]> git.ipfire.org Git - thirdparty/qemu.git/log
thirdparty/qemu.git
7 months agotarget/rx: Inline translator_lduw() and translator_ldl()
Philippe Mathieu-Daudé [Thu, 27 Nov 2025 15:51:32 +0000 (16:51 +0100)] 
target/rx: Inline translator_lduw() and translator_ldl()

translator_lduw() and translator_ldl() are defined in
"exec/translator.h" as:

  192 static inline uint16_t
  193 translator_lduw(CPUArchState *env, DisasContextBase *db, vaddr pc)
  194 {
  195     return translator_lduw_end(env, db, pc, MO_TE);
  196 }

  198 static inline uint32_t
  199 translator_ldl(CPUArchState *env, DisasContextBase *db, vaddr pc)
  200 {
  201     return translator_ldl_end(env, db, pc, MO_TE);
  202 }

Directly use the inlined form, expanding MO_TE -> mo_endian().

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20251224163304.91384-4-philmd@linaro.org>

7 months agotarget/rx: Use explicit little-endian LD/ST API
Philippe Mathieu-Daudé [Fri, 4 Oct 2024 10:00:47 +0000 (12:00 +0200)] 
target/rx: Use explicit little-endian LD/ST API

The RX architecture uses little endianness. Directly use
the little-endian LD/ST API.

Mechanical change using:

  $ end=le; \
    for acc in uw w l q tul; do \
      sed -i -e "s/ld${acc}_p(/ld${acc}_${end}_p(/" \
             -e "s/st${acc}_p(/st${acc}_${end}_p(/" \
        $(git grep -wlE '(ld|st)t?u?[wlq]_p' target/rx/); \
    done

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20251224163304.91384-3-philmd@linaro.org>

7 months agotarget/rx: Use little-endian variant of cpu_ld/st_data*()
Philippe Mathieu-Daudé [Fri, 21 Nov 2025 08:29:14 +0000 (09:29 +0100)] 
target/rx: Use little-endian variant of cpu_ld/st_data*()

We only build the RX target using little endianness order,
therefore the cpu_ld/st_data*() definitions expand to the little
endian declarations. Use the explicit little-endian variants.

Mechanical change running:

  $ tgt=rx; \
    end=le; \
    for op in data mmuidx_ra; do \
      for ac in uw sw l q; do \
        sed -i -e "s/cpu_ld${ac}_${op}/cpu_ld${ac}_${end}_${op}/" \
                  $(git grep -l cpu_ target/${tgt}/); \
      done;
      for ac in w l q; do \
        sed -i -e "s/cpu_st${ac}_${op}/cpu_st${ac}_${end}_${op}/" \
                  $(git grep -l cpu_ target/${tgt}/); \
      done;
    done

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Message-ID: <20251126202200.23100-5-philmd@linaro.org>

7 months agotarget/openrisc: Build system units in common source set
Philippe Mathieu-Daudé [Wed, 7 Jan 2026 08:31:11 +0000 (09:31 +0100)] 
target/openrisc: Build system units in common source set

Since previous 2 commits and range 2795bc52af4..5b67dbf1dc3 we
remove all uses of the target_ulong type in target/rx/. Use the
meson target_common_system_arch[] source set to prevent further
uses of target-specific types.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260107200702.54582-7-philmd@linaro.org>

7 months agotarget/openrisc: Avoid target-specific migration headers in machine.c
Philippe Mathieu-Daudé [Wed, 7 Jan 2026 08:31:05 +0000 (09:31 +0100)] 
target/openrisc: Avoid target-specific migration headers in machine.c

machine.c doesn't use any target-specific macro defined by
the "migration/cpu.h" header. Use the minimum header required:
"migration/qemu-file-types.h" and "migration/vmstate.h", which
are not target-specific.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Prasad Pandit <pjp@fedoraproject.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260107200702.54582-6-philmd@linaro.org>

7 months agotarget/openrisc: Remove unused 'gdbstub/helpers.h' header in helper.c
Philippe Mathieu-Daudé [Wed, 7 Jan 2026 08:30:58 +0000 (09:30 +0100)] 
target/openrisc: Remove unused 'gdbstub/helpers.h' header in helper.c

"gdbstub/helpers.h" uses target-specific symbols, but we don't
need it, so remove it.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260107200702.54582-5-philmd@linaro.org>

7 months agotarget/openrisc: Inline translator_ldl()
Philippe Mathieu-Daudé [Thu, 27 Nov 2025 15:50:59 +0000 (16:50 +0100)] 
target/openrisc: Inline translator_ldl()

translator_ldl() is defined in "exec/translator.h" as:

  198 static inline uint32_t
  199 translator_ldl(CPUArchState *env, DisasContextBase *db, vaddr pc)
  200 {
  201     return translator_ldl_end(env, db, pc, MO_TE);
  202 }

Directly use the inlined form, expanding MO_TE -> mo_endian().

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20251224161804.90064-4-philmd@linaro.org>

7 months agotarget/openrisc: Use explicit big-endian LD/ST API
Philippe Mathieu-Daudé [Fri, 4 Oct 2024 10:02:02 +0000 (12:02 +0200)] 
target/openrisc: Use explicit big-endian LD/ST API

The OpenRISC architecture uses big endianness. Directly
use the big-endian LD/ST API.

Mechanical change running:

  $ for a in uw w l q; do \
      sed -i -e "s/ld${a}_p(/ld${a}_be_p(/" \
        $(git grep -wlE '(ld|st)u?[wlq]_p' target/openrisc/);
    done

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20251224161804.90064-3-philmd@linaro.org>

7 months agohw/intc: Mark OpenRISC-specific peripheral as big-endian
Philippe Mathieu-Daudé [Wed, 10 Dec 2025 05:20:01 +0000 (06:20 +0100)] 
hw/intc: Mark OpenRISC-specific peripheral as big-endian

The Open Multi-Processor Interrupt Controller (ompic) is only
used by the OpenRISC target, which is only built as big-endian.
Therefore the DEVICE_NATIVE_ENDIAN definition expand to
DEVICE_BIG_ENDIAN (besides, the DEVICE_LITTLE_ENDIAN case isn't
tested). Simplify directly using DEVICE_BIG_ENDIAN.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20251224161804.90064-2-philmd@linaro.org>

7 months agohw/microblaze: Build files once
Philippe Mathieu-Daudé [Tue, 6 Jan 2026 21:12:41 +0000 (22:12 +0100)] 
hw/microblaze: Build files once

Previous commit removed the last target-specific use in
hw model units, we can now build them once.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-ID: <20260106235333.22752-7-philmd@linaro.org>

7 months agohw/microblaze: Replace TARGET_BIG_ENDIAN -> target_big_endian()
Philippe Mathieu-Daudé [Tue, 6 Jan 2026 21:14:29 +0000 (22:14 +0100)] 
hw/microblaze: Replace TARGET_BIG_ENDIAN -> target_big_endian()

Check endianness at runtime to remove the target-specific
TARGET_BIG_ENDIAN definition.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-ID: <20260106235333.22752-6-philmd@linaro.org>

7 months agotarget/microblaze: Build system files once
Philippe Mathieu-Daudé [Tue, 6 Jan 2026 21:39:00 +0000 (22:39 +0100)] 
target/microblaze: Build system files once

Previous commit removed the last target-specific use in
system units, we can now build them once.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-ID: <20260106235333.22752-5-philmd@linaro.org>

7 months agotarget/microblaze: Avoid target-specific migration headers in machine.c
Philippe Mathieu-Daudé [Tue, 6 Jan 2026 21:39:34 +0000 (22:39 +0100)] 
target/microblaze: Avoid target-specific migration headers in machine.c

machine.c doesn't use any target-specific macro defined by
the "migration/cpu.h" header. Use the minimum header requiered:
"migration/qemu-file-types.h" and "migration/vmstate.h", which
are not target-specific.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-ID: <20260106235333.22752-4-philmd@linaro.org>

7 months agotarget/microblaze: Directly check endianness via CPUConfig::endi flag
Philippe Mathieu-Daudé [Mon, 5 Jan 2026 19:57:31 +0000 (20:57 +0100)] 
target/microblaze: Directly check endianness via CPUConfig::endi flag

The MicroBlazeCPUConfig::endi flag reports whether the CPU is
configure in little endianness. Directly use this knowledge
instead of evaluating MemOp from mo_endian().

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-ID: <20260106235333.22752-3-philmd@linaro.org>

7 months agotarget/m68k: Replace MD_TLONG -> MD_I32 in monitor.c
Philippe Mathieu-Daudé [Wed, 7 Jan 2026 16:38:41 +0000 (17:38 +0100)] 
target/m68k: Replace MD_TLONG -> MD_I32 in monitor.c

m68k's monitor_defs[] array implicitly uses type=MD_TLONG for
all its entries. Since we only build this target as 32-bit,
use the explicit MD_I32 type to avoid an indirect target_long
use.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260107200702.54582-10-philmd@linaro.org>

7 months agotarget/loongarch: Inline translator_ldl()
Philippe Mathieu-Daudé [Thu, 27 Nov 2025 15:51:32 +0000 (16:51 +0100)] 
target/loongarch: Inline translator_ldl()

translator_ldl() is defined in "exec/translator.h" as:

  198 static inline uint32_t
  199 translator_ldl(CPUArchState *env, DisasContextBase *db, vaddr pc)
  200 {
  201     return translator_ldl_end(env, db, pc, MO_TE);
  202 }

Directly use the inlined form, expanding MO_TE -> MO_LE
since LoongArch use little-endian order.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Bibo Mao <maobibo@loongson.cn>
Message-ID: <20251224161456.89707-8-philmd@linaro.org>

7 months agotarget/loongarch: Use explicit little-endian LD/ST API
Philippe Mathieu-Daudé [Sat, 13 Dec 2025 17:59:04 +0000 (18:59 +0100)] 
target/loongarch: Use explicit little-endian LD/ST API

The LoongArch architecture uses little endianness. Directly
use the little-endian LD/ST API.

Mechanical change using:

  $ end=le; \
    for acc in uw w l q tul; do \
      sed -i -e "s/ld${acc}_p(/ld${acc}_${end}_p(/" \
             -e "s/st${acc}_p(/st${acc}_${end}_p(/" \
        $(git grep -wlE '(ld|st)t?u?[wlq]_p' target/loongarch/); \
    done

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Bibo Mao <maobibo@loongson.cn>
Message-ID: <20251224161456.89707-1-philmd@linaro.org>

7 months agotarget/loongarch: Inline cpu_ldl_code() call in cpu_do_interrupt()
Philippe Mathieu-Daudé [Thu, 20 Nov 2025 17:46:58 +0000 (18:46 +0100)] 
target/loongarch: Inline cpu_ldl_code() call in cpu_do_interrupt()

In preparation of removing the cpu_ldl_code wrapper, inline it.

Since LoongArch instructions are always stored in little-endian
order, replace MO_TE -> MO_LE.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Bibo Mao <maobibo@loongson.cn>
Message-Id: <20251224161456.89707-6-philmd@linaro.org>

7 months agotarget/loongarch: Replace MO_TE -> MO_LE
Philippe Mathieu-Daudé [Mon, 17 Mar 2025 13:32:51 +0000 (14:32 +0100)] 
target/loongarch: Replace MO_TE -> MO_LE

We only build the LoongArch target using little endianness
order, therefore the MO_TE definitions expand to the little
endian one. Use the latter which is more explicit.

Mechanical change running:

  $ sed -i -e s/MO_TE/MO_LE/ \
        $(git grep -wl MO_TE target/loongarch/)

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Bibo Mao <maobibo@loongson.cn>
Message-ID: <20251224161456.89707-5-philmd@linaro.org>

7 months agotarget/loongarch: Use hwaddr type for physical addresses
Philippe Mathieu-Daudé [Sun, 14 Dec 2025 09:30:23 +0000 (10:30 +0100)] 
target/loongarch: Use hwaddr type for physical addresses

Replace variables used with get_physical_address(), which
expect a physical addresses, by the 'hwaddr' type, instead
of the 'target_ulong' one.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Bibo Mao <maobibo@loongson.cn>
Message-ID: <20251224161456.89707-4-philmd@linaro.org>

7 months agotarget/loongarch: Replace target_ulong -> uint64_t for DMW and TLBRBADV
Philippe Mathieu-Daudé [Sun, 14 Dec 2025 09:34:56 +0000 (10:34 +0100)] 
target/loongarch: Replace target_ulong -> uint64_t for DMW and TLBRBADV

The Direct Mapping Configuration Window and Bad Virtual
Address CSR registers are declared as uint64_t since their
introduction in commit 398cecb9c3e ("target/loongarch: Add
CSRs definition"):

 296 typedef struct CPUArchState {
 ...
 345     uint64_t CSR_TLBRBADV;
 ...
 359     uint64_t CSR_DMW[4];
 ...
 385 } CPULoongArchState;

Use the proper uint64_t type instead of target_ulong
(which would otherwise be truncated on 32-bit builds).

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Bibo Mao <maobibo@loongson.cn>
Message-Id: <20251224161456.89707-3-philmd@linaro.org>

7 months agohw/loongarch: Use explicit little-endian LD/ST API
Philippe Mathieu-Daudé [Sat, 13 Dec 2025 18:00:30 +0000 (19:00 +0100)] 
hw/loongarch: Use explicit little-endian LD/ST API

The LoongArch architecture uses little endianness. Directly
use the little-endian LD/ST API.

Mechanical change using:

  $ end=le; \
    for acc in uw w l q tul; do \
      sed -i -e "s/ld${acc}_p(/ld${acc}_${end}_p(/" \
             -e "s/st${acc}_p(/st${acc}_${end}_p(/" \
        $(git grep -wlE '(ld|st)t?u?[wlq]_p' hw/loongarch/); \
    done

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Bibo Mao <maobibo@loongson.cn>
Message-ID: <20251224161456.89707-2-philmd@linaro.org>

7 months agotarget/hppa: Remove target_ulong use in disas_log() handler
Philippe Mathieu-Daudé [Wed, 7 Jan 2026 08:42:54 +0000 (09:42 +0100)] 
target/hppa: Remove target_ulong use in disas_log() handler

Since commit 85c19af63e7 ("include/exec: Use vaddr in DisasContextBase
virtual addresses") the DisasContextBase::pc_first field is a vaddr
type.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260107200702.54582-9-philmd@linaro.org>

7 months agotarget/hppa: Avoid target-specific migration headers in machine.c
Philippe Mathieu-Daudé [Wed, 7 Jan 2026 08:41:52 +0000 (09:41 +0100)] 
target/hppa: Avoid target-specific migration headers in machine.c

machine.c doesn't use any target-specific macro defined by
the "migration/cpu.h" header. Use the minimum header required:
"migration/qemu-file-types.h" and "migration/vmstate.h", which
are not target-specific.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Prasad Pandit <pjp@fedoraproject.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260107200702.54582-8-philmd@linaro.org>

7 months agotarget/hppa: Inline translator_ldl()
Philippe Mathieu-Daudé [Thu, 27 Nov 2025 15:50:59 +0000 (16:50 +0100)] 
target/hppa: Inline translator_ldl()

translator_ldl() is defined in "exec/translator.h" as:

  198 static inline uint32_t
  199 translator_ldl(CPUArchState *env, DisasContextBase *db, vaddr pc)
  200 {
  201     return translator_ldl_end(env, db, pc, MO_TE);
  202 }

Directly use the inlined form, expanding MO_TE -> mo_endian().

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20251229225517.45078-5-philmd@linaro.org>

7 months agotarget/hppa: Use explicit big-endian LD/ST API
Philippe Mathieu-Daudé [Fri, 4 Oct 2024 09:47:05 +0000 (11:47 +0200)] 
target/hppa: Use explicit big-endian LD/ST API

The HPPA architecture uses big endianness. Directly use
the big-endian LD/ST API.

Mechanical change using:

  $ end=be; \
    for acc in uw w l q tul; do \
      sed -i -e "s/ld${acc}_p(/ld${acc}_${end}_p(/" \
             -e "s/st${acc}_p(/st${acc}_${end}_p(/" \
        $(git grep -wlE '(ld|st)t?u?[wlq]_p' target/hppa/); \
    done

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20251229225517.45078-4-philmd@linaro.org>

7 months agotarget/hppa: Remove unnecessary @cpu variable by using cpu_env()
Philippe Mathieu-Daudé [Mon, 29 Dec 2025 22:48:41 +0000 (23:48 +0100)] 
target/hppa: Remove unnecessary @cpu variable by using cpu_env()

Partly revert changes introduced by commit b2c2d00f48c ("target/hppa:
add 64 bit support to gdbstub"), restoring the cpu_env() call and
removing the unused @cpu argument.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20251229225517.45078-3-philmd@linaro.org>

7 months agotarget/hppa: Use big-endian variant of cpu_ld/st_data*()
Philippe Mathieu-Daudé [Fri, 21 Nov 2025 08:47:00 +0000 (09:47 +0100)] 
target/hppa: Use big-endian variant of cpu_ld/st_data*()

We only build the HPPA target using big endianness order,
therefore the cpu_ld/st_data*() definitions expand to the big
endian declarations. Use the explicit big-endian variants.

Mechanical change running:

  $ tgt=hppa; \
    end=be; \
    for op in data mmuidx_ra; do \
      for ac in uw sw l q; do \
        sed -i -e "s/cpu_ld${ac}_${op}/cpu_ld${ac}_${end}_${op}/" \
                  $(git grep -l cpu_ target/${tgt}/); \
      done;
      for ac in w l q; do \
        sed -i -e "s/cpu_st${ac}_${op}/cpu_st${ac}_${end}_${op}/" \
                  $(git grep -l cpu_ target/${tgt}/); \
      done;
    done

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20251229225517.45078-2-philmd@linaro.org>

7 months agotarget/hexagon: Use little-endian variant of cpu_ld/st_data*()
Philippe Mathieu-Daudé [Fri, 21 Nov 2025 08:23:52 +0000 (09:23 +0100)] 
target/hexagon: Use little-endian variant of cpu_ld/st_data*()

We only build the Hexagon target using little endianness order,
therefore the cpu_ld/st_data*() definitions expand to the little
endian declarations. Use the explicit little-endian variants.

Mechanical change running:

  $ tgt=hexagon; \
    end=le; \
    for op in data mmuidx_ra; do \
      for ac in uw sw l q; do \
        sed -i -e "s/cpu_ld${ac}_${op}/cpu_ld${ac}_${end}_${op}/" \
                  $(git grep -l cpu_ target/${tgt}/); \
      done;
      for ac in w l q; do \
        sed -i -e "s/cpu_st${ac}_${op}/cpu_st${ac}_${end}_${op}/" \
                  $(git grep -l cpu_ target/${tgt}/); \
      done;
    done

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Brian Cain <brian.cain@oss.qualcomm.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20251219185025.97318-3-philmd@linaro.org>

7 months agotarget/hexagon: Inline translator_ldl()
Philippe Mathieu-Daudé [Thu, 27 Nov 2025 15:51:32 +0000 (16:51 +0100)] 
target/hexagon: Inline translator_ldl()

translator_ldl() is defined in "exec/translator.h" as:

  198 static inline uint32_t
  199 translator_ldl(CPUArchState *env, DisasContextBase *db, vaddr pc)
  200 {
  201     return translator_ldl_end(env, db, pc, MO_TE);
  202 }

Directly use the inlined form, expanding MO_TE -> MO_LE
since Hexagon use little-endian order.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Message-ID: <20251224160708.89085-2-philmd@linaro.org>

7 months agotarget/avr: Inline translator_lduw()
Philippe Mathieu-Daudé [Thu, 27 Nov 2025 15:51:32 +0000 (16:51 +0100)] 
target/avr: Inline translator_lduw()

translator_lduw() is defined in "exec/translator.h" as:

 192 static inline uint16_t
 193 translator_lduw(CPUArchState *env, DisasContextBase *db, vaddr pc)
 194 {
 195     return translator_lduw_end(env, db, pc, MO_TE);
 196 }

Directly use the inlined form, expanding MO_TE -> MO_LE
since AVR only exists in little-endian.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Message-ID: <20251218213053.61665-3-philmd@linaro.org>

7 months agotarget/alpha: Introduce alpha_phys_addr_space_bits()
Anton Johansson [Mon, 12 Jan 2026 12:22:42 +0000 (13:22 +0100)] 
target/alpha: Introduce alpha_phys_addr_space_bits()

In preparation for dropping TARGET_PHYS_ADDR_SPACE_BITS, add a
a runtime function to correctly represent the size of the physical
address space for EV4-6 based on the current CPU version.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Anton Johansson <anjo@rev.ng>
Message-ID: <20260112-phys_addr-v3-1-5f90fdb4015f@rev.ng>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
7 months agotarget/alpha: Inline translator_ldl()
Philippe Mathieu-Daudé [Thu, 27 Nov 2025 15:51:32 +0000 (16:51 +0100)] 
target/alpha: Inline translator_ldl()

translator_ldl() is defined in "exec/translator.h" as:

  198 static inline uint32_t
  199 translator_ldl(CPUArchState *env, DisasContextBase *db, vaddr pc)
  200 {
  201     return translator_ldl_end(env, db, pc, MO_TE);
  202 }

Directly use the inlined form.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260106155755.53646-5-philmd@linaro.org>

7 months agotarget/alpha: Inline cpu_ldl_code() call in do_unaligned_access()
Philippe Mathieu-Daudé [Thu, 20 Nov 2025 15:07:37 +0000 (16:07 +0100)] 
target/alpha: Inline cpu_ldl_code() call in do_unaligned_access()

In preparation of removing the cpu_ldl_code wrapper, inline it.
Use the return address argument.

Since Alpha instructions are always stored in little-endian
order, replace MO_TE -> MO_LE.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260106155755.53646-4-philmd@linaro.org>

7 months agohw/alpha: Use explicit little-endian LD/ST API
Philippe Mathieu-Daudé [Sat, 13 Dec 2025 18:02:00 +0000 (19:02 +0100)] 
hw/alpha: Use explicit little-endian LD/ST API

The Alpha architecture uses little endianness. Directly
use the little-endian LD/ST API.

Mechanical change running:

  $ for a in uw w l q; do \
      sed -i -e "s/ld${a}_p(/ld${a}_le_p(/" \
        $(git grep -wlE '(ld|st)u?[wlq]_p' hw/alpha/);
    done

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260106155755.53646-2-philmd@linaro.org>

7 months agomeson: Allow system binaries to not have target-specific units
Philippe Mathieu-Daudé [Tue, 6 Jan 2026 21:47:12 +0000 (22:47 +0100)] 
meson: Allow system binaries to not have target-specific units

As we are moving toward a single binary, targets might end
without any target-specific objects (all objects being in
the 'common' source set). Allow this by checking the
target_system_arch[] dictionary contains the target key
before using it.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-ID: <20260106235333.22752-2-philmd@linaro.org>

7 months agosystem/ioport: Do not open-code address_space_ld/st_le() methods
Philippe Mathieu-Daudé [Tue, 9 Dec 2025 18:35:36 +0000 (19:35 +0100)] 
system/ioport: Do not open-code address_space_ld/st_le() methods

When a variable size is known, prefer the address_space_ld/st()
API. Keep address_space_read/write() for blobs.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260109165058.59144-23-philmd@linaro.org>

7 months agosystem/ioport: Declare x86-specific I/O port in little-endian order
Philippe Mathieu-Daudé [Mon, 22 Dec 2025 09:08:50 +0000 (10:08 +0100)] 
system/ioport: Declare x86-specific I/O port in little-endian order

X86 in/out port (related to ISA bus) uses little endianness:
- enforce little endianness in x86 cpu_in/out() accessors,
- serialize QTest in/out port accesses as little-endian.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260109165058.59144-22-philmd@linaro.org>

7 months agosystem/memory: Inline address_space_stq_internal()
Philippe Mathieu-Daudé [Tue, 16 Dec 2025 04:37:15 +0000 (05:37 +0100)] 
system/memory: Inline address_space_stq_internal()

As its name suggests, address_space_stq_internal() is an
internal method which can be inlined like all the other
ones in this file.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260109165058.59144-7-philmd@linaro.org>

7 months agosystem/memory: Split MemoryRegionCache API to 'memory_cached.h'
Philippe Mathieu-Daudé [Mon, 29 Dec 2025 22:31:08 +0000 (23:31 +0100)] 
system/memory: Split MemoryRegionCache API to 'memory_cached.h'

We have 115 direct inclusions of "system/memory.h", and 91 headers
in include/ use it: hundreds of files have to process it.
However only one single header really uses the MemoryRegionCache
API: "hw/virtio/virtio-access.h". Split it out to a new header,
avoiding processing unused inlined functions hundreds of times.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260109165058.59144-6-philmd@linaro.org>

7 months agosystem/physmem: Convert DEBUG_SUBPAGE printf() to trace events
Philippe Mathieu-Daudé [Fri, 19 Dec 2025 13:14:36 +0000 (14:14 +0100)] 
system/physmem: Convert DEBUG_SUBPAGE printf() to trace events

Defining DEBUG_SUBPAGE allows to use raw printf() statements to
print information about some events; convert these to tracepoints.

Suggested-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260109165058.59144-5-philmd@linaro.org>

7 months agosystem/physmem: Inline and remove leul_to_cpu()
Philippe Mathieu-Daudé [Tue, 9 Dec 2025 20:45:06 +0000 (21:45 +0100)] 
system/physmem: Inline and remove leul_to_cpu()

leul_to_cpu() is only used within physmem.c: inline it
and remove.
Since @bitmap is of 'unsigned long' type, use its size
with ldn_le_p() instead of using HOST_LONG_BITS.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260109165058.59144-4-philmd@linaro.org>

7 months agotests/qtest: Remove unnecessary 'qemu/bswap.h' include
Philippe Mathieu-Daudé [Mon, 22 Dec 2025 15:53:10 +0000 (16:53 +0100)] 
tests/qtest: Remove unnecessary 'qemu/bswap.h' include

None of these files use API declared in "qemu/bswap.h",
remove the unnecessary inclusion.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260109164742.58041-2-philmd@linaro.org>

7 months agobswap: Consistently use builtin bswap() functions
Philippe Mathieu-Daudé [Fri, 9 Jan 2026 14:49:41 +0000 (15:49 +0100)] 
bswap: Consistently use builtin bswap() functions

Since these headers use some __builtin_bswap*(), use it
consistently in all the cases, allowing to remove the
"qemu/bswap.h" inclusion (which only defines bswap* to
the builtin equivalent).

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260109164742.58041-5-philmd@linaro.org>

7 months agodocs/devel/loads-stores: Fix ld/stn_*_p() regexp
Philippe Mathieu-Daudé [Fri, 9 Jan 2026 06:13:01 +0000 (07:13 +0100)] 
docs/devel/loads-stores: Fix ld/stn_*_p() regexp

Fixes: afa4f6653dc ("bswap: Add stn_*_p() and ldn_*_p() functions")
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260109063504.71576-3-philmd@linaro.org>

7 months agoMAINTAINERS: Cover 'system/memory_ldst*.h.inc' files
Philippe Mathieu-Daudé [Fri, 19 Dec 2025 15:54:32 +0000 (16:54 +0100)] 
MAINTAINERS: Cover 'system/memory_ldst*.h.inc' files

Missed in commit c611228c0ed ("include: move memory_ldst*
to include/system").

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260109165058.59144-2-philmd@linaro.org>

7 months agoconfigs: use default prefix for Windows compilation
Paolo Bonzini [Mon, 12 Jan 2026 16:07:36 +0000 (17:07 +0100)] 
configs: use default prefix for Windows compilation

The update to Python 3.13 causes meson configuration to fail, see e.g.:

   https://gitlab.com/qemu-project/qemu/-/jobs/12672816538#L397

   meson.build:1:0: ERROR: prefix value '/qemu' must be an absolute path

This is https://github.com/mesonbuild/meson/issues/14303.  Remove the
prefix='/qemu' line in configs/meson/windows.txt, since commit d17f305a264
("configure: use a platform-neutral prefix", 2020-09-30) says that the
NSIS installer doesn't care.

Cc: qemu-stable@nongnu.org
Cc: Thomas Huth <thuth@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260112160736.1028280-1-pbonzini@redhat.com>

7 months agoMerge tag 'pull-request-2026-01-12' of https://gitlab.com/thuth/qemu into staging
Richard Henderson [Mon, 12 Jan 2026 22:44:00 +0000 (09:44 +1100)] 
Merge tag 'pull-request-2026-01-12' of https://gitlab.com/thuth/qemu into staging

* Check functional tests with pylint
* update copyright year to 2026
* Some more universal-binary work for the s390x code done by Philippe
* Fix reverse debugging for s390x and add a functional test for it

# -----BEGIN PGP SIGNATURE-----
#
# iQJFBAABCgAvFiEEJ7iIR+7gJQEY8+q5LtnXdP5wLbUFAmlk81cRHHRodXRoQHJl
# ZGhhdC5jb20ACgkQLtnXdP5wLbWxhxAAlvaTwC7trSsFY3sTMwenG0GHfg0M840H
# vYXHm69uHigT4IyC2pXOjCN0Yq9zujCymtUIWOKY8l+Hx/x5tgi5fKhOXqqZBhJP
# KyBKZqJx3cVZC54qlNWF0vxSYCi32wi6xQmVlMYtbBZPfbMfY1Vi55PAknpXCWjv
# YfBB72LQhS3uPBLOi2Dg3mkGq9+cqHoAVCDVguOBx0N4SdkotvbKrG4XOhFfzjVu
# VrLgwF2LBLQzlU2JZ/b2u1IOSju67c0qW29dx86p5n6JZdLqNhsOjQ81ToHpQML2
# S/X2Nv0uyZTSzjdriBvkyOnM6L35wpZ2qyPrRekfnwzUNKEyHN9b+WTqAZdvCrm1
# eKrs87HQ7u3XUu3lR43fFCVlAgpstsF2I9UyyiMMEqGlKAjllDzgy7U3SYaP04Zm
# pgv7cLt1jgh5GoLB7TC/XRdy1P7Ya1cZ76tL2Uj93CF4w7E2vtHtVzCA6YQk9kVJ
# jn9pxjYXw/qsoQgM2Ze7UI/d5MYqVHVPK83T5natq1sXf9ardmf2OGQWLrp1JaUl
# O8xeVpMR08tElxPlcEL+3zd5YAw4QrNJ9D7GhfJQWKOgnOkT/4Kslcyqp8wLP4/D
# oeNVrv/aEXA8Lf+ozHyIEejmmWJnmgHlAnfL+wi9KV1JzWAsskg5ClR8G3ZzAa69
# CUnS7mOSnsw=
# =N/we
# -----END PGP SIGNATURE-----
# gpg: Signature made Tue 13 Jan 2026 12:12:55 AM AEDT
# gpg:                using RSA key 27B88847EEE0250118F3EAB92ED9D774FE702DB5
# gpg:                issuer "thuth@redhat.com"
# gpg: Good signature from "Thomas Huth <th.huth@gmx.de>" [unknown]
# gpg:                 aka "Thomas Huth <thuth@redhat.com>" [unknown]
# gpg:                 aka "Thomas Huth <th.huth@posteo.de>" [unknown]
# gpg:                 aka "Thomas Huth <huth@tuxfamily.org>" [unknown]
# gpg: WARNING: The key's User ID is not certified with a trusted signature!
# gpg:          There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 27B8 8847 EEE0 2501 18F3  EAB9 2ED9 D774 FE70 2DB5

* tag 'pull-request-2026-01-12' of https://gitlab.com/thuth/qemu:
  tests/functional/s390x: Add reverse debugging test for s390x
  target/s390x: Fix infinite loop during replay
  target/s390x: Un-inline s390_is_pv()
  target/s390x: Simplify S390_ADAPTER_SUPPRESSIBLE definition
  target/s390x: Remove unused 'gdbstub/helpers.h' header in helper.c
  target/s390x: Replace target_ulong -> uint64_t in gdb_write_register()
  target/s390x: Use vaddr for $pc in get_next_pc()
  target/s390x: Restrict WatchPoint API to TCG
  docs: update copyright year to 2026
  tests/functional: Add a generic test that checks the files with pylint
  tests/functional/aarch64/test_smmu: Silence warning from pylint
  tests/functional/aarch64/test_virt_gpu: Fix style issues
  tests/functional/ppc64/test_hv: Silence warnings reported by pylint
  tests/functional/mips/test_malta: Silence warnings reported by pylint
  tests/functional: Add a pylintrc file

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
7 months agoMerge tag 'pull-ppc-for-11.0-20260112' of https://gitlab.com/harshpb/qemu into staging
Richard Henderson [Mon, 12 Jan 2026 22:43:39 +0000 (09:43 +1100)] 
Merge tag 'pull-ppc-for-11.0-20260112' of https://gitlab.com/harshpb/qemu into staging

First PPC PR for 11.0

- Snapshot support for several ppc devices
- Migration fix and OS level migration test for pseries
- Minor code cleanups

# -----BEGIN PGP SIGNATURE-----
#
# iQIzBAABCAAdFiEEa4EM1tK+EPOIPSFCRUTplPnWj7sFAmlky2YACgkQRUTplPnW
# j7vXUg/8Dx/nsygeDspmhlmvqEWjyXm3fjIGnyCtSZWSkDkhh1x+uc0khFLuG8in
# 1Ep2D4qkGDBrdv079WzDKJDhgH21gTApA92xUsJFof2LLgN+MZOgi2Im6wR+Prtr
# EddB7jJ062fDDyMQWBdg+9jkl0+xuj+JE5JXPbXV0Fqu+t3rVJvn7c1b3uRXRrC9
# hgiss0xgTpXdVGnVjsQYLr3+iJ5Qcd7+6UhtRzTgv7S02IJRjpVoHSayBnKmzG9r
# eLqQMykyqU8drmQUruTk1nM2PRbaGTuRO+Swcld7SgqxOxxYIXD72f89B94kZKqM
# qZKv/C03EP30wS7/zJMwWsIEuXKM/oUwXl4i5C5eRUIa637VjcFEhuj0fCd8qxmz
# mUp6tVTYaGESpWUJA9TLZOkvLO9c4gumbTWa5valYeRWCLdXFQZgDg0wrwu7SL5M
# vdzKdnTMozkkKIY0W2Gk5j6E6aHpcGvNxREGrtI1BEUGKtGVzPjMHZmYDormSLIz
# lvgZj7JEncjkGv6uIYKMv1tT7Cbo2YxoGRWbx59PWpK9Ekl8307BMi2OtPYqZm7N
# CKS0lK+OM8CUP7Ao4nwxzH+T6X+C88Ivjt31sS25ixdUK6+Wy8tCEK2XCwA8gxjH
# QuBMDYMoAWgZ+mQITNy+HrqM1TBI8a4PiF9DjX2xj3sdyBd67F8=
# =2zBL
# -----END PGP SIGNATURE-----
# gpg: Signature made Mon 12 Jan 2026 09:22:30 PM AEDT
# gpg:                using RSA key 6B810CD6D2BE10F3883D21424544E994F9D68FBB
# gpg: Good signature from "Harsh Prateek Bora <harsh.prateek.bora@gmail.com>" [undefined]
# gpg:                 aka "Harsh Prateek Bora <harshpb@linux.ibm.com>" [undefined]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg:          There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 6B81 0CD6 D2BE 10F3 883D  2142 4544 E994 F9D6 8FBB

* tag 'pull-ppc-for-11.0-20260112' of https://gitlab.com/harshpb/qemu:
  tests/functional: Add a OS level migration test for pseries
  target/ppc: Fix env->quiesced migration
  hw/ppc: Add VMSTATE information to PnvPsi
  hw/ppc: pnv_chiptod.c add vmstate support
  hw/ppc: pnv_core.c add vmstate support
  hw/ppc: pnv_adu.c added vmstate support
  hw/ppc: Add pnv_i2c vmstate support
  hw/ppc: Add pnv_spi vmstate support
  hw/ppc: Add VMSTATE information for LPC model
  target/ppc/kvm : Use macro names instead of hardcoded constants as return values

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
7 months agoMerge tag 'pull-loongarch-20260112' of https://github.com/bibo-mao/qemu into staging
Richard Henderson [Mon, 12 Jan 2026 21:23:10 +0000 (08:23 +1100)] 
Merge tag 'pull-loongarch-20260112' of https://github.com/bibo-mao/qemu into staging

loongarch queue

# -----BEGIN PGP SIGNATURE-----
#
# iHUEABYKAB0WIQQNhkKjomWfgLCz0aQfewwSUazn0QUCaWSdwgAKCRAfewwSUazn
# 0cwwAQC4xgK0x98Z10yoMfuIz5FfDq1onrFC7rd5k0K7pLgsywEA1NrLtW/lSy6Z
# xlgaus/3reiDz+zEOeBQPLibVIVQSA0=
# =8ksY
# -----END PGP SIGNATURE-----
# gpg: Signature made Mon 12 Jan 2026 06:07:46 PM AEDT
# gpg:                using EDDSA key 0D8642A3A2659F80B0B3D1A41F7B0C1251ACE7D1
# gpg: Good signature from "bibo mao <maobibo@loongson.cn>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg:          There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 7044 3A00 19C0 E97A 31C7  13C4 8E86 8FB7 A176 9D4C
#      Subkey fingerprint: 0D86 42A3 A265 9F80 B0B3  D1A4 1F7B 0C12 51AC E7D1

* tag 'pull-loongarch-20260112' of https://github.com/bibo-mao/qemu:
  hw/loongarch/virt: Add property highmem-mmio-size with virt machine
  hw/loongarch/virt: Add high MMIO support with GPEX host
  hw/loongarch/virt: Add property highmem_mmio with virt machine
  hw/loongarch/virt: Get PCI info from gpex config info
  hw/loongarch/virt: Get irq number from gpex config info
  hw/loongarch/virt: Add field gpex in LoongArchVirtMachineState
  hw/loongarch/virt: Add field ram_end in LoongArchVirtMachineState
  target/loongarch: Add PMU register dump support in KVM
  target/loongarch: Call function loongarch_la464_init_csr() after realized
  target/loongarch: Add PMU migration support in KVM mode

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
7 months agotarget/m68k: Improve CHK and CHK2; implement CMP2
William Hooper [Mon, 22 Dec 2025 00:26:34 +0000 (16:26 -0800)] 
target/m68k: Improve CHK and CHK2; implement CMP2

Some CHK2 (Check Register Against Bounds) instructions, such as opcode
02FA, cause spurious illegal instruction exceptions, despite being valid
on Motorola MC68020 and later processors and used in existing software.

With this patch, QEMU:

- Translates CHK2 and CMP2 (Compare Register Against Bounds)
  instructions [1] having any valid size or effective address. CHK2 and
  CMP2 use the same opcodes but differ in bit 11 of the extension word.
  (BITREV or BYTEREV instructions for ColdFire family processors [2],
  which use similar opcodes, are not captured, however.)

- Implements CMP2, which "is identical to CHK2 except that it sets
  condition codes rather than taking an exception" [1].

- Populates the correct "logical address of the instruction following
  the instruction that caused the trap" [3] in the exception stack frame
  for CHK and CHK2 exceptions, according to the number of words in the
  instruction, including extension words, rather than default lengths.

An existing test for CHK2 is enabled, and tests are added for CHK, CHK2,
and CMP2.

References:
[1] Motorola M68000 Family Programmer's Reference Manual (M68000PM/AD),
    Rev. 1, 1992, pages 4-72 to 4-73 and 4-82 to 4-83.
[2] Freescale Semiconductor, ColdFire Family Programmer's Reference Manual
    (CFPRM), Rev. 3, 2005, pages 4-19 and 4-26.
[3] Motorola M68040 User's Manual (M68040UM/AD), 1993, page 8-8.

Signed-off-by: William Hooper <wsh@wshooper.org>
Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Message-ID: <20251222002634.61480-1-wsh@wshooper.org>
Signed-off-by: Laurent Vivier <laurent@vivier.eu>
7 months agom68k: link.l is only available with 68020+
Laurent Vivier [Sat, 27 Dec 2025 21:02:50 +0000 (22:02 +0100)] 
m68k: link.l is only available with 68020+

Base 68000 only supports word size.

Signed-off-by: Laurent Vivier <laurent@vivier.eu>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: William Hooper <wsh@wshooper.org>
Message-ID: <20251227210250.411882-1-laurent@vivier.eu>

7 months agom68k: fix CAS2 writeback when Dc1==Dc2
Laurent Vivier [Fri, 26 Dec 2025 21:37:07 +0000 (22:37 +0100)] 
m68k: fix CAS2 writeback when Dc1==Dc2

According to Programmer's Reference Manual, if Dc1 and Dc2 specify the
same data register and the comparison fails, memory operand 1 is stored
in the data register.

The current helpers wrote Dc1 then Dc2, leaving operand 2 in the shared
register.

Swap the writeback order for cas2w/cas2l so memory operand 1 wins.

Signed-off-by: Laurent Vivier <laurent@vivier.eu>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20251226213707.331741-1-laurent@vivier.eu>

7 months agotests/functional/s390x: Add reverse debugging test for s390x
Thomas Huth [Fri, 28 Nov 2025 13:39:49 +0000 (14:39 +0100)] 
tests/functional/s390x: Add reverse debugging test for s390x

We just have to make sure that we can set the endianness to big endian,
then we can also run this test on s390x.

Reviewed-by: Ilya Leoshkevich <iii@linux.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20251128133949.181828-1-thuth@redhat.com>

7 months agotarget/s390x: Fix infinite loop during replay
Ilya Leoshkevich [Mon, 1 Dec 2025 21:49:42 +0000 (22:49 +0100)] 
target/s390x: Fix infinite loop during replay

Replaying even trivial s390x kernels hangs, because:

- cpu_post_load() fires the TOD timer immediately.

- s390_tod_load() schedules work for firing the TOD timer.

- If rr loop sees work and then timer, we get one timer expiration.

- If rr loop sees timer and then work, we get two timer expirations.

- Record and replay may diverge due to this race.

- In this particular case divergence makes replay loop spin: it sees that
  TOD timer has expired, but cannot invoke its callback, because there
  is no recorded CHECKPOINT_CLOCK_VIRTUAL.

- The order in which rr loop sees work and timer depends on whether
  and when rr loop wakes up during load_snapshot().

- rr loop may wake up after the main thread kicks the CPU and drops
  the BQL, which may happen if it calls, e.g., qemu_cond_wait_bql().

Firing TOD timer twice is duplicate work, but it was introduced
intentionally in commit 7c12f710bad6 ("s390x/tcg: rearm the CKC timer
during migration") in order to avoid dependency on migration order.

The key culprits here are timers that are armed ready expired. They
break the ordering between timers and CPU work, because they are not
constrained by instruction execution, thus introducing non-determinism
and record-replay divergence.

Fix by converting such timer callbacks to CPU work. Also add TOD clock
updates to the save path, mirroring the load path, in order to have the
same CHECKPOINT_CLOCK_VIRTUAL during recording and replaying.

Link: https://lore.kernel.org/qemu-devel/20251128133949.181828-1-thuth@redhat.com/
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Tested-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20251201215514.1751994-1-iii@linux.ibm.com>
[thuth: Add SPDX license identifiers to the new stubs files]
Signed-off-by: Thomas Huth <thuth@redhat.com>
7 months agotarget/s390x: Un-inline s390_is_pv()
Philippe Mathieu-Daudé [Wed, 7 Jan 2026 13:08:03 +0000 (14:08 +0100)] 
target/s390x: Un-inline s390_is_pv()

Inlining a method which use a static variable is really a
bad idea, as it totally defeats the point of both concepts.

Currently we have 12 + 4 = 16 static 'ccw' variables...:

  $ git grep -wl target/s390x/kvm/pv.h | fgrep .h
  hw/s390x/ipl.h
  $ git grep -wl target/s390x/kvm/pv.h | fgrep .c | wc -l
        12
  $ git grep -wl hw/s390x/ipl.h | fgrep .c | wc -l
         4

Fixes: c3347ed0d2e ("s390x: protvirt: Support unpack facility")
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20260107130807.69870-16-philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
7 months agotarget/s390x: Simplify S390_ADAPTER_SUPPRESSIBLE definition
Philippe Mathieu-Daudé [Wed, 7 Jan 2026 13:08:02 +0000 (14:08 +0100)] 
target/s390x: Simplify S390_ADAPTER_SUPPRESSIBLE definition

Commit 1497c160661 ("s390x: add flags field for registering I/O
adapter") defined S390_ADAPTER_SUPPRESSIBLE twice, one when
KVM is available and another when it isn't. However both
definitions expand to the same value. Unify them, adding an
extra safety check in KVM-specific file.

This allows removing the target-specific 'CONFIG_KVM'
definition in "cpu.h".

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20260107130807.69870-15-philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
7 months agotarget/s390x: Remove unused 'gdbstub/helpers.h' header in helper.c
Philippe Mathieu-Daudé [Wed, 7 Jan 2026 13:07:53 +0000 (14:07 +0100)] 
target/s390x: Remove unused 'gdbstub/helpers.h' header in helper.c

"gdbstub/helpers.h" uses target-specific symbols, but we don't
need it, so remove it.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20260107130807.69870-6-philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
7 months agotarget/s390x: Replace target_ulong -> uint64_t in gdb_write_register()
Philippe Mathieu-Daudé [Wed, 7 Jan 2026 13:07:52 +0000 (14:07 +0100)] 
target/s390x: Replace target_ulong -> uint64_t in gdb_write_register()

On s390x target_ulong expands to uint64_t. Besides,
ldq_be_p() returns a uint64_t type. Use that instead.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20260107130807.69870-5-philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
7 months agotarget/s390x: Use vaddr for $pc in get_next_pc()
Philippe Mathieu-Daudé [Wed, 7 Jan 2026 13:07:51 +0000 (14:07 +0100)] 
target/s390x: Use vaddr for $pc in get_next_pc()

DisasContextBase::pc_next is of vaddr type.
Since translator_lduw_end() returns a uint16_t,
also use that type for clarity.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20260107130807.69870-4-philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
7 months agotarget/s390x: Restrict WatchPoint API to TCG
Philippe Mathieu-Daudé [Wed, 7 Jan 2026 13:07:49 +0000 (14:07 +0100)] 
target/s390x: Restrict WatchPoint API to TCG

By inverting the 'tcg_enabled()' check in s390_cpu_set_psw()
we can let the compiler elide the s390_cpu_recompute_watchpoints()
call when TCG is not available. Move this function -- along with
s390x_cpu_debug_excp_handler() which was introduced in the same
commit 311918b979c ("target-s390x: PER storage-alteration event
support") -- to a TCG specific file to avoid compiling dead code
on KVM. This restricts the WatchPoint API calls to TCG.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20260107130807.69870-2-philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
7 months agodocs: update copyright year to 2026
Ani Sinha [Wed, 7 Jan 2026 04:52:50 +0000 (10:22 +0530)] 
docs: update copyright year to 2026

We are already in 2026. Update docs to update copyright info to year 2026.

Cc: peter.maydell@linaro.org
Cc: qemu-trivial@nongnu.org
Signed-off-by: Ani Sinha <anisinha@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20260107045250.34420-1-anisinha@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
7 months agotests/functional: Add a generic test that checks the files with pylint
Thomas Huth [Mon, 27 Oct 2025 13:22:59 +0000 (14:22 +0100)] 
tests/functional: Add a generic test that checks the files with pylint

To avoid that new pylint-related warnings get committed, let's check
the files with pylint during each run (similar to what we are doing
for the iotests already).

Message-Id: <20251119082636.43286-16-thuth@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
7 months agotests/functional/aarch64/test_smmu: Silence warning from pylint
Thomas Huth [Thu, 13 Nov 2025 12:47:14 +0000 (13:47 +0100)] 
tests/functional/aarch64/test_smmu: Silence warning from pylint

Pylint thinks that the accel variable might be used here without
being set first, since it does not know that skipTest() never
returns. Thus initialize "accel = None" here to make it happy.

Message-Id: <20251119082636.43286-14-thuth@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
7 months agotests/functional/aarch64/test_virt_gpu: Fix style issues
Thomas Huth [Thu, 13 Nov 2025 11:53:01 +0000 (12:53 +0100)] 
tests/functional/aarch64/test_virt_gpu: Fix style issues

Reshuffle the import statements according to the suggestions from pylint,
use lowercase letters for variable names, and drop some spaces that flake8
did not like.

Message-Id: <20251119082636.43286-12-thuth@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
7 months agotests/functional/ppc64/test_hv: Silence warnings reported by pylint
Thomas Huth [Wed, 29 Oct 2025 15:49:54 +0000 (16:49 +0100)] 
tests/functional/ppc64/test_hv: Silence warnings reported by pylint

To make pylint happy here, remove unused variables, switch to f-string,
use "check=True" when calling subprocess.run() and split a line that was
too long.

Message-Id: <20251119082636.43286-7-thuth@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
7 months agotests/functional/mips/test_malta: Silence warnings reported by pylint
Thomas Huth [Tue, 28 Oct 2025 10:56:41 +0000 (11:56 +0100)] 
tests/functional/mips/test_malta: Silence warnings reported by pylint

Pylint complains about too many positional arguments for the
mips_check_wheezy() function. Add a "*" to enforce that the later
ones are passed with an argument name (all calling sites are doing
this already).

Also turn some old-school format strings into proper f-strings now.

Message-Id: <20251119082636.43286-6-thuth@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
7 months agotests/functional: Add a pylintrc file
Thomas Huth [Fri, 24 Oct 2025 12:14:40 +0000 (14:14 +0200)] 
tests/functional: Add a pylintrc file

Add a pylintrc file that can be used for checking the python code of
the functional tests. For the beginning, we use some rather lax settings.
We still can refine them later if we think that there's a need for it.

Message-Id: <20251119082636.43286-2-thuth@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
7 months agotests/functional: Add a OS level migration test for pseries
Fabiano Rosas [Fri, 9 Jan 2026 12:35:19 +0000 (09:35 -0300)] 
tests/functional: Add a OS level migration test for pseries

There's currently no OS level test for ppc64le. Add one such test by
reusing the boot level tests that are already present.

The test boots the source machine, waits for it to reach a mid-boot
message, migrates and checks that the destination has reached the
final boot message (VFS error due to no disk).

Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/qemu-devel/20260109123519.28703-3-farosas@suse.de
Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
7 months agotarget/ppc: Fix env->quiesced migration
Fabiano Rosas [Fri, 9 Jan 2026 12:35:18 +0000 (09:35 -0300)] 
target/ppc: Fix env->quiesced migration

The commit referenced (from QEMU 10.0) has changed the way the pseries
machine marks a cpu as quiesced. Previously, the cpu->halted value
from QEMU common cpu code was (incorrectly) used. With the fix, the
env->quiesced variable starts being used, which improves on the
original situation, but also causes a side effect after migration:

The env->quiesced is set at reset and never migrated, which causes the
destination QEMU to stop delivering interrupts and hang the machine.

To fix the issue from this point on, start migrating the env->quiesced
value.

For QEMU versions < 10.0, sending the new element on the stream would
cause migration to be aborted, so add the appropriate compatibility
property to omit the new subsection.

Independently of this patch, all migrations from QEMU versions < 10.0
would result in a hang since the older QEMU never migrates
env->quiesced. This is bad because it leaves machines already running
on the old QEMU without a migration path into newer versions.

As a workaround, use a few heuristics to infer the new value of
env->quiesced based on cpu->halted, LPCR and PSSCR bits that are
usually set/cleared along with quiesced.

Note that this was tested with -cpu power9 and -machine ic-mode=xive
due to another bug affecting migration of XICS guests. Tested both
forward and backward migration and savevm/loadvm from 9.2 and 10.0.

Also tested loadvm of a savevm image that contains a mix of cpus both
halted and not halted.

Reported-by: Fabian Vogt <fvogt@suse.de>
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3079
Fixes: fb802acdc8b ("ppc/spapr: Fix RTAS stopped state")
Acked-by: Chinmay Rath <rathc@linux.ibm.com>
Reviewed-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
Signed-off-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/qemu-devel/20260109123519.28703-2-farosas@suse.de
Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
7 months agohw/loongarch/virt: Add property highmem-mmio-size with virt machine
Bibo Mao [Mon, 12 Jan 2026 06:58:01 +0000 (14:58 +0800)] 
hw/loongarch/virt: Add property highmem-mmio-size with virt machine

The default high mmio size of GPEX PCIE host controller is 64G bytes on
virt machine. If it does not meet requirements with some pass-throught HW
devices in future, it can be adjust dynamically, here adds property
highmem-mmio-size to set high mmio size.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Song Gao <gaosong@loongson.cn>
7 months agohw/loongarch/virt: Add high MMIO support with GPEX host
Bibo Mao [Fri, 17 Oct 2025 06:45:22 +0000 (14:45 +0800)] 
hw/loongarch/virt: Add high MMIO support with GPEX host

With high MMIO supported, its base address comes from high end of
physical address space. Also add high MMIO support with GPEX host bridge.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Song Gao <gaosong@loongson.cn>
7 months agohw/loongarch/virt: Add property highmem_mmio with virt machine
Bibo Mao [Fri, 17 Oct 2025 06:45:21 +0000 (14:45 +0800)] 
hw/loongarch/virt: Add property highmem_mmio with virt machine

On LoongArch Virt Machine, MMIO region with GPEX host bridge is
0x40000000 -- 0x7FFFFFFF. The total size is 1G bytes and it is enough
for emulated virtio devices basically.

However on some conditions such as hostmem is added with virtio-gpu
device, the command line is -device virtio-gpu-gl,hostmem=4G. The
PCIE MMIO region is not enough, 64-bit high MMIO region is required.

Here add property highmem_mmio with virt machine, however it brings
out incompatible issue. Here the default value is false.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Song Gao <gaosong@loongson.cn>
7 months agohw/loongarch/virt: Get PCI info from gpex config info
Bibo Mao [Fri, 17 Oct 2025 06:45:20 +0000 (14:45 +0800)] 
hw/loongarch/virt: Get PCI info from gpex config info

PCIE host bridge configuration information such as MMIO/Conf/IO base
and size can come from gpex config info.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Song Gao <gaosong@loongson.cn>
7 months agohw/loongarch/virt: Get irq number from gpex config info
Bibo Mao [Fri, 17 Oct 2025 06:45:19 +0000 (14:45 +0800)] 
hw/loongarch/virt: Get irq number from gpex config info

The base irq number of GPEX PCIE host bridge can comes from gpex::irq.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Song Gao <gaosong@loongson.cn>
7 months agohw/loongarch/virt: Add field gpex in LoongArchVirtMachineState
Bibo Mao [Fri, 17 Oct 2025 06:45:18 +0000 (14:45 +0800)] 
hw/loongarch/virt: Add field gpex in LoongArchVirtMachineState

Add field gpex in structure LoongArchVirtMachineState, type of field gpex
is structure GPEXConfig and it is to record configuration information
about GPEX host bridge. And remove field pci_bus in structure
LoongArchVirtMachineState since the information is in field gpex already.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Song Gao <gaosong@loongson.cn>
7 months agohw/loongarch/virt: Add field ram_end in LoongArchVirtMachineState
Bibo Mao [Fri, 17 Oct 2025 06:45:17 +0000 (14:45 +0800)] 
hw/loongarch/virt: Add field ram_end in LoongArchVirtMachineState

DRAM region is dynamically set and the last valid physical address region
with LoongArch Virt Machine. To record the last valid physical address,
field ram_end is added in structure LoongArchVirtMachineState. In future
end address of DRAM cannot exceed base addres of PCIE 64-bit MMIO region.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Song Gao <gaosong@loongson.cn>
7 months agotarget/loongarch: Add PMU register dump support in KVM
Bibo Mao [Thu, 30 Oct 2025 08:17:24 +0000 (16:17 +0800)] 
target/loongarch: Add PMU register dump support in KVM

PMU is supported in KVM mode. With info registers command, PMU CSR
registers should be dumped also. And it is not necessary in TCG mode.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Song Gao <gaosong@loongson.cn>
7 months agotarget/loongarch: Call function loongarch_la464_init_csr() after realized
Bibo Mao [Thu, 30 Oct 2025 08:17:23 +0000 (16:17 +0800)] 
target/loongarch: Call function loongarch_la464_init_csr() after realized

When CPU is realized, it will check capability of host and set guest
features, such as PMU CSR register number used by VM etc. Here move
function call with loongarch_la464_init_csr() after CPU is realized.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Song Gao <gaosong@loongson.cn>
7 months agotarget/loongarch: Add PMU migration support in KVM mode
Bibo Mao [Thu, 30 Oct 2025 08:17:22 +0000 (16:17 +0800)] 
target/loongarch: Add PMU migration support in KVM mode

PMU is supported in KVM mode. When VM is migrated, PMU register should
be migrated also, otherwise PMU will be disabled after migration.

Here add PMU register save and restore interface and PMU register
state migration is added also.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Song Gao <gaosong@loongson.cn>
7 months agohw/ppc: Add VMSTATE information to PnvPsi
Caleb Schlossin [Mon, 5 Jan 2026 16:01:38 +0000 (10:01 -0600)] 
hw/ppc: Add VMSTATE information to PnvPsi

PnvPsi needs to be able to save/load snapshots.  Add VMSTATE information
to the device class and a post_load() method to restore dynamic data items and
memory region mappings.

Signed-off-by: Michael Kowal <kowal@linux.ibm.com>
Reviewed-by: Michael Kowal <kowal@linux.ibm.com>
Reviewed-by: Aditya Gupta <adityag@linux.ibm.com>
Reviewed-by: Chalapathi V <chalapathi.v@linux.ibm.com>
Signed-off-by: Caleb Schlossin <calebs@linux.ibm.com>
Reviewed-by: Glenn Miles <milesg@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/20260105160138.3242709-8-calebs@linux.ibm.com
Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
7 months agohw/ppc: pnv_chiptod.c add vmstate support
Caleb Schlossin [Mon, 5 Jan 2026 16:01:37 +0000 (10:01 -0600)] 
hw/ppc: pnv_chiptod.c add vmstate support

- Added pre_save and post_load methods to handle slave_pc_target and tod_state

Signed-off-by: Angelo Jaramillo <angelo.jaramillo@linux.ibm.com>
Reviewed-by: Michael Kowal <kowal@linux.ibm.com>
Reviewed-by: Aditya Gupta <adityag@linux.ibm.com>
Reviewed-by: Chalapathi V <chalapathi.v@linux.ibm.com>
Signed-off-by: Caleb Schlossin <calebs@linux.ibm.com>
Reviewed-by: Glenn Miles <milesg@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/20260105160138.3242709-7-calebs@linux.ibm.com
Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
7 months agohw/ppc: pnv_core.c add vmstate support
Caleb Schlossin [Mon, 5 Jan 2026 16:01:36 +0000 (10:01 -0600)] 
hw/ppc: pnv_core.c add vmstate support

- Add vmstate support PnvCore and PnvQuad capturing scratch
registers and special wakeup registers

Signed-off-by: Angelo Jaramillo <angelo.jaramillo@linux.ibm.com>
Reviewed-by: Glenn Miles <milesg@linux.ibm.com>
Reviewed-by: Aditya Gupta <adityag@linux.ibm.com>
Reviewed-by: Chalapathi V <chalapathi.v@linux.ibm.com>
Signed-off-by: Caleb Schlossin <calebs@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/20260105160138.3242709-6-calebs@linux.ibm.com
Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
7 months agohw/ppc: pnv_adu.c added vmstate support
Caleb Schlossin [Mon, 5 Jan 2026 16:01:35 +0000 (10:01 -0600)] 
hw/ppc: pnv_adu.c added vmstate support

- Added vmstate support for ADU model

Signed-off-by: Angelo Jaramillo <angelo.jaramillo@linux.ibm.com>
Reviewed-by: Michael Kowal <kowal@linux.ibm.com>
Reviewed-by: Aditya Gupta <adityag@linux.ibm.com>
Reviewed-by: Chalapathi V <chalapathi.v@linux.ibm.com>
Signed-off-by: Caleb Schlossin <calebs@linux.ibm.com>
Reviewed-by: Glenn Miles <milesg@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/20260105160138.3242709-5-calebs@linux.ibm.com
Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
7 months agohw/ppc: Add pnv_i2c vmstate support
Caleb Schlossin [Mon, 5 Jan 2026 16:01:34 +0000 (10:01 -0600)] 
hw/ppc: Add pnv_i2c vmstate support

- Add vmstate support for i2c registers

Reviewed-by: Michael Kowal <kowal@linux.ibm.com>
Reviewed-by: Aditya Gupta <adityag@linux.ibm.com>
Reviewed-by: Chalapathi V <chalapathi.v@linux.ibm.com>
Signed-off-by: Caleb Schlossin <calebs@linux.ibm.com>
Reviewed-by: Glenn Miles <milesg@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/20260105160138.3242709-4-calebs@linux.ibm.com
Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
7 months agohw/ppc: Add pnv_spi vmstate support
Caleb Schlossin [Mon, 5 Jan 2026 16:01:33 +0000 (10:01 -0600)] 
hw/ppc: Add pnv_spi vmstate support

- Add support for needed PnvSpi structure variables

Reviewed-by: Michael Kowal <kowal@linux.ibm.com>
Reviewed-by: Aditya Gupta <adityag@linux.ibm.com>
Reviewed-by: Chalapathi V <chalapathi.v@linux.ibm.com>
Signed-off-by: Caleb Schlossin <calebs@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/20260105160138.3242709-3-calebs@linux.ibm.com
Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
7 months agohw/ppc: Add VMSTATE information for LPC model
Caleb Schlossin [Mon, 5 Jan 2026 16:01:32 +0000 (10:01 -0600)] 
hw/ppc: Add VMSTATE information for LPC model

The PNV LPC model needs snapshot/migration support.  Added a VMSTATE
descriptor to save model data and an associated post_load() method.
Snapshot support added for Power8, Power9, and Power10.

Signed-off-by: Michael Kowal <kowal@linux.ibm.com>
Reviewed-by: Michael Kowal <kowal@linux.ibm.com>
Reviewed-by: Aditya Gupta <adityag@linux.ibm.com>
Reviewed-by: Chalapathi V <chalapathi.v@linux.ibm.com>
Signed-off-by: Caleb Schlossin <calebs@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/20260105160138.3242709-2-calebs@linux.ibm.com
Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
7 months agotarget/ppc/kvm : Use macro names instead of hardcoded constants as return values
Gautam Menghani [Tue, 2 Dec 2025 12:46:52 +0000 (18:16 +0530)] 
target/ppc/kvm : Use macro names instead of hardcoded constants as return values

In the parse_* functions used to parse the return values of
KVM_PPC_GET_CPU_CHAR ioctl, the return values are hardcoded as numbers.
Use the macro names for better readability. No functional change
intended.

Signed-off-by: Gautam Menghani <gautam@linux.ibm.com>
Reviewed-by: Chinmay Rath <rathc@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/20251202124654.11481-1-gautam@linux.ibm.com
Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
7 months agoMerge tag 'pull-tcg-20260112' of https://gitlab.com/rth7680/qemu into staging
Richard Henderson [Sun, 11 Jan 2026 22:00:22 +0000 (09:00 +1100)] 
Merge tag 'pull-tcg-20260112' of https://gitlab.com/rth7680/qemu into staging

tcg/riscv: Fix TCG_REG_TMP0 clobber in tcg_gen_dup{m,i}
tcg/optimize: Fixes for o_mask and a_mask
linux-user: Correction to HWCAP2 accessor
linux-user: Fixes for mremap
linux-user: Implement epoll_pwait2 syscall
meson: disable libatomic with GCC >= 16

# -----BEGIN PGP SIGNATURE-----
#
# iQFRBAABCgA7FiEEekgeeIaLTbaoWgXAZN846K9+IV8FAmlkHJQdHHJpY2hhcmQu
# aGVuZGVyc29uQGxpbmFyby5vcmcACgkQZN846K9+IV8i0gf8C/MTPjEqPDij3WDA
# skE6cNyWaGF1xw8WDrGfC9GkKndBtWKZ/bZi8JmngcqfOkOzkZa5X8D25W0/esOs
# cnjqsGX3blW1YUTXgs/Go/EZguZnO23I/4/2sFdba6lo2zYmwab8HzJjYLhzRZB2
# fFyLVvVDgkCfbpomkuZM7nHlnqP1UXgxkYtdD9hhs/08Mdv/H5BwwZN/xkC+YSwt
# zLfB9fb2/5rf3u+TlUoQsHkDV7hHcAiCwUpL9W89AGTVtuwAd2K+LObebaxk8ExM
# WDSXl5CJsavdGZ7sYUqBlJBnHYdSUqMu3DvghQdn5mC1QuRVelLWJhYkNuWVLMsD
# DyH4GQ==
# =yWGs
# -----END PGP SIGNATURE-----
# gpg: Signature made Mon 12 Jan 2026 08:56:36 AM AEDT
# gpg:                using RSA key 7A481E78868B4DB6A85A05C064DF38E8AF7E215F
# gpg:                issuer "richard.henderson@linaro.org"
# gpg: Good signature from "Richard Henderson <richard.henderson@linaro.org>" [ultimate]

* tag 'pull-tcg-20260112' of https://gitlab.com/rth7680/qemu:
  meson: disable libatomic with GCC >= 16
  linux-user: implement epoll_pwait2 syscall
  linux-user: cleanup epoll_pwait ifdeff'ery
  tests: add tcg coverage for fixed mremap bugs
  linux-user: fix reserved_va page leak in do_munmap
  linux-user: fix mremap errors for invalid ranges
  linux-user: fix mremap unmapping adjacent region
  linux-user/elfload.c: Correction to HWCAP2 accessor
  linux-user: allow null `pathname` for statx()/fstatat()
  tcg/riscv: Fix TCG_REG_TMP0 clobber in tcg_gen_dup{m,i}
  tcg/optimize: Do use affected bits
  tcg/optimize: Fix a_mask computation for orc
  tcg/optimize: Save o_mask in fold_masks_zosa_int

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
7 months agomeson: disable libatomic with GCC >= 16
Daniel P. Berrangé [Thu, 8 Jan 2026 14:14:07 +0000 (14:14 +0000)] 
meson: disable libatomic with GCC >= 16

Historically it was required to ask for libatomic explicitly with
-latomic, but with GCC >= 16 apps will get linked to libatomic
whether they ask for it or not.

This invalidates QEMU's check for atomic op support for int128
which explicitly does NOT want to use the libatomic impl. As a
result with GCC >= 16, QEMU is now getting linked to libatomic
and is activating CONFIG_ATOMIC128. This in turn exposes a bug
in GCC's libatomic.a static buld which is incompatible with the
use of -static-pie leading to build failures like:

    /usr/bin/ld: /usr/lib/gcc/x86_64-redhat-linux/16/libatomic.a(cas_16_.o): relocation R_X86_64_32 against hidden symbol `libat_compare_exchange_16_i1' can not be used when making a PIE object
    /usr/bin/ld: failed to set dynamic section sizes: bad value
collect2: error: ld returned 1 exit status

The newly introduced -fno-link-libatomic flag can be used to
disable the new automatic linking of libatomic. Setting this in
qemu_isa_flags early on ensures that the check for CONFIG_ATOMIC128
still works correctly.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Acked-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260108141407.2151817-1-berrange@redhat.com>

7 months agolinux-user: implement epoll_pwait2 syscall
Michael Tokarev [Fri, 9 Jan 2026 09:09:37 +0000 (12:09 +0300)] 
linux-user: implement epoll_pwait2 syscall

epoll_pwait2 is the same as epoll_pwait but with timeout being
(a pointer to) struct timespec instead of an integer.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3210
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260109090937.599881-3-mjt@tls.msk.ru>

7 months agolinux-user: cleanup epoll_pwait ifdeff'ery
Michael Tokarev [Fri, 9 Jan 2026 09:09:36 +0000 (12:09 +0300)] 
linux-user: cleanup epoll_pwait ifdeff'ery

All linux targets these days have epoll_pwait system call
(while some miss epoll_wait, which is less generic).  And
all linux targets definitely has one or another epoll_*wait*
system call - so whole code block dealing with this system
call should always be present.

Remove the now-unneeded ifdef'fery.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260109090937.599881-2-mjt@tls.msk.ru>

7 months agotests: add tcg coverage for fixed mremap bugs
Matthew Lugg [Mon, 17 Nov 2025 17:09:54 +0000 (17:09 +0000)] 
tests: add tcg coverage for fixed mremap bugs

These tests cover the first two fixes in this patch series. The final
patch is not covered because the bug it fixes is not easily observable
by the guest.

Signed-off-by: Matthew Lugg <mlugg@mlugg.co.uk>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20251117170954.31451-5-mlugg@mlugg.co.uk>

7 months agolinux-user: fix reserved_va page leak in do_munmap
Matthew Lugg [Mon, 17 Nov 2025 17:09:53 +0000 (17:09 +0000)] 
linux-user: fix reserved_va page leak in do_munmap

The old logic had an off-by-one bug. For instance, assuming 4k pages on
host and guest, if 'len' is '4097' (indicating to unmap 2 pages), then
'last = start + 4096', so 'real_last = start + 4095', so ultimately
'real_len = 4096'. I do not believe this could cause any observable bugs
in guests, because `target_munmap` page-aligns the length it passes in.
However, calls to this function in `target_mremap` do not page-align the
length, so those calls could "drop" pages, leading to a part of the
reserved region becoming unmapped. At worst, a host allocation could get
mapped into that hole, then clobbered by a new guest mapping.

Signed-off-by: Matthew Lugg <mlugg@mlugg.co.uk>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20251117170954.31451-4-mlugg@mlugg.co.uk>

7 months agolinux-user: fix mremap errors for invalid ranges
Matthew Lugg [Mon, 17 Nov 2025 17:09:52 +0000 (17:09 +0000)] 
linux-user: fix mremap errors for invalid ranges

If an address range given to `mremap` is invalid (exceeds addressing
bounds on the guest), we were previously returning `ENOMEM`, which is
not correct. The manpage and the Linux kernel implementation both agree
that if `old_addr`/`old_size` refer to an invalid address, `EFAULT` is
returned, and if `new_addr`/`new_size` refer to an invalid address,
`EINVAL` is returned.

Signed-off-by: Matthew Lugg <mlugg@mlugg.co.uk>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20251117170954.31451-3-mlugg@mlugg.co.uk>

7 months agolinux-user: fix mremap unmapping adjacent region
Matthew Lugg [Mon, 17 Nov 2025 17:09:51 +0000 (17:09 +0000)] 
linux-user: fix mremap unmapping adjacent region

This typo meant that calls to `mremap` which shrink a mapping by some N
bytes would, when the virtual address space was pre-reserved (e.g.
32-bit guest on 64-bit host), unmap the N bytes following the *original*
mapping.

Signed-off-by: Matthew Lugg <mlugg@mlugg.co.uk>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20251117170954.31451-2-mlugg@mlugg.co.uk>

7 months agolinux-user/elfload.c: Correction to HWCAP2 accessor
Jim MacArthur [Tue, 6 Jan 2026 15:40:48 +0000 (15:40 +0000)] 
linux-user/elfload.c: Correction to HWCAP2 accessor

get_elf_hwcap was used when get_elf_hwcap2 should have been.

Cc: qemu-stable@nongnu.org
Fixes: fcac98d0ba8b ("linux-user: Remove ELF_HWCAP2")
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3259
Signed-off-by: Jim MacArthur <jim.macarthur@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260106-fix-hwcap2-sve2-v1-1-1d70dff63370@linaro.org>

7 months agolinux-user: allow null `pathname` for statx()/fstatat()
Jean-Christian CÎRSTEA [Mon, 29 Dec 2025 12:14:16 +0000 (14:14 +0200)] 
linux-user: allow null `pathname` for statx()/fstatat()

Since Linux 6.11, the path argument may be NULL.

Before this patch, qemu-*-linux-user failed with EFAULT when `pathname` was
specified as NULL, even for Linux kernel hosts > 6.10. This patch fixes this
issue by checking whether `arg2` is 0. If so, don't return EFAULT, but instead
perform the appropiate syscall and let the host's kernel handle null `pathname`.

Cc: qemu-stable@nongnu.org
Signed-off-by: Jean-Christian CÎRSTEA <jean.christian.cirstea@gmail.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20251229121416.2209295-1-jean.christian.cirstea@gmail.com>

7 months agotcg/riscv: Fix TCG_REG_TMP0 clobber in tcg_gen_dup{m,i}
Richard Henderson [Tue, 6 Jan 2026 06:25:57 +0000 (06:25 +0000)] 
tcg/riscv: Fix TCG_REG_TMP0 clobber in tcg_gen_dup{m,i}

TCG_REG_TMP0 may be used by set_vtype* to load the vtype
parameter, so delay any other use of TCG_REG_TMP0 until
the correct vtype has been installed.

Cc: qemu-stable@nongnu.org
Fixes: d4be6ee1111 ("tcg/riscv: Implement vector mov/dup{m/i}")
Reported-by: Zhijin Zeng <zengzhijin@linux.spacemit.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
7 months agotcg/optimize: Do use affected bits
Paolo Bonzini [Tue, 23 Dec 2025 16:37:20 +0000 (17:37 +0100)] 
tcg/optimize: Do use affected bits

We inadvertently disabled affected bits optimizations on operations
that use fold_masks_zosa.  These happen relatively often in x86 code
for extract/sextract; for example given the following:

   mov %esi, %ebp
   xor $0x1, %ebp

the optimizer is able to simplify the "extract_i64 rbp,tmp0,$0x0,$0x20"
produced by the second instruction to a move.

Cc: qemu-stable@nongnu.org
Fixes: 932522a9ddc ("tcg/optimize: Fold and to extract during optimize")
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20251223163720.985578-1-pbonzini@redhat.com>