msix_init() and msix_init_exclusive_bar() take an "unsigned short"
argument for the number of MSI-X vectors to try to use. This is big
enough for the maximum permitted number of vectors, which is 2048.
Unfortunately, we have several devices (most notably virtio) which
allow the user to specify the desired number of vectors, and which
use uint32_t properties for this. If the user sets the property to a
value that is too big for a uint16_t, the value will be truncated
when it is passed to msix_init(), and msix_init() may then return
success if the truncated value is a valid one.
The resulting mismatch between the number of vectors the msix code
thinks the device has and the number of vectors the device itself
thinks it has can cause assertions, such as the one in issue 2631,
where "-device virtio-mouse-pci,vectors=19923041" is interpreted by
msix as "97 vectors" and by the virtio-pci layer as "19923041
vectors"; a guest attempt to access vector 97 thus passes the
virtio-pci bounds checking and hits an essertion in
msix_vector_use().
Avoid this by making msix_init() and its wrapper function
msix_init_exclusive_bar() take the number of vectors as a uint32_t.
The erroneous command line will now produce the warning
qemu-system-i386: -device virtio-mouse-pci,vectors=19923041:
warning: unable to init msix vectors to 19923041
and proceed without crashing. (The virtio device warns and falls
back to not using MSIX, rather than complaining that the option is
not a valid value this is the same as the existing behaviour for
values that are beyond the MSI-X maximum possible value but fit into
a 16-bit integer, like 2049.)
To ensure this doesn't result in potential overflows in calculation
of the BAR size in msix_init_exclusive_bar(), we duplicate the
nentries error-check from msix_init() at the top of
msix_init_exclusive_bar(), so we know nentries is sane before we
start using it.
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2631
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251107131044.1321637-1-peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Adds a new entry VTDPASIDCacheEntry in VTDAddressSpace to cache the pasid
entry and track PASID usage and future PASID tagged DMA address translation
support in vIOMMU.
When guest triggers pasid cache invalidation, QEMU will capture it and
update or invalidate pasid cache.
vIOMMU emulator could figure out the reason by fetching latest guest pasid
entry in memory and compare it with cached PASID entry if it's valid.
Signed-off-by: Yi Liu <yi.l.liu@intel.com>
Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Reviewed-by: Yi Liu <yi.l.liu@intel.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20251017093602.525338-2-zhenzhong.duan@intel.com>
Misc HW patches
- Add RPMB emulation to eMMC model
- Use generic MachineState::fdt field in microvm machine
- Remove dead code in ac97_realize()
# -----BEGIN PGP SIGNATURE-----
#
# iQIzBAABCAAdFiEE+qvnXhKRciHc/Wuy4+MsLN6twN4FAmkLEUMACgkQ4+MsLN6t
# wN4yURAAuiQPYC6rcPbjCI1RZ5iPyrajH1iKW6HSV6nMWHap1vjL8hUnrfDu1GRH
# uCyf8ExMkPWemNJW1WcxMN19Gie/J42PfKv7ggHTVoEQwg70DLmKBUcFBbsPfLy7
# 7NJ9qNnyZANNgBlvywZRPxs3v+3WEgqa6NEjpWqS5ivIEQjW4bxGa6yJ6LmJq1UY
# YpdSuK/9tsdPcDnc0b95cEBOZa7y8tjr8gtxCAraPwY+elaM9EYDwB8Mrg84RWiN
# zeeiCt1PL/Hc9qRiZral2MsWGtfefeOPGCir0jawaYl7UfbLi/0EXvpHJbMTl626
# MjilMlUi23aUbn1cuxygA1NV3sy+yRpZtxrpfJTOhoo7WZUBnn0atcH6GKMH2AM0
# S/thR6c1ArUck8d8ABUBESskmZpZQFPGXLcW+XCi8SOP/HwmtT/0L+OlexQPLAep
# nqu/T/yXer2C4sUHB2iwK7DrF7Dl2bzhdRZhyTEtIYuT4dC0FDVv9bwdgna/xWj3
# Re0HPT5J9o0tzQ2QaGMwPkjepf+LH1z3ntXhgJstr0D5G2wJ8+g1ZlPFKgrvBsCj
# C/YWZ3og31THAIb12exxaF4mHUF4fBrerQHg4E93MPhz1403D+sqJDxOUaC/PRJB
# OWwBCkWsWE8tjLie+1igNWKKB0N4ZTNKTGu0yxXFbcocu9LO6r0=
# =X6wb
# -----END PGP SIGNATURE-----
# gpg: Signature made Wed 05 Nov 2025 09:56:35 AM CET
# gpg: using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE
# gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <f4bug@amsat.org>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: FAAB E75E 1291 7221 DCFD 6BB2 E3E3 2C2C DEAD C0DE
* tag 'hw-misc-20251104' of https://github.com/philmd/qemu:
hw/audio: Remove dead code from ac97_realize
hw/i386/microvm: Use fdt field from MachineState
docs: Add eMMC device model description
scripts: Add helper script to generate eMMC block device images
hw/sd/sdcard: Handle RPMB MAC field
hw/sd/sdcard: Add basic support for RPMB partition
hw/sd/sdcard: Allow user creation of eMMCs
hw/sd/sdcard: Fix size check for backing block image
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
LASI i82596 network driver fixes
As part of the Google Summer of Code 2025 program "Implementing LASI Network
Card and NCR 710 SCSI Controller Device Models" Soumyajyotii Ssarkar fixed
various bugs and enhanced the existing Qemu i82596 network card implementation.
Specifically he added or fixed the following functionality:
- Monitor Mode
- Promiscuous Mode
- Support for linear mode, segmented mode, and flexible memory models
- RX Timer
- Bus Throttle Timers
- Support for Little Endian mode
- Accurate CU and RU transition State
- HP-UX Specific Behavior Support
- Support for Loopback mode
- Self test
- Statistical counters
- VMstate descriptors
- Polling mechanism
- Transmit and Receive functions
# -----BEGIN PGP SIGNATURE-----
#
# iHUEABYKAB0WIQS86RI+GtKfB8BJu973ErUQojoPXwUCaQoaFAAKCRD3ErUQojoP
# X/JLAP4mXjeN9G2F8xXEnCKDPoGFc16eQ/VjZJgh650KEHAO+gD/ZzSEeeoHGpp+
# Kg0/FrKY4u1TpZCq9RYKWjoDTjrzSAc=
# =26cF
# -----END PGP SIGNATURE-----
# gpg: Signature made Tue 04 Nov 2025 04:21:56 PM CET
# gpg: using EDDSA key BCE9123E1AD29F07C049BBDEF712B510A23A0F5F
# gpg: Good signature from "Helge Deller <deller@gmx.de>" [unknown]
# gpg: aka "Helge Deller <deller@kernel.org>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 4544 8228 2CD9 10DB EF3D 25F8 3E5F 3D04 A7A2 4603
# Subkey fingerprint: BCE9 123E 1AD2 9F07 C049 BBDE F712 B510 A23A 0F5F
* tag 'i82596-fixes-pull-request' of https://github.com/hdeller/qemu-hppa:
i82596: Implement enhanced TX/RX with packet queuing and filtering
i82596: Added core infrastructure and helper functions
hw/hppa: Enable LASI i82596 network on 715 machine
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
MachineState already provides an fdt field, remove it from
MicrovmMachineState and use that instead.
This is useful when using the `dumpdtb` option, as QEMU expects the
device tree to be stored in the MachineState struct, otherwise it
will return this error:
qemu-system-x86_64: This machine doesn't have an FDT
Signed-off-by: Luigi Leonardi <leonardi@redhat.com>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251030-fix_microvm-v1-1-f89544a04be3@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
aspeed queue:
* Move Aspeed machine models in separate source files to ease maintenance
# -----BEGIN PGP SIGNATURE-----
#
# iQIzBAABCAAdFiEEoPZlSPBIlev+awtgUaNDx8/77KEFAmkJudUACgkQUaNDx8/7
# 7KFbOA/8CXCx6LMxs0F4ICUsX/HlmSi8n4oeR9bTar+Di/1wJBZsngVXmFIUq+g9
# i28QJiDKKPaGIbFkKfa/Ndd9vybnQNv9zdA7nbvJ/A9kRzIz3bzBtICwa1rUzwcb
# CeIzAAxLpBUHCwC9MDSe0PbCaCr/Fa1AsQrKrflLtbsDPtLdChwrNAJYD0N3Jih9
# Gh94nRQqy6VEv1bn0bUCxMgWbPVMm+ZAblUK0SN9asr2ZFl180Fec7kmHUKKhbUV
# WaNJM3qu7D15ShsrciarNLEgDQQGDKA/FemscAp41J5Ot1qymgBDS02MaNbFkBaZ
# 43xEh2o1a8pM4fELvawJoeCnODF9+EXYMiC6KTy4gk8T06U1d67AqQDgtmaAW9/T
# Mu79tXyYhygW3eFzvenOviPPmZCRPxeU9HerIZtb82EUJ1Os/ztctobZNdamMnue
# QMjUFfi1FUdvvsonx3kMVVCUsV3ZlSD7aAC3BR+tCe7b2hGeFEFXePUVO/HWSJGJ
# 3e92Wp11QKR9iXFK+g9910mPbNz+AMSw5C/GZIQf9TnGID+PrCTFTAaCW0D18Cvo
# A1zr1OZ8gJRz2hDRYVfDzykvWR7Y8IFdEPPeMzK9VAuv+Draiv1pNQ7bkqmf3m39
# rIV/oFOILQVEdnaQdc/q/cqWjSevptL+kt+Le+5qf0kbrJEOJY0=
# =nxN9
# -----END PGP SIGNATURE-----
# gpg: Signature made Tue 04 Nov 2025 09:31:17 AM CET
# gpg: using RSA key A0F66548F04895EBFE6B0B6051A343C7CFFBECA1
# gpg: Good signature from "Cédric Le Goater <clg@redhat.com>" [full]
# gpg: aka "Cédric Le Goater <clg@kaod.org>" [full]
* tag 'pull-aspeed-20251104' of https://github.com/legoater/qemu: (30 commits)
hw/arm/aspeed: Split AST1030 EVB machine into a separate source file for maintainability
hw/arm/aspeed: Rename and export connect_serial_hds_to_uarts() as aspeed_connect_serial_hds_to_uarts()
hw/arm/aspeed: Split AST2700 EVB machine into a separate source file for maintainability
hw/arm/aspeed: Split AST2600 EVB machine into a separate source file for maintainability
hw/arm/aspeed: Split Catalina machine into a separate source file for maintainability
hw/arm/aspeed: Split Rainier machine into a separate source file for maintainability
hw/arm/aspeed: Split GB200NVL machine into a separate source file for maintainability
hw/arm/aspeed: Make aspeed_machine_ast2600_class_emmc_init() a common API for eMMC boot setup
hw/arm/aspeed: Split QCOM DC-SCM V1 machine into a separate source file for maintainability
hw/arm/aspeed: Split QCOM Firework machine into a separate source file for maintainability
hw/arm/aspeed: Split Fuji machine into a separate source file for maintainability
hw/arm/aspeed: Split FBY35 BMC machine into a separate source file for maintainability
hw/arm/aspeed: Split Bletchley machine into a separate source file for maintainability
hw/arm/aspeed: Move ASPEED_RAM_SIZE() macro to common header for reuse
hw/arm/aspeed: Split Palmetto machine into a separate source file for maintainability
hw/arm/aspeed: Split Supermicro X11 machine into a separate source file for maintainability
hw/arm/aspeed: Split Quanta-Q71L machine into a separate source file for maintainability
hw/arm/aspeed: Split AST2500 EVB machine into a separate source file for maintainability
hw/arm/aspeed: Split Supermicro X11SPI machine into a separate file for maintainability
hw/arm/aspeed: Split Romulus machine into a separate source file for maintainability
...
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Enable the i82596 network chip which is included in the LASI
multi I/O chip. Since LASI has different start addresses on
the various machines, always initialize the LASI components
by their offsets.
Tested-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Soumyajyotii Ssarkar <soumyajyotisarkar23@gmail.com>
Signed-off-by: Helge Deller <deller@gmx.de>
The helper function connect_serial_hds_to_uarts() has been renamed to
aspeed_connect_serial_hds_to_uarts() and promoted to a public Aspeed
machine API.
Previously, this function was declared static within aspeed.c and only
used internally. Renaming it with the aspeed_ prefix and exporting its
declaration in aspeed.h makes the function accessible to other Aspeed
machine implementations that need to attach host serial devices to SoC
UARTs.
No functional changes.
Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20251104031325.146374-30-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
This commit exposes the function aspeed_machine_ast2600_class_emmc_init() as
a common API so that other AST2600-based machine implementations can reuse it
to enable the "boot-emmc" property.
Previously, this function was defined as a static helper within aspeed.c,
limiting its visibility to that file. By making it global and declaring it in
aspeed.h, other machine definition files (e.g., for specific AST2600 boards)
can now easily call this API to register eMMC boot configuration support.
No functional changes.
Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20251104031325.146374-24-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
The helper function create_pca9554() has been renamed to
aspeed_create_pca9554() and made globally available.
Previously, the function was declared static inside aspeed.c, restricting
its visibility to that file. As more Aspeed machine implementations
require PCA9554 I2C expander setup, it makes sense to rename it with the
aspeed_ prefix and export its declaration in aspeed.h for shared use.
No functional changes.
Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20251104031325.146374-5-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
The helper function create_pca9552() has been renamed to
aspeed_create_pca9552() and made non-static for reuse by other Aspeed
machine source files. A corresponding prototype is now declared in
aspeed.h.
This allows multiple Aspeed platforms to share PCA9552 I2C LED controller
initialization logic, improving code reuse and reducing duplication.
No functional changes.
Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20251104031325.146374-4-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
The function aspeed_machine_class_init_cpus_defaults() is now made
globally visible so that it can be used by other Aspeed machine C files.
Previously, this function was declared as static, restricting its
visibility to aspeed.c. Since future machine split files will also
need to call this helper to initialize default CPU settings, its
declaration has been moved to the common header aspeed.h and the
static keyword has been removed.
No functional changes.
Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20251104031325.146374-3-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
Aspeed machines will be moved into split C files for better
modularization and future maintenance.
To allow all machine implementations to reuse the same
AspeedMachineState structure, the struct definition is moved
from aspeed.c to the shared header aspeed.h.
This change centralizes the common state structure used across
all Aspeed machine models, reduces redundancy, and simplifies
future refactoring work for new machines.
No functional changes.
Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20251104031325.146374-2-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
Audio clean-ups
# -----BEGIN PGP SIGNATURE-----
#
# iQJQBAABCgA6FiEEh6m9kz+HxgbSdvYt2ujhCXWWnOUFAmkEWqwcHG1hcmNhbmRy
# ZS5sdXJlYXVAcmVkaGF0LmNvbQAKCRDa6OEJdZac5a4RD/49KcP8h/5+QT3nu703
# OL/c/+M0DEZCVikzbj1T+nZNlUZtto/wE1vY0/xxzoyMh/4XbUFI0b/YK8WcQyUx
# ozrWOCi6TquS1QpR62FBmDJ6QDA2KteTF8Zq/owdFj+l7VJ5F5mzcuuFCxLx1EVH
# 7qOIf37Vk4r8jz42CLRTusPGQZLSvS8LbTBP62guauXlVAKVWI8k9macRSqoTBRo
# VrQO3QC/JFSqkB2jGfes8AMU+RWLYPG3ICCf0UYHH/kMik/JEL+1arx7au7oukTb
# 3kp8cxGnuJzBKCvY8SLwQF3YiCotYQIjSkvAQrMYBXalPBjQIIh+vzegcF1D+xZb
# 6KR4kh3oXPHtVCG2AXcxA4IuAi50jYFPn6TgDkRrUAEhsOqOxLo5bmZsqWK7L3/u
# 61jLKSjLRSc+NjhwHN0YVy1ocdsLf2z1LQNHjC1TuxrgI//9fQnOE2gASb8tmJGg
# BlPYp5h6G50IEaACzlZEtudWpKRb/XyflWpHbWte0VUO9dpz/cUvO1P38CpPD1dr
# ohENb8eLn0L23M12tUABV0IoA729phBYh3Eua9uIzEVfuRVfoPCuocx6VxQked91
# SZr7X9G80Nyh5YYiMlrwpN8eDgPtKfW5JwI2wYME6clGLnf/catkqCl/qp4nQeG5
# LPZiFy5Krz+QuSq41DjcSWRD+g==
# =qTgA
# -----END PGP SIGNATURE-----
# gpg: Signature made Fri 31 Oct 2025 07:43:56 AM CET
# gpg: using RSA key 87A9BD933F87C606D276F62DDAE8E10975969CE5
# gpg: issuer "marcandre.lureau@redhat.com"
# gpg: Good signature from "Marc-André Lureau <marcandre.lureau@redhat.com>" [unknown]
# gpg: aka "Marc-André Lureau <marcandre.lureau@gmail.com>" [unknown]
# gpg: WARNING: The key's User ID is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 87A9 BD93 3F87 C606 D276 F62D DAE8 E109 7596 9CE5
* tag 'audio-test-pull-request' of https://gitlab.com/marcandre.lureau/qemu: (36 commits)
audio: deprecate HMP audio commands
audio: Rename @endianness argument as @big_endian for clarity
audio: Remove pointless local variables
audio: drop needless audio_driver "descr" field
audio: move capture API to own header
audio: cleanup, use bool for booleans
audio: remove dependency on spice header
audio: move audio.h under include/qemu/
audio/dbus: use a helper function to set the backend dbus server
audio: remove QEMUSoundCard
audio: rename AudioState -> AudioBackend
audio: move internal APIs to audio_int.h
audio/replay: fix type punning
audio: introduce AUD_set_volume_{in,out}_lr()
audio: remove AUDIO_HOST_ENDIANNESS
audio: remove some needless headers
audio: initialize card_head during object init
audio: register and unregister vmstate with AudioState
audio: keep vmstate handle with AudioState
audio: drop needless error message
...
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
ppc queue for 10.2
* Firmware updates for SLOF, sam460ex u-boot
* Removal of unusable e200 CPUs
* Coverity fixes for fadump
* Other minor fixes, cleanups for pegasos, spapr.
# -----BEGIN PGP SIGNATURE-----
#
# iQIzBAABCAAdFiEEa4EM1tK+EPOIPSFCRUTplPnWj7sFAmkDH0MACgkQRUTplPnW
# j7tRjQ/+JbtHt8v4liav4EXRMvM0b8ASDQZFtltC8cg/vpgy/CbYgqcltQDKC4+F
# NjBwSR4mKMTLX95LQsdFCLZY6FENKCirjpsCvHDxU9Hw/UdsVA12rFd/+lgytrTe
# yvJzyhUAoUMSFgpYGZSRQVV+eMEMgHBZekR2RLXwEeuLf/TOAdG+giCMM92Xs7bz
# petdqCspKvpw8RHjb2nyIh67RQ3zYVisU9/pczoNRytjQHYgllddXRt1/DOdF/Gi
# zREc7qE3biDg5jYgWScByy6EwBBBPqNbvR1GLjMV2rM77785KD9GsIzKCCzg6YQY
# CSN/fy8V4TXVkJn8nY2s3SHvBz3szNSvx/nL8sCyKXol/5Naha5CLN0ykz5VcrIf
# 9gNwifW22lHbAtvbmRY9yuTrao8RoQwEZ/3o8Te3W/U9iCFLnwCmKWb/3GT6i/kw
# yyJlUBuW5WASf5N+G0N7IB5BAwzoQQtd0WXW1ugXAFG+Bd/nkRvVkIf9sPWUxWJ/
# 0Tx+2rPZOFzju8VYO8188wh/zDLuNRTEdfo+L21GMI2OBBEUO2nIiwPTLIMrCT4e
# ycC7Vvyu3IahX9ojIL9g0RhPH4K4JDbQuDnszp9SBGcgJYzwLh5Hb436A30A6qJE
# 7r5FTCiwtG27eMKCeZU3iBGpcj+g4kWIvmYEITsyCl8CxKv5+fs=
# =fzVo
# -----END PGP SIGNATURE-----
# gpg: Signature made Thu 30 Oct 2025 09:18:11 AM CET
# gpg: using RSA key 6B810CD6D2BE10F3883D21424544E994F9D68FBB
# gpg: Good signature from "Harsh Prateek Bora <harsh.prateek.bora@gmail.com>" [undefined]
# gpg: aka "Harsh Prateek Bora <harshpb@linux.ibm.com>" [undefined]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 6B81 0CD6 D2BE 10F3 883D 2142 4544 E994 F9D6 8FBB
* tag 'pull-ppc-for-10.2-d4-20251030' of https://gitlab.com/harshpb/qemu:
hw/ppc/pegasos: Update documentation for pegasos1
hw/ppc/pegasos2: Rename to pegasos
hw/ppc/pegasos2: Add /chosen/stdin node with VOF
hw/ppc: Fix memory leak in get_cpu_state_data()
hw/ppc: Fix missing return on allocation failure
ppc/spapr: Cleanup MSI IRQ number handling
target/ppc: Remove the unusable e200 CPUs
target/ppc/cpu_init: Simplify the setup of the TLBxCFG SPR registers
hw/ppc/sam460ex: Update u-boot-sam460ex
pseries: Update SLOF firmware image to release 20251027
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Various patches related to single binary work:
- Make hw/arm/ common by adding a QOM type to machines to
tag in which binary (32 or 64-bit) they can be used.
Convert the Virt and SBSA-Ref machines.
- Build Xen files once
# -----BEGIN PGP SIGNATURE-----
#
# iQIzBAABCAAdFiEE+qvnXhKRciHc/Wuy4+MsLN6twN4FAmkDbS4ACgkQ4+MsLN6t
# wN7LOQ/9HQSArWumcPtJNjfdKyN4BI+evdJuIsJlGnVirZzAShd/aA3emeVoIQXf
# kb1xAJvbL6IryasuFFrWJjLKAdTk8RgTzbDwSS07dEvNE/fVo22OarBfusrO+/fJ
# 6da3j08gwb0EV9m8eUbTwuRBxIF/tnPzZMzyRwx23b4wRb4jnIsshutHX9/hoZBj
# 8cdCJx284EZgj5gLTmk+jEyPEU+miKpnHWqpxSKZCXg7UfzXH34gOo6IBZIzylZs
# kJqcPXaJHF//ISMQQGzl7k1GNyr1fZZBIuCd7zdOIBntWjb45g/7lEKTGFaVrR5Y
# yqaUsNZNj8z3ESA4y42RUPSYAvjwGh+AKafZiHE6K7Oa/WIjeqfr33GHNSMrDYk1
# UDz4o6/VhA/T7VaQjcd/IG9vYsF3jwjhbXQRa1xXKxhuIC0PzEKxpyWo3mAIEfm8
# 7vw90xx4no29WsUpKi6kyplJ/fq9o3h0kWpd6fYlJQsCtwVZFLT9UeBVIQHrfGec
# xkJx/L1OZFzym8Y4bcj0/V4zRJyvyuKK30+bFvu0fKcNR3uijKUjYcQHYg04fSG9
# PgQtCgHxwdbO8vCwHf0WIVtOhqC0aOgtE10jh9HdLG07Ef5K1JBkE90XX27rCOV3
# rAVo/czNnHpx2j0kRGpyRlz9M/eqOVcz4z3TFzKOFPEEumvz1MM=
# =Ncy4
# -----END PGP SIGNATURE-----
# gpg: Signature made Thu 30 Oct 2025 02:50:38 PM CET
# gpg: using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE
# gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <f4bug@amsat.org>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: FAAB E75E 1291 7221 DCFD 6BB2 E3E3 2C2C DEAD C0DE
* tag 'single-binary-20251030' of https://github.com/philmd/qemu: (23 commits)
hw/riscv: Replace target_ulong uses
hw/xen: Build only once
hw/xen: Replace target_ulong by agnostic target_long_bits()
hw/xen: Use BITS_PER_BYTE & MAKE_64BIT_MASK() in req_size_bits()
hw/arm/meson: Move Xen files to arm_common_ss[]
hw/arm/virt: Build only once
hw/arm/virt-acpi-build: Build only once
hw/arm/virt-acpi-build: Include missing 'cpu.h' header
hw/arm/sbsa-ref: Build only once
hw/arm/sbsa-ref: Include missing 'cpu.h' header
hw/arm/virt: Get default CPU type at runtime
hw/arm/virt: Replace TARGET_AARCH64 -> target_aarch64()
qemu/target_info: Add target_base_arm() helper
qemu/target_info: Add target_aarch64() helper
qemu/target_info: Add target_arm() helper
hw/arm/virt: Check accelerator availability at runtime
hw/arm/virt: Register valid CPU types dynamically
config/target: Implement per-binary TargetInfo structure (ARM, AARCH64)
meson: Prepare to accept per-binary TargetInfo structure implementation
hw/arm: Filter machine types for qemu-system-arm/aarch64 binaries
...
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
There is no clear need for this extra intermediary structure between
the audio backend and its user.
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
All the functions are about "-audio model=" handling, a simpler
way to setup audio. Rename functions/variables to reflect this better.
audio_register_model_with_cb() dropped "pci" from the name, since it
will be generalized next.
deprecated_register_soundhw() was actually not a function to be
removed since it's used for "-audio model=" aliasing.
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Block layer patches
- Expose block limits in monitor and qemu-img info
- Resize: Refresh filter node size when its child was resized
- Support configuring stats-intervals in -device (instead of only -drive)
- luks: Fix QMP x-blockdev-amend crash and image creation with detached-header
- iotests: Several test case fixes
- Code cleanups
# -----BEGIN PGP SIGNATURE-----
#
# iQJFBAABCgAvFiEE3D3rFZqa+V09dFb+fwmycsiPL9YFAmkCAkIRHGt3b2xmQHJl
# ZGhhdC5jb20ACgkQfwmycsiPL9a3bA/+MMS9ocOyEiE4u66XbhQ4KgqxECtD/uzg
# 3lYQJbfVpphizq0QQn1pAno9rpjdWnkwPv9TasAEM/9R/wz/ygjmXM9GyQDvNLoB
# t6dTyWKpsi4lVB7FNPBNQvyz7mHqWQULrhI/mNGLsbiss32SMiE08amjOzSrFSZJ
# zn8TsEzDB218Bv8OBH/eI1mMvZ2gG6+yzPf7znA5nSOtJkG1kGLPInZuRgeN7e7W
# DUl5EeiP3sGZh4pF/IyRc8BNMsvPR7Lk31PrPEXAz+7g0y8dfPukrcR0nY6nwekT
# omPhbIBfDOEKpYdBxheOdh9TkT40Fo2Oc7DIhzY4at3O02BKy60kJSZaqoWj+80L
# A3yJ1K7wgiwqzOw0VaHU56Y5awnD5cculciwHxrfc6OHnG9cotvCSxsU2qr/UMd2
# N/cPhUDKfWcilVoRNy+yYiubQsp2s4amF2uGDn/QjjZx0c3dgfXc9BCNmu9nbAMr
# UsmzZBH9GCpaTajVIsX8RdnaovMTxGr4UFyuSQ2jWYWp3k2BR89jkBpXReGGOYr6
# SuEOOnx/E1duTZUPq1gdSkQm9uGxxq5FSGIWR+rWMdFkZS09HStmq5hcY+Zx0pSg
# JzDaLgPATV65y0VswFVUj6NemmNU983DwKPACwVCpemeBETtVuoU/CydzEPPwiL6
# Kl5ISmjZz3I=
# =v2BI
# -----END PGP SIGNATURE-----
# gpg: Signature made Wed 29 Oct 2025 01:02:10 PM CET
# gpg: using RSA key DC3DEB159A9AF95D3D7456FE7F09B272C88F2FD6
# gpg: issuer "kwolf@redhat.com"
# gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>" [unknown]
# gpg: WARNING: The key's User ID is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: DC3D EB15 9A9A F95D 3D74 56FE 7F09 B272 C88F 2FD6
* tag 'for-upstream' of https://repo.or.cz/qemu/kevin:
qemu-img info: Add cache mode option
qemu-img info: Optionally show block limits
block: Expose block limits for images in QMP
block: Improve comments in BlockLimits
iotests: add test for resizing a 'file' node below a 'raw' node
iotests: add test for resizing a node below filters
block: implement 'resize' callback for child_of_bds class
block: make bdrv_co_parent_cb_resize() a proper IO API function
include/block/block_int-common: document when resize callback is used
MAINTAINERS: Mark VHDX block driver as "Odd Fixes"
block: enable stats-intervals for storage devices
iotests: Adjust fuse-allow-other expected output
iotests: Adjust nbd expected outputs to match current behavior
block/curl.c: Fix CURLOPT_VERBOSE parameter type
block/monitor: Use hmp_handle_error to report error
block: fix luks 'amend' when run in coroutine
block: remove 'detached-header' option from opts after use
tests/qemu-iotests: Mark the 'inactive-node-nbd' as unsupported with -luks
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
This patch extends the existing support we have for NVMe with only DoE
to also add support to SPDM over the NVMe Security Send/Recv commands.
With the new definition of the `spdm-trans` argument, users can specify
`spdm_trans=nvme` or `spdm_trans=doe`. This allows us to select the SPDM
transport respectively. SPDM over the NVMe Security Send/Recv commands
are defined in the DMTF DSP0286.
Signed-off-by: Wilfred Mallawa <wilfred.mallawa@wdc.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Reviewed-by: Klaus Jensen <k.jensen@samsung.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
[k.jensen: fix declaration in case statement; fix quotes in docs]
Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
A machine defined with the DEFINE_MACHINE_ARM() macro will
be available in both qemu-system-arm and qemu-system-aarch64
binaries.
One defined with DEFINE_MACHINE_AARCH64() will only be
available in the qemu-system-aarch64 binary.
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Acked-by: Peter Maydell <peter.maydell@linaro.org>
Message-Id: <20251021205741.57109-4-philmd@linaro.org>
Define the TYPE_TARGET_ARM_MACHINE and TYPE_TARGET_AARCH64_MACHINE
QOM interface names to allow machines to implement them.
Register these interfaces in common code in target_info-qom.c used
by all binaries because QOM interfaces must be registered before
being checked (see next commit with the 'none' machine).
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Acked-by: Peter Maydell <peter.maydell@linaro.org>
Message-Id: <20251021205741.57109-2-philmd@linaro.org>
This patch allows stats-intervals to be used for storage
devices with the -device option. It accepts a list of interval
lengths in JSON format.
It configures and collects the stats in the BlockBackend layer
through the storage device that consumes the BlockBackend.
Signed-off-by: Chandan Somani <csomani@redhat.com>
Message-ID: <20251003220039.1336663-1-csomani@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
* char: rename CharBackend->CharFrontend
* esp: fix esp_cdb_ready() FIFO wraparound limit calculation
* isapc: warn rather than reject modern x86 CPU models
* mshv: fix Coverity issues
* qdev: Change PropertyInfo method print() to return malloc'ed string
* qobject: make refcount atomic
* rcu: make synchronize_rcu() more efficient
* rust: cleanup glib_sys bindings
* rust: Convert bit value to u8 within #[property]
* rust: only leave leaf crates as workspace members
* scripts: clean up meson-buildoptions.py
* scsi: make refcount atomic
* target/i386: Init SMM cpu address space for hotplugged CPUs
# -----BEGIN PGP SIGNATURE-----
#
# iQFIBAABCgAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAmkB3UUUHHBib256aW5p
# QHJlZGhhdC5jb20ACgkQv/vSX3jHroMrRAgAidqHD3mBOEPhcz3Xh5xuJGd+fFnr
# wD5/zi5DPy2ZmPKY/buMv/92R6GKKQwZVJrKKdj2+yXFayp0LZNs+ZXNhOl8+EWT
# uZayJJt1Wx5E8BB31NKDBLSnvIjVnP+0QDN3pn7ihoIYtdy7ziUd2sS955z+42Vx
# ewLwZMfIodSykYfeUsjA7A4GgXtHZWv1bGOZ4qVX/Bgr06efKui3WUaVAkN6i6T+
# WJBn4Wb3fBiHLhmFzdIxB91hZjyP9athOQb5kiTL1g+2uYsuQPSfWRhqfgy3EWGf
# K72bpnxnMSzhjz0YXKz5S5kjpe/3g7OCiPJm0Jf5Aq7KqGyIkUSSdgo59Q==
# =KCqH
# -----END PGP SIGNATURE-----
# gpg: Signature made Wed 29 Oct 2025 10:24:21 AM CET
# gpg: using RSA key F13338574B662389866C7682BFFBD25F78C7AE83
# gpg: issuer "pbonzini@redhat.com"
# gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" [unknown]
# gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" [unknown]
# gpg: WARNING: The key's User ID is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1
# Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83
* tag 'for-upstream' of https://gitlab.com/bonzini/qemu:
rust: migration: allow passing ParentField<> to vmstate_of!
target/i386: clear CPU_INTERRUPT_SIPI for all accelerators
docs/about/deprecated.rst: document isapc deprecation for modern x86 CPU models
hw/i386/isapc.c: warn rather than reject modern x86 CPU models
qdev: Change PropertyInfo method print() to return malloc'ed string
scsi: make SCSIRequest refcount atomic
rust/qemu-macros: Convert bit value to u8 within #[property]
qtest/am53c974-test: add additional test for cmdfifo overflow
esp.c: fix esp_cdb_ready() FIFO wraparound limit calculation
accel/mshv: use return value of handle_pio_str_read
accel/mshv: initialize thread name
char: rename CharBackend->CharFrontend
qobject: make refcount atomic
rust: only leave leaf crates as workspace members
rust: remove useless glib_sys bindings
rcu: Unify force quiescent state
i386/kvm/cpu: Init SMM cpu address space for hotplugged CPUs
scripts: clean up meson-buildoptions.py
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Misc HW patches
Various fixes and cleanups:
- Set FPCR exception flag bits for HPPA non-trapped exceptions
- Convert VirtIONet::vlans from pointer to array
and remove VMSTATE_BUFFER_POINTER_UNSAFE()
- Remove redundant QOM typedef when OBJECT_DECLARE_SIMPLE_TYPE() is used
- Have various QDev / SysBus helpers take a const device argument
- Improve errors when loaders parse images
- Remove IntelIOMMUState::dma_translation leftover
- Remove most target_[u]long uses in hw/riscv/
- Fix DS1225Y MemoryRegion owner
- Simplification refactors on Raven PCI Host Bridge
# -----BEGIN PGP SIGNATURE-----
#
# iQIzBAABCAAdFiEE+qvnXhKRciHc/Wuy4+MsLN6twN4FAmkAdQ8ACgkQ4+MsLN6t
# wN5ochAAihqZQaRpLWeIt+EQMUAdkJwsg8ctLAz9vJE9leZZh10j1Uw2Y0b5EDKy
# k3vwJUz0gDYnbbq33+FNBVv7Iq4bIvyundqX4odi4AOvRysJRBwkVQ+LeUo+Dyh3
# of1eKDX6psJTo4Jy1ooOkkUq0vWpJPrGZYyzR7bsPDgpuqNOfF6+mwMQkYDXa2uw
# vCJIOnzl+IIHxpnT+XVVXJsO05LUzkAru38jkjQZ1BcWj07ggSs70U7jcOhtvkpC
# x0hXcKNj+uHjoupoX8LMOb6M+D06oL6ZyW51++Cnqu/cAvQqP/VQtb7b4AAKj3G9
# yOMFZPyd4IObf7bxC4Zi/TYLYD43DrSppT4eU5zqYrzKSD6v0fdENkhqJuLTiLTa
# cd4nhWJto+EdZBogp+jVW6ekLoC5CMqNT8HiqdGvDLMp45oSmlYPC030l4gBQdo8
# 4SUWLIRZULybObv+uF3heeaemahWIXOFpclCpITcLqa+VkXlboc0JH2PjbETvAQU
# DBxSJ65izr4795rRhX5yoy2aBfiTFlYxIbpwztEzesdnAHw1N6gQ0J3WraxWSjAh
# Y6IzXBAYLjZNTx5pongcuZT3cX7Cn+0zwaK/ajRcZhIvukDL/bT7GK25akcYIgBR
# XS//Ccm79vs85o1zTBVLQzw343Bvtp4LfRLtrXjdLC+06pEixvo=
# =5G1o
# -----END PGP SIGNATURE-----
# gpg: Signature made Tue 28 Oct 2025 08:47:27 AM CET
# gpg: using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE
# gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <f4bug@amsat.org>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: FAAB E75E 1291 7221 DCFD 6BB2 E3E3 2C2C DEAD C0DE
* tag 'hw-misc-20251028' of https://github.com/philmd/qemu: (23 commits)
hw/riscv: Widen OpenSBI dynamic info struct
hw/riscv: Use generic hwaddr for firmware addresses
hw/i386/intel_iommu: Remove an unused state field
nw/nvram/ds1225y: Fix nvram MemoryRegion owner
hw/ppc: Pass error_fatal to load_image_targphys()
hw/core/loader: Pass errp to load_image_targphys_as()
hw/core/loader: add check for zero size in load_image_targphys_as
hw/core/loader: improve error handling in image loading functions
hw/core/loader: capture Error from load_image_targphys
hw/core/loader: Use qemu_open() instead of open() in get_image_size()
hw/int/loongarch: Include missing 'system/memory.h' header
hw/uefi: Include missing 'system/memory.h' header
hw/sysbus: Have various helpers take a const SysBusDevice argument
hw/qdev: Have qdev_get_gpio_out_connector() take const DeviceState arg
hw/pci-host/raven: Simplify PCI bus creation
hw/pci-host/raven: Use DEFINE_TYPES macro
hw/pci-host/raven: Simplify host bridge type declaration
hw/pci-host/raven: Simplify PCI facing part
hw/pci-host/raven: Simplify creating PCI facing part
migration/vmstate: remove VMSTATE_BUFFER_POINTER_UNSAFE macro
...
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
HP-PARISC 715 machine with NCR710 SCSI chip
This series adds a new emulation for a HP PA-RISC 715/64 model,
as descrived here: https://www.openpa.net/systems/hp-9000_715.html.
That machine has no PCI bus and instead uses a "LASI" chip which has built-in
NCR 53c710 SCSI and i82596 network chips. Compared to the other already
emulated machines B160L and C3700, this machine should be able to support older
operating systems like HP-UX 9 as well.
The QEMU project participated in the Google Summer of Code 2025 program by
"Implementing LASI Network Card and NCR 710 SCSI Controller Device Models", and
Soumyajyotii Ssarkar stepped up to develop those drivers.
This patch series includes the code for the NCR710 SCSI controller,
the network code will follow in later patch series.
# -----BEGIN PGP SIGNATURE-----
#
# iHUEABYKAB0WIQS86RI+GtKfB8BJu973ErUQojoPXwUCaP/g8wAKCRD3ErUQojoP
# X1hOAP9WOYVNz7UIpNztQ9p3tUKApALaPR3aaiORMLrjktaDMQD/TIHExaKIKtn6
# iLy+RXzPFdpqmI/cBQx57q8lWzUd2QI=
# =Y7lX
# -----END PGP SIGNATURE-----
# gpg: Signature made Mon 27 Oct 2025 10:15:31 PM CET
# gpg: using EDDSA key BCE9123E1AD29F07C049BBDEF712B510A23A0F5F
# gpg: Good signature from "Helge Deller <deller@gmx.de>" [unknown]
# gpg: aka "Helge Deller <deller@kernel.org>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 4544 8228 2CD9 10DB EF3D 25F8 3E5F 3D04 A7A2 4603
# Subkey fingerprint: BCE9 123E 1AD2 9F07 C049 BBDE F712 B510 A23A 0F5F
* tag 'devel-scsi-ncr710-pull-request' of https://github.com/hdeller/qemu-hppa:
hw/hppa: Add 715 machine type including NCR710 SCSI
hw/hppa: Require SeaBIOS version 19 for 715 machine
hw/hppa: PCI devices depend on availability of PCI bus
hw/hppa: Add NCR 710 SCSI driver to LASI chip Kconfig entry
hw/hppa: Fix interrupt of LASI parallel port
hw/hppa: Fix firmware end address for LASI chip
hw/scsi: Add config option for new ncr710 driver
lasi: Forward LASI SCSI ports to NCR 53c710 driver
ncr710: Add driver for the NCR 53c710 SCSI chip
lasi_ncr710: Add LASI wrapper for NCR 53c710 SCSI chip
target/hppa: Update SeaBIOS-hppa to version 19
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
"system/memory.h" header is indirectly pulled by "hw/sysbus.h".
Include it explicitly to avoid when refactoring the latter:
In file included from ../../hw/intc/loongson_ipi.c:9:
In file included from /Users/philmd/source/qemu/include/hw/intc/loongson_ipi.h:12:
include/hw/intc/loongson_ipi_common.h:37:18: error: field has incomplete type 'MemoryRegion' (aka 'struct MemoryRegion')
37 | MemoryRegion ipi_iocsr_mem;
| ^
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Bibo Mao <maobibo@loongson.cn>
Message-Id: <20251024190416.8803-21-philmd@linaro.org>
"system/memory.h" header is indirectly pulled by "hw/sysbus.h".
Include it explicitly to avoid when refactoring the latter:
include/hw/uefi/var-service.h:50:39: error: field has incomplete type 'MemoryRegion' (aka 'struct MemoryRegion')
50 | MemoryRegion mr;
| ^
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Acked-by: Gerd Hoffmann <kraxel@redhat.com>
Message-Id: <20251024190416.8803-14-philmd@linaro.org>
Matt Borgerson