* [PULL 00/33] virtio,pc,pci: features, fixes
@ 2026-02-22 14:28 Michael S. Tsirkin
2026-02-22 14:28 ` [PULL 01/33] tests/vhost-user-bridge: Move to contrib/vhost-user-bridge/ Michael S. Tsirkin
` (33 more replies)
0 siblings, 34 replies; 39+ messages in thread
From: Michael S. Tsirkin @ 2026-02-22 14:28 UTC (permalink / raw)
To: qemu-devel; +Cc: Peter Maydell
The following changes since commit 07f97d5da04a9f97e273de85c76f5017d8135a6e:
Merge tag 'pull-target-arm-20260219' of https://gitlab.com/pm215/qemu into staging (2026-02-19 10:36:06 +0000)
are available in the Git repository at:
https://git.kernel.org/pub/scm/virt/kvm/mst/qemu.git tags/for_upstream
for you to fetch changes up to 72f663f575ab5e0f31320d7c9f25cc1f086313bd:
vhost: fix vhost_inflight_buffer_pre_load (2026-02-20 13:04:45 -0500)
----------------------------------------------------------------
virtio,pc,pci: features, fixes
cxl:
RAS features
Back-Invalidate
Flit mode
r3.2 spec event updates
FM-API Physical Switch Command Set support
vhost-vdpa: allow GSO for SVQ
misc fixes, cleanups in intel_iommu, vhost, virtio, acpi
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
----------------------------------------------------------------
Akihiko Odaki (1):
virtio-gpu-virgl: Add virtio-gpu-virgl-hostmem-region type
Alexandr Moshkov (1):
vhost: fix vhost_inflight_buffer_pre_load
Arpit Kumar (2):
hw/cxl: Physical Port Info FMAPI - update to current spec and add defines.
hw/cxl: Add Physical Port Control FMAPI Command (Opcode 5102h)
Clément Mathieu--Drif (1):
intel_iommu: Do not report recoverable faults to host
Davidlohr Bueso (4):
hw/cxl: Add support for Maintenance command and Post Package Repair (PPR)
hw/pcie: Support enabling flit mode
hw/cxl: Support type3 HDM-DB
hw/cxl: Remove register special_ops->read()
Eugenio Pérez (1):
net/vhost-vdpa: Whitelist virtio-net GSO for shadow virtqueue
Ira Weiny (1):
hw/cxl: Refactor component register initialization
Jonathan Cameron (4):
tests/bios-tables-test: Excluded CEDT.cxl for BI restriction relaxation.
hw/cxl: Update CXL Fixed Memory Window ACPI description to include Back Invalidate support.
tests/acpi/cxl: Update CEDT.cxl to allow BI in CFWMS
hw/cxl: Get Physical Port State - update for PCIe flit mode
Manos Pitsidianakis (5):
MAINTAINERS: add me as maintainer to virtio-snd
virtio-snd: remove TODO comments
virtio-snd: handle 5.14.6.2 for PCM_INFO properly
virtio-snd: fix max_size bounds check in input cb
virtio-snd: tighten read amount in in_cb
Mohamed Mediouni (1):
tests/data/acpi: disassemble-aml: rename and change interpreter line
Philippe Mathieu-Daudé (1):
hw/virtio: Pass VirtIODevice* to virtio_reset()
Shiju Jose (7):
qapi: cxl: Refactor CXL event injection for common commands arguments
hw/cxl/events: Update for rev3.2 common event record format
hw/cxl/events: Updates for rev3.2 general media event record
hw/cxl/events: Updates for rev3.2 DRAM event record
hw/cxl/events: Updates for rev3.2 memory module event record
hw/cxl/cxl-mailbox-utils: Move declaration of scrub and ECS feature attributes in cmd_features_set_feature()
hw/cxl: Add emulation for memory sparing control feature
Yanfeng Liu (1):
audio/virtio-snd: fix latency calc
Yodel Eldar (3):
tests/vhost-user-bridge: Move to contrib/vhost-user-bridge/
tests/functional/x86_64: Add vhost-user-bridge test
contrib/vhost-user-bridge: Add UDP receive hexdump
MAINTAINERS | 3 +-
contrib/vhost-user-bridge/meson.build | 4 +
.../vhost-user-bridge}/vhost-user-bridge.c | 7 +
docs/system/devices/cxl.rst | 23 +
docs/system/devices/virtio/vhost-user-contrib.rst | 39 ++
hw/acpi/cxl.c | 2 +-
hw/audio/virtio-snd.c | 80 ++-
hw/cxl/cxl-component-utils.c | 214 ++++--
hw/cxl/cxl-events.c | 3 +-
hw/cxl/cxl-mailbox-utils.c | 752 ++++++++++++++++++++-
hw/display/virtio-gpu-virgl.c | 54 +-
hw/i386/intel_iommu.c | 26 +-
hw/mem/cxl_type3.c | 349 +++++++++-
hw/mem/cxl_type3_stubs.c | 41 +-
hw/pci-bridge/cxl_downstream.c | 19 +-
hw/pci-bridge/cxl_root_port.c | 11 +-
hw/pci-bridge/cxl_upstream.c | 19 +-
hw/pci-bridge/pci_expander_bridge.c | 2 +-
hw/pci/pcie.c | 23 +-
hw/virtio/vhost.c | 4 +-
hw/virtio/virtio.c | 3 +-
include/hw/audio/virtio-snd.h | 1 +
include/hw/cxl/cxl_component.h | 87 ++-
include/hw/cxl/cxl_device.h | 156 ++++-
include/hw/cxl/cxl_events.h | 85 ++-
include/hw/cxl/cxl_port.h | 73 ++
include/hw/pci-bridge/cxl_downstream_port.h | 12 +
include/hw/pci-bridge/cxl_upstream_port.h | 3 +
include/hw/pci/pcie.h | 2 +-
include/hw/pci/pcie_port.h | 1 +
include/hw/virtio/virtio.h | 2 +-
meson.build | 1 +
net/vhost-vdpa.c | 1 +
qapi/cxl.json | 186 +++--
.../acpi/{disassemle-aml.sh => disassemble-aml.sh} | 4 +-
tests/data/acpi/rebuild-expected-aml.sh | 2 +-
tests/data/acpi/x86/q35/CEDT.cxl | Bin 184 -> 184 bytes
tests/functional/x86_64/meson.build | 1 +
tests/functional/x86_64/test_vhost_user_bridge.py | 147 ++++
tests/meson.build | 6 -
40 files changed, 2187 insertions(+), 261 deletions(-)
create mode 100644 contrib/vhost-user-bridge/meson.build
rename {tests => contrib/vhost-user-bridge}/vhost-user-bridge.c (98%)
create mode 100644 include/hw/cxl/cxl_port.h
create mode 100644 include/hw/pci-bridge/cxl_downstream_port.h
rename tests/data/acpi/{disassemle-aml.sh => disassemble-aml.sh} (92%)
create mode 100755 tests/functional/x86_64/test_vhost_user_bridge.py
^ permalink raw reply [flat|nested] 39+ messages in thread
* [PULL 01/33] tests/vhost-user-bridge: Move to contrib/vhost-user-bridge/
2026-02-22 14:28 [PULL 00/33] virtio,pc,pci: features, fixes Michael S. Tsirkin
@ 2026-02-22 14:28 ` Michael S. Tsirkin
2026-02-22 14:28 ` [PULL 02/33] tests/functional/x86_64: Add vhost-user-bridge test Michael S. Tsirkin
` (32 subsequent siblings)
33 siblings, 0 replies; 39+ messages in thread
From: Michael S. Tsirkin @ 2026-02-22 14:28 UTC (permalink / raw)
To: qemu-devel
Cc: Peter Maydell, Yodel Eldar, Marc-André Lureau,
Stefano Garzarella, Pierrick Bouvier, Paolo Bonzini,
Daniel P. Berrangé, Philippe Mathieu-Daudé
From: Yodel Eldar <yodel.eldar@yodel.dev>
After the introduction of vhost-user-bridge and libvhost-user, we
formed the convention of placing vhost-user daemons in eponymous subdirs
of contrib/. Follow this convention.
Create a contrib/vhost-user-bridge/ directory and move vhost-user-bridge
into it. Extract its build target definition from tests/meson.build into
the new directory, and include its subdir in the root-level meson.build.
Add a section about it in the "vhost-user daemons in contrib" document.
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Yodel Eldar <yodel.eldar@yodel.dev>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20260129133049.119829-2-yodel.eldar@yodel.dev>
---
contrib/vhost-user-bridge/meson.build | 4 ++
.../vhost-user-bridge}/vhost-user-bridge.c | 0
.../devices/virtio/vhost-user-contrib.rst | 39 +++++++++++++++++++
meson.build | 1 +
tests/meson.build | 6 ---
5 files changed, 44 insertions(+), 6 deletions(-)
create mode 100644 contrib/vhost-user-bridge/meson.build
rename {tests => contrib/vhost-user-bridge}/vhost-user-bridge.c (100%)
diff --git a/contrib/vhost-user-bridge/meson.build b/contrib/vhost-user-bridge/meson.build
new file mode 100644
index 0000000000..aa58c1df20
--- /dev/null
+++ b/contrib/vhost-user-bridge/meson.build
@@ -0,0 +1,4 @@
+if have_tools and have_vhost_user and host_os == 'linux'
+ executable('vhost-user-bridge', files('vhost-user-bridge.c'),
+ dependencies: [qemuutil, vhost_user], install: false)
+endif
diff --git a/tests/vhost-user-bridge.c b/contrib/vhost-user-bridge/vhost-user-bridge.c
similarity index 100%
rename from tests/vhost-user-bridge.c
rename to contrib/vhost-user-bridge/vhost-user-bridge.c
diff --git a/docs/system/devices/virtio/vhost-user-contrib.rst b/docs/system/devices/virtio/vhost-user-contrib.rst
index 48d04d2ade..660d29a700 100644
--- a/docs/system/devices/virtio/vhost-user-contrib.rst
+++ b/docs/system/devices/virtio/vhost-user-contrib.rst
@@ -85,3 +85,42 @@ vhost-user-scsi - SCSI controller
The vhost-user-scsi daemon can proxy iSCSI devices onto a virtualized
SCSI controller.
+
+.. _vhost_user_bridge:
+
+vhost-user-bridge - Network bridge
+==================================
+
+The vhost-user-bridge daemon serves as a development tool for testing real
+internet traffic by providing a networking backend, i.e. server, for the
+vhost-user protocol.
+
+Example
+-------
+For a single QEMU instance that both runs the user-mode net stack (slirp) and
+serves as a vhost-user protocol frontend, i.e. client, simultaneously:
+
+First, start vhost-user-bridge:
+
+::
+
+ $ vhost-user-bridge -u /tmp/vubr.sock \
+ -l 127.0.0.1:4444 \
+ -r 127.0.0.1:5555
+
+Then, invoke QEMU:
+
+::
+
+ $ qemu-system-x86_64 \
+ -m 4G \
+ -object memory-backend-memfd,id=mem0,size=4G,share=on,prealloc=on \
+ -numa node,memdev=mem0 \
+ -chardev socket,id=char0,path=/tmp/vubr.sock \
+ -netdev vhost-user,id=vhost0,chardev=char0,vhostforce=on \
+ -device virtio-net-pci,netdev=vhost0 \
+ -netdev socket,id=udp0,udp=localhost:4444,localaddr=localhost:5555 \
+ -netdev user,id=user0 \
+ -netdev hubport,id=hub0,hubid=0,netdev=udp0 \
+ -netdev hubport,id=hub1,hubid=0,netdev=user0 \
+ ...
diff --git a/meson.build b/meson.build
index 4af32c3e1f..620b2ad903 100644
--- a/meson.build
+++ b/meson.build
@@ -4504,6 +4504,7 @@ if have_tools
if have_vhost_user
subdir('contrib/vhost-user-blk')
+ subdir('contrib/vhost-user-bridge')
subdir('contrib/vhost-user-gpu')
subdir('contrib/vhost-user-input')
subdir('contrib/vhost-user-scsi')
diff --git a/tests/meson.build b/tests/meson.build
index cbe7916241..87861b2857 100644
--- a/tests/meson.build
+++ b/tests/meson.build
@@ -70,12 +70,6 @@ test_deps = {
'test-qht-par': qht_bench,
}
-if have_tools and have_vhost_user and host_os == 'linux'
- executable('vhost-user-bridge',
- sources: files('vhost-user-bridge.c'),
- dependencies: [qemuutil, vhost_user])
-endif
-
subdir('decode')
if 'CONFIG_TCG' in config_all_accel
--
MST
^ permalink raw reply related [flat|nested] 39+ messages in thread
* [PULL 02/33] tests/functional/x86_64: Add vhost-user-bridge test
2026-02-22 14:28 [PULL 00/33] virtio,pc,pci: features, fixes Michael S. Tsirkin
2026-02-22 14:28 ` [PULL 01/33] tests/vhost-user-bridge: Move to contrib/vhost-user-bridge/ Michael S. Tsirkin
@ 2026-02-22 14:28 ` Michael S. Tsirkin
2026-02-22 14:28 ` [PULL 03/33] contrib/vhost-user-bridge: Add UDP receive hexdump Michael S. Tsirkin
` (31 subsequent siblings)
33 siblings, 0 replies; 39+ messages in thread
From: Michael S. Tsirkin @ 2026-02-22 14:28 UTC (permalink / raw)
To: qemu-devel
Cc: Peter Maydell, Yodel Eldar, Cédric Le Goater,
Marc-André Lureau, Thomas Huth, Marc-André Lureau,
Paolo Bonzini, Zhao Liu, Stefano Garzarella
From: Yodel Eldar <yodel.eldar@yodel.dev>
Introduce a functional test of vhost-user-bridge and enter it into
MAINTAINERS under the vhost section.
The test runs vhost-user-bridge as a subprocess, then launches a guest
with four backends: a unix domain socket for vhost-user, a UDP socket, a
user-mode net, and a hubport to hub the UDP and user backends; only the
vhost-user backend is exposed, the rest are deviceless. This
configuration mimics the testing setup described in the initial commit
of vhost-user-bridge in 3595e2eb0a23.
The test creates a scratch file containing a hardcoded UUID on the host
and exposes it to the the guest via the tftp parameter of the user
netdev. After the guest invokes tftp to request the file, the test
verifies the transfer by hashsum.
Similarly, the test creates a file with another hardcoded UUID in the
guest. A call to check_http_download() serves the file to the host via
http, whereupon a check of the file hashsum occurs on the host.
Lastly, add the test to the thorough tests suite in meson.build.
Suggested-by: Cédric Le Goater <clg@redhat.com>
Suggested-by: Marc-André Lureau <marcandre.lureau@gmail.com>
Suggested-by: Michael S. Tsirkin <mst@redhat.com>
Suggested-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Yodel Eldar <yodel.eldar@yodel.dev>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20260129133049.119829-3-yodel.eldar@yodel.dev>
---
MAINTAINERS | 1 +
tests/functional/x86_64/meson.build | 1 +
.../x86_64/test_vhost_user_bridge.py | 147 ++++++++++++++++++
3 files changed, 149 insertions(+)
create mode 100755 tests/functional/x86_64/test_vhost_user_bridge.py
diff --git a/MAINTAINERS b/MAINTAINERS
index e0c481e212..8df82f313e 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -2406,6 +2406,7 @@ F: subprojects/libvhost-user/
F: block/export/vhost-user*
F: util/vhost-user-server.c
F: net/vhost*
+F: tests/functional/x86_64/test_vhost_user_bridge.py
vhost-shadow-virtqueue
R: Eugenio Pérez <eperezma@redhat.com>
diff --git a/tests/functional/x86_64/meson.build b/tests/functional/x86_64/meson.build
index f78eec5e6c..beab4f304b 100644
--- a/tests/functional/x86_64/meson.build
+++ b/tests/functional/x86_64/meson.build
@@ -34,6 +34,7 @@ tests_x86_64_system_thorough = [
'reverse_debug',
'tuxrun',
'vfio_user_client',
+ 'vhost_user_bridge',
'virtio_balloon',
'virtio_gpu',
]
diff --git a/tests/functional/x86_64/test_vhost_user_bridge.py b/tests/functional/x86_64/test_vhost_user_bridge.py
new file mode 100755
index 0000000000..c36c625420
--- /dev/null
+++ b/tests/functional/x86_64/test_vhost_user_bridge.py
@@ -0,0 +1,147 @@
+#!/usr/bin/env python3
+#
+# Copyright (c) 2025 Software Freedom Conservancy, Inc.
+#
+# Author: Yodel Eldar <yodel.eldar@yodel.dev>
+#
+# SPDX-License-Identifier: GPL-2.0-or-later
+"""
+Test vhost-user-bridge (vubr) functionality:
+
+ 1) Run vhost-user-bridge on the host.
+ 2) Launch a guest VM:
+ a) Instantiate a unix domain socket to the vubr-created path
+ b) Instantiate a vhost-user backend on top of that socket
+ c) Map a virtio-net-pci device to the vhost-user backend
+ d) Instantiate a UDP socket backend
+ e) Instantiate a user-mode net backend
+ i) Forward an ephemeral port to port 8080 in-guest with hostfwd=
+ ii) Expose a generated scratch file to the guest with tftp=
+ f) Hub the UDP and user-mode backends.
+ 3) Invoke tftp in the guest to download exported scratch file from the host.
+ 4) Serve a file to the host via http server in the guest.
+"""
+
+import os
+import shutil
+import subprocess
+from qemu_test import Asset, LinuxKernelTest, which
+from qemu_test import exec_command_and_wait_for_pattern
+from qemu_test import is_readable_executable_file
+from qemu_test import wait_for_console_pattern
+from qemu_test.ports import Ports
+
+class VhostUserBridge(LinuxKernelTest):
+
+ ASSET_KERNEL_INITRAMFS = Asset(
+ "https://github.com/yodel/vhost-user-bridge-test/raw/refs/heads/main/bzImage",
+ "8860d7aa59434f483542cdf25b42eacae0d4d4aa7ec923af9589d1ad4703d42b")
+
+ HOST_UUID = "ba4c2e39-627f-487d-ae3b-93cc5d783eb8"
+ HOST_UUID_HSUM = \
+ "d2932e34bf6c17b33e7325140b691e27c191d9ac4dfa550f68c09506facb09b9"
+
+ GUEST_UUID = "143d2b21-fdf0-4c5e-a9ef-f35ebbac8945"
+ GUEST_UUID_HSUM = \
+ "14b64203f5cf2afe520f8be0fdfe630aafc1e85d1301f55a0d1681e68881f3a2"
+
+ def configure_vm(self, ud_socket_path, lport, rport, hostfwd_port, tftpdir):
+ self.require_accelerator("kvm")
+ self.require_netdev("vhost-user")
+ self.require_netdev("socket")
+ self.require_netdev("hubport")
+ self.require_netdev("user")
+ self.require_device("virtio-net-pci")
+ self.set_machine("q35")
+ self.vm.add_args(
+ "-cpu", "host",
+ "-accel", "kvm",
+ "-append", "printk.time=0 console=ttyS0",
+ "-smp", "2",
+ "-m", "128M",
+ "-object", "memory-backend-memfd,id=mem0,"
+ "size=128M,share=on,prealloc=on",
+ "-numa", "node,memdev=mem0",
+ "-chardev", f"socket,id=char0,path={ud_socket_path}",
+ "-netdev", "vhost-user,id=vhost0,chardev=char0,vhostforce=on",
+ "-device", "virtio-net-pci,netdev=vhost0",
+ "-netdev", f"socket,id=udp0,udp=localhost:{lport},"
+ f"localaddr=localhost:{rport}",
+ "-netdev", "hubport,id=hub0,hubid=0,netdev=udp0",
+ "-netdev", f"user,id=user0,tftp={tftpdir},"
+ f"hostfwd=tcp:127.0.0.1:{hostfwd_port}-:8080",
+ "-netdev", "hubport,id=hub1,hubid=0,netdev=user0"
+ )
+
+ def assemble_vubr_args(self, vubr_path, ud_socket_path, lport, rport):
+ vubr_args = []
+
+ if (stdbuf_path := which("stdbuf")) is None:
+ self.log.info("Could not find stdbuf: vhost-user-bridge "
+ "log lines may appear out of order")
+ else:
+ vubr_args += [stdbuf_path, "-o0", "-e0"]
+
+ vubr_args += [vubr_path, "-u", f"{ud_socket_path}",
+ "-l", f"127.0.0.1:{lport}", "-r", f"127.0.0.1:{rport}"]
+
+ return vubr_args
+
+ def test_vhost_user_bridge(self):
+ prompt = "~ # "
+ host_uuid_filename = "vubr-test-uuid.txt"
+ guest_uuid_path = "/tmp/uuid.txt"
+ kernel_path = self.ASSET_KERNEL_INITRAMFS.fetch()
+
+ vubr_path = self.build_file("contrib", "vhost-user-bridge",
+ "vhost-user-bridge")
+ if not is_readable_executable_file(vubr_path):
+ self.skipTest("Could not find a readable and executable "
+ "vhost-user-bridge")
+
+ vubr_log_path = self.log_file("vhost-user-bridge.log")
+ self.log.info("For the vhost-user-bridge application log,"
+ f" see: {vubr_log_path}")
+
+ sock_dir = self.socket_dir()
+ ud_socket_path = os.path.join(sock_dir.name, "vubr-test.sock")
+
+ tftpdir = self.scratch_file("tftp")
+ shutil.rmtree(tftpdir, ignore_errors=True)
+ os.mkdir(tftpdir)
+ host_uuid_path = self.scratch_file("tftp", host_uuid_filename)
+ with open(host_uuid_path, "w", encoding="utf-8") as host_uuid_file:
+ host_uuid_file.write(self.HOST_UUID)
+
+ with Ports() as ports:
+ # pylint: disable=unbalanced-tuple-unpacking
+ lport, rport, hostfwd_port = ports.find_free_ports(3)
+
+ self.configure_vm(ud_socket_path, lport, rport, hostfwd_port,
+ tftpdir)
+
+ vubr_args = self.assemble_vubr_args(vubr_path, ud_socket_path,
+ lport, rport)
+
+ with open(vubr_log_path, "w", encoding="utf-8") as vubr_log, \
+ subprocess.Popen(vubr_args, stdin=subprocess.DEVNULL,
+ stdout=vubr_log,
+ stderr=subprocess.STDOUT) as vubr_proc:
+ self.launch_kernel(kernel_path, wait_for=prompt)
+
+ exec_command_and_wait_for_pattern(self,
+ f"tftp -g -r {host_uuid_filename} 10.0.2.2 ; "
+ f"sha256sum {host_uuid_filename}", self.HOST_UUID_HSUM)
+ wait_for_console_pattern(self, prompt)
+
+ exec_command_and_wait_for_pattern(self,
+ f"echo -n '{self.GUEST_UUID}' > {guest_uuid_path}", prompt)
+ self.check_http_download(guest_uuid_path, self.GUEST_UUID_HSUM)
+ wait_for_console_pattern(self, prompt)
+
+ self.vm.shutdown()
+ vubr_proc.terminate()
+ vubr_proc.wait()
+
+if __name__ == '__main__':
+ LinuxKernelTest.main()
--
MST
^ permalink raw reply related [flat|nested] 39+ messages in thread
* [PULL 03/33] contrib/vhost-user-bridge: Add UDP receive hexdump
2026-02-22 14:28 [PULL 00/33] virtio,pc,pci: features, fixes Michael S. Tsirkin
2026-02-22 14:28 ` [PULL 01/33] tests/vhost-user-bridge: Move to contrib/vhost-user-bridge/ Michael S. Tsirkin
2026-02-22 14:28 ` [PULL 02/33] tests/functional/x86_64: Add vhost-user-bridge test Michael S. Tsirkin
@ 2026-02-22 14:28 ` Michael S. Tsirkin
2026-02-22 14:28 ` [PULL 04/33] audio/virtio-snd: fix latency calc Michael S. Tsirkin
` (30 subsequent siblings)
33 siblings, 0 replies; 39+ messages in thread
From: Michael S. Tsirkin @ 2026-02-22 14:28 UTC (permalink / raw)
To: qemu-devel
Cc: Peter Maydell, Yodel Eldar, Marc-André Lureau,
Stefano Garzarella
From: Yodel Eldar <yodel.eldar@yodel.dev>
vhost-user-bridge debug prints UDP TX hexdumps in its transmit handler,
but does not for receives, even though they are beneficial for testing.
Add an RX hexdump in the receive callback.
To delineate between transmits and receives, also add a debug print
indicating that the program is in the transmit handler.
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Yodel Eldar <yodel.eldar@yodel.dev>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20260129133049.119829-4-yodel.eldar@yodel.dev>
---
contrib/vhost-user-bridge/vhost-user-bridge.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/contrib/vhost-user-bridge/vhost-user-bridge.c b/contrib/vhost-user-bridge/vhost-user-bridge.c
index ce4c3426d3..3f0fd0fa49 100644
--- a/contrib/vhost-user-bridge/vhost-user-bridge.c
+++ b/contrib/vhost-user-bridge/vhost-user-bridge.c
@@ -179,6 +179,9 @@ vubr_handle_tx(VuDev *dev, int qidx)
assert(qidx % 2);
+ DPRINT("\n\n *** IN UDP TRANSMIT HANDLER ***\n\n");
+ DPRINT(" hdrlen = %d\n", hdrlen);
+
for (;;) {
ssize_t ret;
unsigned int out_num;
@@ -333,6 +336,10 @@ vubr_backend_recv_cb(int sock, void *ctx)
};
ret = RETRY_ON_EINTR(recvmsg(vubr->backend_udp_sock, &msg, 0));
+ if (ret > 0 && VHOST_USER_BRIDGE_DEBUG) {
+ iov_hexdump(sg, num, stderr, "RX:", ret);
+ }
+
if (i == 0) {
iov_restore_front(elem->in_sg, sg, hdrlen);
}
--
MST
^ permalink raw reply related [flat|nested] 39+ messages in thread
* [PULL 04/33] audio/virtio-snd: fix latency calc
2026-02-22 14:28 [PULL 00/33] virtio,pc,pci: features, fixes Michael S. Tsirkin
` (2 preceding siblings ...)
2026-02-22 14:28 ` [PULL 03/33] contrib/vhost-user-bridge: Add UDP receive hexdump Michael S. Tsirkin
@ 2026-02-22 14:28 ` Michael S. Tsirkin
2026-02-22 14:28 ` [PULL 05/33] tests/data/acpi: disassemble-aml: rename and change interpreter line Michael S. Tsirkin
` (29 subsequent siblings)
33 siblings, 0 replies; 39+ messages in thread
From: Michael S. Tsirkin @ 2026-02-22 14:28 UTC (permalink / raw)
To: qemu-devel
Cc: Peter Maydell, Yanfeng Liu, Yanfeng Liu, Manos Pitsidianakis,
Gerd Hoffmann
From: Yanfeng Liu <yfliu2008@qq.com>
Media players needs meaningful latency_bytes update but it is
zero now most of the time. This adds stream-wise latency_bytes
calculation so that to improve the situation.
Signed-off-by: Yanfeng Liu <p-liuyanfeng9@xiaomi.com>
Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <tencent_66E8C146EA79CD00E966DEDAEF8CACD97D05@qq.com>
---
hw/audio/virtio-snd.c | 12 +++++++++++-
include/hw/audio/virtio-snd.h | 1 +
2 files changed, 12 insertions(+), 1 deletion(-)
diff --git a/hw/audio/virtio-snd.c b/hw/audio/virtio-snd.c
index 9101560f38..ed0422b45a 100644
--- a/hw/audio/virtio-snd.c
+++ b/hw/audio/virtio-snd.c
@@ -431,6 +431,7 @@ static uint32_t virtio_snd_pcm_prepare(VirtIOSound *s, uint32_t stream_id)
stream->id = stream_id;
stream->pcm = s->pcm;
stream->s = s;
+ stream->latency_bytes = 0;
qemu_mutex_init(&stream->queue_mutex);
QSIMPLEQ_INIT(&stream->queue);
@@ -899,6 +900,7 @@ static void virtio_snd_handle_tx_xfer(VirtIODevice *vdev, VirtQueue *vq)
buffer->vq = vq;
buffer->size = size;
buffer->offset = 0;
+ stream->latency_bytes += size;
QSIMPLEQ_INSERT_TAIL(&stream->queue, buffer, entry);
}
@@ -1112,12 +1114,19 @@ error_cleanup:
virtio_snd_unrealize(dev);
}
+static inline void update_latency(VirtIOSoundPCMStream *s, size_t used)
+{
+ s->latency_bytes = s->latency_bytes > used ?
+ s->latency_bytes - used : 0;
+}
+
static inline void return_tx_buffer(VirtIOSoundPCMStream *stream,
VirtIOSoundPCMBuffer *buffer)
{
virtio_snd_pcm_status resp = { 0 };
resp.status = cpu_to_le32(VIRTIO_SND_S_OK);
- resp.latency_bytes = cpu_to_le32((uint32_t)buffer->size);
+ update_latency(stream, buffer->size);
+ resp.latency_bytes = cpu_to_le32(stream->latency_bytes);
iov_from_buf(buffer->elem->in_sg,
buffer->elem->in_num,
0,
@@ -1178,6 +1187,7 @@ static void virtio_snd_pcm_out_cb(void *data, int available)
buffer->size -= size;
buffer->offset += size;
available -= size;
+ update_latency(stream, size);
if (buffer->size < 1) {
return_tx_buffer(stream, buffer);
break;
diff --git a/include/hw/audio/virtio-snd.h b/include/hw/audio/virtio-snd.h
index c176066584..9560bac8b1 100644
--- a/include/hw/audio/virtio-snd.h
+++ b/include/hw/audio/virtio-snd.h
@@ -150,6 +150,7 @@ struct VirtIOSoundPCMStream {
} voice;
QemuMutex queue_mutex;
bool active;
+ uint32_t latency_bytes;
QSIMPLEQ_HEAD(, VirtIOSoundPCMBuffer) queue;
};
--
MST
^ permalink raw reply related [flat|nested] 39+ messages in thread
* [PULL 05/33] tests/data/acpi: disassemble-aml: rename and change interpreter line
2026-02-22 14:28 [PULL 00/33] virtio,pc,pci: features, fixes Michael S. Tsirkin
` (3 preceding siblings ...)
2026-02-22 14:28 ` [PULL 04/33] audio/virtio-snd: fix latency calc Michael S. Tsirkin
@ 2026-02-22 14:28 ` Michael S. Tsirkin
2026-02-22 14:28 ` [PULL 06/33] hw/virtio: Pass VirtIODevice* to virtio_reset() Michael S. Tsirkin
` (28 subsequent siblings)
33 siblings, 0 replies; 39+ messages in thread
From: Michael S. Tsirkin @ 2026-02-22 14:28 UTC (permalink / raw)
To: qemu-devel; +Cc: Peter Maydell, Mohamed Mediouni, Ani Sinha, Igor Mammedov
From: Mohamed Mediouni <mohamed@unpredictable.fr>
/usr/bin/bash isn't guaranteed to be present. Switch
to /usr/bin/env bash.
Specifically, on Darwin/macOS:
$ which bash
/opt/homebrew/bin/bash
Rename disassemle to disassemble in the same commit (typo fix).
Adapt the correponding message in rebuild-expected-aml.
Signed-off-by: Mohamed Mediouni <mohamed@unpredictable.fr>
Reviewed-by: Ani Sinha <anisinha@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20260210041248.14701-1-mohamed@unpredictable.fr>
---
tests/data/acpi/{disassemle-aml.sh => disassemble-aml.sh} | 4 ++--
tests/data/acpi/rebuild-expected-aml.sh | 2 +-
2 files changed, 3 insertions(+), 3 deletions(-)
rename tests/data/acpi/{disassemle-aml.sh => disassemble-aml.sh} (92%)
diff --git a/tests/data/acpi/disassemle-aml.sh b/tests/data/acpi/disassemble-aml.sh
similarity index 92%
rename from tests/data/acpi/disassemle-aml.sh
rename to tests/data/acpi/disassemble-aml.sh
index 89561d233d..62e1991ace 100755
--- a/tests/data/acpi/disassemle-aml.sh
+++ b/tests/data/acpi/disassemble-aml.sh
@@ -1,4 +1,4 @@
-#!/usr/bin/bash
+#!/usr/bin/env bash
outdir=
while getopts "o:" arg; do
@@ -7,7 +7,7 @@ while getopts "o:" arg; do
outdir=$OPTARG
;;
\? )
- echo "Usage: ./tests/data/acpi/disassemle-aml.sh [-o <output-directory>]"
+ echo "Usage: ./tests/data/acpi/disassemble-aml.sh [-o <output-directory>]"
exit 1
;;
diff --git a/tests/data/acpi/rebuild-expected-aml.sh b/tests/data/acpi/rebuild-expected-aml.sh
index cbf9ffe0dd..af45cf3007 100755
--- a/tests/data/acpi/rebuild-expected-aml.sh
+++ b/tests/data/acpi/rebuild-expected-aml.sh
@@ -57,7 +57,7 @@ old_allowed_dif=`grep -v -e 'List of comma-separated changed AML files to ignore
echo '/* List of comma-separated changed AML files to ignore */' > ${SRC_PATH}/tests/qtest/bios-tables-test-allowed-diff.h
echo "The files were rebuilt and can be added to git."
-echo "You can use ${SRC_PATH}/tests/data/acpi/disassemle-aml.sh to disassemble them to ASL."
+echo "You can use ${SRC_PATH}/tests/data/acpi/disassemble-aml.sh to disassemble them to ASL."
if [ -z "$old_allowed_dif" ]; then
echo "Note! Please do not commit expected files with source changes"
--
MST
^ permalink raw reply related [flat|nested] 39+ messages in thread
* [PULL 06/33] hw/virtio: Pass VirtIODevice* to virtio_reset()
2026-02-22 14:28 [PULL 00/33] virtio,pc,pci: features, fixes Michael S. Tsirkin
` (4 preceding siblings ...)
2026-02-22 14:28 ` [PULL 05/33] tests/data/acpi: disassemble-aml: rename and change interpreter line Michael S. Tsirkin
@ 2026-02-22 14:28 ` Michael S. Tsirkin
2026-02-22 14:28 ` [PULL 07/33] qapi: cxl: Refactor CXL event injection for common commands arguments Michael S. Tsirkin
` (27 subsequent siblings)
33 siblings, 0 replies; 39+ messages in thread
From: Michael S. Tsirkin @ 2026-02-22 14:28 UTC (permalink / raw)
To: qemu-devel; +Cc: Peter Maydell, Philippe Mathieu-Daudé
From: Philippe Mathieu-Daudé <philmd@linaro.org>
virtio_reset() expects a VirtIODevice pointer, which
is what the single caller - virtio_bus_reset - passes.
Promote the opaque argument to a plain VirtIODevice.
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20260201223929.78790-1-philmd@linaro.org>
---
hw/virtio/virtio.c | 3 +--
include/hw/virtio/virtio.h | 2 +-
2 files changed, 2 insertions(+), 3 deletions(-)
diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c
index 77ca54e520..e9d5532952 100644
--- a/hw/virtio/virtio.c
+++ b/hw/virtio/virtio.c
@@ -3235,9 +3235,8 @@ int virtio_set_features_ex(VirtIODevice *vdev, const uint64_t *features)
return ret;
}
-void virtio_reset(void *opaque)
+void virtio_reset(VirtIODevice *vdev)
{
- VirtIODevice *vdev = opaque;
VirtioDeviceClass *k = VIRTIO_DEVICE_GET_CLASS(vdev);
uint64_t features[VIRTIO_FEATURES_NU64S];
int i;
diff --git a/include/hw/virtio/virtio.h b/include/hw/virtio/virtio.h
index 27cd98d2fe..fcaa9b03b4 100644
--- a/include/hw/virtio/virtio.h
+++ b/include/hw/virtio/virtio.h
@@ -370,7 +370,7 @@ void virtio_queue_set_vector(VirtIODevice *vdev, int n, uint16_t vector);
int virtio_queue_set_host_notifier_mr(VirtIODevice *vdev, int n,
MemoryRegion *mr, bool assign);
int virtio_set_status(VirtIODevice *vdev, uint8_t val);
-void virtio_reset(void *opaque);
+void virtio_reset(VirtIODevice *vdev);
void virtio_queue_reset(VirtIODevice *vdev, uint32_t queue_index);
void virtio_queue_enable(VirtIODevice *vdev, uint32_t queue_index);
void virtio_update_irq(VirtIODevice *vdev);
--
MST
^ permalink raw reply related [flat|nested] 39+ messages in thread
* [PULL 07/33] qapi: cxl: Refactor CXL event injection for common commands arguments
2026-02-22 14:28 [PULL 00/33] virtio,pc,pci: features, fixes Michael S. Tsirkin
` (5 preceding siblings ...)
2026-02-22 14:28 ` [PULL 06/33] hw/virtio: Pass VirtIODevice* to virtio_reset() Michael S. Tsirkin
@ 2026-02-22 14:28 ` Michael S. Tsirkin
2026-02-22 14:28 ` [PULL 08/33] hw/cxl/events: Update for rev3.2 common event record format Michael S. Tsirkin
` (26 subsequent siblings)
33 siblings, 0 replies; 39+ messages in thread
From: Michael S. Tsirkin @ 2026-02-22 14:28 UTC (permalink / raw)
To: qemu-devel
Cc: Peter Maydell, Shiju Jose, Markus Armbruster, Ravi Jonnalagadda,
Jonathan Cameron, Eric Blake, Fan Ni
From: Shiju Jose <shiju.jose@huawei.com>
Refactor CXL event injection to use struct for common command
arguments.
Suggested-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Shiju Jose <shiju.jose@huawei.com>
Acked-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Ravi Jonnalagadda <ravis.opensrc@gmail.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20260205112350.60681-2-Jonathan.Cameron@huawei.com>
---
qapi/cxl.json | 89 +++++++++++++++++++++++++++++++++------------------
1 file changed, 58 insertions(+), 31 deletions(-)
diff --git a/qapi/cxl.json b/qapi/cxl.json
index eeddb58d1d..55a088586e 100644
--- a/qapi/cxl.json
+++ b/qapi/cxl.json
@@ -31,11 +31,10 @@
}
##
-# @cxl-inject-general-media-event:
+# @CXLCommonEventBase:
#
-# Inject an event record for a General Media Event (CXL r3.0
-# 8.2.9.2.1.1). This event type is reported via one of the event logs
-# specified via the log parameter.
+# Common event base for a CXL Event (CXL r3.0 8.2.9.2.1
+# Table 8-42 Common Event Record Format).
#
# @path: CXL type 3 device canonical QOM path
#
@@ -44,6 +43,16 @@
# @flags: Event Record Flags. See CXL r3.0 Table 8-42 Common Event
# Record Format, Event Record Flags for subfield definitions.
#
+# Since: 8.1
+##
+{ 'struct': 'CXLCommonEventBase',
+ 'data': { 'path': 'str', 'log': 'CxlEventLog', 'flags': 'uint8' } }
+
+##
+# @CXLGeneralMediaEvent:
+#
+# Event record for a General Media Event (CXL r3.0 8.2.9.2.1.1).
+#
# @dpa: Device Physical Address (relative to @path device). Note
# lower bits include some flags. See CXL r3.0 Table 8-43 General
# Media Event Record, Physical Address.
@@ -74,26 +83,29 @@
#
# Since: 8.1
##
-{ 'command': 'cxl-inject-general-media-event',
- 'data': { 'path': 'str', 'log': 'CxlEventLog', 'flags': 'uint8',
- 'dpa': 'uint64', 'descriptor': 'uint8',
+{ 'struct': 'CXLGeneralMediaEvent',
+ 'base': 'CXLCommonEventBase',
+ 'data': { 'dpa': 'uint64', 'descriptor': 'uint8',
'type': 'uint8', 'transaction-type': 'uint8',
'*channel': 'uint8', '*rank': 'uint8',
'*device': 'uint32', '*component-id': 'str' } }
##
-# @cxl-inject-dram-event:
+# @cxl-inject-general-media-event:
#
-# Inject an event record for a DRAM Event (CXL r3.0 8.2.9.2.1.2).
-# This event type is reported via one of the event logs specified via
-# the log parameter.
+# Inject an event record for a General Media Event (CXL r3.0
+# 8.2.9.2.1.1). This event type is reported via one of the event
+# logs specified via the log parameter.
#
-# @path: CXL type 3 device canonical QOM path
+# Since: 8.1
+##
+{ 'command': 'cxl-inject-general-media-event',
+ 'data': 'CXLGeneralMediaEvent' }
+
+##
+# @CXLDRAMEvent:
#
-# @log: Event log to add the event to
-#
-# @flags: Event Record Flags. See CXL r3.0 Table 8-42 Common Event
-# Record Format, Event Record Flags for subfield definitions.
+# Event record for a DRAM Event (CXL r3.0 8.2.9.2.1.2).
#
# @dpa: Device Physical Address (relative to @path device). Note
# lower bits include some flags. See CXL r3.0 Table 8-44 DRAM
@@ -133,9 +145,9 @@
#
# Since: 8.1
##
-{ 'command': 'cxl-inject-dram-event',
- 'data': { 'path': 'str', 'log': 'CxlEventLog', 'flags': 'uint8',
- 'dpa': 'uint64', 'descriptor': 'uint8',
+{ 'struct': 'CXLDRAMEvent',
+ 'base': 'CXLCommonEventBase',
+ 'data': { 'dpa': 'uint64', 'descriptor': 'uint8',
'type': 'uint8', 'transaction-type': 'uint8',
'*channel': 'uint8', '*rank': 'uint8', '*nibble-mask': 'uint32',
'*bank-group': 'uint8', '*bank': 'uint8', '*row': 'uint32',
@@ -143,18 +155,21 @@
}}
##
-# @cxl-inject-memory-module-event:
+# @cxl-inject-dram-event:
#
-# Inject an event record for a Memory Module Event (CXL r3.0
-# 8.2.9.2.1.3). This event includes a copy of the Device Health info
-# at the time of the event.
+# Inject an event record for a DRAM Event (CXL r3.0 8.2.9.2.1.2).
+# This event type is reported via one of the event logs
+# specified via the log parameter.
#
-# @path: CXL type 3 device canonical QOM path
+# Since: 8.1
+##
+{ 'command': 'cxl-inject-dram-event',
+ 'data': 'CXLDRAMEvent' }
+
+##
+# @CXLMemModuleEvent:
#
-# @log: Event Log to add the event to
-#
-# @flags: Event Record Flags. See CXL r3.0 Table 8-42 Common Event
-# Record Format, Event Record Flags for subfield definitions.
+# Event record for a Memory Module Event (CXL r3.0 8.2.9.2.1.3).
#
# @type: Device Event Type. See CXL r3.0 Table 8-45 Memory Module
# Event Record for bit definitions for bit definiions.
@@ -185,9 +200,9 @@
#
# Since: 8.1
##
-{ 'command': 'cxl-inject-memory-module-event',
- 'data': { 'path': 'str', 'log': 'CxlEventLog', 'flags' : 'uint8',
- 'type': 'uint8', 'health-status': 'uint8',
+{ 'struct': 'CXLMemModuleEvent',
+ 'base': 'CXLCommonEventBase',
+ 'data': { 'type': 'uint8', 'health-status': 'uint8',
'media-status': 'uint8', 'additional-status': 'uint8',
'life-used': 'uint8', 'temperature' : 'int16',
'dirty-shutdown-count': 'uint32',
@@ -195,6 +210,18 @@
'corrected-persistent-error-count': 'uint32'
}}
+##
+# @cxl-inject-memory-module-event:
+#
+# Inject an event record for a Memory Module Event (CXL r3.0
+# 8.2.9.2.1.3). This event includes a copy of the Device Health info
+# at the time of the event.
+#
+# Since: 8.1
+##
+{ 'command': 'cxl-inject-memory-module-event',
+ 'data': 'CXLMemModuleEvent' }
+
##
# @cxl-inject-poison:
#
--
MST
^ permalink raw reply related [flat|nested] 39+ messages in thread
* [PULL 08/33] hw/cxl/events: Update for rev3.2 common event record format
2026-02-22 14:28 [PULL 00/33] virtio,pc,pci: features, fixes Michael S. Tsirkin
` (6 preceding siblings ...)
2026-02-22 14:28 ` [PULL 07/33] qapi: cxl: Refactor CXL event injection for common commands arguments Michael S. Tsirkin
@ 2026-02-22 14:28 ` Michael S. Tsirkin
2026-02-22 14:28 ` [PULL 09/33] hw/cxl/events: Updates for rev3.2 general media event record Michael S. Tsirkin
` (25 subsequent siblings)
33 siblings, 0 replies; 39+ messages in thread
From: Michael S. Tsirkin @ 2026-02-22 14:28 UTC (permalink / raw)
To: qemu-devel
Cc: Peter Maydell, Shiju Jose, Markus Armbruster, Ravi Jonnalagadda,
Jonathan Cameron, Fan Ni, Eric Blake
From: Shiju Jose <shiju.jose@huawei.com>
CXL spec 3.2 section 8.2.9.2.1 Table 8-55, Common Event Record
format has updated with optional Maintenance Operation Subclass,
LD ID and ID of the device head information.
Add updates for the above optional parameters in the related
CXL events reporting and in the QMP commands to inject CXL events.
Update all related specification references to CXL r3.2 to ensure
one consistent source.
Signed-off-by: Shiju Jose <shiju.jose@huawei.com>
Acked-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Ravi Jonnalagadda <ravis.opensrc@gmail.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20260205112350.60681-3-Jonathan.Cameron@huawei.com>
---
hw/cxl/cxl-events.c | 3 +-
hw/cxl/cxl-mailbox-utils.c | 3 +-
hw/mem/cxl_type3.c | 70 ++++++++++++++++++++++++++++++++-----
hw/mem/cxl_type3_stubs.c | 24 +++++++++++--
include/hw/cxl/cxl_device.h | 7 +++-
include/hw/cxl/cxl_events.h | 15 ++++++--
qapi/cxl.json | 21 ++++++++---
7 files changed, 122 insertions(+), 21 deletions(-)
diff --git a/hw/cxl/cxl-events.c b/hw/cxl/cxl-events.c
index 7583dd9162..5356dfb5b3 100644
--- a/hw/cxl/cxl-events.c
+++ b/hw/cxl/cxl-events.c
@@ -271,7 +271,8 @@ void cxl_create_dc_event_records_for_extents(CXLType3Dev *ct3d,
&dynamic_capacity_uuid,
(1 << CXL_EVENT_TYPE_INFO),
sizeof(event_rec),
- cxl_device_get_timestamp(&ct3d->cxl_dstate));
+ cxl_device_get_timestamp(&ct3d->cxl_dstate),
+ 0, 0, 0, 0, 0, 0, 0, 0);
event_rec.type = type;
event_rec.validity_flags = 1;
event_rec.host_id = 0;
diff --git a/hw/cxl/cxl-mailbox-utils.c b/hw/cxl/cxl-mailbox-utils.c
index 9b99d44a80..125f417aa4 100644
--- a/hw/cxl/cxl-mailbox-utils.c
+++ b/hw/cxl/cxl-mailbox-utils.c
@@ -3463,7 +3463,8 @@ static CXLRetCode cmd_fm_set_dc_region_config(const struct cxl_cmd *cmd,
&dynamic_capacity_uuid,
(1 << CXL_EVENT_TYPE_INFO),
sizeof(dcEvent),
- cxl_device_get_timestamp(&ct3d->cxl_dstate));
+ cxl_device_get_timestamp(&ct3d->cxl_dstate),
+ 0, 0, 0, 0, 0, 0, 0, 0);
dcEvent.type = DC_EVENT_REGION_CONFIG_UPDATED;
dcEvent.validity_flags = 1;
dcEvent.host_id = 0;
diff --git a/hw/mem/cxl_type3.c b/hw/mem/cxl_type3.c
index 6eb20137a0..371bd4dc6a 100644
--- a/hw/mem/cxl_type3.c
+++ b/hw/mem/cxl_type3.c
@@ -1592,12 +1592,39 @@ void qmp_cxl_inject_correctable_error(const char *path, CxlCorErrorType type,
void cxl_assign_event_header(CXLEventRecordHdr *hdr,
const QemuUUID *uuid, uint32_t flags,
- uint8_t length, uint64_t timestamp)
+ uint8_t length, uint64_t timestamp,
+ bool has_maint_op_class, uint8_t maint_op_class,
+ bool has_maint_op_subclass,
+ uint8_t maint_op_subclass,
+ bool has_ld_id, uint16_t ld_id,
+ bool has_head_id, uint8_t head_id)
{
- st24_le_p(&hdr->flags, flags);
hdr->length = length;
memcpy(&hdr->id, uuid, sizeof(hdr->id));
stq_le_p(&hdr->timestamp, timestamp);
+
+ if (has_maint_op_class) {
+ hdr->maint_op_class = maint_op_class;
+ } else {
+ hdr->maint_op_class = 0;
+ }
+
+ if (has_maint_op_subclass) {
+ flags |= CXL_EVENT_REC_FLAGS_MAINT_OP_SUBCLASS_VALID;
+ hdr->maint_op_subclass = maint_op_subclass;
+ }
+
+ if (has_ld_id) {
+ flags |= CXL_EVENT_REC_FLAGS_LD_ID_VALID;
+ stw_le_p(&hdr->ld_id, ld_id);
+ }
+
+ if (has_head_id) {
+ flags |= CXL_EVENT_REC_FLAGS_HEAD_ID_VALID;
+ hdr->head_id = head_id;
+ }
+
+ st24_le_p(&hdr->flags, flags);
}
static const QemuUUID gen_media_uuid = {
@@ -1637,7 +1664,13 @@ static int ct3d_qmp_cxl_event_log_enc(CxlEventLog log)
}
/* Component ID is device specific. Define this as a string. */
void qmp_cxl_inject_general_media_event(const char *path, CxlEventLog log,
- uint8_t flags, uint64_t dpa,
+ uint32_t flags, bool has_maint_op_class,
+ uint8_t maint_op_class,
+ bool has_maint_op_subclass,
+ uint8_t maint_op_subclass,
+ bool has_ld_id, uint16_t ld_id,
+ bool has_head_id, uint8_t head_id,
+ uint64_t dpa,
uint8_t descriptor, uint8_t type,
uint8_t transaction_type,
bool has_channel, uint8_t channel,
@@ -1675,7 +1708,10 @@ void qmp_cxl_inject_general_media_event(const char *path, CxlEventLog log,
memset(&gem, 0, sizeof(gem));
cxl_assign_event_header(hdr, &gen_media_uuid, flags, sizeof(gem),
- cxl_device_get_timestamp(&ct3d->cxl_dstate));
+ cxl_device_get_timestamp(&ct3d->cxl_dstate),
+ has_maint_op_class, maint_op_class,
+ has_maint_op_subclass, maint_op_subclass,
+ has_ld_id, ld_id, has_head_id, head_id);
stq_le_p(&gem.phys_addr, dpa);
gem.descriptor = descriptor;
@@ -1719,7 +1755,13 @@ void qmp_cxl_inject_general_media_event(const char *path, CxlEventLog log,
#define CXL_DRAM_VALID_COLUMN BIT(6)
#define CXL_DRAM_VALID_CORRECTION_MASK BIT(7)
-void qmp_cxl_inject_dram_event(const char *path, CxlEventLog log, uint8_t flags,
+void qmp_cxl_inject_dram_event(const char *path, CxlEventLog log,
+ uint32_t flags,
+ bool has_maint_op_class, uint8_t maint_op_class,
+ bool has_maint_op_subclass,
+ uint8_t maint_op_subclass,
+ bool has_ld_id, uint16_t ld_id,
+ bool has_head_id, uint8_t head_id,
uint64_t dpa, uint8_t descriptor,
uint8_t type, uint8_t transaction_type,
bool has_channel, uint8_t channel,
@@ -1762,7 +1804,10 @@ void qmp_cxl_inject_dram_event(const char *path, CxlEventLog log, uint8_t flags,
memset(&dram, 0, sizeof(dram));
cxl_assign_event_header(hdr, &dram_uuid, flags, sizeof(dram),
- cxl_device_get_timestamp(&ct3d->cxl_dstate));
+ cxl_device_get_timestamp(&ct3d->cxl_dstate),
+ has_maint_op_class, maint_op_class,
+ has_maint_op_subclass, maint_op_subclass,
+ has_ld_id, ld_id, has_head_id, head_id);
stq_le_p(&dram.phys_addr, dpa);
dram.descriptor = descriptor;
dram.type = type;
@@ -1822,7 +1867,13 @@ void qmp_cxl_inject_dram_event(const char *path, CxlEventLog log, uint8_t flags,
}
void qmp_cxl_inject_memory_module_event(const char *path, CxlEventLog log,
- uint8_t flags, uint8_t type,
+ uint32_t flags, bool has_maint_op_class,
+ uint8_t maint_op_class,
+ bool has_maint_op_subclass,
+ uint8_t maint_op_subclass,
+ bool has_ld_id, uint16_t ld_id,
+ bool has_head_id, uint8_t head_id,
+ uint8_t type,
uint8_t health_status,
uint8_t media_status,
uint8_t additional_status,
@@ -1861,7 +1912,10 @@ void qmp_cxl_inject_memory_module_event(const char *path, CxlEventLog log,
memset(&module, 0, sizeof(module));
cxl_assign_event_header(hdr, &memory_module_uuid, flags, sizeof(module),
- cxl_device_get_timestamp(&ct3d->cxl_dstate));
+ cxl_device_get_timestamp(&ct3d->cxl_dstate),
+ has_maint_op_class, maint_op_class,
+ has_maint_op_subclass, maint_op_subclass,
+ has_ld_id, ld_id, has_head_id, head_id);
module.type = type;
module.health_status = health_status;
diff --git a/hw/mem/cxl_type3_stubs.c b/hw/mem/cxl_type3_stubs.c
index c1a5e4a7c1..91b1478114 100644
--- a/hw/mem/cxl_type3_stubs.c
+++ b/hw/mem/cxl_type3_stubs.c
@@ -14,7 +14,13 @@
#include "qapi/qapi-commands-cxl.h"
void qmp_cxl_inject_general_media_event(const char *path, CxlEventLog log,
- uint8_t flags, uint64_t dpa,
+ uint32_t flags, bool has_maint_op_class,
+ uint8_t maint_op_class,
+ bool has_maint_op_subclass,
+ uint8_t maint_op_subclass,
+ bool has_ld_id, uint16_t ld_id,
+ bool has_head_id, uint8_t head_id,
+ uint64_t dpa,
uint8_t descriptor, uint8_t type,
uint8_t transaction_type,
bool has_channel, uint8_t channel,
@@ -23,7 +29,13 @@ void qmp_cxl_inject_general_media_event(const char *path, CxlEventLog log,
const char *component_id,
Error **errp) {}
-void qmp_cxl_inject_dram_event(const char *path, CxlEventLog log, uint8_t flags,
+void qmp_cxl_inject_dram_event(const char *path, CxlEventLog log,
+ uint32_t flags,
+ bool has_maint_op_class, uint8_t maint_op_class,
+ bool has_maint_op_subclass,
+ uint8_t maint_op_subclass,
+ bool has_ld_id, uint16_t ld_id,
+ bool has_head_id, uint8_t head_id,
uint64_t dpa, uint8_t descriptor,
uint8_t type, uint8_t transaction_type,
bool has_channel, uint8_t channel,
@@ -38,7 +50,13 @@ void qmp_cxl_inject_dram_event(const char *path, CxlEventLog log, uint8_t flags,
Error **errp) {}
void qmp_cxl_inject_memory_module_event(const char *path, CxlEventLog log,
- uint8_t flags, uint8_t type,
+ uint32_t flags, bool has_maint_op_class,
+ uint8_t maint_op_class,
+ bool has_maint_op_subclass,
+ uint8_t maint_op_subclass,
+ bool has_ld_id, uint16_t ld_id,
+ bool has_head_id, uint8_t head_id,
+ uint8_t type,
uint8_t health_status,
uint8_t media_status,
uint8_t additional_status,
diff --git a/include/hw/cxl/cxl_device.h b/include/hw/cxl/cxl_device.h
index 165355baf9..e461a824b6 100644
--- a/include/hw/cxl/cxl_device.h
+++ b/include/hw/cxl/cxl_device.h
@@ -723,7 +723,12 @@ bool ct3_test_region_block_backed(CXLType3Dev *ct3d, uint64_t dpa,
uint64_t len);
void cxl_assign_event_header(CXLEventRecordHdr *hdr,
const QemuUUID *uuid, uint32_t flags,
- uint8_t length, uint64_t timestamp);
+ uint8_t length, uint64_t timestamp,
+ bool has_maint_op_class, uint8_t maint_op_class,
+ bool has_maint_op_subclass,
+ uint8_t maint_op_subclass,
+ bool has_ld_id, uint16_t ld_id,
+ bool has_head_id, uint8_t head_id);
void cxl_create_dc_event_records_for_extents(CXLType3Dev *ct3d,
CXLDCEventType type,
CXLDCExtentRaw extents[],
diff --git a/include/hw/cxl/cxl_events.h b/include/hw/cxl/cxl_events.h
index 758b075a64..4d9cfdb621 100644
--- a/include/hw/cxl/cxl_events.h
+++ b/include/hw/cxl/cxl_events.h
@@ -29,9 +29,15 @@ typedef enum CXLEventLogType {
/*
* Common Event Record Format
- * CXL r3.1 section 8.2.9.2.1: Event Records; Table 8-43
+ * CXL r3.2 section 8.2.10.2.1: Event Records; Table 8-55
*/
-#define CXL_EVENT_REC_HDR_RES_LEN 0xf
+#define CXL_EVENT_REC_FLAGS_PERMANENT_COND BIT(2)
+#define CXL_EVENT_REC_FLAGS_MAINT_NEEDED BIT(3)
+#define CXL_EVENT_REC_FLAGS_PERF_DEGRADED BIT(4)
+#define CXL_EVENT_REC_FLAGS_HW_REPLACEMENT_NEEDED BIT(5)
+#define CXL_EVENT_REC_FLAGS_MAINT_OP_SUBCLASS_VALID BIT(6)
+#define CXL_EVENT_REC_FLAGS_LD_ID_VALID BIT(7)
+#define CXL_EVENT_REC_FLAGS_HEAD_ID_VALID BIT(8)
typedef struct CXLEventRecordHdr {
QemuUUID id;
uint8_t length;
@@ -40,7 +46,10 @@ typedef struct CXLEventRecordHdr {
uint16_t related_handle;
uint64_t timestamp;
uint8_t maint_op_class;
- uint8_t reserved[CXL_EVENT_REC_HDR_RES_LEN];
+ uint8_t maint_op_subclass;
+ uint16_t ld_id;
+ uint8_t head_id;
+ uint8_t reserved[0xb];
} QEMU_PACKED CXLEventRecordHdr;
#define CXL_EVENT_RECORD_DATA_LENGTH 0x50
diff --git a/qapi/cxl.json b/qapi/cxl.json
index 55a088586e..82001c0591 100644
--- a/qapi/cxl.json
+++ b/qapi/cxl.json
@@ -33,20 +33,33 @@
##
# @CXLCommonEventBase:
#
-# Common event base for a CXL Event (CXL r3.0 8.2.9.2.1
-# Table 8-42 Common Event Record Format).
+# Common event base for a CXL Event (CXL r3.2 8.2.10.2.1
+# Table 8-55 Common Event Record Format).
#
# @path: CXL type 3 device canonical QOM path
#
# @log: event log to add the event to
#
-# @flags: Event Record Flags. See CXL r3.0 Table 8-42 Common Event
+# @flags: Event Record Flags. See CXL r3.2 Table 8-55 Common Event
# Record Format, Event Record Flags for subfield definitions.
#
+# @maint-op-class: Maintenance operation class the device requests to
+# initiate.
+#
+# @maint-op-subclass: Maintenance operation subclass the device
+# requests to initiate.
+#
+# @ld-id: Logical Device (LD) ID of LD from where the event
+# originated.
+#
+# @head-id: ID of the device head from where the event originated.
+#
# Since: 8.1
##
{ 'struct': 'CXLCommonEventBase',
- 'data': { 'path': 'str', 'log': 'CxlEventLog', 'flags': 'uint8' } }
+ 'data': { 'path': 'str', 'log': 'CxlEventLog', 'flags': 'uint32',
+ '*maint-op-class':'uint8', '*maint-op-subclass':'uint8',
+ '*ld-id':'uint16', '*head-id':'uint8' } }
##
# @CXLGeneralMediaEvent:
--
MST
^ permalink raw reply related [flat|nested] 39+ messages in thread
* [PULL 09/33] hw/cxl/events: Updates for rev3.2 general media event record
2026-02-22 14:28 [PULL 00/33] virtio,pc,pci: features, fixes Michael S. Tsirkin
` (7 preceding siblings ...)
2026-02-22 14:28 ` [PULL 08/33] hw/cxl/events: Update for rev3.2 common event record format Michael S. Tsirkin
@ 2026-02-22 14:28 ` Michael S. Tsirkin
2026-02-22 14:28 ` [PULL 10/33] hw/cxl/events: Updates for rev3.2 DRAM " Michael S. Tsirkin
` (24 subsequent siblings)
33 siblings, 0 replies; 39+ messages in thread
From: Michael S. Tsirkin @ 2026-02-22 14:28 UTC (permalink / raw)
To: qemu-devel
Cc: Peter Maydell, Shiju Jose, Markus Armbruster, Jonathan Cameron,
Fan Ni, Eric Blake
From: Shiju Jose <shiju.jose@huawei.com>
CXL spec rev3.2 section 8.2.10.2.1.1 Table 8-57, general media event
table has updated with following new fields.
1. Advanced Programmable Corrected Memory Error Threshold Event Flags
2. Corrected Memory Error Count at Event
3. Memory Event Sub-Type
4. Support for component ID in the PLDM format.
Add updates for the above spec changes in the CXL general media event
reporting and QMP command to inject general media event.
In order to have one consistent source of references, update all to
references for this command to CXL r3.2.
Signed-off-by: Shiju Jose <shiju.jose@huawei.com>
Acked-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20260205112350.60681-4-Jonathan.Cameron@huawei.com>
---
hw/mem/cxl_type3.c | 31 ++++++++++++++++++++++++++++++-
hw/mem/cxl_type3_stubs.c | 6 ++++++
include/hw/cxl/cxl_events.h | 7 +++++--
qapi/cxl.json | 29 +++++++++++++++++++++--------
4 files changed, 62 insertions(+), 11 deletions(-)
diff --git a/hw/mem/cxl_type3.c b/hw/mem/cxl_type3.c
index 371bd4dc6a..229be88708 100644
--- a/hw/mem/cxl_type3.c
+++ b/hw/mem/cxl_type3.c
@@ -1646,6 +1646,11 @@ static const QemuUUID memory_module_uuid = {
#define CXL_GMER_VALID_RANK BIT(1)
#define CXL_GMER_VALID_DEVICE BIT(2)
#define CXL_GMER_VALID_COMPONENT BIT(3)
+#define CXL_GMER_VALID_COMPONENT_ID_FORMAT BIT(4)
+
+#define CXL_GMER_EV_DESC_UCE BIT(0)
+#define CXL_GMER_EV_DESC_THRESHOLD_EVENT BIT(1)
+#define CXL_GMER_EV_DESC_POISON_LIST_OVERFLOW_EVENT BIT(2)
static int ct3d_qmp_cxl_event_log_enc(CxlEventLog log)
{
@@ -1677,6 +1682,12 @@ void qmp_cxl_inject_general_media_event(const char *path, CxlEventLog log,
bool has_rank, uint8_t rank,
bool has_device, uint32_t device,
const char *component_id,
+ bool has_comp_id_pldm,
+ bool is_comp_id_pldm,
+ bool has_cme_ev_flags,
+ uint8_t cme_ev_flags,
+ bool has_cme_count, uint32_t cme_count,
+ uint8_t sub_type,
Error **errp)
{
Object *obj = object_resolve_path(path, NULL);
@@ -1714,7 +1725,6 @@ void qmp_cxl_inject_general_media_event(const char *path, CxlEventLog log,
has_ld_id, ld_id, has_head_id, head_id);
stq_le_p(&gem.phys_addr, dpa);
- gem.descriptor = descriptor;
gem.type = type;
gem.transaction_type = transaction_type;
@@ -1737,10 +1747,29 @@ void qmp_cxl_inject_general_media_event(const char *path, CxlEventLog log,
strncpy((char *)gem.component_id, component_id,
sizeof(gem.component_id) - 1);
valid_flags |= CXL_GMER_VALID_COMPONENT;
+ if (has_comp_id_pldm && is_comp_id_pldm) {
+ valid_flags |= CXL_GMER_VALID_COMPONENT_ID_FORMAT;
+ }
}
stw_le_p(&gem.validity_flags, valid_flags);
+ if (has_cme_ev_flags) {
+ gem.cme_ev_flags = cme_ev_flags;
+ } else {
+ gem.cme_ev_flags = 0;
+ }
+
+ if (has_cme_count) {
+ descriptor |= CXL_GMER_EV_DESC_THRESHOLD_EVENT;
+ st24_le_p(gem.cme_count, cme_count);
+ } else {
+ st24_le_p(gem.cme_count, 0);
+ }
+ gem.descriptor = descriptor;
+
+ gem.sub_type = sub_type;
+
if (cxl_event_insert(cxlds, enc_log, (CXLEventRecordRaw *)&gem)) {
cxl_event_irq_assert(ct3d);
}
diff --git a/hw/mem/cxl_type3_stubs.c b/hw/mem/cxl_type3_stubs.c
index 91b1478114..2047e97846 100644
--- a/hw/mem/cxl_type3_stubs.c
+++ b/hw/mem/cxl_type3_stubs.c
@@ -27,6 +27,12 @@ void qmp_cxl_inject_general_media_event(const char *path, CxlEventLog log,
bool has_rank, uint8_t rank,
bool has_device, uint32_t device,
const char *component_id,
+ bool has_comp_id_pldm,
+ bool is_comp_id_pldm,
+ bool has_cme_ev_flags,
+ uint8_t cme_ev_flags,
+ bool has_cme_count, uint32_t cme_count,
+ uint8_t sub_type,
Error **errp) {}
void qmp_cxl_inject_dram_event(const char *path, CxlEventLog log,
diff --git a/include/hw/cxl/cxl_events.h b/include/hw/cxl/cxl_events.h
index 4d9cfdb621..352f9891bd 100644
--- a/include/hw/cxl/cxl_events.h
+++ b/include/hw/cxl/cxl_events.h
@@ -115,10 +115,10 @@ typedef struct CXLEventInterruptPolicy {
/*
* General Media Event Record
- * CXL r3.1 Section 8.2.9.2.1.1; Table 8-45
+ * CXL r3.2 Section 8.2.10.2.1.1; Table 8-57
*/
#define CXL_EVENT_GEN_MED_COMP_ID_SIZE 0x10
-#define CXL_EVENT_GEN_MED_RES_SIZE 0x2e
+#define CXL_EVENT_GEN_MED_RES_SIZE 0x29
typedef struct CXLEventGenMedia {
CXLEventRecordHdr hdr;
uint64_t phys_addr;
@@ -130,6 +130,9 @@ typedef struct CXLEventGenMedia {
uint8_t rank;
uint8_t device[3];
uint8_t component_id[CXL_EVENT_GEN_MED_COMP_ID_SIZE];
+ uint8_t cme_ev_flags;
+ uint8_t cme_count[3];
+ uint8_t sub_type;
uint8_t reserved[CXL_EVENT_GEN_MED_RES_SIZE];
} QEMU_PACKED CXLEventGenMedia;
diff --git a/qapi/cxl.json b/qapi/cxl.json
index 82001c0591..4ff66fc6c1 100644
--- a/qapi/cxl.json
+++ b/qapi/cxl.json
@@ -64,22 +64,22 @@
##
# @CXLGeneralMediaEvent:
#
-# Event record for a General Media Event (CXL r3.0 8.2.9.2.1.1).
+# Event record for a General Media Event (CXL r3.2 8.2.10.2.1.1).
#
# @dpa: Device Physical Address (relative to @path device). Note
-# lower bits include some flags. See CXL r3.0 Table 8-43 General
+# lower bits include some flags. See CXL r3.2 Table 8-57 General
# Media Event Record, Physical Address.
#
# @descriptor: Memory Event Descriptor with additional memory event
-# information. See CXL r3.0 Table 8-43 General Media Event
+# information. See CXL r3.2 Table 8-57 General Media Event
# Record, Memory Event Descriptor for bit definitions.
#
-# @type: Type of memory event that occurred. See CXL r3.0 Table 8-43
+# @type: Type of memory event that occurred. See CXL r3.2 Table 8-57
# General Media Event Record, Memory Event Type for possible
# values.
#
# @transaction-type: Type of first transaction that caused the event
-# to occur. See CXL r3.0 Table 8-43 General Media Event Record,
+# to occur. See CXL r3-2 Table 8-57 General Media Event Record,
# Transaction Type for possible values.
#
# @channel: The channel of the memory event location. A channel is an
@@ -94,6 +94,16 @@
# @component-id: Device specific component identifier for the event.
# May describe a field replaceable sub-component of the device.
#
+# @is-comp-id-pldm: This flag specifies whether the device-specific
+# component identifier format follows PLDM.
+#
+# @cme-ev-flags: Advanced programmable corrected memory error
+# threshold event flags.
+#
+# @cme-count: Corrected memory error count at event.
+#
+# @sub-type: Memory event sub-type.
+#
# Since: 8.1
##
{ 'struct': 'CXLGeneralMediaEvent',
@@ -101,13 +111,16 @@
'data': { 'dpa': 'uint64', 'descriptor': 'uint8',
'type': 'uint8', 'transaction-type': 'uint8',
'*channel': 'uint8', '*rank': 'uint8',
- '*device': 'uint32', '*component-id': 'str' } }
+ '*device': 'uint32', '*component-id': 'str',
+ '*is-comp-id-pldm':'bool',
+ '*cme-ev-flags':'uint8', '*cme-count':'uint32',
+ 'sub-type':'uint8' } }
##
# @cxl-inject-general-media-event:
#
-# Inject an event record for a General Media Event (CXL r3.0
-# 8.2.9.2.1.1). This event type is reported via one of the event
+# Inject an event record for a General Media Event (CXL r3.2
+# 8.2.10.2.1.1). This event type is reported via one of the event
# logs specified via the log parameter.
#
# Since: 8.1
--
MST
^ permalink raw reply related [flat|nested] 39+ messages in thread
* [PULL 10/33] hw/cxl/events: Updates for rev3.2 DRAM event record
2026-02-22 14:28 [PULL 00/33] virtio,pc,pci: features, fixes Michael S. Tsirkin
` (8 preceding siblings ...)
2026-02-22 14:28 ` [PULL 09/33] hw/cxl/events: Updates for rev3.2 general media event record Michael S. Tsirkin
@ 2026-02-22 14:28 ` Michael S. Tsirkin
2026-02-22 14:28 ` [PULL 11/33] hw/cxl/events: Updates for rev3.2 memory module " Michael S. Tsirkin
` (23 subsequent siblings)
33 siblings, 0 replies; 39+ messages in thread
From: Michael S. Tsirkin @ 2026-02-22 14:28 UTC (permalink / raw)
To: qemu-devel
Cc: Peter Maydell, Shiju Jose, Markus Armbruster, Jonathan Cameron,
Fan Ni, Eric Blake
From: Shiju Jose <shiju.jose@huawei.com>
CXL spec rev3.2 section 8.2.10.2.1.2 Table 8-58, DRAM event record
has updated with following new fields.
1. Component Identifier
2. Sub-channel of the memory event location
3. Advanced Programmable Corrected Memory Error Threshold Event Flags
4. Corrected Volatile Memory Error Count at Event
5. Memory Event Sub-Type
Add updates for the above spec changes in the CXL DRAM event
reporting and QMP command to inject DRAM event.
In order to ensure consistency update all specification references
for this command to CXL r3.2.
Signed-off-by: Shiju Jose <shiju.jose@huawei.com>
Acked-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20260205112350.60681-5-Jonathan.Cameron@huawei.com>
---
hw/mem/cxl_type3.c | 44 ++++++++++++++++++++++++++++++++++++-
hw/mem/cxl_type3_stubs.c | 7 ++++++
include/hw/cxl/cxl_events.h | 9 ++++++--
qapi/cxl.json | 33 ++++++++++++++++++++++------
4 files changed, 83 insertions(+), 10 deletions(-)
diff --git a/hw/mem/cxl_type3.c b/hw/mem/cxl_type3.c
index 229be88708..be99d20faf 100644
--- a/hw/mem/cxl_type3.c
+++ b/hw/mem/cxl_type3.c
@@ -1783,6 +1783,13 @@ void qmp_cxl_inject_general_media_event(const char *path, CxlEventLog log,
#define CXL_DRAM_VALID_ROW BIT(5)
#define CXL_DRAM_VALID_COLUMN BIT(6)
#define CXL_DRAM_VALID_CORRECTION_MASK BIT(7)
+#define CXL_DRAM_VALID_COMPONENT BIT(8)
+#define CXL_DRAM_VALID_COMPONENT_ID_FORMAT BIT(9)
+#define CXL_DRAM_VALID_SUB_CHANNEL BIT(10)
+
+#define CXL_DRAM_EV_DESC_UCE BIT(0)
+#define CXL_DRAM_EV_DESC_THRESHOLD_EVENT BIT(1)
+#define CXL_DRAM_EV_DESC_POISON_LIST_OVERFLOW_EVENT BIT(2)
void qmp_cxl_inject_dram_event(const char *path, CxlEventLog log,
uint32_t flags,
@@ -1802,6 +1809,12 @@ void qmp_cxl_inject_dram_event(const char *path, CxlEventLog log,
bool has_column, uint16_t column,
bool has_correction_mask,
uint64List *correction_mask,
+ const char *component_id,
+ bool has_comp_id_pldm, bool is_comp_id_pldm,
+ bool has_sub_channel, uint8_t sub_channel,
+ bool has_cme_ev_flags, uint8_t cme_ev_flags,
+ bool has_cvme_count, uint32_t cvme_count,
+ uint8_t sub_type,
Error **errp)
{
Object *obj = object_resolve_path(path, NULL);
@@ -1838,7 +1851,6 @@ void qmp_cxl_inject_dram_event(const char *path, CxlEventLog log,
has_maint_op_subclass, maint_op_subclass,
has_ld_id, ld_id, has_head_id, head_id);
stq_le_p(&dram.phys_addr, dpa);
- dram.descriptor = descriptor;
dram.type = type;
dram.transaction_type = transaction_type;
@@ -1888,6 +1900,36 @@ void qmp_cxl_inject_dram_event(const char *path, CxlEventLog log,
valid_flags |= CXL_DRAM_VALID_CORRECTION_MASK;
}
+ if (component_id) {
+ strncpy((char *)dram.component_id, component_id,
+ sizeof(dram.component_id) - 1);
+ valid_flags |= CXL_DRAM_VALID_COMPONENT;
+ if (has_comp_id_pldm && is_comp_id_pldm) {
+ valid_flags |= CXL_DRAM_VALID_COMPONENT_ID_FORMAT;
+ }
+ }
+
+ if (has_sub_channel) {
+ dram.sub_channel = sub_channel;
+ valid_flags |= CXL_DRAM_VALID_SUB_CHANNEL;
+ }
+
+ if (has_cme_ev_flags) {
+ dram.cme_ev_flags = cme_ev_flags;
+ } else {
+ dram.cme_ev_flags = 0;
+ }
+
+ if (has_cvme_count) {
+ descriptor |= CXL_DRAM_EV_DESC_THRESHOLD_EVENT;
+ st24_le_p(dram.cvme_count, cvme_count);
+ } else {
+ st24_le_p(dram.cvme_count, 0);
+ }
+ dram.descriptor = descriptor;
+
+ dram.sub_type = sub_type;
+
stw_le_p(&dram.validity_flags, valid_flags);
if (cxl_event_insert(cxlds, enc_log, (CXLEventRecordRaw *)&dram)) {
diff --git a/hw/mem/cxl_type3_stubs.c b/hw/mem/cxl_type3_stubs.c
index 2047e97846..231dda263f 100644
--- a/hw/mem/cxl_type3_stubs.c
+++ b/hw/mem/cxl_type3_stubs.c
@@ -53,6 +53,13 @@ void qmp_cxl_inject_dram_event(const char *path, CxlEventLog log,
bool has_column, uint16_t column,
bool has_correction_mask,
uint64List *correction_mask,
+ const char *component_id,
+ bool has_comp_id_pldm,
+ bool is_comp_id_pldm,
+ bool has_sub_channel, uint8_t sub_channel,
+ bool has_cme_ev_flags, uint8_t cme_ev_flags,
+ bool has_cvme_count, uint32_t cvme_count,
+ uint8_t sub_type,
Error **errp) {}
void qmp_cxl_inject_memory_module_event(const char *path, CxlEventLog log,
diff --git a/include/hw/cxl/cxl_events.h b/include/hw/cxl/cxl_events.h
index 352f9891bd..a3c5f2ec20 100644
--- a/include/hw/cxl/cxl_events.h
+++ b/include/hw/cxl/cxl_events.h
@@ -138,7 +138,7 @@ typedef struct CXLEventGenMedia {
/*
* DRAM Event Record
- * CXL r3.1 Section 8.2.9.2.1.2: Table 8-46
+ * CXL r3.2 Section 8.2.10.2.1.2: Table 8-58
* All fields little endian.
*/
typedef struct CXLEventDram {
@@ -156,7 +156,12 @@ typedef struct CXLEventDram {
uint8_t row[3];
uint16_t column;
uint64_t correction_mask[4];
- uint8_t reserved[0x17];
+ uint8_t component_id[CXL_EVENT_GEN_MED_COMP_ID_SIZE];
+ uint8_t sub_channel;
+ uint8_t cme_ev_flags;
+ uint8_t cvme_count[3];
+ uint8_t sub_type;
+ uint8_t reserved;
} QEMU_PACKED CXLEventDram;
/*
diff --git a/qapi/cxl.json b/qapi/cxl.json
index 4ff66fc6c1..1dc8b08ca3 100644
--- a/qapi/cxl.json
+++ b/qapi/cxl.json
@@ -131,21 +131,21 @@
##
# @CXLDRAMEvent:
#
-# Event record for a DRAM Event (CXL r3.0 8.2.9.2.1.2).
+# Event record for a DRAM Event (CXL r3.2 8.2.10.2.1.2).
#
# @dpa: Device Physical Address (relative to @path device). Note
-# lower bits include some flags. See CXL r3.0 Table 8-44 DRAM
+# lower bits include some flags. See CXL r3.2 Table 8-58 DRAM
# Event Record, Physical Address.
#
# @descriptor: Memory Event Descriptor with additional memory event
-# information. See CXL r3.0 Table 8-44 DRAM Event Record, Memory
+# information. See CXL r3.2 Table 8-58 DRAM Event Record, Memory
# Event Descriptor for bit definitions.
#
-# @type: Type of memory event that occurred. See CXL r3.0 Table 8-44
+# @type: Type of memory event that occurred. See CXL r3.2 Table 8-58
# DRAM Event Record, Memory Event Type for possible values.
#
# @transaction-type: Type of first transaction that caused the event
-# to occur. See CXL r3.0 Table 8-44 DRAM Event Record,
+# to occur. See CXL r3.2 Table 8-58 DRAM Event Record,
# Transaction Type for possible values.
#
# @channel: The channel of the memory event location. A channel is an
@@ -169,6 +169,21 @@
# @correction-mask: Bits within each nibble. Used in order of bits
# set in the nibble-mask. Up to 4 nibbles may be covered.
#
+# @component-id: Device specific component identifier for the event.
+# May describe a field replaceable sub-component of the device.
+#
+# @is-comp-id-pldm: This flag specifies whether the device-specific
+# component identifier format follows PLDM.
+#
+# @sub-channel: The sub-channel of the memory event location.
+#
+# @cme-ev-flags: Advanced programmable corrected memory error
+# threshold event flags.
+#
+# @cvme-count: Corrected volatile memory error count at event.
+#
+# @sub-type: Memory event sub-type.
+#
# Since: 8.1
##
{ 'struct': 'CXLDRAMEvent',
@@ -177,13 +192,17 @@
'type': 'uint8', 'transaction-type': 'uint8',
'*channel': 'uint8', '*rank': 'uint8', '*nibble-mask': 'uint32',
'*bank-group': 'uint8', '*bank': 'uint8', '*row': 'uint32',
- '*column': 'uint16', '*correction-mask': [ 'uint64' ]
+ '*column': 'uint16', '*correction-mask': [ 'uint64' ],
+ '*component-id': 'str', '*is-comp-id-pldm':'bool',
+ '*sub-channel':'uint8',
+ '*cme-ev-flags':'uint8', '*cvme-count':'uint32',
+ 'sub-type':'uint8'
}}
##
# @cxl-inject-dram-event:
#
-# Inject an event record for a DRAM Event (CXL r3.0 8.2.9.2.1.2).
+# Inject an event record for a DRAM Event (CXL r3.2 8.2.10.2.1.2).
# This event type is reported via one of the event logs
# specified via the log parameter.
#
--
MST
^ permalink raw reply related [flat|nested] 39+ messages in thread
* [PULL 11/33] hw/cxl/events: Updates for rev3.2 memory module event record
2026-02-22 14:28 [PULL 00/33] virtio,pc,pci: features, fixes Michael S. Tsirkin
` (9 preceding siblings ...)
2026-02-22 14:28 ` [PULL 10/33] hw/cxl/events: Updates for rev3.2 DRAM " Michael S. Tsirkin
@ 2026-02-22 14:28 ` Michael S. Tsirkin
2026-02-22 14:28 ` [PULL 12/33] hw/cxl/cxl-mailbox-utils: Move declaration of scrub and ECS feature attributes in cmd_features_set_feature() Michael S. Tsirkin
` (22 subsequent siblings)
33 siblings, 0 replies; 39+ messages in thread
From: Michael S. Tsirkin @ 2026-02-22 14:28 UTC (permalink / raw)
To: qemu-devel
Cc: Peter Maydell, Shiju Jose, Markus Armbruster, Jonathan Cameron,
Fan Ni, Eric Blake
From: Shiju Jose <shiju.jose@huawei.com>
CXL spec rev3.2 section 8.2.10.2.1.3 Table 8-59, memory module
event record has updated with following new fields.
1. Validity Flags
2. Component Identifier
3. Device Event Sub-Type
Add updates for the above spec changes in the CXL memory module
event reporting and QMP command to inject memory module event.
Updated all references for this command to the CXL r3.2
specification.
Signed-off-by: Shiju Jose <shiju.jose@huawei.com>
Acked-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20260205112350.60681-6-Jonathan.Cameron@huawei.com>
---
hw/mem/cxl_type3.c | 20 ++++++++++++++++++++
hw/mem/cxl_type3_stubs.c | 4 ++++
include/hw/cxl/cxl_events.h | 7 +++++--
qapi/cxl.json | 30 ++++++++++++++++++++----------
4 files changed, 49 insertions(+), 12 deletions(-)
diff --git a/hw/mem/cxl_type3.c b/hw/mem/cxl_type3.c
index be99d20faf..acb75f8f01 100644
--- a/hw/mem/cxl_type3.c
+++ b/hw/mem/cxl_type3.c
@@ -1937,6 +1937,9 @@ void qmp_cxl_inject_dram_event(const char *path, CxlEventLog log,
}
}
+#define CXL_MMER_VALID_COMPONENT BIT(0)
+#define CXL_MMER_VALID_COMPONENT_ID_FORMAT BIT(1)
+
void qmp_cxl_inject_memory_module_event(const char *path, CxlEventLog log,
uint32_t flags, bool has_maint_op_class,
uint8_t maint_op_class,
@@ -1953,11 +1956,16 @@ void qmp_cxl_inject_memory_module_event(const char *path, CxlEventLog log,
uint32_t dirty_shutdown_count,
uint32_t corrected_volatile_error_count,
uint32_t corrected_persist_error_count,
+ const char *component_id,
+ bool has_comp_id_pldm,
+ bool is_comp_id_pldm,
+ uint8_t sub_type,
Error **errp)
{
Object *obj = object_resolve_path(path, NULL);
CXLEventMemoryModule module;
CXLEventRecordHdr *hdr = &module.hdr;
+ uint16_t valid_flags = 0;
CXLDeviceState *cxlds;
CXLType3Dev *ct3d;
uint8_t enc_log;
@@ -2000,6 +2008,18 @@ void qmp_cxl_inject_memory_module_event(const char *path, CxlEventLog log,
stl_le_p(&module.corrected_persistent_error_count,
corrected_persist_error_count);
+ if (component_id) {
+ strncpy((char *)module.component_id, component_id,
+ sizeof(module.component_id) - 1);
+ valid_flags |= CXL_MMER_VALID_COMPONENT;
+ if (has_comp_id_pldm && is_comp_id_pldm) {
+ valid_flags |= CXL_MMER_VALID_COMPONENT_ID_FORMAT;
+ }
+ }
+ module.sub_type = sub_type;
+
+ stw_le_p(&module.validity_flags, valid_flags);
+
if (cxl_event_insert(cxlds, enc_log, (CXLEventRecordRaw *)&module)) {
cxl_event_irq_assert(ct3d);
}
diff --git a/hw/mem/cxl_type3_stubs.c b/hw/mem/cxl_type3_stubs.c
index 231dda263f..98292a931c 100644
--- a/hw/mem/cxl_type3_stubs.c
+++ b/hw/mem/cxl_type3_stubs.c
@@ -78,6 +78,10 @@ void qmp_cxl_inject_memory_module_event(const char *path, CxlEventLog log,
uint32_t dirty_shutdown_count,
uint32_t corrected_volatile_error_count,
uint32_t corrected_persist_error_count,
+ const char *component_id,
+ bool has_comp_id_pldm,
+ bool is_comp_id_pldm,
+ uint8_t sub_type,
Error **errp) {}
void qmp_cxl_inject_poison(const char *path, uint64_t start, uint64_t length,
diff --git a/include/hw/cxl/cxl_events.h b/include/hw/cxl/cxl_events.h
index a3c5f2ec20..4a7836ad72 100644
--- a/include/hw/cxl/cxl_events.h
+++ b/include/hw/cxl/cxl_events.h
@@ -166,7 +166,7 @@ typedef struct CXLEventDram {
/*
* Memory Module Event Record
- * CXL r3.1 Section 8.2.9.2.1.3: Table 8-47
+ * CXL r3.2 Section 8.2.10.2.1.3: Table 8-59
* All fields little endian.
*/
typedef struct CXLEventMemoryModule {
@@ -180,7 +180,10 @@ typedef struct CXLEventMemoryModule {
uint32_t dirty_shutdown_count;
uint32_t corrected_volatile_error_count;
uint32_t corrected_persistent_error_count;
- uint8_t reserved[0x3d];
+ uint16_t validity_flags;
+ uint8_t component_id[CXL_EVENT_GEN_MED_COMP_ID_SIZE];
+ uint8_t sub_type;
+ uint8_t reserved[0x2a];
} QEMU_PACKED CXLEventMemoryModule;
/*
diff --git a/qapi/cxl.json b/qapi/cxl.json
index 1dc8b08ca3..81d6198ba0 100644
--- a/qapi/cxl.json
+++ b/qapi/cxl.json
@@ -214,20 +214,20 @@
##
# @CXLMemModuleEvent:
#
-# Event record for a Memory Module Event (CXL r3.0 8.2.9.2.1.3).
+# Event record for a Memory Module Event (CXL r3.2 8.2.10.2.1.3).
#
-# @type: Device Event Type. See CXL r3.0 Table 8-45 Memory Module
+# @type: Device Event Type. See CXL r3.2 Table 8-59 Memory Module
# Event Record for bit definitions for bit definiions.
#
-# @health-status: Overall health summary bitmap. See CXL r3.0 Table
-# 8-100 Get Health Info Output Payload, Health Status for bit
+# @health-status: Overall health summary bitmap. See CXL r3.2 Table
+# 8-148 Get Health Info Output Payload, Health Status for bit
# definitions.
#
-# @media-status: Overall media health summary. See CXL r3.0 Table
-# 8-100 Get Health Info Output Payload, Media Status for bit
+# @media-status: Overall media health summary. See CXL r3.2 Table
+# 8-148 Get Health Info Output Payload, Media Status for bit
# definitions.
#
-# @additional-status: See CXL r3.0 Table 8-100 Get Health Info Output
+# @additional-status: See CXL r3.2 Table 8-148 Get Health Info Output
# Payload, Additional Status for subfield definitions.
#
# @life-used: Percentage (0-100) of factory expected life span.
@@ -243,6 +243,14 @@
# @corrected-persistent-error-count: Total number of correctable
# errors in persistent memory
#
+# @component-id: Device specific component identifier for the event.
+# May describe a field replaceable sub-component of the device.
+#
+# @is-comp-id-pldm: This flag specifies whether the device-specific
+# component identifier format follows PLDM.
+#
+# @sub-type: Device event sub-type.
+#
# Since: 8.1
##
{ 'struct': 'CXLMemModuleEvent',
@@ -252,14 +260,16 @@
'life-used': 'uint8', 'temperature' : 'int16',
'dirty-shutdown-count': 'uint32',
'corrected-volatile-error-count': 'uint32',
- 'corrected-persistent-error-count': 'uint32'
+ 'corrected-persistent-error-count': 'uint32',
+ '*component-id': 'str', '*is-comp-id-pldm':'bool',
+ 'sub-type':'uint8'
}}
##
# @cxl-inject-memory-module-event:
#
-# Inject an event record for a Memory Module Event (CXL r3.0
-# 8.2.9.2.1.3). This event includes a copy of the Device Health info
+# Inject an event record for a Memory Module Event (CXL r3.2
+# 8.2.10.2.1.3). This event includes a copy of the Device Health info
# at the time of the event.
#
# Since: 8.1
--
MST
^ permalink raw reply related [flat|nested] 39+ messages in thread
* [PULL 12/33] hw/cxl/cxl-mailbox-utils: Move declaration of scrub and ECS feature attributes in cmd_features_set_feature()
2026-02-22 14:28 [PULL 00/33] virtio,pc,pci: features, fixes Michael S. Tsirkin
` (10 preceding siblings ...)
2026-02-22 14:28 ` [PULL 11/33] hw/cxl/events: Updates for rev3.2 memory module " Michael S. Tsirkin
@ 2026-02-22 14:28 ` Michael S. Tsirkin
2026-02-22 14:28 ` [PULL 13/33] hw/cxl: Add support for Maintenance command and Post Package Repair (PPR) Michael S. Tsirkin
` (21 subsequent siblings)
33 siblings, 0 replies; 39+ messages in thread
From: Michael S. Tsirkin @ 2026-02-22 14:28 UTC (permalink / raw)
To: qemu-devel; +Cc: Peter Maydell, Shiju Jose, Jonathan Cameron, Fan Ni
From: Shiju Jose <shiju.jose@huawei.com>
Move the declaration of scrub and ECS feature attributes in
cmd_features_set_feature() to the local scope where they are used.
Signed-off-by: Shiju Jose <shiju.jose@huawei.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20250917143330.294698-2-Jonathan.Cameron@huawei.com>
---
hw/cxl/cxl-mailbox-utils.c | 17 +++++++----------
1 file changed, 7 insertions(+), 10 deletions(-)
diff --git a/hw/cxl/cxl-mailbox-utils.c b/hw/cxl/cxl-mailbox-utils.c
index 125f417aa4..8b471c7d93 100644
--- a/hw/cxl/cxl-mailbox-utils.c
+++ b/hw/cxl/cxl-mailbox-utils.c
@@ -1351,10 +1351,6 @@ static CXLRetCode cmd_features_set_feature(const struct cxl_cmd *cmd,
CXLCCI *cci)
{
CXLSetFeatureInHeader *hdr = (void *)payload_in;
- CXLMemPatrolScrubWriteAttrs *ps_write_attrs;
- CXLMemPatrolScrubSetFeature *ps_set_feature;
- CXLMemECSWriteAttrs *ecs_write_attrs;
- CXLMemECSSetFeature *ecs_set_feature;
CXLSetFeatureInfo *set_feat_info;
uint16_t bytes_to_copy = 0;
uint8_t data_transfer_flag;
@@ -1396,13 +1392,14 @@ static CXLRetCode cmd_features_set_feature(const struct cxl_cmd *cmd,
}
if (qemu_uuid_is_equal(&hdr->uuid, &patrol_scrub_uuid)) {
+ CXLMemPatrolScrubSetFeature *ps_set_feature = (void *)payload_in;
+ CXLMemPatrolScrubWriteAttrs *ps_write_attrs =
+ &ps_set_feature->feat_data;
+
if (hdr->version != CXL_MEMDEV_PS_SET_FEATURE_VERSION) {
return CXL_MBOX_UNSUPPORTED;
}
- ps_set_feature = (void *)payload_in;
- ps_write_attrs = &ps_set_feature->feat_data;
-
if ((uint32_t)hdr->offset + bytes_to_copy >
sizeof(ct3d->patrol_scrub_wr_attrs)) {
return CXL_MBOX_INVALID_PAYLOAD_LENGTH;
@@ -1423,13 +1420,13 @@ static CXLRetCode cmd_features_set_feature(const struct cxl_cmd *cmd,
}
} else if (qemu_uuid_is_equal(&hdr->uuid,
&ecs_uuid)) {
+ CXLMemECSSetFeature *ecs_set_feature = (void *)payload_in;
+ CXLMemECSWriteAttrs *ecs_write_attrs = ecs_set_feature->feat_data;
+
if (hdr->version != CXL_ECS_SET_FEATURE_VERSION) {
return CXL_MBOX_UNSUPPORTED;
}
- ecs_set_feature = (void *)payload_in;
- ecs_write_attrs = ecs_set_feature->feat_data;
-
if ((uint32_t)hdr->offset + bytes_to_copy >
sizeof(ct3d->ecs_wr_attrs)) {
return CXL_MBOX_INVALID_PAYLOAD_LENGTH;
--
MST
^ permalink raw reply related [flat|nested] 39+ messages in thread
* [PULL 13/33] hw/cxl: Add support for Maintenance command and Post Package Repair (PPR)
2026-02-22 14:28 [PULL 00/33] virtio,pc,pci: features, fixes Michael S. Tsirkin
` (11 preceding siblings ...)
2026-02-22 14:28 ` [PULL 12/33] hw/cxl/cxl-mailbox-utils: Move declaration of scrub and ECS feature attributes in cmd_features_set_feature() Michael S. Tsirkin
@ 2026-02-22 14:28 ` Michael S. Tsirkin
2026-02-24 10:49 ` Peter Maydell
2026-02-22 14:28 ` [PULL 14/33] hw/cxl: Add emulation for memory sparing control feature Michael S. Tsirkin
` (20 subsequent siblings)
33 siblings, 1 reply; 39+ messages in thread
From: Michael S. Tsirkin @ 2026-02-22 14:28 UTC (permalink / raw)
To: qemu-devel
Cc: Peter Maydell, Davidlohr Bueso, Shiju Jose, Jonathan Cameron,
Fan Ni
From: Davidlohr Bueso <dave@stgolabs.net>
This adds initial support for the Maintenance command, specifically
the soft and hard PPR operations on a dpa. The implementation allows
to be executed at runtime, therefore semantically, data is retained
and CXL.mem requests are correctly processed.
Keep track of the requests upon a general media or DRAM event.
Post Package Repair (PPR) maintenance operations may be supported by CXL
devices that implement CXL.mem protocol. A PPR maintenance operation
requests the CXL device to perform a repair operation on its media.
For example, a CXL device with DRAM components that support PPR features
may implement PPR Maintenance operations. DRAM components may support two
types of PPR, hard PPR (hPPR), for a permanent row repair, and Soft PPR
(sPPR), for a temporary row repair. Soft PPR is much faster than hPPR,
but the repair is lost with a power cycle.
CXL spec 3.2 section 8.2.10.7.1.2 describes the device's sPPR (soft PPR)
maintenance operation and section 8.2.10.7.1.3 describes the device's
hPPR (hard PPR) maintenance operation feature.
CXL spec 3.2 section 8.2.10.7.2.1 describes the sPPR feature discovery and
configuration.
CXL spec 3.2 section 8.2.10.7.2.2 describes the hPPR feature discovery and
configuration.
CXL spec 3.2 section 8.2.10.2.1.4 Table 8-60 describes the Memory Sparing
Event Record.
Signed-off-by: Davidlohr Bueso <dave@stgolabs.net>
Co-developed-by: Shiju Jose <shiju.jose@huawei.com>
Signed-off-by: Shiju Jose <shiju.jose@huawei.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20250917143330.294698-3-Jonathan.Cameron@huawei.com>
---
hw/cxl/cxl-mailbox-utils.c | 240 +++++++++++++++++++++++++++++++++++-
hw/mem/cxl_type3.c | 125 +++++++++++++++++++
include/hw/cxl/cxl_device.h | 112 +++++++++++++++++
include/hw/cxl/cxl_events.h | 42 +++++++
4 files changed, 517 insertions(+), 2 deletions(-)
diff --git a/hw/cxl/cxl-mailbox-utils.c b/hw/cxl/cxl-mailbox-utils.c
index 8b471c7d93..59f7a392ef 100644
--- a/hw/cxl/cxl-mailbox-utils.c
+++ b/hw/cxl/cxl-mailbox-utils.c
@@ -86,6 +86,8 @@ enum {
#define GET_SUPPORTED 0x0
#define GET_FEATURE 0x1
#define SET_FEATURE 0x2
+ MAINTENANCE = 0x06,
+ #define PERFORM 0x0
IDENTIFY = 0x40,
#define MEMORY_DEVICE 0x0
CCLS = 0x41,
@@ -1111,8 +1113,8 @@ typedef struct CXLSupportedFeatureEntry {
#define CXL_FEAT_ENTRY_ATTR_FLAG_CHANGABLE BIT(0)
#define CXL_FEAT_ENTRY_ATTR_FLAG_DEEPEST_RESET_PERSISTENCE_MASK GENMASK(3, 1)
#define CXL_FEAT_ENTRY_ATTR_FLAG_PERSIST_ACROSS_FIRMWARE_UPDATE BIT(4)
-#define CXL_FEAT_ENTRY_ATTR_FLAG_SUPPORT_DEFAULT_SELECTION BIT(5)
-#define CXL_FEAT_ENTRY_ATTR_FLAG_SUPPORT_SAVED_SELECTION BIT(6)
+#define CXL_FEAT_ENTRY_ATTR_FLAG_SUPPORT_DEFAULT_SEL BIT(5)
+#define CXL_FEAT_ENTRY_ATTR_FLAG_SUPPORT_SAVED_SEL BIT(6)
/* Supported Feature Entry : set feature effects */
#define CXL_FEAT_ENTRY_SFE_CONFIG_CHANGE_COLD_RESET BIT(0)
@@ -1131,6 +1133,8 @@ typedef struct CXLSupportedFeatureEntry {
enum CXL_SUPPORTED_FEATURES_LIST {
CXL_FEATURE_PATROL_SCRUB = 0,
CXL_FEATURE_ECS,
+ CXL_FEATURE_SPPR,
+ CXL_FEATURE_HPPR,
CXL_FEATURE_MAX
};
@@ -1172,6 +1176,28 @@ enum CXL_SET_FEATURE_FLAG_DATA_TRANSFER {
};
#define CXL_SET_FEAT_DATA_SAVED_ACROSS_RESET BIT(3)
+/* CXL r3.2 section 8.2.10.7.2.1: sPPR Feature Discovery and Configuration */
+static const QemuUUID soft_ppr_uuid = {
+ .data = UUID(0x892ba475, 0xfad8, 0x474e, 0x9d, 0x3e,
+ 0x69, 0x2c, 0x91, 0x75, 0x68, 0xbb)
+};
+
+typedef struct CXLMemSoftPPRSetFeature {
+ CXLSetFeatureInHeader hdr;
+ CXLMemSoftPPRWriteAttrs feat_data;
+} QEMU_PACKED QEMU_ALIGNED(16) CXLMemSoftPPRSetFeature;
+
+/* CXL r3.2 section 8.2.10.7.2.2: hPPR Feature Discovery and Configuration */
+static const QemuUUID hard_ppr_uuid = {
+ .data = UUID(0x80ea4521, 0x786f, 0x4127, 0xaf, 0xb1,
+ 0xec, 0x74, 0x59, 0xfb, 0x0e, 0x24)
+};
+
+typedef struct CXLMemHardPPRSetFeature {
+ CXLSetFeatureInHeader hdr;
+ CXLMemHardPPRWriteAttrs feat_data;
+} QEMU_PACKED QEMU_ALIGNED(16) CXLMemHardPPRSetFeature;
+
/* CXL r3.1 section 8.2.9.9.11.1: Device Patrol Scrub Control Feature */
static const QemuUUID patrol_scrub_uuid = {
.data = UUID(0x96dad7d6, 0xfde8, 0x482b, 0xa7, 0x33,
@@ -1235,6 +1261,38 @@ static CXLRetCode cmd_features_get_supported(const struct cxl_cmd *cmd,
for (entry = 0, index = get_feats_in->start_index;
entry < req_entries; index++) {
switch (index) {
+ case CXL_FEATURE_SPPR:
+ /* Fill supported feature entry for soft-PPR */
+ get_feats_out->feat_entries[entry++] =
+ (struct CXLSupportedFeatureEntry) {
+ .uuid = soft_ppr_uuid,
+ .feat_index = index,
+ .get_feat_size = sizeof(CXLMemSoftPPRReadAttrs),
+ .set_feat_size = sizeof(CXLMemSoftPPRWriteAttrs),
+ .attr_flags = CXL_FEAT_ENTRY_ATTR_FLAG_CHANGABLE |
+ CXL_FEAT_ENTRY_ATTR_FLAG_SUPPORT_DEFAULT_SEL,
+ .get_feat_version = CXL_MEMDEV_SPPR_GET_FEATURE_VERSION,
+ .set_feat_version = CXL_MEMDEV_SPPR_SET_FEATURE_VERSION,
+ .set_feat_effects = CXL_FEAT_ENTRY_SFE_IMMEDIATE_CONFIG_CHANGE |
+ CXL_FEAT_ENTRY_SFE_CEL_VALID,
+ };
+ break;
+ case CXL_FEATURE_HPPR:
+ /* Fill supported feature entry for hard-PPR */
+ get_feats_out->feat_entries[entry++] =
+ (struct CXLSupportedFeatureEntry) {
+ .uuid = hard_ppr_uuid,
+ .feat_index = index,
+ .get_feat_size = sizeof(CXLMemHardPPRReadAttrs),
+ .set_feat_size = sizeof(CXLMemHardPPRWriteAttrs),
+ .attr_flags = CXL_FEAT_ENTRY_ATTR_FLAG_CHANGABLE |
+ CXL_FEAT_ENTRY_ATTR_FLAG_SUPPORT_DEFAULT_SEL,
+ .get_feat_version = CXL_MEMDEV_HPPR_GET_FEATURE_VERSION,
+ .set_feat_version = CXL_MEMDEV_HPPR_SET_FEATURE_VERSION,
+ .set_feat_effects = CXL_FEAT_ENTRY_SFE_IMMEDIATE_CONFIG_CHANGE |
+ CXL_FEAT_ENTRY_SFE_CEL_VALID,
+ };
+ break;
case CXL_FEATURE_PATROL_SCRUB:
/* Fill supported feature entry for device patrol scrub control */
get_feats_out->feat_entries[entry++] =
@@ -1333,6 +1391,26 @@ static CXLRetCode cmd_features_get_feature(const struct cxl_cmd *cmd,
memcpy(payload_out,
(uint8_t *)&ct3d->ecs_attrs + get_feature->offset,
bytes_to_copy);
+ } else if (qemu_uuid_is_equal(&get_feature->uuid, &soft_ppr_uuid)) {
+ if (get_feature->offset >= sizeof(CXLMemSoftPPRReadAttrs)) {
+ return CXL_MBOX_INVALID_INPUT;
+ }
+ bytes_to_copy = sizeof(CXLMemSoftPPRReadAttrs) -
+ get_feature->offset;
+ bytes_to_copy = MIN(bytes_to_copy, get_feature->count);
+ memcpy(payload_out,
+ (uint8_t *)&ct3d->soft_ppr_attrs + get_feature->offset,
+ bytes_to_copy);
+ } else if (qemu_uuid_is_equal(&get_feature->uuid, &hard_ppr_uuid)) {
+ if (get_feature->offset >= sizeof(CXLMemHardPPRReadAttrs)) {
+ return CXL_MBOX_INVALID_INPUT;
+ }
+ bytes_to_copy = sizeof(CXLMemHardPPRReadAttrs) -
+ get_feature->offset;
+ bytes_to_copy = MIN(bytes_to_copy, get_feature->count);
+ memcpy(payload_out,
+ (uint8_t *)&ct3d->hard_ppr_attrs + get_feature->offset,
+ bytes_to_copy);
} else {
return CXL_MBOX_UNSUPPORTED;
}
@@ -1444,6 +1522,44 @@ static CXLRetCode cmd_features_set_feature(const struct cxl_cmd *cmd,
ct3d->ecs_wr_attrs.fru_attrs[count].ecs_config & 0x1F;
}
}
+ } else if (qemu_uuid_is_equal(&hdr->uuid, &soft_ppr_uuid)) {
+ CXLMemSoftPPRSetFeature *sppr_set_feature = (void *)payload_in;
+ CXLMemSoftPPRWriteAttrs *sppr_write_attrs =
+ &sppr_set_feature->feat_data;
+
+ if (hdr->version != CXL_MEMDEV_SPPR_SET_FEATURE_VERSION) {
+ return CXL_MBOX_UNSUPPORTED;
+ }
+
+ memcpy((uint8_t *)&ct3d->soft_ppr_wr_attrs + hdr->offset,
+ sppr_write_attrs, bytes_to_copy);
+ set_feat_info->data_size += bytes_to_copy;
+
+ if (data_transfer_flag == CXL_SET_FEATURE_FLAG_FULL_DATA_TRANSFER ||
+ data_transfer_flag == CXL_SET_FEATURE_FLAG_FINISH_DATA_TRANSFER) {
+ ct3d->soft_ppr_attrs.op_mode = ct3d->soft_ppr_wr_attrs.op_mode;
+ ct3d->soft_ppr_attrs.sppr_op_mode =
+ ct3d->soft_ppr_wr_attrs.sppr_op_mode;
+ }
+ } else if (qemu_uuid_is_equal(&hdr->uuid, &hard_ppr_uuid)) {
+ CXLMemHardPPRSetFeature *hppr_set_feature = (void *)payload_in;
+ CXLMemHardPPRWriteAttrs *hppr_write_attrs =
+ &hppr_set_feature->feat_data;
+
+ if (hdr->version != CXL_MEMDEV_HPPR_SET_FEATURE_VERSION) {
+ return CXL_MBOX_UNSUPPORTED;
+ }
+
+ memcpy((uint8_t *)&ct3d->hard_ppr_wr_attrs + hdr->offset,
+ hppr_write_attrs, bytes_to_copy);
+ set_feat_info->data_size += bytes_to_copy;
+
+ if (data_transfer_flag == CXL_SET_FEATURE_FLAG_FULL_DATA_TRANSFER ||
+ data_transfer_flag == CXL_SET_FEATURE_FLAG_FINISH_DATA_TRANSFER) {
+ ct3d->hard_ppr_attrs.op_mode = ct3d->hard_ppr_wr_attrs.op_mode;
+ ct3d->hard_ppr_attrs.hppr_op_mode =
+ ct3d->hard_ppr_wr_attrs.hppr_op_mode;
+ }
} else {
return CXL_MBOX_UNSUPPORTED;
}
@@ -1456,6 +1572,10 @@ static CXLRetCode cmd_features_set_feature(const struct cxl_cmd *cmd,
memset(&ct3d->patrol_scrub_wr_attrs, 0, set_feat_info->data_size);
} else if (qemu_uuid_is_equal(&hdr->uuid, &ecs_uuid)) {
memset(&ct3d->ecs_wr_attrs, 0, set_feat_info->data_size);
+ } else if (qemu_uuid_is_equal(&hdr->uuid, &soft_ppr_uuid)) {
+ memset(&ct3d->soft_ppr_wr_attrs, 0, set_feat_info->data_size);
+ } else if (qemu_uuid_is_equal(&hdr->uuid, &hard_ppr_uuid)) {
+ memset(&ct3d->hard_ppr_wr_attrs, 0, set_feat_info->data_size);
}
set_feat_info->data_transfer_flag = 0;
set_feat_info->data_saved_across_reset = false;
@@ -1466,6 +1586,116 @@ static CXLRetCode cmd_features_set_feature(const struct cxl_cmd *cmd,
return CXL_MBOX_SUCCESS;
}
+static void cxl_mbox_create_mem_sparing_event_records(CXLType3Dev *ct3d,
+ uint8_t maint_op_class, uint8_t maint_op_sub_class,
+ CXLMaintenance *ent)
+{
+ CXLEventSparing event_rec = {};
+
+ cxl_assign_event_header(&event_rec.hdr,
+ &sparing_uuid,
+ (1 << CXL_EVENT_TYPE_INFO),
+ sizeof(event_rec),
+ cxl_device_get_timestamp(&ct3d->cxl_dstate),
+ 1, maint_op_class, 1, maint_op_sub_class,
+ 0, 0, 0, 0);
+ if (ent) {
+ event_rec.flags = 0;
+ event_rec.result = 0;
+ stw_le_p(&event_rec.res_avail, 2);
+ stw_le_p(&event_rec.validity_flags, ent->validity_flags);
+ event_rec.channel = ent->channel;
+ event_rec.rank = ent->rank;
+ st24_le_p(event_rec.nibble_mask, ent->nibble_mask);
+ event_rec.bank_group = ent->bank_group;
+ event_rec.bank = ent->bank;
+ st24_le_p(event_rec.row, ent->row);
+ stw_le_p(&event_rec.column, ent->column);
+ event_rec.sub_channel = ent->sub_channel;
+ if (ent->validity_flags & CXL_MSER_VALID_COMP_ID) {
+ strncpy((char *)event_rec.component_id, (char *)ent->component_id,
+ sizeof(event_rec.component_id));
+ }
+ } else {
+ return;
+ }
+
+ if (cxl_event_insert(&ct3d->cxl_dstate,
+ CXL_EVENT_TYPE_INFO,
+ (CXLEventRecordRaw *)&event_rec)) {
+ cxl_event_irq_assert(ct3d);
+ }
+}
+
+
+static void cxl_perform_ppr(CXLType3Dev *ct3d, uint64_t dpa)
+{
+ CXLMaintenance *ent, *next;
+
+ QLIST_FOREACH_SAFE(ent, &ct3d->maint_list, node, next) {
+ if (dpa == ent->dpa) {
+ /* Produce a Memory Sparing Event Record */
+ if (ct3d->soft_ppr_attrs.sppr_op_mode &
+ CXL_MEMDEV_SPPR_OP_MODE_MEM_SPARING_EV_REC_EN) {
+ cxl_mbox_create_mem_sparing_event_records(ct3d,
+ CXL_MEMDEV_MAINT_CLASS_SPARING,
+ CXL_MEMDEV_MAINT_SUBCLASS_CACHELINE_SPARING,
+ ent);
+ }
+ break;
+ }
+ }
+}
+
+/* CXL r3.2 section 8.2.10.7.1 - Perform Maintenance (Opcode 0600h) */
+#define MAINTENANCE_PPR_QUERY_RESOURCES BIT(0)
+
+static CXLRetCode cmd_media_perform_maintenance(const struct cxl_cmd *cmd,
+ uint8_t *payload_in, size_t len_in,
+ uint8_t *payload_out, size_t *len_out,
+ CXLCCI *cci)
+{
+ struct {
+ uint8_t class;
+ uint8_t subclass;
+ union {
+ struct {
+ uint8_t flags;
+ uint64_t dpa;
+ uint8_t nibble_mask[3];
+ } QEMU_PACKED ppr;
+ };
+ } QEMU_PACKED *maint_in = (void *)payload_in;
+ CXLType3Dev *ct3d = CXL_TYPE3(cci->d);
+
+ if (maintenance_running(cci)) {
+ return CXL_MBOX_BUSY;
+ }
+
+ switch (maint_in->class) {
+ case CXL_MEMDEV_MAINT_CLASS_NO_OP:
+ return CXL_MBOX_SUCCESS; /* nop */
+ case CXL_MEMDEV_MAINT_CLASS_PPR:
+ if (maint_in->ppr.flags & MAINTENANCE_PPR_QUERY_RESOURCES) {
+ return CXL_MBOX_SUCCESS;
+ }
+
+ switch (maint_in->subclass) {
+ case CXL_MEMDEV_MAINT_SUBCLASS_SPPR:
+ case CXL_MEMDEV_MAINT_SUBCLASS_HPPR:
+ cxl_perform_ppr(ct3d, ldq_le_p(&maint_in->ppr.dpa));
+ return CXL_MBOX_SUCCESS;
+ default:
+ return CXL_MBOX_INVALID_INPUT;
+ }
+ break;
+ default:
+ return CXL_MBOX_INVALID_INPUT;
+ }
+
+ return CXL_MBOX_SUCCESS;
+}
+
/* CXL r3.1 Section 8.2.9.9.1.1: Identify Memory Device (Opcode 4000h) */
static CXLRetCode cmd_identify_memory_device(const struct cxl_cmd *cmd,
uint8_t *payload_in,
@@ -3767,6 +3997,12 @@ static const struct cxl_cmd cxl_cmd_set[256][256] = {
CXL_MBOX_IMMEDIATE_POLICY_CHANGE |
CXL_MBOX_IMMEDIATE_LOG_CHANGE |
CXL_MBOX_SECURITY_STATE_CHANGE)},
+ [MAINTENANCE][PERFORM] = { "MAINTENANCE_PERFORM",
+ cmd_media_perform_maintenance, ~0,
+ CXL_MBOX_IMMEDIATE_CONFIG_CHANGE |
+ CXL_MBOX_IMMEDIATE_DATA_CHANGE |
+ CXL_MBOX_IMMEDIATE_LOG_CHANGE |
+ CXL_MBOX_BACKGROUND_OPERATION },
[IDENTIFY][MEMORY_DEVICE] = { "IDENTIFY_MEMORY_DEVICE",
cmd_identify_memory_device, 0, 0 },
[CCLS][GET_PARTITION_INFO] = { "CCLS_GET_PARTITION_INFO",
diff --git a/hw/mem/cxl_type3.c b/hw/mem/cxl_type3.c
index acb75f8f01..697b3fa0de 100644
--- a/hw/mem/cxl_type3.c
+++ b/hw/mem/cxl_type3.c
@@ -964,6 +964,32 @@ static void ct3_realize(PCIDevice *pci_dev, Error **errp)
ct3d->ecs_attrs.fru_attrs[count].ecs_flags = 0;
}
+ /* Set default values for soft-PPR attributes */
+ ct3d->soft_ppr_attrs = (CXLMemSoftPPRReadAttrs) {
+ .max_maint_latency = 0x5, /* 100 ms */
+ .op_caps = 0, /* require host involvement */
+ .op_mode = 0,
+ .maint_op_class = CXL_MEMDEV_MAINT_CLASS_PPR,
+ .maint_op_subclass = CXL_MEMDEV_MAINT_SUBCLASS_SPPR,
+ .sppr_flags = CXL_MEMDEV_SPPR_DPA_SUPPORT_FLAG |
+ CXL_MEMDEV_SPPR_MEM_SPARING_EV_REC_CAP_FLAG,
+ .restriction_flags = 0,
+ .sppr_op_mode = CXL_MEMDEV_SPPR_OP_MODE_MEM_SPARING_EV_REC_EN
+ };
+
+ /* Set default value for hard-PPR attributes */
+ ct3d->hard_ppr_attrs = (CXLMemHardPPRReadAttrs) {
+ .max_maint_latency = 0x5, /* 100 ms */
+ .op_caps = 0, /* require host involvement */
+ .op_mode = 0,
+ .maint_op_class = CXL_MEMDEV_MAINT_CLASS_PPR,
+ .maint_op_subclass = CXL_MEMDEV_MAINT_SUBCLASS_HPPR,
+ .hppr_flags = CXL_MEMDEV_HPPR_DPA_SUPPORT_FLAG |
+ CXL_MEMDEV_HPPR_MEM_SPARING_EV_REC_CAP_FLAG,
+ .restriction_flags = 0,
+ .hppr_op_mode = CXL_MEMDEV_HPPR_OP_MODE_MEM_SPARING_EV_REC_EN
+ };
+
return;
err_release_cdat:
@@ -1667,6 +1693,75 @@ static int ct3d_qmp_cxl_event_log_enc(CxlEventLog log)
return -EINVAL;
}
}
+
+static void cxl_maintenance_insert(CXLType3Dev *ct3d, uint64_t dpa,
+ bool has_channel, uint8_t channel,
+ bool has_rank, uint8_t rank,
+ bool has_nibble_mask, uint32_t nibble_mask,
+ bool has_bank_group, uint8_t bank_group,
+ bool has_bank, uint8_t bank,
+ bool has_row, uint32_t row,
+ bool has_column, uint16_t column,
+ const char *component_id,
+ bool has_comp_id_pldm, bool is_comp_id_pldm,
+ bool has_sub_channel, uint8_t sub_channel)
+{
+ CXLMaintenance *ent, *m;
+
+ QLIST_FOREACH(ent, &ct3d->maint_list, node) {
+ if (dpa == ent->dpa) {
+ return;
+ }
+ }
+ m = g_new0(CXLMaintenance, 1);
+ memset(m, 0, sizeof(*m));
+ m->dpa = dpa;
+ m->validity_flags = 0;
+
+ if (has_channel) {
+ m->channel = channel;
+ m->validity_flags |= CXL_MSER_VALID_CHANNEL;
+ }
+ if (has_rank) {
+ m->rank = rank;
+ m->validity_flags |= CXL_MSER_VALID_RANK;
+ }
+ if (has_nibble_mask) {
+ m->nibble_mask = nibble_mask;
+ m->validity_flags |= CXL_MSER_VALID_NIB_MASK;
+ }
+ if (has_bank_group) {
+ m->bank_group = bank_group;
+ m->validity_flags |= CXL_MSER_VALID_BANK_GROUP;
+ }
+ if (has_bank) {
+ m->bank = bank;
+ m->validity_flags |= CXL_MSER_VALID_BANK;
+ }
+ if (has_row) {
+ m->row = row;
+ m->validity_flags |= CXL_MSER_VALID_ROW;
+ }
+ if (has_column) {
+ m->column = column;
+ m->validity_flags |= CXL_MSER_VALID_COLUMN;
+ }
+ if (has_sub_channel) {
+ m->sub_channel = sub_channel;
+ m->validity_flags |= CXL_MSER_VALID_SUB_CHANNEL;
+ }
+ if (component_id) {
+ strncpy((char *)m->component_id, component_id,
+ sizeof(m->component_id) - 1);
+ m->validity_flags |= CXL_MSER_VALID_COMP_ID;
+ if (has_comp_id_pldm && is_comp_id_pldm) {
+ m->validity_flags |= CXL_MSER_VALID_COMP_ID_FORMAT;
+ }
+ }
+
+ QLIST_INSERT_HEAD(&ct3d->maint_list, m, node);
+}
+
/* Component ID is device specific. Define this as a string. */
void qmp_cxl_inject_general_media_event(const char *path, CxlEventLog log,
uint32_t flags, bool has_maint_op_class,
@@ -1715,6 +1810,11 @@ void qmp_cxl_inject_general_media_event(const char *path, CxlEventLog log,
error_setg(errp, "Unhandled error log type");
return;
}
+ if (rc == CXL_EVENT_TYPE_INFO &&
+ (flags & CXL_EVENT_REC_FLAGS_MAINT_NEEDED)) {
+ error_setg(errp, "Informational event cannot require maintenance");
+ return;
+ }
enc_log = rc;
memset(&gem, 0, sizeof(gem));
@@ -1773,6 +1873,15 @@ void qmp_cxl_inject_general_media_event(const char *path, CxlEventLog log,
if (cxl_event_insert(cxlds, enc_log, (CXLEventRecordRaw *)&gem)) {
cxl_event_irq_assert(ct3d);
}
+
+ if (flags & CXL_EVENT_REC_FLAGS_MAINT_NEEDED) {
+ cxl_maintenance_insert(ct3d, dpa, has_channel, channel,
+ has_rank, rank,
+ 0, 0, 0, 0, 0, 0, 0, 0,
+ 0, 0, component_id,
+ has_comp_id_pldm, is_comp_id_pldm,
+ 0, 0);
+ }
}
#define CXL_DRAM_VALID_CHANNEL BIT(0)
@@ -1842,6 +1951,11 @@ void qmp_cxl_inject_dram_event(const char *path, CxlEventLog log,
error_setg(errp, "Unhandled error log type");
return;
}
+ if (rc == CXL_EVENT_TYPE_INFO &&
+ (flags & CXL_EVENT_REC_FLAGS_MAINT_NEEDED)) {
+ error_setg(errp, "Informational event cannot require maintenance");
+ return;
+ }
enc_log = rc;
memset(&dram, 0, sizeof(dram));
@@ -1935,6 +2049,17 @@ void qmp_cxl_inject_dram_event(const char *path, CxlEventLog log,
if (cxl_event_insert(cxlds, enc_log, (CXLEventRecordRaw *)&dram)) {
cxl_event_irq_assert(ct3d);
}
+
+ if (flags & CXL_EVENT_REC_FLAGS_MAINT_NEEDED) {
+ cxl_maintenance_insert(ct3d, dpa, has_channel, channel,
+ has_rank, rank,
+ has_nibble_mask, nibble_mask,
+ has_bank_group, bank_group,
+ has_bank, bank, has_row, row,
+ has_column, column, component_id,
+ has_comp_id_pldm, is_comp_id_pldm,
+ has_sub_channel, sub_channel);
+ }
}
#define CXL_MMER_VALID_COMPONENT BIT(0)
diff --git a/include/hw/cxl/cxl_device.h b/include/hw/cxl/cxl_device.h
index e461a824b6..2d4f26acfd 100644
--- a/include/hw/cxl/cxl_device.h
+++ b/include/hw/cxl/cxl_device.h
@@ -430,6 +430,12 @@ static inline bool cxl_dev_media_disabled(CXLDeviceState *cxl_dstate)
uint64_t dev_status_reg = cxl_dstate->mbox_reg_state64[R_CXL_MEM_DEV_STS];
return FIELD_EX64(dev_status_reg, CXL_MEM_DEV_STS, MEDIA_STATUS) == 0x3;
}
+
+static inline bool maintenance_running(CXLCCI *cci)
+{
+ return cci->bg.runtime && cci->bg.opcode == 0x0600;
+}
+
static inline bool scan_media_running(CXLCCI *cci)
{
return !!cci->bg.runtime && cci->bg.opcode == 0x4304;
@@ -443,6 +449,23 @@ typedef struct CXLError {
typedef QTAILQ_HEAD(, CXLError) CXLErrorList;
+typedef struct CXLMaintenance {
+ uint64_t dpa;
+ uint16_t validity_flags;
+ uint8_t channel;
+ uint8_t rank;
+ uint32_t nibble_mask;
+ uint8_t bank_group;
+ uint8_t bank;
+ uint32_t row;
+ uint16_t column;
+ uint8_t component_id[CXL_EVENT_GEN_MED_COMP_ID_SIZE];
+ uint8_t sub_channel;
+ QLIST_ENTRY(CXLMaintenance) node;
+} CXLMaintenance;
+
+typedef QLIST_HEAD(, CXLMaintenance) CXLMaintenanceList;
+
typedef struct CXLPoison {
uint64_t start, length;
uint8_t type;
@@ -455,6 +478,87 @@ typedef struct CXLPoison {
typedef QLIST_HEAD(, CXLPoison) CXLPoisonList;
#define CXL_POISON_LIST_LIMIT 256
+/* CXL memory maintenance operation */
+/*
+ * CXL r3.2 section 8.2.10.7.2, Table 8-125: Mainteance Operation:
+ * Classes, Subclasses, and Feature UUIDs
+ */
+#define CXL_MEMDEV_MAINT_CLASS_NO_OP 0x0
+#define CXL_MEMDEV_MAINT_CLASS_PPR 0x1
+#define CXL_MEMDEV_MAINT_CLASS_SPARING 0x2
+#define CXL_MEMDEV_MAINT_CLASS_DEV_BUILT_IN_TEST 0x3
+
+#define CXL_MEMDEV_MAINT_SUBCLASS_SPPR 0x0
+#define CXL_MEMDEV_MAINT_SUBCLASS_HPPR 0x1
+
+#define CXL_MEMDEV_MAINT_SUBCLASS_CACHELINE_SPARING 0x0
+#define CXL_MEMDEV_MAINT_SUBCLASS_ROW_SPARING 0x1
+#define CXL_MEMDEV_MAINT_SUBCLASS_BANK_SPARING 0x2
+#define CXL_MEMDEV_MAINT_SUBCLASS_RANK_SPARING 0x3
+
+/* CXL memory Post Package Repair control attributes */
+/*
+ * CXL r3.2 section 8.2.10.7.2.1, Table 8-128 and 8-129:
+ * sPPR Feature Readable/Writable Attributes
+ */
+typedef struct CXLMemSoftPPRReadAttrs {
+ uint8_t max_maint_latency;
+ uint16_t op_caps;
+ uint16_t op_mode;
+ uint8_t maint_op_class;
+ uint8_t maint_op_subclass;
+ uint8_t rsvd[9];
+ uint8_t sppr_flags;
+ uint16_t restriction_flags;
+ uint8_t sppr_op_mode;
+} QEMU_PACKED CXLMemSoftPPRReadAttrs;
+
+typedef struct CXLMemSoftPPRWriteAttrs {
+ uint16_t op_mode;
+ uint8_t sppr_op_mode;
+} QEMU_PACKED CXLMemSoftPPRWriteAttrs;
+
+#define CXL_MEMDEV_SPPR_GET_FEATURE_VERSION 0x03
+#define CXL_MEMDEV_SPPR_SET_FEATURE_VERSION 0x03
+#define CXL_MEMDEV_SPPR_DPA_SUPPORT_FLAG BIT(0)
+#define CXL_MEMDEV_SPPR_NIBBLE_SUPPORT_FLAG BIT(1)
+#define CXL_MEMDEV_SPPR_MEM_SPARING_EV_REC_CAP_FLAG BIT(2)
+#define CXL_MEMDEV_SPPR_DEV_INITIATED_AT_BOOT_CAP_FLAG BIT(3)
+
+#define CXL_MEMDEV_SPPR_OP_MODE_MEM_SPARING_EV_REC_EN BIT(0)
+#define CXL_MEMDEV_SPPR_OP_MODE_DEV_INITIATED_AT_BOOT BIT(1)
+
+/*
+ * CXL r3.2 section 8.2.10.7.2.2, Table 8-131 and 8-132:
+ * hPPR Feature Readable/Writable Attributes
+ */
+typedef struct CXLMemHardPPRReadAttrs {
+ uint8_t max_maint_latency;
+ uint16_t op_caps;
+ uint16_t op_mode;
+ uint8_t maint_op_class;
+ uint8_t maint_op_subclass;
+ uint8_t rsvd[9];
+ uint8_t hppr_flags;
+ uint16_t restriction_flags;
+ uint8_t hppr_op_mode;
+} QEMU_PACKED CXLMemHardPPRReadAttrs;
+
+typedef struct CXLMemHardPPRWriteAttrs {
+ uint16_t op_mode;
+ uint8_t hppr_op_mode;
+} QEMU_PACKED CXLMemHardPPRWriteAttrs;
+
+#define CXL_MEMDEV_HPPR_GET_FEATURE_VERSION 0x03
+#define CXL_MEMDEV_HPPR_SET_FEATURE_VERSION 0x03
+#define CXL_MEMDEV_HPPR_DPA_SUPPORT_FLAG BIT(0)
+#define CXL_MEMDEV_HPPR_NIBBLE_SUPPORT_FLAG BIT(1)
+#define CXL_MEMDEV_HPPR_MEM_SPARING_EV_REC_CAP_FLAG BIT(2)
+#define CXL_MEMDEV_HPPR_DEV_INITIATED_AT_BOOT_CAP_FLAG BIT(3)
+
+#define CXL_MEMDEV_HPPR_OP_MODE_MEM_SPARING_EV_REC_EN BIT(0)
+#define CXL_MEMDEV_HPPR_OP_MODE_DEV_INITIATED_AT_BOOT BIT(1)
+
/* CXL memory device patrol scrub control attributes */
typedef struct CXLMemPatrolScrubReadAttrs {
uint8_t scrub_cycle_cap;
@@ -605,6 +709,9 @@ struct CXLType3Dev {
/* Error injection */
CXLErrorList error_list;
+ /* Keep track of maintenance requests */
+ CXLMaintenanceList maint_list;
+
/* Poison Injection - cache */
CXLPoisonList poison_list;
unsigned int poison_list_cnt;
@@ -617,6 +724,11 @@ struct CXLType3Dev {
CXLSetFeatureInfo set_feat_info;
+ /* PPR control attributes */
+ CXLMemSoftPPRReadAttrs soft_ppr_attrs;
+ CXLMemSoftPPRWriteAttrs soft_ppr_wr_attrs;
+ CXLMemHardPPRReadAttrs hard_ppr_attrs;
+ CXLMemHardPPRWriteAttrs hard_ppr_wr_attrs;
/* Patrol scrub control attributes */
CXLMemPatrolScrubReadAttrs patrol_scrub_attrs;
CXLMemPatrolScrubWriteAttrs patrol_scrub_wr_attrs;
diff --git a/include/hw/cxl/cxl_events.h b/include/hw/cxl/cxl_events.h
index 4a7836ad72..3052bc9f18 100644
--- a/include/hw/cxl/cxl_events.h
+++ b/include/hw/cxl/cxl_events.h
@@ -219,4 +219,46 @@ typedef enum CXLDCEventType {
DC_EVENT_CAPACITY_RELEASED = 0x5,
} CXLDCEventType;
+/*
+ * CXL r3.2 section Table 8-60: Memory Sparing Event Record
+ * All fields little endian.
+ */
+#define CXL_MSER_VALID_CHANNEL BIT(0)
+#define CXL_MSER_VALID_RANK BIT(1)
+#define CXL_MSER_VALID_NIB_MASK BIT(2)
+#define CXL_MSER_VALID_BANK_GROUP BIT(3)
+#define CXL_MSER_VALID_BANK BIT(4)
+#define CXL_MSER_VALID_ROW BIT(5)
+#define CXL_MSER_VALID_COLUMN BIT(6)
+#define CXL_MSER_VALID_COMP_ID BIT(7)
+#define CXL_MSER_VALID_COMP_ID_FORMAT BIT(8)
+#define CXL_MSER_VALID_SUB_CHANNEL BIT(9)
+
+typedef struct CXLEventSparing {
+ CXLEventRecordHdr hdr;
+ uint8_t maint_op_class;
+ uint8_t maint_op_subclass;
+ uint8_t flags;
+ uint8_t result;
+ uint16_t validity_flags;
+ uint8_t reserved1[6];
+ uint16_t res_avail;
+ uint8_t channel;
+ uint8_t rank;
+ uint8_t nibble_mask[3];
+ uint8_t bank_group;
+ uint8_t bank;
+ uint8_t row[3];
+ uint16_t column;
+ uint8_t component_id[CXL_EVENT_GEN_MED_COMP_ID_SIZE];
+ uint8_t sub_channel;
+ uint8_t reserved2[0x25];
+} QEMU_PACKED CXLEventSparing;
+
+/* CXL r3.2 Table 8-60: Memory Sparing Event Record */
+static const QemuUUID sparing_uuid = {
+ .data = UUID(0xe71f3a40, 0x2d29, 0x4092, 0x8a, 0x39,
+ 0x4d, 0x1c, 0x96, 0x6c, 0x7c, 0x65),
+};
+
#endif /* CXL_EVENTS_H */
--
MST
^ permalink raw reply related [flat|nested] 39+ messages in thread
* [PULL 14/33] hw/cxl: Add emulation for memory sparing control feature
2026-02-22 14:28 [PULL 00/33] virtio,pc,pci: features, fixes Michael S. Tsirkin
` (12 preceding siblings ...)
2026-02-22 14:28 ` [PULL 13/33] hw/cxl: Add support for Maintenance command and Post Package Repair (PPR) Michael S. Tsirkin
@ 2026-02-22 14:28 ` Michael S. Tsirkin
2026-02-22 14:28 ` [PULL 15/33] hw/pcie: Support enabling flit mode Michael S. Tsirkin
` (19 subsequent siblings)
33 siblings, 0 replies; 39+ messages in thread
From: Michael S. Tsirkin @ 2026-02-22 14:28 UTC (permalink / raw)
To: qemu-devel; +Cc: Peter Maydell, Shiju Jose, Jonathan Cameron, Fan Ni
From: Shiju Jose <shiju.jose@huawei.com>
Memory sparing is defined as a repair function that replaces a portion of
memory with a portion of functional memory at that same DPA. The
subclasses for this operation vary in terms of the scope of the sparing
being performed. The Cacheline sparing subclass refers to a sparing
action that can replace a full cacheline. Row sparing is provided as an
alternative to PPR sparing functions and its scope is that of a single
DDR row. Bank sparing allows an entire bank to be replaced. Rank sparing
is defined as an operation in which an entire DDR rank is replaced.
Memory sparing maintenance operations may be supported by CXL devices
that implement CXL.mem protocol. A sparing maintenance operation requests
the CXL device to perform a repair operation on its media.
For example, a CXL device with DRAM components that support memory sparing
features may implement sparing Maintenance operations.
The host may issue a query command by setting Query Resources flag in the
Input Payload (CXL Spec 3.2 Table 8-120) to determine availability of
sparing resources for a given address. In response to a query request,
the device shall report the resource availability by producing the Memory
Sparing Event Record (CXL Spec 3.2 Table 8-60) in which the Channel, Rank,
Nibble Mask, Bank Group, Bank, Row, Column, Sub-Channel fields are a copy
of the values specified in the request.
During the execution of a sparing maintenance operation, a CXL memory
device:
- May or may not retain data
- May or may not be able to process CXL.mem requests correctly.
These CXL memory device capabilities are specified by restriction flags
in the memory sparing feature readable attributes.
When a CXL device identifies error on a memory component, the device
may inform the host about the need for a memory sparing maintenance
operation by using DRAM event record, where the 'maintenance needed' flag
may set. The event record contains some of the DPA, Channel, Rank,
Nibble Mask, Bank Group, Bank, Row, Column, Sub-Channel fields that
should be repaired. The userspace tool requests for maintenance operation
if the 'maintenance needed' flag set in the CXL DRAM error record.
CXL spec 3.2 section 8.2.10.7.2.3 describes the memory sparing feature
discovery and configuration.
CXL spec 3.2 section 8.2.10.7.1.4 describes the device's memory sparing
maintenance operation feature.
Add emulation for CXL memory device memory sparing control feature
and memory sparing maintenance operation command.
Signed-off-by: Shiju Jose <shiju.jose@huawei.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20250917143330.294698-4-Jonathan.Cameron@huawei.com>
---
hw/cxl/cxl-mailbox-utils.c | 317 +++++++++++++++++++++++++++++++++++-
hw/mem/cxl_type3.c | 44 +++++
include/hw/cxl/cxl_device.h | 33 ++++
include/hw/cxl/cxl_events.h | 5 +
4 files changed, 395 insertions(+), 4 deletions(-)
diff --git a/hw/cxl/cxl-mailbox-utils.c b/hw/cxl/cxl-mailbox-utils.c
index 59f7a392ef..2f449980cd 100644
--- a/hw/cxl/cxl-mailbox-utils.c
+++ b/hw/cxl/cxl-mailbox-utils.c
@@ -1135,6 +1135,10 @@ enum CXL_SUPPORTED_FEATURES_LIST {
CXL_FEATURE_ECS,
CXL_FEATURE_SPPR,
CXL_FEATURE_HPPR,
+ CXL_FEATURE_CACHELINE_SPARING,
+ CXL_FEATURE_ROW_SPARING,
+ CXL_FEATURE_BANK_SPARING,
+ CXL_FEATURE_RANK_SPARING,
CXL_FEATURE_MAX
};
@@ -1223,6 +1227,35 @@ typedef struct CXLMemECSSetFeature {
CXLMemECSWriteAttrs feat_data[];
} QEMU_PACKED QEMU_ALIGNED(16) CXLMemECSSetFeature;
+/*
+ * CXL r3.2 section 8.2.10.7.2.3:
+ * Memory Sparing Features Discovery and Configuration
+ */
+static const QemuUUID cacheline_sparing_uuid = {
+ .data = UUID(0x96C33386, 0x91dd, 0x44c7, 0x9e, 0xcb,
+ 0xfd, 0xaf, 0x65, 0x03, 0xba, 0xc4)
+};
+
+static const QemuUUID row_sparing_uuid = {
+ .data = UUID(0x450ebf67, 0xb135, 0x4f97, 0xa4, 0x98,
+ 0xc2, 0xd5, 0x7f, 0x27, 0x9b, 0xed)
+};
+
+static const QemuUUID bank_sparing_uuid = {
+ .data = UUID(0x78b79636, 0x90ac, 0x4b64, 0xa4, 0xef,
+ 0xfa, 0xac, 0x5d, 0x18, 0xa8, 0x63)
+};
+
+static const QemuUUID rank_sparing_uuid = {
+ .data = UUID(0x34dbaff5, 0x0552, 0x4281, 0x8f, 0x76,
+ 0xda, 0x0b, 0x5e, 0x7a, 0x76, 0xa7)
+};
+
+typedef struct CXLMemSparingSetFeature {
+ CXLSetFeatureInHeader hdr;
+ CXLMemSparingWriteAttrs feat_data;
+} QEMU_PACKED QEMU_ALIGNED(16) CXLMemSparingSetFeature;
+
/* CXL r3.1 section 8.2.9.6.1: Get Supported Features (Opcode 0500h) */
static CXLRetCode cmd_features_get_supported(const struct cxl_cmd *cmd,
uint8_t *payload_in,
@@ -1323,6 +1356,70 @@ static CXLRetCode cmd_features_get_supported(const struct cxl_cmd *cmd,
CXL_FEAT_ENTRY_SFE_CEL_VALID,
};
break;
+ case CXL_FEATURE_CACHELINE_SPARING:
+ /* Fill supported feature entry for Cacheline Memory Sparing */
+ get_feats_out->feat_entries[entry++] =
+ (struct CXLSupportedFeatureEntry) {
+ .uuid = cacheline_sparing_uuid,
+ .feat_index = index,
+ .get_feat_size = sizeof(CXLMemSparingReadAttrs),
+ .set_feat_size = sizeof(CXLMemSparingWriteAttrs),
+ .attr_flags = CXL_FEAT_ENTRY_ATTR_FLAG_CHANGABLE |
+ CXL_FEAT_ENTRY_ATTR_FLAG_SUPPORT_DEFAULT_SEL,
+ .get_feat_version = CXL_MEMDEV_SPARING_GET_FEATURE_VERSION,
+ .set_feat_version = CXL_MEMDEV_SPARING_SET_FEATURE_VERSION,
+ .set_feat_effects = CXL_FEAT_ENTRY_SFE_IMMEDIATE_CONFIG_CHANGE |
+ CXL_FEAT_ENTRY_SFE_CEL_VALID,
+ };
+ break;
+ case CXL_FEATURE_ROW_SPARING:
+ /* Fill supported feature entry for Row Memory Sparing */
+ get_feats_out->feat_entries[entry++] =
+ (struct CXLSupportedFeatureEntry) {
+ .uuid = row_sparing_uuid,
+ .feat_index = index,
+ .get_feat_size = sizeof(CXLMemSparingReadAttrs),
+ .set_feat_size = sizeof(CXLMemSparingWriteAttrs),
+ .attr_flags = CXL_FEAT_ENTRY_ATTR_FLAG_CHANGABLE |
+ CXL_FEAT_ENTRY_ATTR_FLAG_SUPPORT_DEFAULT_SEL,
+ .get_feat_version = CXL_MEMDEV_SPARING_GET_FEATURE_VERSION,
+ .set_feat_version = CXL_MEMDEV_SPARING_SET_FEATURE_VERSION,
+ .set_feat_effects = CXL_FEAT_ENTRY_SFE_IMMEDIATE_CONFIG_CHANGE |
+ CXL_FEAT_ENTRY_SFE_CEL_VALID,
+ };
+ break;
+ case CXL_FEATURE_BANK_SPARING:
+ /* Fill supported feature entry for Bank Memory Sparing */
+ get_feats_out->feat_entries[entry++] =
+ (struct CXLSupportedFeatureEntry) {
+ .uuid = bank_sparing_uuid,
+ .feat_index = index,
+ .get_feat_size = sizeof(CXLMemSparingReadAttrs),
+ .set_feat_size = sizeof(CXLMemSparingWriteAttrs),
+ .attr_flags = CXL_FEAT_ENTRY_ATTR_FLAG_CHANGABLE |
+ CXL_FEAT_ENTRY_ATTR_FLAG_SUPPORT_DEFAULT_SEL,
+ .get_feat_version = CXL_MEMDEV_SPARING_GET_FEATURE_VERSION,
+ .set_feat_version = CXL_MEMDEV_SPARING_SET_FEATURE_VERSION,
+ .set_feat_effects = CXL_FEAT_ENTRY_SFE_IMMEDIATE_CONFIG_CHANGE |
+ CXL_FEAT_ENTRY_SFE_CEL_VALID,
+ };
+ break;
+ case CXL_FEATURE_RANK_SPARING:
+ /* Fill supported feature entry for Rank Memory Sparing */
+ get_feats_out->feat_entries[entry++] =
+ (struct CXLSupportedFeatureEntry) {
+ .uuid = rank_sparing_uuid,
+ .feat_index = index,
+ .get_feat_size = sizeof(CXLMemSparingReadAttrs),
+ .set_feat_size = sizeof(CXLMemSparingWriteAttrs),
+ .attr_flags = CXL_FEAT_ENTRY_ATTR_FLAG_CHANGABLE |
+ CXL_FEAT_ENTRY_ATTR_FLAG_SUPPORT_DEFAULT_SEL,
+ .get_feat_version = CXL_MEMDEV_SPARING_GET_FEATURE_VERSION,
+ .set_feat_version = CXL_MEMDEV_SPARING_SET_FEATURE_VERSION,
+ .set_feat_effects = CXL_FEAT_ENTRY_SFE_IMMEDIATE_CONFIG_CHANGE |
+ CXL_FEAT_ENTRY_SFE_CEL_VALID,
+ };
+ break;
default:
__builtin_unreachable();
}
@@ -1411,6 +1508,47 @@ static CXLRetCode cmd_features_get_feature(const struct cxl_cmd *cmd,
memcpy(payload_out,
(uint8_t *)&ct3d->hard_ppr_attrs + get_feature->offset,
bytes_to_copy);
+ } else if (qemu_uuid_is_equal(&get_feature->uuid,
+ &cacheline_sparing_uuid)) {
+ if (get_feature->offset >= sizeof(CXLMemSparingReadAttrs)) {
+ return CXL_MBOX_INVALID_INPUT;
+ }
+ bytes_to_copy = sizeof(CXLMemSparingReadAttrs) -
+ get_feature->offset;
+ bytes_to_copy = MIN(bytes_to_copy, get_feature->count);
+ memcpy(payload_out,
+ (uint8_t *)&ct3d->cacheline_sparing_attrs + get_feature->offset,
+ bytes_to_copy);
+ } else if (qemu_uuid_is_equal(&get_feature->uuid, &row_sparing_uuid)) {
+ if (get_feature->offset >= sizeof(CXLMemSparingReadAttrs)) {
+ return CXL_MBOX_INVALID_INPUT;
+ }
+ bytes_to_copy = sizeof(CXLMemSparingReadAttrs) -
+ get_feature->offset;
+ bytes_to_copy = MIN(bytes_to_copy, get_feature->count);
+ memcpy(payload_out,
+ (uint8_t *)&ct3d->row_sparing_attrs + get_feature->offset,
+ bytes_to_copy);
+ } else if (qemu_uuid_is_equal(&get_feature->uuid, &bank_sparing_uuid)) {
+ if (get_feature->offset >= sizeof(CXLMemSparingReadAttrs)) {
+ return CXL_MBOX_INVALID_INPUT;
+ }
+ bytes_to_copy = sizeof(CXLMemSparingReadAttrs) -
+ get_feature->offset;
+ bytes_to_copy = MIN(bytes_to_copy, get_feature->count);
+ memcpy(payload_out,
+ (uint8_t *)&ct3d->bank_sparing_attrs + get_feature->offset,
+ bytes_to_copy);
+ } else if (qemu_uuid_is_equal(&get_feature->uuid, &rank_sparing_uuid)) {
+ if (get_feature->offset >= sizeof(CXLMemSparingReadAttrs)) {
+ return CXL_MBOX_INVALID_INPUT;
+ }
+ bytes_to_copy = sizeof(CXLMemSparingReadAttrs) -
+ get_feature->offset;
+ bytes_to_copy = MIN(bytes_to_copy, get_feature->count);
+ memcpy(payload_out,
+ (uint8_t *)&ct3d->rank_sparing_attrs + get_feature->offset,
+ bytes_to_copy);
} else {
return CXL_MBOX_UNSUPPORTED;
}
@@ -1560,6 +1698,78 @@ static CXLRetCode cmd_features_set_feature(const struct cxl_cmd *cmd,
ct3d->hard_ppr_attrs.hppr_op_mode =
ct3d->hard_ppr_wr_attrs.hppr_op_mode;
}
+ } else if (qemu_uuid_is_equal(&hdr->uuid, &cacheline_sparing_uuid)) {
+ CXLMemSparingSetFeature *mem_sparing_set_feature = (void *)payload_in;
+ CXLMemSparingWriteAttrs *mem_sparing_write_attrs =
+ &mem_sparing_set_feature->feat_data;
+
+ if (hdr->version != CXL_MEMDEV_SPARING_SET_FEATURE_VERSION) {
+ return CXL_MBOX_UNSUPPORTED;
+ }
+
+ memcpy((uint8_t *)&ct3d->cacheline_sparing_wr_attrs + hdr->offset,
+ mem_sparing_write_attrs, bytes_to_copy);
+ set_feat_info->data_size += bytes_to_copy;
+
+ if (data_transfer_flag == CXL_SET_FEATURE_FLAG_FULL_DATA_TRANSFER ||
+ data_transfer_flag == CXL_SET_FEATURE_FLAG_FINISH_DATA_TRANSFER) {
+ ct3d->cacheline_sparing_attrs.op_mode =
+ ct3d->cacheline_sparing_wr_attrs.op_mode;
+ }
+ } else if (qemu_uuid_is_equal(&hdr->uuid, &row_sparing_uuid)) {
+ CXLMemSparingSetFeature *mem_sparing_set_feature = (void *)payload_in;
+ CXLMemSparingWriteAttrs *mem_sparing_write_attrs =
+ &mem_sparing_set_feature->feat_data;
+
+ if (hdr->version != CXL_MEMDEV_SPARING_SET_FEATURE_VERSION) {
+ return CXL_MBOX_UNSUPPORTED;
+ }
+
+ memcpy((uint8_t *)&ct3d->row_sparing_wr_attrs + hdr->offset,
+ mem_sparing_write_attrs, bytes_to_copy);
+ set_feat_info->data_size += bytes_to_copy;
+
+ if (data_transfer_flag == CXL_SET_FEATURE_FLAG_FULL_DATA_TRANSFER ||
+ data_transfer_flag == CXL_SET_FEATURE_FLAG_FINISH_DATA_TRANSFER) {
+ ct3d->row_sparing_attrs.op_mode =
+ ct3d->row_sparing_wr_attrs.op_mode;
+ }
+ } else if (qemu_uuid_is_equal(&hdr->uuid, &bank_sparing_uuid)) {
+ CXLMemSparingSetFeature *mem_sparing_set_feature = (void *)payload_in;
+ CXLMemSparingWriteAttrs *mem_sparing_write_attrs =
+ &mem_sparing_set_feature->feat_data;
+
+ if (hdr->version != CXL_MEMDEV_SPARING_SET_FEATURE_VERSION) {
+ return CXL_MBOX_UNSUPPORTED;
+ }
+
+ memcpy((uint8_t *)&ct3d->bank_sparing_wr_attrs + hdr->offset,
+ mem_sparing_write_attrs, bytes_to_copy);
+ set_feat_info->data_size += bytes_to_copy;
+
+ if (data_transfer_flag == CXL_SET_FEATURE_FLAG_FULL_DATA_TRANSFER ||
+ data_transfer_flag == CXL_SET_FEATURE_FLAG_FINISH_DATA_TRANSFER) {
+ ct3d->bank_sparing_attrs.op_mode =
+ ct3d->bank_sparing_wr_attrs.op_mode;
+ }
+ } else if (qemu_uuid_is_equal(&hdr->uuid, &rank_sparing_uuid)) {
+ CXLMemSparingSetFeature *mem_sparing_set_feature = (void *)payload_in;
+ CXLMemSparingWriteAttrs *mem_sparing_write_attrs =
+ &mem_sparing_set_feature->feat_data;
+
+ if (hdr->version != CXL_MEMDEV_SPARING_SET_FEATURE_VERSION) {
+ return CXL_MBOX_UNSUPPORTED;
+ }
+
+ memcpy((uint8_t *)&ct3d->rank_sparing_wr_attrs + hdr->offset,
+ mem_sparing_write_attrs, bytes_to_copy);
+ set_feat_info->data_size += bytes_to_copy;
+
+ if (data_transfer_flag == CXL_SET_FEATURE_FLAG_FULL_DATA_TRANSFER ||
+ data_transfer_flag == CXL_SET_FEATURE_FLAG_FINISH_DATA_TRANSFER) {
+ ct3d->rank_sparing_attrs.op_mode =
+ ct3d->rank_sparing_wr_attrs.op_mode;
+ }
} else {
return CXL_MBOX_UNSUPPORTED;
}
@@ -1576,6 +1786,15 @@ static CXLRetCode cmd_features_set_feature(const struct cxl_cmd *cmd,
memset(&ct3d->soft_ppr_wr_attrs, 0, set_feat_info->data_size);
} else if (qemu_uuid_is_equal(&hdr->uuid, &hard_ppr_uuid)) {
memset(&ct3d->hard_ppr_wr_attrs, 0, set_feat_info->data_size);
+ } else if (qemu_uuid_is_equal(&hdr->uuid, &cacheline_sparing_uuid)) {
+ memset(&ct3d->cacheline_sparing_wr_attrs, 0,
+ set_feat_info->data_size);
+ } else if (qemu_uuid_is_equal(&hdr->uuid, &row_sparing_uuid)) {
+ memset(&ct3d->row_sparing_wr_attrs, 0, set_feat_info->data_size);
+ } else if (qemu_uuid_is_equal(&hdr->uuid, &bank_sparing_uuid)) {
+ memset(&ct3d->bank_sparing_wr_attrs, 0, set_feat_info->data_size);
+ } else if (qemu_uuid_is_equal(&hdr->uuid, &rank_sparing_uuid)) {
+ memset(&ct3d->rank_sparing_wr_attrs, 0, set_feat_info->data_size);
}
set_feat_info->data_transfer_flag = 0;
set_feat_info->data_saved_across_reset = false;
@@ -1586,9 +1805,27 @@ static CXLRetCode cmd_features_set_feature(const struct cxl_cmd *cmd,
return CXL_MBOX_SUCCESS;
}
-static void cxl_mbox_create_mem_sparing_event_records(CXLType3Dev *ct3d,
+#define CXL_MEM_SPARING_FLAGS_QUERY_RESOURCES BIT(0)
+#define CXL_MEM_SPARING_FLAGS_HARD_SPARING BIT(1)
+#define CXL_MEM_SPARING_FLAGS_SUB_CHANNEL_VALID BIT(2)
+#define CXL_MEM_SPARING_FLAGS_NIB_MASK_VALID BIT(3)
+
+typedef struct CXLMemSparingMaintInPayload {
+ uint8_t flags;
+ uint8_t channel;
+ uint8_t rank;
+ uint8_t nibble_mask[3];
+ uint8_t bank_group;
+ uint8_t bank;
+ uint8_t row[3];
+ uint16_t column;
+ uint8_t sub_channel;
+} QEMU_PACKED CXLMemSparingMaintInPayload;
+
+static void cxl_create_mem_sparing_event_records(CXLType3Dev *ct3d,
uint8_t maint_op_class, uint8_t maint_op_sub_class,
- CXLMaintenance *ent)
+ CXLMaintenance *ent,
+ CXLMemSparingMaintInPayload *sparing_pi)
{
CXLEventSparing event_rec = {};
@@ -1616,6 +1853,31 @@ static void cxl_mbox_create_mem_sparing_event_records(CXLType3Dev *ct3d,
strncpy((char *)event_rec.component_id, (char *)ent->component_id,
sizeof(event_rec.component_id));
}
+ } else if (sparing_pi) {
+ event_rec.flags = CXL_MSER_FLAGS_QUERY_RESOURCES;
+ event_rec.result = 0;
+ event_rec.validity_flags = CXL_MSER_VALID_CHANNEL |
+ CXL_MSER_VALID_RANK |
+ CXL_MSER_VALID_NIB_MASK |
+ CXL_MSER_VALID_BANK_GROUP |
+ CXL_MSER_VALID_BANK |
+ CXL_MSER_VALID_ROW |
+ CXL_MSER_VALID_COLUMN;
+ event_rec.res_avail = 1;
+ event_rec.channel = sparing_pi->channel;
+ event_rec.rank = sparing_pi->rank;
+ if (sparing_pi->flags & CXL_MEM_SPARING_FLAGS_NIB_MASK_VALID) {
+ memcpy(event_rec.nibble_mask, sparing_pi->nibble_mask,
+ sizeof(sparing_pi->nibble_mask));
+ }
+ event_rec.bank_group = sparing_pi->bank_group;
+ event_rec.bank = sparing_pi->bank;
+ event_rec.column = sparing_pi->column;
+ memcpy(event_rec.row, sparing_pi->row, sizeof(sparing_pi->row));
+ if (sparing_pi->flags & CXL_MEM_SPARING_FLAGS_SUB_CHANNEL_VALID) {
+ event_rec.sub_channel = sparing_pi->sub_channel;
+ event_rec.validity_flags |= CXL_MSER_VALID_SUB_CHANNEL;
+ }
} else {
return;
}
@@ -1627,6 +1889,26 @@ static void cxl_mbox_create_mem_sparing_event_records(CXLType3Dev *ct3d,
}
}
+static CXLRetCode cxl_perform_mem_sparing(CXLType3Dev *ct3d, uint8_t sub_class,
+ void *maint_pi)
+{
+ switch (sub_class) {
+ case CXL_MEMDEV_MAINT_SUBCLASS_CACHELINE_SPARING:
+ qemu_log("Cacheline Memory Sparing\n");
+ return CXL_MBOX_SUCCESS;
+ case CXL_MEMDEV_MAINT_SUBCLASS_ROW_SPARING:
+ qemu_log("Row Memory Sparing\n");
+ return CXL_MBOX_SUCCESS;
+ case CXL_MEMDEV_MAINT_SUBCLASS_BANK_SPARING:
+ qemu_log("Bank Memory Sparing\n");
+ return CXL_MBOX_SUCCESS;
+ case CXL_MEMDEV_MAINT_SUBCLASS_RANK_SPARING:
+ qemu_log("Rank Memory Sparing\n");
+ return CXL_MBOX_SUCCESS;
+ default:
+ return CXL_MBOX_INVALID_INPUT;
+ }
+}
static void cxl_perform_ppr(CXLType3Dev *ct3d, uint64_t dpa)
{
@@ -1637,10 +1919,10 @@ static void cxl_perform_ppr(CXLType3Dev *ct3d, uint64_t dpa)
/* Produce a Memory Sparing Event Record */
if (ct3d->soft_ppr_attrs.sppr_op_mode &
CXL_MEMDEV_SPPR_OP_MODE_MEM_SPARING_EV_REC_EN) {
- cxl_mbox_create_mem_sparing_event_records(ct3d,
+ cxl_create_mem_sparing_event_records(ct3d,
CXL_MEMDEV_MAINT_CLASS_SPARING,
CXL_MEMDEV_MAINT_SUBCLASS_CACHELINE_SPARING,
- ent);
+ ent, NULL);
}
break;
}
@@ -1664,6 +1946,7 @@ static CXLRetCode cmd_media_perform_maintenance(const struct cxl_cmd *cmd,
uint64_t dpa;
uint8_t nibble_mask[3];
} QEMU_PACKED ppr;
+ CXLMemSparingMaintInPayload mem_sparing_pi;
};
} QEMU_PACKED *maint_in = (void *)payload_in;
CXLType3Dev *ct3d = CXL_TYPE3(cci->d);
@@ -1689,6 +1972,32 @@ static CXLRetCode cmd_media_perform_maintenance(const struct cxl_cmd *cmd,
return CXL_MBOX_INVALID_INPUT;
}
break;
+ case CXL_MEMDEV_MAINT_CLASS_SPARING:
+ if (maint_in->mem_sparing_pi.flags &
+ CXL_MEM_SPARING_FLAGS_QUERY_RESOURCES) {
+ /*
+ * CXL r3.2 sect 8.2.10.7.1.4 - Memory Sparing Maintenance Operation
+ * Produce Memory Sparing Event record to report resources
+ * availability.
+ */
+ cxl_create_mem_sparing_event_records(ct3d, maint_in->class,
+ maint_in->subclass, NULL,
+ &maint_in->mem_sparing_pi);
+
+ return CXL_MBOX_SUCCESS;
+ }
+
+ switch (maint_in->subclass) {
+ case CXL_MEMDEV_MAINT_SUBCLASS_CACHELINE_SPARING:
+ case CXL_MEMDEV_MAINT_SUBCLASS_ROW_SPARING:
+ case CXL_MEMDEV_MAINT_SUBCLASS_BANK_SPARING:
+ case CXL_MEMDEV_MAINT_SUBCLASS_RANK_SPARING:
+ return cxl_perform_mem_sparing(ct3d, maint_in->subclass,
+ &maint_in->mem_sparing_pi);
+ default:
+ return CXL_MBOX_INVALID_INPUT;
+ }
+ break;
default:
return CXL_MBOX_INVALID_INPUT;
}
diff --git a/hw/mem/cxl_type3.c b/hw/mem/cxl_type3.c
index 697b3fa0de..10ad3b8b59 100644
--- a/hw/mem/cxl_type3.c
+++ b/hw/mem/cxl_type3.c
@@ -990,6 +990,50 @@ static void ct3_realize(PCIDevice *pci_dev, Error **errp)
.hppr_op_mode = CXL_MEMDEV_HPPR_OP_MODE_MEM_SPARING_EV_REC_EN
};
+ /* Set default value for Cacheline Memory Sparing attributes */
+ ct3d->cacheline_sparing_attrs = (CXLMemSparingReadAttrs) {
+ .max_maint_latency = 0x5, /* 100 ms */
+ .op_caps = 0, /* require host involvement */
+ .op_mode = 0,
+ .maint_op_class = CXL_MEMDEV_MAINT_CLASS_SPARING,
+ .maint_op_subclass = CXL_MEMDEV_MAINT_SUBCLASS_CACHELINE_SPARING,
+ .restriction_flags = CXL_MEMDEV_HARD_SPARING_SUPPORT_FLAG |
+ CXL_MEMDEV_SOFT_SPARING_SUPPORT_FLAG,
+ };
+
+ /* Set default value for Row Memory Sparing attributes */
+ ct3d->row_sparing_attrs = (CXLMemSparingReadAttrs) {
+ .max_maint_latency = 0x5, /* 100 ms */
+ .op_caps = 0, /* require host involvement */
+ .op_mode = 0,
+ .maint_op_class = CXL_MEMDEV_MAINT_CLASS_SPARING,
+ .maint_op_subclass = CXL_MEMDEV_MAINT_SUBCLASS_ROW_SPARING,
+ .restriction_flags = CXL_MEMDEV_HARD_SPARING_SUPPORT_FLAG |
+ CXL_MEMDEV_SOFT_SPARING_SUPPORT_FLAG,
+ };
+
+ /* Set default value for Bank Memory Sparing attributes */
+ ct3d->bank_sparing_attrs = (CXLMemSparingReadAttrs) {
+ .max_maint_latency = 0x5, /* 100 ms */
+ .op_caps = 0, /* require host involvement */
+ .op_mode = 0,
+ .maint_op_class = CXL_MEMDEV_MAINT_CLASS_SPARING,
+ .maint_op_subclass = CXL_MEMDEV_MAINT_SUBCLASS_BANK_SPARING,
+ .restriction_flags = CXL_MEMDEV_HARD_SPARING_SUPPORT_FLAG |
+ CXL_MEMDEV_SOFT_SPARING_SUPPORT_FLAG,
+ };
+
+ /* Set default value for Rank Memory Sparing attributes */
+ ct3d->rank_sparing_attrs = (CXLMemSparingReadAttrs) {
+ .max_maint_latency = 0x5, /* 100 ms */
+ .op_caps = 0, /* require host involvement */
+ .op_mode = 0,
+ .maint_op_class = CXL_MEMDEV_MAINT_CLASS_SPARING,
+ .maint_op_subclass = CXL_MEMDEV_MAINT_SUBCLASS_RANK_SPARING,
+ .restriction_flags = CXL_MEMDEV_HARD_SPARING_SUPPORT_FLAG |
+ CXL_MEMDEV_SOFT_SPARING_SUPPORT_FLAG,
+ };
+
return;
err_release_cdat:
diff --git a/include/hw/cxl/cxl_device.h b/include/hw/cxl/cxl_device.h
index 2d4f26acfd..d5906afb19 100644
--- a/include/hw/cxl/cxl_device.h
+++ b/include/hw/cxl/cxl_device.h
@@ -608,6 +608,30 @@ typedef struct CXLMemECSWriteAttrs {
CXLMemECSFRUWriteAttrs fru_attrs[CXL_ECS_NUM_MEDIA_FRUS];
} QEMU_PACKED CXLMemECSWriteAttrs;
+/*
+ * CXL r3.2 section 8.2.10.7.2.3, Table 8-134 and 8-135:
+ * Memory Sparing Feature Readable/Writable Attributes
+ */
+typedef struct CXLMemSparingReadAttrs {
+ uint8_t max_maint_latency;
+ uint16_t op_caps;
+ uint16_t op_mode;
+ uint8_t maint_op_class;
+ uint8_t maint_op_subclass;
+ uint8_t rsvd[10];
+ uint16_t restriction_flags;
+} QEMU_PACKED CXLMemSparingReadAttrs;
+
+typedef struct CXLMemSparingWriteAttrs {
+ uint16_t op_mode;
+} QEMU_PACKED CXLMemSparingWriteAttrs;
+
+#define CXL_MEMDEV_SPARING_GET_FEATURE_VERSION 0x01
+#define CXL_MEMDEV_SPARING_SET_FEATURE_VERSION 0x01
+#define CXL_MEMDEV_SPARING_SAFE_IN_USE_FLAG BIT(0)
+#define CXL_MEMDEV_HARD_SPARING_SUPPORT_FLAG BIT(1)
+#define CXL_MEMDEV_SOFT_SPARING_SUPPORT_FLAG BIT(2)
+
#define DCD_MAX_NUM_REGION 8
typedef struct CXLDCExtentRaw {
@@ -735,6 +759,15 @@ struct CXLType3Dev {
/* ECS control attributes */
CXLMemECSReadAttrs ecs_attrs;
CXLMemECSWriteAttrs ecs_wr_attrs;
+ /* Memory Sparing control attributes */
+ CXLMemSparingReadAttrs cacheline_sparing_attrs;
+ CXLMemSparingWriteAttrs cacheline_sparing_wr_attrs;
+ CXLMemSparingReadAttrs row_sparing_attrs;
+ CXLMemSparingWriteAttrs row_sparing_wr_attrs;
+ CXLMemSparingReadAttrs bank_sparing_attrs;
+ CXLMemSparingWriteAttrs bank_sparing_wr_attrs;
+ CXLMemSparingReadAttrs rank_sparing_attrs;
+ CXLMemSparingWriteAttrs rank_sparing_wr_attrs;
struct dynamic_capacity {
HostMemoryBackend *host_dc;
diff --git a/include/hw/cxl/cxl_events.h b/include/hw/cxl/cxl_events.h
index 3052bc9f18..89f6aad531 100644
--- a/include/hw/cxl/cxl_events.h
+++ b/include/hw/cxl/cxl_events.h
@@ -223,6 +223,11 @@ typedef enum CXLDCEventType {
* CXL r3.2 section Table 8-60: Memory Sparing Event Record
* All fields little endian.
*/
+
+#define CXL_MSER_FLAGS_QUERY_RESOURCES BIT(0)
+#define CXL_MSER_FLAGS_HARD_SPARING BIT(1)
+#define CXL_MSER_FLAGS_DEV_INITIATED BIT(2)
+
#define CXL_MSER_VALID_CHANNEL BIT(0)
#define CXL_MSER_VALID_RANK BIT(1)
#define CXL_MSER_VALID_NIB_MASK BIT(2)
--
MST
^ permalink raw reply related [flat|nested] 39+ messages in thread
* [PULL 15/33] hw/pcie: Support enabling flit mode
2026-02-22 14:28 [PULL 00/33] virtio,pc,pci: features, fixes Michael S. Tsirkin
` (13 preceding siblings ...)
2026-02-22 14:28 ` [PULL 14/33] hw/cxl: Add emulation for memory sparing control feature Michael S. Tsirkin
@ 2026-02-22 14:28 ` Michael S. Tsirkin
2026-02-22 14:28 ` [PULL 16/33] hw/cxl: Refactor component register initialization Michael S. Tsirkin
` (18 subsequent siblings)
33 siblings, 0 replies; 39+ messages in thread
From: Michael S. Tsirkin @ 2026-02-22 14:28 UTC (permalink / raw)
To: qemu-devel
Cc: Peter Maydell, Davidlohr Bueso, Jonathan Cameron, Dongjoo Seo,
Fan Ni, Marcel Apfelbaum
From: Davidlohr Bueso <dave@stgolabs.net>
PCIe Flit Mode, introduced with the PCIe 6.0 specification, is a
fundamental change in how data is transmitted over the bus to
improve transfer rates. It shifts from variable-sized Transaction
Layer Packets (TLPs) to fixed 256-byte Flow Control Units (FLITs).
As with the link speed and width training, have ad-hoc property for
setting the flit mode and allow CXL components to make use of it.
For the CXL root port and dsp cases, always report flit mode but
the actual value after 'training' will depend on the downstream
device configuration.
Suggested-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Tested-by: Dongjoo Seo <dongjoo.seo1@samsung.com>
Signed-off-by: Davidlohr Bueso <dave@stgolabs.net>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20260204170936.43959-2-Jonathan.Cameron@huawei.com>
---
hw/mem/cxl_type3.c | 6 ++++--
hw/pci-bridge/cxl_downstream.c | 8 +++++---
hw/pci-bridge/cxl_root_port.c | 8 +++++---
hw/pci-bridge/cxl_upstream.c | 16 +++++++++-------
hw/pci/pcie.c | 23 +++++++++++++++++++----
include/hw/cxl/cxl_device.h | 1 +
include/hw/pci-bridge/cxl_upstream_port.h | 1 +
include/hw/pci/pcie.h | 2 +-
include/hw/pci/pcie_port.h | 1 +
9 files changed, 46 insertions(+), 20 deletions(-)
diff --git a/hw/mem/cxl_type3.c b/hw/mem/cxl_type3.c
index 10ad3b8b59..328322b1ef 100644
--- a/hw/mem/cxl_type3.c
+++ b/hw/mem/cxl_type3.c
@@ -405,7 +405,7 @@ static void build_dvsecs(CXLType3Dev *ct3d)
dvsec = (uint8_t *)&(CXLDVSECPortFlexBus){
.cap = 0x26, /* 68B, IO, Mem, non-MLD */
.ctrl = 0x02, /* IO always enabled */
- .status = 0x26, /* same as capabilities */
+ .status = ct3d->flitmode ? 0x6 : 0x26, /* lack of 68B */
.rcvd_mod_ts_data_phase1 = 0xef, /* WTF? */
};
cxl_component_create_dvsec(cxl_cstate, CXL2_TYPE3_DEVICE,
@@ -1315,7 +1315,8 @@ static void ct3d_reset(DeviceState *dev)
uint32_t *reg_state = ct3d->cxl_cstate.crb.cache_mem_registers;
uint32_t *write_msk = ct3d->cxl_cstate.crb.cache_mem_regs_write_mask;
- pcie_cap_fill_link_ep_usp(PCI_DEVICE(dev), ct3d->width, ct3d->speed);
+ pcie_cap_fill_link_ep_usp(PCI_DEVICE(dev), ct3d->width, ct3d->speed,
+ ct3d->flitmode);
cxl_component_register_init_common(reg_state, write_msk, CXL2_TYPE3_DEVICE);
cxl_device_register_init_t3(ct3d, CXL_T3_MSIX_MBOX);
@@ -1354,6 +1355,7 @@ static const Property ct3_props[] = {
speed, PCIE_LINK_SPEED_32),
DEFINE_PROP_PCIE_LINK_WIDTH("x-width", CXLType3Dev,
width, PCIE_LINK_WIDTH_16),
+ DEFINE_PROP_BOOL("x-256b-flit", CXLType3Dev, flitmode, false),
};
static uint64_t get_lsa_size(CXLType3Dev *ct3d)
diff --git a/hw/pci-bridge/cxl_downstream.c b/hw/pci-bridge/cxl_downstream.c
index f7b131e67e..64086d8ec2 100644
--- a/hw/pci-bridge/cxl_downstream.c
+++ b/hw/pci-bridge/cxl_downstream.c
@@ -94,8 +94,9 @@ static void cxl_dsp_reset(DeviceState *qdev)
latch_registers(dsp);
}
-static void build_dvsecs(CXLComponentState *cxl)
+static void build_dvsecs(PCIDevice *d, CXLComponentState *cxl)
{
+ PCIESlot *s = PCIE_SLOT(d);
uint8_t *dvsec;
dvsec = (uint8_t *)&(CXLDVSECPortExt){ 0 };
@@ -107,7 +108,7 @@ static void build_dvsecs(CXLComponentState *cxl)
dvsec = (uint8_t *)&(CXLDVSECPortFlexBus){
.cap = 0x27, /* Cache, IO, Mem, non-MLD */
.ctrl = 0x02, /* IO always enabled */
- .status = 0x26, /* same */
+ .status = s->flitmode ? 0x6 : 0x26, /* lack of 68B */
.rcvd_mod_ts_data_phase1 = 0xef, /* WTF? */
};
cxl_component_create_dvsec(cxl, CXL2_DOWNSTREAM_PORT,
@@ -182,7 +183,7 @@ static void cxl_dsp_realize(PCIDevice *d, Error **errp)
cxl_cstate->dvsec_offset = CXL_DOWNSTREAM_PORT_DVSEC_OFFSET;
cxl_cstate->pdev = d;
- build_dvsecs(cxl_cstate);
+ build_dvsecs(d, cxl_cstate);
cxl_component_register_block_init(OBJECT(d), cxl_cstate, TYPE_CXL_DSP);
pci_register_bar(d, CXL_COMPONENT_REG_BAR_IDX,
PCI_BASE_ADDRESS_SPACE_MEMORY |
@@ -217,6 +218,7 @@ static const Property cxl_dsp_props[] = {
speed, PCIE_LINK_SPEED_64),
DEFINE_PROP_PCIE_LINK_WIDTH("x-width", PCIESlot,
width, PCIE_LINK_WIDTH_16),
+ DEFINE_PROP_BOOL("x-256b-flit", PCIESlot, flitmode, true),
};
static void cxl_dsp_class_init(ObjectClass *oc, const void *data)
diff --git a/hw/pci-bridge/cxl_root_port.c b/hw/pci-bridge/cxl_root_port.c
index 197d3148d2..5641048084 100644
--- a/hw/pci-bridge/cxl_root_port.c
+++ b/hw/pci-bridge/cxl_root_port.c
@@ -104,8 +104,9 @@ static void latch_registers(CXLRootPort *crp)
cxl_component_register_init_common(reg_state, write_msk, CXL2_ROOT_PORT);
}
-static void build_dvsecs(CXLComponentState *cxl)
+static void build_dvsecs(PCIDevice *d, CXLComponentState *cxl)
{
+ PCIESlot *s = PCIE_SLOT(d);
uint8_t *dvsec;
dvsec = (uint8_t *)&(CXLDVSECPortExt){ 0 };
@@ -126,7 +127,7 @@ static void build_dvsecs(CXLComponentState *cxl)
dvsec = (uint8_t *)&(CXLDVSECPortFlexBus){
.cap = 0x26, /* IO, Mem, non-MLD */
.ctrl = 0x2,
- .status = 0x26, /* same */
+ .status = s->flitmode ? 0x6 : 0x26, /* lack of 68B */
.rcvd_mod_ts_data_phase1 = 0xef,
};
cxl_component_create_dvsec(cxl, CXL2_ROOT_PORT,
@@ -176,7 +177,7 @@ static void cxl_rp_realize(DeviceState *dev, Error **errp)
cxl_cstate->dvsec_offset = CXL_ROOT_PORT_DVSEC_OFFSET;
cxl_cstate->pdev = pci_dev;
- build_dvsecs(cxl_cstate);
+ build_dvsecs(pci_dev, cxl_cstate);
cxl_component_register_block_init(OBJECT(pci_dev), cxl_cstate,
TYPE_CXL_ROOT_PORT);
@@ -211,6 +212,7 @@ static const Property gen_rp_props[] = {
speed, PCIE_LINK_SPEED_64),
DEFINE_PROP_PCIE_LINK_WIDTH("x-width", PCIESlot,
width, PCIE_LINK_WIDTH_32),
+ DEFINE_PROP_BOOL("x-256b-flit", PCIESlot, flitmode, true),
};
static void cxl_rp_dvsec_write_config(PCIDevice *dev, uint32_t addr,
diff --git a/hw/pci-bridge/cxl_upstream.c b/hw/pci-bridge/cxl_upstream.c
index 6d708fadc2..c352d11dc7 100644
--- a/hw/pci-bridge/cxl_upstream.c
+++ b/hw/pci-bridge/cxl_upstream.c
@@ -101,28 +101,29 @@ static void cxl_usp_reset(DeviceState *qdev)
pci_bridge_reset(qdev);
pcie_cap_deverr_reset(d);
- pcie_cap_fill_link_ep_usp(d, usp->width, usp->speed);
+ pcie_cap_fill_link_ep_usp(d, usp->width, usp->speed, usp->flitmode);
latch_registers(usp);
}
-static void build_dvsecs(CXLComponentState *cxl)
+static void build_dvsecs(CXLUpstreamPort *usp)
{
+ CXLComponentState *cxl_cstate = &usp->cxl_cstate;
uint8_t *dvsec;
dvsec = (uint8_t *)&(CXLDVSECPortExt){
.status = 0x1, /* Port Power Management Init Complete */
};
- cxl_component_create_dvsec(cxl, CXL2_UPSTREAM_PORT,
+ cxl_component_create_dvsec(cxl_cstate, CXL2_UPSTREAM_PORT,
EXTENSIONS_PORT_DVSEC_LENGTH,
EXTENSIONS_PORT_DVSEC,
EXTENSIONS_PORT_DVSEC_REVID, dvsec);
dvsec = (uint8_t *)&(CXLDVSECPortFlexBus){
.cap = 0x27, /* Cache, IO, Mem, non-MLD */
.ctrl = 0x27, /* Cache, IO, Mem */
- .status = 0x26, /* same */
+ .status = usp->flitmode ? 0x6 : 0x26, /* lack of 68B */
.rcvd_mod_ts_data_phase1 = 0xef, /* WTF? */
};
- cxl_component_create_dvsec(cxl, CXL2_UPSTREAM_PORT,
+ cxl_component_create_dvsec(cxl_cstate, CXL2_UPSTREAM_PORT,
PCIE_CXL3_FLEXBUS_PORT_DVSEC_LENGTH,
PCIE_FLEXBUS_PORT_DVSEC,
PCIE_CXL3_FLEXBUS_PORT_DVSEC_REVID, dvsec);
@@ -132,7 +133,7 @@ static void build_dvsecs(CXLComponentState *cxl)
.reg0_base_lo = RBI_COMPONENT_REG | CXL_COMPONENT_REG_BAR_IDX,
.reg0_base_hi = 0,
};
- cxl_component_create_dvsec(cxl, CXL2_UPSTREAM_PORT,
+ cxl_component_create_dvsec(cxl_cstate, CXL2_UPSTREAM_PORT,
REG_LOC_DVSEC_LENGTH, REG_LOC_DVSEC,
REG_LOC_DVSEC_REVID, dvsec);
}
@@ -327,7 +328,7 @@ static void cxl_usp_realize(PCIDevice *d, Error **errp)
}
cxl_cstate->dvsec_offset = CXL_UPSTREAM_PORT_DVSEC_OFFSET;
cxl_cstate->pdev = d;
- build_dvsecs(cxl_cstate);
+ build_dvsecs(usp);
cxl_component_register_block_init(OBJECT(d), cxl_cstate, TYPE_CXL_USP);
pci_register_bar(d, CXL_COMPONENT_REG_BAR_IDX,
PCI_BASE_ADDRESS_SPACE_MEMORY |
@@ -369,6 +370,7 @@ static const Property cxl_upstream_props[] = {
speed, PCIE_LINK_SPEED_32),
DEFINE_PROP_PCIE_LINK_WIDTH("x-width", CXLUpstreamPort,
width, PCIE_LINK_WIDTH_16),
+ DEFINE_PROP_BOOL("x-256b-flit", CXLUpstreamPort, flitmode, false),
};
static void cxl_upstream_class_init(ObjectClass *oc, const void *data)
diff --git a/hw/pci/pcie.c b/hw/pci/pcie.c
index 50fc4aa8eb..cae5061e69 100644
--- a/hw/pci/pcie.c
+++ b/hw/pci/pcie.c
@@ -113,7 +113,7 @@ pcie_cap_v1_fill(PCIDevice *dev, uint8_t port, uint8_t type, uint8_t version)
/* Includes setting the target speed default */
static void pcie_cap_fill_lnk(uint8_t *exp_cap, PCIExpLinkWidth width,
- PCIExpLinkSpeed speed)
+ PCIExpLinkSpeed speed, bool flitmode)
{
/* Clear and fill LNKCAP from what was configured above */
pci_long_test_and_clear_mask(exp_cap + PCI_EXP_LNKCAP,
@@ -158,10 +158,15 @@ static void pcie_cap_fill_lnk(uint8_t *exp_cap, PCIExpLinkWidth width,
PCI_EXP_LNKCAP2_SLS_64_0GB);
}
}
+
+ if (flitmode) {
+ pci_long_test_and_set_mask(exp_cap + PCI_EXP_LNKSTA2,
+ PCI_EXP_LNKSTA2_FLIT);
+ }
}
void pcie_cap_fill_link_ep_usp(PCIDevice *dev, PCIExpLinkWidth width,
- PCIExpLinkSpeed speed)
+ PCIExpLinkSpeed speed, bool flitmode)
{
uint8_t *exp_cap = dev->config + dev->exp.exp_cap;
@@ -175,7 +180,7 @@ void pcie_cap_fill_link_ep_usp(PCIDevice *dev, PCIExpLinkWidth width,
QEMU_PCI_EXP_LNKSTA_NLW(width) |
QEMU_PCI_EXP_LNKSTA_CLS(speed));
- pcie_cap_fill_lnk(exp_cap, width, speed);
+ pcie_cap_fill_lnk(exp_cap, width, speed, flitmode);
}
static void pcie_cap_fill_slot_lnk(PCIDevice *dev)
@@ -212,7 +217,7 @@ static void pcie_cap_fill_slot_lnk(PCIDevice *dev)
/* the PCI_EXP_LNKSTA_DLLLA will be set in the hotplug function */
}
- pcie_cap_fill_lnk(exp_cap, s->width, s->speed);
+ pcie_cap_fill_lnk(exp_cap, s->width, s->speed, s->flitmode);
}
int pcie_cap_init(PCIDevice *dev, uint8_t offset,
@@ -1175,6 +1180,8 @@ void pcie_sync_bridge_lnk(PCIDevice *bridge_dev)
if (!target || !target->exp.exp_cap) {
lnksta = lnkcap;
} else {
+ uint16_t lnksta2;
+
lnksta = target->config_read(target,
target->exp.exp_cap + PCI_EXP_LNKSTA,
sizeof(lnksta));
@@ -1188,6 +1195,14 @@ void pcie_sync_bridge_lnk(PCIDevice *bridge_dev)
lnksta &= ~PCI_EXP_LNKSTA_CLS;
lnksta |= lnkcap & PCI_EXP_LNKCAP_SLS;
}
+
+ lnksta2 = target->config_read(target,
+ target->exp.exp_cap + PCI_EXP_LNKSTA2,
+ sizeof(lnksta2));
+ pci_word_test_and_clear_mask(exp_cap + PCI_EXP_LNKSTA2,
+ PCI_EXP_LNKSTA2_FLIT);
+ pci_word_test_and_set_mask(exp_cap + PCI_EXP_LNKSTA2,
+ lnksta2 & PCI_EXP_LNKSTA2_FLIT);
}
if (!(lnksta & PCI_EXP_LNKSTA_NLW)) {
diff --git a/include/hw/cxl/cxl_device.h b/include/hw/cxl/cxl_device.h
index d5906afb19..7d9236db8c 100644
--- a/include/hw/cxl/cxl_device.h
+++ b/include/hw/cxl/cxl_device.h
@@ -726,6 +726,7 @@ struct CXLType3Dev {
/* PCIe link characteristics */
PCIExpLinkSpeed speed;
PCIExpLinkWidth width;
+ bool flitmode;
/* DOE */
DOECap doe_cdat;
diff --git a/include/hw/pci-bridge/cxl_upstream_port.h b/include/hw/pci-bridge/cxl_upstream_port.h
index f208397ffe..e3d6a27acc 100644
--- a/include/hw/pci-bridge/cxl_upstream_port.h
+++ b/include/hw/pci-bridge/cxl_upstream_port.h
@@ -15,6 +15,7 @@ typedef struct CXLUpstreamPort {
PCIExpLinkSpeed speed;
PCIExpLinkWidth width;
+ bool flitmode;
DOECap doe_cdat;
uint64_t sn;
diff --git a/include/hw/pci/pcie.h b/include/hw/pci/pcie.h
index d4e065db82..71ba94874b 100644
--- a/include/hw/pci/pcie.h
+++ b/include/hw/pci/pcie.h
@@ -144,7 +144,7 @@ void pcie_ari_init(PCIDevice *dev, uint16_t offset);
void pcie_dev_ser_num_init(PCIDevice *dev, uint16_t offset, uint64_t ser_num);
void pcie_ats_init(PCIDevice *dev, uint16_t offset, bool aligned);
void pcie_cap_fill_link_ep_usp(PCIDevice *dev, PCIExpLinkWidth width,
- PCIExpLinkSpeed speed);
+ PCIExpLinkSpeed speed, bool flitmode);
void pcie_cap_slot_pre_plug_cb(HotplugHandler *hotplug_dev, DeviceState *dev,
Error **errp);
diff --git a/include/hw/pci/pcie_port.h b/include/hw/pci/pcie_port.h
index 7cd7af8cfa..53cd64c5ed 100644
--- a/include/hw/pci/pcie_port.h
+++ b/include/hw/pci/pcie_port.h
@@ -58,6 +58,7 @@ struct PCIESlot {
PCIExpLinkSpeed speed;
PCIExpLinkWidth width;
+ bool flitmode;
/* Disable ACS (really for a pcie_root_port) */
bool disable_acs;
--
MST
^ permalink raw reply related [flat|nested] 39+ messages in thread
* [PULL 16/33] hw/cxl: Refactor component register initialization
2026-02-22 14:28 [PULL 00/33] virtio,pc,pci: features, fixes Michael S. Tsirkin
` (14 preceding siblings ...)
2026-02-22 14:28 ` [PULL 15/33] hw/pcie: Support enabling flit mode Michael S. Tsirkin
@ 2026-02-22 14:28 ` Michael S. Tsirkin
2026-02-22 14:28 ` [PULL 17/33] tests/bios-tables-test: Excluded CEDT.cxl for BI restriction relaxation Michael S. Tsirkin
` (17 subsequent siblings)
33 siblings, 0 replies; 39+ messages in thread
From: Michael S. Tsirkin @ 2026-02-22 14:28 UTC (permalink / raw)
To: qemu-devel
Cc: Peter Maydell, Ira Weiny, Dongjoo Seo, Davidlohr Bueso,
Jonathan Cameron, Fan Ni
From: Ira Weiny <ira.weiny@intel.com>
CXL 3.2 8.2.4 Table 8-22 defines which capabilities are mandatory, not
permitted, or optional for each type of device.
cxl_component_register_init_common() uses a rather odd 'fall through'
mechanism to define each component register set. This assumes that any
device or capability being added builds on the previous devices
capabilities. This is not true as there are mutually exclusive
capabilities defined. For example, downstream ports can not have snoop
but it can have Back Invalidate capable decoders.
Refactor this code to make it easier to add individual capabilities as
defined by a device type. Any capability which is not specified by the
type is left NULL'ed out which complies with the packed nature of the
register array.
Update all spec references to 3.2.
No functional changes should be seen with this patch.
Signed-off-by: Ira Weiny <ira.weiny@intel.com>
Tested-by: Dongjoo Seo <dongjoo.seo1@samsung.com>
[rebased, no RAS for HBs, r3.2 references]
Signed-off-by: Davidlohr Bueso <dave@stgolabs.net>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20260204170936.43959-3-Jonathan.Cameron@huawei.com>
---
hw/cxl/cxl-component-utils.c | 75 +++++++++++-----------------------
include/hw/cxl/cxl_component.h | 33 ++++++++++-----
2 files changed, 46 insertions(+), 62 deletions(-)
diff --git a/hw/cxl/cxl-component-utils.c b/hw/cxl/cxl-component-utils.c
index 473895948b..91770f103a 100644
--- a/hw/cxl/cxl-component-utils.c
+++ b/hw/cxl/cxl-component-utils.c
@@ -284,32 +284,6 @@ void cxl_component_register_init_common(uint32_t *reg_state,
{
int caps = 0;
- /*
- * In CXL 2.0 the capabilities required for each CXL component are such
- * that, with the ordering chosen here, a single number can be used to
- * define which capabilities should be provided.
- */
- switch (type) {
- case CXL2_DOWNSTREAM_PORT:
- case CXL2_DEVICE:
- /* RAS, Link */
- caps = 2;
- break;
- case CXL2_UPSTREAM_PORT:
- case CXL2_TYPE3_DEVICE:
- case CXL2_LOGICAL_DEVICE:
- /* + HDM */
- caps = 3;
- break;
- case CXL2_ROOT_PORT:
- case CXL2_RC:
- /* + Extended Security, + Snoop */
- caps = 5;
- break;
- default:
- abort();
- }
-
memset(reg_state, 0, CXL2_COMPONENT_CM_REGION_SIZE);
/* CXL Capability Header Register */
@@ -317,11 +291,12 @@ void cxl_component_register_init_common(uint32_t *reg_state,
ARRAY_FIELD_DP32(reg_state, CXL_CAPABILITY_HEADER, VERSION,
CXL_CAPABILITY_VERSION);
ARRAY_FIELD_DP32(reg_state, CXL_CAPABILITY_HEADER, CACHE_MEM_VERSION, 1);
- ARRAY_FIELD_DP32(reg_state, CXL_CAPABILITY_HEADER, ARRAY_SIZE, caps);
#define init_cap_reg(reg, id, version) \
do { \
- int which = R_CXL_##reg##_CAPABILITY_HEADER; \
+ int which = CXL_##reg##_CAP_HDR_IDX; \
+ if (CXL_##reg##_CAP_HDR_IDX > caps) \
+ caps = CXL_##reg##_CAP_HDR_IDX; \
reg_state[which] = FIELD_DP32(reg_state[which], \
CXL_##reg##_CAPABILITY_HEADER, ID, id); \
reg_state[which] = \
@@ -332,37 +307,35 @@ void cxl_component_register_init_common(uint32_t *reg_state,
CXL_##reg##_REGISTERS_OFFSET); \
} while (0)
+ /* CXL r3.2 8.2.4 Table 8-22 */
switch (type) {
- case CXL2_DEVICE:
+ case CXL2_ROOT_PORT:
+ case CXL2_RC:
+ /* + Extended Security, + Snoop */
+ init_cap_reg(EXTSEC, 6, 1);
+ init_cap_reg(SNOOP, 8, 1);
+ /* fallthrough */
+ case CXL2_UPSTREAM_PORT:
case CXL2_TYPE3_DEVICE:
case CXL2_LOGICAL_DEVICE:
- case CXL2_ROOT_PORT:
- case CXL2_UPSTREAM_PORT:
+ /* + HDM */
+ init_cap_reg(HDM, 5, 1);
+ hdm_init_common(reg_state, write_msk, type);
+ /* fallthrough */
case CXL2_DOWNSTREAM_PORT:
- init_cap_reg(RAS, 2, CXL_RAS_CAPABILITY_VERSION);
- ras_init_common(reg_state, write_msk);
+ case CXL2_DEVICE:
+ /* RAS, Link */
+ if (type != CXL2_RC) {
+ init_cap_reg(RAS, 2, 2);
+ ras_init_common(reg_state, write_msk);
+ }
+ init_cap_reg(LINK, 4, 2);
break;
default:
- break;
+ abort();
}
- init_cap_reg(LINK, 4, CXL_LINK_CAPABILITY_VERSION);
-
- if (caps < 3) {
- return;
- }
-
- if (type != CXL2_ROOT_PORT) {
- init_cap_reg(HDM, 5, CXL_HDM_CAPABILITY_VERSION);
- hdm_init_common(reg_state, write_msk, type);
- }
- if (caps < 5) {
- return;
- }
-
- init_cap_reg(EXTSEC, 6, CXL_EXTSEC_CAP_VERSION);
- init_cap_reg(SNOOP, 8, CXL_SNOOP_CAP_VERSION);
-
+ ARRAY_FIELD_DP32(reg_state, CXL_CAPABILITY_HEADER, ARRAY_SIZE, caps);
#undef init_cap_reg
}
diff --git a/include/hw/cxl/cxl_component.h b/include/hw/cxl/cxl_component.h
index b0f2aa7914..1f167d3ef7 100644
--- a/include/hw/cxl/cxl_component.h
+++ b/include/hw/cxl/cxl_component.h
@@ -32,10 +32,20 @@ enum reg_type {
};
/*
- * Capability registers are defined at the top of the CXL.cache/mem region and
- * are packed. For our purposes we will always define the caps in the same
- * order.
- * CXL r3.1 Table 8-22: CXL_CAPABILITY_ID Assignment for details.
+ * CXL r3.2 - 8.2.4 Table 8-22 and 8-23
+ *
+ * Capability registers are defined at the top of the CXL.cache/mem region.
+ * They are defined to be packed and at variable offsets. However, NULL
+ * capabilities can be added to the packed array. To facilitate easier access
+ * within the QEMU code, define these at specified offsets. Then NULL out any
+ * capabilities for devices which don't (or can't) have a particular capability
+ * (see cxl_component_register_init_common). NULL capabilities are to be
+ * ignored by software.
+ *
+ * 'offsets' are based on index's which can then be used to report the array
+ * size in CXL Capability Header Register (index/offset 0).
+ *
+ * See CXL r3.2 Table 8-25 for an example of allowing a 'NULL' header.
*/
/* CXL r3.1 Section 8.2.4.1: CXL Capability Header Register */
@@ -46,16 +56,17 @@ REG32(CXL_CAPABILITY_HEADER, 0)
FIELD(CXL_CAPABILITY_HEADER, CACHE_MEM_VERSION, 20, 4)
FIELD(CXL_CAPABILITY_HEADER, ARRAY_SIZE, 24, 8)
-#define CXLx_CAPABILITY_HEADER(type, offset) \
- REG32(CXL_##type##_CAPABILITY_HEADER, offset) \
+#define CXLx_CAPABILITY_HEADER(type, idx) \
+ enum { CXL_##type##_CAP_HDR_IDX = idx }; \
+ REG32(CXL_##type##_CAPABILITY_HEADER, (idx * 0x4)) \
FIELD(CXL_##type##_CAPABILITY_HEADER, ID, 0, 16) \
FIELD(CXL_##type##_CAPABILITY_HEADER, VERSION, 16, 4) \
FIELD(CXL_##type##_CAPABILITY_HEADER, PTR, 20, 12)
-CXLx_CAPABILITY_HEADER(RAS, 0x4)
-CXLx_CAPABILITY_HEADER(LINK, 0x8)
-CXLx_CAPABILITY_HEADER(HDM, 0xc)
-CXLx_CAPABILITY_HEADER(EXTSEC, 0x10)
-CXLx_CAPABILITY_HEADER(SNOOP, 0x14)
+CXLx_CAPABILITY_HEADER(RAS, 1)
+CXLx_CAPABILITY_HEADER(LINK, 2)
+CXLx_CAPABILITY_HEADER(HDM, 3)
+CXLx_CAPABILITY_HEADER(EXTSEC, 4)
+CXLx_CAPABILITY_HEADER(SNOOP, 5)
/*
* Capability structures contain the actual registers that the CXL component
--
MST
^ permalink raw reply related [flat|nested] 39+ messages in thread
* [PULL 17/33] tests/bios-tables-test: Excluded CEDT.cxl for BI restriction relaxation.
2026-02-22 14:28 [PULL 00/33] virtio,pc,pci: features, fixes Michael S. Tsirkin
` (15 preceding siblings ...)
2026-02-22 14:28 ` [PULL 16/33] hw/cxl: Refactor component register initialization Michael S. Tsirkin
@ 2026-02-22 14:28 ` Michael S. Tsirkin
2026-02-22 14:28 ` [PULL 18/33] hw/cxl: Update CXL Fixed Memory Window ACPI description to include Back Invalidate support Michael S. Tsirkin
` (16 subsequent siblings)
33 siblings, 0 replies; 39+ messages in thread
From: Michael S. Tsirkin @ 2026-02-22 14:28 UTC (permalink / raw)
To: qemu-devel; +Cc: Peter Maydell, Jonathan Cameron, Igor Mammedov, Ani Sinha
From: Jonathan Cameron <Jonathan.Cameron@huawei.com>
The next patch will relax restrictions on the fixed memory window
to allow use with back invalidate capable devices.
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20260204170936.43959-4-Jonathan.Cameron@huawei.com>
---
tests/qtest/bios-tables-test-allowed-diff.h | 1 +
1 file changed, 1 insertion(+)
diff --git a/tests/qtest/bios-tables-test-allowed-diff.h b/tests/qtest/bios-tables-test-allowed-diff.h
index dfb8523c8b..b4646b5b31 100644
--- a/tests/qtest/bios-tables-test-allowed-diff.h
+++ b/tests/qtest/bios-tables-test-allowed-diff.h
@@ -1 +1,2 @@
/* List of comma-separated changed AML files to ignore */
+"tests/data/acpi/x86/q35/CEDT.cxl",
--
MST
^ permalink raw reply related [flat|nested] 39+ messages in thread
* [PULL 18/33] hw/cxl: Update CXL Fixed Memory Window ACPI description to include Back Invalidate support.
2026-02-22 14:28 [PULL 00/33] virtio,pc,pci: features, fixes Michael S. Tsirkin
` (16 preceding siblings ...)
2026-02-22 14:28 ` [PULL 17/33] tests/bios-tables-test: Excluded CEDT.cxl for BI restriction relaxation Michael S. Tsirkin
@ 2026-02-22 14:28 ` Michael S. Tsirkin
2026-02-22 14:29 ` [PULL 19/33] tests/acpi/cxl: Update CEDT.cxl to allow BI in CFWMS Michael S. Tsirkin
` (15 subsequent siblings)
33 siblings, 0 replies; 39+ messages in thread
From: Michael S. Tsirkin @ 2026-02-22 14:28 UTC (permalink / raw)
To: qemu-devel
Cc: Peter Maydell, Jonathan Cameron, Davidlohr Bueso, Igor Mammedov,
Ani Sinha
From: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Defaults for these windows has always been to enable anything QEMU supports.
With the addition of back invalidate support it is necessary to specify that
host windows support this.
CXL emulation is currently only suitable for software stack verification.
The relaxation of the restrictions on this window to include BI have no
affect on the OS until BI capable devices are added and until now these
have not existed. As such no backwards compatibility impacts are expected
from this change.
Reviewed-by: Davidlohr Bueso <dave@stgolabs.net>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20260204170936.43959-5-Jonathan.Cameron@huawei.com>
---
hw/acpi/cxl.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/hw/acpi/cxl.c b/hw/acpi/cxl.c
index 75edb2c0a6..f92f7fa3d5 100644
--- a/hw/acpi/cxl.c
+++ b/hw/acpi/cxl.c
@@ -172,7 +172,7 @@ static void cedt_build_cfmws(CXLFixedWindow *fw, Aml *cedt)
build_append_int_noprefix(table_data, fw->enc_int_gran, 4);
/* Window Restrictions */
- build_append_int_noprefix(table_data, 0x0f, 2);
+ build_append_int_noprefix(table_data, 0x2f, 2);
/* QTG ID */
build_append_int_noprefix(table_data, 0, 2);
--
MST
^ permalink raw reply related [flat|nested] 39+ messages in thread
* [PULL 19/33] tests/acpi/cxl: Update CEDT.cxl to allow BI in CFWMS
2026-02-22 14:28 [PULL 00/33] virtio,pc,pci: features, fixes Michael S. Tsirkin
` (17 preceding siblings ...)
2026-02-22 14:28 ` [PULL 18/33] hw/cxl: Update CXL Fixed Memory Window ACPI description to include Back Invalidate support Michael S. Tsirkin
@ 2026-02-22 14:29 ` Michael S. Tsirkin
2026-02-22 14:29 ` [PULL 20/33] hw/cxl: Support type3 HDM-DB Michael S. Tsirkin
` (14 subsequent siblings)
33 siblings, 0 replies; 39+ messages in thread
From: Michael S. Tsirkin @ 2026-02-22 14:29 UTC (permalink / raw)
To: qemu-devel; +Cc: Peter Maydell, Jonathan Cameron, Igor Mammedov, Ani Sinha
From: Jonathan Cameron <Jonathan.Cameron@huawei.com>
With the addition of back invalidate support in the CXL emulation relax
the restriction on the CXL Fixed Memory Window Structures so all
advertised ranges continue to support being used with all features that
QEMU emulates.
[064h 0100 001h] Subtable Type : 01 [CXL Fixed Memory Window Structure]
[065h 0101 001h] Reserved : 00
[066h 0102 002h] Length : 0028
[068h 0104 004h] Reserved : 00000000
[06Ch 0108 008h] Window base address : 0000000110000000
[074h 0116 008h] Window size : 0000000100000000
[07Ch 0124 001h] Interleave Members : 00
[07Dh 0125 001h] Interleave Arithmetic : 00
[07Eh 0126 002h] Reserved : 0000
[080h 0128 004h] Granularity : 00000005
[084h 0132 002h] Restrictions : 002F # Changed from 000F
[086h 0134 002h] QtgId : 0000
[088h 0136 004h] First Target : 0000000C
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20260204170936.43959-6-Jonathan.Cameron@huawei.com>
---
tests/data/acpi/x86/q35/CEDT.cxl | Bin 184 -> 184 bytes
tests/qtest/bios-tables-test-allowed-diff.h | 1 -
2 files changed, 1 deletion(-)
diff --git a/tests/data/acpi/x86/q35/CEDT.cxl b/tests/data/acpi/x86/q35/CEDT.cxl
index ff8203af070241bd23dd0eb8a51460692bb7d229..c35f3882eee67aa5613af427234d1ccd196aa249 100644
GIT binary patch
delta 36
scmdnNxPy_)+0`Xv2Ll5G<Hm_xRgC%*Th)2=85kIN7#JAtF)%Oy0IF37t^fc4
delta 36
scmdnNxPy_)+0`Xv2Ll5G<Hw0yRgC--Th)2^85kIN7#JAtF)%Oy0IW3!t^fc4
diff --git a/tests/qtest/bios-tables-test-allowed-diff.h b/tests/qtest/bios-tables-test-allowed-diff.h
index b4646b5b31..dfb8523c8b 100644
--- a/tests/qtest/bios-tables-test-allowed-diff.h
+++ b/tests/qtest/bios-tables-test-allowed-diff.h
@@ -1,2 +1 @@
/* List of comma-separated changed AML files to ignore */
-"tests/data/acpi/x86/q35/CEDT.cxl",
--
MST
^ permalink raw reply related [flat|nested] 39+ messages in thread
* [PULL 20/33] hw/cxl: Support type3 HDM-DB
2026-02-22 14:28 [PULL 00/33] virtio,pc,pci: features, fixes Michael S. Tsirkin
` (18 preceding siblings ...)
2026-02-22 14:29 ` [PULL 19/33] tests/acpi/cxl: Update CEDT.cxl to allow BI in CFWMS Michael S. Tsirkin
@ 2026-02-22 14:29 ` Michael S. Tsirkin
2026-02-22 14:29 ` [PULL 21/33] hw/cxl: Remove register special_ops->read() Michael S. Tsirkin
` (13 subsequent siblings)
33 siblings, 0 replies; 39+ messages in thread
From: Michael S. Tsirkin @ 2026-02-22 14:29 UTC (permalink / raw)
To: qemu-devel
Cc: Peter Maydell, Davidlohr Bueso, Dongjoo Seo, Jonathan Cameron,
Pierrick Bouvier, Fan Ni, Marcel Apfelbaum
From: Davidlohr Bueso <dave@stgolabs.net>
Add basic plumbing for memory expander devices that support Back
Invalidation. This introduces a 'hdm-db=on|off' parameter and
exposes the relevant BI RT/Decoder component cachemem registers.
Some noteworthy properties:
- Devices require enabling Flit mode across the CXL topology.
- Explicit BI-ID commit is required.
- HDM decoder support both host and dev coherency models.
Tested-by: Dongjoo Seo <dongjoo.seo1@samsung.com>
Signed-off-by: Davidlohr Bueso <dave@stgolabs.net>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20260204170936.43959-7-Jonathan.Cameron@huawei.com>
---
docs/system/devices/cxl.rst | 23 +++++
hw/cxl/cxl-component-utils.c | 142 ++++++++++++++++++++++++++--
hw/mem/cxl_type3.c | 9 +-
hw/pci-bridge/cxl_downstream.c | 2 +-
hw/pci-bridge/cxl_root_port.c | 3 +-
hw/pci-bridge/cxl_upstream.c | 2 +-
hw/pci-bridge/pci_expander_bridge.c | 2 +-
include/hw/cxl/cxl_component.h | 54 ++++++++++-
include/hw/cxl/cxl_device.h | 3 +
9 files changed, 225 insertions(+), 15 deletions(-)
diff --git a/docs/system/devices/cxl.rst b/docs/system/devices/cxl.rst
index ca15a0da1c..9d0771cdfd 100644
--- a/docs/system/devices/cxl.rst
+++ b/docs/system/devices/cxl.rst
@@ -384,6 +384,29 @@ An example of 4 devices below a switch suitable for 1, 2 or 4 way interleave::
-device cxl-type3,bus=swport3,persistent-memdev=cxl-mem3,lsa=cxl-lsa3,id=cxl-pmem3,sn=0x4 \
-M cxl-fmw.0.targets.0=cxl.1,cxl-fmw.0.size=4G,cxl-fmw.0.interleave-granularity=4k
+An example of 4 type3 devices with volatile memory below a switch. Two of the devices
+use HDM-DB for coherence, which requires operating in Flit mode::
+
+ qemu-system-x86_64 -M q35,cxl=on -m 4G,maxmem=8G,slots=8 -smp 4 \
+ ...
+ -object memory-backend-ram,id=cxl-mem0,share=on,size=256M \
+ -object memory-backend-ram,id=cxl-mem1,share=on,size=256M \
+ -object memory-backend-ram,id=cxl-mem2,share=on,size=256M \
+ -object memory-backend-ram,id=cxl-mem3,share=on,size=256M \
+ -device pxb-cxl,bus_nr=12,bus=pcie.0,id=cxl.1 \
+ -device cxl-rp,port=0,bus=cxl.1,id=root_port0,chassis=0,slot=0 \
+ -device cxl-rp,port=1,bus=cxl.1,id=root_port1,chassis=0,slot=1 \
+ -device cxl-upstream,bus=root_port0,id=us0,x-256b-flit=on \
+ -device cxl-downstream,port=0,bus=us0,id=swport0,chassis=0,slot=4 \
+ -device cxl-type3,bus=swport0,volatile-memdev=cxl-mem0,id=cxl-mem0,sn=0x1,x-256b-flit=on,hdm-db=on \
+ -device cxl-downstream,port=1,bus=us0,id=swport1,chassis=0,slot=5 \
+ -device cxl-type3,bus=swport1,volatile-memdev=cxl-mem1,id=cxl-mem1,sn=0x2,x-256b-flit=on,hdm-db=on \
+ -device cxl-downstream,port=2,bus=us0,id=swport2,chassis=0,slot=6 \
+ -device cxl-type3,bus=swport2,volatile-memdev=cxl-mem2,id=cxl-mem2,sn=0x3 \
+ -device cxl-downstream,port=3,bus=us0,id=swport3,chassis=0,slot=7 \
+ -device cxl-type3,bus=swport3,volatile-memdev=cxl-mem3,id=cxl-mem3,sn=0x4 \
+ -M cxl-fmw.0.targets.0=cxl.1,cxl-fmw.0.size=4G,cxl-fmw.0.interleave-granularity=4k
+
A simple arm/virt example featuring a single direct connected CXL Type 3
Volatile Memory device::
diff --git a/hw/cxl/cxl-component-utils.c b/hw/cxl/cxl-component-utils.c
index 91770f103a..a7d36e1128 100644
--- a/hw/cxl/cxl-component-utils.c
+++ b/hw/cxl/cxl-component-utils.c
@@ -71,10 +71,40 @@ static uint64_t cxl_cache_mem_read_reg(void *opaque, hwaddr offset,
case 4:
if (cregs->special_ops && cregs->special_ops->read) {
return cregs->special_ops->read(cxl_cstate, offset, 4);
- } else {
- QEMU_BUILD_BUG_ON(sizeof(*cregs->cache_mem_registers) != 4);
- return cregs->cache_mem_registers[offset / 4];
}
+
+ QEMU_BUILD_BUG_ON(sizeof(*cregs->cache_mem_registers) != 4);
+
+ if (offset == A_CXL_BI_RT_STATUS ||
+ offset == A_CXL_BI_DECODER_STATUS) {
+ int type;
+ uint64_t started;
+
+ type = (offset == A_CXL_BI_RT_STATUS) ?
+ CXL_BISTATE_RT : CXL_BISTATE_DECODER;
+ started = cxl_cstate->bi_state[type].last_commit;
+
+ if (started) {
+ uint32_t *cache_mem = cregs->cache_mem_registers;
+ uint32_t val = cache_mem[offset / 4];
+ uint64_t now;
+ int set;
+
+ now = qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL);
+ /* arbitrary 100 ms to do the commit */
+ set = !!(now >= started + 100);
+
+ if (offset == A_CXL_BI_RT_STATUS) {
+ val = FIELD_DP32(val, CXL_BI_RT_STATUS, COMMITTED, set);
+ } else {
+ val = FIELD_DP32(val, CXL_BI_DECODER_STATUS, COMMITTED,
+ set);
+ }
+ stl_le_p((uint8_t *)cache_mem + offset, val);
+ }
+ }
+
+ return cregs->cache_mem_registers[offset / 4];
case 8:
qemu_log_mask(LOG_UNIMP,
"CXL 8 byte cache mem registers not implemented\n");
@@ -118,6 +148,47 @@ static void dumb_hdm_handler(CXLComponentState *cxl_cstate, hwaddr offset,
stl_le_p((uint8_t *)cache_mem + offset, value);
}
+static void bi_handler(CXLComponentState *cxl_cstate, hwaddr offset,
+ uint32_t value)
+{
+ ComponentRegisters *cregs = &cxl_cstate->crb;
+ uint32_t sts, *cache_mem = cregs->cache_mem_registers;
+ bool to_commit = false;
+ int type = 0; /* Unused value - work around for compiler warning */
+
+ switch (offset) {
+ case A_CXL_BI_RT_CTRL:
+ to_commit = FIELD_EX32(value, CXL_BI_RT_CTRL, COMMIT);
+ if (to_commit) {
+ sts = cxl_cache_mem_read_reg(cxl_cstate,
+ R_CXL_BI_RT_STATUS, 4);
+ sts = FIELD_DP32(sts, CXL_BI_RT_STATUS, COMMITTED, 0);
+ stl_le_p((uint8_t *)cache_mem + R_CXL_BI_RT_STATUS, sts);
+ type = CXL_BISTATE_RT;
+ }
+ break;
+ case A_CXL_BI_DECODER_CTRL:
+ to_commit = FIELD_EX32(value, CXL_BI_DECODER_CTRL, COMMIT);
+ if (to_commit) {
+ sts = cxl_cache_mem_read_reg(cxl_cstate,
+ R_CXL_BI_DECODER_STATUS, 4);
+ sts = FIELD_DP32(sts, CXL_BI_DECODER_STATUS, COMMITTED, 0);
+ stl_le_p((uint8_t *)cache_mem + R_CXL_BI_DECODER_STATUS, sts);
+ type = CXL_BISTATE_DECODER;
+ }
+ break;
+ default:
+ break;
+ }
+
+ if (to_commit) {
+ cxl_cstate->bi_state[type].last_commit =
+ qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL);
+ }
+
+ stl_le_p((uint8_t *)cache_mem + offset, value);
+}
+
static void cxl_cache_mem_write_reg(void *opaque, hwaddr offset, uint64_t value,
unsigned size)
{
@@ -141,6 +212,9 @@ static void cxl_cache_mem_write_reg(void *opaque, hwaddr offset, uint64_t value,
if (offset >= A_CXL_HDM_DECODER_CAPABILITY &&
offset <= A_CXL_HDM_DECODER3_TARGET_LIST_HI) {
dumb_hdm_handler(cxl_cstate, offset, value);
+ } else if (offset == A_CXL_BI_RT_CTRL ||
+ offset == A_CXL_BI_DECODER_CTRL) {
+ bi_handler(cxl_cstate, offset, value);
} else {
cregs->cache_mem_registers[offset / 4] = value;
}
@@ -230,7 +304,7 @@ static void ras_init_common(uint32_t *reg_state, uint32_t *write_msk)
}
static void hdm_init_common(uint32_t *reg_state, uint32_t *write_msk,
- enum reg_type type)
+ enum reg_type type, bool bi)
{
int decoder_count = CXL_HDM_DECODER_COUNT;
int hdm_inc = R_CXL_HDM_DECODER1_BASE_LO - R_CXL_HDM_DECODER0_BASE_LO;
@@ -255,7 +329,9 @@ static void hdm_init_common(uint32_t *reg_state, uint32_t *write_msk,
UIO_DECODER_COUNT, 0);
ARRAY_FIELD_DP32(reg_state, CXL_HDM_DECODER_CAPABILITY, MEMDATA_NXM_CAP, 0);
ARRAY_FIELD_DP32(reg_state, CXL_HDM_DECODER_CAPABILITY,
- SUPPORTED_COHERENCY_MODEL, 0); /* Unknown */
+ SUPPORTED_COHERENCY_MODEL,
+ /* host+dev or Unknown */
+ type == CXL2_TYPE3_DEVICE && bi ? 3 : 0);
ARRAY_FIELD_DP32(reg_state, CXL_HDM_DECODER_GLOBAL_CONTROL,
HDM_DECODER_ENABLE, 0);
write_msk[R_CXL_HDM_DECODER_GLOBAL_CONTROL] = 0x3;
@@ -278,9 +354,43 @@ static void hdm_init_common(uint32_t *reg_state, uint32_t *write_msk,
}
}
+static void bi_rt_init_common(uint32_t *reg_state, uint32_t *write_msk)
+{
+ /* switch usp must commit the new BI-ID, timeout of 2secs */
+ ARRAY_FIELD_DP32(reg_state, CXL_BI_RT_CAPABILITY, EXPLICIT_COMMIT, 1);
+
+ ARRAY_FIELD_DP32(reg_state, CXL_BI_RT_CTRL, COMMIT, 0);
+ write_msk[R_CXL_BI_RT_CTRL] = 0x1;
+
+ ARRAY_FIELD_DP32(reg_state, CXL_BI_RT_STATUS, COMMITTED, 0);
+ ARRAY_FIELD_DP32(reg_state, CXL_BI_RT_STATUS, ERR_NOT_COMMITTED, 0);
+ ARRAY_FIELD_DP32(reg_state, CXL_BI_RT_STATUS, COMMIT_TMO_SCALE, 0x6);
+ ARRAY_FIELD_DP32(reg_state, CXL_BI_RT_STATUS, COMMIT_TMO_BASE, 0x2);
+}
+
+static void bi_decoder_init_common(uint32_t *reg_state, uint32_t *write_msk,
+ enum reg_type type)
+{
+ ARRAY_FIELD_DP32(reg_state, CXL_BI_DECODER_CAPABILITY, HDM_D, 0);
+ /* switch dsp must commit the new BI-ID, timeout of 2secs */
+ ARRAY_FIELD_DP32(reg_state, CXL_BI_DECODER_CAPABILITY, EXPLICIT_COMMIT,
+ (type != CXL2_ROOT_PORT && type != CXL2_TYPE3_DEVICE));
+
+ ARRAY_FIELD_DP32(reg_state, CXL_BI_DECODER_CTRL, BI_FW, 0);
+ ARRAY_FIELD_DP32(reg_state, CXL_BI_DECODER_CTRL, BI_ENABLE, 0);
+ ARRAY_FIELD_DP32(reg_state, CXL_BI_DECODER_CTRL, COMMIT, 0);
+ write_msk[R_CXL_BI_DECODER_CTRL] = 0x7;
+
+ ARRAY_FIELD_DP32(reg_state, CXL_BI_DECODER_STATUS, COMMITTED, 0);
+ ARRAY_FIELD_DP32(reg_state, CXL_BI_DECODER_STATUS, ERR_NOT_COMMITTED, 0);
+ ARRAY_FIELD_DP32(reg_state, CXL_BI_DECODER_STATUS, COMMIT_TMO_SCALE, 0x6);
+ ARRAY_FIELD_DP32(reg_state, CXL_BI_DECODER_STATUS, COMMIT_TMO_BASE, 0x2);
+}
+
void cxl_component_register_init_common(uint32_t *reg_state,
uint32_t *write_msk,
- enum reg_type type)
+ enum reg_type type,
+ bool bi)
{
int caps = 0;
@@ -320,7 +430,7 @@ void cxl_component_register_init_common(uint32_t *reg_state,
case CXL2_LOGICAL_DEVICE:
/* + HDM */
init_cap_reg(HDM, 5, 1);
- hdm_init_common(reg_state, write_msk, type);
+ hdm_init_common(reg_state, write_msk, type, bi);
/* fallthrough */
case CXL2_DOWNSTREAM_PORT:
case CXL2_DEVICE:
@@ -335,6 +445,24 @@ void cxl_component_register_init_common(uint32_t *reg_state,
abort();
}
+ /* back invalidate */
+ if (bi) {
+ switch (type) {
+ case CXL2_UPSTREAM_PORT:
+ init_cap_reg(BI_RT, 11, CXL_BI_RT_CAP_VERSION);
+ bi_rt_init_common(reg_state, write_msk);
+ break;
+ case CXL2_ROOT_PORT:
+ case CXL2_DOWNSTREAM_PORT:
+ case CXL2_TYPE3_DEVICE:
+ init_cap_reg(BI_DECODER, 12, CXL_BI_DECODER_CAP_VERSION);
+ bi_decoder_init_common(reg_state, write_msk, type);
+ break;
+ default:
+ break;
+ }
+ }
+
ARRAY_FIELD_DP32(reg_state, CXL_CAPABILITY_HEADER, ARRAY_SIZE, caps);
#undef init_cap_reg
}
diff --git a/hw/mem/cxl_type3.c b/hw/mem/cxl_type3.c
index 328322b1ef..4739239da3 100644
--- a/hw/mem/cxl_type3.c
+++ b/hw/mem/cxl_type3.c
@@ -748,6 +748,11 @@ static bool cxl_setup_memory(CXLType3Dev *ct3d, Error **errp)
return false;
}
+ if (!ct3d->flitmode && ct3d->hdmdb) {
+ error_setg(errp, "hdm-db requires operating in 256b flit");
+ return false;
+ }
+
if (ct3d->hostvmem) {
MemoryRegion *vmr;
char *v_name;
@@ -1317,7 +1322,8 @@ static void ct3d_reset(DeviceState *dev)
pcie_cap_fill_link_ep_usp(PCI_DEVICE(dev), ct3d->width, ct3d->speed,
ct3d->flitmode);
- cxl_component_register_init_common(reg_state, write_msk, CXL2_TYPE3_DEVICE);
+ cxl_component_register_init_common(reg_state, write_msk,
+ CXL2_TYPE3_DEVICE, ct3d->hdmdb);
cxl_device_register_init_t3(ct3d, CXL_T3_MSIX_MBOX);
/*
@@ -1356,6 +1362,7 @@ static const Property ct3_props[] = {
DEFINE_PROP_PCIE_LINK_WIDTH("x-width", CXLType3Dev,
width, PCIE_LINK_WIDTH_16),
DEFINE_PROP_BOOL("x-256b-flit", CXLType3Dev, flitmode, false),
+ DEFINE_PROP_BOOL("hdm-db", CXLType3Dev, hdmdb, false),
};
static uint64_t get_lsa_size(CXLType3Dev *ct3d)
diff --git a/hw/pci-bridge/cxl_downstream.c b/hw/pci-bridge/cxl_downstream.c
index 64086d8ec2..320818a8f1 100644
--- a/hw/pci-bridge/cxl_downstream.c
+++ b/hw/pci-bridge/cxl_downstream.c
@@ -39,7 +39,7 @@ static void latch_registers(CXLDownstreamPort *dsp)
uint32_t *write_msk = dsp->cxl_cstate.crb.cache_mem_regs_write_mask;
cxl_component_register_init_common(reg_state, write_msk,
- CXL2_DOWNSTREAM_PORT);
+ CXL2_DOWNSTREAM_PORT, true);
}
/* TODO: Look at sharing this code across all CXL port types */
diff --git a/hw/pci-bridge/cxl_root_port.c b/hw/pci-bridge/cxl_root_port.c
index 5641048084..e2093ac39e 100644
--- a/hw/pci-bridge/cxl_root_port.c
+++ b/hw/pci-bridge/cxl_root_port.c
@@ -101,7 +101,8 @@ static void latch_registers(CXLRootPort *crp)
uint32_t *reg_state = crp->cxl_cstate.crb.cache_mem_registers;
uint32_t *write_msk = crp->cxl_cstate.crb.cache_mem_regs_write_mask;
- cxl_component_register_init_common(reg_state, write_msk, CXL2_ROOT_PORT);
+ cxl_component_register_init_common(reg_state, write_msk, CXL2_ROOT_PORT,
+ true);
}
static void build_dvsecs(PCIDevice *d, CXLComponentState *cxl)
diff --git a/hw/pci-bridge/cxl_upstream.c b/hw/pci-bridge/cxl_upstream.c
index c352d11dc7..fb8d19539c 100644
--- a/hw/pci-bridge/cxl_upstream.c
+++ b/hw/pci-bridge/cxl_upstream.c
@@ -90,7 +90,7 @@ static void latch_registers(CXLUpstreamPort *usp)
uint32_t *write_msk = usp->cxl_cstate.crb.cache_mem_regs_write_mask;
cxl_component_register_init_common(reg_state, write_msk,
- CXL2_UPSTREAM_PORT);
+ CXL2_UPSTREAM_PORT, usp->flitmode);
ARRAY_FIELD_DP32(reg_state, CXL_HDM_DECODER_CAPABILITY, TARGET_COUNT, 8);
}
diff --git a/hw/pci-bridge/pci_expander_bridge.c b/hw/pci-bridge/pci_expander_bridge.c
index b6e2eb7969..11623a5666 100644
--- a/hw/pci-bridge/pci_expander_bridge.c
+++ b/hw/pci-bridge/pci_expander_bridge.c
@@ -300,7 +300,7 @@ static void pxb_cxl_dev_reset(DeviceState *dev)
uint32_t *write_msk = cxl_cstate->crb.cache_mem_regs_write_mask;
int dsp_count = 0;
- cxl_component_register_init_common(reg_state, write_msk, CXL2_RC);
+ cxl_component_register_init_common(reg_state, write_msk, CXL2_RC, false);
/*
* The CXL specification allows for host bridges with no HDM decoders
* if they only have a single root port.
diff --git a/include/hw/cxl/cxl_component.h b/include/hw/cxl/cxl_component.h
index 1f167d3ef7..ffc8220220 100644
--- a/include/hw/cxl/cxl_component.h
+++ b/include/hw/cxl/cxl_component.h
@@ -67,6 +67,8 @@ CXLx_CAPABILITY_HEADER(LINK, 2)
CXLx_CAPABILITY_HEADER(HDM, 3)
CXLx_CAPABILITY_HEADER(EXTSEC, 4)
CXLx_CAPABILITY_HEADER(SNOOP, 5)
+CXLx_CAPABILITY_HEADER(BI_RT, 6)
+CXLx_CAPABILITY_HEADER(BI_DECODER, 7)
/*
* Capability structures contain the actual registers that the CXL component
@@ -211,10 +213,55 @@ HDM_DECODER_INIT(3);
(CXL_IDE_REGISTERS_OFFSET + CXL_IDE_REGISTERS_SIZE)
#define CXL_SNOOP_REGISTERS_SIZE 0x8
-QEMU_BUILD_BUG_MSG((CXL_SNOOP_REGISTERS_OFFSET +
- CXL_SNOOP_REGISTERS_SIZE) >= 0x1000,
+#define CXL_BI_RT_CAP_VERSION 1
+#define CXL_BI_RT_REGISTERS_OFFSET \
+ (CXL_SNOOP_REGISTERS_OFFSET + CXL_SNOOP_REGISTERS_SIZE)
+#define CXL_BI_RT_REGISTERS_SIZE 0xC
+
+REG32(CXL_BI_RT_CAPABILITY, CXL_BI_RT_REGISTERS_OFFSET)
+ FIELD(CXL_BI_RT_CAPABILITY, EXPLICIT_COMMIT, 0, 1)
+REG32(CXL_BI_RT_CTRL, CXL_BI_RT_REGISTERS_OFFSET + 0x4)
+ FIELD(CXL_BI_RT_CTRL, COMMIT, 0, 1)
+REG32(CXL_BI_RT_STATUS, CXL_BI_RT_REGISTERS_OFFSET + 0x8)
+ FIELD(CXL_BI_RT_STATUS, COMMITTED, 0, 1)
+ FIELD(CXL_BI_RT_STATUS, ERR_NOT_COMMITTED, 1, 1)
+ FIELD(CXL_BI_RT_STATUS, COMMIT_TMO_SCALE, 8, 4)
+ FIELD(CXL_BI_RT_STATUS, COMMIT_TMO_BASE, 12, 4)
+
+/* CXL r3.2 8.2.4.27 - CXL BI Decoder Capability Structure */
+#define CXL_BI_DECODER_CAP_VERSION 1
+#define CXL_BI_DECODER_REGISTERS_OFFSET \
+ (CXL_BI_RT_REGISTERS_OFFSET + CXL_BI_RT_REGISTERS_SIZE)
+#define CXL_BI_DECODER_REGISTERS_SIZE 0xC
+
+REG32(CXL_BI_DECODER_CAPABILITY, CXL_BI_DECODER_REGISTERS_OFFSET)
+ FIELD(CXL_BI_DECODER_CAPABILITY, HDM_D, 0, 1)
+ FIELD(CXL_BI_DECODER_CAPABILITY, EXPLICIT_COMMIT, 1, 1)
+REG32(CXL_BI_DECODER_CTRL, CXL_BI_DECODER_REGISTERS_OFFSET + 0x4)
+ FIELD(CXL_BI_DECODER_CTRL, BI_FW, 0, 1)
+ FIELD(CXL_BI_DECODER_CTRL, BI_ENABLE, 1, 1)
+ FIELD(CXL_BI_DECODER_CTRL, COMMIT, 2, 1)
+REG32(CXL_BI_DECODER_STATUS, CXL_BI_DECODER_REGISTERS_OFFSET + 0x8)
+ FIELD(CXL_BI_DECODER_STATUS, COMMITTED, 0, 1)
+ FIELD(CXL_BI_DECODER_STATUS, ERR_NOT_COMMITTED, 1, 1)
+ FIELD(CXL_BI_DECODER_STATUS, COMMIT_TMO_SCALE, 8, 4)
+ FIELD(CXL_BI_DECODER_STATUS, COMMIT_TMO_BASE, 12, 4)
+
+QEMU_BUILD_BUG_MSG((CXL_BI_DECODER_REGISTERS_OFFSET +
+ CXL_BI_DECODER_REGISTERS_SIZE) >= 0x1000,
"No space for registers");
+/* track BI explicit commit handling for route table and decoder */
+enum {
+ CXL_BISTATE_RT = 0,
+ CXL_BISTATE_DECODER,
+ CXL_BISTATE_MAX
+};
+
+typedef struct bi_state {
+ uint64_t last_commit; /* last 0->1 transition */
+} BIState;
+
typedef struct component_registers {
/*
* Main memory region to be registered with QEMU core.
@@ -259,6 +306,7 @@ typedef struct cxl_component {
};
CDATObject cdat;
+ BIState bi_state[CXL_BISTATE_MAX];
} CXLComponentState;
void cxl_component_register_block_init(Object *obj,
@@ -266,7 +314,7 @@ void cxl_component_register_block_init(Object *obj,
const char *type);
void cxl_component_register_init_common(uint32_t *reg_state,
uint32_t *write_msk,
- enum reg_type type);
+ enum reg_type type, bool bi);
void cxl_component_create_dvsec(CXLComponentState *cxl_cstate,
enum reg_type cxl_dev_type, uint16_t length,
diff --git a/include/hw/cxl/cxl_device.h b/include/hw/cxl/cxl_device.h
index 7d9236db8c..393f312217 100644
--- a/include/hw/cxl/cxl_device.h
+++ b/include/hw/cxl/cxl_device.h
@@ -770,6 +770,9 @@ struct CXLType3Dev {
CXLMemSparingReadAttrs rank_sparing_attrs;
CXLMemSparingWriteAttrs rank_sparing_wr_attrs;
+ /* BI flows */
+ bool hdmdb;
+
struct dynamic_capacity {
HostMemoryBackend *host_dc;
AddressSpace host_dc_as;
--
MST
^ permalink raw reply related [flat|nested] 39+ messages in thread
* [PULL 21/33] hw/cxl: Remove register special_ops->read()
2026-02-22 14:28 [PULL 00/33] virtio,pc,pci: features, fixes Michael S. Tsirkin
` (19 preceding siblings ...)
2026-02-22 14:29 ` [PULL 20/33] hw/cxl: Support type3 HDM-DB Michael S. Tsirkin
@ 2026-02-22 14:29 ` Michael S. Tsirkin
2026-02-22 14:29 ` [PULL 22/33] net/vhost-vdpa: Whitelist virtio-net GSO for shadow virtqueue Michael S. Tsirkin
` (12 subsequent siblings)
33 siblings, 0 replies; 39+ messages in thread
From: Michael S. Tsirkin @ 2026-02-22 14:29 UTC (permalink / raw)
To: qemu-devel
Cc: Peter Maydell, Davidlohr Bueso, Jonathan.Cameron, Dongjoo Seo,
Fan Ni
From: Davidlohr Bueso <dave@stgolabs.net>
... this is unused, unlike its write counterpart.
Scope needs to be added to avoid _Static_assert() immediately
after a label. c23 makes this valid but before then it is compiler
dependent.
Suggested-by: Jonathan.Cameron@huawei.com
Tested-by: Dongjoo Seo <dongjoo.seo1@samsung.com>
Signed-off-by: Davidlohr Bueso <dave@stgolabs.net>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20260204170936.43959-8-Jonathan.Cameron@huawei.com>
---
hw/cxl/cxl-component-utils.c | 7 ++-----
1 file changed, 2 insertions(+), 5 deletions(-)
diff --git a/hw/cxl/cxl-component-utils.c b/hw/cxl/cxl-component-utils.c
index a7d36e1128..07aabe331c 100644
--- a/hw/cxl/cxl-component-utils.c
+++ b/hw/cxl/cxl-component-utils.c
@@ -68,11 +68,7 @@ static uint64_t cxl_cache_mem_read_reg(void *opaque, hwaddr offset,
ComponentRegisters *cregs = &cxl_cstate->crb;
switch (size) {
- case 4:
- if (cregs->special_ops && cregs->special_ops->read) {
- return cregs->special_ops->read(cxl_cstate, offset, 4);
- }
-
+ case 4: {
QEMU_BUILD_BUG_ON(sizeof(*cregs->cache_mem_registers) != 4);
if (offset == A_CXL_BI_RT_STATUS ||
@@ -105,6 +101,7 @@ static uint64_t cxl_cache_mem_read_reg(void *opaque, hwaddr offset,
}
return cregs->cache_mem_registers[offset / 4];
+ }
case 8:
qemu_log_mask(LOG_UNIMP,
"CXL 8 byte cache mem registers not implemented\n");
--
MST
^ permalink raw reply related [flat|nested] 39+ messages in thread
* [PULL 22/33] net/vhost-vdpa: Whitelist virtio-net GSO for shadow virtqueue
2026-02-22 14:28 [PULL 00/33] virtio,pc,pci: features, fixes Michael S. Tsirkin
` (20 preceding siblings ...)
2026-02-22 14:29 ` [PULL 21/33] hw/cxl: Remove register special_ops->read() Michael S. Tsirkin
@ 2026-02-22 14:29 ` Michael S. Tsirkin
2026-02-22 14:29 ` [PULL 23/33] intel_iommu: Do not report recoverable faults to host Michael S. Tsirkin
` (11 subsequent siblings)
33 siblings, 0 replies; 39+ messages in thread
From: Michael S. Tsirkin @ 2026-02-22 14:29 UTC (permalink / raw)
To: qemu-devel
Cc: Peter Maydell, Eugenio Pérez, Stefano Garzarella, Jason Wang
From: Eugenio Pérez <eperezma@redhat.com>
Even if it is deprecated by the VirtIO standard it does not affect the
layout of the queue, or introduces new operations. So Shadow Virtqueue
can handle it just fine.
Tested with OVS DPDK and VDUSE.
Signed-off-by: Eugenio Pérez <eperezma@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20260206144717.730799-1-eperezma@redhat.com>
---
net/vhost-vdpa.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/net/vhost-vdpa.c b/net/vhost-vdpa.c
index f4b1f0e9e0..3df6091274 100644
--- a/net/vhost-vdpa.c
+++ b/net/vhost-vdpa.c
@@ -116,6 +116,7 @@ static const uint64_t vdpa_svq_device_features =
BIT_ULL(VIRTIO_NET_F_MRG_RXBUF) |
BIT_ULL(VIRTIO_NET_F_STATUS) |
BIT_ULL(VIRTIO_NET_F_CTRL_VQ) |
+ BIT_ULL(VIRTIO_NET_F_GSO) |
BIT_ULL(VIRTIO_NET_F_CTRL_RX) |
BIT_ULL(VIRTIO_NET_F_CTRL_VLAN) |
BIT_ULL(VIRTIO_NET_F_CTRL_RX_EXTRA) |
--
MST
^ permalink raw reply related [flat|nested] 39+ messages in thread
* [PULL 23/33] intel_iommu: Do not report recoverable faults to host
2026-02-22 14:28 [PULL 00/33] virtio,pc,pci: features, fixes Michael S. Tsirkin
` (21 preceding siblings ...)
2026-02-22 14:29 ` [PULL 22/33] net/vhost-vdpa: Whitelist virtio-net GSO for shadow virtqueue Michael S. Tsirkin
@ 2026-02-22 14:29 ` Michael S. Tsirkin
2026-02-22 14:29 ` [PULL 24/33] virtio-gpu-virgl: Add virtio-gpu-virgl-hostmem-region type Michael S. Tsirkin
` (10 subsequent siblings)
33 siblings, 0 replies; 39+ messages in thread
From: Michael S. Tsirkin @ 2026-02-22 14:29 UTC (permalink / raw)
To: qemu-devel
Cc: Peter Maydell, Clement Mathieu--Drif, Zhenzhong Duan, Jason Wang,
Yi Liu, Marcel Apfelbaum, Paolo Bonzini, Richard Henderson,
Eduardo Habkost
From: Clement Mathieu--Drif <clement.mathieu--drif@eviden.com>
Signed-off-by: Clement Mathieu--Drif <clement.mathieu--drif@eviden.com>
Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20260208082252.288-1-clement.mathieu--drif@eviden.com>
---
hw/i386/intel_iommu.c | 26 ++++++++++++++++++++++++--
1 file changed, 24 insertions(+), 2 deletions(-)
diff --git a/hw/i386/intel_iommu.c b/hw/i386/intel_iommu.c
index 92a367d657..4924aa4375 100644
--- a/hw/i386/intel_iommu.c
+++ b/hw/i386/intel_iommu.c
@@ -1857,6 +1857,21 @@ static const bool vtd_qualified_faults[] = {
[VTD_FR_MAX] = false,
};
+static const bool vtd_recoverable_faults[] = {
+ [VTD_FR_WRITE] = true,
+ [VTD_FR_READ] = true,
+ [VTD_FR_PASID_DIR_ENTRY_P] = true,
+ [VTD_FR_PASID_ENTRY_P] = true,
+ [VTD_FR_FS_PAGING_ENTRY_INV] = true,
+ [VTD_FR_FS_PAGING_ENTRY_P] = true,
+ [VTD_FR_FS_PAGING_ENTRY_RSVD] = true,
+ [VTD_FR_PASID_ENTRY_FSPTPTR_INV] = true,
+ [VTD_FR_FS_NON_CANONICAL] = true,
+ [VTD_FR_FS_PAGING_ENTRY_US] = true,
+ [VTD_FR_SM_WRITE] = true,
+ [VTD_FR_MAX] = false,
+};
+
/* To see if a fault condition is "qualified", which is reported to software
* only if the FPD field in the context-entry used to process the faulting
* request is 0.
@@ -1866,6 +1881,11 @@ static inline bool vtd_is_qualified_fault(VTDFaultReason fault)
return vtd_qualified_faults[fault];
}
+static inline bool vtd_is_recoverable_fault(VTDFaultReason fault, int iommu_idx)
+{
+ return iommu_idx == VTD_IDX_ATS && vtd_recoverable_faults[fault];
+}
+
static inline bool vtd_is_interrupt_addr(hwaddr addr)
{
return VTD_INTERRUPT_ADDR_FIRST <= addr && addr <= VTD_INTERRUPT_ADDR_LAST;
@@ -2237,8 +2257,10 @@ static bool vtd_do_iommu_translate(VTDAddressSpace *vtd_as, PCIBus *bus,
}
if (ret_fr) {
- vtd_report_fault(s, -ret_fr, is_fpd_set, source_id,
- addr, is_write, pasid != PCI_NO_PASID, pasid);
+ if (!vtd_is_recoverable_fault(-ret_fr, iommu_idx)) {
+ vtd_report_fault(s, -ret_fr, is_fpd_set, source_id,
+ addr, is_write, pasid != PCI_NO_PASID, pasid);
+ }
goto error;
}
--
MST
^ permalink raw reply related [flat|nested] 39+ messages in thread
* [PULL 24/33] virtio-gpu-virgl: Add virtio-gpu-virgl-hostmem-region type
2026-02-22 14:28 [PULL 00/33] virtio,pc,pci: features, fixes Michael S. Tsirkin
` (22 preceding siblings ...)
2026-02-22 14:29 ` [PULL 23/33] intel_iommu: Do not report recoverable faults to host Michael S. Tsirkin
@ 2026-02-22 14:29 ` Michael S. Tsirkin
2026-02-22 14:29 ` [PULL 25/33] hw/cxl: Physical Port Info FMAPI - update to current spec and add defines Michael S. Tsirkin
` (9 subsequent siblings)
33 siblings, 0 replies; 39+ messages in thread
From: Michael S. Tsirkin @ 2026-02-22 14:29 UTC (permalink / raw)
To: qemu-devel
Cc: Peter Maydell, Akihiko Odaki, qemu-stable, Dmitry Osipenko,
Joelle van Dyne, Alex Bennée
From: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Commit e27194e087ae ("virtio-gpu-virgl: correct parent for blob memory
region") made the name member of MemoryRegion unset, causing a NULL
pointer dereference[1]:
> Thread 2 "qemu-system-x86" received signal SIGSEGV, Segmentation fault.
> (gdb) bt
> #0 0x00007ffff56565e2 in __strcmp_evex () at /lib64/libc.so.6
> #1 0x0000555555841bdb in find_fd (head=0x5555572337d0 <cpr_state>,
> name=0x0, id=0) at ../migration/cpr.c:68
> #2 cpr_delete_fd (name=name@entry=0x0, id=id@entry=0) at
> ../migration/cpr.c:77
> #3 0x000055555582290a in qemu_ram_free (block=0x7ff7e93aa7f0) at
> ../system/physmem.c:2615
> #4 0x000055555581ae02 in memory_region_finalize (obj=<optimized out>)
> at ../system/memory.c:1816
> #5 0x0000555555a70ab9 in object_deinit (obj=<optimized out>,
> type=<optimized out>) at ../qom/object.c:715
> #6 object_finalize (data=0x7ff7e936eff0) at ../qom/object.c:729
> #7 object_unref (objptr=0x7ff7e936eff0) at ../qom/object.c:1232
> #8 0x0000555555814fae in memory_region_unref (mr=<optimized out>) at
> ../system/memory.c:1848
> #9 flatview_destroy (view=0x555559ed6c40) at ../system/memory.c:301
> #10 0x0000555555bfc122 in call_rcu_thread (opaque=<optimized out>) at
> ../util/rcu.c:324
> #11 0x0000555555bf17a7 in qemu_thread_start (args=0x555557b99520) at
> ../util/qemu-thread-posix.c:393
> #12 0x00007ffff556f464 in start_thread () at /lib64/libc.so.6
> #13 0x00007ffff55f25ac in __clone3 () at /lib64/libc.so.6
The intention of the aforementioned commit is to prevent a MemoryRegion
from parenting itself while its references is counted indendependently
of the device. To achieve the same goal, add a type of QOM objects that
count references and parent MemoryRegions.
[1] https://lore.kernel.org/qemu-devel/4eb93d7a-1fa9-4b3c-8ad7-a2eb64f025a0@collabora.com/
Cc: qemu-stable@nongnu.org
Fixes: e27194e087ae ("virtio-gpu-virgl: correct parent for blob memory region")
Signed-off-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Tested-by: Dmitry Osipenko <dmitry.osipenko@collabora.com>
Tested-by: Joelle van Dyne <j@getutm.app>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20260214-region-v1-1-229f00ae1f38@rsg.ci.i.u-tokyo.ac.jp>
---
hw/display/virtio-gpu-virgl.c | 54 +++++++++++++++++++++++++----------
1 file changed, 39 insertions(+), 15 deletions(-)
diff --git a/hw/display/virtio-gpu-virgl.c b/hw/display/virtio-gpu-virgl.c
index ecf8494f36..0f754829fb 100644
--- a/hw/display/virtio-gpu-virgl.c
+++ b/hw/display/virtio-gpu-virgl.c
@@ -52,11 +52,17 @@ virgl_get_egl_display(G_GNUC_UNUSED void *cookie)
#if VIRGL_VERSION_MAJOR >= 1
struct virtio_gpu_virgl_hostmem_region {
+ Object parent_obj;
MemoryRegion mr;
struct VirtIOGPU *g;
bool finish_unmapping;
};
+#define TYPE_VIRTIO_GPU_VIRGL_HOSTMEM_REGION "virtio-gpu-virgl-hostmem-region"
+
+OBJECT_DECLARE_SIMPLE_TYPE(virtio_gpu_virgl_hostmem_region,
+ VIRTIO_GPU_VIRGL_HOSTMEM_REGION)
+
static struct virtio_gpu_virgl_hostmem_region *
to_hostmem_region(MemoryRegion *mr)
{
@@ -70,14 +76,22 @@ static void virtio_gpu_virgl_resume_cmdq_bh(void *opaque)
virtio_gpu_process_cmdq(g);
}
-static void virtio_gpu_virgl_hostmem_region_free(void *obj)
+/*
+ * MR could outlive the resource if MR's reference is held outside of
+ * virtio-gpu. In order to prevent unmapping resource while MR is alive,
+ * and thus, making the data pointer invalid, we will block virtio-gpu
+ * command processing until MR is fully unreferenced and freed.
+ */
+static void virtio_gpu_virgl_hostmem_region_finalize(Object *obj)
{
- MemoryRegion *mr = MEMORY_REGION(obj);
- struct virtio_gpu_virgl_hostmem_region *vmr;
+ struct virtio_gpu_virgl_hostmem_region *vmr = VIRTIO_GPU_VIRGL_HOSTMEM_REGION(obj);
VirtIOGPUBase *b;
VirtIOGPUGL *gl;
- vmr = to_hostmem_region(mr);
+ if (!vmr->g) {
+ return;
+ }
+
vmr->finish_unmapping = true;
b = VIRTIO_GPU_BASE(vmr->g);
@@ -92,11 +106,26 @@ static void virtio_gpu_virgl_hostmem_region_free(void *obj)
qemu_bh_schedule(gl->cmdq_resume_bh);
}
+static const TypeInfo virtio_gpu_virgl_hostmem_region_info = {
+ .parent = TYPE_OBJECT,
+ .name = TYPE_VIRTIO_GPU_VIRGL_HOSTMEM_REGION,
+ .instance_size = sizeof(struct virtio_gpu_virgl_hostmem_region),
+ .instance_finalize = virtio_gpu_virgl_hostmem_region_finalize
+};
+
+static void virtio_gpu_virgl_types(void)
+{
+ type_register_static(&virtio_gpu_virgl_hostmem_region_info);
+}
+
+type_init(virtio_gpu_virgl_types)
+
static int
virtio_gpu_virgl_map_resource_blob(VirtIOGPU *g,
struct virtio_gpu_virgl_resource *res,
uint64_t offset)
{
+ g_autofree char *name = NULL;
struct virtio_gpu_virgl_hostmem_region *vmr;
VirtIOGPUBase *b = VIRTIO_GPU_BASE(g);
MemoryRegion *mr;
@@ -117,21 +146,16 @@ virtio_gpu_virgl_map_resource_blob(VirtIOGPU *g,
}
vmr = g_new0(struct virtio_gpu_virgl_hostmem_region, 1);
+ name = g_strdup_printf("blob[%" PRIu32 "]", res->base.resource_id);
+ object_initialize_child(OBJECT(g), name, vmr,
+ TYPE_VIRTIO_GPU_VIRGL_HOSTMEM_REGION);
vmr->g = g;
mr = &vmr->mr;
- memory_region_init_ram_ptr(mr, OBJECT(mr), NULL, size, data);
+ memory_region_init_ram_ptr(mr, OBJECT(vmr), "mr", size, data);
memory_region_add_subregion(&b->hostmem, offset, mr);
memory_region_set_enabled(mr, true);
- /*
- * MR could outlive the resource if MR's reference is held outside of
- * virtio-gpu. In order to prevent unmapping resource while MR is alive,
- * and thus, making the data pointer invalid, we will block virtio-gpu
- * command processing until MR is fully unreferenced and freed.
- */
- OBJECT(mr)->free = virtio_gpu_virgl_hostmem_region_free;
-
res->mr = mr;
trace_virtio_gpu_cmd_res_map_blob(res->base.resource_id, vmr, mr);
@@ -163,7 +187,7 @@ virtio_gpu_virgl_unmap_resource_blob(VirtIOGPU *g,
* 1. Begin async unmapping with memory_region_del_subregion()
* and suspend/block cmd processing.
* 2. Wait for res->mr to be freed and cmd processing resumed
- * asynchronously by virtio_gpu_virgl_hostmem_region_free().
+ * asynchronously by virtio_gpu_virgl_hostmem_region_finalize().
* 3. Finish the unmapping with final virgl_renderer_resource_unmap().
*/
if (vmr->finish_unmapping) {
@@ -186,7 +210,7 @@ virtio_gpu_virgl_unmap_resource_blob(VirtIOGPU *g,
/* memory region owns self res->mr object and frees it by itself */
memory_region_set_enabled(mr, false);
memory_region_del_subregion(&b->hostmem, mr);
- object_unref(OBJECT(mr));
+ object_unparent(OBJECT(vmr));
}
return 0;
--
MST
^ permalink raw reply related [flat|nested] 39+ messages in thread
* [PULL 25/33] hw/cxl: Physical Port Info FMAPI - update to current spec and add defines.
2026-02-22 14:28 [PULL 00/33] virtio,pc,pci: features, fixes Michael S. Tsirkin
` (23 preceding siblings ...)
2026-02-22 14:29 ` [PULL 24/33] virtio-gpu-virgl: Add virtio-gpu-virgl-hostmem-region type Michael S. Tsirkin
@ 2026-02-22 14:29 ` Michael S. Tsirkin
2026-02-22 14:29 ` [PULL 26/33] hw/cxl: Get Physical Port State - update for PCIe flit mode Michael S. Tsirkin
` (8 subsequent siblings)
33 siblings, 0 replies; 39+ messages in thread
From: Michael S. Tsirkin @ 2026-02-22 14:29 UTC (permalink / raw)
To: qemu-devel; +Cc: Peter Maydell, Arpit Kumar, Jonathan Cameron, Fan Ni
From: Arpit Kumar <arpit1.kumar@samsung.com>
Add a new cxl/cxl_ports.h header for field definitions related only to port
commands. Bring field naming up to date with spec as 'version' bitmasks
have been replaced with bitmasks of the specific features.
Fix a small issue where a reserved value for USP was set to 2 rather
than 0.
Signed-off-by: Arpit Kumar <arpit1.kumar@samsung.com>
Co-developed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Signed-off-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20260204173223.44122-2-Jonathan.Cameron@huawei.com>
---
hw/cxl/cxl-mailbox-utils.c | 31 ++++++++++++++--------
include/hw/cxl/cxl_port.h | 53 ++++++++++++++++++++++++++++++++++++++
2 files changed, 73 insertions(+), 11 deletions(-)
create mode 100644 include/hw/cxl/cxl_port.h
diff --git a/hw/cxl/cxl-mailbox-utils.c b/hw/cxl/cxl-mailbox-utils.c
index 2f449980cd..1c8cbe0f68 100644
--- a/hw/cxl/cxl-mailbox-utils.c
+++ b/hw/cxl/cxl-mailbox-utils.c
@@ -15,6 +15,7 @@
#include "hw/cxl/cxl.h"
#include "hw/cxl/cxl_events.h"
#include "hw/cxl/cxl_mailbox.h"
+#include "hw/cxl/cxl_port.h"
#include "hw/pci/pci.h"
#include "hw/pci-bridge/cxl_upstream_port.h"
#include "qemu/cutils.h"
@@ -565,16 +566,16 @@ static CXLRetCode cmd_get_physical_port_state(const struct cxl_cmd *cmd,
} QEMU_PACKED *in;
/*
- * CXL r3.1 Table 7-19: Get Physical Port State Port Information Block
+ * CXL r3.2 Table 7-19: Get Physical Port State Port Information Block
* Format
*/
struct cxl_fmapi_port_state_info_block {
uint8_t port_id;
uint8_t config_state;
- uint8_t connected_device_cxl_version;
+ uint8_t connected_device_mode;
uint8_t rsv1;
uint8_t connected_device_type;
- uint8_t port_cxl_version_bitmask;
+ uint8_t supported_cxl_mode_bitmask;
uint8_t max_link_width;
uint8_t negotiated_link_width;
uint8_t supported_link_speeds_vector;
@@ -623,21 +624,30 @@ static CXLRetCode cmd_get_physical_port_state(const struct cxl_cmd *cmd,
if (port_dev) { /* DSP */
PCIDevice *ds_dev = pci_bridge_get_sec_bus(PCI_BRIDGE(port_dev))
->devices[0];
- port->config_state = 3;
+ port->config_state = CXL_PORT_CONFIG_STATE_DSP;
if (ds_dev) {
if (object_dynamic_cast(OBJECT(ds_dev), TYPE_CXL_TYPE3)) {
- port->connected_device_type = 5; /* Assume MLD for now */
+ /* Assume MLD for now */
+ port->connected_device_type =
+ CXL_PORT_CONNECTED_DEV_TYPE_3_MLD;
} else {
- port->connected_device_type = 1;
+ port->connected_device_type =
+ CXL_PORT_CONNECTED_DEV_TYPE_PCIE;
+ port->connected_device_mode =
+ CXL_PORT_CONNECTED_DEV_MODE_NOT_CXL_OR_DISCONN;
+
}
} else {
- port->connected_device_type = 0;
+ port->connected_device_type = CXL_PORT_CONNECTED_DEV_TYPE_NONE;
+ port->connected_device_mode =
+ CXL_PORT_CONNECTED_DEV_MODE_NOT_CXL_OR_DISCONN;
}
port->supported_ld_count = 3;
} else if (usp->port == in->ports[i]) { /* USP */
port_dev = PCI_DEVICE(usp);
- port->config_state = 4;
- port->connected_device_type = 0;
+ port->config_state = CXL_PORT_CONFIG_STATE_USP;
+ port->connected_device_type = 0; /* Reserved for USP */
+ port->connected_device_mode = 0; /* Reserved for USP */
} else {
return CXL_MBOX_INVALID_INPUT;
}
@@ -667,8 +677,7 @@ static CXLRetCode cmd_get_physical_port_state(const struct cxl_cmd *cmd,
port->ltssm_state = 0x7;
port->first_lane_num = 0;
port->link_state = 0;
- port->port_cxl_version_bitmask = 0x2;
- port->connected_device_cxl_version = 0x2;
+ port->supported_cxl_mode_bitmask = CXL_PORT_SUPPORTS_68B_VH;
}
pl_size = sizeof(*out) + sizeof(*out->ports) * in->num_ports;
diff --git a/include/hw/cxl/cxl_port.h b/include/hw/cxl/cxl_port.h
new file mode 100644
index 0000000000..04db60f7bc
--- /dev/null
+++ b/include/hw/cxl/cxl_port.h
@@ -0,0 +1,53 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+
+#ifndef CXL_PORT_H
+#define CXL_PORT_H
+
+/* CXL r3.2 Table 7-19: Get Physical Port State Port Information Block Format */
+#define CXL_PORT_CONFIG_STATE_DISABLED 0x0
+#define CXL_PORT_CONFIG_STATE_BIND_IN_PROGRESS 0x1
+#define CXL_PORT_CONFIG_STATE_UNBIND_IN_PROGRESS 0x2
+#define CXL_PORT_CONFIG_STATE_DSP 0x3
+#define CXL_PORT_CONFIG_STATE_USP 0x4
+#define CXL_PORT_CONFIG_STATE_FABRIC_PORT 0x5
+#define CXL_PORT_CONFIG_STATE_INVALID_PORT_ID 0xF
+
+#define CXL_PORT_CONNECTED_DEV_MODE_NOT_CXL_OR_DISCONN 0x00
+#define CXL_PORT_CONNECTED_DEV_MODE_RCD 0x01
+#define CXL_PORT_CONNECTED_DEV_MODE_68B_VH 0x02
+#define CXL_PORT_CONNECTED_DEV_MODE_256B 0x03
+#define CXL_PORT_CONNECTED_DEV_MODE_LO_256B 0x04
+#define CXL_PORT_CONNECTED_DEV_MODE_PBR 0x05
+
+#define CXL_PORT_CONNECTED_DEV_TYPE_NONE 0x00
+#define CXL_PORT_CONNECTED_DEV_TYPE_PCIE 0x01
+#define CXL_PORT_CONNECTED_DEV_TYPE_1 0x02
+#define CXL_PORT_CONNECTED_DEV_TYPE_2_OR_HBR_SWITCH 0x03
+#define CXL_PORT_CONNECTED_DEV_TYPE_3_SLD 0x04
+#define CXL_PORT_CONNECTED_DEV_TYPE_3_MLD 0x05
+#define CXL_PORT_CONNECTED_DEV_PBR_COMPONENT 0x06
+
+#define CXL_PORT_SUPPORTS_RCD BIT(0)
+#define CXL_PORT_SUPPORTS_68B_VH BIT(1)
+#define CXL_PORT_SUPPORTS_256B BIT(2)
+#define CXL_PORT_SUPPORTS_LO_256B BIT(3)
+#define CXL_PORT_SUPPORTS_PBR BIT(4)
+
+#define CXL_PORT_LTSSM_DETECT 0x00
+#define CXL_PORT_LTSSM_POLLING 0x01
+#define CXL_PORT_LTSSM_CONFIGURATION 0x02
+#define CXL_PORT_LTSSM_RECOVERY 0x03
+#define CXL_PORT_LTSSM_L0 0x04
+#define CXL_PORT_LTSSM_L0S 0x05
+#define CXL_PORT_LTSSM_L1 0x06
+#define CXL_PORT_LTSSM_L2 0x07
+#define CXL_PORT_LTSSM_DISABLED 0x08
+#define CXL_PORT_LTSSM_LOOPBACK 0x09
+#define CXL_PORT_LTSSM_HOT_RESET 0x0A
+
+#define CXL_PORT_LINK_STATE_FLAG_LANE_REVERSED BIT(0)
+#define CXL_PORT_LINK_STATE_FLAG_PERST_ASSERTED BIT(1)
+#define CXL_PORT_LINK_STATE_FLAG_PRSNT BIT(2)
+#define CXL_PORT_LINK_STATE_FLAG_POWER_OFF BIT(3)
+
+#endif /* CXL_PORT_H */
--
MST
^ permalink raw reply related [flat|nested] 39+ messages in thread
* [PULL 26/33] hw/cxl: Get Physical Port State - update for PCIe flit mode
2026-02-22 14:28 [PULL 00/33] virtio,pc,pci: features, fixes Michael S. Tsirkin
` (24 preceding siblings ...)
2026-02-22 14:29 ` [PULL 25/33] hw/cxl: Physical Port Info FMAPI - update to current spec and add defines Michael S. Tsirkin
@ 2026-02-22 14:29 ` Michael S. Tsirkin
2026-02-22 14:29 ` [PULL 27/33] hw/cxl: Add Physical Port Control FMAPI Command (Opcode 5102h) Michael S. Tsirkin
` (7 subsequent siblings)
33 siblings, 0 replies; 39+ messages in thread
From: Michael S. Tsirkin @ 2026-02-22 14:29 UTC (permalink / raw)
To: qemu-devel; +Cc: Peter Maydell, Jonathan Cameron, Fan Ni
From: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Recent support for 256B flits, was not accounted for in this FMAPI command
that should be retrieving the current status of Physical Switch Ports.
Note x-flit-mode control is via the downstream devices, so for USPs the
property must be checked to establish support, but for DSPs this mode is
always supported (control is with the next port downstream, typically the
end point. All cases the linksta2 register may be queried to obtain
current status. Note the PCI spec is a little confusing as it refers to
this bit only being non 0 if Device Readiness Status (DRS) is in particular
states (basically link trained) but Flit mode is a separate feature and DRS
may not be present. It is not yet emulated in QEMU. So assume that we
should reflect what states DRS would be reporting if it were actually
present.
One small thing to note is that the current link width for a port with
nothing connected reports the same as the capability. This is odd but valid
because the value under these circumstances is undefined (PCIe r6.2 table
7-26 Link Status Register - field Current Link Speed.)
Signed-off-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20260204173223.44122-3-Jonathan.Cameron@huawei.com>
---
hw/cxl/cxl-mailbox-utils.c | 24 ++++++++++++++++++++++--
1 file changed, 22 insertions(+), 2 deletions(-)
diff --git a/hw/cxl/cxl-mailbox-utils.c b/hw/cxl/cxl-mailbox-utils.c
index 1c8cbe0f68..b6ac987ee0 100644
--- a/hw/cxl/cxl-mailbox-utils.c
+++ b/hw/cxl/cxl-mailbox-utils.c
@@ -627,9 +627,26 @@ static CXLRetCode cmd_get_physical_port_state(const struct cxl_cmd *cmd,
port->config_state = CXL_PORT_CONFIG_STATE_DSP;
if (ds_dev) {
if (object_dynamic_cast(OBJECT(ds_dev), TYPE_CXL_TYPE3)) {
+ uint16_t lnksta2;
+
+ if (!port_dev->exp.exp_cap) {
+ return CXL_MBOX_INTERNAL_ERROR;
+ }
+
+ lnksta2 = port_dev->config_read(port_dev,
+ port_dev->exp.exp_cap + PCI_EXP_LNKSTA2,
+ sizeof(lnksta2));
+
/* Assume MLD for now */
port->connected_device_type =
CXL_PORT_CONNECTED_DEV_TYPE_3_MLD;
+ if (lnksta2 & PCI_EXP_LNKSTA2_FLIT) {
+ port->connected_device_mode =
+ CXL_PORT_CONNECTED_DEV_MODE_256B;
+ } else {
+ port->connected_device_mode =
+ CXL_PORT_CONNECTED_DEV_MODE_68B_VH;
+ }
} else {
port->connected_device_type =
CXL_PORT_CONNECTED_DEV_TYPE_PCIE;
@@ -642,12 +659,17 @@ static CXLRetCode cmd_get_physical_port_state(const struct cxl_cmd *cmd,
port->connected_device_mode =
CXL_PORT_CONNECTED_DEV_MODE_NOT_CXL_OR_DISCONN;
}
+ /* DSP currently always support modes implemented in QEMU */
+ port->supported_cxl_mode_bitmask = CXL_PORT_SUPPORTS_68B_VH |
+ CXL_PORT_SUPPORTS_256B;
port->supported_ld_count = 3;
} else if (usp->port == in->ports[i]) { /* USP */
port_dev = PCI_DEVICE(usp);
port->config_state = CXL_PORT_CONFIG_STATE_USP;
port->connected_device_type = 0; /* Reserved for USP */
port->connected_device_mode = 0; /* Reserved for USP */
+ port->supported_cxl_mode_bitmask = CXL_PORT_SUPPORTS_68B_VH |
+ (CXL_USP(usp)->flitmode ? CXL_PORT_SUPPORTS_256B : 0);
} else {
return CXL_MBOX_INVALID_INPUT;
}
@@ -676,8 +698,6 @@ static CXLRetCode cmd_get_physical_port_state(const struct cxl_cmd *cmd,
/* TODO: Track down if we can get the rest of the info */
port->ltssm_state = 0x7;
port->first_lane_num = 0;
- port->link_state = 0;
- port->supported_cxl_mode_bitmask = CXL_PORT_SUPPORTS_68B_VH;
}
pl_size = sizeof(*out) + sizeof(*out->ports) * in->num_ports;
--
MST
^ permalink raw reply related [flat|nested] 39+ messages in thread
* [PULL 27/33] hw/cxl: Add Physical Port Control FMAPI Command (Opcode 5102h)
2026-02-22 14:28 [PULL 00/33] virtio,pc,pci: features, fixes Michael S. Tsirkin
` (25 preceding siblings ...)
2026-02-22 14:29 ` [PULL 26/33] hw/cxl: Get Physical Port State - update for PCIe flit mode Michael S. Tsirkin
@ 2026-02-22 14:29 ` Michael S. Tsirkin
2026-02-22 14:29 ` [PULL 28/33] MAINTAINERS: add me as maintainer to virtio-snd Michael S. Tsirkin
` (6 subsequent siblings)
33 siblings, 0 replies; 39+ messages in thread
From: Michael S. Tsirkin @ 2026-02-22 14:29 UTC (permalink / raw)
To: qemu-devel
Cc: Peter Maydell, Arpit Kumar, Jonathan Cameron, Fan Ni,
Marcel Apfelbaum
From: Arpit Kumar <arpit1.kumar@samsung.com>
Added assert-deassert PERST implementation for physical ports (both USP
and DSP's).
Assert PERST involves bg operation for holding 100ms.
Reset PPB implementation for physical ports.
Signed-off-by: Arpit Kumar <arpit1.kumar@samsung.com>
Co-developed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20260204173223.44122-4-Jonathan.Cameron@huawei.com>
---
hw/cxl/cxl-mailbox-utils.c | 130 ++++++++++++++++++++
hw/pci-bridge/cxl_downstream.c | 9 ++
hw/pci-bridge/cxl_upstream.c | 1 +
include/hw/cxl/cxl_port.h | 20 +++
include/hw/pci-bridge/cxl_downstream_port.h | 12 ++
include/hw/pci-bridge/cxl_upstream_port.h | 2 +
6 files changed, 174 insertions(+)
create mode 100644 include/hw/pci-bridge/cxl_downstream_port.h
diff --git a/hw/cxl/cxl-mailbox-utils.c b/hw/cxl/cxl-mailbox-utils.c
index b6ac987ee0..c83b5f90d4 100644
--- a/hw/cxl/cxl-mailbox-utils.c
+++ b/hw/cxl/cxl-mailbox-utils.c
@@ -17,6 +17,7 @@
#include "hw/cxl/cxl_mailbox.h"
#include "hw/cxl/cxl_port.h"
#include "hw/pci/pci.h"
+#include "hw/pci-bridge/cxl_downstream_port.h"
#include "hw/pci-bridge/cxl_upstream_port.h"
#include "qemu/cutils.h"
#include "qemu/host-utils.h"
@@ -119,6 +120,7 @@ enum {
PHYSICAL_SWITCH = 0x51,
#define IDENTIFY_SWITCH_DEVICE 0x0
#define GET_PHYSICAL_PORT_STATE 0x1
+ #define PHYSICAL_PORT_CONTROL 0x2
TUNNEL = 0x53,
#define MANAGEMENT_COMMAND 0x0
FMAPI_DCD_MGMT = 0x56,
@@ -616,6 +618,7 @@ static CXLRetCode cmd_get_physical_port_state(const struct cxl_cmd *cmd,
struct cxl_fmapi_port_state_info_block *port;
/* First try to match on downstream port */
PCIDevice *port_dev;
+ CXLPhyPortPerst *perst;
uint16_t lnkcap, lnkcap2, lnksta;
port = &out->ports[i];
@@ -663,6 +666,7 @@ static CXLRetCode cmd_get_physical_port_state(const struct cxl_cmd *cmd,
port->supported_cxl_mode_bitmask = CXL_PORT_SUPPORTS_68B_VH |
CXL_PORT_SUPPORTS_256B;
port->supported_ld_count = 3;
+ perst = cxl_dsp_get_perst(CXL_DSP(port_dev));
} else if (usp->port == in->ports[i]) { /* USP */
port_dev = PCI_DEVICE(usp);
port->config_state = CXL_PORT_CONFIG_STATE_USP;
@@ -670,6 +674,7 @@ static CXLRetCode cmd_get_physical_port_state(const struct cxl_cmd *cmd,
port->connected_device_mode = 0; /* Reserved for USP */
port->supported_cxl_mode_bitmask = CXL_PORT_SUPPORTS_68B_VH |
(CXL_USP(usp)->flitmode ? CXL_PORT_SUPPORTS_256B : 0);
+ perst = &CXL_USP(usp)->perst;
} else {
return CXL_MBOX_INVALID_INPUT;
}
@@ -698,6 +703,7 @@ static CXLRetCode cmd_get_physical_port_state(const struct cxl_cmd *cmd,
/* TODO: Track down if we can get the rest of the info */
port->ltssm_state = 0x7;
port->first_lane_num = 0;
+ port->link_state = perst ? CXL_PORT_LINK_STATE_FLAG_PERST_ASSERTED : 0;
}
pl_size = sizeof(*out) + sizeof(*out->ports) * in->num_ports;
@@ -706,6 +712,115 @@ static CXLRetCode cmd_get_physical_port_state(const struct cxl_cmd *cmd,
return CXL_MBOX_SUCCESS;
}
+static void *bg_assertcb(void *opaque)
+{
+ CXLPhyPortPerst *perst = opaque;
+
+ /* holding reset phase for 100ms */
+ while (perst->asrt_time--) {
+ usleep(1000);
+ }
+ perst->issued_assert_perst = true;
+ return NULL;
+}
+
+static CXLRetCode cxl_deassert_perst(Object *obj, CXLPhyPortPerst *perst)
+{
+ if (!perst->issued_assert_perst) {
+ return CXL_MBOX_INTERNAL_ERROR;
+ }
+
+ QEMU_LOCK_GUARD(&perst->lock);
+ resettable_release_reset(obj, RESET_TYPE_COLD);
+ perst->issued_assert_perst = false;
+ perst->asrt_time = ASSERT_WAIT_TIME_MS;
+
+ return CXL_MBOX_SUCCESS;
+}
+
+static CXLRetCode cxl_assert_perst(Object *obj, CXLPhyPortPerst *perst)
+{
+ if (cxl_perst_asserted(perst)) {
+ return CXL_MBOX_INTERNAL_ERROR;
+ }
+
+ QEMU_LOCK_GUARD(&perst->lock);
+ resettable_assert_reset(obj, RESET_TYPE_COLD);
+ qemu_thread_create(&perst->asrt_thread, "assert_thread", bg_assertcb,
+ perst, QEMU_THREAD_DETACHED);
+
+ return CXL_MBOX_SUCCESS;
+}
+
+static CXLDownstreamPort *cxl_find_dsp_on_bus(PCIBus *bus, uint8_t pn)
+{
+
+ PCIDevice *port_dev = pcie_find_port_by_pn(bus, pn);
+
+ if (object_dynamic_cast(OBJECT(port_dev), TYPE_CXL_DSP)) {
+ return CXL_DSP(port_dev);
+ }
+
+ return NULL;
+}
+
+/* CXL r3.2 Section 7.6.7.1.3: Get Physical Port Control (Opcode 5102h) */
+static CXLRetCode cmd_physical_port_control(const struct cxl_cmd *cmd,
+ uint8_t *payload_in,
+ size_t len_in,
+ uint8_t *payload_out,
+ size_t *len_out,
+ CXLCCI *cci)
+{
+ CXLUpstreamPort *pp = CXL_USP(cci->d);
+ CXLPhyPortPerst *perst;
+ PCIDevice *dev;
+
+ struct cxl_fmapi_get_physical_port_control_req_pl {
+ uint8_t ppb_id;
+ uint8_t ports_op;
+ } QEMU_PACKED *in = (void *)payload_in;
+
+ if (len_in < sizeof(*in)) {
+ return CXL_MBOX_INVALID_PAYLOAD_LENGTH;
+ }
+
+ if (PCIE_PORT(pp)->port == in->ppb_id) {
+ dev = PCI_DEVICE(pp);
+ perst = &pp->perst;
+ } else {
+ CXLDownstreamPort *dsp =
+ cxl_find_dsp_on_bus(&PCI_BRIDGE(pp)->sec_bus, in->ppb_id);
+
+ if (!dsp) {
+ return CXL_MBOX_INVALID_INPUT;
+ }
+ dev = PCI_DEVICE(dsp);
+ perst = cxl_dsp_get_perst(dsp);
+ }
+
+ switch (in->ports_op) {
+ case 0:
+ return cxl_assert_perst(OBJECT(&dev->qdev), perst);
+ case 1:
+ return cxl_deassert_perst(OBJECT(&dev->qdev), perst);
+ case 2: {
+ if (!perst) {
+ return CXL_MBOX_INVALID_INPUT;
+ }
+
+ if (perst->issued_assert_perst ||
+ perst->asrt_time < ASSERT_WAIT_TIME_MS) {
+ return CXL_MBOX_INTERNAL_ERROR;
+ }
+ device_cold_reset(&dev->qdev);
+ return CXL_MBOX_SUCCESS;
+ }
+ default:
+ return CXL_MBOX_INVALID_INPUT;
+ }
+}
+
/* CXL r3.1 Section 8.2.9.1.2: Background Operation Status (Opcode 0002h) */
static CXLRetCode cmd_infostat_bg_op_sts(const struct cxl_cmd *cmd,
uint8_t *payload_in,
@@ -4412,6 +4527,8 @@ static const struct cxl_cmd cxl_cmd_set_sw[256][256] = {
cmd_identify_switch_device, 0, 0 },
[PHYSICAL_SWITCH][GET_PHYSICAL_PORT_STATE] = { "SWITCH_PHYSICAL_PORT_STATS",
cmd_get_physical_port_state, ~0, 0 },
+ [PHYSICAL_SWITCH][PHYSICAL_PORT_CONTROL] = { "SWITCH_PHYSICAL_PORT_CONTROL",
+ cmd_physical_port_control, 2, 0 },
[TUNNEL][MANAGEMENT_COMMAND] = { "TUNNEL_MANAGEMENT_COMMAND",
cmd_tunnel_management_cmd, ~0, 0 },
};
@@ -4618,6 +4735,19 @@ static void cxl_rebuild_cel(CXLCCI *cci)
}
}
+void cxl_init_physical_port_control(CXLPhyPortPerst *perst)
+{
+ qemu_mutex_init(&perst->lock);
+ perst->issued_assert_perst = false;
+ /*
+ * Assert PERST involves physical port to be in
+ * hold reset phase for minimum 100ms. No other
+ * physical port control requests are entertained
+ * until Deassert PERST command.
+ */
+ perst->asrt_time = ASSERT_WAIT_TIME_MS;
+}
+
void cxl_init_cci(CXLCCI *cci, size_t payload_max)
{
cci->payload_max = payload_max;
diff --git a/hw/pci-bridge/cxl_downstream.c b/hw/pci-bridge/cxl_downstream.c
index 320818a8f1..ec450d1aa0 100644
--- a/hw/pci-bridge/cxl_downstream.c
+++ b/hw/pci-bridge/cxl_downstream.c
@@ -13,9 +13,11 @@
#include "hw/pci/msi.h"
#include "hw/pci/pcie.h"
#include "hw/pci/pcie_port.h"
+#include "hw/pci-bridge/cxl_downstream_port.h"
#include "hw/core/qdev-properties.h"
#include "hw/core/qdev-properties-system.h"
#include "hw/cxl/cxl.h"
+#include "hw/cxl/cxl_port.h"
#include "qapi/error.h"
typedef struct CXLDownstreamPort {
@@ -24,6 +26,7 @@ typedef struct CXLDownstreamPort {
/*< public >*/
CXLComponentState cxl_cstate;
+ CXLPhyPortPerst perst;
} CXLDownstreamPort;
#define CXL_DOWNSTREAM_PORT_MSI_OFFSET 0x70
@@ -81,6 +84,11 @@ static void cxl_dsp_config_write(PCIDevice *d, uint32_t address,
cxl_dsp_dvsec_write_config(d, address, val, len);
}
+CXLPhyPortPerst *cxl_dsp_get_perst(CXLDownstreamPort *dsp)
+{
+ return &dsp->perst;
+}
+
static void cxl_dsp_reset(DeviceState *qdev)
{
PCIDevice *d = PCI_DEVICE(qdev);
@@ -92,6 +100,7 @@ static void cxl_dsp_reset(DeviceState *qdev)
pci_bridge_reset(qdev);
latch_registers(dsp);
+ cxl_init_physical_port_control(&dsp->perst);
}
static void build_dvsecs(PCIDevice *d, CXLComponentState *cxl)
diff --git a/hw/pci-bridge/cxl_upstream.c b/hw/pci-bridge/cxl_upstream.c
index fb8d19539c..b6281cbd4c 100644
--- a/hw/pci-bridge/cxl_upstream.c
+++ b/hw/pci-bridge/cxl_upstream.c
@@ -103,6 +103,7 @@ static void cxl_usp_reset(DeviceState *qdev)
pcie_cap_deverr_reset(d);
pcie_cap_fill_link_ep_usp(d, usp->width, usp->speed, usp->flitmode);
latch_registers(usp);
+ cxl_init_physical_port_control(&usp->perst);
}
static void build_dvsecs(CXLUpstreamPort *usp)
diff --git a/include/hw/cxl/cxl_port.h b/include/hw/cxl/cxl_port.h
index 04db60f7bc..fb2e22a9f2 100644
--- a/include/hw/cxl/cxl_port.h
+++ b/include/hw/cxl/cxl_port.h
@@ -3,6 +3,8 @@
#ifndef CXL_PORT_H
#define CXL_PORT_H
+#include "qemu/thread.h"
+
/* CXL r3.2 Table 7-19: Get Physical Port State Port Information Block Format */
#define CXL_PORT_CONFIG_STATE_DISABLED 0x0
#define CXL_PORT_CONFIG_STATE_BIND_IN_PROGRESS 0x1
@@ -50,4 +52,22 @@
#define CXL_PORT_LINK_STATE_FLAG_PRSNT BIT(2)
#define CXL_PORT_LINK_STATE_FLAG_POWER_OFF BIT(3)
+#define CXL_MAX_PHY_PORTS 256
+#define ASSERT_WAIT_TIME_MS 100 /* Assert - Deassert PERST */
+
+/* Assert - Deassert PERST */
+typedef struct CXLPhyPortPerst {
+ bool issued_assert_perst;
+ QemuMutex lock; /* protecting assert-deassert reset request */
+ uint64_t asrt_time;
+ QemuThread asrt_thread; /* thread for 100ms delay */
+} CXLPhyPortPerst;
+
+void cxl_init_physical_port_control(CXLPhyPortPerst *perst);
+
+static inline bool cxl_perst_asserted(CXLPhyPortPerst *perst)
+{
+ return perst->issued_assert_perst || perst->asrt_time < ASSERT_WAIT_TIME_MS;
+}
+
#endif /* CXL_PORT_H */
diff --git a/include/hw/pci-bridge/cxl_downstream_port.h b/include/hw/pci-bridge/cxl_downstream_port.h
new file mode 100644
index 0000000000..1611504c87
--- /dev/null
+++ b/include/hw/pci-bridge/cxl_downstream_port.h
@@ -0,0 +1,12 @@
+/*
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#ifndef CXL_DOWNSTREAM_PORT_H
+#define CXL_DOWNSTREAM_PORT_H
+#include "include/hw/cxl/cxl_port.h"
+
+typedef struct CXLDownstreamPort CXLDownstreamPort;
+CXLPhyPortPerst *cxl_dsp_get_perst(CXLDownstreamPort *dsp);
+
+#endif
diff --git a/include/hw/pci-bridge/cxl_upstream_port.h b/include/hw/pci-bridge/cxl_upstream_port.h
index e3d6a27acc..dfe01771c7 100644
--- a/include/hw/pci-bridge/cxl_upstream_port.h
+++ b/include/hw/pci-bridge/cxl_upstream_port.h
@@ -4,6 +4,7 @@
#include "hw/pci/pcie.h"
#include "hw/pci/pcie_port.h"
#include "hw/cxl/cxl.h"
+#include "hw/cxl/cxl_port.h"
typedef struct CXLUpstreamPort {
/*< private >*/
@@ -12,6 +13,7 @@ typedef struct CXLUpstreamPort {
/*< public >*/
CXLComponentState cxl_cstate;
CXLCCI swcci;
+ CXLPhyPortPerst perst;
PCIExpLinkSpeed speed;
PCIExpLinkWidth width;
--
MST
^ permalink raw reply related [flat|nested] 39+ messages in thread
* [PULL 28/33] MAINTAINERS: add me as maintainer to virtio-snd
2026-02-22 14:28 [PULL 00/33] virtio,pc,pci: features, fixes Michael S. Tsirkin
` (26 preceding siblings ...)
2026-02-22 14:29 ` [PULL 27/33] hw/cxl: Add Physical Port Control FMAPI Command (Opcode 5102h) Michael S. Tsirkin
@ 2026-02-22 14:29 ` Michael S. Tsirkin
2026-02-22 14:29 ` [PULL 29/33] virtio-snd: remove TODO comments Michael S. Tsirkin
` (5 subsequent siblings)
33 siblings, 0 replies; 39+ messages in thread
From: Michael S. Tsirkin @ 2026-02-22 14:29 UTC (permalink / raw)
To: qemu-devel
Cc: Peter Maydell, Manos Pitsidianakis, Alex Bennée,
Philippe Mathieu-Daudé, Thomas Huth, Pierrick Bouvier,
Richard Henderson, Cédric Le Goater
From: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Cc: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20260220-virtio-snd-series-v1-1-207c4f7200a2@linaro.org>
---
MAINTAINERS | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/MAINTAINERS b/MAINTAINERS
index 8df82f313e..4918f41ec4 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -2602,7 +2602,7 @@ F: include/hw/virtio/virtio-mem.h
virtio-snd
M: Gerd Hoffmann <kraxel@redhat.com>
-R: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
+M: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
S: Supported
F: hw/audio/virtio-snd.c
F: hw/audio/virtio-snd-pci.c
--
MST
^ permalink raw reply related [flat|nested] 39+ messages in thread
* [PULL 29/33] virtio-snd: remove TODO comments
2026-02-22 14:28 [PULL 00/33] virtio,pc,pci: features, fixes Michael S. Tsirkin
` (27 preceding siblings ...)
2026-02-22 14:29 ` [PULL 28/33] MAINTAINERS: add me as maintainer to virtio-snd Michael S. Tsirkin
@ 2026-02-22 14:29 ` Michael S. Tsirkin
2026-02-22 14:29 ` [PULL 30/33] virtio-snd: handle 5.14.6.2 for PCM_INFO properly Michael S. Tsirkin
` (4 subsequent siblings)
33 siblings, 0 replies; 39+ messages in thread
From: Michael S. Tsirkin @ 2026-02-22 14:29 UTC (permalink / raw)
To: qemu-devel; +Cc: Peter Maydell, Manos Pitsidianakis, Gerd Hoffmann
From: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Replying with a VIRTIO_SND_S_BAD_MSG error does not warrant a device
reset. Instead, a device reset happens when the driver requests it from the
transport.
Signed-off-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20260220-virtio-snd-series-v1-2-207c4f7200a2@linaro.org>
---
hw/audio/virtio-snd.c | 21 ---------------------
1 file changed, 21 deletions(-)
diff --git a/hw/audio/virtio-snd.c b/hw/audio/virtio-snd.c
index ed0422b45a..232179a04a 100644
--- a/hw/audio/virtio-snd.c
+++ b/hw/audio/virtio-snd.c
@@ -168,9 +168,6 @@ static void virtio_snd_handle_pcm_info(VirtIOSound *s,
sizeof(virtio_snd_query_info));
if (msg_sz != sizeof(virtio_snd_query_info)) {
- /*
- * TODO: do we need to set DEVICE_NEEDS_RESET?
- */
qemu_log_mask(LOG_GUEST_ERROR,
"%s: virtio-snd command size incorrect %zu vs \
%zu\n", __func__, msg_sz, sizeof(virtio_snd_query_info));
@@ -184,9 +181,6 @@ static void virtio_snd_handle_pcm_info(VirtIOSound *s,
if (iov_size(cmd->elem->in_sg, cmd->elem->in_num) <
sizeof(virtio_snd_hdr) + size * count) {
- /*
- * TODO: do we need to set DEVICE_NEEDS_RESET?
- */
error_report("pcm info: buffer too small, got: %zu, needed: %zu",
iov_size(cmd->elem->in_sg, cmd->elem->in_num),
sizeof(virtio_snd_pcm_info));
@@ -244,9 +238,6 @@ uint32_t virtio_snd_set_pcm_params(VirtIOSound *s,
virtio_snd_pcm_set_params *st_params;
if (stream_id >= s->snd_conf.streams || s->pcm->pcm_params == NULL) {
- /*
- * TODO: do we need to set DEVICE_NEEDS_RESET?
- */
virtio_error(VIRTIO_DEVICE(s), "Streams have not been initialized.\n");
return cpu_to_le32(VIRTIO_SND_S_BAD_MSG);
}
@@ -297,9 +288,6 @@ static void virtio_snd_handle_pcm_set_params(VirtIOSound *s,
sizeof(virtio_snd_pcm_set_params));
if (msg_sz != sizeof(virtio_snd_pcm_set_params)) {
- /*
- * TODO: do we need to set DEVICE_NEEDS_RESET?
- */
qemu_log_mask(LOG_GUEST_ERROR,
"%s: virtio-snd command size incorrect %zu vs \
%zu\n", __func__, msg_sz, sizeof(virtio_snd_pcm_set_params));
@@ -610,9 +598,6 @@ static void virtio_snd_handle_pcm_release(VirtIOSound *s,
sizeof(stream_id));
if (msg_sz != sizeof(stream_id)) {
- /*
- * TODO: do we need to set DEVICE_NEEDS_RESET?
- */
qemu_log_mask(LOG_GUEST_ERROR,
"%s: virtio-snd command size incorrect %zu vs \
%zu\n", __func__, msg_sz, sizeof(stream_id));
@@ -624,9 +609,6 @@ static void virtio_snd_handle_pcm_release(VirtIOSound *s,
trace_virtio_snd_handle_pcm_release(stream_id);
stream = virtio_snd_pcm_get_stream(s, stream_id);
if (stream == NULL) {
- /*
- * TODO: do we need to set DEVICE_NEEDS_RESET?
- */
error_report("already released stream %"PRIu32, stream_id);
virtio_error(VIRTIO_DEVICE(s),
"already released stream %"PRIu32,
@@ -669,9 +651,6 @@ process_cmd(VirtIOSound *s, virtio_snd_ctrl_command *cmd)
sizeof(virtio_snd_hdr));
if (msg_sz != sizeof(virtio_snd_hdr)) {
- /*
- * TODO: do we need to set DEVICE_NEEDS_RESET?
- */
qemu_log_mask(LOG_GUEST_ERROR,
"%s: virtio-snd command size incorrect %zu vs \
%zu\n", __func__, msg_sz, sizeof(virtio_snd_hdr));
--
MST
^ permalink raw reply related [flat|nested] 39+ messages in thread
* [PULL 30/33] virtio-snd: handle 5.14.6.2 for PCM_INFO properly
2026-02-22 14:28 [PULL 00/33] virtio,pc,pci: features, fixes Michael S. Tsirkin
` (28 preceding siblings ...)
2026-02-22 14:29 ` [PULL 29/33] virtio-snd: remove TODO comments Michael S. Tsirkin
@ 2026-02-22 14:29 ` Michael S. Tsirkin
2026-02-22 14:29 ` [PULL 31/33] virtio-snd: fix max_size bounds check in input cb Michael S. Tsirkin
` (3 subsequent siblings)
33 siblings, 0 replies; 39+ messages in thread
From: Michael S. Tsirkin @ 2026-02-22 14:29 UTC (permalink / raw)
To: qemu-devel
Cc: Peter Maydell, Manos Pitsidianakis, qemu-stable,
罗铭源, Gerd Hoffmann
From: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
The section 5.14.6.2 of the VIRTIO spec says:
5.14.6.2 Driver Requirements: Item Information Request
- The driver MUST NOT set start_id and count such that start_id +
count is greater than the total number of particular items that is
indicated in the device configuration space.
- The driver MUST provide a buffer of sizeof(struct virtio_snd_hdr) +
count * size bytes for the response.
While we performed some check for the second requirement, it failed to
check for integer overflow.
Add also a check for the first requirement, which should limit exposure
to any overflow, since realistically the number of streams will be low
enough in value such that overflow is improbable.
Cc: qemu-stable@nongnu.org
Reported-by: 罗铭源 <myluo24@m.fudan.edu.cn>
Signed-off-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20260220-virtio-snd-series-v1-3-207c4f7200a2@linaro.org>
---
hw/audio/virtio-snd.c | 31 +++++++++++++++++++++++++++----
1 file changed, 27 insertions(+), 4 deletions(-)
diff --git a/hw/audio/virtio-snd.c b/hw/audio/virtio-snd.c
index 232179a04a..ae8bfbca43 100644
--- a/hw/audio/virtio-snd.c
+++ b/hw/audio/virtio-snd.c
@@ -156,7 +156,7 @@ static virtio_snd_pcm_set_params *virtio_snd_pcm_get_params(VirtIOSound *s,
static void virtio_snd_handle_pcm_info(VirtIOSound *s,
virtio_snd_ctrl_command *cmd)
{
- uint32_t stream_id, start_id, count, size;
+ uint32_t stream_id, start_id, count, size, tmp;
virtio_snd_pcm_info val;
virtio_snd_query_info req;
VirtIOSoundPCMStream *stream = NULL;
@@ -179,11 +179,34 @@ static void virtio_snd_handle_pcm_info(VirtIOSound *s,
count = le32_to_cpu(req.count);
size = le32_to_cpu(req.size);
- if (iov_size(cmd->elem->in_sg, cmd->elem->in_num) <
- sizeof(virtio_snd_hdr) + size * count) {
+ /*
+ * 5.14.6.2 Driver Requirements: Item Information Request
+ * "The driver MUST NOT set start_id and count such that start_id + count
+ * is greater than the total number of particular items that is indicated
+ * in the device configuration space."
+ */
+ if (start_id > s->snd_conf.streams
+ || !g_uint_checked_add(&tmp, start_id, count)
+ || start_id + count > s->snd_conf.streams) {
+ error_report("pcm info: start_id + count is greater than the total "
+ "number of streams, got: start_id = %u, count = %u",
+ start_id, count);
+ cmd->resp.code = cpu_to_le32(VIRTIO_SND_S_BAD_MSG);
+ return;
+ }
+
+ /*
+ * 5.14.6.2 Driver Requirements: Item Information Request
+ * "The driver MUST provide a buffer of sizeof(struct virtio_snd_hdr) +
+ * count * size bytes for the response."
+ */
+ if (!g_uint_checked_mul(&tmp, size, count)
+ || !g_uint_checked_add(&tmp, tmp, sizeof(virtio_snd_hdr))
+ || iov_size(cmd->elem->in_sg, cmd->elem->in_num) <
+ sizeof(virtio_snd_hdr) + size * count) {
error_report("pcm info: buffer too small, got: %zu, needed: %zu",
iov_size(cmd->elem->in_sg, cmd->elem->in_num),
- sizeof(virtio_snd_pcm_info));
+ sizeof(virtio_snd_pcm_info) * count);
cmd->resp.code = cpu_to_le32(VIRTIO_SND_S_BAD_MSG);
return;
}
--
MST
^ permalink raw reply related [flat|nested] 39+ messages in thread
* [PULL 31/33] virtio-snd: fix max_size bounds check in input cb
2026-02-22 14:28 [PULL 00/33] virtio,pc,pci: features, fixes Michael S. Tsirkin
` (29 preceding siblings ...)
2026-02-22 14:29 ` [PULL 30/33] virtio-snd: handle 5.14.6.2 for PCM_INFO properly Michael S. Tsirkin
@ 2026-02-22 14:29 ` Michael S. Tsirkin
2026-02-22 14:29 ` [PULL 32/33] virtio-snd: tighten read amount in in_cb Michael S. Tsirkin
` (2 subsequent siblings)
33 siblings, 0 replies; 39+ messages in thread
From: Michael S. Tsirkin @ 2026-02-22 14:29 UTC (permalink / raw)
To: qemu-devel
Cc: Peter Maydell, Manos Pitsidianakis, qemu-stable, DARKNAVY,
Gerd Hoffmann
From: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
In 98e77e3d we calculated the max size and checked that each buffer is smaller than it.
We neglected to subtract the size of the virtio_snd_pcm_status header
from the max size, and max_size was thus larger than the correct value,
leading to potential OOB writes.
If the buffer cannot fit the header or can fit only the header, return
the buffer immediately.
Cc: qemu-stable@nongnu.org
Fixes: 98e77e3dd8dd6e7aa9a7dffa60f49c8c8a49d4e3 ("virtio-snd: add max size bounds check in input cb")
Reported-by: DARKNAVY <vr@darknavy.com>
Signed-off-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20260220-virtio-snd-series-v1-4-207c4f7200a2@linaro.org>
---
hw/audio/virtio-snd.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/hw/audio/virtio-snd.c b/hw/audio/virtio-snd.c
index ae8bfbca43..d1a46d47bc 100644
--- a/hw/audio/virtio-snd.c
+++ b/hw/audio/virtio-snd.c
@@ -1265,6 +1265,12 @@ static void virtio_snd_pcm_in_cb(void *data, int available)
}
max_size = iov_size(buffer->elem->in_sg, buffer->elem->in_num);
+ if (max_size <= sizeof(virtio_snd_pcm_status)) {
+ return_rx_buffer(stream, buffer);
+ continue;
+ }
+ max_size -= sizeof(virtio_snd_pcm_status);
+
for (;;) {
if (buffer->size >= max_size) {
return_rx_buffer(stream, buffer);
--
MST
^ permalink raw reply related [flat|nested] 39+ messages in thread
* [PULL 32/33] virtio-snd: tighten read amount in in_cb
2026-02-22 14:28 [PULL 00/33] virtio,pc,pci: features, fixes Michael S. Tsirkin
` (30 preceding siblings ...)
2026-02-22 14:29 ` [PULL 31/33] virtio-snd: fix max_size bounds check in input cb Michael S. Tsirkin
@ 2026-02-22 14:29 ` Michael S. Tsirkin
2026-02-22 14:29 ` [PULL 33/33] vhost: fix vhost_inflight_buffer_pre_load Michael S. Tsirkin
2026-02-23 9:55 ` [PULL 00/33] virtio,pc,pci: features, fixes Peter Maydell
33 siblings, 0 replies; 39+ messages in thread
From: Michael S. Tsirkin @ 2026-02-22 14:29 UTC (permalink / raw)
To: qemu-devel
Cc: Peter Maydell, Manos Pitsidianakis, qemu-stable, DARKNAVY,
Gerd Hoffmann
From: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
The amount of bytes to read passed to AUD_read() should never surpass
the maximum available buffer length. Tighten the current amount by
MIN(<amount>, max_size - <existing size>).
Cc: qemu-stable@nongnu.org
Fixes: 98e77e3dd8dd6e7aa9a7dffa60f49c8c8a49d4e3 ("virtio-snd: add max size bounds check in input cb")
Reported-by: DARKNAVY <vr@darknavy.com>
Signed-off-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20260220-virtio-snd-series-v1-5-207c4f7200a2@linaro.org>
---
hw/audio/virtio-snd.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/hw/audio/virtio-snd.c b/hw/audio/virtio-snd.c
index d1a46d47bc..d5d430ad65 100644
--- a/hw/audio/virtio-snd.c
+++ b/hw/audio/virtio-snd.c
@@ -1250,7 +1250,7 @@ static void virtio_snd_pcm_in_cb(void *data, int available)
{
VirtIOSoundPCMStream *stream = data;
VirtIOSoundPCMBuffer *buffer;
- size_t size, max_size;
+ size_t size, max_size, to_read;
WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {
while (!QSIMPLEQ_EMPTY(&stream->queue)) {
@@ -1276,10 +1276,12 @@ static void virtio_snd_pcm_in_cb(void *data, int available)
return_rx_buffer(stream, buffer);
break;
}
+ to_read = stream->params.period_bytes - buffer->size;
+ to_read = MIN(to_read, available);
+ to_read = MIN(to_read, max_size - buffer->size);
size = AUD_read(stream->voice.in,
- buffer->data + buffer->size,
- MIN(available, (stream->params.period_bytes -
- buffer->size)));
+ buffer->data + buffer->size,
+ to_read);
if (!size) {
available = 0;
break;
--
MST
^ permalink raw reply related [flat|nested] 39+ messages in thread
* [PULL 33/33] vhost: fix vhost_inflight_buffer_pre_load
2026-02-22 14:28 [PULL 00/33] virtio,pc,pci: features, fixes Michael S. Tsirkin
` (31 preceding siblings ...)
2026-02-22 14:29 ` [PULL 32/33] virtio-snd: tighten read amount in in_cb Michael S. Tsirkin
@ 2026-02-22 14:29 ` Michael S. Tsirkin
2026-02-22 21:16 ` Michael Tokarev
2026-02-23 9:55 ` [PULL 00/33] virtio,pc,pci: features, fixes Peter Maydell
33 siblings, 1 reply; 39+ messages in thread
From: Michael S. Tsirkin @ 2026-02-22 14:29 UTC (permalink / raw)
To: qemu-devel
Cc: Peter Maydell, Alexandr Moshkov, Vladimir Sementsov-Ogievskiy,
Stefano Garzarella
From: Alexandr Moshkov <dtalexundeer@yandex-team.ru>
While I was rebasing my series about inflight migration, I missed a
small issue in vhost_inflight_buffer_preload:
* fix wrong return type in function
* fix error check
Signed-off-by: Alexandr Moshkov <dtalexundeer@yandex-team.ru>
Fixes: tag pls?
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20260220094800.276489-1-dtalexundeer@yandex-team.ru>
---
hw/virtio/vhost.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/hw/virtio/vhost.c b/hw/virtio/vhost.c
index 52801c1796..f83bdcaf8b 100644
--- a/hw/virtio/vhost.c
+++ b/hw/virtio/vhost.c
@@ -1926,8 +1926,8 @@ static bool vhost_inflight_buffer_pre_load(void *opaque, Error **errp)
void *addr = qemu_memfd_alloc("vhost-inflight", inflight->size,
F_SEAL_GROW | F_SEAL_SHRINK | F_SEAL_SEAL,
&fd, errp);
- if (*errp) {
- return -ENOMEM;
+ if (!addr) {
+ return false;
}
inflight->offset = 0;
--
MST
^ permalink raw reply related [flat|nested] 39+ messages in thread
* Re: [PULL 33/33] vhost: fix vhost_inflight_buffer_pre_load
2026-02-22 14:29 ` [PULL 33/33] vhost: fix vhost_inflight_buffer_pre_load Michael S. Tsirkin
@ 2026-02-22 21:16 ` Michael Tokarev
2026-02-23 7:58 ` Michael S. Tsirkin
0 siblings, 1 reply; 39+ messages in thread
From: Michael Tokarev @ 2026-02-22 21:16 UTC (permalink / raw)
To: Michael S. Tsirkin, qemu-devel
Cc: Peter Maydell, Alexandr Moshkov, Vladimir Sementsov-Ogievskiy,
Stefano Garzarella
On 22.02.2026 17:29, Michael S. Tsirkin wrote:
> From: Alexandr Moshkov <dtalexundeer@yandex-team.ru>
>
> While I was rebasing my series about inflight migration, I missed a
> small issue in vhost_inflight_buffer_preload:
>
> * fix wrong return type in function
> * fix error check
>
> Signed-off-by: Alexandr Moshkov <dtalexundeer@yandex-team.ru>
> Fixes: tag pls?
Is this intentional? :)
/mjt
^ permalink raw reply [flat|nested] 39+ messages in thread
* Re: [PULL 33/33] vhost: fix vhost_inflight_buffer_pre_load
2026-02-22 21:16 ` Michael Tokarev
@ 2026-02-23 7:58 ` Michael S. Tsirkin
0 siblings, 0 replies; 39+ messages in thread
From: Michael S. Tsirkin @ 2026-02-23 7:58 UTC (permalink / raw)
To: Michael Tokarev
Cc: qemu-devel, Peter Maydell, Alexandr Moshkov,
Vladimir Sementsov-Ogievskiy, Stefano Garzarella
On Mon, Feb 23, 2026 at 12:16:46AM +0300, Michael Tokarev wrote:
> On 22.02.2026 17:29, Michael S. Tsirkin wrote:
> > From: Alexandr Moshkov <dtalexundeer@yandex-team.ru>
> >
> > While I was rebasing my series about inflight migration, I missed a
> > small issue in vhost_inflight_buffer_preload:
> >
> > * fix wrong return type in function
> > * fix error check
> >
> > Signed-off-by: Alexandr Moshkov <dtalexundeer@yandex-team.ru>
> > Fixes: tag pls?
>
> Is this intentional? :)
>
> /mjt
Ouch (
^ permalink raw reply [flat|nested] 39+ messages in thread
* Re: [PULL 00/33] virtio,pc,pci: features, fixes
2026-02-22 14:28 [PULL 00/33] virtio,pc,pci: features, fixes Michael S. Tsirkin
` (32 preceding siblings ...)
2026-02-22 14:29 ` [PULL 33/33] vhost: fix vhost_inflight_buffer_pre_load Michael S. Tsirkin
@ 2026-02-23 9:55 ` Peter Maydell
33 siblings, 0 replies; 39+ messages in thread
From: Peter Maydell @ 2026-02-23 9:55 UTC (permalink / raw)
To: Michael S. Tsirkin; +Cc: qemu-devel
On Sun, 22 Feb 2026 at 14:28, Michael S. Tsirkin <mst@redhat.com> wrote:
>
> The following changes since commit 07f97d5da04a9f97e273de85c76f5017d8135a6e:
>
> Merge tag 'pull-target-arm-20260219' of https://gitlab.com/pm215/qemu into staging (2026-02-19 10:36:06 +0000)
>
> are available in the Git repository at:
>
> https://git.kernel.org/pub/scm/virt/kvm/mst/qemu.git tags/for_upstream
>
> for you to fetch changes up to 72f663f575ab5e0f31320d7c9f25cc1f086313bd:
>
> vhost: fix vhost_inflight_buffer_pre_load (2026-02-20 13:04:45 -0500)
>
> ----------------------------------------------------------------
> virtio,pc,pci: features, fixes
>
> cxl:
> RAS features
> Back-Invalidate
> Flit mode
> r3.2 spec event updates
> FM-API Physical Switch Command Set support
> vhost-vdpa: allow GSO for SVQ
>
> misc fixes, cleanups in intel_iommu, vhost, virtio, acpi
>
> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
>
Applied, thanks.
Please update the changelog at https://wiki.qemu.org/ChangeLog/11.0
for any user-visible changes.
-- PMM
^ permalink raw reply [flat|nested] 39+ messages in thread
* Re: [PULL 13/33] hw/cxl: Add support for Maintenance command and Post Package Repair (PPR)
2026-02-22 14:28 ` [PULL 13/33] hw/cxl: Add support for Maintenance command and Post Package Repair (PPR) Michael S. Tsirkin
@ 2026-02-24 10:49 ` Peter Maydell
2026-02-24 18:25 ` Shiju Jose via qemu development
0 siblings, 1 reply; 39+ messages in thread
From: Peter Maydell @ 2026-02-24 10:49 UTC (permalink / raw)
To: Michael S. Tsirkin
Cc: qemu-devel, Davidlohr Bueso, Shiju Jose, Jonathan Cameron, Fan Ni
On Sun, 22 Feb 2026 at 14:28, Michael S. Tsirkin <mst@redhat.com> wrote:
>
> From: Davidlohr Bueso <dave@stgolabs.net>
>
> This adds initial support for the Maintenance command, specifically
> the soft and hard PPR operations on a dpa. The implementation allows
> to be executed at runtime, therefore semantically, data is retained
> and CXL.mem requests are correctly processed.
Hi; Coverity emits a warning here (CID 1645325) for use of strncpy():
> +static void cxl_mbox_create_mem_sparing_event_records(CXLType3Dev *ct3d,
> + uint8_t maint_op_class, uint8_t maint_op_sub_class,
> + CXLMaintenance *ent)
> +{
> + CXLEventSparing event_rec = {};
> +
> + cxl_assign_event_header(&event_rec.hdr,
> + &sparing_uuid,
> + (1 << CXL_EVENT_TYPE_INFO),
> + sizeof(event_rec),
> + cxl_device_get_timestamp(&ct3d->cxl_dstate),
> + 1, maint_op_class, 1, maint_op_sub_class,
> + 0, 0, 0, 0);
> + if (ent) {
> + event_rec.flags = 0;
> + event_rec.result = 0;
> + stw_le_p(&event_rec.res_avail, 2);
> + stw_le_p(&event_rec.validity_flags, ent->validity_flags);
> + event_rec.channel = ent->channel;
> + event_rec.rank = ent->rank;
> + st24_le_p(event_rec.nibble_mask, ent->nibble_mask);
> + event_rec.bank_group = ent->bank_group;
> + event_rec.bank = ent->bank;
> + st24_le_p(event_rec.row, ent->row);
> + stw_le_p(&event_rec.column, ent->column);
> + event_rec.sub_channel = ent->sub_channel;
> + if (ent->validity_flags & CXL_MSER_VALID_COMP_ID) {
> + strncpy((char *)event_rec.component_id, (char *)ent->component_id,
> + sizeof(event_rec.component_id));
Since this does a strncpy() with a length parameter equal to the
full size of the struct array field:
> + uint8_t component_id[CXL_EVENT_GEN_MED_COMP_ID_SIZE];
it might result in there being no NUL terminator on the end.
Is that the intended behaviour ?
Conversely, in this function:
> +static void cxl_maintenance_insert(CXLType3Dev *ct3d, uint64_t dpa,
> + bool has_channel, uint8_t channel,
> + bool has_rank, uint8_t rank,
> + bool has_nibble_mask, uint32_t nibble_mask,
> + bool has_bank_group, uint8_t bank_group,
> + bool has_bank, uint8_t bank,
> + bool has_row, uint32_t row,
> + bool has_column, uint16_t column,
> + const char *component_id,
> + bool has_comp_id_pldm, bool is_comp_id_pldm,
> + bool has_sub_channel, uint8_t sub_channel)
> +{
> + CXLMaintenance *ent, *m;
> +
> + QLIST_FOREACH(ent, &ct3d->maint_list, node) {
> + if (dpa == ent->dpa) {
> + return;
> + }
> + }
> + m = g_new0(CXLMaintenance, 1);
> + memset(m, 0, sizeof(*m));
(Side note: this memset() is not wanted, because g_new0() is
specifically "allocate and zero this".)
> + if (component_id) {
> + strncpy((char *)m->component_id, component_id,
> + sizeof(m->component_id) - 1);
...here we do limit the strncpy size to one less than the array
size, which (together with the fact we're doing it into zeroed
memory) means it will always be NUL terminated.
Are these two things really supposed to be handled differently ?
> + m->validity_flags |= CXL_MSER_VALID_COMP_ID;
> + if (has_comp_id_pldm && is_comp_id_pldm) {
> + m->validity_flags |= CXL_MSER_VALID_COMP_ID_FORMAT;
> + }
> + }
> +
> + QLIST_INSERT_HEAD(&ct3d->maint_list, m, node);
> +}
thanks
-- PMM
^ permalink raw reply [flat|nested] 39+ messages in thread
* RE: [PULL 13/33] hw/cxl: Add support for Maintenance command and Post Package Repair (PPR)
2026-02-24 10:49 ` Peter Maydell
@ 2026-02-24 18:25 ` Shiju Jose via qemu development
0 siblings, 0 replies; 39+ messages in thread
From: Shiju Jose via qemu development @ 2026-02-24 18:25 UTC (permalink / raw)
To: Peter Maydell, Michael S. Tsirkin
Cc: qemu-devel@nongnu.org, Davidlohr Bueso, Jonathan Cameron, Fan Ni
>-----Original Message-----
>From: Peter Maydell <peter.maydell@linaro.org>
>Sent: 24 February 2026 10:49
>To: Michael S. Tsirkin <mst@redhat.com>
>Cc: qemu-devel@nongnu.org; Davidlohr Bueso <dave@stgolabs.net>; Shiju Jose
><shiju.jose@huawei.com>; Jonathan Cameron
><jonathan.cameron@huawei.com>; Fan Ni <fan.ni@samsung.com>
>Subject: Re: [PULL 13/33] hw/cxl: Add support for Maintenance command and
>Post Package Repair (PPR)
>
>On Sun, 22 Feb 2026 at 14:28, Michael S. Tsirkin <mst@redhat.com> wrote:
>>
>> From: Davidlohr Bueso <dave@stgolabs.net>
>>
>> This adds initial support for the Maintenance command, specifically
>> the soft and hard PPR operations on a dpa. The implementation allows
>> to be executed at runtime, therefore semantically, data is retained
>> and CXL.mem requests are correctly processed.
>
>Hi; Coverity emits a warning here (CID 1645325) for use of strncpy():
>
>> +static void cxl_mbox_create_mem_sparing_event_records(CXLType3Dev
>*ct3d,
>> + uint8_t maint_op_class, uint8_t maint_op_sub_class,
>> + CXLMaintenance *ent) {
>> + CXLEventSparing event_rec = {};
>> +
>> + cxl_assign_event_header(&event_rec.hdr,
>> + &sparing_uuid,
>> + (1 << CXL_EVENT_TYPE_INFO),
>> + sizeof(event_rec),
>> + cxl_device_get_timestamp(&ct3d->cxl_dstate),
>> + 1, maint_op_class, 1, maint_op_sub_class,
>> + 0, 0, 0, 0);
>> + if (ent) {
>> + event_rec.flags = 0;
>> + event_rec.result = 0;
>> + stw_le_p(&event_rec.res_avail, 2);
>> + stw_le_p(&event_rec.validity_flags, ent->validity_flags);
>> + event_rec.channel = ent->channel;
>> + event_rec.rank = ent->rank;
>> + st24_le_p(event_rec.nibble_mask, ent->nibble_mask);
>> + event_rec.bank_group = ent->bank_group;
>> + event_rec.bank = ent->bank;
>> + st24_le_p(event_rec.row, ent->row);
>> + stw_le_p(&event_rec.column, ent->column);
>> + event_rec.sub_channel = ent->sub_channel;
>> + if (ent->validity_flags & CXL_MSER_VALID_COMP_ID) {
>> + strncpy((char *)event_rec.component_id, (char *)ent->component_id,
>> + sizeof(event_rec.component_id));
>
>Since this does a strncpy() with a length parameter equal to the full size of the
>struct array field:
>
>> + uint8_t component_id[CXL_EVENT_GEN_MED_COMP_ID_SIZE];
>
>it might result in there being no NUL terminator on the end.
>
>Is that the intended behaviour ?
Thanks Peter for reporting.
component_id is fixed data length of 16 bytes without NULL terminator (CXL spec 3.2 Table 8-56.
Component Identifier Format ), but I think need to use memcpy instead (tested okay) to fix this warning?
>
>Conversely, in this function:
>
>> +static void cxl_maintenance_insert(CXLType3Dev *ct3d, uint64_t dpa,
>> + bool has_channel, uint8_t channel,
>> + bool has_rank, uint8_t rank,
>> + bool has_nibble_mask, uint32_t nibble_mask,
>> + bool has_bank_group, uint8_t bank_group,
>> + bool has_bank, uint8_t bank,
>> + bool has_row, uint32_t row,
>> + bool has_column, uint16_t column,
>> + const char *component_id,
>> + bool has_comp_id_pldm, bool is_comp_id_pldm,
>> + bool has_sub_channel, uint8_t
>> +sub_channel) {
>> + CXLMaintenance *ent, *m;
>> +
>> + QLIST_FOREACH(ent, &ct3d->maint_list, node) {
>> + if (dpa == ent->dpa) {
>> + return;
>> + }
>> + }
>> + m = g_new0(CXLMaintenance, 1);
>> + memset(m, 0, sizeof(*m));
>
>(Side note: this memset() is not wanted, because g_new0() is specifically "allocate
>and zero this".)
>
>> + if (component_id) {
>> + strncpy((char *)m->component_id, component_id,
>> + sizeof(m->component_id) - 1);
>
>...here we do limit the strncpy size to one less than the array size, which (together
>with the fact we're doing it into zeroed
>memory) means it will always be NUL terminated.
This should copy CXL_EVENT_GEN_MED_COMP_ID_SIZE (16) bytes instead of
CXL_EVENT_GEN_MED_COMP_ID_SIZE - 1 and also I think should use memcpy instead
as above (tested okay)?
memcpy((char *)m->component_id, component_id,
sizeof(m->component_id));
If so, this should be fixed in other CXL events records as well.
>
>Are these two things really supposed to be handled differently ?
>
>> + m->validity_flags |= CXL_MSER_VALID_COMP_ID;
>> + if (has_comp_id_pldm && is_comp_id_pldm) {
>> + m->validity_flags |= CXL_MSER_VALID_COMP_ID_FORMAT;
>> + }
>> + }
>> +
>> + QLIST_INSERT_HEAD(&ct3d->maint_list, m, node); }
>
>thanks
>-- PMM
Thanks,
Shiju
^ permalink raw reply [flat|nested] 39+ messages in thread
end of thread, other threads:[~2026-02-24 18:25 UTC | newest]
Thread overview: 39+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-02-22 14:28 [PULL 00/33] virtio,pc,pci: features, fixes Michael S. Tsirkin
2026-02-22 14:28 ` [PULL 01/33] tests/vhost-user-bridge: Move to contrib/vhost-user-bridge/ Michael S. Tsirkin
2026-02-22 14:28 ` [PULL 02/33] tests/functional/x86_64: Add vhost-user-bridge test Michael S. Tsirkin
2026-02-22 14:28 ` [PULL 03/33] contrib/vhost-user-bridge: Add UDP receive hexdump Michael S. Tsirkin
2026-02-22 14:28 ` [PULL 04/33] audio/virtio-snd: fix latency calc Michael S. Tsirkin
2026-02-22 14:28 ` [PULL 05/33] tests/data/acpi: disassemble-aml: rename and change interpreter line Michael S. Tsirkin
2026-02-22 14:28 ` [PULL 06/33] hw/virtio: Pass VirtIODevice* to virtio_reset() Michael S. Tsirkin
2026-02-22 14:28 ` [PULL 07/33] qapi: cxl: Refactor CXL event injection for common commands arguments Michael S. Tsirkin
2026-02-22 14:28 ` [PULL 08/33] hw/cxl/events: Update for rev3.2 common event record format Michael S. Tsirkin
2026-02-22 14:28 ` [PULL 09/33] hw/cxl/events: Updates for rev3.2 general media event record Michael S. Tsirkin
2026-02-22 14:28 ` [PULL 10/33] hw/cxl/events: Updates for rev3.2 DRAM " Michael S. Tsirkin
2026-02-22 14:28 ` [PULL 11/33] hw/cxl/events: Updates for rev3.2 memory module " Michael S. Tsirkin
2026-02-22 14:28 ` [PULL 12/33] hw/cxl/cxl-mailbox-utils: Move declaration of scrub and ECS feature attributes in cmd_features_set_feature() Michael S. Tsirkin
2026-02-22 14:28 ` [PULL 13/33] hw/cxl: Add support for Maintenance command and Post Package Repair (PPR) Michael S. Tsirkin
2026-02-24 10:49 ` Peter Maydell
2026-02-24 18:25 ` Shiju Jose via qemu development
2026-02-22 14:28 ` [PULL 14/33] hw/cxl: Add emulation for memory sparing control feature Michael S. Tsirkin
2026-02-22 14:28 ` [PULL 15/33] hw/pcie: Support enabling flit mode Michael S. Tsirkin
2026-02-22 14:28 ` [PULL 16/33] hw/cxl: Refactor component register initialization Michael S. Tsirkin
2026-02-22 14:28 ` [PULL 17/33] tests/bios-tables-test: Excluded CEDT.cxl for BI restriction relaxation Michael S. Tsirkin
2026-02-22 14:28 ` [PULL 18/33] hw/cxl: Update CXL Fixed Memory Window ACPI description to include Back Invalidate support Michael S. Tsirkin
2026-02-22 14:29 ` [PULL 19/33] tests/acpi/cxl: Update CEDT.cxl to allow BI in CFWMS Michael S. Tsirkin
2026-02-22 14:29 ` [PULL 20/33] hw/cxl: Support type3 HDM-DB Michael S. Tsirkin
2026-02-22 14:29 ` [PULL 21/33] hw/cxl: Remove register special_ops->read() Michael S. Tsirkin
2026-02-22 14:29 ` [PULL 22/33] net/vhost-vdpa: Whitelist virtio-net GSO for shadow virtqueue Michael S. Tsirkin
2026-02-22 14:29 ` [PULL 23/33] intel_iommu: Do not report recoverable faults to host Michael S. Tsirkin
2026-02-22 14:29 ` [PULL 24/33] virtio-gpu-virgl: Add virtio-gpu-virgl-hostmem-region type Michael S. Tsirkin
2026-02-22 14:29 ` [PULL 25/33] hw/cxl: Physical Port Info FMAPI - update to current spec and add defines Michael S. Tsirkin
2026-02-22 14:29 ` [PULL 26/33] hw/cxl: Get Physical Port State - update for PCIe flit mode Michael S. Tsirkin
2026-02-22 14:29 ` [PULL 27/33] hw/cxl: Add Physical Port Control FMAPI Command (Opcode 5102h) Michael S. Tsirkin
2026-02-22 14:29 ` [PULL 28/33] MAINTAINERS: add me as maintainer to virtio-snd Michael S. Tsirkin
2026-02-22 14:29 ` [PULL 29/33] virtio-snd: remove TODO comments Michael S. Tsirkin
2026-02-22 14:29 ` [PULL 30/33] virtio-snd: handle 5.14.6.2 for PCM_INFO properly Michael S. Tsirkin
2026-02-22 14:29 ` [PULL 31/33] virtio-snd: fix max_size bounds check in input cb Michael S. Tsirkin
2026-02-22 14:29 ` [PULL 32/33] virtio-snd: tighten read amount in in_cb Michael S. Tsirkin
2026-02-22 14:29 ` [PULL 33/33] vhost: fix vhost_inflight_buffer_pre_load Michael S. Tsirkin
2026-02-22 21:16 ` Michael Tokarev
2026-02-23 7:58 ` Michael S. Tsirkin
2026-02-23 9:55 ` [PULL 00/33] virtio,pc,pci: features, fixes Peter Maydell
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.