From 07a20852f4e56f9922474aa89b17d3b7147a0a4c Mon Sep 17 00:00:00 2001 From: Thomas Huth Date: Sat, 27 Jun 2026 10:45:19 +0200 Subject: pseries: Update SLOF firmware image to release 20260627 Contains a fix for the parsing of ELF program headers. Signed-off-by: Thomas Huth Signed-off-by: Harsh Prateek Bora --- pc-bios/README | 2 +- pc-bios/slof.bin | Bin 994176 -> 997576 bytes roms/SLOF | 2 +- 3 files changed, 2 insertions(+), 2 deletions(-) diff --git a/pc-bios/README b/pc-bios/README index 4818272968..2f8a565245 100644 --- a/pc-bios/README +++ b/pc-bios/README @@ -14,7 +14,7 @@ - SLOF (Slimline Open Firmware) is a free IEEE 1275 Open Firmware implementation for certain IBM POWER hardware. The sources are at https://gitlab.com/slof/slof, and the image currently in qemu is - built from git tag qemu-slof-20251026. + built from git tag qemu-slof-20260627. - VOF (Virtual Open Firmware) is a minimalistic firmware to work with -machine pseries,x-vof=on. When enabled, the firmware acts as a slim shim and diff --git a/pc-bios/slof.bin b/pc-bios/slof.bin index 39b9248967..6a6d944b07 100644 Binary files a/pc-bios/slof.bin and b/pc-bios/slof.bin differ diff --git a/roms/SLOF b/roms/SLOF index b7f755248e..47457c9078 160000 --- a/roms/SLOF +++ b/roms/SLOF @@ -1 +1 @@ -Subproject commit b7f755248e2dcc56c02634d288e1c0ff7e0ce1c7 +Subproject commit 47457c9078a217150aa1634f2657e6804fbde467 -- cgit v1.2.3 From 544f05ad6413c5a4d17763ebc8f66d6febb51562 Mon Sep 17 00:00:00 2001 From: Glenn Miles Date: Tue, 5 May 2026 09:46:10 -0500 Subject: Revert "hw/ppc: Deprecate 405 CPUs" MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This reverts commit 52f0b59ec6b780f2a3e162d5862b90b406fa4697. The PowerPC 405 CPU is used by the PPE42 CPU which was added to QEMU v10.2. The PPE42 CPU is basically a stripped down version of the PowerPC 405 CPU and is used by the Power9, Power10, and Power11 CPUs as an embedded processor to handle various tasks. Also, IBM has plans to use the PowerPC 405 CPU model within a year to model the On Chip Controller (OCC), which has an embedded PPC405 CPU. Therefore, this patch removes the PowerPC 405 CPU from the deprecated list. Signed-off-by: Glenn Miles Acked-by: Cédric Le Goater Acked-by: Harsh Prateek Bora Link: https://lore.kernel.org/qemu-devel/20260505144621.1308457-1-milesg@linux.ibm.com Signed-off-by: Harsh Prateek Bora --- docs/about/deprecated.rst | 9 --------- 1 file changed, 9 deletions(-) diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst index cf3e1a007c..169c5dfe4f 100644 --- a/docs/about/deprecated.rst +++ b/docs/about/deprecated.rst @@ -206,15 +206,6 @@ in the QEMU object model anymore. ``Sun-UltraSparc-IIIi+`` and but for consistency these will get removed in a future release, too. Use ``Sun-UltraSparc-IIIi-plus`` and ``Sun-UltraSparc-IV-plus`` instead. -PPC 405 CPUs (since 10.0) -''''''''''''''''''''''''' - -The PPC 405 CPU has no known users and the ``ref405ep`` machine was -removed in QEMU 10.0. Since the IBM POWER [8-11] processors uses an -embedded 405 for power management (OCC) and other internal tasks, it -is theoretically possible to use QEMU to model them. Let's keep the -CPU implementation for a while before removing all support. - Power8E and Power8NVL CPUs and corresponding Pnv chips (since 10.1) ''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''' -- cgit v1.2.3 From ea87cc5e3cec916ebf3f7bd320ea585913121ad3 Mon Sep 17 00:00:00 2001 From: Jishnu Warrier Date: Mon, 8 Jun 2026 15:04:30 +0530 Subject: hw/pci-host: Split PowerNV PHB5 code from PHB4 files Separate Power10/11 PHB5 implementation from Power9 PHB4 code for better maintainability and clarity. This is a pure code movement with no functional changes. Signed-off-by: Jishnu Warrier Reviewed-by: Aditya Gupta Link: https://lore.kernel.org/qemu-devel/20260608093430.2729688-1-jishnuvw@linux.ibm.com Signed-off-by: Harsh Prateek Bora --- hw/pci-host/meson.build | 2 ++ hw/pci-host/pnv_phb4.c | 6 ---- hw/pci-host/pnv_phb4_pec.c | 58 ---------------------------------- hw/pci-host/pnv_phb5.c | 23 ++++++++++++++ hw/pci-host/pnv_phb5_pec.c | 77 ++++++++++++++++++++++++++++++++++++++++++++++ 5 files changed, 102 insertions(+), 64 deletions(-) create mode 100644 hw/pci-host/pnv_phb5.c create mode 100644 hw/pci-host/pnv_phb5_pec.c diff --git a/hw/pci-host/meson.build b/hw/pci-host/meson.build index 86b754d0b0..3217e7e912 100644 --- a/hw/pci-host/meson.build +++ b/hw/pci-host/meson.build @@ -44,5 +44,7 @@ specific_ss.add(when: 'CONFIG_PCI_POWERNV', if_true: files( 'pnv_phb3_pbcq.c', 'pnv_phb4.c', 'pnv_phb4_pec.c', + 'pnv_phb5.c', + 'pnv_phb5_pec.c', 'pnv_phb.c', )) diff --git a/hw/pci-host/pnv_phb4.c b/hw/pci-host/pnv_phb4.c index 396bc47817..705a5bcf07 100644 --- a/hw/pci-host/pnv_phb4.c +++ b/hw/pci-host/pnv_phb4.c @@ -1721,11 +1721,6 @@ static const TypeInfo pnv_phb4_type_info = { } }; -static const TypeInfo pnv_phb5_type_info = { - .name = TYPE_PNV_PHB5, - .parent = TYPE_PNV_PHB4, - .instance_size = sizeof(PnvPHB4), -}; static void pnv_phb4_root_bus_get_prop(Object *obj, Visitor *v, const char *name, @@ -1794,7 +1789,6 @@ static void pnv_phb4_register_types(void) { type_register_static(&pnv_phb4_root_bus_info); type_register_static(&pnv_phb4_type_info); - type_register_static(&pnv_phb5_type_info); type_register_static(&pnv_phb4_iommu_memory_region_info); } diff --git a/hw/pci-host/pnv_phb4_pec.c b/hw/pci-host/pnv_phb4_pec.c index 58ec14ec2f..ee5cdc3e45 100644 --- a/hw/pci-host/pnv_phb4_pec.c +++ b/hw/pci-host/pnv_phb4_pec.c @@ -394,67 +394,9 @@ static const TypeInfo pnv_pec_type_info = { } }; -/* - * POWER10 definitions - */ -static uint32_t pnv_phb5_pec_xscom_cplt_base(PnvPhb4PecState *pec) -{ - return PNV10_XSCOM_PEC_NEST_CPLT_BASE + XPEC_PCI_CPLT_OFFSET * pec->index; -} - -static uint32_t pnv_phb5_pec_xscom_pci_base(PnvPhb4PecState *pec) -{ - return PNV10_XSCOM_PEC_PCI_BASE + 0x1000000 * pec->index; -} - -static uint32_t pnv_phb5_pec_xscom_nest_base(PnvPhb4PecState *pec) -{ - /* index goes down ... */ - return PNV10_XSCOM_PEC_NEST_BASE - 0x1000000 * pec->index; -} - -/* - * PEC0 -> 3 stacks - * PEC1 -> 3 stacks - */ -static const uint32_t pnv_phb5_pec_num_stacks[] = { 3, 3 }; - -static void pnv_phb5_pec_class_init(ObjectClass *klass, const void *data) -{ - PnvPhb4PecClass *pecc = PNV_PHB4_PEC_CLASS(klass); - static const char compat[] = "ibm,power10-pbcq"; - static const char stk_compat[] = "ibm,power10-phb-stack"; - - pecc->xscom_cplt_base = pnv_phb5_pec_xscom_cplt_base; - pecc->xscom_nest_base = pnv_phb5_pec_xscom_nest_base; - pecc->xscom_pci_base = pnv_phb5_pec_xscom_pci_base; - pecc->xscom_nest_size = PNV10_XSCOM_PEC_NEST_SIZE; - pecc->xscom_pci_size = PNV10_XSCOM_PEC_PCI_SIZE; - pecc->compat = compat; - pecc->compat_size = sizeof(compat); - pecc->stk_compat = stk_compat; - pecc->stk_compat_size = sizeof(stk_compat); - pecc->version = PNV_PHB5_VERSION; - pecc->phb_type = TYPE_PNV_PHB5; - pecc->num_phbs = pnv_phb5_pec_num_stacks; -} - -static const TypeInfo pnv_phb5_pec_type_info = { - .name = TYPE_PNV_PHB5_PEC, - .parent = TYPE_PNV_PHB4_PEC, - .instance_size = sizeof(PnvPhb4PecState), - .class_init = pnv_phb5_pec_class_init, - .class_size = sizeof(PnvPhb4PecClass), - .interfaces = (const InterfaceInfo[]) { - { TYPE_PNV_XSCOM_INTERFACE }, - { } - } -}; - static void pnv_pec_register_types(void) { type_register_static(&pnv_pec_type_info); - type_register_static(&pnv_phb5_pec_type_info); } type_init(pnv_pec_register_types); diff --git a/hw/pci-host/pnv_phb5.c b/hw/pci-host/pnv_phb5.c new file mode 100644 index 0000000000..c3f2e16ce6 --- /dev/null +++ b/hw/pci-host/pnv_phb5.c @@ -0,0 +1,23 @@ +/* + * QEMU PowerPC PowerNV (POWER10) PHB5 model + * + * Copyright (c) 2018-2026, IBM Corporation. + * + * SPDX-License-Identifier: GPL-2.0-or-later + */ + +#include "qemu/osdep.h" +#include "hw/pci-host/pnv_phb4.h" + +static const TypeInfo pnv_phb5_type_info = { + .name = TYPE_PNV_PHB5, + .parent = TYPE_PNV_PHB4, + .instance_size = sizeof(PnvPHB4), +}; + +static void pnv_phb5_register_types(void) +{ + type_register_static(&pnv_phb5_type_info); +} + +type_init(pnv_phb5_register_types); diff --git a/hw/pci-host/pnv_phb5_pec.c b/hw/pci-host/pnv_phb5_pec.c new file mode 100644 index 0000000000..488ccbfb12 --- /dev/null +++ b/hw/pci-host/pnv_phb5_pec.c @@ -0,0 +1,77 @@ +/* + * QEMU PowerPC PowerNV (POWER10) PHB5 PEC model + * + * Copyright (c) 2018-2026, IBM Corporation. + * + * SPDX-License-Identifier: GPL-2.0-or-later + */ + +#include "qemu/osdep.h" +#include "hw/pci-host/pnv_phb4.h" +#include "hw/ppc/pnv_xscom.h" + +#define XPEC_PCI_CPLT_OFFSET 0x1000000ULL + +/* + * POWER10 definitions + */ +static uint32_t pnv_phb5_pec_xscom_cplt_base(PnvPhb4PecState *pec) +{ + return PNV10_XSCOM_PEC_NEST_CPLT_BASE + XPEC_PCI_CPLT_OFFSET * pec->index; +} + +static uint32_t pnv_phb5_pec_xscom_pci_base(PnvPhb4PecState *pec) +{ + return PNV10_XSCOM_PEC_PCI_BASE + 0x1000000 * pec->index; +} + +static uint32_t pnv_phb5_pec_xscom_nest_base(PnvPhb4PecState *pec) +{ + /* index goes down ... */ + return PNV10_XSCOM_PEC_NEST_BASE - 0x1000000 * pec->index; +} + +/* + * PEC0 -> 3 stacks + * PEC1 -> 3 stacks + */ +static const uint32_t pnv_phb5_pec_num_stacks[] = { 3, 3 }; + +static void pnv_phb5_pec_class_init(ObjectClass *klass, const void *data) +{ + PnvPhb4PecClass *pecc = PNV_PHB4_PEC_CLASS(klass); + static const char compat[] = "ibm,power10-pbcq"; + static const char stk_compat[] = "ibm,power10-phb-stack"; + + pecc->xscom_cplt_base = pnv_phb5_pec_xscom_cplt_base; + pecc->xscom_nest_base = pnv_phb5_pec_xscom_nest_base; + pecc->xscom_pci_base = pnv_phb5_pec_xscom_pci_base; + pecc->xscom_nest_size = PNV10_XSCOM_PEC_NEST_SIZE; + pecc->xscom_pci_size = PNV10_XSCOM_PEC_PCI_SIZE; + pecc->compat = compat; + pecc->compat_size = sizeof(compat); + pecc->stk_compat = stk_compat; + pecc->stk_compat_size = sizeof(stk_compat); + pecc->version = PNV_PHB5_VERSION; + pecc->phb_type = TYPE_PNV_PHB5; + pecc->num_phbs = pnv_phb5_pec_num_stacks; +} + +static const TypeInfo pnv_phb5_pec_type_info = { + .name = TYPE_PNV_PHB5_PEC, + .parent = TYPE_PNV_PHB4_PEC, + .instance_size = sizeof(PnvPhb4PecState), + .class_init = pnv_phb5_pec_class_init, + .class_size = sizeof(PnvPhb4PecClass), + .interfaces = (const InterfaceInfo[]) { + { TYPE_PNV_XSCOM_INTERFACE }, + { } + } +}; + +static void pnv_phb5_pec_register_types(void) +{ + type_register_static(&pnv_phb5_pec_type_info); +} + +type_init(pnv_phb5_pec_register_types); -- cgit v1.2.3 From feeef57ca0466e39e1fc99d154ec25e27d59e83f Mon Sep 17 00:00:00 2001 From: Gautam Menghani Date: Mon, 29 Jun 2026 10:56:01 +0530 Subject: target/ppc: Expose the TB offset of the guest in QEMU monitor When debugging issues in KVM guests, it is sometimes helpful to have a unified trace log of both guest and host to see where things are going wrong. Expose the TB (timebase) offset through QEMU monitor to enable capturing of unified log. The below steps can be then used for KVM guests to get a unified log: 1. In host trace-cmd record -e kvm_hv:kvm_guest_enter -e kvm_hv:kvm_guest_exit \ -C ppc-tb -o trace_host.dat 2. In guest trace-cmd record -e powerpc:hcall_entry -e powerpc:hcall_exit -C ppc-tb \ --ts-offset -o trace_guest.dat NOTE: The TB offset would be reported as a negative number in QEMU monitor. For this step, the minus sign must be ignored. 3. Transfer the guest logs to the host with scp/rsync 4. Unify the logs trace-cmd report -i trace_host.dat -i trace_guest.dat > combined_log In case of TCG guests, the TB offset would be reported as 0 since the offset logic is not applicable in this case. Tested-by: Amit Machhiwal Reviewed-by: Amit Machhiwal Reviewed-by: Vaibhav Jain Signed-off-by: Gautam Menghani Tested-by: Sneh Shikha Yadav Link: https://lore.kernel.org/qemu-devel/20260629052602.78276-1-gautam@linux.ibm.com Signed-off-by: Harsh Prateek Bora --- hw/ppc/ppc.c | 5 +++++ target/ppc/cpu.h | 1 + target/ppc/cpu_init.c | 5 +++-- 3 files changed, 9 insertions(+), 2 deletions(-) diff --git a/hw/ppc/ppc.c b/hw/ppc/ppc.c index a512d4fa64..b123b4cc1c 100644 --- a/hw/ppc/ppc.c +++ b/hw/ppc/ppc.c @@ -515,6 +515,11 @@ uint64_t cpu_ppc_get_tb(ppc_tb_t *tb_env, uint64_t vmclk, int64_t tb_offset) return ns_to_tb(tb_env->tb_freq, vmclk) + tb_offset; } +int64_t cpu_ppc_load_tb_offset(CPUPPCState *env) +{ + return env->tb_env->tb_offset; +} + uint64_t cpu_ppc_load_tbl (CPUPPCState *env) { ppc_tb_t *tb_env = env->tb_env; diff --git a/target/ppc/cpu.h b/target/ppc/cpu.h index 057c54bbb8..cbd5964b1a 100644 --- a/target/ppc/cpu.h +++ b/target/ppc/cpu.h @@ -1693,6 +1693,7 @@ void cpu_ppc_store_hdecr(CPUPPCState *env, target_ulong value); void cpu_ppc_store_tbu40(CPUPPCState *env, uint64_t value); uint64_t cpu_ppc_load_purr(CPUPPCState *env); void cpu_ppc_store_purr(CPUPPCState *env, uint64_t value); +int64_t cpu_ppc_load_tb_offset(CPUPPCState *env); #if !defined(CONFIG_USER_ONLY) target_ulong load_40x_pit(CPUPPCState *env); void store_40x_pit(CPUPPCState *env, target_ulong val); diff --git a/target/ppc/cpu_init.c b/target/ppc/cpu_init.c index a02187ce5a..8cab5e12b6 100644 --- a/target/ppc/cpu_init.c +++ b/target/ppc/cpu_init.c @@ -7620,8 +7620,9 @@ void ppc_cpu_dump_state(CPUState *cs, FILE *f, int flags) #if !defined(CONFIG_USER_ONLY) if (env->tb_env) { qemu_fprintf(f, "TB %08" PRIu32 " %08" PRIu64 - " DECR " TARGET_FMT_lu "\n", cpu_ppc_load_tbu(env), - cpu_ppc_load_tbl(env), cpu_ppc_load_decr(env)); + " DECR " TARGET_FMT_lu " TB_OFFSET %016" PRId64 "\n", + cpu_ppc_load_tbu(env), cpu_ppc_load_tbl(env), + cpu_ppc_load_decr(env), cpu_ppc_load_tb_offset(env)); } #else qemu_fprintf(f, "TB %08" PRIu32 " %08" PRIu64 "\n", cpu_ppc_load_tbu(env), -- cgit v1.2.3 From 75f3c97476454f735f85c77a3183856be7ba0c4c Mon Sep 17 00:00:00 2001 From: Thomas Huth Date: Thu, 2 Jul 2026 07:48:58 +0000 Subject: docs/system/ppc/pseries: Update the link to the SLOF repository MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit SLOF has been moved to gitlab.com already a while ago. We updated the link in pc-bios/README in commit 7f98b4f25ed9 ("pseries: Update SLOF firmware image"), but forgot to update it in the manual, too. Signed-off-by: Thomas Huth Reviewed-by: Daniel P. Berrangé Link: https://lore.kernel.org/qemu-devel/20260702074842.4806-1-th.huth@posteo.eu Signed-off-by: Harsh Prateek Bora --- docs/system/ppc/pseries.rst | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/system/ppc/pseries.rst b/docs/system/ppc/pseries.rst index bbc51aa7fc..107091a37f 100644 --- a/docs/system/ppc/pseries.rst +++ b/docs/system/ppc/pseries.rst @@ -43,7 +43,7 @@ Firmware The pSeries platform in QEMU comes with 2 firmwares: -`SLOF `_ (Slimline Open Firmware) is an +`SLOF `_ (Slimline Open Firmware) is an implementation of the `IEEE 1275-1994, Standard for Boot (Initialization Configuration) Firmware: Core Requirements and Practices `_. -- cgit v1.2.3 From 55db0113c38997c9c969c8260adb18c6d2982929 Mon Sep 17 00:00:00 2001 From: Shivang Upadhyay Date: Tue, 30 Jun 2026 16:05:07 +0530 Subject: ppc/pnv: avoid regenerating DTB if external DTB is present Currently externally provided dtb is overwritten in `pnv_reset`. Fix this by only creating dtb if not provided from `-dtb`. Reviewed-by: Aditya Gupta Signed-off-by: Shivang Upadhyay Reviewed-by: Amit Machhiwal Link: https://lore.kernel.org/qemu-devel/20260630103508.254000-2-shivangu@linux.ibm.com Signed-off-by: Harsh Prateek Bora --- hw/ppc/pnv.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/hw/ppc/pnv.c b/hw/ppc/pnv.c index 62812f22f8..afb6019b10 100644 --- a/hw/ppc/pnv.c +++ b/hw/ppc/pnv.c @@ -803,9 +803,13 @@ static void pnv_reset(MachineState *machine, ResetType type) mpipl_write_succeeded = do_mpipl_write(pnv); } - /* Regenerate device tree */ - fdt = pnv_dt_create(machine); - _FDT((fdt_pack(fdt))); + /* Only create new dt if not provided in -dtb */ + if (!machine->dtb) { + fdt = pnv_dt_create(machine); + _FDT((fdt_pack(fdt))); + } else { + fdt = machine->fdt; + } /* * If it's a MPIPL boot, add the "mpipl-boot" property, and reset the -- cgit v1.2.3 From f9d05801eb4acd6402d73cb25d498a2419920cf9 Mon Sep 17 00:00:00 2001 From: Shivang Upadhyay Date: Tue, 30 Jun 2026 16:05:08 +0530 Subject: ppc/pnv: add test to verify external DTB is honored Test boots a powernv11 machine, using a custom dtb. Custom dtb has the following bootargs. chosen { bootargs = "hello world"; }; Test Checks whether above bootargs make it to kernel's command line. Reviewed-by: Aditya Gupta Signed-off-by: Shivang Upadhyay Link: https://lore.kernel.org/qemu-devel/20260630103508.254000-3-shivangu@linux.ibm.com Signed-off-by: Harsh Prateek Bora --- tests/functional/ppc64/test_powernv.py | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/tests/functional/ppc64/test_powernv.py b/tests/functional/ppc64/test_powernv.py index 0ea6c93e42..b5b2f0d158 100755 --- a/tests/functional/ppc64/test_powernv.py +++ b/tests/functional/ppc64/test_powernv.py @@ -27,6 +27,11 @@ class PowernvMachine(LinuxKernelTest): 'buildroot/qemu_ppc64le_powernv8-2025.02/rootfs.ext2'), 'aee2192b692077c4bde31cb56ce474424b358f17cec323d5c94af3970c9aada2') + # testdtb for power11, which contains string "hello world" in command line + ASSET_SAMPLE_DTB = Asset( + ('https://github.com/roz3x/qemu/raw/refs/heads/sample-dtb/qemu-powernv11.dtb'), + 'ea1271516264eea1eb58a067a99d0c2ca9528be8dc7d4e46bb2d5ae0d42fc568') + def do_test_linux_boot(self, command_line = KERNEL_COMMON_COMMAND_LINE): self.require_accelerator("tcg") kernel_path = self.ASSET_KERNEL.fetch() @@ -104,6 +109,20 @@ class PowernvMachine(LinuxKernelTest): # Device detection output driven by udev probing is sometimes cut off # from console output, suspect S14silence-console init script. + def test_ppc64_powernv_external_dtb(self): + self.set_machine('powernv11') + self.require_accelerator("tcg") + + kernel_path = self.ASSET_KERNEL.fetch() + sample_dtb_path = self.ASSET_SAMPLE_DTB.fetch() + self.vm.set_console() + self.vm.add_args('-kernel', kernel_path, + '-dtb', sample_dtb_path) + self.vm.launch() + + # check if custom dtb is reflected or not + wait_for_console_pattern(self, "Kernel command line: hello world", self.panic_message) + def test_powernv8(self): self.set_machine('powernv8') self.do_test_ppc64_powernv('P8') -- cgit v1.2.3