Section tags are case sensitive and end with a colon. Screwing up
either gets them interpreted as ordinary paragraph. Fix a few.
Fixes: 4e88e7e340 (qapi/qom: Define cache enumeration and properties for machine, 2024-11-01)
Fixes: 8eb6d39e22 (qom: qom-list-get, 2025-07-11)
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20260701061136.798815-1-armbru@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Aliases are not handled, and that's why tests used them
are skipped, like this:
PYTHONPATH=python:tests/functional \
QEMU_TEST_QEMU_BINARY=$PWD/build/qemu-system-x86_64 \
MESON_BUILD_ROOT=$PWD/build \
./build/pyvenv/bin/python3 tests/functional/x86_64/test_hotplug_blk.py
TAP version 13
ok 1 test_hotplug_blk.HotPlugBlk.test # SKIP no support for machine q35
1..1
Fixes: 0e7aa78b0b ("tests/functional: use QMP to query available machines")
Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-ID: <20260710090317.498350-1-vsementsov@yandex-team.ru>
Signed-off-by: Thomas Huth <th.huth@posteo.eu>
Merge tpm 2026/07/10 v1
# -----BEGIN PGP SIGNATURE-----
#
# iQEzBAABCgAdFiEEuBi5yt+QicLVzsZrda1lgCoLQhEFAmpRAe4ACgkQda1lgCoL
# QhGL0gf9HIR8FclQjPEi4qEYylE0hD7CXEpOkxmiX3dIP8fVn/FX8fYjSetgcJdb
# DINIiph2ypTRv+ZUtAC+s8UaYMCYUV9CM5Fs3TnwEayAvVNuuIRfz5gi00eZyprE
# RxL4b6LMoucTm9HnBre8SYlGzlb25MgstHy86s0vl4O9LuLZ9PgJq8aONp99YvCK
# IdAIbyOoL3wAyzpK55igRa1Ld6uxLGALByWWXZOKyLnutog/V8yOhV2uo70h8u6j
# DhFeAVNTZHDRwFvONO1n0M97mY21tWaU4QQ3gmznEknfpnbB66y503LhuKwmlOgg
# FdOSO+cB93wECvXi7uK7nR9VYHMDsg==
# =WrOS
# -----END PGP SIGNATURE-----
# gpg: Signature made Fri 10 Jul 2026 16:30:06 CEST
# gpg: using RSA key B818B9CADF9089C2D5CEC66B75AD65802A0B4211
# gpg: Good signature from "Stefan Berger <stefanb@linux.vnet.ibm.com>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: B818 B9CA DF90 89C2 D5CE C66B 75AD 6580 2A0B 4211
* tag 'pull-tpm-2026-07-10-1' of https://github.com/stefanberger/qemu-tpm:
hw/core/machine: disable tpm-tis-device PPI for machine type <= 11.0
hw/tpm: gate PPI support on tpm-tis-device behind a device property
hw/core/platform-bus: guard platform_bus_get_mmio_addr() against NULL
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Merge the PT_LOAD loop with the PT_INTERP loop, as the XXX
comment suggests. Pass the probed range to probe_guest_base.
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Prepare to share probe_guest_base with bsd-user.
Create a linux_probe_guest_base wrapper with the portions
of probe_guest_base that are linux specific: managing the
commpage for various targets.
Reviewed-by: Warner Losh <imp@bsdimp.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
This interface is only used for user-only. It's more usefully
placed within common-user than util. Temporarily add stub
implementation for bsd-user.
Reviewed-by: Helge Deller <deller@gmx.de>
Reviewed-by: Warner Losh <imp@bsdimp.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Introduce user/mmap-min-addr.h. Initialize the variable
from a constructor instead of main.
Reviewed-by: Helge Deller <deller@gmx.de>
Reviewed-by: Warner Losh <imp@bsdimp.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
This simplifies check for no commpage to a NULL pointer
check, rather than reserved values for LO_COMMPAGE and
HI_COMMPAGE.
Unify {LO,HI}_COMMPAGE into a single COMMPAGE define.
Acked-by: Warner Losh <imp@bsdimp.com>
Tested-by: Helge Deller <deller@gmx.de>
Reviewed-by: Helge Deller <deller@gmx.de>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Since dropping 32-bit host support, a guest address cannot
overflow a host pointer. This means guest_hiaddr is unused
for relocatable images, so don't pass guest_hiaddr as size.
Reviewed-by: Warner Losh <imp@bsdimp.com>
Reviewed-by: Helge Deller <deller@gmx.de>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Create a structure to hold a beginning/end range for guest virtual
addresses, for use by probe_guest_base. Use vaddr for clarity.
Reviewed-by: Warner Losh <imp@bsdimp.com>
Reviewed-by: Helge Deller <deller@gmx.de>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Add a "ppi" boolean property (default: true) to tpm-tis-device.
When ppi=off the RAMBlock is never registered and the migration
stream omits "tpm-ppi", restoring backward compatibility.
Move sysbus_init_mmio() calls from instance_init to realizefn so
the memory regions are initialized before being registered. When
ppi=off, the PPI MMIO region is simply not exposed.
Fixes: 46cd2c1050 ("hw/tpm: add PPI support to tpm-tis-device for ARM64 virt")
Signed-off-by: Mohammadfaiz Bawa <mbawa@redhat.com>
Reviewed-by: Stefan Berger <stefanb@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/20260619093140.832136-3-mbawa@redhat.com
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
sysbus_mmio_get_region() returns NULL when a device has fewer MMIO
regions than the requested slot index. platform_bus_get_mmio_addr()
passes the result directly to memory_region_is_mapped() without a
NULL check, causing a SIGSEGV.
Return -1 early when the region pointer is NULL, consistent with the
existing "not mapped" path.
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Mohammadfaiz Bawa <mbawa@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20260619093140.832136-2-mbawa@redhat.com
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
RISC-V PR for 11.1
* Fix IOMMU fault type for spa_fetch() faults
* Check IOMMU for reserved PTE bits
* Fault when IOMMU !PTE_U and no priv access
* Fault IOMMU for non-user PTE in G_STAGE
* Check IOMMU reserved MSI PTE basic bits
* Record fault on IOMMU-generated MSI write
* Move RISC-V TCG files and fix --disable-tcg
* Check for misaligned IOMMU IOHGATP_PPN
* Update IOMMU ioval2 when faulting in spa_fetch()
* Forbid IOMMU GATE/SADE if caps.AMO_HWADD is zero
* Set IOMMU ftype and iova in riscv_iommu_ctx()
* Check PCIe DOE mailbox length for overflows
* Add extensions after v7.1-rc4 update
* Remove job building OpenSBI firmware binaries
* Correct ACPI field sequence in SPCR table
# -----BEGIN PGP SIGNATURE-----
#
# iQIzBAABCgAdFiEEaukCtqfKh31tZZKWr3yVEwxTgBMFAmpQXvUACgkQr3yVEwxT
# gBPkyQ/+J3Lhx3W1Go5+m4oRBbCPxq5w4ZyV3VUPNBcwLXtcZJQNiW2YghCGegNn
# 1HJzHihA1W9YromNlmIJzcOOWM81yScf0tV29NXCQW0Si1N9cA2jr4z8Nunwcndu
# L+T5s5nLKaijwM0xnL4CtnhZ3fu+gcowS1V2ohaQvRyMVkHCHUsz9nqoHa/j6GsX
# ipItcOQt6tXcAD1n+MqD5lm1UlQ1eV1d3pMLIwTU3+WpvDJzgOGriF+t56kbVIlT
# NcyT2ShmSSVpl6nu8VqqmE8nMLkKzw7c6uAJI8QR99yCqCWeFhkCeE6boE0CWFZl
# qAsmWL3tY1FcKU1bKiSZBaeDDFJUq1lKTMzJFyTDOR6O0kuVtUi9vJvSK1BXyGza
# zBjmRvnZYVM1CPu6IE/HvVWc3L1EECv1v6LF+yIOKfSpWe5k+AM8NN82awHPBQLO
# wnsUWFziecLae9ipdOnhmf7MB2oHiYzmjyRahgr4/ZbCOvcBdUF8l43nH067iNub
# 9DXuQt61dcayEkfz281ziiHBwSqkwK6aEpuEDcG8MFXyYth98Rl6e0iz5AHp5+rv
# YVp1sKcel9ZJSIdHb2zo/yXJNh/0tG6MChpoQnaJ2xHw+KHlRs1xZjt04itJl0lK
# utEe24epJCzE2HPeRVBTPSMRRvh5KudaAMdOgj5dsPCM6cq3qEM=
# =cZmZ
# -----END PGP SIGNATURE-----
# gpg: Signature made Fri 10 Jul 2026 04:54:45 CEST
# gpg: using RSA key 6AE902B6A7CA877D6D659296AF7C95130C538013
# gpg: Good signature from "Alistair Francis <alistair@alistair23.me>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 6AE9 02B6 A7CA 877D 6D65 9296 AF7C 9513 0C53 8013
* tag 'pull-riscv-to-apply-20260710' of https://github.com/alistair23/qemu: (40 commits)
tests: update SPCR loongarch64 and riscv64 test data
hw/acpi: correct field sequence in SPCR table
tests: allow differences in SPCR
gitlab-ci: Remove job building OpenSBI firmware binaries
target/riscv/kvm: add extensions after v7.1-rc4 update
hw/pci/pcie_doe: Check mailbox length for overflows
hw/riscv/riscv-iommu.c: set ftype and iova in riscv_iommu_ctx()
hw/riscv/riscv-iommu: forbid GATE/SADE if caps.AMO_HWADD is zero
hw/riscv/riscv-iommu.c: update ioval2 when faulting in spa_fetch()
hw/riscv/riscv-iommu.c: check for misaligned IOHGATP_PPN
gitlab-ci.d/crossbuilds: add riscv64 KVM-only build job
target/riscv: move riscv_cpu_set_aia_ireg_rmw_cb() to riscv_imsic
target/riscv: move riscv_cpu_set_geilen() to riscv-imsic
target/riscv/tcg: remove unused riscv_cpu_get_geilen()
target/riscv: move riscv_cpu_set_rdtime_fn to riscv_aclint
target/riscv/gdbstub.c: isolate TCG only checks
hw/riscv/riscv_hart.c isolate tcg only bits
target/riscv/cpu.c: filter TCG only bits in riscv_cpu_reset_hold()
target/riscv: gate riscv_cpu_update_mip with tcg_enabled()
target/riscv/cpu.c: handle TCG bits of riscv_cpu_dump_state
...
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
The OpenSBI firmware build job follows the same pattern as the EDK2 job
[1] that was removed earlier [2]: it exists to produce firmware binaries
from CI artifacts, but those outputs are not consumed by the tree.
Remove the job definition and its project include to avoid maintaining
bitrotting container and firmware build logic.
[1] 71920809ce ("gitlab-ci.yml: Add jobs to build EDK2 firmware binaries")
[2] 690ceb7193 ("gitlab-ci: Remove job building EDK2 firmware binaries")
Signed-off-by: Bin Meng <bin.meng@processmission.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Message-ID: <20260706161716.29488-1-bin.meng@processmission.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
It was possible that a guest could overflow the `doe_cap->write_mbox`
buffer by writing more then PCI_DOE_DW_SIZE_MAX dwords.
`doe_cap->write_mbox_len` would continue to increment and there were no
bounds checks on the length when offsetting into doe_cap->write_mbox.
This patch adds a check and reports a guest error if we would overflow.
On an overflow we also silenty discard the entire object as instructed
to do in the PCIe spec when the length specified in the header
(up to PCI_DOE_DW_SIZE_MAX dwords) doesn't match the length of the
object.
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3679
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Reviewed-by: Tao Tang <tangtao1634@phytium.com.cn>
Message-ID: <20260707020750.788960-1-alistair.francis@wdc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
riscv_iommu_translate(), the only caller of riscv_iommu_spa_fetch(),
will use riscv_iommu_report_fault() for all faults it detects. And it
will use iotlb->translated_addr as 'iotval2' every time.
At this moment we're updating iotlb->translated_addr only after a
translation step is completed, meaning any fault that occur before that
will have a zeroed iotlb->translated_addr, and as a result iotval2 will
also be zero later on.
Keep iotlb->translated_addr updated with the latest translated addr we
have.
Fixes: 0c54acb824 ("hw/riscv: add RISC-V IOMMU base emulation")
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3559
Signed-off-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20260702171202.1322493-1-daniel.barboza@oss.qualcomm.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Add CI coverage for a riscv64 --disable-tcg cross build. This ensures that
RISC-V no-TCG/KVM-only builds keep working and prevents TCG-only code from
being accidentally pulled into common RISC-V sources again.
The cross_accel_build_job template enables KVM by default via
--enable-${ACCEL:-kvm}, so the extra options only need to disable TCG.
Signed-off-by: Zephyr Li <fritchleybohrer@gmail.com>
Reviewed-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20260703180538.3346781-25-daniel.barboza@oss.qualcomm.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
The following functions are TCG only and are broken, if they were ever
usable in the first place, with KVM:
- riscv_gdb_(get|se)t_csr
- riscv_gdb_(get|set)_virtual
- riscv_gen_dynamic_csr_feature
Gate everything with TCG enabled to at least get them out of the way to
enable --disable-tcg.
As a note for the future: other archs have distincts gdbstub files for
each accelerator. There's a strong case for RISC-V to do the same.
Signed-off-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Message-ID: <20260703180538.3346781-20-daniel.barboza@oss.qualcomm.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
riscv_cpu_update_mip() is a TCG only call. Its KVM equivalent is
kvm_riscv_set_irq(). cpu.c gates the KVM only function with a
kvm_enabled() check, making it unavailable for TCG only builds. We need
to do the same for riscv_cpu_update_mip() otherwise a KVM only build
will fail because it doesn't know what this function is.
Use tcg_enabled() for the couple of riscv_cpu_update_mip() calls we have
unguarded in cpu.c.
We have way more calls to deal with in time_helper.c which isn't using
kvm_riscv_set_irq() at all, so create a riscv_accel_set_irq() local
helper that will choose whether to use the KVM or TCG API.
The reason we're going through all this hassle in time_helper.c is
because hw/int/riscv_aclint.c uses it, and if we don't do something
about we won't have riscv_aclint working for KVM. Whether this is a
real problem or not and we should remove aclint support for KVM is
question for another day.
Signed-off-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20260703180538.3346781-17-daniel.barboza@oss.qualcomm.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
riscv_dump_csr() is a TCG only function but we'll have to implement it
at some capacity for KVM eventually, therefore put it under a CONFIG_TCG
ifdef while making a note that this function is unimplemented in KVM.
The csr_ops array is also TCG specific, thus the for loop inside
dump_state that iterates it is also TCG only business.
Signed-off-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Message-ID: <20260703180538.3346781-16-daniel.barboza@oss.qualcomm.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
riscv_cpu_has_work() uses a handful of irq pending functions from
cpu_helper.c. There is a very high possibility that KVM doesn't need
the current implermentation of has_work(), but the common accel code
needs an implementation of this callback (see cpu_exec_class_post_init)
otherwise the KVM driver won't initialize.
Move the relevant irq helpers to cpu.c to allow KVM to keep using the
current has_work implementation, allowing --disable-tcg to work. We'll
circle it back to evaluate a proper KVM implementation for it in a later
date.
Signed-off-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20260703180538.3346781-14-daniel.barboza@oss.qualcomm.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
We have a couple of CPUs that has a set of custom CSRs that uses TCG
specific APIs. Move the related code to tcg-cpu.c and do not set
.custom_csrs if we're not in a TCG build.
What we'll end up doing, sooner or later, is punting all these CPUs to
tcg-cpu.c since they're all TCG specific and KVM has nothing to do with
them. Another time.
Signed-off-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20260703180538.3346781-12-daniel.barboza@oss.qualcomm.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
