hw/nvme: unmap req->sg earlier in nvme_enqueue_req_completion
Instead of unmapping req->sg in nvme_post_cqes(), we can do it earlier in
nvme_enqueue_req_completion(). When req completion is enqueued we don't
need to access req->sg anymore. We only care about req->sq, req->cqe and
req->status.
Reviewed-by: Klaus Jensen <k.jensen@samsung.com> Acked-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Alexander Mikhalitsyn <aleksandr.mikhalitsyn@futurfusion.io> Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
Instead of filling req->cqe.sq_id in nvme_post_cqes, let's set it earlier
in nvme_process_sq.
This shouldn't cause any issues, because req->cqe.sq_id never changes
during lifetime of req.
This will help us for migration support.
Reviewed-by: Klaus Jensen <k.jensen@samsung.com> Acked-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Alexander Mikhalitsyn <aleksandr.mikhalitsyn@futurfusion.io> Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
hw/nvme: split nvme_init_sq/nvme_init_cq into helpers
We will make a benefit from this split in later patches.
Reviewed-by: Klaus Jensen <k.jensen@samsung.com> Acked-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Alexander Mikhalitsyn <aleksandr.mikhalitsyn@futurfusion.io> Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
hw/nvme: add migration blockers for non-supported cases
Let's block migration for cases we don't support:
- SR-IOV
- CMB
- PMR
- SPDM
No functional changes here, because NVMe migration is
not supported at all as of this commit.
Reviewed-by: Klaus Jensen <k.jensen@samsung.com> Acked-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Alexander Mikhalitsyn <aleksandr.mikhalitsyn@futurfusion.io> Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
tests/functional/migration: add VM launch/configure hooks
Introduce configure_machine, launch_source_vm and assert_dest_vm
methods to allow child classes to override some pieces of
source/dest VMs creation, start and check logic.
Reviewed-by: Peter Xu <peterx@redhat.com> Acked-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Alexander Mikhalitsyn <aleksandr.mikhalitsyn@futurfusion.io> Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
Keith Busch [Fri, 29 May 2026 13:59:47 +0000 (06:59 -0700)]
hw/nvme: ensure sgl forward progress
A degenerate host can create segment loops of zero-byte data descriptors
that the controller never breaks out of. While the spec allows zero
length segments, it provides no guidance on handling loops. It
makes no sense for a host to submit such a descriptor anyway since it
can and trivially should point to the next transfer segment, so don't
even try to work with such behavior. Just reject the command,
terminating the loop.
Cc: qemu-stable@nongnu.org Reported-by: Feifan Qian <bea1e@proton.me> Reported-by: boy juju <agx1657748706@gmail.com> Signed-off-by: Keith Busch <kbusch@kernel.org> Reviewed-by: Klaus Jensen <k.jensen@samsung.com> Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
Addresses an issue reported whereby user-provided event type values
could trigger two issues:
1. if provided event_type == 0xff -> out-of-bounds access
2. if provided event_type > 7 -> generate a value too large for the
u8 event mask.
This patch fixes (1) by correctly adjusting the length of the look-up
array to be 256 values.
This patch fixes (2) by:
a. changing the event_type mask to 64bit, matching
NvmeRuHandle.event_filter
b. Matching the behavior of Get Feature - FDP Events by skipping
event type values which we do not support.
5.2.26.1.21 of the 2.3 Base specification does not explicitly
tell us to reject unsupported event type values.
c. Documenting in the event type lookup table, that supporting
event types greater than 63 requires refactoring the masking
code.
Cc: qemu-stable@nongnu.org Reported-by: jaeyeong <fin@spl.team>
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3631 Signed-off-by: Jesper Wendel Devantier <foss@defmacro.it> Reviewed-by: Klaus Jensen <k.jensen@samsung.com> Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
Stefan Hajnoczi [Mon, 6 Jul 2026 16:38:14 +0000 (18:38 +0200)]
Merge tag 'accel-20260706' of https://github.com/philmd/qemu into staging
Accelerators patches queue
- Various cleanups around debugging APIs
- Correctly check singlestep flag enabled in CPUState
- Fix possible memory corruption with MSHV (CID 1660876)
* tag 'accel-20260706' of https://github.com/philmd/qemu: (32 commits)
cpu: Only check SSTEP_ENABLE flag in cpu_single_stepping()
cpu: Rename CPUState @singlestep_enabled -> @singlestep_flags
cpu: Introduce cpu_single_stepping() helper
cpu: Better name cpu_single_step() trace event
accel/tcg: Improve docstrings around TCGCPUOps::*watchpoint* handlers
target/ppc: Ensure TCG is used in ppc_update_daw()
target/arm: Inline check_watchpoints() in arm_debug_check_watchpoint()
accel: Use GdbBreakpointType enum
gdbstub: Introduce GdbBreakpointType enumerator
gdbstub: Reduce @type variable scope
gdbstub/user: Directly call gdb_breakpoint_remove_all() in user mode
accel: Remove unnecessary 'inline' qualifier in remove_all_breakpoints
cpu: Move BREAKPOINT definitions to 'exec/breakpoint.h'
cpu: Move cpu_breakpoint_test out of line
accel: Remove AccelOpsClass::supports_guest_debug
accel: Hold @can_reverse information in AccelGdbConfig
gdbstub: Make default replay_mode value explicit in stubs
accel: Have each implementation return their AccelGdbConfig
gdbstub: Move supported_sstep_flags in AccelGdbConfig structure
gdbstub: Reduce gdb_supports_guest_debug() scope
...
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Stefan Hajnoczi [Mon, 6 Jul 2026 16:37:28 +0000 (18:37 +0200)]
Merge tag 'pull-target-arm-20260706' of https://gitlab.com/pm215/qemu into staging
target-arm queue:
* hw/net/fsl_etsec: validate FCB offsets in process_tx_fcb()
* hw/arm/smmuv3-accel: Fix veventq read returning true on EAGAIN/EINTR
* target/arm: Only evaluate SCR_EL3.PIEN if ARM_FEATURE_EL3 is present
* hw/arm: use cortex-a9 mpcore base for CBAR on npcm7xx machines
* docs/specs/fw_cfg: Document all architecture register layouts
* hw/nvram/fw_cfg: Simplify functions so board models don't have
the opportunity to create non-standard fw_cfg register layouts
* hw/misc: use tracepoints rather than DPRINTF in imx ccm models
* hw/arm: add support for shim loading
* docs/system/arm: Document Zynq Buildroot boot
* target/arm: Report correct syndrome to AArch32 EL2 for trapped
Neon/VFP insns
* target/arm: implement WFET to not be a NOP
* target/arm: Emulate FEAT_SME_MOP4
* target/arm: Emulate FEAT_FPRCVT
* target/arm: Emulate FEAT_SSVE_FEXPA
* tag 'pull-ppc-for-11.1-sf-20260706' of https://gitlab.com/harshpb/qemu:
MAINTAINERS: Add self as maintainer for PowerNV
ppc/pnv: Remove Power8E and Power8NVL CPUs
ppc/pnv: Remove Power8E and Power8NVL pnv chips
ppc/pnv: Replace Power8E with Power11 for 'none' machine test
tests/functional: Use default powernv machine instead of power10
tests/qtest: Add Power11 chip & machine to qtests
tests/qtest/pnv_spi: Test Power11 PNV_SPI
tests/functional: Add remote interrupts test for PowerNV
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Stefan Hajnoczi [Mon, 6 Jul 2026 16:36:12 +0000 (18:36 +0200)]
Merge tag 'hppa-fixes-for-v11.1-pull-request' of https://github.com/hdeller/qemu-hppa into staging
Updates for hppa architecture for qemu v11.1
A few patches to fix TLB for HP-UX 9, and a lasi irq fix,
as well as a new SeaBIOS-hppa v25 firmware.
# -----BEGIN PGP SIGNATURE-----
#
# iHUEABYKAB0WIQS86RI+GtKfB8BJu973ErUQojoPXwUCakp8eQAKCRD3ErUQojoP
# X0S0AP9snfMLNer3zkojMLVsUNJtNUGmcRSNpmapiEN59lHRJwEAv30x2P3CnXLZ
# ObN+XV79pTNHtrBAGRYKHUtaLPddlgQ=
# =RRlH
# -----END PGP SIGNATURE-----
# gpg: Signature made Sun 05 Jul 2026 17:47:05 CEST
# gpg: using EDDSA key BCE9123E1AD29F07C049BBDEF712B510A23A0F5F
# gpg: Good signature from "Helge Deller <deller@gmx.de>" [unknown]
# gpg: aka "Helge Deller <deller@kernel.org>" [unknown]
# gpg: aka "Helge Deller <deller@debian.org>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 4544 8228 2CD9 10DB EF3D 25F8 3E5F 3D04 A7A2 4603
# Subkey fingerprint: BCE9 123E 1AD2 9F07 C049 BBDE F712 B510 A23A 0F5F
* tag 'hppa-fixes-for-v11.1-pull-request' of https://github.com/hdeller/qemu-hppa:
target/hppa: Update SeaBIOS-hppa to version 25
hw/misc/lasi: derive IRR from pending and unmasked requests
target/hppa: Delay MMU update until TLB protection bits were set
target/hppa: Work-around for Fast TLB insert instruction on HP-UX 9
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
target/s390x: Fix wrong address handling in address loops
The loop increments addr by the element stride (+= 4) before calling
wrap_address, but then overwrites the loop addr with the wrapped
value. On the next iteration the stride is applied to the wrapped
address of the previous element, not to the original unwrapped
address. This results in every element after the first is read from a
wrong (wrapped) address.
Fixes: 9f17bfdab4 ("target/s390x: support SHA-512 extensions") Signed-off-by: Harald Freudenberger <freude@linux.ibm.com> Reviewed-by: Holger Dengler <dengler@linux.ibm.com>
Message-ID: <20260706094317.17032-2-freude@linux.ibm.com> Signed-off-by: Cornelia Huck <cohuck@redhat.com>
cpu: Only check SSTEP_ENABLE flag in cpu_single_stepping()
Only the SSTEP_ENABLE bitmask means single-step is enabled.
Fixes: 60897d369f1 ("Debugger single step without interrupts") Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Reviewed-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260705215729.62196-33-philmd@oss.qualcomm.com>
CPUState::singlestep_enabled contains multiple flags since
commit 60897d369f1 ("Debugger single step without interrupts").
Use an unsigned type and rename the field to avoid mistakes.
Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260705215729.62196-32-philmd@oss.qualcomm.com>
Access CPUState::@singlestep_enabled field with a helper.
Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260705215729.62196-31-philmd@oss.qualcomm.com>
accel/tcg: Improve docstrings around TCGCPUOps::*watchpoint* handlers
Commit d5ee641cfc5 ("target/ppc: Implement watchpoint debug facility
for v2.07S") also implemented TCGCPUOps::debug_check_watchpoint for
PPC: make the comment generic.
Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Reviewed-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260705215729.62196-29-philmd@oss.qualcomm.com>
target/arm: Inline check_watchpoints() in arm_debug_check_watchpoint()
check_watchpoints() is called once, by arm_debug_check_watchpoint(),
which doesn't do more than this call. Merge both. No logical change
intended.
Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260705215729.62196-27-philmd@oss.qualcomm.com>
Include '_gdbstub_' in the AccelOpsClass handlers to emphasize
we are handling gdbstub-related requests.
Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Reviewed-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260705215729.62196-26-philmd@oss.qualcomm.com>
Introduce the GdbBreakpointType enumerator to better follow
code related to GDB protocol handling.
Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Reviewed-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260705215729.62196-25-philmd@oss.qualcomm.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Reviewed-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260705215729.62196-24-philmd@oss.qualcomm.com>
gdbstub/user: Directly call gdb_breakpoint_remove_all() in user mode
No need to deref external methods with unused argument to
end up calling a method defined in the same unit file, call
it directly.
Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Reviewed-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260705215729.62196-23-philmd@oss.qualcomm.com>
accel: Remove unnecessary 'inline' qualifier in remove_all_breakpoints
Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Reviewed-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260705215729.62196-22-philmd@oss.qualcomm.com>
cpu: Move BREAKPOINT definitions to 'exec/breakpoint.h'
Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Reviewed-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260705215729.62196-20-philmd@oss.qualcomm.com>
Move the function to cpu-common.c, with the other
breakpoint functions.
Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Message-ID: <20260705215729.62196-19-philmd@oss.qualcomm.com>
Now accelerators hold the 'guest debug supported' information
in their state, accessible by the common code. No need to call
a per-accelerator handler, simply check for the SSTEP_ENABLE
in AccelGdbConfig::sstep_flags.
Remove all AccelOpsClass::supports_guest_debug implementations,
inline gdb_supports_guest_debug() and remove the now unnecessary
KVMState::have_guest_debug field.
Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260705215729.62196-18-philmd@oss.qualcomm.com>
accel: Hold @can_reverse information in AccelGdbConfig
Hold @can_reverse in AccelGdbConfig, set it when initializing
AccelState in AccelClass::init_machine handlers (only TCG sets
it). Remove gdb_can_reverse() as now unused.
Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Message-ID: <20260705215729.62196-17-philmd@oss.qualcomm.com>
gdbstub: Make default replay_mode value explicit in stubs
Make explicit @replay_mode is stubbed as REPLAY_MODE_NONE.
Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260705215729.62196-16-philmd@oss.qualcomm.com>
accel: Have each implementation return their AccelGdbConfig
Hold the per-accelerator AccelGdbConfig in AccelState, set its
single @sstep_flags field in AccelClass::init_machine handlers.
Remove the AccelClass::gdbstub_supported_sstep_flags() getter
and inline the single accel_supported_gdbstub_sstep_flags() call
in gdb_init_gdbserver_state().
Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260705215729.62196-15-philmd@oss.qualcomm.com>
gdbstub: Move supported_sstep_flags in AccelGdbConfig structure
supported_sstep_flags are per-accelerators. Move them
to a new AccelGdbConfig structure, still in GDBState.
Suggested-by: Alex Bennée <alex.bennee@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260705215729.62196-14-philmd@oss.qualcomm.com>
gdb_supports_guest_debug() is only required for system emulation,
reduce its scope by making it private; remove the user emulation
variant.
Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Message-ID: <20260705215729.62196-13-philmd@oss.qualcomm.com>
Prefer to store per-accelerator variables in the per-accelerator
state, rather than as static variables. This is a good practice
to allow concurrent accelerators in the future.
Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Reviewed-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260705215729.62196-12-philmd@oss.qualcomm.com>
Simplify #ifdef'ry using TARGET_KVM_HAVE_GUEST_DEBUG in kvm_init().
No need to zero-initialize kvm_sstep_flags again.
Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260705215729.62196-11-philmd@oss.qualcomm.com>
Whether TARGET_KVM_HAVE_GUEST_DEBUG is defined or not,
kvm_supports_guest_debug() still exists and can be called.
Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Reviewed-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260705215729.62196-10-philmd@oss.qualcomm.com>
Correct gdbstub support requires some gdbstub_supported_sstep_flags.
Apparently missed in commit d7482ffe975 ("whpx: Added support for
breakpoints and stepping"), even with the recent 19b48084f71 ("whpx:
i386: re-enable guest debug support") fixes.
Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Reviewed-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260705215729.62196-9-philmd@oss.qualcomm.com>
gdbstub: Only return E22 when reverse GDB is not supported
No need to keep processing the arguments when we know
reverse debugging is not available.
Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Reviewed-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com> Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20260705215729.62196-8-philmd@oss.qualcomm.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Reviewed-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com> Acked-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20260705215729.62196-7-philmd@oss.qualcomm.com>
get_proc_features() to retrieve the 2nd bank was passing a pointer that
steps over the whole union (+16B) instead of picking the 2nd bank _in_
the union. This manifests in mismatching feature bits for the 2nd bank
and possibly other side-effects caused by writing beyond the union.
We need to step over the first bank (+8B) by using as_uint64[0/1] to
correct this behaviour.
Resolves: Coverity CID 1660876 Fixes: 2f6da91e8a ("accel/mshv: store partition proc features") Signed-off-by: Magnus Kulke <magnuskulke@linux.microsoft.com> Reviewed-by: Doru Blânzeanu <dblanzeanu@linux.microsoft.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-ID: <20260701130335.418156-1-magnuskulke@linux.microsoft.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
accel/mshv: Replace @dirty field by generic CPUState::vcpu_dirty field
No need for accel-specific @dirty field when we have
a generic one in CPUState. (Other accelerators already
did that in commits 6f13a0ada01..36ab216b81d).
Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Tested-by: Magnus Kulke <magnuskulke@linux.microsoft.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260705215729.62196-6-philmd@oss.qualcomm.com>
Missed in commit 6bf331164c5 ("accel/hvf: Drop hvf_slot and
hvf_find_overlap_slot").
Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Reviewed-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260705215729.62196-5-philmd@oss.qualcomm.com>
accel/tcg: Restrict tlb_protect/unprotect_code() to TCG
Both tlb_protect() and tlb_unprotect_code() are only used
within accel/tcg/. Avoid exposing them to the whole code base,
declare them in a new "system-page-protection.h" local header
(maintaining the previous LGPL-2.1-or-later license).
Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Reviewed-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Chao Liu <chao.liu.zevorn@gmail.com>
Message-ID: <20260705215729.62196-4-philmd@oss.qualcomm.com>
target/i386: Remove duplicate tlb_flush() call in cpu_post_load()
Common vCPU cpu_common_post_load() handler calls tlb_flush() since
commit 9656f324d25 ("Move interrupt_request and user_mode_only to
common cpu state..."), no need to call it twice.
Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Chao Liu <chao.liu.zevorn@gmail.com>
Message-ID: <20260705215729.62196-3-philmd@oss.qualcomm.com>
Various CPUState can share the same CPUClass parent,
and must not update its fields. Protect the CPUClass
by marking the CPUState pointer const.
Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Reviewed-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Chao Liu <chao.liu.zevorn@gmail.com>
Message-ID: <20260705215729.62196-2-philmd@oss.qualcomm.com>
Jared Rossi [Tue, 30 Jun 2026 14:19:16 +0000 (10:19 -0400)]
pc-bios/s390-ccw: write IPLB location for non-net virtio devices
When IPL type is PCI, cutype is unknown, so the IPLB location does not
get written to lowcore. Instead of checking cutype, check if the device
is virtio generically, which covers both CCW and PCI variants. Net devices
are excluded.
Signed-off-by: Jared Rossi <jrossi@linux.ibm.com> Reviewed-by: Eric Farman <farman@linux.ibm.com> Tested-by: Matthew Rosato <mjrosato@linux.ibm.com>
Message-ID: <20260630141917.673995-6-jrossi@linux.ibm.com> Signed-off-by: Cornelia Huck <cohuck@redhat.com>
Zhuoying Cai [Tue, 30 Jun 2026 14:19:14 +0000 (10:19 -0400)]
pc-bios/s390-ccw: Add per-queue notification offset for multi-queue virtio configurations
The initial support for virtio-blk-pci IPL devices used a single virt-queue, but
other device types require multiple queues, and for PCI device types this also
requires a per-queue notification offset.
Add a PCI notify field to the VRing struct so that each queue has a unique
notify offset as defined in the virtio spec.
Signed-off-by: Zhuoying Cai <zycai@linux.ibm.com> Signed-off-by: Jared Rossi <jrossi@linux.ibm.com> Reviewed-by: Eric Farman <farman@linux.ibm.com> Tested-by: Matthew Rosato <mjrosato@linux.ibm.com>
Message-ID: <20260630141917.673995-4-jrossi@linux.ibm.com> Signed-off-by: Cornelia Huck <cohuck@redhat.com>
Jared Rossi [Tue, 30 Jun 2026 14:19:13 +0000 (10:19 -0400)]
pc-bios/s390-ccw/virtio.c: Fix missing break for PCI notifications
Add a break after calling the PCI specific notification function instead of
falling through to the default case.
Signed-off-by: Jared Rossi <jrossi@linux.ibm.com> Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com> Fixes: d72fb5e6b2 ("pc-bios/s390-ccw: Add support for virtio-blk-pci IPL") Reviewed-by: Eric Farman <farman@linux.ibm.com> Tested-by: Matthew Rosato <mjrosato@linux.ibm.com>
Message-ID: <20260630141917.673995-3-jrossi@linux.ibm.com> Signed-off-by: Cornelia Huck <cohuck@redhat.com>
Zhuoying Cai [Tue, 30 Jun 2026 14:19:12 +0000 (10:19 -0400)]
pc-bios/s390-ccw: Refactor byte swapping
Introduce local variables to cache the byte-swapped values eliminating
some redundant byte swap operations. Additionally, do byte swap when
polling to avoid a special case where endianness is preserved.
Reviewed-by: Eric Farman <farman@linux.ibm.com> Signed-off-by: Zhuoying Cai <zycai@linux.ibm.com> Signed-off-by: Jared Rossi <jrossi@linux.ibm.com> Tested-by: Matthew Rosato <mjrosato@linux.ibm.com>
Message-ID: <20260630141917.673995-2-jrossi@linux.ibm.com> Signed-off-by: Cornelia Huck <cohuck@redhat.com>
Peter Maydell [Thu, 2 Jul 2026 18:40:12 +0000 (19:40 +0100)]
target/arm: Define fields for NSACR
Currently we handle cp15.nsacr with raw bit numbers in the few places
we need to work with it. We're about to add some more uses of this
field, so define its fields with the FIELD macro and use the macros
in the places that were previously using bit numbers.
Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20260702184019.3431139-5-peter.maydell@linaro.org
Peter Maydell [Thu, 2 Jul 2026 18:40:11 +0000 (19:40 +0100)]
target/arm: Report correct syndrome to AArch32 EL2 for trapped Neon/VFP insns
When an AArch32 Neon or VFP insn is trapped to AArch64 EL2, bits
[19:0] of the syndrome in ESR_EL2 are RES0. However, when it is
trapped to AArch32 EL2, the HSR syndrome information defines some
extra fields:
[5] : TA
[3:0] : coproc
where the TA bit is 1 for a trapped Neon insn and 0 for a trapped
VFP insn, and the coproc field is 0b1010 when TA is 0, and 0 when
TA is 1.
We attempted to address this in commit fa33eead ("target/arm: Add
coproc parameter to syn_fp_access_trap"), but got it wrong: we
thought the RES0 condition was "is v8A" rather than "is EL2 AArch32",
and we made all insns be TA=0 coproc = 0b1010 rather than only the
VFP ones. Correct the condition we use to decide the coproc and TA
fields. We set these fields unconditionally; later on in
arm_cpu_do_interrupt_aarch64() we will squash them to zero if we are
taking the exception to AArch64.
NB: there is some disagreement between different revisions of the
Arm ARM about the exact handling of 'coproc':
* the v8A Arm ARM text says coproc is 0b1010 when TA is 1
* the v8A Arm ARM pseudocode in AArch32_CheckFPAdvSIMDTrap()
sets coproc to 0b1010 when TA is 0
* the v7A Arm ARM text says coproc is 0b1010 when TA is 0
* the v7A Arm ARM pseudocode sets coproc to 0b1010 when TA is 0
The v7A Arm ARM pseudocode also disagrees with the v7A text, v8A text
and v8A pseudocode in only setting TA to 1 for traps caused by
HCPTR.TASE; the others set Ta for all trapped AdvSIMD insns
(i.e. including traps caused by HCPTR.TCP10).
We assume that the v8A pseudocode is incorrect about coproc (as it is
the odd one out) and that the v7A pseudocode is incorrect about when
TA is set (again, as it is the odd one out).
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/1153 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20260702184019.3431139-4-peter.maydell@linaro.org
Peter Maydell [Thu, 2 Jul 2026 18:40:10 +0000 (19:40 +0100)]
target/arm: Separate syndrome functions for A32 and A64
Currently we have one syn_fp_access_trap() which we use for fp
traps from A64 and from VFP and Neon A32. This means that A64
has to specify arguments that are always fixed for it (coproc
and is_16bit) and A32 can't specify arguments it needs to (TA).
Split it up into syn_a64_fp_access_trap() and
syn_a32_fp_access_trap(). This is a refactor with no
behavioural change.
Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20260702184019.3431139-3-peter.maydell@linaro.org
Peter Maydell [Thu, 2 Jul 2026 18:40:09 +0000 (19:40 +0100)]
target/arm: Separate out Neon from VFP access checks
Currently we use vfp_access_check() for AArch32 VFP and Neon
instructions. This is not quite right:
* there are optional CPACR.ASEDIS and HCPTR.TASE controls that allow
trapping of just the Neon and not VFP instructions
* Neon instructions are supposed to report a slightly different
syndrome in HCR when they trap to AArch32 EL2
As a preliminary refactor so we have somewhere we can make this
distinction, separate out Neon access checks into a separate
neon_access_check(), which initially just calls vfp_access_check().
The set of insns this needs to cover are those described in section
E1.3.9 of the DDI0487M.b Arm ARM. For us this corresponds to
everything in neon-dp.decode and neon-ls.decode and thus in
translate-neon.c, plus three insns that we handle in translate-vfp.c:
- VDUP (general-purpose register)
- VMOV (general-purpose register to scalar) byte and halfword
- VMOV (scalar to general-purpose register) byte and halfword
(which are the ones in that file with ARM_FEATURE_NEON checks).
Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20260702184019.3431139-2-peter.maydell@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20260702204314.79224-16-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20260702204314.79224-15-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20260702204314.79224-14-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20260702204314.79224-13-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20260702204314.79224-12-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20260702204314.79224-11-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20260702204314.79224-10-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
target/arm: Implement FMOP4A (widening, 2-way, FP8 to FP16)
Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20260702204314.79224-9-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
target/arm: Implement FMOP4 (widening, 4-way fp8 to fp32)
Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20260702204314.79224-8-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
target/arm: Implement FMOP4 (widening, 2-way fp16 to fp32)
Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20260702204314.79224-7-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20260702204314.79224-6-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20260702204314.79224-5-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
target/arm: Implement FMOP4 (non-widening) for float64
Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20260702204314.79224-4-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
target/arm: Implement FMOP4 (non-widening) for float16
Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20260702204314.79224-3-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
target/arm: Implement FMOP4 (non-widening) for float32
Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20260702204314.79224-2-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Bin Meng [Sun, 28 Jun 2026 11:49:25 +0000 (19:49 +0800)]
docs/system/arm: Document Zynq Buildroot boot
The Zynq board documentation only showed a generic direct kernel
boot command.
Add Buildroot ZC702 commands for booting through U-Boot proper
with the generic loader and for direct Linux boot from the
generated SD image.
Signed-off-by: Bin Meng <bin.meng@processmission.com> Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20260628114925.418293-1-bin.meng@processmission.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Jason Wright [Mon, 29 Jun 2026 20:52:20 +0000 (20:52 +0000)]
target/arm/hvf: seed NO_RAW ID registers from isar.idregs[] on vCPU init
Commit 887eaa8a29 ("target/arm: implement FEAT_RNG_TRAP for RNDR/RNDRRS")
gave ID_AA64ISAR0_EL1 a readfn so the RNDR field can reflect SCR_EL3.TRNDR
at read time, and marked the cpreg ARM_CP_NO_RAW in the system-emulation
path. HVF then trips its hvf_arch_init_vcpu() assertion that no ID
register in hvf_sreg_list[] is NO_RAW, aborting on boot on Apple Silicon:
Assertion failed: (!(ri->type & ARM_CP_NO_RAW)),
function hvf_arch_init_vcpu, file hvf.c, line 1441.
Fix it the same way ID_AA64PFR0_EL1 already is: list
HV_SYS_REG_ID_AA64ISAR0_EL1 in the SYNC_NO_RAW_REGS block in sysreg.c.inc
so the assert loop skips it, and seed the vCPU's copy at init time.
While here, unify how the three isar.idregs[]-backed ID registers are
seeded. isar.idregs[] already holds QEMU's intended value for each (the
host caps, probed once at realize via hv_vcpu_config_get_feature_reg(),
plus any QEMU adjustment), so there is no need to read each register back
from the vCPU first. Seed PFR0, ISAR0 and MMFR0 directly from
isar.idregs[], dropping the two per-vCPU hv_vcpu_get_sys_reg() reads:
- PFR0: take the GIC sysreg-interface bit from env->gicv3state, as the
id_aa64pfr0_read() readfn does. Identical to the previous code
whenever a GICv3 sysreg interface is present (the configuration HVF
runs in practice); it differs only in that a vCPU with no GICv3 now
reports ID_AA64PFR0_EL1.GIC == 0 instead of inheriting the host's
value, which matches the field's meaning.
- ISAR0: no overlay is needed; HVF does not expose EL3, so
SCR_EL3.TRNDR is never set and the readfn is constant.
- MMFR0: still clamp PARANGE to the chosen IPA size, updating
isar.idregs[] in place because the page-table walker and the
ID_AA64MMFR0_EL1 cpreg resetvalue read PARANGE back from there.
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3533 Reported-by: Zenghui Yu <zenghui.yu@linux.dev> Suggested-by: Peter Maydell <peter.maydell@linaro.org> Fixes: 887eaa8a29 ("target/arm: implement FEAT_RNG_TRAP for RNDR/RNDRRS") Signed-off-by: Jason Wright <wrigjl@proton.me> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Tested-by: Zenghui Yu <zenghui.yu@linux.dev> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Peter Maydell [Fri, 3 Jul 2026 09:52:07 +0000 (10:52 +0100)]
hw/misc/imx31_ccm: Replace DPRINTF with trace events
Signed-off-by: jack wang <163wangjack@gmail.com>
[PMM: Remove stray loss of a brace; use trace.h] Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
jack wang [Thu, 25 Jun 2026 16:01:43 +0000 (00:01 +0800)]
hw/misc/imx25_ccm: Replace DPRINTF with trace events
Signed-off-by: jack wang <163wangjack@gmail.com>
[PMM: Removed incorrect change to a function prototype;
use just "trace.h" for include] Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
jack wang [Thu, 25 Jun 2026 16:01:42 +0000 (00:01 +0800)]
hw/misc/imx_ccm: Replace DPRINTF with trace events
Signed-off-by: jack wang <163wangjack@gmail.com>
[PMM: trace include is just "trace.h"] Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Peter Maydell [Fri, 29 May 2026 17:46:39 +0000 (18:46 +0100)]
hw/nvram/fw_cfg: Document fw_cfg_init_mem_nodma()
The last few commits have added doc comments for all the fw_cfg_init*
functions except for fw_cfg_init_mem_nodma(). Fill in the gap by
adding a doc comment for it.
Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@mailo.com>
Message-id: 20260529174639.451353-6-peter.maydell@linaro.org Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Peter Maydell [Fri, 29 May 2026 17:46:38 +0000 (18:46 +0100)]
hw/nvram/fw_cfg: Remove support for I/O port fw_cfg without DMA
Currently fw_cfg_init_io_dma() allows the caller to pass a NULL
dma_as argument, which causes it to create a fw_cfg without
the DMA port or DMA support. None of the callers use this
capability: they all pass &address_space_memory.
We don't really want to leave the door open for some future x86
machine type which doesn't support DMA for the fw_cfg device, so
remove this, and instead make the function assert that it has a
non-NULL dma_as argument, like fw_cfg_init_mem_dma().
Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@mailo.com>
Message-id: 20260529174639.451353-5-peter.maydell@linaro.org Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Peter Maydell [Fri, 29 May 2026 17:46:37 +0000 (18:46 +0100)]
hw/nvram/fw_cfg: Enforce standard layout for x86 fw_cfg I/O ports
The fw_cfg_init_io_dma() function allows the caller to specify the
base port number of the selector/data register and the base port
number of the DMA address register separately. No caller actually
uses this: they all pass in base + 4 for the dma_iobase.
To reduce the risk of unnecessary variation in what different x86
machine types use as their fw_cfg register layout, remove the
dma_iobase argument from fw_cfg_init_io_dma(), and have the function
always use the same "DMA port is base port + 4" layout.
Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@mailo.com>
Message-id: 20260529174639.451353-4-peter.maydell@linaro.org Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Peter Maydell [Fri, 29 May 2026 17:46:36 +0000 (18:46 +0100)]
hw/nvram/fw_cfg: Enforce standard layout for fw_cfg_init_mem_dma()
Currently fw_cfg_init_mem_dma() allows the caller to customize the
register layout, by specifying separately the offsets for control,
data and DMA registers, plus the width of the data register.
In practice, all the boards using this function specify the same
standard layout: "base + 8, base, 8, base + 16", meaning that the
data register is 8 bytes and the registers are data at offset 0,
control/selector at offset 8, and DMA at offset 16.
Allowing every board to be different is gratuitous and useless
variation which leads to code in guest OSes having architecture
ifdeffery to cope with it. Avoid potentially introducing any more of
this by removing all the arguments from fw_cfg_init_mem_dma(), so
that the callers only specify the base address.
Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Message-id: 20260529174639.451353-3-peter.maydell@linaro.org Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Peter Maydell [Fri, 29 May 2026 17:46:35 +0000 (18:46 +0100)]
docs/specs/fw_cfg: Document all architecture register layouts
We implement the fw_cfg device for more architectures and machines
that we let on about in our documentation. Luckily most of the new
ones (notably riscv and loongarch) have followed the straightforward
layout that the Arm virt board picked.
Restructure the documentation to present this as the "standard"
layout, followed by the other layouts used by various other boards
for historical reasons. This adds PA-RISC, SPARC, PPC and MIPS.
Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Message-id: 20260529174639.451353-2-peter.maydell@linaro.org Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Alex Bennée [Wed, 24 Jun 2026 10:30:49 +0000 (11:30 +0100)]
target/arm: implement WFET
Now we have the event stream and SEV/SEVL implemented we can finally
enable WFET for Aarch64.
To avoid issues with QEMU's incomplete ldst exclusive handling causing
potential deadlocks in common WFE enabled locking patterns we take
advantage of the architectures flexibility and treat being in the
exclusive region as a reason to exit.
Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20260624103049.884930-8-alex.bennee@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Alex Bennée [Wed, 24 Jun 2026 10:30:48 +0000 (11:30 +0100)]
target/arm: enable WFE sleeping for A-profile
To enable full architectural behaviour for A-profile we need to do a
number of things:
- add support for the event stream to wake things up
- add support for potential trap on sleep
- handle the global monitor's interactions with WFE
- remove the M-profile specific gates
Event stream
------------
Two generic timers (K and H) are capable of generating timer event
stream events. Provide a helper to calculate when the nearest one will
happen.
Now we can calculate when the next event stream event is we can re-use
the wfxt_timer and configure it to fire as we enter a WFE that is
going to sleep. Reverse the M-profile logic so we can enter a sleep
state in both profiles.
We also take care to use atomics for accessing env->event_register as
we now have potential access outside the vCPU context.
Traps
-----
A-profile can trap WFE's *if* the instruction would otherwise sleep.
To do this we need to pass the instruction size so we can deal with
the is_16bit syndrome encoding.
Global Monitor
--------------
To avoid issues with QEMU's incomplete ldst exclusive handling causing
potential deadlocks in common WFE enabled locking patterns we take
advantage of the architectures flexibility and treat being in the
exclusive region as a reason to exit.
Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20260624103049.884930-7-alex.bennee@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Alex Bennée [Wed, 24 Jun 2026 10:30:47 +0000 (11:30 +0100)]
target/arm: implements SEV/SEVL for all modes
Remove the restrictions that make this a M-profile only operation and
enable the instructions for all Arm profiles.
Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20260624103049.884930-6-alex.bennee@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Alex Bennée [Wed, 24 Jun 2026 10:30:46 +0000 (11:30 +0100)]
target/arm: ensure we create the wxft_timer for all modes
We don't want to just use it for timeouts as we will calculate which
will comes first. Remove the wxft feature test in favour of the
broader architecture checks.
Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20260624103049.884930-5-alex.bennee@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Alex Bennée [Wed, 24 Jun 2026 10:30:45 +0000 (11:30 +0100)]
target/arm: do not clear halting reason in has_work helper
The helper will be called multiple times as we exit a loop and until
we actually restart (via arm_cpu_exec_halt) we should leave the
condition the same.
Fixes: 6fd2fcdc61b (target/arm: teach arm_cpu_has_work about halting reasons) Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20260624103049.884930-4-alex.bennee@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Cédric Le Goater <clg@redhat.com> Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20260624103049.884930-3-alex.bennee@linaro.org Suggested-by: Cédric Le Goater <clg@redhat.com> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Alex Bennée [Wed, 24 Jun 2026 10:30:43 +0000 (11:30 +0100)]
hw/arm: use cortex-a9 mpcore base for CBAR on npcm7xx machines
CBAR is an IMPDEF register and according to the A9 TRM [1]:
In Cortex-A9 MPCore implementations, the base address is reset to
PERIPHBASE[31:13] so that software can determine the location of the
private memory region [2].
If it doesn't we will confuse the Linux kernel as it probes the system
SCU registers [3] and erroneously assumes the system is a buggy Aegis SOC
and nerf the emission of SEV instructions, deadlocking any WFE's in
the kernel (or QEMU smpboot code).
target/arm: Implement and enable FEAT_SSVE_FEXPA for -cpu max
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20260626164819.770787-1-richard.henderson@linaro.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Jim MacArthur [Tue, 30 Jun 2026 13:16:37 +0000 (14:16 +0100)]
tests/tcg/arm: Tests for new FPRCVT instructions
We autodetect the presence of FPRCVT in the test cross compiler,
which is a recent feature in GCC and not supported by many distros
yet. If this is in place, we compile the existing fcvt.c test with
an extra compiler flag which uses the new SIMD instructions; the
output from the test is unchanged.
The existing [US]CVTF instructions do not have a test, so no new
tests are added for the SIMD versions. They have been tested manually
to check the new SIMD versions produce the same numerical results as
the existing versions.
Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Signed-off-by: Jim MacArthur <jim.macarthur@linaro.org>
Message-id: 20260630-jmac-fprcvt-v3-6-f4840d5e0a7f@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Jim MacArthur [Tue, 30 Jun 2026 13:16:36 +0000 (14:16 +0100)]
docs/system/arm: Add FEAT_FPRCVT to A-profile support
Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Jim MacArthur <jim.macarthur@linaro.org>
Message-id: 20260630-jmac-fprcvt-v3-5-f4840d5e0a7f@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Jim MacArthur [Tue, 30 Jun 2026 13:16:35 +0000 (14:16 +0100)]
linux-user/aarch64/elfload.c: Add FPRCVT
Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Jim MacArthur <jim.macarthur@linaro.org>
Message-id: 20260630-jmac-fprcvt-v3-4-f4840d5e0a7f@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Jim MacArthur [Tue, 30 Jun 2026 13:16:34 +0000 (14:16 +0100)]
target/arm/tcg/cpu64.c: Add FEAT_FPRCVT to cpu_max
Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Signed-off-by: Jim MacArthur <jim.macarthur@linaro.org>
Message-id: 20260630-jmac-fprcvt-v3-3-f4840d5e0a7f@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Jim MacArthur [Tue, 30 Jun 2026 13:16:33 +0000 (14:16 +0100)]
target/arm/tcg: Allow vector FP conversions with FPRCVT
FEAT_FPRCVT allows the vector forms of FCVTXX and [US]CVTF in streaming
mode which would otherwise only be available in nonstreaming mode.
Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Jim MacArthur <jim.macarthur@linaro.org>
Message-id: 20260630-jmac-fprcvt-v3-2-f4840d5e0a7f@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Jim MacArthur [Tue, 30 Jun 2026 13:16:32 +0000 (14:16 +0100)]
target/arm/tcg: Implement new instructions for FPRCVT
Adds the opcode format for the SIMD versions of FCVTXX and [US]CVTF.
These use very similar logic to the FP-to-general and general-to-FP
register versions which exist, but use another SIMD/FP register
as source or destination. The source and destination size rules are
slightly different.
Signed-off-by: Jim MacArthur <jim.macarthur@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20260630-jmac-fprcvt-v3-1-f4840d5e0a7f@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Oliver Upton [Fri, 26 Jun 2026 23:17:38 +0000 (16:17 -0700)]
target/arm: Only evaluate SCR_EL3.PIEN if ARM_FEATURE_EL3 is present
Running KVM with (as of writing, out-of-tree) support for FEAT_S2PIE
on -cpu max gets stuck in an infinite loop of stage-2 permission faults
due to the PTW incorrectly using an effective value of 0 for S2PIR_EL2.
Similar to how S1PIE is handled, only use the IMPLEMENTATION SPECIFIC
value of 0 for S2PIR_EL2 if EL3 is implemented and PIEN=0.
Cc: qemu-stable@nongnu.org Fixes: a811c5dafb ("target/arm: Implement get_S2prot_indirect") Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Oliver Upton <oupton@kernel.org>
Message-id: 20260626231738.947317-1-oupton@kernel.org
[PMM: removed hardcoded tab] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
projects / thirdparty / qemu.git / log
