aboutsummaryrefslogtreecommitdiff
path: root/hw
AgeCommit message (Collapse)AuthorFilesLines
2025-07-15intel_iommu: Set address mask when a translation fails and adjust W permissionCLEMENT MATHIEU--DRIF1-3/+9
Implements the behavior defined in section 10.2.3.5 of PCIe spec rev 5. This is needed by devices that support ATS. Signed-off-by: Clement Mathieu--Drif <clement.mathieu--drif@eviden.com> Message-Id: <20250628180226.133285-10-clement.mathieu--drif@eviden.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2025-07-15intel_iommu: Return page walk level even when the translation failsCLEMENT MATHIEU--DRIF1-9/+8
We will use this information in vtd_do_iommu_translate to populate the IOMMUTLBEntry and indicate the correct page mask. This prevents ATS devices from sending many useless translation requests when a megapage or gigapage is not present. Signed-off-by: Clement Mathieu--Drif <clement.mathieu--drif@eviden.com> Message-Id: <20250628180226.133285-9-clement.mathieu--drif@eviden.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2025-07-15intel_iommu: Implement the PCIIOMMUOps callbacks related to invalidations of ↵CLEMENT MATHIEU--DRIF1-0/+35
device-IOTLB Signed-off-by: Clement Mathieu--Drif <clement.mathieu--drif@eviden.com> Message-Id: <20250628180226.133285-8-clement.mathieu--drif@eviden.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2025-07-15intel_iommu: Implement vtd_get_iotlb_info from PCIIOMMUOpsCLEMENT MATHIEU--DRIF1-0/+10
Signed-off-by: Clement Mathieu--Drif <clement.mathieu--drif@eviden.com> Message-Id: <20250628180226.133285-7-clement.mathieu--drif@eviden.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2025-07-15intel_iommu: Declare supported PASID sizeCLEMENT MATHIEU--DRIF2-1/+2
the PSS field of the extended capabilities stores the supported PASID size minus 1. This commit adds support for 8bits PASIDs (limited by MemTxAttrs::pid). Signed-off-by: Clement Mathieu--Drif <clement.mathieu--drif@eviden.com> Message-Id: <20250628180226.133285-6-clement.mathieu--drif@eviden.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2025-07-15intel_iommu: Fill the PASID field when creating an IOMMUTLBEntryCLEMENT MATHIEU--DRIF1-0/+3
PASID value must be used by devices as a key (or part of a key) when populating their ATC with the IOTLB entries returned by the IOMMU. Signed-off-by: Clement Mathieu--Drif <clement.mathieu--drif@eviden.com> Message-Id: <20250628180226.133285-5-clement.mathieu--drif@eviden.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2025-07-15hw/display: Allow injection of virtio-gpu EDID nameAndrew Keesler2-0/+71
Thanks to 72d277a7, 1ed2cb32, and others, EDID (Extended Display Identification Data) is propagated by QEMU such that a virtual display presents legitimate metadata (e.g., name, serial number, preferred resolutions, etc.) to its connected guest. This change adds the ability to specify the EDID name for a particular virtio-vga display. Previously, every virtual display would have the same name: "QEMU Monitor". Now, we can inject names of displays in order to test guest behavior that is specific to display names. We provide the ability to inject the display name from the frontend since this is guest visible data. Furthermore, this makes it clear where N potential display outputs would get their name from (which will be added in a future change). Note that we have elected to use a struct here for output data for extensibility - we intend to add per-output fields like resolution in a future change. It should be noted that EDID names longer than 12 bytes will be truncated per spec (I think?). Testing: verified that when I specified 2 outputs for a virtio-gpu with edid_name set, the names matched those that I configured with my vnc display. -display vnc=localhost:0,id=aaa,display=vga,head=0 \ -display vnc=localhost:1,id=bbb,display=vga,head=1 \ -device '{"driver":"virtio-vga", "max_outputs":2, "id":"vga", "outputs":[ { "name":"AAA" }, { "name":"BBB" } ]}' Signed-off-by: Andrew Keesler <ankeesler@google.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20250709121126.2946088-2-ankeesler@google.com>
2025-07-15esp.c: only allow ESP commands permitted in the current asc_modeMark Cave-Ayland2-0/+38
If an ESP command is issued in an incorrect mode then an illegal command interrupt should be generated. Add a new esp_cmd_is_valid() function to indicate whether the ESP command is valid for the current mode, and if not then raise the illegal command interrupt. This fixes WinNT MIPS which issues ICCS after a Chip Reset which is not permitted, but will fail with an INACCESSIBLE_BOOT_DEVICE error unless an interrupt is generated. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Fixes: 83428f7a97 ("esp.c: move write_response() non-DMA logic to esp_do_nodma()") Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2464 Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20250711204636.542964-8-mark.cave-ayland@ilande.co.uk> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2025-07-15esp.c: add asc_mode property to indicate the current ESP modeMark Cave-Ayland1-1/+20
Add a new asc_mode property to ESPState which indicates the current mode of the ESP and update the ESP state machine accordingly. Bump the vmstate version and include migration logic to ensure that asc_mode is set to initiator mode such that any commands in progress will always continue. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20250711204636.542964-7-mark.cave-ayland@ilande.co.uk> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2025-07-15esp.c: only call dma_memory_write function if transfer length is non-zeroMark Cave-Ayland1-1/+5
In the cases where mixed DMA/non-DMA transfers are used or no data is available, it is possible for the calculated transfer length to be zero. Only call the dma_memory_write function where the transfer length is non-zero to avoid invoking the DMA engine for a zero length transfer which can have side-effects (along with generating additional tracing noise). Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20250711204636.542964-6-mark.cave-ayland@ilande.co.uk> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2025-07-15esp.c: only call dma_memory_read function if transfer length is non-zeroMark Cave-Ayland1-7/+13
In the cases where mixed DMA/non-DMA transfers are used or no data is available, it is possible for the calculated transfer length to be zero. Only call the dma_memory_read function where the transfer length is non-zero to avoid invoking the DMA engine for a zero length transfer which can have side-effects (along with generating additional tracing noise). Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20250711204636.542964-5-mark.cave-ayland@ilande.co.uk> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2025-07-15esp.c: improve comment in esp_transfer_data()Mark Cave-Ayland1-2/+3
Whilst working on the previous patch, the existing comment was not enough to document when the TI command codepath was being used. Update and improve the comment accordingly. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20250711204636.542964-3-mark.cave-ayland@ilande.co.uk> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2025-07-15esp.c: only raise IRQ in esp_transfer_data() for CMD_SEL, CMD_SELATN and ↵Mark Cave-Ayland1-2/+3
CMD_TI commands Clarify the logic in esp_transfer_data() to ensure that the deferred interrupt code can only be triggered for CMD_SEL, CMD_SELATN and CMD_TI commands. This should already be the case, but make it explicit to ensure the logic isn't triggered unexpectedly. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20250711204636.542964-2-mark.cave-ayland@ilande.co.uk> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2025-07-15hw/microblaze: Add missing FDT dependencyBernhard Beschow1-2/+2
These boards ship with a bundled DTB, and dtc will be required for generating these from device tree sources. Prepare for that by adding an FDT dependency. Signed-off-by: Bernhard Beschow <shentey@gmail.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20250708204806.1898-2-shentey@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2025-07-15hw/intc/loongarch_extioi: Remove unnecessary 'qemu/typedefs.h' includePhilippe Mathieu-Daudé1-1/+0
"qemu/typedefs.h" is already included by "qemu/osdep.h". Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Song Gao <gaosong@loongson.cn> Message-Id: <20250708085859.7885-2-philmd@linaro.org>
2025-07-15hw/mips: Restrict ITU to TCGPhilippe Mathieu-Daudé3-3/+4
MIPS Inter-Thread Communication Unit is implemented using TCG. Check for TCG both in Kconfig and CPS source. Fixes: 2321d971b6f ("hw/mips: Add dependency MIPS_CPS -> MIPS_ITU") Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20250702164953.18579-1-philmd@linaro.org>
2025-07-14Merge tag 'for-upstream' of https://gitlab.com/bonzini/qemu into stagingStefan Hajnoczi4-4/+64
* rust: miscellaneous fixes * rust: qemu-api-macros: cleanup and add unit tests for TryInto * rust: log: implement io::Write, avoid memory allocations when logging constant strings * target/i386: fix usage of properties whenever accelerators change the default (e.g. vendor) * target/i386: add support for TDVMCALL_SETUP_EVENT_NOTIFY_INTERRUPT * target/i386: add support for booting an SEV VM from an IGVM file * target/i386: unify cache model descriptions between CPUID 2, CPUID 4 and AMD specific CPUID 0x80000006 * target/i386: introduce cache models for recent Intel CPU models * target/i386: mark some 0x80000000-0x80000008 bits as reserved on Intel * target/i386: cleanups # -----BEGIN PGP SIGNATURE----- # # iQFIBAABCgAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAmh0v+sUHHBib256aW5p # QHJlZGhhdC5jb20ACgkQv/vSX3jHroOQUQf8CTsCnl2xYrnrkVfSVj6kuAE+JYD6 # oLSXsOEG4yrVknuhwIfVsqNScmleJCdz85ej7CZxy3vzzgjLfmy7nwifKEIKku7E # XO/Q3HbB898MnzqceQRmwe1AzELoj1Lave215CPhUBo60LCRPwaIZsiHprnNZgXi # TyHlmywDVRjyFLtKkx3El0dnLAhFqPWeGh81CD5lPLZZJ+Wt2FuAw2zqSOGB2ztM # FkJmunFJiaTItjyCN/uNvBSbDKecAHgCXvSCVNG3+I4U2R0gK1lcwm3TRo7yKia+ # HUHGa3UEXoIqlRfXdX6zuc8tW1/u6SPv+8WX53t204PAeSWDUrtIe9jZ4A== # =y4/a # -----END PGP SIGNATURE----- # gpg: Signature made Mon 14 Jul 2025 04:29:31 EDT # gpg: using RSA key F13338574B662389866C7682BFFBD25F78C7AE83 # gpg: issuer "pbonzini@redhat.com" # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" [full] # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" [full] # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * tag 'for-upstream' of https://gitlab.com/bonzini/qemu: (77 commits) i386/cpu: Honor maximum value for CPUID.8000001DH.EAX[25:14] i386/cpu: Fix overflow of cache topology fields in CPUID.04H i386/cpu: Fix cpu number overflow in CPUID.01H.EBX[23:16] i386/cpu: Fix number of addressable IDs field for CPUID.01H.EBX[23:16] i386/cpu: Reorder CPUID leaves in cpu_x86_cpuid() tests/vm: bump FreeBSD image to 14.3 tests/functional: test_x86_cpu_model_versions: remove dead tests i386/cpu: Mark CPUID 0x80000008 ECX bits[0:7] & [12:15] as reserved for Intel/Zhaoxin i386/cpu: Mark CPUID 0x80000007[EBX] as reserved for Intel i386/cpu: Mark EBX/ECX/EDX in CPUID 0x80000000 leaf as reserved for Intel i386/cpu: Enable 0x1f leaf for YongFeng by default i386/cpu: Enable 0x1f leaf for SapphireRapids by default i386/cpu: Enable 0x1f leaf for GraniteRapids by default i386/cpu: Enable 0x1f leaf for SierraForest by default i386/cpu: Enable 0x1f leaf for SierraForest by default i386/cpu: Add a "x-force-cpuid-0x1f" property i386/cpu: Introduce cache model for YongFeng i386/cpu: Introduce cache model for SapphireRapids i386/cpu: Introduce cache model for GraniteRapids i386/cpu: Introduce cache model for SierraForest ... Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2025-07-14Merge tag 'net-pull-request' of https://github.com/jasowang/qemu into stagingStefan Hajnoczi4-158/+51
# -----BEGIN PGP SIGNATURE----- # # iQEzBAABCAAdFiEEIV1G9IJGaJ7HfzVi7wSWWzmNYhEFAmh0lXsACgkQ7wSWWzmN # YhGvVwf+OxTtnr84VdsEckqNVuzVkMHk3PAuSlxpvfjHXnwwo5Efto9lA4h4BUSX # As9sYpF3qXZdh95QYB/49CvVdizsI/KW1wPEx4ryVqCi7kcdOrzNB/MMMXBrrJE+ # 86xtc2a53CHHcctUIvkBr/GVzhay/gm6VHjnPEB/B0Tv+rTKpIBr/nJzVlG+8uX9 # O/XRI0aqnCPlsWDQFR2TbyE4TSSmTw5oXru0I12tPfxt2ed6b+izKubHmqgeLCyH # ne+qEy2ds40eBZ4YMDDIsxYKY8RlWIdUY0Dnz6wSjC00BNo5yLu7cirL0Ozd6AsI # pK5eqQGZGGQIGV/KD+M7WwKWVltBJg== # =rS9w # -----END PGP SIGNATURE----- # gpg: Signature made Mon 14 Jul 2025 01:28:27 EDT # gpg: using RSA key 215D46F48246689EC77F3562EF04965B398D6211 # gpg: Good signature from "Jason Wang (Jason Wang on RedHat) <jasowang@redhat.com>" [full] # Primary key fingerprint: 215D 46F4 8246 689E C77F 3562 EF04 965B 398D 6211 * tag 'net-pull-request' of https://github.com/jasowang/qemu: net/passt: Implement vhost-user backend support net: Add passt network backend net: Add is_vhost_user flag to vhost_net struct net: Allow network backends to advertise max TX queue size net: Add save_acked_features callback to vhost_net net: Add get_acked_features callback to VhostNetOptions net: Consolidate vhost feature bits into vhost_net structure net: Add get_vhost_net callback to NetClientInfo vhost_net: Rename vhost_set_vring_enable() for clarity net: Define net_client_set_link() net: Refactor stream logic for reuse in '-net passt' virtio-net: Add queues for RSS during migration net: fix buffer overflow in af_xdp_umem_create() Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2025-07-14acpi: Add machine option to disable SPCR tableLi Chen4-3/+33
The ACPI SPCR (Serial Port Console Redirection) table allows firmware to specify a preferred serial console device to the operating system. On ARM64 systems, Linux by default respects this table: even if the kernel command line does not include a hardware serial console (e.g., "console=ttyAMA0"), the kernel still register the serial device referenced by SPCR as a printk console. While this behavior is standard-compliant, it can lead to situations where guest console behavior is influenced by platform firmware rather than user-specified configuration. To make guest console behavior more predictable and under user control, this patch introduces a machine option to explicitly disable SPCR table exposure: -machine spcr=off By default, the option is enabled (spcr=on), preserving existing behavior. When disabled, QEMU will omit the SPCR table from the guest's ACPI namespace, ensuring that only consoles explicitly declared in the kernel command line are registered. Signed-off-by: Li Chen <chenl311@chinatelecom.cn> Reviewed-by: Bibo Mao <maobibo@loongson.cn> Acked-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Gavin Shan <gshan@redhat.com> Reviewed-by: Sunil V L <sunilvl@ventanamicro.com> Message-Id: <20250528105404.457729-2-me@linux.beauty> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2025-07-14amd_iommu: Fix truncation of oldval in amdvi_writeqEthan Milon1-1/+1
The variable `oldval` was incorrectly declared as a 32-bit `uint32_t`. This could lead to truncation and incorrect behavior where the upper read-only 32 bits are significant. Fix the type of `oldval` to match the return type of `ldq_le_p()`. Cc: qemu-stable@nongnu.org Fixes: d29a09ca6842 ("hw/i386: Introduce AMD IOMMU") Signed-off-by: Ethan Milon <ethan.milon@eviden.com> Message-Id: <20250617150427.20585-9-alejandro.j.jimenez@oracle.com> Reviewed-by: Vasant Hegde <vasant.hegde@amd.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2025-07-14amd_iommu: Remove duplicated definitionsAlejandro Jimenez1-4/+0
No functional change. Signed-off-by: Alejandro Jimenez <alejandro.j.jimenez@oracle.com> Reviewed-by: Vasant Hegde <vasant.hegde@amd.com> Message-Id: <20250617150427.20585-8-alejandro.j.jimenez@oracle.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2025-07-14amd_iommu: Fix the calculation for Device Table sizeAlejandro Jimenez1-2/+2
Correctly calculate the Device Table size using the format encoded in the Device Table Base Address Register (MMIO Offset 0000h). Cc: qemu-stable@nongnu.org Fixes: d29a09ca6842 ("hw/i386: Introduce AMD IOMMU") Signed-off-by: Alejandro Jimenez <alejandro.j.jimenez@oracle.com> Reviewed-by: Vasant Hegde <vasant.hegde@amd.com> Message-Id: <20250617150427.20585-7-alejandro.j.jimenez@oracle.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2025-07-14amd_iommu: Fix mask to retrieve Interrupt Table Root Pointer from DTEAlejandro Jimenez1-1/+1
Fix an off-by-one error in the definition of AMDVI_IR_PHYS_ADDR_MASK. The current definition masks off the most significant bit of the Interrupt Table Root ptr i.e. it only generates a mask with bits [50:6] set. See the AMD I/O Virtualization Technology (IOMMU) Specification for the Interrupt Table Root Pointer[51:6] field in the Device Table Entry format. Cc: qemu-stable@nongnu.org Fixes: b44159fe0078 ("x86_iommu/amd: Add interrupt remap support when VAPIC is not enabled") Signed-off-by: Alejandro Jimenez <alejandro.j.jimenez@oracle.com> Reviewed-by: Vasant Hegde <vasant.hegde@amd.com> Message-Id: <20250617150427.20585-6-alejandro.j.jimenez@oracle.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2025-07-14amd_iommu: Fix masks for various IOMMU MMIO RegistersAlejandro Jimenez1-19/+19
Address various issues with definitions of the MMIO registers e.g. for the Device Table Address Register, the size mask currently encompasses reserved bits [11:9], so change it to only extract the bits [8:0] encoding size. Convert masks to use GENMASK64 for consistency, and make unrelated definitions independent. Cc: qemu-stable@nongnu.org Fixes: d29a09ca6842 ("hw/i386: Introduce AMD IOMMU") Signed-off-by: Alejandro Jimenez <alejandro.j.jimenez@oracle.com> Reviewed-by: Vasant Hegde <vasant.hegde@amd.com> Message-Id: <20250617150427.20585-5-alejandro.j.jimenez@oracle.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2025-07-14amd_iommu: Update bitmasks representing DTE reserved fieldsAlejandro Jimenez2-6/+10
The DTE validation method verifies that all bits in reserved DTE fields are unset. Update them according to the latest definition available in AMD I/O Virtualization Technology (IOMMU) Specification - Section 2.2.2.1 Device Table Entry Format. Remove the magic numbers and use a macro helper to generate bitmasks covering the specified ranges for better legibility. Note that some reserved fields specify that events are generated when they contain non-zero bits, or checks are skipped under certain configurations. This change only updates the reserved masks, checks for special conditions are not yet implemented. Cc: qemu-stable@nongnu.org Signed-off-by: Alejandro Jimenez <alejandro.j.jimenez@oracle.com> Reviewed-by: Vasant Hegde <vasant.hegde@amd.com> Message-Id: <20250617150427.20585-4-alejandro.j.jimenez@oracle.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2025-07-14amd_iommu: Fix Device ID decoding for INVALIDATE_IOTLB_PAGES commandAlejandro Jimenez1-2/+2
The DeviceID bits are extracted using an incorrect offset in the call to amdvi_iotlb_remove_page(). This field is read (correctly) earlier, so use the value already retrieved for devid. Cc: qemu-stable@nongnu.org Fixes: d29a09ca6842 ("hw/i386: Introduce AMD IOMMU") Signed-off-by: Alejandro Jimenez <alejandro.j.jimenez@oracle.com> Reviewed-by: Vasant Hegde <vasant.hegde@amd.com> Message-Id: <20250617150427.20585-3-alejandro.j.jimenez@oracle.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2025-07-14amd_iommu: Fix Miscellaneous Information Register 0 encodingAlejandro Jimenez1-3/+3
The definitions encoding the maximum Virtual, Physical, and Guest Virtual Address sizes supported by the IOMMU are using incorrect offsets i.e. the VASize and GVASize offsets are switched. The value in the GVAsize field is also modified, since it was incorrectly encoded. Cc: qemu-stable@nongnu.org Fixes: d29a09ca6842 ("hw/i386: Introduce AMD IOMMU") Co-developed-by: Ethan MILON <ethan.milon@eviden.com> Signed-off-by: Ethan MILON <ethan.milon@eviden.com> Signed-off-by: Alejandro Jimenez <alejandro.j.jimenez@oracle.com> Message-Id: <20250617150427.20585-2-alejandro.j.jimenez@oracle.com> Reviewed-by: Vasant Hegde <vasant.hegde@amd.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2025-07-14hw/acpi: Fix GPtrArray memory leak in crs_range_mergeLi Zhijian1-2/+1
This leak was detected by the valgrind. The crs_range_merge() function unconditionally allocated a GPtrArray 'even when range->len was zero, causing an early return without freeing the allocated array. This resulted in a memory leak when an empty range was processed. Instead of moving the allocation after the check (as previously attempted), use g_autoptr for automatic cleanup. This ensures the array is freed even on early returns, and also removes the need for the explicit free at the end of the function. Signed-off-by: Li Zhijian <lizhijian@fujitsu.com> Message-Id: <20250613085110.111204-1-lizhijian@fujitsu.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Ani Sinha <anisinha@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2025-07-14vhost-user-blk: add an option to skip GET_VRING_BASE for force shutdownDaniil Tatianin1-1/+8
If we have a server running disk requests that is for whatever reason hanging or not able to process any more IO requests but still has some in-flight requests previously issued by the guest OS, QEMU will still try to drain the vring before shutting down even if it was explicitly asked to do a "force shutdown" via SIGTERM or QMP quit. This is not useful since the guest is no longer running at this point since it was killed by QEMU earlier in the process. At this point, we don't care about whatever in-flight IO it might have pending, we just want QEMU to shut down. Add an option called "skip-get-vring-base-on-force-shutdown" to allow SIGTERM/QMP quit() to actually act like a "force shutdown" at least for vhost-user-blk devices since those require the drain operation to shut down gracefully unlike, for example, network devices. Signed-off-by: Daniil Tatianin <d-tatianin@yandex-team.ru> Message-Id: <20250609212547.2859224-4-d-tatianin@yandex-team.ru> Acked-by: Raphael Norwitz <raphael@enfabrica.net> Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2025-07-14vhost: add a helper for force stopping a deviceDaniil Tatianin1-13/+39
This adds an ability to skip GET_VRING_BASE during device stop entirely, and thus the expensive drain operation that this call entails as well, which may be useful during a non-graceful shutdown in case the guest operating system hangs or refuses to react to a previously requested ACPI shutdown for whatever reason. Signed-off-by: Daniil Tatianin <d-tatianin@yandex-team.ru> Message-Id: <20250609212547.2859224-3-d-tatianin@yandex-team.ru> Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2025-07-14vhost: Fix used memslot tracking when destroying a vhost deviceDavid Hildenbrand1-27/+10
When we unplug a vhost device, we end up calling vhost_dev_cleanup() where we do a memory_listener_unregister(). This memory_listener_unregister() call will end up disconnecting the listener from the address space through listener_del_address_space(). In that process, we effectively communicate the removal of all memory regions from that listener, resulting in region_del() + commit() callbacks getting triggered. So in case of vhost, we end up calling vhost_commit() with no remaining memory slots (0). In vhost_commit() we end up overwriting the global variables used_memslots / used_shared_memslots, used for detecting the number of free memslots. With used_memslots / used_shared_memslots set to 0 by vhost_commit() during device removal, we'll later assume that the other vhost devices still have plenty of memslots left when calling vhost_get_free_memslots(). Let's fix it by simply removing the global variables and depending only on the actual per-device count. Easy to reproduce by adding two vhost-user devices to a VM and then hot-unplugging one of them. While at it, detect unexpected underflows in vhost_get_free_memslots() and issue a warning. Reported-by: yuanminghao <yuanmh12@chinatelecom.cn> Link: https://lore.kernel.org/qemu-devel/20241121060755.164310-1-yuanmh12@chinatelecom.cn/ Fixes: 2ce68e4cf5be ("vhost: add vhost_has_free_slot() interface") Cc: Igor Mammedov <imammedo@redhat.com> Cc: Michael S. Tsirkin <mst@redhat.com> Cc: Stefano Garzarella <sgarzare@redhat.com> Signed-off-by: David Hildenbrand <david@redhat.com> Message-Id: <20250603111336.1858888-1-david@redhat.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2025-07-14virtio-net: Add hash type optionsAkihiko Odaki1-2/+43
By default, virtio-net limits the hash types that will be advertised to the guest so that all hash types are covered by the offloading capability the client provides. This change allows to override this behavior and to advertise hash types that require user-space hash calculation by specifying "on" for the corresponding properties. Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Message-Id: <20250530-vdpa-v1-6-5af4109b1c19@daynix.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2025-07-14virtio-net: Retrieve peer hashing capabilityAkihiko Odaki1-13/+58
Retrieve peer hashing capability instead of hardcoding. Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Message-Id: <20250530-vdpa-v1-4-5af4109b1c19@daynix.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2025-07-14virtio-net: Move virtio_net_get_features() downAkihiko Odaki1-73/+73
Move virtio_net_get_features() to the later part of the file so that it can call other functions. Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Message-Id: <20250530-vdpa-v1-3-5af4109b1c19@daynix.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2025-07-14qdev-properties: Add DEFINE_PROP_ON_OFF_AUTO_BIT64()Akihiko Odaki1-1/+66
DEFINE_PROP_ON_OFF_AUTO_BIT64() corresponds to DEFINE_PROP_ON_OFF_AUTO() as DEFINE_PROP_BIT64() corresponds to DEFINE_PROP_BOOL(). The difference is that DEFINE_PROP_ON_OFF_AUTO_BIT64() exposes OnOffAuto instead of bool. Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Message-Id: <20250530-vdpa-v1-1-5af4109b1c19@daynix.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2025-07-14net: Add is_vhost_user flag to vhost_net structLaurent Vivier2-3/+8
Introduce a boolean is_vhost_user field to the vhost_net structure. This flag is initialized during vhost_net_init based on whether the backend is vhost-user. This refactoring simplifies checks for vhost-user specific behavior, replacing direct comparisons of 'net->nc->info->type' with the new flag. It improves readability and encapsulates the backend type information directly within the vhost_net instance. Signed-off-by: Laurent Vivier <lvivier@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2025-07-14net: Allow network backends to advertise max TX queue sizeLaurent Vivier2-12/+13
This commit refactors how the maximum transmit queue size for virtio-net devices is determined, making the mechanism more generic and extensible. Previously, virtio_net_max_tx_queue_size() contained hardcoded checks for specific network backend types (vhost-user and vhost-vdpa) to determine their supported maximum queue size. This created direct dependencies and would require modifications for every new backend that supports variable queue sizes. To improve flexibility, a new max_tx_queue_size field is added to the vhost_net structure. This allows each network backend to advertise its supported maximum transmit queue size directly. The virtio_net_max_tx_queue_size() function now retrieves the max TX queue size from the vhost_net struct, if available and set. Otherwise, it defaults to VIRTIO_NET_TX_QUEUE_DEFAULT_SIZE. Signed-off-by: Laurent Vivier <lvivier@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2025-07-14net: Add save_acked_features callback to vhost_netLaurent Vivier2-6/+5
This commit introduces a save_acked_features function pointer to vhost_net and converts the vhost_net function into a generic dispatcher. The vhost-user backend provides the callback, making its function static. With this change, no other module has a direct dependency on the vhost-user implementation. This cleanup allows for the complete removal of the net/vhost-user.h header file. Signed-off-by: Laurent Vivier <lvivier@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2025-07-14net: Add get_acked_features callback to VhostNetOptionsLaurent Vivier1-4/+2
This patch continues the effort to decouple the generic vhost layer from specific network backend implementations. Previously, the vhost_net initialization code contained a hardcoded check for the vhost-user client type to retrieve its acked features by calling vhost_user_get_acked_features(). This exposed an internal vhost-user function in a public header and coupled the two modules. The vhost-user backend is updated to provide a callback, and its getter function is now static. The call site in vhost_net.c is simplified to use the new generic helper, removing the type check and the direct dependency. Signed-off-by: Laurent Vivier <lvivier@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2025-07-14net: Consolidate vhost feature bits into vhost_net structureLaurent Vivier1-87/+3
Previously, the vhost_net_get_feature_bits() function in hw/net/vhost_net.c used a large switch statement to determine the appropriate feature bits based on the NetClientDriver type. This created unnecessary coupling between the generic vhost layer and specific network backends (like TAP, vhost-user, and vhost-vdpa). This patch moves the definition of vhost feature bits directly into the vhost_net structure for each relevant network client. Signed-off-by: Laurent Vivier <lvivier@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2025-07-14net: Add get_vhost_net callback to NetClientInfoLaurent Vivier1-27/+4
The get_vhost_net() function previously contained a large switch statement to find the VHostNetState pointer based on the net client's type. This created a tight coupling, requiring the generic vhost layer to be aware of every specific backend that supported vhost, such as tap, vhost-user, and vhost-vdpa. This approach is not scalable and requires modifying a central function for any new backend. It also forced each backend to expose its internal getter function in a public header file. This patch refactors the logic by introducing a new get_vhost_net function pointer to the NetClientInfo struct. The central get_vhost_net() function is now a simple, generic dispatcher that invokes the callback provided by the net client. Each backend now implements its own private getter and registers it in its NetClientInfo. Signed-off-by: Laurent Vivier <lvivier@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2025-07-14vhost_net: Rename vhost_set_vring_enable() for clarityLaurent Vivier3-5/+5
This is a cosmetic change with no functional impact. The function vhost_set_vring_enable() is specific to vhost_net and is used outside of vhost_net.c (specifically, in hw/net/virtio-net.c). To prevent confusion with other similarly named vhost functions, such as the one found in cryptodev-vhost.c, it has been renamed to vhost_net_set_vring_enable(). This clarifies that the function belongs to the vhost_net module. Signed-off-by: Laurent Vivier <lvivier@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2025-07-14virtio-net: Add queues for RSS during migrationAkihiko Odaki2-14/+11
virtio_net_pre_load_queues() inspects vdev->guest_features to tell if VIRTIO_NET_F_RSS or VIRTIO_NET_F_MQ is enabled to infer the required number of queues. This works for VIRTIO_NET_F_MQ but it doesn't for VIRTIO_NET_F_RSS because only the lowest 32 bits of vdev->guest_features is set at the point and VIRTIO_NET_F_RSS uses bit 60 while VIRTIO_NET_F_MQ uses bit 22. Instead of inferring the required number of queues from vdev->guest_features, use the number loaded from the vm state. This change also has a nice side effect to remove a duplicate peer queue pair change by circumventing virtio_net_set_multiqueue(). Also update the comment in include/hw/virtio/virtio.h to prevent an implementation of pre_load_queues() from refering to any fields being loaded during migration by accident in the future. Fixes: 8c49756825da ("virtio-net: Add only one queue pair when realizing") Tested-by: Lei Yang <leiyang@redhat.com> Cc: qemu-stable@nongnu.org Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2025-07-13hw/uefi: Create and use trace.h wrapper headerPeter Maydell5-4/+6
The documentation of the trace subsystem (docs/devel/tracing.rst) says that each subdirectory which uses trace events should create a wrapper trace.h file which includes the trace/trace-foo.h generated header, and that .c files then #include "trace.h". We didn't follow this pattern in hw/uefi/. Correct this by creating and using the trace.h wrapper header. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Michael Tokarev <mjt@tls.msk.ru> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2025-07-13hw/usb/dev-hid: Support side and extra mouse buttons for usb-tabletThomas Lambertz1-3/+3
The necessary plumbing for side- and extra mouse buttons to reach usb-tablet is already done. But the descriptor advertises three buttons max. Increase this to 5. Buttons are now identical to usb-mouse. Signed-off-by: Thomas Lambertz <patch@thomaslambertz.de> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2025-07-13Merge tag 'migration-20250711-pull-request' of ↵Stefan Hajnoczi5-7/+7
https://gitlab.com/farosas/qemu into staging Migration pull request - General cleanups around: postcopy, bg-snapshot, migration hooks, migration completion and formatting of 'info migrate'. - Overhaul of postcopy blocktime tracking. # -----BEGIN PGP SIGNATURE----- # # iQJEBAABCAAuFiEEqhtIsKIjJqWkw2TPx5jcdBvsMZ0FAmhxGdgQHGZhcm9zYXNA # c3VzZS5kZQAKCRDHmNx0G+wxnahoD/9uNXirlmRk3tDnhiJsiYx+HnXYPFEORSZq # zlpUyqvhQ1POp3Fa5pRf+bJ5mmPw8h8PdOR2StMpnW2Xa1OatAZj5m1uityAVWOl # EkVfZLl0j6j9HCCmE3c4dztOGIBsd9YY0GWizL05XHYZPrdX4zOpolMN4m53RwQY # HUVD6T2y9eFDnCO6MsoA9EfmkFYCRvqlS0VzTcYzQFN4H+QHlcpDfweqJpTLPa+1 # trahAN9PBuMjoewjDqwkNkf0CLaCXHszAfj6yv62Vi8Cbp9DDPywIYJKFnxspElW # Fjg1b4MdsbYZNmeKgIawzgTOL1RrojvKkoi7KWp3D7M+/ZZl9kBwQuUcBXKI7N0R # Y0GNfkkTycn18nM0JU/6QWSuVeiPbLArxQUGP1cLgvcHSSNgD9JxWbNBu5+1fFOG # Gg3qnyYatJ6xJDiCrdKqV8fwozNlm/G6b9BiCDeVq+4nA2OKQ0shiNA1GZHvVSQL # X4uAPexETdHfA/LeA2w5sgVBEw7BewBdjLntZDIFsyBnLrvqrDcU5Aav0wiHoI8U # QBC2aIpJfMLHiIQ93mVX96NltXC7KvJTIZVl3iwfiYEYCvQtTYgdJ09ELXFJYxFX # XpTTazqpmPSfuZpPRgx9YbDP/kS8Fg/PTOlPeD0T/frFgd1S6Thh6OW455PavMp8 # ht2lE4sxjA== # =vtRD # -----END PGP SIGNATURE----- # gpg: Signature made Fri 11 Jul 2025 10:04:08 EDT # gpg: using RSA key AA1B48B0A22326A5A4C364CFC798DC741BEC319D # gpg: issuer "farosas@suse.de" # gpg: Good signature from "Fabiano Rosas <farosas@suse.de>" [unknown] # gpg: aka "Fabiano Almeida Rosas <fabiano.rosas@suse.com>" [unknown] # gpg: WARNING: The key's User ID is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: AA1B 48B0 A223 26A5 A4C3 64CF C798 DC74 1BEC 319D * tag 'migration-20250711-pull-request' of https://gitlab.com/farosas/qemu: (26 commits) migration: Rename save_live_complete_precopy_thread to save_complete_precopy_thread migration/postcopy: Add latency distribution report for blocktime migration/postcopy: blocktime allows track / report non-vCPU faults migration/postcopy: Optimize blocktime fault tracking with hashtable migration/postcopy: Cleanup the total blocktime accounting migration/postcopy: Cache the tid->vcpu mapping for blocktime migration/postcopy: Initialize blocktime context only until listen migration/postcopy: Report fault latencies in blocktime migration/postcopy: Add blocktime fault counts per-vcpu migration/postcopy: Bring blocktime layer to ns level migration/postcopy: Drop PostcopyBlocktimeContext.start_time migration/postcopy: Make all blocktime vars 64bits migration/postcopy: Drop all atomic ops in blocktime feature migration/postcopy: Push blocktime start/end into page req mutex migration: Add option to set postcopy-blocktime migration/postcopy: Avoid clearing dirty bitmap for postcopy too migration: Rewrite the migration complete detect logic migration/ram: Add tracepoints for ram_save_complete() migration/ram: One less indent for ram_find_and_save_block() migration: qemu_savevm_complete*() helpers ... Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2025-07-13Merge tag 'pull-target-arm-20250711' of https://gitlab.com/pm215/qemu into ↵Stefan Hajnoczi23-104/+1770
staging target-arm queue: * New board type max78000fthr * Enable use of CXL on Arm 'virt' board * Some more tidyup of ID register handling * Refactor AT insns and PMU regs into separate source files * Don't enforce NSE,NS check for EL3->EL3 returns * hw/arm/fsl-imx8mp: Wire VIRQ and VFIQ * Allow nested-virtualization with KVM on the 'virt' board * system/qdev: Remove pointless NULL check in qdev_device_add_from_qdict * hw/arm/virt-acpi-build: Don't create ITS id mappings by default * target/arm: Remove unused helper_sme2_luti4_4b # -----BEGIN PGP SIGNATURE----- # # iQJNBAABCAA3FiEE4aXFk81BneKOgxXPPCUl7RQ2DN4FAmhxEcoZHHBldGVyLm1h # eWRlbGxAbGluYXJvLm9yZwAKCRA8JSXtFDYM3j5yEACWYnNeqo8Yph6/EJExE6eV # r0tC6FBb5ShPgA6kDxhpOc1lI6uXGh8+D7bL9BePEdz/brCf1QDfs2Z4q/hb5ysX # D0H6VI5Gr1j6MjkFRBo3+vvYz4Yh++XLn5Q9lZv8zaSEdraq/ay2kxnuhRCK+4Ar # +QoGtKrGMJ7UCpfiRlvNnd1UjgORZf10EE/bRImX13sxeDomP3CZhFzAyJyShOP9 # JA7bAd4rYJ4oj8R33y8Yaxjwm4FOndj740B0zwpO8mpjzFiE5zbqsaO+mEgYSflc # OQisCu/KRFpyIR+UqP+4gNaJLfKQW5Y4r61zEaiJWV/c4RdKNnbK1f7MX11fNhOk # k1paF3GIXp6f794Hb14vtsYnKHF2eeNSmRkAomXxLgUSYzLezL+yj7cdYmRJhgYU # thc1PSiEmHYhjRmOaMC9+dkMtvIexWyDNYNFTygoOE5/kTMSazeTFQpFmw+ZuTee # 9pjKsYRZJgTa64IkJy1L34jc2gds48Q20KpQsqZ22KQcjwt4PW4eQXkvMylawSut # mArHVH6AAxIK+defeEmnQCJ0OccyGCENjRDuWyWMMGoP/ggZpO47rGWmCUOK8xz8 # IfGdPeF/9xsKSKWvjpiHyyKa48wuO2bVC+5bISS6IPA2uGneS2DpmjkHU+gHBqpk # GNlvEnXZfavZOHejE7/L/Q== # =hJ4/ # -----END PGP SIGNATURE----- # gpg: Signature made Fri 11 Jul 2025 09:29:46 EDT # gpg: using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE # gpg: issuer "peter.maydell@linaro.org" # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [full] # gpg: aka "Peter Maydell <pmaydell@gmail.com>" [full] # gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" [full] # gpg: aka "Peter Maydell <peter@archaic.org.uk>" [unknown] # Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83 15CF 3C25 25ED 1436 0CDE * tag 'pull-target-arm-20250711' of https://gitlab.com/pm215/qemu: (36 commits) tests/functional: Add a test for the MAX78000 arm machine docs/system: arm: Add max78000 board description target/arm: Remove helper_sme2_luti4_4b hw/arm/virt-acpi-build: Don't create ITS id mappings by default system/qdev: Remove pointless NULL check in qdev_device_add_from_qdict hw/arm/virt: Allow virt extensions with KVM hw/arm/arm_gicv3_kvm: Add a migration blocker with kvm nested virt target/arm: Enable feature ARM_FEATURE_EL2 if EL2 is supported target/arm/kvm: Add helper to detect EL2 when using KVM hw/arm: Allow setting KVM vGIC maintenance IRQ hw/arm/fsl-imx8mp: Wire VIRQ and VFIQ target/arm: Don't enforce NSE,NS check for EL3->EL3 returns target/arm: Split out performance monitor regs to cpregs-pmu.c target/arm: Split out AT insns to tcg/cpregs-at.c target/arm: Drop stub for define_tlb_insn_regs arm/kvm: shorten one overly long line arm/cpu: store clidr into the idregs array arm/cpu: fix trailing ',' for SET_IDREG arm/cpu: store id_aa64afr{0,1} into the idregs array arm/cpu: store id_afr0 into the idregs array ... Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2025-07-13Merge tag 'pull-request-2025-07-11' of https://gitlab.com/thuth/qemu into ↵Stefan Hajnoczi1-12/+14
staging * s390x: Allow to select different entries when booting via pxelinux.cfg * Link s390-ccw.img statically * Fix broken bamboo functional test * s390x code cleanups and refactorings # -----BEGIN PGP SIGNATURE----- # # iQJFBAABCgAvFiEEJ7iIR+7gJQEY8+q5LtnXdP5wLbUFAmhw2i0RHHRodXRoQHJl # ZGhhdC5jb20ACgkQLtnXdP5wLbUGtA//XVr5t2/iH+zFdaHHFglMtYkqwyYspa/O # zGPgcIZptQrzlbR+GFJwd4ae1HWb60E1YDyC7M1iWGQXeMNrDgeJJjUQfhB7693Y # CPT1FCWaqXdrTHQJhf5+EGJZopwY1K4EHs+bMxCpU3ManD+MKuXzCgOMzZATnPUZ # EcvOrzDBfEFEzQn5COUi5FF5Ds4DpOqQY1g1tpG92hQwWeAgdPPXSYlakG64Hm8C # Km6BzAcylrRiHdORk3GeMJ1cPQ3vCjMrjTd87ra/xuH+DvPeyZ31cRIWIP1dn44x # eog5dWo7pNmwfU50c4w/6dTSqwHG/bD/2ZPJH2nnJDLK02WeguantPN43fdoPU0c # NEMldVE5GAqEr7Sbd5YIw9lBqrROIDfeUAxje4VZa1gSY4N/GYMGEZaM5vqYJJTP # 0ndWP83QdamWuE0eOYMA+4oZiPpW79+Igv/PV13lsm9JgvO0WQisPFxE0cZqMTQp # +wgbQ69rpyMiQxpusiL/6LA3khDyC8Z8g7cmjBfpqgwmVAZp7ly+GLk+ctG0zsjE # hB99hkujZVkBZQLnVs0C/pXn1NdJ0wEupiHOSsVlQtqzNHlbweRJoxuGSp4Rl0Et # 0DnTr3YHB6bdvRazaKzlkBHLLAXKEw0/xaRWGbE4tftZIrkOEeE0LMLLaLWLNKhX # rqRoxq00OPs= # =SOH3 # -----END PGP SIGNATURE----- # gpg: Signature made Fri 11 Jul 2025 05:32:29 EDT # gpg: using RSA key 27B88847EEE0250118F3EAB92ED9D774FE702DB5 # gpg: issuer "thuth@redhat.com" # gpg: Good signature from "Thomas Huth <th.huth@gmx.de>" [full] # gpg: aka "Thomas Huth <thuth@redhat.com>" [full] # gpg: aka "Thomas Huth <huth@tuxfamily.org>" [full] # gpg: aka "Thomas Huth <th.huth@posteo.de>" [unknown] # Primary key fingerprint: 27B8 8847 EEE0 2501 18F3 EAB9 2ED9 D774 FE70 2DB5 * tag 'pull-request-2025-07-11' of https://gitlab.com/thuth/qemu: target/s390x: Have s390_cpu_halt() not return anything target/s390x: Expose s390_count_running_cpus() method target/s390x: Remove unused s390_cpu_[un]halt() user stubs tests/functional/test_ppc_bamboo: Replace broken link with working assets tests/functional: Add dependency to the keymap_targets pc-bios: Update the s390 bios images with the pxelinux.cfg loadparm changes pc-bios/s390-ccw: link statically tests/functional: Add a test for s390x pxelinux.cfg network booting pc-bios/s390-ccw: Add a boot menu for booting via pxelinux.cfg pc-bios/s390-ccw: Make get_boot_index() from menu.c global pc-bios/s390-ccw: Allow up to 31 entries for pxelinux.cfg pc-bios/s390-ccw: Allow to select a different pxelinux.cfg entry via loadparm hw/s390x/s390-pci-bus.c: Use g_assert_not_reached() in functions taking an ett target/s390x/tcg: Use vaddr in s390_probe_access() target/s390x/kvm: Use vaddr in find/insert_hw_breakpoint() Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2025-07-12i386/cpu: Add x-vendor-cpuid-only-v2 option for compatibilityZhao Liu1-0/+1
Add a compat property "x-vendor-cpuid-only-v2" (for PC machine v10.0 and older) to keep the original behavior. This property will be used to adjust vendor specific CPUID fields. Make x-vendor-cpuid-only-v2 depend on x-vendor-cpuid-only. Although x-vendor-cpuid-only and v2 should be initernal only, QEMU doesn't support "internal" property. To avoid any other unexpected issues, check the dependency. Tested-by: Yi Lai <yi1.lai@intel.com> Signed-off-by: Zhao Liu <zhao1.liu@intel.com> Link: https://lore.kernel.org/r/20250711102143.1622339-8-zhao1.liu@intel.com Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2025-07-12i386/cpu: Present same cache model in CPUID 0x2 & 0x4Zhao Liu1-1/+3
For a long time, the default cache models used in CPUID 0x2 and 0x4 were inconsistent and had a FIXME note from Eduardo at commit 5e891bf8fd50 ("target-i386: Use #defines instead of magic numbers for CPUID cache info"): "/*FIXME: CPUID leaf 2 descriptor is inconsistent with CPUID leaf 4 */". This difference is wrong, in principle, both 0x2 and 0x4 are used for Intel's cache description. 0x2 leaf is used for ancient machines while 0x4 leaf is a subsequent addition, and both should be based on the same cache model. Furthermore, on real hardware, 0x4 leaf should be used in preference to 0x2 when it is available. Revisiting the git history, that difference occurred much earlier. Current legacy_l2_cache_cpuid2 (hardcode: "0x2c307d"), which is used for CPUID 0x2 leaf, is introduced in commit d8134d91d9b7 ("Intel cache info, by Filip Navara."). Its commit message didn't said anything, but its patch [1] mentioned the cache model chosen is "closest to the ones reported in the AMD registers". Now it is not possible to check which AMD generation this cache model is based on (unfortunately, AMD does not use 0x2 leaf), but at least it is close to the Pentium 4. In fact, the patch description of commit d8134d91d9b7 is also a bit wrong, the original cache model in leaf 2 is from Pentium Pro, and its cache descriptor had specified the cache line size ad 32 byte by default, while the updated cache model in commit d8134d91d9b7 has 64 byte line size. But after so many years, such judgments are no longer meaningful. On the other hand, for legacy_l2_cache, which is used in CPUID 0x4 leaf, is based on Intel Core Duo (patch [2]) and Core2 Duo (commit e737b32a3688 ("Core 2 Duo specification (Alexander Graf).") The patches of Core Duo and Core 2 Duo add the cache model for CPUID 0x4, but did not update CPUID 0x2 encoding. This is the reason that Intel Guests use two cache models in 0x2 and 0x4 all the time. Of course, while no Core Duo or Core 2 Duo machines have been found for double checking, this still makes no sense to encode different cache models on a single machine. Referring to the SDM and the real hardware available, 0x2 leaf can be directly encoded 0xFF to instruct software to go to 0x4 leaf to get the cache information, when 0x4 is available. Therefore, it's time to clean up Intel's default cache models. As the first step, add "x-consistent-cache" compat option to allow newer machines (v10.1 and newer) to have the consistent cache model in CPUID 0x2 and 0x4 leaves. This doesn't affect the CPU models with CPUID level < 4 ("486", "pentium", "pentium2" and "pentium3"), because they have already had the special default cache model - legacy_intel_cpuid2_cache_info. [1]: https://lore.kernel.org/qemu-devel/5b31733c0709081227w3e5f1036odbc649edfdc8c79b@mail.gmail.com/ [2]: https://lore.kernel.org/qemu-devel/478B65C8.2080602@csgraf.de/ Cc: Alexander Graf <agraf@csgraf.de> Tested-by: Yi Lai <yi1.lai@intel.com> Signed-off-by: Zhao Liu <zhao1.liu@intel.com> Link: https://lore.kernel.org/r/20250711102143.1622339-5-zhao1.liu@intel.com Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
generated by cgit v1.1 at 2025-09-18 23:53:51 +0000