Refactor RamDiscardManager to aggregate multiple RamDiscardSource
instances. This enables scenarios where multiple components (e.g.,
virtio-mem and RamBlockAttributes) can coordinate memory discard
state for the same memory region.
The aggregation uses:
- Populated: ALL sources populated
- Discarded: ANY source discarded
When a source is added with existing listeners, they are notified
about regions that become discarded. When a source is removed,
listeners are notified about regions that become populated.
system/ram-discard-manager: drop replay from source interface
Remove replay_populated and replay_discarded from RamDiscardSourceClass
now that the RamDiscardManager handles replay iteration internally via
is_populated.
Remove the now-dead replay methods, helpers, and
for_each_populated/discarded_section() from ram-block-attributes, which
was the last source still carrying this code.
The replay iteration logic has been moved into the RamDiscardManager,
which now iterates at source granularity using is_populated(). The
source-level replay_populated/replay_discarded methods and their
helpers are no longer called.
Remove the now-dead replay methods, the VirtIOMEMReplayData struct,
the virtio_mem_for_each_plugged/unplugged_section() helpers (only used
by the replay methods), and the virtio_mem_section_cb typedef.
system/ram-discard-manager: implement replay via is_populated iteration
Replace the source-level replay wrappers with a new
replay_by_populated_state() helper that iterates the section at
min-granularity, calls is_populated() for each chunk, and aggregates
consecutive chunks of the same state before invoking the callback.
This moves the iteration logic from individual sources into the manager,
preparing for multi-source aggregation where the manager must combine
state from multiple sources anyway.
The replay_populated/replay_discarded vtable entries in
RamDiscardSourceClass are no longer called but remain in the interface
for now; they will be removed in follow-up commits along with the
now-dead source implementations.
Reviewed-by: Peter Xu <peterx@redhat.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Acked-by: Maciej S. Szmigiero <maciej.szmigiero@oracle.com> # for CPR Acked-by: David Hildenbrand (Arm) <david@kernel.org> Link: https://lore.kernel.org/r/20260604-rdm5-v5-3-5768e6a0943d@redhat.com Signed-off-by: Peter Xu <peterx@redhat.com>
system/memory: split RamDiscardManager into source and manager
Refactor the RamDiscardManager interface into two distinct components:
- RamDiscardSource: An interface that state providers (virtio-mem,
RamBlockAttributes) implement to provide discard state information
(granularity, populated/discarded ranges, replay callbacks).
- RamDiscardManager: A concrete QOM object that wraps a source, owns
the listener list, and handles listener registration/unregistration
and notifications.
This separation moves the listener management logic from individual
source implementations into the central RamDiscardManager, reducing
code duplication between virtio-mem and RamBlockAttributes.
The change prepares for future work where a RamDiscardManager could
aggregate multiple sources.
Note, the original virtio-mem code had conditions before discard:
if (vmem->size) {
rdl->notify_discard(rdl, rdl->section);
}
however, the new code calls discard unconditionally. This is considered
safe, since the populate/discard of sections are already asymmetrical
(unplug & unregister all listener section unconditionally).
Reviewed-by: Peter Xu <peterx@redhat.com> Acked-by: David Hildenbrand <david@kernel.org> Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260604-rdm5-v5-1-5768e6a0943d@redhat.com Signed-off-by: Peter Xu <peterx@redhat.com>
Peter Xu [Fri, 12 Jun 2026 15:53:07 +0000 (11:53 -0400)]
migration/tests: Update a-b-boot images for all archs
We just added a GPLv2 licence identifier to __note, update all headers with
that. When at this, s390 seems to generate a new binary with the latest
cross-compiler I have here:
s390x-linux-gnu-gcc (GCC) 15.2.1 20250808 (Red Hat Cross 15.2.1-1)
The hope is the new generated should normally be better. Update them.
Cc: Bibo Mao <maobibo@loongson.cn> Cc: Cornelia Huck <cohuck@redhat.com> Cc: Eric Farman <farman@linux.ibm.com> Cc: Matthew Rosato <mjrosato@linux.ibm.com> Cc: Richard Henderson <richard.henderson@linaro.org> Cc: Ilya Leoshkevich <iii@linux.ibm.com> Cc: David Hildenbrand <david@kernel.org> Cc: qemu-s390x@nongnu.org Reviewed-by: Bibo Mao <maobibo@loongson.cn>
Based-on: <20260611084312.70042-1-maobibo@loongson.cn> Acked-by: Fabiano Rosas <farosas@suse.de> Link: https://lore.kernel.org/r/20260612155307.2172358-1-peterx@redhat.com Signed-off-by: Peter Xu <peterx@redhat.com>
Bibo Mao [Thu, 11 Jun 2026 08:43:12 +0000 (16:43 +0800)]
tests/qtest/migration: Add migration test on loongarch
Add migration qtest on loongarch64 system, the test passes to run with
the following result:
qemu:qtest+qtest-loongarch64/qtest-loongarch64/migration-test OK 15.94s 9 subtests passed
Peter Xu [Tue, 9 Jun 2026 17:25:05 +0000 (13:25 -0400)]
migration: Use OBJECT_DECLARE_SIMPLE_TYPE
Migration object's class has nothing special, switch to the newly
introduced macro.
Suggested-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Mark Cave-Ayland <mark.caveayland@nutanix.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Fabiano Rosas <farosas@suse.de> Link: https://lore.kernel.org/r/20260609172514.2037645-2-peterx@redhat.com Signed-off-by: Peter Xu <peterx@redhat.com>
Gavin Shan [Mon, 8 Jun 2026 00:23:03 +0000 (10:23 +1000)]
system/memory: Remove MAX_PHYS_ADDR
Remove MAX_PHYS_ADDR and MAX_PHYS_ADDR_SPACE_BITS as they're not used
since the addition by commit 052e87b073cb ("memory: make section size
a 128-bit integer").
Akihiko Odaki [Sat, 23 May 2026 12:38:28 +0000 (21:38 +0900)]
system/physmem: Synchronize ram_list accesses
Alex Bennée reported a ThreadSanitizer warning about a plain concurrent
access to ram_list [1]. Ensure the concurrent accesses to ram_list are
properly synchronized with atomic accesses, mutexes, or RCU.
First, the plain assignments of ram_list.mru_block are replaced with
qatomic_set(). A comment in qemu_get_ram_block() explains why the
ordering requirement is relaxed, but it still needs to be atomically
accessed. include/qemu/atomic.h says:
> The C11 memory model says that variables that are accessed from
> different threads should at least be done with __ATOMIC_RELAXED
> primitives or the result is undefined. Generally this has little to
> no effect on the generated code but not using the atomic primitives
> will get flagged by sanitizers as a violation.
Second, ram_list.version accesses are replaced with atomic operations
or protected with a mutex. Unlike ram_list.mru_block, ram_list.version
has tighter ordering requirements for one of its goals: ensuring that
the reader-held rs->last_seen_block value is invalidated whenever a RAM
block is reclaimed between two RCU reader critical sections. Below are
steps a reader and an updater follow:
Reader:
R-1. Enter the first RCU read-side critical section:
R-1-1. rs->last_version = qatomic_load_acquire(&ram_list.version)
R-1-2. rs->last_seen_block = an element of ram_list.blocks
R-2. Enter the second RCU read-side critical section:
R-2-1. if (qatomic_read(&ram_list.version) != rs->last_version)
R-2-2. rs->last_seen_block = NULL
Updater:
W-1. Enter a ram_list.mutex critical section
W-1-1. Update ram_list.blocks
W-1-2. qatomic_store_release(&ram_list.version, ram_list.version + 1)
W-2. Enter another ram_list.mutex critical section
W-2-1. QLIST_REMOVE_RCU(block, next)
W-2-2. qatomic_store_release(&ram_list.version, ram_list.version + 1)
W-2-3. call_rcu(block, reclaim_ramblock, rcu)
W-1-2 represents the write observed by R-1-1.
ram_list.version is read non-atomically on the update side because the
update side is serialized with ram_list.mutex. The other ram_list
accesses in these steps are reasoned about in two cases.
When the grace period of W-2-3 contains R-2:
qatomic_load_acquire() at R-1-1 and qatomic_store_release() at W-1-2
enforce the following ordering:
W-1-1 -> W-1-2 -> R-1-1 -> R-1-2
The value of ram_list.blocks stored by W-1-1 or a newer value that
was loaded by R-1-2 is still valid because of the grace period.
When the grace period of W-2-3 ends before R-2:
call_rcu() at W-2-3 and the read-side critical section at R-2 ensure
the following ordering:
W-2-2 -> W-2-3 -> the grace period -> R-2 -> R-2-1
The value of ram_list.version stored by W-2-2 or a newer value that
was loaded by R-2-1 differs from rs->last_version and the reader
invalidates rs->last_seen_block.
Together, these steps ensure that rs->last_seen_block is invalidated
whenever necessary. With added atomic operations, pre-existing memory
barriers are no longer necessary and are removed.
Any other ram_list accesses are already properly synchronized.
Peter Xu [Thu, 28 May 2026 20:12:36 +0000 (16:12 -0400)]
qapi/migration: Remove @cpr-exec-command doc in MigrationParameter
This parameter was developed during similar window when the deduplication
work was done in commit 2220c2b9ef ("qapi/migration: Don't document
MigrationParameter"), hence it was overlooked.
Remove the leftover parameter. After all, MigrationParameter is already in
the exception list of the doc sanity checker.
thread-pool: Allow at least 1 thread in thread_pool_adjust_max_threads_to_work()
thread_pool_adjust_max_threads_to_work() is supposed to give each task its
own thread by setting the pool max thread count limit accordingly.
However, if there aren't any tasks currently in the pool the pool max
thread count will be set to 0, which will trigger an assertion failure
in thread_pool_set_max_threads() - because setting this value would
completely block the pool by not allowing it to process any submitted
tasks.
This also can happen if a task is submitted via
thread_pool_submit_immediate() to an empty pool but the task completes so
quickly that by the time this function calls
thread_pool_adjust_max_threads_to_work() the pool again has no unfinished
tasks in it.
Quoting from Maciej on reproducing this issue:
It's difficult to reproduce in most setups.
My main VFIO live migration setup never hit it for more than a year,
other similar setup hit it recently 3 times.
On the other hand, putting sleep(5) in the middle of
thread_pool_submit_immediate() makes it reproduce nearly always for me.
Fix this by making sure that the pool is allowed to create at least 1
thread.
Alex Bennée [Fri, 19 Jun 2026 15:56:51 +0000 (16:56 +0100)]
python/qemu: split console from harness args
Before we mess with the console output lets create a new helper just
for that.
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20260619155657.944220-3-alex.bennee@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Alex Bennée [Fri, 19 Jun 2026 15:56:50 +0000 (16:56 +0100)]
python/qemu: split arg between base and harness lists
There are argument we add because we want the test harness to control
QEMU and arguments we default for handling the display and machine
type. Split the obvious ones between base_args and a new list called
harness_args.
We will leave the complexity of the serial ports for now.
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20260619155657.944220-2-alex.bennee@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Stefan Hajnoczi [Fri, 19 Jun 2026 18:58:38 +0000 (14:58 -0400)]
Merge tag 'linux-user-pull-request' of https://github.com/hdeller/qemu-hppa into staging
linux-user patches
One frame pointer memory locking fix for the xtensa architecture, a generic
loader fix for programs with modified headers, and two patches to emulate
/proc/cpuinfo for loogarch and m68k CPUs.
# -----BEGIN PGP SIGNATURE-----
#
# iHUEABYKAB0WIQS86RI+GtKfB8BJu973ErUQojoPXwUCajRo/gAKCRD3ErUQojoP
# X+3IAQCPg/Z8KRa43miOMpOJVRxel3eg5h9+A/Sh4SwPp9Sk2gD/U6gh4l64Bl2O
# CT30o35Afd7rl1G1dD9rsB/H9tU/gwM=
# =mTKh
# -----END PGP SIGNATURE-----
# gpg: Signature made Thu 18 Jun 2026 17:54:06 EDT
# gpg: using EDDSA key BCE9123E1AD29F07C049BBDEF712B510A23A0F5F
# gpg: Good signature from "Helge Deller <deller@gmx.de>" [unknown]
# gpg: aka "Helge Deller <deller@kernel.org>" [unknown]
# gpg: aka "Helge Deller <deller@debian.org>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 4544 8228 2CD9 10DB EF3D 25F8 3E5F 3D04 A7A2 4603
# Subkey fingerprint: BCE9 123E 1AD2 9F07 C049 BBDE F712 B510 A23A 0F5F
* tag 'linux-user-pull-request' of https://github.com/hdeller/qemu-hppa:
linux-user/xtensa: fix unlock of uninitialized frame pointer on sigreturn
linux-user: Implement /proc/cpuinfo for m68k CPU
linux-user: Implement /proc/cpuinfo for loongarch cpus
linux-user: Fix AT_PHDR when program headers are relocated into their own segment
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Ziyang Zhang [Thu, 18 Jun 2026 08:24:26 +0000 (16:24 +0800)]
plugins: use int64_t for the syscall filter return value
The syscall return value passed back through the syscall filter
callback is semantically signed: negative values encode errno codes.
Declaring the sysret pointer as uint64_t * is therefore misleading and
forces callers to launder the value through an unsigned temporary.
Change the sysret pointer to int64_t * across the public plugin API
typedef (qemu_plugin_vcpu_syscall_filter_cb_t), the internal
qemu_plugin_vcpu_syscall_filter() prototypes and stub, its
implementation in plugins/core.c, the linux-user caller, and the
in-tree example plugins.
Matt Turner [Thu, 18 Jun 2026 13:33:53 +0000 (09:33 -0400)]
linux-user/xtensa: fix unlock of uninitialized frame pointer on sigreturn
If lock_user_struct fails, frame is uninitialized but the badframe
label unconditionally calls unlock_user_struct on it. Handle the
lock failure inline so badframe is only reached with a valid lock.
Akshit Yadav [Sat, 13 Jun 2026 15:21:56 +0000 (20:51 +0530)]
linux-user: Fix AT_PHDR when program headers are relocated into their own segment
When a binary is patched or relocated such that the program header table is
moved into a separate PT_LOAD segment (rather than sitting at the start of the
first loadable segment), QEMU's AT_PHDR auxv entry becomes incorrect. The
loader was computing AT_PHDR as load_addr + e_phoff, which assumes the headers
are mapped 1:1 from file offset 0. This breaks when the headers are elsewhere.
The Linux kernel instead locates the PT_LOAD segment that contains e_phoff,
then computes the in-memory address as p_vaddr + (e_phoff - p_offset). This
correctly handles relocated headers.
Fix by:
1. Add phdr_addr field to image_info to cache the resolved address.
2. Initialize to load_addr + e_phoff (fallback for headers outside any PT_LOAD).
3. In the PT_LOAD mapping loop, detect if the segment contains e_phoff and
override with the segment-relative address.
4. Use info->phdr_addr for AT_PHDR instead of the incorrect formula.
Stefan Hajnoczi [Thu, 18 Jun 2026 20:28:12 +0000 (16:28 -0400)]
Merge tag 'accel-20260618' of https://github.com/philmd/qemu into staging
Accelerators patches queue
- Avoid double hv_vcpu_destroy() call during teardown on HVF ARM
- Constify various AddressSpace/MemoryRegionCache arguments
- Clarify physical_memory_*() API in "system/physmem.h"
- Extract "accel/tcg/cpu-loop.h" out of "exec/cpu-common.h"
- Restrict few TCG-specific code
- Remove pre-C11 check
- Various header cleanups
* tag 'accel-20260618' of https://github.com/philmd/qemu: (48 commits)
accel/tcg: Restrict headers being TCG specific
accel/tcg: Move cpu_loop_exit_*() out of 'exec/cpu-common.h'
accel/tcg: Have cpu_loop_exit_requested() take const @cpu argument
accel/tcg: Move cpu_restore_state() out of 'exec/cpu-common.h'
accel/tcg: Move cpu_unwind_state_data() out of 'exec/cpu-common.h'
accel/tcg: Move cpu_exec_step_atomic() out of 'exec/cpu-common.h'
accel/tcg: Move cpu_exec() out of 'exec/cpu-common.h'
accel/tcg: Remove cpu_loop_exit() stub
hw/s390x/ipl: Remove TCG dependency in handle_diag_308()
system/memory: Rename cpu_exec_init_all() -> machine_memory_init()
system/memory: Remove unnecessary CONFIG_USER_ONLY guards
exec/cpu-common.h: Avoid including unused exec/page-protection.h header
exec/cpu-common.h: Avoid including unused 'tcg/debug-assert.h' header
exec/cpu-common.h: Avoid including unused 'exec/vaddr.h' header
exec/cpu-common.h: Include missing 'qemu/thread.h' header
ui/cocoa: Use qemu_input_map_osx_to_linux
util/cutils: drop qemu_strnlen() in favor of strnlen()
configure: honor --extra-ldflags when forced to use objc_LINKER
meson: build macOS signed binary as part of the default target
accel/tcg: Restrict IOMMU declarations
...
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Tom Stellard [Wed, 17 Jun 2026 22:41:45 +0000 (15:41 -0700)]
trace/control: Fix -Wunused-but-set-global warning with clang 23+
../trace/control.c:41:13: error: variable 'init_trace_on_startup' set but not used [-Werror,-Wunused-but-set-global]
41 | static bool init_trace_on_startup;
| ^
1 error generated.
Signed-off-by: Tom Stellard <tstellar@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-id: 20260617224145.1419961-1-tstellar@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
* tag 'pull-9p-20260617' of https://github.com/cschoenebeck/qemu:
hw/9pfs: consolidate name validation with check_name()
hw/9pfs: reject . and .. in Twstat rename
hw/9pfs: fix abort due to illegal name with Twstat rename
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
* tag 'ui-input-pr-v1' of https://gitlab.com/marcandre.lureau/qemu: (27 commits)
ui/sdl2: Set GL ES profile before creating initial GL context
ui/sdl2: Explicitly specify EGL platform
ui/pixman: fix zero rowstride in qemu_pixman_image_new_shareable()
ui/input: Have qemu_input_is_absolute() take a const QemuConsole
tools/qemu-vnc: Have console_get_mouse/keyboard take const QemuConsole
ui/input: remove old LED handler broadcast queue
ui/dbus: switch LED handling to Notifier-based input API
ui/spice: switch LED handling to Notifier-based input API
ui/vnc: switch LED handling to Notifier-based input API
hw/input/virtio-input-hid: use qemu_input_handler_set_leds_mask() for LED state
hw/input/hid: use qemu_input_handler_set_leds_mask() for LED state
hw/input/ps2: use qemu_input_handler_set_leds_mask() for LED state
ui/input: qemu_input_handler_register to warn for unused result
hw/m68k: keep QemuInputHandlerState in next-kbd
hw/input: keep QemuInputHandlerState in stellaris
hw/input: keep QemuInputHandlerState in adb-kbd
hw/arm: keep QemuInputHandlerState in musicpal
hw/input/ps2: keep QemuInputHandlerState in PS2State
ui/input: add LED state tracking to QemuInputHandlerState
ui/input: remove dead declaration
...
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Stefan Hajnoczi [Thu, 18 Jun 2026 13:46:49 +0000 (09:46 -0400)]
Merge tag 'for-upstream' of https://gitlab.com/bonzini/qemu into staging
* GNU/Hurd support
* More patches to support qemu-ga builds with clang-cl
* gdbstub: Update x86 control register bits
* rust: fix incorrect dependency in Cargo.toml
* target/i386: apply mod to immediate count of an RCL/RCR operation
* tag 'for-upstream' of https://gitlab.com/bonzini/qemu:
qga/vss: Drop unused define uuid(x)
qga/vss: Remove unused undefs
qga/vss: Use MAX_PATH instead of PATH_MAX
qga/meson: Allow to use MSVC message compiler 'mc'
qga/meson: Use windows.compile_resources instead of custom_target
qga/meson: Remove unused lib stdc++
qga/win: Use swprintf instead of snwprintf
Make copy_file_range non-static on GNU/Hurd
block/file-posix: Clean up sys/ioctl import
tpm: Add conditional to not compile ioctls on GNU/Hurd
Add GNU/Hurd host_os=gnu
Include new arbitrary limits if not already defined
gdbstub: Update x86 control register bits
target/i386: add more easy cases to gen_eflags_adcox
target/i386: apply mod to immediate count of an RCL/RCR operation
rust: fix incorrect dependency in Cargo.toml
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Forbid including TCG-specific headers in non-TCG builds.
Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20260617171438.75914-12-philmd@oss.qualcomm.com>
accel/tcg: Move cpu_loop_exit_*() out of 'exec/cpu-common.h'
Move the following TCG-specific cpu_loop_exit_*() declarations
out of the generic "exec/cpu-common.h" header, to the recently
created "accel/tcg/cpu-loop.h" one, documenting them:
Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20260617171438.75914-11-philmd@oss.qualcomm.com>
accel/tcg: Have cpu_loop_exit_requested() take const @cpu argument
Since the CPUState argument is simply read-only accessed, make it const.
Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20260617171438.75914-9-philmd@oss.qualcomm.com>
accel/tcg: Move cpu_restore_state() out of 'exec/cpu-common.h'
Move the TCG-specific cpu_restore_state() declaration out
of the generic "exec/cpu-common.h" header, to the recently
created "accel/tcg/cpu-loop.h" one.
Include "accel/tcg/cpu-loop.h" where appropriate.
Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20260617171438.75914-8-philmd@oss.qualcomm.com>
accel/tcg: Move cpu_unwind_state_data() out of 'exec/cpu-common.h'
Move the TCG-specific cpu_unwind_state_data() declaration out
of the generic "exec/cpu-common.h" header, to the recently
created "accel/tcg/cpu-loop.h" one.
Include "accel/tcg/cpu-loop.h" where appropriate.
Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20260617171438.75914-7-philmd@oss.qualcomm.com>
accel/tcg: Move cpu_exec_step_atomic() out of 'exec/cpu-common.h'
Move the TCG-specific cpu_exec_step_atomic() declaration out
of the generic "exec/cpu-common.h" header, to the recently
created "accel/tcg/cpu-loop.h" one.
Include "accel/tcg/cpu-loop.h" where appropriate.
Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20260617171438.75914-6-philmd@oss.qualcomm.com>
accel/tcg: Move cpu_exec() out of 'exec/cpu-common.h'
In order to keep TCG-specific functions under a TCG
API namespace, add the "accel/tcg/cpu-loop.h" header
and move cpu_exec() declaration to it. Add a bit of
documentation.
Include "accel/tcg/cpu-loop.h" where appropriate.
Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20260617171438.75914-5-philmd@oss.qualcomm.com>
Last commit removed the last non-TCG use of cpu_loop_exit().
This method is now only called within TCG files, so we can
remove its stub for non-TCG accelerators.
Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20260617171438.75914-4-philmd@oss.qualcomm.com>
hw/s390x/ipl: Remove TCG dependency in handle_diag_308()
Rather than calling a TCG specific method in s390_ipl_reset_request(),
have handle_diag_308() return whether a vCPU reset is pending, and use
that in the TCG DIAG helper to return to the main loop.
Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Jared Rossi <jrossi@linux.ibm.com>
Message-Id: <20260617164035.70788-4-philmd@oss.qualcomm.com>
cpu_exec_init_all() is system specific: it initializes globals
for the memory subsystem. Rename it as machine_memory_init()
and restrict its declaration to 'system/' namespace.
Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20260616153754.93545-3-philmd@oss.qualcomm.com>
This header is only used when building system units,
checking for CONFIG_USER_ONLY is pointless.
Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20260616153754.93545-2-philmd@oss.qualcomm.com>
exec/cpu-common.h: Avoid including unused exec/page-protection.h header
Since commit e74781c0888e ("exec/cpu: Extract page-protection
definitions to page-protection.h") the "exec/cpu-common.h" isn't
using anything defined in "exec/page-protection.h"; remove it.
Include it in few files where it is currently pulled in indirectly,
otherwise we'd get:
linux-user/qemu.h:182:22: error: ‘PAGE_READ’ undeclared
182 | #define VERIFY_READ PAGE_READ
| ^~~~~~~~~
target/loongarch/cpu_helper.c:329:25: error: use of undeclared identifier 'PAGE_READ'
329 | context->prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
| ^
target/loongarch/cpu_helper.c:329:37: error: use of undeclared identifier 'PAGE_WRITE'
329 | context->prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
| ^
target/loongarch/cpu_helper.c:329:50: error: use of undeclared identifier 'PAGE_EXEC'
329 | context->prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
| ^
target/ppc/mmu-hash32.h:98:20: error: use of undeclared identifier 'PAGE_READ'
98 | prot = PAGE_READ | PAGE_WRITE;
| ^
target/ppc/mmu-hash32.h:98:32: error: use of undeclared identifier 'PAGE_WRITE'
98 | prot = PAGE_READ | PAGE_WRITE;
| ^
hw/ppc/ppc_booke.c:39:17: error: use of undeclared identifier 'PAGE_RWX'
39 | tlb->prot = PAGE_RWX << 4 | PAGE_VALID;
| ^
hw/ppc/ppc_booke.c:39:33: error: use of undeclared identifier 'PAGE_VALID'
39 | tlb->prot = PAGE_RWX << 4 | PAGE_VALID;
| ^
Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20260617160426.64461-6-philmd@oss.qualcomm.com>
exec/cpu-common.h: Avoid including unused 'tcg/debug-assert.h' header
Since commit efe25c260cd ("include/exec: Split out
accel/tcg/cpu-mmu-index.h") the "exec/cpu-common.h" isn't using
anything defined in "tcg/debug-assert.h".
Include it in target/loongarch/tcg/tcg_cpu.c however, where it
is required but included indirectly, otherwise we'd get:
target/loongarch/tcg/tcg_cpu.c:291:5: error: call to undeclared function 'tcg_debug_assert'
291 | tcg_debug_assert(!tcg_cflags_has(cs, CF_PCREL));
| ^
Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20260617160426.64461-5-philmd@oss.qualcomm.com>
exec/cpu-common.h: Avoid including unused 'exec/vaddr.h' header
We neglected to remove the "exec/vaddr.h" header when moving
cpu_memory_rw_debug() around in commit e9048f099b3 ("exec/cpu:
Declare cpu_memory_rw_debug() in 'hw/core/cpu.h' and document").
Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20260617160426.64461-4-philmd@oss.qualcomm.com>
exec/cpu-common.h: Include missing 'qemu/thread.h' header
Unfortunately we need to include "qemu/thread.h" -- which is
currently indirectly pulled in -- to get the QemuMutex type
definition:
extern QemuMutex qemu_cpu_list_lock;
Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20260617160426.64461-3-philmd@oss.qualcomm.com>
Akihiko Odaki [Thu, 4 Jun 2026 06:39:32 +0000 (15:39 +0900)]
ui/cocoa: Use qemu_input_map_osx_to_linux
ui/cocoa used to have a conversion table from macOS keycode to Linux
key code. It is an unnecessary redundancy as ui/input-keymap.c already
has such a table. Worse, I added an incorrect mapping of kVK_JIS_Eisu and
kVK_JIS_Kana with commit 708b72557ff5 ("ui/cocoa: Support unique keys of
JIS keyboards").
According to the following documentations, the definitions in
ui/keycodemapdb/keymaps.csv, which ui/input-keymap.c uses, are correct:
https://developer.apple.com/documentation/uikit/uikeyboardhidusage/uikeyboardhidusagekeyboardlang1?language=objc
https://developer.apple.com/documentation/uikit/uikeyboardhidusage/uikeyboardhidusagekeyboardlang2?language=objc
https://docs.microsoft.com/en-us/windows-hardware/design/component-guidelines/keyboard-japan-ime
Use qemu_input_map_osx_to_linux to eliminate the redundancy and
incorrect mappings.
Fixes: 708b72557ff5 ("ui/cocoa: Support unique keys of JIS keyboards") Signed-off-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp> Reviewed-by: Philippe Mathieu-Daudé <philmd@mailo.com>
Message-ID: <20260604-osx-v3-1-453b4ee0e072@rsg.ci.i.u-tokyo.ac.jp> Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Bin Guo [Sat, 30 May 2026 06:28:16 +0000 (14:28 +0800)]
util/cutils: drop qemu_strnlen() in favor of strnlen()
There are only three call sites, and strnlen() is available on all
supported platforms (POSIX.1-2008, Windows via UCRT, MinGW). Remove
the hand-rolled wrapper and use the standard function directly.
While here, align bsd-user/uaccess.c to use size_t for max_len/len,
matching linux-user/uaccess.c and eliminating a signed/unsigned mismatch.
Also remove the stale qemu_strnlen() entry from docs/devel/style.rst.
Suggested-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Bin Guo <guobin@linux.alibaba.com> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Warner Losh <imp@bsdimp.com>
Message-ID: <20260530062816.59206-1-guobin@linux.alibaba.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Matt Jacobson [Mon, 15 Jun 2026 04:55:47 +0000 (00:55 -0400)]
configure: honor --extra-ldflags when forced to use objc_LINKER
3220b38a8d had the side effect of making the individual target link steps
use objc_LINKER on macOS, because `coreaudio.m` became visible to Meson as
a source file. (The preexisting presence of `cocoa.m` is masked by the
fact that it gets built into libsystem and then extracted back out as an
object file.)
`configure` correctly passes `$EXTRA_LDFLAGS` to the "C linker" and "C++
linker", but it neglected to do so for the "Objective-C linker". Fix that.
Signed-off-by: Matt Jacobson <mhjacobson@me.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Message-ID: <20260615045547.23422-1-mhjacobson@me.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Move the two TCG-specific IOMMU method declarations from the
generic "exec/cpu-common.h" header to "accel/tcg/iommu.h".
Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20260616153633.93267-1-philmd@oss.qualcomm.com>
target/sparc: Include missing 'accel/tcg/cpu-ops.h' header in cpu.c
target/sparc/cpu.c implement a TCGCPUOps structure, which is
defined in "accel/tcg/cpu-ops.h":
1040 static const TCGCPUOps sparc_tcg_ops = {
...
While this header is currently included indirectly, make the
inclusion explicit to avoid issue when refactoring unrelated
headers.
Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20260617160426.64461-2-philmd@oss.qualcomm.com>
"accel/accel-cpu-target.h" is to register accelerator target
specific hooks via TypeInfo::ACCEL_CPU_NAME(), which LoongArch
TCG frontend does not. Remove as unused header.
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
Message-Id: <20260529194940.97143-2-philmd@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
TCGTBCPUState is a structure used during TCG translation,
therefore not needed when TCG is not available.
Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20260616153432.92939-4-philmd@oss.qualcomm.com>
Avoid including TCG-specific headers in non-TCG builds.
Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20260617171438.75914-2-philmd@oss.qualcomm.com>
Armv8-M Protected Memory System Architecture can only be emulated,
therefore restrict it to TCG to avoid compiling it on hardware
accelerators.
Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-Id: <20260616153432.92939-3-philmd@oss.qualcomm.com>
target/arm: Remove vcpu_dirty=true assigments in hvf_handle_exception()
Commit 2a425aae0b5 ("target/arm: ensure PSCI register updates
are flushed") manually sets %vcpu_dirty in hvf_handle_exception(),
but these calls follow calls to cpu_synchronize_state() which
itself sets %vcpu_dirty. Better have the generic CPU API handle
this, but add a pair of assertions when serializing the accelerator
state to be safe.
Suggested-by: Alex Bennée <alex.bennee@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260423170229.64655-13-philmd@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Commit 34c45d53026 ("target-arm: kvm - re-inject guest debug
exceptions") removed CPU_INTERRUPT_EXITTB from KVM, but it
also appears on HVF. Better to restrict it to TCG.
Suggested-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
Message-Id: <20250630130937.3487-2-philmd@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
HVF should be able to handle task priority register accesses.
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Message-Id: <20250616090632.55214-1-philmd@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
tcg: Include missing 'qemu/bitops.h' header in tcg-gvec-desc.h
Include the missing 'qemu/bitops.h' header to avoid when refactoring
unrelated headers:
In file included from target/arm/internals.h:34:
include/tcg/tcg-gvec-desc.h:48:12: error: call to undeclared function 'extract32'
48 | return extract32(desc, SIMD_MAXSZ_SHIFT, SIMD_MAXSZ_BITS) * 8 + 8;
| ^
Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20260616153432.92939-2-philmd@oss.qualcomm.com>
We mandate a compiler supporting C11 since 2021-06-15 in
commit d22797ce36a ("configure: Use -std=gnu11"), thus the
max_align_t type definition exists. Remove what is now dead
code.
Note, C11 provides aligned_alloc(). Using it is left as a
future cleanup step.
Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20260615091308.4458-3-philmd@oss.qualcomm.com>
We mandate a compiler supporting C99 since 2019-01-17 in
commit 7be41675f7c ("configure: Force the C standard to gnu99"),
thus supporting flexible array members [*]. Remove what is now
dead code.
[*] https://www.gnu.org/software/c-intro-and-ref/manual/html_node/Flexible-Array-Fields.html Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20260615091308.4458-2-philmd@oss.qualcomm.com>
Rename them removing the 'cpu_' prefix, and move then to the
"system/physmem.h" header with the other methods involved in
global physical address space.
Mechanical change using sed, then adding missing headers manually.
No logical change intended.
Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20260616020839.19104-7-philmd@oss.qualcomm.com>
cpu_physical_memory_read() and cpu_physical_memory_write() are
legacy (see commit b7ecba0f6f6), replace by address_space_read()
and address_space_write() respectively, accessing the per-vCPU
address space instead of the global &address_space_memory one.
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Jared Rossi <jrossi@linux.ibm.com>
Message-Id: <20260616020839.19104-6-philmd@oss.qualcomm.com>
target/s390x: Factor common s390_ipl_read/write() helpers
Prevent duplication factoring common helpers.
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Jared Rossi <jrossi@linux.ibm.com>
Message-Id: <20260616020839.19104-5-philmd@oss.qualcomm.com>
cpu_physical_memory_read() and cpu_physical_memory_write() are
legacy (see commit b7ecba0f6f6), replace the two calls by a single
one to address_space_rw(). So far there is no logical change, but
stop ignoring these functions returned value and propagate it,
respecting the *memory_rw_debug() family error path. Thus this is
effectively a logical change.
Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20260616020839.19104-4-philmd@oss.qualcomm.com>
cpu_physical_memory_write() is legacy (see commit b7ecba0f6f6),
replace it by address_space_write(). Both if() ladders only
differ in the address space argument: rework to have a single
address_space_write() call. No logical change intended.
Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20260616020839.19104-3-philmd@oss.qualcomm.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20260616020839.19104-2-philmd@oss.qualcomm.com>
system/cpu: Reset vCPU %exception_index before resuming it
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20260423170229.64655-8-philmd@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Ryan Zhang [Fri, 15 May 2026 11:21:55 +0000 (19:21 +0800)]
ui/sdl2: Set GL ES profile before creating initial GL context
When the user selects GLES via '-display sdl,gl=es', we need to set
SDL_GL_CONTEXT_PROFILE_MASK to SDL_GL_CONTEXT_PROFILE_ES before
calling SDL_GL_CreateContext(). This ensures SDL_GL_LoadLibrary()
loads the correct GLES driver instead of the desktop OpenGL driver.
Fix the below issue: qemu-system-aarch64: /usr/src/debug/libepoxy
/1.5.10/src/dispatch_common.c:872: epoxy_get_proc_address: Assertion
`0 && "Couldn't find current GLX or EGL context.\n"' failed.
sdl2_gl_create_context() already sets the profile mask correctly for
ES mode, but the initial context created in sdl2_window_create() is
missing the same treatment.
Akihiko Odaki [Thu, 11 Jun 2026 11:58:03 +0000 (20:58 +0900)]
ui/sdl2: Explicitly specify EGL platform
Mesa's eglGetDisplay() chooses the native EGL platform from
EGL_PLATFORM, limited autodetection, or the build-time default. If that
selects Wayland while SDL is using the X11 video backend, Mesa can treat
the X11 Display pointer as a wl_display and crash during eglInitialize().
Probe EGL with the X11 platform explicitly before enabling
SDL_HINT_VIDEO_X11_FORCE_EGL.
ui/pixman: fix zero rowstride in qemu_pixman_image_new_shareable()
qemu_create_displaysurface_from() callers such as xlnx_dp.c pass
linesize=0 with data=NULL, relying on pixman to compute the stride.
Since 1ff788db978 ("ui: use a shareable type"), the data=NULL path
goes through qemu_pixman_image_new_shareable() which computes
size = height * rowstride_bytes, resulting in a zero-size allocation
and an abort in qemu_memfd_alloc().
Introduce qemu-pixman-helpers.h with overflow-safe stride and buffer
size computation (matching pixman's create_bits() formula), and use it
from both qemu_pixman_image_new_shareable() and pixman-minimal's
create_bits().
Reported-by: Peter Maydell <peter.maydell@linaro.org> Fixes: 1ff788db9781 ("ui: use a shareable type") Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-ID: <20260611113614.1935094-1-marcandre.lureau@redhat.com>
ui/vnc: switch LED handling to Notifier-based input API
Replace QEMUPutLEDEntry with an embedded Notifier in VncDisplay.
Use qemu_input_led_notifier_add/remove instead of the old
qemu_add/remove_led_event_handler.
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
ui/input: add LED state tracking to QemuInputHandlerState
Add per-handler LED state and a NotifierList for UI backends to
subscribe to LED changes.
Devices call qemu_input_handler_set_led() to store their LED state and
notify backends. Notify also on focus change, or list update.
Note: I considered conflating mouse-mode & led-state changes, but those
are quite different events (from different source kinds etc) and we may
want to improve the internal implementation.
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
ui: move LED and key utilities to input.c, delete input-legacy.c
With both legacy mouse API consumers converted, the remaining
code in input-legacy.c (LED broadcast, index_from_key, qmp_send_key)
is not legacy-specific. Move it to ui/input.c and delete the file.
Clean up include/ui/console.h by removing the now-unused legacy
mouse API declarations (QEMUPutMouseEvent, QEMUPutMouseEntry,
QEMUPutKBDEvent, QEMUPutKbdEntry) and MOUSE_EVENT_* constants.
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
projects / thirdparty / qemu.git / log
