summary refs log tree commit diff stats
path: root/tests/functional/qemu_test/linuxkernel.py (unfollow)
Commit message (Collapse)AuthorFilesLines
2024-10-18hw/intc/openpic: Improve errors for out of bounds property valuesMarkus Armbruster1-4/+1
The error message doesn't matter much, as the "openpic" device isn't user-creatable. But it's the last use of QERR_PROPERTY_VALUE_OUT_OF_RANGE, which has to go. Change the message just like the previous commit did for x86 CPUs. Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-ID: <20241010150144.986655-7-armbru@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-10-18target/i386/cpu: Improve errors for out of bounds property valuesMarkus Armbruster1-11/+9
The error message for a "stepping" value that is out of bounds is a bit odd: $ qemu-system-x86_64 -cpu qemu64,stepping=16 qemu-system-x86_64: can't apply global qemu64-x86_64-cpu.stepping=16: Property .stepping doesn't take value 16 (minimum: 0, maximum: 15) The "can't apply global" part is an unfortunate artifact of -cpu's implementation. Left for another day. The remainder feels overly verbose. Change it to qemu64-x86_64-cpu: can't apply global qemu64-x86_64-cpu.stepping=16: parameter 'stepping' can be at most 15 Likewise for "family", "model", and "tsc-frequency". Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-ID: <20241010150144.986655-6-armbru@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com>
2024-10-18target/i386/cpu: Avoid mixing signed and unsigned in property settersMarkus Armbruster1-24/+21
Properties "family", "model", and "stepping" are visited as signed integers. They are backed by bits in CPUX86State member @cpuid_version. The code to extract and insert these bits mixes signed and unsigned. Not actually wrong, but avoiding such mixing is good practice. Visit them as unsigned integers instead. This adds a few mildly ugly cast in arguments of error_setg(). The next commit will get rid of them again. Property "tsc-frequency" is also visited as signed integer. The value ultimately flows into the kernel, where it is 31 bits unsigned. The QEMU code freely mixes int, uint32_t, int64_t. I elect not to attempt draining this swamp today. Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-ID: <20241010150144.986655-5-armbru@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com>
2024-10-18block: Adjust check_block_size() signatureMarkus Armbruster5-21/+11
Parameter @id is no longer used, drop. Return a bool to indicate success / failure, as recommended by qapi/error.h. Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-ID: <20241010150144.986655-4-armbru@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-10-18block: Improve errors about block sizesMarkus Armbruster1-11/+7
Block sizes need to be a power of two between 512 and an arbitrary limit, currently 2MiB. Commit 5937835ac4c factored block size checking out of set_blocksize() into new check_block_size(), for reuse in block/export/. Its two error messages are okay for the original purpose: $ qemu-system-x86_64 -device ide-hd,physical_block_size=1 qemu-system-x86_64: -device ide-hd,physical_block_size=1: Property .physical_block_size doesn't take value 1 (minimum: 512, maximum: 2097152) $ qemu-system-x86_64 -device ide-hd,physical_block_size=513 qemu-system-x86_64: -device ide-hd,physical_block_size=513: Property .physical_block_size doesn't take value '513', it's not a power of 2 They're mildly off for block exports: $ qemu-storage-daemon --blockdev node-name=nod0,driver=file,filename=foo.img --export type=vduse-blk,id=exp0,node-name=nod0,name=foo,logical-block-size=1 qemu-storage-daemon: --export type=vduse-blk,id=exp0,node-name=nod0,name=foo,logical-block-size=1: Property exp0.logical-block-size doesn't take value 1 (minimum: 512, maximum: 2097152) The error message talks about a property. CLI options like --export don't have properties, they have parameters. Replace the two error messages by a single one that's okay for both purposes. Looks like this: qemu-storage-daemon: --export type=vduse-blk,id=exp0,node-name=nod0,name=foo,logical-block-size=1: parameter logical-block-size must be a power of 2 between 512 and 2097152 Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-ID: <20241010150144.986655-3-armbru@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2024-10-18error: Drop superfluous #include "qapi/qmp/qerror.h"Markus Armbruster3-3/+0
Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-ID: <20241010150144.986655-2-armbru@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2024-10-18qga: Improve error for guest-set-user-password parameter @cryptedMarkus Armbruster2-4/+1
The Windows version of guest-set-user-password rejects argument "crypted": true with the rather useless "this feature or command is not currently supported". Improve to "'crypted' must be off on this host". QERR_UNSUPPORTED is now unused. Drop. Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-ID: <20240911131206.2503035-3-armbru@redhat.com>
2024-10-18qga/qapi-schema: Drop obsolete note on "unsupported" errorsMarkus Armbruster1-9/+0
The note talks about "unsupported" errors and QERR_UNSUPPORTED. The former is vague, and the latter makes sense only in C, not in external interface documentation. Fortunately, we don't have to address this anymore: recent merge commit 3b5efc553eb got rid of these errors. Delete the note. Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-ID: <20240911131206.2503035-2-armbru@redhat.com>
2024-10-18tests: Wait for migration completion on destination QEMU to avoid failuresStefan Berger1-1/+1
Rather than waiting for the completion of migration on the source side, wait for it on the destination QEMU side to avoid accessing the TPM TIS memory mapped registers before QEMU could restore their state. This error condition could be triggered on busy systems where the destination QEMU did not have enough time to restore the TIS state while the test case was already reading its registers. The test case was for example reading the STS register and received an unexpected value (0xffffffff), which lead to a segmentation fault later on due to trying to read 0xffff bytes from the TIS into a buffer. Cc: <qemu-stable@nongnu.org> Reported-by: Fabiano Rosas <farosas@suse.de> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
2024-10-18tpm_emulator: Read control channel response in 2 passesStefan Berger1-16/+46
Error responses from swtpm are typically only 4 bytes long with the exception of a few commands that return more bytes. Therefore, read the entire response in 2 steps and stop if the first few bytes indicate an error response with no subsequent bytes readable. Read the rest in a 2nd step, if needed. This avoids getting stuck while waiting for too many bytes in case of an error. The 'getting stuck' condition has not been observed in practice so far, though. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2615 Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
2024-10-18tpm: Use new ptm_cap_n structure for PTM_GET_CAPABILITYStefan Berger3-8/+21
Use the new ptm_cap_n structure for getting the PTM_GET_CAPABILITY response from swtpm. Previously only 17 bits could possibly have been set in ptm_cap (uint64_t) in big endian order and those bits are now found in the 2nd 32bit word in the response in the caps field. This data structure makes it now clear that the 1st 32bit word carries the tpm_result like all the other response structures of all other commands do. The changes are taken from the swtpm project's tpm_ioctl.h. Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
2024-10-17target/i386: Use only 16 and 32-bit operands for IN/OUTRichard Henderson1-4/+4
The REX.W prefix is ignored for these instructions. Mirror the solution already used for INS/OUTS: X86_SIZE_z. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2581 Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Cc: qemu-stable@nongnu.org Link: https://lore.kernel.org/r/20241015004144.2111817-1-richard.henderson@linaro.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-10-17accel/kvm: check for KVM_CAP_MEMORY_ATTRIBUTES on vmPaolo Bonzini1-6/+6
The exact set of available memory attributes can vary by VM. In the future it might vary depending on enabled capabilities, too. Query the extension on the VM level instead of on the KVM level, and only after architecture-specific initialization. Inspired by an analogous patch by Tom Dohrmann. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-10-17accel/kvm: check for KVM_CAP_MULTI_ADDRESS_SPACE on vmPaolo Bonzini1-6/+6
KVM_CAP_MULTI_ADDRESS_SPACE used to be a global capability, but with the introduction of AMD SEV-SNP confidential VMs, the number of address spaces can vary by VM type. Query the extension on the VM level instead of on the KVM level. Inspired by an analogous patch by Tom Dohrmann. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-10-17accel/kvm: check for KVM_CAP_READONLY_MEM on VMTom Dohrmann1-1/+1
KVM_CAP_READONLY_MEM used to be a global capability, but with the introduction of AMD SEV-SNP confidential VMs, this extension is not always available on all VM types [1,2]. Query the extension on the VM level instead of on the KVM level. [1] https://patchwork.kernel.org/project/kvm/patch/20240809190319.1710470-2-seanjc@google.com/ [2] https://patchwork.kernel.org/project/kvm/patch/20240902144219.3716974-1-erbse.13@gmx.de/ Cc: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Tom Dohrmann <erbse.13@gmx.de> Link: https://lore.kernel.org/r/20240903062953.3926498-1-erbse.13@gmx.de Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-10-17target/i386/tcg: Use DPL-level accesses for interrupts and call gatesPaolo Bonzini1-6/+11
Stack accesses should be explicit and use the privilege level of the target stack. This ensures that SMAP is not applied when the target stack is in ring 3. This fixes a bug wherein i386/tcg assumed that an interrupt return, or a far call using the CALL or JMP instruction, was always going from kernel or user mode to kernel mode when using a call gate. This assumption is violated if the call gate has a DPL that is greater than 0. Analyzed-by: Robert R. Henry <rrh.henry@gmail.com> Resolves: https://gitlab.com/qemu-project/qemu/-/issues/249 Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-10-17KVM: Rename KVMState->nr_slots to nr_slots_maxPeter Xu2-8/+8
This value used to reflect the maximum supported memslots from KVM kernel. Rename it to be clearer. Reviewed-by: David Hildenbrand <david@redhat.com> Signed-off-by: Peter Xu <peterx@redhat.com> Link: https://lore.kernel.org/r/20240917163835.194664-5-peterx@redhat.com Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-10-17KVM: Rename KVMMemoryListener.nr_used_slots to nr_slots_usedPeter Xu2-4/+4
This will make all nr_slots counters to be named in the same manner. Reviewed-by: David Hildenbrand <david@redhat.com> Signed-off-by: Peter Xu <peterx@redhat.com> Link: https://lore.kernel.org/r/20240917163835.194664-4-peterx@redhat.com Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-10-17KVM: Define KVM_MEMSLOTS_NUM_MAX_DEFAULTPeter Xu1-1/+3
Make the default max nr_slots a macro, it's only used when KVM reports nothing. Reviewed-by: David Hildenbrand <david@redhat.com> Signed-off-by: Peter Xu <peterx@redhat.com> Link: https://lore.kernel.org/r/20240917163835.194664-3-peterx@redhat.com Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-10-17KVM: Dynamic sized kvm memslots arrayPeter Xu3-15/+74
Zhiyi reported an infinite loop issue in VFIO use case. The cause of that was a separate discussion, however during that I found a regression of dirty sync slowness when profiling. Each KVMMemoryListerner maintains an array of kvm memslots. Currently it's statically allocated to be the max supported by the kernel. However after Linux commit 4fc096a99e ("KVM: Raise the maximum number of user memslots"), the max supported memslots reported now grows to some number large enough so that it may not be wise to always statically allocate with the max reported. What's worse, QEMU kvm code still walks all the allocated memslots entries to do any form of lookups. It can drastically slow down all memslot operations because each of such loop can run over 32K times on the new kernels. Fix this issue by making the memslots to be allocated dynamically. Here the initial size was set to 16 because it should cover the basic VM usages, so that the hope is the majority VM use case may not even need to grow at all (e.g. if one starts a VM with ./qemu-system-x86_64 by default it'll consume 9 memslots), however not too large to waste memory. There can also be even better way to address this, but so far this is the simplest and should be already better even than before we grow the max supported memslots. For example, in the case of above issue when VFIO was attached on a 32GB system, there are only ~10 memslots used. So it could be good enough as of now. In the above VFIO context, measurement shows that the precopy dirty sync shrinked from ~86ms to ~3ms after this patch applied. It should also apply to any KVM enabled VM even without VFIO. NOTE: we don't have a FIXES tag for this patch because there's no real commit that regressed this in QEMU. Such behavior existed for a long time, but only start to be a problem when the kernel reports very large nr_slots_max value. However that's pretty common now (the kernel change was merged in 2021) so we attached cc:stable because we'll want this change to be backported to stable branches. Cc: qemu-stable <qemu-stable@nongnu.org> Reported-by: Zhiyi Guo <zhguo@redhat.com> Tested-by: Zhiyi Guo <zhguo@redhat.com> Signed-off-by: Peter Xu <peterx@redhat.com> Acked-by: David Hildenbrand <david@redhat.com> Reviewed-by: Fabiano Rosas <farosas@suse.de> Link: https://lore.kernel.org/r/20240917163835.194664-2-peterx@redhat.com Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-10-17target/i386: assert that cc_op* and pc_save are preservedPaolo Bonzini1-9/+3
Now all decoding has been done before any code generation. There is no need anymore to save and restore cc_op* and pc_save but, for the time being, assert that this is indeed the case. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-10-17target/i386: list instructions still in translate.cPaolo Bonzini1-0/+31
Group them so that it is easier to figure out which two-byte opcodes to tackle together. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-10-17target/i386: do not check PREFIX_LOCK in old-style decoderPaolo Bonzini1-18/+8
It is already checked before getting there. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-10-17target/i386: convert CMPXCHG8B/CMPXCHG16B to new decoderPaolo Bonzini4-129/+124
The gen_cmpxchg8b and gen_cmpxchg16b functions even have the correct prototype already; the only thing that needs to be done is removing the gen_lea_modrm() call. This moves the last LOCK-enabled instructions to the new decoder. It is now possible to assume that gen_multi0F is called only after checking that PREFIX_LOCK was not specified. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-10-17target/i386: decode address before going back to translate.cPaolo Bonzini4-118/+103
There are now relatively few unconverted opcodes in translate.c (there are 13 of them including 8 for x87), and all of them have the same format with a mod/rm byte and no immediate. A good next step is to remove the early bail out to disas_insn_x87/disas_insn_old, instead giving these legacy translator functions the same prototype as the other gen_* functions. To do this, the X86DecodeInsn can be passed down to the places that used to fetch address bytes from the instruction stream. To make sure that everything is done cleanly, the CPUX86State* argument is removed. As part of the unification, the gen_lea_modrm() name is now free, so rename gen_load_ea() to gen_lea_modrm(). This is as good a name and it makes the changes to translate.c easier to review. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-10-17target/i386: convert bit test instructions to new decoderPaolo Bonzini4-158/+183
Code generation was rewritten; it reuses the same trick to use the CC_OP_SAR values for cc_op, but it tries to use CC_OP_ADCX or CC_OP_ADCOX instead of CC_OP_EFLAGS. This is a tiny bit more efficient in the common case where only CF is checked in the resulting flags. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-10-17tcg/s390x: fix constraint for 32-bit TSTEQ/TSTNEPaolo Bonzini1-8/+16
32-bit TSTEQ and TSTNE is subject to the same constraints as for 64-bit, but setcond_i32 and negsetcond_i32 were incorrectly using TCG_CT_CONST ("i") instead of TCG_CT_CONST_CMP ("C"). Adjust the constraint and make tcg_target_const_match use the same sequence as tgen_cmp2: first check if the constant is a valid operand for TSTEQ/TSTNE, then accept everything for 32-bit non-test comparisons, finally check if the constant is a valid operand for 64-bit non-test comparisons. Reported-by: Philippe Mathieu-Daudé <philmd@linaro.org> Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-10-17docs/system: Add recommendations to Hyper-V enlightenments docVitaly Kuznetsov1-0/+30
While hyperv.rst already has all currently implemented Hyper-V enlightenments documented, it may be unclear what is the recommended set to achieve the best result. Add the corresponding section to the doc. Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com> Link: https://lore.kernel.org/r/20240917160051.2637594-5-vkuznets@redhat.com Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-10-17target/i386: Make sure SynIC state is really updated before KVM_RUNVitaly Kuznetsov1-0/+1
'hyperv_synic' test from KVM unittests was observed to be flaky on certain hardware (hangs sometimes). Debugging shows that the problem happens in hyperv_sint_route_new() when the test tries to set up a new SynIC route. The function bails out on: if (!synic->sctl_enabled) { goto cleanup; } but the test writes to HV_X64_MSR_SCONTROL just before it starts establishing SINT routes. Further investigation shows that synic_update() (called from async_synic_update()) happens after the SINT setup attempt and not before. Apparently, the comment before async_safe_run_on_cpu() in kvm_hv_handle_exit() does not correctly describe the guarantees async_safe_run_on_cpu() gives. In particular, async worked added to a CPU is actually processed from qemu_wait_io_event() which is not always called before KVM_RUN, i.e. kvm_cpu_exec() checks whether an exit request is pending for a CPU and if not, keeps running the vCPU until it meets an exit it can't handle internally. Hyper-V specific MSR writes are not automatically trigger an exit. Fix the issue by simply raising an exit request for the vCPU where SynIC update was queued. This is not a performance critical path as SynIC state does not get updated so often (and async_safe_run_on_cpu() is a big hammer anyways). Reported-by: Jan Richter <jarichte@redhat.com> Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com> Link: https://lore.kernel.org/r/20240917160051.2637594-4-vkuznets@redhat.com Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-10-17target/i386: Exclude 'hv-syndbg' from 'hv-passthrough'Vitaly Kuznetsov2-6/+14
Windows with Hyper-V role enabled doesn't boot with 'hv-passthrough' when no debugger is configured, this significantly limits the usefulness of the feature as there's no support for subtracting Hyper-V features from CPU flags at this moment (e.g. "-cpu host,hv-passthrough,-hv-syndbg" does not work). While this is also theoretically fixable, 'hv-syndbg' is likely very special and unneeded in the default set. Genuine Hyper-V doesn't seem to enable it either. Introduce 'skip_passthrough' flag to 'kvm_hyperv_properties' and use it as one-off to skip 'hv-syndbg' when enabling features in 'hv-passthrough' mode. Note, "-cpu host,hv-passthrough,hv-syndbg" can still be used if needed. As both 'hv-passthrough' and 'hv-syndbg' are debug features, the change should not have any effect on production environments. Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com> Link: https://lore.kernel.org/r/20240917160051.2637594-3-vkuznets@redhat.com Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-10-17target/i386: Fix conditional CONFIG_SYNDBG enablementVitaly Kuznetsov2-4/+9
Putting HYPERV_FEAT_SYNDBG entry under "#ifdef CONFIG_SYNDBG" in 'kvm_hyperv_properties' array is wrong: as HYPERV_FEAT_SYNDBG is not the highest feature number, the result is an empty (zeroed) entry in the array (and not a skipped entry!). hyperv_feature_supported() is designed to check that all CPUID bits are set but for a zeroed feature in 'kvm_hyperv_properties' it returns 'true' so QEMU considers HYPERV_FEAT_SYNDBG as always supported, regardless of whether KVM host actually supports it. To fix the issue, leave HYPERV_FEAT_SYNDBG's definition in 'kvm_hyperv_properties' array, there's nothing wrong in having it defined even when 'CONFIG_SYNDBG' is not set. Instead, put "hv-syndbg" CPU property under '#ifdef CONFIG_SYNDBG' to alter the existing behavior when the flag is silently skipped in !CONFIG_SYNDBG builds. Leave an 'assert' sentinel in hyperv_feature_supported() making sure there are no 'holes' or improperly defined features in 'kvm_hyperv_properties'. Fixes: d8701185f40c ("hw: hyperv: Initial commit for Synthetic Debugging device") Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com> Link: https://lore.kernel.org/r/20240917160051.2637594-2-vkuznets@redhat.com Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-10-17target/i386: Add support save/load HWCR MSRGao Shiyuan3-0/+37
KVM commit 191c8137a939 ("x86/kvm: Implement HWCR support") introduced support for emulating HWCR MSR. Add support for QEMU to save/load this MSR for migration purposes. Signed-off-by: Gao Shiyuan <gaoshiyuan@baidu.com> Signed-off-by: Wang Liang <wangliang44@baidu.com> Link: https://lore.kernel.org/r/20241009095109.66843-1-gaoshiyuan@baidu.com Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-10-17target/i386: Add more features enumerated by CPUID.7.2.EDXChao Gao1-2/+2
Following 5 bits in CPUID.7.2.EDX are supported by KVM. Add their supports in QEMU. Each of them indicates certain bits of IA32_SPEC_CTRL are supported. Those bits can control CPU speculation behavior which can be used to defend against side-channel attacks. bit0: intel-psfd if 1, indicates bit 7 of the IA32_SPEC_CTRL MSR is supported. Bit 7 of this MSR disables Fast Store Forwarding Predictor without disabling Speculative Store Bypass bit1: ipred-ctrl If 1, indicates bits 3 and 4 of the IA32_SPEC_CTRL MSR are supported. Bit 3 of this MSR enables IPRED_DIS control for CPL3. Bit 4 of this MSR enables IPRED_DIS control for CPL0/1/2 bit2: rrsba-ctrl If 1, indicates bits 5 and 6 of the IA32_SPEC_CTRL MSR are supported. Bit 5 of this MSR disables RRSBA behavior for CPL3. Bit 6 of this MSR disables RRSBA behavior for CPL0/1/2 bit3: ddpd-u If 1, indicates bit 8 of the IA32_SPEC_CTRL MSR is supported. Bit 8 of this MSR disables Data Dependent Prefetcher. bit4: bhi-ctrl if 1, indicates bit 10 of the IA32_SPEC_CTRL MSR is supported. Bit 10 of this MSR enables BHI_DIS_S behavior. Signed-off-by: Chao Gao <chao.gao@intel.com> Link: https://lore.kernel.org/r/20240919051011.118309-1-chao.gao@intel.com Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-10-17target/i386: Make invtsc migratable when user sets tsc-khz explicitlyXiaoyao Li1-2/+9
When user sets tsc-frequency explicitly, the invtsc feature is actually migratable because the tsc-frequency is supposed to be fixed during the migration. See commit d99569d9d856 ("kvm: Allow invtsc migration if tsc-khz is set explicitly") for referrence. Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com> Link: https://lore.kernel.org/r/20240814075431.339209-10-xiaoyao.li@intel.com Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-10-17target/i386: Construct CPUID 2 as stateful iff times > 1Xiaoyao Li1-2/+4
When times == 1, the CPUID leaf 2 is not stateful. Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com> Link: https://lore.kernel.org/r/20240814075431.339209-6-xiaoyao.li@intel.com Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-10-17target/i386: Enable fdp-excptn-only and zero-fcs-fdsXiaoyao Li2-2/+6
- CPUID.(EAX=07H,ECX=0H):EBX[bit 6]: x87 FPU Data Pointer updated only on x87 exceptions if 1. - CPUID.(EAX=07H,ECX=0H):EBX[bit 13]: Deprecates FPU CS and FPU DS values if 1. i.e., X87 FCS and FDS are always zero. Define names for them so that they can be exposed to guest with -cpu host. Also define the bit field MACROs so that named cpu models can add it as well in the future. Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com> Link: https://lore.kernel.org/r/20240814075431.339209-3-xiaoyao.li@intel.com Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-10-17target/i386: Don't construct a all-zero entry for CPUID[0xD 0x3f]Xiaoyao Li1-5/+6
Currently, QEMU always constructs a all-zero CPUID entry for CPUID[0xD 0x3f]. It's meaningless to construct such a leaf as the end of leaf 0xD. Rework the logic of how subleaves of 0xD are constructed to get rid of such all-zero value of subleaf 0x3f. Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com> Link: https://lore.kernel.org/r/20240814075431.339209-2-xiaoyao.li@intel.com Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-10-16hw/loongarch/fw_cfg: Build in common_ss[]Philippe Mathieu-Daudé1-1/+1
Nothing in LoongArch fw_cfg.c requires target specific definitions. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Song Gao <gaosong@loongson.cn> Reviewed-by: Thomas Huth <thuth@redhat.com> Message-Id: <20240927213254.17552-3-philmd@linaro.org> Signed-off-by: Song Gao <gaosong@loongson.cn>
2024-10-16hw/loongarch/virt: Remove unnecessary 'cpu.h' inclusionPhilippe Mathieu-Daudé1-1/+0
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Song Gao <gaosong@loongson.cn> Reviewed-by: Thomas Huth <thuth@redhat.com> Message-Id: <20240927213254.17552-2-philmd@linaro.org> Signed-off-by: Song Gao <gaosong@loongson.cn>
2024-10-16target/loongarch: Avoid bits shift exceeding width of bool typeBibo Mao1-5/+1
Variable env->cf[i] is defined as bool type, it is treated as int type with shift operation. However the max possible width is 56 for the shift operation, exceeding the width of int type. And there is existing api read_fcc() which is converted to u64 type with bitwise shift, it can be used to dump fp registers into coredump note segment. Resolves: Coverity CID 1561133 Signed-off-by: Bibo Mao <maobibo@loongson.cn> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20240914064645.2099169-1-maobibo@loongson.cn> Signed-off-by: Song Gao <gaosong@loongson.cn>
2024-10-16hw/loongarch/virt: Add FDT table support with acpi ged pm registerBibo Mao1-0/+39
ACPI ged is used for power management on LoongArch virt platform, in general it is parsed from acpi table. However if system boot directly from elf kernel, no UEFI bios is provided and acpi table cannot be used also. Here acpi ged pm register is exposed with FDT table, it is compatbile with syscon method in FDT table, only that acpi ged pm register is accessed with 8-bit mode, rather with 32-bit mode. Signed-off-by: Bibo Mao <maobibo@loongson.cn> Reviewed-by: Song Gao <gaosong@loongson.cn> Tested-by: Song Gao <gaosong@loongson.cn> Message-Id: <20240918014206.2165821-3-maobibo@loongson.cn> Signed-off-by: Song Gao <gaosong@loongson.cn>
2024-10-16acpi: ged: Add macro for acpi sleep control registerBibo Mao2-5/+8
Macro definition is added for acpi sleep control register, ged emulation driver can use the macro , also it can be used in FDT table if ged is exposed with FDT table. Signed-off-by: Bibo Mao <maobibo@loongson.cn> Reviewed-by: Igor Mammedov <imammedo@redhat.com> Message-Id: <20240918014206.2165821-2-maobibo@loongson.cn> Signed-off-by: Song Gao <gaosong@loongson.cn>
2024-10-15hw/mips: Have mips_cpu_create_with_clock() take an endianness argumentPhilippe Mathieu-Daudé7-7/+15
mips_cpu_create_with_clock() creates a vCPU. Pass it the vCPU endianness requested by argument. Update the board call sites. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Jiaxun Yang <jiaxun.yang@flygoat.com> Tested-by: Jiaxun Yang <jiaxun.yang@flygoat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20241010215015.44326-17-philmd@linaro.org>
2024-10-15hw/mips/cps: Set the vCPU 'cpu-big-endian' propertyPhilippe Mathieu-Daudé3-0/+7
Have the CPS expose a 'cpu-big-endian' property so it can set it to the vCPUs it creates. Note, since the number of vCPUs created is dynamic, we can not use QOM aliases. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Jiaxun Yang <jiaxun.yang@flygoat.com> Tested-by: Jiaxun Yang <jiaxun.yang@flygoat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20241010215015.44326-16-philmd@linaro.org>
2024-10-15target/mips: Expose MIPSCPU::is_big_endian propertyPhilippe Mathieu-Daudé2-4/+11
Add the "big-endian" property and set the CP0C0_BE bit in CP0_Config0. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Jiaxun Yang <jiaxun.yang@flygoat.com> Tested-by: Jiaxun Yang <jiaxun.yang@flygoat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20241010215015.44326-15-philmd@linaro.org>
2024-10-15target/mips: Use tcg_constant_tl() instead of tcg_gen_movi_tl()Philippe Mathieu-Daudé2-101/+59
Directly use tcg_constant_tl() for constant integer, this save a call to tcg_gen_movi_tl(), often saving a temp register. Most of the places found using the following Coccinelle spatch script: @@ identifier tmp; constant val; @@ * TCGv tmp = tcg_temp_new(); ... * tcg_gen_movi_tl(tmp, val); @@ identifier tmp; int val; @@ * TCGv tmp = tcg_temp_new(); ... * tcg_gen_movi_i64(tmp, val); Suggested-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20241004202621.4321-2-philmd@linaro.org>
2024-10-15target/mips: Use gen_op_addr_addi() when possiblePhilippe Mathieu-Daudé5-26/+12
Replace tcg_gen_movi_tl() + gen_op_addr_add() by a single gen_op_addr_addi() call. gen_op_addr_addi() calls tcg_gen_addi_tl() which might optimize if the immediate is zero. Suggested-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20241010215015.44326-13-philmd@linaro.org>
2024-10-15target/mips: Have gen_addiupc() expand $pc during translationPhilippe Mathieu-Daudé1-6/+4
Suggested-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20241010215015.44326-12-philmd@linaro.org>
2024-10-15target/mips: Replace MO_TE by mo_endian()Philippe Mathieu-Daudé6-103/+106
Replace compile-time MO_TE evaluation by runtime mo_endian() one, which expand target endianness from DisasContext. Mechanical change using: $ sed -i -e 's/MO_TE/mo_endian(ctx)/' \ $(git grep -l MO_TE target/mips) Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Jiaxun Yang <jiaxun.yang@flygoat.com> Tested-by: Jiaxun Yang <jiaxun.yang@flygoat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20241010215015.44326-11-philmd@linaro.org>
2024-10-15target/mips: Introduce mo_endian() helperPhilippe Mathieu-Daudé1-0/+5
Introduce mo_endian() which returns the endian MemOp corresponding to the vCPU DisasContext. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Jiaxun Yang <jiaxun.yang@flygoat.com> Tested-by: Jiaxun Yang <jiaxun.yang@flygoat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20241010215015.44326-10-philmd@linaro.org>