Extract the implicit MO_TE definition in order to replace
it in the next commit.
Mechanical change using:
$ for n in UW UL UQ UO SW SL SQ; do \
sed -i -e "s/MO_TE$n/MO_TE | MO_$n/" \
$(git grep -l MO_TE$n target/hexagon); \
done
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20251010155045.78220-3-philmd@linaro.org> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Merge tag 'pull-target-arm-20251023' of https://gitlab.com/pm215/qemu into staging
target-arm queue:
* target/arm: Enable FEAT_AIE for -cpu max
* target/arm: Fix reads of CNTFRQ_EL0 in linux-user mode
* target/arm: Implement SME2 support in gdbstub
* hw/intc/arm_gicv3_dist: Implement GICD_TYPER2 as 0
* hw/intc/arm_gicv3_kvm: Avoid reading ICC_CTLR_EL1 from kernel in cpuif reset
* MAINTAINERS: Claim the Arm XML in gdb-xml
* hw/net/rocker: Don't overflow in of_dpa_mask2prefix()
# -----BEGIN PGP SIGNATURE-----
#
# iQJNBAABCAA3FiEE4aXFk81BneKOgxXPPCUl7RQ2DN4FAmj6QZ8ZHHBldGVyLm1h
# eWRlbGxAbGluYXJvLm9yZwAKCRA8JSXtFDYM3gA1D/0S210sIggCfQoJGXrcEgEh
# pfoRMnESlMk2rdnkYdSUrWp+62/mVx+PwaJxtle4HOzCp2iEwDttJI7XSJoUIg90
# uYLg9wCCjMxu5oHrRgD5xTzJPVALJLHSO2oF3UXmTk44nCxbcAerM3lQYiTJJRZA
# 32uy4RhNdDDy+KhZccUAD1XNR1kcoczMQ2lxMD9NADFgRF5E4z06grVIwiuRe6sK
# 4GhkMIXox9679qQMX/IkVKWJyIPEQv4F42B0Ksbpe4GxJxmt/Q/4Ef1dHYWwodwr
# X0Ot7OMClBsEoivlgeMAhLrU92RY1sVrITGRn675tJ6Hsaz3PnkjEF7t9aX4PqiP
# TDStDpcli7zOU/O5QL5qrNF7GZfhNlBdZmFFE6vZk6eGjAdhev8eNmgU33hP5ndr
# sbrVYZ+UQvWkGrUWl9Vopw0rPHrBejtQ4xWFSp0LJqX1Ev6R3LDIA+XOxvetue1t
# jiqlVqJfnTcsggfy2/nmY/zgdQDruNhvg8OrY1XM8Zhw7TT+1WFoh2K0OtgnxFi8
# pPpg15MMI872lMbn9U81qHFxfC82LXr4nw8hn6ox36FUSCDdqqdSjIkCb7OstyC9
# lrgd9WbmkeG9fJqhiSaKywgfvOGbfIfrRiJpKkSSeJQIjX8HxqjDCtOARvGw0duq
# 5no0CUpaUoPT6LFsl7/3wA==
# =ZRVN
# -----END PGP SIGNATURE-----
# gpg: Signature made Thu 23 Oct 2025 09:54:23 AM CDT
# gpg: using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE
# gpg: issuer "peter.maydell@linaro.org"
# gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [unknown]
# gpg: aka "Peter Maydell <pmaydell@gmail.com>" [unknown]
# gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" [unknown]
# gpg: aka "Peter Maydell <peter@archaic.org.uk>" [unknown]
# gpg: WARNING: The key's User ID is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83 15CF 3C25 25ED 1436 0CDE
* tag 'pull-target-arm-20251023' of https://gitlab.com/pm215/qemu:
hw/net/rocker: Don't overflow in of_dpa_mask2prefix()
tests/tcg/aarch64: Add test case for SME2 gdbstub registers
target/arm: Implement org.gnu.gdb.aarch64.tls XML feature in gdbstub
target/arm: Implement SME2 support in gdbstub
MAINTAINERS: Claim the Arm XML in gdb-xml
hw/intc/arm_gicv3_kvm: Avoid reading ICC_CTLR_EL1 from kernel in cpuif reset
target/arm: Fix reads of CNTFRQ_EL0 in linux-user mode
target/arm: Enable FEAT_AIE for -cpu max
target/arm: Honor param.aie in get_phys_addr_lpae
target/arm: Use el local indexing mair_el
target/arm: Drop trivial assert vs attrindx
target/arm: Add AIE to ARMVAParameters
target/arm: Implement MAIR2_ELx and AMAIR2_ELx
target/arm: Add isar feature test for FEAT_AIE
hw/intc/arm_gicv3_kvm: Drop DPRINTF macro
hw/intc/arm_gicv3_dist: Implement GICD_TYPER2 as 0
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Merge tag 'pull-ppc-for-10.2-d2-20251023-1' of https://gitlab.com/harshpb/qemu into staging
ppc queue for 10.2
* FADUMP Support for pSeries
* Pegasos II cleanup and Pegasos I emulation
* Deprecation of pseries 3.0 up till 4.2
* Coverity fix for amigaone (CID: 1641398)
# -----BEGIN PGP SIGNATURE-----
#
# iQIzBAABCAAdFiEEa4EM1tK+EPOIPSFCRUTplPnWj7sFAmj6G24ACgkQRUTplPnW
# j7uSmA/+MECjSD6TTVaRFdE/+Cd9LVMp8HmlkteaT+Fp/MhJKUGAxF89eBrZKBsJ
# Ukecklx+6x1d6grmBIAaI3sGW3qJW42CcZL4Q1xuL+zsny8sZ3vpp3q/Haxn68WV
# j53LC46rqCUueBffWWRf0q3wRovjY1MiO3LmQn+sEPLcMGLgghvD4kl2WD2uI/Gy
# iYeZJq+FjroVp606xVXQHhymuQeXd/4txGEzU2x7+FpLtdhuoxKa7FD+YtJ4PP3a
# qgZtZy3y4Bs41Gm6uEjdUnuKINjfADOhjqSDzqY5JZF7tgYh5hK0ibd1MI+opvCt
# 39YTpDoN18ljtO2g509sBuywxkz+y/EDsI8pry42MpkXxys2bj8mXoAV45jBOp5s
# n/GHfJ0d//dm2gpDxGhOKFK5qvFldo8tX5msgbMAXirbXzke5PVHbMr/YXmM7kkW
# 4DaKnMjyRxPIDeyqPfjKspC8VnmF6Z6LzDSMYGYejHO/OKlNE7ZQqaYh5itNTaqE
# xkRC+WISGm98cGYpu57VvD/wE0VmygBZ2l+j5gYS5tDVniZW3B4dUAOAqo7JCbIO
# uMfRgmHaR0Jc2Xj5wf8J/D1ZzDok2OV2siabfwew5pvhJl7HiCoH/k+qzgovC5hO
# L/5P4n+7ZRJwLhP45ewXkEoOK5tWowofdq/5SsFjie7n8d3U5cU=
# =usd9
# -----END PGP SIGNATURE-----
# gpg: Signature made Thu 23 Oct 2025 07:11:26 AM CDT
# gpg: using RSA key 6B810CD6D2BE10F3883D21424544E994F9D68FBB
# gpg: Good signature from "Harsh Prateek Bora <harsh.prateek.bora@gmail.com>" [undefined]
# gpg: aka "Harsh Prateek Bora <harshpb@linux.ibm.com>" [undefined]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 6B81 0CD6 D2BE 10F3 883D 2142 4544 E994 F9D6 8FBB
* tag 'pull-ppc-for-10.2-d2-20251023-1' of https://gitlab.com/harshpb/qemu: (32 commits)
MAINTAINERS: Add entry for FADump (pSeries)
tests/functional: Add test for fadump in PSeries
hw/ppc: Enable fadump for PSeries
hw/ppc: Pass dump-sizes property for fadump in device tree
hw/ppc: Implement saving CPU state in Fadump
hw/ppc: Preserve memory regions registered for fadump
hw/ppc: Trigger Fadump boot if fadump is registered
hw/ppc: Implement fadump register command
hw/ppc/pegasos2: Add VOF support for pegasos1
hw/ppc/pegasos2: Add Pegasos I emulation
hw/ppc/pegasos2: Add bus frequency to machine state
hw/ppc/pegasos2: Introduce abstract superclass
hw/ppc/pegasos2: Move hardware specific parts out of machine reset
hw/ppc/pegasos2: Move PCI IRQ routing setup to a function
hw/ppc/pegasos2: Add south bridge pointer in the machine state
hw/ppc/pegasos2: Rename mv field in machine state
hw/ppc/pegasos2: Remove fdt pointer from machine state
hw/ppc/pegasos2: Change device tree generation
hw/ppc/pegasos2: Remove explicit name properties from device tree
ppc/vof: Make nextprop behave more like Open Firmware
...
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Merge tag 'pull-loongarch-20251023' of https://github.com/bibo-mao/qemu into staging
loongarch queue
# -----BEGIN PGP SIGNATURE-----
#
# iHUEABYKAB0WIQQNhkKjomWfgLCz0aQfewwSUazn0QUCaPoVJAAKCRAfewwSUazn
# 0V1sAP4xtZMCEK9XuKApu4ZyTfPAtl0WLmhEQUKuEn3A6lNfowD9EUTMW3ksiyY/
# hZRb4D8WIJGj3nEIWvLiTg3a+wBT1AI=
# =sB19
# -----END PGP SIGNATURE-----
# gpg: Signature made Thu 23 Oct 2025 06:44:36 AM CDT
# gpg: using EDDSA key 0D8642A3A2659F80B0B3D1A41F7B0C1251ACE7D1
# gpg: Good signature from "bibo mao <maobibo@loongson.cn>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 7044 3A00 19C0 E97A 31C7 13C4 8E86 8FB7 A176 9D4C
# Subkey fingerprint: 0D86 42A3 A265 9F80 B0B3 D1A4 1F7B 0C12 51AC E7D1
* tag 'pull-loongarch-20251023' of https://github.com/bibo-mao/qemu:
target/loongarch: Add bit A/D checking in TLB entry with PTW supported
target/loongarch: Update matched ptw bit A/D with PTW supported
target/loongarch: Add basic hardware PTW support
target/loongarch: Add common interface update_tlb_index()
target/loongarch: Add field tlb_index to record TLB search info
target/loongarch: Move last PTE lookup into page table walker loop
target/loongarch: Reserve higher 48 bit PTE attribute with huge page
target/loongarch: Add debug parameter with loongarch_page_table_walker()
target/loongarch: Add MMUContext parameter in fill_tlb_entry()
target/loongarch: target/loongarch: Add common function get_tlb_random_index()
target/loongarch: Add function sptw_prepare_tlb before adding tlb entry
target/loongarch: Add present and write bit with pte entry
target/loongarch: Add CSR_PWCH write helper function
target/loongarch: Use auto method with PTW feature
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Peter Maydell [Thu, 16 Oct 2025 14:54:07 +0000 (15:54 +0100)]
hw/net/rocker: Don't overflow in of_dpa_mask2prefix()
In of_dpa_mask2prefix() we do "(2 << i)" for a loop where i can go up
to 31. At i == 31 we shift off the top end of an integer. This
doesn't actually calculate the wrong value in practice, because we
calculate 0 - 1 which is the 0xffffffff mask we wanted (and for QEMU
shifting off the top of a signed integer is not UB); but it makes
Coverity complain.
We could fix this simply by using "2ULL" (where the "(2ULL << i) - 1"
expression also evaluates to 0xffffffff for i == 31), but in fact
this function is a slow looping implementation of counting the number
of trailing zeroes in the (network-order) input mask:
Peter Maydell [Fri, 17 Oct 2025 15:30:27 +0000 (16:30 +0100)]
tests/tcg/aarch64: Add test case for SME2 gdbstub registers
Test the SME2 register exposure over gdbstub, in the same way
we already do for SME.
Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20251017153027.969016-4-peter.maydell@linaro.org
Peter Maydell [Fri, 17 Oct 2025 15:30:26 +0000 (16:30 +0100)]
target/arm: Implement org.gnu.gdb.aarch64.tls XML feature in gdbstub
GDB expects the TLS registers to be exposed via org.gnu.gdb.aarch64.tls,
which will contain either just "tpidr", or else "tpidr" and "tpidr2".
This will be important for SME in future, because the lazy state
restoration scheme requires GDB to use the TPIDR2 information.
GDB doesn't currently implement that, but we should provide the
register via the XML so that we are ready when future GDB versions
support it.
Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20251017153027.969016-3-peter.maydell@linaro.org
Peter Maydell [Fri, 17 Oct 2025 15:30:25 +0000 (16:30 +0100)]
target/arm: Implement SME2 support in gdbstub
For SME2, we need to expose the new ZT0 register in the gdbstub XML.
gdb documents that the requirements are:
> The ‘org.gnu.gdb.aarch64.sme2’ feature is optional. If present,
> then the ‘org.gnu.gdb.aarch64.sme’ feature must also be present.
> The ‘org.gnu.gdb.aarch64.sme2’ feature should contain the
> following:
>
> - ZT0 is a register of 512 bits (64 bytes). It is defined as a
> vector of bytes.
Implement this.
Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20251017153027.969016-2-peter.maydell@linaro.org
Peter Maydell [Fri, 17 Oct 2025 15:42:44 +0000 (16:42 +0100)]
MAINTAINERS: Claim the Arm XML in gdb-xml
Add F: entries to the Arm CPU section to claim the Arm related
XML files in gdb-xml.
Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20251017154244.971608-1-peter.maydell@linaro.org
Peter Maydell [Thu, 23 Oct 2025 12:12:50 +0000 (13:12 +0100)]
hw/intc/arm_gicv3_kvm: Avoid reading ICC_CTLR_EL1 from kernel in cpuif reset
Currently in arm_gicv3_icc_reset() we read the kernel's value of
ICC_CTLR_EL1 as part of resetting the CPU interface. This mostly
works, but we're actually breaking an assumption the kernel makes
that userspace only accesses the in-kernel GIC data when the VM is
totally paused, which may not be the case if a single vCPU is being
reset. The effect is that it's possible that the read attempt
returns EBUSY.
Avoid this by reading the kernel's value of the reset ICC_CTLR_EL1
once in device realize. This brings ICC_CTLR_EL1 into line with
the other cpuif registers, where we assume we know what the kernel
is resetting them to and just update QEMU's data structures in
arm_gicv3_icc_reset().
Peter Maydell [Thu, 23 Oct 2025 12:12:50 +0000 (13:12 +0100)]
target/arm: Fix reads of CNTFRQ_EL0 in linux-user mode
In commit bd8e9ddf6f6 ("target/arm: Refactor default generic timer
frequency handling") we changed how we initialized the generic timer
frequency as reported in the CNTFRQ_EL0 register. As part of that,
we chanegd the linux-user version of the CNTFRQ_EL0 sysreg from
having a constant value set at compile time through the .resetvalue
field to having a reset value which we compute in a .resetfn.
This accidentally broke the reading of CNTFRQ_EL0 in linux-user mode,
because the cpreg is marked as ARM_CP_CONST, which means we translate
it as a read of the compile-time constant value in the .resetvalue
field. This is now zero, so userspace sees a 0 frequency value.
Fix the bug by dropping the ARM_CP_CONST marking. This will cause us
to translate the read as a load of the value from the CPU state
struct cp15.c14_cntfrq field, which is where the real frequency value
now lives.
Cc: qemu-stable@nongnu.org
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3159 Fixes: bd8e9ddf6f6 ("target/arm: Refactor default generic timer frequency handling") Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20251013161040.216819-1-peter.maydell@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20251014195017.421681-8-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20251014195017.421681-7-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20251014195017.421681-6-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
We just extracted 3 bits; the <= 7 test is trivially true.
Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20251014195017.421681-5-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Allow the bit to be set in TCR2;
extract the bit in aa64_va_parameters.
Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20251014195017.421681-4-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Enable the SCR.AIEn bit in scr_write, and test it in aien_access.
Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20251014195017.421681-3-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20251014195017.421681-2-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Peter Maydell [Thu, 23 Oct 2025 12:12:49 +0000 (13:12 +0100)]
hw/intc/arm_gicv3_kvm: Drop DPRINTF macro
We don't generally like DPRINTF debug macros, preferring tracepoints.
In this case the macro is used in only three places (reset, realize,
and in the unlikely event the host kernel doesn't have GICv3 register
access support). These don't seem worth converting to tracepoints,
so simply delete the macro and its uses.
Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Eric Auger <eric.auger@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Peter Maydell [Thu, 23 Oct 2025 12:12:49 +0000 (13:12 +0100)]
hw/intc/arm_gicv3_dist: Implement GICD_TYPER2 as 0
The GIC distributor registers GICD_TYPER2 is present when the
GICv4.1 is implemented, and RES0 otherwise. QEMU's TCG implementation
is only GICv4.0, so this register is RES0. However, since it's
reasonable for GICv4.1-aware software to read the register, expecting
the zero for GICv3 and GICv4.0, implement the case to avoid it being
logged as an invalid guest read.
Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Eric Auger <eric.auger@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Aditya Gupta [Tue, 21 Oct 2025 13:48:17 +0000 (19:18 +0530)]
tests/functional: Add test for fadump in PSeries
Add testcases for testing fadump with PSeries and PSeries+KVM
combinations
It tests if fadump is successfully detected and registered in the first
kernel boot. Then crashes the kernel, and verifies whether we have a
/proc/vmcore in the 2nd boot
Also introduce 'wait_for_regex_console_pattern' to check for cases where
there is a single success message, but can have multiple failure
messages.
This is particularly useful for cases such as fadump, where the
success message is
"Reserved 1024MB ... successfully"
But at the same point, it can fail with multiple errors such as
"Not supported" or "Allocation failed"
'wait_for_regex_console_pattern' also has a timeout, for cases when we
know the success/failure should appear in a short amount of time,
instead of waiting for the much longer test timeout, such as kernels
with support of fadump will print the success/failure in earlyboot of
the kernel, while kernel without support of fadump won't print anything
for long time, and without a timeout the testcase keeps waiting till
longer test timeout
Aditya Gupta [Tue, 21 Oct 2025 13:48:16 +0000 (19:18 +0530)]
hw/ppc: Enable fadump for PSeries
With all support in place for preserving memory regions, enable fadump by
exporting the "ibm,kernel-dump" property in the device tree, representing
the fadump dump information, in case of a crash.
Currently "ibm,configure-kernel-dump" RTAS call is already registered,
which tells the kernel that the platform (QEMU) supports fadump.
Now, in case of a crash, if fadump was registered, we also pass
"ibm,kernel-dump" in device tree, which tells the kernel that the fadump
dump is active.
Pass "fadump=on" to enable Linux to use firmware assisted dump.
Aditya Gupta [Tue, 21 Oct 2025 13:48:15 +0000 (19:18 +0530)]
hw/ppc: Pass dump-sizes property for fadump in device tree
Platform (ie. QEMU) is expected to pass few device tree properties for
details for fadump:
* "ibm,configure-kernel-dump-sizes": Space required to store dump data
for firmware provided dump sections (ie. CPU & HPTE regions)
* "ibm,configure-kernel-dump-version": Versions of fadump supported
Pass the above device tree nodes so that kernel can reserve sufficient
space for preserving the CPU state data
Aditya Gupta [Tue, 21 Oct 2025 13:48:14 +0000 (19:18 +0530)]
hw/ppc: Implement saving CPU state in Fadump
Kernel expects CPU states/register states in the format mentioned in
"Register Save Area" in PAPR.
The platform (in our case, QEMU) saves each CPU register in the form of
an array of "register entries", the start and end of this array is
signified by "CPUSTRT" and "CPUEND" register entries respectively.
The CPUSTRT and CPUEND register entry also has 4-byte logical CPU ID,
thus storing the CPU ID corresponding to the array of register entries.
Each register, and CPUSTRT, CPUEND has a predefined identifier.
Implement calculating identifier for a given register in
'fadump_str_to_u64', which has been taken from the linux kernel
Similarly GPRs also have predefined identifiers, and a corresponding
64-bit resiter value (split into two 32-bit cells). Implement
calculation of GPR identifiers with 'fadump_gpr_id_to_u64'
PAPR has restrictions on particular order of few registers, and is
free to be in any order for other registers.
Some registers mentioned in PAPR have not been exported as they are not
implemented in QEMU / don't make sense in QEMU.
Implement saving of CPU state according to the PAPR document
Aditya Gupta [Tue, 21 Oct 2025 13:48:13 +0000 (19:18 +0530)]
hw/ppc: Preserve memory regions registered for fadump
While the first kernel boots, it registers memory regions for fadump
such as:
* CPU state data (has to be populated by the platform)
* HPTE state data (has to be populated by the platform)
* Real Mode Regions (platform should copy it to requested
destination addresses)
* OS defined regions (such as parameter save area)
Platform is also expected to modify the 'bytes_dumped' to the length of
data preserved/copied by platform (ideally same as the source length
passed by kernel).
The kernel passes source address and length for the memory regions, and
a destination address to where the memory is to be copied.
Implement the preserving/copying of the Real Mode Regions and the
Parameter Save Area in QEMU Pseries
The regions are copied in chunks instead of copying all at once.
Aditya Gupta [Tue, 21 Oct 2025 13:48:12 +0000 (19:18 +0530)]
hw/ppc: Trigger Fadump boot if fadump is registered
According to PAPR:
R1–7.3.30–3. When the platform receives an ibm,os-term RTAS call, or
on a system reset without an ibm,nmi-interlock RTAS call, if the
platform has a dump structure registered through the
ibm,configure-kernel-dump call, the platform must process each
registered kernel dump section as required and, when available,
present the dump structure information to the operating system
through the “ibm,kernel-dump” property, updated with status for each
dump section, until the dump has been invalidated through the
ibm,configure-kernel-dump RTAS call.
If Fadump has been registered, trigger an Fadump boot (memory preserving
boot), if QEMU recieves a 'ibm,os-term' rtas call.
Implementing the fadump boot as:
* pause all vcpus (will need to save registers later)
* preserve memory regions specified by fadump (will be implemented
in future)
* do a memory preserving reboot (GUEST_RESET in QEMU doesn't clear
the memory)
Memory regions registered by fadump will be handled in a later patch.
Note: Preserving memory regions is not implemented yet so on an
"ibm,os-term" call will just trigger a reboot in QEMU if fadump is
registered, and the second kernel will boot as a normal boot (not
fadump boot)
Aditya Gupta [Tue, 21 Oct 2025 13:48:11 +0000 (19:18 +0530)]
hw/ppc: Implement fadump register command
Add skeleton to handle "ibm,configure-kernel-dump" rtas call in QEMU,
including register, unregister and invalidate commands.
The register just verifies the structure of the fadump memory structure
passed by kernel, and set fadump_registered in spapr state to true.
Verify basic details mandated by the PAPR, such as number of
inputs/output, and add handling for the three fadump commands:
regiser/unregister/invalidate.
The checks are based on the table in following requirement in PAPR v2.13:
"R1–7.3.30–1. For the Configure Platform Assisted Kernel Dump option ..."
Relevant section for the register command in PAPR is:
Section 7.3.30: "ibm,configure-kernel-dump RTAS call" (PAPR v2.13)
Note: Any modifications made by the kernel to the fadump memory
structure after the 'ibm,configure-kernel-dump' RTAS call returns will
not be reflected in QEMU, as QEMU retains the fadump memory structure
that was provided during fadump registration.
The kernel must unregister and re-register fadump to apply any changes
to the fadump memory structure.
BALATON Zoltan [Thu, 23 Oct 2025 00:06:19 +0000 (02:06 +0200)]
hw/ppc/pegasos2: Add VOF support for pegasos1
When running without firmware ROM using Virtual Open Firmware we need
to do some hardware initialisation and provide the device tree as the
machine firmware would normally do.
BALATON Zoltan [Thu, 23 Oct 2025 00:06:18 +0000 (02:06 +0200)]
hw/ppc/pegasos2: Add Pegasos I emulation
The Pegasos II is a redesign of the original Pegasos (later marked I)
that replaces the north bridge and has updated firmware but otherwise
these are very similar. The Pegasos uses the same north bridge that
AmigaOne used which we already emulate so we can also easily emulate
Pegasos I.
BALATON Zoltan [Thu, 23 Oct 2025 00:06:15 +0000 (02:06 +0200)]
hw/ppc/pegasos2: Move hardware specific parts out of machine reset
Move the pegasos2 specific chipset reset out from machine reset to a
separate function and move generic parts that are not pegasos2
specific from build_fdt to machine reset so now build_fdt only
contains pegasos2 specific parts and can be renamed accordingly.
BALATON Zoltan [Thu, 23 Oct 2025 00:06:09 +0000 (02:06 +0200)]
hw/ppc/pegasos2: Change device tree generation
We generate a flattened device tree programmatically for VOF. Change
this to load the static parts from a device tree blob and only
generate the parts that depend on run time conditions such as CPU
type, memory size and PCI devices. Moving the static parts in a dts
makes the board code simpler and more generic.
BALATON Zoltan [Thu, 23 Oct 2025 00:06:07 +0000 (02:06 +0200)]
ppc/vof: Make nextprop behave more like Open Firmware
The FDT does not normally store name properties but reconstructs it
from path but Open Firmware specification says each node should at
least have this property. This is correctly handled in getprop but
nextprop should also return it even if not present as a property.
Explicit name properties are still allowed because they are needed
e.g. on the root node that guests expect to have specific names as
seen on real machines instead of being empty so sometimes the node
name may need to be overriden. For example on pegasos MorphOS checks
the name of "/" and expects to find bplan,Pegasos2 which is how it
identifies the machine.
The SpaprMachineClass::phb_placement callback was only used by
the pseries-4.0 machine, which got removed. Remove it as now
unused, directly calling spapr_phb_placement().
Move spapr_phb_placement() definition to avoid forward declaration.
pseries-4.0 had been deprecated and due for removal now as per policy.
Also remove pre-4.1 migration hacks which were introduced for backward
compatibility.
Suggested-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: Cédric Le Goater <clg@redhat.com>
[PMD: Remove SpaprMachineClass::pre_4_1_migration field] Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Link: https://lore.kernel.org/qemu-devel/20251021084346.73671-9-philmd@linaro.org Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
pseries-3.1 had been deprecated and due for removal now as per policy.
Also remove backward compatibility flags and related code introduced for
pre pseries-4.0 machines.
Bibo Mao [Fri, 10 Oct 2025 03:11:07 +0000 (11:11 +0800)]
target/loongarch: Add bit A/D checking in TLB entry with PTW supported
With read/write access, add bit A/D checking if hardware PTW is
supported. If no matched, hardware page table walk is called. And
then bit A/D is updated in PTE entry and TLB entry is updated also.
Signed-off-by: Bibo Mao <maobibo@loongson.cn> Reviewed-by: Song Gao <gaosong@loongson.cn>
Bibo Mao [Thu, 23 Oct 2025 09:23:09 +0000 (17:23 +0800)]
target/loongarch: Add basic hardware PTW support
However with hardware PTW supported, hardware will search page table
with TLB miss. Also if there is no TLB miss however bit Present is not set,
hardware PTW will happen also. Because there is odd/even page in one TLB
entry on LoongArch system, for example in the first time odd TLB entry is
valid and even TLB entry is 0. When software accesses with address within
even page, there is no TLB miss only that TLB entry is 0. In this
condition, hardwre PTW will happen also.
Signed-off-by: Bibo Mao <maobibo@loongson.cn> Reviewed-by: Song Gao <gaosong@loongson.cn>
Bibo Mao [Thu, 9 Oct 2025 06:54:33 +0000 (14:54 +0800)]
target/loongarch: Add common interface update_tlb_index()
Common API update_tlb_index() is added here, it is to update TLB entry
with specified index. It is called by helper_tlbwr() now, also it can
be used by HW PTW when adding new TLB entry.
Signed-off-by: Bibo Mao <maobibo@loongson.cn> Reviewed-by: Song Gao <gaosong@loongson.cn>
Bibo Mao [Tue, 30 Sep 2025 02:41:23 +0000 (10:41 +0800)]
target/loongarch: Add field tlb_index to record TLB search info
With hardware PTW function, TLB entry will be searched at first.
If there is odd/even page on one TLB entry, and odd page is valid and
even page is none. When software access memory with address in even
page, hardware PTW will happen and fill new entry in the same TLB entry.
Here add field tlb_index to record TLB index when search TLB tables.
Signed-off-by: Bibo Mao <maobibo@loongson.cn> Reviewed-by: Song Gao <gaosong@loongson.cn>
Bibo Mao [Wed, 27 Aug 2025 03:53:07 +0000 (11:53 +0800)]
target/loongarch: Reserve higher 48 bit PTE attribute with huge page
With PTE entry, high bit 48-63 is valid HW bit for PTE attribute,
for example bit 63 is RPLV and bit 62 is NX. With page directory table,
it is physical address of page table from view of HW, so high bit
48-63 need be discarded.
Here reverve high bit 48-63 with huge page since it is PTE entry, and
only discard it with page directory table.
Signed-off-by: Bibo Mao <maobibo@loongson.cn> Reviewed-by: Song Gao <gaosong@loongson.cn>
Bibo Mao [Tue, 30 Sep 2025 02:19:15 +0000 (10:19 +0800)]
target/loongarch: Add debug parameter with loongarch_page_table_walker()
Add debug parameter with function loongarch_page_table_walker(),
in debug mode it is only to get physical address. And It used in
future HW PTW usage, bit dirty and access will be updated in HW
PTW mode.
Also function loongarch_page_table_walker() is renamed as
loongarch_ptw() for short.
Signed-off-by: Bibo Mao <maobibo@loongson.cn> Reviewed-by: Song Gao <gaosong@loongson.cn>
Bibo Mao [Tue, 30 Sep 2025 01:43:56 +0000 (09:43 +0800)]
target/loongarch: Add function sptw_prepare_tlb before adding tlb entry
With software page table walker, tlb entry comes from CSR registers.
however with hardware page table walker, tlb entry comes from page
table entry information directly, TLB CSR registers are not necessary.
Here add function sptw_prepare_context(), get tlb entry information
from TLB CSR registers.
Signed-off-by: Bibo Mao <maobibo@loongson.cn> Reviewed-by: Song Gao <gaosong@loongson.cn>
Bibo Mao [Thu, 9 Oct 2025 03:32:43 +0000 (11:32 +0800)]
target/loongarch: Add present and write bit with pte entry
With hardware PTW feature enabled, Present bit and Write bit is checked
by hardware, rather Valid bit and Dirty bit. Bit P means that the page is
valid and present, and bit W means that the page is writable.
The original V bit is treated as access bit, hardware sets this bit if
there is a read or write access. Bit D bit is updated by hardware if
there is a write access.
Signed-off-by: Bibo Mao <maobibo@loongson.cn> Reviewed-by: Song Gao <gaosong@loongson.cn>
Bibo Mao [Tue, 30 Sep 2025 01:14:58 +0000 (09:14 +0800)]
target/loongarch: Use auto method with PTW feature
PTW is short for page table walker, it is hardware page table walker
function. With PTW supported, hardware MMU will parse page table
table and update TLB entries automatically.
This patch adds type OnOffAuto for PTW feature setting.
Signed-off-by: Bibo Mao <maobibo@loongson.cn> Reviewed-by: Song Gao <gaosong@loongson.cn>
Merge tag 'pull-vfio-20251022' of https://github.com/legoater/qemu into staging
vfio queue:
* Fix CPR transfer
* Add support for VFIO_DMA_UNMAP_FLAG_ALL
* Fix vfio-user documentation
* Update Alex Williamson's email address
* Fix for vfio-region cache for the vGPU use case
# -----BEGIN PGP SIGNATURE-----
#
# iQIzBAABCAAdFiEEoPZlSPBIlev+awtgUaNDx8/77KEFAmj4y4QACgkQUaNDx8/7
# 7KFGOw/8DRo/tRCW5q5uQj8T5DPQqL7QSBsZ50Zbtxn31xAstx8d30waxNCYGyMz
# /LzKHATb/MFKtM4pZnQS9fVQRXsHaiFyokIx58u+xZpbxrAs8WeBsBgepftkid9+
# Mv88plvFdMRZuIiEmAZOvuIcCWjAMjDwJ60o/InykQR6Y2a+LawAy2Jp30wAp5q4
# 7RH4+CkjKP4G00WAjhi1cRZjjBOa8xA+BvD5CDMlZKpURnSivjK0K5XQARWpj3aG
# X0Ggg8LVsE98iJtq7g/+233QfCiuHe+c7FvVd+c6svg18n0uEYzfUUI0MGJPUtWS
# zxUlhDcNoy0XCVIb5Dd3QG+8NfetMV5T4oNrhZADRBjKHBk+OuJfI9yZFwAzXlKl
# n9hVRk/HVIsdi2f5OtRgUNJYhuph0gkryNPQQRDgPb8XLip/OeLRQJ4qUyZ4XuYA
# nfU3vZWFwfPdhfbqU6koa49VTIJTx2TGj/naFAeqLhJolGVTdjgXoJTIS62y58gd
# eKxJwkB0sVv7em8VvjhdsOPMdeosU/ZS82aM6B0u5PB/DepsG1tq5RSSkbmozgYJ
# 6muXwOsSwMQbvsf2KVy70kQCuTb5sKyWr2BlS8tvya5LV7BPbNNlOqtnapekCh+B
# C2cP1MAVs2LcKNQwI2avrDrb7mun6uupFtA3Ci7gxxbBulMQZTA=
# =O4HA
# -----END PGP SIGNATURE-----
# gpg: Signature made Wed 22 Oct 2025 07:18:12 AM CDT
# gpg: using RSA key A0F66548F04895EBFE6B0B6051A343C7CFFBECA1
# gpg: Good signature from "Cédric Le Goater <clg@redhat.com>" [full]
# gpg: aka "Cédric Le Goater <clg@kaod.org>" [full]
* tag 'pull-vfio-20251022' of https://github.com/legoater/qemu:
vfio: only check region info cache for initial regions
vfio: rename field to "num_initial_regions"
MAINTAINERS: Update Alex Williamson's email address
docs/system/devices/vfio-user: fix formatting
vfio/listener: Add an assertion for unmap_all
vfio/iommufd: Support unmap all in one ioctl()
vfio/container: Support unmap all in one ioctl()
accel/kvm: Fix an erroneous check on coalesced_mmio_ring
vfio/iommufd: Restore vbasedev's reference to hwpt after CPR transfer
vfio/iommufd: Set cpr.ioas_id on source side for CPR transfer
vfio/cpr-legacy: drop an erroneous assert
vfio/container: Remap only populated parts in a section
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Merge tag 'pull-aspeed-20251022' of https://github.com/legoater/qemu into staging
aspeed queue:
* Improve AST2700 co-processor models
* Add vbootrom support to the ast2700fc multi-soc machine
* Bump SDK version to v09.08 for the ast2700fc machine
* Add 32 bits property for Aspeed GPIOs
* Change ast2600-evb machine flash model to w25q512jv
# -----BEGIN PGP SIGNATURE-----
#
# iQIzBAABCAAdFiEEoPZlSPBIlev+awtgUaNDx8/77KEFAmj4ziMACgkQUaNDx8/7
# 7KFBBxAAy6LnSZDA9XncZsqVe1Vk254OLdwHAlOVgFD7pBDXp12qNBMJHyjw8QmV
# sxxQXyyLARq4z+P58HMdEBvqdwtdyrieo7lv7QsR8zhYa/HSJtFQmnwRVFKA9lS5
# vAJ1TRi+B29ff24DC2CVBjnAgjrvE0lxmcXoLhObFdc2gU4Gzd+Oia91Nbgf35gA
# NjfgIjMs1wKLO5SICCGDhW5bsdm2jYS+b5dP35VuvizfSihlUQMAbdnSXzLk2aT+
# iimik/aOAv/Tu3nV8G6RmQ/aWZhRNvuTGfBnK0AnSCWnQP6/9a9y+gp61mDzD8ht
# 6hpLgEbBTwldjdrvaejg1iYQ04szYNiIYRTxT7ral4sIkCEi0tg4yzOcpHLfSnr1
# 1YT3Z1+Z2z7w3jAsd/SqMfQXksLQR3G/51tGkatxHMJ4IScdt/cASZWXK3RlhXH1
# YrQjiF5GuanM0oMcbyhgoq+sWNXP4EIWC3i6ER7H6MSRlfIjG+27kuxfnzJuZtDU
# iAq4YD0tckoivhixvdv2OiT9IdYCDAeb/TMRy+5Xdf36D8NOhyoQUBgHeIhow6yJ
# nCNPyCkM4HnpgkF0C+fyPBTqUP2AQ8NiTzBQA1bLorSjEN/9LMKvY9lwkEammp8/
# VnfeoIzNHIupeEcFCO+vgomHBKo/i4DeetrQYGDGkicvR7ztP8k=
# =mivB
# -----END PGP SIGNATURE-----
# gpg: Signature made Wed 22 Oct 2025 07:29:23 AM CDT
# gpg: using RSA key A0F66548F04895EBFE6B0B6051A343C7CFFBECA1
# gpg: Good signature from "Cédric Le Goater <clg@redhat.com>" [full]
# gpg: aka "Cédric Le Goater <clg@kaod.org>" [full]
* tag 'pull-aspeed-20251022' of https://github.com/legoater/qemu:
hw/arm/aspeed: Remove ast2700fc self-aliasing
hw/arm/aspeed: ast2600-evb: Use w25q512jv flash model
tests/qtest: Add qtest for for ASPEED GPIO gpio-set property
hw/gpio: Add property for ASPEED GPIO in 32 bits basis
tests/functional/aarch64/ast2700fc: Add vbootrom test
tests/functional/aarch64/ast2700fc: Move coprocessor image loading to common function
tests/functional/aarch64/ast2700fc: Add eth2 network interface check in PCIe test
tests/functional/aarch64/ast2700fc: Update test ASPEED SDK v09.08
hw/arm/aspeed_ast27x0-fc: Add VBOOTROM support
hw/arm/aspeed_ast27x0-fc: Map FMC0 flash contents into CA35 boot ROM
hw/arm/ast27x0: Share single UART set across PSP, SSP, and TSP
hw/arm/ast27x0: Share single SCU instance across PSP, SSP, and TSP
hw/arm/ast27x0: Add SRAM link and alias mapping for TSP coprocessor
hw/arm/ast27x0: Add SRAM link and alias mapping for SSP coprocessor
hw/arm/aspeed_ast27x0-tsp: Add SDRAM region and fix naming and size to 512MB
hw/arm/aspeed_ast27x0-ssp: Add SDRAM region and fix naming and size to 512MB
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Merge tag 'hw-misc-20251021' of https://github.com/philmd/qemu into staging
Misc HW patches
- Replace compile-time checks by runtime ones to build virtio-mem.c once
- Cleanups in Raven PCI host bridge, audio and PC devices
- Allow machine dynamic registration of valid CPU types
- Introduce DEFINE_MACHINE_WITH_INTERFACE[_ARRAY]() macros
- Set DDR2 minimum write recovery time in EEPROM SPD
- Have PPCe500 machines abort gracefully when using invalid CPU
- Prevent buffer overflow in openrisc_sim_init()
- Pass PCI domain to Xen xc_physdev_map_pirq_msi()
- Fix register API leaks
- Simplify Xilinx CANFD model
- Unconditionally create System I/O on PReP machine
- Update documentation around '-soundhw' command line option
# -----BEGIN PGP SIGNATURE-----
#
# iQIzBAABCAAdFiEE+qvnXhKRciHc/Wuy4+MsLN6twN4FAmj4k3QACgkQ4+MsLN6t
# wN7dTw/9EIt8F4b0Y8fYgXngAPyNm4GxVPNJt1ULUIbG/D8NSPcXmbTyFwC+1HL+
# KtDp5Dxs460BSWBVQUH1BYlrcJTkl2UP/hB31md3S5E3GtKLp7dN+W96RtAENqlc
# jcGkNtNftozuA939eNmGgoxdRN8UYnHB1y423aKrZ7SpMu1AZU+XKaiF2/x5RAZJ
# hyKqEvNK8DIy+1dF8O4xJ2v8w59kmIMeptpqEIhkIkS2bsPKt6nJ1/Rw7TG9z4L5
# inIcKvYP1fRu+P0BHTUakTjkzyQtbtTNzbxJfAZ/z6/gSxbdfWOI4N0dslhxzo7Z
# thjV5O52fr+dOkHEKOvUNOKZCXNtvUlbjqZQz8GfOwvneEca6LpJwZu0ZikHx7vY
# y7e1d8FzC3qDSwLzXu4f1a/HiuPPAeYpLz7kfW5q3Y43ahtp+SurDswv2kBKk8GK
# ZbgMO0bw0C5rV/bnoqItG4Ce+MzROkY/CWDNAy9AcjwzTL/SmMryXTFcKHcpHEoL
# ya4hADwNR5df2ItquZ/YkNFkmpWHUM3cMlWQYDpQe2hgmIyObSGCluUJ/hlwyEJY
# nlTypsC2ui+eH+CkB3fWcjOCcYo/FFRKOn4MLWcXczTgMnI41n6VyUlcO7vyhEXD
# 2xTSvGe0+7z/C0KDqWYDOWab1GuPVAjjInD8Ygo0u3CBU2jCR1M=
# =Tz8F
# -----END PGP SIGNATURE-----
# gpg: Signature made Wed 22 Oct 2025 03:19:00 AM CDT
# gpg: using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE
# gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <f4bug@amsat.org>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: FAAB E75E 1291 7221 DCFD 6BB2 E3E3 2C2C DEAD C0DE
* tag 'hw-misc-20251021' of https://github.com/philmd/qemu: (45 commits)
docs: Update mentions of removed '-soundhw' command line option
docs: update -soundhw -> -device list
MAINTAINERS: Add missing machine name in the Alpha section
qemu/target-info: Include missing 'qapi-types-common.h' header
hw/ppc/spapr: Rename resize_hpt_err to errp
hw/audio: replace AUD_log() usage
hw/pcspk: check the "pit" is set
hw/pcspk: make 'pit' a class property
hw/pcspk: use explicitly the required PIT types
hw/audio: remove global pcspk
hw/audio: rename model list function
hw/audio: improve error reports
tests/qtest/ds1338: Reuse from_bcd()
hw/intc/apic: Pass APICCommonState to apic_register_{read,write}
hw/i386/apic: Ensure own APIC use in apic_msr_{read,write}
hw/i386/apic: Prefer APICCommonState over DeviceState
hw/ide/ide-internal: Move dma_buf_commit() into ide "namespace"
hw/rtc/mc146818rtc: Assert correct usage of mc146818rtc_set_cmos_data()
hw/rtc/mc146818rtc: Use ARRAY_SIZE macro
hw/rtc/mc146818rtc: Convert CMOS_DPRINTF() into trace events
...
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Gerd Hoffmann [Fri, 17 Oct 2025 11:50:05 +0000 (13:50 +0200)]
hw/uefi/ovmf-log: add maxsize parameter
Allow limiting the amount of log output sent. Allow up to 1 MiB.
In case the guest log buffer is larger than 1 MiB limit the output
instead of throwing an error.
Acked-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Message-ID: <20251017115006.2696991-4-kraxel@redhat.com>
Gerd Hoffmann [Fri, 17 Oct 2025 11:50:03 +0000 (13:50 +0200)]
hw/uefi: add query-firmware-log monitor command
Starting with the edk2-stable202508 tag OVMF (and ArmVirt too) have
optional support for logging to a memory buffer. There is guest side
support -- for example in linux kernels v6.17+ -- to read that buffer.
But that might not helpful if your guest stops booting early enough that
guest tooling can not be used yet. So host side support to read that
log buffer is a useful thing to have.
This patch implements the query-firmware-log qmp monitor command to
read the firmware log.
Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Message-ID: <20251017115006.2696991-2-kraxel@redhat.com>
docs: Update mentions of removed '-soundhw' command line option
The `-soundhw` CLI was removed in commit 039a68373c4 ("introduce
-audio as a replacement for -soundhw"). Remove outdated comments
and update the document mentioning the old usage.
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-Id: <20251021131825.99390-2-philmd@linaro.org>
Thomas Huth [Mon, 20 Oct 2025 14:04:24 +0000 (16:04 +0200)]
MAINTAINERS: Add missing machine name in the Alpha section
Without a machine name here, get_maintainers.pl uses the "-----..."
separator for describing what the maintainer is taking care of:
$ scripts/get_maintainer.pl -f hw/alpha/dp264.c
Richard Henderson <richard.henderson@linaro.org> (maintainer:--------------)
qemu-devel@nongnu.org (open list:All patches CC here)
Signed-off-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251020140425.45003-1-thuth@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
qemu/target-info: Include missing 'qapi-types-common.h' header
When adding the TargetInfo::@endianness field in commit a37aec2e7d8,
we neglected to include the "qapi-types-common.h" header to get the
EndianMode enum definition. Fix that.
We don't let the user create a "isa-pcspk" via -device yet (in theory,
we could, and fallback on a lookup PIT), but we can add some safety
checks that the property was correctly set nonetheless.
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251021090317.425409-7-marcandre.lureau@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Cédric Le Goater [Thu, 16 Oct 2025 21:24:37 +0000 (23:24 +0200)]
hw/arm/aspeed: ast2600-evb: Use w25q512jv flash model
The ast2600-evb machine model is using the "mx66u51235f" flash model,
which has issues with recent Linux kernels (6.15+) when reading SFDP
data.
Change the flash model to "w25q512jv", which is the model present on
some ast2600a3 EVB board and is known to work correctly with recent
kernels. Adjust the corresponding qtest to reflect the new JEDEC ID of
the w25q512jv flash.
Felix Wu [Wed, 15 Oct 2025 01:18:25 +0000 (01:18 +0000)]
hw/gpio: Add property for ASPEED GPIO in 32 bits basis
Added 32 bits property for ASPEED GPIO. Previously it can only be
access in bitwise manner.
The changes to qobject is to index gpios with array indices on top of
accessing with registers. This allows for easier gpio access,
especially in tests with complex behaviors that requires large number
of gpios at a time, like fault injection and networking behaviors.
Indexing multiple gpios at once allows qmp/side band client to no
longer hardcode and populate register names and manipulate them
faster.
Jamin Lin [Wed, 15 Oct 2025 06:22:05 +0000 (14:22 +0800)]
tests/functional/aarch64/ast2700fc: Add eth2 network interface check in PCIe test
Enhance the AST2700 functional PCIe test to verify the network interface
configuration for eth2. This adds an additional command to check the IP
address assignment on eth2 to ensure network functionality is correctly
initialized in the test environment.
Jamin Lin [Wed, 15 Oct 2025 06:22:02 +0000 (14:22 +0800)]
hw/arm/aspeed_ast27x0-fc: Map FMC0 flash contents into CA35 boot ROM
This patch introduces a dedicated ca35_boot_rom memory region and
copies the FMC0 flash data into it.
The motivation is to support the upcoming vbootrom. The vbootrom
replaces the existing BOOTMCU (RISC-V 32 SPL) flow, which currently reads
the "image-bmc" from FMC_CS0 and loads the following components
into DRAM:
- Trusted Firmware-A
- OP-TEE OS
- u-boot-nodtb.bin
- u-boot.dtb
After loading, BOOTMCU releases the CA35 reset so that CA35 can start
executing Trusted Firmware-A.
The vbootrom follows the same sequence: CA35 fetches "image-bmc" from FMC0
flash at the SPI boot ROM base address (0x100000000), parses the FIT image,
loads each component into its designated DRAM location, and then jumps to
Trusted Firmware-A.
Jamin Lin [Wed, 15 Oct 2025 06:22:01 +0000 (14:22 +0800)]
hw/arm/ast27x0: Share single UART set across PSP, SSP, and TSP
In the original model, each subsystem (PSP, SSP, and TSP) created its own
set of 13 UART devices, resulting in a total of 39 UART instances. However,
on real AST2700 hardware, there is only one set of 13 UARTs shared among
all processors.
This commit reworks the UART handling to correctly model the shared
hardware design. The PSP now creates the full set of 13 UART instances,
while the SSP and TSP link to the corresponding shared UART device
through object properties.
Changes include:
- Add "DEFINE_PROP_LINK("uart", ...)" and "DEFINE_PROP_INT32("uart-dev", ...)"
to allow each coprocessor to reference a specific shared UART instance.
- Modify SSP to link to PSP’s UART4, and TSP to link to PSP’s UART7.
- Introduce "uart_alias" to remap the UART’s MMIO region into the coprocessor’s
memory space.
- Redirect the UART interrupt to the coprocessor’s NVIC, replacing the
default routing to the PSP’s GIC.
With this change, only one set of 13 UART devices is instantiated by the PSP,
while the SSP and TSP reuse them via aliasing and shared interrupt routing,
matching the real AST2700 hardware behavior.
projects / thirdparty / qemu.git / log
