Ani Sinha [Thu, 19 Mar 2026 12:21:36 +0000 (17:51 +0530)]
hw/i386/hyperv: add stubs for synic enablement
Add a new call hyperv_enable_synic() that can be called whether or not
CONFIG_HYPERV is enabled. This way genetic code in i396/kvm.c can call this
function to enable synic for hyperv. For non-hyperv cases, the stub will
be a noop.
Reported-by: Michale Tokarev <mjt@tls.msk.ru> Signed-off-by: Ani Sinha <anisinha@redhat.com> Reviewed-by: Michael Tokarev <mjt@tls.msk.ru> Tested-by: Michael Tokarev <mjt@tls.msk.ru>
Message-ID: <20260319122137.142178-3-anisinha@redhat.com> Tested-by: Xudong Hao <xudong.hao@intel.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Trieu Huynh [Wed, 18 Mar 2026 14:14:13 +0000 (23:14 +0900)]
hw/pci/msix: fix error handling for msix_init callers
Check return value of msix_init() and return early on
failure instead of continuing with invalid state.
- Use ret < 0 to handle negative return value.
- Use errp parameter to handle failure instead of NULL.
- No functional changes.
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/413 Signed-off-by: Trieu Huynh <vikingtc4@gmail.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-ID: <20260318141415.8538-5-vikingtc4@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Trieu Huynh [Wed, 18 Mar 2026 14:14:12 +0000 (23:14 +0900)]
util/event_notifier: fix error handling for event_notifier_init callers
Check return value of event_notifier_init() and return early on
failure instead of continuing with invalid state.
- Use ret < 0 to handle negative return value.
- No functional changes.
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/413 Signed-off-by: Trieu Huynh <vikingtc4@gmail.com> Acked-by: Anthony Krowiak <akrowiak@linux.ibm.com> Reviewed-by: Jagannathan Raman <jag.raman@oracle.com> Reviewed-by: Maciej S. Szmigiero <maciej.szmigiero@oracle.com> # for the Hyper-V part Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com>
Message-ID: <20260318141415.8538-4-vikingtc4@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Trieu Huynh [Wed, 18 Mar 2026 14:14:10 +0000 (23:14 +0900)]
hw/core/loader: fix error handling for load_image_targphys callers
Use QEMU's Error API to handle load_image_targphys() failures
consistently across callers.
- Use &error_fatal for callers that previously passed NULL, ensuring
the process exits early on failure instead of continuing in an invalid
state.
- No functional changes.
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/413 Signed-off-by: Trieu Huynh <vikingtc4@gmail.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-ID: <20260318141415.8538-2-vikingtc4@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Jamin Lin [Wed, 11 Mar 2026 02:13:20 +0000 (02:13 +0000)]
hw/i3c/dw-i3c: Fix uninitialized data use in short transfer
Coverity reports that dw_i3c_short_transfer() may pass an
uninitialized buffer to dw_i3c_send().
The immediate cause is the use of `data[len] += arg.byte0`, which
reads from an uninitialized element of the buffer. Replace this with
a simple assignment.
Additionally, avoid calling dw_i3c_send() when the constructed payload
length is zero. In that case the transfer has no data phase, so the
controller can transition to the idle state directly.
This resolves the Coverity UNINIT warning and clarifies the handling
of zero-length short transfers.
Resolves: Coverity CID 1645555 Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> Reviewed-by: Nabih Estefan <nabihestefan@google.com> Reviewed-by: Cédric Le Goater <clg@redhat.com>
Message-ID: <20260311021319.1053774-1-jamin_lin@aspeedtech.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Matthew Penney [Thu, 5 Mar 2026 21:33:32 +0000 (21:33 +0000)]
hw/char/virtio-console: clear dangling GLib event source tag
Clear dangling GLib event source tag when virtio-console is
unrealized. This prevents a stale tag from being used, and
maintains consistency with the rest of virtio-console.
Signed-off-by: Matthew Penney <matt@matthewpenney.net> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-ID: <20260305213308.96441-1-matt@matthewpenney.net> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Alireza Sanaee [Wed, 4 Feb 2026 15:00:00 +0000 (15:00 +0000)]
hw/cxl: Use HPA in cxl_cfmws_find_device() rather than offset in window.
This function will shortly be used to help find if there is a route to a
device, serving an HPA, under a particular fixed memory window. Rather than
having that new use case subtract the base address in the caller, only to
add it again in cxl_cfmws_find_device(), push the responsibility for
calculating the HPA to the caller.
This also reduces the inconsistency in the meaning of the hwaddr addr
parameter between this function and the calls made within it that access
the HDM decoders that operating on HPA.
Reviewed-by: Li Zhijian <lizhijian@fujitsu.com> Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com> Reviewed-by: Gregory Price <gourry@gourry.net> Tested-by: Gregory Price <gourry@gourry.net> Signed-off-by: Alireza Sanaee <alireza.sanaee@huawei.com>
Message-ID: <20260318171918.146-2-alireza.sanaee@huawei.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
hw/riscv: Mark RISC-V specific peripherals as little-endian
These devices are only used by the RISC-V targets, which are
only built as little-endian. Therefore the DEVICE_NATIVE_ENDIAN
definition expand to DEVICE_LITTLE_ENDIAN (besides, the
DEVICE_BIG_ENDIAN case isn't tested). Simplify directly
using DEVICE_LITTLE_ENDIAN.
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20260318103122.97244-2-philmd@linaro.org>
Thomas Huth [Fri, 20 Mar 2026 15:51:07 +0000 (15:51 +0000)]
tests: Replace ncat with socat in migration test and drop ncat from containers
nmap / ncat has a somewhat problematic license (e.g. saying claiming
that derived work is also considered for software that "is designed
specifically to execute Covered Software and parse the results", e.g.
by executing ncat from your own program, you might already fall into
this category) - so for example in openSUSE 16, you can only find it
in the "non-OSS" repository.
We are currently only using it in the migration functional test, and
that likely does not fall into this "derived work" category yet (since
it is also doing some other stuff), but still, to be safe, we should
move away from using it now.
Unfortunately, switching to one of the other flavors of netcat is
also not a real option (see commit f700abbbeb6ab68a3446d1fb168a934d),
but socat should be a solid replacement here instead.
To avoid that someone else easily uses ncat again, let's also remove
it from our container files now.
Suggested-by: Daniel P. Berrangé <berrange@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com> Acked-by: Peter Xu <peterx@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20260316183016.239526-1-thuth@redhat.com>
Message-ID: <20260320155107.2143191-9-alex.bennee@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Thomas Huth [Fri, 20 Mar 2026 15:51:05 +0000 (15:51 +0000)]
tests/lcitool: Update openSUSE to version 16
The first version of openSUSE 15 has been released in 2018, and
according to our support policy, we "support the most recent major
version at all times for up to five years after its initial release."
Since openSUSE 16 has been released a while ago, and openSUSE is
clearly older than 5 years already, it's time to update to version 16
now.
Signed-off-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20260316135407.209072-3-thuth@redhat.com>
Message-ID: <20260320155107.2143191-7-alex.bennee@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Thomas Huth [Fri, 20 Mar 2026 15:51:04 +0000 (15:51 +0000)]
tests/lcitool: Remove python3-sqlite3 from the list of needed packages
According to commit 7485508341f4 ("tests/docker: Add sqlite3 module to
openSUSE Leap container") that introduced this line, the sqlite3 package
was only required for Avocado. We don't use Avocado in QEMU anymore since
a while, so we can drop this package now from our list again.
Signed-off-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20260316135407.209072-2-thuth@redhat.com>
Message-ID: <20260320155107.2143191-6-alex.bennee@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Alex Bennée [Fri, 20 Mar 2026 15:51:03 +0000 (15:51 +0000)]
tests/functional: add VBSA linux tests
This extends the VBSA test to run the linux tests. The sysarch-acs
test suite does provide some pre-built images which is good because
the tests require a patched kernel. However due to the structure of
the image we need to jump one or two hoops to get something useful:
- download and double decompress (zip then xz) the image
- navigate grub to launch the Linux Execution Environment
- shutdown the system once tests are done
- extract the logs from the MSDOS file system and parse them
It does make the code a bit ugly but it works for me at least. So far
the subset of tests run is limited but that might be solved by adding
some more devices to the PCIe bus to exercise the SMMU behaviour.
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-ID: <20260320155107.2143191-5-alex.bennee@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Alex Bennée [Fri, 20 Mar 2026 15:51:02 +0000 (15:51 +0000)]
tests/functional: allow tests to define decompression target
When dealing with multi-stage decompression we want to specify the
target file name lest we just overload the cache name. It also allows
for something is little more friendly than the cache hash.
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-ID: <20260320155107.2143191-4-alex.bennee@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
tests/tcg/multiarch/linux-test: use portable alternative for dirent64
dirent64 and readdir64 are glibc-specific and not portable to other
C libraries such as musl. Define _FILE_OFFSET_BITS=64 instead, which
portably instructs all libc implementations to use 64-bit file offsets,
making readdir() and struct dirent equivalent to their 64-bit variants.
Alex Bennée [Fri, 20 Mar 2026 15:51:00 +0000 (15:51 +0000)]
tests/tcg: allow filtering of TCG tests
We have a lot of TCG tests now which can be fiddly if we just want to
check one particular test type across the targets. Introduce
TCG_TEST_FILTER to allow this:
make check-tcg TCG_TEST_FILTER=gdb
to run all the gdb tests across the suites.
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-ID: <20260320155107.2143191-2-alex.bennee@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Peter Maydell [Mon, 23 Mar 2026 10:55:20 +0000 (10:55 +0000)]
Merge tag 'pull-target-arm-20260323' of https://gitlab.com/pm215/qemu into staging
target-arm queue:
* tests/qtest/arm-cpu-features: Fix thinko in g_strdup_printf() call
* configure: Remove unused variable default_cflags
* whpx: arm: Various fixes, notably making '-cpu host' work
* configs/targets: Restrict the legacy ldst_phys() API on ARM / Aarch64
* hw/isa/piix: Embed i8259 irq in device state instead of allocating
* tag 'pull-target-arm-20260323' of https://gitlab.com/pm215/qemu:
hw/isa/piix: Embed i8259 irq in device state instead of allocating
configs/targets: Restrict the legacy ldst_phys() API on ARM / Aarch64
whpx: arm: fix ID_AA64MMFR3_EL1 host feature register index
target/arm: cpu: alter error message for host CPU type
whpx: arm: remove comment bit that is no longer accurate
whpx: arm: enable more enlightenments
whpx: arm: add EC_DATAABORT assert for WHvRunVpExitReasonGpaIntercept/UnmappedGpa
whpx: arm: fix -cpu host
configure: Remove unused variable default_cflags
tests/qtest/arm-cpu-features: Fix thinko in g_strdup_printf() call
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* tag 'pull-request-2026-03-23' of https://gitlab.com/thuth/qemu:
tests/functional: remove heuristics for finding build dir
tests/functional: fix log placement when run directly
hw/sparc64/sun4u_iommu: Fix crash when introspecting sun4u-iommu from the CLI
hw/sparc/sun4m_iommu: Fix crash when introspecting sun4m-iommu from the CLI
hw/display/cg3: Fix crash when introspecting cgthree from the CLI
hw/pci-host/raven: Fix crash when introspecting raven-pcihost from the CLI
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* tag 'pull-hex-20260320' of https://github.com/quic/qemu:
tests/tcg/hexagon: add test for predicated .new branch LSB evaluation
target/hexagon: use TCG_COND_TSTEQ/TSTNE for predicate branches
target/hexagon: fix J2_jumptnew/pt predicate check to use LSB
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Peter Maydell [Mon, 23 Mar 2026 09:51:01 +0000 (09:51 +0000)]
hw/isa/piix: Embed i8259 irq in device state instead of allocating
The pci_piix_realize() function's use of qemu_allocate_irqs()
results in a memory leak:
Direct leak of 8 byte(s) in 1 object(s) allocated from:
#0 0x61045c7a1a43 in malloc (/home/pm215/qemu/build/san/qemu-system-mips+0x16f8a43) (BuildId: aa43d3865e0f1991b1fc04422b5570fe522b6fa7)
#1 0x724cc3095ac9 in g_malloc (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x62ac9) (BuildId: 116e142b9b52c8a4dfd403e759e71ab8f95d8bb3)
#2 0x61045db72134 in qemu_extend_irqs /home/pm215/qemu/build/san/../../hw/core/irq.c:77:51
#3 0x61045cd7bf49 in pci_piix_realize /home/pm215/qemu/build/san/../../hw/isa/piix.c:318:35
#4 0x61045cf4533e in pci_qdev_realize /home/pm215/qemu/build/san/../../hw/pci/pci.c:2308:9
#5 0x61045db6cbca in device_set_realized /home/pm215/qemu/build/san/../../hw/core/qdev.c:523:13
#6 0x61045db86bd9 in property_set_bool /home/pm215/qemu/build/san/../../qom/object.c:2376:5
#7 0x61045db81c5e in object_property_set /home/pm215/qemu/build/san/../../qom/object.c:1450:5
#8 0x61045db8e2fc in object_property_set_qobject /home/pm215/qemu/build/san/../../qom/qom-qobject.c:28:10
#9 0x61045db8258f in object_property_set_bool /home/pm215/qemu/build/san/../../qom/object.c:1520:15
#10 0x61045db687aa in qdev_realize_and_unref /home/pm215/qemu/build/san/../../hw/core/qdev.c:283:11
#11 0x61045d892e21 in mips_malta_init /home/pm215/qemu/build/san/../../hw/mips/malta.c:1239:5
(The i386 PC sets the has-pic property to 'false', so this only
affects the MIPS Malta board.)
Fix this by embedding the i8259 irq in the device state instead of
allocating it. This is a similar fix to the one we used for vt82c686
in commit 2225dc562a93dc, except that we use qemu_init_irq_child()
instead of qemu_init_irq(). The behaviour is identical except that
the _child() version avoids what would be a leak if we ever
unrealized the device.
Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Bernhard Beschow <shentey@gmail.com>
Message-id: 20260309171258.1905205-1-peter.maydell@linaro.org
configs/targets: Restrict the legacy ldst_phys() API on ARM / Aarch64
Commit d751921cffd ("hw/arm/omap1: Remove omap_badwidth_*
implementations") removed the last use of the legacy ldst_phys()
API. Set the TARGET_NOT_USING_LEGACY_LDST_PHYS_API variable to
hide the legacy API to the ARM / Aarch64 binaries, avoiding further
API uses to creep in.
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20260319104414.66367-1-philmd@linaro.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Osama Abdelkader [Mon, 23 Mar 2026 09:51:01 +0000 (09:51 +0000)]
whpx: arm: fix ID_AA64MMFR3_EL1 host feature register index
IdAa64Mmfr3El1 was stored in idregs[ID_AA64MMFR2_EL1_IDX], overwriting
MMFR2 and leaving MMFR3 never set. Use ID_AA64MMFR3_EL1_IDX so the host
MMFR3 value is stored in the correct slot.
Mohamed Mediouni [Mon, 23 Mar 2026 09:51:01 +0000 (09:51 +0000)]
whpx: arm: enable more enlightenments
Unconditionally enable some more enlightenments for whpx. In
particular, linux uses AccessVpRegs without checking availability and
panics if it's not there, so it's important to expose it.
We also had a duplicate line where we set AccessHypercallRegs = 1
twice; remove the duplicate.
Microsoft’s VMM exposes SyncContext on arm64 and FastHypercallOutput
regardless of architecture unconditionally, so add those two to match
that configuration.
Signed-off-by: Mohamed Mediouni <mohamed@unpredictable.fr>
Message-id: 20260314221529.47841-4-mohamed@unpredictable.fr Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Mohamed Mediouni [Mon, 23 Mar 2026 09:51:01 +0000 (09:51 +0000)]
whpx: arm: fix -cpu host
"hw/arm/virt: Register valid CPU types dynamically" went under my
radar, so fix this for WHPX.
Signed-off-by: Mohamed Mediouni <mohamed@unpredictable.fr> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Stefan Weil <sw@weilnetz.de>
Message-id: 20260314221529.47841-2-mohamed@unpredictable.fr Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Peter Maydell [Mon, 23 Mar 2026 09:51:01 +0000 (09:51 +0000)]
configure: Remove unused variable default_cflags
configure has a variable default_cflags, which was originally added
in commit bafe78ad3bc4c ("contrib/plugins: use an independent
makefile") as part of it setting up the build environment for
contrib/plugins, which at the time used make. However, we now build
the plugins with meson, and in commit 55c84a72aba4 ("contrib/plugins:
remove Makefile for contrib/plugins") we dropped the logic from
configure that does that makefile setup, leaving default_cflags
as an unused variable.
shellcheck helpfully reports this:
default_cflags='-O0 -g'
^------------^ SC2034 (warning): default_cflags appears unused. Verify use (or export if used externally).
Remove the unused variable.
Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20260317120215.2075164-1-peter.maydell@linaro.org
Peter Maydell [Mon, 23 Mar 2026 09:51:01 +0000 (09:51 +0000)]
tests/qtest/arm-cpu-features: Fix thinko in g_strdup_printf() call
In commit 62272f9f8891 we changed some uses of fixed char arrays
to call g_strdup_printf() instead. In one place I made a silly
error where in changing
sprintf(name, "fmt string", ...)
to
name = g_strdup_printf("fmt string", ...)
I forgot to delete "name" from the argument list.
Luckily Coverity spotted this (as CID 1645771) because at this
point "name" is NULL and passing g_strdup_printf() a NULL first
argument is not valid.
We didn't notice the mistake in testing or CI because this bit of
code is only run if on an AArch64 host with KVM and SVE available.
Correct the error by removing the stray function argument.
Fixes: 62272f9f8891 ("tests/qtest/arm-cpu-features: Use g_strdup_printf() instead of char arrays") Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Cédric Le Goater <clg@redhat.com>
Message-id: 20260317111121.2062455-1-peter.maydell@linaro.org
tests/functional: remove heuristics for finding build dir
Currently some heuristics are used to locate the build dir, if the
MESON_BUILD_ROOT environment variable is not set. These are not
entirely accurate, however, especially if the developer is using
nested sub-dirs under $PWD/build/...
Since the introduction of the 'run' script, we can ensure any
direct execution of the tests will have MESON_BUILD_ROOT set.
Meanwhile when meson runs the test it will also have this env
set. The only gap is when running pre-caching, and that is easily
fixed to set MESON_BUILD_ROOT.
It can thus be assumed that MESON_BUILD_ROOT will always be set
in any supported execution scenario, which allows the heuristics
to be removed.
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20260310114756.146083-3-berrange@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
tests/functional: fix log placement when run directly
When running functional tests directly there are some heuristics
to figure out where the build directory lives, along with the
possibility to override the logic by setting the QEMU_BUILD_DIR
env variable. This env var is set as part of the test env when
run via Meson but not when run directly.
A particular flaw with the currently logic is that it silently
uses the wrong location when the build directory is a sub-dir
under "./build", which is a common usage scenario for some devs.
With the recent introduction of the 'run' script, we now have
the MESON_BUILD_ROOT env variable set unconditionally, so we
can rely on that from the functional tests to get the correct
location in all scenarios.
Reported-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20260310114756.146083-2-berrange@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
There does not seem to be a compelling reason for initializing the
memory regions from the instance_init function, so let's simply move
the code into a realize() function instead to fix this issue.
Reported-by: Markus Armbruster <armbru@redhat.com> Tested-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20260317085839.445178-1-thuth@redhat.com>
There does not seem to be a compelling reason for initializing the
memory regions from the instance_init function, so let's simply move
the code into a realize() function instead to fix this issue.
Reported-by: Markus Armbruster <armbru@redhat.com> Tested-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20260317084450.442071-1-thuth@redhat.com>
This happens because the memory_region_init_rom() function internally
calls qemu_ram_alloc_internal() that needs the current_machine pointer
to be set up - which is not the case here since the machine has not
been created yet.
There does not seem to be a compelling reason for initializing the
memory regions from the instance_init function, so let's simply move
the code into the realize() function instead to fix this issue.
Tested-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20260317080623.438230-1-thuth@redhat.com>
This happens because the raven_pcihost_initfn instance init function
calls get_system_memory(), but that is not available here yet.
There does not seem to be a compelling reason for initializing the
memory regions from the instance init function, so let's simply move
the code into the realize() function instead to fix this issue.
Tested-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20260317074049.436460-1-thuth@redhat.com>
Brian Cain [Tue, 3 Mar 2026 05:29:01 +0000 (21:29 -0800)]
tests/tcg/hexagon: add test for predicated .new branch LSB evaluation
Test for predicated .new branches with non-standard predicate values
(non-all-0, non-all-1). Hexagon predicates are 8 bits wide but conditional
branches evaluate only the LSB.
Reviewed-by: Taylor Simpson <ltaylorsimpson@gmail.com> Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>
Brian Cain [Tue, 3 Mar 2026 05:29:00 +0000 (21:29 -0800)]
target/hexagon: use TCG_COND_TSTEQ/TSTNE for predicate branches
Replace TCG_COND_EQ/NE comparisons against 0 with TCG_COND_TSTEQ/TSTNE
comparisons against 1 for all predicate-conditional branches. This tests
bit 0 of the predicate register directly, eliminating redundant andi
operations that previously extracted the LSB before the comparison.
For predicate-conditional jumps (jumpt, jumpf, jumptnew, etc.) and
jump-register variants (jumprt, jumprf, etc.), pass the raw predicate
value directly instead of going through fLSBOLD/fLSBNEW extraction.
For callers that produce a 0/1 result via setcond (compare-and-jump,
jumprz, etc.), the TSTEQ/TSTNE test on bit 0 is equivalent to the
previous EQ/NE test against 0.
Reviewed-by: Taylor Simpson <ltaylorsimpson@gmail.com> Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>
Brian Cain [Tue, 3 Mar 2026 05:28:59 +0000 (21:28 -0800)]
target/hexagon: fix J2_jumptnew/pt predicate check to use LSB
J2_jumptnew and J2_jumptnewpt passed the raw predicate value to
gen_cond_jump(), checking if the full 8-bit value was non-zero.
Refer to PRM Section 6.1.2 "predicate-consuming instructions examine
only the least-significant bit".
This inconsistency caused if (p0.new) jumps and if (p0.new) loads
within the same packet to disagree when the predicate had values
other than the ones generated by predicate-generating instructions
(e.g. 0x80 or 0xAA where bit 0 is clear but the value is
non-zero): the jump would be taken while the loads were skipped.
Fix by routing both macros through fGEN_TCG_cond_jumpt(fLSBNEW(PuN)),
matching the pattern used by every other predicated jump.
Discovered-by: Alexey Karyakin <akaryaki@qti.qualcomm.com> Reviewed-by: Taylor Simpson <ltaylorsimpson@gmail.com> Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>
Peter Maydell [Fri, 20 Mar 2026 10:04:48 +0000 (10:04 +0000)]
Merge tag 'hppa-fixes-for-v11-pull-request' of https://github.com/hdeller/qemu-hppa into staging
HPPA fixes for v11
Some late fixes for QEMU-v11
Various fixes in SeaBIOS-hppa and qemu code, most importantly
this fixes boot of the C3700, which broke while we added
support for CPUs with 40 and 44 bits physical address space.
# -----BEGIN PGP SIGNATURE-----
#
# iHUEABYKAB0WIQS86RI+GtKfB8BJu973ErUQojoPXwUCabxmmwAKCRD3ErUQojoP
# X5z0AP4h0hBe/jDlQ8VLs0LtdG4bBnyPSVl+4rahw10mmgkvZwD7B/wimiCUBOJZ
# Jj9nKpNWtgZRXwRIM4XOl/a6pYcbCw8=
# =MzWS
# -----END PGP SIGNATURE-----
# gpg: Signature made Thu Mar 19 21:11:55 2026 GMT
# gpg: using EDDSA key BCE9123E1AD29F07C049BBDEF712B510A23A0F5F
# gpg: Good signature from "Helge Deller <deller@gmx.de>" [unknown]
# gpg: aka "Helge Deller <deller@kernel.org>" [unknown]
# gpg: aka "Helge Deller <deller@debian.org>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 4544 8228 2CD9 10DB EF3D 25F8 3E5F 3D04 A7A2 4603
# Subkey fingerprint: BCE9 123E 1AD2 9F07 C049 BBDE F712 B510 A23A 0F5F
* tag 'hppa-fixes-for-v11-pull-request' of https://github.com/hdeller/qemu-hppa:
target/hppa: Update SeaBIOS-hppa to version 23
hw/hppa: Fix crash of 64-bit HP-UX 11 while flushing caches
hw/pci-host/astro: Use proper region names
target/hppa: Always map 64-bit firmware at 0xfffffff0f0000000
hw/hppa: Adjust physical addresses of Astro and Elroy
hw/hppa: Fix description of the HP A400-44 server
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Peter Maydell [Fri, 20 Mar 2026 10:04:40 +0000 (10:04 +0000)]
Merge tag 'pull-riscv-to-apply-20260320' of https://github.com/alistair23/qemu into staging
RISC-V PR for 11.
* Fix integer overflow in cm_base calculation
* Fix null pointer dereference in cpu_set_exception_base
* Update Daniel Henrique Barboza's email
* Add Chao Liu as reviewer
* Set SiFive PDMA done bit upon completion
* Remove deprecated 'riscv, delegate' device-tree property
* Fix OCP FP8 E4M3 conversion issues
* Fix IOMMU instance_init allocations in instance_finalize
* Support Smpmpmt extension
* Fix SiFive UART spurious IRQ issue and misc updates
* Fix missing flags merge in probe_pages for cross-page accesses
* Fix page probe issues in vext_ldff
* Fix scountovf CSR behavior in VS-mode and M-mode
# -----BEGIN PGP SIGNATURE-----
#
# iQIzBAABCgAdFiEEaukCtqfKh31tZZKWr3yVEwxTgBMFAmm8ha4ACgkQr3yVEwxT
# gBMKOBAAsB6CwDSsi+DmuCD5r25kaLtvFg7hqc6iYpzjuwUE+uHu3LWMky19Div1
# mpMLZi1an/NbIKX8N9KS1G87hzteqvxY4wKVoMn1mF/3yQ5r6OJ2SfZoDiiJyAva
# UIhaiRUbmg78OX0YCBYCWaRbqN7rbV6XJnB8oGUyhVNwtfJ/pZppfCflsd5+E3KD
# U7sKMVaytfeQCQGXeNYgZBvYvDQ7/t21eLytLYGhUNy89N8mo7V5egFJEN45BE8O
# Zh+Oa7bN+lUOg0eUTj98zwXXXeOZMEKbn5I01XuUH1gn5aO+CeEvFEqDssF1fKle
# mq00WkK1Tk9kZOTLhMR4pdW2kXkom/mEmXI9jU0CInmF63+r8/SugimPS8LyLE3N
# qZodmmEeckOPsE+RnmBOHww2Y+g668+C/sTcSAuHsWUXJLDty+DyO0RU4d0ioRHa
# zyOf2cNoSVV8EWJ5uHk9Et2eimq0Q83n/tVpkKyq877rOGLQzoDIKJEwIO7nI59x
# NF437R7hWKOZ0JLE22wuLWNW8LohxaFkzYRGFDH2/qKlsEv7mSkutTU4y6g0XKok
# iTjBaibmwsaDeMrf5JYHTGMSvF/3lIXyeJiBCq6uQac3fFXKKeehttaU4F+KW0KE
# gO6oUdJWExp7Tt+9nx5KqFxlJPNd/JV3gDCKRjQskW3bT4H1cco=
# =chEj
# -----END PGP SIGNATURE-----
# gpg: Signature made Thu Mar 19 23:24:30 2026 GMT
# gpg: using RSA key 6AE902B6A7CA877D6D659296AF7C95130C538013
# gpg: Good signature from "Alistair Francis <alistair@alistair23.me>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 6AE9 02B6 A7CA 877D 6D65 9296 AF7C 9513 0C53 8013
* tag 'pull-riscv-to-apply-20260320' of https://github.com/alistair23/qemu:
target/riscv: Fix scountovf CSR behavior in VS-mode and M-mode
target/riscv: rvv: Fix page probe issues in vext_ldff
target/riscv: rvv: Fix missing flags merge in probe_pages for cross-page accesses
hw/char: sifive_uart: Remove ip variable
hw/char: sifive_uart: Update IRQ when rxctrl is written
hw/char: sifive_uart: Sync txwm interrupt pending status after TX FIFO enqueue
hw/char: sifive_uart: Implement txctrl.txen and rxctrl.rxen
target/riscv: Support Smpmpmt extension
hw/riscv/riscv-iommu: Free instance_init allocations in instance_finalize
fpu: Fix unexpected exception flags when converting infinity to OCP E4M3
fpu: Fix repacking issues in the uncanonical step for E4M3 overflow
hw/riscv: Remove deprecated 'riscv, delegate' device-tree property
hw/dma: sifive_pdma: Set done bit upon completion
MAINTAINERS: Add myself as a reviewer for RISC-V TCG CPUs
MAINTAINERS: update my email
target/riscv: Fix null pointer dereference in cpu_set_exception_base
hw/riscv: Fix integer overflow in cm_base calculation
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Peter Maydell [Fri, 20 Mar 2026 10:04:21 +0000 (10:04 +0000)]
Merge tag 'staging-pull-request' of https://gitlab.com/peterx/qemu into staging
mem pull for 11.0-rc1
Two fixes included:
- Xiaoyao's fix on recent coco guest boot failure
- BALATON's fix on recent sparce device-introspect-test failure
# -----BEGIN PGP SIGNATURE-----
#
# iIgEABYKADAWIQS5GE3CDMRX2s990ak7X8zN86vXBgUCabwC2xIccGV0ZXJ4QHJl
# ZGhhdC5jb20ACgkQO1/MzfOr1wYozgEAg32MCV/R9xs5krn9mSpBLLoVZCAIDp2C
# 4hLW7aEnf4UBALeUmJY/pLWEGwFc6LVzPe4kZ5BLl0j72jtcVP1BcmoG
# =Zd1r
# -----END PGP SIGNATURE-----
# gpg: Signature made Thu Mar 19 14:06:19 2026 GMT
# gpg: using EDDSA key B9184DC20CC457DACF7DD1A93B5FCCCDF3ABD706
# gpg: issuer "peterx@redhat.com"
# gpg: Good signature from "Peter Xu <xzpeter@gmail.com>" [marginal]
# gpg: aka "Peter Xu <peterx@redhat.com>" [marginal]
# gpg: WARNING: The key's User ID is not certified with sufficiently trusted signatures!
# gpg: It is not certain that the signature belongs to the owner.
# Primary key fingerprint: B918 4DC2 0CC4 57DA CF7D D1A9 3B5F CCCD F3AB D706
* tag 'staging-pull-request' of https://gitlab.com/peterx/qemu:
hw/display/tcx: Init memory regions in realize
memory: Set mr->ram before RAM Block allocation
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Jim Shu [Wed, 18 Mar 2026 02:42:34 +0000 (10:42 +0800)]
target/riscv: Fix scountovf CSR behavior in VS-mode and M-mode
From Sscofpmf spec [1]:
- In M-mode, scountovf bit X is always readable.
- in VS mode, scountovf bit X is readable when mcounteren bit X and
hcounteren bit X are both set, and otherwise reads as zero.
Signed-off-by: Jim Shu <jim.shu@sifive.com> Signed-off-by: Max Chou <max.chou@sifive.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20260318024234.2772480-1-jim.shu@sifive.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Max Chou [Wed, 18 Mar 2026 01:38:05 +0000 (09:38 +0800)]
target/riscv: rvv: Fix page probe issues in vext_ldff
Commit 17288e38bebf ("optimize the memory probing for vector
fault-only-first loads") introduced an optimization that moved from
per-element probing to a fast-path broad probe. Unfortunately it
introduced following bugs in cross-page handling:
- Wrong condition for second page probing: checked "env->vl > elems"
instead of "env->vl > elems + env->vstart", failing to account for
the vstart offset.
- Incorrect second page address calculation: used
"addr + (elems << log2_esz)" instead of "addr + page_split".
For segment loads (nf > 1), this would probe the wrong address,not
at the page boundary.
- Wrong second page probe size: used "elems * msize" (the first page
size) instead of calculating the remaining size as
"(env->vl - env->vstart) * msize - page_split". This would probe
too little memory and could miss faults.
This commit fixes these bugs by leveraging the probe_pages helper
which automatically handles cross-page memory accesses correctly.
Fixes: 17288e38bebf ("optimize the memory probing for vector fault-only-first loads.") Signed-off-by: Max Chou <max.chou@sifive.com> Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20260318013805.1920377-3-max.chou@sifive.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Max Chou [Wed, 18 Mar 2026 01:38:04 +0000 (09:38 +0800)]
target/riscv: rvv: Fix missing flags merge in probe_pages for cross-page accesses
When probe_pages probes a memory region that spans two pages, it calls
probe_access_flags twice - once for each page. However, the flags from
the second page probe were overwriting the flags from the first page
instead of being merged together.
Signed-off-by: Max Chou <max.chou@sifive.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20260318013805.1920377-2-max.chou@sifive.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Frank Chang [Thu, 12 Mar 2026 03:32:01 +0000 (11:32 +0800)]
hw/char: sifive_uart: Remove ip variable
The ip variable is no longer used in the code. Remove it from the
codebase.
Signed-off-by: Frank Chang <frank.chang@sifive.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20260312033201.1619554-5-frank.chang@sifive.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Frank Chang [Thu, 12 Mar 2026 03:32:00 +0000 (11:32 +0800)]
hw/char: sifive_uart: Update IRQ when rxctrl is written
When rxctl is updated, we also need to check whether the IRQ should be
raised, as the user may activate the Rx channel or change the Rx FIFO
watermark level.
Signed-off-by: Frank Chang <frank.chang@sifive.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20260312033201.1619554-4-frank.chang@sifive.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Frank Chang [Thu, 12 Mar 2026 03:31:59 +0000 (11:31 +0800)]
hw/char: sifive_uart: Sync txwm interrupt pending status after TX FIFO enqueue
Currently, the txwm interrupt pending status is only updated when the
asynchronous transmit handler runs. This can cause the txwm interrupt
state to become unsynchronized between the SiFive UART and the
interrupt controller.
For example, when a txwm interrupt is raised, the corresponding APLIC
pending bit is also set. However, if software later enqueues additional
characters into the TX FIFO exceeding the transmit watermark, the
APLIC pending bit may remain set because the txwm interrupt pending
status is not updated at enqueue time.
This issue has been observed on resource-constrained machines, where
Linux reports spurious IRQ errors. In these cases, the asynchronous
transmit handler is unable to drain the TX FIFO quickly enough to update
the txwm pending status before software reads the ip register, which
derives the txwm pending state directly from the actual number of
characters in the TX FIFO.
This commit fixes the issue by updating the txwm interrupt pending
status immediately after enqueuing data into the TX FIFO, ensuring that
the interrupt pending status between the SiFive UART and the interrupt
controller remains synchronized.
Signed-off-by: Frank Chang <frank.chang@sifive.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20260312033201.1619554-3-frank.chang@sifive.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Frank Chang [Thu, 12 Mar 2026 03:31:58 +0000 (11:31 +0800)]
hw/char: sifive_uart: Implement txctrl.txen and rxctrl.rxen
Implement txctrl.txen and rxctrl.rxen as follows:
* txctrl.txen
The txen bit controls whether the Tx channel is active. When cleared,
transmission of Tx FIFO contents is suppressed, and the txd pin is
driven high.
* rxctrl.rxen:
The rxen bit controls whether the Rx channel is active. When cleared,
the state of the rxd pin is ignored, and no characters will be
enqueued into the Rx FIFO.
Therefore, the Tx FIFO should not be dequeued when txctrl.txen is
cleared, and the Rx FIFO should not be enqueued when rxctrl.rxen is
cleared.
Signed-off-by: Frank Chang <frank.chang@sifive.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20260312033201.1619554-2-frank.chang@sifive.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Helge Deller [Tue, 17 Mar 2026 19:38:54 +0000 (20:38 +0100)]
target/hppa: Update SeaBIOS-hppa to version 23
New SeaBIOS-hppa v23 release with various fixes for qemu-v11:
- Various fixes to support CPUs with 40 and 44 bits physical address
- Fix PAT_CPU call when asking for current CPU
- Add function to stop CPU in PDC_PROC
- Prevent execution of some functions when running as PAT firmware
- Tune cache parameters to speed up cache flushes in operating systems
- Revert resetting LSI SCSI with ODE on HP3000
Signed-off-by: Helge Deller <deller@gmx.de> Reviewed-by: Anton Johansson <anjo@rev.ng>
Helge Deller [Sun, 15 Mar 2026 18:16:02 +0000 (19:16 +0100)]
hw/hppa: Fix crash of 64-bit HP-UX 11 while flushing caches
HP-UX 11 64-bit reads at bootup a word from address CPU_HPA + 0x500
while flushing the the cache of a T600.
Add a memory handler to avoid crashing while reading this word.
Signed-off-by: Helge Deller <deller@gmx.de> Reviewed-by: Anton Johansson <anjo@rev.ng>
Helge Deller [Sun, 15 Mar 2026 18:00:00 +0000 (19:00 +0100)]
hw/pci-host/astro: Use proper region names
All 64-bit hppa machines have at least 4 Elroy PCI busses in the system.
Make sure to use proper names in the qemu device tree, e.g. "elroy0" or
"elroy2-pci-mmio", to be able to distinguish between the various chips.
Signed-off-by: Helge Deller <deller@gmx.de> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Helge Deller [Fri, 13 Mar 2026 18:43:09 +0000 (19:43 +0100)]
target/hppa: Always map 64-bit firmware at 0xfffffff0f0000000
I checked on a physical A500, C3700 and C8000 machine and all load their
64-bit PDC (Firmware) at 0xfffffff0f0000000, independed if the CPU uses
40 or 44 physical address bits.
For qemu we will do the same and load the 64-bit SeaBIOS-hppa at the
same address for our emulated machines.
Signed-off-by: Helge Deller <deller@gmx.de> Reviewed-by: Anton Johansson <anjo@rev.ng>
Xiaoyao Li [Thu, 12 Mar 2026 06:34:20 +0000 (14:34 +0800)]
memory: Set mr->ram before RAM Block allocation
Commit 2fb627ef2f48 ("memory: Factor out common ram region initialization")
introduced a helper function memory_region_set_ram_block(), which causes
mr->ram to be set to true after the RAM Block allocation by
qemu_ram_alloc_*().
It leads to the assertion
g_assert(memory_region_is_ram(mr));
in memory_region_set_ram_discard_manager() being triggered when creating
RAM Block with the RAM_GUEST_MEMFD flag.
Fix this by restoring the original behavior of setting mr->ram before
RAM Block allocation.
Jay Chang [Thu, 5 Mar 2026 03:44:29 +0000 (11:44 +0800)]
target/riscv: Support Smpmpmt extension
The Smpmpmt extension provides a mechanism to control memory attributes
at the granularity of PMP (Physical Memory Protection) registers, similar
to how Svpbmt controls memory attributes at the page level.
Version 0.6
https://github.com/riscv/riscv-isa-manual/blob/smpmpmt/src/smpmpmt.adoc#svpbmt
Signed-off-by: Jay Chang <jay.chang@sifive.com> Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com> Reviewed-by: Frank Chang <frank.chang@sifive.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20260305034429.74739-1-jay.chang@sifive.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Peter Maydell [Sat, 7 Mar 2026 12:52:22 +0000 (12:52 +0000)]
hw/riscv/riscv-iommu: Free instance_init allocations in instance_finalize
The riscv-iommu device makes various allocations in its
instance_init method. These will leak when QMP inits an
object of this type to introspect it, as can be seen if you
run 'make check' with the address sanitizer enabled:
Direct leak of 4096 byte(s) in 1 object(s) allocated from:
#0 0x5d8415b6ed9d in calloc (/home/pm215/qemu/build/san/qemu-system-riscv32+0x1832d9d) (BuildId: fedcc313e48ba803d63837329c37fd609dd50849)
#1 0x75c0502f1771 in g_malloc0 (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x63771) (BuildId: 116e142b9b52c8a4dfd403e759e71ab8f95d8bb3)
#2 0x5d8416d09391 in riscv_iommu_instance_init /home/pm215/qemu/build/san/../../hw/riscv/riscv-iommu.c:2463:18
#3 0x5d841710483f in object_initialize_with_type /home/pm215/qemu/build/san/../../qom/object.c:570:5
#4 0x5d8417104ee9 in object_initialize /home/pm215/qemu/build/san/../../qom/object.c:578:5
#5 0x5d8417104ee9 in object_initialize_child_with_propsv /home/pm215/qemu/build/san/../../qom/object.c:608:5
#6 0x5d8417104db1 in object_initialize_child_with_props /home/pm215/qemu/build/san/../../qom/object.c:591:10
#7 0x5d8417106506 in object_initialize_child_internal /home/pm215/qemu/build/san/../../qom/object.c:645:5
#8 0x5d8416d16a12 in riscv_iommu_sys_init /home/pm215/qemu/build/san/../../hw/riscv/riscv-iommu-sys.c:199:5
#9 0x5d841710483f in object_initialize_with_type /home/pm215/qemu/build/san/../../qom/object.c:570:5
#10 0x5d841710661f in object_new_with_type /home/pm215/qemu/build/san/../../qom/object.c:774:5
#11 0x5d841755d956 in qmp_device_list_properties /home/pm215/qemu/build/san/../../qom/qom-qmp-cmds.c:206:11
(and other similar backtraces).
Fix these by freeing the resources we allocate in instance_init in
instance_finalize. In some cases we were freeing these in unrealize,
and in some cases not at all.
Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Chao Liu <chao.liu.zevorn@gmail.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20260307125222.3656140-1-peter.maydell@linaro.org> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Max Chou [Thu, 26 Feb 2026 07:18:15 +0000 (15:18 +0800)]
fpu: Fix unexpected exception flags when converting infinity to OCP E4M3
Infinity is a special case distinct from numeric overflow:
- Numeric overflow: finite value exceeds format's max normal
-> overflow|inexact
- Infinity conversion: input is already infinite
-> no flags
This commit fixes the unexpect exception flags by relocating the float
exception flag update flow to be outside the uncanon_e4m3_overflow.
And raising the overflow|inexact for numeric overflow in uncanon_normal.
Fixes: 27e989f99c ("fpu: Add conversion routines for OCP FP8 E4M3") Reviewed-by: Chao Liu <chao.liu.zevorn@gmail.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Max Chou <max.chou@sifive.com>
Message-ID: <20260226071817.1417875-3-max.chou@sifive.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Max Chou [Thu, 26 Feb 2026 07:18:14 +0000 (15:18 +0800)]
fpu: Fix repacking issues in the uncanonical step for E4M3 overflow
In the uncanonical step, the input FloatParts will be repacked to the
target FloatFmt. This commit fixes following issues after calling
uncanon_e4m3_overflow in the uncanon/uncanon_normal functions.
- Add the local exp update after calling uncanon_e4m3_overflow in the
parts_uncanon_normal function.
- Add the fraction shift after calling uncanon_e4m3_overflow in the
parts_uncanon function.
Fixes: 27e989f99c ("fpu: Add conversion routines for OCP FP8 E4M3") Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Chao Liu <chao.liu.zevorn@gmail.com> Signed-off-by: Max Chou <max.chou@sifive.com>
Message-ID: <20260226071817.1417875-2-max.chou@sifive.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
The "riscv,delegate" DT property was added in QEMU 7.0 as part of
the AIA APLIC support. The property changed name during the
review process in Linux and the correct name ended up being
"riscv,delegation". The incorrect name was added as alias, and
deprecated in v9.1 (commit 38facfa8432), so can be removed for
v11.0.
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Chao Liu <chao.liu.zevorn@gmail.com> Reviewed-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
Message-ID: <20260227232838.23392-1-philmd@linaro.org> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Jay Chang [Wed, 4 Mar 2026 03:08:16 +0000 (11:08 +0800)]
hw/dma: sifive_pdma: Set done bit upon completion
Ensure that the 'done' bit is set upon transfer completion, even if
an error occurs, since all transfers are considered completed regardless
of success or failure.
Signed-off-by: Jay Chang <jay.chang@sifive.com> Reviewed-by: Frank Chang <frank.chang@sifive.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20260304030816.33209-1-jay.chang@sifive.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Chao Liu [Thu, 26 Feb 2026 10:20:08 +0000 (18:20 +0800)]
MAINTAINERS: Add myself as a reviewer for RISC-V TCG CPUs
Add myself as a reviewer for RISC-V TCG CPU related code to better
participate in patch review.
Signed-off-by: Chao Liu <chao.liu.zevorn@gmail.com> Reviewed-by: Bin Meng <bmeng.cn@gmail.com> Reviewed-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com> Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Message-ID: <20260226102008.146928-1-chao.liu.zevorn@gmail.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Also add myself as a "RISC-V TCG target" reviewer.
Signed-off-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com> Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251217191726.194767-1-daniel.barboza@oss.qualcomm.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
* tag 'single-binary-20260317' of https://github.com/philmd/qemu:
target/ppc: Replace TARGET_PAGE_BITS -> qemu_target_page_bits()
hw/s390x/vfio: Replace TARGET_PAGE_BITS -> qemu_target_page_bits()
hw/misc: Build 'mac_via' as common unit file
hw/display: Build stubs once
fsdev: Build stubs once
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Peter Maydell [Wed, 18 Mar 2026 10:12:39 +0000 (10:12 +0000)]
Merge tag 'migration-20260317-pull-request' of https://gitlab.com/farosas/qemu into staging
Migration/Qtest pull request
Various fixes
# -----BEGIN PGP SIGNATURE-----
#
# iQJEBAABCAAuFiEEqhtIsKIjJqWkw2TPx5jcdBvsMZ0FAmm5muIQHGZhcm9zYXNA
# c3VzZS5kZQAKCRDHmNx0G+wxnVpBEADQYBxOt+SzHpHfv/BqJ2dx0zrJK44+wjUd
# gL8iLA7cd0/Rri2gYV1GuVEiNarC10Fg8NSNf/td2HbucDHviwkg9G84GgbjdyXl
# CWs6pseTkCk0X1W+o/fEaXB4ve1ES4RyJwCpWL+QCN3XUNuaMA7YnFB+8ksW2AuA
# lsgNU6mvXHrR8agTl77/G0R5/mVZ5lu5p9gwz09PCXk0nrWyi5j2a7rA2zLneLuk
# jBfEa5b9yX7au/DL/55wMszkA8NRqft0CabJxTZRYO5YNPXvlsJS0L3gWHWDQ9DB
# I895zk2JnagARpiu/v/eHSf+b6nnmE+huAYxv8iXTw9aOet/2aLusJidS+S5IIV4
# 7Lkomis/ch8KqnDMB+SPnW/9TplfKHHa3Jv/3ZphbOwSM6SxjcHHTtUaIvAhQeAt
# DSLBdprDcMePYxi9ugoZLkIHgJGNiWnx+egOrEMa4ShyDXmIlxcjuV4/RtjI158V
# UXK4qPw2f60+Ic+d6gUMpByEX1O2BZziL97qHLAKWYtA9mktL+mX2x6sIEkIjrQJ
# F6dJcE1yvMY6Imhz+zRcS0Dck+vafHGA0DP8t1oxMYcBKeaGrCzuS9jCBQEp10hk
# L/P2jfdgvtlLRXhcoa22Ynn2qNkJDLEAy6+xHH8thkaaYeg52NGO5wGIYe5+F766
# Cekez3u3NA==
# =7Smy
# -----END PGP SIGNATURE-----
# gpg: Signature made Tue Mar 17 18:18:10 2026 GMT
# gpg: using RSA key AA1B48B0A22326A5A4C364CFC798DC741BEC319D
# gpg: issuer "farosas@suse.de"
# gpg: Good signature from "Fabiano Rosas <farosas@suse.de>" [unknown]
# gpg: aka "Fabiano Almeida Rosas <fabiano.rosas@suse.com>" [unknown]
# gpg: WARNING: The key's User ID is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: AA1B 48B0 A223 26A5 A4C3 64CF C798 DC74 1BEC 319D
* tag 'migration-20260317-pull-request' of https://gitlab.com/farosas/qemu:
tests/qtest/test-hmp: Free machine options
tests/qtest: Don't dup machine name in qtest_cb_for_every_machine callbacks
migration: fix implicit integer division in migration_update_counters
migration/options: Fix leaks in StrOrNull qdev accessors
migration: assert that the same migration handler is not being added twice
tests/qtest/migration: Force exit-on-error=false
migration/multifd: Fix leaks of TLS error objects
tests/qtest/migration: Fix leak in CPR exec test
io: Fix TLS bye task leak
tests/qtest/migration: Fix leak of migration tests data
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* tag 'for-11.0-pull-request' of https://gitlab.com/marcandre.lureau/qemu:
coreaudio: Initialize the buffer for device change
audio: Add functions to initialize buffers
coreaudio: Commit the result of init in the end
coreaudio: Improve naming
ui/surface: Avoid including epoxy/gl.h in header files
ui/console: Remove DisplaySurface::mem_obj
ui/console: Unify pixman-OpenGL format mapping
dump: enhance dump_state_prepare fd initialization
ui/gtk-egl: Ensure EGL surface is available before drawing
ui/dbus-listener: remove dbus_filter on connection close
ui/dbus-listener: Fix FBO leak in dbus_cursor_dmabuf
virtio-gpu: use computed rowstride instead of deriving it from hostmem
virtio-gpu: fix overflow check when allocating 2d image
ui/vdagent: add migration blocker when machine version < 10.1
rutabaga: improve error handling, fix potential crash during init
audio/mixeng: drop some needless checks
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Peter Maydell [Wed, 18 Mar 2026 09:16:48 +0000 (09:16 +0000)]
Merge tag 'pull-block-2026-03-17' of https://gitlab.com/hreitz/qemu into staging
Block layer patches for rc0
- Fix race condition in throttle-group code triggering an assertion
failure
- Fix assertion failure in mirror job when issuing job-complete twice
# -----BEGIN PGP SIGNATURE-----
#
# iQJGBAABCgAwFiEEy2LXoO44KeRfAE00ofpA0JgBnN8FAmm5SG8SHGhyZWl0ekBy
# ZWRoYXQuY29tAAoJEKH6QNCYAZzfMvMP/0IXpGtqMmG4cHvW6KS+VDrX4AOA7ZOg
# 8TP7KhpiFPKxnTzdlSiwlbNGAndUdxA8Ef7z5SUF0kslG9N+Ry3BCG6oB3b1zHAA
# 1Irz30FWny0zlESAvLjsK6KAetGEX/ZKKiEfWjlamZSfWzLI5RK5M8x59SxSene5
# oOe3+nxPV/I2VnXI1+svD3VtPjFxNjx2aA51sUfyuQRMP1II3XUdWCSv6DSb8wAh
# QVTFYWnFK9lHejXIXVOTHas5JG30cvC9fAsIBW8mK5J4rRWJP4zfqq5SQbgg9vtm
# pv0YZS8h0X/Vj3SSbPV6abP4MecVTLvvqCr/gRc+OtHbltK4HFMl3Y29VPDO5vTY
# XCPInFv6D84CliCESx2hGUJx9APScZqH047hxlmTTYdQGO2/RQSI6mr83CoVwKBh
# AmN23A5T2Bru+3zKea8HMwi/8NVtvZUWxJfq/NQRThXtLHILPTzKR6QP2VV8ZyD0
# d4Tqk1CqwE/yitbu9xjxpE5lC3O67q/X8DsH5SYiHJZVxSxQYs4b6LirHmlQrN4F
# aW3TQ7C18re4iqqPK3rlRsgR2q0pEdTbkBqSp5I7ZPU/QKLdklKgYnjI4ZefwjGy
# cMPy94rfP7HINH6SHX6R6AhIqFmPIxr1gPE3IjdOIWEqXV5r89DJ0ehrwWogasFv
# q1Qq7HRBIgwX
# =9y5H
# -----END PGP SIGNATURE-----
# gpg: Signature made Tue Mar 17 12:26:23 2026 GMT
# gpg: using RSA key CB62D7A0EE3829E45F004D34A1FA40D098019CDF
# gpg: issuer "hreitz@redhat.com"
# gpg: Good signature from "Hanna Reitz <hreitz@redhat.com>" [unknown]
# gpg: WARNING: The key's User ID is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: CB62 D7A0 EE38 29E4 5F00 4D34 A1FA 40D0 9801 9CDF
* tag 'pull-block-2026-03-17' of https://gitlab.com/hreitz/qemu:
block/mirror: fix assertion failure upon duplicate complete for job using 'replaces'
throttle-group: Fix race condition in throttle_group_restart_queue()
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Peter Maydell [Wed, 18 Mar 2026 09:16:26 +0000 (09:16 +0000)]
Merge tag 'for-upstream' of https://gitlab.com/bonzini/qemu into staging
* runstate: handle return code of EOPNOTSUPP properly from rebuild_guest()
* meson: do not hardcode paths to generated files
* rust: fix build when --disable-rust and meson < 1.9
* rust: suggest passing --locked to "cargo install"
* tag 'for-upstream' of https://gitlab.com/bonzini/qemu:
rust: suggest passing --locked to "cargo install"
rust: fix build when --disable-rust and meson < 1.9
build-sys: use the "run" variable
runstate: handle return code of EOPNOTSUPP properly from rebuild_guest()
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Paolo Bonzini [Wed, 18 Mar 2026 07:35:21 +0000 (08:35 +0100)]
rust: suggest passing --locked to "cargo install"
Without the option, cargo will try using the latest version of the
dependencies of bindgen-cli. While it will obviously respect the
constraints in Cargo.toml, old versions of Cargo do not have
version-constrained resolution and will choke on dependencies
that need Rust 2024.
Cc: Daniel P. Berrangé <berrange@redhat.com> Cc: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Move stubs to the global stub_ss[] source set. These files
are now built once for all binaries, instead of one time
per system binary.
Add pixman to qemuutil library dependencies since pixman is
transitively included, which is needed to be able to include
prototypes for stubs we declared:
In file included from include/ui/console.h:4,
include/ui/qemu-pixman.h:10:10: fatal error: pixman.h: No such file or directory
10 | #include <pixman.h>
| ^~~~~~~~~~
On OpenBSD, opengl headers are not available in default
include path, and thus we need to add opengl to list of
qemuutil dependencies, otherwise we get:
In file included from ../hw/display/acpi-vga-stub.c:4:
In file included from ../hw/display/vga_int.h:28:
In file included from include/ui/console.h:9:
include/ui/surface.h:11:11: fatal error: 'epoxy/gl.h' file not found
# include <epoxy/gl.h>
^~~~~~~~~~~~
1 error generated.
migrate_add_blocker() can fail (e.g. if migration is already in
progress), in which case it returns a negative value and populates
its errp argument with the reason.
The previous code ignored the return value. Pass &error_fatal so
that on failure QEMU exits cleanly with an informative error message
rather than continuing in an inconsistent state.
Fabiano Rosas [Fri, 13 Mar 2026 18:29:53 +0000 (15:29 -0300)]
tests/qtest: Don't dup machine name in qtest_cb_for_every_machine callbacks
The qtest_get_machines function caches the list of machines in a
static variable. Dup'ing the machine->name string only serves to leak
that memory when a single test is executed.
Aadeshveer Singh [Mon, 16 Mar 2026 13:45:09 +0000 (19:15 +0530)]
migration: fix implicit integer division in migration_update_counters
switchover_bw is a uint64_t, so switchover_bw / 1000 results in an
integer division. This value is then assigned to expected_bw_per_ms
which is of type double. This results in losing precision and is type
unsafe. Adding explicit cast ensures floating-point division.
Akihiko Odaki [Wed, 4 Mar 2026 06:16:57 +0000 (15:16 +0900)]
coreaudio: Commit the result of init in the end
init_out_device may only commit some part of the result and leave the
state inconsistent when it encounters a fatal error or the device gets
unplugged during the operation, which is expressed by
kAudioHardwareBadObjectError or kAudioHardwareBadDeviceError. Commit the
result in the end of the function so that it commits the result iff it
sees no fatal error and the device remains plugged.
With this change, handle_voice_change can rely on core->outputDeviceID
to know whether the output device is initialized after calling
init_out_device.
Akihiko Odaki [Wed, 4 Mar 2026 06:16:56 +0000 (15:16 +0900)]
coreaudio: Improve naming
coreaudio had names that are not conforming to QEMU codding style.
coreaudioVoiceOut also had some members that are prefixed with redundant
words like "output" or "audio".
Global names included "out" to tell they are specific to output devices,
but this rule was not completely enforced.
The frame size had three different names "frameSize", "bufferFrameSize",
and "frameCount".
Akihiko Odaki [Tue, 3 Mar 2026 13:08:56 +0000 (22:08 +0900)]
ui/surface: Avoid including epoxy/gl.h in header files
include/ui/shader.h and include/ui/surface.h are included by files that
do not depend on Epoxy so they shouldn't include epoxy/gl.h. Otherwise,
compilations of these files can fail because the path to the directory
containing epoxy/gl.h may not be passed to the compiler.
Akihiko Odaki [Tue, 3 Mar 2026 13:08:54 +0000 (22:08 +0900)]
ui/console: Unify pixman-OpenGL format mapping
console_gl_check_format() was supposed to check if the pixman format is
supported by surface_gl_create_texture(), but it missed
PIXMAN_BE_x8r8g8b8 and PIXMAN_BE_a8r8g8b8, which are properly mapped to
OpenGL formats by surface_gl_create_texture().
Fix the discrepancy of the two functions by sharing the code to map
pixman formats to OpenGL ones.
Initializing descriptor with zero is unsafe: during cleanup we risk to
unconditional close of fd == 0 in case dump state wasn't fully
initialized. Thus, let's init fd with -1 value and check its value
before closing it.
Signed-off-by: Nikolai Barybin <nikolai.barybin@virtuozzo.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-Id: <20250911123656.413160-2-nikolai.barybin@virtuozzo.com>
Dongwon Kim [Tue, 3 Mar 2026 01:11:51 +0000 (17:11 -0800)]
ui/gtk-egl: Ensure EGL surface is available before drawing
The EGL surface and context are destroyed when a new GTK window is
created. We must ensure these are recreated and initialized before
any rendering happens in gd_egl_refresh.
Currently, the check for a pending draw is performed before the
surface initialization block. This can result in an attempt to
draw when the EGL surface (vc->gfx.esurface) is not yet available.
This patch moves the drawing check after the surface initialization
to ensure a valid surface exists before rendering in gd_egl_refresh.
ui/dbus-listener: remove dbus_filter on connection close
The dbus filter holds a strong reference to the DBusDisplayListener
(via GDestroyNotify) to ensure the listener remains alive while the
filter may still be running in another thread. This creates a
reference cycle (ddl -> conn -> filter -> ddl) that prevents the
listener from being freed.
Break the cycle by connecting to the connection's "closed" signal
and removing the filter when the connection closes.
Fixes: commit fa88b85dea96 ("ui/dbus: filter out pending messages when scanout") Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
ui/dbus-listener: Fix FBO leak in dbus_cursor_dmabuf
cursor_fb is a local egl_fb that gets an FBO allocated via
egl_fb_setup_for_tex but is never destroyed, leaking the
framebuffer object on every cursor update.
Add egl_fb_destroy() after the cursor data has been read.
virtio-gpu: fix overflow check when allocating 2d image
The calc_image_hostmem() comment says pixman_image_create_bits() checks
for overflow. However, this relied on the facts that "bits" was NULL and
it performed it when it was introduced. Since commit 9462ff4695aa, the
"bits" argument can be provided and the check is no longer applied.
Promotes the computation to uint64_t and adds an explicit overflow check
to avoid potential later OOB read/write on the image data.
projects / thirdparty / qemu.git / log
