Caleb Schlossin [Mon, 5 Jan 2026 16:01:32 +0000 (10:01 -0600)]
hw/ppc: Add VMSTATE information for LPC model
The PNV LPC model needs snapshot/migration support. Added a VMSTATE
descriptor to save model data and an associated post_load() method.
Snapshot support added for Power8, Power9, and Power10.
Signed-off-by: Michael Kowal <kowal@linux.ibm.com> Reviewed-by: Michael Kowal <kowal@linux.ibm.com> Reviewed-by: Aditya Gupta <adityag@linux.ibm.com> Reviewed-by: Chalapathi V <chalapathi.v@linux.ibm.com> Signed-off-by: Caleb Schlossin <calebs@linux.ibm.com> Link: https://lore.kernel.org/qemu-devel/20260105160138.3242709-2-calebs@linux.ibm.com Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
Gautam Menghani [Tue, 2 Dec 2025 12:46:52 +0000 (18:16 +0530)]
target/ppc/kvm : Use macro names instead of hardcoded constants as return values
In the parse_* functions used to parse the return values of
KVM_PPC_GET_CPU_CHAR ioctl, the return values are hardcoded as numbers.
Use the macro names for better readability. No functional change
intended.
Historically it was required to ask for libatomic explicitly with
-latomic, but with GCC >= 16 apps will get linked to libatomic
whether they ask for it or not.
This invalidates QEMU's check for atomic op support for int128
which explicitly does NOT want to use the libatomic impl. As a
result with GCC >= 16, QEMU is now getting linked to libatomic
and is activating CONFIG_ATOMIC128. This in turn exposes a bug
in GCC's libatomic.a static buld which is incompatible with the
use of -static-pie leading to build failures like:
/usr/bin/ld: /usr/lib/gcc/x86_64-redhat-linux/16/libatomic.a(cas_16_.o): relocation R_X86_64_32 against hidden symbol `libat_compare_exchange_16_i1' can not be used when making a PIE object
/usr/bin/ld: failed to set dynamic section sizes: bad value
collect2: error: ld returned 1 exit status
The newly introduced -fno-link-libatomic flag can be used to
disable the new automatic linking of libatomic. Setting this in
qemu_isa_flags early on ensures that the check for CONFIG_ATOMIC128
still works correctly.
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> Acked-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260108141407.2151817-1-berrange@redhat.com>
Michael Tokarev [Fri, 9 Jan 2026 09:09:36 +0000 (12:09 +0300)]
linux-user: cleanup epoll_pwait ifdeff'ery
All linux targets these days have epoll_pwait system call
(while some miss epoll_wait, which is less generic). And
all linux targets definitely has one or another epoll_*wait*
system call - so whole code block dealing with this system
call should always be present.
Remove the now-unneeded ifdef'fery.
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260109090937.599881-2-mjt@tls.msk.ru>
Matthew Lugg [Mon, 17 Nov 2025 17:09:54 +0000 (17:09 +0000)]
tests: add tcg coverage for fixed mremap bugs
These tests cover the first two fixes in this patch series. The final
patch is not covered because the bug it fixes is not easily observable
by the guest.
Signed-off-by: Matthew Lugg <mlugg@mlugg.co.uk> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20251117170954.31451-5-mlugg@mlugg.co.uk>
Matthew Lugg [Mon, 17 Nov 2025 17:09:53 +0000 (17:09 +0000)]
linux-user: fix reserved_va page leak in do_munmap
The old logic had an off-by-one bug. For instance, assuming 4k pages on
host and guest, if 'len' is '4097' (indicating to unmap 2 pages), then
'last = start + 4096', so 'real_last = start + 4095', so ultimately
'real_len = 4096'. I do not believe this could cause any observable bugs
in guests, because `target_munmap` page-aligns the length it passes in.
However, calls to this function in `target_mremap` do not page-align the
length, so those calls could "drop" pages, leading to a part of the
reserved region becoming unmapped. At worst, a host allocation could get
mapped into that hole, then clobbered by a new guest mapping.
Signed-off-by: Matthew Lugg <mlugg@mlugg.co.uk> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20251117170954.31451-4-mlugg@mlugg.co.uk>
Matthew Lugg [Mon, 17 Nov 2025 17:09:52 +0000 (17:09 +0000)]
linux-user: fix mremap errors for invalid ranges
If an address range given to `mremap` is invalid (exceeds addressing
bounds on the guest), we were previously returning `ENOMEM`, which is
not correct. The manpage and the Linux kernel implementation both agree
that if `old_addr`/`old_size` refer to an invalid address, `EFAULT` is
returned, and if `new_addr`/`new_size` refer to an invalid address,
`EINVAL` is returned.
Signed-off-by: Matthew Lugg <mlugg@mlugg.co.uk> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20251117170954.31451-3-mlugg@mlugg.co.uk>
Matthew Lugg [Mon, 17 Nov 2025 17:09:51 +0000 (17:09 +0000)]
linux-user: fix mremap unmapping adjacent region
This typo meant that calls to `mremap` which shrink a mapping by some N
bytes would, when the virtual address space was pre-reserved (e.g.
32-bit guest on 64-bit host), unmap the N bytes following the *original*
mapping.
Signed-off-by: Matthew Lugg <mlugg@mlugg.co.uk> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20251117170954.31451-2-mlugg@mlugg.co.uk>
linux-user: allow null `pathname` for statx()/fstatat()
Since Linux 6.11, the path argument may be NULL.
Before this patch, qemu-*-linux-user failed with EFAULT when `pathname` was
specified as NULL, even for Linux kernel hosts > 6.10. This patch fixes this
issue by checking whether `arg2` is 0. If so, don't return EFAULT, but instead
perform the appropiate syscall and let the host's kernel handle null `pathname`.
Cc: qemu-stable@nongnu.org Signed-off-by: Jean-Christian CÎRSTEA <jean.christian.cirstea@gmail.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20251229121416.2209295-1-jean.christian.cirstea@gmail.com>
Paolo Bonzini [Tue, 23 Dec 2025 16:37:20 +0000 (17:37 +0100)]
tcg/optimize: Do use affected bits
We inadvertently disabled affected bits optimizations on operations
that use fold_masks_zosa. These happen relatively often in x86 code
for extract/sextract; for example given the following:
mov %esi, %ebp
xor $0x1, %ebp
the optimizer is able to simplify the "extract_i64 rbp,tmp0,$0x0,$0x20"
produced by the second instruction to a move.
Cc: qemu-stable@nongnu.org Fixes: 932522a9ddc ("tcg/optimize: Fold and to extract during optimize") Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20251223163720.985578-1-pbonzini@redhat.com>
In computing a_mask, for or, we remove the bits from t1->o_mask
which are known to be zero. For orc, the bits known to be zero
are the inverse of those known to be one.
Cc: qemu-stable@nongnu.org Fixes: cc4033ee47c ("tcg/optimize: Build and use zero, one and affected bits in fold_orc") Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Merge tag 'pull-riscv-to-apply-20260109' of https://github.com/alistair23/qemu into staging
First RISC-V PR for 11.
* Remove unused import statement from sifive_u test
* Free allocated memory in core/loader
* Add all available CSRs to 'info registers'
* Add 'riscv-aia' accel prop info to documentation
* Fix IOMMU MemoryRegion owner
* Make riscv cpu.h target partially independent
* Expand AIA target[i] source handling and refactor related code
* Don't look up DDT cache in Off and Bare modes
* Add Zilsd and Zclsd extension support
* Add RISCV ZALASR extension
* Add support for MIPS P8700 CPU
# -----BEGIN PGP SIGNATURE-----
#
# iQIzBAABCgAdFiEEaukCtqfKh31tZZKWr3yVEwxTgBMFAmlgmt8ACgkQr3yVEwxT
# gBMxsRAAsdrRs8jrvjJqA60vt6Q/YZRCZFTeRfGlq92zVV4cmkUIkZdCESQsbToV
# lGmbdLXXeC8huxh27zjQuoO9JZzPlg6tBzxCpuNXnrTQB57UKjLJoQ4rKJ9F6wT+
# iakZ3ky6iN9N64p1lDRwfph7hjxodb6Vxgi/iBTsWdj1p4OsJgL2kOPSVBZLdkoL
# fTngoy0bmnV83o2eXIBx09YMxCaT3zjrhIf5lZ3zIeML8wJiq9RKUTs9pDlVO5Z1
# UEeBC8SHNj6siZ5EkCk3IQf7hIq77UITR4wHMQmNLqXY25pSexzqgAKiQt5bbU38
# VyUcXZglXKyvWDPLR36kKQeSSQFaToyVYmw2pr4oZXtEwAUrh8KqprlL+o/V1kFk
# 726i03xtqpPn/HN49kzvfOatlq5qUkeLPWI5RN/q9jjE4RdNxPeSBeyy47yNoR6t
# i9jPV+Z9XhNk7OpTmFKyEEBrf2cyGBubddpDgjDlzBohaICk24pIZgUpHs5WyIkF
# 8/mz9nruUHNXYwasQ5zjHoEaNfoCAgmAMY8klNK6t7Ty5AhT5x0c/5c5WxJ4L0BC
# z0WMZrK4r3uoFeXxRqQZnaWxx0ySCQkPyCuRNGqCx8J/bFhx9VUz5xgR1fZpkfNG
# NdDCueZI3mtdULz2JFe+wwan5XPapEKArFW0RQdR4QYBHiZTrpE=
# =gVkC
# -----END PGP SIGNATURE-----
# gpg: Signature made Fri 09 Jan 2026 05:06:23 PM AEDT
# gpg: using RSA key 6AE902B6A7CA877D6D659296AF7C95130C538013
# gpg: Good signature from "Alistair Francis <alistair@alistair23.me>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 6AE9 02B6 A7CA 877D 6D65 9296 AF7C 9513 0C53 8013
* tag 'pull-riscv-to-apply-20260109' of https://github.com/alistair23/qemu: (34 commits)
test/functional: Add test for boston-aia board
riscv/boston-aia: Add an e1000e NIC in slot 0 func 1
hw/riscv: Add support for MIPS Boston-aia board mode
hw/riscv: Add support for RISCV CPS
hw/misc: Add RISC-V CPC device implementation
hw/misc: Add RISC-V CMGCR device implementation
target/riscv: Add Xmipslsp instructions
target/riscv: Add mips.pref instruction
target/riscv: Add mips.ccmov instruction
target/riscv: Add MIPS P8700 CSRs
target/riscv: Add MIPS P8700 CPU
target/riscv: Add cpu_set_exception_base
Add RISCV ZALASR extension
target/riscv: Add Zilsd and Zclsd extension support
hw/riscv: riscv-iommu: Don't look up DDT cache in Off and Bare modes
hw/intc/riscv_aplic: Factor out source_active() and remove duplicate checks
hw/intc/riscv_aplic: Expand inactive source handling for AIA target[i]
target/riscv: Remove upper_half from riscv_pmu_ctr_get_fixed_counters_val
target/riscv: Combine mhpmcounter and mhpmcounterh
target/riscv: Combine minstretcfg and minstretcfgh
...
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
riscv/boston-aia: Add an e1000e NIC in slot 0 func 1
The Boston AIA board needs a basic GbE NIC. There is no PCH GbE
device emulation, so use an `e1000e` instead. We place it in
**slot 0, function 1** in order not to conflict with the existing
AHCI device in slot 0 func 0.
Signed-off-by: Chao-ying Fu <cfu@mips.com> Signed-off-by: Djordje Todorovic <djordje.todorovic@htecgroup.com> Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20260108134128.2218102-12-djordje.todorovic@htecgroup.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
hw/riscv: Add support for MIPS Boston-aia board mode
The board model supports up to 64 harts with MIPS CPS, MIPS GCR,
MIPS CPC, AIA plic, and AIA clint devices. The model can create
boot code, if there is no -bios parameter. We can specify -smp x,
cores=y,thread=z.
Ex: Use 4 cores and 2 threads with each core to
have 8 smp cpus as follows.
qemu-system-riscv64 -cpu mips-p8700 \
-m 2G -M boston-aia \
-smp 8,cores=4,threads=2 -kernel fw_payload.bin \
-drive file=rootfs.ext2,format=raw -serial stdio
Signed-off-by: Chao-ying Fu <cfu@mips.com> Signed-off-by: Djordje Todorovic <djordje.todorovic@htecgroup.com> Acked-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com> Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20260108134128.2218102-11-djordje.todorovic@htecgroup.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Add support for the Coherent Processing System for RISC-V.
This enables SMP support for RISC-V boards that require
cache-coherent multiprocessor systems.
Signed-off-by: Chao-ying Fu <cfu@mips.com> Signed-off-by: Djordje Todorovic <djordje.todorovic@htecgroup.com> Acked-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20260108134128.2218102-10-djordje.todorovic@htecgroup.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Add RISC-V implementation of the Cluster Power Controller (CPC) device.
It is based on the existing MIPS CPC implementations but adapted for
RISC-V systems.
The CPC device manages power control for CPU clusters in RISC-V
systems.
This is needed for the MIPS BOSTON AIA board.
Signed-off-by: Chao-ying Fu <cfu@mips.com> Signed-off-by: Djordje Todorovic <djordje.todorovic@htecgroup.com> Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20260108134128.2218102-9-djordje.todorovic@htecgroup.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Add RISC-V implementation of the Coherent Manager Global Control
Register (CMGCR) device. It is based on the existing MIPS CMGCR
implementation but adapted for RISC-V systems.
The CMGCR device provides global system control for multi-core
configurations in RISC-V systems.
This is needed for the MIPS BOSTON AIA board.
Signed-off-by: Chao-ying Fu <cfu@mips.com> Signed-off-by: Djordje Todorovic <djordje.todorovic@htecgroup.com> Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20260108134128.2218102-8-djordje.todorovic@htecgroup.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Frank Chang [Tue, 28 Oct 2025 08:50:32 +0000 (16:50 +0800)]
hw/riscv: riscv-iommu: Don't look up DDT cache in Off and Bare modes
According to the RISC-V IOMMU specification:
* When ddtp.iommu_mode is set to Off, there is no DDT look-up, and an "All
inbound transactions disallowed" fault (cause = 256) is reported for any
inbound transaction.
* When ddtp.iommu_mode is set to Bare, there is no DDT look-up, and the
translated address is the same as the IOVA, unless the transaction type
is disallowed (cause = 260).
In the current implementation, the DDT cache is incorrectly looked up
even when ddtp.iommu_mode is set to Off or Bare. This may result in
unintended cache hits.
Therefore, the DDT cache must not be looked up when ddtp.iommu_mode is
set to Off or Bare. For other modes, software is required to issue cache
invalidation commands before any inbound transactions.
Signed-off-by: Frank Chang <frank.chang@sifive.com> Acked-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com> Reviewed-by: Jim Shu <jim.shu@sifive.com>
Message-ID: <20251028085032.2053569-1-frank.chang@sifive.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Nikita Novikov [Wed, 29 Oct 2025 07:17:12 +0000 (10:17 +0300)]
hw/intc/riscv_aplic: Expand inactive source handling for AIA target[i]
According to the RISC-V AIA v1.0, section 4.5.2 ("Source configurations"),
register target[i] shall be read-only zero when interrupt source i is inactive
in this domain. A source is inactive if it is delegated to a child domain or
its source mode is INACTIVE.
The previous implementation only checked SM == INACTIVE. This patch adds
full compliance:
- Return zero on read if D == 1 or SM == INACTIVE
- Ignore writes in both cases
Fixes: b6f1244678 ("intc/riscv_aplic: Fix target register read when source is inactive") Signed-off-by: Nikita Novikov <n.novikov@syntacore.com> Acked-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20251029-n-novikov-aplic_aia_ro-v1-1-39fec74c918a@syntacore.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
target/riscv: Remove upper_half from riscv_pmu_ctr_get_fixed_counters_val
Now that mhpmcounter is always a 64-bit value we can remove the
upper_half argument from riscv_pmu_ctr_get_fixed_counters_val() and
always return a 64-bit value.
Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Anton Johansson <anjo@rev.ng> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251103033713.904455-9-alistair.francis@wdc.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Anton Johansson [Mon, 3 Nov 2025 03:37:12 +0000 (13:37 +1000)]
target/riscv: Combine mhpmcounter and mhpmcounterh
According to version 20250508 of the privileged specification,
mhpmconter is a 64-bit register and mhpmcounterh refers to the top
32 bits of this register when XLEN == 32. No real advantage is
gained by keeping them separate, and combining allows for slight
simplification.
Note, the cpu/pmu VMSTATE version is bumped breaking migration from
older versions.
Signed-off-by: Anton Johansson <anjo@rev.ng> Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20251027181831.27016-9-anjo@rev.ng> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20251103033713.904455-8-alistair.francis@wdc.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Anton Johansson [Mon, 3 Nov 2025 03:37:11 +0000 (13:37 +1000)]
target/riscv: Combine minstretcfg and minstretcfgh
According to version 20250508 of the privileged specification,
minstretcfg is a 64-bit register and minstretcfgh refers to the top
32 bits of this register when XLEN == 32. No real advantage is
gained by keeping them separate, and combining them allows for slight
simplification.
Signed-off-by: Anton Johansson <anjo@rev.ng> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-ID: <20251027181831.27016-8-anjo@rev.ng> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20251103033713.904455-7-alistair.francis@wdc.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Anton Johansson [Mon, 3 Nov 2025 03:37:10 +0000 (13:37 +1000)]
target/riscv: Combine mcyclecfg and mcyclecfgh
According to version 20250508 of the privileged specification, mcyclecfg
is a 64-bit register and mcyclecfgh refers to the top 32 bits of this
register when XLEN == 32. No real advantage is gained by keeping
them separate, and combining them allows for slight simplification.
Signed-off-by: Anton Johansson <anjo@rev.ng> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-ID: <20251027181831.27016-7-anjo@rev.ng> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20251103033713.904455-6-alistair.francis@wdc.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Anton Johansson [Mon, 3 Nov 2025 03:37:09 +0000 (13:37 +1000)]
target/riscv: Combine mhpmevent and mhpmeventh
According to version 20250508 of the privileged specification,
mhpmeventn is 64 bits in size and mhpmeventnh is only ever used
when XLEN == 32 and accesses the top 32 bits of the 64-bit
mhpmeventn registers. Combine the two arrays of target_ulong
mhpmeventh[] and mhpmevent[] to a single array of uint64_t.
This also allows for some minor code simplification where branches
handling either mhpmeventh[] or mhpmevent[] could be combined.
Signed-off-by: Anton Johansson <anjo@rev.ng> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-ID: <20251027181831.27016-6-anjo@rev.ng> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20251103033713.904455-5-alistair.francis@wdc.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Anton Johansson [Mon, 3 Nov 2025 03:37:08 +0000 (13:37 +1000)]
target/riscv: Bugfix make bit 62 read-only 0 for sireg* cfg CSR read
According to version 20250508 of the privileged specification, a read of
cyclecfg or instretcfg through sireg* should make the MINH bit
read-only 0, currently bit 30 is zeroed.
Signed-off-by: Anton Johansson <anjo@rev.ng> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-ID: <20251027181831.27016-5-anjo@rev.ng> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20251103033713.904455-4-alistair.francis@wdc.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Anton Johansson [Mon, 3 Nov 2025 03:37:07 +0000 (13:37 +1000)]
target/riscv: Fix size of mhartid
and update formatting in log.
Signed-off-by: Anton Johansson <anjo@rev.ng> Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20251027181831.27016-3-anjo@rev.ng> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20251103033713.904455-3-alistair.francis@wdc.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Anton Johansson [Mon, 3 Nov 2025 03:37:06 +0000 (13:37 +1000)]
target/riscv: Fix size of trivial CPUArchState fields
This commits groups together all CPUArchState fields whose behaviour can
be retained by simply changing the size of the field.
Note, senvcfg is defined to be SXLEN bits wide, but is widened to 64
bits to match henvcfg and menvcfg. Next, [m|h]edeleg are changed to
64 bits as defined privileged specification, and hvictl is fixed to 32
bits which holds all relevant values, see HVICTL_VALID_MASK. The
remaining fields touched in the commit are widened from [H|S|M]XLEN
to 64-bit.
Note, the cpu/hyper, cpu/envcfg, cpu/jvt, and cpu VMSTATE versions are
bumped, breaking migration from older versions.
References to the privileged/unprivileged RISCV specification refer to
version 20250508.
Signed-off-by: Anton Johansson <anjo@rev.ng> Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20251027181831.27016-2-anjo@rev.ng> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20251103033713.904455-2-alistair.francis@wdc.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
docs/specs/riscv-aia.rst: add 'riscv-aia' accel prop info
Add a small section talking about the 'riscv-aia' KVM setting we
implement and how it affects the provisioning of the IMSIC s-mode
in-kernel controller.
While we're at it, fix the formatting of the AIA bullet list.
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com> Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20251028084622.1177574-1-dbarboza@ventanamicro.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
target/riscv: print all available CSRs in riscv_cpu_dump_state()
At this moment we're printing a small selection of CSRs. There's no
particular reason to not print all of them.
We're ignoring the note about CSR_SSTATUS being ommited because it can
be read via CSR_MSTATUS. There's a huge list of CSRs that would fall in
this category and it would be an extra burden to manage them, not
mentioning having to document "we're not listing X because it's the same
value as Y" to users.
Remove 'dump_csrs' and use the existing 'csr_ops' array to print all
available CSRs. Create two helpers in csr.c to identify FPU and VPU CSRs
and skip them - they'll be printed in the FPU/VPU blocks later.
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250623172119.997166-4-dbarboza@ventanamicro.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
target/riscv/cpu: print all FPU CSRs in riscv_cpu_dump_state()
We're missing fflags and frm.
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250623172119.997166-3-dbarboza@ventanamicro.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
riscv_cpu_dump_state() is using the same pattern to print a CSR given
its number. Add a helper to avoid code repetition.
While we're at it fix the identation of the 'flags & CPU_DUMP_VPU'
block.
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250623172119.997166-2-dbarboza@ventanamicro.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
skipIfMissingCommands is not used here, remove the import to silence
a pylint warning for this file.
Signed-off-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com> Reviewed-by: Nutty Liu <nutty.liu@hotmail.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251027112803.54564-1-thuth@redhat.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Merge tag 'pull-maintainers-2026-01-08' of https://repo.or.cz/qemu/armbru into staging
MAINTAINERS patches for 2026-01-08
# -----BEGIN PGP SIGNATURE-----
#
# iQJGBAABCgAwFiEENUvIs9frKmtoZ05fOHC0AOuRhlMFAmlfcIUSHGFybWJydUBy
# ZWRoYXQuY29tAAoJEDhwtADrkYZTv3YQAJGXEh1vqIZsEIRfPlOFPQWSfXUCbchX
# aiHYiWieMLJsNdP9jj+vxAz0agCURqbipqIAOJF21FfrSi8sC1T0g6bW7Bo8DFhn
# SP+LWHv+dqUds1Tb+GKk2qiU/g+giXCJ01paj2VuNzo3e5Aitj/l5uxVdXnCLZGy
# FwdchNPJBl2H9IO6J+OF1D7u4SKlIZncRyyyosaRGxVdKlF5hhIz8PypW/xw2kf2
# aCgHVldcij2ZXZSRuxGhyUsKtldGHNTEZFE/pQf30xhg30PlPA4crZuS3I/dlaQ4
# Nhx62ahQaZsG/D/jLvqUtOHKM7zFToLMSdvV5VKioxkgcf16VJ2RNf9OWgkWjUHz
# uBQgJJUFEF3gjE5DV1bEAQYDtp7xv0vOyUphkE6EJf7eAiIF4+vy6HvFpK7v1fpQ
# Bkd36FkL2uuFpDNk7fxFhcKbxEOreGjQOQoowhByLoCY/MuSro6NFvEh8Jtcid8L
# 2ju5+yCcLiZv3UXRTQ5uffi4CKzsjAGVSq2odqz7Xo6N0RGCQGp/NfrmumJEqM0k
# JSn/hxsn9kpKsi9WvwM5kpsDt7d45vjVF3VfiI5pZpoyOQPjud+1jdUR30BmuyGy
# CJ1Z+v6afnwTAh1KdYb8d7RNo1JOBnNWOFenmAzhevL3+sYthlS5LsK5iblMJr1e
# 3oiFTiACHbiO
# =kYKn
# -----END PGP SIGNATURE-----
# gpg: Signature made Thu 08 Jan 2026 07:53:25 PM AEDT
# gpg: using RSA key 354BC8B3D7EB2A6B68674E5F3870B400EB918653
# gpg: issuer "armbru@redhat.com"
# gpg: Good signature from "Markus Armbruster <armbru@redhat.com>" [unknown]
# gpg: aka "Markus Armbruster <armbru@pond.sub.org>" [unknown]
# gpg: WARNING: The key's User ID is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 354B C8B3 D7EB 2A6B 6867 4E5F 3870 B400 EB91 8653
* tag 'pull-maintainers-2026-01-08' of https://repo.or.cz/qemu/armbru:
MAINTAINERS: Add MAX78000FTHR section as orphan
MAINTAINERS: Add EEPROM 93xx section
MAINTAINERS: Fix coverage of meson.build in tests/functional
MAINTAINERS: Fix coverage of tests/functional/acpi-bits/
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Merge tag 'pull-error-2026-01-07-v2' of https://repo.or.cz/qemu/armbru into staging
Error reporting patches for 2026-01-07
# -----BEGIN PGP SIGNATURE-----
#
# iQJGBAABCgAwFiEENUvIs9frKmtoZ05fOHC0AOuRhlMFAmlfU/wSHGFybWJydUBy
# ZWRoYXQuY29tAAoJEDhwtADrkYZToiUP/RW1I1wFyescGOpUxBjlXqbkgZvrdRbL
# BxtTcoCW0q/cc1Fv3CSYZMm+vvwWJyAysnYONDu6ldDl9ojKfGT/gi1Tgp/99/r4
# bgLbAvExRbbyPOkPBtoXCYeobmgaDP9pMHHlVcdFQrW9hmQiEl4QSWPImmNrKEk2
# gV9SZJ737k9n5dq4XLbqlHXKspn4lWiUE9hbHIUrKWZDn0LDdr5z2wkjhZCmuCR2
# mRSgJhc68Lnb1LdBdRo/5PlG6Hw3jvLat4+q+42teN/aI6zJbD9yKocgaGtubVv1
# h4ntJPMvDKD7DRZF06k8crpLMXJjZFztVr30XBE/e7wG+xY34+3tho3iCQN1vTFe
# RBJne0FaRPGSNYpF8Tj7lPIr0kduqk3/lOQ9HPobTroIPTrCcRXbdOeQ/Ed/Cjrk
# suh8t4OGmy0ThcsUsAajSjPDw2aFlitCS4pWNaSctTvR7V+2trol+WS2QO4My0MX
# 4Z3BnOHBnhE/xo+22T4FW3NvNcFKsQ5Tlq6mjjAgFJ/guaJ2TbMFe/Pm9TtzcPHj
# 7mhBBvKStNWFrQz66z7+hxJhOuOEmON8i4coADDPTUWmcICCyjtJW5m5f+PoYYHr
# LpFwIFHWuKtSAwWQKReOAmA2p0gx1FNZX9eGCl/4IQ54/tLP2zJ07t6LwAl6fn6t
# mKXChdbC9L7p
# =CY68
# -----END PGP SIGNATURE-----
# gpg: Signature made Thu 08 Jan 2026 05:51:40 PM AEDT
# gpg: using RSA key 354BC8B3D7EB2A6B68674E5F3870B400EB918653
# gpg: issuer "armbru@redhat.com"
# gpg: Good signature from "Markus Armbruster <armbru@redhat.com>" [unknown]
# gpg: aka "Markus Armbruster <armbru@pond.sub.org>" [unknown]
# gpg: WARNING: The key's User ID is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 354B C8B3 D7EB 2A6B 6867 4E5F 3870 B400 EB91 8653
* tag 'pull-error-2026-01-07-v2' of https://repo.or.cz/qemu/armbru:
block/file-win32: Improve an error message
qga/commands-win32: Use error_setg_win32() for better error messages
error: Use error_setg_errno() for simplicity and consistency
error: Use error_setg_errno() to improve error messages
net/slirp: Improve file open error message
error: Use error_setg_file_open() for simplicity and consistency
blkdebug: Use error_setg_file_open() for a better error message
net/tap: Use error_setg_file_open() for a better error message
qga: Use error_setg_file_open() for better error messages
tap-solaris: Use error_setg_file_open() for better error messages
ui: Convert to qemu_create() for simplicity and consistency
error: Strip trailing '\n' from error string arguments (again)
error: Consistently name Error * objects err, and not errp
error: error_free(NULL) is safe, drop unnecessary conditionals
nbd/client-connection: Replace error_propagate() by assignment
hw/nvram/xlnx-bbram: More idiomatic and simpler error reporting
hw/core/loader: Make load_elf_hdr() return bool, simplify caller
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
This machine was contributed by Jackson Donaldson a couple of months
ago. Its RISC-V core is not implemented. Unfortunately, Jackson
isn't able to serve as maintainer at this time, so add it as orphan.
Cc: Jackson Donaldson <jackson88044@gmail.com> Cc: qemu-arm@nongnu.org Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20251220173336.3781377-5-armbru@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com>
Stefan Weil volunteered to serve as maintainer. Thanks!
Cc: Stefan Weil <sw@weilnetz.de> Signed-off-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Stefan Weil <sw@weilnetz.de>
Message-ID: <20251220173336.3781377-4-armbru@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com>
MAINTAINERS: Fix coverage of meson.build in tests/functional
Of the 29 meson.build wihin tests/functional, only 8 are covered. Add
the architecture-independent ones to "Functional testing framework",
and the remainder to "$arcg general architecture support" when
available, else to "$arch TCG CPUs".
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20251220173336.3781377-3-armbru@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com>
MAINTAINERS: Fix coverage of tests/functional/acpi-bits/
The pattern tests/functional/acpi-bits/* covers files in
acpi-bits/ (there are none), but not the files in its
subdirectories (there are five). Drop the *.
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20251220173336.3781377-2-armbru@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com>
Two out of three calls of CreateFile() use error_setg_win32() to
report errors. The third uses error_setg_errno(), mapping
ERROR_ACCESS_DENIED to EACCES, and everything else to EINVAL, throwing
away detail. Switch it to error_setg_win32().
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20251121121438.1249498-16-armbru@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
error: Use error_setg_errno() to improve error messages
A few error messages show numeric errno codes. Use error_setg_errno()
to show human-readable text instead.
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20251121121438.1249498-13-armbru@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
[Trivial fixup to riscv_kvm_cpu_finalize_features()]
Merge tag 'pull-monitor-2026-01-07' of https://repo.or.cz/qemu/armbru into staging
Monitor patches for 2026-01-07
# -----BEGIN PGP SIGNATURE-----
#
# iQJGBAABCgAwFiEENUvIs9frKmtoZ05fOHC0AOuRhlMFAmlehMoSHGFybWJydUBy
# ZWRoYXQuY29tAAoJEDhwtADrkYZTuPgP/2rHOlK4GKLJH6QHzK8RJKSyuSH2aPj8
# 7Mz22qnwxmlckinstF5AHpIdtzJtvpm9GpHQpvqzjaIObHNSqbopNUcC+C7SVYmB
# LomxyyBfNOGtqF7lCsWGwJIEDthMELN8BrrahADVxJRdEnVBJ3u8N21JaQegYJeE
# A+oywBUTdfNBkXwpwk/EzgXQSH9mSZxQI9QAfvqwd6alleRdSdlWQ1tt++x9TNXr
# 4I/leZpk5Olh99HtFonxMs03crVoNDaxEkqRzZaxa9WivFUjt6RZwOjfLnam7dFM
# fKz05/KeK8bgaJU0oaP8yrIZqcKeEM2kF+uYyBEsDsu8BWghv6a9mQ/7KrbU+idN
# lmr0el4Uk1kGmubpxEtWvse3yP2v4C4Y2/0r4nx00ebW3A09iBcfYQ9DjCvAhZ+O
# Ml7ECzZ63ubJ6Sj4w6sjjiUK6kcrbqxBP+DzLMzUY9YrGofSTLx6YUtyvEFyUm8J
# NPLl3u6vCI5zKnc9nHZoXsmLsPFKGe3at3TOJahNyM68TFc27xcvYlm3ZnKit6Un
# V2EvMxEjdZk2ZU6rWqEnIsVREQoC3Uje8zSkS9UFZEWWCj0WDhv552WXHlHRf4Uo
# ssP0T2wIG6N97LIdtKZSOg32Ff/EFU6ZI7J0pN8j4jz8is+7qdBuCkobq4kZ3vqN
# rfPt/lIY6dpc
# =RlpK
# -----END PGP SIGNATURE-----
# gpg: Signature made Thu 08 Jan 2026 03:07:38 AM AEDT
# gpg: using RSA key 354BC8B3D7EB2A6B68674E5F3870B400EB918653
# gpg: issuer "armbru@redhat.com"
# gpg: Good signature from "Markus Armbruster <armbru@redhat.com>" [unknown]
# gpg: aka "Markus Armbruster <armbru@pond.sub.org>" [unknown]
# gpg: WARNING: The key's User ID is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 354B C8B3 D7EB 2A6B 6867 4E5F 3870 B400 EB91 8653
* tag 'pull-monitor-2026-01-07' of https://repo.or.cz/qemu/armbru:
monitor/qmp: cleanup SocketChardev listener sources early to avoid fd handling race
scripts/device-crash-test: ERROR_RULE_LIST garbage collection
qdev: Legacy properties are now unused internally, drop
qdev: Fix "info qtree" to show links
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Merge tag 'pull-request-2026-01-07' of https://gitlab.com/thuth/qemu into staging
* Compat machines for 11.0
* Add some more files to the MAINTAINERS file
* Use explicit big-endian API calls in the s390x code
* Add the possibility to run sub-tests manually in the functional test suite
# -----BEGIN PGP SIGNATURE-----
#
# iQJFBAABCgAvFiEEJ7iIR+7gJQEY8+q5LtnXdP5wLbUFAmleSkMRHHRodXRoQHJl
# ZGhhdC5jb20ACgkQLtnXdP5wLbVegA//R8zGTnW++Rcb3xFlRGQye08eKNWda4K8
# hqgHg4nEf3zj8dYm91lop8v3CMwVJtlBLiKtv+8GAo5ma/yItM9N/F3AgsUXt6po
# dpAAJISucDyIkHLDEMtlPTfQsEvoegEIaXoM7m1AOktArRaLzynmu430f8oAV8BE
# H3pPGUxaNgjtGlF+6yeUJ/FzrRpI2PXR6o8vtoG8+II5lQZvajOcmix6Znh+u0xj
# QKzYchYeN1u1YCvykQSp7dTUPygaGOgXHKpUvzUFNWyiq9d0eRW75NMLQJ4LSG2q
# nqmmHlSxsay5E0H+AWzDRGAsGNrXDtsxkXuAVE0GitKLcc3a1U5m4RQAl2bCW7Px
# +tx5xjxzg5d38wyKo7mif5WKKIdJs0ljuFlMMMn+FR8MEblCorW/CVCB4qVBdJ2v
# GMSD7hvHoRba2SpT6y0s+pIOZRsXdWW9FhAAVk9gURkm494UxBJZZL37gQEKwC0t
# HMxq8WMFLqZAC4TaoxSMdIRW9CZD5qKjGa4y2N9JU1HO2YDHsItce9DWb/09ep91
# LQg+adtqOFsYs5oGAZ1I17AIl9+ZYUatCeOGxwyYV4Bso5VZ45YH0z2puhA+FSp6
# zT+4trfasVDPQTFOFzBOZXOzhSFBqeVBPeBZAPG3CsTfHBdqu/YNOQuYtWWize94
# 0qmfMrevMxs=
# =oVgR
# -----END PGP SIGNATURE-----
# gpg: Signature made Wed 07 Jan 2026 10:57:55 PM AEDT
# gpg: using RSA key 27B88847EEE0250118F3EAB92ED9D774FE702DB5
# gpg: issuer "thuth@redhat.com"
# gpg: Good signature from "Thomas Huth <th.huth@gmx.de>" [unknown]
# gpg: aka "Thomas Huth <thuth@redhat.com>" [unknown]
# gpg: aka "Thomas Huth <th.huth@posteo.de>" [unknown]
# gpg: aka "Thomas Huth <huth@tuxfamily.org>" [unknown]
# gpg: WARNING: The key's User ID is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 27B8 8847 EEE0 2501 18F3 EAB9 2ED9 D774 FE70 2DB5
* tag 'pull-request-2026-01-07' of https://gitlab.com/thuth/qemu:
tests/functional/qemu_test/testcase: Fix mismatched quotations
tests/functional: Allow tests to be run individually
target/s390x: Inline translator_lduw() and translator_ldl()
target/s390x: Use big-endian variant of cpu_ld/st_data*()
target/s390x: Inline cpu_ld{uw, l}_code() calls in EX opcode helper
target/s390x: Replace MO_TE -> MO_BE
target/s390x: Replace gdb_get_regl() -> gdb_get_reg64()
target/s390x: Use explicit big-endian LD/ST API
hw/s390x: Use explicit big-endian LD/ST API
MAINTAINERS: Add configs/targets/s390x-softmmu.mak to the S390 general section
MAINTAINERS: Add util/s390x_pci_mmio.c to the S390 PCI section
hw/s390x: Un-inline the s390_do_cpu_*() functions
hw: add compat machines for 11.0
hw/s390x/ccw: Remove deprecated s390-ccw-virtio-5.0 machine
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Jie Song [Tue, 25 Nov 2025 14:07:06 +0000 (22:07 +0800)]
monitor/qmp: cleanup SocketChardev listener sources early to avoid fd handling race
When starting a dummy QEMU process with virsh version, monitor_init_qmp()
enables IOThread monitoring of the QMP fd by default. However, a race
condition exists during the initialization phase: the IOThread only removes
the main thread's fd watch when it reaches qio_net_listener_set_client_func_full(),
which may be delayed under high system load.
This creates a window between monitor_qmp_setup_handlers_bh() and
qio_net_listener_set_client_func_full() where both the main thread and
IOThread are simultaneously monitoring the same fd and processing events.
This race can cause either the main thread or the IOThread to hang and
become unresponsive.
Fix this by proactively cleaning up the listener's IO sources in
monitor_init_qmp() before the IOThread initializes QMP monitoring,
ensuring exclusive fd ownership and eliminating the race condition.
Signed-off-by: Jie Song <songjie_yewu@cmss.chinamobile.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-ID: <20251125140706.114197-1-mail@jiesong.me>
Device 'nand' was dropped in commit commit e86c1f967a3.
Device 'vfio-amd-xgbe' was dropped in commit aeb1a50d4a7.
Device 'vfio-calxeda-xgmac' was dropped in commit 8ebc416ac17.
The last error messages matching r"images* must be given with the
'pflash' parameter" was dropped in commit a2ccff4d2bc.
The error message matching r"Option '-device [\w.,-]+' cannot be
handled by this machine" was dropped in commit commit db78a605599.
The error message matching r"Ignoring smp_cpus value" ceased to match
in commit f2ad5140fa5, and was then dropped in commit 72649619341.
The error message matching r"rom check and register reset failed" was
lost in merge commit af3f37319cb.
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20251128101321.3287186-1-armbru@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com>
qdev: Legacy properties are now unused internally, drop
Legacy properties are an accidental and undocumented external
interface. qom-set doesn't work for them (no .set() method). qom-get
and qom-list-get work only when the underlying qdev property has a
.print() method, i.e. the PCI address properties, as explained in the
previous commit. Here's one that works:
(qemu) qom-get /machine/unattached/device[3]/pm bus
"/machine/i440fx/pci.0"
(qemu) qom-get /machine/unattached/device[3]/pm legacy-bus
Error: Property 'PIIX4_PM.legacy-bus' is not readable
Actual use of this undocumented interface seems quite unlikely. A
deprecation period seems unnecessary. Drop it.
qdev_print_props() retrieves a property's value from its legacy
property if it exists. A legacy property is created by
qdev_class_add_legacy_property() when the property has a print()
method or does not have a get() method.
If it has a print() method, the legacy property's value is obtained
from the property's print() method. This is used to format PCI
addresses nicely, i.e. like 01.3 instead of 11.
Else, if doesn't have a get() method, the legacy property is
unreadable. "info qtree" silently skips unreadable properties.
Link properties don't have a get() method, and are therefore skipped.
This is wrong, because the underlying QOM property *is* readable.
Change qdev_print_props() to simply use a print() method directly if
it exists, else get the value via QOM.
"info qtree" now shows links fine. For instance, machine "pc" onboard
device "PIIX4_PM" property "bus" is now visible.
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20251022101420.36059-3-armbru@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
This error reports failure to create a temporary file, and
error_setg_file_open() would probably be too terse, so merely switch
to error_setg_errno() to add errno information.
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20251121121438.1249498-12-armbru@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
error: Use error_setg_file_open() for simplicity and consistency
Replace
error_setg_errno(errp, errno, MSG, FNAME);
by
error_setg_file_open(errp, errno, FNAME);
where MSG is "Could not open '%s'" or similar.
Also replace equivalent uses of error_setg().
A few messages lose prefixes ("net dump: ", "SEV: ", __func__ ": ").
We could put them back with error_prepend(). Not worth the bother.
Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dave@treblig.org>
Message-ID: <20251121121438.1249498-11-armbru@redhat.com>
[Conflict with commit 26b4a6ffe7f (monitor/hmp: Merge
hmp-cmds-target.c within hmp-cmds.c) resolved]
net/tap: Use error_setg_file_open() for a better error message
The error message changes from
tap: open vhost char device failed
to
Could not open '/dev/vhost-net': REASON
I think the exact file name is more useful to know than the file's
purpose.
We could put back the "tap: " prefix with error_prepend(). Not
worth the bother.
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20251121121438.1249498-9-armbru@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
qga: Use error_setg_file_open() for better error messages
Error messages change from
open("FNAME"): REASON
to
Could not open 'FNAME': REASON
Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dave@treblig.org> Reviewed-by: Kostiantyn Kostiuk <kkostiuk@redhat.com>
Message-ID: <20251121121438.1249498-6-armbru@redhat.com>
tap-solaris: Use error_setg_file_open() for better error messages
Error messages change from
Can't open /dev/ip (actually /dev/udp)
Can't open /dev/tap
Can't open /dev/tap (2)
to
Could not open '/dev/udp': REASON
Could not open '/dev/tap': REASON
where REASON is the value of strerror(errno).
Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dave@treblig.org>
Message-ID: <20251121121438.1249498-5-armbru@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
error: Strip trailing '\n' from error string arguments (again)
Tracked down with scripts/coccinelle/err-bad-newline.cocci.
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20251121121438.1249498-2-armbru@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
error: Consistently name Error * objects err, and not errp
This touches code in xen_enable_tpm() that is obviously wrong. Since
I don't know how to fix it properly, I'm adding a FIXME there.
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20251119130855.105479-6-armbru@redhat.com> Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
error: error_free(NULL) is safe, drop unnecessary conditionals
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20251119130855.105479-5-armbru@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru> Reviewed-by: Peter Xu <peterx@redhat.com> Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
nbd/client-connection: Replace error_propagate() by assignment
connect_thread_func() sets a variable to null, then error_propagate()s
an Error * to it. This is a roundabout way to assign the Error * to
it, so replace it by just that.
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20251119130855.105479-4-armbru@redhat.com> Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru> Reviewed-by: Peter Xu <peterx@redhat.com> Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
hw/nvram/xlnx-bbram: More idiomatic and simpler error reporting
bbram_bdrv_error() interpolates a "detail" string into a template with
error_setg_errno(), then reports the result with error_report().
Produces error messages with an unwanted '.':
BLK-NAME: BBRAM backstore DETAIL failed.: STERROR
Replace both calls of bbram_bdrv_error() by straightforward
error_report(), and drop the function. This is less code, easier to
read, and the error message is more greppable.
Also delete the unwanted '.'.
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20251119130855.105479-3-armbru@redhat.com> Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru> Reviewed-by: Peter Xu <peterx@redhat.com> Reviewed-by: Luc Michel <luc.michel@amd.com> Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
hw/core/loader: Make load_elf_hdr() return bool, simplify caller
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20251119130855.105479-2-armbru@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru> Reviewed-by: Peter Xu <peterx@redhat.com> Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com> Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
A debug string incorrectly mixes single-quotes with double-quotes,
causing the variable within to be treated as a literal. Fix it.
Signed-off-by: Yodel Eldar <yodel.eldar@yodel.dev>
Message-ID: <20260106220319.74785-1-yodel.eldar@yodel.dev> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Signed-off-by: Thomas Huth <thuth@redhat.com>
Fabiano Rosas [Fri, 2 Jan 2026 18:17:00 +0000 (15:17 -0300)]
tests/functional: Allow tests to be run individually
The functional tests currently don't allow a single test to be
selected for execution by dotted name, e.g:
./build/run tests/functional/ppc64/test_pseries.py PseriesMachine.test_ppc64_linux_boot
^
The issue is that the testcase.py main function passes the test
module's name as the second argument to unittest.main(), which makes
it ignore all other positional arguments (presumably because the
module is already the superset of all tests).
After commit cac08383f0 ("tests/functional: expose sys.argv to
unittest.main"), the situation improves by passing the rest of the
argv from the command line invocation into unittest.main(), but it
still doesn't fix the issue. The short form options are now accepted,
so the -k option could be used to filter for a pattern, which is
useful, but not the same as listing the test names.
Fix this by passing the test module name via the "module" argument to
unittest.main() and stop touching argv. The ways of invoking tests are
now as per unittests documentation (-k still works):
Examples:
test_pseries.py - run default set of tests
test_pseries.py MyTestSuite - run suite 'MyTestSuite'
test_pseries.py MyTestCase.testSomething - run MyTestCase.testSomething
test_pseries.py MyTestCase - run all 'test*' test methods in MyTestCase
Note that ever since we've been programatically passing the module
name to unittest.main(), the usage 'test_pseries.py test_pseries' was
never valid. It used to "work" just the same as 'test_pseries.py
foobar' would. After this patch, that usage results in an error.
Also note that testcase.py:main() pertains to running the test module
that invoked it via QemuSystemTest.main(), i.e. module == __main__. So
the 'discover' usage of unittest doesn't apply here, the module is
already discovered because that's where this code was called from to
begin with. This patch could just as well call unittest.main() instead
of unittest.main(test_module), but the latter provides nicer error
messages prefixed with the module name.
Tested-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Fabiano Rosas <farosas@suse.de>
Message-ID: <20260102181700.11886-1-farosas@suse.de> Signed-off-by: Thomas Huth <thuth@redhat.com>
target/s390x: Use big-endian variant of cpu_ld/st_data*()
We only build the S390x target using big endianness order,
therefore the cpu_ld/st_data*() definitions expand to the
big endian declarations. Use the explicit big-endian variants.
Mechanical change running:
$ tgt=s390x; \
end=be; \
for op in data mmuidx_ra; do \
for ac in uw sw l q; do \
sed -i -e "s/cpu_ld${ac}_${op}/cpu_ld${ac}_${end}_${op}/" \
$(git grep -l cpu_ target/${tgt}/); \
done;
for ac in w l q; do \
sed -i -e "s/cpu_st${ac}_${op}/cpu_st${ac}_${end}_${op}/" \
$(git grep -l cpu_ target/${tgt}/); \
done;
done
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org> Reviewed-by: Eric Farman <farman@linux.ibm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20251224162036.90404-7-philmd@linaro.org> Signed-off-by: Thomas Huth <thuth@redhat.com>
We only build the S390x target using big endianness order,
therefore the MO_TE definitions expand to the big endian
one. Use the latter which is more explicit.
Thomas Huth [Thu, 18 Dec 2025 19:47:14 +0000 (20:47 +0100)]
MAINTAINERS: Add configs/targets/s390x-softmmu.mak to the S390 general section
Make sure that configs/targets/s390x-softmmu.mak is covered by
MAINTAINERS - the "S390 general architecture support" section seems
to be a good place for this.
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20251218194714.174897-1-thuth@redhat.com>
Thomas Huth [Thu, 18 Dec 2025 19:36:42 +0000 (20:36 +0100)]
MAINTAINERS: Add util/s390x_pci_mmio.c to the S390 PCI section
s390x_pci_mmio.c currently shows up as unmaintained. Add it to
the S390 PCI section to make the right people aware of changes
to this file.
Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com> Reviewed-by: Farhan Ali <alifm@linux.ibm.com> Reviewed-by: Eric Farman <farman@linux.ibm.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20251218193642.170968-1-thuth@redhat.com>
Thomas Huth [Wed, 17 Dec 2025 14:42:38 +0000 (15:42 +0100)]
hw/s390x: Un-inline the s390_do_cpu_*() functions
These functions are only called via their function pointer by using
the run_on_cpu() function, so it does not make sense to declare these
as "inline" functions. Move the functions from cpu.h to either cpu.c
(when they are still used in multiple places), or to s390-virtio-ccw.c
(when they are only called from that file).
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Eric Farman <farman@linux.ibm.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20251217144238.37610-1-thuth@redhat.com>
This machine has been supported for a period of more than 6 years.
According to our versioned machine support policy (see commit ce80c4fa6ff "docs: document special exception for machine type
deprecation & removal") it can now be removed.
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251017133002.61410-4-philmd@linaro.org> Signed-off-by: Thomas Huth <thuth@redhat.com>
Merge tag 'pull-aspeed-20260105' of https://github.com/legoater/qemu into staging
aspeed queue:
* Removed the ast2700-a0 SoC and ast2700a0-evb machine.
* Added SGPIO support to the ast2700 SoC, including unit tests.
* Added several FRU EEPROMs to the Catalina board.
* Added support for the new AST1060 SoC and ast1060-evb machine,
including functional tests.
* Fixed the silicon revision ID register for AST2600 and AST1030 SoCs.
* Added an SFDP table for a Winbond flash chip.
* Updated documentation for Aspeed boards.
# -----BEGIN PGP SIGNATURE-----
#
# iQIzBAABCAAdFiEEoPZlSPBIlev+awtgUaNDx8/77KEFAmlbtGMACgkQUaNDx8/7
# 7KGtVBAAgiCDME1oXrc+ZVmYn8RtRsx/lakp4prbqRbs6A8qoITk3ao6WjNd2k3P
# kOkvB/xQCqRDSSJIpp8BQhUzDet80b8KUz16iTw1m7KubMIqapmOxVkGJqSc9kGT
# PfLVjB60rHqiCkInNaaMXxMQuY0iAFKS+SDM8mCGaay0MXdvsEIi+XIcxv2TX0Jo
# tnHMaJxtSKfzY3QiM7yeB+WryzOlzQ7IMqRkai9tCN1y3XyDy8PodelZFCIGXw/N
# tw04Z3q/LhmxT6kjvYLmeTETne+1k69gfME+7JhB1hPSrIgdIqM9qyXCROb0U8/W
# 5mJDkm84blHc4QWITdewiyhIGps9ITxqlIelCExPL1GpEubSg5BVkqFbIjMv+6HJ
# 2XcBbP+rG6IdEpxeT+PcHw5HvOfLjMY6kGrawpK4s2id5jI9GSSyNY5k576tqRzg
# P10GfeKUDNDj1nYhUfOmzL6qXb9TqIyQtOVJVGcHkaASnXIqFvL6rYQHcttFej08
# YepKqvYBBSwsb2TdSb1t6VKTgCublFUD4jdhph3iqVmfQRl3ei8WJHFKCt8aQ235
# HqXzcmBDoTFYqJ97SAg1bvydhVL+rDpd//gcPqVw2cwMnTa2S3zvgI6xj1oBTEf8
# YiRPtFYJ03Y9baNZRdGdYAErxIdiliZh+OYfaEFNNn5Zuqp6tYQ=
# =64bG
# -----END PGP SIGNATURE-----
# gpg: Signature made Mon 05 Jan 2026 11:53:55 PM AEDT
# gpg: using RSA key A0F66548F04895EBFE6B0B6051A343C7CFFBECA1
# gpg: Good signature from "Cédric Le Goater <clg@redhat.com>" [full]
# gpg: aka "Cédric Le Goater <clg@kaod.org>" [full]
* tag 'pull-aspeed-20260105' of https://github.com/legoater/qemu: (36 commits)
hw/i2c/aspeed: Fix wrong I2CC_DMA_LEN when I2CM_DMA_TX/RX_ADDR set first
hw/intc/aspeed: Remove TSP 128 - 138
hw/intc/aspeed: Remove SSP 128 - 138
docs/specs/aspeed-intc: Remove GIC 128 - 136
hw/intc/aspeed: Remove GIC 128 - 136
hw/arm/aspeed_ast27x0: Remove ast2700-a0 SOC
hw/arm: Remove ast2700a0-evb machine
tests/functional: Fix URL of gb200nvl-bmc image
test/qtest: Add Unit test for Aspeed SGPIO
hw/arm/aspeed_ast27x0: Wire SGPIO controller to AST2700 SoC
hw/arm/aspeed_soc: Update Aspeed SoC to support two SGPIO controllers
hw/gpio/aspeed_sgpio: Implement SGPIO interrupt handling
hw/gpio/aspeed_sgpio: Add QOM property accessors for SGPIO pins
hw/gpio/aspeed_sgpio: Add basic device model for Aspeed SGPIO
hw/arm/aspeed: catalina: add Cable Cartridge FRU EEPROM
hw/arm/aspeed: catalina: add NIC FRU EEPROM
hw/arm/aspeed: catalina: add HMC FRU EEPROM
hw/arm/aspeed: catalina: add GB200-IO FRU EEPROM
hw/arm/aspeed: catalina: add GB200 FRU EEPROM
hw/arm/aspeed: catalina: add HDD FRU EEPROM
...
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Yunpeng Yang [Mon, 5 Jan 2026 15:56:55 +0000 (15:56 +0000)]
hw/ipmi/ipmi_bmc_sim: Support setting fake LAN channel config
The "Set LAN Configuration Parameters" IPMI command is added to the
`ipmi_bmc_sim` device to support dynamically setting fake LAN channel
configurations. With the fake LAN channel enabled, inside the guest OS,
tools such as `ipmitool` can be used to modify the configurations.
Signed-off-by: Yunpeng Yang <yunpeng.yang@nutanix.com>
Message-ID: <20260105155648.1037077-3-yunpeng.yang@nutanix.com> Signed-off-by: Corey Minyard <corey@minyard.net>
Yunpeng Yang [Mon, 5 Jan 2026 15:56:54 +0000 (15:56 +0000)]
hw/ipmi/ipmi_bmc_sim: Support getting fake LAN channel config
The following IPMI commands are added or modified to support getting
fake LAN channel configurations from the `ipmi_bmc_sim` device:
* Get Channel Access;
* Get Channel Info Command;
* Get LAN Configuration Parameters.
The fake LAN channel configurations can be specified from QEMU
commandline options for device `ipmi_bmc_sim`. Inside the guest OS, the
configurations can be retrieved from the device using some IPMI tools,
e.g., `ipmitool lan print`.
Note, there is not a real LAN channel. The fake LAN channel is suitable
for testing purposes.
Signed-off-by: Yunpeng Yang <yunpeng.yang@nutanix.com>
Message-ID: <20260105155648.1037077-2-yunpeng.yang@nutanix.com> Signed-off-by: Corey Minyard <corey@minyard.net>
projects / thirdparty / qemu.git / log
