4016 Commits

Author SHA1 Message Date
Stefan Hajnoczi
4eac8b40f2 Merge tag 'linux-user-for-v11.1-pull-request' of https://github.com/hdeller/qemu-hppa into staging
linux-user-for-v11.1 pull request

Please pull two fixes for linux-user for v11.1:
- Validate guest-passed dm_ioctl data_size
- Alpha: Fix programs using getauxval(AT_HWCAP) to detect BWX/FIX/CIX

# -----BEGIN PGP SIGNATURE-----
#
# iHUEABYKAB0WIQS86RI+GtKfB8BJu973ErUQojoPXwUCalT3fwAKCRD3ErUQojoP
# X7twAPsH/PcMbDMiwKluAOE+/r1rZ95Qp9YXuKfZhUypoizivwEAs5IdB5PKwI5s
# lGaJdOpkm7HWAEbjiYgr25d+dPBcagg=
# =zCLL
# -----END PGP SIGNATURE-----
# gpg: Signature made Mon 13 Jul 2026 15:34:39 BST
# gpg:                using EDDSA key BCE9123E1AD29F07C049BBDEF712B510A23A0F5F
# gpg: Good signature from "Helge Deller <deller@gmx.de>" [unknown]
# gpg:                 aka "Helge Deller <deller@kernel.org>" [unknown]
# gpg:                 aka "Helge Deller <deller@debian.org>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg:          There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 4544 8228 2CD9 10DB EF3D  25F8 3E5F 3D04 A7A2 4603
#      Subkey fingerprint: BCE9 123E 1AD2 9F07 C049  BBDE F712 B510 A23A 0F5F

* tag 'linux-user-for-v11.1-pull-request' of https://github.com/hdeller/qemu-hppa:
  linux-user/alpha: populate AT_HWCAP from env->amask
  linux-user: Validate guest-passed dm_ioctl data_size

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2026-07-14 07:25:06 +01:00
Matt Turner
7a2e863f9d linux-user/alpha: populate AT_HWCAP from env->amask
Alpha has never set AT_HWCAP in linux-user emulation, so getauxval(AT_HWCAP)
always returned 0 regardless of the emulated CPU model.

The Linux kernel computes ELF_HWCAP as ~amask(-1), i.e. the set of ISA
extension bits that the amask instruction reports as supported (cleared in
its output).  env->amask stores exactly those bits with the same layout
(BWX=0x1, FIX=0x2, CIX=0x4, MVI=0x100, TRAP=0x200, PREFETCH=0x1000), so
returning it directly from get_elf_hwcap matches the kernel convention.

Add HAVE_ELF_HWCAP to target_elf.h and implement get_elf_hwcap() in
elfload.c to expose the emulated CPU's capability mask to user-space
programs via the auxiliary vector.

Without this fix, programs using getauxval(AT_HWCAP) to detect BWX/FIX/CIX
(such as glibc's memcpy or JIT compilers targeting Alpha) incorrectly
concluded that no extensions were available even when emulating ev56+.

Signed-off-by: Matt Turner <mattst88@gmail.com>
Cc: qemu-stable@nongnu.org
Reviewed-by: Helge Deller <deller@gmx.de>
Signed-off-by: Helge Deller <deller@gmx.de>
2026-07-13 16:16:31 +02:00
Richard Henderson
de1a225711 common-user: Move guest_base, have_guest_base to probe-guest-base.c
Unify the definitions of guest_base and have_guest_base.

Reviewed-by: Helge Deller <deller@gmx.de>
Reviewed-by: Warner Losh <imp@bsdimp.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2026-07-10 14:40:42 -07:00
Richard Henderson
9affb4decd common-user: Move probe_guest_base from linux-user
Prepare to share probe_guest_base with bsd-user.

Create a linux_probe_guest_base wrapper with the portions
of probe_guest_base that are linux specific: managing the
commpage for various targets.

Reviewed-by: Warner Losh <imp@bsdimp.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2026-07-10 14:40:42 -07:00
Richard Henderson
544f4c5b68 common-user: Move selfmap from util
This interface is only used for user-only.  It's more usefully
placed within common-user than util.  Temporarily add stub
implementation for bsd-user.

Reviewed-by: Helge Deller <deller@gmx.de>
Reviewed-by: Warner Losh <imp@bsdimp.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2026-07-10 14:39:58 -07:00
Richard Henderson
c56da35d5d common-user: Move mmap_min_addr from linux-user
Introduce user/mmap-min-addr.h.  Initialize the variable
from a constructor instead of main.

Reviewed-by: Helge Deller <deller@gmx.de>
Reviewed-by: Warner Losh <imp@bsdimp.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2026-07-10 14:39:43 -07:00
Richard Henderson
6fe7a5bba7 linux-user: Use PGBRange for commpage
This simplifies check for no commpage to a NULL pointer
check, rather than reserved values for LO_COMMPAGE and
HI_COMMPAGE.

Unify {LO,HI}_COMMPAGE into a single COMMPAGE define.

Acked-by: Warner Losh <imp@bsdimp.com>
Tested-by: Helge Deller <deller@gmx.de>
Reviewed-by: Helge Deller <deller@gmx.de>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2026-07-10 14:38:10 -07:00
Richard Henderson
3452cbd09f linux-user: Pass image_range to probe_guest_base
Pass a PGBRange structure instead of separate guest_loaddr
and guest_hiaddr parameters.  This allows NULL to indicate
that the image is relocatable, so that image_range->lo == 0
is a valid fixed setting.

Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/1890
Tested-by: Helge Deller <deller@gmx.de>
Reviewed-by: Warner Losh <imp@bsdimp.com>
Reviewed-by: Helge Deller <deller@gmx.de>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2026-07-10 14:38:10 -07:00
Richard Henderson
66259fc5a2 linux-user: Drop hiaddr out-of-range check in probe_guest_base
Since dropping 32-bit host support, a guest address cannot
overflow a host pointer.  This means guest_hiaddr is unused
for relocatable images, so don't pass guest_hiaddr as size.

Reviewed-by: Warner Losh <imp@bsdimp.com>
Reviewed-by: Helge Deller <deller@gmx.de>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2026-07-10 14:38:10 -07:00
Richard Henderson
1e2ccb69b1 linux-user: Use PGBRange in load_elf_image
Collect into range instead of loaddr+hiaddr.

Reviewed-by: Warner Losh <imp@bsdimp.com>
Reviewed-by: Helge Deller <deller@gmx.de>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2026-07-10 14:38:10 -07:00
Richard Henderson
fb13afb1c6 linux-user: Introduce PGBRange
Create a structure to hold a beginning/end range for guest virtual
addresses, for use by probe_guest_base.  Use vaddr for clarity.

Reviewed-by: Warner Losh <imp@bsdimp.com>
Reviewed-by: Helge Deller <deller@gmx.de>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2026-07-10 14:38:10 -07:00
Peter Maydell
a47e3c26b1 linux-user: Validate guest-passed dm_ioctl data_size
In do_ioctl_dm() we work with a struct dm_ioctl from the guest.  This
has a fixed initial part, and then a variable data part; the guest
tells us how long that part is by setting the data_size field.  The
data_size is supposed to include the length of the fixed parts of the
struct dm_ioctl.  Currently we don't validate anything about the
guest-provided data_size, and we use it to allocate a buffer which we
then copy the fixed part of the dm_ioctl struct into.  This means
that if the guest passes a very small data_size the copy of the fixed
part will overrun the buffer.

Perform the same sanitizing of the minimum and maximum limits of the
data_size that the kernel does in drivers/md/dm-ioctl.c in the
copy_params() function.

Cc: qemu-stable@nongnu.org
Fixes: 56e904ecb2 ("linux-user: implement device mapper ioctls")
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3736
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Helge Deller <deller@gmx.de>
Signed-off-by: Helge Deller <deller@gmx.de>
2026-07-07 23:49:35 +02:00
Stefan Hajnoczi
94826ec137 Merge tag 'accel-20260706' of https://github.com/philmd/qemu into staging
Accelerators patches queue

- Various cleanups around debugging APIs
- Correctly check singlestep flag enabled in CPUState
- Fix possible memory corruption with MSHV (CID 1660876)

# -----BEGIN PGP SIGNATURE-----
#
# iQIzBAABCAAdFiEE+qvnXhKRciHc/Wuy4+MsLN6twN4FAmpLsRwACgkQ4+MsLN6t
# wN7TRRAAhTnAG0VuUat9MYUCuWWSiTrNKm6m2vVcO+Zec/bBbU1+twBSBzVQ/rwm
# kGzImAWip6nYorU5BxTKePlpCy6Rm+t0evYaA5ixF0aXtmm3n6IGIMSsi5yEJxF5
# YHDXxvpD56Z1p8kRvkp4ynABiiF5gfBFqbSuI7/gxSI2tcJ2uSx8MC+HEO/X4vJc
# +Clich5n4eyN7YL7vqGrVl84cqHOwe40bXAm1OOa5S83/y2hc//SHgFqTB8BL1P7
# 9SafbFIFiqbfy4kWV86mSu3LDsSYLoIU7bgpRb9mX9WVrvfuoQeVUf7XH+fjmqIo
# s/2uHN6ha/h12jS1q0nCYu585EzXCuPRF3upSslPaoEd16sFEO6ZiODmaMIsomA2
# SlCM3jGYUUw+vkfS/+SJUF17QEHtv0R8Dp5IfseE9Tp+huYvJuwn3Qh4UwbVRg0P
# YHoRa2KiXvBPntY/GkyhCL9Y5oWC5RaRHyKxMs83tdUouOeBy2t/ftnVtDqeRn3p
# 04W+pilUEodSnzcNfAGxQhkqDeGIOveRubaeNICgmxO0Bp9dMUZIOju84hY77KEw
# hClBI87cOc1REC7YNXkoouWcr8moNSZlKAyIbTf/Ag5cAheYOSvO5UDDVVepudSl
# kER+S1iuPkeb0uVvnvk5Kh4UBCMwdfYKe9bNu/SB0ab6N3IpY4s=
# =knBq
# -----END PGP SIGNATURE-----
# gpg: Signature made Mon 06 Jul 2026 15:43:56 CEST
# gpg:                using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE
# gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <f4bug@amsat.org>" [full]
# Primary key fingerprint: FAAB E75E 1291 7221 DCFD  6BB2 E3E3 2C2C DEAD C0DE

* tag 'accel-20260706' of https://github.com/philmd/qemu: (32 commits)
  cpu: Only check SSTEP_ENABLE flag in cpu_single_stepping()
  cpu: Rename CPUState @singlestep_enabled -> @singlestep_flags
  cpu: Introduce cpu_single_stepping() helper
  cpu: Better name cpu_single_step() trace event
  accel/tcg: Improve docstrings around TCGCPUOps::*watchpoint* handlers
  target/ppc: Ensure TCG is used in ppc_update_daw()
  target/arm: Inline check_watchpoints() in arm_debug_check_watchpoint()
  accel: Use GdbBreakpointType enum
  gdbstub: Introduce GdbBreakpointType enumerator
  gdbstub: Reduce @type variable scope
  gdbstub/user: Directly call gdb_breakpoint_remove_all() in user mode
  accel: Remove unnecessary 'inline' qualifier in remove_all_breakpoints
  cpu: Move BREAKPOINT definitions to 'exec/breakpoint.h'
  cpu: Move cpu_breakpoint_test out of line
  accel: Remove AccelOpsClass::supports_guest_debug
  accel: Hold @can_reverse information in AccelGdbConfig
  gdbstub: Make default replay_mode value explicit in stubs
  accel: Have each implementation return their AccelGdbConfig
  gdbstub: Move supported_sstep_flags in AccelGdbConfig structure
  gdbstub: Reduce gdb_supports_guest_debug() scope
  ...

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2026-07-06 18:38:14 +02:00
Philippe Mathieu-Daudé
0a8bc0f251 cpu: Introduce cpu_single_stepping() helper
Access CPUState::@singlestep_enabled field with a helper.

Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260705215729.62196-31-philmd@oss.qualcomm.com>
2026-07-06 15:42:18 +02:00
Richard Henderson
82d7e57204 target/arm: Enable FEAT_SME_MOP4 for -cpu max
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20260702204314.79224-16-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2026-07-06 11:32:01 +01:00
Richard Henderson
272eef0d25 target/arm: Implement and enable FEAT_SSVE_FEXPA for -cpu max
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20260626164819.770787-1-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2026-07-06 11:32:01 +01:00
Jim MacArthur
6b32b32892 linux-user/aarch64/elfload.c: Add FPRCVT
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Jim MacArthur <jim.macarthur@linaro.org>
Message-id: 20260630-jmac-fprcvt-v3-4-f4840d5e0a7f@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2026-07-06 11:32:01 +01:00
Stefan Hajnoczi
654b54fb37 Merge tag 'pull-target-arm-20260629' of https://gitlab.com/pm215/qemu into staging
target-arm queue:
 * hw/timer/imx_epit: Replace DPRINTF with trace events
target/arm: Enable SCTLR_EL1.EnFPM for user-only
target/arm: Implement FEAT_SME_F8F32
target/arm: Implement FEAT_SSVE_AES
target/arm: Implement FEAT_SME_F8F16
target/arm: GICv5: Fix some minor bugs
target/arm: Add GPC3 granule bypass windows
target/arm: Fix some minor timer related bugs
hw/arm/sabrelite: Add FlexCAN emulation
docs/system: add FEAT_ECV_POFF to the emulation list
docs/system/arm/virt: Document accelerated SMMUv3 and Tegra241 CMDQV

# -----BEGIN PGP SIGNATURE-----
#
# iQJNBAABCAA3FiEE4aXFk81BneKOgxXPPCUl7RQ2DN4FAmpCXaQZHHBldGVyLm1h
# eWRlbGxAbGluYXJvLm9yZwAKCRA8JSXtFDYM3nfkEACJkoMzHDyHcAiRdO8fK4o6
# zHP3f42UOnXTbX//Yga0PpxScWfvD8XbbOSeJRvpjuxl8nP8QF4/rF4b+atMy9Vl
# MH0r/CWl9fZwQOSmjOLzgRGzXx0j9RPPpB/7eYTnKYImfOaEEaGvW4JqoBRE2Nbo
# x5PaQjaqFQi76uGAJvALPgAPCgaK1DGbNDSRuH4RM7auLBWmSaoxdidiTDSBUqY0
# xsI/lU7t+/LLWirjP/QhM4mbxEc2DjENbguRHYlOqe5aHc6KdSmNj2B4/hTfyDON
# c6APaAAPfCy3duL3JsvmwRZ8YM7zoUFEHysLjRxLWyiFfXZUIXPSMZaGpz88iyDV
# Cbraw24K5tVVNvwQTKOpHYCnjNb4dZj1Zt/jdGIu16LQ8nsKgX2EJ6oh6lI85Q6n
# d3Jbq+iLOy2r2r4CRTMIJYKZ2Bikkmyr+wZGO18nttnTVpWNzWVZtq4cutygr5vb
# 0+5Lmr7YeYsdmIc1tpcJmlfmmo7dW987HyzK3/B65gPXV64w+a3eALRLPkMGevTT
# MhG48151NEovHxfKqzsOMIixnPUKGPtAUbeKy/Ywv2ezKUmER19h/7nJ0lsa32pl
# HYctGj4QeK4VjOO8E1q44ZIionhZFt+RHXBxxbiBzQBns/ryFBOQFEA3WzKi7rnd
# a0v1M+AAK/UxmCjV7Sl0WA==
# =OvGk
# -----END PGP SIGNATURE-----
# gpg: Signature made Mon 29 Jun 2026 13:57:24 CEST
# gpg:                using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE
# gpg:                issuer "peter.maydell@linaro.org"
# gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [full]
# gpg:                 aka "Peter Maydell <pmaydell@gmail.com>" [full]
# gpg:                 aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" [full]
# gpg:                 aka "Peter Maydell <peter@archaic.org.uk>" [unknown]
# Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83  15CF 3C25 25ED 1436 0CDE

* tag 'pull-target-arm-20260629' of https://gitlab.com/pm215/qemu: (54 commits)
  docs/system/arm/virt: Document accelerated SMMUv3 and Tegra241 CMDQV
  target/arm: Enable FEAT_SME_F8F16 for -cpu max
  target/arm: Implement FVDOT (FP8 to FP16)
  target/arm: Rename FVDOT pattern
  target/arm: Implement FMOPA (widening, 2-way, FP8 to FP16)
  target/arm: Implement FDOT (multiple and indexed, FP8 to FP16)
  target/arm: Implement FDOT (multiple, multiple and single, FP8 to FP16)
  target/arm: Implement FMLAL (multiple and indexed, FP8 to FP16)
  target/arm: Implement FMLAL (multiple, multiple and single, FP8 to FP16)
  target/arm: Rename SME FMLAL/FMLSL patterns
  target/arm: Enable FADD/FSUB (half-precision) with FEAT_SME_F8F16
  docs/system: add FEAT_ECV_POFF to the emulation list
  target/arm: trigger timer recalc on HCR:(E2H|TGE) changes
  target/arm: gate check on scr_el3 behind ARM_FEATURE_EL3 check
  target/arm: trigger timer recalc on SCR:ECVEN change
  target/arm: trigger timer recalculation when toggling CNTHCTL:ECV
  target/arm: split evaluation of CNTHCTL timer IRQ masks
  docs/arm/sabrelite: Mention FlexCAN support
  tests: Add qtests for FlexCAN
  hw/arm: Plug FlexCAN into FSL_IMX6 and Sabrelite
  ...

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2026-07-02 10:44:27 +02:00
Brian Cain
eb0dac0558 target/hexagon: Implement hex_tlb_entry_get_perm()
Reviewed-by: Taylor Simpson <ltaylorsimpson@gmail.com>
Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>
2026-06-29 06:02:59 -07:00
Brian Cain
9831d3cab1 target/hexagon: Add privilege check, use tag_ignore()
Add system event and cause code definitions needed for exception
handling in sysemu mode.  Add privilege checks that raise exceptions
for guest/supervisor-only instructions executed without appropriate
privilege.

Expose hex_gen_exception_end_tb() via translate.h (previously the
static gen_exception_end_tb) so that it can be called from the
generated privileged-instruction TCG stubs.

Reviewed-by: Taylor Simpson <ltaylorsimpson@gmail.com>
Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>
2026-06-29 06:02:59 -07:00
Richard Henderson
c3da6e9f75 target/arm: Enable FEAT_SME_F8F16 for -cpu max
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20260625015159.719300-11-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2026-06-29 11:03:47 +01:00
Richard Henderson
69f3323ef5 target/arm: Enable FEAT_SME_F8F32 for -cpu max
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20260618041517.573469-11-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2026-06-29 11:03:46 +01:00
Richard Henderson
4bdbb20240 target/arm: Implement FEAT_SSVE_AES
Enable FEAT_SVE_AES instructions in streaming mode.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20260618040718.572950-8-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2026-06-29 11:03:46 +01:00
Richard Henderson
2d7709ad7b target/arm: Rename isar_feature_aa64_sve_aes
Rename from isar_feature_aa64_sve2_aes to match
the feature name: FEAT_SVE_AES.

Suggested-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20260618040718.572950-7-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2026-06-29 11:03:46 +01:00
Stefan Hajnoczi
b833716681 Merge tag 'pbouvier/pr/plugins-20260618' of https://gitlab.com/p-b-o/qemu into staging
Changes:
- [PATCH v2 0/1] plugins: fix syscall filter return value type (Ziyang Zhang <functioner@sjtu.edu.cn>)
  Link: https://lore.kernel.org/qemu-devel/20260618082426.790315-1-functioner@sjtu.edu.cn

# -----BEGIN PGP SIGNATURE-----
#
# iQGzBAABCgAdFiEEN8FWlNi6l2Sxlz/btEQ30ZwoYt8FAmo0g58ACgkQtEQ30Zwo
# Yt8swQwAqqVmnVqOsIbF/XCO9/K26WfoQM7BSzPWS1khtCSRxWRU5y0L+ePhU8MY
# JWIT/dbCloVuAdeEkdU19AxMWjTqC3B9PANHVRDkDtciOn0597RuQ7BV4w+P7NyN
# ZPeVkn2Wx5ly01OxIDkvhkGcturuJK0+2R1EnuNPJt3sQyUrEVZK5ApbBOvi+EL/
# ZHFZfXkXM9kINiN7ptTfjEuRZc6jXWyMq8Jgb3177XCd8EiA0DbZjKUs2keprPzG
# hEu0p6VK7qnO3tMsRBxad8sddg3FEIlhz3aByfFY6Ct8kJfHGvuqWOJlmr8+i1uT
# r0zVM78Ra2AJxnwO0gMTGv+CPhIw7KD0LW4PrSjMvrZb5R/7iQZz200vwZecmghu
# gEZjG/BZbybhK5QVf8xgGq1SmEGMBZGVvPpVB0x2GGiJJq4+4a4Fm2s0chyrsCWi
# SCgGhlGh1t5RsmS+6turW3DmiAQw3tLox4qETc9WMcLM3WeFdhBMonB6Xm0JkU4J
# tW7juYvs
# =zqrs
# -----END PGP SIGNATURE-----
# gpg: Signature made Thu 18 Jun 2026 19:47:43 EDT
# gpg:                using RSA key 37C15694D8BA9764B1973FDBB44437D19C2862DF
# gpg: Good signature from "Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg:          There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 37C1 5694 D8BA 9764 B197  3FDB B444 37D1 9C28 62DF

* tag 'pbouvier/pr/plugins-20260618' of https://gitlab.com/p-b-o/qemu:
  plugins: use int64_t for the syscall filter return value

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2026-06-19 15:00:01 -04:00
Stefan Hajnoczi
dc1667bf64 Merge tag 'linux-user-pull-request' of https://github.com/hdeller/qemu-hppa into staging
linux-user patches

One frame pointer memory locking fix for the xtensa architecture, a generic
loader fix for programs with modified headers, and two patches to emulate
/proc/cpuinfo for loogarch and m68k CPUs.

# -----BEGIN PGP SIGNATURE-----
#
# iHUEABYKAB0WIQS86RI+GtKfB8BJu973ErUQojoPXwUCajRo/gAKCRD3ErUQojoP
# X+3IAQCPg/Z8KRa43miOMpOJVRxel3eg5h9+A/Sh4SwPp9Sk2gD/U6gh4l64Bl2O
# CT30o35Afd7rl1G1dD9rsB/H9tU/gwM=
# =mTKh
# -----END PGP SIGNATURE-----
# gpg: Signature made Thu 18 Jun 2026 17:54:06 EDT
# gpg:                using EDDSA key BCE9123E1AD29F07C049BBDEF712B510A23A0F5F
# gpg: Good signature from "Helge Deller <deller@gmx.de>" [unknown]
# gpg:                 aka "Helge Deller <deller@kernel.org>" [unknown]
# gpg:                 aka "Helge Deller <deller@debian.org>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg:          There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 4544 8228 2CD9 10DB EF3D  25F8 3E5F 3D04 A7A2 4603
#      Subkey fingerprint: BCE9 123E 1AD2 9F07 C049  BBDE F712 B510 A23A 0F5F

* tag 'linux-user-pull-request' of https://github.com/hdeller/qemu-hppa:
  linux-user/xtensa: fix unlock of uninitialized frame pointer on sigreturn
  linux-user: Implement /proc/cpuinfo for m68k CPU
  linux-user: Implement /proc/cpuinfo for loongarch cpus
  linux-user: Fix AT_PHDR when program headers are relocated into their own segment

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2026-06-19 14:58:38 -04:00
Ziyang Zhang
731525c276 plugins: use int64_t for the syscall filter return value
The syscall return value passed back through the syscall filter
callback is semantically signed: negative values encode errno codes.
Declaring the sysret pointer as uint64_t * is therefore misleading and
forces callers to launder the value through an unsigned temporary.

Change the sysret pointer to int64_t * across the public plugin API
typedef (qemu_plugin_vcpu_syscall_filter_cb_t), the internal
qemu_plugin_vcpu_syscall_filter() prototypes and stub, its
implementation in plugins/core.c, the linux-user caller, and the
in-tree example plugins.

Signed-off-by: Ziyang Zhang <functioner@sjtu.edu.cn>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
Link: https://lore.kernel.org/qemu-devel/20260618082426.790315-2-functioner@sjtu.edu.cn
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
2026-06-18 16:47:12 -07:00
Matt Turner
54e08dbe8f linux-user/xtensa: fix unlock of uninitialized frame pointer on sigreturn
If lock_user_struct fails, frame is uninitialized but the badframe
label unconditionally calls unlock_user_struct on it. Handle the
lock failure inline so badframe is only reached with a valid lock.

Signed-off-by: Matt Turner <mattst88@gmail.com>
Cc: qemu-stable@nongnu.org
Reviewed-by: Helge Deller <deller@gmx.de>
Signed-off-by: Helge Deller <deller@gmx.de>
2026-06-18 23:43:35 +02:00
Helge Deller
0b0ef9060c linux-user: Implement /proc/cpuinfo for m68k CPU
Mimic the entries for /proc/cpuinfo to what can be seen on the debian
porterbox mitchy.debian.org.

Cc: Thomas Huth <th.huth+qemu@posteo.eu>
Cc: Laurent Vivier <laurent@vivier.eu>
Signed-off-by: Helge Deller <deller@gmx.de>
2026-06-18 23:43:35 +02:00
Helge Deller
13956e8244 linux-user: Implement /proc/cpuinfo for loongarch cpus
Mimic the entries for /proc/cpuinfo to what can be seen on the debian
porterbox loomis.debian.org.

Cc: Song Gao <gaosong@loongson.cn>
Cc: Bibo Mao <maobibo@loongson.cn>
Cc: Jiaxun Yang <jiaxun.yang@flygoat.com>
Signed-off-by: Helge Deller <deller@gmx.de>
2026-06-18 23:43:35 +02:00
Akshit Yadav
156e536a7b linux-user: Fix AT_PHDR when program headers are relocated into their own segment
When a binary is patched or relocated such that the program header table is
moved into a separate PT_LOAD segment (rather than sitting at the start of the
first loadable segment), QEMU's AT_PHDR auxv entry becomes incorrect. The
loader was computing AT_PHDR as load_addr + e_phoff, which assumes the headers
are mapped 1:1 from file offset 0. This breaks when the headers are elsewhere.

The Linux kernel instead locates the PT_LOAD segment that contains e_phoff,
then computes the in-memory address as p_vaddr + (e_phoff - p_offset). This
correctly handles relocated headers.

Fix by:
1. Add phdr_addr field to image_info to cache the resolved address.
2. Initialize to load_addr + e_phoff (fallback for headers outside any PT_LOAD).
3. In the PT_LOAD mapping loop, detect if the segment contains e_phoff and
   override with the segment-relative address.
4. Use info->phdr_addr for AT_PHDR instead of the incorrect formula.

Signed-off-by: Akshit Yadav <valium7171@gmail.com>
Reviewed-by: Helge Deller <deller@gmx.de>
2026-06-18 23:43:35 +02:00
Philippe Mathieu-Daudé
67e17ab2b3 exec/cpu-common.h: Avoid including unused exec/page-protection.h header
Since commit e74781c0888e ("exec/cpu: Extract page-protection
definitions to page-protection.h") the "exec/cpu-common.h" isn't
using anything defined in "exec/page-protection.h"; remove it.

Include it in few files where it is currently pulled in indirectly,
otherwise we'd get:

  linux-user/qemu.h:182:22: error: ‘PAGE_READ’ undeclared
    182 | #define VERIFY_READ  PAGE_READ
        |                      ^~~~~~~~~
  target/loongarch/cpu_helper.c:329:25: error: use of undeclared identifier 'PAGE_READ'
    329 |         context->prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
        |                         ^
  target/loongarch/cpu_helper.c:329:37: error: use of undeclared identifier 'PAGE_WRITE'
    329 |         context->prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
        |                                     ^
  target/loongarch/cpu_helper.c:329:50: error: use of undeclared identifier 'PAGE_EXEC'
    329 |         context->prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
        |                                                  ^
  target/ppc/mmu-hash32.h:98:20: error: use of undeclared identifier 'PAGE_READ'
     98 |             prot = PAGE_READ | PAGE_WRITE;
        |                    ^
  target/ppc/mmu-hash32.h:98:32: error: use of undeclared identifier 'PAGE_WRITE'
     98 |             prot = PAGE_READ | PAGE_WRITE;
        |                                ^
  hw/ppc/ppc_booke.c:39:17: error: use of undeclared identifier 'PAGE_RWX'
     39 |     tlb->prot = PAGE_RWX << 4 | PAGE_VALID;
        |                 ^
  hw/ppc/ppc_booke.c:39:33: error: use of undeclared identifier 'PAGE_VALID'
     39 |     tlb->prot = PAGE_RWX << 4 | PAGE_VALID;
        |                                 ^

Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20260617160426.64461-6-philmd@oss.qualcomm.com>
2026-06-18 14:27:21 +02:00
Bin Guo
66ac993bda util/cutils: drop qemu_strnlen() in favor of strnlen()
There are only three call sites, and strnlen() is available on all
supported platforms (POSIX.1-2008, Windows via UCRT, MinGW).  Remove
the hand-rolled wrapper and use the standard function directly.

While here, align bsd-user/uaccess.c to use size_t for max_len/len,
matching linux-user/uaccess.c and eliminating a signed/unsigned mismatch.

Also remove the stale qemu_strnlen() entry from docs/devel/style.rst.

Suggested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Bin Guo <guobin@linux.alibaba.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Warner Losh <imp@bsdimp.com>
Message-ID: <20260530062816.59206-1-guobin@linux.alibaba.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
2026-06-18 14:27:21 +02:00
Anton Johansson
e59bd5cdb7 target/riscv: Introduce externally facing CSR access functions
Convert riscv_csr_[read|write]() into target_ulong angnostic CSR access
functions that can be safely used from outside of target/ without
knowledge of the target register size.  Replace the 4 existing CSR
accesses in hw/ and linux-user/.

Signed-off-by: Anton Johansson <anjo@rev.ng>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20260520125406.28693-25-anjo@rev.ng>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2026-06-15 13:10:15 +10:00
Matt Turner
6858e3a71c linux-user/xtensa: save/restore FP registers across signal delivery
Add support for saving and restoring f0-f15 across signal delivery.
The target_xtensa_xtregs_fp struct carries 32-bit f-regs for cores
with XTENSA_OPTION_FP_COPROCESSOR; target_xtensa_xtregs_dfp carries
64-bit f-regs for cores with XTENSA_OPTION_DFP_COPROCESSOR.

Lock the xtregs region via lock_user before reading on sigreturn,
since sc_xtregs is a user-space pointer that may lie outside the
locked sigframe.

Signed-off-by: Matt Turner <mattst88@gmail.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Helge Deller <deller@gmx.de>
2026-06-12 17:47:27 +02:00
Helge Deller
ec9abae783 linux-user: Implement /proc/cpuinfo for ppc cpus
Mimic the entries for /proc/cpuinfo to what can be seen on two debian
porterboxes (ppc64 and ppc64le), which are running via KVM/QEMU.

The "timebase" value in /proc/cpuinfo is used by glibc on power, but only if
the __kernel_get_tbfreq vdso call isn't implemented. So switch
cpu_ppc_load_tbl() for linux-user to get_clock(), as suggested by Richard, and
report timebase = 1GHz in /proc/cpuinfo, which will make the vdso
implementation simple too.

v4: change timebase to 1GHz and use get_clock()
v3: drop another colon, indenting fixes
v2: drop colon, add clock output, refine pvr calculation

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Helge Deller <deller@gmx.de>
2026-06-12 17:45:48 +02:00
Dominique Martinet
fb4c08147b linux-user: add preadv2/preadv2
Some programs apparently use these, like the python test suite.

The flags argument (rwf_t) is an int, with values shared on all arches
and does not need translating.

This was tested manually with the following python script:
```
import os
fd = os.open('test', os.O_RDWR|os.O_CREAT)
os.pwritev(fd, [b'test', b'ok'], 0, os.RWF_HIPRI)
buf = [bytearray(3), bytearray(10)]
os.preadv(fd, buf, 0, os.RWF_HIPRI)
print(buf[0])
print(buf[1])
```

Signed-off-by: Dominique Martinet <dominique.martinet@atmark-techno.com>
Reviewed-by: Helge Deller <deller@gmx.de>
Signed-off-by: Helge Deller <deller@gmx.de>
2026-06-12 17:45:15 +02:00
Stefan Hajnoczi
ec6a1f4398 Merge tag 'linux-user-pull-request' of https://github.com/hdeller/qemu-hppa into staging
linux-user patches for alpha, sparc and sh4

Various linux-user related patches from Matt Turner with coredump support for
alpha and sparc, as well as some fixes for the signal handler in sparc.

The patches from Xinhui Yang add the missing fsmount series syscalls support
for systemd.

# -----BEGIN PGP SIGNATURE-----
#
# iHUEABYKAB0WIQS86RI+GtKfB8BJu973ErUQojoPXwUCaimUqgAKCRD3ErUQojoP
# X82/APsHNDNgLBaVZpddfYs3HxFbIVyn+i2BBvVzPNopJYdciQD+NmjnXo+9NC1O
# ld6wztNGYQSx2t09tpctYpPeaBchUQY=
# =43TP
# -----END PGP SIGNATURE-----
# gpg: Signature made Wed 10 Jun 2026 12:45:30 EDT
# gpg:                using EDDSA key BCE9123E1AD29F07C049BBDEF712B510A23A0F5F
# gpg: Good signature from "Helge Deller <deller@gmx.de>" [unknown]
# gpg:                 aka "Helge Deller <deller@kernel.org>" [unknown]
# gpg:                 aka "Helge Deller <deller@debian.org>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg:          There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 4544 8228 2CD9 10DB EF3D  25F8 3E5F 3D04 A7A2 4603
#      Subkey fingerprint: BCE9 123E 1AD2 9F07 C049  BBDE F712 B510 A23A 0F5F

* tag 'linux-user-pull-request' of https://github.com/hdeller/qemu-hppa:
  target/sh4: decode_gusa: recognize add#imm with prior mov Rm, Rn
  linux-user/sparc: flush register windows before core dump
  linux-user/sparc: call block_signals() before set_sigmask() in setcontext
  linux-user/sparc: restore L/I registers from RSA in sparc64_set_context
  linux-user/sparc: add coredump support
  linux-user/alpha: add coredump support
  linux-user/strace: add fsmount series of syscalls
  linux-user: implement fsmount(2) series of syscalls

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2026-06-11 13:22:50 -04:00
Matt Turner
f83f550549 linux-user/sparc: flush register windows before core dump
Without this, only the crash frame's window is spilled to the
stack; all deeper call frames remain in the register file and
are absent from the core's memory segments. Stack unwinding
fails past the first DWARF step because the callers' register
save areas contain stale/garbage data.

The real kernel calls flush_all_user_windows() at the top of
do_coredump(). Mirror that via a weak target_flush_windows()
hook called from dump_core_and_abort(), with the SPARC override
calling the existing flush_windows() in cpu_loop.c.

Signed-off-by: Matt Turner <mattst88@gmail.com>
Cc: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Signed-off-by: Helge Deller <deller@gmx.de>
2026-06-10 18:42:59 +02:00
Matt Turner
e0f0ce88eb linux-user/sparc: call block_signals() before set_sigmask() in setcontext
sparc64_set_context() emulates the kernel's `ta 0x6f` trap by calling
set_sigmask() to install the mask supplied via the user's ucontext_t.
The contract of set_sigmask() (see its comment in linux-user/signal.c)
is that the caller must have first called block_signals(), which sets
TaskState::signal_pending.

Without block_signals(), if a guest signal is pending-and-blocked at
the time setcontext is invoked and the new mask unblocks it,
signal_pending stays 0 and the post-trap process_pending_signals()
call in linux-user/sparc/cpu_loop.c never enters its while loop, so
the now-deliverable signal is left undelivered indefinitely.

This affects programs that use getcontext/setcontext to swap signal
masks, including libunwind's unw_resume() out of a signal handler:
without this fix, the test program below loops forever printing
"calling setcontext" instead of delivering the pending SIGUSR2.

  #define _GNU_SOURCE
  #include <ucontext.h>
  #include <signal.h>
  #include <stdio.h>
  #include <unistd.h>
  static int got;
  static void h(int s) { got = 1; }
  int main(void) {
      signal(SIGUSR2, h);
      sigset_t m; sigemptyset(&m); sigaddset(&m, SIGUSR2);
      sigprocmask(SIG_BLOCK, &m, NULL);
      kill(getpid(), SIGUSR2);
      ucontext_t uc;
      getcontext(&uc);
      if (got) return 0;
      uc.uc_sigmask.__val[0] = 0;
      setcontext(&uc);
      return 1;
  }

The 32-bit sparc do_sigreturn / do_rt_sigreturn paths already get
block_signals() from the rt_sigreturn syscall wrapper in
linux-user/syscall.c, so only sparc64_set_context (invoked directly
from cpu_loop) needs the addition.

Signed-off-by: Matt Turner <mattst88@gmail.com>
Cc: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Signed-off-by: Helge Deller <deller@gmx.de>
2026-06-10 18:42:59 +02:00
Matt Turner
14a27b0fd8 linux-user/sparc: restore L/I registers from RSA in sparc64_set_context
The kernel's do_rt_sigreturn loads L and I registers from the register
save area (RSA) at the restored O6+STACK_BIAS.  QEMU lacks the kernel's
window-fill path, so restore L0-L7 and I0-I5 explicitly from the RSA.
I6 and I7 are already restored from mc_fp/mc_i7.

Signed-off-by: Matt Turner <mattst88@gmail.com>
Cc: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Signed-off-by: Helge Deller <deller@gmx.de>
2026-06-10 18:42:59 +02:00
Matt Turner
68ed426cf0 linux-user/sparc: add coredump support
Define HAVE_ELF_CORE_DUMP and target_elf_gregset_t in target_elf.h
sized to match the kernel's elf_gregset_t:

  sparc32/sparc32plus (ELF_NGREG = 38):
    [0]      PSR
    [1]      PC
    [2]      NPC
    [3]      Y
    [4..11]  G0-G7
    [12..19] O0-O7
    [20..27] L0-L7
    [28..35] I0-I7
    [36..37] reserved (stack_check)

  sparc64 (ELF_NGREG = 36):
    [0..7]   G0-G7
    [8..15]  O0-O7
    [16..23] L0-L7
    [24..31] I0-I7
    [32]     TSTATE
    [33]     TPC
    [34]     TNPC
    [35]     Y

Also define ELF_MACHINE as EM_SPARC32PLUS for TARGET_ABI32 builds,
matching the kernel and ensuring the correct machine type appears in
the core file.

Implement elf_core_copy_regs() in elfload.c to populate the gregset
from CPUSPARCState, including L0-L7 and I0-I7 from env->regwptr.
A memset() at entry zeros the trailing reserved slots.

Without this, bprm->core_dump is NULL for SPARC targets.  When a
guest signal goes unhandled, dump_core_and_abort() skips the core
write and falls through to die_with_signal(), which re-raises the
signal to the host.  The host kernel then writes an x86-64 core file
for the qemu-sparc process instead of a SPARC guest core.

Populating the full register layout is required for tools like
libunwind-coredump, which reads pr_reg[33] for the trap PC and
pr_reg[16..31] for the windowed registers.

Signed-off-by: Matt Turner <mattst88@gmail.com>
Cc: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Signed-off-by: Helge Deller <deller@gmx.de>
2026-06-10 18:42:59 +02:00
Matt Turner
9db18ed063 linux-user/alpha: add coredump support
Define HAVE_ELF_CORE_DUMP and target_elf_gregset_t in target_elf.h,
mirroring the kernel's elf_gregset_t (ELF_NGREG = 66): r0-r31
[0..31], f0-f31 [32..63], pc [64], unique [65].  Implement
elf_core_copy_regs() in elfload.c to populate the gregset from
CPUAlphaState.

Without this, bprm->core_dump is NULL for Alpha targets.  When a
guest signal goes unhandled, dump_core_and_abort() skips the core
write and falls through to die_with_signal(), which re-raises the
signal to the host.  The host kernel then writes an x86-64 core file
for the qemu-alpha process instead of an Alpha guest core.

v2: Store thread unique field, same as in Linux kernel. Added by Helge &
suggested by Richard.

Signed-off-by: Matt Turner <mattst88@gmail.com>
Signed-off-by: Helge Deller <deller@gmx.de>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
2026-06-10 18:42:59 +02:00
Xinhui Yang
6e0aa9f6c7 linux-user/strace: add fsmount series of syscalls
Following the addition of fsmount(2) series of syscalls in the syscall
handler, strace support is added, with a dedicated function to print the
parameters of fsconfig(2), which contains parameters that can be
interpreted as multiple types.

Snippet of the strace dump when running `mount -t tmpfs tmpfs /media`:

18 fsopen(tmpfs,1) = 3
18 read(3,0x407fcf1c,8191) = -1 errno=61 (No data available)
18 fsconfig(3,FSCONFIG_SET_STRING,"source","tmpfs",0) = 0
18 read(3,0x407fce3c,8191) = -1 errno=61 (No data available)
18 fsconfig(3,FSCONFIG_CMD_CREATE,NULL,NULL,0) = 0
18 read(3,0x407fce3c,8191) = -1 errno=61 (No data available)
18 fsmount(3,1,0) = 4
18 read(3,0x407fce3c,8191) = -1 errno=61 (No data available)
18 statx(4,"",AT_EMPTY_PATH|AT_STATX_SYNC_AS_STAT,0x1000,0x407fee98) = 0
18 move_mount(4,,-100,/media,4) = 0
18 read(3,0x407fcfcc,8191) = -1 errno=61 (No data available)
18 close(3) = 0
18 close(4) = 0

v2: Fixed build on RHEL9 due to missing syscalls (Helge)

Signed-off-by: Xinhui Yang <cyan@cyano.uk>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
Signed-off-by: Helge Deller <deller@gmx.de>
2026-06-10 18:42:59 +02:00
Xinhui Yang
767c32fe69 linux-user: implement fsmount(2) series of syscalls
This series of syscalls replaces the old mount(2) syscall with a series
of syscalls that operates around a filesystem context. This series of
syscalls is available since Linux 5.2 and glibc 2.36+.

Their users include systemd since v259 and libmount from util-linux, and
possibly other widely used projects.

Preliminary checks are implemented to ensure the validity of the
interface.

v2: Add syscall wrappers in case the build machine does not
support the fsmount() syscalls. (added by Helge Deller)

Signed-off-by: Xinhui Yang <cyan@cyano.uk>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
Signed-off-by: Helge Deller <deller@gmx.de>
2026-06-10 18:42:59 +02:00
Richard Henderson
c45b02cb24 target/arm: Enable FEAT_F8F16MM for -cpu max
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20260609192110.752384-46-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2026-06-10 16:54:40 +01:00
Richard Henderson
97f97d15c7 target/arm: Enable FEAT_F8F32MM for -cpu max
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20260609192110.752384-43-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2026-06-10 16:54:40 +01:00
Richard Henderson
c67d5463da target/arm: Enable FEAT_FP8DOT2, FEAT_SSVE_FP8DOT2 for -cpu max
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20260609192110.752384-40-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2026-06-10 16:54:40 +01:00
Richard Henderson
908c7a23d5 target/arm: Enable FEAT_FP8DOT4, FEAT_SSVE_FP8DOT4 for -cpu max
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20260609192110.752384-37-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2026-06-10 16:54:40 +01:00
Richard Henderson
07e9ea8f1c target/arm: Enable FEAT_FP8FMA, FEAT_SSVE_FP8FMA for -cpu max
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20260609192110.752384-34-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2026-06-10 16:54:40 +01:00