Peter Maydell [Thu, 5 Feb 2026 09:50:33 +0000 (09:50 +0000)]
Merge tag 'pull-aspeed-20260204' of https://github.com/legoater/qemu into staging
aspeed queue:
* Added support for the new AST1700 IO expander, including several
device models (LTPI, PWM, I2C, GPIO, etc.).
* Updated the AST2700 SoC with LTPI support, EHCI IRQ fixes, and other
improvements.
* Updated test images and test cases for various Aspeed platforms.
* Fixed issues in the Aspeed I2C and ADC models.
* Added support for pca9535 GPIO expander.
* Updated documentation for Aspeed boards.
* tag 'pull-aspeed-20260204' of https://github.com/legoater/qemu: (45 commits)
tests/functional/aarch64: Add I2C test for AST1700 IO expanders
tests/functional/aarch64: Parameterize PCIe2 initialization in AST2700
tests/functional/aarch64: Parameterize I2C bus ID in AST2700 test
hw/arm/aspeed: Enable AST1700 IO expander support
hw/arm/aspeed: Model AST1700 I3C block as unimplemented device
hw/arm/aspeed: Attach SGPIOM device to AST1700 model
hw/arm/aspeed: Attach PWM device to AST1700 model
hw/arm/aspeed: Attach WDT device to AST1700 model
hw/arm/aspeed: attach I2C device to AST1700 model
hw/arm/aspeed: Attach GPIO device to AST1700 model
hw/arm/aspeed: Attach SCU device to AST1700 model
hw/arm/aspeed: Attach ADC device to AST1700 model
hw/arm/aspeed: Attach SPI device to AST1700 model
hw/arm/aspeed: Attach SRAM device to AST1700 model
hw/arm/aspeed: Attach UART device to AST1700 model
hw/arm/aspeed: Attach LTPI controller to AST1700 model
hw/arm/aspeed: Integrate interrupt controller for AST1700
hw/arm/aspeed: Integrate AST1700 device into AST27X0
hw/arm/aspeed: Add AST1700 LTPI expander device model
hw/misc: Add basic Aspeed PWM model
...
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Clement Mathieu--Drif <clement.mathieu--drif@eviden.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20251029105137.1097933-8-clement.mathieu--drif@eviden.com>
intel_iommu: Minimal handling of privileged ATS request
The purpose of this commit is not to support privileged requests but
to prevent devices from doing things they wouldn't be able to do
with real hardware.
We simply block privileged requests when the SRS ecap is not set
and abort when the ecap is present.
For now, its not worth implementing support for privileged requests
because the kernel does not support it.
(https://lore.kernel.org/linux-iommu/20230411064815.31456-11-baolu.lu@linux.intel.com/)
However, we may consider working on it depending on how the development
goes in the kernel.
Signed-off-by: Clement Mathieu--Drif <clement.mathieu--drif@eviden.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20251029105137.1097933-7-clement.mathieu--drif@eviden.com>
intel_iommu: Handle insufficient permissions during translation requests
ATS translations should not fail when the write permission is not set.
Signed-off-by: Clement Mathieu--Drif <clement.mathieu--drif@eviden.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20251029105137.1097933-6-clement.mathieu--drif@eviden.com>
pci: Block ATS requests when privileged mode is disabled
Signed-off-by: Clement Mathieu--Drif <clement.mathieu--drif@eviden.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20251029105137.1097933-5-clement.mathieu--drif@eviden.com>
pcie: Add a function to check if pasid privileged mode is enabled
Signed-off-by: Clement Mathieu--Drif <clement.mathieu--drif@eviden.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20251029105137.1097933-4-clement.mathieu--drif@eviden.com>
intel_iommu: Support memory operations with pre-translated addresses
Signed-off-by: Clement Mathieu--Drif <clement.mathieu--drif@eviden.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20251029105137.1097933-3-clement.mathieu--drif@eviden.com>
intel_iommu: Add an IOMMU index for pre-translated addresses
Signed-off-by: Clement Mathieu--Drif <clement.mathieu--drif@eviden.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20251029105137.1097933-2-clement.mathieu--drif@eviden.com>
hw/pci-host: Set DEVICE_CATEGORY_BRIDGE once in parent class_init()
No need to set DEVICE_CATEGORY_BRIDGE for each device
implementing TYPE_PCI_HOST_BRIDGE: set it once in the
parent.
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20251027112306.57634-1-philmd@linaro.org> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20251027112306.57634-1-philmd@linaro.org>
Akihiko Odaki [Mon, 27 Oct 2025 01:24:18 +0000 (10:24 +0900)]
pci/shpc: Do not unparent in instance_finalize()
Children are automatically unparented so manually unparenting is
unnecessary.
Worse, automatic unparenting happens before the instance_finalize()
callback of the parent gets called, so object_unparent() calls in
the callback will refer to objects that are already unparented, which
is semantically incorrect.
Signed-off-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp> Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20251027-shpc-v1-1-00e9b20a355d@rsg.ci.i.u-tokyo.ac.jp> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20251027-shpc-v1-1-00e9b20a355d@rsg.ci.i.u-tokyo.ac.jp>
Kane Chen [Wed, 4 Feb 2026 08:21:46 +0000 (08:21 +0000)]
tests/functional/aarch64: Add I2C test for AST1700 IO expanders
Extend the AST2700 test suite to verify I2C connectivity on AST1700
IO expanders using the DCSCM image. This validates the new bus-label
naming scheme by testing communication on both primary and
expander-attached I2C buses.
Kane Chen [Wed, 4 Feb 2026 08:21:44 +0000 (08:21 +0000)]
tests/functional/aarch64: Parameterize PCIe2 initialization in AST2700
The current AST2700 functional test forces PCIe2 enablement by manually
manipulating U-Boot env and FDT via the console. This sequence
interferes with test cases that rely on the default boot flow of the
image.
Introduce a 'enable_pcie' parameter (defaulting to True) to both
'verify_openbmc_boot_start' and 'verify_openbmc_boot_and_login' methods.
This allow test cases to toggle the PCIe2 initialization sequence based
on their specific requirements without breaking standard boot tests.
Kane Chen [Wed, 4 Feb 2026 08:21:43 +0000 (08:21 +0000)]
tests/functional/aarch64: Parameterize I2C bus ID in AST2700 test
The current Aspeed AST2700 functional test case strictly uses I2C bus
1 for its sensor tests. This hard-coded approach prevents the test
logic from being reused for other machine types or configurations
where I2C bus 1 might be disabled or where a different bus needs to
be verified (e.g., I2C expanders).
This refactoring allows the same I2C verification logic to be shared
across different test scenarios by simply passing the target bus
number.
Kane Chen [Wed, 4 Feb 2026 08:21:40 +0000 (08:21 +0000)]
hw/arm/aspeed: Model AST1700 I3C block as unimplemented device
AST1700 exposes more I3C buses than the current dummy I3C model
provides. When Linux probes the I3C devices on AST1700 this mismatch
can trigger a kernel panic. Model the I3C block as an unimplemented
device to make the missing functionality explicit and avoid unexpected
side effects.
This wires up the I3C interrupt lines for the IO expanders and adds the
corresponding device entries for the AST1700 model.
No functional I3C emulation is provided yet; this only prevents crashes and
documents the missing piece.
Kane Chen [Wed, 4 Feb 2026 08:21:21 +0000 (08:21 +0000)]
hw/arm/aspeed: Integrate AST1700 device into AST27X0
Connect the AST1700 device as a child of the AST27X0 model to reflect
its role in DC-SCM 2.0 LTPI-based architectures. This patch wires
the AST1700 device into the platform without introducing functional
peripherals.
This forms the base for LTPI expander emulation in QEMU using
AST27X0 as the host controller.
Note: ioexp_num is set to 0 at this stage. Once all related devices
and interrupts are fully implemented, ioexp_num will be updated to
its expected value. This ensures the machine remains functional at
every commit and avoids potential compiler or build issues.
Kane Chen [Wed, 4 Feb 2026 08:21:19 +0000 (08:21 +0000)]
hw/arm/aspeed: Add AST1700 LTPI expander device model
Introduce a minimal QEMU device model for the ASPEED AST1700, an
MCU-less I/O expander used in the LTPI topology defined by the
DC-SCM 2.0 specification (see figure 2):
https://www.opencompute.org/documents/ocp-dc-scm-2-0-ltpi-ver-1-0-pdf
This initial implementation includes:
* Definition of aspeed.ast1700 as a SysBusDevice
* Setup of a basic memory region to reserve I/O space for future
peripheral modeling
This stub establishes the foundation for LTPI-related device emulation,
without implementing any functional peripherals at this stage.
Kane Chen [Wed, 4 Feb 2026 08:21:17 +0000 (08:21 +0000)]
hw/arm/aspeed: Attach LTPI controller to AST27X0 platform
Connect the LTPI controller device (representing the AST1700 I/O
expander) to the AST27X0 SoC model. This patch sets up the memory
mapping and device registration according to the AST2700 SoC design,
where the LTPI controller is exposed at fixed MMIO regions.
This change only handles device instantiation and integration,
without implementing the controller's internal logic.
Kane Chen [Wed, 4 Feb 2026 08:21:15 +0000 (08:21 +0000)]
hw/misc: Add LTPI controller
LTPI (LVDS Tunneling Protocol & Interface) is defined in the OCP DC-SCM
2.0 specification:
https://www.opencompute.org/documents/ocp-dc-scm-2-0-ltpi-ver-1-0-pdf
LTPI is a protocol and physical interface for tunneling various low-speed
signals between the HPM and SCM. As shown in Figure 2, the AST27x0 (left)
integrates two LTPI controllers, allowing it to connect to up to two
extended boards.
This commit introduces a simple device model for the ASPEED LTPI
controller in QEMU.
The model includes basic MMIO read/write operations and sets default
register values during reset to emulate a link-up state.
Implements register space with read/write callbacks.
Jamin Lin [Tue, 3 Feb 2026 02:08:53 +0000 (10:08 +0800)]
docs/system/arm/aspeed: Load raw U-Boot image in AST2700 boot example
Recent SDK versions no longer provide a U-Boot FIT image, and U-Boot is
now built as a single raw binary. Update the documentation to load the
raw u-boot.bin image directly.
Jamin Lin [Tue, 3 Feb 2026 02:08:50 +0000 (10:08 +0800)]
tests/functional/aarch64/test_aspeed_ast2700: Enable PCIe2 DTS status for AST2700 tests
PCIe2 is disabled by default starting from SDK v10.00.
Add a helper function to stop U-Boot autoboot and update the device
tree at runtime, setting the PCIe2 node status to "okay" before
booting Linux. This allows the AST2700 functional test to verify
the PCIe2 root complex behavior correctly.
Jamin Lin [Tue, 3 Feb 2026 02:08:49 +0000 (10:08 +0800)]
hw/i2c/aspeed_i2c: Fix DMA moving data into incorrect address
In the previous design, the I2C model updated dma_dram_offset only when
firmware programmed the RX/TX DMA buffer address registers. The firmware
used to rewrite these registers before issuing each DMA command.
The firmware driver behavior has changed to program the DMA address
registers only once during I2C initialization. As a result, the I2C model
no longer refreshes dma_dram_offset, causing DMA to move data into an
incorrect DRAM address.
Fix this by introducing helper functions to update dma_dram_offset from
the DMA address registers, and invoke them right before handling TX/RX
DMA operations. This guarantees DMA always uses the correct buffer
address even if the registers are programmed only once.
Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> Fixes: c400c38854017eeccda63115814eba4c3ef2b51f ("hw/i2c/aspeed: Introduce a new dma_dram_offset attribute in AspeedI2Cbus") Reviewed-by: Cédric Le Goater <clg@redhat.com> Link: https://lore.kernel.org/qemu-devel/20260203020855.1642884-5-jamin_lin@aspeedtech.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
Jamin Lin [Tue, 3 Feb 2026 02:08:46 +0000 (10:08 +0800)]
hw/arm/aspeed_ast27x0: Fix EHCI3/4 IRQ routing to GIC
EHCI3 and EHCI4 were missing entries in aspeed_soc_ast2700a1_irqmap,
so their source IRQs were never routed through the INTC OR-gates.
As a result, EHCI3/4 interrupts were not propagated to the GIC,
causing incorrect interrupt behavior for these controllers.
Add EHCI3 and EHCI4 to the IRQ map and route them to the same INTC
group as other shared peripherals, ensuring their interrupts are
properly connected to the GIC.
Jamin Lin [Tue, 27 Jan 2026 03:23:40 +0000 (11:23 +0800)]
hw/arm/aspeed_ast2600: Expand RC_H PCIe MMIO window to 0x60000000 - 0x80000000
Historically, the ASPEED PCIe driver supported both RC_L and RC_H, with RC_L
using MMIO window 0x60000000 - 0x70000000 and RC_H using 0x70000000 - 0x80000000.
Mainline Linux has dropped RC_L support and now supports RC_H only, updating
RC_H to use a single combined MMIO window 0x60000000 - 0x80000000.
Update the AST2600 QEMU model accordingly by moving PCIE_MMIO1 base to
0x60000000 and increasing the aliased MMIO size to 0x20000000.
Jamin Lin [Tue, 27 Jan 2026 03:23:39 +0000 (11:23 +0800)]
hw/pci-host/aspeed_pcie: Drop AST2600 RC_H root-bus remap and bus-nr property
The original AST2600 PCIe design supported both RC_L and RC_H, using root bus
number 0 for RC_L and 0x80 for RC_H. In that model, the root port appeared as
80:08.0 and QEMU carried a "bus-nr" property plus a config-space bus remap to
translate bus 0x80 to bus 0x00 for PCI enumeration.
Linux mainline has since dropped RC_L support and updated the RC_H root bus
number to start at 0. The root port is now enumerated as 00:08.0, matching the
default QEMU PCIe subsystem root bus numbering.
Remove the bus number setting and the AST2600 bus remap logic, and drop the
corresponding "bus-nr"/rc_bus_nr fields and property plumbing. QEMU now relies
on the default root bus 0 behavior.
Jamin Lin [Tue, 27 Jan 2026 03:23:38 +0000 (11:23 +0800)]
hw/pci-host/aspeed_pcie: Drop AST2600 PCIe root device
AST2600 PCIe previously exposed a root bus at 0x80 with both a
root device at 80:00.0 and a root port at 80:08.0.
Recent ASPEED SDK PCIe driver updates decided to remove the root
device and keep only a single root port. This behavior has already
been accepted by the upstream Linux kernel.
Update the QEMU PCIe model accordingly by dropping the root device
implementation and related properties. AST2600 now matches the
AST2700 PCIe topology and no longer supports the legacy RC_L
layout.
Cédric Le Goater [Mon, 26 Jan 2026 14:18:20 +0000 (15:18 +0100)]
hw/adc: Fix out-of-bounds write in Aspeed ADC model
The 'regs' array has ASPEED_ADC_NR_REGS (52) elements, while the
memory region covers offsets 0x00-0xFC. The aspeed_adc_engine_write()
function has an out-of-bounds write vulnerability when accessing
unimplemented registers.
Fix this by using 'return' instead of 'break' in the default case,
which prevents execution from reaching the s->regs[reg] assignment for
unimplemented registers.
Patrick Williams [Wed, 21 Jan 2026 18:17:06 +0000 (13:17 -0500)]
hw/arm/aspeed: catalina: use pca9535
A few entries in the catalina model were using the PCA9552 chip
because it was "close enough" in function. Since there is a PCA9535
model now, switch to use it.
Nabih Estefan [Tue, 20 Jan 2026 21:11:16 +0000 (21:11 +0000)]
hw/i2c/aspeed_i2c.c: Add a check for dma_read
If aspeed_i2c_dma_read fails in aspeed_i2c_bus_send currently, we get
stuck in an infinite retry loop. Add a check for the return value of
aspeed_i2c_dma_read that will break us out of said loop.
Kane-Chen-AS [Mon, 12 Jan 2026 08:30:53 +0000 (16:30 +0800)]
hw/i2c/aspeed: Introduce 'bus-label' to customize bus naming
On some Aspeed-based machines, multiple I2C controllers may exist
across different components, such as the primary SoC and an external
IO expander or co-processor (e.g., AST1700). Using the current static
naming convention results in object name conflicts when multiple
controllers attempt to instantiate buses with the same ID.
This patch introduces a 'bus-label' property for the Aspeed I2C
controller. This allows higher-level layers, such as the SoC realize
function, to provide a unique identifier for the buses. The I2C bus
object name is then constructed using this label (e.g., "ioexp0.0"
instead of the default "aspeed.i2c.bus.0").
This enhancement ensures unique bus identifiers across the system and
resolves naming conflicts in multi-controller configurations.
Merge tag 'single-binary-20260203' of https://github.com/philmd/qemu into staging
Various patches related to single binary effort:
- Endianness cleanups on various targets (PPC in particular)
- Few cleanups around target_ulong type on Alpha
- Have CPUClass::disas_set_info() take a const CPUState
# -----BEGIN PGP SIGNATURE-----
#
# iQIzBAABCAAdFiEE+qvnXhKRciHc/Wuy4+MsLN6twN4FAmmCDTkACgkQ4+MsLN6t
# wN7vHQ/+LCAYESbTy7cXeKGgAslwPbX1Q2zYGk0rhGMgrbBtQThbgQSkNsAwYmzg
# 6vx5crw9vYA/kLq0jyJQPTRIAKzXH9BzdEfTsEt5AIpZv6Cc4im6JBZdrxUa6S0O
# AMGb4pn9bpkcwHOv2ufotJbl0fa+id4WgQgXyLDEgwgNVvY18fVWfn5OwAon2bWo
# nb6zqRfwgdyAB+liwmlPNI+M4hZ3vDdct7whUP8t37FjTL0lNrsyG/Epr0xJB5ru
# CRsjubBkXAq8HlmwHZp8JSM/Lriitp8Z2ubD8VBqYbMYI25XUnRlBWWxTnQKkaDD
# Vgbq67UqS/k/X6vV5cfJaeS2qOdgF98V0VmrOqlNXTwMU56lzMn0ThgLqUXznRos
# IUfTUvmjfGu63aAWG2l+HBrehK5JEAGYzK6ZTiTA6abpvfHUjehslsQlAlMgcSnL
# TnMsM7mxS+XNbf6bsew0azTt2p/V81JDVrQuQgmAJS9ZOpALMFGep5YAYKvN/kLf
# cSbl+hQRsxqxQPoc6y0NrnCcfT33U1+I+IXpMIR/VyC0RgseW9HeRdJWuNyKBW/4
# VUBnQnYNhZM9hDHKp5PzU2KhoeudAlK3gws8zvtWfLCFyAvfmEYX0Gt5r23JkoxT
# IO340Jz5XRwfXMWENc6Bm8lqr7HilQi28HFNXWdy897YfNS83Ow=
# =J0gm
# -----END PGP SIGNATURE-----
# gpg: Signature made Wed 04 Feb 2026 12:59:05 AM AEST
# gpg: using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE
# gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <f4bug@amsat.org>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: FAAB E75E 1291 7221 DCFD 6BB2 E3E3 2C2C DEAD C0DE
* tag 'single-binary-20260203' of https://github.com/philmd/qemu: (30 commits)
disas: Have disas_set_info() take a const CPUState
disas: Make disassemble_info::target_info field const
disas/riscv: Make rv_decode::cfg const
target/arm: Have arm_sctlr_b() take a const @env argument
target/arm: Have is_64() take a const @env argument
target/arm: Have cpu_isar_feature() use a const ARMCPU object
target/arm: Have arm_feature() take a const @env argument
target/alpha: Expand TCGv type for 64-bit target
target/alpha: Remove target_ulong uses in get_physical_address()
target/alpha: Do not use target_ulong for page table entries / indexes
target/alpha: Do not use target_ulong for trap arguments
target/alpha: Replace target_ulong -> uint64_t in gdb_write_register()
target/alpha: Build system units in common source set
target/alpha: Avoid target-specific migration headers in machine.c
target/m68k: Inline translator_ld[uw,l,q]() calls
target/i386: Inline translator_ld[uw,l,q]() calls
target/riscv: Inline translator_ld[uw,l,q]() calls
target/riscv: Inline cpu_ld[lq]_code() calls
target/ppc: Inline cpu_ldl_code() call in ppc_ldl_code()
target/ppc: Check endianness at runtime in ppc_data_endian_env()
...
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Merge tag 'firmware-20260203-pull-request' of https://gitlab.com/kraxel/qemu into staging
firmware updates for 11.0
- igvm: rework reset handling.
- igvm: add MADT parameter support.
- uefi: variable store fixes.
# -----BEGIN PGP SIGNATURE-----
#
# iQIzBAABCgAdFiEEoDKM/7k6F6eZAf59TLbY7tPocTgFAmmB5AYACgkQTLbY7tPo
# cThR7Q//d5Z9cIQEOn7hqAgsqyz4llvyLpZk+pWuyQmJ7iBtF7geP0p61iICi5vP
# +jyKJChHtPQzAQLqKwgHLWAuYSW82EZPh74YvL4MBNe7WX8LouHvCoTsOE28Nxqx
# EWDtucSwwwQpx/r1iSSHEHqjlV2MudlGFMaOb0+by57j2ZsAGEe/0J+yF07hhXLQ
# OxQY1l8gHC+PK6BnRLnwIlBVBe+o2E9hJeV0GA/zd1UufTxsan/r06T1JRsdNhPe
# vkBFedwPz+4+jKbOVWBp2pY5FSxmIEe+sOqRdhFvyvz+KBziAyisCNtv/eABrd9h
# Jk/yfvrDIZEJk7GtwMAC/un+zz/iQfu9BK3EAtT5OnUCEbj7HNaEjuStB2AnfBnw
# 4clhjPA+qwej1771zAuKC5HOc+2mMxbON/roD4nGcEY3WKq7JvjUrIopesJcgCCu
# TjV1UXAxyG6CRvsiUc3uesdleumAqt3I4+OryfnPY5SloYjlg+bEW8fpKvXmI82l
# uZsI1SL3yqXJMVQEh0cS7awquKKkjzNR0CGR+a9KBMl3kCiuAPPkevEhERpd1J6V
# W6zZrNI9IHczBKrZEJ42apXutGmADDZUdREjktc4gUBvTzC317bfSTGk/tvQQe7N
# lRr9KV+56bSVrnLiqcCzfVj8U2YTecsvO98Xp28W3nwwvIls3mQ=
# =npQG
# -----END PGP SIGNATURE-----
# gpg: Signature made Tue 03 Feb 2026 10:03:18 PM AEST
# gpg: using RSA key A0328CFFB93A17A79901FE7D4CB6D8EED3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" [unknown]
# gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" [unknown]
# gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138
* tag 'firmware-20260203-pull-request' of https://gitlab.com/kraxel/qemu:
igvm: Fill MADT IGVM parameter field on x86_64
igvm: Only build stubs if igvm is enabled
igvm: Pass machine state to IGVM file processing
igvm: Refactor qigvm_parameter_insert
igvm: Add common function for finding parameter entries
igvm: Move structs to internal header
hw/acpi: Add standalone function to build MADT
hw/acpi: Make BIOS linker optional
hw/acpi: Make acpi_checksum() public
igvm: move igvm file processing to reset callbacks
igvm: add trace points for igvm file loading and processing
igvm: move file load to complete callback
igvm: make igvm-cfg object resettable
igvm: reorganize headers
hw/uefi: fix size negotiation
hw/uefi: skip time check for append-write updates.
docs/system/igvm.rst: Update external links
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
disas: Have disas_set_info() take a const CPUState
The CPUClass::disas_set_info() handler is meant to initialize
the %disassemble_info structure; it shoudn't alter the CPU state.
Enforce the CPUState can not be modified by having the handler
take a const pointer.
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20260202222412.24923-8-philmd@linaro.org>
disas: Make disassemble_info::target_info field const
Disassemblers shouldn't need writeable context, so make the
disassemble_info::target_info field const.
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260202222412.24923-7-philmd@linaro.org>
Disassembler is not expected to alter the CPU config.
Besides, all other RISC-V methods takes a const RISCVCPUConfig.
Make the @cfg field of the rv_decode structure const, passing
a const pointer to disasm_inst().
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260202222412.24923-6-philmd@linaro.org>
target/arm: Have arm_sctlr_b() take a const @env argument
arm_sctlr_b() only access @env read-only, make it const.
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260202222412.24923-5-philmd@linaro.org>
target/arm: Have is_64() take a const @env argument
is_64() only access @env read-only, make it const.
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260202222412.24923-4-philmd@linaro.org>
target/arm: Have cpu_isar_feature() use a const ARMCPU object
The @cpu_ variable is only accessed read-only, make it const.
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260202222412.24923-3-philmd@linaro.org>
target/arm: Have arm_feature() take a const @env argument
arm_feature() only access @env read-only, make it const.
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260202222412.24923-2-philmd@linaro.org>
This is a mechanical replacement, adapting style to pass
the checkpatch.pl script.
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260202234550.34156-8-philmd@linaro.org>
target/alpha: Remove target_ulong uses in get_physical_address()
%addr is a virtual address, so use the 'vaddr' type.
%pphys is a pointer to a physical address, so use the 'hwaddr' type.
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260202234550.34156-7-philmd@linaro.org>
target/alpha: Do not use target_ulong for page table entries / indexes
%L[123]pte are loaded calling ldq_le_phys() which returns
a uint64_t. %pt is loaded with @ptbr, declared as uint64_t
in target/alpha/cpu.h:
236 uint64_t ptbr;
%index is at most 1024 so can fit in uint16_t.
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260202234550.34156-6-philmd@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260202234550.34156-5-philmd@linaro.org>
target/alpha: Replace target_ulong -> uint64_t in gdb_write_register()
On Alpha, the target_ulong type expands to uint64_t.
Besides, ldq_be_p() returns a uint64_t type, and all
field / values accessed are uint64_t, see target/alpha/cpu.h:
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260202234550.34156-4-philmd@linaro.org>
target/alpha: Build system units in common source set
Since commits bb5de52524c ("target: Widen pc/cs_base in
cpu_get_tb_cpu_state") and 32f0c394bbf ("target: Use vaddr
in gen_intermediate_code") we remove all uses of the target_ulong
type in target/alpha/. Use the meson target_common_system_arch[]
source set to prevent further uses of target-specific types.
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260202234550.34156-3-philmd@linaro.org>
target/alpha: Avoid target-specific migration headers in machine.c
machine.c doesn't use any target-specific macro defined by
the "migration/cpu.h" header. Use the minimum header required:
"migration/qemu-file-types.h" and "migration/vmstate.h", which
are not target-specific.
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260202234550.34156-2-philmd@linaro.org>
In preparation of removing the translator_ld[uw,l,q]() methods,
inline them for the m68k target, expanding MO_TE -> MO_BE since
this architecture is only available in big endianness.
Mechanical change using the following Coccinelle 'spatch' script:
In preparation of removing the translator_ld[uw,l,q]() methods,
inline them for the x86 targets, expanding MO_TE -> MO_LE since
the architecture uses little endian order.
Mechanical change using the following Coccinelle 'spatch' script:
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260202213348.96754-1-philmd@linaro.org>
In preparation of removing the translator_ld[uw,l,q]() methods,
inline them for the RISC-V targets, using mo_endian(ctx) -- which
we introduced in commit 504f7f304ff -- instead of MO_TE.
Mechanical change using the following Coccinelle 'spatch' script:
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260202213810.97141-1-philmd@linaro.org>
In preparation of removing the cpu_ldl_code() and cpu_ldq_code()
wrappers, inline them.
Since RISC-V instructions are always stored in little-endian order
(see "Volume I: RISC-V Unprivileged ISA" document, chapter
'Instruction Encoding Spaces and Prefixes': "instruction fetch
in RISC-V is little-endian"), replace MO_TE -> MO_LE.
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260202214317.99090-1-philmd@linaro.org>
target/ppc: Inline cpu_ldl_code() call in ppc_ldl_code()
In preparation of removing the cpu_ldl_code wrapper, inline it.
Get the runtime endianness with ppc_data_endian_env(), passing it
to cpu_ldl_code_mmu(). No need to swap versus qemu-system binary
anymore.
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Anton Johansson <anjo@rev.ng>
Message-Id: <20260202210106.93257-12-philmd@linaro.org>
target/ppc: Check endianness at runtime in ppc_data_endian_env()
Rather a runtime endianness check via env MSR over
a build-time one.
Now CPU can change endianness at runtime.
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Anton Johansson <anjo@rev.ng>
Message-Id: <20260202210106.93257-11-philmd@linaro.org>
Centralize endianness check on MSR via a common helper.
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Anton Johansson <anjo@rev.ng>
Message-Id: <20260202210106.93257-10-philmd@linaro.org>
target/ppc: Check endianness via env in ppc_disas_set_info()
disas_set_info() shouldn't bother with env->hflags,
access env->msr directly.
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Anton Johansson <anjo@rev.ng>
Message-Id: <20260202210106.93257-9-philmd@linaro.org>
target/ppc: Inline need_byteswap() and replace translator_ldl_swap()
Rather than using a boolean with translator_ldl_swap(),
get the MemOp endianness with ppc_code_endian() and pass
it to translator_ldl_end().
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Anton Johansson <anjo@rev.ng>
Message-Id: <20260202210106.93257-8-philmd@linaro.org>
Introduce the ppc_code_endian_dc() helper which returns the
MemOp endianness for the CODE path.
Use it in need_byteswap(), removing one TARGET_BIG_ENDIAN.
Note, the target MemOp endianness can be evaluated as (see
commit 5c43a750b67 "accel/tcg: Implement translator_ld*_end"):
MO_TE ^ (do_swap * MO_BSWAP)
For PPC we use the DisasContext::le_mode field to swap the
default (big-endian) order, so to get the PPC MemOp endianness
we can directly use:
MO_BE ^ (ctx->le_mode * MO_BSWAP)
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Anton Johansson <anjo@rev.ng>
Message-ID: <20260202210106.93257-7-philmd@linaro.org>
Introduce ppc_data_endian_env() which returns the endian MemOp
of the data path from the vCPU env pointer. Keep it hardcoded
as MO_TE, the target built-time endianness.
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Anton Johansson <anjo@rev.ng>
Message-ID: <20260202210106.93257-6-philmd@linaro.org>
target/ppc: Expect page translation hash addresses to be aligned
The page translation hash addresses are aligned:
remove the misleading MO_UNALN flag.
Reported-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Anton Johansson <anjo@rev.ng>
Message-Id: <20260202210106.93257-5-philmd@linaro.org>
target/ppc: Inline cpu_ld/st_data_ra() calls in do_hash()
In preparation of removing the cpu_ld*_data_ra() and
cpu_st*_data_ra() calls, inline them. No logical change
intended.
We note the page translation hash address is expected to
be aligned, so the MO_UNALN flag is misleading. Next commit
will remove it.
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Anton Johansson <anjo@rev.ng>
Message-Id: <20260202210106.93257-4-philmd@linaro.org>
target/ppc: Inline cpu_ld/st_mmuidx_ra() calls in memory helpers
In preparation of removing the cpu_ld*_mmuidx_ra() and
cpu_st*_mmuidx_ra() calls, inline them.
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Anton Johansson <anjo@rev.ng>
Message-Id: <20260202210106.93257-3-philmd@linaro.org>
target/ppc: Inline cpu_ldl_data_ra() calls in ICBI helpers
Inline the cpu_ldl_data_ra() call in preparation of
removing it. Since the returned value is discarded,
don't bother to set the access endianness.
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Anton Johansson <anjo@rev.ng>
Message-Id: <20260202210106.93257-2-philmd@linaro.org>
My dictionary says the former spelling is incorrect.
Message-ID: <52339e58-4366-4b7c-872f-b28e05370a5d@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Gustavo Romero <gustavo.romero@linaro.org> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Oliver Steffen [Fri, 30 Jan 2026 05:47:14 +0000 (06:47 +0100)]
igvm: Fill MADT IGVM parameter field on x86_64
Use the new acpi_build_madt_standalone() function to fill the MADT
parameter field.
The IGVM parameter can be consumed by Coconut SVSM [1], instead of
relying on the fw_cfg interface, which has caused problems before due to
unexpected access [2,3]. Using IGVM parameters is the default way for
Coconut SVSM across hypervisors; switching over would allow removing
specialized code paths for QEMU in Coconut.
Coconut SVSM needs to know the SMP configuration, but does not look at
any other ACPI data, nor does it interact with the PCI bus settings.
Since the MADT is static and not linked with other ACPI tables, it can
be supplied stand-alone like this.
Generating the MADT twice (during ACPI table building and IGVM processing)
seems acceptable, since there is no infrastructure to obtain the MADT
out of the ACPI table memory area.
In any case OVMF, which runs after SVSM has already been initialized,
will continue reading all ACPI tables via fw_cfg and provide fixed up
ACPI data to the OS as before without any changes.
The IGVM parameter handler is implemented for the i386 machine target
and stubbed for all others.
Oliver Steffen [Fri, 30 Jan 2026 05:47:13 +0000 (06:47 +0100)]
igvm: Only build stubs if igvm is enabled
Change meson script to only include the IGVM stubs file if the IGVM
feature is enabled. It is used to handle architecture specific
differences within the IGVM backend, not to provide stubs of the backend
itself.
Signed-off-by: Oliver Steffen <osteffen@redhat.com>
Message-ID: <20260130054714.715928-9-osteffen@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Oliver Steffen [Fri, 30 Jan 2026 05:47:12 +0000 (06:47 +0100)]
igvm: Pass machine state to IGVM file processing
Pass the full MachineState to the IGVM backend during file processing,
instead of just the ConfidentialGuestSupport struct (which is a member
of the MachineState).
This replaces the cgs parameter of qigvm_process_file() with the machine
state to make it available in the IGVM processing context.
We will use it later to generate MADT data there to pass to the guest
as IGVM parameter.
Reviewed-by: Luigi Leonardi <leonardi@redhat.com> Signed-off-by: Oliver Steffen <osteffen@redhat.com>
Message-ID: <20260130054714.715928-8-osteffen@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Oliver Steffen [Fri, 30 Jan 2026 05:47:11 +0000 (06:47 +0100)]
igvm: Refactor qigvm_parameter_insert
Use qigvm_find_param_entry() also in qigvm_parameter_insert().
This changes behavior: Processing now stops after the first parameter
entry found. That is OK, because we expect only one matching entry
anyway.
Reviewed-by: Luigi Leonardi <leonardi@redhat.com> Signed-off-by: Oliver Steffen <osteffen@redhat.com>
Message-ID: <20260130054714.715928-7-osteffen@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Oliver Steffen [Fri, 30 Jan 2026 05:47:09 +0000 (06:47 +0100)]
igvm: Move structs to internal header
Move QIgvm and QIgvmParameter struct definitions from the source file
into an IGVM internal header file to allow implementing architecture
specific IGVM code in other places, for example target/i386/igvm.c.
Signed-off-by: Oliver Steffen <osteffen@redhat.com>
Message-ID: <20260130054714.715928-5-osteffen@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Gerd Hoffmann [Mon, 26 Jan 2026 12:37:55 +0000 (13:37 +0100)]
igvm: move igvm file processing to reset callbacks
Move igvm file processing from machine init to reset callbacks. With
that the igvm file is properly re-loaded on reset. Also the loading
happens later in the init process now. This will simplify future
support for some IGVM parameters which depend on initialization steps
which happen after machine init.
Gerd Hoffmann [Mon, 26 Jan 2026 12:37:53 +0000 (13:37 +0100)]
igvm: move file load to complete callback
Add UserCreatableClass->complete callback function for igvm-cfg object.
Move file loading and parsing of the igvm file from the process function
to the new complete() callback function. Keep the igvm file loaded
after processing, release it in finalize() instead, so we parse it only
once.
projects / thirdparty / qemu.git / log
