When debugging issues in KVM guests, it is sometimes helpful to have a
unified trace log of both guest and host to see where things are going
wrong. Expose the TB (timebase) offset through QEMU monitor to enable
capturing of unified log.
The below steps can be then used for KVM guests to get a unified log:
1. In host
trace-cmd record -e kvm_hv:kvm_guest_enter -e kvm_hv:kvm_guest_exit \
-C ppc-tb -o trace_host.dat
2. In guest
trace-cmd record -e powerpc:hcall_entry -e powerpc:hcall_exit -C ppc-tb \
--ts-offset <TB offset from QEMU monitor> -o trace_guest.dat
NOTE: The TB offset would be reported as a negative number in QEMU
monitor. For this step, the minus sign must be ignored.
3. Transfer the guest logs to the host with scp/rsync
4. Unify the logs
trace-cmd report -i trace_host.dat -i trace_guest.dat > combined_log
In case of TCG guests, the TB offset would be
reported as 0 since the offset logic is not applicable in this case.
Tested-by: Amit Machhiwal <amachhiw@linux.ibm.com>
Reviewed-by: Amit Machhiwal <amachhiw@linux.ibm.com>
Reviewed-by: Vaibhav Jain <vaibhav@linux.ibm.com>
Signed-off-by: Gautam Menghani <gautam@linux.ibm.com>
Tested-by: Sneh Shikha Yadav <syadav@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/20260629052602.78276-1-gautam@linux.ibm.com
Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
Move the following TCG-specific cpu_loop_exit_*() declarations
out of the generic "exec/cpu-common.h" header, to the recently
created "accel/tcg/cpu-loop.h" one, documenting them:
- cpu_loop_exit_noexc()
- cpu_loop_exit_atomic()
- cpu_loop_exit_restore()
- cpu_loop_exit()
Include "accel/tcg/cpu-loop.h" where appropriate.
Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20260617171438.75914-11-philmd@oss.qualcomm.com>
Move the TCG-specific cpu_restore_state() declaration out
of the generic "exec/cpu-common.h" header, to the recently
created "accel/tcg/cpu-loop.h" one.
Include "accel/tcg/cpu-loop.h" where appropriate.
Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20260617171438.75914-8-philmd@oss.qualcomm.com>
GCC 16 tightens diagnostics around const correctness and now correctly
rejects attempts to modify strings referenced through const-qualified
pointers. In kvm_ppc_register_host_cpu_type(), ppc_cpu_aliases[i].model
is defined as const char *, but the code was using strstr() on it and
then modifying the returned pointer in-place to strip
POWERPC_CPU_TYPE_SUFFIX.
This results in a write through a pointer derived from const data,
triggering a build failure with GCC 16:
error: assignment discards 'const' qualifier from pointer target type [-Werror=discarded-qualifiers]
suffix = strstr(ppc_cpu_aliases[i].model, POWERPC_CPU_TYPE_SUFFIX);
^
Fix this by changing suffix to 'const gchar *' and using g_strstr_len()
to locate the suffix, then allocating a new string with g_strndup() (to
copy only the prefix) or g_strdup() (to copy the entire name if no
suffix exists). This maintains const correctness throughout while
preserving the original functionality.
No functional change intended.
Signed-off-by: Vaibhav Jain <vaibhav@linux.ibm.com>
Signed-off-by: Amit Machhiwal <amachhiw@linux.ibm.com>
Tested-by: Anushree Mathur <anushree.mathur@linux.ibm.com>
Reviewed-by: Aditya Gupta <adityag@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/20260518172517.12466-2-amachhiw@linux.ibm.com
Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
Now that we have ensured that all implementations of the get_phys_page_debug
method handle a non-page-aligned input and return the corresponding
non-page-aligned output, the name of the method is somewhat misleading.
Rename it to get_phys_addr_debug.
This commit was produced with the commands
sed -i -e 's/_cpu_get_phys_page_debug/_cpu_get_phys_addr_debug/g;s/\<get_phys_page_debug\>/get_phys_addr_debug/g' $(git grep -l get_phys_page_debug)
sed -i -e 's/_cpu_get_phys_page_attrs_debug/_cpu_get_phys_addr_attrs_debug/g;s/\<get_phys_page_attrs_debug\>/get_phys_addr_attrs_debug/g' $(git grep -l get_phys_page_attrs_debug)
which catches all references to the method name itself plus
the functions which each target uses as the method implementation,
but (deliberately) not the cpu_phys_get_page_debug() and
cpu_phys_get_page_attrs_debug() wrapper functions or their callers.
(We'll deal with those in the next commit.)
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20260417173105.1648172-9-peter.maydell@linaro.org
Message-ID: <20260430093810.2762539-10-peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Currently our implementations of SysemuCPUOps::get_phys_page_debug
and SysemuCPUOps::get_phys_page_attrs_debug are a mix of "accepts a
non-page-aligned virtual address and returns the corresponding
non-page-aligned physical address" and "only returns a page-aligned
physical address". This is awkward for callsites, which in practice
all want the physical address for an arbitrary virtual address and
have to work around the possibility of getting a page-aligned
address, and it doesn't account for protection being possibly on a
sub-page-sized granularity. We want to standardize on the
implementation having to handle non-page-aligned addresses.
The ppc_xlate() function can accept a non-page-aligned input but may
return a page-aligned output; we take the simple approach of ORing
the page offset back into the result address after calling it.
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20260417173105.1648172-8-peter.maydell@linaro.org
Reviewed-by: Glenn Miles <milesg@linux.ibm.com>
Message-ID: <20260430093810.2762539-9-peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Use TargetInfo target_long_bits() helper at runtime to migrate
the VPN register as 32 or 64-bits.
The "migration/qemu-file-types.h" isn't required anymore in
"migration/cpu.h", however it was missing in "ppc/machine.c".
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-Id: <20260325211728.89204-7-philmd@linaro.org>
hash32_load_hpte() helpers are only used within mmu-hash32.c,
no need to have each file including "mmu-hash32.h" to compile
them. Move their definition to this source file.
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
Message-Id: <20260319111936.68041-5-philmd@linaro.org>
Nothing in all our target "cpu.h" directly uses definitions
from "exec/cpu-defs.h": no need to include it there. This
remove a lot of target-specificities, simplifying inclusion
of target "cpu.h" by common code.
Inspired-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-Id: <20260313062055.2188-20-philmd@linaro.org>
The "exec/target_long.h" header is indirectly included, pulled
via "exec/cpu-defs.h". Include it explicitly otherwise we'd get
when removing the latter:
target/ppc/cpu.h:1281:5: error: unknown type name 'target_ulong'
1281 | target_ulong gpr[32]; /* general purpose registers */
| ^
hw/ppc/spapr_ovec.h:76:44: error: unknown type name 'target_ulong'
76 | SpaprOptionVector *spapr_ovec_parse_vector(target_ulong table_addr, int vector);
| ^
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-Id: <20260313062055.2188-13-philmd@linaro.org>
Migration pull request
- Cleanups to internal vmstate APIs
- Cleanups to handling of vmstate flags
- New vmstate VMS_ARRAY_OF_POINTER_AUTO_ALLOC
- Fixes to:
- functional exec test
- leaks in file migration
- mapped-ram migration input validation
- programming errors in qemu-file and multifd
- qtest leaks
- Additions to iochannel APIs:
qio_channel_pread{v,}_all{,_eof}
qio_channel_pwrite{v,}_all
- New migration qtest for capabilities validation
- Tweaks to documentation and checkpatch
# -----BEGIN PGP SIGNATURE-----
#
# iQJEBAABCAAuFiEEqhtIsKIjJqWkw2TPx5jcdBvsMZ0FAmnqar8QHGZhcm9zYXNA
# c3VzZS5kZQAKCRDHmNx0G+wxnQZzEACJcMspEO21PClDOwkhyqjIT0j2Xmyhe+B9
# OZkl42SnbXsKNDdORIKJ2U9oG2v+vzWccEMSqjV0jFyQJzrUfEvA0V2i5eH/zXuW
# jUTgrOO5nbwbvPUk4BXGxnplRwB2BrKgjQ62WDgLEn/ZeW9KxUOuNcUCvAtJnljY
# WFYOFn5oeV41TdGj7H5w7fzwYDsRYMUAB9lbr4MnRynSVq2aWrf+ddJpbPhC03fZ
# t6hMyhIT3SnELMw1hnIOGbkYJn5gCHme6cnyMOUrnU/ws+2lExEL4X11sSCexRbo
# N9zpJfi2U/wfiKrHPjUZ7InavaJm47WvzOQ1eC2I0v5xWY5G3wgvFJ9PAm3gtgr/
# n0QYf4xWpJ2rZDnFvKepXRqcndhNa6VYAhs4v2qVBH/9mSjhKHEqLMza6llZ/d/W
# 4ovHK3OQp0NUDWkBmjYUEu/JCusKrWLMdzosm75Z0Vs/cG4ks4s5zb47NIFjFsnT
# WWIK6dAi+27eiZ7BMflVx6La2DAFBc9b8jpO1Rxi3VyN2J7LTzXWIqshJ1Rap6wb
# kNtVjQOtsLdURX6tKLthdzY1M7mgYm+W12l94X9OTZHZUcQwoYKO0P7FJ4YdKDh/
# lPEkAg5um66drxPM268E4jLBxzRWxhPz5SPgv2qeXRO9vkm6G2mapgQtWb00Ta4P
# CitNkhqk0A==
# =3vDa
# -----END PGP SIGNATURE-----
# gpg: Signature made Thu 23 Apr 2026 14:53:51 EDT
# gpg: using RSA key AA1B48B0A22326A5A4C364CFC798DC741BEC319D
# gpg: issuer "farosas@suse.de"
# gpg: Good signature from "Fabiano Rosas <farosas@suse.de>" [unknown]
# gpg: aka "Fabiano Almeida Rosas <fabiano.rosas@suse.com>" [unknown]
# gpg: WARNING: The key's User ID is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: AA1B 48B0 A223 26A5 A4C3 64CF C798 DC74 1BEC 319D
* tag 'migration-20260423-pull-request' of https://gitlab.com/farosas/qemu: (43 commits)
migration/qemu-file: drop incorrect const from qemu_get_buffer_at buf
migration/file: switch file_write_ramblock_iov to pwritev_all
migration/qemu-file: switch buffer_at functions to positioned I/O _all helpers
tests/qtest/migration: fix fd leak in ufd_version_check
tests/unit: add pread/pwrite _all tests for io channel file
migration/file: fix type mismatch and NULL deref in multifd_file_recv_data
io/channel: introduce qio_channel_pwrite{v,}_all()
io/channel: introduce qio_channel_pread{v, }_all{, _eof}()
migration: validate page_size in mapped-ram header before use
tests/unit/test-vmstate: add tests for VMS_ARRAY_OF_POINTER_AUTO_ALLOC
vmstate: Stop checking size for nullptr compression
vmstate: Implement VMS_ARRAY_OF_POINTER_AUTO_ALLOC
vmstate: Implement load of ptr marker in vmstate core
vmstate: Allow vmstate_info_nullptr to emit non-NULL markers
vmstate: Introduce vmstate_save_field_with_vmdesc()
vmstate: Rename VMS_NULLPTR_MARKER to VMS_MARKER_PTR_NULL
vmstate: Update max_elems early and check field compressable once
vmstate: Do not set size for VMS_ARRAY_OF_POINTER
vmstate: Pass in struct itself for VMSTATE_VARRAY_OF_POINTER_UINT32
vmstate: Pass in struct itself for VMSTATE_ARRAY_OF_POINTER
...
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
With TCG_ADDRESS_BITS mechanism, it's now possible to specify which
variant every source file is written for. Compared to before, it means
that addr_type will now vary per tb translation, where it was constant
for a given target previously.
Thus, we add new a parameter to translator_loop().
This will allow us to convert targets one by one.
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20260407222208.271838-15-pierrick.bouvier@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
The test case in the ppe42 functional test triggers a TCG debug
assertion, which causes the test to fail in an --enable-debug
build or when the sanitizers are enabled:
#6 0x00007ffff4a3b517 in __assert_fail
(assertion=0x5555562e7589 "!temp_readonly(ots)", file=0x5555562e5b23 "../../tcg/tcg.c", line=4928, function=0x5555562e8900 <__PRETTY_FUNCTION__.23> "tcg_reg_alloc_mov") at ./assert/assert.c:105
#7 0x0000555555cc2189 in tcg_reg_alloc_mov (s=0x7fff60000b70, op=0x7fff600126f8) at ../../tcg/tcg.c:4928
#8 0x0000555555cc74e0 in tcg_gen_code (s=0x7fff60000b70, tb=0x7fffa802f540, pc_start=4294446080) at ../../tcg/tcg.c:6667
#9 0x0000555555d02abe in setjmp_gen_code
(env=0x555556cbe610, tb=0x7fffa802f540, pc=4294446080, host_pc=0x7fffeea00c00, max_insns=0x7fffee9f9d74, ti=0x7fffee9f9d90)
at ../../accel/tcg/translate-all.c:257
#10 0x0000555555d02d75 in tb_gen_code (cpu=0x555556cba590, s=...) at ../../accel/tcg/translate-all.c:325
#11 0x0000555555cf5922 in cpu_exec_loop (cpu=0x555556cba590, sc=0x7fffee9f9ee0) at ../../accel/tcg/cpu-exec.c:970
#12 0x0000555555cf5aae in cpu_exec_setjmp (cpu=0x555556cba590, sc=0x7fffee9f9ee0) at ../../accel/tcg/cpu-exec.c:1016
#13 0x0000555555cf5b4b in cpu_exec (cpu=0x555556cba590) at ../../accel/tcg/cpu-exec.c:1042
#14 0x0000555555d1e7ab in tcg_cpu_exec (cpu=0x555556cba590) at ../../accel/tcg/tcg-accel-ops.c:82
#15 0x0000555555d1ff97 in rr_cpu_thread_fn (arg=0x555556cba590) at ../../accel/tcg/tcg-accel-ops-rr.c:285
#16 0x00005555561586c9 in qemu_thread_start (args=0x555556ee3c90) at ../../util/qemu-thread-posix.c:393
#17 0x00007ffff4a9caa4 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:447
#18 0x00007ffff4b29c6c in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
This can be reproduced "by hand":
./build/clang/qemu-system-ppc -display none -vga none \
-machine ppe42_machine -serial stdio \
-device loader,file=$HOME/.cache/qemu/download/03c1ac0fb7f6c025102a02776a93b35101dae7c14b75e4eab36a337e39042ea8 \
-device loader,addr=0xfff80040,cpu-num=0
(assuming you have the image file from the functional test
in your local cache).
This happens for this input:
IN:
0xfff80c00: 07436004 .byte 0x07, 0x43, 0x60, 0x04
which generates (among other things):
not_i32 $0x80000,$0x80000
which the TCG optimization pass turns into:
mov_i32 $0x80000,$0xfff7ffff dead: 1 pref=0xffff
and where we then assert because we tried to write to a constant.
This happens for the CLRBWIBC instruction which ends up in
do_mask_branch() with rb_is_gpr false and invert true. In this case
we will generate code that sets mask to a tcg_constant_tl() but then
uses it as the LHS in tcg_gen_not_tl().
Fix the assertion by doing the invert in the translate time C code
for the "mask is constant" case.
Cc: qemu-stable@nongnu.org
Fixes: f7ec91c239 ("target/ppc: Add IBM PPE42 special instructions")
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Glenn Miles <milesg@linux.ibm.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Link: https://lore.kernel.org/qemu-devel/20260212150753.1749448-1-peter.maydell@linaro.org
Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
Keep ppc-qmp-cmds.c for QMP, use monitor.c for HMP.
Since ppc-qmp-cmds.c was introduced using the MIT license
(see commit bf95728400 "monitor: remove target-specific
code from monitor.c") retain the same license for the new
monitor.c file.
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20260219191955.83815-22-philmd@linaro.org>
All these registers are already provided by via gdbstub parsed XML
and handler by the gdb_get_register() helper in the monitor/hmp.c
file. Remove as now unreachable code.
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20260219191955.83815-21-philmd@linaro.org>
This commit removes TARGET_INSN_START_EXTRA_WORDS and force all arch to
call the same version of tcg_gen_insn_start, with additional 0 arguments
if needed. Since all arch have a single call site (in translate.c), this
is as good documentation as having a single define.
The notable exception is target/arm, which has two different translate
files for 32/64 bits. Since it's the only one, we accept to have two
call sites for this.
As well, we update parameter type to use uint64_t instead of
target_ulong, so it can be called from common code.
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-id: 20260219040150.2098396-15-pierrick.bouvier@linaro.org
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
The CPUClass::disas_set_info() handler is meant to initialize
the %disassemble_info structure; it shoudn't alter the CPU state.
Enforce the CPUState can not be modified by having the handler
take a const pointer.
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20260202222412.24923-8-philmd@linaro.org>
In preparation of removing the cpu_ldl_code wrapper, inline it.
Get the runtime endianness with ppc_data_endian_env(), passing it
to cpu_ldl_code_mmu(). No need to swap versus qemu-system binary
anymore.
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Anton Johansson <anjo@rev.ng>
Message-Id: <20260202210106.93257-12-philmd@linaro.org>
Rather than using a boolean with translator_ldl_swap(),
get the MemOp endianness with ppc_code_endian() and pass
it to translator_ldl_end().
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Anton Johansson <anjo@rev.ng>
Message-Id: <20260202210106.93257-8-philmd@linaro.org>
Introduce the ppc_code_endian_dc() helper which returns the
MemOp endianness for the CODE path.
Use it in need_byteswap(), removing one TARGET_BIG_ENDIAN.
Note, the target MemOp endianness can be evaluated as (see
commit 5c43a750b6 "accel/tcg: Implement translator_ld*_end"):
MO_TE ^ (do_swap * MO_BSWAP)
For PPC we use the DisasContext::le_mode field to swap the
default (big-endian) order, so to get the PPC MemOp endianness
we can directly use:
MO_BE ^ (ctx->le_mode * MO_BSWAP)
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Anton Johansson <anjo@rev.ng>
Message-ID: <20260202210106.93257-7-philmd@linaro.org>
Introduce ppc_data_endian_env() which returns the endian MemOp
of the data path from the vCPU env pointer. Keep it hardcoded
as MO_TE, the target built-time endianness.
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Anton Johansson <anjo@rev.ng>
Message-ID: <20260202210106.93257-6-philmd@linaro.org>
