aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2025-07-11target/s390x: Have s390_cpu_halt() not return anythingPhilippe Mathieu-Daudé3-5/+5
Since halting a vCPU and how many left running do not need to be tied together, split the s390_count_running_cpus() call out of s390_cpu_halt() to the single caller using it: s390_handle_wait(). Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20250708095746.12697-4-philmd@linaro.org> Signed-off-by: Thomas Huth <thuth@redhat.com>
2025-07-11target/s390x: Expose s390_count_running_cpus() methodPhilippe Mathieu-Daudé2-1/+2
In order to simplify the next commit where s390_count_running_cpus() is split out of s390_cpu_halt(), make its prototype public as a preliminary step. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20250708095746.12697-3-philmd@linaro.org> Signed-off-by: Thomas Huth <thuth@redhat.com>
2025-07-11target/s390x: Remove unused s390_cpu_[un]halt() user stubsPhilippe Mathieu-Daudé1-10/+0
Since commit da944885469 ("target/s390x: make helper.c sysemu-only") target/s390x/helper.c is only built for system mode, so s390_cpu_halt() and s390_cpu_unhalt() are never called from user mode. Fixes: da944885469 ("target/s390x: make helper.c sysemu-only") Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20250708095746.12697-2-philmd@linaro.org> Signed-off-by: Thomas Huth <thuth@redhat.com>
2025-07-11tests/functional/test_ppc_bamboo: Replace broken link with working assetsThomas Huth1-15/+19
The old image that we used for testing the bamboo machine has disappeared from the internet. Fortunately there is another kernel + initrd provided by Cédric that can be used for testing this machine, too. Reported-by: Stefan Hajnoczi <stefanha@gmail.com> Suggested-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: Cédric Le Goater <clg@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com> Message-ID: <20250707184736.88660-1-thuth@redhat.com>
2025-07-11tests/functional: Add dependency to the keymap_targetsThomas Huth1-1/+1
When doing a "configure" in a an empty build directory, followed by a "make check" without a normal build in between, the vnc functional test currently fails since the keymaps have not been built yet. Thus add a dependency to the keymap_targets here to make sure that the keymaps are built before running the functional tests. Signed-off-by: Thomas Huth <thuth@redhat.com> Message-ID: <20250701104827.363904-1-thuth@redhat.com>
2025-07-11pc-bios: Update the s390 bios images with the pxelinux.cfg loadparm changesThomas Huth1-0/+0
This new s390-ccw.img binary contains the addition of the loadparm feature to the pxelinux.cfg network booting code. Signed-off-by: Thomas Huth <thuth@redhat.com>
2025-07-11pc-bios/s390-ccw: link staticallySertonix1-1/+1
Adding -pie to LDFLAGS caused s390-ccw.img to become dynamically linked. By using -static-pie it will be linked statically like other bios. This ensures that the build output doesn't change depending on the default dynamic loader path of the toolchain. Fixes: d884c86dcd3b ("s390/bios: Make the s390-ccw.img relocatable") Signed-off-by: Sertonix <sertonix@posteo.net> Message-ID: <DAJ1QOSAP9LS.342SQSM0UZU80@posteo.net> Signed-off-by: Thomas Huth <thuth@redhat.com>
2025-07-11tests/functional: Add a test for s390x pxelinux.cfg network bootingThomas Huth3-0/+121
Check the various ways of booting a kernel via pxelinux.cfg file, e.g. by specifying the config file name via the MAC address or the UUID of the guest. Also check whether we can successfully load an alternate kernel via the "loadparm" parameter here and whether the boot menu shows up with "-boot menu=on". Reviewed-by: Jared Rossi <jrossi@linux.ibm.com> Signed-off-by: Thomas Huth <thuth@redhat.com> Message-ID: <20250709083443.41574-6-thuth@redhat.com>
2025-07-11pc-bios/s390-ccw: Add a boot menu for booting via pxelinux.cfgThomas Huth1-0/+26
Show a simple boot menu for pxelinux.cfg, too, if the user requested it. Reviewed-by: Jared Rossi <jrossi@linux.ibm.com> Signed-off-by: Thomas Huth <thuth@redhat.com> Message-ID: <20250709083443.41574-5-thuth@redhat.com>
2025-07-11pc-bios/s390-ccw: Make get_boot_index() from menu.c globalThomas Huth2-3/+4
We are going to reuse this function for selecting an entry from the pxelinux.cfg menu, so rename this function with a "menu_" prefix and make it available globally. Reviewed-by: Jared Rossi <jrossi@linux.ibm.com> Signed-off-by: Thomas Huth <thuth@redhat.com> Message-ID: <20250709083443.41574-4-thuth@redhat.com>
2025-07-11pc-bios/s390-ccw: Allow up to 31 entries for pxelinux.cfgThomas Huth1-6/+4
We're going to support a menu for the pxelinux.cfg code, and to be able to reuse some functionality from menu.c, we should align the maximum amount of possible entries with the MAX_BOOT_ENTRIES constant that is used there. Thus replace MAX_PXELINUX_ENTRIES with MAX_BOOT_ENTRIES. Reviewed-by: Jared Rossi <jrossi@linux.ibm.com> Signed-off-by: Thomas Huth <thuth@redhat.com> Message-ID: <20250709083443.41574-3-thuth@redhat.com>
2025-07-11pc-bios/s390-ccw: Allow to select a different pxelinux.cfg entry via loadparmThomas Huth1-8/+24
Since we're linking the network booting code into the main firmware binary nowadays, we can support the "loadparm" parameter now quite easily for pxelinux.cfg config files that contain multiple entries. Reviewed-by: Jared Rossi <jrossi@linux.ibm.com> Signed-off-by: Thomas Huth <thuth@redhat.com> Message-ID: <20250709083443.41574-2-thuth@redhat.com>
2025-07-11hw/s390x/s390-pci-bus.c: Use g_assert_not_reached() in functions taking an ettPeter Maydell1-12/+14
The s390-pci-bus.c code, Coverity complains about a possible overflow because get_table_index() can return -1 if the ett value passed in is not one of the three permitted ZPCI_ETT_PT, ZPCI_ETT_ST, ZPCI_ETT_RT, but the caller in table_translate() doesn't check this and instead uses the return value directly in a calculation of the guest address to read from. In fact this case cannot happen, because: * get_table_index() is called only from table_translate() * the only caller of table_translate() loops through the ett values in the order RT, ST, PT until table_translate() returns 0 * table_translate() will return 0 for the error cases and when translate_iscomplete() returns true * translate_iscomplete() is always true for ZPCI_ETT_PT So table_translate() is always called with a valid ett value. Instead of having the various functions called from table_translate() return a default or dummy value when the ett argument is out of range, use g_assert_not_reached() to indicate that this is impossible. Coverity: CID 1547609 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com> Reviewed-by: Halil Pasic <pasic@linux.ibm.com> Message-ID: <20250710161552.1287399-1-peter.maydell@linaro.org> Signed-off-by: Thomas Huth <thuth@redhat.com>
2025-07-11target/s390x/tcg: Use vaddr in s390_probe_access()Philippe Mathieu-Daudé1-5/+5
Commit 70ebd9ce1cb ("s390x/tcg: Fault-safe memset") passed vaddr type to access_prepare(), and commit b6c636f2cd6 ("s390x/tcg: Fault-safe memmove") to do_access_get_byte(), but declared S390Access::vaddr[1,2] as target_ulong. Directly declare these as vaddr type, and have s390_probe_access() use that type as argument. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-ID: <20250707171059.3064-3-philmd@linaro.org> Signed-off-by: Thomas Huth <thuth@redhat.com>
2025-07-11target/s390x/kvm: Use vaddr in find/insert_hw_breakpoint()Philippe Mathieu-Daudé1-2/+2
Since commit b8a6eb1862a both kvm_arch_insert_hw_breakpoint() and kvm_arch_remove_hw_breakpoint() use a vaddr type. Use the same type for the callees. Fixes: b8a6eb1862a ("sysemu/kvm: Use vaddr for kvm_arch_[insert|remove]_hw_breakpoint") Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-ID: <20250707171059.3064-2-philmd@linaro.org> Signed-off-by: Thomas Huth <thuth@redhat.com>
2025-07-11target/i386: move max_features to classPaolo Bonzini4-7/+10
max_features is always set to true for instances created by -cpu max or -cpu host; it's always false for other classes. Therefore it can be turned into a field in the X86CPUClass. Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com> Reviewed-by: Zhao Liu <zhao1.liu@intel.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2025-07-11target/loongarch: Remove unnecessary page size validity checkingBibo Mao1-17/+10
Page size of TLB entry comes from CSR STLBPS and pwcl register. With huge page, it is dir_base + dir_width from pwcl register. With normal page, it is field of PTBASE from pwcl register. So it is ok to check validity in function helper_ldpte() and function helper_csrwr_stlbps(). And it is unnecessary in tlb entry fill path. Signed-off-by: Bibo Mao <maobibo@loongson.cn> Reviewed-by: Song Gao <gaosong@loongson.cn>
2025-07-11target/loongarch: Fix CSR STLBPS register write emulationBibo Mao1-0/+4
Function helper_csrwr_stlbps() is emulation with CSR STLBPS register write operation. However there is only parameter checking action, and no register updating action. Here update value of CSR_STLBPS when parameter passes to check. Signed-off-by: Bibo Mao <maobibo@loongson.cn> Reviewed-by: Song Gao <gaosong@loongson.cn>
2025-07-11target/loongarch: Correct spelling in helper_csrwr_pwcl()Bibo Mao1-2/+2
There is small typo issue in function helper_csrwr_pwcl(), this patch corrects this issue. Signed-off-by: Bibo Mao <maobibo@loongson.cn> Reviewed-by: Song Gao <gaosong@loongson.cn>
2025-07-11hw/intc/loongarch_extioi: Move unrealize function to common codeBibo Mao4-10/+10
Memory about LoongArchExtIOICommonState::cpu is allocated in common code, it had better be freed in common code also. Signed-off-by: Bibo Mao <maobibo@loongson.cn> Reviewed-by: Song Gao <gaosong@loongson.cn>
2025-07-10linux-user: Hold the fd-trans lock across forkGeoffrey Thomas2-0/+12
If another thread is holding target_fd_trans_lock during a fork, then the lock becomes permanently locked in the child and the emulator deadlocks at the next interaction with the fd-trans table. As with other locks, acquire the lock in fork_start() and release it in fork_end(). Cc: qemu-stable@nongnu.org Signed-off-by: Geoffrey Thomas <geofft@ldpreload.com> Fixes: c093364f4d91 "fd-trans: Fix race condition on reallocation of the translation table." Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2846 Buglink: https://github.com/astral-sh/uv/issues/6105 Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-ID: <20250314124742.4965-1-geofft@ldpreload.com>
2025-07-10linux-user/mips/o32: Drop sa_restorer functionalityThomas Weißschuh2-5/+0
The Linux kernel dropped support for sa_restorer on O32 MIPS in the release 2.5.48 because it was unused. See the comment in arch/mips/include/uapi/asm/signal.h. Applications using the kernels UAPI headers will not reserve enough space for qemu-user to copy the sigaction.sa_restorer field to. Unrelated data may be overwritten. Align qemu-user with the kernel by also dropping sa_restorer support. Signed-off-by: Thomas Weißschuh <thomas@t-8ch.de> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-ID: <20250709-mips-sa-restorer-v1-1-fc17120e4afe@t-8ch.de>
2025-07-10linux-user/gen-vdso: Don't read off the end of buf[]Peter Maydell1-0/+5
In gen-vdso we load in a file and assume it's a valid ELF file. In particular we assume it's big enough to be able to read the ELF information in e_ident in the ELF header. Add a check that the total file length is at least big enough for all the e_ident bytes, which is good enough for the code in gen-vdso.c. This will catch the most obvious possible bad input file (truncated) and allow us to run the sanity checks like "not actually an ELF file" without potentially crashing. The code in elf32_process() and elf64_process() still makes assumptions about the file being well-formed, but this is OK because we only run it on the vdso binaries that we create ourselves in the build process by running the compiler. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-ID: <20250710170707.1299926-3-peter.maydell@linaro.org>
2025-07-10linux-user/gen-vdso: Handle fseek() failurePeter Maydell1-2/+9
Coverity points out that we don't check for fseek() failure in gen-vdso.c, and so we might pass -1 to malloc(). Add the error checking. (This is a standalone executable that doesn't link against glib, so we can't do the easy thing and use g_file_get_contents().) Coverity: CID 1523742 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-ID: <20250710170707.1299926-2-peter.maydell@linaro.org>
2025-07-10linux-user: Check for EFAULT failure in nanosleepPeter Maydell1-2/+6
target_to_host_timespec() returns an error if the memory the guest passed us isn't actually readable. We check for this everywhere except the callsite in the TARGET_NR_nanosleep case, so this mistake was caught by a Coverity heuristic. Add the missing error checks to the calls that convert between the host and target timespec structs. Coverity: CID 1507104 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-ID: <20250710164355.1296648-1-peter.maydell@linaro.org>
2025-07-10linux-user: Implement fchmodat2 syscallPeter Maydell1-0/+13
The fchmodat2 syscall is new from Linux 6.6; it is like the existing fchmodat syscall except that it takes a flags parameter. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3019 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-ID: <20250710113123.1109461-1-peter.maydell@linaro.org>
2025-07-10fpu: Process float_muladd_negate_result after roundingRichard Henderson4-14/+82
Changing the sign before rounding affects the correctness of the asymmetric rouding modes: float_round_up and float_round_down. Reported-by: WANG Rui <wangrui@loongson.cn> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2025-07-10rust/qemu-api: log: implement io::WritePaolo Bonzini3-8/+98
This makes it possible to lock the log file; it also makes log_mask_ln! not allocate memory when logging a constant string. Reviewed-by: Zhao Liu <zhao1.liu@intel.com> Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2025-07-10rust/qemu-api-macros: add unit testsManos Pitsidianakis3-0/+143
Add unit tests to check Derive macro output for expected error messages, or for expected correct codegen output. Signed-off-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org> Reviewed-by: Zhao Liu <zhao1.liu@intel.com> Link: https://lore.kernel.org/r/20250704-rust_add_derive_macro_unit_tests-v1-2-ebd47fa7f78f@linaro.org [Remove usage of MacroError. - Paolo] Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2025-07-10rust/qemu-api-macros: normalize TryInto outputManos Pitsidianakis1-2/+2
Remove extraneous `;` and add missing trailing comma to TryInto derive macro to match rustfmt style. We will add a test in the followup commit and we would like the inlined output in the test body to be properly formatted as well. No functional changes intended. Signed-off-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org> Reviewed-by: Zhao Liu <zhao1.liu@intel.com> Link: https://lore.kernel.org/r/20250704-rust_add_derive_macro_unit_tests-v1-1-ebd47fa7f78f@linaro.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2025-07-10rust/bindings: allow unnecessary_transmutes (1.88)Manos Pitsidianakis1-0/+1
This is a new lint introduced in Rust 1.88. It does not affect compilation when using a previous version or our MSRV, 1.77. But with 1.88 compilation fails because we deny all warnings: error: unnecessary transmute --> rust/qemu-api/libqemu_api.rlib.p/structured/bindings.inc.rs:729:18 | 729 | unsafe { ::std::mem::transmute(self._bitfield_1.get(0usize, 24u8) as u32) } | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ help: replace this with: `u32::cast_signed(self._bitfield_1.get(0usize, 24u8) as u32)` | = note: `-D unnecessary-transmutes` implied by `-D warnings` = help: to override `-D warnings` add `#[allow(unnecessary_transmutes)]` Allow this lint, which even though it does not exist in previous versions, it works because we allow for `unknown_lints` in rust/Cargo.toml. Signed-off-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org> Link: https://lore.kernel.org/r/20250703-rust_bindings_allow_unnecessary_transmutes-v1-1-692ca210d331@linaro.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2025-07-10rust/qemu-api-macros: use syn::Error directlyManos Pitsidianakis4-111/+70
Our MacroError type wraps syn::Error as a variant, and uses another variant for custom errors. Fortunately syn::Error can be used directly, avoiding extra code on our side, so change the proc macro crate to use it. Signed-off-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org> Link: https://lore.kernel.org/r/20250703-rust_macros-v1-1-b99f82febbbf@linaro.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2025-07-10rust/qemu-api: Fix binding path in source directoryZhao Liu1-5/+7
The build.rs had supported placing bindings.inc.rs in rust/qemu-api/src, but this "not encouraged" feature is broken. Considering that manually copying bindings.inc.rs to the development directory is also useful, fix the bindings.inc.rs path generation to give this feature another chance. Fixes: commit 1ae4ca0463d7 ("rust: move rust.bindgen to qemu-api crate") Signed-off-by: Zhao Liu <zhao1.liu@intel.com> Link: https://lore.kernel.org/r/20250623073436.1833357-1-zhao1.liu@intel.com Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2025-07-10hw/arm/virt-acpi-build: Don't create ITS id mappings by defaultShameer Kolothum1-6/+0
Commit d6afe18b7242 ("hw/arm/virt-acpi-build: Fix ACPI IORT and MADT tables when its=off") moved ITS group node generation under the its=on condition. However, it still creates rc_its_idmaps unconditionally, which results in duplicate ID mappings in the IORT table. Fixes:d6afe18b7242 ("hw/arm/virt-acpi-build: Fix ACPI IORT and MADT tables when its=off") Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com> Reviewed-by: Eric Auger <eric.auger@redhat.com> Reviewed-by: Donald Dutile <ddutile@redhat.com> Tested-by: Eric Auger <eric.auger@redhat.com> Signed-off-by: Shameer Kolothum <shameerali.kolothum.thodi@huawei.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2025-07-10system/qdev: Remove pointless NULL check in qdev_device_add_from_qdictPhilippe Mathieu-Daudé1-5/+4
Coverity reported a unnecessary NULL check: qemu/system/qdev-monitor.c: 720 in qdev_device_add_from_qdict() 683 /* create device */ 684 dev = qdev_new(driver); ... 719 err_del_dev: >>> CID 1590192: Null pointer dereferences (REVERSE_INULL) >>> Null-checking "dev" suggests that it may be null, but it has already been dereferenced on all paths leading to the check. 720 if (dev) { 721 object_unparent(OBJECT(dev)); 722 object_unref(OBJECT(dev)); 723 } 724 return NULL; 725 } Indeed, unlike qdev_try_new() which can return NULL, qdev_new() always returns a heap pointer (or aborts). Remove the unnecessary assignment and check. Fixes: f3a85056569 ("qdev/qbus: add hidden device support") Resolves: Coverity CID 1590192 (Null pointer dereferences) Suggested-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2025-07-10hw/arm/virt: Allow virt extensions with KVMPeter Maydell1-1/+18
Up to now virt support on guest has been only supported with TCG. Now it becomes feasible to use it with KVM acceleration. Check neither in-kernel GICv3 nor aarch64=off is used along with KVM EL2. Signed-off-by: Haibo Xu <haibo.xu@linaro.org> Signed-off-by: Miguel Luis <miguel.luis@oracle.com> Signed-off-by: Eric Auger <eric.auger@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20250707164129.1167837-6-eric.auger@redhat.com [PMM: make "kernel doesn't have EL2 support" error message distinct from the old "QEMU doesn't have KVM EL2 support" one] Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2025-07-10hw/arm/arm_gicv3_kvm: Add a migration blocker with kvm nested virtEric Auger1-0/+8
We may be miss some NV related GIC register save/restore. Until we complete the study, let's add a migration blocker when the maintenance IRQ is set. Signed-off-by: Eric Auger <eric.auger@redhat.com> Message-id: 20250707164129.1167837-5-eric.auger@redhat.com Suggested-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2025-07-10target/arm: Enable feature ARM_FEATURE_EL2 if EL2 is supportedHaibo Xu1-0/+16
KVM_CAP_ARM_EL2 must be supported by the cpu to enable ARM_FEATURE_EL2. In case the host does support NV, expose the feature. Signed-off-by: Haibo Xu <haibo.xu@linaro.org> Signed-off-by: Miguel Luis <miguel.luis@oracle.com> Signed-off-by: Eric Auger <eric.auger@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20250707164129.1167837-4-eric.auger@redhat.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2025-07-10target/arm/kvm: Add helper to detect EL2 when using KVMHaibo Xu3-0/+17
Introduce query support for KVM_CAP_ARM_EL2. Signed-off-by: Haibo Xu <haibo.xu@linaro.org> Signed-off-by: Miguel Luis <miguel.luis@oracle.com> Signed-off-by: Eric Auger <eric.auger@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-id: 20250707164129.1167837-3-eric.auger@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2025-07-10hw/arm: Allow setting KVM vGIC maintenance IRQHaibo Xu4-0/+26
Allow virt arm machine to set the interrupt ID for the KVM GIC maintenance interrupt. This setting must be done before the KVM_DEV_ARM_VGIC_CTRL_INIT hence the choice to perform the setting in the GICv3 realize instead of proceeding the same way as kvm_arm_pmu_set_irq(). Signed-off-by: Haibo Xu <haibo.xu@linaro.org> Signed-off-by: Miguel Luis <miguel.luis@oracle.com> Signed-off-by: Eric Auger <eric.auger@redhat.com> Message-id: 20250707164129.1167837-2-eric.auger@redhat.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2025-07-10hw/arm/fsl-imx8mp: Wire VIRQ and VFIQBernhard Beschow1-0/+4
Allows to run KVM guests inside the imx8mp-evk machine. Fixes: a4eefc69b237 ("hw/arm: Add i.MX 8M Plus EVK board") CC: qemu-stable Signed-off-by: Bernhard Beschow <shentey@gmail.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2025-07-10target/arm: Don't enforce NSE,NS check for EL3->EL3 returnsPeter Maydell1-9/+11
In the Arm ARM, rule R_TYTWB that defines illegal exception return cases includes the case: If FEAT_RME is implemented, then if SCR_EL3.{NSE, NS} is {1, 0}, an exception return from EL3 to a lower Exception level Our implementation of this check fails to check that the return is to a lower exception level, so it will incorrectly fire on EL3->EL3 exception returns. Fix the check condition. This requires us to move it further down in the function to a point where we know the new_el value. Fixes: 35aa6715ddcd9 ("target/arm: Catch illegal-exception-return from EL3 with bad NSE/NS") Cc: qemu-stable@nongnu.org Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3016 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20250704165636.261888-1-peter.maydell@linaro.org
2025-07-10target/arm: Split out performance monitor regs to cpregs-pmu.cRichard Henderson5-1284/+1319
Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-id: 20250707151547.196393-4-richard.henderson@linaro.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2025-07-10target/arm: Split out AT insns to tcg/cpregs-at.cRichard Henderson4-512/+525
Split out all "system instructions for address translation". While mapped into "cpregs", these are instructions, and thus are handled in hardware by virtualization. They are all priviledged, and thus not reachable for user-only. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20250707151547.196393-3-richard.henderson@linaro.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2025-07-10target/arm: Drop stub for define_tlb_insn_regsRichard Henderson2-6/+3
Allow the call to be compiled out by protecting it with tcg_enabled. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-id: 20250707151547.196393-2-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2025-07-10arm/kvm: shorten one overly long lineCornelia Huck1-1/+2
Fixes: 804cfc7eedb7 ("arm/cpu: Store aa64isar0/aa64zfr0 into the idregs arrays") Signed-off-by: Cornelia Huck <cohuck@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Eric Auger <eric.auger@redhat.com> Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-id: 20250704141927.38963-6-cohuck@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2025-07-10arm/cpu: store clidr into the idregs arrayCornelia Huck8-25/+25
Signed-off-by: Cornelia Huck <cohuck@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Eric Auger <eric.auger@redhat.com> Message-id: 20250704141927.38963-5-cohuck@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2025-07-10arm/cpu: fix trailing ',' for SET_IDREGCornelia Huck1-7/+7
While a trailing comma is not broken for SET_IDREG invocations, it does look odd; use a semicolon instead. Fixes: f1fd81291c91 ("arm/cpu: Store aa64mmfr0-3 into the idregs array") Fixes: def3f1c1026a ("arm/cpu: Store aa64dfr0/1 into the idregs array") Signed-off-by: Cornelia Huck <cohuck@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Eric Auger <eric.auger@redhat.com> Message-id: 20250704141927.38963-4-cohuck@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2025-07-10arm/cpu: store id_aa64afr{0,1} into the idregs arrayCornelia Huck4-12/+12
Signed-off-by: Cornelia Huck <cohuck@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Eric Auger <eric.auger@redhat.com> Message-id: 20250704141927.38963-3-cohuck@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2025-07-10arm/cpu: store id_afr0 into the idregs arrayCornelia Huck8-30/+30
Signed-off-by: Cornelia Huck <cohuck@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Eric Auger <eric.auger@redhat.com> Message-id: 20250704141927.38963-2-cohuck@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>