hw/usb/dev-wacom: convert to modern QemuInputHandler API
Replace the legacy QEMUPutMouseEvent callbacks with a proper
QemuInputHandler registration. The device now receives typed
input events (BTN/ABS/REL) directly.
Replace the legacy QEMUPutMouseEvent callback with a proper
QemuInputHandler registration. This eliminates one of the two
remaining users of the legacy input adapter in ui/input-legacy.c.
Right & middle buttons are inverted (see hmp_mouse_button)
Acked-by: Dr. David Alan Gilbert <dave@treblig.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
hw/9pfs: consolidate name validation with check_name()
Add a new, shared helper function check_name() that consolidates the name
validation logic (illegal name check and "." / ".." rejection) currently
spread over multiple 9p handlers, unnecessarily duplicating code.
This is pure refactoring with no behavior change. The existing error code
semantics are preserved: rename operations return -EISDIR, create
operations return -EEXIST.
Note: These current error codes actually differ from native Linux system
calls (e.g. rename() returns -EBUSY, open(O_CREAT) returns -EISDIR). The 9P
protocol does not mandate specific error codes for these validation errors.
Hence consolidating to a single error code (e.g., -EINVAL) for all cases
could be considered in the future for simplicity reason.
This change reduces code duplication across 9 functions:
The other Trename and Trenameat handlers already reject "." and ".."
as new name on rename requests by returning -EISDIR in this case.
The legacy Twstat rename handler is missing this validation. While passing
"." or ".." does not trigger a crash as fixed by the previous patch (since
the fs backend driver's system calls handle these gracefully), it creates
a behavioral inconsistency, as it is semantically meaningless to rename a
file to a directory reference in the first place.
Fix this by rejecting "." and ".." in Twstat rename handler with -EISDIR
to match behavior of Trename and Trenameat handlers.
hw/9pfs: fix abort due to illegal name with Twstat rename
The legacy Twstat 9p request can be used to rename files and directories.
Unlike the other, more recent rename requests like Trename and Trenameat,
Twstat does not validate the submitted new name before passing it to
v9fs_complete_rename().
A priviliged guest user with direct communication access to 9p server
could pass a string containing '/' as new name, which causes an assertion
fault (DoS) in local_name_to_path().
Fix this by rejecting such strings by checking the client supplied new
name with name_is_illegal(), similar to how Trename and Trenameat handlers
do already.
* tag 'firmware-20260617-pull-request' of https://gitlab.com/kraxel/qemu:
igvm: fix handling of optional variable header types
igvm: replace raw uint32_t with igvm library types
hw/uefi: fix parse_hexstr
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Stefan Hajnoczi [Wed, 17 Jun 2026 14:17:03 +0000 (10:17 -0400)]
Merge tag 'pull-target-arm-20260616' of https://gitlab.com/pm215/qemu into staging
target-arm queue:
* Implementation of various insns preparatory to FEAT_SVE2p2
* hw/arm/smmuv3: Make smmuv3 ATS, RIL, SSIDSIZE, and OAS 'auto' properties work
* hw/pci/pci: Enforce pci_setup_iommu_per_bus() is called only once per bus
* hw/arm/virt: Introduce Tegra241 CMDQV support for accelerated SMMUv3
* target/arm: honour CCR.BFHFNMIGN for probed data BusFaults
* hw/arm/bcm2838: Route I2C interrupts to GIC
Stefan Hajnoczi [Wed, 17 Jun 2026 14:16:23 +0000 (10:16 -0400)]
Merge tag 'pbouvier/pr/plugins-20260616' of https://gitlab.com/p-b-o/qemu into staging
Changes:
- [PATCH v2 00/26] plugins: refactor API to maintain state through (Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>) Link: https://lore.kernel.org/qemu-devel/20260615193526.2883349-1-pierrick.bouvier@oss.qualcomm.com
# -----BEGIN PGP SIGNATURE-----
#
# iQHWBAABCgBAFiEEN8FWlNi6l2Sxlz/btEQ30ZwoYt8FAmoxmRAiHHBpZXJyaWNr
# LmJvdXZpZXJAb3NzLnF1YWxjb21tLmNvbQAKCRC0RDfRnChi3ztKC/45bQ+YlttE
# d2Zdt/N57raaZ8cumzTfpsmnN3Yd+ilIzJizW2OUgdrKrsXsZ73nEwsy9oV2XAGN
# XEaXBlVmLrIXnWRcVYyeKeTr0pJpjhglbLMwXHotgCpCZn77wOkIhTsJlEL83G0/
# F0Vt0o1FbvOepwZXr0jCU9JT/kewT0BptXClfQpyJcGeggj6x/rUsk32Lj7c5kZH
# 6T64T5tJZ5hxndJ/MQCHbsPkUksZT2WD44EYNb3QpVIvPBeoD/02WBfqC+U0fXQ3
# +O/JSfNacgjLWskaPiykft8t9GsRX3DgR5IJJ/WG4y3h9rxpbQKVdn5aKhmNavYK
# QplhS47OashPPbRWBYmKPipQO30sga5dPBt43mU0y1OfKBJR240r5CnFDNtU+XPM
# fwrcdmogleAKAU5rMqvP7fp2usBX0VAzTwtHF6PtswYX46uon/qIQ7E4VYh8mOeV
# DULhi38wKXUKHDwv00pXOvk2n6SOUdoro6XYaJoyArSK+vVFptV6nd4=
# =gcF/
# -----END PGP SIGNATURE-----
# gpg: Signature made Tue 16 Jun 2026 14:42:24 EDT
# gpg: using RSA key 37C15694D8BA9764B1973FDBB44437D19C2862DF
# gpg: issuer "pierrick.bouvier@oss.qualcomm.com"
# gpg: Good signature from "Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>" [unknown]
# gpg: WARNING: The key's User ID is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 37C1 5694 D8BA 9764 B197 3FDB B444 37D1 9C28 62DF
* tag 'pbouvier/pr/plugins-20260616' of https://gitlab.com/p-b-o/qemu: (26 commits)
plugins/cpp: register callbacks using captureless lambda
scripts/checkpatch: remove check on forbidden space before '[' in C++
scripts/checkpatch: ignore spaces required around some operators in C++
plugins: use consistent parameter documentation for userdata
plugins: add userdata to qemu_plugin_register_vcpu_syscall_ret_cb
plugins: remove qemu_plugin_id from qemu_plugin_vcpu_syscall_ret_cb_t
plugins: add userdata to qemu_plugin_register_vcpu_syscall_filter_cb
plugins: remove qemu_plugin_id from qemu_plugin_vcpu_syscall_filter_cb_t
plugins: add userdata to qemu_plugin_register_vcpu_syscall_cb
plugins: remove qemu_plugin_id from qemu_plugin_vcpu_syscall_cb_t
plugins: add userdata to qemu_plugin_vcpu_tb_trans_cb_t
plugins: remove qemu_plugin_id from qemu_plugin_vcpu_tb_trans_cb_t
plugins: remove qemu_plugin_id from qemu_plugin_vcpu_discon_cb_t
plugins: add userdata to qemu_plugin_register_vcpu_discon_cb
plugins: remove type qemu_plugin_vcpu_simple_cb_t
plugins: add userdata to qemu_plugin_vcpu_for_each
plugins: add userdata to qemu_plugin_register_vcpu_resume_cb
plugins: add userdata to qemu_plugin_register_vcpu_idle_cb
plugins: add userdata to qemu_plugin_register_vcpu_exit_cb
plugins: add userdata to qemu_plugin_register_vcpu_init_cb
...
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
qga_libs are libraries for guest agent linking. Guest Agent
is a pure C-language application and doesn't need any C++ libs.
VSS linking dependencies are placed in a separate file.
snwprintf is a Microsoft extension, and according to the MSVC spec,
it is called _snwprintf. MinGW defines both snwprintf and _snwprintf,
while MSVC defines only _snwprintf.
We can also use swprintf here. The only difference between
the two is the return value, and we are not using it. So change
the function to support MSVC build env.
Damien Zammit [Sun, 8 Feb 2026 05:59:45 +0000 (05:59 +0000)]
Make copy_file_range non-static on GNU/Hurd
glibc has a stubs mechanism: a function can be declared in the
system headers, but only implemented as a stub that always fails with
ENOSYS, for example. Therefore when implementing this function
we cannot use static.
Damien Zammit [Sun, 8 Feb 2026 05:59:32 +0000 (05:59 +0000)]
tpm: Add conditional to not compile ioctls on GNU/Hurd
The Hurd currently doesn't have any TPM driver, compilation fails
for missing _IOT__IOTBASE_* symbols unless these are left undefined.
Signed-off-by: Damien Zammit <damien@zamaudio.com> Signed-off-by: Manolo de Medici <manolo.demedici@gmail.com> Reviewed-by: Stefan Berger <stefanb@linux.ibm.com> Link: https://lore.kernel.org/r/20260208055858.2166524-4-damien@zamaudio.com Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Include new arbitrary limits if not already defined
Although GNU/Hurd supports unlimited path lengths
only bounded by available memory, for now we can use
an arbitrary limit on PATH_MAX that matches what POSIX requires.
We don't have bandwidth to fix this properly right now.
Paolo Bonzini [Thu, 28 May 2026 15:02:52 +0000 (17:02 +0200)]
target/i386: apply mod to immediate count of an RCL/RCR operation
RCR and RCL instructions with a count of 9 are the same as if the
count was 0, but they generated incorrect code because the can_be_zero
flag is false. This causes 0 to underflow into -1 at
tcg_gen_subi_tl(count, count, 1).
Fix by absorbing the modulo computation into gen_shift_count(), now
renamed gen_shift_count_1(), so that it can handle both reductions.
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3452 Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Luigi Leonardi [Tue, 9 Jun 2026 12:29:04 +0000 (14:29 +0200)]
igvm: fix handling of optional variable header types
The IGVM spec defines bit 31 of the variable header type as an
optional flag: if set, a loader that does not recognize the header
type may safely skip it. If clear, the loader must reject the file.
Currently, the optional bit is not stripped before comparing header
types, so headers with the bit set fail to match any known type
and are rejected.
Mask bit 31 before comparing header types throughout the IGVM
loader, and skip with a warning any unrecognized header that has
the optional bit set.
Fixes: c1d466d267cf ("backends/igvm: Add IGVM loader and configuration") Signed-off-by: Luigi Leonardi <leonardi@redhat.com>
Message-ID: <20260609-igvm_optional-v2-2-b1f1f08dc40e@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Luigi Leonardi [Tue, 9 Jun 2026 12:29:03 +0000 (14:29 +0200)]
igvm: replace raw uint32_t with igvm library types
Use IgvmVariableHeaderType and IgvmHeaderSection in QIGVMHandler and
qigvm_handler() instead of plain uint32_t, so that each field's purpose
is clear from its type.
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com> Reviewed-by: Ani Sinha <anisinha@redhat.com> Signed-off-by: Luigi Leonardi <leonardi@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Message-ID: <20260609-igvm_optional-v2-1-b1f1f08dc40e@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Gerd Hoffmann [Tue, 26 May 2026 13:59:48 +0000 (15:59 +0200)]
hw/uefi: fix parse_hexstr
Make sure we actually have two input characters available before going
to parse two hex digits. Fixes one byte buffer overflow of the output
buffer in case the input string has an odd number of characters.
Pierrick Bouvier [Mon, 15 Jun 2026 19:35:25 +0000 (12:35 -0700)]
plugins/cpp: register callbacks using captureless lambda
We can now demonstrate what previous changes allow us to do. Since all
callbacks have a userdata pointer, we can use that mechanism to move an
object through all of them.
In other words, we can now have stateful plugins without resorting to
any global variable.
As an example, we implement tb counting plugin with our cpp plugin. It
produces an output similar to hotblocks, with same performance.
Pierrick Bouvier [Mon, 15 Jun 2026 19:35:23 +0000 (12:35 -0700)]
scripts/checkpatch: ignore spaces required around some operators in C++
C++ has a different style when it comes to space around references,
dereferences, so don't report it.
Also, closing templates with >> gets wrongly confused with >> operator,
so just relax this check.
Some examples:
ERROR: spaces required around that '&' (ctx:WxV)
+ auto &[counter, p] = *static_cast<TbData*>(udata);
^
ERROR: spaces required around that '*' (ctx:VxO)
+ auto &[counter, p] = *static_cast<TbData*>(udata);
^
ERROR: spaces required around that '>>' (ctx:VxW)
+ std::vector<std::pair<Vaddr, uint64_t>> v; ^
Pierrick Bouvier [Mon, 15 Jun 2026 19:35:05 +0000 (12:35 -0700)]
plugins: remove qemu_plugin_id_t from qemu_plugin_vcpu_simple_cb_t
Not used in all our plugins.
Future commits will remove qemu_plugin_vcpu_simple_cb_t completely, and
replace it with qemu_plugin_vcpu_udata_cb_t, so id information can be
passed using userdata if needed.
target/arm: Implement floating-point log and convert to integer (zeroing)
This is FLOGB, FCVTZS, FCVTZU.
Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20260604234852.573178-19-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
target/arm: Implement SVE floating-point convert (top, predicated, zeroing)
This includes FCVTXNT, BFCVTNT, FCVTNT, FCVTLT.
Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20260604234852.573178-18-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
target/arm: Enable zeroing in DO_FCVT{N, L}T macros in sve_helper.c
Use the low bit of simd_data to hold a 'zeroing' bit.
The simd_data field is currently unused and always 0.
Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20260604234852.573178-17-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20260604234852.573178-16-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20260604234852.573178-15-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20260604234852.573178-14-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20260604234852.573178-13-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
target/arm: Implement Floating-point round to integral value (predicated, zeroing)
This is the various FRINT rounding modes.
Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20260604234852.573178-12-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20260604234852.573178-11-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20260604234852.573178-10-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
target/arm: Implement SVE reverse doublewords (zeroing)
Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20260604234852.573178-9-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
target/arm: Implement SVE reverse within elements (zeroing)
This includes REVB, REVH, REVW, RBIT.
Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20260604234852.573178-8-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
target/arm: Implement SVE bitwise unary operations (predicated, zeroing)
This includes CLS, CLZ, CNT, CNOT, NOT, FABS, FNEG.
Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20260604234852.573178-7-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
target/arm: Implement SVE integer unary operations (predicated, zeroing)
This includes ABS, NEG, SXT{B,H,W}.
Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20260604234852.573178-6-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Prepare for adding zeroing instructions for some of these.
Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20260604234852.573178-5-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
target/arm: Enable zeroing in DO_ZPZ macros in sve_helper.c
Use the low bit of simd_data to hold a 'zeroing' bit.
The simd_data field is currently unused and always 0.
Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20260604234852.573178-4-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Add an "_m" suffix to indicate merging, in preparation for
adding new predicated zeroing instructions.
Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20260604234852.573178-3-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
target/arm: Add feature predicates for SVE2.2 and SME2.2
Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20260604234852.573178-2-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Stefan Hajnoczi [Tue, 16 Jun 2026 14:41:47 +0000 (10:41 -0400)]
Merge tag 'pull-riscv-to-apply-20260616' of https://github.com/alistair23/qemu into staging
RISC-V PR for 11.1
* Disable svpbmt if satp_mode is less then sv39
* Fix PMP address alignment
* Mstatus write bug fixes
* Add 'cbo' insns to disassembler
* Do not hide Sstc CSRs from gdbstub
* Reject Svinval instructions in U-mode
* Save opcode before zicbo helpers
* Fault with reserved PTE.PBMT val
* Allow LOAD_ADDR_MIS promotion to AMO fault
* Make riscv cpu.h target independent
* Add PMA access fault
* Disable svnapot if satp_mode is less then sv39
* Fix disassembler inst_length calculation
* Add RISC-V big-endian target support
* Add the implied rules for G and B extensions
* Print privilege level and ELP in riscv_cpu_dump_state
* Improve alignment in riscv_cpu_dump_state
* Mask vxrm csrw write to the low 2 bits
* Reorder Smrnmi CPU fields above CPU reset line
* Supplement cpu topology arguments
* Don't insert DDT cache in Bare mode
* Fix 'iommu-map' FDT entry
* Fix mstatus.FS dirty tracking for FP exception-raising instructions
* Enable `mnret` disassembly
* Add support for K230 board
* FDT creation helpers
# -----BEGIN PGP SIGNATURE-----
#
# iQIzBAABCgAdFiEEaukCtqfKh31tZZKWr3yVEwxTgBMFAmoxH8EACgkQr3yVEwxT
# gBOA0A/9EoqSh73fuWzBwOANN7sXBDRJwOzCetvoTqyXzbUtQJGPbslldLDoYA0K
# GfqdmFNqi6pp01pBm/eWUu2vxid1d1IID+4g7LQ1TIyexbc58Qm7Hb1r+F1RSLj4
# NcZc+RGvJ+3D/hXUfj1dnT+yxUDsVAuf1NPONR9E9CD4q8gkvtA79Lwj3o/2Ks18
# 02ZPi8+vc5XmSjtwGVFdcxu4je89vvhzl4P+zwZMKOOU04bpsCG5chSRfSiGUnuz
# jae/5YDOk4v6T61Yt3kDFc9CkuenhiDSHMiQy/PD/ufvBOlA3EzyIago3SO0DP9d
# ZW+aVHOJ7SgcUPFbj6kkLo/FhXraXmKVo4vDhASoKHydoL1s6ZAR7TCAwLXa39Rq
# z15OGtRzdQX48AkeUjeN+Mz6lxHusm4MmsBhMAnPxzhiGRjOH024SR2C9iSeuB4h
# mMmYi25z48NLK5oilEhPAy37xUYUuRa+HoO07puQdLLReiuMyIWAwubhwMsog3MR
# IULX57BlxrxqVSt3z7sLGAwBEz353ARYNSiDYR+2XXt8Qjy6kY7ONrSfeJMhjbH7
# wrYQ0+30Af+b7Lpm8kpapeEsn1KWYIJU//ji5tbgAmd0sSLCiAqZX6GwzFKoGUKO
# u9Gc+A7vISxD5bBw33Z0Pp/zL1QUBom/pdZUHhaAGtKIuwLSA8s=
# =iXpr
# -----END PGP SIGNATURE-----
# gpg: Signature made Tue 16 Jun 2026 06:04:49 EDT
# gpg: using RSA key 6AE902B6A7CA877D6D659296AF7C95130C538013
# gpg: Good signature from "Alistair Francis <alistair@alistair23.me>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 6AE9 02B6 A7CA 877D 6D65 9296 AF7C 9513 0C53 8013
* tag 'pull-riscv-to-apply-20260616' of https://github.com/alistair23/qemu: (83 commits)
hw/riscv: add create_fdt_socket_cpu_sifive()
hw/riscv/fdt_common.c: create create_fdt_socket_cpu_internal()
hw/riscv/spike.c: use create_fdt_socket_cpus()
hw/riscv: add create_fdt_socket_cpus()
hw/riscv: add fdt_create_cpu_socket_subnode() helper
hw/riscv/sifive_u.c: add cpu-map, cluster and core DTs
hw/riscv: add create_fdt_clint() helper
hw/riscv/spike.c: add intc_phandles array
hw/riscv/sifive_u.c: add intc_phandles array
hw/riscv: add create_fdt_socket_memory() helper
hw/riscv/numa: make numa_enabled() public
hw/riscv: add fdt-common helper
hw/riscv/sifive_u.c: add a FDT phandle to cpu-intc
docs/system/riscv: add documentation for k230 machine
tests/qtest: add test for K230 watchdog
hw/watchdog: add k230 watchdog initial support
hw/riscv: add k230 board initial support
target/riscv: add thead-c908 cpu support
disas/riscv: enable `mnret` disassembly
target/riscv: rvv: Set mstatus.FS dirty when vector FP raises exceptions
...
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
John Snow [Thu, 11 Jun 2026 04:23:32 +0000 (00:23 -0400)]
qapi: add doc comment "Intro" section parsing
Add parsing for explicit Intro section syntax.
A side effect of this patch is that we will (currently) always create
an empty Intro section, similar to how we used to have an empty Plain
section. The tests are adjusted accordingly, rendered document output
does not change at all.
Signed-off-by: John Snow <jsnow@redhat.com>
Message-ID: <20260611042332.482979-14-jsnow@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com>
[Commit message tweaked] Signed-off-by: Markus Armbruster <armbru@redhat.com>
John Snow [Thu, 11 Jun 2026 04:23:31 +0000 (00:23 -0400)]
qapi/qapidoc: add rendering for INTRO sections
Amend the qapidoc generator to handle and render INTRO sections.
The only real difference here from other sections is that we need to
dedent the text so it renders correctly. Members and Features are also
indented, but do not require a dedent() because they are always used
in tandem with an rST construct that forms the start of a new indented
block; there is coincidental harmony.
Plaintext sections, however, do not start their own block and thus
need to be dedented to prevent accidentally rendering them as a
blockquote or a syntax error.
This dedent transformation on the text does not reflow the text, so
source line information remains accurate, and the "blame" chain of
custody for sphinx rST parsing error messages continues to be correct
even through this transformation.
Signed-off-by: John Snow <jsnow@redhat.com>
Message-ID: <20260611042332.482979-13-jsnow@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com>
[Commit message tweaked] Signed-off-by: Markus Armbruster <armbru@redhat.com>
John Snow [Thu, 11 Jun 2026 04:23:30 +0000 (00:23 -0400)]
qapi: remove implicit doc comment Plain section
Prior to this patch, we always create an empty Plain section. Removing
this allows us to gradually phase out the "Plain" section in favor of
"Intro" and "Details" sections while keeping "Plain" around for the
interim churn during the series - meaning that we don't actually know
at __init__ time which type of section we'll have first.
Signed-off-by: John Snow <jsnow@redhat.com>
Message-ID: <20260611042332.482979-12-jsnow@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com>
[Commit message tweaked] Signed-off-by: Markus Armbruster <armbru@redhat.com>
John Snow [Thu, 11 Jun 2026 04:23:29 +0000 (00:23 -0400)]
qapi: adjust doc comment stub member insertion algorithm
A forthcoming patch removes the implicit PLAIN section that always
starts a QAPIDoc section list. Further future changes begin converting
"PLAIN" sections to "INTRO" sections.
This will affect the code that inserts "Not documented" descriptions
for undocumented members ("stub sections") and the dummy section that
marks the spot for "The members of ..." references.
Adjust the algorithm to cope with not only the finished state, but
temporary intermediate states while the series is merged.
This algorithm can handle zero-or-more PLAIN *or* INTRO sections at
the beginning of a QAPIDoc object, in contrast to the previous
algorithm which assumed and relied upon there being always one PLAIN
section at the beginning of every QAPIDoc section list.
In other words: (PLAIN | INTRO)* <EverythingElse>
This does not impact what the parser itself will actually produce. As
of this patch, the parser will still always generate QAPIDoc section
lists that start with precisely one PLAIN section (whether or not it
is empty), followed by the remaining sections. Those remaining
sections may or may not include additional PLAIN sections, but never
two such sections contiguously as the parser will always treat that
layout as one PLAIN section consisting of multiple paragraph(s).
In other other words: This insertion algorithm is more lenient than
the parser, but this is on purpose for flexibility mid-stream as we
convert QAPI to using explicit introductory sections. The allowed
order of sections will eventually become strictly enforced in the
parser, which will in turn allow dramatic simplifications to the
insertion algorithm. This only exists as transitory code until we are
able to enforce that order.
Fear not: the intermediate ReST output before and after this patch
are byte identical, so failing all else, we at least know it doesn't
make anything worse.
Lastly, because we have three places in the code that need to insert
stub/dummy sections, we take the opportunity to consolidate this code
to handle all three cases with one function. This winds up
necessitating the qapidoc.py generator actually modify the section
list to insert a "dummy" member that acts as a placeholder for "The
members of ..." text. While it looks like a code smell to modify the
caller's argument, it is ultimately safe because the QAPI Schema
object is re-parsed and re-constructed in memory for each individual
process that needs to operate on it. In other words, the Sphinx
document generator already does have "its own copy" of the section
lists, so it is "safe" to modify here without regards to other
consumers of the QAPIDoc objects. It only *looks* like it smells
bad. Ultimately, this code will also be removed once the inliner is
merged, so it is only a temporary aesthetic issue regardless.
That's my story and I'm sticking to it.
Signed-off-by: John Snow <jsnow@redhat.com>
Message-ID: <20260611042332.482979-11-jsnow@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com>
[Commit message tweaked] Signed-off-by: Markus Armbruster <armbru@redhat.com>
John Snow [Thu, 11 Jun 2026 04:23:28 +0000 (00:23 -0400)]
qapi/parser: add mea culpa comment for ensure_returns
These algorithms are quite a mess currently, but they are temporary
until we add the inliner which will address these issues more
holistically. For now, add the "mea culpa".
Signed-off-by: John Snow <jsnow@redhat.com>
Message-ID: <20260611042332.482979-10-jsnow@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com>
John Snow [Thu, 11 Jun 2026 04:23:27 +0000 (00:23 -0400)]
qapi/parser: move _insert_near_kind() method
Move this function out from underneath `ensure_returns` and make it
available for general purpose use as an object method instead. This is
purely a scope-level patch with no functional changes.
Signed-off-by: John Snow <jsnow@redhat.com>
Message-ID: <20260611042332.482979-9-jsnow@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com>
John Snow [Thu, 11 Jun 2026 04:23:26 +0000 (00:23 -0400)]
qapi: new doc comment "Intro" section
This patch adds an "Intro" doc section, intended to eventually replace
the "Plain" doc section alongside a forthcoming "Details" section.
For now, this section is not actually instantiated or used, but
subsequent patches will slowly convert the leading introductory sections
of QAPIDoc documentation to use this new section.
A main motivation of this series of changes is to more explicitly
delineate the "Introductory" documentation for each QAPI definition for
the sake of the inliner. When inlining members, examples, and details
from multiple QAPIDoc sections, we will want to omit the "Introductory"
text from inlined definitions while keeping notes, caution boxes,
examples, and so on. This new section facilitates that.
Signed-off-by: John Snow <jsnow@redhat.com>
Message-ID: <20260611042332.482979-8-jsnow@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com>
[Commit message tweaked] Signed-off-by: Markus Armbruster <armbru@redhat.com>
John Snow [Thu, 11 Jun 2026 04:23:24 +0000 (00:23 -0400)]
qapi/parser: make remaining subsection members "private"
These fields are used to provide error checking and internal logistics
and should not be used by a user of the library to directly access
documentation sections, so make them private.
The "since" field alone is left public, as the qapidoc generator does
use this field to pull that section out of the regular flow of the
document.
Signed-off-by: John Snow <jsnow@redhat.com>
Message-ID: <20260611042332.482979-6-jsnow@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com>
[Commit message tweaked] Signed-off-by: Markus Armbruster <armbru@redhat.com>
John Snow [Thu, 11 Jun 2026 04:23:22 +0000 (00:23 -0400)]
qapi/parser: remove unused QAPIDoc subsection members
All users of the QAPIDoc object should be iterating over all_sections
and not grabbing arbitrary subsections, if possible. Remove the 'body'
and 'sections' members, as they are no longer used.
Signed-off-by: John Snow <jsnow@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20260611042332.482979-4-jsnow@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com>
[Commit message tweaked] Signed-off-by: Markus Armbruster <armbru@redhat.com>
Nicholas Righi [Tue, 9 Jun 2026 02:40:27 +0000 (19:40 -0700)]
hw/arm/bcm2838: Route I2C interrupts to GIC
The I2C interrupts are only routed to the legacy interrupt controller. This means
that for modern device trees that use the GIC, the interrupts don't work. This patch
adds a splitter to route the I2C interrupt to both the legacy interrupt controller and the GIC.
Before this change, running i2c get to read from EEPROM would result in this
i2cget -y 1 0x50
Error: Read failed
After this change, running i2c to read from EEPROM results in this
i2cget -y 1 0x50
0x00
The eeprom can now also be enabled in the device tree. Before the
eeprom driver load would fail due to the read failing
ls -l /sys/bus/i2c/devices/i2c-1/1-0050/ | grep -i eeprom
-rw------- 1 root root 4096 May 17 16:57 eeprom
Signed-off-by: Nicholas Righi <nicholasrighi@gmail.com>
Message-id: 20260609024027.22140-1-nicholasrighi@gmail.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Kyle Fox [Mon, 15 Jun 2026 00:08:35 +0000 (19:08 -0500)]
target/arm: honour CCR.BFHFNMIGN for probed data BusFaults
M-profile CCR.BFHFNMIGN lets software executing at a negative execution
priority (in HardFault/NMI, or with FAULTMASK set) suppress precise data
BusFaults caused by load/store instructions: the access completes
returning UNKNOWN data, the fault status is recorded in BFSR/BFAR, but no
BusFault exception is taken. Software uses this to probe for the presence
of a device.
QEMU stored CCR.BFHFNMIGN but never consumed it: arm_cpu_do_transaction_
failed() always raised the external abort, which arm_v7m_cpu_do_interrupt()
pended as a BusFault and then escalated to a HardFault it could not take at
priority -1, aborting the VM with "Lockup: can't escalate 3 to HardFault".
Honour the bit in arm_cpu_do_transaction_failed(): when the access is a
data access from M-profile code at negative priority with BFHFNMIGN set,
record PRECISERR/BFARVALID and BFAR and return without raising, so the
faulting instruction completes instead of re-faulting forever. Instruction
fetches are unaffected, since BFHFNMIGN applies only to data accesses.
The SG instruction's stack-word load is also an AccType_NORMAL data access
that must honour BFHFNMIGN, but QEMU performs it manually in
v7m_read_sg_stack_word() (outside the TCG TLB, so it never reaches
arm_cpu_do_transaction_failed()). Apply the same suppression there: on a
BusFault, record the status and, when BFHFNMIGN is set at negative
priority, return the UNKNOWN data instead of pending ARMV7M_EXCP_BUS. The
remaining manual EXCP_BUS sites (vector-table loads, stacking, unstacking)
are AccType_VECTABLE/STACK/UNSTACK and are not required to honour the bit,
so they are left unchanged.
This surfaced running the real NXP i.MX 95 System Manager firmware on the
emulated Cortex-M33: its SystemMemoryProbe() (set BFHFNMIGN + FAULTMASK,
do the access, test CFSR.BFARVALID) locked up the VM. With this change the
SM's debug-monitor memory-probe commands run and recover correctly.
Signed-off-by: Kyle Fox <kylefoxaustin.github@gmail.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
[PMM: minor tweak to v7m_read_sg_stack_word() code] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
hw/arm/smmuv3-accel: Enforce viommu association when CMDQV is active
When CMDQV is active, the first cold-plugged VFIO device establishes
the viommu to host SMMUv3 association, and the guest's boot-time CMDQV
configuration (VINTFs, VCMDQs) is built on top of that association.
Hot-unplugging that device would release the viommu and tear down all
CMDQV state. Hot-plugging another device behind a different host
SMMUv3+CMDQV would then re-bind the same vSMMUv3 to new host hardware,
while the guest keeps using its boot-time configuration and ends up
issuing commands to the wrong host. Block hot-unplug of the
establishing device to avoid this; retaining the binding across unplug
is non-trivial and not required by any current use case.
Also abort at machine_done if cmdqv=on is requested but no cold-plugged
VFIO device was present to initialize it.
Reviewed-by: Nicolin Chen <nicolinc@nvidia.com> Tested-by: Nicolin Chen <nicolinc@nvidia.com> Reviewed-by: Eric Auger <eric.auger@redhat.com> Signed-off-by: Shameer Kolothum <skolothumtho@nvidia.com> Tested-by: Eric Auger <eric.auger@redhat.com>
Message-id: 20260609112552.378999-30-skolothumtho@nvidia.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Nicolin Chen [Tue, 9 Jun 2026 11:25:49 +0000 (12:25 +0100)]
hw/arm/virt-acpi: Advertise Tegra241 CMDQV nodes in DSDT
Add ACPI DSDT support for Tegra241 CMDQV when the SMMUv3 instance is
created with tegra241-cmdqv.
For each accelerated SMMUv3 instance, add a Tegra241 CMDQV device
object under the DSDT \_SB namespace, with HID "NVDA200C" and a UID
that matches the Identifier of the corresponding SMMUv3 IORT node, so
the guest OS can associate the DSDT device with the right SMMU. The
_CRS covers the CMDQV MMIO aperture plus its interrupt, and _CCA
declares I/O cache coherency.
See ACPI Specification 6.5, Section 6 (Device Configuration) for
_HID/_UID/_CCA/_CRS.
Generated DSDT entry for a CMDQV instance paired with SMMUv3 Identifier=1:
...
Device (CV01)
{
Name (_HID, "NVDA200C") // _HID: Hardware ID
Name (_UID, One) // _UID: Unique ID
Name (_CCA, One) // _CCA: Cache Coherency Attribute
Name (_CRS, ResourceTemplate () // _CRS: Current Resource Settings
{
QWordMemory (ResourceProducer, PosDecode, MinFixed, MaxFixed, Cacheable, ReadWrite,
0x0000000000000000, // Granularity
0x000000000C080000, // Range Minimum
0x000000000C0CFFFF, // Range Maximum
0x0000000000000000, // Translation Offset
0x0000000000050000, // Length
,, , AddressRangeMemory, TypeStatic)
Interrupt (ResourceConsumer, Edge, ActiveHigh, Exclusive, ,, )
{
0x00000094,
}
})
}
...
Generated IORT SMMUv3 node (Identifier = 1):
Add an "identifier" property to the SMMUv3 device and use it when
building the ACPI IORT SMMUv3 node Identifier field.
This avoids relying on device enumeration order and provides a stable
per-device identifier. A subsequent patch will use the same identifier
when generating the DSDT description for Tegra241 CMDQV, ensuring that
the IORT and DSDT entries refer to the same SMMUv3 instance.
The identifier is assigned at pre-plug time, accounting for the ITS Group
node that build_iort() places before SMMUv3 nodes in the IORT table, so
that identifiers are globally unique across all IORT nodes.
No functional change: IORT blob content for bios-tables qtest is identical
to before.
Reviewed-by: Eric Auger <eric.auger@redhat.com> Reviewed-by: Nicolin Chen <nicolinc@nvidia.com> Tested-by: Nicolin Chen <nicolinc@nvidia.com> Signed-off-by: Shameer Kolothum <skolothumtho@nvidia.com> Tested-by: Eric Auger <eric.auger@redhat.com>
Message-id: 20260609112552.378999-27-skolothumtho@nvidia.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Nicolin Chen [Tue, 9 Jun 2026 11:25:46 +0000 (12:25 +0100)]
hw/arm/tegra241-cmdqv: Limit queue size based on backend page size
CMDQV HW performs DMA accesses to guest queue memory by its host
physical address set up via IOMMUFD. This requires the guest queue
to be contiguous in both guest PA and host PA space. With Tegra241
CMDQV enabled, we must only advertise a command queue size (CMDQS)
that the host can safely back with physically contiguous memory.
Allowing a queue size larger than the host page size could cause
the hardware to DMA across page boundaries, leading to faults.
Use qemu_minrampagesize() to find the smallest memory-backend page
size in use, then cap IDR1.CMDQS so the guest cannot configure a
command queue that exceeds that contiguous backing.
Note this is done at SMMUv3 init, before any guest queue GPA is
known, so the cap is conservative. Maximum queue size is 8MiB;
it is recommended to back the VM with hugepage sizes large enough
so CMDQS stays at the HW maximum. Smaller backing pages reduce
CMDQS accordingly.
Signed-off-by: Nicolin Chen <nicolinc@nvidia.com> Tested-by: Nicolin Chen <nicolinc@nvidia.com> Reviewed-by: Eric Auger <eric.auger@redhat.com> Signed-off-by: Shameer Kolothum <skolothumtho@nvidia.com> Tested-by: Eric Auger <eric.auger@redhat.com>
Message-id: 20260609112552.378999-26-skolothumtho@nvidia.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
hw/arm/smmuv3-accel: Introduce common helper for veventq read
Move the vEVENTQ read and validation logic into a common helper
smmuv3_accel_event_read_validate(). The helper performs the read(),
checks for overflow and short reads, validates the sequence number,
and updates the sequence state.
This helper can be reused for Tegra241 CMDQV vEVENTQ support in a
subsequent patch.
Error handling is slightly adjusted: instead of reporting errors
directly in the read handler, the helper now returns errors via
Error **. Sequence gaps are reported as warnings.
Reviewed-by: Nicolin Chen <nicolinc@nvidia.com> Reviewed-by: Eric Auger <eric.auger@redhat.com> Tested-by: Nicolin Chen <nicolinc@nvidia.com> Signed-off-by: Shameer Kolothum <skolothumtho@nvidia.com> Tested-by: Eric Auger <eric.auger@redhat.com>
Message-id: 20260609112552.378999-23-skolothumtho@nvidia.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
projects / thirdparty / qemu.git / log
