linux-user/loongarch64: Create init_main_thread

Merge init_thread and target_cpu_copy_regs.
There's no point going through a target_pt_regs intermediate.

Note that init_thread had set crmd in target_pt_regs, but
target_cpu_copy_regs did not copy to env.  This turns out to be
ok because loongarch_cpu_reset_hold initializes CRMD properly.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

linux-user/ppc: Create init_main_thread

Merge init_thread and target_cpu_copy_regs.
There's no point going through a target_pt_regs intermediate.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

linux-user/sparc: Create init_main_thread

Merge init_thread and target_cpu_copy_regs.
There's no point going through a target_pt_regs intermediate.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

linux-user/aarch64: Create init_main_thread

Merge init_thread and target_cpu_copy_regs.
There's no point going through a target_pt_regs intermediate.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

linux-user/arm: Remove a.out startup remenents

The setting of r1/r2 was removed in kernel commit acfdd4b1f7590d0
("ARM: 7791/1: a.out: remove partial a.out support"), and the
kernel commit message explains the history.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

linux-user/arm: Create init_main_thread

Merge init_thread and target_cpu_copy_regs.
There's no point going through a target_pt_regs intermediate.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

linux-user/i386: Create init_main_thread

Merge init_thread and target_cpu_copy_regs.
There's no point going through a target_pt_regs intermediate.
Temporarily introduce HAVE_INIT_MAIN_THREAD during conversion.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

linux-user: Create do_init_main_thread

Provide a unified function to initialize the main thread.
Keep target_pt_regs isolated to this function.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

linux-user: Move target_cpu_copy_regs decl to qemu.h

The function is not used by bsd-user, so placement
within include/user/cpu_loop.h is not ideal.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

linux-user: Move get_elf_base_platform to mips/elfload.c

Pass in CPUState; define HAVE_ELF_BASE_PLATFORM.
Since this was the only instance of ELF_BASE_PLATFORM, go ahead and
provide the stub definition for other platforms.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

linux-user: Remove ELF_PLATFORM

All real definitions of ELF_PLATFORM are now identical, and the stub
definitions are NULL.  Use HAVE_ELF_PLATFORM and provide a stub as a
fallback definition of get_elf_platform.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

linux-user/hppa: Create get_elf_platform

Move the string literal to a new function.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

linux-user/loongarch64: Create get_elf_platform

Move the string literal to a new function.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

linux-user: Move get_elf_platform to arm/elfload.c

Move the aarch32 get_elf_platform to arm/elfload.c; pass in CPUState.
Create a simple version in aarch64/elfload.c, which we must do at the
same time because of the ifdef dependency between TARGET_AARCH64
and TARGET_ARM.

Since all versions of get_elf_platform now have the same
signature, remove the ifdef from the declaration in loader.h.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

linux-user/i386: Return const data from get_elf_platform

Rather than modify a static buffer, index into an array of const data.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

linux-user: Move get_elf_platform to {i386,x86_64}/elfload.c

Move get_elf_platform to i386/elfload.c; pass in CPUState.
Create a simple get_elf_platform for x86_64.
Introduce HAVE_ELF_PLATFORM.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

linux-user: Remove ELF_HWCAP2

All definitions of ELF_HWCAP2 are now identical.  Provide a
not-reached stub as a fallback definition of get_elf_hwcap2.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

linux-user: Remove ELF_HWCAP

All real definitions of ELF_HWCAP are now identical, and the stub
definitions are 0.  Provide zero stub as a fallback definition.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

linux-user: Move get_elf_hwcap to riscv/elfload.c

Change the return type to abi_ulong, and pass in the cpu.
As this is the last instance of get_elf_hwcap to be converted,
remove the ifdef around the declaration in loader.h.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

linux-user: Move hwcap functions to s390x/elfload.c

For get_elf_hwcap, change the return type to abi_ulong
and pass in the cpu.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

linux-user: Move get_elf_hwcap to sh4/elfload.c

Change the return type to abi_ulong, and pass in the cpu.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

linux-user: Move get_elf_hwcap to mips/elfload.c

Change the return type to abi_ulong, and pass in the cpu.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

linux-user: Move get_elf_hwcap to loongarch64/elfload.c

Change the return type to abi_ulong, and pass in the cpu.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

linux-user: Move hwcap functions to ppc/elfload.c

Change the return type to abi_ulong, and pass in the cpu.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

linux-user: Move get_elf_hwcap to sparc/elfload.c

Change the return type to abi_ulong, and pass in the cpu.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

linux-user: Move hwcap functions to {arm,aarch64}/elfload.c

For get_elf_hwcap and get_elf_hwcap2, change the return type to
abi_ulong, and pass in the cpu.  We must do these targets at the
same time because of the ifdef dependency between TARGET_AARCH64
and TARGET_ARM.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

linux-user: Move get_elf_hwcap to {i386,x86_64}/elfload.c

Change the return type to abi_ulong, and pass in the cpu.
Duplicate the one line function between i386 and x86_64,
as most other additions to elfload.c won't be common.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

linux-user: Move get_elf_cpu_model to target/elfload.c

Rename from cpu_get_model to emphasize that this is an elf-specific
function.  Declare the function once in loader.h.

This frees up target_elf.h for other uses.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

linux-user: Move ppc uabi/asm/elf.h workaround to osdep.h

Move the workaround out of linux-user/elfload.c, so that
we don't have to replicate it in many places.  Place it
immediately after the include of <signal.h>, which draws
in the relevant symbols.

Note that ARCH_DLINFO is not defined by the kernel header,
and so there's no need to undef it either.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

linux-user: Create target/elfload.c files

Prepare to split the main linux-user/elfload.c.
Create empty files for each target, and add the common build rule.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

semihosting: Initialize heap once per process

While semihosting isn't really thread aware, the current
implementation allocates space for the heap per-thread.

Remove the heap_base and heap_limit fields from TaskState.
Replace with static variables within do_common_semihosting.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

semihosting: Retrieve stack top from image_info

Remove the write-once field TaskState.stack_base, and use the
same value from struct image_info.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

Merge tag 'pull-request-2025-08-27' of https://gitlab.com/thuth/qemu into staging

* Add v10.2 compat machines
* Move functional tests to target specific subfolders
* Fix some issues in functional tests

# -----BEGIN PGP SIGNATURE-----
#
# iQJFBAABCgAvFiEEJ7iIR+7gJQEY8+q5LtnXdP5wLbUFAmiuuP0RHHRodXRoQHJl
# ZGhhdC5jb20ACgkQLtnXdP5wLbVMEA//egQiaWsMquQan7D8RWt7TkD2deY2L5Dx
# D/pkO3xGA1hxCzD37ptGfFw2NO6cVpH8cjOevrJYUwW1Yefbsf8HqUlC7PrqDjTw
# +ztyIPSl7ny3xQxif+1Oc2rmt6MCNCQTw9CLdB0k3D1jr7aY0Z20JrxFrQmExhOe
# oSqiILYwiZGfNI4jiQSBYtBVpKrqwCQ+gEs6HyqayQOczaYynHvt8Gqwyp/DpKpY
# bfBcqbREK8zYTMMRYl5d/qcJpWgVtCj5OeqDQyhLMSgNt9fGmdKMzjK5Wzgl18gX
# 8A9tFK8KreXXLu1UfJWe+/kFAHMWhEWMkOv81Z/gqB4Zmp/eMioKlGDwVBU//PPm
# VFigfAPtqBqvOiuJo673ze2AOWMGROtLyZ9nyfv8/MZcQqoYLtvfZMUa08/M74/w
# TRSsBMGKk3H2O/prrXjFHK8q0aRXB2Ld3to0TyZOwlB17rhaD5jq/P8ge2UgGRGb
# fSghUKGmBAHueZyUdlCer+TEzH8ySl5zmotfiDeQfIYkwQ6rWUQZfehLxoycuHvr
# Kl3ZU6RD7fD2kCzRbvUOsyg0H3pihVvzcCL5BMxbGQ1sqZ+WI1dWPoOaUrZ9EvOg
# lQtsNMiu2i7bVqaJ27zNR4V3nwU77f/f+6zJwyXtD+6Wb+bFcQu5aYfgjqOr/Tlv
# zEVoqp5pRU4=
# =pSMT
# -----END PGP SIGNATURE-----
# gpg: Signature made Wed 27 Aug 2025 05:51:25 PM AEST
# gpg:                using RSA key 27B88847EEE0250118F3EAB92ED9D774FE702DB5
# gpg:                issuer "thuth@redhat.com"
# gpg: Good signature from "Thomas Huth <th.huth@gmx.de>" [unknown]
# gpg:                 aka "Thomas Huth <thuth@redhat.com>" [unknown]
# gpg:                 aka "Thomas Huth <th.huth@posteo.de>" [unknown]
# gpg:                 aka "Thomas Huth <huth@tuxfamily.org>" [unknown]
# gpg: WARNING: The key's User ID is not certified with a trusted signature!
# gpg:          There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 27B8 8847 EEE0 2501 18F3  EAB9 2ED9 D774 FE70 2DB5

* tag 'pull-request-2025-08-27' of https://gitlab.com/thuth/qemu: (31 commits)
  tests/functional: Mark main in QemuBaseTest class as a static method
  MAINTAINERS: Adjust wildcards for the migration, multiprocess and replay tests
  tests/functional: Move the generic tests to a subfolder
  tests/functional: Move xtensa tests into target-specific folder
  tests/functional: Move x86_64 tests into target-specific folder
  tests/functional: Move sparc/sparc64 tests into target-specific folders
  tests/functional: Move sh4/sh4eb tests into target-specific folders
  tests/functional: Move s390x tests into target-specific folders
  tests/functional: Move rx test into target-specific folders
  tests/functional: Move riscv32/riscv64 tests into target-specific folders
  tests/functional: Move ppc/ppc64 tests into target-specific folders
  tests/functional: Move or1k tests into target-specific folders
  tests/functional: Move mips tests into target-specific folders
  tests/functional: Move microblaze tests into architecture specific folder
  tests/functional: Move m68k tests into architecture specific folder
  tests/functional: Move loongarch64 tests into architecture specific folder
  tests/functional: Move i386 tests into architecture specific folder
  tests/functional: Move hppa tests into architecture specific folder
  tests/functional: Move avr tests into architecture specific folder
  tests/functional: Move arm tests into architecture specific folder
  ...

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

tests/functional: Mark main in QemuBaseTest class as a static method

The main() method in the QemuBaseTest class has no parameters but is
defined as a regular method. Currently, this does not cause any issues
because in the functional tests main() is always called directly from
QemuBaseTest (never from instances), but the way this method is defined
makes its signature wrong, implying a 'self'. Hence, it's best practice
to define such a method as a static method, so decorate it with
@staticmethod.

Signed-off-by: Gustavo Romero <gustavo.romero@linaro.org>
Message-ID: <20250819143916.4138035-4-gustavo.romero@linaro.org>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>

MAINTAINERS: Adjust wildcards for the migration, multiprocess and replay tests

Now that we moved the tests into subfolders, we have to adjust the
wildcards accordingly.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250819112403.432587-26-thuth@redhat.com>

tests/functional: Move the generic tests to a subfolder

This also removes the line for using tests from the main folder
since we do not have any tests left here. And while we're at it,
also mark the vnc test as generic now since it is not specific to x86.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250819112403.432587-25-thuth@redhat.com>

tests/functional: Move xtensa tests into target-specific folder

The tests/functional folder has become quite crowded, thus move the
xtensa tests into a target-specific subfolder.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250819112403.432587-24-thuth@redhat.com>

tests/functional: Move x86_64 tests into target-specific folder

The tests/functional folder has become quite crowded, thus move the
x86_64 tests into a target-specific subfolder.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250819112403.432587-23-thuth@redhat.com>

tests/functional: Move sparc/sparc64 tests into target-specific folders

The tests/functional folder has become quite crowded, thus move the
sparc tests into a target-specific subfolder.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250819112403.432587-22-thuth@redhat.com>

tests/functional: Move sh4/sh4eb tests into target-specific folders

The tests/functional folder has become quite crowded, thus move the
sh4 tests into a target-specific subfolder.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250819112403.432587-21-thuth@redhat.com>

tests/functional: Move s390x tests into target-specific folders

The tests/functional folder has become quite crowded, thus move the
s390x tests into a target-specific subfolder.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250819112403.432587-20-thuth@redhat.com>

tests/functional: Move rx test into target-specific folders

Move the architecture specific test into an architecture specific
subdirectory.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250819112403.432587-19-thuth@redhat.com>

tests/functional: Move riscv32/riscv64 tests into target-specific folders

The opensbi test is used for both, riscv32 and riscv64. Copy the main
test to the riscv64 folder and add a simple wrapper to the riscv32
folder to be able to run it for that target, too.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250819112403.432587-18-thuth@redhat.com>

tests/functional: Move ppc/ppc64 tests into target-specific folders

The tests/functional folder has become quite crowded, thus move the
ppc and ppc64 tests into a target-specific subfolder.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250819112403.432587-17-thuth@redhat.com>

tests/functional: Move or1k tests into target-specific folders

The tests/functional folder has become quite crowded, thus move the
openrisc tests into a target-specific subfolder.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250819112403.432587-16-thuth@redhat.com>

tests/functional: Move mips tests into target-specific folders

The tests/functional folder has become quite crowded, thus move the
mips tests into a target-specific subfolder.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250819112403.432587-15-thuth@redhat.com>

tests/functional: Move microblaze tests into architecture specific folder

The tests/functional folder has become quite crowded, thus move the
microblaze tests into a target-specific subfolder.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250819112403.432587-14-thuth@redhat.com>

tests/functional: Move m68k tests into architecture specific folder

The tests/functional folder has become quite crowded, thus move the
m68k tests into a target-specific subfolder.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250819112403.432587-13-thuth@redhat.com>

tests/functional: Move loongarch64 tests into architecture specific folder

The tests/functional folder has become quite crowded, thus move the
loongarch64 tests into a target-specific subfolder.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250819112403.432587-12-thuth@redhat.com>

tests/functional: Move i386 tests into architecture specific folder

The tests/functional folder has become quite crowded, thus move the
i386 tests into a target-specific subfolder.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250819112403.432587-11-thuth@redhat.com>

tests/functional: Move hppa tests into architecture specific folder

The tests/functional folder has become quite crowded, thus move the
avr tests into a target-specific subfolder.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250819112403.432587-10-thuth@redhat.com>

tests/functional: Move avr tests into architecture specific folder

The tests/functional folder has become quite crowded, thus move the
avr tests into a target-specific subfolder.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250819112403.432587-9-thuth@redhat.com>

tests/functional: Move arm tests into architecture specific folder

The tests/functional folder has become quite crowded, thus move the
arm tests into a target-specific subfolder.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250819112403.432587-8-thuth@redhat.com>

tests/functional: Move alpha tests into architecture specific folder

The tests/functional folder has become quite crowded already, some
restructuring would be helpful here. Thus move the alpha tests into
a target-specific subfolder.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250819112403.432587-7-thuth@redhat.com>

tests/functional: Move aarch64 tests into architecture specific folder

The tests/functional folder has become quite crowded already, some
restructuring would be helpful here. Thus move the aarch64 tests into
a target-specific subfolder.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250819112403.432587-6-thuth@redhat.com>

tests/functional/meson.build: Allow tests to reside in subfolders

We are going to move target-specific tests to subfolders that are
named after the target (and generic tests will be put into a "generic"
folder), so prepare the meson.build file to allow such locations, too.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250819112403.432587-5-thuth@redhat.com>

tests/functional/meson.build: Split timeout settings by target

We are going to move these settings into target-specific subfolders.
As a first step, split the big test_timeouts array up into individual
ones.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250819112403.432587-4-thuth@redhat.com>

tests/functional: Rework the multiprocess test to have target-specific files

We are going to move the tests for each target into separate subdirectories.
The multiprocess test currently contains code for both, x86 and aarch64,
so it does not quite fit into this scheme. Rework the test to have a common
test class, and target specific files with a target specific class, so
that this will fit better into the new scheme.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250819112403.432587-3-thuth@redhat.com>

tests/functional: Rework the migration test to have target-specific files

We are going to move the tests for each target into separate subdirectories.
The migration test does not fit quite into this scheme, since it works
for multiple targets, but not all. Rework the test to have a common
test class, and target specific files with a target specific class, so
that this will fit better into the new scheme.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250819112403.432587-2-thuth@redhat.com>

tests/functional: Use more fine-grained locking when looking for free ports

Currently, we have one lock that is held while a test is looking for
free ports. However, we are also using different ranges for looking
for free ports nowadays (PORTS_START is based on the PID of the process),
so instead of using only one lock, we should rather use a lock per
range instead. This should help to allow running more tests in parallel.

While we're at it, also create the lock files without executable bit
(mode is 0o777 by default).

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250821094735.804210-1-thuth@redhat.com>

tests/functional: Fix reverse_debugging asset precaching

This commit fixes the asset precaching in the reverse_debugging test on
aarch64.

QemuBaseTest.main() precaches assets (kernel, rootfs, DT blobs, etc.)
that are defined in variables with the ASSET_ prefix. This works because
it ultimately calls Asset.precache_test(), which relies on introspection
to locate these variables.

If an asset variable is not named with the ASSET_ prefix, precache_test
cannot find the asset and precaching silently fails. Hence, fix the
asset precaching by fixing the asset variable name.

Signed-off-by: Gustavo Romero <gustavo.romero@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Message-ID: <20250827001008.22112-1-gustavo.romero@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>

tests/functional/test_aarch64_virt_gpu: Skip test if EGL won't initialize

If you are using the Nvidia drivers and have installed new versions
of those packages but have not yet rebooted the host kernel,
attempting to use the egl-headless display will cause QEMU to fail to
start with

$ qemu-system-aarch64 -M virt -display egl-headless
qemu-system-aarch64: egl: eglInitialize failed: EGL_NOT_INITIALIZED
qemu-system-aarch64: egl: render node init failed

together with this complaint in the host kernel dmesg:

[7874777.555649] NVRM: API mismatch: the client has the version 535.247.01, but
                 NVRM: this kernel module has the version 535.230.02.  Please
                 NVRM: make sure that this kernel module and all NVIDIA driver
                 NVRM: components have the same version.

This isn't a problem with QEMU itself, so reporting this as a test
failure is misleading.  Instead skip the tests, as we already do for
various other kinds of "host system can't actually run the EGL
display" situation.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-ID: <20250826123455.2856988-1-peter.maydell@linaro.org>
Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Acked-by: Alex Bennée <alex.bennee@linaro.org>
Acked-by: Dmitry Osipenko <dmitry.osipenko@collabora.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>

CI: Use mingw-w64-x86_64-curl-winssl instead of mingw-w64-x86_64-curl for Windows build

mingw-w64-x86_64-curl-winssl is required for https connections.

Signed-off-by: Stefan Weil <sw@weilnetz.de>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-ID: <20250806200909.507803-1-sw@weilnetz.de>
Signed-off-by: Thomas Huth <thuth@redhat.com>

hw: add compat machines for 10.2

Add 10.2 machine types for arm/i440fx/m68k/q35/s390x/spapr.

Signed-off-by: Cornelia Huck <cohuck@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20250805095616.1168905-1-cohuck@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>

Open 10.2 development tree

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

Update version for the v10.1.0 release

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

Update version for the v10.1.0-rc4 release

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

Revert "i386/cpu: Warn about why CPUID_EXT_PDCM is not available"

This reverts commit 00268e00027459abede448662f8794d78eb4b0a4.
(The only conflict is in the !is_tdx_vm() part of the condition,
which is safe to keep).

mark_unavailable_features() actively blocks usage of the feature,
so it is a functional change, not merely a emitting warning.
The commit was intended to merely warn if PDCM was enabled when
the performance counters are not, so revert it.

Reported-by: Christian A. Ehrhardt <christian.ehrhardt@canonical.com>
Analyzed-by: Daniel P. Berrangé <berrange@redhat.com>
Analyzed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-ID: <20250819150235.785559-1-pbonzini@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

Merge tag 'uefi-20250812-pull-request' of https://gitlab.com/kraxel/qemu into staging

hw/uefi: last-minute bug fixes for the uefi variable store [for 10.1]

# -----BEGIN PGP SIGNATURE-----
#
# iQIzBAABCgAdFiEEoDKM/7k6F6eZAf59TLbY7tPocTgFAmibENYACgkQTLbY7tPo
# cTi2vQ/9FlAPZTZ/z/D5dfDHLhB06esVe6qd7LuI7rV3/6bUB+g+LYwoJI40SVMq
# Q5YDsQGX0muhzsE343XYMXIcz8yxUEvALpvFVW6e5pg92Q2g1aeHeJaxsaiPdbo2
# gG9WU3paCOQzRK488fUe8ed6Gkqmu6SLDwuAtQ5D9UXZ7qCSfy2Rr8/Li9Qs5JCJ
# StLccRvK6G72S+ESYDo/O1Q1P0CdpgJXuOV+75NdYZn4e7G0GUXN52l1U3fH0JZZ
# sSqoo4TgMjrchEhE4YrXNm/UFrhLpn+uv1Xhyv6UuLpLLWlSU/5EeARS7mGjMGbp
# z3Np11LrqtbB9fxxrxf75OLzya2aKBVUlmuh/HCP1wLNx7kxYpT4yyjsywXkksQ3
# TV2dMknDHm0JRf/i2DJuS6bDZlbehfu+1KkR25+0h/QSd2tK9Ct/ZxO59QcR02Kt
# ecvSzRfFG8+jTVorwVguftDyRe4b/qpFn4X7KujlkKvLiOA4lZ8NZsIFi0x2FGeA
# efdLRVEaDRJBmblcykPR+NYAyxcwGdHYerOsbf/vnRlCAsNQw1oofqTSU6qxnjnH
# hDF+fGBVQ2drjTfb5aFdLpQ4Fq9yD+x9fdpshT8IzqIdsJDKrlPYZK4ueSBF4A3V
# 32N2ZumxH17bvE44WkclJ0aog25M2+dgs5OJvqjcYY5VllEMTis=
# =Ntwr
# -----END PGP SIGNATURE-----
# gpg: Signature made Tue 12 Aug 2025 06:00:54 EDT
# gpg:                using RSA key A0328CFFB93A17A79901FE7D4CB6D8EED3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" [full]
# gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>" [full]
# gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>" [full]
# Primary key fingerprint: A032 8CFF B93A 17A7 9901  FE7D 4CB6 D8EE D3E8 7138

* tag 'uefi-20250812-pull-request' of https://gitlab.com/kraxel/qemu:
  hw/uefi: open json file in binary mode
  hw/uefi: check access for first variable
  hw/uefi: return success for notifications
  hw/uefi: clear uefi-vars buffer in uefi_vars_write callback

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

Update version for the v10.1.0-rc3 release

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

Merge tag 'for-upstream' of git://repo.or.cz/qemu/kevin into staging

Patches for QEMU 10.1.0-rc3

- configure: Don't disable Rust for too old meson version
- rbd: Fix hang in query-named-block-nodes if the server is down
- iotests: Fix reference output for newer bash versions

# -----BEGIN PGP SIGNATURE-----
#
# iQJFBAABCgAvFiEE3D3rFZqa+V09dFb+fwmycsiPL9YFAmiblrYRHGt3b2xmQHJl
# ZGhhdC5jb20ACgkQfwmycsiPL9Z3UQ//Xl3LZP4ZHScc16X4vDhH/4eru9Yu5zz/
# k2kWqmns6aClUZXplfWPKnM5a47b/23ZiM7MaxhgTolShtFPAODP0dDxAaPJSCJD
# EjhMbTB8u4GeMCe7T4HqGY/UHcGDWGzD9Ne5ssxt8yRT3fkuM/XxTptlIT93Rz9w
# bjTuCnctP6pGWW3za67bUdr9ZzwpmMXvXwpcXrlhKCqq+qbpHK8/rTp2yaNF5Pi9
# 3K+uITLOVk04UL1JbSgXgvId5JSBDE0JnPDFPhhkAcliQJKR3W3iWhIKwA4rvnZ5
# dzAMNk3TafzUsZp+k9gPXdQ/+km3Hj17vyHLEoEk0cPVoNi+ZbpKCij15O6OPKAn
# OP6aznanat8W8hQh+2lv29fLyYICZpXbsEGB7X7Kfz4uf4BhhopHHvq6SOnZwO14
# MaUjVEO7kBWHgXH3o8PzyHsZq7oWQdEZuKhcnemMb5+6ngLoGX1N1zZUGAcuaar+
# 31rePhgWprdOfZEW9X46i6AKff3xWHl5yQ9jQMPZWNwiYXNemh4oZXSYsgVbvNHd
# g73d/4G5iUt61fg6CtyqFDDa4/1WP0jU4164p6kcvYJVj1HaKy3FrAVrOfINbFFy
# dX3jCECkd52ilBwWisDWSWUqh2S09LJrn7O7FZUwYySivINuajZWwJYuDdxRvyc6
# q7Qg7ocWaQ8=
# =goPX
# -----END PGP SIGNATURE-----
# gpg: Signature made Tue 12 Aug 2025 15:32:06 EDT
# gpg:                using RSA key DC3DEB159A9AF95D3D7456FE7F09B272C88F2FD6
# gpg:                issuer "kwolf@redhat.com"
# gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>" [full]
# Primary key fingerprint: DC3D EB15 9A9A F95D 3D74  56FE 7F09 B272 C88F 2FD6

* tag 'for-upstream' of git://repo.or.cz/qemu/kevin:
  qemu-iotests: Ignore indentation in Killed messages
  rbd: Fix .bdrv_get_specific_info implementation
  configure: Don't disable Rust for too old meson version

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

ui/spice: Destroy the temporary egl fb after the blit is submitted

The temporary egl fb scanout_tex_fb is only needed to facilitate the
blit to the display surface's texture (ssd->ds->texture). Therefore,
destroy it after the blit is submitted. And, also make sure that it
is empty initialized before it is actually used.

Fixes: f851cd65 ("ui/spice: Blit the scanout texture if its memory layout is not linear")
Reported-by: Peter Maydell <peter.maydell@linaro.org>
Cc: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Vivek Kasireddy <vivek.kasireddy@intel.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-ID: <20250718234039.2266704-1-vivek.kasireddy@intel.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

readthedocs: don't build extra formats

We don't build the PDFs ourselves for the hosted docs and it looks
like rtd can't manage building PDFs now they have gone over a certain
size. Disable the extra formats so we can at least have the online
stuff again.

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-ID: <20250804162959.330060-1-alex.bennee@linaro.org>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

Merge tag 'sdmmc-20250812' of https://github.com/philmd/qemu into staging

SD/MMC patches queue

- Return noise (dummy byte) when no SD card connected over SPI

# -----BEGIN PGP SIGNATURE-----
#
# iQIzBAABCAAdFiEE+qvnXhKRciHc/Wuy4+MsLN6twN4FAmibcbsACgkQ4+MsLN6t
# wN5DkA/9F9lOPelfONSvAkZ4IkahoTaulYglQHxePbYvCopufx7RiM5yigmVrcGW
# I6MhGf9PtD4nlQ6Zl8ZUcr+WHMZQJaCcizdtzDsWR597to1z+ylbgoQqlhZi3gEX
# V6mOl5peS2LZ0nZ5WQpMs9kNUTTGahTagqkBRLWTCuTVZF/UAyXGFGK+9U3c4vu+
# iOS8XMkfACg2Df51Jj4cnyMmjjYoJgoQliGueaiOTyNEL0Euq18t/FiaL1C6X9+i
# rraagCq9s4rVLeh3KTZSz4ywKHticNtsXpHXGzlBIRJbxGCv7rV4GOehzjHdDcgq
# H7zpv9l7J4bBr9uY6m8SHP0WkxKE/B+g261h6mIg3PNjyamjrwWnoX9IYU4wPaVu
# +JUaxqU24HUyVi5r//h5pCASQPCl0MhtrsDHQSvClaiXVcCu8dBfiFxR5+tDuCaO
# An6ORL+Rd5S5dS36XQZr+CnmLCfnlr10auPq4tQ+L32VcPWjqHp+70+yM4DVtPfq
# sFb1O5ChQEsCzk9laO7OLqDqf8zJ5T4n21/i83vH/QGOi4+NRFIJoncGfXmHW/GW
# OzAE1S3LRDVBq+RA66so4y30i83H2CCZNqjRkXCoa+680P0MP5aUSxNhS7T3dN6u
# Er3QXkZQPeQDtVTCbslXnEtJ7drU6Jtfj4ZPTanua9TpCotAnb4=
# =4VWG
# -----END PGP SIGNATURE-----
# gpg: Signature made Tue 12 Aug 2025 12:54:19 EDT
# gpg:                using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE
# gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <f4bug@amsat.org>" [full]
# Primary key fingerprint: FAAB E75E 1291 7221 DCFD  6BB2 E3E3 2C2C DEAD C0DE

* tag 'sdmmc-20250812' of https://github.com/philmd/qemu:
  tests/functional: Test SPI-SD adapter without SD card connected
  hw/sd/ssi-sd: Return noise (dummy byte) when no card connected

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

mkvenv: Support pip 25.2

Fix compilation with pip-25.2 due to missing distlib.version

Bug: https://gitlab.com/qemu-project/qemu/-/issues/3062

Signed-off-by: Sv. Lockal <lockalsash@gmail.com>
[Edits: Type "safety" whackamole --js]
Signed-off-by: John Snow <jsnow@redhat.com>
Message-ID: <20250811190159.237321-1-jsnow@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

tests/functional: Test SPI-SD adapter without SD card connected

SPI-SD adapter should be usable, even without any SD card
wired. Refactor test_riscv64_sifive_u_mmc_spi() to make it
more generic and add another test, inspired by this report:
https://lore.kernel.org/qemu-devel/5b2dc427-f0db-4332-a997-fe0c82415acd@roeck-us.net/

Inspired-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Gustavo Romero <gustavo.romero@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20250812140415.70153-3-philmd@linaro.org>

hw/sd/ssi-sd: Return noise (dummy byte) when no card connected

Commit 1585ab9f1ba ("hw/sd/sdcard: Fill SPI response bits in card
code") exposed a bug in the SPI adapter: if no SD card is plugged,
we are returning "there is a card with an error". This is wrong,
we shouldn't return any particular packet response, but the noise
shifted on the MISO line. Return the dummy byte, otherwise we get:

  qemu-system-riscv64: ../hw/sd/ssi-sd.c:160: ssi_sd_transfer: Assertion `s->arglen > 0' failed.

Reported-by: Guenter Roeck <linux@roeck-us.net>
Fixes: 775616c3ae8 ("Partial SD card SPI mode support")
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Gustavo Romero <gustavo.romero@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20250812140415.70153-2-philmd@linaro.org>

qemu-iotests: Ignore indentation in Killed messages

New bash 5.3 uses a different padding for reporting job status.

Resolves: boo#1246830
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3050
Signed-off-by: Werner Fink <werner@suse.de>
Message-ID: <aJL8RH8ePPNEteMg@boole.nue2.suse.org>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Tested-by: Martin Kletzander <mkletzan@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>

rbd: Fix .bdrv_get_specific_info implementation

qemu_rbd_get_specific_info() has at least two problems:

The first is that it issues a blocking rbd_read() call in order to probe
the encryption format for the image while querying the node. This means
that if the connection to the server goes down, not only I/O is stuck
(which is unavoidable), but query-names-block-nodes will actually make
the whole QEMU instance unresponsive. .bdrv_get_specific_info
implementations shouldn't perform blocking operations, but only return
what is already known.

The second is that the information returned isn't even correct. If the
image is already opened with encryption enabled at the RBD level, we'll
probe for "double encryption", i.e. if the encrypted data contains
another encryption header. If it doesn't (which is the normal case), we
won't return the encryption format. If it does, we return misleading
information because it looks like we're talking about the outer level
(the encryption format of the image itself) while the information is
about an encryption header in the guest data.

Fix this by storing the encryption format in BDRVRBDState when the image
is opened (and we do blocking operations anyway) and returning only the
stored information in qemu_rbd_get_specific_info().

The information we'll store is either the actual encryption format that
we enabled on the RBD level, or if the image is unencrypted, the result
of the same probing as we previously did when querying the node. Probing
image formats based on content that can be modified by the guest has
long been known as problematic, but as long as we only output it to the
user instead of making decisions based on it, it should be okay. It is
undoubtedly useful in the context of 'qemu-img info' when you're trying
to figure out which encryption options you have to use to open the
image successfully.

Fixes: 42e4ac9ef5a6 ("block/rbd: Add support for rbd image encryption")
Buglink: https://issues.redhat.com/browse/RHEL-105440
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Message-ID: <20250811134010.81787-1-kwolf@redhat.com>
Reviewed-by: Hanna Czenczek <hreitz@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>

configure: Don't disable Rust for too old meson version

If the user explicitly specified --enable-rust, don't just fail if meson
is too old for Rust support, but do the same thing as if meson was too
old for the C code: Just download a newer one.

In order to avoid the additional download for people who aren't
intentionally opting in to Rust, keep the automatic disabling based on
the meson version as the default if neither --enable-rust nor
--disable-rust were given.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Message-ID: <20250811142923.89983-1-kwolf@redhat.com>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>

hw/uefi: open json file in binary mode

Fixes file length discrepancies due to line ending conversions
on windows hosts.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3058
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Message-ID: <20250811130110.820958-4-kraxel@redhat.com>

hw/uefi: check access for first variable

When listing variables (via get-next-variable-name) only the names of
variables which can be accessed will be returned.  That check was
missing for the first variable though.  Add it.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Message-ID: <20250811130110.820958-3-kraxel@redhat.com>

hw/uefi: return success for notifications

Set status to SUCCESS for ready-to-boot and exit-boot-services
notification calls.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Message-ID: <20250811130110.820958-2-kraxel@redhat.com>

hw/uefi: clear uefi-vars buffer in uefi_vars_write callback

When the guest writes to register UEFI_VARS_REG_BUFFER_SIZE, the .write
callback `uefi_vars_write` is invoked. The function allocates a
heap buffer without zeroing the memory, leaving the buffer filled with
residual data from prior allocations. When the guest later reads from
register UEFI_VARS_REG_PIO_BUFFER_TRANSFER, the .read callback
`uefi_vars_read` returns leftover metadata or other sensitive process
memory from the previously allocated buffer, leading to an information
disclosure vulnerability.

Fixes: CVE-2025-8860
Fixes: 90ca4e03c27d ("hw/uefi: add var-service-core.c")
Reported-by: ZDI <zdi-disclosures@trendmicro.com>
Suggested-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Mauro Matteo Cascella <mcascell@redhat.com>
Message-ID: <20250811101128.17661-1-mcascell@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

Merge tag 'pull-nvme-20250811' of https://gitlab.com/birkelund/qemu into staging

nvme queue

# -----BEGIN PGP SIGNATURE-----
#
# iQEzBAABCgAdFiEEUigzqnXi3OaiR2bATeGvMW1PDekFAmiZmYQACgkQTeGvMW1P
# DenI0wf9GPov0a82A2F23UTU+R8NC/NASBovEfPRTz7/J9fGL844ID3G6uT4emFP
# wAilGmMbNuPHKAtII4holCximP/7yosVZJIIdjLsRBBP9AZqpMHkr27VBny9rklZ
# X7TW6zI8INIjdqvRlIBevH5t5By/qLiaDc6GzRWJ3PoeXE6SKACDi0lNBsn75xah
# IbcHi72c96CwYJCEtOHXBs+zECo1yGDhK0OPvs/s7OykuRcOumF21IzuY958bVs/
# 7dJZkTL+oarZHIvKiUrErKK3gWfSrLeaWrR6sW1QNuOhzEeNHk47w86p+CEQ7CrU
# w0ioEaZ9awXk7wnZeY//CpUKFbsmwQ==
# =Qfvu
# -----END PGP SIGNATURE-----
# gpg: Signature made Mon 11 Aug 2025 03:19:32 EDT
# gpg:                using RSA key 522833AA75E2DCE6A24766C04DE1AF316D4F0DE9
# gpg: Good signature from "Klaus Jensen <its@irrelevant.dk>" [unknown]
# gpg:                 aka "Klaus Jensen <k.jensen@samsung.com>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg:          There is no indication that the signature belongs to the owner.
# Primary key fingerprint: DDCA 4D9C 9EF9 31CC 3468  4272 63D5 6FC5 E55D A838
#      Subkey fingerprint: 5228 33AA 75E2 DCE6 A247  66C0 4DE1 AF31 6D4F 0DE9

* tag 'pull-nvme-20250811' of https://gitlab.com/birkelund/qemu:
  hw/nvme: cap MDTS value for internal limitation
  hw/nvme: revert CMIC behavior
  hw/nvme: fix namespace attachment

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

Merge tag 'pull-vfio-20250810' of https://github.com/legoater/qemu into staging

vfio queue:

* Add documentation for the use-legacy-x86-rom property
* Preserve pending VFIO interrupts during CPR

# -----BEGIN PGP SIGNATURE-----
#
# iQIzBAABCAAdFiEEoPZlSPBIlev+awtgUaNDx8/77KEFAmiYwgkACgkQUaNDx8/7
# 7KH5ew//ThaCgYlT2KwwJFfNUw290uQuvZAZUCB0vx+zhsQzQW5vzAx6KvFO+UQu
# k64BQLk8OV97tDpsEcnZEUoPfLo/05mxlcSKYfG3rTpp+ZxoCXUBhQ9f0ZR9t2gz
# WihHrA+g/r69VlcW9fCdar/n2svvysmY2OzybSAILplmJlk5CsJRB4cbpy09AR70
# t70bWGl+4+voENeVQjdYa35588bjwTdnzpOqy7fbFacs6L17NzaW30lJ8S8AWX8W
# a84nnuJgL2qkR73EvY1wL10EyqqR6gYCsbE39ARf4GoC8UE0cRp7tSXm/xkFd6U1
# I6Wv/7zx9FkKq51b8GB9n8NfW9U3XTTfJSS6QR6GYU77zcukUj06Fr5PNLEg9yOf
# 9dfrPt6pap1vx4xuoq9IqrwOVcKd9e9vi9hARLonlzcLMXZqJnKr3KcelcCcF8El
# Sf994H1izHjr1PqpKCDn7dDJ5Bp7CkvnR9RSCzRssovDzfRBmSI5iC75vpjcEd9z
# zMpKG1auyamlpjyFIBOw3rlMXSkv4vk0wmjv/P5aQxKTlu0Oyyp4dZMPl7C4Grut
# WmXJao6zrcUsxvxf2pi2aELGKzLow240Xh4oceD+dDyLQ6Z25J5aj/4MUWxXbbUT
# YffunKYQ00Bk5+x0gp7tiitNu9s4Z2ezshqebweBxNGHWMiJ5sI=
# =lM1W
# -----END PGP SIGNATURE-----
# gpg: Signature made Sun 10 Aug 2025 12:00:09 EDT
# gpg:                using RSA key A0F66548F04895EBFE6B0B6051A343C7CFFBECA1
# gpg: Good signature from "Cédric Le Goater <clg@redhat.com>" [full]
# gpg:                 aka "Cédric Le Goater <clg@kaod.org>" [full]
# Primary key fingerprint: A0F6 6548 F048 95EB FE6B  0B60 51A3 43C7 CFFB ECA1

* tag 'pull-vfio-20250810' of https://github.com/legoater/qemu:
  vfio: Document 'use-legacy-x86-rom' property
  vfio/pci: preserve pending interrupts
  vfio/pci: augment set_handler

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

tests/functional: fix URLs in PCI hotplug test for aarch64

Debian trixie has been released. The "stable" alias no longer refers to
the Debian bookworm release, so URLs referring to bookworm artifacts via
the "stable" alias no longer work.

Switch to explicit release naming ("bookworm") to make a permalink so
the test passes again.

Suggested-by: Peter Maydell <peter.maydell@linaro.org>
Fixes: 374a245573b8 ("tests/functional: Add PCI hotplug test for aarch64")
Resolves: #3073 ("PCI hotplug test for aarch64 fails due to broken Debian installer URL")
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-ID: <20250811162315.59997-1-stefanha@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

hw/nvme: cap MDTS value for internal limitation

The emulated device had let the user set whatever max transfers size
they wanted, including no limit. However the device does have an
internal limit of 1024 segments. NVMe doesn't report max segments,
though. This is implicitly inferred based on the MDTS and MPSMIN values.

IOV_MAX is currently 1024 which 4k PRPs can exceed with 2MB transfers.
Don't allow MDTS values that can exceed this, otherwise users risk
seeing "internal error" status to their otherwise protocol compliant
commands.

Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Klaus Jensen <k.jensen@samsung.com>

hw/nvme: revert CMIC behavior

Commit cd59f50ab017 ("hw/nvme: always initialize a subsystem") causes
the controller to always set the CMIC.MCTRS ("Multiple Controllers")
bit. While spec-compliant, this is a deviation from the previous
behavior where this was only set if an nvme-subsys device was explicitly
created (to configure a subsystem with multiple controllers/namespaces).

Revert the behavior to only set CMIC.MCTRS if an nvme-subsys device is
created explicitly.

Reported-by: Alan Adamson <alan.adamson@oracle.com>
Fixes: cd59f50ab017 ("hw/nvme: always initialize a subsystem")
Reviewed-by: Alan Adamson <alan.adamson@oracle.com>
Tested-by: Alan Adamson <alan.adamson@oracle.com>
Signed-off-by: Klaus Jensen <k.jensen@samsung.com>

hw/nvme: fix namespace attachment

Commit 6ccca4b6bb9f ("hw/nvme: rework csi handling") introduced a bug in
Namespace Attachment, causing it to

  a) not allow a controller to attach namespaces to other controllers
  b) assert if a valid non-attached namespace is detached

This fixes both issues.

Fixes: 6ccca4b6bb9f ("hw/nvme: rework csi handling")
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2976
Reviewed-by: Jesper Wendel Devantier <foss@defmacro.it>
Signed-off-by: Klaus Jensen <k.jensen@samsung.com>

Merge tag 'pull-qapi-2025-08-09' of https://repo.or.cz/qemu/armbru into staging

QAPI patches for 2025-08-09

# -----BEGIN PGP SIGNATURE-----
#
# iQJGBAABCAAwFiEENUvIs9frKmtoZ05fOHC0AOuRhlMFAmiW4TgSHGFybWJydUBy
# ZWRoYXQuY29tAAoJEDhwtADrkYZTuQEP+waO/E590BU0LIBUoZZbi5/xYY0mavtn
# oMn7dtJZGdjV4c247/YghuwhVvPTmNdPsTTsvf1T/Q1SSXmuAgW3vTtsaG/NzbBy
# gJMkvjNOBN5ihI+3cIDC95w8l1e93Wg6YcHsPKQh/NYoBSoy5Kk+QJctcO2Y1R66
# f/9rxaVBAjnWEmCGrP9acJnsTvxWIwmk+E6ABhlt24DCYG1Wjp8CgTrLqveqi8Fx
# lmhVF0XuHgnkwsItj6mnSAnj60SVQjT6F7iaAO8L+4UxHhO+LzXIQiTjdgBHppfJ
# llakFeFLKDulBvRnsnxxrT1CkO1apMfrNkua8JCwHzQAxikuhhkgV1QTIlXQXa7A
# hBE/5VQ5Jev+W6rzM6hmYl0HByKjKB23bQK7j8m8logV9OJCw+1Scsn2kgFX7rWL
# PLIyp63auXnt+vX29+T80KYu+qGi4o9BcQIr44myq/nIuAgcE7eEz7r6y0N66OiQ
# cvShDvd9YO0v8JtPbtUZAeUEyjLOEiYaExBJIAY98r0XFtxlroT8C7o8kjYlQX1K
# K5mv1Xs9y4J8kgxRjveYDosFbJAW4EOkypDc1tV50WV7f83kHRFUx340u+pnX3AI
# vmB/2KIftlt3bDVbJrJkWdbNshJyG4YBsfkzi7WScn/2BnpboNNzk8yKKkGOxrOl
# NQ3QQbUj4Gid
# =RYBV
# -----END PGP SIGNATURE-----
# gpg: Signature made Sat 09 Aug 2025 01:48:40 EDT
# gpg:                using RSA key 354BC8B3D7EB2A6B68674E5F3870B400EB918653
# gpg:                issuer "armbru@redhat.com"
# gpg: Good signature from "Markus Armbruster <armbru@redhat.com>" [full]
# gpg:                 aka "Markus Armbruster <armbru@pond.sub.org>" [full]
# Primary key fingerprint: 354B C8B3 D7EB 2A6B 6867  4E5F 3870 B400 EB91 8653

* tag 'pull-qapi-2025-08-09' of https://repo.or.cz/qemu/armbru:
  docs/devel/qapi-code-gen: Update cross-reference syntax
  docs/devel/qapi-code-gen: Fix typos in QAPI schema language grammar
  docs/devel/qapi-code-gen: Add two cross-references we missed

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

docs/devel/qapi-code-gen: Update cross-reference syntax

The new QAPI code generator creates a cross-reference target for each
definition documentation.  Enabled for the QEMU QMP Reference manual
in commit a377f39f38f, and for the QEMU Storage Daemon QMP Reference
Manual and the QEMU Guest Agent Protocol Reference in commit
a6af5443440.  We've put these targets to use since, but neglected to
update doc comment markup documentation.  Do that now.

Co-developed-by: John Snow <jsnow@redhat.com>
Signed-off-by: John Snow <jsnow@redhat.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20250731054044.4011789-4-armbru@redhat.com>

docs/devel/qapi-code-gen: Fix typos in QAPI schema language grammar

Fixes: 3248c1aaf2db (docs: update the documentation upfront about schema configuration)
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20250731054044.4011789-3-armbru@redhat.com>
Reviewed-by: John Snow <jsnow@redhat.com>

docs/devel/qapi-code-gen: Add two cross-references we missed

Missed in commit 9c66762a601 (docs/qapi-code-gen: add
cross-references).

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20250731054044.4011789-2-armbru@redhat.com>
Reviewed-by: John Snow <jsnow@redhat.com>

vfio: Document 'use-legacy-x86-rom' property

Commit 350785d41d8b ("ramfb: Add property to control if load the
romfile") introduced the `use-legacy-x86-rom` property for the
`vfio-pci-nohotplug` device. Add documentation for the property.

Fixes: d5fcf0d960d8 ("hw/i386: Add the ramfb romfile compatibility")
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Link: https://lore.kernel.org/qemu-devel/20250805065543.120091-1-clg@redhat.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>

vfio/pci: preserve pending interrupts

cpr-transfer may lose a VFIO interrupt because the KVM instance is
destroyed and recreated.  If an interrupt arrives in the middle, it is
dropped.  To fix, stop pending new interrupts during cpr save, and pick
up the pieces.  In more detail:

Stop the VCPUs. Call kvm_irqchip_remove_irqfd_notifier_gsi --> KVM_IRQFD to
deassign the irqfd gsi that routes interrupts directly to the VCPU and KVM.
After this call, interrupts fall back to the kernel vfio_msihandler, which
writes to QEMU's kvm_interrupt eventfd.  CPR already preserves that
eventfd.  When the route is re-established in new QEMU, the kernel tests
the eventfd and injects an interrupt to KVM if necessary.

Deassign INTx in a similar manner.  For both MSI and INTx, remove the
eventfd handler so old QEMU does not consume an event.

If an interrupt was already pended to KVM prior to the completion of
kvm_irqchip_remove_irqfd_notifier_gsi, it will be recovered by the
subsequent call to cpu_synchronize_all_states, which pulls KVM interrupt
state to userland prior to saving it in vmstate.

Signed-off-by: Steve Sistare <steven.sistare@oracle.com>
Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Link: https://lore.kernel.org/qemu-devel/1752689169-233452-3-git-send-email-steven.sistare@oracle.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>

vfio/pci: augment set_handler

Extend vfio_pci_msi_set_handler() so it can set or clear the handler.
Add a similar accessor for INTx.  No functional change.

Signed-off-by: Steve Sistare <steven.sistare@oracle.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/1752689169-233452-2-git-send-email-steven.sistare@oracle.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>

Merge tag 'pull-loongarch-20250808' of https://github.com/gaosong715/qemu into staging

pul-loongarch-20250808

# -----BEGIN PGP SIGNATURE-----
#
# iLMEAAEIAB0WIQTKRzxE1qCcGJoZP81FK5aFKyaCFgUCaJVRCAAKCRBFK5aFKyaC
# Fn9TA/97BaWn3s3HlDy8HhIEereLJ1NWz9FGmYw2jBT77IVrpWeSSmUY3LapmHT0
# lVTrj4aCRlY5zjKn4xw8AQLACrNl2SL5brPXg4YMuwow062Akq/Ow+ooj3LHSlnX
# qXULIMi7hq3gPcmjLeR03AJjiSR2fgIjTzUN8RjangAS+PZ8/A==
# =ZQ4o
# -----END PGP SIGNATURE-----
# gpg: Signature made Thu 07 Aug 2025 21:21:12 EDT
# gpg:                using RSA key CA473C44D6A09C189A193FCD452B96852B268216
# gpg: Good signature from "Song Gao <gaosong@loongson.cn>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg:          There is no indication that the signature belongs to the owner.
# Primary key fingerprint: CA47 3C44 D6A0 9C18 9A19  3FCD 452B 9685 2B26 8216

* tag 'pull-loongarch-20250808' of https://github.com/gaosong715/qemu:
  target/loongarch: Fix [X]VLDI raising exception incorrectly

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

Merge tag 'pull-trivial-patches' of https://gitlab.com/mjt0k/qemu into staging

trivial patches for 2025-08-07

# -----BEGIN PGP SIGNATURE-----
#
# iQIzBAABCgAdFiEEZKoqtTHVaQM2a/75gqpKJDselHgFAmiVEtUACgkQgqpKJDse
# lHh6Lg/+MdkCRc9q+1lo2pQqu5AY3uWMVxCgHZSGgTkkBpSgp4AXgPU9AusOU7jd
# ZEKsmfHTiSodahE7+c6k09yzD+6FIBO3CTi502YPvzJ4Fmyd1Y5hWjUcG+lh9Qhs
# zDA4rg3Gfg8ecCZX9S4A0DAlLmgxCCnqJaGnJhv1sCYgmG1/jshTdpZbgxHDhxho
# 202yMqJagsWApTPmslEBgdBBC8cKUqd8+Lb9AYd+68As9mvCyLq8VbA4lPJ9sSgm
# PdeJzNdFSc5UNKbUe5AYghXeof++mBdKrvegIzRfCVtDkS64ermh2kL22iZI+9Ij
# nxgxYWQAYrsyF6d3vrRTVDWovAPEReu4j1VywOAbaQX6464EVnXDAeq+y9JOlZDs
# +d2pb1uyyFUqGh1A3OwSApyiGGOeMXxDxm77ixkFgf+WTPZ+BNOOrl/YootRxk87
# z7BmTqzycO2eRo6OGNh04LfEOTILhXtENy7NrS/dC2EG4+lgWuGOb3Cl4v1O6cE9
# E2cS7pqpihGyNTXai//USazr3Dh6NxmBsMEfZvWw/WMDy71kBx7XpKn4jv6Dnh+b
# wgg3CoLu9YeCdpmp1zb/g0wKEvFU41f2W1dR7BvCG18xtalr5zmFbdiDRwhnSwJh
# VW8k0XHcBXYHeBBqyrNglZ31alGq2UlmVG29LOzZyfFEVxz+HfM=
# =GrRa
# -----END PGP SIGNATURE-----
# gpg: Signature made Thu 07 Aug 2025 16:55:49 EDT
# gpg:                using RSA key 64AA2AB531D56903366BFEF982AA4A243B1E9478
# gpg: Good signature from "Michael Tokarev <mjt@debian.org>" [unknown]
# gpg:                 aka "Michael Tokarev <mjt@corpit.ru>" [unknown]
# gpg:                 aka "Michael Tokarev <mjt@tls.msk.ru>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg:          There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 9D8B E14E 3F2A 9DD7 9199  28F1 61AD 3D98 ECDF 2C8E
#      Subkey fingerprint: 64AA 2AB5 31D5 6903 366B  FEF9 82AA 4A24 3B1E 9478

* tag 'pull-trivial-patches' of https://gitlab.com/mjt0k/qemu:
  meson: Fix brlapi compile test for Windows builds
  tests/qemu-iotests/tests/mirror-sparse: actually require O_DIRECT

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

target/loongarch: Fix [X]VLDI raising exception incorrectly

According to the specification, [X]VLDI should trigger an invalid instruction
exception only when Bit[12] is 1 and Bit[11:8] > 12. This patch fixes an issue
where an exception was incorrectly raised even when Bit[12] was 0.

Test case:

```
    .global main
main:
    vldi    $vr0, 3328
    ret
```

Reported-by: Zhou Qiankang <wszqkzqk@qq.com>
Signed-off-by: WANG Rui <wangrui@loongson.cn>
Reviewed-by: Song Gao <gaosong@loongson.cn>
Message-ID: <20250804132212.4816-1-wangrui@loongson.cn>
Signed-off-by: Song Gao <gaosong@loongson.cn>