Commit Graph

18645 Commits

Author SHA1 Message Date
Peter Maydell
cd5a79dc98 Merge tag 'for_upstream' of https://git.kernel.org/pub/scm/virt/kvm/mst/qemu into staging
virtio,pci,pc: features, fixes

intel_iommu:
    SVM support
vhost:
    support for indirect descriptors in shadow virtqueue
vhost-user:
    vhost-user-spi support
    vhost-user-blk inflight migration support
    vhost-user-blk inflight migration support

misc fixes in pci, vhost, virtio, acpi, cxl
cleanups in acpi/ghes

Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

# -----BEGIN PGP SIGNATURE-----
#
# iQFDBAABCgAtFiEEXQn9CHHI+FuUyooNKB8NuNKNVGkFAmmEa9APHG1zdEByZWRo
# YXQuY29tAAoJECgfDbjSjVRpqj8H/iBqAHZSTmAdBJgoLnmgoTLB01J9aUTrQU2H
# BHKyrd+G3m54pwjgUNN5ieZARtlXscigf6fr0Gq2wrc8/kV/O5G5jViw9+1Bo8nW
# OkLDW45nDzZGhap4oUedV+PJ3fCuW2fC8Jyb1n8OGlkadbhq0NU6GtqiEx6/7QIh
# hk5WUDE/3LH4cTp8qNtr0/nYfM4FZk2sjq7aRyg4cz/uC7rIAFRq7BCZ/dfRqMh/
# T+rLnizSSAg9PFMd8slWqoxOGF9NzT9LIoDSkAlso1L9lUekUSNoUblhlWDrRlLn
# DEEqqGCVounfBzA95WrTRmvWs6JodppjjAjI0M4isrMKGXXg8dg=
# =HdgY
# -----END PGP SIGNATURE-----
# gpg: Signature made Thu Feb  5 10:07:12 2026 GMT
# gpg:                using RSA key 5D09FD0871C8F85B94CA8A0D281F0DB8D28D5469
# gpg:                issuer "mst@redhat.com"
# gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>" [full]
# gpg:                 aka "Michael S. Tsirkin <mst@redhat.com>" [full]
# Primary key fingerprint: 0270 606B 6F3C DF3D 0B17  0970 C350 3912 AFBE 8E67
#      Subkey fingerprint: 5D09 FD08 71C8 F85B 94CA  8A0D 281F 0DB8 D28D 5469

* tag 'for_upstream' of https://git.kernel.org/pub/scm/virt/kvm/mst/qemu: (38 commits)
  hw/cxl: Take into account how many media operations are requested for param check
  hw/cxl: Check for overflow on santize media as both base and offset 64bit.
  vhost-user-blk: support inter-host inflight migration
  vhost: add vmstate for inflight region with inner buffer
  vmstate: introduce VMSTATE_VBUFFER_UINT64
  vhost-user: introduce protocol feature for skip drain on GET_VRING_BASE
  vhost-user.rst: specify vhost-user back-end action on GET_VRING_BASE
  virtio-gpu: use consistent error checking for virtio_gpu_create_mapping_iov
  virtio-gpu: fix error handling in virgl_cmd_resource_create_blob
  virtio-pmem: ignore empty queue notifications
  virtio-gpu-virgl: correct parent for blob memory region
  MAINTAINERS: Update VIOT maintainer
  cryptodev-builtin: Limit the maximum size
  hw/virtio/virtio-crypto: verify asym request size
  virtio-spi: Add vhost-user-spi device support
  standard-headers: Update virtio_spi.h from Linux v6.18-rc3
  q35: Fix migration of SMRAM state
  pcie_sriov: Fix PCI_SRIOV_* accesses in pcie_sriov_pf_exit()
  virtio: Fix crash when sriov-pf is set for non-PCI-Express device
  virtio-dmabuf: Ensure UUID persistence for hash table insertion
  ...

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2026-02-05 13:54:50 +00:00
Alexandr Moshkov
3dfd711ea9 vhost-user-blk: support inter-host inflight migration
During inter-host migration, waiting for disk requests to be drained
in the vhost-user backend can incur significant downtime.

This can be avoided if QEMU migrates the inflight region in
vhost-user-blk.
Thus, during the qemu migration, with feature flag the vhost-user
back-end can immediately stop vrings, so all in-flight requests will be
migrated to another host.

Signed-off-by: Alexandr Moshkov <dtalexundeer@yandex-team.ru>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Raphael Norwitz <raphael.s.norwitz@gmail.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20260115081103.655749-6-dtalexundeer@yandex-team.ru>
2026-02-05 05:06:46 -05:00
Alexandr Moshkov
f6fdd8b2bd vmstate: introduce VMSTATE_VBUFFER_UINT64
This is an analog of VMSTATE_VBUFFER_UINT32 macro, but for uint64 type.

Signed-off-by: Alexandr Moshkov <dtalexundeer@yandex-team.ru>
Acked-by: Peter Xu <peterx@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20260115081103.655749-4-dtalexundeer@yandex-team.ru>
2026-02-05 05:06:46 -05:00
Alexandr Moshkov
e0822e6085 vhost-user: introduce protocol feature for skip drain on GET_VRING_BASE
Add vhost-user protocol feature
VHOST_USER_PROTOCOL_F_GET_VRING_BASE_INFLIGHT

Now on GET_VRING_BASE this feature can control whether to wait for
in-flight requests to complete or not.
Also we have to validate that this feature will be enabled only when
qemu and back-end supports in-flight buffer and in-flight migration

It will be helpfull in future for in-flight requests migration in
vhost-user devices.

Update docs, add ref to label for inflight-io-tracking

Signed-off-by: Alexandr Moshkov <dtalexundeer@yandex-team.ru>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20260115081103.655749-3-dtalexundeer@yandex-team.ru>
2026-02-05 05:06:46 -05:00
Haixu Cui
6ab7b84fc2 virtio-spi: Add vhost-user-spi device support
This patch introduces support for vhost-user-spi and vhost-user-spi-pci
devices in QEMU, enabling virtio-based SPI communication via the vhost-user
protocol.

The implementation follows the virtio-spi specification and leverages
the upstream virtio-spi driver in Linux. Relevant references:

- Virtio SPI specification:
  https://github.com/oasis-tcs/virtio-spec/tree/master/device-types/spi
- Linux virtio-spi driver:
  https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/drivers/spi/spi-virtio.c?h=v6.18-rc3
- vhost-user-spi daemon:
  https://github.com/rust-vmm/vhost-device/tree/main/vhost-device-spi

Example usage with rust-vmm vhost-user-spi daemon:

Start the vhost-user-spi daemon:
    vhost-device-spi --socket-path=vspi.sock --socket-count=1 \
        --device "/dev/spidev0.0"

Launch QEMU with:
    qemu-system-aarch64 -m 1G \
        -chardev socket,path=/home/root/vspi.sock0,id=vspi \
        -device vhost-user-spi-device,chardev=vspi,id=spi \
        -object memory-backend-file,id=mem,size=1G,mem-path=/dev/shm,share=on \
        -numa node,memdev=mem

Signed-off-by: Haixu Cui <quic_haixcui@quicinc.com>
Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20251216032122.1316684-3-quic_haixcui@quicinc.com>
2026-02-05 05:06:46 -05:00
Haixu Cui
f4cc404c82 standard-headers: Update virtio_spi.h from Linux v6.18-rc3
Synced virtio_spi.h from upstream Linux kernelusing
scripts/update-linux-headers.sh.

Source:
- Linux commit dcb6fa37fd7bc9c3d2b066329b0d27dedf8becaa (v6.18-rc3)
- Author: Linus Torvalds <torvalds@linux-foundation.org>
- Date:   Sun Oct 26 15:59:49 2025 -0700

This update ensures QEMU's standard headers are consistent with the latest
virtio SPI definitions from Linux v6.18-rc3.

Signed-off-by: Haixu Cui <quic_haixcui@quicinc.com>
Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20251216032122.1316684-2-quic_haixcui@quicinc.com>
2026-02-05 05:06:46 -05:00
Gavin Shan
0771574c2f acpi/ghes: Use error_fatal in acpi_ghes_memory_errors()
Use error_fatal in acpi_ghes_memory_errors() so that the caller needn't
explicitly call exit(). The return value of acpi_ghes_memory_errors()
and ghes_record_cper_errors() is changed to 'bool' indicating an error
has been raised, to be compatible with what's documented in error.h.

Suggested-by: Igor Mammedov <imammedo@redhat.com>
Suggested-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Gavin Shan <gshan@redhat.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20251201141803.2386129-6-gshan@redhat.com>
2026-02-05 05:06:45 -05:00
Wafer Xie
fd3a2c601a vdpa: fix vhost-vdpa suspended state not be shared
When stopping a vhost-vdpa device, only the first queue pair is marked as suspended,
while the remaining queues are not updated to the suspended state.
As a result, when stopping a multi-queue vhost-vdpa device,
the following error message will be printed.

qemu-system-x86_64:vhost VQ 2 ring restore failed: -1: Operation not permitted (1)

qemu-system-x86_64:vhost VQ 3 ring restore failed: -1: Operation not permitted (1)

So move v->suspended to v->shared, and then all the vhost_vdpa devices cannot
have different suspended states.

Fixes: 0bb302a996 ("vdpa: add vhost_vdpa_suspend")
Suggested-by: Eugenio Pérez <eperezma@redhat.com>
Acked-by: Eugenio Pérez <eperezma@redhat.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Wafer Xie <wafer@jaguarmicro.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Message-Id: <20251119132452.3117-1-wafer@jaguarmicro.com>
2026-02-05 05:06:45 -05:00
CLEMENT MATHIEU--DRIF
952e1a6e90 intel_iommu: Add a CLI option to enable SVM
Signed-off-by: Clement Mathieu--Drif <clement.mathieu--drif@eviden.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20251029105137.1097933-8-clement.mathieu--drif@eviden.com>
2026-02-05 03:18:40 -05:00
CLEMENT MATHIEU--DRIF
b7e31028a3 pcie: Add a function to check if pasid privileged mode is enabled
Signed-off-by: Clement Mathieu--Drif <clement.mathieu--drif@eviden.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20251029105137.1097933-4-clement.mathieu--drif@eviden.com>
2026-02-05 03:18:40 -05:00
Kane Chen
551fe2c376 hw/arm/aspeed: Model AST1700 I3C block as unimplemented device
AST1700 exposes more I3C buses than the current dummy I3C model
provides. When Linux probes the I3C devices on AST1700 this mismatch
can trigger a kernel panic. Model the I3C block as an unimplemented
device to make the missing functionality explicit and avoid unexpected
side effects.

This wires up the I3C interrupt lines for the IO expanders and adds the
corresponding device entries for the AST1700 model.

No functional I3C emulation is provided yet; this only prevents crashes and
documents the missing piece.

Signed-off-by: Kane-Chen-AS <kane_chen@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Nabih Estefan <nabihestefan@google.com>
Tested-by: Nabih Estefan <nabihestefan@google.com>
Link: https://lore.kernel.org/qemu-devel/20260204082113.3955407-19-kane_chen@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
2026-02-04 10:10:57 +01:00
Kane Chen
8cb4865429 hw/arm/aspeed: Attach SGPIOM device to AST1700 model
Connect the SGPIOM device to AST1700 model.

Signed-off-by: Kane-Chen-AS <kane_chen@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Nabih Estefan <nabihestefan@google.com>
Tested-by: Nabih Estefan <nabihestefan@google.com>
Link: https://lore.kernel.org/qemu-devel/20260204082113.3955407-18-kane_chen@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
2026-02-04 10:10:57 +01:00
Kane Chen
7e70b59776 hw/arm/aspeed: Attach PWM device to AST1700 model
Connect the PWM device to AST1700 model.

Signed-off-by: Kane-Chen-AS <kane_chen@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Nabih Estefan <nabihestefan@google.com>
Tested-by: Nabih Estefan <nabihestefan@google.com>
Link: https://lore.kernel.org/qemu-devel/20260204082113.3955407-17-kane_chen@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
2026-02-04 10:10:57 +01:00
Kane Chen
7caf444957 hw/arm/aspeed: Attach WDT device to AST1700 model
Connect the WDT device to AST1700 model.

Signed-off-by: Kane-Chen-AS <kane_chen@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Nabih Estefan <nabihestefan@google.com>
Tested-by: Nabih Estefan <nabihestefan@google.com>
Link: https://lore.kernel.org/qemu-devel/20260204082113.3955407-16-kane_chen@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
2026-02-04 10:10:57 +01:00
Kane Chen
a8b43ac5b6 hw/arm/aspeed: attach I2C device to AST1700 model
Connect the I2C controller to the AST1700 model by mapping its MMIO
region and wiring its interrupt line.

Signed-off-by: Kane-Chen-AS <kane_chen@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20260204082113.3955407-15-kane_chen@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
2026-02-04 10:10:57 +01:00
Kane Chen
1ab5e44df7 hw/arm/aspeed: Attach GPIO device to AST1700 model
Connect the GPIO controller to the AST1700 model by mapping its MMIO
region and wiring its interrupt line.

Signed-off-by: Kane-Chen-AS <kane_chen@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Nabih Estefan <nabihestefan@google.com>
Tested-by: Nabih Estefan <nabihestefan@google.com>
Link: https://lore.kernel.org/qemu-devel/20260204082113.3955407-14-kane_chen@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
2026-02-04 10:10:57 +01:00
Kane Chen
b500ab0055 hw/arm/aspeed: Attach SCU device to AST1700 model
Connect the SCU device to AST1700 model.

Signed-off-by: Kane-Chen-AS <kane_chen@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Nabih Estefan <nabihestefan@google.com>
Tested-by: Nabih Estefan <nabihestefan@google.com>
Link: https://lore.kernel.org/qemu-devel/20260204082113.3955407-13-kane_chen@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
2026-02-04 10:10:57 +01:00
Kane Chen
5d04074cb7 hw/arm/aspeed: Attach ADC device to AST1700 model
Connect the ADC device to AST1700 model.

Signed-off-by: Kane-Chen-AS <kane_chen@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Nabih Estefan <nabihestefan@google.com>
Tested-by: Nabih Estefan <nabihestefan@google.com>
Link: https://lore.kernel.org/qemu-devel/20260204082113.3955407-12-kane_chen@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
2026-02-04 10:10:57 +01:00
Kane Chen
79856931e3 hw/arm/aspeed: Attach SPI device to AST1700 model
Connect the SPI device to AST1700 model.

Signed-off-by: Kane-Chen-AS <kane_chen@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20260204082113.3955407-11-kane_chen@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
2026-02-04 10:10:57 +01:00
Kane Chen
7ba5fd213d hw/arm/aspeed: Attach SRAM device to AST1700 model
Map the SRAM device to AST1700 model

Signed-off-by: Kane-Chen-AS <kane_chen@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Nabih Estefan <nabihestefan@google.com>
Tested-by: Nabih Estefan <nabihestefan@google.com>
Link: https://lore.kernel.org/qemu-devel/20260204082113.3955407-10-kane_chen@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
2026-02-04 10:10:57 +01:00
Kane Chen
d75f9e5aca hw/arm/aspeed: Attach UART device to AST1700 model
Connect the UART controller to the AST1700 model by mapping its MMIO
region.

Signed-off-by: Kane-Chen-AS <kane_chen@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Nabih Estefan <nabihestefan@google.com>
Tested-by: Nabih Estefan <nabihestefan@google.com>
Link: https://lore.kernel.org/qemu-devel/20260204082113.3955407-9-kane_chen@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
2026-02-04 10:10:57 +01:00
Kane Chen
5f37bf0127 hw/arm/aspeed: Attach LTPI controller to AST1700 model
Connect the LTPI controller to the AST1700 model by mapping its MMIO
region.

Signed-off-by: Kane-Chen-AS <kane_chen@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Nabih Estefan <nabihestefan@google.com>
Tested-by: Nabih Estefan <nabihestefan@google.com>
Link: https://lore.kernel.org/qemu-devel/20260204082113.3955407-8-kane_chen@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
2026-02-04 10:10:57 +01:00
Kane Chen
a844b88044 hw/arm/aspeed: Integrate interrupt controller for AST1700
Connect the AST1700 interrupt lines to the GIC in AST27X0, enabling
the propagation of AST1700-originated interrupts to the host SoC.

This patch does not implement interrupt sources in AST1700 itself,
only the wiring into AST27X0.

Signed-off-by: Kane-Chen-AS <kane_chen@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20260204082113.3955407-7-kane_chen@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
2026-02-04 10:10:57 +01:00
Kane Chen
b6fb986047 hw/arm/aspeed: Integrate AST1700 device into AST27X0
Connect the AST1700 device as a child of the AST27X0 model to reflect
its role in DC-SCM 2.0 LTPI-based architectures. This patch wires
the AST1700 device into the platform without introducing functional
peripherals.

This forms the base for LTPI expander emulation in QEMU using
AST27X0 as the host controller.

Note: ioexp_num is set to 0 at this stage. Once all related devices
and interrupts are fully implemented, ioexp_num will be updated to
its expected value. This ensures the machine remains functional at
every commit and avoids potential compiler or build issues.

Signed-off-by: Kane-Chen-AS <kane_chen@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Nabih Estefan <nabihestefan@google.com>
Tested-by: Nabih Estefan <nabihestefan@google.com>
Link: https://lore.kernel.org/qemu-devel/20260204082113.3955407-6-kane_chen@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
2026-02-04 10:10:57 +01:00
Kane Chen
fc381d5b03 hw/arm/aspeed: Add AST1700 LTPI expander device model
Introduce a minimal QEMU device model for the ASPEED AST1700, an
MCU-less I/O expander used in the LTPI topology defined by the
DC-SCM 2.0 specification (see figure 2):
https://www.opencompute.org/documents/ocp-dc-scm-2-0-ltpi-ver-1-0-pdf

This initial implementation includes:

* Definition of aspeed.ast1700 as a SysBusDevice

* Setup of a basic memory region to reserve I/O space for future
  peripheral modeling

This stub establishes the foundation for LTPI-related device emulation,
without implementing any functional peripherals at this stage.

Signed-off-by: Kane-Chen-AS <kane_chen@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Nabih Estefan <nabihestefan@google.com>
Tested-by: Nabih Estefan <nabihestefan@google.com>
Link: https://lore.kernel.org/qemu-devel/20260204082113.3955407-5-kane_chen@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
2026-02-04 10:10:57 +01:00
Kane Chen
b935def0f8 hw/misc: Add basic Aspeed PWM model
Add an initial PWM model for Aspeed SoCs, including device state,
register definitions, and basic initialization as a sysbus device.

Signed-off-by: Cédric Le Goater <clg@kaod.org>
Signed-off-by: Kane-Chen-AS <kane_chen@aspeedtech.com>
Link: https://lore.kernel.org/qemu-devel/20260204082113.3955407-4-kane_chen@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
2026-02-04 10:10:57 +01:00
Kane Chen
8ed21f4ba6 hw/arm/aspeed: Attach LTPI controller to AST27X0 platform
Connect the LTPI controller device (representing the AST1700 I/O
expander) to the AST27X0 SoC model. This patch sets up the memory
mapping and device registration according to the AST2700 SoC design,
where the LTPI controller is exposed at fixed MMIO regions.

This change only handles device instantiation and integration,
without implementing the controller's internal logic.

Signed-off-by: Kane-Chen-AS <kane_chen@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Nabih Estefan <nabihestefan@google.com>
Tested-by: Nabih Estefan <nabihestefan@google.com>
Link: https://lore.kernel.org/qemu-devel/20260204082113.3955407-3-kane_chen@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
2026-02-04 10:10:57 +01:00
Kane Chen
b75d9bef4a hw/misc: Add LTPI controller
LTPI (LVDS Tunneling Protocol & Interface) is defined in the OCP DC-SCM
2.0 specification:
https://www.opencompute.org/documents/ocp-dc-scm-2-0-ltpi-ver-1-0-pdf

LTPI is a protocol and physical interface for tunneling various low-speed
signals between the HPM and SCM. As shown in Figure 2, the AST27x0 (left)
integrates two LTPI controllers, allowing it to connect to up to two
extended boards.

This commit introduces a simple device model for the ASPEED LTPI
controller in QEMU.

The model includes basic MMIO read/write operations and sets default
register values during reset to emulate a link-up state.

Implements register space with read/write callbacks.

Signed-off-by: Kane-Chen-AS <kane_chen@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Nabih Estefan <nabihestefan@google.com>
Tested-by: Nabih Estefan <nabihestefan@google.com>
Link: https://lore.kernel.org/qemu-devel/20260204082113.3955407-2-kane_chen@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
2026-02-04 10:10:57 +01:00
Jamin Lin
6b7f0908dc hw/pci-host/aspeed_pcie: Drop AST2600 RC_H root-bus remap and bus-nr property
The original AST2600 PCIe design supported both RC_L and RC_H, using root bus
number 0 for RC_L and 0x80 for RC_H. In that model, the root port appeared as
80:08.0 and QEMU carried a "bus-nr" property plus a config-space bus remap to
translate bus 0x80 to bus 0x00 for PCI enumeration.

Linux mainline has since dropped RC_L support and updated the RC_H root bus
number to start at 0. The root port is now enumerated as 00:08.0, matching the
default QEMU PCIe subsystem root bus numbering.

Remove the bus number setting and the AST2600 bus remap logic, and drop the
corresponding "bus-nr"/rc_bus_nr fields and property plumbing. QEMU now relies
on the default root bus 0 behavior.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20260127032348.2238527-4-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
2026-02-04 08:24:29 +01:00
Jamin Lin
8f5e28530f hw/pci-host/aspeed_pcie: Drop AST2600 PCIe root device
AST2600 PCIe previously exposed a root bus at 0x80 with both a
root device at 80:00.0 and a root port at 80:08.0.

Recent ASPEED SDK PCIe driver updates decided to remove the root
device and keep only a single root port. This behavior has already
been accepted by the upstream Linux kernel.

Update the QEMU PCIe model accordingly by dropping the root device
implementation and related properties. AST2600 now matches the
AST2700 PCIe topology and no longer supports the legacy RC_L
layout.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20260127032348.2238527-3-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
2026-02-04 08:24:29 +01:00
Patrick Williams
f139033e58 hw/gpio/pca9552: add pca9535 support
Extend the 16-bit PCA9552 model to support non-LED devices such as
the PCA9535[1].

[1]: https://www.ti.com/lit/ds/symlink/pca9535.pdf

Signed-off-by: Patrick Williams <patrick@stwcx.xyz>
Reviewed-by: Glenn Miles <milesg@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/20260121-pca9535-v1-1-164640e622ff@stwcx.xyz
Signed-off-by: Cédric Le Goater <clg@redhat.com>
2026-02-04 08:24:29 +01:00
Kane-Chen-AS
2835794bcd hw/i2c/aspeed: Introduce 'bus-label' to customize bus naming
On some Aspeed-based machines, multiple I2C controllers may exist
across different components, such as the primary SoC and an external
IO expander or co-processor (e.g., AST1700). Using the current static
naming convention results in object name conflicts when multiple
controllers attempt to instantiate buses with the same ID.

This patch introduces a 'bus-label' property for the Aspeed I2C
controller. This allows higher-level layers, such as the SoC realize
function, to provide a unique identifier for the buses. The I2C bus
object name is then constructed using this label (e.g., "ioexp0.0"
instead of the default "aspeed.i2c.bus.0").

This enhancement ensures unique bus identifiers across the system and
resolves naming conflicts in multi-controller configurations.

Signed-off-by: Kane-Chen-AS <kane_chen@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Tested-by: Nabih Estefan <nabihestefan@google.com>
Reviewed-by: Nabih Estefan <nabihestefan@google.com>
Link: https://lore.kernel.org/qemu-devel/20260112083054.4151945-2-kane_chen@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
2026-02-04 08:24:29 +01:00
Richard Henderson
28a6ca268c Merge tag 'single-binary-20260203' of https://github.com/philmd/qemu into staging
Various patches related to single binary effort:

- Endianness cleanups on various targets (PPC in particular)
- Few cleanups around target_ulong type on Alpha
- Have CPUClass::disas_set_info() take a const CPUState

# -----BEGIN PGP SIGNATURE-----
#
# iQIzBAABCAAdFiEE+qvnXhKRciHc/Wuy4+MsLN6twN4FAmmCDTkACgkQ4+MsLN6t
# wN7vHQ/+LCAYESbTy7cXeKGgAslwPbX1Q2zYGk0rhGMgrbBtQThbgQSkNsAwYmzg
# 6vx5crw9vYA/kLq0jyJQPTRIAKzXH9BzdEfTsEt5AIpZv6Cc4im6JBZdrxUa6S0O
# AMGb4pn9bpkcwHOv2ufotJbl0fa+id4WgQgXyLDEgwgNVvY18fVWfn5OwAon2bWo
# nb6zqRfwgdyAB+liwmlPNI+M4hZ3vDdct7whUP8t37FjTL0lNrsyG/Epr0xJB5ru
# CRsjubBkXAq8HlmwHZp8JSM/Lriitp8Z2ubD8VBqYbMYI25XUnRlBWWxTnQKkaDD
# Vgbq67UqS/k/X6vV5cfJaeS2qOdgF98V0VmrOqlNXTwMU56lzMn0ThgLqUXznRos
# IUfTUvmjfGu63aAWG2l+HBrehK5JEAGYzK6ZTiTA6abpvfHUjehslsQlAlMgcSnL
# TnMsM7mxS+XNbf6bsew0azTt2p/V81JDVrQuQgmAJS9ZOpALMFGep5YAYKvN/kLf
# cSbl+hQRsxqxQPoc6y0NrnCcfT33U1+I+IXpMIR/VyC0RgseW9HeRdJWuNyKBW/4
# VUBnQnYNhZM9hDHKp5PzU2KhoeudAlK3gws8zvtWfLCFyAvfmEYX0Gt5r23JkoxT
# IO340Jz5XRwfXMWENc6Bm8lqr7HilQi28HFNXWdy897YfNS83Ow=
# =J0gm
# -----END PGP SIGNATURE-----
# gpg: Signature made Wed 04 Feb 2026 12:59:05 AM AEST
# gpg:                using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE
# gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <f4bug@amsat.org>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg:          There is no indication that the signature belongs to the owner.
# Primary key fingerprint: FAAB E75E 1291 7221 DCFD  6BB2 E3E3 2C2C DEAD C0DE

* tag 'single-binary-20260203' of https://github.com/philmd/qemu: (30 commits)
  disas: Have disas_set_info() take a const CPUState
  disas: Make disassemble_info::target_info field const
  disas/riscv: Make rv_decode::cfg const
  target/arm: Have arm_sctlr_b() take a const @env argument
  target/arm: Have is_64() take a const @env argument
  target/arm: Have cpu_isar_feature() use a const ARMCPU object
  target/arm: Have arm_feature() take a const @env argument
  target/alpha: Expand TCGv type for 64-bit target
  target/alpha: Remove target_ulong uses in get_physical_address()
  target/alpha: Do not use target_ulong for page table entries / indexes
  target/alpha: Do not use target_ulong for trap arguments
  target/alpha: Replace target_ulong -> uint64_t in gdb_write_register()
  target/alpha: Build system units in common source set
  target/alpha: Avoid target-specific migration headers in machine.c
  target/m68k: Inline translator_ld[uw,l,q]() calls
  target/i386: Inline translator_ld[uw,l,q]() calls
  target/riscv: Inline translator_ld[uw,l,q]() calls
  target/riscv: Inline cpu_ld[lq]_code() calls
  target/ppc: Inline cpu_ldl_code() call in ppc_ldl_code()
  target/ppc: Check endianness at runtime in ppc_data_endian_env()
  ...

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2026-02-04 01:57:26 +10:00
Philippe Mathieu-Daudé
a63b90ca6c disas: Have disas_set_info() take a const CPUState
The CPUClass::disas_set_info() handler is meant to initialize
the %disassemble_info structure; it shoudn't alter the CPU state.
Enforce the CPUState can not be modified by having the handler
take a const pointer.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20260202222412.24923-8-philmd@linaro.org>
2026-02-03 14:57:34 +01:00
Philippe Mathieu-Daudé
b10b43176d disas: Make disassemble_info::target_info field const
Disassemblers shouldn't need writeable context, so make the
disassemble_info::target_info field const.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260202222412.24923-7-philmd@linaro.org>
2026-02-03 14:57:34 +01:00
Pierrick Bouvier
f2ac221cc5 target-info: add target_base_ppc, target_ppc and target_ppc64
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20260131020100.1115203-2-pierrick.bouvier@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2026-02-03 14:57:33 +01:00
Oliver Steffen
dea1f68a5c igvm: Fill MADT IGVM parameter field on x86_64
Use the new acpi_build_madt_standalone() function to fill the MADT
parameter field.

The IGVM parameter can be consumed by Coconut SVSM [1], instead of
relying on the fw_cfg interface, which has caused problems before due to
unexpected access [2,3]. Using IGVM parameters is the default way for
Coconut SVSM across hypervisors; switching over would allow removing
specialized code paths for QEMU in Coconut.

Coconut SVSM needs to know the SMP configuration, but does not look at
any other ACPI data, nor does it interact with the PCI bus settings.
Since the MADT is static and not linked with other ACPI tables, it can
be supplied stand-alone like this.

Generating the MADT twice (during ACPI table building and IGVM processing)
seems acceptable, since there is no infrastructure to obtain the MADT
out of the ACPI table memory area.

In any case OVMF, which runs after SVSM has already been initialized,
will continue reading all ACPI tables via fw_cfg and provide fixed up
ACPI data to the OS as before without any changes.

The IGVM parameter handler is implemented for the i386 machine target
and stubbed for all others.

[1] https://github.com/coconut-svsm/svsm/pull/858
[2] https://gitlab.com/qemu-project/qemu/-/issues/2882
[3] https://github.com/coconut-svsm/svsm/issues/646

Signed-off-by: Oliver Steffen <osteffen@redhat.com>
Message-ID: <20260130054714.715928-10-osteffen@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2026-02-03 08:32:33 +01:00
Oliver Steffen
8effe94499 igvm: Pass machine state to IGVM file processing
Pass the full MachineState to the IGVM backend during file processing,
instead of just the ConfidentialGuestSupport struct (which is a member
of the MachineState).
This replaces the cgs parameter of qigvm_process_file() with the machine
state to make it available in the IGVM processing context.

We will use it later to generate MADT data there to pass to the guest
as IGVM parameter.

Reviewed-by: Luigi Leonardi <leonardi@redhat.com>
Signed-off-by: Oliver Steffen <osteffen@redhat.com>
Message-ID: <20260130054714.715928-8-osteffen@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2026-02-03 08:32:33 +01:00
Oliver Steffen
4113ac8c41 igvm: Add common function for finding parameter entries
Move repeating code for finding the parameter entries in the IGVM
backend out of the parameter handlers into a common function.

A warning message is emitted in case a no parameter entry can be found
for a given index.

Reviewed-by: Luigi Leonardi <leonardi@redhat.com>
Signed-off-by: Oliver Steffen <osteffen@redhat.com>
Message-ID: <20260130054714.715928-6-osteffen@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2026-02-03 08:32:33 +01:00
Oliver Steffen
2b0cb58451 igvm: Move structs to internal header
Move QIgvm and QIgvmParameter struct definitions from the source file
into an IGVM internal header file to allow implementing architecture
specific IGVM code in other places, for example target/i386/igvm.c.

Signed-off-by: Oliver Steffen <osteffen@redhat.com>
Message-ID: <20260130054714.715928-5-osteffen@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2026-02-03 08:32:33 +01:00
Oliver Steffen
8e862b7246 hw/acpi: Make acpi_checksum() public
Make the ACPI table checksum calculation function (in core.c) public so
it can be reused in other parts of the ACPI code.

Signed-off-by: Oliver Steffen <osteffen@redhat.com>
Message-ID: <20260130054714.715928-2-osteffen@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2026-02-03 08:32:33 +01:00
Gerd Hoffmann
74d800a098 igvm: move file load to complete callback
Add UserCreatableClass->complete callback function for igvm-cfg object.

Move file loading and parsing of the igvm file from the process function
to the new complete() callback function.  Keep the igvm file loaded
after processing, release it in finalize() instead, so we parse it only
once.

Reviewed-by: Ani Sinha <anisinha@redhat.com>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Message-ID: <20260126123755.357378-4-kraxel@redhat.com>
2026-02-03 08:32:33 +01:00
Gerd Hoffmann
0a158a4148 igvm: make igvm-cfg object resettable
Add TYPE_RESETTABLE_INTERFACE to interfaces.  Register callbacks for the
reset phases.  Add trace points for logging and debugging.  No
functional change, that will come in followup patches.

Reviewed-by: Ani Sinha <anisinha@redhat.com>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Message-ID: <20260126123755.357378-3-kraxel@redhat.com>
2026-02-03 08:32:33 +01:00
Gerd Hoffmann
acd47d9928 igvm: reorganize headers
Add a new igvm-internal.h header file.  Structs and declarations which
depend on the igvm library header go into that file.

Also declare IgvmCfg in typedefs.h, so the type can be used without
including igvm header files.

Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Message-ID: <20260126123755.357378-2-kraxel@redhat.com>
2026-02-03 08:32:33 +01:00
Philippe Mathieu-Daudé
a9edda7250 monitor: Reduce target-specific declarations
Some declarations do not depend on target-specific types,
move them out of "monitor/hmp-target.h" to "monitor/hmp.h".

Commit 409e9f7131 ("mos6522: add "info via" HMP command
for debugging") declared hmp_info_via() is declared twice.
Remove the one in "hw/misc/mos6522.h" otherwise we get:

  In file included from ../hw/misc/mos6522.c:33:
  include/monitor/hmp.h:43:6: error: redundant redeclaration of 'hmp_info_via' [-Werror=redundant-decls]
     43 | void hmp_info_via(Monitor *mon, const QDict *qdict);
        |      ^~~~~~~~~~~~
  In file included from ../hw/misc/mos6522.c:29:
  include/hw/misc/mos6522.h:175:6: note: previous declaration of 'hmp_info_via' with type 'void(Monitor *, const QDict *)'
    175 | void hmp_info_via(Monitor *mon, const QDict *qdict);
        |      ^~~~~~~~~~~~

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20260129164039.58472-3-philmd@linaro.org>
2026-02-02 22:14:51 +01:00
Jim Shu
854cd16e31 accel/tcg: Fix iotlb_to_section() for different AddressSpace
'CPUTLBEntryFull.xlat_section' stores section_index in last 12 bits to
find the correct section when CPU access the IO region over the IOTLB.
However, section_index is only unique inside single AddressSpace. If
address space translation is over IOMMUMemoryRegion, it could return
section from other AddressSpace. 'iotlb_to_section()' API only finds the
sections from CPU's AddressSpace so that it couldn't find section in
other AddressSpace. Thus, using 'iotlb_to_section()' API will find the
wrong section and QEMU will have wrong load/store access.

To fix this bug of iotlb_to_section(), store complete MemoryRegionSection
pointer in CPUTLBEntryFull to replace the section_index in xlat_section.
Rename 'xlat_section' to 'xlat' as we remove last 12 bits section_index
inside. Also, since we directly use section pointer in the
CPUTLBEntryFull (full->section), we can remove the unused functions:
iotlb_to_section(), memory_region_section_get_iotlb().

This bug occurs only when
(1) IOMMUMemoryRegion is in the path of CPU access.
(2) IOMMUMemoryRegion returns different target_as and the section is in
the IO region.

Common IOMMU devices don't have this issue since they are only in the
path of DMA access. Currently, the bug only occurs when ARM MPC device
(hw/misc/tz-mpc.c) returns 'blocked_io_as' to emulate blocked access
handling. Upcoming RISC-V wgChecker [1] and IOPMP [2] devices are also
affected by this bug.

[1] RISC-V WG:
https://patchew.org/QEMU/20251021155548.584543-1-jim.shu@sifive.com/
[2] RISC-V IOPMP:
https://patchew.org/QEMU/20250312093735.1517740-1-ethan84@andestech.com/

Signed-off-by: Jim Shu <jim.shu@sifive.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Mark Burton <mburton@qti.qualcomm.com>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-ID: <20260128152348.2095427-3-jim.shu@sifive.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2026-02-02 16:43:38 +01:00
Alberto Garcia
7652e5556f hw/ide, scsi-disk: Fix typo on the rotation_rate documentation
Correct values according to the Medium Rotation Rate field from the
Block Device Characteristics VPD page (B1h) of the SCSI specification.

Signed-off-by: Alberto Garcia <berto@igalia.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20260128102548.224237-1-berto@igalia.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2026-02-02 16:43:38 +01:00
BALATON Zoltan
5cf3908f70 memory: Remove memory_region_init_rom_device_nomigrate()
This function is not used outside of memory_region_init_rom_device()
which is its only caller. Inline it there and remove it.

Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <e6f973ff3c243fe1780bf01c3e67c9e019b08fa9.1770042013.git.balaton@eik.bme.hu>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2026-02-02 16:43:38 +01:00
Jeuk Kim
ed621cc8e2 hw/ufs: fix CQE endianness and UPIU length
Round-trip UTRD fields through cpu_to_le/ le_to_cpu when building MCQ CQEs to
keep BE hosts correct. Also avoid double BE conversion of response
data_segment_length and document the LE round-trip.

Signed-off-by: Jeuk Kim <jeuk20.kim@samsung.com>
2026-02-02 14:33:46 +09:00
Richard Henderson
d21a442a5a Merge tag 'pull-target-arm-20260129' of https://gitlab.com/pm215/qemu into staging
target-arm queue:
 * Support SMMUv3 acceleration
 * A few other minor cleanups and fixes

# -----BEGIN PGP SIGNATURE-----
#
# iQJNBAABCAA3FiEE4aXFk81BneKOgxXPPCUl7RQ2DN4FAml7hesZHHBldGVyLm1h
# eWRlbGxAbGluYXJvLm9yZwAKCRA8JSXtFDYM3mFyEACUDY0XTLaqkCLQyeJc1OAg
# +oH6sRblPCJpBT3Y8eFUiDjH/2amSdxADxNmE7B/+ltD2InXJ6lHfPsA+F7QiaXD
# 7D0vKQ9LlQiv2KXwH75xEqTkG1W0m/9OLhnuyygiBIA+hjvCU5wuCmJ3AIAZOdV1
# haiW5Dg4++nxjyFNJOdC7IVCb8xIMO7rlITG4aAFhl8VOT9Orx/kJYvBCnk2flFP
# +X8JQuI3kn5ew4iTahsvAnsxTSn403u/A7j1PT8I4cODnRoV7rNF4L+LmtROHkIs
# Fkqz5LI7yN8IQeh8/kDxXr25tZnwsQ2xrBLcZsyMelVDN4fXj2+HDn+ohCNV+xIh
# 65mlQkPZ+uos4PBLgXRmuRHfvt4EBYBwAx/iRk4D+NPmHbNGlznKBRiy/7/HpFsr
# JH3XYJBW6iqmqbvfCfGJ83aiSfTkRYE/k/w8JPBO9ko8nmuqMwlCysHfBfmr/zU3
# 2MHzx+CcQ6kWEh7bi3R1r/r0LPtzT9Y4xsZKKhGyjKmwmA7eNbVCbpzbTmxWICcP
# donH/9ecAX+il7/hZOZliG7050HeSPuZC+pM7BkJlLuiKDpfwn/hBeIPJu4JGna7
# N4qRls6rO3IOchzQk9eFewie1575xUV/BDUlNsXE2ZdN0n8XgSHd9lBXzlLeOoV+
# cjg2O1Iwi+53Nb4G5Ap74Q==
# =JEwH
# -----END PGP SIGNATURE-----
# gpg: Signature made Fri 30 Jan 2026 03:08:11 AM AEDT
# gpg:                using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE
# gpg:                issuer "peter.maydell@linaro.org"
# gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [unknown]
# gpg:                 aka "Peter Maydell <pmaydell@gmail.com>" [unknown]
# gpg:                 aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" [unknown]
# gpg:                 aka "Peter Maydell <peter@archaic.org.uk>" [unknown]
# gpg: WARNING: The key's User ID is not certified with a trusted signature!
# gpg:          There is no indication that the signature belongs to the owner.
# Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83  15CF 3C25 25ED 1436 0CDE

* tag 'pull-target-arm-20260129' of https://gitlab.com/pm215/qemu: (43 commits)
  arm: add DCZID_EL0 to idregs array
  arm: add {get,set}_dczid_bs helpers
  docs/system: update FEAT_BBML[12] references
  MAINTAINERS: add emulation.rst to ARM TCG CPUs
  target/arm/hvf: Sync CNTV_CTL_EL0 & CNTV_CVAL_EL0
  target/arm/hvf: Move hvf_sysreg_[read, write]_cp() functions around
  hw/arm/smmuv3-accel: Make SubstreamID support configurable
  hw/vfio/pci: Synthesize PASID capability for vfio-pci devices
  hw/pci: Factor out common PASID capability initialization
  hw/pci: Add helper to insert PCIe extended capability at a fixed offset
  backends/iommufd: Add get_pasid_info() callback
  backends/iommufd: Retrieve PASID width from iommufd_backend_get_device_info()
  hw/arm/smmuv3-accel: Add property to specify OAS bits
  hw/arm/smmuv3-accel: Add support for ATS
  hw/arm/smmuv3-accel: Add a property to specify RIL support
  hw/arm/smmuv3: Add accel property for SMMUv3 device
  hw/arm/smmuv3: Block migration when accel is enabled
  tests/qtest/bios-tables-test: Update IORT blobs after revision upgrade
  hw/arm/virt-acpi-build: Add IORT RMR regions to handle MSI nested binding
  tests/qtest/bios-tables-test: Prepare for IORT revison upgrade
  ...

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2026-02-02 15:04:44 +11:00