]> git.ipfire.org Git - thirdparty/qemu.git/log
thirdparty/qemu.git
3 months agohw/arm/fsl-imx8mm: Adding support for I2C emulation
Gaurav Sharma [Tue, 21 Apr 2026 06:52:20 +0000 (12:22 +0530)] 
hw/arm/fsl-imx8mm: Adding support for I2C emulation

This can be used to test and debug I2C device drivers.
Added I2C interrupts

Reviewed-by: Philippe Mathieu-Daude <philmd@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Bernhard Beschow <shentey@gmail.com>
Signed-off-by: Gaurav Sharma <gaurav.sharma_7@nxp.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
3 months agohw/arm/fsl-imx8mm: Add GPIO controllers
Gaurav Sharma [Tue, 21 Apr 2026 06:52:19 +0000 (12:22 +0530)] 
hw/arm/fsl-imx8mm: Add GPIO controllers

Enabled GPIO controller emulation
Also updated the GPIO IRQ lines of iMX8MM

Reviewed-by: Philippe Mathieu-Daude <philmd@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Bernhard Beschow <shentey@gmail.com>
Signed-off-by: Gaurav Sharma <gaurav.sharma_7@nxp.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
3 months agohw/arm/fsl-imx8mm: Add PCIe support
Gaurav Sharma [Tue, 21 Apr 2026 06:52:18 +0000 (12:22 +0530)] 
hw/arm/fsl-imx8mm: Add PCIe support

This enables support for Designware PCI Express Controller emulation
It provides a controlled environment to debug the linux pci subsystem

Reviewed-by: Philippe Mathieu-Daude <philmd@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Bernhard Beschow <shentey@gmail.com>
Signed-off-by: Gaurav Sharma <gaurav.sharma_7@nxp.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
3 months agohw/arm/fsl-imx8mm: Adding support for USDHC storage controllers
Gaurav Sharma [Tue, 21 Apr 2026 06:52:17 +0000 (12:22 +0530)] 
hw/arm/fsl-imx8mm: Adding support for USDHC storage controllers

It enables emulation of SD/MMC cards through a virtual SDHCI interface
The emulated SDHCI controller allows guest OS to use emulated storage as
a standard block device.
This will allow running the images such as those generated
by Buildroot.

Reviewed-by: Philippe Mathieu-Daude <philmd@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Bernhard Beschow <shentey@gmail.com>
Signed-off-by: Gaurav Sharma <gaurav.sharma_7@nxp.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
3 months agohw/arm/fsl-imx8mm: Implemented support for SNVS
Gaurav Sharma [Tue, 21 Apr 2026 06:52:16 +0000 (12:22 +0530)] 
hw/arm/fsl-imx8mm: Implemented support for SNVS

SNVS contains an RTC which allows Linux to deal correctly with time

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Bernhard Beschow <shentey@gmail.com>
Signed-off-by: Gaurav Sharma <gaurav.sharma_7@nxp.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
3 months agohw/arm/fsl-imx8mm: Add Clock Control Module IP to iMX8MM
Gaurav Sharma [Tue, 21 Apr 2026 06:52:15 +0000 (12:22 +0530)] 
hw/arm/fsl-imx8mm: Add Clock Control Module IP to iMX8MM

Add the Clock Control Module (CCM) device to i.MX8MM SoC.
The CCM implementation is shared with i.MX8MP as the register
layout is identical between the two variants.Hence iMX8MM will
be using the source of iMX8MP CCM.

Reviewed-by: Bernhard Beschow <shentey@gmail.com>
Signed-off-by: Gaurav Sharma <gaurav.sharma_7@nxp.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
3 months agohw/arm/fsl-imx8mm: Add Analog device IP to iMX8MM SOC
Gaurav Sharma [Tue, 21 Apr 2026 06:52:14 +0000 (12:22 +0530)] 
hw/arm/fsl-imx8mm: Add Analog device IP to iMX8MM SOC

Add the Analog IP to i.MX8MM SoC. iMX8MM and i.MX8MP uses
the same Analog IP so the analog ip source will be shared.

The ARM PLL divider control register (arm-pll-fdiv-ctl0) has
a different reset value on i.MX8MM (0x000fa030) compared to
i.MX8MP (0x000fa031). So iMX8MM will be overriding this property
with its own reset-value.

Reviewed-by: Bernhard Beschow <shentey@gmail.com>
Signed-off-by: Gaurav Sharma <gaurav.sharma_7@nxp.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
3 months agohw/misc/imx8mp_analog: Add property to analog device
Gaurav Sharma [Tue, 21 Apr 2026 06:52:13 +0000 (12:22 +0530)] 
hw/misc/imx8mp_analog: Add property to analog device

Add configurable properties for register reset values that differ
between i.MX 8M variants (Plus, Mini, etc.). This allows the same
device implementation to be shared across multiple SoCs.

Properties added:
- arm-pll-fdiv-ctl0-reset: ARM PLL divider control reset value

Default value is set to match i.MX 8MP reset value (0x000FA031).
This can be overridden in the variant like iMX8MM with its own
reset value.

Reviewed-by: Bernhard Beschow <shentey@gmail.com>
Signed-off-by: Gaurav Sharma <gaurav.sharma_7@nxp.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
3 months agotests/functional/ppc/test_ppe42: Fix warning from the latest version of pylint
Thomas Huth [Mon, 27 Apr 2026 08:04:21 +0000 (10:04 +0200)] 
tests/functional/ppc/test_ppe42: Fix warning from the latest version of pylint

The pylint from Fedora 44 found a new issue in this test:

 tests/functional/ppc/test_ppe42.py:63:20: W0101: Unreachable code (unreachable)

And indeed, the "break" is unreachable since the previous self.fail()
always aborts immediately. Thus let's remove the "break" to make pylint
happy again.

Message-ID: <20260427080731.389061-1-thuth@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
3 months agohw/arm: Add the i.MX 8MM EVK(Evaluation Kit) board
Gaurav Sharma [Tue, 21 Apr 2026 06:52:12 +0000 (12:22 +0530)] 
hw/arm: Add the i.MX 8MM EVK(Evaluation Kit) board

Implemented CPUs, RAM, UARTs and Interrupt Controller
Other peripherals are represented as TYPE_UNIMPLEMENTED_DEVICE
Complete memory map of the SoC is provided.

Set default RAM size to 2GB and default CPU count to 4 to match
the real i.MX8MM EVK hardware configuration.

Documentation is shared with imx8mp-evk to avoid duplication.

Signed-off-by: Gaurav Sharma <gaurav.sharma_7@nxp.com>
[PMM: fixed over-long lines in doc]
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Bernhard Beschow <shentey@gmail.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
3 months agodocs/system: add FEAT_AA32 and FEAT_AA64 to emulation list
Alex Bennée [Tue, 21 Apr 2026 09:35:06 +0000 (10:35 +0100)] 
docs/system: add FEAT_AA32 and FEAT_AA64 to emulation list

This is just a documentation tweak as we already support both.
FEAT_AA32 implies FEAT_AA32EL0. FEAT_AA64 implies FEAT_AA64EL[0123].

This is however useful if you are using emulation.rst as a source of
truth of what QEMU emulates and when cross checking with
Features.json from Arm.

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20260421093506.616307-1-alex.bennee@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
3 months agotarget/xtensa: Replace malloc() with g_strdup_printf()
Dmitry Frolov [Wed, 30 Jul 2025 06:21:43 +0000 (09:21 +0300)] 
target/xtensa: Replace malloc() with g_strdup_printf()

malloc() return value is used without a check.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Signed-off-by: Dmitry Frolov <frolov@swemel.ru>
Reviewed-by: Max Filippov <jcmvbkbc@gmail.com>
Message-ID: <20250730062142.1665980-1-frolov@swemel.ru>
Signed-off-by: Thomas Huth <thuth@redhat.com>
3 months agohw/i386/fw_cfg: Use g_new() and g_new0() instead of g_malloc()
Sourish Dutta Sharma [Tue, 24 Feb 2026 16:00:20 +0000 (16:00 +0000)] 
hw/i386/fw_cfg: Use g_new() and g_new0() instead of g_malloc()

Replace g_malloc() and g_malloc0() calls that calculate the allocation
size using sizeof() with the type-safe g_new() and g_new0() macros.

This aligns the code with QEMU's coding style guidelines, improving
readability and protecting against potential integer overflow
vulnerabilities when allocating arrays.

Signed-off-by: Sourish Duttta Sharma <sourishduttasharma770@gmail.com>
Message-ID: <20260224160020.137036-1-sourishduttasharma770@gmail.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
3 months agohw/core/register: add register_array_get_owner
Luc Michel [Fri, 24 Apr 2026 15:56:44 +0000 (17:56 +0200)] 
hw/core/register: add register_array_get_owner

Add the register_array_get_owner function to the register API. This
function can be used to retrieve the device owning the given
RegisterInfoArray.

This was previously done inline by some devices.
5c6367bc1c8850f74812eeaaf87cff9911be58de modified the way register
blocks are created and parented to the device. Since this is an
implementation detail of the register API, it makes sense to have a
function for this.

Use it in the Versal OSPI and Versal/ZynqMP eFuse models instead of
tinkering with the API internals.

Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3421
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3422
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3423
Signed-off-by: Luc Michel <luc.michel@amd.com>
Tested-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Fixes: 5c6367bc1c8 ("hw/core/register: add the REGISTER_ARRAY type")
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20260424155646.533334-1-luc.michel@amd.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
3 months agotests/functional/qemu_test: Silence warnings from pylint in tesseract.py
Thomas Huth [Wed, 22 Apr 2026 07:11:44 +0000 (09:11 +0200)] 
tests/functional/qemu_test: Silence warnings from pylint in tesseract.py

Pylint complains:

 tesseract.py:1:0: C0114: Missing module docstring (missing-module-docstring)
 tesseract.py:12:0: C0116: Missing function or method docstring (missing-function-docstring)
 tesseract.py:15:11: W1510: 'subprocess.run' used without explicitly defining the value for 'check'. (subprocess-run-check)
 tesseract.py:12:30: W0613: Unused argument 'tesseract_args' (unused-argument)

Thus add the missing bits and remove the unused tesseract_args argument.
While we're at it, also add a SPDX identifier instead of the weird three
dots at the beginning of the file, and drop the license boilerplate text.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20260422071145.244820-1-thuth@redhat.com>

3 months agoutil: fix use of pthread_get_name_np on OpenBSD
Daniel P. Berrangé [Fri, 17 Apr 2026 12:05:31 +0000 (13:05 +0100)] 
util: fix use of pthread_get_name_np on OpenBSD

The pthread_get_name_np function is present on FreeBSD and OpenBSD
and has 'void' return not 'int'. We didn't notice this build problem
on FreeBSD since it also has pthread_getname_np which does return
int like Linux and we use the latter preferentially.

Fixes: 215235d365e49c72a85ea2940751e45419676031
Closes: https://gitlab.com/qemu-project/qemu/-/work_items/3399
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20260417120531.2215549-1-berrange@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
3 months agotarget: convert TABS indentation to spaces for consistency
Tanya Agarwal [Sat, 28 Mar 2026 17:09:14 +0000 (22:39 +0530)] 
target: convert TABS indentation to spaces for consistency

To follow consistent coding style, convert TABS indentation to spaces
for consistency.

Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/372

Signed-off-by: Tanya Agarwal <tanyaagarwal25699@gmail.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20260328170913.3673-1-tanyaagarwal25699@gmail.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
3 months agotarget/i386/tcg/sysemu: Allow 32-bit SMM code to be used in the 64-bit binary
Thomas Huth [Wed, 25 Mar 2026 12:09:44 +0000 (13:09 +0100)] 
target/i386/tcg/sysemu: Allow 32-bit SMM code to be used in the 64-bit binary

This is a preparation for the QEMU universal binary where we might want
to support both, the x86_64 and the i386 target, in one binary. Instead
of using #ifdef TARGET_X86_64 here, check the LM bit to select the 32-bit
or 64-bit code during runtime.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20260325120944.29391-3-thuth@redhat.com>

3 months agotarget/i386/tcg/sysemu: Move target specific SMM code to separate functions
Thomas Huth [Wed, 25 Mar 2026 12:09:43 +0000 (13:09 +0100)] 
target/i386/tcg/sysemu: Move target specific SMM code to separate functions

This code movement will make the next patch easier to read.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20260325120944.29391-2-thuth@redhat.com>

3 months agomeson.build: Bump the minimum GCC version to v10.4
Thomas Huth [Tue, 10 Mar 2026 15:53:31 +0000 (16:53 +0100)] 
meson.build: Bump the minimum GCC version to v10.4

Our minimum supported version of GCC used to be v7.4 since we still
wanted to support NetBSD 9.x in the past:

 https://gitlab.com/qemu-project/qemu/-/issues/614
 https://gitlab.com/qemu-project/qemu/-/commit/3830df5f83b9b52d949676

However, NetBSD 10 has already been released since two years ago
(see https://www.netbsd.org/releases/formal-10/NetBSD-10.0.html),
so according to our support policy, starting with QEMU v11.0, we
don't have to take care of the previous major release of NetBSD
anymore.

Looking at the various distros that we take care of (see e.g.
https://repology.org/project/gcc/versions), and the NetBSD 10.0
3rd party package information:

 https://cvsweb.netbsd.org/bsdweb.cgi/src/doc/3RDPARTY?rev=1.1905.2.14;content-type=text%2Fplain;only_with_tag=netbsd-10-0-RELEASE

... it seems like NetBSD 10 has the lowest version of GCC again,
but at least it's GCC 10.4 now. Thus bump our GCC requirement to
this version now.

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Acked-by: Fabiano Rosas <farosas@suse.de>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20260310155331.320066-1-thuth@redhat.com>

3 months agolinux-user: Flush errors by using exit() instead of _exit() in error path
Helge Deller [Sat, 25 Apr 2026 14:38:39 +0000 (16:38 +0200)] 
linux-user: Flush errors by using exit() instead of _exit() in error path

Qemu user mode does not properly flushes error messages related to bad
arguments when exiting (at least when the output is piped to a file
instead of running on a terminal).
Ensure that we always flush by using exit() instead of _exit().

Reported by: Tobias Bergkvist
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/2544
Signed-off-by: Helge Deller <deller@gmx.de>
3 months agoMerge tag 'pbouvier/pr/plugins-20260424' of https://gitlab.com/p-b-o/qemu into staging
Stefan Hajnoczi [Sat, 25 Apr 2026 14:22:04 +0000 (10:22 -0400)] 
Merge tag 'pbouvier/pr/plugins-20260424' of https://gitlab.com/p-b-o/qemu into staging

Changes:
- [PATCH v2 0/2] contrib/plugins/uftrace_symbols.py: fix issues to (Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>)
Link: https://lore.kernel.org/qemu-devel/20260424194451.1439316-1-pierrick.bouvier@oss.qualcomm.com
# -----BEGIN PGP SIGNATURE-----
#
# iQGzBAABCgAdFiEEN8FWlNi6l2Sxlz/btEQ30ZwoYt8FAmnsC04ACgkQtEQ30Zwo
# Yt+8ywv8D5QrLcqIfxeImZiNN1chM0qv8qs3rISMxTV7bSbgCdEWV8hZgadYqNrT
# Nnw3/ebWEZFdmtnVvSRbKAt9DKdjAAGtIMq91HNIKsAkPCaUEpRx24ccBLTeSvwx
# ZmQ1jntvcXGz+TRrp+OBzxEst/C+SeVk3pMNGVwFZhcae9ci9NDaY5RUTaQ/5U7d
# E5czK1GJUYJAUJALdXp8gpMCfdIkwMHuv1tyrTb6YZIBHGASCLDGbcy6pHWUNlqJ
# V7iMBNdP9mhSSHDmAZgO7uNnYmqNQ7rvZmkqOoPO8RkZF8nHIJydZStYyxVxUNTR
# SlnNBDGiMiUeNIqWAsEhf9wrpwxrvd7jlG4X4yuGSJkQZ5HcF3rvOeaaJUcqA555
# KnJiZNZ+nqraAgXKLHEhX3EAKW6iFGdiNzBmuwxqm52O7YGQgWywvRrnPjMTVUCu
# /MQLOX03uBZtSoX0VT7J7/pd7de0lkQxYc1QBg0Hj1o1ztzeJ0eaYoahPodirkWX
# wymbic6n
# =IZwN
# -----END PGP SIGNATURE-----
# gpg: Signature made Fri 24 Apr 2026 20:31:10 EDT
# gpg:                using RSA key 37C15694D8BA9764B1973FDBB44437D19C2862DF
# gpg: Good signature from "Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg:          There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 37C1 5694 D8BA 9764 B197  3FDB B444 37D1 9C28 62DF

* tag 'pbouvier/pr/plugins-20260424' of https://gitlab.com/p-b-o/qemu:
  contrib/plugins/uftrace_symbols.py: handle missing source line from addr2line
  contrib/plugins/uftrace_symbols.py: fix symbols reading

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
3 months agoMerge tag 'hw-misc-20260422' of https://github.com/philmd/qemu into staging
Stefan Hajnoczi [Sat, 25 Apr 2026 14:21:42 +0000 (10:21 -0400)] 
Merge tag 'hw-misc-20260422' of https://github.com/philmd/qemu into staging

Misc HW patches

- Build hw/avr/ as common unit files
- Header cleanups around 'cpu.h', 'qemu/audio.h' or duplicated lines
- Remove obsolete TPMIfClass::ppi_enabled field
- Cleanups around load/store API
- Restrict 'compat' properties API to system emulation
- Correct TPM PPCI ACPI for Windows guests on ARM Virt machine
- Simplify physical_memory_range_includes_clean()
- Avoid including CONFIG_DEVICES in hw/arm/smmuv3
- Initialize bus frequency in PPC e500 device tree blob
- More ATI VGA fixes
- Fix fuzzing issues on AVR power controller and SH4 MCU
- MAINTAINERS updates
- Machine compat array for v11.0.0 release
- USB EHCI cleanups

# -----BEGIN PGP SIGNATURE-----
#
# iQIzBAABCAAdFiEE+qvnXhKRciHc/Wuy4+MsLN6twN4FAmnrxC4ACgkQ4+MsLN6t
# wN4Qvw/9FjyoP38tsif1KtdoYm269IFNyriunJ9bh3rCyknVoA03I0tbmMlkHaNE
# UsorLSKdbvhFM5Fq4pa0xuu2bmXZMe5xxm4SHzeJF//ejOQkWqW7NJo/tTsXLhpX
# ZdkouHDM+VGhNjEnBCWQeXDECiVQNXDmDfHIMh6/ufTlF9XTr6rfIEw/uIkzw6HD
# ebCwiMQa+dBQE7WrTtSR2qkqyFN9MGqpJ9bQFgDLw/iDiRqDmZwLtKW2aFMAaPxf
# Wmlz+bvp/tIC0ZNdmGFS5mTS2SN5uP4msP/4EvE6Odcd+CapCGW0CBgXFi9M7OJD
# /4MoIhpuH8cd4wPwQZjY3Lobug8ctxItBzjZeUkQsjUrt5rtLI5+iElkEPfLdCPD
# FX6gCGZxeg7ME7C+A22ZRbXh9gpsoQhmjAn0GvAVuMkaIohPczqLilem3nAWQCEx
# tMvO+M0QIbY8W6aQUQpOLkZMbagaiz8wF3cbnvnZaA+ZrbHt6R2nz/i+H8FGww4c
# ccMoGIRmaST1uWU9t5+/DqhLAgAMuT5ZcbQmRUxHNjZXABUQoz/o0N+gTO3MGyHX
# UCI15p4PTa3pmBMBr9eRFgMbE00k9QdxAi816RlvFtXh1dBYsf5bKPsgzluN27Y2
# QwpTaSLlMTzQbFpSMLujOk+T/HMnMAUP4CMsXFOmXoTSkBLodEI=
# =bA6W
# -----END PGP SIGNATURE-----
# gpg: Signature made Fri 24 Apr 2026 15:27:42 EDT
# gpg:                using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE
# gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <f4bug@amsat.org>" [full]
# Primary key fingerprint: FAAB E75E 1291 7221 DCFD  6BB2 E3E3 2C2C DEAD C0DE

* tag 'hw-misc-20260422' of https://github.com/philmd/qemu: (62 commits)
  MAINTAINERS: Transfer CI maintenance to Pierrick
  MAINTAINERS: Maintain MIPS Boston
  MAINTAINERS: Remove PhilMD from NVMe Block Driver
  MAINTAINERS: Remove my disfunctional emails
  MAINTAINERS: Remove my unused git tree locations
  MAINTAINERS: Cover hexloader tests under the Generic Loader section
  MAINTAINERS: Merge PCIe DOE section within SPDM
  hw/usb/hcd-ehci: Introduce common properties macro for sysbus and pci
  hw/usb/hcd-ehci: Replace DPRINTF debug logs with trace events
  hw/usb/hcd-ehci.c: Replace fprintf(stderr, ...) with qemu_log_mask(LOG_GUEST_ERROR)
  hw/usb/hcd-ehci.c: Fix coding style issues reported by checkpatch
  hw/usb/hcd-ehci.h: Fix coding style issues reported by checkpatch
  hw/usb/hcd-ehci: Remove unused EHCIfstn structure and dead code
  hw/arm/virt: Do not select Kconfig symbol PCI_EXPRESS
  hw/cxl: Define cxl_fmws_get_all_sorted() stub
  hw/sh4/sh7750: Remove forgotten abort() in the MM_ITLB_DATA handler
  hw/misc: Fix the valid access size to the avr-power device
  hw/ppc/amigaone: remove duplicate include
  hw/hyperv: remove duplicate include
  hw/virtio/virtio-iommu: remove duplicate include
  ...

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
3 months agoMerge tag 'pull-hex-20260423' of https://github.com/quic/qemu into staging
Stefan Hajnoczi [Sat, 25 Apr 2026 14:21:12 +0000 (10:21 -0400)] 
Merge tag 'pull-hex-20260423' of https://github.com/quic/qemu into staging

Hexagon arch rev specific behavior

# -----BEGIN PGP SIGNATURE-----
#
# iQIzBAABCgAdFiEEPWaq5HRZSCTIjOD4GlSvuOVkbDIFAmnq1vAACgkQGlSvuOVk
# bDJW9w/9GC+x5k98AJVNz3Hf03esR3MEka7aWM6S/lqBFTq68gVJ0HOqUGBgbjtC
# ENnlh97PNuAXUg3/i3G3OM3xwUYxrjkinpAvwQzKd42yvFUk/x4bUOO/KxpqR07w
# qJXLDy9n5nW9wLR2hqPuBFd3MlGWBmteH1ZrpSFMxElgQ7/M5LNprCKzuy5PYDLr
# a+z9eRcL0MOrVWxnXE4weM2U5oCiaIC6Zk37sDen1jGrgtnlPSAyZj4L+W8qtYzN
# 1SFR1BBCxCXUmpwYvhwxsfjrXzP3I9yuDkppszKRxYE2oyBC5I20aDtet7VK89NY
# pMOxdFzLoWHbZpLDGC92EKysns1eXya/9HN262sr4aJcyMTINReBW+/jb4KPxbdk
# a+VoXyPBkAT9r2B0L+J3t6/YkoFo0CNvUjtj39AKPnPppJY9Gpgy2Wf0BbgK3akG
# s9qV8THqYNPnfFKUW8pPoTyFLa6vVrl53eJqZ9C3oChEeFs3efdCyC603ecruRWq
# 7jW43s0Zpp7CgMfBjpQRLUbui3bYPeS+L9y6+jnnlMVMj0fsXWm0MsQ0Hz0NMZqD
# jjiqRosqCt9s5i7LlKEbUQnMVkfk8hnpYqnvEnnlLttdOC088IwW5TvheSb1gYNY
# YhzPOcyYxWAbsupV9WsJXBO+Mpd2EPRHiUUVsgGIsGyUwCpHI+E=
# =7ufn
# -----END PGP SIGNATURE-----
# gpg: Signature made Thu 23 Apr 2026 22:35:28 EDT
# gpg:                using RSA key 3D66AAE474594824C88CE0F81A54AFB8E5646C32
# gpg: Good signature from "Brian Cain (OSS Qualcomm) <brian.cain@oss.qualcomm.com>" [unknown]
# gpg:                 aka "Brian Cain <bcain@kernel.org>" [unknown]
# gpg:                 aka "Brian Cain (QuIC) <bcain@quicinc.com>" [unknown]
# gpg:                 aka "Brian Cain (CAF) <bcain@codeaurora.org>" [unknown]
# gpg:                 aka "bcain" [unknown]
# gpg:                 aka "Brian Cain (QUIC) <quic_bcain@quicinc.com>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg:          There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 6350 20F9 67A7 7164 79EF  49E0 175C 464E 541B 6D47
#      Subkey fingerprint: 3D66 AAE4 7459 4824 C88C  E0F8 1A54 AFB8 E564 6C32

* tag 'pull-hex-20260423' of https://github.com/quic/qemu:
  target/hexagon: Change DisasContext packet type
  Hexagon (target/hexagon) Remove snprint_a_pkt_debug
  tests/tcg/hexagon: Add test for revision-gated instruction decoding
  Hexagon (target/hexagon) Disassembly of invalid packets
  Hexagon (target/hexagon) Check each opcode against current CPU definition
  Hexagon (target/hexagon) Introduce tag_rev_info.c.inc
  Hexagon (target/hexagon) Add Hexagon definition field to DisasContext
  Hexagon (linux-user/hexagon) Identify Hexagon version in ELF file
  Hexagon (target/hexagon) Properly handle Hexagon CPU version

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
3 months agoMerge tag 'migration-20260423-pull-request' of https://gitlab.com/farosas/qemu into...
Stefan Hajnoczi [Sat, 25 Apr 2026 14:20:29 +0000 (10:20 -0400)] 
Merge tag 'migration-20260423-pull-request' of https://gitlab.com/farosas/qemu into staging

Migration pull request

- Cleanups to internal vmstate APIs
- Cleanups to handling of vmstate flags
- New vmstate VMS_ARRAY_OF_POINTER_AUTO_ALLOC
- Fixes to:
  - functional exec test
  - leaks in file migration
  - mapped-ram migration input validation
  - programming errors in qemu-file and multifd
  - qtest leaks
- Additions to iochannel APIs:
  qio_channel_pread{v,}_all{,_eof}
  qio_channel_pwrite{v,}_all
- New migration qtest for capabilities validation
- Tweaks to documentation and checkpatch

# -----BEGIN PGP SIGNATURE-----
#
# iQJEBAABCAAuFiEEqhtIsKIjJqWkw2TPx5jcdBvsMZ0FAmnqar8QHGZhcm9zYXNA
# c3VzZS5kZQAKCRDHmNx0G+wxnQZzEACJcMspEO21PClDOwkhyqjIT0j2Xmyhe+B9
# OZkl42SnbXsKNDdORIKJ2U9oG2v+vzWccEMSqjV0jFyQJzrUfEvA0V2i5eH/zXuW
# jUTgrOO5nbwbvPUk4BXGxnplRwB2BrKgjQ62WDgLEn/ZeW9KxUOuNcUCvAtJnljY
# WFYOFn5oeV41TdGj7H5w7fzwYDsRYMUAB9lbr4MnRynSVq2aWrf+ddJpbPhC03fZ
# t6hMyhIT3SnELMw1hnIOGbkYJn5gCHme6cnyMOUrnU/ws+2lExEL4X11sSCexRbo
# N9zpJfi2U/wfiKrHPjUZ7InavaJm47WvzOQ1eC2I0v5xWY5G3wgvFJ9PAm3gtgr/
# n0QYf4xWpJ2rZDnFvKepXRqcndhNa6VYAhs4v2qVBH/9mSjhKHEqLMza6llZ/d/W
# 4ovHK3OQp0NUDWkBmjYUEu/JCusKrWLMdzosm75Z0Vs/cG4ks4s5zb47NIFjFsnT
# WWIK6dAi+27eiZ7BMflVx6La2DAFBc9b8jpO1Rxi3VyN2J7LTzXWIqshJ1Rap6wb
# kNtVjQOtsLdURX6tKLthdzY1M7mgYm+W12l94X9OTZHZUcQwoYKO0P7FJ4YdKDh/
# lPEkAg5um66drxPM268E4jLBxzRWxhPz5SPgv2qeXRO9vkm6G2mapgQtWb00Ta4P
# CitNkhqk0A==
# =3vDa
# -----END PGP SIGNATURE-----
# gpg: Signature made Thu 23 Apr 2026 14:53:51 EDT
# gpg:                using RSA key AA1B48B0A22326A5A4C364CFC798DC741BEC319D
# gpg:                issuer "farosas@suse.de"
# gpg: Good signature from "Fabiano Rosas <farosas@suse.de>" [unknown]
# gpg:                 aka "Fabiano Almeida Rosas <fabiano.rosas@suse.com>" [unknown]
# gpg: WARNING: The key's User ID is not certified with a trusted signature!
# gpg:          There is no indication that the signature belongs to the owner.
# Primary key fingerprint: AA1B 48B0 A223 26A5 A4C3  64CF C798 DC74 1BEC 319D

* tag 'migration-20260423-pull-request' of https://gitlab.com/farosas/qemu: (43 commits)
  migration/qemu-file: drop incorrect const from qemu_get_buffer_at buf
  migration/file: switch file_write_ramblock_iov to pwritev_all
  migration/qemu-file: switch buffer_at functions to positioned I/O _all helpers
  tests/qtest/migration: fix fd leak in ufd_version_check
  tests/unit: add pread/pwrite _all tests for io channel file
  migration/file: fix type mismatch and NULL deref in multifd_file_recv_data
  io/channel: introduce qio_channel_pwrite{v,}_all()
  io/channel: introduce qio_channel_pread{v, }_all{, _eof}()
  migration: validate page_size in mapped-ram header before use
  tests/unit/test-vmstate: add tests for VMS_ARRAY_OF_POINTER_AUTO_ALLOC
  vmstate: Stop checking size for nullptr compression
  vmstate: Implement VMS_ARRAY_OF_POINTER_AUTO_ALLOC
  vmstate: Implement load of ptr marker in vmstate core
  vmstate: Allow vmstate_info_nullptr to emit non-NULL markers
  vmstate: Introduce vmstate_save_field_with_vmdesc()
  vmstate: Rename VMS_NULLPTR_MARKER to VMS_MARKER_PTR_NULL
  vmstate: Update max_elems early and check field compressable once
  vmstate: Do not set size for VMS_ARRAY_OF_POINTER
  vmstate: Pass in struct itself for VMSTATE_VARRAY_OF_POINTER_UINT32
  vmstate: Pass in struct itself for VMSTATE_ARRAY_OF_POINTER
  ...

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
3 months agocontrib/plugins/uftrace_symbols.py: handle missing source line from addr2line
Pierrick Bouvier [Fri, 24 Apr 2026 19:44:50 +0000 (12:44 -0700)] 
contrib/plugins/uftrace_symbols.py: handle missing source line from addr2line

Some symbols have only a file information, and no line information. In
this case, addr2line reports '?'. Replace with 0 to guarantee consistent
data for consumers.

Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Link: https://lore.kernel.org/qemu-devel/20260424194451.1439316-3-pierrick.bouvier@oss.qualcomm.com
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
3 months agocontrib/plugins/uftrace_symbols.py: fix symbols reading
Pierrick Bouvier [Fri, 24 Apr 2026 19:44:49 +0000 (12:44 -0700)] 
contrib/plugins/uftrace_symbols.py: fix symbols reading

When running this on hexagon binary, we observe some undefined symbols
without any address or size.

Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Link: https://lore.kernel.org/qemu-devel/20260424194451.1439316-2-pierrick.bouvier@oss.qualcomm.com
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
3 months agolinux-user: Use abi_int for imr_ifindex in ip_mreqn struct
Helge Deller [Fri, 24 Apr 2026 15:21:01 +0000 (17:21 +0200)] 
linux-user: Use abi_int for imr_ifindex in ip_mreqn struct

Peter Hartley noticed, that in the qemu code the imr_ifindex member of
struct target_ip_mreq needs to be of type "int" instead of "long", which
is what the Linux kernel uses on all architectures.

Adjust the type accordingly, and add a QEMU_BUILD_BUG_ON() checker to
prevent such issues in the future.

This change should fix multicast issues when using hosts and guests with
different endianess or bit size.

Reported-by: Peter Hartley <peter@talesfromthearmchair.net>
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/2553
Signed-off-by: Helge Deller <deller@gmx.de>
3 months agolinux-user: Fix CLONE_PARENT_SETTID when using fork-like clone
Helge Deller [Fri, 24 Apr 2026 13:17:28 +0000 (15:17 +0200)] 
linux-user: Fix CLONE_PARENT_SETTID when using fork-like clone

The CLONE_PARENT_SETTID option requires the implementation to store the
child thread ID at the location pointed to by parent_tid in the parent's
memory.

Fix our implementation and move the code from the client side (where
fork returned 0), to the parent side and store the return value from the
fork call (which is the client TID) in the parent_tid pointer.

Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3340
Signed-off-by: Helge Deller <deller@gmx.de>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
3 months agolinux-user: Add getsockopt() for SO_RCVTIMEO_NEW and SO_SNDTIMEO_NEW
Helge Deller [Fri, 24 Apr 2026 08:51:32 +0000 (10:51 +0200)] 
linux-user: Add getsockopt() for SO_RCVTIMEO_NEW and SO_SNDTIMEO_NEW

Add handlers for both sockopts which use 64-bit time_t from userspace.

Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/885
Signed-off-by: Helge Deller <deller@gmx.de>
3 months agolinux-user: Add setsockopt() for SO_RCVTIMEO_NEW and SO_SNDTIMEO_NEW
Helge Deller [Fri, 24 Apr 2026 08:25:34 +0000 (10:25 +0200)] 
linux-user: Add setsockopt() for SO_RCVTIMEO_NEW and SO_SNDTIMEO_NEW

Add handlers for both sockopts which use 64-bit time_t from userspace.

Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/885
Signed-off-by: Helge Deller <deller@gmx.de>
3 months agolinux-user: Define SO_TIMESTAMP*_NEW and SO_RCVTIMEIO_NEW
Helge Deller [Fri, 24 Apr 2026 08:23:02 +0000 (10:23 +0200)] 
linux-user: Define SO_TIMESTAMP*_NEW and SO_RCVTIMEIO_NEW

Define the entries which always use the 64-bit timestamps.

Signed-off-by: Helge Deller <deller@gmx.de>
3 months agolinux-user/mips: sync k0 TLS for EF_MIPS_MACH_OCTEON userlands
James Hilliard [Fri, 10 Apr 2026 02:00:12 +0000 (20:00 -0600)] 
linux-user/mips: sync k0 TLS for EF_MIPS_MACH_OCTEON userlands

Cavium Octeon userspace is not following a generic MIPS Linux TLS
ABI rule here. Older Octeon glibc uses the k0 register as the fast
thread pointer, while newer Octeon2 and Octeon3 glibc variants use
the normal rdhwr $29 path.

linux-user already updates CP0_UserLocal for cpu_set_tls() and
TARGET_NR_set_thread_area, but it does not keep gpr[26]
synchronized. That leaves EF_MIPS_MACH_OCTEON userlands able to
complete set_thread_area() and still reach pthread startup or
pthread_self() with a stale k0 value.

Use the existing MIPS ELF machine flags from linux-user/elfload.c and
mirror CP0_UserLocal into gpr[26] only for EF_MIPS_MACH_OCTEON.

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Helge Deller <deller@gmx.de>
3 months agolinux-user/strace: Use pointer type for read and write values
Alistair Francis [Wed, 15 Apr 2026 23:37:38 +0000 (09:37 +1000)] 
linux-user/strace: Use pointer type for read and write values

The stack pointer is being truncated as 32-bits for qemu-riscv64, so
let's use %p to print the syscall pointer argument.

Cc: qemu-stable@nongnu.org
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3238
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Nutty Liu <nutty.liu@hotmail.com>
Signed-off-by: Helge Deller <deller@gmx.de>
3 months agolinux-user/arm/nwfpe: Use thread-local storage for qemufpa
Richard Henderson [Mon, 13 Apr 2026 23:02:51 +0000 (09:02 +1000)] 
linux-user/arm/nwfpe: Use thread-local storage for qemufpa

Fix the thread safety of the emulation by not storing a
pointer in global storage.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Helge Deller <deller@gmx.de>
3 months agolinux-user/arm/nwfpe: Replace user_registers with current_cpu
Richard Henderson [Mon, 13 Apr 2026 23:02:50 +0000 (09:02 +1000)] 
linux-user/arm/nwfpe: Replace user_registers with current_cpu

Use the thread-local variable current_cpu instead of
a global variable to access the general registers.
This also means we don't need to pass env to EmulateAll.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Helge Deller <deller@gmx.de>
3 months agolinux-user: Don't define target_stat64 struct for loongarch64
Gyorgy Tamasi [Wed, 8 Apr 2026 18:17:54 +0000 (20:17 +0200)] 
linux-user: Don't define target_stat64 struct for loongarch64

The kernel defines 'struct stat64' only if
__BITS_PER_LONG != 64 || defined(__ARCH_WANT_STAT64).
loongarch64 doesn't set __ARCH_WANT_STAT64, and it isn't 32-bit,
so it won't get this struct.

QEMU incorrectly does define a target_stat64 struct. However this
isn't causing any guest-visible problems, because defining the
target_stat64 struct and TARGET_HAS_STRUCT_STAT64 affects these
syscalls:
 TARGET_NR_stat64
 TARGET_NR_lstat64
 TARGET_NR_fstat64
 TARGET_NR_fstatat64
 TARGET_NR_newfstatat

For loongarch64 the only one of those we provide is newfstatat,
and that is actually a separate QEMU bug, because the kernel does
not provide that syscall for this architecture. No real guest
code will be using a syscall that doesn't exist in the ABI.

(Some of these syscalls are present in the loongarch64 "ABI1.0",
but that ABI was never accepted in the upstream kernel, and
QEMU does not model that ABI, only the "ABI2.0".)

Stop defining TARGET_HAS_STRUCT_STAT64 anyway, for consistency
with the kernel and to avoid confusion.

Note:
Commit message suggested by Peter Maydell <peter.maydell@linaro.org>

Signed-off-by: Gyorgy Tamasi <gyorgy.tamasi@gmail.com>
Tested-by: Gyorgy Tamasi <gyorgy.tamasi@gmail.com>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Helge Deller <deller@gmx.de>
3 months agolinux-user: fix off-by-one in host_to_target_for_each_rtattr()
Yixin Wei [Thu, 9 Apr 2026 16:49:38 +0000 (17:49 +0100)] 
linux-user: fix off-by-one in host_to_target_for_each_rtattr()

host_to_target_for_each_rtattr() uses "len > sizeof(struct rtattr)"
as its loop condition. When the last rtattr in a netlink message has
exactly sizeof(struct rtattr) (4) bytes remaining, the loop exits
without byte-swapping its rta_len and rta_type. A big-endian guest
then reads rta_len in the wrong byte order and fails validation.

The companion function target_to_host_for_each_rtattr() correctly
uses ">=" (added in commit fa2229dbf8). The kernel's RTA_OK macro
also uses ">=". Fix the host_to_target direction to match.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2485
Signed-off-by: Yixin Wei <yixinwei@meta.com>
Fixes: 6c5b5645ae0 ("linux-user: add rtnetlink(7) support")
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Helge Deller <deller@gmx.de>
Cc: qemu-stable@nongnu.org
3 months agolinux-user/ppc: Fix ppc64 rt_sigframe stack offset
Matt Turner [Thu, 16 Apr 2026 18:25:27 +0000 (14:25 -0400)] 
linux-user/ppc: Fix ppc64 rt_sigframe stack offset

The kernel's 64-bit signal delivery (signal_64.c) uses:

    newsp = frame - __SIGNAL_FRAMESIZE

while the 32-bit path (signal_32.c) uses:

    newsp = frame - (__SIGNAL_FRAMESIZE + 16)

The extra 16 bytes in the 32-bit case is to place siginfo and ucontext
at the same offsets as older kernels (see the comment in signal_32.c).
The 64-bit rt_sigframe starts with ucontext directly and does not need
this adjustment.

QEMU's setup_rt_frame() unconditionally used (SIGNAL_FRAMESIZE + 16)
for both 32-bit and 64-bit, placing the handler's SP 16 bytes too low
on ppc64. Signal delivery and return still worked because do_rt_sigreturn
had the matching wrong offset, but the vDSO DWARF unwind info encodes
the correct kernel offset. This caused any DWARF unwinder (libunwind,
libgcc, etc.) to compute a CFA that is 16 bytes off, reading garbage
register values from the signal frame.

Define RT_SIGFRAME_ADJUST (0 on ppc64, 16 on ppc32) and use it in both
setup_rt_frame and do_rt_sigreturn to match the kernel.

This was verified by A/B testing with libunwind's test suite:

  ppc64le: Gtest-bt, Ltest-bt, Gtest-concurrent, Ltest-concurrent,
           and Ltest-sig-context all change from FAIL to PASS.
  ppc64be: Gtest-bt, Ltest-bt, and Ltest-sig-context all change
           from FAIL to PASS.

Signed-off-by: Matt Turner <mattst88@gmail.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Helge Deller <deller@gmx.de>
Cc: qemu-stable@nongnu.org
3 months agoMAINTAINERS: Add myself as maintainer for linux-user
Helge Deller [Thu, 23 Apr 2026 15:10:34 +0000 (17:10 +0200)] 
MAINTAINERS: Add myself as maintainer for linux-user

I'd like to step up as maintainer for linux-user. I'm actively using
linux-user to emulate a HP-PARISC (hppa) linux environment on my debian
buildd servers, so I'm very much interested that linux-user is running
good and stable.

Signed-off-by: Helge Deller <deller@gmx.de>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
3 months agoMAINTAINERS: Transfer CI maintenance to Pierrick
Philippe Mathieu-Daudé [Fri, 17 Apr 2026 10:38:45 +0000 (12:38 +0200)] 
MAINTAINERS: Transfer CI maintenance to Pierrick

Pass the torch to Pierrick who does much better and useful
work in this area: https://github.com/p-b-o/qemu-ci

Remove me from custom runner files since I don't have
contact with OSUOSL or IBM.

Cc: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-Id: <20260422080406.62638-11-philmd@linaro.org>

3 months agoMAINTAINERS: Maintain MIPS Boston
Philippe Mathieu-Daudé [Fri, 17 Apr 2026 10:22:36 +0000 (12:22 +0200)] 
MAINTAINERS: Maintain MIPS Boston

Maintain the Boston board as just another MIPS board.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-Id: <20260422080406.62638-4-philmd@linaro.org>

3 months agoMAINTAINERS: Remove PhilMD from NVMe Block Driver
Philippe Mathieu-Daudé [Fri, 17 Apr 2026 10:38:24 +0000 (12:38 +0200)] 
MAINTAINERS: Remove PhilMD from NVMe Block Driver

I'm not following this code anymore, no need
to be listed as reviewer.

My gratitude to Stefan for everything he taught me while
supervising this topic. I truly appreciate the time he spent
helping me in many occasions. Thank you very much Stefan!

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-Id: <20260422080406.62638-8-philmd@linaro.org>

3 months agoMAINTAINERS: Remove my disfunctional emails
Philippe Mathieu-Daudé [Wed, 22 Apr 2026 07:26:59 +0000 (09:26 +0200)] 
MAINTAINERS: Remove my disfunctional emails

With retrospective, mentioning email in authorship wasn't
really useful, more now than these addresses are dead:
 - f4bug@amsat.org
 - philmd@redhat.com
Simply remove them.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20260422080406.62638-3-philmd@linaro.org>

3 months agoMAINTAINERS: Remove my unused git tree locations
Philippe Mathieu-Daudé [Wed, 22 Apr 2026 07:33:05 +0000 (09:33 +0200)] 
MAINTAINERS: Remove my unused git tree locations

I haven't used these for years. And as explained in [*]
QEMU development workflow doesn't leverage subsystem's
git trees. Remove them.

[*] https://lore.kernel.org/qemu-devel/CAFEAcA9xCN6XMUFmZ_QAn617W14FAzi4D_H1mgSER10otTtQMQ@mail.gmail.com/

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-Id: <20260422080406.62638-2-philmd@linaro.org>

3 months agoMAINTAINERS: Cover hexloader tests under the Generic Loader section
Philippe Mathieu-Daudé [Fri, 17 Apr 2026 10:29:13 +0000 (12:29 +0200)] 
MAINTAINERS: Cover hexloader tests under the Generic Loader section

Drop the orphan 'Intel Hexadecimal Object File Loader' section
but keep the tests covered under the Generic Loader section, since
both loader.c and generic-loader.c calls load_targphys_hex_as().

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20260422080406.62638-7-philmd@linaro.org>

3 months agoMAINTAINERS: Merge PCIe DOE section within SPDM
Philippe Mathieu-Daudé [Fri, 17 Apr 2026 10:26:22 +0000 (12:26 +0200)] 
MAINTAINERS: Merge PCIe DOE section within SPDM

SPDM depends on PCIe DOE, so it makes sense to cover
these files there. Cover the spdm.rst document. Add
Tao Tang who volunteered to be designated reviewer:
https://lore.kernel.org/qemu-devel/44abaece-6a6f-43c6-b29a-53d6eb08033c@phytium.com.cn/

Cc: Tao Tang <tangtao1634@phytium.com.cn>
Cc: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Gustavo Romero <gustavo.romero@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20260422080406.62638-6-philmd@linaro.org>

3 months agohw/usb/hcd-ehci: Introduce common properties macro for sysbus and pci
Jamin Lin [Thu, 23 Apr 2026 05:18:14 +0000 (07:18 +0200)] 
hw/usb/hcd-ehci: Introduce common properties macro for sysbus and pci

EHCI properties are currently defined separately in both sysbus and
PCI implementations, leading to duplicated code for common fields
such as "maxframes".

Introduce DEFINE_EHCI_COMMON_PROPERTIES() to consolidate shared
property definitions and reuse them across both EHCISysBusState
and EHCIPCIState.

This reduces code duplication and keeps property definitions
consistent between different EHCI device variants.

No functional change.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20260424080508.53992-8-jamin_lin@aspeedtech.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
3 months agohw/usb/hcd-ehci: Replace DPRINTF debug logs with trace events
Jamin Lin [Thu, 23 Apr 2026 05:18:13 +0000 (07:18 +0200)] 
hw/usb/hcd-ehci: Replace DPRINTF debug logs with trace events

Replace legacy DPRINTF() debug logging in the EHCI host controller
implementation with QEMU trace events.

The EHCI_DEBUG macro and associated DPRINTF() definitions are
removed as they are no longer needed.

Trace events are added for:
- packet submission and completion
- queue head execution state
- periodic schedule advancement
- ITD error conditions
- port state handling
- skipped microframes

No functional change.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20260424080508.53992-7-jamin_lin@aspeedtech.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
3 months agohw/usb/hcd-ehci.c: Replace fprintf(stderr, ...) with qemu_log_mask(LOG_GUEST_ERROR)
Jamin Lin [Thu, 23 Apr 2026 05:18:11 +0000 (07:18 +0200)] 
hw/usb/hcd-ehci.c: Replace fprintf(stderr, ...) with qemu_log_mask(LOG_GUEST_ERROR)

Replace direct fprintf(stderr, ...) calls with qemu_log_mask()
using LOG_GUEST_ERROR in the EHCI controller implementation.

Direct writes to stderr are discouraged in QEMU as they bypass
the logging framework and cannot be filtered or controlled at
runtime. Using qemu_log_mask() ensures that guest-visible errors
are properly categorized and can be managed via QEMU logging
options.

All affected messages correspond to guest-triggerable error
conditions, so LOG_GUEST_ERROR is used consistently.

This change improves integration with QEMU's logging infrastructure
and aligns with upstream coding guidelines.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Message-ID: <20260424080508.53992-6-jamin_lin@aspeedtech.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
3 months agohw/usb/hcd-ehci.c: Fix coding style issues reported by checkpatch
Jamin Lin [Wed, 11 Mar 2026 07:26:18 +0000 (08:26 +0100)] 
hw/usb/hcd-ehci.c: Fix coding style issues reported by checkpatch

No functional change.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20260424080508.53992-5-jamin_lin@aspeedtech.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
3 months agohw/usb/hcd-ehci.h: Fix coding style issues reported by checkpatch
Jamin Lin [Wed, 11 Mar 2026 07:26:17 +0000 (08:26 +0100)] 
hw/usb/hcd-ehci.h: Fix coding style issues reported by checkpatch

No functional change.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20260424080508.53992-4-jamin_lin@aspeedtech.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
3 months agohw/usb/hcd-ehci: Remove unused EHCIfstn structure and dead code
Jamin Lin [Fri, 24 Apr 2026 08:05:12 +0000 (08:05 +0000)] 
hw/usb/hcd-ehci: Remove unused EHCIfstn structure and dead code

The EHCIfstn structure, defined according to EHCI spec section 3.7,
is currently unused in the EHCI implementation. Remove it to reduce
unused code and improve maintainability.

Additionally, drop a block of disabled (#if 0) code in
ehci_state_advqueue() that was never implemented. This code path
is incomplete and has no functional impact.

No functional change.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Message-ID: <20260424080508.53992-3-jamin_lin@aspeedtech.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
3 months agohw/arm/virt: Do not select Kconfig symbol PCI_EXPRESS
Philippe Mathieu-Daudé [Wed, 22 Apr 2026 09:22:31 +0000 (11:22 +0200)] 
hw/arm/virt: Do not select Kconfig symbol PCI_EXPRESS

The PCIe bus is not provided by the Virt machine but by
its GPEX host bridge (selected via PCI_EXPRESS_GENERIC_BRIDGE).

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20260423170229.64655-4-philmd@linaro.org>

3 months agohw/cxl: Define cxl_fmws_get_all_sorted() stub
Philippe Mathieu-Daudé [Wed, 22 Apr 2026 09:11:09 +0000 (11:11 +0200)] 
hw/cxl: Define cxl_fmws_get_all_sorted() stub

Add a stub for cxl_fmws_get_all_sorted() to fix building
a QEMU configured with the '--without-default-devices' option:

  Undefined symbols for architecture arm64:
    "_cxl_fmws_get_all_sorted", referenced from:
        _cxl_build_cedt in hw_acpi_cxl.c.o

Note, the CXL <-> ACPI Kconfig relationship is a bit convoluted.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20260423170229.64655-3-philmd@linaro.org>

3 months agohw/sh4/sh7750: Remove forgotten abort() in the MM_ITLB_DATA handler
Thomas Huth [Wed, 22 Apr 2026 07:54:29 +0000 (09:54 +0200)] 
hw/sh4/sh7750: Remove forgotten abort() in the MM_ITLB_DATA handler

QEMU currently aborts when the guest writes to the MM_ITLB_DATA register:

 echo "writel 0xf3000000 0x11223344" | \
  ./qemu-system-sh4 -M r2d -display none -accel qtest -qtest stdio
 [I 0.000000] OPENED
 [R +0.004476] writel 0xf3000000 0x11223344
 Aborted                    (core dumped)

Looking at the history of the code, the abort() here has likely just
been forgotten when the register handler had been implemented (it used
to be a reminder about unimplemented functionality initially):

 https://gitlab.com/qemu-project/qemu/-/commit/9f97309a70f12df5f9104f1f

Thus simply remove the abort() now to get rid of the problem.

Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3420
Signed-off-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20260422075429.341409-1-thuth@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
3 months agohw/misc: Fix the valid access size to the avr-power device
Thomas Huth [Tue, 21 Apr 2026 08:29:35 +0000 (10:29 +0200)] 
hw/misc: Fix the valid access size to the avr-power device

Accessing the device with in non-single byte mode currently causes
QEMU to abort:

 $ echo "writew 0x800064 0x4142" | \
   ./qemu-system-avr -M mega2560 -display none -qtest stdio -accel qtest
 [I 0.000000] OPENED
 [R +0.001784] writew 0x800064 0x4142
 qemu-system-avr: ../../devel/qemu/hw/misc/avr_power.c:58: avr_mask_write:
  Assertion `offset == 0' failed.
 Aborted                    (core dumped)

Set the valid max access size to 1 to fix the problem.

Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3393
Signed-off-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20260421082935.85995-1-thuth@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
3 months agohw/ppc/amigaone: remove duplicate include
Osama Abdelkader [Mon, 20 Apr 2026 16:40:58 +0000 (18:40 +0200)] 
hw/ppc/amigaone: remove duplicate include

hw/ppc/ppc.h is included twice

Signed-off-by: Osama Abdelkader <osama.abdelkader@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: BALATON Zoltan <balaton@eik.bme.hu>
Message-ID: <20260420164058.335872-1-osama.abdelkader@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
3 months agohw/hyperv: remove duplicate include
Osama Abdelkader [Mon, 20 Apr 2026 16:34:53 +0000 (18:34 +0200)] 
hw/hyperv: remove duplicate include

exec/target_page.h is included twice

Signed-off-by: Osama Abdelkader <osama.abdelkader@gmail.com>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
Message-ID: <20260420163452.327350-2-osama.abdelkader@gmail.com>
Reviewed-by: Maciej S. Szmigiero <maciej.szmigiero@oracle.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20260420163844.332663-1-osama.abdelkader@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
3 months agohw/virtio/virtio-iommu: remove duplicate include
Osama Abdelkader [Mon, 20 Apr 2026 16:30:50 +0000 (18:30 +0200)] 
hw/virtio/virtio-iommu: remove duplicate include

qemu/reserved-region.h is included twice

Signed-off-by: Osama Abdelkader <osama.abdelkader@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20260420163050.321668-1-osama.abdelkader@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
3 months agohw/arm, hw/ppc: Remove unnecessary audio.h includes from board code
Peter Maydell [Fri, 17 Apr 2026 09:38:05 +0000 (10:38 +0100)] 
hw/arm, hw/ppc: Remove unnecessary audio.h includes from board code

Some boards (mostly arm, but also ppc/prep) include audio.h, but they
don't need anything from it.  Drop the unnecessary include lines.

These seem to have been introduced with commits 2b16397264a8e,
b8ab0303de, which added the machine-default audiodev handling, but as
far as I can tell they were unecessary right from the start, as the
machine_add_audiodev_property() function has always been in boards.h.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20260417093805.1076954-1-peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
3 months agoati-vga: mask out lock bit from CUR_OFFSET in cursor offset calculation
Junjie Cao [Tue, 14 Apr 2026 21:35:23 +0000 (05:35 +0800)] 
ati-vga: mask out lock bit from CUR_OFFSET in cursor offset calculation

Bit 31 of CUR_OFFSET is the cursor lock bit, not part of the actual
cursor address (bits 26:4).  Although the callers already check for the
lock bit and return early, mask it out with 0x07fffff0 when computing
the cursor source offset so the calculation only uses the address bits.

Suggested-by: BALATON Zoltan <balaton@eik.bme.hu>
Signed-off-by: Junjie Cao <junjie.cao@intel.com>
Reviewed-by: BALATON Zoltan <balaton@eik.bme.hu>
Message-ID: <20260414213523.1125859-2-junjie.cao@intel.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
3 months agoati-vga: fix unsigned integer overflow in cursor bounds checks
Junjie Cao [Tue, 14 Apr 2026 14:14:58 +0000 (22:14 +0800)] 
ati-vga: fix unsigned integer overflow in cursor bounds checks

The cursor bounds checks compare (srcoff + N) against vram_size, but
both sides are uint32_t so the addition can wrap past UINT32_MAX when
srcoff underflows from the cur_hv_offs subtraction, causing the check
to be bypassed.

Rewrite the checks as (srcoff > vram_size - N) to avoid the
overflow-prone addition, matching the style already used in
ati_mm_read() and ati_mm_write().

Cc: qemu-stable@nongnu.org
Fixes: 2f1fbe6ee9b5 ("ati-vga: Make sure hardware cursor data is within vram")
Signed-off-by: Junjie Cao <junjie.cao@intel.com>
Message-ID: <20260414141458.1076014-1-junjie.cao@intel.com>
Reviewed-by: BALATON Zoltan <balaton@eik.bme.hu>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
3 months agohw/ppc/e500: fix bus-frequency property hardcoded to zero in CPU FDT node
Vivien LEGER [Sat, 11 Apr 2026 15:45:35 +0000 (17:45 +0200)] 
hw/ppc/e500: fix bus-frequency property hardcoded to zero in CPU FDT node

The bus-frequency property in the CPU FDT node was hardcoded to 0.
This is incorrect - it should reflect the actual platform bus clock
frequency, as firmware and RTOSes use it to derive peripheral clock
rates.

Notably, the RTEMS QorIQ BSP uses bus-frequency to program the MPIC
global timer interval. With bus-frequency=0, the timer interval
overflows to ~85 seconds, preventing any clock interrupts from firing.

Fix by adding a bus_freq field to PPCE500MachineClass and using it in
the FDT generator. Set bus_freq = PLATFORM_CLK_FREQ_HZ (400MHz) for
existing machines, matching the existing clock_freq value.

Signed-off-by: Vivien LEGER <vivien.leger@gmail.com>
Reviewed-by: Bernhard Beschow <shentey@gmail.com>
Message-ID: <20260411154535.1451361-1-vivien.leger@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
3 months agohw/arm/smmuv3: Avoid including CONFIG_DEVICES in hw/ header
Philippe Mathieu-Daudé [Tue, 10 Mar 2026 11:06:19 +0000 (12:06 +0100)] 
hw/arm/smmuv3: Avoid including CONFIG_DEVICES in hw/ header

By turning the inline functions into stubs we can avoid the
use of target-specific CONFIG_DEVICES include in a hw/ header,
allowing to build the source files including it as common objects.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Shameer Kolothum <skolothumtho@nvidia.com>
Message-Id: <20260410200031.18572-3-philmd@linaro.org>

3 months agohw/arm/smmuv3: Have smmuv3_accel_init() take an Error* parameter
Philippe Mathieu-Daudé [Thu, 9 Apr 2026 11:35:56 +0000 (13:35 +0200)] 
hw/arm/smmuv3: Have smmuv3_accel_init() take an Error* parameter

By giving smmuv3_accel_init() the ability to populate an error,
we can fail early in smmu_realize() when CONFIG_ARM_SMMUV3_ACCEL
is not available, simplifying smmu_validate_property().

Suggested-by: Shameer Kolothum Thodi <skolothumtho@nvidia.com>
Co-developed-by: Shameer Kolothum Thodi <skolothumtho@nvidia.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Shameer Kolothum <skolothumtho@nvidia.com>
Message-Id: <20260410200031.18572-2-philmd@linaro.org>

3 months agophysmem: Simplify dirty memory type checks with loop
Bin Guo [Wed, 1 Apr 2026 10:00:05 +0000 (18:00 +0800)] 
physmem: Simplify dirty memory type checks with loop

In physical_memory_range_includes_clean(), we have three nearly identical
if-statements checking different DIRTY_MEMORY types (VGA, CODE, MIGRATION).
This code duplication makes maintenance harder and increases the risk of
inconsistencies when adding new dirty memory types.

Replace the repetitive checks with a simple loop that iterates through
all DIRTY_MEMORY_NUM types, checking only those specified in the mask.
This reduces code size and makes it easier to add new dirty memory types
in the future.

Signed-off-by: Bin Guo <guobin@linux.alibaba.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20260401100005.20651-1-guobin@linux.alibaba.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
3 months agohw/tpm: add PPI support to tpm-tis-device for ARM64 virt
Mohammadfaiz Bawa [Fri, 27 Mar 2026 17:32:09 +0000 (23:02 +0530)] 
hw/tpm: add PPI support to tpm-tis-device for ARM64 virt

Add PPI memory region and ACPI _STA, _DSM to tpm-tis-sysbus so
Windows 11 ARM64 guests no longer log Event ID 15 errors from
tpm.sys on every boot.

Reviewed-by: Stefan Berger <stefanb@linux.ibm.com>
Signed-off-by: Mohammadfaiz Bawa <mbawa@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20260327173209.148180-4-mbawa@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
3 months agohw/acpi/tpm: parameterize PPI base address in tpm_build_ppi_acpi
Mohammadfaiz Bawa [Fri, 27 Mar 2026 17:32:08 +0000 (23:02 +0530)] 
hw/acpi/tpm: parameterize PPI base address in tpm_build_ppi_acpi

Add a ppi_base parameter to tpm_build_ppi_acpi() instead of
hardcoding TPM_PPI_ADDR_BASE. This prepares for ARM64 support where
PPI memory is dynamically allocated by the platform bus and the
address is not known at compile time.

Update the x86 callers (ISA TIS and CRB) to pass TPM_PPI_ADDR_BASE
explicitly. No behavioral change.

Reviewed-by: Stefan Berger <stefanb@linux.ibm.com>
Signed-off-by: Mohammadfaiz Bawa <mbawa@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20260327173209.148180-3-mbawa@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
3 months agodocs/specs/tpm: document PPI support on ARM64 virt
Mohammadfaiz Bawa [Fri, 27 Mar 2026 17:32:07 +0000 (23:02 +0530)] 
docs/specs/tpm: document PPI support on ARM64 virt

Document that tpm-tis-device on the ARM virt machine supports PPI
with dynamically allocated MMIO via the platform bus, unlike x86
where PPI is at the fixed address 0xFED45000.

Also add hw/arm/virt-acpi-build.c and hw/acpi/tpm.c to the list
of files related to TPM ACPI tables.

Reviewed-by: Stefan Berger <stefanb@linux.ibm.com>
Signed-off-by: Mohammadfaiz Bawa <mbawa@redhat.com>
Message-ID: <20260327173209.148180-2-mbawa@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
3 months agoqom: Restrict compat properties API to system emulation
Philippe Mathieu-Daudé [Wed, 25 Mar 2026 14:47:12 +0000 (15:47 +0100)] 
qom: Restrict compat properties API to system emulation

Move compat properties API definitions to their own file
unit, compile it only when system emulation is configured.
Add a pair of stubs for user emulation.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Message-Id: <20260325151728.45378-6-philmd@linaro.org>

3 months agoqom: Declare compat properties API in 'qom/compat-properties.h'
Philippe Mathieu-Daudé [Wed, 25 Mar 2026 14:47:02 +0000 (15:47 +0100)] 
qom: Declare compat properties API in 'qom/compat-properties.h'

While most of QEMU files use the QOM concept, few of them
use the compatibility properties API (mostly use in system
emulation). Move its prototype to a new "qom/compat-properties.h"
header, keeping "qom/object.h" for generic QOM.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Message-Id: <20260325151728.45378-5-philmd@linaro.org>

3 months agoqom: Declare GlobalProperty structure in 'qom/compat-properties.h'
Philippe Mathieu-Daudé [Wed, 25 Mar 2026 14:44:40 +0000 (15:44 +0100)] 
qom: Declare GlobalProperty structure in 'qom/compat-properties.h'

While GlobalProperty is expected to only be used by QDev board
layer, it is used by the lower QOM API, so define it in the
qom/ namespace. This helps to build binary which use QOM but
don't need the QDev layer.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Message-Id: <20260325151728.45378-4-philmd@linaro.org>

3 months agohw/core: Move compat_props_add() to 'hw/core/boards.h'
Philippe Mathieu-Daudé [Wed, 25 Mar 2026 14:43:15 +0000 (15:43 +0100)] 
hw/core: Move compat_props_add() to 'hw/core/boards.h'

compat_props_add() is only used by board models, no need
to expose it to any device model. Restrict by defining it
only in "hw/core/boards.h".

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Message-Id: <20260325151728.45378-3-philmd@linaro.org>

3 months agohw: add compat machines for 11.1
Cornelia Huck [Tue, 31 Mar 2026 14:03:47 +0000 (16:03 +0200)] 
hw: add compat machines for 11.1

Add 11.1 machine types for arm/i440fx/m68k/q35/s390x/spapr.

Reviewed-by: Eric Farman <farman@linux.ibm.com> # s390
Signed-off-by: Cornelia Huck <cohuck@redhat.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20260331140347.653404-1-cohuck@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
3 months agosystem/memory: Constify various AddressSpace arguments (flatview)
Philippe Mathieu-Daudé [Thu, 19 Mar 2026 12:26:31 +0000 (13:26 +0100)] 
system/memory: Constify various AddressSpace arguments (flatview)

Mark the AddressSpace structure const when it is only accessed
read-only.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-Id: <20260319191017.12636-2-philmd@linaro.org>

3 months agohw/hyperv: Replace legacy ld_phys() -> address_space_ld()
Philippe Mathieu-Daudé [Thu, 19 Mar 2026 08:02:18 +0000 (09:02 +0100)] 
hw/hyperv: Replace legacy ld_phys() -> address_space_ld()

Prefer the address_space_ld/st API over the legacy ld/st_phys()
because it allow checking for bus access fault, which shouldn't
happen here.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Acked-by: Maciej S. Szmigiero <maciej.szmigiero@oracle.com>
Message-ID: <20260319082954.65069-1-philmd@linaro.org>

3 months agohw/ppc/spapr: Un-inline rtas_load/store() helpers
Philippe Mathieu-Daudé [Wed, 18 Mar 2026 16:37:41 +0000 (17:37 +0100)] 
hw/ppc/spapr: Un-inline rtas_load/store() helpers

The 32-bit binary doesn't use these helpers, so don't need to
compile them. Rather than using 64-bit target #ifdef'ry in a
global header, un-inline the calls since the helpers are called
from I/O (cold) path.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
Reviewed-by: Chinmay Rath <rathc@linux.ibm.com>
Acked-by: Glenn Miles <milesg@linux.ibm.com>
Message-Id: <20260319111936.68041-2-philmd@linaro.org>

3 months agohw/tpm: Simplify tpm_ppi_enabled()
Philippe Mathieu-Daudé [Tue, 17 Mar 2026 11:42:09 +0000 (12:42 +0100)] 
hw/tpm: Simplify tpm_ppi_enabled()

TPM instances don't expose any "ppi" property anymore,
remove that dead code.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Stefan Berger <stefanb@linux.ibm.com>
Message-Id: <20260317120241.16320-6-philmd@linaro.org>

3 months agohw/tpm: Propagate @ppi_enabled to tpm_tis_reset() and remove in TPMState
Philippe Mathieu-Daudé [Tue, 17 Mar 2026 11:41:31 +0000 (12:41 +0100)] 
hw/tpm: Propagate @ppi_enabled to tpm_tis_reset() and remove in TPMState

Of the TPM devices using FIFO mode, only the ISA variant has
PPI, and calls tpm_ppi_init() to initialize the PPI state.
Propagate @ppi_enabled to tpm_tis_reset() so it only resets
the PPI part when requested (ISA case) otherwise the PPI is in
uninitialized state. Remove the now unused TPMState::ppi_enabled
field. Set the generic TPMIfClass::ppi_enabled so ACPI subsystem
can keep checking its availability.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Stefan Berger <stefanb@linux.ibm.com>
Message-Id: <20260317120241.16320-5-philmd@linaro.org>

3 months agohw/tpm: Remove CRBState::ppi_enabled field
Philippe Mathieu-Daudé [Tue, 17 Mar 2026 11:32:06 +0000 (12:32 +0100)] 
hw/tpm: Remove CRBState::ppi_enabled field

The CRBState::ppi_enabled boolean was only set in the
hw_compat_3_1[] array, via the 'ppi=false' property.
We removed all machines using that array, and the array
itself in commit a861ffef237 ("hw/core/machine: Remove
the hw_compat_3_1[] array"). We can safely remove the
now unused property. Since CRB devices always use PPI,
simplify removing the CRBState::ppi_enabled field.
Set the generic TPMIfClass::ppi_enabled so ACPI subsystem
can keep checking its availability.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Stefan Berger <stefanb@linux.ibm.com>
Message-Id: <20260317120241.16320-4-philmd@linaro.org>

3 months agohw/tpm: Add TPMIfClass::ppi_enabled field
Philippe Mathieu-Daudé [Tue, 17 Mar 2026 11:31:42 +0000 (12:31 +0100)] 
hw/tpm: Add TPMIfClass::ppi_enabled field

Each TPM derived device has a @ppi_enabled field, itself
exposed as a QOM property. External layers (like the ACPI
subsystem) wanting to know whether a device implements PPI
has to check for the QOM property available. This can be
simplified by declaring a single field in the TPM interface.

Here we add such field to TPMIfClass, before converting each
TPM devices to use it in the following commits.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Stefan Berger <stefanb@linux.ibm.com>
Message-Id: <20260317120241.16320-3-philmd@linaro.org>

3 months agohw/tpm: Factor tpm_ppi_enabled() out
Philippe Mathieu-Daudé [Tue, 17 Mar 2026 11:26:56 +0000 (12:26 +0100)] 
hw/tpm: Factor tpm_ppi_enabled() out

Factor out tpm_ppi_enabled() before modifying it in a unique place.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Stefan Berger <stefanb@linux.ibm.com>
Message-Id: <20260317120241.16320-2-philmd@linaro.org>

3 months agohw/xtensa: Include full path to target 'cpu.h' header
Philippe Mathieu-Daudé [Fri, 13 Mar 2026 05:08:50 +0000 (06:08 +0100)] 
hw/xtensa: Include full path to target 'cpu.h' header

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-Id: <20260313062055.2188-36-philmd@linaro.org>

3 months agohw/tricore: Include full path to target 'cpu.h' header
Philippe Mathieu-Daudé [Fri, 13 Mar 2026 05:10:23 +0000 (06:10 +0100)] 
hw/tricore: Include full path to target 'cpu.h' header

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-Id: <20260313062055.2188-35-philmd@linaro.org>

3 months agohw/sparc: Include full path to target 'cpu.h' header
Philippe Mathieu-Daudé [Fri, 13 Mar 2026 05:10:19 +0000 (06:10 +0100)] 
hw/sparc: Include full path to target 'cpu.h' header

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-Id: <20260313062055.2188-34-philmd@linaro.org>

3 months agohw/sh4: Include full path to target 'cpu.h' header
Philippe Mathieu-Daudé [Fri, 13 Mar 2026 05:10:10 +0000 (06:10 +0100)] 
hw/sh4: Include full path to target 'cpu.h' header

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-Id: <20260313062055.2188-33-philmd@linaro.org>

3 months agohw/s390x: Include full path to target 'cpu.h' header
Philippe Mathieu-Daudé [Fri, 13 Mar 2026 05:07:41 +0000 (06:07 +0100)] 
hw/s390x: Include full path to target 'cpu.h' header

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-Id: <20260313062055.2188-32-philmd@linaro.org>

3 months agohw/riscv: Include full path to target 'cpu.h' header
Philippe Mathieu-Daudé [Fri, 13 Mar 2026 05:07:29 +0000 (06:07 +0100)] 
hw/riscv: Include full path to target 'cpu.h' header

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-Id: <20260313062055.2188-31-philmd@linaro.org>

3 months agohw/ppc: Include full path to target 'cpu.h' header
Philippe Mathieu-Daudé [Fri, 13 Mar 2026 05:07:16 +0000 (06:07 +0100)] 
hw/ppc: Include full path to target 'cpu.h' header

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-Id: <20260313062055.2188-30-philmd@linaro.org>

3 months agohw/or1k: Include full path to target 'cpu.h' header
Philippe Mathieu-Daudé [Fri, 13 Mar 2026 05:09:51 +0000 (06:09 +0100)] 
hw/or1k: Include full path to target 'cpu.h' header

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-Id: <20260313062055.2188-29-philmd@linaro.org>

3 months agohw/mips: Include full path to target 'cpu.h' header
Philippe Mathieu-Daudé [Fri, 13 Mar 2026 05:09:08 +0000 (06:09 +0100)] 
hw/mips: Include full path to target 'cpu.h' header

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-Id: <20260313062055.2188-28-philmd@linaro.org>

3 months agohw/microblaze: Include full path to target 'cpu.h' header
Philippe Mathieu-Daudé [Fri, 13 Mar 2026 05:09:43 +0000 (06:09 +0100)] 
hw/microblaze: Include full path to target 'cpu.h' header

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-Id: <20260313062055.2188-27-philmd@linaro.org>

3 months agohw/m68k: Include full path to target 'cpu.h' header
Philippe Mathieu-Daudé [Fri, 13 Mar 2026 05:09:21 +0000 (06:09 +0100)] 
hw/m68k: Include full path to target 'cpu.h' header

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-Id: <20260313062055.2188-26-philmd@linaro.org>

3 months agohw/i386: Include full path to target 'cpu.h' header
Philippe Mathieu-Daudé [Fri, 13 Mar 2026 05:10:00 +0000 (06:10 +0100)] 
hw/i386: Include full path to target 'cpu.h' header

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-Id: <20260313062055.2188-25-philmd@linaro.org>

3 months agohw/hppa: Include full path to target 'cpu.h' header
Philippe Mathieu-Daudé [Fri, 13 Mar 2026 05:08:15 +0000 (06:08 +0100)] 
hw/hppa: Include full path to target 'cpu.h' header

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-Id: <20260313062055.2188-24-philmd@linaro.org>

3 months agohw/avr: Include full path to target 'cpu.h' header
Philippe Mathieu-Daudé [Fri, 13 Mar 2026 05:08:10 +0000 (06:08 +0100)] 
hw/avr: Include full path to target 'cpu.h' header

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-Id: <20260313062055.2188-23-philmd@linaro.org>

3 months agohw/arm: Include full path to target 'cpu.h' header
Philippe Mathieu-Daudé [Fri, 13 Mar 2026 05:08:01 +0000 (06:08 +0100)] 
hw/arm: Include full path to target 'cpu.h' header

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-Id: <20260313062055.2188-22-philmd@linaro.org>

3 months agohw/alpha: Include full path to target 'cpu.h' header
Philippe Mathieu-Daudé [Fri, 13 Mar 2026 05:07:47 +0000 (06:07 +0100)] 
hw/alpha: Include full path to target 'cpu.h' header

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-Id: <20260313062055.2188-21-philmd@linaro.org>

3 months agohw/misc/cpc: Include missing 'hw/core/cpu.h' header
Philippe Mathieu-Daudé [Fri, 13 Mar 2026 04:42:44 +0000 (05:42 +0100)] 
hw/misc/cpc: Include missing 'hw/core/cpu.h' header

The "hw/core/cpu.h" header is indirectly included. Include it
explicitly otherwise we get when refactoring unrelated headers:

  ../hw/misc/mips_cpc.c:36:53: error: unknown type name 'run_on_cpu_data'
     36 | static void mips_cpu_reset_async_work(CPUState *cs, run_on_cpu_data data)
        |                                                     ^
  ../hw/misc/mips_cpc.c:40:5: error: call to undeclared function 'cpu_reset'
       40 |     cpu_reset(cs);
          |     ^
  ../hw/misc/riscv_cpc.c:34:54: error: unknown type name 'run_on_cpu_data'
     34 | static void riscv_cpu_reset_async_work(CPUState *cs, run_on_cpu_data data)
        |                                                      ^
  ../hw/misc/riscv_cpc.c:39:5: error: call to undeclared function 'cpu_reset'
     39 |     cpu_reset(cs);
        |     ^

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-Id: <20260313062055.2188-17-philmd@linaro.org>