qemu/target, branch master

target/i386: Fix tss access size in switch_tss_ra

2024-08-20T23:11:26Z

The two limit_max variables represent size - 1, just like the encoding in the GDT, thus the 'old' access was off by one. Access the minimal size of the new tss: the complete tss contains the iopb, which may be a larger block than the access api expects, and irrelevant because the iopb is not accessed during the switch itself. Fixes: 8b131065080a ("target/i386/tcg: use X86Access for TSS access") Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2511 Signed-off-by: Richard Henderson Message-Id: <20240819074052.207783-1-richard.henderson@linaro.org> Reviewed-by: Peter Maydell Reviewed-by: Pierrick Bouvier

target/i386: Fix carry flag for BLSI

2024-08-20T23:11:26Z

BLSI has inverted semantics for C as compared to the other two BMI1 instructions, BLSMSK and BLSR. Introduce CC_OP_BLSI* for this purpose. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2175 Signed-off-by: Richard Henderson Reviewed-by: Philippe Mathieu-Daudé Message-Id: <20240801075845.573075-3-richard.henderson@linaro.org>

target/i386: Split out gen_prepare_val_nz

2024-08-20T23:11:26Z

Split out the TCG_COND_TSTEQ logic from gen_prepare_eflags_z, and use it for CC_OP_BMILG* as well. Prepare for requiring both zero and non-zero senses. Reviewed-by: Philippe Mathieu-Daudé Signed-off-by: Richard Henderson Message-Id: <20240801075845.573075-2-richard.henderson@linaro.org>

Merge tag 'hw-misc-20240820' of https://github.com/philmd/qemu into staging

2024-08-19T23:17:41Z

Various fixes - Null pointer dereference in IPI IOCSR (Jiaxun) - Correct '-smbios type=4' in man page (Heinrich) - Use correct MMU index in MIPS get_pte (Phil) - Reset MPQEMU remote message using device_cold_reset (Peter) - Update linux-user MIPS CPU list (Phil) - Do not let exec_command read console if no pattern to wait for (Nick) - Remove shadowed declaration warning (Pierrick) - Restrict STQF opcode to SPARC V9 (Richard) - Add missing Kconfig dependency for POWERNV ISA serial port (Bernhard) - Do not allow vmport device without i8042 PS/2 controller (Kamil) - Fix QCryptoTLSCredsPSK leak (Peter) # -----BEGIN PGP SIGNATURE----- # # iQIzBAABCAAdFiEE+qvnXhKRciHc/Wuy4+MsLN6twN4FAmbDzAsACgkQ4+MsLN6t # wN7SvBAAwM0Frtg4ZKDZQu8XgMjLq1xVoSWjC3YJZKTpyGap5gO+7StvHg0sf9iB # YyGqocCO+qdj9a7pTSasfGDyufpwoIZkOqkwGUWKBos76cOcHWt4e/gkl9O65Lf1 # VVKX4/xdY+a5w2eVAAdWWrYdaPWkKLm0ZZXKoeSIvN4R9A41j7J4kANhE2SweczF # NnTt2gBnSlpRzghlVWPJKhnq+aYbvLeR7ApdNGUJDpSI1ZTh9gH1GtZFwBN7aeDo # PvDucoui0EmuyHTVdOYOH3zihTfzKlNZECcT3Y6/6i8y5p7jLHyINHHexsKw6T56 # i5RidJMPTfM0EO6LU1GvUN5FzZy24zXOf298Fe/GMYczQsOznQd4+aFHYPb3d4hZ # 8Vc1wB1s8XF5WGj+7bchBAUdynUnbwUqfMOb2pMXLIm21pSDnOTVgmYMnp1Kt4AA # 9WbHiS6tUJf/HjQsep8BBNGUiVSsUPDNNhL8QN43u2C0NgNRPgtRuIV+ytgVXS1G # 2t1QiRX0lX4ACHmw88agUCU3OhorumuDOpoitQK5jn2VutT7TqbGgibkQMFSgn9E # Xwrmtlf7nYU9MVgXYJjH2bBh7wbOmQCqbHniEj0targkxccAMJoswG4vtKsP9zkd # tBs6qMiZ8qSj5eoq8JBRF8bF4tONmboPZjRlboACJ0kTD5wCElA= # =lPMG # -----END PGP SIGNATURE----- # gpg: Signature made Tue 20 Aug 2024 08:49:47 AM AEST # gpg: using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE # gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) " [full] * tag 'hw-misc-20240820' of https://github.com/philmd/qemu: crypto/tlscredspsk: Free username on finalize hw/i386/pc: Ensure vmport prerequisites are fulfilled hw/i386/pc: Unify vmport=auto handling hw/ppc/Kconfig: Add missing SERIAL_ISA dependency to POWERNV machine target/sparc: Restrict STQF to sparcv9 contrib/plugins/execlog: Fix shadowed declaration warning tests/avocado: Mark ppc_hv_tests.py as non-flaky after fixed console interaction tests/avocado: exec_command should not consume console output linux-user/mips: Select Loongson CPU for Loongson binaries linux-user/mips: Select MIPS64R2-generic for Rel2 binaries linux-user/mips: Select Octeon68XX CPU for Octeon binaries linux-user/mips: Do not try to use removed R5900 CPU hw/remote/message.c: Don't directly invoke DeviceClass:reset hw/dma/xilinx_axidma: Use semicolon at end of statement, not comma target/mips: Load PTE as DATA target/mips: Use correct MMU index in get_pte() target/mips: Pass page table entry size as MemOp to get_pte() qemu-options.hx: correct formatting -smbios type=4 hw/mips/loongson3_virt: Fix condition of IPI IOCSR connection hw/mips/loongson3_virt: Store core_iocsr into LoongsonMachineState Signed-off-by: Richard Henderson

target/sparc: Restrict STQF to sparcv9

2024-08-19T22:49:14Z

Prior to sparcv9, the same encoding was STDFQ. Cc: qemu-stable@nongnu.org Fixes: 06c060d9e5b ("target/sparc: Move simple fp load/store to decodetree") Signed-off-by: Richard Henderson Reviewed-by: Philippe Mathieu-Daudé Message-ID: <20240816072311.353234-2-richard.henderson@linaro.org> Signed-off-by: Philippe Mathieu-Daudé

target/mips: Load PTE as DATA

2024-08-19T22:38:48Z

PTE is not CODE so load it as normal DATA access. Fixes: 074cfcb4da ("Implement hardware page table walker for MIPS32") Suggested-by: Richard Henderson Signed-off-by: Philippe Mathieu-Daudé Reviewed-by: Richard Henderson Message-ID: <20240814090452.2591-4-philmd@linaro.org>

target/mips: Use correct MMU index in get_pte()

2024-08-19T22:38:48Z

When refactoring page_table_walk_refill() in commit 4e999bf419 we missed the indirect call to cpu_mmu_index() in get_pte(): page_table_walk_refill() -> get_pte() -> cpu_ld[lq]_code() -> cpu_mmu_index() Since we don't mask anymore the modes in hflags, cpu_mmu_index() can return UM or SM, while we only expect KM or ERL. Fix by propagating ptw_mmu_idx to get_pte(), and use the cpu_ld/st_code_mmu() API with the correct MemOpIdx. Reported-by: Thomas Petazzoni Reported-by: Waldemar Brodkorb Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2470 Fixes: 4e999bf419 ("target/mips: Pass ptw_mmu_idx down from mips_cpu_tlb_fill") Signed-off-by: Philippe Mathieu-Daudé Reviewed-by: Richard Henderson Message-ID: <20240814090452.2591-3-philmd@linaro.org>

target/mips: Pass page table entry size as MemOp to get_pte()

2024-08-19T22:38:48Z

In order to simplify the next commit, pass the PTE size as MemOp. Rename: native_shift -> native_op directory_shift -> directory_mop leaf_shift -> leaf_mop Suggested-by: Richard Henderson Reviewed-by: Richard Henderson Signed-off-by: Philippe Mathieu-Daudé Message-ID: <20240814090452.2591-2-philmd@linaro.org>

target/i386: allow access_ptr to force slow path on failed probe

2024-08-16T13:04:19Z

When we are using TCG plugin memory callbacks probe_access_internal will return TLB_MMIO to force the slow path for memory access. This results in probe_access returning NULL but the x86 access_ptr function happily accepts an empty haddr resulting in segfault hilarity. Check for an empty haddr to prevent the segfault and enable plugins to track all the memory operations for the x86 save/restore helpers. As we also want to run the slow path when instrumenting *-user we should also not have the short cutting test_ptr macro. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2489 Fixes: 6d03226b42 (plugins: force slow path when plugins instrument memory ops) Reviewed-by: Alexandre Iooss Reviewed-by: Richard Henderson Signed-off-by: Alex Bennée Message-Id: <20240813202329.1237572-8-alex.bennee@linaro.org>

target/s390x: fix build warning (gcc-12 -fsanitize=thread)

2024-08-15T14:33:56Z

Found on debian stable. ../target/s390x/tcg/translate.c: In function ‘get_mem_index’: ../target/s390x/tcg/translate.c:398:1: error: control reaches end of non-void function [-Werror=return-type] 398 | } Signed-off-by: Pierrick Bouvier Acked-by: Ilya Leoshkevich Message-ID: <20240814224132.897098-4-pierrick.bouvier@linaro.org> Signed-off-by: Thomas Huth