Commit Graph

18745 Commits

Author SHA1 Message Date
Marc-André Lureau
e31b29f446 audio: rework DEBUG_POLL
Use more correct GTimer, specific for each backend, with a trace event.

Reviewed-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
2026-02-23 14:38:22 +01:00
Marc-André Lureau
eebba32fe5 audio: replace int endianness with bool big_endian in audsettings
The endianness field used an int to represent a boolean concept, with
0 meaning little-endian and 1 meaning big-endian. This required runtime
validation to reject invalid values and made the code less readable.

Replace with a bool big_endian field that is self-documenting and
type-safe. The compiler now enforces valid values, eliminating the
need for the validation check in audio_validate_settings().

Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
2026-02-23 14:38:22 +01:00
Marc-André Lureau
42061a1435 audio/mixeng: replace redundant pcm_info fields with AudioFormat
The audio_pcm_info structure stored three fields (bits, is_signed,
is_float) that were always derived from the AudioFormat enum. This
redundancy meant the same information was represented twice, with no
type-level guarantee that they stayed in sync.

Replace these fields with a single AudioFormat field, and add helper
functions to extract the derived properties when needed:
- audio_format_bits()
- audio_format_is_signed()
- audio_format_is_float()

This improves type safety by making AudioFormat the single source of
truth, eliminating the possibility of inconsistent state between the
format enum and its derived boolean/integer representations.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Reviewed-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
2026-02-23 14:38:22 +01:00
Marc-André Lureau
740578d483 audio: constify some add_capture() arguments
Reviewed-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
2026-02-23 14:38:22 +01:00
Marc-André Lureau
2842da1dc0 audio: split AudioMixengBackend code in audio-mixeng-be.c
Allow to build the audio/ base classes without the
resampling/mixing/queuing code.

Reviewed-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
2026-02-23 14:38:22 +01:00
Marc-André Lureau
c70d79776b audio: AUD_ -> audio_be_
Use the associate AudioBackend prefix for readability.

Reviewed-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
2026-02-23 14:38:20 +01:00
Marc-André Lureau
25153b29f8 audio: split AudioBackend
Code clean-up, to allow building bare abstract class separately.

The original file is MIT-licensed.

Reviewed-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
2026-02-23 14:33:15 +01:00
Marc-André Lureau
909f04f417 audio: make AudioBackend truly abstract
Add virtual methods to be implemented by concrete classes, like
AudioMixengBackendClass.

Reviewed-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
2026-02-23 14:33:15 +01:00
Marc-André Lureau
61e95a0c60 audio: make all the backend-specific APIs take the be
This will allow to dispatch to different implementations next.

Reviewed-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
2026-02-23 14:33:09 +01:00
Marc-André Lureau
5ca6c931a7 replay: remove dependency on audio/
The replay infrastructure shouldn't depend on internals of audio/.
(st_sample is an internal implementation detail and could be different)

Let audio drive the audio samples recording/replaying.

Notice also we don't need to save & restore the internal ring "wpos",
all replay should care about is the number of samples and the samples.

Bump the replay version.

Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
2026-02-23 14:28:57 +01:00
Marc-André Lureau
d8f9785fcc module: remove audio module support
It relies on dynamic object loading support instead.

Reviewed-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
2026-02-23 14:28:57 +01:00
Marc-André Lureau
b47ed8a5c9 audio: lookup "audio-" object types, and realize them
Now "audio_driver" is a detail implementation of AudioMixengBackend and
not required to implement an AudioBackend.

Reviewed-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
2026-02-23 14:28:57 +01:00
Marc-André Lureau
1618bea984 audio: introduce AudioMixengBackend
Introduce a sub-class for current "audio_driver" based implementations.
Future AudioBackend implementations can do without it.

Next cleanup will actually remove "audio_driver" struct altogether and
make the subclass proper QOM objects.

Public APIs still rely on backend being an AudioMixeng. They will
assert() if not. This will be addressed later to allow other backends.

Note that the initial naming proposed for this object was AudioDriver,
however the semantics for "driver" is already overloaded and leads to
confusion, in particular with the QAPI AudiodevDriver. The defining
characteristic is of using QEMU's software mixing engine, so
AudioMixengBackend.

Reviewed-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
2026-02-23 14:28:57 +01:00
Marc-André Lureau
1f11eb930e audio: constify audsettings argument
It shouldn't be modified by the audio functions.

Reviewed-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
2026-02-23 14:28:57 +01:00
Marc-André Lureau
52ef022ae8 audio: remove obsolete/obscure functions
AUD_init_time_stamp_{in,out} and AUD_get_elapsed_usec_{in,out} are only
used by the adlib device. The result isn't actually being used since
ADLIB_KILL_TIMERS was set some 20y ago. Let's drop this dead code now.

Drop QEMUAudioTimeStamp as well as reported by Akihiko Odaki.

Reviewed-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
2026-02-23 14:28:56 +01:00
Peter Maydell
a6ec632dca Merge tag 'hw-misc-20260223' of https://github.com/philmd/qemu into staging
Misc HW & Net patches

- Fix trace event name in m68k system controller
- Constify and rename virtio_is_big_endian()
- Fix heap buffer overflow in virtio-serial-bus
- Set graphic display dimensions generically (removing system/globals-target.c)
- Mark eth_header, udp_header, tcp_header as packed structures
- Minor doc / header cleanups

# -----BEGIN PGP SIGNATURE-----
#
# iQIzBAABCAAdFiEE+qvnXhKRciHc/Wuy4+MsLN6twN4FAmmbj2wACgkQ4+MsLN6t
# wN7LqBAAq30ShByylpAJ7DvekgGOHCXeHSdVPZKB8eDC5aVULQfPKp8Ij0v7WpwD
# RzZZWL35nSAqLiMLxxpP/VSY1T+PopoaHtKuZfVc5J/J/mr6lvpbsMlo6jRe/lvT
# r2m5MYGyUnAPsm/t44nG7E53xIqvT5eFMMjMQSYQXgi1RztNGepE5acrOHk2RrWc
# X0NqORf6SeAvo6FX8lIQTQq9/4ePH9f3+DXiM48OaKNVDshARd8C7l3Q2aAC0UWi
# sP0oL7Re0mmCJ4820/tTqsKs9D+4U3Hu5lW0FPdXU6uLoNr70T2g29pRLE4o5mP5
# UV91+x6FdUm7o0oDJ6fxqa0Acdc14QObNeNKkFPIJetvWCOyLdk6tJA6sb6XfPnd
# t2JNvBDJonoUrSSaSp6ZiPP3pOzHyoa/NJUJ7HbRrTPzGHPf3ffwKtG53NkSqP4i
# Py1kFVJW3Ykyq1SUlQ/7UD/N5SPg1RLv8lTqdYXuY6cig7D1XDOPapUtvhKjb+H0
# GIouskPOF/nfB8vBiPDnM+LAC3RwFUi03U3IEEUfRPPvjSflwsNho7j6g+tU7IXk
# DfCwgfyMxvbTJAcalH0EufIDEsCrQ3HvH0oMnidP5Jz4VXCEocb/0zOrBTxbScKH
# Gk4UDN2eqqsbecnAeF7kOE9VOfSSZDrA7ZdvWGD6ofPL0b9wytk=
# =VJig
# -----END PGP SIGNATURE-----
# gpg: Signature made Sun Feb 22 23:21:16 2026 GMT
# gpg:                using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE
# gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <f4bug@amsat.org>" [full]
# Primary key fingerprint: FAAB E75E 1291 7221 DCFD  6BB2 E3E3 2C2C DEAD C0DE

* tag 'hw-misc-20260223' of https://github.com/philmd/qemu: (21 commits)
  net: mark struct tcp_header as QEMU_PACKED
  net: mark struct udp_header as QEMU_PACKED
  net: mark struct eth_header as QEMU_PACKED
  hw/net/rocker: Don't assume h_proto is aligned in eth_strip_vlan_ex()
  hw/net/rocker: Don't keep pointer to h_proto as uint16_t* in OfDpaFlowPktFields
  hw/net/rtl8139: Remove ineffective parameter
  hw/core/cpu: expand cpu_reset function docs
  hw/alpha: remove unused includes
  hw/ppc/spapr: extract SPAPR_MAX_RAM_SLOTS in a new header
  system/globals: Build as common code
  hw/ppc: Set graphic display dimensions generically
  hw/sparc: Set graphic display dimensions generically
  hw/m68k: Set graphic display dimensions generically
  hw/m68k/q800: Set MACFB_DISPLAY_APPLE_21_COLOR within MacFrameBuffer
  hw/m68k/q800: Use MacFbMode fields in q800_machine_init()
  hw/display/macfb: Constify macfb_mode_table[] array
  hw/display/macfb: Constify macfb_sense_table[] array
  hw/char/virtio-serial-bus: Fix Heap-buffer-overflow in set_config()
  hw/virtio: rename virtio_is_big_endian to virtio_vdev_is_big_endian
  hw/virtio: Constify virtio_is_big_endian() argument
  ...

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2026-02-23 09:56:00 +00:00
Peter Maydell
7de8587b53 net: mark struct tcp_header as QEMU_PACKED
The eth_header is not actually guaranteed to be aligned.  We attempt
to deal with this in some places such as net_checksum_calculate() by
using lduw_be_p() and so on to access the fields, but this is not
sufficient to be correct, because even accessing a byte member within
a misaligned struct is undefined behaviour.  The clang sanitizer will
emit an error like this if you run the sifive_u_mmc functional test
with sanitizers enabled:

../../net/checksum.c:144:24: runtime error: member access within misaligned address 0x619a74c32033 for type 'tcp_header' (aka 'struct tcp_header'), which requires 4 byte alignment
0x619a74c32033: note: pointer points here
 0a  00 02 02 86 aa 00 16 52  c1 d3 70 00 00 00 00 a0  02 fa f0 00 00 00 00 02  04 05 b4 04 02 08 0a
              ^
    #0 0x619a6ba84794 in net_checksum_calculate /home/pm215/qemu/build/clang/../../net/checksum.c:144:24
    #1 0x619a6b5940da in gem_transmit /home/pm215/qemu/build/clang/../../hw/net/cadence_gem.c:1386:21
    #2 0x619a6b592141 in gem_write /home/pm215/qemu/build/clang/../../hw/net/cadence_gem.c:1650:13

Fix this by marking the tcp_header struct as QEMU_PACKED.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Message-ID: <20260212140917.1443253-6-peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2026-02-23 00:17:35 +01:00
Peter Maydell
2ca81b0eb3 net: mark struct udp_header as QEMU_PACKED
The eth_header is not actually guaranteed to be aligned.  We attempt
to deal with this in some places such as net_checksum_calculate() by
using lduw_be_p() and so on to access the fields, but this is not
sufficient to be correct, because even accessing a byte member within
a misaligned struct is undefined behaviour.  The clang sanitizer will
emit an error like this if you run the sifive_u_mmc functional test
with sanitizers enabled:

../../net/checksum.c:168:24: runtime error: member access within misaligned address 0x5b7a7f829033 for type 'udp_header' (aka 'struct udp_header'), which requires 2 byte alignment
0x5b7a7f829033: note: pointer points here
 ff  ff ff ff 00 44 00 43 01  34 58 54 01 01 06 00 85  95 80 60 00 00 00 00 00  00 00 00 00 00 00 00
              ^
    #0 0x5b7a71a5887e in net_checksum_calculate /home/pm215/qemu/build/clang/../../net/checksum.c:168:24
    #1 0x5b7a7156819a in gem_transmit /home/pm215/qemu/build/clang/../../hw/net/cadence_gem.c:1386:21
    #2 0x5b7a71566201 in gem_write /home/pm215/qemu/build/clang/../../hw/net/cadence_gem.c:1650:13

Fix this by marking the udp_header struct as QEMU_PACKED,
so that the compiler knows it might be unaligned and will
generate the right code for accessing fields.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Message-ID: <20260212140917.1443253-5-peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2026-02-23 00:17:35 +01:00
Peter Maydell
42ada5daf9 net: mark struct eth_header as QEMU_PACKED
The eth_header is not actually guaranteed to be aligned.  We attempt
to deal with this in some places such as net_checksum_calculate() by
using lduw_be_p() and so on to access the fields, but this is not
sufficient to be correct, because even accessing a byte member within
a misaligned struct is undefined behaviour.  The clang sanitizer will
emit an error like this if you run the sifive_u_mmc functional test
with sanitizers enabled:

../../net/checksum.c:78:47: runtime error: member access within misaligned address 0x561f52f35011 for type 'struct eth_header', which requires 2 byte alignment
0x561f52f35011: note: pointer points here
 00 00 00  00 33 33 00 00 00 16 52  54 00 12 34 56 86 dd 60  00 00 00 00 24 00 01 00  00 00 00 00 00
              ^
    #0 0x561f20608459 in net_checksum_calculate /home/pm215/qemu/build/clang/../../net/checksum.c:78:47
    #1 0x561f20117bfa in gem_transmit /home/pm215/qemu/build/clang/../../hw/net/cadence_gem.c:1386:21
    #2 0x561f20115c61 in gem_write /home/pm215/qemu/build/clang/../../hw/net/cadence_gem.c:1650:13

SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior ../../net/checksum.c:78:47

Fix this by marking the eth_header struct as QEMU_PACKED, so that the
compiler knows it might be unaligned and will generate the right code
for accessing fields.

This is similar to commit f8b94b4c52 ("net: mark struct ip_header as
QEMU_PACKED") where we fixed this for a different struct defined in
this file.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Message-ID: <20260212140917.1443253-4-peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2026-02-23 00:17:35 +01:00
Alex Bennée
703bc80f55 hw/core/cpu: expand cpu_reset function docs
Add a hint to the developer that this should only be called from a
reset chain.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-ID: <20260219171810.602667-15-alex.bennee@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2026-02-23 00:17:34 +01:00
Pierrick Bouvier
fe25b9213c hw/ppc/spapr: extract SPAPR_MAX_RAM_SLOTS in a new header
Allow to include it from common code (vhost-user, in next commit),
else it pulls ppc/cpu.h which has target specifics.

Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20260131020100.1115203-4-pierrick.bouvier@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2026-02-23 00:17:34 +01:00
Philippe Mathieu-Daudé
ee56761607 hw/display/macfb: Constify macfb_mode_table[] array
macfb_mode_table[] is only read, never updated, so can be const.

Update the call sites accordingly.
Make the MacfbState::mode pointer to const.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20260216213121.47122-3-philmd@linaro.org>
2026-02-23 00:17:34 +01:00
Pierrick Bouvier
6325407f67 hw/virtio: rename virtio_is_big_endian to virtio_vdev_is_big_endian
Renaming this function removes the confusion with
existing virtio_is_big_endian cpu ops.

Indeed, virtio_vdev_is_big_endian is *not* calling cpu
virtio_is_big_endian everytime.

Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20260212234602.338131-3-pierrick.bouvier@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2026-02-22 22:52:29 +01:00
Philippe Mathieu-Daudé
2622a178b6 hw/virtio: Constify virtio_is_big_endian() argument
VirtIODevice argument is accessed read-only, make it const.

Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20260206221908.1451528-2-pierrick.bouvier@linaro.org>
2026-02-22 22:52:29 +01:00
Arpit Kumar
6e1410fdcf hw/cxl: Add Physical Port Control FMAPI Command (Opcode 5102h)
Added assert-deassert PERST implementation for physical ports (both USP
and DSP's).

Assert PERST involves bg operation for holding 100ms.
Reset PPB implementation for physical ports.

Signed-off-by: Arpit Kumar <arpit1.kumar@samsung.com>
Co-developed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20260204173223.44122-4-Jonathan.Cameron@huawei.com>
2026-02-20 13:04:45 -05:00
Arpit Kumar
7df839591c hw/cxl: Physical Port Info FMAPI - update to current spec and add defines.
Add a new cxl/cxl_ports.h header for field definitions related only to port
commands. Bring field naming up to date with spec as 'version' bitmasks
have been replaced with bitmasks of the specific features.

Fix a small issue where a reserved value for USP was set to 2 rather
than 0.

Signed-off-by: Arpit Kumar <arpit1.kumar@samsung.com>
Co-developed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Signed-off-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20260204173223.44122-2-Jonathan.Cameron@huawei.com>
2026-02-20 13:04:45 -05:00
Davidlohr Bueso
88ac457c88 hw/cxl: Support type3 HDM-DB
Add basic plumbing for memory expander devices that support Back
Invalidation. This introduces a 'hdm-db=on|off' parameter and
exposes the relevant BI RT/Decoder component cachemem registers.

Some noteworthy properties:
 - Devices require enabling Flit mode across the CXL topology.
 - Explicit BI-ID commit is required.
 - HDM decoder support both host and dev coherency models.

Tested-by: Dongjoo Seo <dongjoo.seo1@samsung.com>
Signed-off-by: Davidlohr Bueso <dave@stgolabs.net>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20260204170936.43959-7-Jonathan.Cameron@huawei.com>
2026-02-20 13:04:45 -05:00
Ira Weiny
5729c01a60 hw/cxl: Refactor component register initialization
CXL 3.2 8.2.4 Table 8-22 defines which capabilities are mandatory, not
permitted, or optional for each type of device.

cxl_component_register_init_common() uses a rather odd 'fall through'
mechanism to define each component register set.  This assumes that any
device or capability being added builds on the previous devices
capabilities.  This is not true as there are mutually exclusive
capabilities defined.  For example, downstream ports can not have snoop
but it can have Back Invalidate capable decoders.

Refactor this code to make it easier to add individual capabilities as
defined by a device type.  Any capability which is not specified by the
type is left NULL'ed out which complies with the packed nature of the
register array.

Update all spec references to 3.2.

No functional changes should be seen with this patch.

Signed-off-by: Ira Weiny <ira.weiny@intel.com>
Tested-by: Dongjoo Seo <dongjoo.seo1@samsung.com>
[rebased, no RAS for HBs, r3.2 references]
Signed-off-by: Davidlohr Bueso <dave@stgolabs.net>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20260204170936.43959-3-Jonathan.Cameron@huawei.com>
2026-02-20 13:04:45 -05:00
Davidlohr Bueso
d29f3f5cdd hw/pcie: Support enabling flit mode
PCIe Flit Mode, introduced with the PCIe 6.0 specification, is a
fundamental change in how data is transmitted over the bus to
improve transfer rates. It shifts from variable-sized Transaction
Layer Packets (TLPs) to fixed 256-byte Flow Control Units (FLITs).

As with the link speed and width training, have ad-hoc property for
setting the flit mode and allow CXL components to make use of it.

For the CXL root port and dsp cases, always report flit mode but
the actual value after 'training' will depend on the downstream
device configuration.

Suggested-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Tested-by: Dongjoo Seo <dongjoo.seo1@samsung.com>
Signed-off-by: Davidlohr Bueso <dave@stgolabs.net>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20260204170936.43959-2-Jonathan.Cameron@huawei.com>
2026-02-20 13:04:45 -05:00
Shiju Jose
da5cafdc4d hw/cxl: Add emulation for memory sparing control feature
Memory sparing is defined as a repair function that replaces a portion of
memory with a portion of functional memory at that same DPA. The
subclasses for this operation vary in terms of the scope of the sparing
being performed. The Cacheline sparing subclass refers to a sparing
action that can replace a full cacheline. Row sparing is provided as an
alternative to PPR sparing functions and its scope is that of a single
DDR row. Bank sparing allows an entire bank to be replaced. Rank sparing
is defined as an operation in which an entire DDR rank is replaced.

Memory sparing maintenance operations may be supported by CXL devices
that implement CXL.mem protocol. A sparing maintenance operation requests
the CXL device to perform a repair operation on its media.
For example, a CXL device with DRAM components that support memory sparing
features may implement sparing Maintenance operations.

The host may issue a query command by setting Query Resources flag in the
Input Payload (CXL Spec 3.2 Table 8-120) to determine availability of
sparing resources for a given address. In response to a query request,
the device shall report the resource availability by producing the Memory
Sparing Event Record (CXL Spec 3.2 Table 8-60) in which the Channel, Rank,
Nibble Mask, Bank Group, Bank, Row, Column, Sub-Channel fields are a copy
of the values specified in the request.

During the execution of a sparing maintenance operation, a CXL memory
device:
- May or may not retain data
- May or may not be able to process CXL.mem requests correctly.
These CXL memory device capabilities are specified by restriction flags
in the memory sparing feature readable attributes.

When a CXL device identifies error on a memory component, the device
may inform the host about the need for a memory sparing maintenance
operation by using DRAM event record, where the 'maintenance needed' flag
may set. The event record contains some of the DPA, Channel, Rank,
Nibble Mask, Bank Group, Bank, Row, Column, Sub-Channel fields that
should be repaired. The userspace tool requests for maintenance operation
if the 'maintenance needed' flag set in the CXL DRAM error record.

CXL spec 3.2 section 8.2.10.7.2.3 describes the memory sparing feature
discovery and configuration.

CXL spec 3.2 section 8.2.10.7.1.4 describes the device's memory sparing
maintenance operation feature.

Add emulation for CXL memory device memory sparing control feature
and memory sparing maintenance operation command.

Signed-off-by: Shiju Jose <shiju.jose@huawei.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20250917143330.294698-4-Jonathan.Cameron@huawei.com>
2026-02-20 13:04:45 -05:00
Davidlohr Bueso
5e5a86bab8 hw/cxl: Add support for Maintenance command and Post Package Repair (PPR)
This adds initial support for the Maintenance command, specifically
the soft and hard PPR operations on a dpa. The implementation allows
to be executed at runtime, therefore semantically, data is retained
and CXL.mem requests are correctly processed.

Keep track of the requests upon a general media or DRAM event.

Post Package Repair (PPR) maintenance operations may be supported by CXL
devices that implement CXL.mem protocol. A PPR maintenance operation
requests the CXL device to perform a repair operation on its media.
For example, a CXL device with DRAM components that support PPR features
may implement PPR Maintenance operations. DRAM components may support two
types of PPR, hard PPR (hPPR), for a permanent row repair, and Soft PPR
(sPPR), for a temporary row repair. Soft PPR is much faster than hPPR,
but the repair is lost with a power cycle.

CXL spec 3.2 section 8.2.10.7.1.2 describes the device's sPPR (soft PPR)
maintenance operation and section 8.2.10.7.1.3 describes the device's
hPPR (hard PPR) maintenance operation feature.

CXL spec 3.2 section 8.2.10.7.2.1 describes the sPPR feature discovery and
configuration.

CXL spec 3.2 section 8.2.10.7.2.2 describes the hPPR feature discovery and
configuration.

CXL spec 3.2 section 8.2.10.2.1.4 Table 8-60 describes the Memory Sparing
Event Record.

Signed-off-by: Davidlohr Bueso <dave@stgolabs.net>
Co-developed-by: Shiju Jose <shiju.jose@huawei.com>
Signed-off-by: Shiju Jose <shiju.jose@huawei.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20250917143330.294698-3-Jonathan.Cameron@huawei.com>
2026-02-20 13:04:45 -05:00
Shiju Jose
1fc57dd250 hw/cxl/events: Updates for rev3.2 memory module event record
CXL spec rev3.2 section 8.2.10.2.1.3 Table 8-59, memory module
event record has updated with following new fields.
1. Validity Flags
2. Component Identifier
3. Device Event Sub-Type

Add updates for the above spec changes in the CXL memory module
event reporting and QMP command to inject memory module event.

Updated all references for this command to the CXL r3.2
specification.

Signed-off-by: Shiju Jose <shiju.jose@huawei.com>
Acked-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20260205112350.60681-6-Jonathan.Cameron@huawei.com>
2026-02-20 13:04:45 -05:00
Shiju Jose
94976b8631 hw/cxl/events: Updates for rev3.2 DRAM event record
CXL spec rev3.2 section 8.2.10.2.1.2 Table 8-58, DRAM event record
has updated with following new fields.
1. Component Identifier
2. Sub-channel of the memory event location
3. Advanced Programmable Corrected Memory Error Threshold Event Flags
4. Corrected Volatile Memory Error Count at Event
5. Memory Event Sub-Type

Add updates for the above spec changes in the CXL DRAM event
reporting and QMP command to inject DRAM event.

In order to ensure consistency update all specification references
for this command to CXL r3.2.

Signed-off-by: Shiju Jose <shiju.jose@huawei.com>
Acked-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20260205112350.60681-5-Jonathan.Cameron@huawei.com>
2026-02-20 13:04:45 -05:00
Shiju Jose
1aa989a176 hw/cxl/events: Updates for rev3.2 general media event record
CXL spec rev3.2 section 8.2.10.2.1.1 Table 8-57, general media event
table has updated with following new fields.
1. Advanced Programmable Corrected Memory Error Threshold Event Flags
2. Corrected Memory Error Count at Event
3. Memory Event Sub-Type
4. Support for component ID in the PLDM format.

Add updates for the above spec changes in the CXL general media event
reporting and QMP command to inject general media event.

In order to have one consistent source of references, update all to
references for this command to CXL r3.2.

Signed-off-by: Shiju Jose <shiju.jose@huawei.com>
Acked-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20260205112350.60681-4-Jonathan.Cameron@huawei.com>
2026-02-20 13:04:45 -05:00
Shiju Jose
e5b7d31243 hw/cxl/events: Update for rev3.2 common event record format
CXL spec 3.2 section 8.2.9.2.1 Table 8-55, Common Event Record
format has updated with optional Maintenance Operation Subclass,
LD ID and ID of the device head information.

Add updates for the above optional parameters in the related
CXL events reporting and in the QMP commands to inject CXL events.

Update all related specification references to CXL r3.2 to ensure
one consistent source.

Signed-off-by: Shiju Jose <shiju.jose@huawei.com>
Acked-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Ravi Jonnalagadda <ravis.opensrc@gmail.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20260205112350.60681-3-Jonathan.Cameron@huawei.com>
2026-02-20 13:04:45 -05:00
Philippe Mathieu-Daudé
843a97fa2c hw/virtio: Pass VirtIODevice* to virtio_reset()
virtio_reset() expects a VirtIODevice pointer, which
is what the single caller - virtio_bus_reset - passes.
Promote the opaque argument to a plain VirtIODevice.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20260201223929.78790-1-philmd@linaro.org>
2026-02-20 13:04:45 -05:00
Yanfeng Liu
27b3708292 audio/virtio-snd: fix latency calc
Media players needs meaningful latency_bytes update but it is
zero now most of the time. This adds stream-wise latency_bytes
calculation so that to improve the situation.

Signed-off-by: Yanfeng Liu <p-liuyanfeng9@xiaomi.com>
Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <tencent_66E8C146EA79CD00E966DEDAEF8CACD97D05@qq.com>
2026-02-20 13:04:44 -05:00
Peter Maydell
07f97d5da0 Merge tag 'pull-target-arm-20260219' of https://gitlab.com/pm215/qemu into staging
target-arm queue:
 * Allow TCG to emulate CPUs with SME but not SVE
 * Refactorings for single-binary
 * whpx: minor fixes
 * hw/usb/hcd-ohci: Implement frame number overflow event

# -----BEGIN PGP SIGNATURE-----
#
# iQJNBAABCAA3FiEE4aXFk81BneKOgxXPPCUl7RQ2DN4FAmmW5pgZHHBldGVyLm1h
# eWRlbGxAbGluYXJvLm9yZwAKCRA8JSXtFDYM3uukD/9hu74EY24AYHuOog8Kb/xO
# 1WLGKFOa6rcSlSh+bvQ+mVqWXxsFp2sdEWddG7GD5i1ztOv2tcY+cKnvt9GBSaUf
# /SGepqoY8xgUWuDhRwk3tzfssemZC5IK6dSfljhlPlFpRU8ih7nWrsNjg1igK922
# UjYz2r/q+DT19liTOVzQhkl8VT7TvmFVOh3LxZcj0s4tB7E8S6DucWvhT/BYb/HF
# kxNcnsW/TkHuhgKSxqioLnY5WEb28EKVCZHO5GOBhc50l9P/adEQ9Osx/2uSsSir
# flnXbIc8JCOngNTyyF0RE00E14Fkh0EjTL/RB+kS5cqhcIN0NBI4E+JG7cjZ/+3H
# oDY1f+BS47s7Yrqi0yjXiOeM7i4Hcn7R9Kod8NUOalFHDOne0pPusWrK9kGQbnwO
# fnnJ2GCxTPcIG9tYVLqF0v4Wc8pAn5U1i2gK9HcRrUItgO0n7zvU/KBGZAAUW/Z/
# YMgpQaWuGC8mFlhojPQ9I4gCVjLUBt7TwkmdFrdeNmeYSuZfIRBer6uSbr4b+nvi
# VYyZgANiNazGIOZo+vchgHjqUMOkUN8L3bU0W8sFgISd2AEtWLVV1pAQs8XLWvxM
# NFVCBBPcYngMkxMxNB1yC6Mx1JcUwmYOnBEXF9koHIf89RIQhpcQQA6W7zoiME+o
# Do4a6MG6W4MekYVfsEJoJQ==
# =OMZn
# -----END PGP SIGNATURE-----
# gpg: Signature made Thu Feb 19 10:31:52 2026 GMT
# gpg:                using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE
# gpg:                issuer "peter.maydell@linaro.org"
# gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [ultimate]
# gpg:                 aka "Peter Maydell <pmaydell@gmail.com>" [ultimate]
# gpg:                 aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" [ultimate]
# gpg:                 aka "Peter Maydell <peter@archaic.org.uk>" [ultimate]
# Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83  15CF 3C25 25ED 1436 0CDE

* tag 'pull-target-arm-20260219' of https://gitlab.com/pm215/qemu: (32 commits)
  include/tcg/tcg-op.h: eradicate TARGET_INSN_START_EXTRA_WORDS
  target/arm/tcg/translate.h: replace target_long with int64_t
  target/arm/tcg/translate.h: replace target_ulong with vaddr
  target/arm/tcg/vec_helper.c: make compilation unit common
  target/arm/tcg/cpu-v7m.c: make compilation unit common
  target/arm/tcg/psci.c: make compilation unit common
  target/arm: move exec/helper-* plumbery to helper.h
  tcg: move tcg_use_softmmu to tcg/tcg-internal.h
  target/arm: extract helper-sme.h from helper.h
  target/arm: extract helper-sve.h from helper.h
  target/arm: extract helper-a64.h from helper.h
  target/arm: extract helper-mve.h from helper.h
  target/arm: Don't require helper prototypes in helper.c
  target/arm: Move TCG-specific code out of debug_helper.c
  whpx: fix FP register loop
  whpx: remove duplicate include
  hw/usb/hcd-ohci: Implement frame number overflow event
  target/arm: Permit configurations with SME but not SVE
  target/arm: Squash FEAT_SME_FA64 if FEAT_SVE is not present
  target/arm: Don't squash all ID_AA64ZFR0_EL1 fields for non-SVE
  ...

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2026-02-19 10:36:06 +00:00
Pierrick Bouvier
10059583c7 include/tcg/tcg-op.h: eradicate TARGET_INSN_START_EXTRA_WORDS
This commit removes TARGET_INSN_START_EXTRA_WORDS and force all arch to
call the same version of tcg_gen_insn_start, with additional 0 arguments
if needed. Since all arch have a single call site (in translate.c), this
is as good documentation as having a single define.

The notable exception is target/arm, which has two different translate
files for 32/64 bits. Since it's the only one, we accept to have two
call sites for this.

As well, we update parameter type to use uint64_t instead of
target_ulong, so it can be called from common code.

Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-id: 20260219040150.2098396-15-pierrick.bouvier@linaro.org
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2026-02-19 10:12:25 +00:00
Pierrick Bouvier
9085154835 tcg: move tcg_use_softmmu to tcg/tcg-internal.h
In next commit, we'll apply same helper pattern for base helpers
remaining.

Our new helper pattern always include helper-*-common.h, which ends up
including include/tcg/tcg.h, which contains one occurrence of
CONFIG_USER_ONLY.
Thus, common files not being duplicated between system and target
relying on helpers will fail to compile. Existing occurrences are:
- target/arm/tcg/arith_helper.c
- target/arm/tcg/crypto_helper.c

This occurrence of CONFIG_USER_ONLY is for defining variable
tcg_use_softmmu, and we rely on dead code elimination with it in various
tcg-target.c.inc.

Thus, move its definition to tcg/tcg-internal.h, so helpers can be
included by common files. Also, change it to a define, as it has fixed
values for now.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-id: 20260219040150.2098396-8-pierrick.bouvier@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2026-02-19 10:12:25 +00:00
Peter Maydell
53af6529b1 Merge tag 'pull-vfio-20260218' of https://github.com/legoater/qemu into staging
vfio queue:

* Improves VFIO region mmap alignment for hugepfnmap support on
  Grace-based systems (GB200)
* Documents vfio_device_get_region_info() API
* Adds a new VFIO_MIGRATION event notifying PRE_COPY_P2P transition

# -----BEGIN PGP SIGNATURE-----
#
# iQIzBAABCAAdFiEEoPZlSPBIlev+awtgUaNDx8/77KEFAmmVxcMACgkQUaNDx8/7
# 7KGOLw//XyKW5Xuyo6nqsTYbukHEa2LGkQ4IkdLiJm5lVdXl86G23e0N+PzA+Ukr
# hjSUysTHjrmEds53x57yYGfn+cLtGgxC7IWETDcMpBYtzs5hIgEpmkeTb0mTghc1
# U4U99xdDcN33ASt7kPfYrOXOBPKWcfZd+Ut/UW9H8qm+RPu8I63khh7t6OG7uMdf
# 7QJZ2cfaNTR9fSQb15/1YsMcHn4lyQG03fpbhueKA+tC08I+FHp6OCYIbZJrdk3E
# L+XRtZgeUow5o63cG8zBIZuhci4B9J8Di/tMmldZOOF6xq0rKL/0yzKt1ifuTiTx
# G25OeoVnXcBYGJd+f9wcSREslNjSqUrfnz8Z5+WUJLUZ9Jy2ugiyQUiS/d9eqrr3
# p7GDE+GfykvjNS2MD2vW34yg5AhrJSP97InrUpq+p/Ed4WWdfk0oED1I6NRJeEmo
# URPAHbSVPCSTh0GQMbop73+gQibee5PTd9Fg7CUoEPXYvt9nTWSuUycMfWPzLa/C
# +AdOXA42ocP6TZaS4/XGLmT4KeVxf/uYoBe/iWD0FJ8uvQ2fvZ71llsmMMk6ju17
# 3NiUHZqypWBhSpMkSDBY6fmtGaLy9NwzEwRy9XGMET8o4tyq/T4fr7/aHqsM6IN6
# EZx7hXffQ3rjY72P32esimVOa/FnXbc6JbDBkfP2iXf3FIIJZD8=
# =9FKA
# -----END PGP SIGNATURE-----
# gpg: Signature made Wed Feb 18 13:59:31 2026 GMT
# gpg:                using RSA key A0F66548F04895EBFE6B0B6051A343C7CFFBECA1
# gpg: Good signature from "Cédric Le Goater <clg@redhat.com>" [full]
# gpg:                 aka "Cédric Le Goater <clg@kaod.org>" [full]
# Primary key fingerprint: A0F6 6548 F048 95EB FE6B  0B60 51A3 43C7 CFFB ECA1

* tag 'pull-vfio-20260218' of https://github.com/legoater/qemu:
  vfio: Document vfio_device_get_region_info()
  hw/vfio: align mmap to power-of-2 of region size for hugepfnmap
  vfio: Add Error ** parameter to vfio_region_setup()
  hw/vfio: sort and validate sparse mmap regions by offset
  vfio/migration: Send VFIO_MIGRATION event before PRE_COPY_P2P transition

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2026-02-19 09:37:09 +00:00
Vivek Kasireddy
9757da8951 vfio: Document vfio_device_get_region_info()
Add documentation for vfio_device_get_region_info() and clarify the
expectations around its usage.

Cc: Alex Williamson <alex@shazbot.org>
Cc: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Signed-off-by: Vivek Kasireddy <vivek.kasireddy@intel.com>
Link: https://lore.kernel.org/qemu-devel/20260210070155.1176081-8-vivek.kasireddy@intel.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
2026-02-18 10:55:30 +01:00
Peter Xu
a545fafccf migration: Rename MIG_EVENT_PRECOPY_* to MIG_EVENT_*
All three events are shared between precopy and postcopy, rather than
precopy specific.

For example, both precopy and postcopy will go through a SETUP process.

Meanwhile, both FAILED and DONE notifiers will be notified for either
precopy or postcopy on completions / failures.

Rename them to make them match what they do, and shorter.

Reviewed-by: Fabiano Rosas <farosas@suse.de>
Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Peter Xu <peterx@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20260126213614.3815900-6-peterx@redhat.com
[fixed-up entry in scsi-disk.c that got merged first]
Signed-off-by: Fabiano Rosas <farosas@suse.de>
2026-02-17 09:43:09 -03:00
Peter Xu
ff3a9e4e31 migration: Fix double notification of DONE/FAIL for postcopy
Migration notifiers will notify at any of three places: (1) SETUP
phase, (2) migration completes, (3) migration fails.

There's actually a special case for spice: one can refer to
b82fc321bf ("Postcopy+spice: Pass spice migration data earlier").  It
doesn't need another 4th event because in commit 9d9babf78d ("migration:
MigrationEvent for notifiers") we merged it together with the DONE event.

The merge makes some sense if we treat "switchover" of postcopy as "DONE",
however that also means for postcopy we'll notify DONE twice..  The other
one at the end of postcopy when migration_cleanup().

In reality, the current code base will also notify FAILED for postcopy
twice.  It's because an (maybe accidental) change in commit
4af667f87c ("migration: notifier error checking").

First of all, we still need that notification when switchover as stated in
Dave's commit, however that's only needed for spice.  To fix it, introduce
POSTCOPY_START event to differenciate it from DONE.  Use that instead in
postcopy_start().  Then spice will need to capture this event too.

Then we remove the extra FAILED notification in postcopy_start().

If one wonder if other DONE users should also monitor POSTCOPY_START
event.. We have two more DONE users:

  - kvm_arm_gicv3_notifier
  - cpr_exec_notifier

Both of them do not need a notification for POSTCOPY_START, but only when
migration completed.  Actually, both of them are used in CPR, which doesn't
support postcopy.

When at this, update the notifier transition graph in the comment, and move
it from migration_add_notifier() to be closer to where the enum is defined.

I didn't attach Fixes: because I am not aware of any real bug on such
double reporting.  I'm wildly guessing the 2nd notify might be silently
ignored in many cases.  However this is still worth fixing.

Cc: Marc-André Lureau <marcandre.lureau@redhat.com>
Cc: Dr. David Alan Gilbert <dave@treblig.org>
Signed-off-by: Peter Xu <peterx@redhat.com>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/qemu-devel/20260126213614.3815900-3-peterx@redhat.com
Signed-off-by: Fabiano Rosas <farosas@suse.de>
2026-02-17 09:40:32 -03:00
Peter Maydell
ece408818d Merge tag 'for-upstream' of https://gitlab.com/bonzini/qemu into staging
* hw/i386: Remove deprecated PC 2.6 and 2.7 machines
* i386/cpu: Fix incorrect initializer in Diamond Rapids definition
* qom: Clean up property release
* target/i386/kvm: set KVM_PMU_CAP_DISABLE if "-pmu" is configured
* target/i386/kvm: reset AMD and perfmon-v2 PMU registers during VM reset
* mshv: Cleanup
* target/i386: convert SEV-ES termination requests to guest panic events

# -----BEGIN PGP SIGNATURE-----
#
# iQFIBAABCgAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAmmO+kYUHHBib256aW5p
# QHJlZGhhdC5jb20ACgkQv/vSX3jHroPwIQf/XL4HXB7bYQH7LtTgsjmmxPpEqGuM
# 2QWvv1HurGf4pBCkBB7iFdzngSbJSzvtIM4D2KRuXVc99Ml8Do4kKGwDdtVfaM+I
# x+nsJfnSGA7tuNVQUUDEM1XWrnk3+O9oQxlk3elBWy8IBIjHFY1rv3FBdO9WkDpu
# AlaMITrX4R7u5gadCrxvAprbngNGlK220HZ+nxdxvf6mWkYMPqy1xtNzHIioG61V
# A94tdv/OZnUoQMd98c/yUvfST4/Gx6FeoEYfmyXGrnLM+Tc9es/xpN/mCYLdP3wA
# MDS170D2Z0zoZScLcpMfeqSn5cDYBMOSHBzqFpw2/FNVTO3td2qlSMLjzw==
# =AqB6
# -----END PGP SIGNATURE-----
# gpg: Signature made Fri Feb 13 10:17:42 2026 GMT
# gpg:                using RSA key F13338574B662389866C7682BFFBD25F78C7AE83
# gpg:                issuer "pbonzini@redhat.com"
# gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" [full]
# gpg:                 aka "Paolo Bonzini <pbonzini@redhat.com>" [full]
# Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4  E2F7 7E15 100C CD36 69B1
#      Subkey fingerprint: F133 3857 4B66 2389 866C  7682 BFFB D25F 78C7 AE83

* tag 'for-upstream' of https://gitlab.com/bonzini/qemu: (41 commits)
  target/i386/mshv: remove unused optimization of gva=>gpa translation
  accel/mshv: Remove remap overlapping mappings code
  tests: add /qdev/free-properties test
  qdev: make release_tpm() idempotent
  qdev: make release_drive() idempotent
  qdev: make release_string() idempotent
  qdev: Free property array on release
  target/i386/kvm: support perfmon-v2 for reset
  target/i386/kvm: reset AMD PMU registers during VM reset
  target/i386/kvm: rename architectural PMU variables
  target/i386/kvm: extract unrelated code out of kvm_x86_build_cpuid()
  target/i386/kvm: set KVM_PMU_CAP_DISABLE if "-pmu" is configured
  i386/cpu: Fix incorrect initializer in Diamond Rapids definition
  hw/char/virtio-serial: Do not expose the 'emergency-write' property
  hw/virtio/virtio-pci: Remove VirtIOPCIProxy::ignore_backend_features field
  hw/i386/intel_iommu: Remove IntelIOMMUState::buggy_eim field
  hw/core/machine: Remove hw_compat_2_7[] array
  hw/audio/pcspk: Remove PCSpkState::migrate field
  target/i386/cpu: Remove CPUX86State::full_cpuid_auto_level field
  hw/i386/pc: Remove pc_compat_2_7[] array
  ...

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2026-02-13 10:30:08 +00:00
Peter Maydell
4dd433550d Merge tag 'char-pull-request' of https://gitlab.com/marcandre.lureau/qemu into staging
chardev patches

# -----BEGIN PGP SIGNATURE-----
#
# iQIzBAABCgAdFiEEh6m9kz+HxgbSdvYt2ujhCXWWnOUFAmmO8tUACgkQ2ujhCXWW
# nOW1sg//bqvhuJeHHQoDzNM5qgPTwLoqKYOt5xx2MZkH5oRoG0L6RfjNKqs8DPVc
# rnWFNr6YYHP+AjtYSoOFZZZugQyYDggE6Defkb52ScMNgQF0MSYXfZz6gEllgbzw
# +xvSsS1MztwpfkcUGaV5GL6PatuhkmioX0v083w0AbyHhuCF5zjKPaW6tNb9iwdz
# A3pnPkZSdGQ876R53vRY0OhEDFD7aT/jiVPiN6rzjxaz7CL5nAGy3PQtXWnJptCd
# YPgl5CIKe0NsTBD+h4rq7GtU8z2dNGW+wocXuyBvBDxkfVgjWEi0yJ9C1tY3focG
# cZxuaC8GLpbowdNqBUdJzjOdj7GIn8pG/ASPrjYjA3igFspdr8vRfEiS01KnBNi7
# 9Jzg6A4uHJI25ydPEAGRjbWjPYuElrEoLO2WUG3NWlb2sAoj+WEhQyD6C9+Mp0KY
# 9aDAClzOLylqZLe4vLrMjR9MGHE7nAilvwFTVeD3CBEySmBvDgygzMzuDXq8D5NB
# nsZslPy+WXJAydTvCfB8eS3NGZWUz2MQmHsdLGBheSLnLoAKoC4p9BFx09XgMLAw
# hV0n0/0v9XtOLwvGILy7ejxt0sZXHFI3avy1df8gMSeP2VpX7DXnd745fZJQt3xB
# ppwYRg9MHHuIb1KoVvfck34WHJ6bhSHROEe2I/fdVFhCXg2eyms=
# =CYVg
# -----END PGP SIGNATURE-----
# gpg: Signature made Fri Feb 13 09:45:57 2026 GMT
# gpg:                using RSA key 87A9BD933F87C606D276F62DDAE8E10975969CE5
# gpg: Good signature from "Marc-André Lureau <marcandre.lureau@redhat.com>" [full]
# gpg:                 aka "Marc-André Lureau <marcandre.lureau@gmail.com>" [full]
# Primary key fingerprint: 87A9 BD93 3F87 C606 D276  F62D DAE8 E109 7596 9CE5

* tag 'char-pull-request' of https://gitlab.com/marcandre.lureau/qemu:
  baum: Add copy/paste bindings
  chardev: add logtimestamp option
  error-report: make real_time_iso8601() public
  char: qemu_chr_write_log() use qemu_write_full()
  chardev/char: qemu_char_open(): add return value
  chardev: rework filename handling
  chardev: introduce .chr_get_pty_name() handler
  chardev/char-pty: store pty_name into PtyChardev state
  chardev: .chr_open(): add boolean return value
  chardev: .chr_open(): drop be_opened parameter
  chardev: consistent naming for ChardevClass handlers implementations
  chardev: ChardevClass: consistent naming for handlers
  ui/spice: drop SPICE_HAS_ATTACHED_WORKER macro
  ui/spice: Require spice-server >= 0.15.0
  char-udp: Fix initial backend open status

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2026-02-13 10:29:55 +00:00
Magnus Kulke
626e5dc999 accel/mshv: Remove remap overlapping mappings code
This change removes userland code that worked around a restriction
in the mshv driver in the 6.18 kernel: regions from userland
couldn't be mapped to multiple regions in the kernel. We maintained a
shadow mapping table in qemu and used a heuristic to swap in a requested
region in case of UNMAPPED_GPA exits.

However, this heuristic wasn't reliable in all cases, since HyperV
behaviour is not 100% reliable across versions. HyperV itself doesn't
prohibit to map regions at multiple places into the guest, so the
restriction has been removed in the mshv driver.

Hence we can remove the remapping code. Effectively this will mandate a
6.19 kernel, if the workload attempt to map e.g. BIOS to multiple
reagions. I still think it's the right call to remove this logic:

- The workaround only seems to work reliably with a certain revision
  of HyperV as a nested hypervisor.
- We expect Direct Virtualization (L1VH) to be the main platform for
  the mshv accelerator, which also requires a 6.19 kernel

This reverts commit efc4093358.

Signed-off-by: Magnus Kulke <magnuskulke@linux.microsoft.com>
Acked-by: Wei Liu (Microsoft) <wei.liu@kernel.org>
Tested-by: Mohamed Mediouni <mohamed@unpredictable.fr>
Link: https://lore.kernel.org/r/20260113153708.448968-1-magnuskulke@linux.microsoft.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2026-02-13 11:16:52 +01:00
Peter Maydell
91eb10be2e Merge tag 'pull-aspeed-20260212' of https://github.com/legoater/qemu into staging
aspeed-next queue:

* Adds support for the AST2700 A2 SoC, including a new machine and
  a functional test
* Enhances AST2600 OTP functional test
* Restructures Aspeed ARM tests into separate files for better
  parallelism.
* Includes new SDK tests with Linux 5.15.
* Fixes Aspeed I2C models

# -----BEGIN PGP SIGNATURE-----
#
# iQIzBAABCAAdFiEEoPZlSPBIlev+awtgUaNDx8/77KEFAmmOSFgACgkQUaNDx8/7
# 7KEq0RAAyhY6FCrwU3hyeA0WPCWAIhoXjqVkuPIqbLEKpazuRK2A0XeN1QH38VUu
# rotcWx5O/eTqwDXm4uTPcHGjiFjL9YRkj3opBE33pfbnMWllezUrK6Soa3q4A9uk
# FnV2YN0sucaueUdXaKe4dJr12uxUWWTQ53Lr+yt0wmXJsjvBsUWaXBTJj+aGPWuS
# u46yxJFxKUK/3GkA8nnEOm91EEQYkETX5LeWZm8aqN/BHuvJNqWuhx19rj1kaa1K
# VXgv3lvvfTpKCpqz2BwFa03ZL4PNCRlS+fN1A9idcnh4yQzngw07jc/9r3Kx/8PS
# zYFgko7EU6Ja4WojToFU4yZK5NZN6BfCd6HAjIBN86EsysDWcNS9DXmqvPnMaPGl
# l+580YsGFO2F7sd8iSPAYT1Tl17jOLVMNIW4khNVOTUnJKIJWlfyA2u4J/1iYKcF
# UiASnvmtryNru9TahlCfTK1SLsFywKN3q6lgVFMba9GX2fzrtZCCDHrQYqHWnnGj
# IzpiUAX/GU8ST1p3RjA0hR2TdBHcA6QByOFhJYQoSmHw5gcuuVxXKNl+y1y9zj07
# YPJFm2V/29m/XcpV0NkAhpX+Gcg9ASrMEQplis2v0nvzSMd/Lcr7YNJLtX9/zkth
# wP8dRnSqisWrUDEUSYap8rxPdguRlUv/tAoxcJVlryN2fB8sOOc=
# =78p2
# -----END PGP SIGNATURE-----
# gpg: Signature made Thu Feb 12 21:38:32 2026 GMT
# gpg:                using RSA key A0F66548F04895EBFE6B0B6051A343C7CFFBECA1
# gpg: Good signature from "Cédric Le Goater <clg@redhat.com>" [full]
# gpg:                 aka "Cédric Le Goater <clg@kaod.org>" [full]
# Primary key fingerprint: A0F6 6548 F048 95EB FE6B  0B60 51A3 43C7 CFFB ECA1

* tag 'pull-aspeed-20260212' of https://github.com/legoater/qemu:
  tests/functional/aarch64/test_aspeed_ast2700fc: Use AST2700 A2 SDK image for FC tests
  hw/arm/aspeed_ast27x0-fc: Increase BMC DRAM size to 2GB for AST2700 A2
  hw/arm/aspeed_ast27x0-fc: Switch AST2700 FC machine to A2 SoC
  tests/functional/aarch64/test_aspeed_ast2700a2: Add AST2700 A2 EVB functional tests
  tests/functional/aarch64/test_aspeed_ast2700: Rename AST2700 A1 test to reduce test runtime
  tests/qtest/ast2700-hace-test: Use ast2700-evb alias for AST2700 HACE tests
  hw/arm/aspeed_ast27x0_evb: Move ast2700-evb alias to AST2700 A2 EVB
  hw/arm/aspeed_ast27x0_evb: Add AST2700 A2 EVB machine
  hw/arm/aspeed_ast27x0: Add AST2700 A2 SoC support
  hw/misc/aspeed_scu: Add AST2700 A2 silicon revisions
  hw/misc/aspeed_scu: Remove unused SoC silicon revision definitions
  tests/functional/arm/aspeed_ast2600: Enhance OTP test with functional validation
  hw/i2c/aspeed_i2c: Increase I2C device register size to 0xA0
  hw/i2c/aspeed_i2c: Fix out-of-bounds read in I2C MMIO handlers
  tests/functional: Add SDK tests with Linux 5.15
  tests/functional: Split Aspeed ARM tests into separate files

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2026-02-13 09:33:35 +00:00
Peter Maydell
05167ea35a Merge tag 'ipmi-add-fake-lan-config' of https://github.com/cminyard/qemu into staging
Add a fake LAN config operation for testing

Just add the commands, the proper data that can be set, and some tests.

Submitter ran migration test.

# -----BEGIN PGP SIGNATURE-----
#
# iQIzBAABCgAdFiEE/Q1c5nzg9ZpmiCaGYfOMkJGb/4EFAmmODfcACgkQYfOMkJGb
# /4EGEg/+NAygBBmU3gyBwrbSwS6Zch1Csq9M8sBGexEmbi/T9ICHI8Sfb3aX7JSr
# 3hZS/pPXn9Bb1vNQ5fQ2KCfDY0CjXtNBiSOvttgtYHiYu+Dz7+0WicusGKUoUywp
# jYwzsFaa8Nf//rhNGdXLXOOhNtMHD5ia3awhg5lPBgFTTrfGiKaz9CzTQCaFZtub
# Tt4nWjN+qBXPTBOsLTEZiIJ7qh9LhM56qT6e85wLwLjNSPgmctCTR+j1gg4nWSq2
# SOUQ6KeIY+DGk4G21i2HnHpjZK9BrUoISBElrSUECxRMokOAgPapMzAFZvErDI5n
# SiIuLjJqsOsPqjw60zrGhM81lawqJxSViQtVdHZ2vM4XABMOUs5msgE7doJMPGIH
# Hmnchv7WGZuWIwAsvF1T3fTyLvGES/8pv6UMKLjscdEIO7JMveUAvQHjUN1j06Ny
# p1VEB2EgkPz6YnvxZ2WN693SuWGhAuixRmjBHABwp+l43QvCYen+XMEnaBzcAnKl
# qrNMrU44OXDqofUrb5zaqj5o5Lmv8vjApGa3ouhKmYCinluboEEvPtP8szGVGat3
# k6cRPtz6FkngM1jtAUBCxH2pb0Rol3gFqfkoZRjqO3hyOl8q1ky5nSWcZqiJ5DPE
# fPIZW22ZF3yJPdVtSzwaiJ8klk9z3hgOoFlyZQkojaGuSeu2UOE=
# =QbzC
# -----END PGP SIGNATURE-----
# gpg: Signature made Thu Feb 12 17:29:27 2026 GMT
# gpg:                using RSA key FD0D5CE67CE0F59A6688268661F38C90919BFF81
# gpg: Good signature from "Corey Minyard <cminyard@mvista.com>" [unknown]
# gpg:                 aka "Corey Minyard <minyard@acm.org>" [unknown]
# gpg:                 aka "Corey Minyard <corey@minyard.net>" [unknown]
# gpg:                 aka "Corey Minyard <minyard@mvista.com>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg:          There is no indication that the signature belongs to the owner.
# Primary key fingerprint: FD0D 5CE6 7CE0 F59A 6688  2686 61F3 8C90 919B FF81

* tag 'ipmi-add-fake-lan-config' of https://github.com/cminyard/qemu:
  hw/ipmi/ipmi_bmc_sim: Support setting fake LAN channel config
  hw/ipmi/ipmi_bmc_sim: Support getting fake LAN channel config

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2026-02-13 09:33:24 +00:00
Vladimir Sementsov-Ogievskiy
b108dcbebc chardev: add logtimestamp option
Add an option to inject timestamps into serial log file.
That simplifies debugging a lot, when you can simply compare
QEMU logs with guest console logs.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Acked-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-ID: <20260201173633.413934-4-vsementsov@yandex-team.ru>
2026-02-13 10:00:02 +01:00