Commit Graph

18762 Commits

Author SHA1 Message Date
Richard Henderson
eb52c6d769 page-vary: Build finalize_target_page_bits as common code
Use target_info->page_bits_init to merge
finalize_target_page_bits_common into
finalize_target_page_bits in page-vary-common.c.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-ID: <20260217095106.598486-6-richard.henderson@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2026-02-26 00:12:07 +01:00
Richard Henderson
79674d07d4 page-vary: Build set_preferred_target_page_bits as common code
Use target_info->page_bits_vary to merge
set_preferred_target_page_bits_common into
set_preferred_target_page_bits in page-vary-common.c.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20260217095106.598486-5-richard.henderson@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2026-02-26 00:11:30 +01:00
Richard Henderson
afb94ae333 target-info: Add page_bits_{init,vary}
Add two fields that will hold TARGET_PAGE_BITS,
TARGET_PAGE_BITS_VARY, TARGET_PAGE_BITS_LEGACY.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20260217095106.598486-3-richard.henderson@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2026-02-26 00:11:21 +01:00
Philippe Mathieu-Daudé
40a5b6745e page-vary: Expose TARGET_PAGE_BITS_MIN definition
We'll use TARGET_PAGE_BITS_MIN in page-vary-common.c,
so expose it via "exec/page-vary.h".

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260213182713.44924-3-philmd@linaro.org>
2026-02-26 00:11:14 +01:00
Philippe Mathieu-Daudé
747b494f12 system: Reduce 'arch_init.h' scope
Better to restrict qemu_arch_available() scope so it is only
used by generic system/ code to parse command line options.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-Id: <20260213175032.32121-6-philmd@linaro.org>
2026-02-26 00:02:14 +01:00
Philippe Mathieu-Daudé
1bfbe1fc5a system: Make qemu_arch_available() common code
Remove the need of per-target QEMU_ARCH. Define the
QEMU_ARCH_* constants based on SYS_EMU_TARGET_* ones,
themselves already exposed via target_arch(), allowing
to check the current target is included in @arch_bitmask.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-Id: <20260213175032.32121-5-philmd@linaro.org>
2026-02-26 00:02:14 +01:00
Philippe Mathieu-Daudé
2dc8c9cf72 qemu/target_info: Add target_s390x() helper
Add a helper to distinct whether the binary is targetting
S390x or not.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-Id: <20260213175032.32121-3-philmd@linaro.org>
2026-02-26 00:02:14 +01:00
Philippe Mathieu-Daudé
4b75d19e36 qemu: Document qemu_arch_available() method
qemu_arch_available() is used to check if a broadly available
feature should be exposed to a particular set of target
architectures.

Since its argument is a mask of bits, rename it as @arch_bitmask.

We have less than 32 target architectures so far, so restrict it
to the uint32_t type.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-Id: <20260213175032.32121-2-philmd@linaro.org>
2026-02-26 00:02:14 +01:00
Philippe Mathieu-Daudé
4ebb5ba551 gdbstub/helpers: Convert gdb_get_regl() macro to inlined helper
Rather than checking TARGET_LONG_BITS at build time,
check target_long_bits() at runtime.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20260219191955.83815-38-philmd@linaro.org>
2026-02-26 00:02:14 +01:00
Philippe Mathieu-Daudé
cebda82488 gdbstub: Remove ldtul*() macros
These macros aren't used anymore, remove them to avoid
further uses creeping back in.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20260219191955.83815-32-philmd@linaro.org>
2026-02-26 00:02:14 +01:00
Philippe Mathieu-Daudé
7ddd3aca5f gdbstub: Always infer gdb_num_core_regs when using XML file
Rather correct inferred count over invalid manual one.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20260219191955.83815-10-philmd@linaro.org>
2026-02-25 23:46:04 +01:00
Anton Johansson
cf884c075e exec: Drop TARGET_PHYS_ADDR_SPACE_BITS
The macro is no longer in use and can safely be dropped.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Brian Cain <brian.cain@oss.qualcomm.com>
Signed-off-by: Anton Johansson <anjo@rev.ng>
Message-ID: <20260218-phys_addr-v6-7-a603bf363218@rev.ng>
[PMD: Keep TARGET_PHYS_ADDR_SPACE_BITS poisoned]
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2026-02-25 23:46:04 +01:00
Anton Johansson
16d73d390c hw/loongarch: Use loongarch_palen_mask()
Replaces remaining uses of TARGET_PHYS_ADDR_SPACE_BITS with
runtime calls to loongarch_palen_mask() to fetch the physical
address mask from the cpucfg PALEN field.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Anton Johansson <anjo@rev.ng>
Message-ID: <20260218-phys_addr-v6-5-a603bf363218@rev.ng>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2026-02-25 23:46:04 +01:00
Max Chou
b5fee33bbf fpu: Add conversion routines for OCP FP4 E2M1
Reviewed-by: Chao Liu <chao.liu.zevorn@gmail.com>
Signed-off-by: Max Chou <max.chou@sifive.com>
[rth: Update for exp_max_kind]
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2026-02-24 16:21:18 +11:00
Max Chou
27e989f99c fpu: Add conversion routines for OCP FP8 E4M3
Reviewed-by: Chao Liu <chao.liu.zevorn@gmail.com>
Signed-off-by: Max Chou <max.chou@sifive.com>
[rth: Split out of a larger patch; adjust overflow detection.]
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2026-02-24 16:21:15 +11:00
Max Chou
d8be495376 fpu: Add conversion routines for OCP FP8 E5M2
Reviewed-by: Chao Liu <chao.liu.zevorn@gmail.com>
Signed-off-by: Max Chou <max.chou@sifive.com>
[rth: Split out of a larger patch]
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2026-02-24 16:21:06 +11:00
Max Chou
dddee8e1ba fpu/softfloat: Refactor floatx80 format NaN classification to share code
The floatx80_is_[quiet|signaling]_nan functions contain duplicated
logic that should be shared.
This commit introduces floatx80_nan_is_snan helper function that
determine if a NaN is signaling and change the return type of
floatx80_is_[signaling|quiet]_nan to bool.

Suggested-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Max Chou <max.chou@sifive.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Chao Liu <chao.liu.zevorn@gmail.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260204051756.667397-4-max.chou@sifive.com>
2026-02-24 16:19:57 +11:00
Marc-André Lureau
e31b29f446 audio: rework DEBUG_POLL
Use more correct GTimer, specific for each backend, with a trace event.

Reviewed-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
2026-02-23 14:38:22 +01:00
Marc-André Lureau
eebba32fe5 audio: replace int endianness with bool big_endian in audsettings
The endianness field used an int to represent a boolean concept, with
0 meaning little-endian and 1 meaning big-endian. This required runtime
validation to reject invalid values and made the code less readable.

Replace with a bool big_endian field that is self-documenting and
type-safe. The compiler now enforces valid values, eliminating the
need for the validation check in audio_validate_settings().

Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
2026-02-23 14:38:22 +01:00
Marc-André Lureau
42061a1435 audio/mixeng: replace redundant pcm_info fields with AudioFormat
The audio_pcm_info structure stored three fields (bits, is_signed,
is_float) that were always derived from the AudioFormat enum. This
redundancy meant the same information was represented twice, with no
type-level guarantee that they stayed in sync.

Replace these fields with a single AudioFormat field, and add helper
functions to extract the derived properties when needed:
- audio_format_bits()
- audio_format_is_signed()
- audio_format_is_float()

This improves type safety by making AudioFormat the single source of
truth, eliminating the possibility of inconsistent state between the
format enum and its derived boolean/integer representations.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Reviewed-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
2026-02-23 14:38:22 +01:00
Marc-André Lureau
740578d483 audio: constify some add_capture() arguments
Reviewed-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
2026-02-23 14:38:22 +01:00
Marc-André Lureau
2842da1dc0 audio: split AudioMixengBackend code in audio-mixeng-be.c
Allow to build the audio/ base classes without the
resampling/mixing/queuing code.

Reviewed-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
2026-02-23 14:38:22 +01:00
Marc-André Lureau
c70d79776b audio: AUD_ -> audio_be_
Use the associate AudioBackend prefix for readability.

Reviewed-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
2026-02-23 14:38:20 +01:00
Marc-André Lureau
25153b29f8 audio: split AudioBackend
Code clean-up, to allow building bare abstract class separately.

The original file is MIT-licensed.

Reviewed-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
2026-02-23 14:33:15 +01:00
Marc-André Lureau
909f04f417 audio: make AudioBackend truly abstract
Add virtual methods to be implemented by concrete classes, like
AudioMixengBackendClass.

Reviewed-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
2026-02-23 14:33:15 +01:00
Marc-André Lureau
61e95a0c60 audio: make all the backend-specific APIs take the be
This will allow to dispatch to different implementations next.

Reviewed-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
2026-02-23 14:33:09 +01:00
Marc-André Lureau
5ca6c931a7 replay: remove dependency on audio/
The replay infrastructure shouldn't depend on internals of audio/.
(st_sample is an internal implementation detail and could be different)

Let audio drive the audio samples recording/replaying.

Notice also we don't need to save & restore the internal ring "wpos",
all replay should care about is the number of samples and the samples.

Bump the replay version.

Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
2026-02-23 14:28:57 +01:00
Marc-André Lureau
d8f9785fcc module: remove audio module support
It relies on dynamic object loading support instead.

Reviewed-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
2026-02-23 14:28:57 +01:00
Marc-André Lureau
b47ed8a5c9 audio: lookup "audio-" object types, and realize them
Now "audio_driver" is a detail implementation of AudioMixengBackend and
not required to implement an AudioBackend.

Reviewed-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
2026-02-23 14:28:57 +01:00
Marc-André Lureau
1618bea984 audio: introduce AudioMixengBackend
Introduce a sub-class for current "audio_driver" based implementations.
Future AudioBackend implementations can do without it.

Next cleanup will actually remove "audio_driver" struct altogether and
make the subclass proper QOM objects.

Public APIs still rely on backend being an AudioMixeng. They will
assert() if not. This will be addressed later to allow other backends.

Note that the initial naming proposed for this object was AudioDriver,
however the semantics for "driver" is already overloaded and leads to
confusion, in particular with the QAPI AudiodevDriver. The defining
characteristic is of using QEMU's software mixing engine, so
AudioMixengBackend.

Reviewed-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
2026-02-23 14:28:57 +01:00
Marc-André Lureau
1f11eb930e audio: constify audsettings argument
It shouldn't be modified by the audio functions.

Reviewed-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
2026-02-23 14:28:57 +01:00
Marc-André Lureau
52ef022ae8 audio: remove obsolete/obscure functions
AUD_init_time_stamp_{in,out} and AUD_get_elapsed_usec_{in,out} are only
used by the adlib device. The result isn't actually being used since
ADLIB_KILL_TIMERS was set some 20y ago. Let's drop this dead code now.

Drop QEMUAudioTimeStamp as well as reported by Akihiko Odaki.

Reviewed-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
2026-02-23 14:28:56 +01:00
Peter Maydell
a6ec632dca Merge tag 'hw-misc-20260223' of https://github.com/philmd/qemu into staging
Misc HW & Net patches

- Fix trace event name in m68k system controller
- Constify and rename virtio_is_big_endian()
- Fix heap buffer overflow in virtio-serial-bus
- Set graphic display dimensions generically (removing system/globals-target.c)
- Mark eth_header, udp_header, tcp_header as packed structures
- Minor doc / header cleanups

# -----BEGIN PGP SIGNATURE-----
#
# iQIzBAABCAAdFiEE+qvnXhKRciHc/Wuy4+MsLN6twN4FAmmbj2wACgkQ4+MsLN6t
# wN7LqBAAq30ShByylpAJ7DvekgGOHCXeHSdVPZKB8eDC5aVULQfPKp8Ij0v7WpwD
# RzZZWL35nSAqLiMLxxpP/VSY1T+PopoaHtKuZfVc5J/J/mr6lvpbsMlo6jRe/lvT
# r2m5MYGyUnAPsm/t44nG7E53xIqvT5eFMMjMQSYQXgi1RztNGepE5acrOHk2RrWc
# X0NqORf6SeAvo6FX8lIQTQq9/4ePH9f3+DXiM48OaKNVDshARd8C7l3Q2aAC0UWi
# sP0oL7Re0mmCJ4820/tTqsKs9D+4U3Hu5lW0FPdXU6uLoNr70T2g29pRLE4o5mP5
# UV91+x6FdUm7o0oDJ6fxqa0Acdc14QObNeNKkFPIJetvWCOyLdk6tJA6sb6XfPnd
# t2JNvBDJonoUrSSaSp6ZiPP3pOzHyoa/NJUJ7HbRrTPzGHPf3ffwKtG53NkSqP4i
# Py1kFVJW3Ykyq1SUlQ/7UD/N5SPg1RLv8lTqdYXuY6cig7D1XDOPapUtvhKjb+H0
# GIouskPOF/nfB8vBiPDnM+LAC3RwFUi03U3IEEUfRPPvjSflwsNho7j6g+tU7IXk
# DfCwgfyMxvbTJAcalH0EufIDEsCrQ3HvH0oMnidP5Jz4VXCEocb/0zOrBTxbScKH
# Gk4UDN2eqqsbecnAeF7kOE9VOfSSZDrA7ZdvWGD6ofPL0b9wytk=
# =VJig
# -----END PGP SIGNATURE-----
# gpg: Signature made Sun Feb 22 23:21:16 2026 GMT
# gpg:                using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE
# gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <f4bug@amsat.org>" [full]
# Primary key fingerprint: FAAB E75E 1291 7221 DCFD  6BB2 E3E3 2C2C DEAD C0DE

* tag 'hw-misc-20260223' of https://github.com/philmd/qemu: (21 commits)
  net: mark struct tcp_header as QEMU_PACKED
  net: mark struct udp_header as QEMU_PACKED
  net: mark struct eth_header as QEMU_PACKED
  hw/net/rocker: Don't assume h_proto is aligned in eth_strip_vlan_ex()
  hw/net/rocker: Don't keep pointer to h_proto as uint16_t* in OfDpaFlowPktFields
  hw/net/rtl8139: Remove ineffective parameter
  hw/core/cpu: expand cpu_reset function docs
  hw/alpha: remove unused includes
  hw/ppc/spapr: extract SPAPR_MAX_RAM_SLOTS in a new header
  system/globals: Build as common code
  hw/ppc: Set graphic display dimensions generically
  hw/sparc: Set graphic display dimensions generically
  hw/m68k: Set graphic display dimensions generically
  hw/m68k/q800: Set MACFB_DISPLAY_APPLE_21_COLOR within MacFrameBuffer
  hw/m68k/q800: Use MacFbMode fields in q800_machine_init()
  hw/display/macfb: Constify macfb_mode_table[] array
  hw/display/macfb: Constify macfb_sense_table[] array
  hw/char/virtio-serial-bus: Fix Heap-buffer-overflow in set_config()
  hw/virtio: rename virtio_is_big_endian to virtio_vdev_is_big_endian
  hw/virtio: Constify virtio_is_big_endian() argument
  ...

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2026-02-23 09:56:00 +00:00
Peter Maydell
7de8587b53 net: mark struct tcp_header as QEMU_PACKED
The eth_header is not actually guaranteed to be aligned.  We attempt
to deal with this in some places such as net_checksum_calculate() by
using lduw_be_p() and so on to access the fields, but this is not
sufficient to be correct, because even accessing a byte member within
a misaligned struct is undefined behaviour.  The clang sanitizer will
emit an error like this if you run the sifive_u_mmc functional test
with sanitizers enabled:

../../net/checksum.c:144:24: runtime error: member access within misaligned address 0x619a74c32033 for type 'tcp_header' (aka 'struct tcp_header'), which requires 4 byte alignment
0x619a74c32033: note: pointer points here
 0a  00 02 02 86 aa 00 16 52  c1 d3 70 00 00 00 00 a0  02 fa f0 00 00 00 00 02  04 05 b4 04 02 08 0a
              ^
    #0 0x619a6ba84794 in net_checksum_calculate /home/pm215/qemu/build/clang/../../net/checksum.c:144:24
    #1 0x619a6b5940da in gem_transmit /home/pm215/qemu/build/clang/../../hw/net/cadence_gem.c:1386:21
    #2 0x619a6b592141 in gem_write /home/pm215/qemu/build/clang/../../hw/net/cadence_gem.c:1650:13

Fix this by marking the tcp_header struct as QEMU_PACKED.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Message-ID: <20260212140917.1443253-6-peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2026-02-23 00:17:35 +01:00
Peter Maydell
2ca81b0eb3 net: mark struct udp_header as QEMU_PACKED
The eth_header is not actually guaranteed to be aligned.  We attempt
to deal with this in some places such as net_checksum_calculate() by
using lduw_be_p() and so on to access the fields, but this is not
sufficient to be correct, because even accessing a byte member within
a misaligned struct is undefined behaviour.  The clang sanitizer will
emit an error like this if you run the sifive_u_mmc functional test
with sanitizers enabled:

../../net/checksum.c:168:24: runtime error: member access within misaligned address 0x5b7a7f829033 for type 'udp_header' (aka 'struct udp_header'), which requires 2 byte alignment
0x5b7a7f829033: note: pointer points here
 ff  ff ff ff 00 44 00 43 01  34 58 54 01 01 06 00 85  95 80 60 00 00 00 00 00  00 00 00 00 00 00 00
              ^
    #0 0x5b7a71a5887e in net_checksum_calculate /home/pm215/qemu/build/clang/../../net/checksum.c:168:24
    #1 0x5b7a7156819a in gem_transmit /home/pm215/qemu/build/clang/../../hw/net/cadence_gem.c:1386:21
    #2 0x5b7a71566201 in gem_write /home/pm215/qemu/build/clang/../../hw/net/cadence_gem.c:1650:13

Fix this by marking the udp_header struct as QEMU_PACKED,
so that the compiler knows it might be unaligned and will
generate the right code for accessing fields.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Message-ID: <20260212140917.1443253-5-peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2026-02-23 00:17:35 +01:00
Peter Maydell
42ada5daf9 net: mark struct eth_header as QEMU_PACKED
The eth_header is not actually guaranteed to be aligned.  We attempt
to deal with this in some places such as net_checksum_calculate() by
using lduw_be_p() and so on to access the fields, but this is not
sufficient to be correct, because even accessing a byte member within
a misaligned struct is undefined behaviour.  The clang sanitizer will
emit an error like this if you run the sifive_u_mmc functional test
with sanitizers enabled:

../../net/checksum.c:78:47: runtime error: member access within misaligned address 0x561f52f35011 for type 'struct eth_header', which requires 2 byte alignment
0x561f52f35011: note: pointer points here
 00 00 00  00 33 33 00 00 00 16 52  54 00 12 34 56 86 dd 60  00 00 00 00 24 00 01 00  00 00 00 00 00
              ^
    #0 0x561f20608459 in net_checksum_calculate /home/pm215/qemu/build/clang/../../net/checksum.c:78:47
    #1 0x561f20117bfa in gem_transmit /home/pm215/qemu/build/clang/../../hw/net/cadence_gem.c:1386:21
    #2 0x561f20115c61 in gem_write /home/pm215/qemu/build/clang/../../hw/net/cadence_gem.c:1650:13

SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior ../../net/checksum.c:78:47

Fix this by marking the eth_header struct as QEMU_PACKED, so that the
compiler knows it might be unaligned and will generate the right code
for accessing fields.

This is similar to commit f8b94b4c52 ("net: mark struct ip_header as
QEMU_PACKED") where we fixed this for a different struct defined in
this file.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Message-ID: <20260212140917.1443253-4-peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2026-02-23 00:17:35 +01:00
Alex Bennée
703bc80f55 hw/core/cpu: expand cpu_reset function docs
Add a hint to the developer that this should only be called from a
reset chain.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-ID: <20260219171810.602667-15-alex.bennee@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2026-02-23 00:17:34 +01:00
Pierrick Bouvier
fe25b9213c hw/ppc/spapr: extract SPAPR_MAX_RAM_SLOTS in a new header
Allow to include it from common code (vhost-user, in next commit),
else it pulls ppc/cpu.h which has target specifics.

Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20260131020100.1115203-4-pierrick.bouvier@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2026-02-23 00:17:34 +01:00
Philippe Mathieu-Daudé
ee56761607 hw/display/macfb: Constify macfb_mode_table[] array
macfb_mode_table[] is only read, never updated, so can be const.

Update the call sites accordingly.
Make the MacfbState::mode pointer to const.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20260216213121.47122-3-philmd@linaro.org>
2026-02-23 00:17:34 +01:00
Pierrick Bouvier
6325407f67 hw/virtio: rename virtio_is_big_endian to virtio_vdev_is_big_endian
Renaming this function removes the confusion with
existing virtio_is_big_endian cpu ops.

Indeed, virtio_vdev_is_big_endian is *not* calling cpu
virtio_is_big_endian everytime.

Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20260212234602.338131-3-pierrick.bouvier@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2026-02-22 22:52:29 +01:00
Philippe Mathieu-Daudé
2622a178b6 hw/virtio: Constify virtio_is_big_endian() argument
VirtIODevice argument is accessed read-only, make it const.

Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20260206221908.1451528-2-pierrick.bouvier@linaro.org>
2026-02-22 22:52:29 +01:00
Arpit Kumar
6e1410fdcf hw/cxl: Add Physical Port Control FMAPI Command (Opcode 5102h)
Added assert-deassert PERST implementation for physical ports (both USP
and DSP's).

Assert PERST involves bg operation for holding 100ms.
Reset PPB implementation for physical ports.

Signed-off-by: Arpit Kumar <arpit1.kumar@samsung.com>
Co-developed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20260204173223.44122-4-Jonathan.Cameron@huawei.com>
2026-02-20 13:04:45 -05:00
Arpit Kumar
7df839591c hw/cxl: Physical Port Info FMAPI - update to current spec and add defines.
Add a new cxl/cxl_ports.h header for field definitions related only to port
commands. Bring field naming up to date with spec as 'version' bitmasks
have been replaced with bitmasks of the specific features.

Fix a small issue where a reserved value for USP was set to 2 rather
than 0.

Signed-off-by: Arpit Kumar <arpit1.kumar@samsung.com>
Co-developed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Signed-off-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20260204173223.44122-2-Jonathan.Cameron@huawei.com>
2026-02-20 13:04:45 -05:00
Davidlohr Bueso
88ac457c88 hw/cxl: Support type3 HDM-DB
Add basic plumbing for memory expander devices that support Back
Invalidation. This introduces a 'hdm-db=on|off' parameter and
exposes the relevant BI RT/Decoder component cachemem registers.

Some noteworthy properties:
 - Devices require enabling Flit mode across the CXL topology.
 - Explicit BI-ID commit is required.
 - HDM decoder support both host and dev coherency models.

Tested-by: Dongjoo Seo <dongjoo.seo1@samsung.com>
Signed-off-by: Davidlohr Bueso <dave@stgolabs.net>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20260204170936.43959-7-Jonathan.Cameron@huawei.com>
2026-02-20 13:04:45 -05:00
Ira Weiny
5729c01a60 hw/cxl: Refactor component register initialization
CXL 3.2 8.2.4 Table 8-22 defines which capabilities are mandatory, not
permitted, or optional for each type of device.

cxl_component_register_init_common() uses a rather odd 'fall through'
mechanism to define each component register set.  This assumes that any
device or capability being added builds on the previous devices
capabilities.  This is not true as there are mutually exclusive
capabilities defined.  For example, downstream ports can not have snoop
but it can have Back Invalidate capable decoders.

Refactor this code to make it easier to add individual capabilities as
defined by a device type.  Any capability which is not specified by the
type is left NULL'ed out which complies with the packed nature of the
register array.

Update all spec references to 3.2.

No functional changes should be seen with this patch.

Signed-off-by: Ira Weiny <ira.weiny@intel.com>
Tested-by: Dongjoo Seo <dongjoo.seo1@samsung.com>
[rebased, no RAS for HBs, r3.2 references]
Signed-off-by: Davidlohr Bueso <dave@stgolabs.net>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20260204170936.43959-3-Jonathan.Cameron@huawei.com>
2026-02-20 13:04:45 -05:00
Davidlohr Bueso
d29f3f5cdd hw/pcie: Support enabling flit mode
PCIe Flit Mode, introduced with the PCIe 6.0 specification, is a
fundamental change in how data is transmitted over the bus to
improve transfer rates. It shifts from variable-sized Transaction
Layer Packets (TLPs) to fixed 256-byte Flow Control Units (FLITs).

As with the link speed and width training, have ad-hoc property for
setting the flit mode and allow CXL components to make use of it.

For the CXL root port and dsp cases, always report flit mode but
the actual value after 'training' will depend on the downstream
device configuration.

Suggested-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Tested-by: Dongjoo Seo <dongjoo.seo1@samsung.com>
Signed-off-by: Davidlohr Bueso <dave@stgolabs.net>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20260204170936.43959-2-Jonathan.Cameron@huawei.com>
2026-02-20 13:04:45 -05:00
Shiju Jose
da5cafdc4d hw/cxl: Add emulation for memory sparing control feature
Memory sparing is defined as a repair function that replaces a portion of
memory with a portion of functional memory at that same DPA. The
subclasses for this operation vary in terms of the scope of the sparing
being performed. The Cacheline sparing subclass refers to a sparing
action that can replace a full cacheline. Row sparing is provided as an
alternative to PPR sparing functions and its scope is that of a single
DDR row. Bank sparing allows an entire bank to be replaced. Rank sparing
is defined as an operation in which an entire DDR rank is replaced.

Memory sparing maintenance operations may be supported by CXL devices
that implement CXL.mem protocol. A sparing maintenance operation requests
the CXL device to perform a repair operation on its media.
For example, a CXL device with DRAM components that support memory sparing
features may implement sparing Maintenance operations.

The host may issue a query command by setting Query Resources flag in the
Input Payload (CXL Spec 3.2 Table 8-120) to determine availability of
sparing resources for a given address. In response to a query request,
the device shall report the resource availability by producing the Memory
Sparing Event Record (CXL Spec 3.2 Table 8-60) in which the Channel, Rank,
Nibble Mask, Bank Group, Bank, Row, Column, Sub-Channel fields are a copy
of the values specified in the request.

During the execution of a sparing maintenance operation, a CXL memory
device:
- May or may not retain data
- May or may not be able to process CXL.mem requests correctly.
These CXL memory device capabilities are specified by restriction flags
in the memory sparing feature readable attributes.

When a CXL device identifies error on a memory component, the device
may inform the host about the need for a memory sparing maintenance
operation by using DRAM event record, where the 'maintenance needed' flag
may set. The event record contains some of the DPA, Channel, Rank,
Nibble Mask, Bank Group, Bank, Row, Column, Sub-Channel fields that
should be repaired. The userspace tool requests for maintenance operation
if the 'maintenance needed' flag set in the CXL DRAM error record.

CXL spec 3.2 section 8.2.10.7.2.3 describes the memory sparing feature
discovery and configuration.

CXL spec 3.2 section 8.2.10.7.1.4 describes the device's memory sparing
maintenance operation feature.

Add emulation for CXL memory device memory sparing control feature
and memory sparing maintenance operation command.

Signed-off-by: Shiju Jose <shiju.jose@huawei.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20250917143330.294698-4-Jonathan.Cameron@huawei.com>
2026-02-20 13:04:45 -05:00
Davidlohr Bueso
5e5a86bab8 hw/cxl: Add support for Maintenance command and Post Package Repair (PPR)
This adds initial support for the Maintenance command, specifically
the soft and hard PPR operations on a dpa. The implementation allows
to be executed at runtime, therefore semantically, data is retained
and CXL.mem requests are correctly processed.

Keep track of the requests upon a general media or DRAM event.

Post Package Repair (PPR) maintenance operations may be supported by CXL
devices that implement CXL.mem protocol. A PPR maintenance operation
requests the CXL device to perform a repair operation on its media.
For example, a CXL device with DRAM components that support PPR features
may implement PPR Maintenance operations. DRAM components may support two
types of PPR, hard PPR (hPPR), for a permanent row repair, and Soft PPR
(sPPR), for a temporary row repair. Soft PPR is much faster than hPPR,
but the repair is lost with a power cycle.

CXL spec 3.2 section 8.2.10.7.1.2 describes the device's sPPR (soft PPR)
maintenance operation and section 8.2.10.7.1.3 describes the device's
hPPR (hard PPR) maintenance operation feature.

CXL spec 3.2 section 8.2.10.7.2.1 describes the sPPR feature discovery and
configuration.

CXL spec 3.2 section 8.2.10.7.2.2 describes the hPPR feature discovery and
configuration.

CXL spec 3.2 section 8.2.10.2.1.4 Table 8-60 describes the Memory Sparing
Event Record.

Signed-off-by: Davidlohr Bueso <dave@stgolabs.net>
Co-developed-by: Shiju Jose <shiju.jose@huawei.com>
Signed-off-by: Shiju Jose <shiju.jose@huawei.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20250917143330.294698-3-Jonathan.Cameron@huawei.com>
2026-02-20 13:04:45 -05:00
Shiju Jose
1fc57dd250 hw/cxl/events: Updates for rev3.2 memory module event record
CXL spec rev3.2 section 8.2.10.2.1.3 Table 8-59, memory module
event record has updated with following new fields.
1. Validity Flags
2. Component Identifier
3. Device Event Sub-Type

Add updates for the above spec changes in the CXL memory module
event reporting and QMP command to inject memory module event.

Updated all references for this command to the CXL r3.2
specification.

Signed-off-by: Shiju Jose <shiju.jose@huawei.com>
Acked-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20260205112350.60681-6-Jonathan.Cameron@huawei.com>
2026-02-20 13:04:45 -05:00
Shiju Jose
94976b8631 hw/cxl/events: Updates for rev3.2 DRAM event record
CXL spec rev3.2 section 8.2.10.2.1.2 Table 8-58, DRAM event record
has updated with following new fields.
1. Component Identifier
2. Sub-channel of the memory event location
3. Advanced Programmable Corrected Memory Error Threshold Event Flags
4. Corrected Volatile Memory Error Count at Event
5. Memory Event Sub-Type

Add updates for the above spec changes in the CXL DRAM event
reporting and QMP command to inject DRAM event.

In order to ensure consistency update all specification references
for this command to CXL r3.2.

Signed-off-by: Shiju Jose <shiju.jose@huawei.com>
Acked-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20260205112350.60681-5-Jonathan.Cameron@huawei.com>
2026-02-20 13:04:45 -05:00