[PATCH v2] target/i386: Revert monitor_puts() in do_inject_x86_mce()

2024-03-20 Thread Tao Su
monitor_puts() doesn't check the monitor pointer, but do_inject_x86_mce()
may have a parameter with NULL monitor pointer. Revert monitor_puts() in
do_inject_x86_mce() to fix, then the fact that we send the same message to
monitor and log is again more obvious.

Fixes: bf0c50d4aa85 (monitor: expose monitor_puts to rest of code)
Reviwed-by: Xiaoyao Li 
Reviewed-by: Markus Armbruster 
Signed-off-by: Tao Su 
---
v1 -> v2:
- Instead revert the broken part of commit bf0c50d4aa85
- Add Markus's Reviewed-by

v1:
- https://lore.kernel.org/all/20240320052118.520378-1-tao1...@linux.intel.com/
---
 target/i386/helper.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/i386/helper.c b/target/i386/helper.c
index 2070dd0dda..23ccb23a5b 100644
--- a/target/i386/helper.c
+++ b/target/i386/helper.c
@@ -430,7 +430,7 @@ static void do_inject_x86_mce(CPUState *cs, run_on_cpu_data 
data)
 if (need_reset) {
 emit_guest_memory_failure(MEMORY_FAILURE_ACTION_RESET, ar,
   recursive);
-monitor_puts(params->mon, msg);
+monitor_printf(params->mon, "%s", msg);
 qemu_log_mask(CPU_LOG_RESET, "%s\n", msg);
 qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET);
 return;

base-commit: c62d54d0a8067ffb3d5b909276f7296d7df33fa7
-- 
2.34.1




Re: [PATCH] target/i386: Check NULL monitor pointer when injecting MCE

2024-03-20 Thread Tao Su
On Wed, Mar 20, 2024 at 08:17:36AM +0100, Philippe Mathieu-Daudé wrote:
> Hi Tao,
> 
> On 20/3/24 07:02, Markus Armbruster wrote:
> > Tao Su  writes:
> > 
> > > monitor_puts() doesn't check the monitor pointer, but do_inject_x86_mce()
> > > may have a parameter with NULL monitor pointer. Check the monitor pointer
> > > before calling monitor_puts().
> > > 
> > > Fixes: bf0c50d4aa85 (monitor: expose monitor_puts to rest of code)
> > > Reviwed-by: Xiaoyao Li 
> > > Signed-off-by: Tao Su 
> > > ---
> > >   target/i386/helper.c | 3 ++-
> > >   1 file changed, 2 insertions(+), 1 deletion(-)
> > > 
> > > diff --git a/target/i386/helper.c b/target/i386/helper.c
> > > index 2070dd0dda..a9ff830a17 100644
> > > --- a/target/i386/helper.c
> > > +++ b/target/i386/helper.c
> > > @@ -430,7 +430,8 @@ static void do_inject_x86_mce(CPUState *cs, 
> > > run_on_cpu_data data)
> > >   if (need_reset) {
> > >   emit_guest_memory_failure(MEMORY_FAILURE_ACTION_RESET, ar,
> > > recursive);
> > > -monitor_puts(params->mon, msg);
> > > +if (params->mon)
> 
> Missing braces, see QEMU coding style:
> https://www.qemu.org/docs/master/devel/style.html#block-structure

Yes, I prefer to revert the broken part.

Anyway, I got this point and will always pay attention to it, thanks for
reminding.

> 
> > > +monitor_puts(params->mon, msg);
> > >   qemu_log_mask(CPU_LOG_RESET, "%s\n", msg);
> > >   qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET);
> > >   return;
> > 
> > Could instead revert the broken part of commit bf0c50d4aa85:
> > 
> >-monitor_puts(params->mon, msg);
> >+monitor_printf(params->mon, "%s", msg);
> > qemu_log_mask(CPU_LOG_RESET, "%s\n", msg);
> > 
> > Then the fact that we send the same message to monitor and log is again
> > more obvious.
> > 
> > Either way:
> > Reviewed-by: Markus Armbruster 
> > 
> > 
> 



Re: [PATCH] target/i386: Check NULL monitor pointer when injecting MCE

2024-03-20 Thread Tao Su
On Wed, Mar 20, 2024 at 07:02:46AM +0100, Markus Armbruster wrote:
> Tao Su  writes:
> 
> > monitor_puts() doesn't check the monitor pointer, but do_inject_x86_mce()
> > may have a parameter with NULL monitor pointer. Check the monitor pointer
> > before calling monitor_puts().
> >
> > Fixes: bf0c50d4aa85 (monitor: expose monitor_puts to rest of code)
> > Reviwed-by: Xiaoyao Li 
> > Signed-off-by: Tao Su 
> > ---
> >  target/i386/helper.c | 3 ++-
> >  1 file changed, 2 insertions(+), 1 deletion(-)
> >
> > diff --git a/target/i386/helper.c b/target/i386/helper.c
> > index 2070dd0dda..a9ff830a17 100644
> > --- a/target/i386/helper.c
> > +++ b/target/i386/helper.c
> > @@ -430,7 +430,8 @@ static void do_inject_x86_mce(CPUState *cs, 
> > run_on_cpu_data data)
> >  if (need_reset) {
> >  emit_guest_memory_failure(MEMORY_FAILURE_ACTION_RESET, ar,
> >recursive);
> > -monitor_puts(params->mon, msg);
> > +if (params->mon)
> > +monitor_puts(params->mon, msg);
> >  qemu_log_mask(CPU_LOG_RESET, "%s\n", msg);
> >  qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET);
> >  return;
> 
> Could instead revert the broken part of commit bf0c50d4aa85:
> 
>   -monitor_puts(params->mon, msg);
>   +monitor_printf(params->mon, "%s", msg);
>qemu_log_mask(CPU_LOG_RESET, "%s\n", msg);
> 
> Then the fact that we send the same message to monitor and log is again
> more obvious.

Good suggestion. I will send a v2 with this change.

> 
> Either way:
> Reviewed-by: Markus Armbruster 

Thanks for review!

> 



[PATCH] target/i386: Check NULL monitor pointer when injecting MCE

2024-03-19 Thread Tao Su
monitor_puts() doesn't check the monitor pointer, but do_inject_x86_mce()
may have a parameter with NULL monitor pointer. Check the monitor pointer
before calling monitor_puts().

Fixes: bf0c50d4aa85 (monitor: expose monitor_puts to rest of code)
Reviwed-by: Xiaoyao Li 
Signed-off-by: Tao Su 
---
 target/i386/helper.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/target/i386/helper.c b/target/i386/helper.c
index 2070dd0dda..a9ff830a17 100644
--- a/target/i386/helper.c
+++ b/target/i386/helper.c
@@ -430,7 +430,8 @@ static void do_inject_x86_mce(CPUState *cs, run_on_cpu_data 
data)
 if (need_reset) {
 emit_guest_memory_failure(MEMORY_FAILURE_ACTION_RESET, ar,
   recursive);
-monitor_puts(params->mon, msg);
+if (params->mon)
+monitor_puts(params->mon, msg);
 qemu_log_mask(CPU_LOG_RESET, "%s\n", msg);
 qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET);
 return;
-- 
2.34.1




[PATCH v2] target/i386: Add new CPU model SierraForest

2024-03-19 Thread Tao Su
According to table 1-2 in Intel Architecture Instruction Set Extensions and
Future Features (rev 051) [1], SierraForest has the following new features
which have already been virtualized:

- CMPCCXADD CPUID.(EAX=7,ECX=1):EAX[bit 7]
- AVX-IFMA CPUID.(EAX=7,ECX=1):EAX[bit 23]
- AVX-VNNI-INT8 CPUID.(EAX=7,ECX=1):EDX[bit 4]
- AVX-NE-CONVERT CPUID.(EAX=7,ECX=1):EDX[bit 5]

Add above features to new CPU model SierraForest. Comparing with GraniteRapids
CPU model, SierraForest bare-metal removes the following features:

- HLE CPUID.(EAX=7,ECX=0):EBX[bit 4]
- RTM CPUID.(EAX=7,ECX=0):EBX[bit 11]
- AVX512F CPUID.(EAX=7,ECX=0):EBX[bit 16]
- AVX512DQ CPUID.(EAX=7,ECX=0):EBX[bit 17]
- AVX512_IFMA CPUID.(EAX=7,ECX=0):EBX[bit 21]
- AVX512CD CPUID.(EAX=7,ECX=0):EBX[bit 28]
- AVX512BW CPUID.(EAX=7,ECX=0):EBX[bit 30]
- AVX512VL CPUID.(EAX=7,ECX=0):EBX[bit 31]
- AVX512_VBMI CPUID.(EAX=7,ECX=0):ECX[bit 1]
- AVX512_VBMI2 CPUID.(EAX=7,ECX=0):ECX[bit 6]
- AVX512_VNNI CPUID.(EAX=7,ECX=0):ECX[bit 11]
- AVX512_BITALG CPUID.(EAX=7,ECX=0):ECX[bit 12]
- AVX512_VPOPCNTDQ CPUID.(EAX=7,ECX=0):ECX[bit 14]
- LA57 CPUID.(EAX=7,ECX=0):ECX[bit 16]
- TSXLDTRK CPUID.(EAX=7,ECX=0):EDX[bit 16]
- AMX-BF16 CPUID.(EAX=7,ECX=0):EDX[bit 22]
- AVX512_FP16 CPUID.(EAX=7,ECX=0):EDX[bit 23]
- AMX-TILE CPUID.(EAX=7,ECX=0):EDX[bit 24]
- AMX-INT8 CPUID.(EAX=7,ECX=0):EDX[bit 25]
- AVX512_BF16 CPUID.(EAX=7,ECX=1):EAX[bit 5]
- fast zero-length MOVSB CPUID.(EAX=7,ECX=1):EAX[bit 10]
- fast short CMPSB, SCASB CPUID.(EAX=7,ECX=1):EAX[bit 12]
- AMX-FP16 CPUID.(EAX=7,ECX=1):EAX[bit 21]
- PREFETCHI CPUID.(EAX=7,ECX=1):EDX[bit 14]
- XFD CPUID.(EAX=0xD,ECX=1):EAX[bit 4]
- EPT_PAGE_WALK_LENGTH_5 VMX_EPT_VPID_CAP(0x48c)[bit 7]

Add all features of GraniteRapids CPU model except above features to
SierraForest CPU model.

SierraForest doesn’t support TSX and RTM but supports TAA_NO. When RTM is
not enabled in host, KVM will not report TAA_NO. So, just don't include
TAA_NO in SierraForest CPU model.

[1] https://cdrdv2.intel.com/v1/dl/getContent/671368

Reviewed-by: Zhao Liu 
Reviewed-by: Xiaoyao Li 
Signed-off-by: Tao Su 
---
v1 -> v2:
 - Specify the spec rev and table which says the contained features.
 - Fix commit message to make it clearer.
 - Move the spec link above --- line so that it won’t be gone after commit.
 - Add Reviewed-by of Zhao and Xiaoyao.

v1:
 - https://lore.kernel.org/all/20231206131923.1192066-1-tao1...@linux.intel.com/
---
 target/i386/cpu.c | 126 ++
 1 file changed, 126 insertions(+)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 9a210d8d92..8b86698939 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -4099,6 +4099,132 @@ static const X86CPUDefinition builtin_x86_defs[] = {
 { /* end of list */ },
 },
 },
+{
+.name = "SierraForest",
+.level = 0x23,
+.vendor = CPUID_VENDOR_INTEL,
+.family = 6,
+.model = 175,
+.stepping = 0,
+/*
+ * please keep the ascending order so that we can have a clear view of
+ * bit position of each feature.
+ */
+.features[FEAT_1_EDX] =
+CPUID_FP87 | CPUID_VME | CPUID_DE | CPUID_PSE | CPUID_TSC |
+CPUID_MSR | CPUID_PAE | CPUID_MCE | CPUID_CX8 | CPUID_APIC |
+CPUID_SEP | CPUID_MTRR | CPUID_PGE | CPUID_MCA | CPUID_CMOV |
+CPUID_PAT | CPUID_PSE36 | CPUID_CLFLUSH | CPUID_MMX | CPUID_FXSR |
+CPUID_SSE | CPUID_SSE2,
+.features[FEAT_1_ECX] =
+CPUID_EXT_SSE3 | CPUID_EXT_PCLMULQDQ | CPUID_EXT_SSSE3 |
+CPUID_EXT_FMA | CPUID_EXT_CX16 | CPUID_EXT_PCID | CPUID_EXT_SSE41 |
+CPUID_EXT_SSE42 | CPUID_EXT_X2APIC | CPUID_EXT_MOVBE |
+CPUID_EXT_POPCNT | CPUID_EXT_TSC_DEADLINE_TIMER | CPUID_EXT_AES |
+CPUID_EXT_XSAVE | CPUID_EXT_AVX | CPUID_EXT_F16C | 
CPUID_EXT_RDRAND,
+.features[FEAT_8000_0001_EDX] =
+CPUID_EXT2_SYSCALL | CPUID_EXT2_NX | CPUID_EXT2_PDPE1GB |
+CPUID_EXT2_RDTSCP | CPUID_EXT2_LM,
+.features[FEAT_8000_0001_ECX] =
+CPUID_EXT3_LAHF_LM | CPUID_EXT3_ABM | CPUID_EXT3_3DNOWPREFETCH,
+.features[FEAT_8000_0008_EBX] =
+CPUID_8000_0008_EBX_WBNOINVD,
+.features[FEAT_7_0_EBX] =
+CPUID_7_0_EBX_FSGSBASE | CPUID_7_0_EBX_BMI1 | CPUID_7_0_EBX_AVX2 |
+CPUID_7_0_EBX_SMEP | CPUID_7_0_EBX_BMI2 | CPUID_7_0_EBX_ERMS |
+CPUID_7_0_EBX_INVPCID | CPUID_7_0_EBX_RDSEED | CPUID_7_0_EBX_ADX |
+CPUID_7_0_EBX_SMAP | CPUID_7_0_EBX_CLFLUSHOPT | CPUID_7_0_EBX_CLWB 
|
+CPUID_7_0_EBX_SHA_NI,
+.features[FEAT_7_0_ECX] =
+CPUID_7_0_ECX_UMIP | CPUID_7_0_ECX_PKU | CPUID_7_0_ECX_GFNI |
+CPUID_7_0_ECX_VAES | CPUID_7_0_ECX_VPCLMULQDQ |
+CPUID_7_0_ECX_RDPID | CPUID_7_0_ECX_BUS_LOCK_DETECT,
+.features[FEAT_7_0_EDX] =
+CPUID_7_0_EDX_FSRM | CPUID_7_0_

Re: [PATCH v3 2/3] kvm: add support for guest physical bits

2024-03-17 Thread Tao Su
On Wed, Mar 13, 2024 at 02:27:18PM +0100, Gerd Hoffmann wrote:
> Query kvm for supported guest physical address bits, in cpuid
> function 8008, eax[23:16].  Usually this is identical to host
> physical address bits.  With NPT or EPT being used this might be
> restricted to 48 (max 4-level paging address space size) even if
> the host cpu supports more physical address bits.
> 
> When set pass this to the guest, using cpuid too.  Guest firmware
> can use this to figure how big the usable guest physical address
> space is, so PCI bar mapping are actually reachable.
> 
> Signed-off-by: Gerd Hoffmann 
> ---
>  target/i386/cpu.h |  1 +
>  target/i386/cpu.c |  1 +
>  target/i386/kvm/kvm-cpu.c | 32 +++-
>  3 files changed, 33 insertions(+), 1 deletion(-)
> 
> diff --git a/target/i386/cpu.h b/target/i386/cpu.h
> index 952174bb6f52..d427218827f6 100644
> --- a/target/i386/cpu.h
> +++ b/target/i386/cpu.h
> @@ -2026,6 +2026,7 @@ struct ArchCPU {
>  
>  /* Number of physical address bits supported */
>  uint32_t phys_bits;
> +uint32_t guest_phys_bits;
>  
>  /* in order to simplify APIC support, we leave this pointer to the
> user */
> diff --git a/target/i386/cpu.c b/target/i386/cpu.c
> index 9a210d8d9290..c88c895a5b3e 100644
> --- a/target/i386/cpu.c
> +++ b/target/i386/cpu.c
> @@ -6570,6 +6570,7 @@ void cpu_x86_cpuid(CPUX86State *env, uint32_t index, 
> uint32_t count,
>  if (env->features[FEAT_8000_0001_EDX] & CPUID_EXT2_LM) {
>  /* 64 bit processor */
>   *eax |= (cpu_x86_virtual_addr_width(env) << 8);
> + *eax |= (cpu->guest_phys_bits << 16);
>  }
>  *ebx = env->features[FEAT_8000_0008_EBX];
>  if (cs->nr_cores * cs->nr_threads > 1) {
> diff --git a/target/i386/kvm/kvm-cpu.c b/target/i386/kvm/kvm-cpu.c
> index 9c791b7b0520..a2b7bfaeadf8 100644
> --- a/target/i386/kvm/kvm-cpu.c
> +++ b/target/i386/kvm/kvm-cpu.c
> @@ -18,10 +18,36 @@
>  #include "kvm_i386.h"
>  #include "hw/core/accel-cpu.h"
>  
> +static void kvm_set_guest_phys_bits(CPUState *cs)
> +{
> +X86CPU *cpu = X86_CPU(cs);
> +uint32_t eax, guest_phys_bits;
> +
> +if (!cpu->host_phys_bits) {
> +return;
> +}
> +
> +eax = kvm_arch_get_supported_cpuid(cs->kvm_state, 0x8008, 0, R_EAX);
> +guest_phys_bits = (eax >> 16) & 0xff;
> +if (!guest_phys_bits) {
> +return;
> +}
> +
> +if (cpu->guest_phys_bits == 0 ||
> +cpu->guest_phys_bits > guest_phys_bits) {
> +cpu->guest_phys_bits = guest_phys_bits;
> +}
> +
> +if (cpu->guest_phys_bits > cpu->host_phys_bits_limit) {
> +cpu->guest_phys_bits = cpu->host_phys_bits_limit;

host_phys_bits_limit is zero by default, so I think it is better to be
like:

if (cpu->host_phys_bits_limit &&
cpu->guest_phys_bits > cpu->host_phys_bits_limit) {
cpu->guest_phys_bits = cpu->host_phys_bits_limit;
}

> +}
> +}
> +
>  static bool kvm_cpu_realizefn(CPUState *cs, Error **errp)
>  {
>  X86CPU *cpu = X86_CPU(cs);
>  CPUX86State *env = >env;
> +bool ret;
>  
>  /*
>   * The realize order is important, since x86_cpu_realize() checks if
> @@ -50,7 +76,11 @@ static bool kvm_cpu_realizefn(CPUState *cs, Error **errp)
> MSR_IA32_UCODE_REV);
>  }
>  }
> -return host_cpu_realizefn(cs, errp);
> +ret = host_cpu_realizefn(cs, errp);
> +
> +kvm_set_guest_phys_bits(cs);
> +
> +return ret;
>  }
>  
>  static bool lmce_supported(void)
> -- 
> 2.44.0
> 
> 



Re: [PATCH] target/i386: Add new CPU model SierraForest

2024-03-13 Thread Tao Su
On Fri, Mar 08, 2024 at 05:36:52PM +0100, Igor Mammedov wrote:
> On Wed,  6 Dec 2023 21:19:23 +0800
> Tao Su  wrote:
> 
> > SierraForest is Intel's first generation E-core based Xeon server
> > processor, which will be released in the first half of 2024.
> > 
> > SierraForest mainly adds the following new features based on
> > GraniteRapids:
> > 
> 
> *) Please specify chapter/table where it says that CPU model got
> this features

I got it from table 1-2 in Intel Architecture Instruction Set Extensions
and Future Features (rev 051), I will add to next version.

> 
> > - CMPCCXADD CPUID.(EAX=7,ECX=1):EAX[bit 7]
> > - AVX-IFMA CPUID.(EAX=7,ECX=1):EAX[bit 23]
> > - AVX-VNNI-INT8 CPUID.(EAX=7,ECX=1):EDX[bit 4]
> > - AVX-NE-CONVERT CPUID.(EAX=7,ECX=1):EDX[bit 5]
> 
> > - LAM CPUID.(EAX=7,ECX=1):EAX[bit 26]
> > - LASS CPUID.(EAX=7,ECX=1):EAX[bit 6]
> this implies that series adds these bit but later you say it doesn't,
> it's confusing at best.
> 
> Also you've missed some other features mentioned in spec
> (for example: RDMSRLIST, UIRET, UC-Lock Disable, ENQCMD ...)
> so it makes above list even more inconsistent.
> Why some features were added while others not.

The above spec lists bare-metal features, but the virtualization patches
of some features still aren’t merged in mainline now, e.g. LAM and LASS.
CPU model only contains the features which have already been virtualized,
otherwise the unvirtualized features will trigger warning and be filtered.

>  
> 
> ditto [*] for removed +
> where it says that it's GraniteRapids based.
> 

The "based on" should be misleading, SierraForest and GraniteRapids have
completely different instruction sets and SierraForest is based on
Efficient-core, maybe "compared with" is more accurate. The below features
are captured from SierraForest real machine.

> > and removes the following features based on GraniteRapids:
> > 
> > - HLE CPUID.(EAX=7,ECX=0):EBX[bit 4]
> > - RTM CPUID.(EAX=7,ECX=0):EBX[bit 11]
> > - AVX512F CPUID.(EAX=7,ECX=0):EBX[bit 16]
> > - AVX512DQ CPUID.(EAX=7,ECX=0):EBX[bit 17]
> > - AVX512_IFMA CPUID.(EAX=7,ECX=0):EBX[bit 21]
> > - AVX512CD CPUID.(EAX=7,ECX=0):EBX[bit 28]
> > - AVX512BW CPUID.(EAX=7,ECX=0):EBX[bit 30]
> > - AVX512VL CPUID.(EAX=7,ECX=0):EBX[bit 31]
> > - AVX512_VBMI CPUID.(EAX=7,ECX=0):ECX[bit 1]
> > - AVX512_VBMI2 CPUID.(EAX=7,ECX=0):ECX[bit 6]
> > - AVX512_VNNI CPUID.(EAX=7,ECX=0):ECX[bit 11]
> > - AVX512_BITALG CPUID.(EAX=7,ECX=0):ECX[bit 12]
> > - AVX512_VPOPCNTDQ CPUID.(EAX=7,ECX=0):ECX[bit 14]
> > - LA57 CPUID.(EAX=7,ECX=0):ECX[bit 16]
> > - TSXLDTRK CPUID.(EAX=7,ECX=0):EDX[bit 16]
> > - AMX-BF16 CPUID.(EAX=7,ECX=0):EDX[bit 22]
> > - AVX512_FP16 CPUID.(EAX=7,ECX=0):EDX[bit 23]
> > - AMX-TILE CPUID.(EAX=7,ECX=0):EDX[bit 24]
> > - AMX-INT8 CPUID.(EAX=7,ECX=0):EDX[bit 25]
> > - AVX512_BF16 CPUID.(EAX=7,ECX=1):EAX[bit 5]
> > - fast zero-length MOVSB CPUID.(EAX=7,ECX=1):EAX[bit 10]
> > - fast short CMPSB, SCASB CPUID.(EAX=7,ECX=1):EAX[bit 12]
> > - AMX-FP16 CPUID.(EAX=7,ECX=1):EAX[bit 21]
> > - PREFETCHI CPUID.(EAX=7,ECX=1):EDX[bit 14]
> > - XFD CPUID.(EAX=0xD,ECX=1):EAX[bit 4]
> > - EPT_PAGE_WALK_LENGTH_5 VMX_EPT_VPID_CAP(0x48c)[bit 7]
> 
> 
> > SierraForest doesn't support TSX, so TSX Async Abort(TAA) vulnerabilities
> > don't exist on SierraForest. On KVM side, if host doesn't enumerate RTM
> > or RTM gets disabled, ARCH_CAP_TAA_NO is reported as unsupported. To
> > avoid the confusing warning:
> > warning: host doesn't support requested feature: MSR(10AH).taa-no
> >  [bit 8]
> > 
> > just don't include TAA_NO in SierraForest CPU model.
> 
> I probably missing something.
> 
> If host is Sierra Forest it won't have TSX and so TAA_NO, right?
> If so, then how above warning can be triggered and why SierraForest
> might have when it shouldn't?
> /me confused

Host doesn’t support TSX and RTM but supports TAA_NO. When RTM is not
enabled in host, KVM will not report TAA_NO. So, if adding TAA_NO to CPU
model, it will trigger warning and be filtered because KVM doesn’t report.

> 
> 
> > Currently LAM and LASS are not enabled in KVM mainline yet,  will add
> > them after merged.
> 
> if you add features in this series while kernel side is missing,
> wouldn't they be filtered out since kernel doesn't support  them yet?

Yes, they will be filtered, but they will trigger warning in QEMU.

> 
> > 
> > Signed-off-by: Tao Su 
> > ---
> > The new features can be found in Intel ISE[1].
> > LAM has just been accepted by KVM[2].
> > 
> > Although we would like to include all SierraFo

Re: [PATCH v2 2/2] kvm: add support for guest physical bits

2024-03-13 Thread Tao Su
On Tue, Mar 05, 2024 at 11:52:33AM +0100, Gerd Hoffmann wrote:
> Query kvm for supported guest physical address bits, in cpuid
> function 8008, eax[23:16].  Usually this is identical to host
> physical address bits.  With NPT or EPT being used this might be
> restricted to 48 (max 4-level paging address space size) even if
> the host cpu supports more physical address bits.
> 
> When set pass this to the guest, using cpuid too.  Guest firmware
> can use this to figure how big the usable guest physical address
> space is, so PCI bar mapping are actually reachable.

If this patch is applied, do you have plans to implement it in
OVMF/Seabios?

Thanks,
Tao

> 
> Signed-off-by: Gerd Hoffmann 
> ---
>  target/i386/cpu.h |  1 +
>  target/i386/cpu.c |  1 +
>  target/i386/kvm/kvm.c | 17 +
>  3 files changed, 19 insertions(+)
> 
> diff --git a/target/i386/cpu.h b/target/i386/cpu.h
> index 952174bb6f52..d427218827f6 100644
> --- a/target/i386/cpu.h
> +++ b/target/i386/cpu.h
> @@ -2026,6 +2026,7 @@ struct ArchCPU {
>  
>  /* Number of physical address bits supported */
>  uint32_t phys_bits;
> +uint32_t guest_phys_bits;
>  
>  /* in order to simplify APIC support, we leave this pointer to the
> user */
> diff --git a/target/i386/cpu.c b/target/i386/cpu.c
> index 2666ef380891..1a6cfc75951e 100644
> --- a/target/i386/cpu.c
> +++ b/target/i386/cpu.c
> @@ -6570,6 +6570,7 @@ void cpu_x86_cpuid(CPUX86State *env, uint32_t index, 
> uint32_t count,
>  if (env->features[FEAT_8000_0001_EDX] & CPUID_EXT2_LM) {
>  /* 64 bit processor */
>   *eax |= (cpu_x86_virtual_addr_width(env) << 8);
> + *eax |= (cpu->guest_phys_bits << 16);
>  }
>  *ebx = env->features[FEAT_8000_0008_EBX];
>  if (cs->nr_cores * cs->nr_threads > 1) {
> diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
> index 7298822cb511..ce22dfcaa661 100644
> --- a/target/i386/kvm/kvm.c
> +++ b/target/i386/kvm/kvm.c
> @@ -238,6 +238,15 @@ static int kvm_get_tsc(CPUState *cs)
>  return 0;
>  }
>  
> +/* return cpuid fn 8000_0008 eax[23:16] aka GuestPhysBits */
> +static int kvm_get_guest_phys_bits(KVMState *s)
> +{
> +uint32_t eax;
> +
> +eax = kvm_arch_get_supported_cpuid(s, 0x8008, 0, R_EAX);
> +return (eax >> 16) & 0xff;
> +}
> +
>  static inline void do_kvm_synchronize_tsc(CPUState *cpu, run_on_cpu_data arg)
>  {
>  kvm_get_tsc(cpu);
> @@ -1730,6 +1739,7 @@ int kvm_arch_init_vcpu(CPUState *cs)
>  X86CPU *cpu = X86_CPU(cs);
>  CPUX86State *env = >env;
>  uint32_t limit, i, j, cpuid_i;
> +uint32_t guest_phys_bits;
>  uint32_t unused;
>  struct kvm_cpuid_entry2 *c;
>  uint32_t signature[3];
> @@ -1765,6 +1775,13 @@ int kvm_arch_init_vcpu(CPUState *cs)
>  
>  env->apic_bus_freq = KVM_APIC_BUS_FREQUENCY;
>  
> +guest_phys_bits = kvm_get_guest_phys_bits(cs->kvm_state);
> +if (guest_phys_bits &&
> +(cpu->guest_phys_bits == 0 ||
> + cpu->guest_phys_bits > guest_phys_bits)) {
> +cpu->guest_phys_bits = guest_phys_bits;
> +}
> +
>  /*
>   * kvm_hyperv_expand_features() is called here for the second time in 
> case
>   * KVM_CAP_SYS_HYPERV_CPUID is not supported. While we can't possibly 
> handle
> -- 
> 2.44.0
> 
> 



Re: [PATCH 1/1] kvm: add support for guest physical bits

2024-03-03 Thread Tao Su
On Mon, Mar 04, 2024 at 09:54:40AM +0800, Xiaoyao Li wrote:
> On 3/1/2024 6:17 PM, Gerd Hoffmann wrote:
> > query kvm for supported guest physical address bits using
> > KVM_CAP_VM_GPA_BITS.  Expose the value to the guest via cpuid
> > (leaf 0x8008, eax, bits 16-23).
> > 
> > Signed-off-by: Gerd Hoffmann 
> > ---
> >   target/i386/cpu.h | 1 +
> >   target/i386/cpu.c | 1 +
> >   target/i386/kvm/kvm.c | 8 
> >   3 files changed, 10 insertions(+)
> > 
> > diff --git a/target/i386/cpu.h b/target/i386/cpu.h
> > index 952174bb6f52..d427218827f6 100644
> > --- a/target/i386/cpu.h
> > +++ b/target/i386/cpu.h
> > @@ -2026,6 +2026,7 @@ struct ArchCPU {
> >   /* Number of physical address bits supported */
> >   uint32_t phys_bits;
> > +uint32_t guest_phys_bits;
> >   /* in order to simplify APIC support, we leave this pointer to the
> >  user */
> > diff --git a/target/i386/cpu.c b/target/i386/cpu.c
> > index 2666ef380891..1a6cfc75951e 100644
> > --- a/target/i386/cpu.c
> > +++ b/target/i386/cpu.c
> > @@ -6570,6 +6570,7 @@ void cpu_x86_cpuid(CPUX86State *env, uint32_t index, 
> > uint32_t count,
> >   if (env->features[FEAT_8000_0001_EDX] & CPUID_EXT2_LM) {
> >   /* 64 bit processor */
> >*eax |= (cpu_x86_virtual_addr_width(env) << 8);
> > + *eax |= (cpu->guest_phys_bits << 16);
> 
> I think you misunderstand this field.
> 
> If you expose this field to guest, it's the information for nested guest.
> i.e., the guest itself runs as a hypervisor will know its nested guest can
> have guest_phys_bits for physical addr.

I'm also thinking about this issue...

Currently guest KVM doesn't use this field to advertise MAXPHYADDR because
nested guest hasn't tdp. And this patch only affects KVM hypervisor now.

Thanks,
Tao

> 
> >   }
> >   *ebx = env->features[FEAT_8000_0008_EBX];
> >   if (cs->nr_cores * cs->nr_threads > 1) {
> > diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
> > index 42970ab046fa..e06c9d66bb01 100644
> > --- a/target/i386/kvm/kvm.c
> > +++ b/target/i386/kvm/kvm.c
> > @@ -1716,6 +1716,7 @@ int kvm_arch_init_vcpu(CPUState *cs)
> >   X86CPU *cpu = X86_CPU(cs);
> >   CPUX86State *env = >env;
> >   uint32_t limit, i, j, cpuid_i;
> > +uint32_t guest_phys_bits;
> >   uint32_t unused;
> >   struct kvm_cpuid_entry2 *c;
> >   uint32_t signature[3];
> > @@ -1751,6 +1752,13 @@ int kvm_arch_init_vcpu(CPUState *cs)
> >   env->apic_bus_freq = KVM_APIC_BUS_FREQUENCY;
> > +guest_phys_bits = kvm_check_extension(cs->kvm_state, 
> > KVM_CAP_VM_GPA_BITS);
> > +if (guest_phys_bits &&
> > +(cpu->guest_phys_bits == 0 ||
> > + cpu->guest_phys_bits > guest_phys_bits)) {
> > +cpu->guest_phys_bits = guest_phys_bits;
> > +}
> > +
> >   /*
> >* kvm_hyperv_expand_features() is called here for the second time in 
> > case
> >* KVM_CAP_SYS_HYPERV_CPUID is not supported. While we can't possibly 
> > handle
> 
> 



Re: [PATCH v2 6/6] target/i386: Add new CPU model GraniteRapids

2024-01-31 Thread Tao Su
On Wed, Jan 31, 2024 at 01:34:31PM +0100, Igor Mammedov wrote:
> On Tue, 30 Jan 2024 21:34:36 +0800
> Tao Su  wrote:
> 
> > On Tue, Jan 30, 2024 at 11:14:59AM +0100, Igor Mammedov wrote:
> > > On Thu,  6 Jul 2023 13:49:49 +0800
> > > Tao Su  wrote:
> > >   
> > > > The GraniteRapids CPU model mainly adds the following new features
> > > > based on SapphireRapids:
> > > > - PREFETCHITI CPUID.(EAX=7,ECX=1):EDX[bit 14]
> > > > - AMX-FP16 CPUID.(EAX=7,ECX=1):EAX[bit 21]  
> > > 
> > > it seems the list/definition is not complete, see
> > > https://lore.kernel.org/kvm/20221125125845.1182922-1-jiaxi.c...@linux.intel.com/
> > > and those feature bits were merged into QEMU earlier 
> > > (a9ce107fd0f..d1a5143)
> > > 
> > > were they omited intentionaly?
> > >   
> > 
> > No, Jiaxi’s patch series includes new feature bits of both Granite 
> > Rapids(GNR)
> > and Sierra Forest(SRF).
> > 
> > GNR contains:
> > PREFETCHITI CPUID.(EAX=7,ECX=1):EDX[bit 14]
> > AMX-FP16 CPUID.(EAX=7,ECX=1):EAX[bit 21]
> > 
> > SRF contains:
> > CMPccXADD CPUID.(EAX=7,ECX=1):EAX[bit 7]
> > AVX-IFMA CPUID.(EAX=7,ECX=1):EAX[bit 23]
> > AVX-VNNI-INT8 CPUID.(EAX=7,ECX=1):EDX[bit 4]
> > AVX-NE-CONVERT CPUID.(EAX=7,ECX=1):EDX[bit 5]
> 
> > What new platforms support the new features can be found in Table 1-2 of 
> > ISE[1].
> > And the SRF CPU model we submitted[2] contains the four feature bits 
> > supported above.
> Thanks,
> 
> for future patches: 
> this kind of info should be part of commit message incl.
> spec/doc title/revision it's coming from with a specific
> chapter/table also mentioned. This way whoever reads it
> later won't have to ask or spend time for searching where
> it comes from.
> 
> And maybe also have a comment close to new code,
> aka like we do for ACPI patches.

Got it, thanks for the suggestion! This is really useful, I will do.

Thanks,
Tao

>  
> > [1] https://cdrdv2.intel.com/v1/dl/getContent/671368
> > [2] 
> > https://lore.kernel.org/all/20231206131923.1192066-1-tao1...@linux.intel.com/
> > 
> > Thanks,
> > Tao
> > 
> 



Re: [PATCH v2 6/6] target/i386: Add new CPU model GraniteRapids

2024-01-30 Thread Tao Su
On Tue, Jan 30, 2024 at 11:14:59AM +0100, Igor Mammedov wrote:
> On Thu,  6 Jul 2023 13:49:49 +0800
> Tao Su  wrote:
> 
> > The GraniteRapids CPU model mainly adds the following new features
> > based on SapphireRapids:
> > - PREFETCHITI CPUID.(EAX=7,ECX=1):EDX[bit 14]
> > - AMX-FP16 CPUID.(EAX=7,ECX=1):EAX[bit 21]
> 
> it seems the list/definition is not complete, see
> https://lore.kernel.org/kvm/20221125125845.1182922-1-jiaxi.c...@linux.intel.com/
> and those feature bits were merged into QEMU earlier 
> (a9ce107fd0f..d1a5143)
> 
> were they omited intentionaly?
> 

No, Jiaxi’s patch series includes new feature bits of both Granite Rapids(GNR)
and Sierra Forest(SRF).

GNR contains:
PREFETCHITI CPUID.(EAX=7,ECX=1):EDX[bit 14]
AMX-FP16 CPUID.(EAX=7,ECX=1):EAX[bit 21]

SRF contains:
CMPccXADD CPUID.(EAX=7,ECX=1):EAX[bit 7]
AVX-IFMA CPUID.(EAX=7,ECX=1):EAX[bit 23]
AVX-VNNI-INT8 CPUID.(EAX=7,ECX=1):EDX[bit 4]
AVX-NE-CONVERT CPUID.(EAX=7,ECX=1):EDX[bit 5]

What new platforms support the new features can be found in Table 1-2 of ISE[1].
And the SRF CPU model we submitted[2] contains the four feature bits supported 
above.

[1] https://cdrdv2.intel.com/v1/dl/getContent/671368
[2] 
https://lore.kernel.org/all/20231206131923.1192066-1-tao1...@linux.intel.com/

Thanks,
Tao



Re: [PATCH] target/i386: Add new CPU model SierraForest

2024-01-18 Thread Tao Su
Kindly ping for any comments.

Thanks,
Tao



[PATCH] target/i386: Add new CPU model SierraForest

2023-12-06 Thread Tao Su
SierraForest is Intel's first generation E-core based Xeon server
processor, which will be released in the first half of 2024.

SierraForest mainly adds the following new features based on
GraniteRapids:

- CMPCCXADD CPUID.(EAX=7,ECX=1):EAX[bit 7]
- AVX-IFMA CPUID.(EAX=7,ECX=1):EAX[bit 23]
- AVX-VNNI-INT8 CPUID.(EAX=7,ECX=1):EDX[bit 4]
- AVX-NE-CONVERT CPUID.(EAX=7,ECX=1):EDX[bit 5]
- LAM CPUID.(EAX=7,ECX=1):EAX[bit 26]
- LASS CPUID.(EAX=7,ECX=1):EAX[bit 6]

and removes the following features based on GraniteRapids:

- HLE CPUID.(EAX=7,ECX=0):EBX[bit 4]
- RTM CPUID.(EAX=7,ECX=0):EBX[bit 11]
- AVX512F CPUID.(EAX=7,ECX=0):EBX[bit 16]
- AVX512DQ CPUID.(EAX=7,ECX=0):EBX[bit 17]
- AVX512_IFMA CPUID.(EAX=7,ECX=0):EBX[bit 21]
- AVX512CD CPUID.(EAX=7,ECX=0):EBX[bit 28]
- AVX512BW CPUID.(EAX=7,ECX=0):EBX[bit 30]
- AVX512VL CPUID.(EAX=7,ECX=0):EBX[bit 31]
- AVX512_VBMI CPUID.(EAX=7,ECX=0):ECX[bit 1]
- AVX512_VBMI2 CPUID.(EAX=7,ECX=0):ECX[bit 6]
- AVX512_VNNI CPUID.(EAX=7,ECX=0):ECX[bit 11]
- AVX512_BITALG CPUID.(EAX=7,ECX=0):ECX[bit 12]
- AVX512_VPOPCNTDQ CPUID.(EAX=7,ECX=0):ECX[bit 14]
- LA57 CPUID.(EAX=7,ECX=0):ECX[bit 16]
- TSXLDTRK CPUID.(EAX=7,ECX=0):EDX[bit 16]
- AMX-BF16 CPUID.(EAX=7,ECX=0):EDX[bit 22]
- AVX512_FP16 CPUID.(EAX=7,ECX=0):EDX[bit 23]
- AMX-TILE CPUID.(EAX=7,ECX=0):EDX[bit 24]
- AMX-INT8 CPUID.(EAX=7,ECX=0):EDX[bit 25]
- AVX512_BF16 CPUID.(EAX=7,ECX=1):EAX[bit 5]
- fast zero-length MOVSB CPUID.(EAX=7,ECX=1):EAX[bit 10]
- fast short CMPSB, SCASB CPUID.(EAX=7,ECX=1):EAX[bit 12]
- AMX-FP16 CPUID.(EAX=7,ECX=1):EAX[bit 21]
- PREFETCHI CPUID.(EAX=7,ECX=1):EDX[bit 14]
- XFD CPUID.(EAX=0xD,ECX=1):EAX[bit 4]
- EPT_PAGE_WALK_LENGTH_5 VMX_EPT_VPID_CAP(0x48c)[bit 7]

SierraForest doesn't support TSX, so TSX Async Abort(TAA) vulnerabilities
don't exist on SierraForest. On KVM side, if host doesn't enumerate RTM
or RTM gets disabled, ARCH_CAP_TAA_NO is reported as unsupported. To
avoid the confusing warning:
warning: host doesn't support requested feature: MSR(10AH).taa-no
 [bit 8]

just don't include TAA_NO in SierraForest CPU model.

Currently LAM and LASS are not enabled in KVM mainline yet,  will add
them after merged.

Signed-off-by: Tao Su 
---
The new features can be found in Intel ISE[1].
LAM has just been accepted by KVM[2].

Although we would like to include all SierraForest features in the first
version of the CPU model, SierraForest will be released in the first half
of 2024[3], we would want user can have a first usable SierraForest CPU
model in the QEMU when they have the hardware in their hand.

[1] https://cdrdv2.intel.com/v1/dl/getContent/671368
[2]
https://lore.kernel.org/all/169810442917.2499338.3440694989716170017.b4...@google.com/
[3]
https://www.intel.com/content/www/us/en/newsroom/news/tackling-throughput-computing-sierra-forest.html
---
 target/i386/cpu.c | 126 ++
 1 file changed, 126 insertions(+)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index cd16cb893d..2405c9e407 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -4099,6 +4099,132 @@ static const X86CPUDefinition builtin_x86_defs[] = {
 { /* end of list */ },
 },
 },
+{
+.name = "SierraForest",
+.level = 0x23,
+.vendor = CPUID_VENDOR_INTEL,
+.family = 6,
+.model = 175,
+.stepping = 0,
+/*
+ * please keep the ascending order so that we can have a clear view of
+ * bit position of each feature.
+ */
+.features[FEAT_1_EDX] =
+CPUID_FP87 | CPUID_VME | CPUID_DE | CPUID_PSE | CPUID_TSC |
+CPUID_MSR | CPUID_PAE | CPUID_MCE | CPUID_CX8 | CPUID_APIC |
+CPUID_SEP | CPUID_MTRR | CPUID_PGE | CPUID_MCA | CPUID_CMOV |
+CPUID_PAT | CPUID_PSE36 | CPUID_CLFLUSH | CPUID_MMX | CPUID_FXSR |
+CPUID_SSE | CPUID_SSE2,
+.features[FEAT_1_ECX] =
+CPUID_EXT_SSE3 | CPUID_EXT_PCLMULQDQ | CPUID_EXT_SSSE3 |
+CPUID_EXT_FMA | CPUID_EXT_CX16 | CPUID_EXT_PCID | CPUID_EXT_SSE41 |
+CPUID_EXT_SSE42 | CPUID_EXT_X2APIC | CPUID_EXT_MOVBE |
+CPUID_EXT_POPCNT | CPUID_EXT_TSC_DEADLINE_TIMER | CPUID_EXT_AES |
+CPUID_EXT_XSAVE | CPUID_EXT_AVX | CPUID_EXT_F16C | 
CPUID_EXT_RDRAND,
+.features[FEAT_8000_0001_EDX] =
+CPUID_EXT2_SYSCALL | CPUID_EXT2_NX | CPUID_EXT2_PDPE1GB |
+CPUID_EXT2_RDTSCP | CPUID_EXT2_LM,
+.features[FEAT_8000_0001_ECX] =
+CPUID_EXT3_LAHF_LM | CPUID_EXT3_ABM | CPUID_EXT3_3DNOWPREFETCH,
+.features[FEAT_8000_0008_EBX] =
+CPUID_8000_0008_EBX_WBNOINVD,
+.features[FEAT_7_0_EBX] =
+CPUID_7_0_EBX_FSGSBASE | CPUID_7_0_EBX_BMI1 | CPUID_7_0_EBX_AVX2 |
+CPUID_7_0_EBX_SMEP | CPUID_7_0_EBX_BMI2 | CPUID_7_0_EBX_ERMS |
+CPUID_7_0_EBX_INVPCID | CPUID_7_0_EBX_RDSEED | CPUID_7_0_EBX_ADX |
+CPUID_7_0_EBX_SMAP | CPUID_7_0_EBX_

Re: [PATCH] target/i386: Add support for AMX-COMPLEX in CPUID enumeration

2023-08-30 Thread Tao Su
On Wed, Aug 30, 2023 at 12:41:11PM +0200, Paolo Bonzini wrote:
> Queued, thanks.

Thanks Paolo!



[PATCH] target/i386: Add support for AMX-COMPLEX in CPUID enumeration

2023-08-30 Thread Tao Su
Latest Intel platform GraniteRapids-D introduces AMX-COMPLEX, which adds
two instructions to perform matrix multiplication of two tiles containing
complex elements and accumulate the results into a packed single precision
tile.

AMX-COMPLEX is enumerated via CPUID.(EAX=7,ECX=1):EDX[bit 8]. Add the CPUID
definition for AMX-COMPLEX, AMX-COMPLEX will be enabled automatically when
using '-cpu host' and KVM advertises AMX-COMPLEX to userspace.

Signed-off-by: Tao Su 
Reviewed-by: Xiaoyao Li 
---
KVM part of advertising AMX-COMPLEX CPUID bit already has been applied to
kvm-x86 misc.

[1/1] KVM: x86: Advertise AMX-COMPLEX CPUID to userspace
  https://github.com/kvm-x86/linux/commit/99b668545356
---
 target/i386/cpu.c | 2 +-
 target/i386/cpu.h | 2 ++
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 00f913b638..24ee67b42d 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -980,7 +980,7 @@ FeatureWordInfo feature_word_info[FEATURE_WORDS] = {
 .feat_names = {
 NULL, NULL, NULL, NULL,
 "avx-vnni-int8", "avx-ne-convert", NULL, NULL,
-NULL, NULL, NULL, NULL,
+"amx-complex", NULL, NULL, NULL,
 NULL, NULL, "prefetchiti", NULL,
 NULL, NULL, NULL, NULL,
 NULL, NULL, NULL, NULL,
diff --git a/target/i386/cpu.h b/target/i386/cpu.h
index a6000e93bd..fbb05eace5 100644
--- a/target/i386/cpu.h
+++ b/target/i386/cpu.h
@@ -930,6 +930,8 @@ uint64_t x86_cpu_get_supported_feature_word(FeatureWord w,
 #define CPUID_7_1_EDX_AVX_VNNI_INT8 (1U << 4)
 /* AVX NE CONVERT Instructions */
 #define CPUID_7_1_EDX_AVX_NE_CONVERT(1U << 5)
+/* AMX COMPLEX Instructions */
+#define CPUID_7_1_EDX_AMX_COMPLEX   (1U << 8)
 /* PREFETCHIT0/1 Instructions */
 #define CPUID_7_1_EDX_PREFETCHITI   (1U << 14)
 

base-commit: 813bac3d8d70d85cb7835f7945eb9eed84c2d8d0
-- 
2.34.1




Re: [PATCH v2 0/6] Add new CPU model GraniteRapids

2023-07-07 Thread Tao Su
On Fri, Jul 07, 2023 at 12:52:37PM +0200, Paolo Bonzini wrote:
> Queued, thanks.

Paolo, thanks!

> 
> Paolo
> 



[PATCH v2 0/6] Add new CPU model GraniteRapids

2023-07-05 Thread Tao Su
This patch series mainly updates SapphireRapids CPU model and adds new
CPU model GraniteRapids.

Bit 13 (ARCH_CAP_SBDR_SSDP_NO), bit 14 (ARCH_CAP_FBSDP_NO) and bit 15
(ARCH_CAP_PSDP_NO) of MSR_IA32_ARCH_CAPABILITIES are enumerated starting
from SapphireRapids, which are missed in current SapphireRapids CPU model,
so add a new version for SapphireRapids CPU model to expose these bits.

GraniteRapids is Intel's successor to EmeraldRapids, an Intel 3 process
microarchitecture for enthusiasts and servers, which adds new features
based on SapphireRapids. The new features can be found in [1].

---

Changelog:

v2:
- Drop the same part of patch[2]
- Drop EmeraldRapids CPU model
- Change the commit messages to make these clear

v1: https://lore.kernel.org/all/20230616032311.19137-1-tao1...@linux.intel.com/

[1] https://cdrdv2.intel.com/v1/dl/getContent/671368
[2]
https://lore.kernel.org/all/63d85cc76d4cdc51e6c732478b81d8f13be11e5a.1687551881.git.pawan.kumar.gu...@linux.intel.com/


Lei Wang (1):
  target/i386: Add few security fix bits in ARCH_CAPABILITIES into
SapphireRapids CPU model

Tao Su (5):
  target/i386: Add FEAT_7_1_EDX to adjust feature level
  target/i386: Add support for MCDT_NO in CPUID enumeration
  target/i386: Allow MCDT_NO if host supports
  target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES
  target/i386: Add new CPU model GraniteRapids

 target/i386/cpu.c | 172 ++
 target/i386/cpu.h |   8 ++
 target/i386/kvm/kvm.c |   4 +
 3 files changed, 184 insertions(+)


base-commit: 2a6ae69154542caa91dd17c40fd3f5ffbec300de
-- 
2.34.1




[PATCH v2 3/6] target/i386: Allow MCDT_NO if host supports

2023-07-05 Thread Tao Su
MCDT_NO bit indicates HW contains the security fix and doesn't need to
be mitigated to avoid data-dependent behaviour for certain instructions.
It needs no hypervisor support. Treat it as supported regardless of what
KVM reports.

Signed-off-by: Tao Su 
Reviewed-by: Xiaoyao Li 
---
 target/i386/kvm/kvm.c | 4 
 1 file changed, 4 insertions(+)

diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
index de531842f6..ebfaf3d24c 100644
--- a/target/i386/kvm/kvm.c
+++ b/target/i386/kvm/kvm.c
@@ -432,6 +432,10 @@ uint32_t kvm_arch_get_supported_cpuid(KVMState *s, 
uint32_t function,
 uint32_t eax;
 host_cpuid(7, 1, , , , );
 ret |= eax & (CPUID_7_1_EAX_FZRM | CPUID_7_1_EAX_FSRS | 
CPUID_7_1_EAX_FSRC);
+} else if (function == 7 && index == 2 && reg == R_EDX) {
+uint32_t edx;
+host_cpuid(7, 2, , , , );
+ret |= edx & CPUID_7_2_EDX_MCDT_NO;
 } else if (function == 0xd && index == 0 &&
(reg == R_EAX || reg == R_EDX)) {
 /*
-- 
2.34.1




[PATCH v2 4/6] target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES

2023-07-05 Thread Tao Su
Currently, bit 13, 14, 15 and 24 of MSR_IA32_ARCH_CAPABILITIES are
disclosed for fixing security issues, so add those bit definitions.

Signed-off-by: Tao Su 
Reviewed-by: Igor Mammedov 
---
 target/i386/cpu.h | 4 
 1 file changed, 4 insertions(+)

diff --git a/target/i386/cpu.h b/target/i386/cpu.h
index c196b0a482..e0771a1043 100644
--- a/target/i386/cpu.h
+++ b/target/i386/cpu.h
@@ -1022,7 +1022,11 @@ uint64_t x86_cpu_get_supported_feature_word(FeatureWord 
w,
 #define MSR_ARCH_CAP_PSCHANGE_MC_NO (1U << 6)
 #define MSR_ARCH_CAP_TSX_CTRL_MSR   (1U << 7)
 #define MSR_ARCH_CAP_TAA_NO (1U << 8)
+#define MSR_ARCH_CAP_SBDR_SSDP_NO   (1U << 13)
+#define MSR_ARCH_CAP_FBSDP_NO   (1U << 14)
+#define MSR_ARCH_CAP_PSDP_NO(1U << 15)
 #define MSR_ARCH_CAP_FB_CLEAR   (1U << 17)
+#define MSR_ARCH_CAP_PBRSB_NO   (1U << 24)
 
 #define MSR_CORE_CAP_SPLIT_LOCK_DETECT  (1U << 5)
 
-- 
2.34.1




[PATCH v2 6/6] target/i386: Add new CPU model GraniteRapids

2023-07-05 Thread Tao Su
The GraniteRapids CPU model mainly adds the following new features
based on SapphireRapids:
- PREFETCHITI CPUID.(EAX=7,ECX=1):EDX[bit 14]
- AMX-FP16 CPUID.(EAX=7,ECX=1):EAX[bit 21]

And adds the following security fix for corresponding vulnerabilities:
- MCDT_NO CPUID.(EAX=7,ECX=2):EDX[bit 5]
- SBDR_SSDP_NO MSR_IA32_ARCH_CAPABILITIES[bit 13]
- FBSDP_NO MSR_IA32_ARCH_CAPABILITIES[bit 14]
- PSDP_NO MSR_IA32_ARCH_CAPABILITIES[bit 15]
- PBRSB_NO MSR_IA32_ARCH_CAPABILITIES[bit 24]

Signed-off-by: Tao Su 
Tested-by: Xuelian Guo 
Reviewed-by: Xiaoyao Li 
---
 target/i386/cpu.c | 136 ++
 1 file changed, 136 insertions(+)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index ec229072e7..97ad229d8b 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -3956,6 +3956,142 @@ static const X86CPUDefinition builtin_x86_defs[] = {
 { /* end of list */ }
 }
 },
+{
+.name = "GraniteRapids",
+.level = 0x20,
+.vendor = CPUID_VENDOR_INTEL,
+.family = 6,
+.model = 173,
+.stepping = 0,
+/*
+ * please keep the ascending order so that we can have a clear view of
+ * bit position of each feature.
+ */
+.features[FEAT_1_EDX] =
+CPUID_FP87 | CPUID_VME | CPUID_DE | CPUID_PSE | CPUID_TSC |
+CPUID_MSR | CPUID_PAE | CPUID_MCE | CPUID_CX8 | CPUID_APIC |
+CPUID_SEP | CPUID_MTRR | CPUID_PGE | CPUID_MCA | CPUID_CMOV |
+CPUID_PAT | CPUID_PSE36 | CPUID_CLFLUSH | CPUID_MMX | CPUID_FXSR |
+CPUID_SSE | CPUID_SSE2,
+.features[FEAT_1_ECX] =
+CPUID_EXT_SSE3 | CPUID_EXT_PCLMULQDQ | CPUID_EXT_SSSE3 |
+CPUID_EXT_FMA | CPUID_EXT_CX16 | CPUID_EXT_PCID | CPUID_EXT_SSE41 |
+CPUID_EXT_SSE42 | CPUID_EXT_X2APIC | CPUID_EXT_MOVBE |
+CPUID_EXT_POPCNT | CPUID_EXT_TSC_DEADLINE_TIMER | CPUID_EXT_AES |
+CPUID_EXT_XSAVE | CPUID_EXT_AVX | CPUID_EXT_F16C | 
CPUID_EXT_RDRAND,
+.features[FEAT_8000_0001_EDX] =
+CPUID_EXT2_SYSCALL | CPUID_EXT2_NX | CPUID_EXT2_PDPE1GB |
+CPUID_EXT2_RDTSCP | CPUID_EXT2_LM,
+.features[FEAT_8000_0001_ECX] =
+CPUID_EXT3_LAHF_LM | CPUID_EXT3_ABM | CPUID_EXT3_3DNOWPREFETCH,
+.features[FEAT_8000_0008_EBX] =
+CPUID_8000_0008_EBX_WBNOINVD,
+.features[FEAT_7_0_EBX] =
+CPUID_7_0_EBX_FSGSBASE | CPUID_7_0_EBX_BMI1 | CPUID_7_0_EBX_HLE |
+CPUID_7_0_EBX_AVX2 | CPUID_7_0_EBX_SMEP | CPUID_7_0_EBX_BMI2 |
+CPUID_7_0_EBX_ERMS | CPUID_7_0_EBX_INVPCID | CPUID_7_0_EBX_RTM |
+CPUID_7_0_EBX_AVX512F | CPUID_7_0_EBX_AVX512DQ |
+CPUID_7_0_EBX_RDSEED | CPUID_7_0_EBX_ADX | CPUID_7_0_EBX_SMAP |
+CPUID_7_0_EBX_AVX512IFMA | CPUID_7_0_EBX_CLFLUSHOPT |
+CPUID_7_0_EBX_CLWB | CPUID_7_0_EBX_AVX512CD | CPUID_7_0_EBX_SHA_NI 
|
+CPUID_7_0_EBX_AVX512BW | CPUID_7_0_EBX_AVX512VL,
+.features[FEAT_7_0_ECX] =
+CPUID_7_0_ECX_AVX512_VBMI | CPUID_7_0_ECX_UMIP | CPUID_7_0_ECX_PKU 
|
+CPUID_7_0_ECX_AVX512_VBMI2 | CPUID_7_0_ECX_GFNI |
+CPUID_7_0_ECX_VAES | CPUID_7_0_ECX_VPCLMULQDQ |
+CPUID_7_0_ECX_AVX512VNNI | CPUID_7_0_ECX_AVX512BITALG |
+CPUID_7_0_ECX_AVX512_VPOPCNTDQ | CPUID_7_0_ECX_LA57 |
+CPUID_7_0_ECX_RDPID | CPUID_7_0_ECX_BUS_LOCK_DETECT,
+.features[FEAT_7_0_EDX] =
+CPUID_7_0_EDX_FSRM | CPUID_7_0_EDX_SERIALIZE |
+CPUID_7_0_EDX_TSX_LDTRK | CPUID_7_0_EDX_AMX_BF16 |
+CPUID_7_0_EDX_AVX512_FP16 | CPUID_7_0_EDX_AMX_TILE |
+CPUID_7_0_EDX_AMX_INT8 | CPUID_7_0_EDX_SPEC_CTRL |
+CPUID_7_0_EDX_ARCH_CAPABILITIES | CPUID_7_0_EDX_SPEC_CTRL_SSBD,
+.features[FEAT_ARCH_CAPABILITIES] =
+MSR_ARCH_CAP_RDCL_NO | MSR_ARCH_CAP_IBRS_ALL |
+MSR_ARCH_CAP_SKIP_L1DFL_VMENTRY | MSR_ARCH_CAP_MDS_NO |
+MSR_ARCH_CAP_PSCHANGE_MC_NO | MSR_ARCH_CAP_TAA_NO |
+MSR_ARCH_CAP_SBDR_SSDP_NO | MSR_ARCH_CAP_FBSDP_NO |
+MSR_ARCH_CAP_PSDP_NO | MSR_ARCH_CAP_PBRSB_NO,
+.features[FEAT_XSAVE] =
+CPUID_XSAVE_XSAVEOPT | CPUID_XSAVE_XSAVEC |
+CPUID_XSAVE_XGETBV1 | CPUID_XSAVE_XSAVES | CPUID_D_1_EAX_XFD,
+.features[FEAT_6_EAX] =
+CPUID_6_EAX_ARAT,
+.features[FEAT_7_1_EAX] =
+CPUID_7_1_EAX_AVX_VNNI | CPUID_7_1_EAX_AVX512_BF16 |
+CPUID_7_1_EAX_FZRM | CPUID_7_1_EAX_FSRS | CPUID_7_1_EAX_FSRC |
+CPUID_7_1_EAX_AMX_FP16,
+.features[FEAT_7_1_EDX] =
+CPUID_7_1_EDX_PREFETCHITI,
+.features[FEAT_7_2_EDX] =
+CPUID_7_2_EDX_MCDT_NO,
+.features[FEAT_VMX_BASIC] =
+MSR_VMX_BASIC_INS_OUTS | MSR_VMX_BASIC_TRUE_CTLS,
+.features[FEAT_VMX_ENTRY_CTLS] =
+VMX_VM_ENTRY_LOAD_DEBUG_CONTROLS | VMX_VM_ENTRY_

[PATCH v2 2/6] target/i386: Add support for MCDT_NO in CPUID enumeration

2023-07-05 Thread Tao Su
CPUID.(EAX=7,ECX=2):EDX[bit 5] enumerates MCDT_NO. Processors enumerate
this bit as 1 do not exhibit MXCSR Configuration Dependent Timing (MCDT)
behavior and do not need to be mitigated to avoid data-dependent behavior
for certain instructions.

Since MCDT_NO is in a new sub-leaf, add a new CPUID feature word
FEAT_7_2_EDX. Also update cpuid_level_func7 by FEAT_7_2_EDX.

Signed-off-by: Tao Su 
Reviewed-by: Xiaoyao Li 
---
 target/i386/cpu.c | 26 ++
 target/i386/cpu.h |  4 
 2 files changed, 30 insertions(+)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 952744af97..852c45b965 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -739,6 +739,7 @@ void x86_cpu_vendor_words2str(char *dst, uint32_t vendor1,
 #define TCG_7_1_EAX_FEATURES (CPUID_7_1_EAX_FZRM | CPUID_7_1_EAX_FSRS | \
   CPUID_7_1_EAX_FSRC)
 #define TCG_7_1_EDX_FEATURES 0
+#define TCG_7_2_EDX_FEATURES 0
 #define TCG_APM_FEATURES 0
 #define TCG_6_EAX_FEATURES CPUID_6_EAX_ARAT
 #define TCG_XSAVE_FEATURES (CPUID_XSAVE_XSAVEOPT | CPUID_XSAVE_XGETBV1)
@@ -993,6 +994,25 @@ FeatureWordInfo feature_word_info[FEATURE_WORDS] = {
 },
 .tcg_features = TCG_7_1_EDX_FEATURES,
 },
+[FEAT_7_2_EDX] = {
+.type = CPUID_FEATURE_WORD,
+.feat_names = {
+NULL, NULL, NULL, NULL,
+NULL, "mcdt-no", NULL, NULL,
+NULL, NULL, NULL, NULL,
+NULL, NULL, NULL, NULL,
+NULL, NULL, NULL, NULL,
+NULL, NULL, NULL, NULL,
+NULL, NULL, NULL, NULL,
+NULL, NULL, NULL, NULL,
+},
+.cpuid = {
+.eax = 7,
+.needs_ecx = true, .ecx = 2,
+.reg = R_EDX,
+},
+.tcg_features = TCG_7_2_EDX_FEATURES,
+},
 [FEAT_8000_0007_EDX] = {
 .type = CPUID_FEATURE_WORD,
 .feat_names = {
@@ -6017,6 +6037,11 @@ void cpu_x86_cpuid(CPUX86State *env, uint32_t index, 
uint32_t count,
 *edx = env->features[FEAT_7_1_EDX];
 *ebx = 0;
 *ecx = 0;
+} else if (count == 2) {
+*edx = env->features[FEAT_7_2_EDX];
+*eax = 0;
+*ebx = 0;
+*ecx = 0;
 } else {
 *eax = 0;
 *ebx = 0;
@@ -6881,6 +6906,7 @@ void x86_cpu_expand_features(X86CPU *cpu, Error **errp)
 x86_cpu_adjust_feat_level(cpu, FEAT_7_0_ECX);
 x86_cpu_adjust_feat_level(cpu, FEAT_7_1_EAX);
 x86_cpu_adjust_feat_level(cpu, FEAT_7_1_EDX);
+x86_cpu_adjust_feat_level(cpu, FEAT_7_2_EDX);
 x86_cpu_adjust_feat_level(cpu, FEAT_8000_0001_EDX);
 x86_cpu_adjust_feat_level(cpu, FEAT_8000_0001_ECX);
 x86_cpu_adjust_feat_level(cpu, FEAT_8000_0007_EDX);
diff --git a/target/i386/cpu.h b/target/i386/cpu.h
index 2c9b0d2ebc..c196b0a482 100644
--- a/target/i386/cpu.h
+++ b/target/i386/cpu.h
@@ -628,6 +628,7 @@ typedef enum FeatureWord {
 FEAT_XSAVE_XSS_LO, /* CPUID[EAX=0xd,ECX=1].ECX */
 FEAT_XSAVE_XSS_HI, /* CPUID[EAX=0xd,ECX=1].EDX */
 FEAT_7_1_EDX,   /* CPUID[EAX=7,ECX=1].EDX */
+FEAT_7_2_EDX,   /* CPUID[EAX=7,ECX=2].EDX */
 FEATURE_WORDS,
 } FeatureWord;
 
@@ -932,6 +933,9 @@ uint64_t x86_cpu_get_supported_feature_word(FeatureWord w,
 /* PREFETCHIT0/1 Instructions */
 #define CPUID_7_1_EDX_PREFETCHITI   (1U << 14)
 
+/* Do not exhibit MXCSR Configuration Dependent Timing (MCDT) behavior */
+#define CPUID_7_2_EDX_MCDT_NO   (1U << 5)
+
 /* XFD Extend Feature Disabled */
 #define CPUID_D_1_EAX_XFD   (1U << 4)
 
-- 
2.34.1




[PATCH v2 1/6] target/i386: Add FEAT_7_1_EDX to adjust feature level

2023-07-05 Thread Tao Su
Considering the case of FEAT_7_1_EAX being 0 and FEAT_7_1_EDX being
non-zero. Such as starting a VM on GraniteRapids using '-cpu host',
we can see two leafs CPUID_7_0 and CPUID_7_1 in VM, because both
CPUID_7_1_EAX and CPUID_7_1_EDX have non-zero value, but if minus all
FEAT_7_1_EAX features using
'-cpu host,-avx-vnni,-avx512-bf16,-fzrm,-fsrs,-fsrc,-amx-fp16', we can't
get CPUID_7_1 leaf even though CPUID_7_1_EDX has non-zero value.

So it is necessary to update cpuid_level_func7 by CPUID_7_1_EDX, otherwise
guest may report wrong maximum number sub-leaves in leaf 07H.

Fixes: eaaa197d5b11 ("target/i386: Add support for AVX-VNNI-INT8 in CPUID
enumeration")

Signed-off-by: Tao Su 
Reviewed-by: Xiaoyao Li 
---
 target/i386/cpu.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index b5688cabb4..952744af97 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -6880,6 +6880,7 @@ void x86_cpu_expand_features(X86CPU *cpu, Error **errp)
 x86_cpu_adjust_feat_level(cpu, FEAT_6_EAX);
 x86_cpu_adjust_feat_level(cpu, FEAT_7_0_ECX);
 x86_cpu_adjust_feat_level(cpu, FEAT_7_1_EAX);
+x86_cpu_adjust_feat_level(cpu, FEAT_7_1_EDX);
 x86_cpu_adjust_feat_level(cpu, FEAT_8000_0001_EDX);
 x86_cpu_adjust_feat_level(cpu, FEAT_8000_0001_ECX);
 x86_cpu_adjust_feat_level(cpu, FEAT_8000_0007_EDX);
-- 
2.34.1




[PATCH v2 5/6] target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model

2023-07-05 Thread Tao Su
From: Lei Wang 

SapphireRapids has bit 13, 14 and 15 of MSR_IA32_ARCH_CAPABILITIES
enabled, which are related to some security fixes.

Add version 2 of SapphireRapids CPU model with those bits enabled also.

Signed-off-by: Lei Wang 
Signed-off-by: Tao Su 
---
 target/i386/cpu.c | 13 +++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 852c45b965..ec229072e7 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -3944,8 +3944,17 @@ static const X86CPUDefinition builtin_x86_defs[] = {
 .model_id = "Intel Xeon Processor (SapphireRapids)",
 .versions = (X86CPUVersionDefinition[]) {
 { .version = 1 },
-{ /* end of list */ },
-},
+{
+.version = 2,
+.props = (PropValue[]) {
+{ "sbdr-ssdp-no", "on" },
+{ "fbsdp-no", "on" },
+{ "psdp-no", "on" },
+{ /* end of list */ }
+}
+},
+{ /* end of list */ }
+}
 },
 {
 .name = "Denverton",
-- 
2.34.1




Re: [PATCH 7/7] target/i386: Add new CPU model GraniteRapids

2023-06-28 Thread Tao Su
On Tue, Jun 27, 2023 at 01:55:23PM +0200, Igor Mammedov wrote:
> On Fri, 16 Jun 2023 11:23:11 +0800
> Tao Su  wrote:
> 
> > The GraniteRapids CPU model mainly adds the following new features based
> > on SapphireRapids:
> > 
> > - PREFETCHITI CPUID.(EAX=7,ECX=1):EDX[bit 14]
> > - AMX-FP16 CPUID.(EAX=7,ECX=1):EAX[bit 21]
> > - MCDT_NO CPUID.(EAX=7,ECX=2):EDX[bit 5]
> > - SBDR_SSDP_NO MSR_IA32_ARCH_CAPABILITIES[bit 13]
> > - FBSDP_NO MSR_IA32_ARCH_CAPABILITIES[bit 14]
> > - PSDP_NO MSR_IA32_ARCH_CAPABILITIES[bit 15]
> > - PBRSB_NO MSR_IA32_ARCH_CAPABILITIES[bit 24]
> 
> Can you point me to a some doc where above features
> are are documented as being introduced by GraniteRapids?

Sure. For PREFETCHITI and AMX-FP16, Intel ISE[1] lists them as GraniteRapids new
features, but the last five mainly indicate the HW contains the security fix for
corresponding vulnerabilities, which not list there. I dump the CPUIDs/MSRs
from the physical machine and get these added features.

[1] https://cdrdv2.intel.com/v1/dl/getContent/671368

Thanks,
Tao

> 
>  
> > Signed-off-by: Tao Su 
> > Tested-by: Xuelian Guo 
> > Reviewed-by: Xiaoyao Li 
> > ---
> >  target/i386/cpu.c | 136 ++
> >  1 file changed, 136 insertions(+)
> > 
> > diff --git a/target/i386/cpu.c b/target/i386/cpu.c
> > index 7faf6dfaee..860106fc24 100644
> > --- a/target/i386/cpu.c
> > +++ b/target/i386/cpu.c
> > @@ -3993,6 +3993,142 @@ static const X86CPUDefinition builtin_x86_defs[] = {
> >  { /* end of list */ },
> >  },
> >  },
> > +{
> > +.name = "GraniteRapids",
> > +.level = 0x20,
> > +.vendor = CPUID_VENDOR_INTEL,
> > +.family = 6,
> > +.model = 173,
> > +.stepping = 0,
> > +/*
> > + * please keep the ascending order so that we can have a clear 
> > view of
> > + * bit position of each feature.
> > + */
> > +.features[FEAT_1_EDX] =
> > +CPUID_FP87 | CPUID_VME | CPUID_DE | CPUID_PSE | CPUID_TSC |
> > +CPUID_MSR | CPUID_PAE | CPUID_MCE | CPUID_CX8 | CPUID_APIC |
> > +CPUID_SEP | CPUID_MTRR | CPUID_PGE | CPUID_MCA | CPUID_CMOV |
> > +CPUID_PAT | CPUID_PSE36 | CPUID_CLFLUSH | CPUID_MMX | 
> > CPUID_FXSR |
> > +CPUID_SSE | CPUID_SSE2,
> > +.features[FEAT_1_ECX] =
> > +CPUID_EXT_SSE3 | CPUID_EXT_PCLMULQDQ | CPUID_EXT_SSSE3 |
> > +CPUID_EXT_FMA | CPUID_EXT_CX16 | CPUID_EXT_PCID | 
> > CPUID_EXT_SSE41 |
> > +CPUID_EXT_SSE42 | CPUID_EXT_X2APIC | CPUID_EXT_MOVBE |
> > +CPUID_EXT_POPCNT | CPUID_EXT_TSC_DEADLINE_TIMER | 
> > CPUID_EXT_AES |
> > +CPUID_EXT_XSAVE | CPUID_EXT_AVX | CPUID_EXT_F16C | 
> > CPUID_EXT_RDRAND,
> > +.features[FEAT_8000_0001_EDX] =
> > +CPUID_EXT2_SYSCALL | CPUID_EXT2_NX | CPUID_EXT2_PDPE1GB |
> > +CPUID_EXT2_RDTSCP | CPUID_EXT2_LM,
> > +.features[FEAT_8000_0001_ECX] =
> > +CPUID_EXT3_LAHF_LM | CPUID_EXT3_ABM | CPUID_EXT3_3DNOWPREFETCH,
> > +.features[FEAT_8000_0008_EBX] =
> > +CPUID_8000_0008_EBX_WBNOINVD,
> > +.features[FEAT_7_0_EBX] =
> > +CPUID_7_0_EBX_FSGSBASE | CPUID_7_0_EBX_BMI1 | 
> > CPUID_7_0_EBX_HLE |
> > +CPUID_7_0_EBX_AVX2 | CPUID_7_0_EBX_SMEP | CPUID_7_0_EBX_BMI2 |
> > +CPUID_7_0_EBX_ERMS | CPUID_7_0_EBX_INVPCID | CPUID_7_0_EBX_RTM 
> > |
> > +CPUID_7_0_EBX_AVX512F | CPUID_7_0_EBX_AVX512DQ |
> > +CPUID_7_0_EBX_RDSEED | CPUID_7_0_EBX_ADX | CPUID_7_0_EBX_SMAP |
> > +CPUID_7_0_EBX_AVX512IFMA | CPUID_7_0_EBX_CLFLUSHOPT |
> > +CPUID_7_0_EBX_CLWB | CPUID_7_0_EBX_AVX512CD | 
> > CPUID_7_0_EBX_SHA_NI |
> > +CPUID_7_0_EBX_AVX512BW | CPUID_7_0_EBX_AVX512VL,
> > +.features[FEAT_7_0_ECX] =
> > +CPUID_7_0_ECX_AVX512_VBMI | CPUID_7_0_ECX_UMIP | 
> > CPUID_7_0_ECX_PKU |
> > +CPUID_7_0_ECX_AVX512_VBMI2 | CPUID_7_0_ECX_GFNI |
> > +CPUID_7_0_ECX_VAES | CPUID_7_0_ECX_VPCLMULQDQ |
> > +CPUID_7_0_ECX_AVX512VNNI | CPUID_7_0_ECX_AVX512BITALG |
> > +CPUID_7_0_ECX_AVX512_VPOPCNTDQ | CPUID_7_0_ECX_LA57 |
> > +CPUID_7_0_ECX_RDPID | CPUID_7_0_ECX_BUS_LOCK_DETECT,
> > +.features[FEAT_7_0_EDX] =
> > +CPUID_7_0_EDX_FSRM | CPUID_7_0_EDX_SERIALIZE |
> > +  

Re: [PATCH 3/7] target/i386: Allow MCDT_NO if host supports

2023-06-26 Thread Tao Su
On Mon, Jun 26, 2023 at 03:03:12PM +0200, Igor Mammedov wrote:
> On Fri, 16 Jun 2023 11:23:07 +0800
> Tao Su  wrote:
> 
> > MCDT_NO bit indicates HW contains the security fix and doesn't need to
> > be mitigated to avoid data-dependent behaviour for certain instructions.
> > It needs no hypervisor support. Treat it as supported regardless of what
> > KVM reports.
> > 
> > Signed-off-by: Tao Su 
> > Reviewed-by: Xiaoyao Li 
> > ---
> >  target/i386/kvm/kvm.c | 5 +
> >  1 file changed, 5 insertions(+)
> > 
> > diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
> > index de531842f6..4defd8b479 100644
> > --- a/target/i386/kvm/kvm.c
> > +++ b/target/i386/kvm/kvm.c
> > @@ -432,6 +432,11 @@ uint32_t kvm_arch_get_supported_cpuid(KVMState *s, 
> > uint32_t function,
> >  uint32_t eax;
> >  host_cpuid(7, 1, , , , );
> >  ret |= eax & (CPUID_7_1_EAX_FZRM | CPUID_7_1_EAX_FSRS | 
> > CPUID_7_1_EAX_FSRC);
> > +} else if (function == 7 && index == 2 && reg == R_EDX) {
> 
> > +/* Not new instructions, just an optimization.  */
> comment doesn't make much sense to me, just drop it or
> describe what MCDT_NO is/mitigates.

Ok, I will drop it in the next version, thanks!

> 
> > +uint32_t edx;
> > +host_cpuid(7, 2, , , , );
> > +ret |= edx & CPUID_7_2_EDX_MCDT_NO;
> >  } else if (function == 0xd && index == 0 &&
> > (reg == R_EAX || reg == R_EDX)) {
> >  /*
> 
> 



Re: [PATCH 1/7] target/i386: Add FEAT_7_1_EDX to adjust feature level

2023-06-26 Thread Tao Su
On Mon, Jun 26, 2023 at 02:39:15PM +0200, Igor Mammedov wrote:
> On Fri, 16 Jun 2023 11:23:05 +0800
> Tao Su  wrote:
> 
> > Considering the case of FEAT_7_1_EAX being 0 and FEAT_7_1_EDX being
> > non-zero,
> Can you clarify when/why that happens?

When start a VM on GraniteRapids using '-cpu host', we can see two leafs 
CPUID_7_0
and CPUID_7_1 in VM, because both CPUID_7_1_EAX and CPUID_7_1_EDX have non-zero 
value:
0x0007 0x01: eax=0x00201c30 edx=0x4000

But if we minus all FEAT_7_1_EAX features using
'-cpu host,-avx-vnni,-avx512-bf16,-fzrm,-fsrs,-fsrc,-amx-fp16', we can't get 
CPUID_7_1
leaf even though CPUID_7_1_EDX has non-zero value, so it is necessary to update
cpuid_level_func7 by CPUID_7_1_EDX.

Thanks,
Tao

> 
> > guest may report wrong maximum number sub-leaves in leaf
> > 07H. So add FEAT_7_1_EDX to adjust feature level.
> > 
> > Fixes: eaaa197d5b11 ("target/i386: Add support for AVX-VNNI-INT8 in CPUID
> > enumeration")
> > 
> > Signed-off-by: Tao Su 
> > Reviewed-by: Xiaoyao Li 
> > ---
> >  target/i386/cpu.c | 1 +
> >  1 file changed, 1 insertion(+)
> > 
> > diff --git a/target/i386/cpu.c b/target/i386/cpu.c
> > index 1242bd541a..e8a70c35d2 100644
> > --- a/target/i386/cpu.c
> > +++ b/target/i386/cpu.c
> > @@ -6778,6 +6778,7 @@ void x86_cpu_expand_features(X86CPU *cpu, Error 
> > **errp)
> >  x86_cpu_adjust_feat_level(cpu, FEAT_6_EAX);
> >  x86_cpu_adjust_feat_level(cpu, FEAT_7_0_ECX);
> >  x86_cpu_adjust_feat_level(cpu, FEAT_7_1_EAX);
> > +x86_cpu_adjust_feat_level(cpu, FEAT_7_1_EDX);
> >  x86_cpu_adjust_feat_level(cpu, FEAT_8000_0001_EDX);
> >  x86_cpu_adjust_feat_level(cpu, FEAT_8000_0001_ECX);
> >  x86_cpu_adjust_feat_level(cpu, FEAT_8000_0007_EDX);
> 
> 



Re: [PATCH 0/7] Add new CPU model EmeraldRapids and GraniteRapids

2023-06-15 Thread Tao Su
On Fri, Jun 16, 2023 at 12:01:52PM +0800, Wang, Lei wrote:
> On 6/16/2023 11:23, Tao Su wrote:
> > This patch series mainly updates SapphireRapids CPU model and adds
> > new CPU model EmeraldRapids and GraniteRapids.
> > 
> > Bit 13 (ARCH_CAP_FBSDP_NO), bit 14 (ARCH_CAP_FBSDP_NO) and bit 15
> 
> Bit 13 should be MSR_ARCH_CAP_SBDR_SSDP_NO, right?

Yes, copied by mistake, thanks!

Tao

> 
> > (ARCH_CAP_PSDP_NO) of MSR_IA32_ARCH_CAPABILITIES are enumerated starting
> > from latest SapphireRapids, which are missed in current SapphireRapids
> > CPU model, so add a new version for SapphireRapids CPU model to expose
> > these bits.
> > 
> > Add EmeraldRapids CPU model to this series, since EmeraldRapids also
> > enumerates these bits. The original patch of EmeraldRapids CPU model is
> > in [1].
> > 
> > GraniteRapids is Intel's successor to EmeraldRapids, an Intel 3 process
> > microarchitecture for enthusiasts and servers, which adds new features
> > based on SapphireRapids and EmeraldRapids.
> > 
> > [1]
> > https://lore.kernel.org/qemu-devel/20230515025308.1050277-1-qian@intel.com/
> > 
> > Lei Wang (1):
> >   target/i386: Add few security fix bits in ARCH_CAPABILITIES into
> > SapphireRapids CPU model
> > 
> > Qian Wen (1):
> >   target/i386: Add new CPU model EmeraldRapids
> > 
> > Tao Su (5):
> >   target/i386: Add FEAT_7_1_EDX to adjust feature level
> >   target/i386: Add support for MCDT_NO in CPUID enumeration
> >   target/i386: Allow MCDT_NO if host supports
> >   target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES
> >   target/i386: Add new CPU model GraniteRapids
> > 
> >  target/i386/cpu.c | 303 +-
> >  target/i386/cpu.h |   8 ++
> >  target/i386/kvm/kvm.c |   5 +
> >  3 files changed, 314 insertions(+), 2 deletions(-)
> > 
> > 
> > base-commit: 7efd65423ab22e6f5890ca08ae40c84d6660242f



[PATCH 0/7] Add new CPU model EmeraldRapids and GraniteRapids

2023-06-15 Thread Tao Su
This patch series mainly updates SapphireRapids CPU model and adds
new CPU model EmeraldRapids and GraniteRapids.

Bit 13 (ARCH_CAP_FBSDP_NO), bit 14 (ARCH_CAP_FBSDP_NO) and bit 15
(ARCH_CAP_PSDP_NO) of MSR_IA32_ARCH_CAPABILITIES are enumerated starting
from latest SapphireRapids, which are missed in current SapphireRapids
CPU model, so add a new version for SapphireRapids CPU model to expose
these bits.

Add EmeraldRapids CPU model to this series, since EmeraldRapids also
enumerates these bits. The original patch of EmeraldRapids CPU model is
in [1].

GraniteRapids is Intel's successor to EmeraldRapids, an Intel 3 process
microarchitecture for enthusiasts and servers, which adds new features
based on SapphireRapids and EmeraldRapids.

[1]
https://lore.kernel.org/qemu-devel/20230515025308.1050277-1-qian@intel.com/

Lei Wang (1):
  target/i386: Add few security fix bits in ARCH_CAPABILITIES into
SapphireRapids CPU model

Qian Wen (1):
  target/i386: Add new CPU model EmeraldRapids

Tao Su (5):
  target/i386: Add FEAT_7_1_EDX to adjust feature level
  target/i386: Add support for MCDT_NO in CPUID enumeration
  target/i386: Allow MCDT_NO if host supports
  target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES
  target/i386: Add new CPU model GraniteRapids

 target/i386/cpu.c | 303 +-
 target/i386/cpu.h |   8 ++
 target/i386/kvm/kvm.c |   5 +
 3 files changed, 314 insertions(+), 2 deletions(-)


base-commit: 7efd65423ab22e6f5890ca08ae40c84d6660242f
-- 
2.34.1




[PATCH 3/7] target/i386: Allow MCDT_NO if host supports

2023-06-15 Thread Tao Su
MCDT_NO bit indicates HW contains the security fix and doesn't need to
be mitigated to avoid data-dependent behaviour for certain instructions.
It needs no hypervisor support. Treat it as supported regardless of what
KVM reports.

Signed-off-by: Tao Su 
Reviewed-by: Xiaoyao Li 
---
 target/i386/kvm/kvm.c | 5 +
 1 file changed, 5 insertions(+)

diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
index de531842f6..4defd8b479 100644
--- a/target/i386/kvm/kvm.c
+++ b/target/i386/kvm/kvm.c
@@ -432,6 +432,11 @@ uint32_t kvm_arch_get_supported_cpuid(KVMState *s, 
uint32_t function,
 uint32_t eax;
 host_cpuid(7, 1, , , , );
 ret |= eax & (CPUID_7_1_EAX_FZRM | CPUID_7_1_EAX_FSRS | 
CPUID_7_1_EAX_FSRC);
+} else if (function == 7 && index == 2 && reg == R_EDX) {
+/* Not new instructions, just an optimization.  */
+uint32_t edx;
+host_cpuid(7, 2, , , , );
+ret |= edx & CPUID_7_2_EDX_MCDT_NO;
 } else if (function == 0xd && index == 0 &&
(reg == R_EAX || reg == R_EDX)) {
 /*
-- 
2.34.1




[PATCH 4/7] target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES

2023-06-15 Thread Tao Su
Currently, bit 13, 14, 15 and 24 of MSR_IA32_ARCH_CAPABILITIES are
disclosed for fixing security issues, so add those bit definitions
and feature names.

Signed-off-by: Tao Su 
---
 target/i386/cpu.c | 4 ++--
 target/i386/cpu.h | 4 
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 7898a4c79a..b5321240c6 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -1069,10 +1069,10 @@ FeatureWordInfo feature_word_info[FEATURE_WORDS] = {
 "rdctl-no", "ibrs-all", "rsba", "skip-l1dfl-vmentry",
 "ssb-no", "mds-no", "pschange-mc-no", "tsx-ctrl",
 "taa-no", NULL, NULL, NULL,
-NULL, NULL, NULL, NULL,
+NULL, "sbdr-ssdp-no", "fbsdp-no", "psdp-no",
 NULL, "fb-clear", NULL, NULL,
 NULL, NULL, NULL, NULL,
-NULL, NULL, NULL, NULL,
+"pbrsb-no", NULL, NULL, NULL,
 NULL, NULL, NULL, NULL,
 },
 .msr = {
diff --git a/target/i386/cpu.h b/target/i386/cpu.h
index 64d50acf41..6221b1c0a4 100644
--- a/target/i386/cpu.h
+++ b/target/i386/cpu.h
@@ -1022,7 +1022,11 @@ uint64_t x86_cpu_get_supported_feature_word(FeatureWord 
w,
 #define MSR_ARCH_CAP_PSCHANGE_MC_NO (1U << 6)
 #define MSR_ARCH_CAP_TSX_CTRL_MSR   (1U << 7)
 #define MSR_ARCH_CAP_TAA_NO (1U << 8)
+#define MSR_ARCH_CAP_SBDR_SSDP_NO   (1u << 13)
+#define MSR_ARCH_CAP_FBSDP_NO   (1u << 14)
+#define MSR_ARCH_CAP_PSDP_NO(1u << 15)
 #define MSR_ARCH_CAP_FB_CLEAR   (1U << 17)
+#define MSR_ARCH_CAP_PBRSB_NO   (1U << 24)
 
 #define MSR_CORE_CAP_SPLIT_LOCK_DETECT  (1U << 5)
 
-- 
2.34.1




[PATCH 7/7] target/i386: Add new CPU model GraniteRapids

2023-06-15 Thread Tao Su
The GraniteRapids CPU model mainly adds the following new features based
on SapphireRapids:

- PREFETCHITI CPUID.(EAX=7,ECX=1):EDX[bit 14]
- AMX-FP16 CPUID.(EAX=7,ECX=1):EAX[bit 21]
- MCDT_NO CPUID.(EAX=7,ECX=2):EDX[bit 5]
- SBDR_SSDP_NO MSR_IA32_ARCH_CAPABILITIES[bit 13]
- FBSDP_NO MSR_IA32_ARCH_CAPABILITIES[bit 14]
- PSDP_NO MSR_IA32_ARCH_CAPABILITIES[bit 15]
- PBRSB_NO MSR_IA32_ARCH_CAPABILITIES[bit 24]

Signed-off-by: Tao Su 
Tested-by: Xuelian Guo 
Reviewed-by: Xiaoyao Li 
---
 target/i386/cpu.c | 136 ++
 1 file changed, 136 insertions(+)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 7faf6dfaee..860106fc24 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -3993,6 +3993,142 @@ static const X86CPUDefinition builtin_x86_defs[] = {
 { /* end of list */ },
 },
 },
+{
+.name = "GraniteRapids",
+.level = 0x20,
+.vendor = CPUID_VENDOR_INTEL,
+.family = 6,
+.model = 173,
+.stepping = 0,
+/*
+ * please keep the ascending order so that we can have a clear view of
+ * bit position of each feature.
+ */
+.features[FEAT_1_EDX] =
+CPUID_FP87 | CPUID_VME | CPUID_DE | CPUID_PSE | CPUID_TSC |
+CPUID_MSR | CPUID_PAE | CPUID_MCE | CPUID_CX8 | CPUID_APIC |
+CPUID_SEP | CPUID_MTRR | CPUID_PGE | CPUID_MCA | CPUID_CMOV |
+CPUID_PAT | CPUID_PSE36 | CPUID_CLFLUSH | CPUID_MMX | CPUID_FXSR |
+CPUID_SSE | CPUID_SSE2,
+.features[FEAT_1_ECX] =
+CPUID_EXT_SSE3 | CPUID_EXT_PCLMULQDQ | CPUID_EXT_SSSE3 |
+CPUID_EXT_FMA | CPUID_EXT_CX16 | CPUID_EXT_PCID | CPUID_EXT_SSE41 |
+CPUID_EXT_SSE42 | CPUID_EXT_X2APIC | CPUID_EXT_MOVBE |
+CPUID_EXT_POPCNT | CPUID_EXT_TSC_DEADLINE_TIMER | CPUID_EXT_AES |
+CPUID_EXT_XSAVE | CPUID_EXT_AVX | CPUID_EXT_F16C | 
CPUID_EXT_RDRAND,
+.features[FEAT_8000_0001_EDX] =
+CPUID_EXT2_SYSCALL | CPUID_EXT2_NX | CPUID_EXT2_PDPE1GB |
+CPUID_EXT2_RDTSCP | CPUID_EXT2_LM,
+.features[FEAT_8000_0001_ECX] =
+CPUID_EXT3_LAHF_LM | CPUID_EXT3_ABM | CPUID_EXT3_3DNOWPREFETCH,
+.features[FEAT_8000_0008_EBX] =
+CPUID_8000_0008_EBX_WBNOINVD,
+.features[FEAT_7_0_EBX] =
+CPUID_7_0_EBX_FSGSBASE | CPUID_7_0_EBX_BMI1 | CPUID_7_0_EBX_HLE |
+CPUID_7_0_EBX_AVX2 | CPUID_7_0_EBX_SMEP | CPUID_7_0_EBX_BMI2 |
+CPUID_7_0_EBX_ERMS | CPUID_7_0_EBX_INVPCID | CPUID_7_0_EBX_RTM |
+CPUID_7_0_EBX_AVX512F | CPUID_7_0_EBX_AVX512DQ |
+CPUID_7_0_EBX_RDSEED | CPUID_7_0_EBX_ADX | CPUID_7_0_EBX_SMAP |
+CPUID_7_0_EBX_AVX512IFMA | CPUID_7_0_EBX_CLFLUSHOPT |
+CPUID_7_0_EBX_CLWB | CPUID_7_0_EBX_AVX512CD | CPUID_7_0_EBX_SHA_NI 
|
+CPUID_7_0_EBX_AVX512BW | CPUID_7_0_EBX_AVX512VL,
+.features[FEAT_7_0_ECX] =
+CPUID_7_0_ECX_AVX512_VBMI | CPUID_7_0_ECX_UMIP | CPUID_7_0_ECX_PKU 
|
+CPUID_7_0_ECX_AVX512_VBMI2 | CPUID_7_0_ECX_GFNI |
+CPUID_7_0_ECX_VAES | CPUID_7_0_ECX_VPCLMULQDQ |
+CPUID_7_0_ECX_AVX512VNNI | CPUID_7_0_ECX_AVX512BITALG |
+CPUID_7_0_ECX_AVX512_VPOPCNTDQ | CPUID_7_0_ECX_LA57 |
+CPUID_7_0_ECX_RDPID | CPUID_7_0_ECX_BUS_LOCK_DETECT,
+.features[FEAT_7_0_EDX] =
+CPUID_7_0_EDX_FSRM | CPUID_7_0_EDX_SERIALIZE |
+CPUID_7_0_EDX_TSX_LDTRK | CPUID_7_0_EDX_AMX_BF16 |
+CPUID_7_0_EDX_AVX512_FP16 | CPUID_7_0_EDX_AMX_TILE |
+CPUID_7_0_EDX_AMX_INT8 | CPUID_7_0_EDX_SPEC_CTRL |
+CPUID_7_0_EDX_ARCH_CAPABILITIES | CPUID_7_0_EDX_SPEC_CTRL_SSBD,
+.features[FEAT_ARCH_CAPABILITIES] =
+MSR_ARCH_CAP_RDCL_NO | MSR_ARCH_CAP_IBRS_ALL |
+MSR_ARCH_CAP_SKIP_L1DFL_VMENTRY | MSR_ARCH_CAP_MDS_NO |
+MSR_ARCH_CAP_PSCHANGE_MC_NO | MSR_ARCH_CAP_TAA_NO |
+MSR_ARCH_CAP_SBDR_SSDP_NO | MSR_ARCH_CAP_FBSDP_NO |
+MSR_ARCH_CAP_PSDP_NO | MSR_ARCH_CAP_PBRSB_NO,
+.features[FEAT_XSAVE] =
+CPUID_XSAVE_XSAVEOPT | CPUID_XSAVE_XSAVEC |
+CPUID_XSAVE_XGETBV1 | CPUID_XSAVE_XSAVES | CPUID_D_1_EAX_XFD,
+.features[FEAT_6_EAX] =
+CPUID_6_EAX_ARAT,
+.features[FEAT_7_1_EAX] =
+CPUID_7_1_EAX_AVX_VNNI | CPUID_7_1_EAX_AVX512_BF16 |
+CPUID_7_1_EAX_FZRM | CPUID_7_1_EAX_FSRS | CPUID_7_1_EAX_FSRC |
+CPUID_7_1_EAX_AMX_FP16,
+.features[FEAT_7_1_EDX] =
+CPUID_7_1_EDX_PREFETCHITI,
+.features[FEAT_7_2_EDX] =
+CPUID_7_2_EDX_MCDT_NO,
+.features[FEAT_VMX_BASIC] =
+MSR_VMX_BASIC_INS_OUTS | MSR_VMX_BASIC_TRUE_CTLS,
+.features[FEAT_VMX_ENTRY_CTLS] =
+VMX_VM_ENTRY_LOAD_DEBUG_CONTROLS | VMX_VM_ENTRY_IA32E_MODE |
+VMX_VM_ENTRY_LOAD_IA32_PERF_G

[PATCH 5/7] target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model

2023-06-15 Thread Tao Su
From: Lei Wang 

Latest stepping (8) of SapphireRapids has bit 13, 14 and 15 of
MSR_IA32_ARCH_CAPABILITIES enabled, which are related to some security
fixes.

Add version 2 of SapphireRapids CPU model with those bits enabled also.

Signed-off-by: Lei Wang 
Signed-off-by: Tao Su 
---
 target/i386/cpu.c | 13 +++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index b5321240c6..f84fd20bb1 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -3854,8 +3854,17 @@ static const X86CPUDefinition builtin_x86_defs[] = {
 .model_id = "Intel Xeon Processor (SapphireRapids)",
 .versions = (X86CPUVersionDefinition[]) {
 { .version = 1 },
-{ /* end of list */ },
-},
+{
+.version = 2,
+.props = (PropValue[]) {
+{ "sbdr-ssdp-no", "on" },
+{ "fbsdp-no", "on" },
+{ "psdp-no", "on" },
+{ /* end of list */ }
+}
+},
+{ /* end of list */ }
+}
 },
 {
 .name = "Denverton",
-- 
2.34.1




[PATCH 6/7] target/i386: Add new CPU model EmeraldRapids

2023-06-15 Thread Tao Su
From: Qian Wen 

Emerald Rapids (EMR) is the next generation of Xeon server processor
after Sapphire Rapids (SPR).

Currently, regarding the feature set that can be exposed to guest, there
isn't any one new comparing with SPR cpu model, except that EMR has a
different model number.

Though it's practicable to define EMR as an alias of a new version of
SPR by only updating the model number and model name, it loses the
flexibility when new version of EMR cpu model are needed for adding new
features (that hasn't virtalized/supported by KVM yet).

So just add EMR as a standalone cpu model.

Signed-off-by: Qian Wen 
Reviewed-by: Xiaoyao Li 
Signed-off-by: Tao Su 
---
Changes to original patch
(https://lore.kernel.org/qemu-devel/20230515025308.1050277-1-qian@intel.com/)

- Add MSR_ARCH_CAP_SBDR_SSDP_NO, MSR_ARCH_CAP_FBSDP_NO and
  MSR_ARCH_CAP_PSDP_NO
---
 target/i386/cpu.c | 127 ++
 1 file changed, 127 insertions(+)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index f84fd20bb1..7faf6dfaee 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -3866,6 +3866,133 @@ static const X86CPUDefinition builtin_x86_defs[] = {
 { /* end of list */ }
 }
 },
+{
+.name = "EmeraldRapids",
+.level = 0x20,
+.vendor = CPUID_VENDOR_INTEL,
+.family = 6,
+.model = 207,
+.stepping = 1,
+.features[FEAT_1_EDX] =
+CPUID_FP87 | CPUID_VME | CPUID_DE | CPUID_PSE | CPUID_TSC |
+CPUID_MSR | CPUID_PAE | CPUID_MCE | CPUID_CX8 | CPUID_APIC |
+CPUID_SEP | CPUID_MTRR | CPUID_PGE | CPUID_MCA | CPUID_CMOV |
+CPUID_PAT | CPUID_PSE36 | CPUID_CLFLUSH | CPUID_MMX | CPUID_FXSR |
+CPUID_SSE | CPUID_SSE2,
+.features[FEAT_1_ECX] =
+CPUID_EXT_SSE3 | CPUID_EXT_PCLMULQDQ | CPUID_EXT_SSSE3 |
+CPUID_EXT_FMA | CPUID_EXT_CX16 | CPUID_EXT_PCID | CPUID_EXT_SSE41 |
+CPUID_EXT_SSE42 | CPUID_EXT_X2APIC | CPUID_EXT_MOVBE |
+CPUID_EXT_POPCNT | CPUID_EXT_TSC_DEADLINE_TIMER | CPUID_EXT_AES |
+CPUID_EXT_XSAVE | CPUID_EXT_AVX | CPUID_EXT_F16C | 
CPUID_EXT_RDRAND,
+.features[FEAT_8000_0001_EDX] =
+CPUID_EXT2_SYSCALL | CPUID_EXT2_NX | CPUID_EXT2_PDPE1GB |
+CPUID_EXT2_RDTSCP | CPUID_EXT2_LM,
+.features[FEAT_8000_0001_ECX] =
+CPUID_EXT3_LAHF_LM | CPUID_EXT3_ABM | CPUID_EXT3_3DNOWPREFETCH,
+.features[FEAT_8000_0008_EBX] =
+CPUID_8000_0008_EBX_WBNOINVD,
+.features[FEAT_7_0_EBX] =
+CPUID_7_0_EBX_FSGSBASE | CPUID_7_0_EBX_BMI1 | CPUID_7_0_EBX_HLE |
+CPUID_7_0_EBX_AVX2 | CPUID_7_0_EBX_SMEP | CPUID_7_0_EBX_BMI2 |
+CPUID_7_0_EBX_ERMS | CPUID_7_0_EBX_INVPCID | CPUID_7_0_EBX_RTM |
+CPUID_7_0_EBX_AVX512F | CPUID_7_0_EBX_AVX512DQ |
+CPUID_7_0_EBX_RDSEED | CPUID_7_0_EBX_ADX | CPUID_7_0_EBX_SMAP |
+CPUID_7_0_EBX_AVX512IFMA | CPUID_7_0_EBX_CLFLUSHOPT |
+CPUID_7_0_EBX_CLWB | CPUID_7_0_EBX_AVX512CD | CPUID_7_0_EBX_SHA_NI 
|
+CPUID_7_0_EBX_AVX512BW | CPUID_7_0_EBX_AVX512VL,
+.features[FEAT_7_0_ECX] =
+CPUID_7_0_ECX_AVX512_VBMI | CPUID_7_0_ECX_UMIP | CPUID_7_0_ECX_PKU 
|
+CPUID_7_0_ECX_AVX512_VBMI2 | CPUID_7_0_ECX_GFNI |
+CPUID_7_0_ECX_VAES | CPUID_7_0_ECX_VPCLMULQDQ |
+CPUID_7_0_ECX_AVX512VNNI | CPUID_7_0_ECX_AVX512BITALG |
+CPUID_7_0_ECX_AVX512_VPOPCNTDQ | CPUID_7_0_ECX_LA57 |
+CPUID_7_0_ECX_RDPID | CPUID_7_0_ECX_BUS_LOCK_DETECT,
+.features[FEAT_7_0_EDX] =
+CPUID_7_0_EDX_FSRM | CPUID_7_0_EDX_SERIALIZE |
+CPUID_7_0_EDX_TSX_LDTRK | CPUID_7_0_EDX_AMX_BF16 |
+CPUID_7_0_EDX_AVX512_FP16 | CPUID_7_0_EDX_AMX_TILE |
+CPUID_7_0_EDX_AMX_INT8 | CPUID_7_0_EDX_SPEC_CTRL |
+CPUID_7_0_EDX_ARCH_CAPABILITIES | CPUID_7_0_EDX_SPEC_CTRL_SSBD,
+.features[FEAT_ARCH_CAPABILITIES] =
+MSR_ARCH_CAP_RDCL_NO | MSR_ARCH_CAP_IBRS_ALL |
+MSR_ARCH_CAP_SKIP_L1DFL_VMENTRY | MSR_ARCH_CAP_MDS_NO |
+MSR_ARCH_CAP_PSCHANGE_MC_NO | MSR_ARCH_CAP_TAA_NO |
+MSR_ARCH_CAP_SBDR_SSDP_NO | MSR_ARCH_CAP_FBSDP_NO |
+MSR_ARCH_CAP_PSDP_NO,
+.features[FEAT_XSAVE] =
+CPUID_XSAVE_XSAVEOPT | CPUID_XSAVE_XSAVEC |
+CPUID_XSAVE_XGETBV1 | CPUID_XSAVE_XSAVES | CPUID_D_1_EAX_XFD,
+.features[FEAT_6_EAX] =
+CPUID_6_EAX_ARAT,
+.features[FEAT_7_1_EAX] =
+CPUID_7_1_EAX_AVX_VNNI | CPUID_7_1_EAX_AVX512_BF16 |
+CPUID_7_1_EAX_FZRM | CPUID_7_1_EAX_FSRS | CPUID_7_1_EAX_FSRC,
+.features[FEAT_VMX_BASIC] =
+MSR_VMX_BASIC_INS_OUTS | MSR_VMX_BASIC_TRUE_CTLS,
+.features[FEAT_VMX_ENTRY_CTLS] =
+VMX_VM_ENTRY_LOAD_DEBUG_CONTROLS | VMX_VM_ENTRY_

[PATCH 1/7] target/i386: Add FEAT_7_1_EDX to adjust feature level

2023-06-15 Thread Tao Su
Considering the case of FEAT_7_1_EAX being 0 and FEAT_7_1_EDX being
non-zero, guest may report wrong maximum number sub-leaves in leaf
07H. So add FEAT_7_1_EDX to adjust feature level.

Fixes: eaaa197d5b11 ("target/i386: Add support for AVX-VNNI-INT8 in CPUID
enumeration")

Signed-off-by: Tao Su 
Reviewed-by: Xiaoyao Li 
---
 target/i386/cpu.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 1242bd541a..e8a70c35d2 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -6778,6 +6778,7 @@ void x86_cpu_expand_features(X86CPU *cpu, Error **errp)
 x86_cpu_adjust_feat_level(cpu, FEAT_6_EAX);
 x86_cpu_adjust_feat_level(cpu, FEAT_7_0_ECX);
 x86_cpu_adjust_feat_level(cpu, FEAT_7_1_EAX);
+x86_cpu_adjust_feat_level(cpu, FEAT_7_1_EDX);
 x86_cpu_adjust_feat_level(cpu, FEAT_8000_0001_EDX);
 x86_cpu_adjust_feat_level(cpu, FEAT_8000_0001_ECX);
 x86_cpu_adjust_feat_level(cpu, FEAT_8000_0007_EDX);
-- 
2.34.1




[PATCH 2/7] target/i386: Add support for MCDT_NO in CPUID enumeration

2023-06-15 Thread Tao Su
CPUID.(EAX=7,ECX=2):EDX[bit 5] enumerates MCDT_NO. Processors enumerate
this bit as 1 do not exhibit MXCSR Configuration Dependent Timing (MCDT)
behavior and do not need to be mitigated to avoid data-dependent behavior
for certain instructions.

Since MCDT_NO is in a new sub-leaf, add a new CPUID feature word
FEAT_7_2_EDX. Also update cpuid_level_func7 by FEAT_7_2_EDX.

Signed-off-by: Tao Su 
Reviewed-by: Xiaoyao Li 
---
 target/i386/cpu.c | 26 ++
 target/i386/cpu.h |  4 
 2 files changed, 30 insertions(+)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index e8a70c35d2..7898a4c79a 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -668,6 +668,7 @@ void x86_cpu_vendor_words2str(char *dst, uint32_t vendor1,
 #define TCG_7_1_EAX_FEATURES (CPUID_7_1_EAX_FZRM | CPUID_7_1_EAX_FSRS | \
   CPUID_7_1_EAX_FSRC)
 #define TCG_7_1_EDX_FEATURES 0
+#define TCG_7_2_EDX_FEATURES 0
 #define TCG_APM_FEATURES 0
 #define TCG_6_EAX_FEATURES CPUID_6_EAX_ARAT
 #define TCG_XSAVE_FEATURES (CPUID_XSAVE_XSAVEOPT | CPUID_XSAVE_XGETBV1)
@@ -910,6 +911,25 @@ FeatureWordInfo feature_word_info[FEATURE_WORDS] = {
 },
 .tcg_features = TCG_7_1_EDX_FEATURES,
 },
+[FEAT_7_2_EDX] = {
+.type = CPUID_FEATURE_WORD,
+.feat_names = {
+NULL, NULL, NULL, NULL,
+NULL, "mcdt-no", NULL, NULL,
+NULL, NULL, NULL, NULL,
+NULL, NULL, NULL, NULL,
+NULL, NULL, NULL, NULL,
+NULL, NULL, NULL, NULL,
+NULL, NULL, NULL, NULL,
+NULL, NULL, NULL, NULL,
+},
+.cpuid = {
+.eax = 7,
+.needs_ecx = true, .ecx = 2,
+.reg = R_EDX,
+},
+.tcg_features = TCG_7_2_EDX_FEATURES,
+},
 [FEAT_8000_0007_EDX] = {
 .type = CPUID_FEATURE_WORD,
 .feat_names = {
@@ -5919,6 +5939,11 @@ void cpu_x86_cpuid(CPUX86State *env, uint32_t index, 
uint32_t count,
 *edx = env->features[FEAT_7_1_EDX];
 *ebx = 0;
 *ecx = 0;
+} else if (count == 2) {
+*edx = env->features[FEAT_7_2_EDX];
+*eax = 0;
+*ebx = 0;
+*ecx = 0;
 } else {
 *eax = 0;
 *ebx = 0;
@@ -6779,6 +6804,7 @@ void x86_cpu_expand_features(X86CPU *cpu, Error **errp)
 x86_cpu_adjust_feat_level(cpu, FEAT_7_0_ECX);
 x86_cpu_adjust_feat_level(cpu, FEAT_7_1_EAX);
 x86_cpu_adjust_feat_level(cpu, FEAT_7_1_EDX);
+x86_cpu_adjust_feat_level(cpu, FEAT_7_2_EDX);
 x86_cpu_adjust_feat_level(cpu, FEAT_8000_0001_EDX);
 x86_cpu_adjust_feat_level(cpu, FEAT_8000_0001_ECX);
 x86_cpu_adjust_feat_level(cpu, FEAT_8000_0007_EDX);
diff --git a/target/i386/cpu.h b/target/i386/cpu.h
index cd047e0410..64d50acf41 100644
--- a/target/i386/cpu.h
+++ b/target/i386/cpu.h
@@ -628,6 +628,7 @@ typedef enum FeatureWord {
 FEAT_XSAVE_XSS_LO, /* CPUID[EAX=0xd,ECX=1].ECX */
 FEAT_XSAVE_XSS_HI, /* CPUID[EAX=0xd,ECX=1].EDX */
 FEAT_7_1_EDX,   /* CPUID[EAX=7,ECX=1].EDX */
+FEAT_7_2_EDX,   /* CPUID[EAX=7,ECX=2].EDX */
 FEATURE_WORDS,
 } FeatureWord;
 
@@ -932,6 +933,9 @@ uint64_t x86_cpu_get_supported_feature_word(FeatureWord w,
 /* PREFETCHIT0/1 Instructions */
 #define CPUID_7_1_EDX_PREFETCHITI   (1U << 14)
 
+/* Do not exhibit MXCSR Configuration Dependent Timing (MCDT) behavior */
+#define CPUID_7_2_EDX_MCDT_NO   (1U << 5)
+
 /* XFD Extend Feature Disabled */
 #define CPUID_D_1_EAX_XFD   (1U << 4)
 
-- 
2.34.1




Re: [PATCH v2 0/6] target/i386: Support new Intel platform Instructions in CPUID enumeration

2023-04-26 Thread Tao Su
On Wed, Apr 26, 2023 at 02:24:18PM +0200, Paolo Bonzini wrote:
> Queued, thanks.
> 
> Paolo
> 

Paolo, thanks!

Tao



[PATCH v2 0/6] target/i386: Support new Intel platform Instructions in CPUID enumeration

2023-03-02 Thread Tao Su
Intel platforms Granite Rapids/Sierra Forest introduce below new
instructions and CPUID leaves:

 - CMPccXADD CPUID.(EAX=7,ECX=1):EAX[bit 7]
 - AMX-FP16 CPUID.(EAX=7,ECX=1):EAX[bit 21]
 - AVX-IFMA CPUID.(EAX=7,ECX=1):EAX[bit 23]
 - AVX-VNNI-INT8 CPUID.(EAX=7,ECX=1):EDX[bit 4]
 - AVX-NE-CONVERT CPUID.(EAX=7,ECX=1):EDX[bit 5]
 - PREFETCHITI CPUID.(EAX=7,ECX=1):EDX[bit 14]

Details can be found in recent Intel ISE (Instruction Set Extensions)[1].

KVM part of advertising these CPUID bits have been already in Linux
mainline from commit(6a19d7aa5821) to commit(29c46979b25d). This series
adds the counterpart in QEMU to allow these features exposed to guest.

[1] Intel ISE: https://cdrdv2.intel.com/v1/dl/getContent/671368

---

Changelog:

v2:
 - Rebase to latest QEMU.
 - Improve changelog.
v1:
 - 
https://lore.kernel.org/all/20221208071917.1923093-1-jiaxi.c...@linux.intel.com/

Jiaxi Chen (6):
  target/i386: Add support for CMPCCXADD in CPUID enumeration
  target/i386: Add support for AMX-FP16 in CPUID enumeration
  target/i386: Add support for AVX-IFMA in CPUID enumeration
  target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration
  target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration
  target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration

 target/i386/cpu.c | 26 +++---
 target/i386/cpu.h | 14 ++
 2 files changed, 37 insertions(+), 3 deletions(-)


base-commit: 627634031092e1514f363fd8659a579398de0f0e
-- 
2.34.1




[PATCH v2 2/6] target/i386: Add support for AMX-FP16 in CPUID enumeration

2023-03-02 Thread Tao Su
From: Jiaxi Chen 

Latest Intel platform Granite Rapids has introduced a new instruction -
AMX-FP16, which performs dot-products of two FP16 tiles and accumulates
the results into a packed single precision tile. AMX-FP16 adds FP16
capability and allows a FP16 GPU trained model to run faster without
loss of accuracy or added SW overhead.

The bit definition:
CPUID.(EAX=7,ECX=1):EAX[bit 21]

Add CPUID definition for AMX-FP16.

Signed-off-by: Jiaxi Chen 
Signed-off-by: Tao Su 
---
 target/i386/cpu.c | 2 +-
 target/i386/cpu.h | 2 ++
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index e54e13d050..ed08a52619 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -876,7 +876,7 @@ FeatureWordInfo feature_word_info[FEATURE_WORDS] = {
 NULL, NULL, "fzrm", "fsrs",
 "fsrc", NULL, NULL, NULL,
 NULL, NULL, NULL, NULL,
-NULL, NULL, NULL, NULL,
+NULL, "amx-fp16", NULL, NULL,
 NULL, NULL, NULL, NULL,
 NULL, NULL, NULL, NULL,
 },
diff --git a/target/i386/cpu.h b/target/i386/cpu.h
index 7df8f4b8f9..ae6a0fdfc2 100644
--- a/target/i386/cpu.h
+++ b/target/i386/cpu.h
@@ -912,6 +912,8 @@ uint64_t x86_cpu_get_supported_feature_word(FeatureWord w,
 #define CPUID_7_1_EAX_FSRS  (1U << 11)
 /* Fast Short REP CMPS/SCAS */
 #define CPUID_7_1_EAX_FSRC  (1U << 12)
+/* Support Tile Computational Operations on FP16 Numbers */
+#define CPUID_7_1_EAX_AMX_FP16  (1U << 21)
 
 /* XFD Extend Feature Disabled */
 #define CPUID_D_1_EAX_XFD   (1U << 4)
-- 
2.34.1




[PATCH v2 5/6] target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration

2023-03-02 Thread Tao Su
From: Jiaxi Chen 

AVX-NE-CONVERT is a new set of instructions which can convert low
precision floating point like BF16/FP16 to high precision floating point
FP32, as well as convert FP32 elements to BF16. This instruction allows
the platform to have improved AI capabilities and better compatibility.

The bit definition:
CPUID.(EAX=7,ECX=1):EDX[bit 5]

Add CPUID definition for AVX-NE-CONVERT.

Signed-off-by: Jiaxi Chen 
Signed-off-by: Tao Su 
---
 target/i386/cpu.c | 2 +-
 target/i386/cpu.h | 2 ++
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 246d10aa49..eee1e5c25f 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -892,7 +892,7 @@ FeatureWordInfo feature_word_info[FEATURE_WORDS] = {
 .type = CPUID_FEATURE_WORD,
 .feat_names = {
 NULL, NULL, NULL, NULL,
-"avx-vnni-int8", NULL, NULL, NULL,
+"avx-vnni-int8", "avx-ne-convert", NULL, NULL,
 NULL, NULL, NULL, NULL,
 NULL, NULL, NULL, NULL,
 NULL, NULL, NULL, NULL,
diff --git a/target/i386/cpu.h b/target/i386/cpu.h
index d53b960f23..14876938c1 100644
--- a/target/i386/cpu.h
+++ b/target/i386/cpu.h
@@ -920,6 +920,8 @@ uint64_t x86_cpu_get_supported_feature_word(FeatureWord w,
 
 /* Support for VPDPB[SU,UU,SS]D[,S] */
 #define CPUID_7_1_EDX_AVX_VNNI_INT8 (1U << 4)
+/* AVX NE CONVERT Instructions */
+#define CPUID_7_1_EDX_AVX_NE_CONVERT(1U << 5)
 
 /* XFD Extend Feature Disabled */
 #define CPUID_D_1_EAX_XFD   (1U << 4)
-- 
2.34.1




[PATCH v2 1/6] target/i386: Add support for CMPCCXADD in CPUID enumeration

2023-03-02 Thread Tao Su
From: Jiaxi Chen 

CMPccXADD is a new set of instructions in the latest Intel platform
Sierra Forest. This new instruction set includes a semaphore operation
that can compare and add the operands if condition is met, which can
improve database performance.

The bit definition:
CPUID.(EAX=7,ECX=1):EAX[bit 7]

Add CPUID definition for CMPCCXADD.

Signed-off-by: Jiaxi Chen 
Signed-off-by: Tao Su 
---
 target/i386/cpu.c | 2 +-
 target/i386/cpu.h | 2 ++
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 4bad3d41d3..e54e13d050 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -872,7 +872,7 @@ FeatureWordInfo feature_word_info[FEATURE_WORDS] = {
 .type = CPUID_FEATURE_WORD,
 .feat_names = {
 NULL, NULL, NULL, NULL,
-"avx-vnni", "avx512-bf16", NULL, NULL,
+"avx-vnni", "avx512-bf16", NULL, "cmpccxadd",
 NULL, NULL, "fzrm", "fsrs",
 "fsrc", NULL, NULL, NULL,
 NULL, NULL, NULL, NULL,
diff --git a/target/i386/cpu.h b/target/i386/cpu.h
index ea650e68a3..7df8f4b8f9 100644
--- a/target/i386/cpu.h
+++ b/target/i386/cpu.h
@@ -904,6 +904,8 @@ uint64_t x86_cpu_get_supported_feature_word(FeatureWord w,
 #define CPUID_7_1_EAX_AVX_VNNI  (1U << 4)
 /* AVX512 BFloat16 Instruction */
 #define CPUID_7_1_EAX_AVX512_BF16   (1U << 5)
+/* CMPCCXADD Instructions */
+#define CPUID_7_1_EAX_CMPCCXADD (1U << 7)
 /* Fast Zero REP MOVS */
 #define CPUID_7_1_EAX_FZRM  (1U << 10)
 /* Fast Short REP STOS */
-- 
2.34.1




[PATCH v2 6/6] target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration

2023-03-02 Thread Tao Su
From: Jiaxi Chen 

Latest Intel platform Granite Rapids has introduced a new instruction -
PREFETCHIT0/1, which moves code to memory (cache) closer to the
processor depending on specific hints.

The bit definition:
CPUID.(EAX=7,ECX=1):EDX[bit 14]

Add CPUID definition for PREFETCHIT0/1.

Signed-off-by: Jiaxi Chen 
Signed-off-by: Tao Su 
---
 target/i386/cpu.c | 2 +-
 target/i386/cpu.h | 2 ++
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index eee1e5c25f..719e6a2636 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -894,7 +894,7 @@ FeatureWordInfo feature_word_info[FEATURE_WORDS] = {
 NULL, NULL, NULL, NULL,
 "avx-vnni-int8", "avx-ne-convert", NULL, NULL,
 NULL, NULL, NULL, NULL,
-NULL, NULL, NULL, NULL,
+NULL, NULL, "prefetchiti", NULL,
 NULL, NULL, NULL, NULL,
 NULL, NULL, NULL, NULL,
 NULL, NULL, NULL, NULL,
diff --git a/target/i386/cpu.h b/target/i386/cpu.h
index 14876938c1..febb1837d0 100644
--- a/target/i386/cpu.h
+++ b/target/i386/cpu.h
@@ -922,6 +922,8 @@ uint64_t x86_cpu_get_supported_feature_word(FeatureWord w,
 #define CPUID_7_1_EDX_AVX_VNNI_INT8 (1U << 4)
 /* AVX NE CONVERT Instructions */
 #define CPUID_7_1_EDX_AVX_NE_CONVERT(1U << 5)
+/* PREFETCHIT0/1 Instructions */
+#define CPUID_7_1_EDX_PREFETCHITI   (1U << 14)
 
 /* XFD Extend Feature Disabled */
 #define CPUID_D_1_EAX_XFD   (1U << 4)
-- 
2.34.1




[PATCH v2 4/6] target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration

2023-03-02 Thread Tao Su
From: Jiaxi Chen 

AVX-VNNI-INT8 is a new set of instructions in the latest Intel platform
Sierra Forest, aims for the platform to have superior AI capabilities.
This instruction multiplies the individual bytes of two unsigned or
unsigned source operands, then adds and accumulates the results into the
destination dword element size operand.

The bit definition:
CPUID.(EAX=7,ECX=1):EDX[bit 4]

AVX-VNNI-INT8 is on a new feature bits leaf. Add a CPUID feature word
FEAT_7_1_EDX for this leaf.

Add CPUID definition for AVX-VNNI-INT8.

Signed-off-by: Jiaxi Chen 
Signed-off-by: Tao Su 
---
 target/i386/cpu.c | 22 +-
 target/i386/cpu.h |  4 
 2 files changed, 25 insertions(+), 1 deletion(-)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 9aaa373e97..246d10aa49 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -664,6 +664,7 @@ void x86_cpu_vendor_words2str(char *dst, uint32_t vendor1,
 #define TCG_7_0_EDX_FEATURES CPUID_7_0_EDX_FSRM
 #define TCG_7_1_EAX_FEATURES (CPUID_7_1_EAX_FZRM | CPUID_7_1_EAX_FSRS | \
   CPUID_7_1_EAX_FSRC)
+#define TCG_7_1_EDX_FEATURES 0
 #define TCG_APM_FEATURES 0
 #define TCG_6_EAX_FEATURES CPUID_6_EAX_ARAT
 #define TCG_XSAVE_FEATURES (CPUID_XSAVE_XSAVEOPT | CPUID_XSAVE_XGETBV1)
@@ -887,6 +888,25 @@ FeatureWordInfo feature_word_info[FEATURE_WORDS] = {
 },
 .tcg_features = TCG_7_1_EAX_FEATURES,
 },
+[FEAT_7_1_EDX] = {
+.type = CPUID_FEATURE_WORD,
+.feat_names = {
+NULL, NULL, NULL, NULL,
+"avx-vnni-int8", NULL, NULL, NULL,
+NULL, NULL, NULL, NULL,
+NULL, NULL, NULL, NULL,
+NULL, NULL, NULL, NULL,
+NULL, NULL, NULL, NULL,
+NULL, NULL, NULL, NULL,
+NULL, NULL, NULL, NULL,
+},
+.cpuid = {
+.eax = 7,
+.needs_ecx = true, .ecx = 1,
+.reg = R_EDX,
+},
+.tcg_features = TCG_7_1_EDX_FEATURES,
+},
 [FEAT_8000_0007_EDX] = {
 .type = CPUID_FEATURE_WORD,
 .feat_names = {
@@ -5516,9 +5536,9 @@ void cpu_x86_cpuid(CPUX86State *env, uint32_t index, 
uint32_t count,
 }
 } else if (count == 1) {
 *eax = env->features[FEAT_7_1_EAX];
+*edx = env->features[FEAT_7_1_EDX];
 *ebx = 0;
 *ecx = 0;
-*edx = 0;
 } else {
 *eax = 0;
 *ebx = 0;
diff --git a/target/i386/cpu.h b/target/i386/cpu.h
index 8e50617efb..d53b960f23 100644
--- a/target/i386/cpu.h
+++ b/target/i386/cpu.h
@@ -623,6 +623,7 @@ typedef enum FeatureWord {
 FEAT_SGX_12_1_EAX,  /* CPUID[EAX=0x12,ECX=1].EAX (SGX ATTRIBUTES[31:0]) */
 FEAT_XSAVE_XSS_LO, /* CPUID[EAX=0xd,ECX=1].ECX */
 FEAT_XSAVE_XSS_HI, /* CPUID[EAX=0xd,ECX=1].EDX */
+FEAT_7_1_EDX,   /* CPUID[EAX=7,ECX=1].EDX */
 FEATURE_WORDS,
 } FeatureWord;
 
@@ -917,6 +918,9 @@ uint64_t x86_cpu_get_supported_feature_word(FeatureWord w,
 /* Support for VPMADD52[H,L]UQ */
 #define CPUID_7_1_EAX_AVX_IFMA  (1U << 23)
 
+/* Support for VPDPB[SU,UU,SS]D[,S] */
+#define CPUID_7_1_EDX_AVX_VNNI_INT8 (1U << 4)
+
 /* XFD Extend Feature Disabled */
 #define CPUID_D_1_EAX_XFD   (1U << 4)
 
-- 
2.34.1




[PATCH v2 3/6] target/i386: Add support for AVX-IFMA in CPUID enumeration

2023-03-02 Thread Tao Su
From: Jiaxi Chen 

AVX-IFMA is a new instruction in the latest Intel platform Sierra
Forest. This instruction packed multiplies unsigned 52-bit integers and
adds the low/high 52-bit products to Qword Accumulators.

The bit definition:
CPUID.(EAX=7,ECX=1):EAX[bit 23]

Add CPUID definition for AVX-IFMA.

Signed-off-by: Jiaxi Chen 
Signed-off-by: Tao Su 
---
 target/i386/cpu.c | 2 +-
 target/i386/cpu.h | 2 ++
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index ed08a52619..9aaa373e97 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -876,7 +876,7 @@ FeatureWordInfo feature_word_info[FEATURE_WORDS] = {
 NULL, NULL, "fzrm", "fsrs",
 "fsrc", NULL, NULL, NULL,
 NULL, NULL, NULL, NULL,
-NULL, "amx-fp16", NULL, NULL,
+NULL, "amx-fp16", NULL, "avx-ifma",
 NULL, NULL, NULL, NULL,
 NULL, NULL, NULL, NULL,
 },
diff --git a/target/i386/cpu.h b/target/i386/cpu.h
index ae6a0fdfc2..8e50617efb 100644
--- a/target/i386/cpu.h
+++ b/target/i386/cpu.h
@@ -914,6 +914,8 @@ uint64_t x86_cpu_get_supported_feature_word(FeatureWord w,
 #define CPUID_7_1_EAX_FSRC  (1U << 12)
 /* Support Tile Computational Operations on FP16 Numbers */
 #define CPUID_7_1_EAX_AMX_FP16  (1U << 21)
+/* Support for VPMADD52[H,L]UQ */
+#define CPUID_7_1_EAX_AVX_IFMA  (1U << 23)
 
 /* XFD Extend Feature Disabled */
 #define CPUID_D_1_EAX_XFD   (1U << 4)
-- 
2.34.1