@posteo.net> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
* target/riscv: rvv: Fix missing exit TB flow for ldff_transMax Chou2025-07-041-0/+6
| | | | | | | | | | | | | According to the V spec, the vector fault-only-first load instructions may change the VL CSR. So the ldff_trans TCG translation function should generate the lookup_and_goto_ptr flow as the vsetvl/vsetvli translation function to make sure the vl_eq_vlmax TB flag is correct. Signed-off-by: Max Chou <max.chou@sifive.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-ID: <20250627133013.443997-1-max.chou@sifive.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
* target/riscv: Add BOSC's Xiangshan Kunminghu CPUHuang Borong2025-07-042-0/+59
| | | | | | | | | | | | | | | | | | | | Add a CPU entry for the Xiangshan Kunminghu CPU, an open-source, high-performance RISC-V processor. More details can be found at: https://github.com/OpenXiangShan/XiangShan Note: The ISA extensions supported by the Xiangshan Kunminghu CPU are categorized based on four RISC-V specifications: Volume I: Unprivileged Architecture, Volume II: Privileged Architecture, AIA, and RVA23. The extensions within each category are organized according to the chapter order in the specifications. Signed-off-by: Yu Hu <huyu@bosc.ac.cn> Signed-off-by: Ran Wang <wangran@bosc.ac.cn> Signed-off-by: Borong Huang <3543977024@qq.com> Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com> Acked-by: Alistair Francis <alistair.francis@wdc.com> Message-ID: <20250425122212.364-1-wangran@bosc.ac.cn> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
* target/riscv: Fix fcvt.s.bf16 NaN box checkingAnton Blanchard2025-07-042-1/+17
| | | | | | | | | | fcvt.s.bf16 uses the FP16 check_nanbox_h() which returns an FP16 quiet NaN. Add check_nanbox_bf16() which returns a BF16 quiet NaN. Signed-off-by: Anton Blanchard <antonb@tenstorrent.com> Acked-by: Alistair Francis <alistair.francis@wdc.com> Message-ID: <20250501114253.594887-1-antonb@tenstorrent.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
* target/riscv: use qemu_chr_fe_write_all() in DBCN_CONSOLE_WRITE_BYTEDaniel Henrique Barboza2025-07-041-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | The SBI spec states, for console write byte: "This is a blocking SBI call and it will only return after writing the specified byte to the debug console. It will also return, with SBI_ERR_FAILED, if there are I/O errors." Being a blocker call will either succeed writing the byte or error out, it's feasible to use the blocking qemu_chr_fe_write_all() instead of qemu_chr_fe_write(). Last but not the least, we will duck possible changes in qemu_chr_fe_write() where ret = 0 will have a 'zero byte written' semantic [1] - something that we're not ready to deal in this current state. [1] https://lore.kernel.org/qemu-devel/CAFEAcA_kEndvNtw4EHySXWwQPoGs029yAzZGGBcV=zGHaj7KUQ@mail.gmail.com/ Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20250605094456.1385105-2-dbarboza@ventanamicro.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
* target/riscv: Make PMP region count configurableJay Chang2025-07-046-14/+74
| | | | | | | | | | | | | | | | | | | | Previously, the number of PMP regions was hardcoded to 16 in QEMU. This patch replaces the fixed value with a new `pmp_regions` field, allowing platforms to configure the number of PMP regions. If no specific value is provided, the default number of PMP regions remains 16 to preserve the existing behavior. A new CPU parameter num-pmp-regions has been introduced to the QEMU command line. For example: -cpu rv64, g=true, c=true, pmp=true, num-pmp-regions=8 Signed-off-by: Jay Chang <jay.chang@sifive.com> Reviewed-by: Frank Chang <frank.chang@sifive.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-ID: <20250606072525.17313-3-jay.chang@sifive.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
* target/riscv/kvm: add max_satp_mode from host cpuMeng Zhuo2025-07-041-1/+15
| | | | | | | | | | | | This patch adds max_satp_mode from host kvm cpu setting. Tested on: Milkv Megrez (Eswin 7700x) Reviewed-by: Andrew Jones <ajones@ventanamicro.com> Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2931 Signed-off-by: Meng Zhuo <mengzhuo@iscas.ac.cn> Message-ID: <20250606034250.181707-1-mengzhuo@iscas.ac.cn> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
* target/riscv: support atomic instruction fetch (Ziccif)Jim Shu2025-07-041-12/+34
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Support 4-byte atomic instruction fetch when instruction is natural aligned. Current implementation is not atomic because it loads instruction twice for first and last 2 bytes. We load 4 bytes at once to keep the atomicity. This instruction preload method only applys when instruction is 4-byte aligned. If instruction is unaligned, it could be across pages so that preload will trigger additional page fault. We encounter this issue when doing pressure test of enabling & disabling Linux kernel ftrace. Ftrace with kernel preemption requires concurrent modification and execution of instruction, so non-atomic instruction fetch will cause the race condition. We may fetch the wrong instruction which is the mixing of 2 instructions. Also, RISC-V Profile wants to provide this feature by HW. RVA20U64 Ziccif protects the atomicity of instruction fetch when it is natural aligned. This commit depends on the atomic read support of translator_ld in the commit 6a9dfe1984b0c593fb0ddb52d4e70832e6201dd6. Signed-off-by: Jim Shu <jim.shu@sifive.com> Reviewed-by: Frank Chang <frank.chang@sifive.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-ID: <20250508094838.19394-1-jim.shu@sifive.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
* target/riscv/cpu.c: do better with 'named features' docDaniel Henrique Barboza2025-07-041-2/+12
| | | | | | | | | | | | Most of the named features are added directly in isa_edata_arr[], some of them are also added in riscv_cpu_named_features(). There is a reason for that, and the existing docs can do better explaining it. Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com> Message-ID: <20250529202315.1684198-4-dbarboza@ventanamicro.com> Acked-by: Alistair Francis <alistair.francis@wdc.com> Message-ID: <20250604174329.1147549-4-dbarboza@ventanamicro.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
* target/riscv/cpu.c: add 'ssstrict' to riscv, isaDaniel Henrique Barboza2025-07-041-0/+1
| | | | | | | | | | | | | | | | | | 'ssstrict' is a RVA23 profile-defined extension defined as follows: "No non-conforming extensions are present. Attempts to execute unimplemented opcodes or access unimplemented CSRs in the standard or reserved encoding spaces raises an illegal instruction exception that results in a contained trap to the supervisor-mode trap handler." In short, we need to throw an exception when accessing unimplemented CSRs or opcodes. We do that, so let's advertise it. Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com> Reviewed-by: Andrew Jones <ajones@ventanamicro.com> Message-ID: <20250529202315.1684198-3-dbarboza@ventanamicro.com> Message-ID: <20250604174329.1147549-3-dbarboza@ventanamicro.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
* target/riscv/cpu.c: add 'sdtrig' in riscv,isaDaniel Henrique Barboza2025-07-042-0/+10
| | | | | | | | | | | | | | We have support for sdtrig for awhile but we are not advertising it. It is enabled by default via the 'debug' flag. Use the same flag to also advertise sdtrig. Add an exception in disable_priv_spec_isa_exts() to avoid spamming warnings for 'sdtrig' for vendor CPUs like sifive_u. Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-ID: <20250604174329.1147549-2-dbarboza@ventanamicro.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
* target/riscv: remove capital 'Z' CPU propertiesDaniel Henrique Barboza2025-07-043-48/+1
| | | | | | | | | These properties were deprecated in QEMU 8.2, commit 8043effd9b. Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-ID: <20250530134608.1806922-1-dbarboza@ventanamicro.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
* target/riscv: Extend PMP region up to 64Jay Chang2025-07-042-2/+182
| | | | | | | | | | | | | According to the RISC-V Privileged Specification (version >1.12), RV32 supports 16 CSRs (pmpcfg0–pmpcfg15) to configure 64 PMP regions (pmpaddr0–pmpaddr63). Signed-off-by: Jay Chang <jay.chang@sifive.com> Reviewed-by: Frank Chang <frank.chang@sifive.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com> Message-ID: <20250522081236.4050-2-jay.chang@sifive.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
* target/riscv: add profile->present flagDaniel Henrique Barboza2025-07-043-9/+19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Björn reported in [1] a case where a rv64 CPU is going through the profile code path to enable satp mode. In this case,the amount of extensions on top of the rv64 CPU made it compliant with the RVA22S64 profile during the validation of CPU 0. When the subsequent CPUs were initialized the static profile object has the 'enable' flag set, enabling the profile code path for those CPUs. This happens because we are initializing and realizing each CPU before going to the next, i.e. init and realize CPU0, then init and realize CPU1 and so on. If we change any persistent state during the validation of CPU N it will interfere with the init/realization of CPU N+1. We're using the 'enabled' profile flag to do two distinct things: inform cpu_init() that we want profile extensions to be enabled, and telling QMP that a profile is currently enabled in the CPU. We want to be flexible enough to recognize profile support for all CPUs that has the extension prerequisites, but we do not want to force the profile code path if a profile wasn't set too. Add a new 'present' flag for profiles that will coexist with the 'enabled' flag. Enabling a profile means "we want to switch on all its mandatory extensions". A profile is 'present' if we asserted during validation that the CPU has the needed prerequisites. This means that the case reported by Björn now results in RVA22S64.enabled=false and RVA22S64.present=true. QMP will recognize it as a RVA22 compliant CPU and we won't force the CPU into the profile path. [1] https://lore.kernel.org/qemu-riscv/87y0usiz22.fsf@all.your.base.are.belong.to.us/ Reported-by: Björn Töpel <bjorn@kernel.org> Fixes: 2af005d610 ("target/riscv/tcg: validate profiles during finalize") Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com> Reviewed-by: Andrew Jones <ajones@ventanamicro.com> Reviewed-by: Björn Töpel <bjorn@rivosinc.com> Tested-by: Björn Töpel <bjorn@rivosinc.com> Message-ID: <20250528184407.1451983-4-dbarboza@ventanamicro.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
* target/riscv/tcg: decouple profile enablement from user propDaniel Henrique Barboza2025-07-041-60/+67
| | | | | | | | | | | | | | | | | | | We have code in riscv_cpu_add_profiles() to enable a profile right away in case a CPU chose the profile during its cpu_init(). But we're using the user callback option to do so, setting profile->user_set. Create a new helper that does all the grunt work to enable/disable a given profile. Use this new helper in the cases where we want a CPU to be compatible to a certain profile, leaving the user callback to be used exclusively by users. Fixes: fba92a92e3 ("target/riscv: add 'rva22u64' CPU") Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com> Reviewed-by: Andrew Jones <ajones@ventanamicro.com> Reviewed-by: Björn Töpel <bjorn@rivosinc.com> Tested-by: Björn Töpel <bjorn@rivosinc.com> Message-ID: <20250528184407.1451983-3-dbarboza@ventanamicro.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
* target/riscv/tcg: restrict satp_mode changes in cpu_set_profileDaniel Henrique Barboza2025-07-041-7/+7
| | | | | | | | | | | | | | | | | | | | We're changing 'mmu' to true regardless of whether the profile is being enabled or not, and at the same time we're changing satp_mode to profile->enabled. This will promote a situation where we'll set mmu=on without a virtual memory mode, which is a mistake. Only touch 'mmu' and satp_mode if the profile is being enabled. Suggested-by: Andrew Jones <ajones@ventanamicro.com> Fixes: 55398025e7 ("target/riscv: add satp_mode profile support") Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com> Reviewed-by: Andrew Jones <ajones@ventanamicro.com> Reviewed-by: Björn Töpel <bjorn@rivosinc.com> Tested-by: Björn Töpel <bjorn@rivosinc.com> Message-ID: <20250528184407.1451983-2-dbarboza@ventanamicro.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
* target/riscv/cpu.c: fix zama16b order in isa_edata_arr[]Daniel Henrique Barboza2025-07-041-1/+1
| | | | | | | | | | | Put it after zalrsc and before zawrs. Cc: qemu-trivial@nongnu.org Fixes: a60ce58fd9 ("target/riscv: Support Zama16b extension") Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-ID: <20250522113344.823294-1-dbarboza@ventanamicro.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
* target/riscv: Enable/Disable S/VS-mode Timer when STCE bit is changedJim Shu2025-07-043-0/+93
| | | | | | | | | | Updating STCE will enable/disable SSTC in S-mode or/and VS-mode, so we also need to update S/VS-mode Timer and S/VSTIP bits in $mip CSR. Signed-off-by: Jim Shu <jim.shu@sifive.com> Acked-by: Alistair Francis <alistair.francis@wdc.com> Message-ID: <20250519143518.11086-5-jim.shu@sifive.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
* target/riscv: Fix VSTIP bit in sstc extension.Jim Shu2025-07-041-1/+8
| | | | | | | | | | VSTIP is only writable when both [mh]envcfg.STCE is enabled, or it will revert it's defined behavior as if sstc extension is not implemented. Signed-off-by: Jim Shu <jim.shu@sifive.com> Acked-by: Alistair Francis <alistair.francis@wdc.com> Message-ID: <20250519143518.11086-4-jim.shu@sifive.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
* target/riscv: Add the checking into stimecmp write function.Jim Shu2025-07-041-2/+17
| | | | | | | | | | | Preparation commit to let aclint timer to use stimecmp write function. Aclint timer doesn't call sstc() predicate so we need to check inside the stimecmp write function. Signed-off-by: Jim Shu <jim.shu@sifive.com> Acked-by: Alistair Francis <alistair.francis@wdc.com> Message-ID: <20250519143518.11086-2-jim.shu@sifive.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
* Merge tag 'for-upstream' of https://gitlab.com/bonzini/qemu into stagingStefan Hajnoczi2025-05-301-0/+5
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * target/i386/kvm: Intel TDX support * target/i386/emulate: more lflags cleanups * meson: remove need for explicit listing of dependencies in hw_common_arch and target_common_arch * rust: small fixes * hpet: Reorganize register decoding to be more similar to Rust code * target/i386: fixes for AMD models * target/i386: new EPYC-Turin CPU model # -----BEGIN PGP SIGNATURE----- # # iQFIBAABCgAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAmg4BxwUHHBib256aW5p # QHJlZGhhdC5jb20ACgkQv/vSX3jHroP67gf+PEP4EDQP0AJUfxXYVsczGf5snGjz # ro8jYmKG+huBZcrS6uPK5zHYxtOI9bHr4ipTHJyHd61lyzN6Ys9amPbs/CRE2Q4x # Ky4AojPhCuaL2wHcYNcu41L+hweVQ3myj97vP3hWvkatulXYeMqW3/4JZgr4WZ69 # A9LGLtLabobTz5yLc8x6oHLn/BZ2y7gjd2LzTz8bqxx7C/kamjoDrF2ZHbX9DLQW # BKWQ3edSO6rorSNHWGZsy9BE20AEkW2LgJdlV9eXglFEuEs6cdPKwGEZepade4bQ # Rdt2gHTlQdUDTFmAbz8pttPxFGMC9Zpmb3nnicKJpKQAmkT/x4k9ncjyAQ== # =XmkU # -----END PGP SIGNATURE----- # gpg: Signature made Thu 29 May 2025 03:05:00 EDT # gpg: using RSA key F13338574B662389866C7682BFFBD25F78C7AE83 # gpg: issuer "pbonzini@redhat.com" # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" [full] # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" [full] # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * tag 'for-upstream' of https://gitlab.com/bonzini/qemu: (77 commits) target/i386/tcg/helper-tcg: fix file references in comments target/i386: Add support for EPYC-Turin model target/i386: Update EPYC-Genoa for Cache property, perfmon-v2, RAS and SVM feature bits target/i386: Add couple of feature bits in CPUID_Fn80000021_EAX target/i386: Update EPYC-Milan CPU model for Cache property, RAS, SVM feature bits target/i386: Update EPYC-Rome CPU model for Cache property, RAS, SVM feature bits target/i386: Update EPYC CPU model for Cache property, RAS, SVM feature bits rust: make declaration of dependent crates more consistent docs: Add TDX documentation i386/tdx: Validate phys_bits against host value i386/tdx: Make invtsc default on i386/tdx: Don't treat SYSCALL as unavailable i386/tdx: Fetch and validate CPUID of TD guest target/i386: Print CPUID subleaf info for unsupported feature i386: Remove unused parameter "uint32_t bit" in feature_word_description() i386/cgs: Introduce x86_confidential_guest_check_features() i386/tdx: Define supported KVM features for TDX i386/tdx: Add XFD to supported bit of TDX i386/tdx: Add supported CPUID bits relates to XFAM i386/tdx: Add supported CPUID bits related to TD Attributes ... Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
| * kvm: Introduce kvm_arch_pre_create_vcpu()Xiaoyao Li2025-05-281-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Introduce kvm_arch_pre_create_vcpu(), to perform arch-dependent work prior to create any vcpu. This is for i386 TDX because it needs call TDX_INIT_VM before creating any vcpu. The specific implementation for i386 will be added in the future patch. Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com> Acked-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Zhao Liu <zhao1.liu@intel.com> Link: https://lore.kernel.org/r/20250508150002.689633-8-xiaoyao.li@intel.com Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* | Merge tag 'pull-qapi-2025-05-28' of https://repo.or.cz/qemu/armbru into stagingStefan Hajnoczi2025-05-291-1/+1
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | QAPI patches patches for 2025-05-28 # -----BEGIN PGP SIGNATURE----- # # iQJGBAABCAAwFiEENUvIs9frKmtoZ05fOHC0AOuRhlMFAmg3UTYSHGFybWJydUBy # ZWRoYXQuY29tAAoJEDhwtADrkYZTz9cQALqbici35rI19BYR8XNTcIK1sS6iB9wx # 6vLLix7a+/vsmBXiHEfo6nnlTBsU1NVP+8Tvx8+6TRBUnjK+9YaPZHE8k6lGglWm # 5lbue7nUlzaF4TfTmqrsCeeYKvc8iwC5TUBHbsLNpf9IIvNHbRm4IrD4ySnur+mN # vTQWEvLkT9quh5KPaiZajlQulIpaFZjwREJ2U8LC6Tb+t0qtAGL6hc+etI49re6A # 2jJq29G+hSxK87FBFwgilh4Dl5DCDAe75Plp1Opy0wyowM06ilSATYBJ6SL4B3wg # RKQXmHiHZCxk+MLs3vhE65bhNmMLkf+xbY/jxSNs5Hisj4Snt7bLqWRaBAhkRZOz # ZCyGMI6lpJELo8VIEE2gB8m/kf6YAG4pfLdZkIZCuFyW2I6b3OQjOn5G0td6JtvX # a5ygtuzi8VIxA3FcODb/EMNAPOv6B4aHgW3IaiwLB2kgeiqR+yMIE6zqZZHrEGUl # A/S7an99vbHgSFPtJ37VaUEdDnb06b4ebIvNyBzrgtXO8ekHaXAjCh52UYkLFOJe # S0dBrENj6M1yJ8HPwqWgP25PdlBAbCGHCsaZScrv7j08Q7sNJbQz0mmrCi0V/djV # riZBVcODabQ9mveMc1KJplKwIg351YJk3XwHqMLKHw9srMl3z3YcZf6T3e/G3ScQ # rlqRDslZvvgd # =3NrB # -----END PGP SIGNATURE----- # gpg: Signature made Wed 28 May 2025 14:08:54 EDT # gpg: using RSA key 354BC8B3D7EB2A6B68674E5F3870B400EB918653 # gpg: issuer "armbru@redhat.com" # gpg: Good signature from "Markus Armbruster <armbru@redhat.com>" [full] # gpg: aka "Markus Armbruster <armbru@pond.sub.org>" [full] # Primary key fingerprint: 354B C8B3 D7EB 2A6B 6867 4E5F 3870 B400 EB91 8653 * tag 'pull-qapi-2025-05-28' of https://repo.or.cz/qemu/armbru: qapi: use imperative style in documentation qapi: make all generated files common qapi: remove qapi_specific_outputs from meson.build qapi: make s390x specific CPU commands unconditionally available qapi: make most CPU commands unconditionally available qapi: Make CpuModelExpansionInfo::deprecated-props optional and generic qapi: remove the misc-target.json file qapi: make Xen event commands unconditionally available qapi: make SGX commands unconditionally available qapi: expose query-gic-capability command unconditionally qapi: make SEV commands unconditionally available qapi: expand docs for SEV commands qapi: expose rtc-reset-reinjection command unconditionally Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
| * | qapi: make most CPU commands unconditionally availableDaniel P. Berrangé2025-05-281-1/+1
| |/ | | | | | | | | | | | | | | | | | | | | | | | | This removes the TARGET_* conditions from all the CPU commands that are conceptually target independent. Top level stubs are provided to cope with targets which do not currently implement all of the commands. Adjust the doc comments accordingly. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Message-ID: <20250522190542.588267-10-pierrick.bouvier@linaro.org> Reviewed-by: Markus Armbruster <armbru@redhat.com>