meson: Allow system binaries to not have target-specific units
As we are moving toward a single binary, targets might end
without any target-specific objects (all objects being in
the 'common' source set). Allow this by checking the
target_system_arch[] dictionary contains the target key
before using it.
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-ID: <20260106235333.22752-2-philmd@linaro.org>
system/ioport: Do not open-code address_space_ld/st_le() methods
When a variable size is known, prefer the address_space_ld/st()
API. Keep address_space_read/write() for blobs.
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260109165058.59144-23-philmd@linaro.org>
system/ioport: Declare x86-specific I/O port in little-endian order
X86 in/out port (related to ISA bus) uses little endianness:
- enforce little endianness in x86 cpu_in/out() accessors,
- serialize QTest in/out port accesses as little-endian.
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Fabiano Rosas <farosas@suse.de> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260109165058.59144-22-philmd@linaro.org>
system/memory: Split MemoryRegionCache API to 'memory_cached.h'
We have 115 direct inclusions of "system/memory.h", and 91 headers
in include/ use it: hundreds of files have to process it.
However only one single header really uses the MemoryRegionCache
API: "hw/virtio/virtio-access.h". Split it out to a new header,
avoiding processing unused inlined functions hundreds of times.
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260109165058.59144-6-philmd@linaro.org>
leul_to_cpu() is only used within physmem.c: inline it
and remove.
Since @bitmap is of 'unsigned long' type, use its size
with ldn_le_p() instead of using HOST_LONG_BITS.
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260109165058.59144-4-philmd@linaro.org>
Since these headers use some __builtin_bswap*(), use it
consistently in all the cases, allowing to remove the
"qemu/bswap.h" inclusion (which only defines bswap* to
the builtin equivalent).
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260109164742.58041-5-philmd@linaro.org>
Merge tag 'pull-loongarch-20260112' of https://github.com/bibo-mao/qemu into staging
loongarch queue
# -----BEGIN PGP SIGNATURE-----
#
# iHUEABYKAB0WIQQNhkKjomWfgLCz0aQfewwSUazn0QUCaWSdwgAKCRAfewwSUazn
# 0cwwAQC4xgK0x98Z10yoMfuIz5FfDq1onrFC7rd5k0K7pLgsywEA1NrLtW/lSy6Z
# xlgaus/3reiDz+zEOeBQPLibVIVQSA0=
# =8ksY
# -----END PGP SIGNATURE-----
# gpg: Signature made Mon 12 Jan 2026 06:07:46 PM AEDT
# gpg: using EDDSA key 0D8642A3A2659F80B0B3D1A41F7B0C1251ACE7D1
# gpg: Good signature from "bibo mao <maobibo@loongson.cn>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 7044 3A00 19C0 E97A 31C7 13C4 8E86 8FB7 A176 9D4C
# Subkey fingerprint: 0D86 42A3 A265 9F80 B0B3 D1A4 1F7B 0C12 51AC E7D1
* tag 'pull-loongarch-20260112' of https://github.com/bibo-mao/qemu:
hw/loongarch/virt: Add property highmem-mmio-size with virt machine
hw/loongarch/virt: Add high MMIO support with GPEX host
hw/loongarch/virt: Add property highmem_mmio with virt machine
hw/loongarch/virt: Get PCI info from gpex config info
hw/loongarch/virt: Get irq number from gpex config info
hw/loongarch/virt: Add field gpex in LoongArchVirtMachineState
hw/loongarch/virt: Add field ram_end in LoongArchVirtMachineState
target/loongarch: Add PMU register dump support in KVM
target/loongarch: Call function loongarch_la464_init_csr() after realized
target/loongarch: Add PMU migration support in KVM mode
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Bibo Mao [Mon, 12 Jan 2026 06:58:01 +0000 (14:58 +0800)]
hw/loongarch/virt: Add property highmem-mmio-size with virt machine
The default high mmio size of GPEX PCIE host controller is 64G bytes on
virt machine. If it does not meet requirements with some pass-throught HW
devices in future, it can be adjust dynamically, here adds property
highmem-mmio-size to set high mmio size.
Signed-off-by: Bibo Mao <maobibo@loongson.cn> Reviewed-by: Song Gao <gaosong@loongson.cn>
Bibo Mao [Fri, 17 Oct 2025 06:45:21 +0000 (14:45 +0800)]
hw/loongarch/virt: Add property highmem_mmio with virt machine
On LoongArch Virt Machine, MMIO region with GPEX host bridge is
0x40000000 -- 0x7FFFFFFF. The total size is 1G bytes and it is enough
for emulated virtio devices basically.
However on some conditions such as hostmem is added with virtio-gpu
device, the command line is -device virtio-gpu-gl,hostmem=4G. The
PCIE MMIO region is not enough, 64-bit high MMIO region is required.
Here add property highmem_mmio with virt machine, however it brings
out incompatible issue. Here the default value is false.
Signed-off-by: Bibo Mao <maobibo@loongson.cn> Reviewed-by: Song Gao <gaosong@loongson.cn>
Bibo Mao [Fri, 17 Oct 2025 06:45:18 +0000 (14:45 +0800)]
hw/loongarch/virt: Add field gpex in LoongArchVirtMachineState
Add field gpex in structure LoongArchVirtMachineState, type of field gpex
is structure GPEXConfig and it is to record configuration information
about GPEX host bridge. And remove field pci_bus in structure
LoongArchVirtMachineState since the information is in field gpex already.
Signed-off-by: Bibo Mao <maobibo@loongson.cn> Reviewed-by: Song Gao <gaosong@loongson.cn>
Bibo Mao [Fri, 17 Oct 2025 06:45:17 +0000 (14:45 +0800)]
hw/loongarch/virt: Add field ram_end in LoongArchVirtMachineState
DRAM region is dynamically set and the last valid physical address region
with LoongArch Virt Machine. To record the last valid physical address,
field ram_end is added in structure LoongArchVirtMachineState. In future
end address of DRAM cannot exceed base addres of PCIE 64-bit MMIO region.
Signed-off-by: Bibo Mao <maobibo@loongson.cn> Reviewed-by: Song Gao <gaosong@loongson.cn>
Bibo Mao [Thu, 30 Oct 2025 08:17:23 +0000 (16:17 +0800)]
target/loongarch: Call function loongarch_la464_init_csr() after realized
When CPU is realized, it will check capability of host and set guest
features, such as PMU CSR register number used by VM etc. Here move
function call with loongarch_la464_init_csr() after CPU is realized.
Signed-off-by: Bibo Mao <maobibo@loongson.cn> Reviewed-by: Song Gao <gaosong@loongson.cn>
Historically it was required to ask for libatomic explicitly with
-latomic, but with GCC >= 16 apps will get linked to libatomic
whether they ask for it or not.
This invalidates QEMU's check for atomic op support for int128
which explicitly does NOT want to use the libatomic impl. As a
result with GCC >= 16, QEMU is now getting linked to libatomic
and is activating CONFIG_ATOMIC128. This in turn exposes a bug
in GCC's libatomic.a static buld which is incompatible with the
use of -static-pie leading to build failures like:
/usr/bin/ld: /usr/lib/gcc/x86_64-redhat-linux/16/libatomic.a(cas_16_.o): relocation R_X86_64_32 against hidden symbol `libat_compare_exchange_16_i1' can not be used when making a PIE object
/usr/bin/ld: failed to set dynamic section sizes: bad value
collect2: error: ld returned 1 exit status
The newly introduced -fno-link-libatomic flag can be used to
disable the new automatic linking of libatomic. Setting this in
qemu_isa_flags early on ensures that the check for CONFIG_ATOMIC128
still works correctly.
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> Acked-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260108141407.2151817-1-berrange@redhat.com>
Michael Tokarev [Fri, 9 Jan 2026 09:09:36 +0000 (12:09 +0300)]
linux-user: cleanup epoll_pwait ifdeff'ery
All linux targets these days have epoll_pwait system call
(while some miss epoll_wait, which is less generic). And
all linux targets definitely has one or another epoll_*wait*
system call - so whole code block dealing with this system
call should always be present.
Remove the now-unneeded ifdef'fery.
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260109090937.599881-2-mjt@tls.msk.ru>
Matthew Lugg [Mon, 17 Nov 2025 17:09:54 +0000 (17:09 +0000)]
tests: add tcg coverage for fixed mremap bugs
These tests cover the first two fixes in this patch series. The final
patch is not covered because the bug it fixes is not easily observable
by the guest.
Signed-off-by: Matthew Lugg <mlugg@mlugg.co.uk> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20251117170954.31451-5-mlugg@mlugg.co.uk>
Matthew Lugg [Mon, 17 Nov 2025 17:09:53 +0000 (17:09 +0000)]
linux-user: fix reserved_va page leak in do_munmap
The old logic had an off-by-one bug. For instance, assuming 4k pages on
host and guest, if 'len' is '4097' (indicating to unmap 2 pages), then
'last = start + 4096', so 'real_last = start + 4095', so ultimately
'real_len = 4096'. I do not believe this could cause any observable bugs
in guests, because `target_munmap` page-aligns the length it passes in.
However, calls to this function in `target_mremap` do not page-align the
length, so those calls could "drop" pages, leading to a part of the
reserved region becoming unmapped. At worst, a host allocation could get
mapped into that hole, then clobbered by a new guest mapping.
Signed-off-by: Matthew Lugg <mlugg@mlugg.co.uk> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20251117170954.31451-4-mlugg@mlugg.co.uk>
Matthew Lugg [Mon, 17 Nov 2025 17:09:52 +0000 (17:09 +0000)]
linux-user: fix mremap errors for invalid ranges
If an address range given to `mremap` is invalid (exceeds addressing
bounds on the guest), we were previously returning `ENOMEM`, which is
not correct. The manpage and the Linux kernel implementation both agree
that if `old_addr`/`old_size` refer to an invalid address, `EFAULT` is
returned, and if `new_addr`/`new_size` refer to an invalid address,
`EINVAL` is returned.
Signed-off-by: Matthew Lugg <mlugg@mlugg.co.uk> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20251117170954.31451-3-mlugg@mlugg.co.uk>
Matthew Lugg [Mon, 17 Nov 2025 17:09:51 +0000 (17:09 +0000)]
linux-user: fix mremap unmapping adjacent region
This typo meant that calls to `mremap` which shrink a mapping by some N
bytes would, when the virtual address space was pre-reserved (e.g.
32-bit guest on 64-bit host), unmap the N bytes following the *original*
mapping.
Signed-off-by: Matthew Lugg <mlugg@mlugg.co.uk> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20251117170954.31451-2-mlugg@mlugg.co.uk>
linux-user: allow null `pathname` for statx()/fstatat()
Since Linux 6.11, the path argument may be NULL.
Before this patch, qemu-*-linux-user failed with EFAULT when `pathname` was
specified as NULL, even for Linux kernel hosts > 6.10. This patch fixes this
issue by checking whether `arg2` is 0. If so, don't return EFAULT, but instead
perform the appropiate syscall and let the host's kernel handle null `pathname`.
Cc: qemu-stable@nongnu.org Signed-off-by: Jean-Christian CÎRSTEA <jean.christian.cirstea@gmail.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20251229121416.2209295-1-jean.christian.cirstea@gmail.com>
Paolo Bonzini [Tue, 23 Dec 2025 16:37:20 +0000 (17:37 +0100)]
tcg/optimize: Do use affected bits
We inadvertently disabled affected bits optimizations on operations
that use fold_masks_zosa. These happen relatively often in x86 code
for extract/sextract; for example given the following:
mov %esi, %ebp
xor $0x1, %ebp
the optimizer is able to simplify the "extract_i64 rbp,tmp0,$0x0,$0x20"
produced by the second instruction to a move.
Cc: qemu-stable@nongnu.org Fixes: 932522a9ddc ("tcg/optimize: Fold and to extract during optimize") Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20251223163720.985578-1-pbonzini@redhat.com>
In computing a_mask, for or, we remove the bits from t1->o_mask
which are known to be zero. For orc, the bits known to be zero
are the inverse of those known to be one.
Cc: qemu-stable@nongnu.org Fixes: cc4033ee47c ("tcg/optimize: Build and use zero, one and affected bits in fold_orc") Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Merge tag 'pull-riscv-to-apply-20260109' of https://github.com/alistair23/qemu into staging
First RISC-V PR for 11.
* Remove unused import statement from sifive_u test
* Free allocated memory in core/loader
* Add all available CSRs to 'info registers'
* Add 'riscv-aia' accel prop info to documentation
* Fix IOMMU MemoryRegion owner
* Make riscv cpu.h target partially independent
* Expand AIA target[i] source handling and refactor related code
* Don't look up DDT cache in Off and Bare modes
* Add Zilsd and Zclsd extension support
* Add RISCV ZALASR extension
* Add support for MIPS P8700 CPU
# -----BEGIN PGP SIGNATURE-----
#
# iQIzBAABCgAdFiEEaukCtqfKh31tZZKWr3yVEwxTgBMFAmlgmt8ACgkQr3yVEwxT
# gBMxsRAAsdrRs8jrvjJqA60vt6Q/YZRCZFTeRfGlq92zVV4cmkUIkZdCESQsbToV
# lGmbdLXXeC8huxh27zjQuoO9JZzPlg6tBzxCpuNXnrTQB57UKjLJoQ4rKJ9F6wT+
# iakZ3ky6iN9N64p1lDRwfph7hjxodb6Vxgi/iBTsWdj1p4OsJgL2kOPSVBZLdkoL
# fTngoy0bmnV83o2eXIBx09YMxCaT3zjrhIf5lZ3zIeML8wJiq9RKUTs9pDlVO5Z1
# UEeBC8SHNj6siZ5EkCk3IQf7hIq77UITR4wHMQmNLqXY25pSexzqgAKiQt5bbU38
# VyUcXZglXKyvWDPLR36kKQeSSQFaToyVYmw2pr4oZXtEwAUrh8KqprlL+o/V1kFk
# 726i03xtqpPn/HN49kzvfOatlq5qUkeLPWI5RN/q9jjE4RdNxPeSBeyy47yNoR6t
# i9jPV+Z9XhNk7OpTmFKyEEBrf2cyGBubddpDgjDlzBohaICk24pIZgUpHs5WyIkF
# 8/mz9nruUHNXYwasQ5zjHoEaNfoCAgmAMY8klNK6t7Ty5AhT5x0c/5c5WxJ4L0BC
# z0WMZrK4r3uoFeXxRqQZnaWxx0ySCQkPyCuRNGqCx8J/bFhx9VUz5xgR1fZpkfNG
# NdDCueZI3mtdULz2JFe+wwan5XPapEKArFW0RQdR4QYBHiZTrpE=
# =gVkC
# -----END PGP SIGNATURE-----
# gpg: Signature made Fri 09 Jan 2026 05:06:23 PM AEDT
# gpg: using RSA key 6AE902B6A7CA877D6D659296AF7C95130C538013
# gpg: Good signature from "Alistair Francis <alistair@alistair23.me>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 6AE9 02B6 A7CA 877D 6D65 9296 AF7C 9513 0C53 8013
* tag 'pull-riscv-to-apply-20260109' of https://github.com/alistair23/qemu: (34 commits)
test/functional: Add test for boston-aia board
riscv/boston-aia: Add an e1000e NIC in slot 0 func 1
hw/riscv: Add support for MIPS Boston-aia board mode
hw/riscv: Add support for RISCV CPS
hw/misc: Add RISC-V CPC device implementation
hw/misc: Add RISC-V CMGCR device implementation
target/riscv: Add Xmipslsp instructions
target/riscv: Add mips.pref instruction
target/riscv: Add mips.ccmov instruction
target/riscv: Add MIPS P8700 CSRs
target/riscv: Add MIPS P8700 CPU
target/riscv: Add cpu_set_exception_base
Add RISCV ZALASR extension
target/riscv: Add Zilsd and Zclsd extension support
hw/riscv: riscv-iommu: Don't look up DDT cache in Off and Bare modes
hw/intc/riscv_aplic: Factor out source_active() and remove duplicate checks
hw/intc/riscv_aplic: Expand inactive source handling for AIA target[i]
target/riscv: Remove upper_half from riscv_pmu_ctr_get_fixed_counters_val
target/riscv: Combine mhpmcounter and mhpmcounterh
target/riscv: Combine minstretcfg and minstretcfgh
...
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
riscv/boston-aia: Add an e1000e NIC in slot 0 func 1
The Boston AIA board needs a basic GbE NIC. There is no PCH GbE
device emulation, so use an `e1000e` instead. We place it in
**slot 0, function 1** in order not to conflict with the existing
AHCI device in slot 0 func 0.
Signed-off-by: Chao-ying Fu <cfu@mips.com> Signed-off-by: Djordje Todorovic <djordje.todorovic@htecgroup.com> Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20260108134128.2218102-12-djordje.todorovic@htecgroup.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
hw/riscv: Add support for MIPS Boston-aia board mode
The board model supports up to 64 harts with MIPS CPS, MIPS GCR,
MIPS CPC, AIA plic, and AIA clint devices. The model can create
boot code, if there is no -bios parameter. We can specify -smp x,
cores=y,thread=z.
Ex: Use 4 cores and 2 threads with each core to
have 8 smp cpus as follows.
qemu-system-riscv64 -cpu mips-p8700 \
-m 2G -M boston-aia \
-smp 8,cores=4,threads=2 -kernel fw_payload.bin \
-drive file=rootfs.ext2,format=raw -serial stdio
Signed-off-by: Chao-ying Fu <cfu@mips.com> Signed-off-by: Djordje Todorovic <djordje.todorovic@htecgroup.com> Acked-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com> Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20260108134128.2218102-11-djordje.todorovic@htecgroup.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Add support for the Coherent Processing System for RISC-V.
This enables SMP support for RISC-V boards that require
cache-coherent multiprocessor systems.
Signed-off-by: Chao-ying Fu <cfu@mips.com> Signed-off-by: Djordje Todorovic <djordje.todorovic@htecgroup.com> Acked-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20260108134128.2218102-10-djordje.todorovic@htecgroup.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Add RISC-V implementation of the Cluster Power Controller (CPC) device.
It is based on the existing MIPS CPC implementations but adapted for
RISC-V systems.
The CPC device manages power control for CPU clusters in RISC-V
systems.
This is needed for the MIPS BOSTON AIA board.
Signed-off-by: Chao-ying Fu <cfu@mips.com> Signed-off-by: Djordje Todorovic <djordje.todorovic@htecgroup.com> Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20260108134128.2218102-9-djordje.todorovic@htecgroup.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Add RISC-V implementation of the Coherent Manager Global Control
Register (CMGCR) device. It is based on the existing MIPS CMGCR
implementation but adapted for RISC-V systems.
The CMGCR device provides global system control for multi-core
configurations in RISC-V systems.
This is needed for the MIPS BOSTON AIA board.
Signed-off-by: Chao-ying Fu <cfu@mips.com> Signed-off-by: Djordje Todorovic <djordje.todorovic@htecgroup.com> Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20260108134128.2218102-8-djordje.todorovic@htecgroup.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Frank Chang [Tue, 28 Oct 2025 08:50:32 +0000 (16:50 +0800)]
hw/riscv: riscv-iommu: Don't look up DDT cache in Off and Bare modes
According to the RISC-V IOMMU specification:
* When ddtp.iommu_mode is set to Off, there is no DDT look-up, and an "All
inbound transactions disallowed" fault (cause = 256) is reported for any
inbound transaction.
* When ddtp.iommu_mode is set to Bare, there is no DDT look-up, and the
translated address is the same as the IOVA, unless the transaction type
is disallowed (cause = 260).
In the current implementation, the DDT cache is incorrectly looked up
even when ddtp.iommu_mode is set to Off or Bare. This may result in
unintended cache hits.
Therefore, the DDT cache must not be looked up when ddtp.iommu_mode is
set to Off or Bare. For other modes, software is required to issue cache
invalidation commands before any inbound transactions.
Signed-off-by: Frank Chang <frank.chang@sifive.com> Acked-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com> Reviewed-by: Jim Shu <jim.shu@sifive.com>
Message-ID: <20251028085032.2053569-1-frank.chang@sifive.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Nikita Novikov [Wed, 29 Oct 2025 07:17:12 +0000 (10:17 +0300)]
hw/intc/riscv_aplic: Expand inactive source handling for AIA target[i]
According to the RISC-V AIA v1.0, section 4.5.2 ("Source configurations"),
register target[i] shall be read-only zero when interrupt source i is inactive
in this domain. A source is inactive if it is delegated to a child domain or
its source mode is INACTIVE.
The previous implementation only checked SM == INACTIVE. This patch adds
full compliance:
- Return zero on read if D == 1 or SM == INACTIVE
- Ignore writes in both cases
Fixes: b6f1244678 ("intc/riscv_aplic: Fix target register read when source is inactive") Signed-off-by: Nikita Novikov <n.novikov@syntacore.com> Acked-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20251029-n-novikov-aplic_aia_ro-v1-1-39fec74c918a@syntacore.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
target/riscv: Remove upper_half from riscv_pmu_ctr_get_fixed_counters_val
Now that mhpmcounter is always a 64-bit value we can remove the
upper_half argument from riscv_pmu_ctr_get_fixed_counters_val() and
always return a 64-bit value.
Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Anton Johansson <anjo@rev.ng> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251103033713.904455-9-alistair.francis@wdc.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Anton Johansson [Mon, 3 Nov 2025 03:37:12 +0000 (13:37 +1000)]
target/riscv: Combine mhpmcounter and mhpmcounterh
According to version 20250508 of the privileged specification,
mhpmconter is a 64-bit register and mhpmcounterh refers to the top
32 bits of this register when XLEN == 32. No real advantage is
gained by keeping them separate, and combining allows for slight
simplification.
Note, the cpu/pmu VMSTATE version is bumped breaking migration from
older versions.
Signed-off-by: Anton Johansson <anjo@rev.ng> Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20251027181831.27016-9-anjo@rev.ng> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20251103033713.904455-8-alistair.francis@wdc.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Anton Johansson [Mon, 3 Nov 2025 03:37:11 +0000 (13:37 +1000)]
target/riscv: Combine minstretcfg and minstretcfgh
According to version 20250508 of the privileged specification,
minstretcfg is a 64-bit register and minstretcfgh refers to the top
32 bits of this register when XLEN == 32. No real advantage is
gained by keeping them separate, and combining them allows for slight
simplification.
Signed-off-by: Anton Johansson <anjo@rev.ng> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-ID: <20251027181831.27016-8-anjo@rev.ng> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20251103033713.904455-7-alistair.francis@wdc.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Anton Johansson [Mon, 3 Nov 2025 03:37:10 +0000 (13:37 +1000)]
target/riscv: Combine mcyclecfg and mcyclecfgh
According to version 20250508 of the privileged specification, mcyclecfg
is a 64-bit register and mcyclecfgh refers to the top 32 bits of this
register when XLEN == 32. No real advantage is gained by keeping
them separate, and combining them allows for slight simplification.
Signed-off-by: Anton Johansson <anjo@rev.ng> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-ID: <20251027181831.27016-7-anjo@rev.ng> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20251103033713.904455-6-alistair.francis@wdc.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Anton Johansson [Mon, 3 Nov 2025 03:37:09 +0000 (13:37 +1000)]
target/riscv: Combine mhpmevent and mhpmeventh
According to version 20250508 of the privileged specification,
mhpmeventn is 64 bits in size and mhpmeventnh is only ever used
when XLEN == 32 and accesses the top 32 bits of the 64-bit
mhpmeventn registers. Combine the two arrays of target_ulong
mhpmeventh[] and mhpmevent[] to a single array of uint64_t.
This also allows for some minor code simplification where branches
handling either mhpmeventh[] or mhpmevent[] could be combined.
Signed-off-by: Anton Johansson <anjo@rev.ng> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-ID: <20251027181831.27016-6-anjo@rev.ng> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20251103033713.904455-5-alistair.francis@wdc.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Anton Johansson [Mon, 3 Nov 2025 03:37:08 +0000 (13:37 +1000)]
target/riscv: Bugfix make bit 62 read-only 0 for sireg* cfg CSR read
According to version 20250508 of the privileged specification, a read of
cyclecfg or instretcfg through sireg* should make the MINH bit
read-only 0, currently bit 30 is zeroed.
Signed-off-by: Anton Johansson <anjo@rev.ng> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-ID: <20251027181831.27016-5-anjo@rev.ng> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20251103033713.904455-4-alistair.francis@wdc.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Anton Johansson [Mon, 3 Nov 2025 03:37:07 +0000 (13:37 +1000)]
target/riscv: Fix size of mhartid
and update formatting in log.
Signed-off-by: Anton Johansson <anjo@rev.ng> Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20251027181831.27016-3-anjo@rev.ng> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20251103033713.904455-3-alistair.francis@wdc.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Anton Johansson [Mon, 3 Nov 2025 03:37:06 +0000 (13:37 +1000)]
target/riscv: Fix size of trivial CPUArchState fields
This commits groups together all CPUArchState fields whose behaviour can
be retained by simply changing the size of the field.
Note, senvcfg is defined to be SXLEN bits wide, but is widened to 64
bits to match henvcfg and menvcfg. Next, [m|h]edeleg are changed to
64 bits as defined privileged specification, and hvictl is fixed to 32
bits which holds all relevant values, see HVICTL_VALID_MASK. The
remaining fields touched in the commit are widened from [H|S|M]XLEN
to 64-bit.
Note, the cpu/hyper, cpu/envcfg, cpu/jvt, and cpu VMSTATE versions are
bumped, breaking migration from older versions.
References to the privileged/unprivileged RISCV specification refer to
version 20250508.
Signed-off-by: Anton Johansson <anjo@rev.ng> Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20251027181831.27016-2-anjo@rev.ng> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20251103033713.904455-2-alistair.francis@wdc.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
docs/specs/riscv-aia.rst: add 'riscv-aia' accel prop info
Add a small section talking about the 'riscv-aia' KVM setting we
implement and how it affects the provisioning of the IMSIC s-mode
in-kernel controller.
While we're at it, fix the formatting of the AIA bullet list.
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com> Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20251028084622.1177574-1-dbarboza@ventanamicro.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
target/riscv: print all available CSRs in riscv_cpu_dump_state()
At this moment we're printing a small selection of CSRs. There's no
particular reason to not print all of them.
We're ignoring the note about CSR_SSTATUS being ommited because it can
be read via CSR_MSTATUS. There's a huge list of CSRs that would fall in
this category and it would be an extra burden to manage them, not
mentioning having to document "we're not listing X because it's the same
value as Y" to users.
Remove 'dump_csrs' and use the existing 'csr_ops' array to print all
available CSRs. Create two helpers in csr.c to identify FPU and VPU CSRs
and skip them - they'll be printed in the FPU/VPU blocks later.
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250623172119.997166-4-dbarboza@ventanamicro.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
target/riscv/cpu: print all FPU CSRs in riscv_cpu_dump_state()
We're missing fflags and frm.
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250623172119.997166-3-dbarboza@ventanamicro.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
riscv_cpu_dump_state() is using the same pattern to print a CSR given
its number. Add a helper to avoid code repetition.
While we're at it fix the identation of the 'flags & CPU_DUMP_VPU'
block.
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250623172119.997166-2-dbarboza@ventanamicro.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
skipIfMissingCommands is not used here, remove the import to silence
a pylint warning for this file.
Signed-off-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com> Reviewed-by: Nutty Liu <nutty.liu@hotmail.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251027112803.54564-1-thuth@redhat.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Merge tag 'pull-maintainers-2026-01-08' of https://repo.or.cz/qemu/armbru into staging
MAINTAINERS patches for 2026-01-08
# -----BEGIN PGP SIGNATURE-----
#
# iQJGBAABCgAwFiEENUvIs9frKmtoZ05fOHC0AOuRhlMFAmlfcIUSHGFybWJydUBy
# ZWRoYXQuY29tAAoJEDhwtADrkYZTv3YQAJGXEh1vqIZsEIRfPlOFPQWSfXUCbchX
# aiHYiWieMLJsNdP9jj+vxAz0agCURqbipqIAOJF21FfrSi8sC1T0g6bW7Bo8DFhn
# SP+LWHv+dqUds1Tb+GKk2qiU/g+giXCJ01paj2VuNzo3e5Aitj/l5uxVdXnCLZGy
# FwdchNPJBl2H9IO6J+OF1D7u4SKlIZncRyyyosaRGxVdKlF5hhIz8PypW/xw2kf2
# aCgHVldcij2ZXZSRuxGhyUsKtldGHNTEZFE/pQf30xhg30PlPA4crZuS3I/dlaQ4
# Nhx62ahQaZsG/D/jLvqUtOHKM7zFToLMSdvV5VKioxkgcf16VJ2RNf9OWgkWjUHz
# uBQgJJUFEF3gjE5DV1bEAQYDtp7xv0vOyUphkE6EJf7eAiIF4+vy6HvFpK7v1fpQ
# Bkd36FkL2uuFpDNk7fxFhcKbxEOreGjQOQoowhByLoCY/MuSro6NFvEh8Jtcid8L
# 2ju5+yCcLiZv3UXRTQ5uffi4CKzsjAGVSq2odqz7Xo6N0RGCQGp/NfrmumJEqM0k
# JSn/hxsn9kpKsi9WvwM5kpsDt7d45vjVF3VfiI5pZpoyOQPjud+1jdUR30BmuyGy
# CJ1Z+v6afnwTAh1KdYb8d7RNo1JOBnNWOFenmAzhevL3+sYthlS5LsK5iblMJr1e
# 3oiFTiACHbiO
# =kYKn
# -----END PGP SIGNATURE-----
# gpg: Signature made Thu 08 Jan 2026 07:53:25 PM AEDT
# gpg: using RSA key 354BC8B3D7EB2A6B68674E5F3870B400EB918653
# gpg: issuer "armbru@redhat.com"
# gpg: Good signature from "Markus Armbruster <armbru@redhat.com>" [unknown]
# gpg: aka "Markus Armbruster <armbru@pond.sub.org>" [unknown]
# gpg: WARNING: The key's User ID is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 354B C8B3 D7EB 2A6B 6867 4E5F 3870 B400 EB91 8653
* tag 'pull-maintainers-2026-01-08' of https://repo.or.cz/qemu/armbru:
MAINTAINERS: Add MAX78000FTHR section as orphan
MAINTAINERS: Add EEPROM 93xx section
MAINTAINERS: Fix coverage of meson.build in tests/functional
MAINTAINERS: Fix coverage of tests/functional/acpi-bits/
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Merge tag 'pull-error-2026-01-07-v2' of https://repo.or.cz/qemu/armbru into staging
Error reporting patches for 2026-01-07
# -----BEGIN PGP SIGNATURE-----
#
# iQJGBAABCgAwFiEENUvIs9frKmtoZ05fOHC0AOuRhlMFAmlfU/wSHGFybWJydUBy
# ZWRoYXQuY29tAAoJEDhwtADrkYZToiUP/RW1I1wFyescGOpUxBjlXqbkgZvrdRbL
# BxtTcoCW0q/cc1Fv3CSYZMm+vvwWJyAysnYONDu6ldDl9ojKfGT/gi1Tgp/99/r4
# bgLbAvExRbbyPOkPBtoXCYeobmgaDP9pMHHlVcdFQrW9hmQiEl4QSWPImmNrKEk2
# gV9SZJ737k9n5dq4XLbqlHXKspn4lWiUE9hbHIUrKWZDn0LDdr5z2wkjhZCmuCR2
# mRSgJhc68Lnb1LdBdRo/5PlG6Hw3jvLat4+q+42teN/aI6zJbD9yKocgaGtubVv1
# h4ntJPMvDKD7DRZF06k8crpLMXJjZFztVr30XBE/e7wG+xY34+3tho3iCQN1vTFe
# RBJne0FaRPGSNYpF8Tj7lPIr0kduqk3/lOQ9HPobTroIPTrCcRXbdOeQ/Ed/Cjrk
# suh8t4OGmy0ThcsUsAajSjPDw2aFlitCS4pWNaSctTvR7V+2trol+WS2QO4My0MX
# 4Z3BnOHBnhE/xo+22T4FW3NvNcFKsQ5Tlq6mjjAgFJ/guaJ2TbMFe/Pm9TtzcPHj
# 7mhBBvKStNWFrQz66z7+hxJhOuOEmON8i4coADDPTUWmcICCyjtJW5m5f+PoYYHr
# LpFwIFHWuKtSAwWQKReOAmA2p0gx1FNZX9eGCl/4IQ54/tLP2zJ07t6LwAl6fn6t
# mKXChdbC9L7p
# =CY68
# -----END PGP SIGNATURE-----
# gpg: Signature made Thu 08 Jan 2026 05:51:40 PM AEDT
# gpg: using RSA key 354BC8B3D7EB2A6B68674E5F3870B400EB918653
# gpg: issuer "armbru@redhat.com"
# gpg: Good signature from "Markus Armbruster <armbru@redhat.com>" [unknown]
# gpg: aka "Markus Armbruster <armbru@pond.sub.org>" [unknown]
# gpg: WARNING: The key's User ID is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 354B C8B3 D7EB 2A6B 6867 4E5F 3870 B400 EB91 8653
* tag 'pull-error-2026-01-07-v2' of https://repo.or.cz/qemu/armbru:
block/file-win32: Improve an error message
qga/commands-win32: Use error_setg_win32() for better error messages
error: Use error_setg_errno() for simplicity and consistency
error: Use error_setg_errno() to improve error messages
net/slirp: Improve file open error message
error: Use error_setg_file_open() for simplicity and consistency
blkdebug: Use error_setg_file_open() for a better error message
net/tap: Use error_setg_file_open() for a better error message
qga: Use error_setg_file_open() for better error messages
tap-solaris: Use error_setg_file_open() for better error messages
ui: Convert to qemu_create() for simplicity and consistency
error: Strip trailing '\n' from error string arguments (again)
error: Consistently name Error * objects err, and not errp
error: error_free(NULL) is safe, drop unnecessary conditionals
nbd/client-connection: Replace error_propagate() by assignment
hw/nvram/xlnx-bbram: More idiomatic and simpler error reporting
hw/core/loader: Make load_elf_hdr() return bool, simplify caller
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
This machine was contributed by Jackson Donaldson a couple of months
ago. Its RISC-V core is not implemented. Unfortunately, Jackson
isn't able to serve as maintainer at this time, so add it as orphan.
Cc: Jackson Donaldson <jackson88044@gmail.com> Cc: qemu-arm@nongnu.org Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20251220173336.3781377-5-armbru@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com>
Stefan Weil volunteered to serve as maintainer. Thanks!
Cc: Stefan Weil <sw@weilnetz.de> Signed-off-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Stefan Weil <sw@weilnetz.de>
Message-ID: <20251220173336.3781377-4-armbru@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com>
MAINTAINERS: Fix coverage of meson.build in tests/functional
Of the 29 meson.build wihin tests/functional, only 8 are covered. Add
the architecture-independent ones to "Functional testing framework",
and the remainder to "$arcg general architecture support" when
available, else to "$arch TCG CPUs".
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20251220173336.3781377-3-armbru@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com>
MAINTAINERS: Fix coverage of tests/functional/acpi-bits/
The pattern tests/functional/acpi-bits/* covers files in
acpi-bits/ (there are none), but not the files in its
subdirectories (there are five). Drop the *.
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20251220173336.3781377-2-armbru@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com>
Two out of three calls of CreateFile() use error_setg_win32() to
report errors. The third uses error_setg_errno(), mapping
ERROR_ACCESS_DENIED to EACCES, and everything else to EINVAL, throwing
away detail. Switch it to error_setg_win32().
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20251121121438.1249498-16-armbru@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
error: Use error_setg_errno() to improve error messages
A few error messages show numeric errno codes. Use error_setg_errno()
to show human-readable text instead.
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20251121121438.1249498-13-armbru@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
[Trivial fixup to riscv_kvm_cpu_finalize_features()]
Merge tag 'pull-monitor-2026-01-07' of https://repo.or.cz/qemu/armbru into staging
Monitor patches for 2026-01-07
# -----BEGIN PGP SIGNATURE-----
#
# iQJGBAABCgAwFiEENUvIs9frKmtoZ05fOHC0AOuRhlMFAmlehMoSHGFybWJydUBy
# ZWRoYXQuY29tAAoJEDhwtADrkYZTuPgP/2rHOlK4GKLJH6QHzK8RJKSyuSH2aPj8
# 7Mz22qnwxmlckinstF5AHpIdtzJtvpm9GpHQpvqzjaIObHNSqbopNUcC+C7SVYmB
# LomxyyBfNOGtqF7lCsWGwJIEDthMELN8BrrahADVxJRdEnVBJ3u8N21JaQegYJeE
# A+oywBUTdfNBkXwpwk/EzgXQSH9mSZxQI9QAfvqwd6alleRdSdlWQ1tt++x9TNXr
# 4I/leZpk5Olh99HtFonxMs03crVoNDaxEkqRzZaxa9WivFUjt6RZwOjfLnam7dFM
# fKz05/KeK8bgaJU0oaP8yrIZqcKeEM2kF+uYyBEsDsu8BWghv6a9mQ/7KrbU+idN
# lmr0el4Uk1kGmubpxEtWvse3yP2v4C4Y2/0r4nx00ebW3A09iBcfYQ9DjCvAhZ+O
# Ml7ECzZ63ubJ6Sj4w6sjjiUK6kcrbqxBP+DzLMzUY9YrGofSTLx6YUtyvEFyUm8J
# NPLl3u6vCI5zKnc9nHZoXsmLsPFKGe3at3TOJahNyM68TFc27xcvYlm3ZnKit6Un
# V2EvMxEjdZk2ZU6rWqEnIsVREQoC3Uje8zSkS9UFZEWWCj0WDhv552WXHlHRf4Uo
# ssP0T2wIG6N97LIdtKZSOg32Ff/EFU6ZI7J0pN8j4jz8is+7qdBuCkobq4kZ3vqN
# rfPt/lIY6dpc
# =RlpK
# -----END PGP SIGNATURE-----
# gpg: Signature made Thu 08 Jan 2026 03:07:38 AM AEDT
# gpg: using RSA key 354BC8B3D7EB2A6B68674E5F3870B400EB918653
# gpg: issuer "armbru@redhat.com"
# gpg: Good signature from "Markus Armbruster <armbru@redhat.com>" [unknown]
# gpg: aka "Markus Armbruster <armbru@pond.sub.org>" [unknown]
# gpg: WARNING: The key's User ID is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 354B C8B3 D7EB 2A6B 6867 4E5F 3870 B400 EB91 8653
* tag 'pull-monitor-2026-01-07' of https://repo.or.cz/qemu/armbru:
monitor/qmp: cleanup SocketChardev listener sources early to avoid fd handling race
scripts/device-crash-test: ERROR_RULE_LIST garbage collection
qdev: Legacy properties are now unused internally, drop
qdev: Fix "info qtree" to show links
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Merge tag 'pull-request-2026-01-07' of https://gitlab.com/thuth/qemu into staging
* Compat machines for 11.0
* Add some more files to the MAINTAINERS file
* Use explicit big-endian API calls in the s390x code
* Add the possibility to run sub-tests manually in the functional test suite
# -----BEGIN PGP SIGNATURE-----
#
# iQJFBAABCgAvFiEEJ7iIR+7gJQEY8+q5LtnXdP5wLbUFAmleSkMRHHRodXRoQHJl
# ZGhhdC5jb20ACgkQLtnXdP5wLbVegA//R8zGTnW++Rcb3xFlRGQye08eKNWda4K8
# hqgHg4nEf3zj8dYm91lop8v3CMwVJtlBLiKtv+8GAo5ma/yItM9N/F3AgsUXt6po
# dpAAJISucDyIkHLDEMtlPTfQsEvoegEIaXoM7m1AOktArRaLzynmu430f8oAV8BE
# H3pPGUxaNgjtGlF+6yeUJ/FzrRpI2PXR6o8vtoG8+II5lQZvajOcmix6Znh+u0xj
# QKzYchYeN1u1YCvykQSp7dTUPygaGOgXHKpUvzUFNWyiq9d0eRW75NMLQJ4LSG2q
# nqmmHlSxsay5E0H+AWzDRGAsGNrXDtsxkXuAVE0GitKLcc3a1U5m4RQAl2bCW7Px
# +tx5xjxzg5d38wyKo7mif5WKKIdJs0ljuFlMMMn+FR8MEblCorW/CVCB4qVBdJ2v
# GMSD7hvHoRba2SpT6y0s+pIOZRsXdWW9FhAAVk9gURkm494UxBJZZL37gQEKwC0t
# HMxq8WMFLqZAC4TaoxSMdIRW9CZD5qKjGa4y2N9JU1HO2YDHsItce9DWb/09ep91
# LQg+adtqOFsYs5oGAZ1I17AIl9+ZYUatCeOGxwyYV4Bso5VZ45YH0z2puhA+FSp6
# zT+4trfasVDPQTFOFzBOZXOzhSFBqeVBPeBZAPG3CsTfHBdqu/YNOQuYtWWize94
# 0qmfMrevMxs=
# =oVgR
# -----END PGP SIGNATURE-----
# gpg: Signature made Wed 07 Jan 2026 10:57:55 PM AEDT
# gpg: using RSA key 27B88847EEE0250118F3EAB92ED9D774FE702DB5
# gpg: issuer "thuth@redhat.com"
# gpg: Good signature from "Thomas Huth <th.huth@gmx.de>" [unknown]
# gpg: aka "Thomas Huth <thuth@redhat.com>" [unknown]
# gpg: aka "Thomas Huth <th.huth@posteo.de>" [unknown]
# gpg: aka "Thomas Huth <huth@tuxfamily.org>" [unknown]
# gpg: WARNING: The key's User ID is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 27B8 8847 EEE0 2501 18F3 EAB9 2ED9 D774 FE70 2DB5
* tag 'pull-request-2026-01-07' of https://gitlab.com/thuth/qemu:
tests/functional/qemu_test/testcase: Fix mismatched quotations
tests/functional: Allow tests to be run individually
target/s390x: Inline translator_lduw() and translator_ldl()
target/s390x: Use big-endian variant of cpu_ld/st_data*()
target/s390x: Inline cpu_ld{uw, l}_code() calls in EX opcode helper
target/s390x: Replace MO_TE -> MO_BE
target/s390x: Replace gdb_get_regl() -> gdb_get_reg64()
target/s390x: Use explicit big-endian LD/ST API
hw/s390x: Use explicit big-endian LD/ST API
MAINTAINERS: Add configs/targets/s390x-softmmu.mak to the S390 general section
MAINTAINERS: Add util/s390x_pci_mmio.c to the S390 PCI section
hw/s390x: Un-inline the s390_do_cpu_*() functions
hw: add compat machines for 11.0
hw/s390x/ccw: Remove deprecated s390-ccw-virtio-5.0 machine
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Jie Song [Tue, 25 Nov 2025 14:07:06 +0000 (22:07 +0800)]
monitor/qmp: cleanup SocketChardev listener sources early to avoid fd handling race
When starting a dummy QEMU process with virsh version, monitor_init_qmp()
enables IOThread monitoring of the QMP fd by default. However, a race
condition exists during the initialization phase: the IOThread only removes
the main thread's fd watch when it reaches qio_net_listener_set_client_func_full(),
which may be delayed under high system load.
This creates a window between monitor_qmp_setup_handlers_bh() and
qio_net_listener_set_client_func_full() where both the main thread and
IOThread are simultaneously monitoring the same fd and processing events.
This race can cause either the main thread or the IOThread to hang and
become unresponsive.
Fix this by proactively cleaning up the listener's IO sources in
monitor_init_qmp() before the IOThread initializes QMP monitoring,
ensuring exclusive fd ownership and eliminating the race condition.
Signed-off-by: Jie Song <songjie_yewu@cmss.chinamobile.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-ID: <20251125140706.114197-1-mail@jiesong.me>
Device 'nand' was dropped in commit commit e86c1f967a3.
Device 'vfio-amd-xgbe' was dropped in commit aeb1a50d4a7.
Device 'vfio-calxeda-xgmac' was dropped in commit 8ebc416ac17.
The last error messages matching r"images* must be given with the
'pflash' parameter" was dropped in commit a2ccff4d2bc.
The error message matching r"Option '-device [\w.,-]+' cannot be
handled by this machine" was dropped in commit commit db78a605599.
The error message matching r"Ignoring smp_cpus value" ceased to match
in commit f2ad5140fa5, and was then dropped in commit 72649619341.
The error message matching r"rom check and register reset failed" was
lost in merge commit af3f37319cb.
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20251128101321.3287186-1-armbru@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com>
qdev: Legacy properties are now unused internally, drop
Legacy properties are an accidental and undocumented external
interface. qom-set doesn't work for them (no .set() method). qom-get
and qom-list-get work only when the underlying qdev property has a
.print() method, i.e. the PCI address properties, as explained in the
previous commit. Here's one that works:
(qemu) qom-get /machine/unattached/device[3]/pm bus
"/machine/i440fx/pci.0"
(qemu) qom-get /machine/unattached/device[3]/pm legacy-bus
Error: Property 'PIIX4_PM.legacy-bus' is not readable
Actual use of this undocumented interface seems quite unlikely. A
deprecation period seems unnecessary. Drop it.
qdev_print_props() retrieves a property's value from its legacy
property if it exists. A legacy property is created by
qdev_class_add_legacy_property() when the property has a print()
method or does not have a get() method.
If it has a print() method, the legacy property's value is obtained
from the property's print() method. This is used to format PCI
addresses nicely, i.e. like 01.3 instead of 11.
Else, if doesn't have a get() method, the legacy property is
unreadable. "info qtree" silently skips unreadable properties.
Link properties don't have a get() method, and are therefore skipped.
This is wrong, because the underlying QOM property *is* readable.
Change qdev_print_props() to simply use a print() method directly if
it exists, else get the value via QOM.
"info qtree" now shows links fine. For instance, machine "pc" onboard
device "PIIX4_PM" property "bus" is now visible.
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20251022101420.36059-3-armbru@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
This error reports failure to create a temporary file, and
error_setg_file_open() would probably be too terse, so merely switch
to error_setg_errno() to add errno information.
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20251121121438.1249498-12-armbru@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
error: Use error_setg_file_open() for simplicity and consistency
Replace
error_setg_errno(errp, errno, MSG, FNAME);
by
error_setg_file_open(errp, errno, FNAME);
where MSG is "Could not open '%s'" or similar.
Also replace equivalent uses of error_setg().
A few messages lose prefixes ("net dump: ", "SEV: ", __func__ ": ").
We could put them back with error_prepend(). Not worth the bother.
Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dave@treblig.org>
Message-ID: <20251121121438.1249498-11-armbru@redhat.com>
[Conflict with commit 26b4a6ffe7f (monitor/hmp: Merge
hmp-cmds-target.c within hmp-cmds.c) resolved]
net/tap: Use error_setg_file_open() for a better error message
The error message changes from
tap: open vhost char device failed
to
Could not open '/dev/vhost-net': REASON
I think the exact file name is more useful to know than the file's
purpose.
We could put back the "tap: " prefix with error_prepend(). Not
worth the bother.
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20251121121438.1249498-9-armbru@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
qga: Use error_setg_file_open() for better error messages
Error messages change from
open("FNAME"): REASON
to
Could not open 'FNAME': REASON
Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dave@treblig.org> Reviewed-by: Kostiantyn Kostiuk <kkostiuk@redhat.com>
Message-ID: <20251121121438.1249498-6-armbru@redhat.com>
tap-solaris: Use error_setg_file_open() for better error messages
Error messages change from
Can't open /dev/ip (actually /dev/udp)
Can't open /dev/tap
Can't open /dev/tap (2)
to
Could not open '/dev/udp': REASON
Could not open '/dev/tap': REASON
where REASON is the value of strerror(errno).
Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dave@treblig.org>
Message-ID: <20251121121438.1249498-5-armbru@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
error: Strip trailing '\n' from error string arguments (again)
Tracked down with scripts/coccinelle/err-bad-newline.cocci.
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20251121121438.1249498-2-armbru@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
error: Consistently name Error * objects err, and not errp
This touches code in xen_enable_tpm() that is obviously wrong. Since
I don't know how to fix it properly, I'm adding a FIXME there.
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20251119130855.105479-6-armbru@redhat.com> Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
error: error_free(NULL) is safe, drop unnecessary conditionals
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20251119130855.105479-5-armbru@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru> Reviewed-by: Peter Xu <peterx@redhat.com> Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
nbd/client-connection: Replace error_propagate() by assignment
connect_thread_func() sets a variable to null, then error_propagate()s
an Error * to it. This is a roundabout way to assign the Error * to
it, so replace it by just that.
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20251119130855.105479-4-armbru@redhat.com> Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru> Reviewed-by: Peter Xu <peterx@redhat.com> Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
hw/nvram/xlnx-bbram: More idiomatic and simpler error reporting
bbram_bdrv_error() interpolates a "detail" string into a template with
error_setg_errno(), then reports the result with error_report().
Produces error messages with an unwanted '.':
BLK-NAME: BBRAM backstore DETAIL failed.: STERROR
Replace both calls of bbram_bdrv_error() by straightforward
error_report(), and drop the function. This is less code, easier to
read, and the error message is more greppable.
Also delete the unwanted '.'.
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20251119130855.105479-3-armbru@redhat.com> Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru> Reviewed-by: Peter Xu <peterx@redhat.com> Reviewed-by: Luc Michel <luc.michel@amd.com> Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
hw/core/loader: Make load_elf_hdr() return bool, simplify caller
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20251119130855.105479-2-armbru@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru> Reviewed-by: Peter Xu <peterx@redhat.com> Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com> Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
projects / thirdparty / qemu.git / log
