16604 Commits

Author SHA1 Message Date
Richard Henderson
28a6ca268c Merge tag 'single-binary-20260203' of https://github.com/philmd/qemu into staging
Various patches related to single binary effort:

- Endianness cleanups on various targets (PPC in particular)
- Few cleanups around target_ulong type on Alpha
- Have CPUClass::disas_set_info() take a const CPUState

# -----BEGIN PGP SIGNATURE-----
#
# iQIzBAABCAAdFiEE+qvnXhKRciHc/Wuy4+MsLN6twN4FAmmCDTkACgkQ4+MsLN6t
# wN7vHQ/+LCAYESbTy7cXeKGgAslwPbX1Q2zYGk0rhGMgrbBtQThbgQSkNsAwYmzg
# 6vx5crw9vYA/kLq0jyJQPTRIAKzXH9BzdEfTsEt5AIpZv6Cc4im6JBZdrxUa6S0O
# AMGb4pn9bpkcwHOv2ufotJbl0fa+id4WgQgXyLDEgwgNVvY18fVWfn5OwAon2bWo
# nb6zqRfwgdyAB+liwmlPNI+M4hZ3vDdct7whUP8t37FjTL0lNrsyG/Epr0xJB5ru
# CRsjubBkXAq8HlmwHZp8JSM/Lriitp8Z2ubD8VBqYbMYI25XUnRlBWWxTnQKkaDD
# Vgbq67UqS/k/X6vV5cfJaeS2qOdgF98V0VmrOqlNXTwMU56lzMn0ThgLqUXznRos
# IUfTUvmjfGu63aAWG2l+HBrehK5JEAGYzK6ZTiTA6abpvfHUjehslsQlAlMgcSnL
# TnMsM7mxS+XNbf6bsew0azTt2p/V81JDVrQuQgmAJS9ZOpALMFGep5YAYKvN/kLf
# cSbl+hQRsxqxQPoc6y0NrnCcfT33U1+I+IXpMIR/VyC0RgseW9HeRdJWuNyKBW/4
# VUBnQnYNhZM9hDHKp5PzU2KhoeudAlK3gws8zvtWfLCFyAvfmEYX0Gt5r23JkoxT
# IO340Jz5XRwfXMWENc6Bm8lqr7HilQi28HFNXWdy897YfNS83Ow=
# =J0gm
# -----END PGP SIGNATURE-----
# gpg: Signature made Wed 04 Feb 2026 12:59:05 AM AEST
# gpg:                using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE
# gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <f4bug@amsat.org>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg:          There is no indication that the signature belongs to the owner.
# Primary key fingerprint: FAAB E75E 1291 7221 DCFD  6BB2 E3E3 2C2C DEAD C0DE

* tag 'single-binary-20260203' of https://github.com/philmd/qemu: (30 commits)
  disas: Have disas_set_info() take a const CPUState
  disas: Make disassemble_info::target_info field const
  disas/riscv: Make rv_decode::cfg const
  target/arm: Have arm_sctlr_b() take a const @env argument
  target/arm: Have is_64() take a const @env argument
  target/arm: Have cpu_isar_feature() use a const ARMCPU object
  target/arm: Have arm_feature() take a const @env argument
  target/alpha: Expand TCGv type for 64-bit target
  target/alpha: Remove target_ulong uses in get_physical_address()
  target/alpha: Do not use target_ulong for page table entries / indexes
  target/alpha: Do not use target_ulong for trap arguments
  target/alpha: Replace target_ulong -> uint64_t in gdb_write_register()
  target/alpha: Build system units in common source set
  target/alpha: Avoid target-specific migration headers in machine.c
  target/m68k: Inline translator_ld[uw,l,q]() calls
  target/i386: Inline translator_ld[uw,l,q]() calls
  target/riscv: Inline translator_ld[uw,l,q]() calls
  target/riscv: Inline cpu_ld[lq]_code() calls
  target/ppc: Inline cpu_ldl_code() call in ppc_ldl_code()
  target/ppc: Check endianness at runtime in ppc_data_endian_env()
  ...

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2026-02-04 01:57:26 +10:00
Philippe Mathieu-Daudé
a63b90ca6c disas: Have disas_set_info() take a const CPUState
The CPUClass::disas_set_info() handler is meant to initialize
the %disassemble_info structure; it shoudn't alter the CPU state.
Enforce the CPUState can not be modified by having the handler
take a const pointer.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20260202222412.24923-8-philmd@linaro.org>
2026-02-03 14:57:34 +01:00
Philippe Mathieu-Daudé
c87ef9d18a target/arm: Have arm_sctlr_b() take a const @env argument
arm_sctlr_b() only access @env read-only, make it const.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260202222412.24923-5-philmd@linaro.org>
2026-02-03 14:57:34 +01:00
Philippe Mathieu-Daudé
655309dc4c target/arm: Have is_64() take a const @env argument
is_64() only access @env read-only, make it const.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260202222412.24923-4-philmd@linaro.org>
2026-02-03 14:57:34 +01:00
Philippe Mathieu-Daudé
8a91d97085 target/arm: Have cpu_isar_feature() use a const ARMCPU object
The @cpu_ variable is only accessed read-only, make it const.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260202222412.24923-3-philmd@linaro.org>
2026-02-03 14:57:34 +01:00
Philippe Mathieu-Daudé
fd37919778 target/arm: Have arm_feature() take a const @env argument
arm_feature() only access @env read-only, make it const.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260202222412.24923-2-philmd@linaro.org>
2026-02-03 14:57:34 +01:00
Philippe Mathieu-Daudé
d8f0217284 target/alpha: Expand TCGv type for 64-bit target
The Alpha targets are only built as 64-bit:

  $ git grep TARGET_LONG_BITS configs/targets/alpha-*
  configs/targets/alpha-linux-user.mak:4:TARGET_LONG_BITS=64
  configs/targets/alpha-softmmu.mak:2:TARGET_LONG_BITS=64

Replace:

  TCGv -> TCGv_i64
  tcg_temp_new -> tcg_temp_new_i64

This is a mechanical replacement, adapting style to pass
the checkpatch.pl script.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260202234550.34156-8-philmd@linaro.org>
2026-02-03 14:57:34 +01:00
Philippe Mathieu-Daudé
2be3650d62 target/alpha: Remove target_ulong uses in get_physical_address()
%addr is a virtual address, so use the 'vaddr' type.
%pphys is a pointer to a physical address, so use the 'hwaddr' type.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260202234550.34156-7-philmd@linaro.org>
2026-02-03 14:57:34 +01:00
Philippe Mathieu-Daudé
c3ba74e21a target/alpha: Do not use target_ulong for page table entries / indexes
%L[123]pte are loaded calling ldq_le_phys() which returns
a uint64_t. %pt is loaded with @ptbr, declared as uint64_t
in target/alpha/cpu.h:

  236    uint64_t ptbr;

%index is at most 1024 so can fit in uint16_t.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260202234550.34156-6-philmd@linaro.org>
2026-02-03 14:57:34 +01:00
Philippe Mathieu-Daudé
29a45d20a0 target/alpha: Do not use target_ulong for trap arguments
%mmcsr and %cause are filled with @trap_arg1 / @trap_arg2,
both declared as uint64_t in target/alpha/cpu.h:

    229     uint64_t trap_arg1;
    230     uint64_t trap_arg2;
    ...

Use uint64_t instead of target_ulong.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260202234550.34156-5-philmd@linaro.org>
2026-02-03 14:57:34 +01:00
Philippe Mathieu-Daudé
f5d00b3b3a target/alpha: Replace target_ulong -> uint64_t in gdb_write_register()
On Alpha, the target_ulong type expands to uint64_t.
Besides, ldq_be_p() returns a uint64_t type, and all
field / values accessed are uint64_t, see target/alpha/cpu.h:

  200 typedef struct CPUArchState {
  201     uint64_t ir[31];
  202     float64 fir[31];
  203     uint64_t pc;
  204     uint64_t unique;
  ...
  443 void cpu_alpha_store_fpcr (CPUAlphaState *env, uint64_t val);
  445 void cpu_alpha_store_gr(CPUAlphaState *env, unsigned reg, uint64_t val);

Use uint64_t instead of target_ulong.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260202234550.34156-4-philmd@linaro.org>
2026-02-03 14:57:34 +01:00
Philippe Mathieu-Daudé
63004cd8c4 target/alpha: Build system units in common source set
Since commits bb5de52524 ("target: Widen pc/cs_base in
cpu_get_tb_cpu_state") and 32f0c394bb ("target: Use vaddr
in gen_intermediate_code") we remove all uses of the target_ulong
type in target/alpha/. Use the meson target_common_system_arch[]
source set to prevent further uses of target-specific types.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260202234550.34156-3-philmd@linaro.org>
2026-02-03 14:57:34 +01:00
Philippe Mathieu-Daudé
5d9e60294c target/alpha: Avoid target-specific migration headers in machine.c
machine.c doesn't use any target-specific macro defined by
the "migration/cpu.h" header. Use the minimum header required:
"migration/qemu-file-types.h" and "migration/vmstate.h", which
are not target-specific.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260202234550.34156-2-philmd@linaro.org>
2026-02-03 14:57:34 +01:00
Philippe Mathieu-Daudé
18cae273a1 target/m68k: Inline translator_ld[uw,l,q]() calls
In preparation of removing the translator_ld[uw,l,q]() methods,
inline them for the m68k target, expanding MO_TE -> MO_BE since
this architecture is only available in big endianness.

Mechanical change using the following Coccinelle 'spatch' script:

    @@
    expression env, db, pc, do_swap;
    @@
    (
    - translator_lduw(env, db, pc)
    + translator_lduw_end(env, db, pc, MO_BE)
    |
    - translator_ldl(env, db, pc)
    + translator_ldl_end(env, db, pc, MO_BE)
    |
    - translator_ldq(env, db, pc)
    + translator_ldq_end(env, db, pc, MO_BE)
    )

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Message-ID: <20260202214050.98935-1-philmd@linaro.org>
2026-02-03 14:57:34 +01:00
Philippe Mathieu-Daudé
39520c9eaa target/i386: Inline translator_ld[uw,l,q]() calls
In preparation of removing the translator_ld[uw,l,q]() methods,
inline them for the x86 targets, expanding MO_TE -> MO_LE since
the architecture uses little endian order.

Mechanical change using the following Coccinelle 'spatch' script:

    @@
    expression env, db, pc, do_swap;
    @@
    (
    - translator_lduw(env, db, pc)
    + translator_lduw_end(env, db, pc, MO_LE)
    |
    - translator_ldl(env, db, pc)
    + translator_ldl_end(env, db, pc, MO_LE)
    |
    - translator_ldq(env, db, pc)
    + translator_ldq_end(env, db, pc, MO_LE)
    )

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260202213348.96754-1-philmd@linaro.org>
2026-02-03 14:57:33 +01:00
Philippe Mathieu-Daudé
a31f16bdd4 target/riscv: Inline translator_ld[uw,l,q]() calls
In preparation of removing the translator_ld[uw,l,q]() methods,
inline them for the RISC-V targets, using mo_endian(ctx) -- which
we introduced in commit 504f7f304f -- instead of MO_TE.

Mechanical change using the following Coccinelle 'spatch' script:

    @@
    expression env, db, pc, do_swap;
    @@
    (
    - translator_lduw(env, db, pc)
    + translator_lduw_end(env, db, pc, mo_endian(ctx))
    |
    - translator_ldl(env, db, pc)
    + translator_ldl_end(env, db, pc, mo_endian(ctx))
    |
    - translator_ldq(env, db, pc)
    + translator_ldq_end(env, db, pc, mo_endian(ctx))
    )

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260202213810.97141-1-philmd@linaro.org>
2026-02-03 14:57:33 +01:00
Philippe Mathieu-Daudé
f7f4cd501c target/riscv: Inline cpu_ld[lq]_code() calls
In preparation of removing the cpu_ldl_code() and cpu_ldq_code()
wrappers, inline them.

Since RISC-V instructions are always stored in little-endian order
(see "Volume I: RISC-V Unprivileged ISA" document, chapter
'Instruction Encoding Spaces and Prefixes': "instruction fetch
in RISC-V is little-endian"), replace MO_TE -> MO_LE.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260202214317.99090-1-philmd@linaro.org>
2026-02-03 14:57:33 +01:00
Philippe Mathieu-Daudé
b9789d2993 target/ppc: Inline cpu_ldl_code() call in ppc_ldl_code()
In preparation of removing the cpu_ldl_code wrapper, inline it.

Get the runtime endianness with ppc_data_endian_env(), passing it
to cpu_ldl_code_mmu(). No need to swap versus qemu-system binary
anymore.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Anton Johansson <anjo@rev.ng>
Message-Id: <20260202210106.93257-12-philmd@linaro.org>
2026-02-03 14:57:33 +01:00
Philippe Mathieu-Daudé
7ef4fee1a6 target/ppc: Check endianness at runtime in ppc_data_endian_env()
Rather a runtime endianness check via env MSR over
a build-time one.

Now CPU can change endianness at runtime.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Anton Johansson <anjo@rev.ng>
Message-Id: <20260202210106.93257-11-philmd@linaro.org>
2026-02-03 14:57:33 +01:00
Philippe Mathieu-Daudé
cf7719d302 target/ppc: Introduce ppc_env_is_little_endian() helper
Centralize endianness check on MSR via a common helper.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Anton Johansson <anjo@rev.ng>
Message-Id: <20260202210106.93257-10-philmd@linaro.org>
2026-02-03 14:57:33 +01:00
Philippe Mathieu-Daudé
3d072f029f target/ppc: Check endianness via env in ppc_disas_set_info()
disas_set_info() shouldn't bother with env->hflags,
access env->msr directly.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Anton Johansson <anjo@rev.ng>
Message-Id: <20260202210106.93257-9-philmd@linaro.org>
2026-02-03 14:57:33 +01:00
Philippe Mathieu-Daudé
3531dc3dd9 target/ppc: Inline need_byteswap() and replace translator_ldl_swap()
Rather than using a boolean with translator_ldl_swap(),
get the MemOp endianness with ppc_code_endian() and pass
it to translator_ldl_end().

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Anton Johansson <anjo@rev.ng>
Message-Id: <20260202210106.93257-8-philmd@linaro.org>
2026-02-03 14:57:33 +01:00
Philippe Mathieu-Daudé
858a54e44d target/ppc: Introduce ppc_code_endian_dc() helper
Introduce the ppc_code_endian_dc() helper which returns the
MemOp endianness for the CODE path.

Use it in need_byteswap(), removing one TARGET_BIG_ENDIAN.

Note, the target MemOp endianness can be evaluated as (see
commit 5c43a750b6 "accel/tcg: Implement translator_ld*_end"):

    MO_TE ^ (do_swap * MO_BSWAP)

For PPC we use the DisasContext::le_mode field to swap the
default (big-endian) order, so to get the PPC MemOp endianness
we can directly use:

    MO_BE ^ (ctx->le_mode * MO_BSWAP)

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Anton Johansson <anjo@rev.ng>
Message-ID: <20260202210106.93257-7-philmd@linaro.org>
2026-02-03 14:57:33 +01:00
Philippe Mathieu-Daudé
043c4e1715 target/ppc: Introduce ppc_data_endian_env() helper
Introduce ppc_data_endian_env() which returns the endian MemOp
of the data path from the vCPU env pointer. Keep it hardcoded
as MO_TE, the target built-time endianness.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Anton Johansson <anjo@rev.ng>
Message-ID: <20260202210106.93257-6-philmd@linaro.org>
2026-02-03 14:57:33 +01:00
Philippe Mathieu-Daudé
3b24453f85 target/ppc: Expect page translation hash addresses to be aligned
The page translation hash addresses are aligned:
remove the misleading MO_UNALN flag.

Reported-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Anton Johansson <anjo@rev.ng>
Message-Id: <20260202210106.93257-5-philmd@linaro.org>
2026-02-03 14:57:33 +01:00
Philippe Mathieu-Daudé
50d114e04f target/ppc: Inline cpu_ld/st_data_ra() calls in do_hash()
In preparation of removing the cpu_ld*_data_ra() and
cpu_st*_data_ra() calls, inline them. No logical change
intended.

We note the page translation hash address is expected to
be aligned, so the MO_UNALN flag is misleading. Next commit
will remove it.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Anton Johansson <anjo@rev.ng>
Message-Id: <20260202210106.93257-4-philmd@linaro.org>
2026-02-03 14:57:33 +01:00
Philippe Mathieu-Daudé
cd4b54a030 target/ppc: Inline cpu_ld/st_mmuidx_ra() calls in memory helpers
In preparation of removing the cpu_ld*_mmuidx_ra() and
cpu_st*_mmuidx_ra() calls, inline them.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Anton Johansson <anjo@rev.ng>
Message-Id: <20260202210106.93257-3-philmd@linaro.org>
2026-02-03 14:57:33 +01:00
Philippe Mathieu-Daudé
f09e80011b target/ppc: Inline cpu_ldl_data_ra() calls in ICBI helpers
Inline the cpu_ldl_data_ra() call in preparation of
removing it. Since the returned value is discarded,
don't bother to set the access endianness.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Anton Johansson <anjo@rev.ng>
Message-Id: <20260202210106.93257-2-philmd@linaro.org>
2026-02-03 14:57:33 +01:00
Oliver Steffen
dea1f68a5c igvm: Fill MADT IGVM parameter field on x86_64
Use the new acpi_build_madt_standalone() function to fill the MADT
parameter field.

The IGVM parameter can be consumed by Coconut SVSM [1], instead of
relying on the fw_cfg interface, which has caused problems before due to
unexpected access [2,3]. Using IGVM parameters is the default way for
Coconut SVSM across hypervisors; switching over would allow removing
specialized code paths for QEMU in Coconut.

Coconut SVSM needs to know the SMP configuration, but does not look at
any other ACPI data, nor does it interact with the PCI bus settings.
Since the MADT is static and not linked with other ACPI tables, it can
be supplied stand-alone like this.

Generating the MADT twice (during ACPI table building and IGVM processing)
seems acceptable, since there is no infrastructure to obtain the MADT
out of the ACPI table memory area.

In any case OVMF, which runs after SVSM has already been initialized,
will continue reading all ACPI tables via fw_cfg and provide fixed up
ACPI data to the OS as before without any changes.

The IGVM parameter handler is implemented for the i386 machine target
and stubbed for all others.

[1] https://github.com/coconut-svsm/svsm/pull/858
[2] https://gitlab.com/qemu-project/qemu/-/issues/2882
[3] https://github.com/coconut-svsm/svsm/issues/646

Signed-off-by: Oliver Steffen <osteffen@redhat.com>
Message-ID: <20260130054714.715928-10-osteffen@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2026-02-03 08:32:33 +01:00
Oliver Steffen
8effe94499 igvm: Pass machine state to IGVM file processing
Pass the full MachineState to the IGVM backend during file processing,
instead of just the ConfidentialGuestSupport struct (which is a member
of the MachineState).
This replaces the cgs parameter of qigvm_process_file() with the machine
state to make it available in the IGVM processing context.

We will use it later to generate MADT data there to pass to the guest
as IGVM parameter.

Reviewed-by: Luigi Leonardi <leonardi@redhat.com>
Signed-off-by: Oliver Steffen <osteffen@redhat.com>
Message-ID: <20260130054714.715928-8-osteffen@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2026-02-03 08:32:33 +01:00
Philippe Mathieu-Daudé
a9edda7250 monitor: Reduce target-specific declarations
Some declarations do not depend on target-specific types,
move them out of "monitor/hmp-target.h" to "monitor/hmp.h".

Commit 409e9f7131 ("mos6522: add "info via" HMP command
for debugging") declared hmp_info_via() is declared twice.
Remove the one in "hw/misc/mos6522.h" otherwise we get:

  In file included from ../hw/misc/mos6522.c:33:
  include/monitor/hmp.h:43:6: error: redundant redeclaration of 'hmp_info_via' [-Werror=redundant-decls]
     43 | void hmp_info_via(Monitor *mon, const QDict *qdict);
        |      ^~~~~~~~~~~~
  In file included from ../hw/misc/mos6522.c:29:
  include/hw/misc/mos6522.h:175:6: note: previous declaration of 'hmp_info_via' with type 'void(Monitor *, const QDict *)'
    175 | void hmp_info_via(Monitor *mon, const QDict *qdict);
        |      ^~~~~~~~~~~~

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20260129164039.58472-3-philmd@linaro.org>
2026-02-02 22:14:51 +01:00
Philippe Mathieu-Daudé
a91b167cea target/i386: Include missing 'svm.h' header in 'sev.h'
"target/i386/sev.h" uses the vmcb_seg structure type, which
is defined in "target/i386/svm.h". Current builds succeed
because the files including "target/i386/sev.h" also include
"monitor/hmp-target.h", itself including "cpu.h" and finally
"target/i386/svm.h".

Include the latter, otherwise removing "cpu.h" from
"monitor/hmp-target.h" triggers:

  ../target/i386/sev.h:62:21: error: field has incomplete type 'struct vmcb_seg'
     62 |     struct vmcb_seg es;
        |                     ^

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Message-Id: <20260129164039.58472-2-philmd@linaro.org>
2026-02-02 22:14:51 +01:00
Philippe Mathieu-Daudé
59ac89211b target/alpha: Replace legacy ld_phys() -> address_space_ld()
Prefer the address_space_ld/st API over the legacy ld_phys()
because it allow checking for bus access fault.

Since we removed the last legacy uses of the legacy ldst_phys()
API, set the TARGET_NOT_USING_LEGACY_LDST_PHYS_API variable to
hide the legacy API to alpha binaries, avoiding further API uses
to creep in.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20251224160040.88612-7-philmd@linaro.org>
2026-02-02 12:34:14 +01:00
Philippe Mathieu-Daudé
fd8e27d2dc target/alpha: Inline translator_ldl()
translator_ldl() is defined in "exec/translator.h" as:

  198 static inline uint32_t
  199 translator_ldl(CPUArchState *env, DisasContextBase *db, vaddr pc)
  200 {
  201     return translator_ldl_end(env, db, pc, MO_TE);
  202 }

Directly use the inlined form, expanding MO_TE -> MO_LE
since Alpha use little-endian order.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20251224160040.88612-5-philmd@linaro.org>
2026-02-02 12:34:14 +01:00
Philippe Mathieu-Daudé
954072d255 target/alpha: Use explicit little-endian LD/ST API
The Alpha architecture uses little endianness. Directly
use the little-endian LD/ST API.

Mechanical change running:

  $ for a in uw w l q; do \
      sed -i -e "s/ld${a}_p(/ld${a}_le_p(/" \
        $(git grep -wlE '(ld|st)u?[wlq]_p' target/alpha/);
    done

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20251224160040.88612-2-philmd@linaro.org>
2026-02-02 12:34:14 +01:00
Cornelia Huck
5252c07746 arm: add DCZID_EL0 to idregs array
Continue moving ID registers to the idregs array, so that we
eventually can switch to an autogenerated cpu-sysregs.h.inc.

This requires a bit of care, since we still have to handle the EL
specific part (DCZID_EL0.DZP). The value previously saved in
cpu->dcz_blocksize is now kept in DCZID_EL.BS (transparent to
callers using the wrappers.)

KVM currently does not support DCZID_EL0 via ONE_REG, assert that
we're not trying to do anything with it until it does.

Signed-off-by: Cornelia Huck <cohuck@redhat.com>
Reviewed-by: Sebastian Ott <sebott@redhat.com>
Message-id: 20260105154119.59853-3-cohuck@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2026-01-29 13:45:39 +00:00
Cornelia Huck
7d2e2d0941 arm: add {get,set}_dczid_bs helpers
Most accesses to cpu->dcz_blocksize really care about
DCZID_EL0.BS (i.e. the part of the register that does not change at
different EL.) Wean them off directly dealing with cpu->dcz_blocksize
so that we can switch to handling DCZID_EL0 differently in a followup
patch.

Signed-off-by: Cornelia Huck <cohuck@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Sebastian Ott <sebott@redhat.com>
Message-id: 20260105154119.59853-2-cohuck@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2026-01-29 13:45:39 +00:00
Philippe Mathieu-Daudé
bfbea371ef target/arm/hvf: Sync CNTV_CTL_EL0 & CNTV_CVAL_EL0
Keep CNTV_CTL_EL0 and CNTV_CVAL_EL0 synchronized with the
host hardware accelerator.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Message-id: 20260118215945.46693-3-philmd@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2026-01-29 13:32:05 +00:00
Philippe Mathieu-Daudé
c0f2a78e2c target/arm/hvf: Move hvf_sysreg_[read, write]_cp() functions around
Next commit will use these functions prototype earlier. Rather
than forward-declaring them, move them around.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Message-id: 20260118215945.46693-2-philmd@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2026-01-29 13:32:05 +00:00
Shameer Kolothum
5c921b29c9 hw/pci/pci: Introduce a callback to retrieve the MSI doorbell GPA directly
For certain vIOMMU implementations, such as SMMUv3 in accelerated mode,
the translation tables are programmed directly into the physical SMMUv3
in a nested configuration. While QEMU knows where the guest tables live,
safely walking them in software would require trapping and ordering all
guest invalidations on every command queue. Without this, QEMU could race
with guest updates and walk stale or freed page tables.

This constraint is fundamental to the design of HW-accelerated vSMMU when
used with downstream vfio-pci endpoint devices, where QEMU must never walk
guest translation tables and must rely on the physical SMMU for
translation. Future accelerated vSMMU features, such as virtual CMDQ, will
also prevent trapping invalidations, reinforcing this restriction.

For vfio-pci endpoints behind such a vSMMU, the only translation QEMU
needs is for the MSI doorbell used when setting up KVM MSI route tables.
Instead of attempting a software walk, introduce an optional vIOMMU
callback that returns the MSI doorbell GPA directly.

kvm_arch_fixup_msi_route() uses this callback when available and ignores
the guest provided IOVA in that case.

If the vIOMMU does not implement the callback, we fall back to the
existing IOMMU based address space translation path.

This ensures correct MSI routing for accelerated SMMUv3 + VFIO passthrough
while avoiding unsafe software walks of guest translation tables.

As a related change, replace RCU_READ_LOCK_GUARD() with explicit
rcu_read_lock()/rcu_read_unlock(). The introduction of an early goto
(set_doorbell) path means the RCU read side critical section can no longer
be safely scoped using RCU_READ_LOCK_GUARD().

Cc: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Nicolin Chen <nicolinc@nvidia.com>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Tested-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Zhangfei Gao <zhangfei.gao@linaro.org>
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Signed-off-by: Shameer Kolothum <skolothumtho@nvidia.com>
Message-id: 20260126104342.253965-17-skolothumtho@nvidia.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2026-01-29 13:32:04 +00:00
Paolo Bonzini
2a52067b06 target/i386/tcg: cleanup #ifdef TARGET_X86_64
32-bit TCG opcodes produced for the i386 target usually looks the same
as 64-bit TCG opcodes produced for the x86_64.  The special one that
needs extensions is 32-bit TCG opcodes produced for the x86_64 target.
Make all #ifdefs look the same, like this:

    case MO_32:
  #ifdef TARGET_X86_64
      /* code using 32-bit opcodes */

    case MO_64:
  #endif
      /* code using target_long opcodes */

  default:
    g_assert_not_reached();

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2026-01-27 08:57:52 +01:00
Paolo Bonzini
5585d072c6 target/i386/tcg: replace havesib variable with the SIB byte itself
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2026-01-27 08:57:52 +01:00
Paolo Bonzini
a1356c5677 target/i386/tcg: merge decode_modrm and decode_modrm_address split
Unlike the older code in translate.c, mod=11b *is* filtered out earlier
by decode_modrm, and it would have returned bogus code.  Since the register
case is so simple, just inline decode_modrm_address into its caller instead
of removing the "if".

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2026-01-27 08:57:52 +01:00
Paolo Bonzini
30ebb65f83 target/i386/tcg: remove dead constants
NB_OP_SIZES has been dead since the conversion to TCG, REG_L_OFFSET
since 2015, the others somewhere in the middle.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2026-01-27 08:57:52 +01:00
Paolo Bonzini
d66532600f target/i386/tcg: fix typo in dpps/dppd instructions
Their gen_* functions were incorrectly named gen_VDDPS and gen_VDDPD.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2026-01-27 08:57:52 +01:00
Paolo Bonzini
2eb8d97343 target/i386/tcg: fix a few instructions that do not support VEX.L=1
Match the contents of table 2-17 ("#UD Exception and VEX.L Field Encoding")
in the SDM, for instruction in exception class 5.  They were incorrectly
accepting 256-bit versions that do not exist.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2026-01-27 08:57:52 +01:00
Richard Henderson
9c4c090d27 Merge tag 'pull-target-arm-20260123' of https://gitlab.com/pm215/qemu into staging
target-arm queue:
 * hw/arm/imx8mp-evk: Provide some defaults matching real hardware
 * hw/intc: endianness fixes
 * various: Clean up includes
 * kernel-doc.py: sync with upstream Kernel v6.19-rc4
 * scripts/clean-includes: Minor improvements; exclude list update
 * docs/system/arm/imx8mp-evk: Avoid suggesting redundant CLI parameters
 * docs/system/arm/xlnx-zynq.rst: Improve docs rendering
 * docs: Be consistent about capitalization of 'Arm' (again)
 * docs: Avoid unintended mailto: hyperlinks
 * qemu-options.hx: Drop uses of @var
 * qemu-options.hx: Improve formatting in colo-compare docs

# -----BEGIN PGP SIGNATURE-----
#
# iQJNBAABCAA3FiEE4aXFk81BneKOgxXPPCUl7RQ2DN4FAmlzju4ZHHBldGVyLm1h
# eWRlbGxAbGluYXJvLm9yZwAKCRA8JSXtFDYM3uU/D/9IHpo57UIHAF7vU9gsWm5k
# TxLl9PBw3ev2Uv6zWWza0wYZQF2ZcvqwMiU/AlBFuyJFyXTLocL3iN6Rsw+8kcjh
# jaq2hCtzSNJWj41CEU22l7iUfJ5PdOVdRYhhwlrQqxXDJj8Oj3plliRc6AL1EZYD
# mxAJ+YQ8pfJ/2ibO66sqwGMLjPsjCmmgfloTm/qFzk7QccQkPZKzDrC9CGGRmmRA
# tcdBGMtu+DOqpCRKIRul0S8ed2qaTecIK3+fUID0+qEzb10VWgFs/AAQiwLPkwyi
# RvMmIbC9lYVCnP+YC4HlvYMfd61V3lpzsUXgMIbdRZYsN/IlTVfetJUOVmn3LTQ/
# gGU0b+t6D/OZAt1L6toBngKVh89VPqbpGXEx4UMHCNIcvfI1Xo+HRT9ZV5WCw6b8
# sVKOZUwKs9ZbFAcrgBgskXp/5KWZAb92IFjwbfwxxl/2NRK3B3y7CDHBoOM/zQ9a
# rZ7rfJHhQVGR2+1QonNbpG0IFwbgs0zPQwBjPreGh6TWf2UiXvx1ku94Wxe2lA+5
# CPeju+swbFKRNjwSas6NZjJWazacohYG3nhmhF7HtcgX279BzIV0d+ZIl786Juls
# 4Vt4dPUxU/kHHZHjE52AZUS/opIy+UHAj0FKPAPpTrc7UfuHlY3gqoI7UfVpciau
# q3DqM7PlF2X91kw4xJ6JCA==
# =bE6w
# -----END PGP SIGNATURE-----
# gpg: Signature made Sat 24 Jan 2026 02:08:30 AM AEDT
# gpg:                using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE
# gpg:                issuer "peter.maydell@linaro.org"
# gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [unknown]
# gpg:                 aka "Peter Maydell <pmaydell@gmail.com>" [unknown]
# gpg:                 aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" [unknown]
# gpg:                 aka "Peter Maydell <peter@archaic.org.uk>" [unknown]
# gpg: WARNING: The key's User ID is not certified with a trusted signature!
# gpg:          There is no indication that the signature belongs to the owner.
# Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83  15CF 3C25 25ED 1436 0CDE

* tag 'pull-target-arm-20260123' of https://gitlab.com/pm215/qemu: (22 commits)
  qemu-options.hx: Improve formatting in colo-compare docs
  qemu-options.hx: Drop uses of @var
  docs: avoid unintended mailto: hyperlinks
  docs/system/arm/xlnx-zynq.rst: Improve docs rendering
  hw/intc: avoid byte swap fiddling in gicv3 its path
  hw/intc: declare GICv3 regions as little endian
  hw/intc: declare GIC regions as little endian
  hw/intc: declare NVIC regions as little endian
  all: Clean up includes
  misc: Clean up includes
  bsd-user: Clean up includes
  mshv: Clean up includes
  scripts/clean-includes: Update exclude list
  scripts/clean-includes: Give the args in git commit messages
  scripts/clean-includes: Do all our exclusions with REGEXFILE
  scripts/clean-includes: Make ignore-regexes one per line
  scripts/clean-includes: Remove outdated comment
  scripts/clean-includes: Allow directories on command line
  docs: Be consistent about capitalization of 'Arm' (again)
  kernel-doc.py: sync with upstream Kernel v6.19-rc4
  ...

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2026-01-24 07:59:34 +11:00
Peter Maydell
75f48413bb all: Clean up includes
This commit was created with scripts/clean-includes:
 ./scripts/clean-includes '--git' 'all' '--all'

and manually edited to remove one change to hw/virtio/cbor-helpers.c.
All these changes are header files that include osdep.h or some
system header that osdep.h pulls in; they don't need to do this.

All .c should include qemu/osdep.h first.  The script performs three
related cleanups:

* Ensure .c files include qemu/osdep.h first.
* Including it in a .h is redundant, since the .c  already includes
  it.  Drop such inclusions.
* Likewise, including headers qemu/osdep.h includes is redundant.
  Drop these, too.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20260116125830.926296-5-peter.maydell@linaro.org
2026-01-22 11:23:31 +00:00
Peter Maydell
dc249aaf57 misc: Clean up includes
This commit deals with various .c files that included system
headers that are already pulled in by osdep.h, where the .c
file includes osdep.h already itself.

This commit was created with scripts/clean-includes:
 ./scripts/clean-includes '--git' 'misc' 'hw/core' 'semihosting' 'target/arm' 'target/i386/kvm/kvm.c' 'target/loongarch' 'target/riscv' 'tools' 'util'

All .c should include qemu/osdep.h first.  The script performs three
related cleanups:

* Ensure .c files include qemu/osdep.h first.
* Including it in a .h is redundant, since the .c  already includes
  it.  Drop such inclusions.
* Likewise, including headers qemu/osdep.h includes is redundant.
  Drop these, too.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20260116125830.926296-4-peter.maydell@linaro.org
2026-01-22 11:23:31 +00:00
Peter Maydell
2be48b31b4 mshv: Clean up includes
This commit was created with scripts/clean-includes:
 ./scripts/clean-includes '--git' 'mshv' 'accel/mshv' 'target/i386/mshv' 'include/system/mshv.h'

All .c should include qemu/osdep.h first.  The script performs three
related cleanups:

* Ensure .c files include qemu/osdep.h first.
* Including it in a .h is redundant, since the .c  already includes
  it.  Drop such inclusions.
* Likewise, including headers qemu/osdep.h includes is redundant.
  Drop these, too.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20260116125830.926296-2-peter.maydell@linaro.org
2026-01-22 11:23:31 +00:00