summary refs log tree commit diff stats
path: root/include (follow)
Commit message (Collapse)AuthorAgeFilesLines
* arm/virt: Wire up a GED error device for ACPI / GHESMauro Carvalho Chehab2025-10-051-0/+1
| | | | | | | | | | | | | | | | | | Adds support to ARM virtualization to allow handling generic error ACPI Event via GED & error source device. It is aligned with Linux Kernel patch: https://lore.kernel.org/lkml/1272350481-27951-8-git-send-email-ying.huang@intel.com/ Co-authored-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org> Co-authored-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org> Acked-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Message-ID: <3237a76b1469d669436399495825348bf34122cd.1758610789.git.mchehab+huawei@kernel.org> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
* acpi/generic_event_device: add an APEI error deviceMauro Carvalho Chehab2025-10-043-0/+4
| | | | | | | | | | | | | | | | | | | Adds a generic error device to handle generic hardware error events as specified at ACPI 6.5 specification at 18.3.2.7.2: https://uefi.org/specs/ACPI/6.5/18_Platform_Error_Interfaces.html#event-notification-for-generic-error-sources using HID PNP0C33. The PNP0C33 device is used to report hardware errors to the guest via ACPI APEI Generic Hardware Error Source (GHES). Co-authored-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org> Co-authored-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org> Reviewed-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Message-ID: <2790f664c849d53de0ce3049fa8c7950c1de1f86.1758610789.git.mchehab+huawei@kernel.org> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
* acpi/ghes: add a notifier to notify when error data is readyMauro Carvalho Chehab2025-10-041-0/+3
| | | | | | | | | | | | | Some error injection notify methods are async, like GPIO notify. Add a notifier to be used when the error record is ready to be sent to the guest OS. Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org> Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> Acked-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Message-ID: <edf9c6e5b80dc57e3443893bf9e1eb25cb9d266b.1758610789.git.mchehab+huawei@kernel.org> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
* acpi/ghes: don't hard-code the number of sources for HEST tableMauro Carvalho Chehab2025-10-041-5/+12
| | | | | | | | | | | | | | | | | | | The current code is actually dependent on having just one error structure with a single source, as any change there would cause migration issues. As the number of sources should be arch-dependent, as it will depend on what kind of notifications will exist, and how many errors can be reported at the same time, change the logic to be more flexible, allowing the number of sources to be defined when building the HEST table by the caller. Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org> Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Message-ID: <1698680848c11d6f26368426f1657e14faaf55c4.1758610789.git.mchehab+huawei@kernel.org> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
* acpi/ghes: Use HEST table offsets when preparing GHES recordsMauro Carvalho Chehab2025-10-041-1/+1
| | | | | | | | | | | | | | | | | | | | | There are two pointers that are needed during error injection: 1. The start address of the CPER block to be stored; 2. The address of the read ack. It is preferable to calculate them from the HEST table. This allows checking the source ID, the size of the table and the type of the HEST error block structures. Yet, keep the old code, as this is needed for migration purposes from older QEMU versions. Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org> Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Message-ID: <d4344e8dbe66372e1e093d968eda2e8b0527ba48.1758610789.git.mchehab+huawei@kernel.org> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
* acpi/ghes: add a firmware file with HEST addressMauro Carvalho Chehab2025-10-041-1/+5
| | | | | | | | | | | | Store HEST table address at GPA, placing its the start of the table at hest_addr_le variable. Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org> Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Message-ID: <c29aa5e6ab9b2d93dd5328481630c3b03da86261.1758610789.git.mchehab+huawei@kernel.org> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
* acpi/ghes: prepare to change the way HEST offsets are calculatedMauro Carvalho Chehab2025-10-041-1/+11
| | | | | | | | | | | | | | | | | | | | Add a new ags flag to change the way HEST offsets are calculated. Currently, offsets needed to store ACPI HEST offsets and read ack are calculated based on a previous knowledge from the logic which creates the HEST table. Such logic is not generic, not allowing to easily add more HEST entries nor replicates what OSPM does. As the next patches will be adding a more generic logic, add a new use_hest_addr, set to false, in preparation for such changes. Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org> Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Message-ID: <f5de17bf04b27828e1a439ad396b4f7982eaf156.1758610789.git.mchehab+huawei@kernel.org> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
* acpi/ghes: Cleanup the code which gets ghes ged stateMauro Carvalho Chehab2025-10-041-7/+7
| | | | | | | | | | | | Move the check logic into a common function and simplify the code which checks if GHES is enabled and was properly setup. Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org> Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Message-ID: <2bbb1d3eb88b0a668114adef2f1c2a94deebba0e.1758610789.git.mchehab+huawei@kernel.org> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
* Revert "hw/acpi/ghes: Make ghes_record_cper_errors() static"Mauro Carvalho Chehab2025-10-041-0/+2
| | | | | | | | | | | | | | | | | The ghes_record_cper_errors() function was introduced to be used by other types of errors, as part of the error injection patch series. That's why it is not static. Make it non-static again to allow its usage outside ghes.c This reverts commit 611f3bdb20f7828b0813aa90d47d1275ef18329b. Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org> Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Message-ID: <14f2a888cfbf922d5f2bf94d7612114f25107d59.1758610789.git.mchehab+huawei@kernel.org> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
* net: implement UDP tunnel features offloadingPaolo Abeni2025-10-041-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | When any host or guest GSO over UDP tunnel offload is enabled the virtio net header includes the additional tunnel-related fields, update the size accordingly. Push the GSO over UDP tunnel offloads all the way down to the tap device extending the newly introduced NetFeatures struct, and eventually enable the associated features. As per virtio specification, to convert features bit to offload bit, map the extended features into the reserved range. Finally, make the vhost backend aware of the exact header layout, to copy it correctly. The tunnel-related field are present if either the guest or the host negotiated any UDP tunnel related feature: add them to the kernel supported features list, to allow qemu transfer to the backend the needed information. Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp> Acked-by: Jason Wang <jasowang@redhat.com> Signed-off-by: Paolo Abeni <pabeni@redhat.com> Tested-by: Lei Yang <leiyang@redhat.com> Acked-by: Stefano Garzarella <sgarzare@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Message-ID: <093b4bc68368046bffbcab2202227632d6e4e83b.1758549625.git.pabeni@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
* net: implement tunnel probingPaolo Abeni2025-10-041-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | Tap devices support GSO over UDP tunnel offload. Probe for such feature in a similar manner to other offloads. GSO over UDP tunnel needs to be enabled in addition to a "plain" offload (TSO or USO). No need to check separately for the outer header checksum offload: the kernel is going to support both of them or none. The new features are disabled by default to avoid compat issues, and could be enabled, after that hw_compat_10_1 will be added, together with the related compat entries. Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp> Acked-by: Jason Wang <jasowang@redhat.com> Signed-off-by: Paolo Abeni <pabeni@redhat.com> Tested-by: Lei Yang <leiyang@redhat.com> Acked-by: Stefano Garzarella <sgarzare@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Message-ID: <a987a8a7613cbf33bb2209c7c7f5889b512638a7.1758549625.git.pabeni@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
* virtio-net: implement extended features supportPaolo Abeni2025-10-041-1/+1
| | | | | | | | | | | | | | | | | Use the extended types and helpers to manipulate the virtio_net features. Note that offloads are still 64bits wide, as per specification, and extended offloads will be mapped into such range. Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp> Acked-by: Jason Wang <jasowang@redhat.com> Signed-off-by: Paolo Abeni <pabeni@redhat.com> Tested-by: Lei Yang <leiyang@redhat.com> Acked-by: Stefano Garzarella <sgarzare@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Message-ID: <bc5afdc5c1cb1a37238dd2b36004db3d46cbf211.1758549625.git.pabeni@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
* vhost-net: implement extended features supportPaolo Abeni2025-10-041-3/+30
| | | | | | | | | | | | | | | Provide extended version of the features manipulation helpers, and let the device initialization deal with the full features space, adjusting the relevant format strings accordingly. Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp> Acked-by: Jason Wang <jasowang@redhat.com> Signed-off-by: Paolo Abeni <pabeni@redhat.com> Tested-by: Lei Yang <leiyang@redhat.com> Acked-by: Stefano Garzarella <sgarzare@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Message-ID: <69c78c432e28e146a8874b2a7d00e9cbd111b1ba.1758549625.git.pabeni@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
* vhost: add support for negotiating extended featuresPaolo Abeni2025-10-042-7/+55
| | | | | | | | | | | | | | | | | | | Similar to virtio infra, vhost core maintains the features status in the full extended format and allows the devices to implement extended version of the getter/setter. Note that 'protocol_features' are not extended: they are only used by vhost-user, and the latter device is not going to implement extended features soon. Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp> Acked-by: Jason Wang <jasowang@redhat.com> Acked-by: Stefano Garzarella <sgarzare@redhat.com> Signed-off-by: Paolo Abeni <pabeni@redhat.com> Tested-by: Lei Yang <leiyang@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Message-ID: <a0062c3b1847fb2baedd6cd8f6ef13b051d6beb2.1758549625.git.pabeni@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
* virtio-pci: implement support for extended featuresPaolo Abeni2025-10-041-1/+1
| | | | | | | | | | | | | | | | | | | | Extend the features configuration space to 128 bits. If the virtio device supports any extended features, allow the common read/write operation to access all of it, otherwise keep exposing only the lower 64 bits. On migration, save the 128 bit version of the features only if the upper bits are non zero. Relay on reset to clear all the feature space before load. Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp> Acked-by: Jason Wang <jasowang@redhat.com> Acked-by: Stefano Garzarella <sgarzare@redhat.com> Signed-off-by: Paolo Abeni <pabeni@redhat.com> Tested-by: Lei Yang <leiyang@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Message-ID: <c0b81601f65b41ca8310eba8f05e2dcf3702de89.1758549625.git.pabeni@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
* virtio: add support for negotiating extended featuresPaolo Abeni2025-10-041-0/+4
| | | | | | | | | | | | | | | | | | | | | | | The virtio specifications allows for a device features space up to 128 bits and more. Soon we are going to use some of the 'extended' bits features for the virtio net driver. Add support to allow extended features negotiation on a per devices basis. Devices willing to negotiated extended features need to implemented a new pair of features getter/setter, the core will conditionally use them instead of the basic one. Note that 'bad_features' don't need to be extended, as they are bound to the 64 bits limit. Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp> Acked-by: Jason Wang <jasowang@redhat.com> Acked-by: Stefano Garzarella <sgarzare@redhat.com> Signed-off-by: Paolo Abeni <pabeni@redhat.com> Tested-by: Lei Yang <leiyang@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Message-ID: <9bb29d70adc3f2b8c7756d4e3cd076cffee87826.1758549625.git.pabeni@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
* virtio: introduce extended features typePaolo Abeni2025-10-042-3/+130
| | | | | | | | | | | | | | | | | | | | | | The virtio specifications allows for up to 128 bits for the device features. Soon we are going to use some of the 'extended' bits features (bit 64 and above) for the virtio net driver. Represent the virtio features bitmask with a fixed size array, and introduce a few helpers to help manipulate them. Most drivers will keep using only 64 bits features space: use union to allow them access the lower part of the extended space without any per driver change. Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp> Acked-by: Jason Wang <jasowang@redhat.com> Acked-by: Stefano Garzarella <sgarzare@redhat.com> Signed-off-by: Paolo Abeni <pabeni@redhat.com> Tested-by: Lei Yang <leiyang@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Message-ID: <6a9bbb5eb33830f20afbcb7e64d300af4126dd98.1758549625.git.pabeni@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
* linux-headers: Update to Linux v6.17-rc1Paolo Abeni2025-10-047-3/+113
| | | | | | | | | | | | | Update headers to include the virtio GSO over UDP tunnel features Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp> Acked-by: Jason Wang <jasowang@redhat.com> Signed-off-by: Paolo Abeni <pabeni@redhat.com> Tested-by: Lei Yang <leiyang@redhat.com> Acked-by: Stefano Garzarella <sgarzare@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Message-ID: <0b1f3c011f90583ab52aa4fef04df6db35cc4a69.1758549625.git.pabeni@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
* net: bundle all offloads in a single structPaolo Abeni2025-10-041-3/+12
| | | | | | | | | | | | | | | | The set_offload() argument list is already pretty long and we are going to introduce soon a bunch of additional offloads. Replace the offload arguments with a single struct and update all the relevant call-sites. No functional changes intended. Signed-off-by: Paolo Abeni <pabeni@redhat.com> Tested-by: Lei Yang <leiyang@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Message-ID: <a9d4dd043b8c71b791e9ff05e17ef06072d9714e.1758549625.git.pabeni@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
* Merge tag 'pull-vfio-20251003' of https://github.com/legoater/qemu into stagingRichard Henderson2025-10-033-10/+11
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | vfio queue: * Remove workaround for kernel DMA unmap overflow * Remove invalid uses of ram_addr_t type # -----BEGIN PGP SIGNATURE----- # # iQIzBAABCAAdFiEEoPZlSPBIlev+awtgUaNDx8/77KEFAmjfpl4ACgkQUaNDx8/7 # 7KFAHQ//R0WtsAsEYE8Diczscl9++gqORrrLYN2ffTKrhUBrBskPptWZ+4Rh4R2e # OSxdcf1cl0sFNkzCqnbWE3sbAG1Yq6mvCXTGTx3Y+2wi0KNwZXSxYGMWApOydp5K # McQv1Uyd48TKCEwjumu6jmoPUSi89kvA58BLjBtw2bwJQzdlMZpIHX0XlSjlBHTz # wHPqqW5+WCWq52pTp2vNkRrcqTl/HuoaijHPEJMzd/GIl1x2tBruuXuwzkY33ZKy # EyDNq/stK12Pa1Va1ey8QOMQUJJ1jb3feVognDDVRMUGbBPljMawi8vtXW6LW28P # 0micGzDk1A3yi8X+tIHjQE/rcL86mIKyzCmrSB7WM+t3r79/hWZQruUu2e1eUGCE # Mw5K0UoxBvp4LxeB2wKSIFUL1VgcB0azgsq6nOwRgMyzcqjniBu7M7gctIQQdypZ # wSdUo8cViagUXS+YDVLsMreq4FShFWx6JLOGlxvN/eTaicUTjiOccriGmu1huhW/ # VzcfkgZWL1lSKoDeOAOafNjUP557hv0YbiAGa8ywglrukFLdFKIFJOvNdnzmmkiG # 5YJt2RH/rx+etF0hBI4uZLCnumpiKVM27/9MuMRiF7jZSXx0rz8tFVcscxQY10GP # pSPL3SZAeLD4HMhndrlLSPAJyboQ4TGPA26yn5nahUGmOhoP91o= # =kCV9 # -----END PGP SIGNATURE----- # gpg: Signature made Fri 03 Oct 2025 03:33:02 AM PDT # gpg: using RSA key A0F66548F04895EBFE6B0B6051A343C7CFFBECA1 # gpg: Good signature from "Cédric Le Goater <clg@redhat.com>" [full] # gpg: aka "Cédric Le Goater <clg@kaod.org>" [full] * tag 'pull-vfio-20251003' of https://github.com/legoater/qemu: hw/vfio: Use uint64_t for IOVA mapping size in vfio_container_dma_*map hw/vfio: Avoid ram_addr_t in vfio_container_query_dirty_bitmap() hw/vfio: Reorder vfio_container_query_dirty_bitmap() trace format system/iommufd: Use uint64_t type for IOVA mapping size vfio: Remove workaround for kernel DMA unmap overflow bug Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
| * hw/vfio: Use uint64_t for IOVA mapping size in vfio_container_dma_*mapPhilippe Mathieu-Daudé2025-10-022-6/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The 'ram_addr_t' type is described as: a QEMU internal address space that maps guest RAM physical addresses into an intermediate address space that can map to host virtual address spaces. This doesn't represent well an IOVA mapping size. Simply use the uint64_t type. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Cédric Le Goater <clg@redhat.com> Link: https://lore.kernel.org/qemu-devel/20250930123528.42878-5-philmd@linaro.org Signed-off-by: Cédric Le Goater <clg@redhat.com>
| * hw/vfio: Avoid ram_addr_t in vfio_container_query_dirty_bitmap()Philippe Mathieu-Daudé2025-10-021-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The 'ram_addr_t' type is described as: a QEMU internal address space that maps guest RAM physical addresses into an intermediate address space that can map to host virtual address spaces. vfio_container_query_dirty_bitmap() doesn't expect such QEMU intermediate address, but a guest physical addresses. Use the appropriate 'hwaddr' type, rename as @translated_addr for clarity. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Cédric Le Goater <clg@redhat.com> Link: https://lore.kernel.org/qemu-devel/20250930123528.42878-4-philmd@linaro.org Signed-off-by: Cédric Le Goater <clg@redhat.com>
| * system/iommufd: Use uint64_t type for IOVA mapping sizePhilippe Mathieu-Daudé2025-10-021-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The 'ram_addr_t' type is described as: a QEMU internal address space that maps guest RAM physical addresses into an intermediate address space that can map to host virtual address spaces. This doesn't represent well an IOVA mapping size. Simply use the uint64_t type. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Cédric Le Goater <clg@redhat.com> Link: https://lore.kernel.org/qemu-devel/20250930123528.42878-2-philmd@linaro.org Signed-off-by: Cédric Le Goater <clg@redhat.com>
* | Merge tag 'pull-riscv-to-apply-20251003-3' of ↵Richard Henderson2025-10-033-1/+15
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | https://github.com/alistair23/qemu into staging First RISC-V PR for 10.2 * Fix MSI table size limit * Add riscv64 to FirmwareArchitecture * Sync RISC-V hwprobe with Linux * Implement MonitorDef HMP API * Update OpenSBI to v1.7 * Fix SiFive UART character drop issue and minor refactors * Fix RISC-V timer migration issues * Use riscv_cpu_is_32bit() when handling SBI_DBCN reg * Use riscv_csrr in riscv_csr_read * Align memory allocations to 2M on RISC-V * Do not use translator_ldl in opcode_at * Minor fixes of RISC-V CFI * Modify minimum VLEN rule * Fix vslide1[up|down].vx unexpected result when XLEN=32 and SEW=64 * Fixup IOMMU PDT Nested Walk * Fix endianness swap on compressed instructions * Update status of IOMMU kernel support # -----BEGIN PGP SIGNATURE----- # # iQIzBAABCgAdFiEEaukCtqfKh31tZZKWr3yVEwxTgBMFAmjfQhoACgkQr3yVEwxT # gBPnTg//eQ9GMFTLcW4kFMsVYeY8TbkmQN9Wnk+XubG92siGkzuNmfy36yo7oeib # dB6/h5JLjycjttOfgyx73/TKUucyZs+ZYkVVWWQCSU+sqPTA370MmGNM8CSmPms/ # lFuNIixd+sSUDIOod9zQHzxv+f3ZN2bjEAyzJAEhSXgTO+1xnOeJHHjxB5O2Z/a1 # ccd3Po1wR6nm2T4x88LcHDHj8svLsfG0G1RRkU+yeLu7J6Qpp0d/lOZI7if+AQqb # Nmz65n2uSuUEuNNQIxYaQp/nbkF3DSxi3mg3+hCQjF+hMjXL4hAhSEPril3MQjGi # 802nEaqG8Qdzec+bZiKt0c3e0f4SrnpDXDnz7NrtfSO6vXAvqqZuC8kTdZy8dsPU # 1D809ksZoNDIB87z89MQPsQ7k1Bs2Iq9pNpB9huD3mzY4DHqYhkzysAwc8Qhvimv # pBaeSDV66OrI/al5c0FqSN0LiLHvlRcwqiATiQwIdCV+PUe+cVPwIKq6ABQiYpVu # mvnzgEJ4r7iO92hOoAGM+eRC7krafF1/gbe3SDI3RLUTDPM6hcTRcluvBlpBdNDj # lIYXs89f0jBh0I4IRGm8ftqD9xPDP56mZVEIIjSWDRTT6mfZLxWWMmXC/OK63U7/ # bpJKohFOKy8P6SSvTACcLSOQlP3r+FRrmBOXs7S24U+Hr9xUep0= # =DGkt # -----END PGP SIGNATURE----- # gpg: Signature made Thu 02 Oct 2025 08:25:14 PM PDT # gpg: using RSA key 6AE902B6A7CA877D6D659296AF7C95130C538013 # gpg: Good signature from "Alistair Francis <alistair@alistair23.me>" [unknown] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 6AE9 02B6 A7CA 877D 6D65 9296 AF7C 9513 0C53 8013 * tag 'pull-riscv-to-apply-20251003-3' of https://github.com/alistair23/qemu: (26 commits) docs: riscv-iommu: Update status of kernel support target/riscv: Fix endianness swap on compressed instructions hw/riscv/riscv-iommu: Fixup PDT Nested Walk target/riscv: rvv: Fix vslide1[up|down].vx unexpected result when XLEN=32 and SEW=64 target/riscv: rvv: Modify minimum VLEN according to enabled vector extensions target/riscv: rvv: Replace checking V by checking Zve32x target/riscv: Fix ssamoswap error handling target/riscv: Fix SSP CSR error handling in VU/VS mode target/riscv: Fix the mepc when sspopchk triggers the exception target/riscv: do not use translator_ldl in opcode_at qemu/osdep: align memory allocations to 2M on RISC-V target/riscv: use riscv_csrr in riscv_csr_read target/riscv/kvm: Use riscv_cpu_is_32bit() when handling SBI_DBCN reg target/riscv: Save stimer and vstimer in CPU vmstate hw/intc: Save timers array in RISC-V mtimer VMState migration: Add support for a variable-length array of UINT32 pointers hw/intc: Save time_delta in RISC-V mtimer VMState hw/char: sifive_uart: Add newline to error message hw/char: sifive_uart: Remove outdated comment about Tx FIFO hw/char: sifive_uart: Avoid pushing Tx FIFO when size is zero ... Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
| * | qemu/osdep: align memory allocations to 2M on RISC-VXuemei Liu2025-10-031-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Similar to other architectures (e.g., x86_64, aarch64), utilizing THP on RISC-V KVM requires 2MiB-aligned memory blocks. Signed-off-by: Xuemei Liu <liu.xuemei1@zte.com.cn> Reviewed-by: David Hildenbrand <david@redhat.com> Message-ID: <20250924131803656Yqt9ZJKfevWkInaGppFdE@zte.com.cn> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
| * | hw/intc: Save timers array in RISC-V mtimer VMStateTANG Tiancheng2025-10-031-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The current 'timecmp' field in vmstate_riscv_mtimer is insufficient to keep timers functional after migration. If an mtimer's entry in 'mtimer->timers' is active at the time the snapshot is taken, it means riscv_aclint_mtimer_write_timecmp() has written to 'mtimecmp' and scheduled a timer into QEMU's main loop 'timer_list'. During snapshot save, these active timers must also be migrated; otherwise, after snapshot load there is no mechanism to restore 'mtimer->timers' back into the 'timer_list', and any pending timer events would be lost. QEMU's migration framework commonly uses VMSTATE_TIMER_xxx macros to save and restore 'QEMUTimer' variables. However, 'timers' is a pointer array with variable length, and vmstate.h did not previously provide a helper macro for such type. This commit adds a new macro, 'VMSTATE_TIMER_PTR_VARRAY', to handle saving and restoring a variable-length array of 'QEMUTimer *'. We then use this macro to migrate the 'mtimer->timers' array, ensuring that timer events remain scheduled correctly after snapshot load. Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com> Signed-off-by: TANG Tiancheng <lyndra@linux.alibaba.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-ID: <20250911-timers-v3-3-60508f640050@linux.alibaba.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
| * | migration: Add support for a variable-length array of UINT32 pointersTANG Tiancheng2025-10-031-0/+10
| |/ | | | | | | | | | | | | | | | | | | | | | | | | | | Add support for defining a vmstate field which is a variable-length array of pointers, and use this to define a VMSTATE_TIMER_PTR_VARRAY() which allows a variable-length array of QEMUTimer* to be used by devices. Message-id: 20250909-timers-v1-0-7ee18a9d8f4b@linux.alibaba.com Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com> Reviewed-by: Peter Xu <peterx@redhat.com> Signed-off-by: TANG Tiancheng <lyndra@linux.alibaba.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-ID: <20250911-timers-v3-2-60508f640050@linux.alibaba.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
* | Merge tag 'tracing-pull-request' of https://gitlab.com/stefanha/qemu into ↵Richard Henderson2025-10-012-24/+24
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | staging Pull request Tanish Desai and Paolo Bonzini's tracing Rust support. # -----BEGIN PGP SIGNATURE----- # # iQEzBAABCgAdFiEEhpWov9P5fNqsNXdanKSrs4Grc8gFAmjdSSIACgkQnKSrs4Gr # c8h8hwf/RXawMzImGn3I2kTOUWAQ97+yY0UgtyO010K71gypBa2EBcPIVH0ZOsy0 # oT5pF2w7k0g83DXqupXiZO3yjSSmeGBXlOw8QS6D+FN0VpsdxrYJnvzVMqCckOrR # 6wwM+fYYfCk/LwQFvjcMDdd6BSB/wUyMuBnh+fa8X9vxRL6CgMY7RpQd7YZ9JNtL # PFQscu/K6zUARxwQ/DZTx5jYlW4rE5O4mq80CW2l1pgnyOH5vH/TySTKp0yX8eDO # 5eoF7ttieOxxt6YobFak7EfWFvFuyp1j5NlWlyWKzhce1oSOAbaXnB1I61admRb3 # 7XrsTU0RjH6kp8ki4SZEoAh/HMw+4w== # =myWt # -----END PGP SIGNATURE----- # gpg: Signature made Wed 01 Oct 2025 08:30:42 AM PDT # gpg: using RSA key 8695A8BFD3F97CDAAC35775A9CA4ABB381AB73C8 # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>" [unknown] # gpg: aka "Stefan Hajnoczi <stefanha@gmail.com>" [unknown] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 8695 A8BF D3F9 7CDA AC35 775A 9CA4 ABB3 81AB 73C8 * tag 'tracing-pull-request' of https://gitlab.com/stefanha/qemu: tracetool/syslog: add Rust support tracetool/ftrace: add Rust support tracetool/log: add Rust support log: change qemu_loglevel to unsigned tracetool/simple: add Rust support rust: pl011: add tracepoints rust: qdev: add minimal clock bindings rust: add trace crate tracetool: Add Rust format support tracetool/backend: remove redundant trace event checks tracetool: add CHECK_TRACE_EVENT_GET_STATE trace/ftrace: move snprintf+write from tracepoints to ftrace.c tracetool: add SPDX headers treewide: remove unnessary "coding" header tracetool: remove dead code tracetool: fix usage of try_import() Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
| * | log: change qemu_loglevel to unsignedPaolo Bonzini2025-10-012-24/+24
| |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Bindgen makes the LOG_* constants unsigned, even if they are defined as (1 << 15): pub const LOG_TRACE: u32 = 32768; Make them unsigned in C as well through the BIT() macro, and also change the type of the variable that they are used with. Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org> Reviewed-by: Zhao Liu <zhao1.liu@intel.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Message-ID: <20250929154938.594389-14-pbonzini@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
* | Merge tag 'pull-error-2025-09-30-v2' of https://repo.or.cz/qemu/armbru into ↵Richard Henderson2025-10-013-10/+4
|\ \ | |/ |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | staging Error reporting patches for 2025-09-30 # -----BEGIN PGP SIGNATURE----- # # iQJGBAABCAAwFiEENUvIs9frKmtoZ05fOHC0AOuRhlMFAmjczNQSHGFybWJydUBy # ZWRoYXQuY29tAAoJEDhwtADrkYZTX3kP/1doayteIqVfNLYJn8EDIU6ccZgAsdVw # GLHkxSikaBBzjJoG2ebadGusmX8F5H16/KG4vpilP1WHuIw73QRiCFJduFmfFjU/ # SCagaj58PPZaiNJeydN8dSHIDyLLAbIpI1xqdFObBgVKl37E7nZ2uatjKwopmK69 # iV7y39Xcs6wu4gVsz5IH3FC+CdzctWfjjkZbkk3PeNj+Nt7q22RvbB0Rf30P9SBo # FWnh3UEDz2VIlnuIFSAAXQfJ0+h2l9L0yZ05RnVyMM8rZ72v393X8h/jgEo0ETHI # eNnJHh/pKL6I+vq10aM/mMgj5fRsly+CsAmjC+11ULg7ybDUMbEU32Ftqeylo2HS # ZkGw20egEgzMldC5yELTgTjMPCGF9VWWwNNH9OWM58w9ZCyjDb9wDw1uaHU3Tc15 # TZaBwcCGEc/atRFHfWD66oK/KcDrFnWETr6qi9fPJ2SJxiHjHbJe/eNQaxxrEZCu # 1OntcQdL46Ef1LeQGzhgLNlKyAxq9V9ybh8gPD4yhCK5NCNub2NvWj/CLlnxGJwH # JHZRRXvVoBPlIMSMydGPV8RHkfUr4NMgHql5Y+VykheEBcg+ThZ2JSjS7avwzCHM # 5dSUeV+YcvhQN2sojH4xdnUUJWxAAEM1SirkaHTHWZoDKagfjHu3SEYwNyIIchhi # BAfRdd94Lxpg # =tlEf # -----END PGP SIGNATURE----- # gpg: Signature made Tue 30 Sep 2025 11:40:20 PM PDT # gpg: using RSA key 354BC8B3D7EB2A6B68674E5F3870B400EB918653 # gpg: issuer "armbru@redhat.com" # gpg: Good signature from "Markus Armbruster <armbru@redhat.com>" [unknown] # gpg: aka "Markus Armbruster <armbru@pond.sub.org>" [unknown] # gpg: WARNING: The key's User ID is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 354B C8B3 D7EB 2A6B 6867 4E5F 3870 B400 EB91 8653 * tag 'pull-error-2025-09-30-v2' of https://repo.or.cz/qemu/armbru: error: Kill @error_warn ivshmem-flat: Mark an instance of missing error handling FIXME ui/dbus: Consistent handling of texture mutex failure ui/dbus: Clean up dbus_update_gl_cb() error checking ui/pixman: Consistent error handling in qemu_pixman_shareable_free() util/oslib-win32: Do not treat null @errp as &error_warn ui/spice-core: Clean up error reporting net/slirp: Clean up error reporting hw/remote/vfio-user: Clean up error reporting migration/cpr: Clean up error reporting in cpr_resave_fd() hw/cxl: Convert cxl_fmws_link() to Error tcg: Fix error reporting on mprotect() failure in tcg_region_init() monitor: Clean up HMP gdbserver error reporting Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
| * error: Kill @error_warnMarkus Armbruster2025-10-012-7/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We added @error_warn some two years ago in commit 3ffef1a55ca (error: add global &error_warn destination). It has multiple issues: * error.h's big comment was not updated for it. * Function contracts were not updated for it. * ERRP_GUARD() is unaware of @error_warn, and fails to mask it from error_prepend() and such. These crash on @error_warn, as pointed out by Akihiko Odaki. All fixable. However, after more than two years, we had just of 15 uses, of which the last few patches removed seven as unclean or otherwise undesirable, adding back five elsewhere. I didn't look closely enough at the remaining seven to decide whether they are desirable or not. I don't think this feature earns its keep. Drop it. Thanks-to: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp> Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru> Message-ID: <20250923091000.3180122-14-armbru@redhat.com> Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
| * monitor: Clean up HMP gdbserver error reportingMarkus Armbruster2025-09-301-3/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | HMP command gdbserver used to emit two error messages for certain errors. For instance, with -M none: (qemu) gdbserver gdbstub: meaningless to attach gdb to a machine without any CPU. Could not open gdbserver on device 'tcp::1234' The first message is the specific error, and the second one a generic additional message that feels superfluous to me. Commit c0e6b8b798b (system: propagate Error to gdbserver_start (and other device setups)) turned the first message into a warning: warning: gdbstub: meaningless to attach gdb to a machine without any CPU. Could not open gdbserver on device 'tcp::1234' This is arguably worse. hmp_gdbserver() passes &error_warn to gdbserver_start(), so that failure gets reported as warning, and then additionally emits the generic error on failure. This is a misuse of &error_warn. Instead, receive the error in &err and report it, as usual. With this, gdbserver reports just the error: gdbstub: meaningless to attach gdb to a machine without any CPU. Cc: Alex Bennée <alex.bennee@linaro.org> Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Message-ID: <20250923091000.3180122-2-armbru@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
* | Merge tag 'pull-aspeed-20250929' of https://github.com/legoater/qemu into ↵Richard Henderson2025-09-295-0/+201
|\ \ | |/ |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | staging aspeed queue: * Introduce a new ASPEED OTP memory device model integrated with the Secure Boot Controller. It includes a new block device backend ('drive' property), is enabled for AST2600 SoCs and AST1030 SoCs. Functional tests are included * Changed "ast2700-evb" alias to point to the "ast2700a1-evb" machine * Introduce support for Aspeed PCIe host controller, including models for the PCIe Root Complex, Root Port, and PHY. Enabled for the AST2600 and AST2700 SoCs, and functional tests are included * Refactor Boot ROM support to improve code reuse across the different Aspeed machine. This is in preparation of vbootrom support in the ast2700fc machine * Improved Error Handling in the AST27x0-fc machine init functions # -----BEGIN PGP SIGNATURE----- # # iQIzBAABCAAdFiEEoPZlSPBIlev+awtgUaNDx8/77KEFAmjauRoACgkQUaNDx8/7 # 7KGAxA//YdPPGf8vKhPeblUt0/3760GGhI17TBWJFVZP/aZYcIiE0oRxo5zH0Lne # YjwFKTtx7GXzbE2wqVCLSt/VPDAEMk6wZGwGvMbmeydssyNjbPuF79+EVYnFsUrQ # Zkm8YPf/qFcKYFxp8O5GTKedAu70AFDMkFwy2xuBRqE5v0RQJe20+EHaiEC8S+3a # z5PIZJ74J3m4d+h+BlIHoiPe7hwTiyQ8V4rrWKWupwqDBExZfgNGX0zGPZDOlwOo # bpV38gb0ugyG93/FJSXyXQqiiH5h+10CaSzc1QuytYtQXAM2qj60Kh86YruTsbLu # g3TUz+jOgDatTk/MhH8q/gtwDjmqcygGeybbMJZeCzhq1qLIFgJW2KwPNwj8eHCd # 7jZp6NT9GekVMB+FghApWjc63EozKveJ3wzyHE481GGF7TgvuVF1Km+dVHNPjpBz # pjXgIeKmDl0hmgGp3Se9S8B1ryWK3+KvuNoKe63UK/NMCkSXF3xTerkU1evJjIrp # B9Tus7kLRqbDGWPyprp1d7Jv6MKJ6sELKvGHlalMcnzo4vAvQu1RB5s1kYqsCGlY # 414Bc2v/YdkLxQGU6hCp1rABq3sIdWVzxRJ4c0XalRNZBkOmlsy1p5FaG5RXQdhz # Gm27nzDAWBeNmWD6Jjjj6VwWmqBbSO4M4mYVTMnTfEaO7y/l1d4= # =7BzG # -----END PGP SIGNATURE----- # gpg: Signature made Mon 29 Sep 2025 09:51:38 AM PDT # gpg: using RSA key A0F66548F04895EBFE6B0B6051A343C7CFFBECA1 # gpg: Good signature from "Cédric Le Goater <clg@redhat.com>" [full] # gpg: aka "Cédric Le Goater <clg@kaod.org>" [full] * tag 'pull-aspeed-20250929' of https://github.com/legoater/qemu: (32 commits) hw/arm/aspeed_ast27x0-fc: Make sub-init functions return bool with errp hw/arm/aspeed_ast27x0-fc: Drop dead return checks hw/arm/aspeed: Move aspeed_load_vbootrom to common SoC code hw/arm/aspeed: Move aspeed_install_boot_rom to common SoC code hw/arm/aspeed: Move write_boot_rom to common SoC code hw/arm/aspeed: Move aspeed_board_init_flashes() to common SoC code tests/functional/arm/test_aspeed_ast2600: Add PCIe and network test hw/arm/aspeed_ast27x0: Introduce 3 PCIe RCs for AST2700 hw/pci-host/aspeed: Disable Root Device and place Root Port at 00:00.0 to AST2700 hw/pci-host/aspeed: Add AST2700 PCIe config with dedicated H2X blocks hw/pci-host/aspeed: Add AST2700 PCIe PHY hw/arm/aspeed_ast2600: Add PCIe RC support (RC_H only) hw/arm/aspeed: Wire up PCIe devices in SoC model hw/pci-host/aspeed: Add MSI support and per-RC IOMMU address space hw/pci-host/aspeed: Add AST2600 PCIe Root Port and make address configurable hw/pci-host/aspeed: Add AST2600 PCIe Root Device support hw/pci-host/aspeed: Add AST2600 PCIe config space and host bridge hw/pci-host/aspeed: Add AST2600 PCIe PHY model hw/pci/pci_ids: Add PCI vendor ID for ASPEED tests/functional/arm: Add AST2600 boot test with generated OTP image ... Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
| * hw/arm/aspeed: Move aspeed_load_vbootrom to common SoC codeJamin Lin2025-09-291-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Move the vbootrom loader helper into common SoC code so it can be reused by all ASPEED boards, and decouple the API from AspeedMachineState. Specifically: - Move aspeed_load_vbootrom() to hw/arm/aspeed_soc_common.c and declare it in include/hw/arm/aspeed_soc.h. - Change the helper’s signature to take AspeedSoCState * instead of AspeedMachineState *. - Update aspeed_machine_init() call sites accordingly. No functional change. Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Link: https://lore.kernel.org/qemu-devel/20250925050535.2657256-5-jamin_lin@aspeedtech.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
| * hw/arm/aspeed: Move aspeed_install_boot_rom to common SoC codeJamin Lin2025-09-291-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Move the boot ROM install helper into common SoC code so it can be reused by all ASPEED boards, and decouple the API from AspeedMachineState. Specifically: - Move aspeed_install_boot_rom() to hw/arm/aspeed_soc_common.c and declare it in include/hw/arm/aspeed_soc.h. - Change the helper’s signature to take AspeedSoCState * and a MemoryRegion * provided by the caller, instead of AspeedMachineState *. - Update aspeed_machine_init() call sites accordingly. No functional change. Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Link: https://lore.kernel.org/qemu-devel/20250925050535.2657256-4-jamin_lin@aspeedtech.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
| * hw/arm/aspeed: Move write_boot_rom to common SoC codeJamin Lin2025-09-291-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Move the write_boot_rom helper from hw/arm/aspeed.c into hw/arm/aspeed_soc_common.c so it can be reused by all ASPEED machines. Export the API as aspeed_write_boot_rom() in include/hw/arm/aspeed_soc.h and update the existing call site to use the new helper. No functional change. Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Link: https://lore.kernel.org/qemu-devel/20250925050535.2657256-3-jamin_lin@aspeedtech.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
| * hw/arm/aspeed_ast27x0: Introduce 3 PCIe RCs for AST2700Jamin Lin2025-09-291-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add PCIe Root Complex support to the AST2700 SoC model. The AST2700 A1 silicon revision provides three PCIe Root Complexes: PCIe0 with its PHY at 0x12C15000, config (H2X) block at 0x120E0000, MMIO window at 0x60000000, and GIC IRQ 56. PCIe1 with its PHY at 0x12C15800, config (H2X) block at 0x120F0000, MMIO window at 0x80000000, and GIC IRQ 57. PCIe2 with its PHY at 0x14C1C000, config (H2X) block at 0x140D0000, MMIO window at 0xA0000000, and IRQ routed through INTC4 bit 31 mapped to GIC IRQ 196. Each RC instantiates a PHY device, a PCIe config (H2X) bridge, and an MMIO alias region. The per-RC MMIO alias size is 0x20000000. The AST2700 A0 silicon revision does not support PCIe Root Complexes, so pcie_num is set to 0 in that variant. Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Link: https://lore.kernel.org/qemu-devel/20250919093017.338309-13-jamin_lin@aspeedtech.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
| * hw/pci-host/aspeed: Add AST2700 PCIe config with dedicated H2X blocksJamin Lin2025-09-291-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Introduce PCIe config (H2X) support for the AST2700 SoC. Unlike the AST2600, the AST2700 provides three independent Root Complexes, each with its own H2X (AHB to PCIe bridge) register block of size 0x100. All RCs use the same MSI address (0x000000F0). The H2X block includes two different access paths: 1. CFGI (internal bridge): used to access the host bridge itself, always with BDF=0. The AST2700 controller simplifies the design by exposing only one register (H2X_CFGI_TLP) with fields for ADDR[15:0], BEN[19:16], and WR[20]. This is not a full TLP descriptor as in the external case. For QEMU readability and code reuse, the model converts H2X_CFGI_TLP into a standard TLP TX descriptor with BDF forced to 0 and then calls the existing helpers aspeed_pcie_cfg_readwrite() and aspeed_pcie_cfg_translate_write(). 2. CFGE (external EP access): used to access external endpoints. The AST2700 design provides H2X_CFGE_TLP1 and a small FIFO at H2X_CFGE_TLPN. For reads, TX DESC0 is stored in TLP1 and DESC1/DESC2 in TLPN FIFO slots. For writes, TX DESC0 is stored in TLP1, DESC1/DESC2 in TLPN FIFO[0..1], and TX write data in TLPN FIFO[2]. The implementation extends AspeedPCIECfgState with a small FIFO and index, wires up new register definitions for AST2700, and adds a specific ops table and class (TYPE_ASPEED_2700_PCIE_CFG). The reset handler clears the FIFO state. Interrupt and MSI status registers are also supported. This provides enough modeling for firmware and drivers to use any of the three PCIe RCs on AST2700 with their own dedicated H2X config window, while reusing existing TLP decode helpers in QEMU. Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Link: https://lore.kernel.org/qemu-devel/20250919093017.338309-11-jamin_lin@aspeedtech.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
| * hw/pci-host/aspeed: Add AST2700 PCIe PHYJamin Lin2025-09-291-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Introduce a PCIe Host Controller PHY model for AST2700. This adds an AST2700 specific PHY type (TYPE_ASPEED_2700_PCIE_PHY) with a 0x800 byte register space and link-status bits compatible with the firmware’s expectations. AST2700 provides three PCIe RCs; PCIe0 and PCIe1 are GEN4, PCIe2 is GEN2. The PHY exposes: PEHR_2700_LINK_GEN2 at 0x344, bit 18 indicates GEN2 link up PEHR_2700_LINK_GEN4 at 0x358, bit 8 indicates GEN4 link up In real hardware these GEN2/GEN4 link bits are mutually exclusive. QEMU does not model GEN2 vs GEN4 signaling differences, so the reset handler sets both bits to 1. This keeps the model simple and lets firmware see the link as up; firmware will read the appropriate register per RC port to infer the intended mode. The header gains TYPE_ASPEED_2700_PCIE_PHY; the new class derives from TYPE_ASPEED_PCIE_PHY, sets nr_regs to 0x800 >> 2, and installs an AST2700 reset routine that programs the class code (0x06040011) and the GEN2/GEN4 status bits. Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Link: https://lore.kernel.org/qemu-devel/20250919093017.338309-10-jamin_lin@aspeedtech.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
| * hw/arm/aspeed_ast2600: Add PCIe RC support (RC_H only)Jamin Lin2025-09-291-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Wire up the PCIe Root Complex in the AST2600 SoC model. According to the AST2600 firmware driver, only the RC_H controller is supported. RC_H uses PCIe PHY1 at 0x1e6ed200 and the PCIe config (H2X) register block at 0x1e770000. The RC_H MMIO window is mapped at 0x70000000–0x80000000. RC_L is not modeled. The RC_H interrupt is wired to IRQ 168. Only RC_H is realized and connected to the SoC interrupt controller. The SoC integration initializes PCIe PHY1, instantiates a single RC instance, wires its MMIO regions, and connects its interrupt. An alias region is added to map the RC MMIO space into the guest physical address space. This provides enough functionality for firmware and guest drivers to discover and use the AST2600 RC_H Root Complex while leaving RC_L unimplemented. Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Link: https://lore.kernel.org/qemu-devel/20250919093017.338309-9-jamin_lin@aspeedtech.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
| * hw/arm/aspeed: Wire up PCIe devices in SoC modelJamin Lin2025-09-291-0/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add PCIe controller and PHY instances to the Aspeed SoC state and device enum. This prepares the SoC model to host PCIe Root Complexes and their associated PHYs. Although the AST2600 supports only a single Root Complex, the AST2700 provides three Root Complexes. For this reason, the model defines arrays of three PCIe config/PHY objects and enumerates three PCIe device IDs so that both SoCs can be represented consistently. Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Link: https://lore.kernel.org/qemu-devel/20250919093017.338309-8-jamin_lin@aspeedtech.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
| * hw/pci-host/aspeed: Add MSI support and per-RC IOMMU address spaceJamin Lin2025-09-291-0/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add MSI support to the ASPEED PCIe RC/Config model and introduce a per-RC "IOMMU root" address space to correctly route MSI writes. On AST2700 all RCs use the same MSI address, and the MSI target is PCI system memory (not normal DRAM). If the MSI window were mapped into real system RAM, an endpoint's write could be observed by other RCs and spuriously trigger their interrupts. To avoid this, each RC now owns an isolated IOMMU root AddressSpace that contains a small MSI window and a DRAM alias region for normal DMA. The MSI window captures writes and asserts the RC IRQ. MSI status bits are tracked in new H2X RC_H registers (R_H2X_RC_H_MSI_EN{0,1} and R_H2X_RC_H_MSI_STS{0,1}). Clearing all status bits drops the IRQ. The default MSI address is set to 0x1e77005c and can be overridden via the msi-addr property. This keeps MSI traffic contained within each RC while preserving normal DMA to system DRAM. It enables correct MSI/MSI-X interrupt delivery when multiple RCs use the same MSI target address. Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Link: https://lore.kernel.org/qemu-devel/20250919093017.338309-7-jamin_lin@aspeedtech.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
| * hw/pci-host/aspeed: Add AST2600 PCIe Root Port and make address configurableJamin Lin2025-09-291-0/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Introduce an ASPEED PCIe Root Port and wire it under the RC. The root port is modeled as TYPE_ASPEED_PCIE_ROOT_PORT (subclass of TYPE_PCIE_ROOT_PORT). Key changes: - Add TYPE_ASPEED_PCIE_ROOT_PORT (PCIESlot-based) with vendor/device IDs and AER capability offset. - Extend AspeedPCIERcState to embed a root_port instance and a configurable rp_addr. - Add "rp-addr" property to the RC to place the root port at a specific devfn on the root bus. - Set the root port's "chassis" property to ensure a unique chassis per RC. - Extend AspeedPCIECfgClass with rc_rp_addr defaulting to PCI_DEVFN(8,0). Rationale: - AST2600 places the root port at 80:08.0 (bus 0x80, dev 8, fn 0). - AST2700 must place the root port at 00:00.0, and it supports three RCs. Each root port must therefore be uniquely identifiable; uses the PCIe "chassis" ID for that. - Providing a configurable "rp-addr" lets platforms select the correct devfn per SoC family, while the "chassis" property ensures uniqueness across multiple RC instances on AST2700. Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Link: https://lore.kernel.org/qemu-devel/20250919093017.338309-6-jamin_lin@aspeedtech.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
| * hw/pci-host/aspeed: Add AST2600 PCIe Root Device supportJamin Lin2025-09-291-0/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Introduce a PCIe Root Device for AST2600 platform. The AST2600 root complex exposes a PCIe root device at bus 80, devfn 0. This root device is implemented as a child of the PCIe RC and modeled as a host bridge PCI function (class_id = PCI_CLASS_BRIDGE_HOST). Key changes: - Add a new device type "aspeed.pcie-root-device". - Instantiate the root device as part of AspeedPCIERcState. - Initialize it during RC realize() and attach it to the root bus. - Mark the root device as non-user-creatable. - Add RC boolean property "has-rd" to control whether the Root Device is created (platforms can enable/disable it as needed). Note: Only AST2600 implements this PCIe root device. AST2700 does not provide one. Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Link: https://lore.kernel.org/qemu-devel/20250919093017.338309-5-jamin_lin@aspeedtech.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
| * hw/pci-host/aspeed: Add AST2600 PCIe config space and host bridgeJamin Lin2025-09-291-0/+59
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Introduce PCIe config and host bridge model for the AST2600 platform. This patch adds support for the H2X (AHB to PCIe Bus Bridge) controller with a 0x100 byte register space. The register layout is shared between two root complexes: 0x00–0x7f is common, 0x80–0xbf for RC_L, and 0xc0–0xff for RC_H. Only RC_H is modeled in this implementation. The RC_H bus uses bus numbers in the 0x80–0xff range instead of the standard root bus 0x00. To allow the PCI subsystem to discover devices, the host bridge logic remaps the root bus number back to 0x00 whenever the configured bus number matches the "bus-nr" property. New MMIO callbacks are added for the H2X config space: - aspeed_pcie_cfg_read() and aspeed_pcie_cfg_write() handle register accesses. - aspeed_pcie_cfg_readwrite() provides configuration read/write support. - aspeed_pcie_cfg_translate_write() handles PCIe byte-enable semantics for write operations. The reset handler initializes the H2X register block with default values as defined in the AST2600 datasheet. Additional changes: - Implement ASPEED PCIe root complex (TYPE_ASPEED_PCIE_RC). - Wire up interrupt propagation via aspeed_pcie_rc_set_irq(). - Add tracepoints for config read/write and INTx handling. Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Link: https://lore.kernel.org/qemu-devel/20250919093017.338309-4-jamin_lin@aspeedtech.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
| * hw/pci-host/aspeed: Add AST2600 PCIe PHY modelJamin Lin2025-09-291-0/+42
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch introduces an initial ASPEED PCIe PHY/host controller model to support the AST2600 SoC. It provides a simple register block with MMIO read/write callbacks, integration into the build system, and trace events for debugging. Key changes: 1. PCIe PHY MMIO read/write callbacks Implemented aspeed_pcie_phy_read() and aspeed_pcie_phy_write() to handle 32-bit register accesses. 2. Build system and Kconfig integration Added CONFIG_PCI_EXPRESS_ASPEED in hw/pci-host/Kconfig and meson rules. Updated ASPEED_SOC in hw/arm/Kconfig to imply PCI_DEVICES and select PCI_EXPRESS_ASPEED. 3. Trace events for debug New tracepoints aspeed_pcie_phy_read and aspeed_pcie_phy_write allow monitoring MMIO accesses. 4. Register space and defaults (AST2600 reference) Expose a 0x100 register space, as documented in the AST2600 datasheet. On reset, set default values: PEHR_ID: Vendor ID = ASPEED, Device ID = 0x1150 PEHR_CLASS_CODE = 0x06040006 PEHR_DATALINK = 0xD7040022 PEHR_LINK: bit[5] set to 1 to indicate link up. This provides a skeleton device for the AST2600 platform. It enables firmware to detect the PCIe link as up by default and allows future extension. This commit is the starting point of the series to introduce ASPEED PCIe Root Complex (RC) support. Based on previous work from Cédric Le Goater, the following commits in this series extend and refine the implementation: - Add a PCIe Root Port so that devices can be attached without requiring an extra bridge. - Restrict the Root Port device instantiation to the AST2600 platform. - Integrate aspeed_cfg_translate_write() to support both AST2600 and AST2700. - Add MSI support and a preliminary RC IOMMU address space. - Fix issues with MSI interrupt clearing. - Extend support to the AST2700 SoC. - Drop the AST2600 RC_L support. - Introduce PCIe RC functional tests covering both AST2600 and AST2700. Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Link: https://lore.kernel.org/qemu-devel/20250919093017.338309-3-jamin_lin@aspeedtech.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
| * hw/pci/pci_ids: Add PCI vendor ID for ASPEEDJamin Lin2025-09-291-0/+2
| | | | | | | | | | | | | | Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Link: https://lore.kernel.org/qemu-devel/20250919093017.338309-2-jamin_lin@aspeedtech.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
| * hw/arm: Integrate ASPEED OTP memory support into AST1030 SoCsKane-Chen-AS2025-09-291-0/+1
| | | | | | | | | | | | | | | | | | | | The has_otp attribute is enabled in the SBC subclasses for AST1030 to control the presence of OTP support per SoC type. Signed-off-by: Kane-Chen-AS <kane_chen@aspeedtech.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Link: https://lore.kernel.org/qemu-devel/20250812094011.2617526-7-kane_chen@aspeedtech.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
| * hw/misc/aspeed_sbc: Connect ASPEED OTP memory device to SBCKane-Chen-AS2025-09-291-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch connects the aspeed.otp device to the ASPEED Secure Boot Controller (SBC) model. It implements OTP memory access via the SBC's command interface and enables emulation of secure fuse programming flows. The following OTP commands are supported: - READ: reads a 32-bit word from OTP memory into internal registers - PROG: programs a 32-bit word value to the specified OTP address Trace events are added to observe read/program operations and command handling flow. Signed-off-by: Kane-Chen-AS <kane_chen@aspeedtech.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Link: https://lore.kernel.org/qemu-devel/20250812094011.2617526-3-kane_chen@aspeedtech.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
| * hw/nvram/aspeed_otp: Add ASPEED OTP memory device modelKane-Chen-AS2025-09-291-0/+33
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Introduce a QEMU device model for ASPEED's One-Time Programmable (OTP) memory. This model simulates a word-addressable OTP region used for secure fuse storage. The OTP memory can operate with an internal memory buffer. The OTP model provides a memory-like interface through a dedicated AddressSpace, allowing other device models (e.g., SBC) to issue transactions as if accessing a memory-mapped region. Signed-off-by: Kane-Chen-AS <kane_chen@aspeedtech.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Link: https://lore.kernel.org/qemu-devel/20250812094011.2617526-2-kane_chen@aspeedtech.com Signed-off-by: Cédric Le Goater <clg@redhat.com>