Model Linx EBSTATE and firmwareless direct-kernel boot in QEMU

[zhoubot]

Summary

• package the current model-generated Linx QEMU work from the existing checkout
• make the ACR1 EBSTATE window explicit in CSR naming and state handling
• add firmwareless direct-kernel boot seeding, low-page diagnostics, and related translate/execute bring-up changes

Testing

• git diff --check

Not tested

• QEMU build
• runtime smoke
• TSVC and full-OS gates

[gemini-code-assist]

Code Review

This pull request introduces the new 'linx' target architecture, including custom CPU, memory, and interrupt controller (LXIC) models, along with support for atomic block execution, custom debugging tools, and low-precision softfloat types. While the implementation is comprehensive, several critical issues must be addressed. These include a potential out-of-bounds memory read in loader.c due to integer underflow, a potential NULL pointer dereference in linx_hart.c, a missing break statement in tcg-accel-ops-mttcg.c, and a regression in configure that breaks non-Linux compilation. Additionally, several portability issues with format specifiers, GDB syntax errors, and code style violations should be resolved.

[gemini-code-assist]

If rom->addr is greater than 0x5c (for example, 0x60), the expression 0x5c - rom->addr will underflow to a very large unsigned value. This causes rom->datasize > 0x5c - rom->addr + 7 to evaluate to true, and subsequently rom->data + off will point to an out-of-bounds memory location (before rom->data), leading to an out-of-bounds read and potential crash. Add a check to ensure rom->addr <= 0x5c before performing the subtraction.

                if (rom->data && rom->addr <= 0x5c && rom->datasize > 0x5c - rom->addr + 7) {
                    size_t off = 0x5c - rom->addr;
                    uint8_t *p = rom->data + off;
                    error_report("LINX_ROM_LOW[%s] src_5c=%02x %02x %02x %02x %02x %02x %02x %02x",
                                 rom->name,
                                 p[0], p[1], p[2], p[3],
                                 p[4], p[5], p[6], p[7]);
                }

[gemini-code-assist]

Using %lu to print uint64_t variables (cpu->max_insn_count and cpu->insn_count) is non-portable and will cause compilation warnings or errors on 32-bit platforms or 64-bit Windows where long is 32-bit. Use PRIu64 instead. Also, consider using qemu_log instead of printf to avoid polluting stdout.

            qemu_log("cpu %d: linx_debug max insn (%" PRIu64 ") reach on %" PRIu64 "\n",
                     cpu->cpu_index, cpu->max_insn_count, cpu->insn_count);

[gemini-code-assist]

There is a missing break statement at the end of case EXCP_ATOMIC_BLK:, which causes execution to fall through to default:. While default currently only contains a break, this is extremely fragile and violates coding standards.

Suggested change

	qemu_mutex_lock_iothread();
	qemu_mutex_lock_iothread();
	break;

[gemini-code-assist]

Removing [ "$targetos" = linux ] allows linux-user to be enabled on non-Linux hosts (such as macOS or BSD) if the directory $source_path/linux-user/include/host/$cpu exists. Since linux-user relies on Linux-specific system calls and headers, this will cause compilation failures on non-Linux platforms.

Suggested change

	if [ -d $source_path/linux-user/include/host/$cpu ]; then
	if [ "$targetos" = linux ] && [ -d $source_path/linux-user/include/host/$cpu ]; then

[gemini-code-assist]

Using %lx to print hwaddr (which is uint64_t) is non-portable and will fail to compile on 32-bit hosts where hwaddr is unsigned long long. Use HWADDR_PRIx instead. Also, use qemu_log_mask(LOG_GUEST_ERROR, ...) instead of bare qemu_log for guest errors.

        qemu_log_mask(LOG_GUEST_ERROR, "Error offset: %" HWADDR_PRIx ", error domain: %x\n", offset, dom);

[gemini-code-assist]

Just writing qemu.gdbinit is not a valid GDB command and will result in a syntax error when GDB attempts to load this file. It should be prefixed with the source command.

source qemu.gdbinit

[gemini-code-assist]

Hardcoding internal corporate URLs (such as szv-y.codehub.huawei.com) in .gitmodules prevents external contributors from cloning the submodules. Consider using public mirrors or relative paths if possible.

[gemini-code-assist]

QEMU coding style requires braces {} for all blocks, even single-line ones.

        for (j = 0; j < CTL_PENDING_WORD; j++) {
            ctl->page[i].pending[j] = 0;
        }
        for (j = 0; j < CTL_ENABLE_WORD; j++) {
            ctl->page[i].enable[j] = 0xFFFFFFFF;
        }
        for (j = 0; j < CTL_TYPE_WORD; j++) {
            ctl->page[i].type[j] = 0x11111111;
        }

[gemini-code-assist]

Assigning start_addr and kernel_entry (which are 64-bit hwaddr/uint64_t values) directly to elements of the uint32_t array reset_vec will cause implicit truncation compiler warnings. Cast them to uint32_t explicitly.

        (uint32_t)start_addr,                  /* start: .dword                   */
        start_addr_hi32,
        fdt_load_addr,               /* fdt_laddr: .dword               */
        0x00000000,
        (uint32_t)kernel_entry,                /* kernel_entry: .dword            */
        kernel_entry_hi32,

[gemini-code-assist]

The header file include/hw/core/cpu.h is including itself, which is redundant and a code smell.