From 61eb064a5672255f9ac4f6303077fc5c30bb5f19 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Fri, 13 Mar 2026 05:52:01 +0100 Subject: [PATCH 01/62] hw/avr: Build as common unit files MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Nothing there is target-specific anymore. Signed-off-by: Philippe Mathieu-Daudé Reviewed-by: Pierrick Bouvier Message-Id: <20260313062055.2188-38-philmd@linaro.org> --- hw/misc/meson.build | 2 +- hw/timer/meson.build | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/hw/misc/meson.build b/hw/misc/meson.build index 092f70bde2..245ab9b98c 100644 --- a/hw/misc/meson.build +++ b/hw/misc/meson.build @@ -152,7 +152,7 @@ system_ss.add(when: 'CONFIG_GRLIB', if_true: files('grlib_ahb_apb_pnp.c')) system_ss.add(when: 'CONFIG_I2C_ECHO', if_true: files('i2c-echo.c')) -specific_ss.add(when: 'CONFIG_AVR_POWER', if_true: files('avr_power.c')) +system_ss.add(when: 'CONFIG_AVR_POWER', if_true: files('avr_power.c')) system_ss.add(when: 'CONFIG_MAC_VIA', if_true: files('mac_via.c')) diff --git a/hw/timer/meson.build b/hw/timer/meson.build index 178321c029..201b5d8316 100644 --- a/hw/timer/meson.build +++ b/hw/timer/meson.build @@ -33,4 +33,4 @@ system_ss.add(when: 'CONFIG_XILINX', if_true: files('xilinx_timer.c')) specific_ss.add(when: 'CONFIG_IBEX', if_true: files('ibex_timer.c')) system_ss.add(when: 'CONFIG_SIFIVE_PWM', if_true: files('sifive_pwm.c')) -specific_ss.add(when: 'CONFIG_AVR_TIMER16', if_true: files('avr_timer16.c')) +system_ss.add(when: 'CONFIG_AVR_TIMER16', if_true: files('avr_timer16.c')) From 790d65e1a1a7928d9ba5200d7d63c08680c09641 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Tue, 26 Aug 2025 16:29:12 +0200 Subject: [PATCH 02/62] hw/core/cpu: Expose CPUState::start_powered_off docstring MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The comment about @start_powered_off is buried within the CPUState structure. Hoist it to the structure docstring comment. Signed-off-by: Philippe Mathieu-Daudé Reviewed-by: Richard Henderson Message-Id: <20260423170229.64655-6-philmd@linaro.org> --- include/hw/core/cpu.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h index 6bdae9ab70..207a7a1bec 100644 --- a/include/hw/core/cpu.h +++ b/include/hw/core/cpu.h @@ -419,6 +419,7 @@ struct qemu_work_item; * QOM parent. * Under TCG this value is propagated to @tcg_cflags. * See TranslationBlock::TCG CF_CLUSTER_MASK. + * @start_powered_off: Indicates whether the CPU starts in powered-off state. * @tcg_cflags: Pre-computed cflags for this cpu. * @nr_threads: Number of threads within this CPU core. * @thread: Host thread details, only live once @created is #true @@ -502,7 +503,6 @@ struct CPUState { bool stop; bool stopped; - /* Should CPU start in powered-off state? */ bool start_powered_off; bool unplug; From e86f85142943db8992796a26d51d66ee0889fff2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Fri, 13 Mar 2026 05:42:44 +0100 Subject: [PATCH 03/62] hw/misc/cpc: Include missing 'hw/core/cpu.h' header MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The "hw/core/cpu.h" header is indirectly included. Include it explicitly otherwise we get when refactoring unrelated headers: ../hw/misc/mips_cpc.c:36:53: error: unknown type name 'run_on_cpu_data' 36 | static void mips_cpu_reset_async_work(CPUState *cs, run_on_cpu_data data) | ^ ../hw/misc/mips_cpc.c:40:5: error: call to undeclared function 'cpu_reset' 40 | cpu_reset(cs); | ^ ../hw/misc/riscv_cpc.c:34:54: error: unknown type name 'run_on_cpu_data' 34 | static void riscv_cpu_reset_async_work(CPUState *cs, run_on_cpu_data data) | ^ ../hw/misc/riscv_cpc.c:39:5: error: call to undeclared function 'cpu_reset' 39 | cpu_reset(cs); | ^ Signed-off-by: Philippe Mathieu-Daudé Reviewed-by: Thomas Huth Reviewed-by: Pierrick Bouvier Message-Id: <20260313062055.2188-17-philmd@linaro.org> --- hw/misc/mips_cpc.c | 1 + hw/misc/riscv_cpc.c | 1 + 2 files changed, 2 insertions(+) diff --git a/hw/misc/mips_cpc.c b/hw/misc/mips_cpc.c index 924de855ee..d092f76f44 100644 --- a/hw/misc/mips_cpc.c +++ b/hw/misc/mips_cpc.c @@ -22,6 +22,7 @@ #include "cpu.h" #include "qemu/log.h" #include "qemu/module.h" +#include "hw/core/cpu.h" #include "hw/core/sysbus.h" #include "migration/vmstate.h" diff --git a/hw/misc/riscv_cpc.c b/hw/misc/riscv_cpc.c index 4bf2fd8db1..e04ccdf54f 100644 --- a/hw/misc/riscv_cpc.c +++ b/hw/misc/riscv_cpc.c @@ -18,6 +18,7 @@ #include "qemu/module.h" #include "qemu/timer.h" #include "qemu/bitops.h" +#include "hw/core/cpu.h" #include "hw/core/sysbus.h" #include "migration/vmstate.h" From fcffcce6e4b6a94f0e3a5ce1510ea74dcacb0fd6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Fri, 13 Mar 2026 06:07:47 +0100 Subject: [PATCH 04/62] hw/alpha: Include full path to target 'cpu.h' header MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Philippe Mathieu-Daudé Reviewed-by: Pierrick Bouvier Message-Id: <20260313062055.2188-21-philmd@linaro.org> --- hw/alpha/dp264.c | 2 +- hw/alpha/typhoon.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/hw/alpha/dp264.c b/hw/alpha/dp264.c index 2ab3c14747..f928e0cee8 100644 --- a/hw/alpha/dp264.c +++ b/hw/alpha/dp264.c @@ -7,7 +7,7 @@ */ #include "qemu/osdep.h" -#include "cpu.h" +#include "target/alpha/cpu.h" #include "exec/target_page.h" #include "elf.h" #include "hw/core/loader.h" diff --git a/hw/alpha/typhoon.c b/hw/alpha/typhoon.c index 7722d4fd00..e32fed86f9 100644 --- a/hw/alpha/typhoon.c +++ b/hw/alpha/typhoon.c @@ -12,7 +12,7 @@ #include "exec/cpu-interrupt.h" #include "qapi/error.h" #include "hw/pci/pci_host.h" -#include "cpu.h" +#include "target/alpha/cpu.h" #include "hw/core/irq.h" #include "alpha_sys.h" From ca8883f016d66b1c3a31b7ecda1158ea4d55aa56 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Fri, 13 Mar 2026 06:08:01 +0100 Subject: [PATCH 05/62] hw/arm: Include full path to target 'cpu.h' header MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Philippe Mathieu-Daudé Reviewed-by: Pierrick Bouvier Message-Id: <20260313062055.2188-22-philmd@linaro.org> --- hw/arm/boot.c | 2 +- hw/arm/exynos4210.c | 2 +- hw/arm/mps3r.c | 2 +- hw/arm/omap1.c | 2 +- hw/arm/realview.c | 2 +- hw/arm/smmuv3.c | 2 +- hw/intc/arm_gicv3_cpuif.c | 2 +- hw/intc/arm_gicv3_cpuif_common.c | 2 +- include/hw/arm/digic.h | 2 +- include/hw/arm/fsl-imx6.h | 2 +- include/hw/arm/fsl-imx6ul.h | 2 +- include/hw/arm/fsl-imx7.h | 2 +- include/hw/arm/fsl-imx8mp.h | 2 +- 13 files changed, 13 insertions(+), 13 deletions(-) diff --git a/hw/arm/boot.c b/hw/arm/boot.c index c97d4c4e11..780b6be637 100644 --- a/hw/arm/boot.c +++ b/hw/arm/boot.c @@ -14,7 +14,7 @@ #include #include "hw/arm/boot.h" #include "hw/arm/linux-boot-if.h" -#include "cpu.h" +#include "target/arm/cpu.h" #include "exec/tswap.h" #include "exec/target_page.h" #include "system/kvm.h" diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c index 25c385ba1f..5efe95030c 100644 --- a/hw/arm/exynos4210.c +++ b/hw/arm/exynos4210.c @@ -24,7 +24,7 @@ #include "qemu/osdep.h" #include "qapi/error.h" #include "exec/tswap.h" -#include "cpu.h" +#include "target/arm/cpu.h" #include "hw/cpu/a9mpcore.h" #include "hw/core/irq.h" #include "system/blockdev.h" diff --git a/hw/arm/mps3r.c b/hw/arm/mps3r.c index 2d64a198c4..caad820d3b 100644 --- a/hw/arm/mps3r.c +++ b/hw/arm/mps3r.c @@ -29,7 +29,7 @@ #include "qapi/error.h" #include "qobject/qlist.h" #include "system/address-spaces.h" -#include "cpu.h" +#include "target/arm/cpu.h" #include "system/system.h" #include "hw/core/boards.h" #include "hw/core/or-irq.h" diff --git a/hw/arm/omap1.c b/hw/arm/omap1.c index 47d0f0d736..980959166d 100644 --- a/hw/arm/omap1.c +++ b/hw/arm/omap1.c @@ -22,7 +22,7 @@ #include "qemu/error-report.h" #include "qemu/main-loop.h" #include "qapi/error.h" -#include "cpu.h" +#include "target/arm/cpu.h" #include "system/address-spaces.h" #include "exec/cpu-common.h" #include "hw/core/hw-error.h" diff --git a/hw/arm/realview.c b/hw/arm/realview.c index c9558be4d4..7e8acd34ac 100644 --- a/hw/arm/realview.c +++ b/hw/arm/realview.c @@ -9,7 +9,7 @@ #include "qemu/osdep.h" #include "qapi/error.h" -#include "cpu.h" +#include "target/arm/cpu.h" #include "hw/core/sysbus.h" #include "hw/arm/boot.h" #include "hw/arm/primecell.h" diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c index 7fead1c3cf..5570a13c8a 100644 --- a/hw/arm/smmuv3.c +++ b/hw/arm/smmuv3.c @@ -26,7 +26,7 @@ #include "hw/core/qdev-properties.h" #include "hw/core/qdev.h" #include "hw/pci/pci.h" -#include "cpu.h" +#include "target/arm/cpu.h" #include "exec/target_page.h" #include "trace.h" #include "qemu/log.h" diff --git a/hw/intc/arm_gicv3_cpuif.c b/hw/intc/arm_gicv3_cpuif.c index eaf1e512ed..fcb3922fa0 100644 --- a/hw/intc/arm_gicv3_cpuif.c +++ b/hw/intc/arm_gicv3_cpuif.c @@ -19,7 +19,7 @@ #include "trace.h" #include "gicv3_internal.h" #include "hw/core/irq.h" -#include "cpu.h" +#include "target/arm/cpu.h" #include "target/arm/cpregs.h" #include "target/arm/cpu-features.h" #include "target/arm/internals.h" diff --git a/hw/intc/arm_gicv3_cpuif_common.c b/hw/intc/arm_gicv3_cpuif_common.c index ff1239f65d..e03085592e 100644 --- a/hw/intc/arm_gicv3_cpuif_common.c +++ b/hw/intc/arm_gicv3_cpuif_common.c @@ -11,7 +11,7 @@ #include "qemu/osdep.h" #include "gicv3_internal.h" -#include "cpu.h" +#include "target/arm/cpu.h" void gicv3_set_gicv3state(CPUState *cpu, GICv3CPUState *s) { diff --git a/include/hw/arm/digic.h b/include/hw/arm/digic.h index 8f2735c284..646802806e 100644 --- a/include/hw/arm/digic.h +++ b/include/hw/arm/digic.h @@ -18,7 +18,7 @@ #ifndef HW_ARM_DIGIC_H #define HW_ARM_DIGIC_H -#include "cpu.h" +#include "target/arm/cpu.h" #include "hw/timer/digic-timer.h" #include "hw/char/digic-uart.h" #include "qom/object.h" diff --git a/include/hw/arm/fsl-imx6.h b/include/hw/arm/fsl-imx6.h index bb866994df..cddd100dd6 100644 --- a/include/hw/arm/fsl-imx6.h +++ b/include/hw/arm/fsl-imx6.h @@ -35,7 +35,7 @@ #include "hw/pci-host/designware.h" #include "hw/core/or-irq.h" #include "system/memory.h" -#include "cpu.h" +#include "target/arm/cpu.h" #include "qom/object.h" #define TYPE_FSL_IMX6 "fsl-imx6" diff --git a/include/hw/arm/fsl-imx6ul.h b/include/hw/arm/fsl-imx6ul.h index 4e3209b25b..f8f9c249a2 100644 --- a/include/hw/arm/fsl-imx6ul.h +++ b/include/hw/arm/fsl-imx6ul.h @@ -34,7 +34,7 @@ #include "hw/usb/chipidea.h" #include "hw/usb/imx-usb-phy.h" #include "system/memory.h" -#include "cpu.h" +#include "target/arm/cpu.h" #include "qom/object.h" #include "qemu/units.h" diff --git a/include/hw/arm/fsl-imx7.h b/include/hw/arm/fsl-imx7.h index 710831c8bf..a573e0dd4f 100644 --- a/include/hw/arm/fsl-imx7.h +++ b/include/hw/arm/fsl-imx7.h @@ -37,7 +37,7 @@ #include "hw/pci-host/designware.h" #include "hw/usb/chipidea.h" #include "hw/core/or-irq.h" -#include "cpu.h" +#include "target/arm/cpu.h" #include "qom/object.h" #include "qemu/units.h" diff --git a/include/hw/arm/fsl-imx8mp.h b/include/hw/arm/fsl-imx8mp.h index 4b367b754c..3b6183ed1d 100644 --- a/include/hw/arm/fsl-imx8mp.h +++ b/include/hw/arm/fsl-imx8mp.h @@ -9,7 +9,7 @@ #ifndef FSL_IMX8MP_H #define FSL_IMX8MP_H -#include "cpu.h" +#include "target/arm/cpu.h" #include "hw/char/imx_serial.h" #include "hw/gpio/imx_gpio.h" #include "hw/i2c/imx_i2c.h" From 4b603ceb0443426f82cce4bacf606ea86b223881 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Fri, 13 Mar 2026 06:08:10 +0100 Subject: [PATCH 06/62] hw/avr: Include full path to target 'cpu.h' header MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Philippe Mathieu-Daudé Reviewed-by: Pierrick Bouvier Message-Id: <20260313062055.2188-23-philmd@linaro.org> --- hw/avr/boot.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/avr/boot.h b/hw/avr/boot.h index 9eed205559..c5efa54d98 100644 --- a/hw/avr/boot.h +++ b/hw/avr/boot.h @@ -12,7 +12,7 @@ #define HW_AVR_BOOT_H #include "hw/core/boards.h" -#include "cpu.h" +#include "target/avr/cpu.h" /** * avr_load_firmware: load an image into a memory region From 696570ea028efc2684ee9ffe8e657c291113f013 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Fri, 13 Mar 2026 06:08:15 +0100 Subject: [PATCH 07/62] hw/hppa: Include full path to target 'cpu.h' header MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Philippe Mathieu-Daudé Reviewed-by: Pierrick Bouvier Message-Id: <20260313062055.2188-24-philmd@linaro.org> --- hw/hppa/machine.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/hppa/machine.c b/hw/hppa/machine.c index 3b03ad44d2..0937d90ed2 100644 --- a/hw/hppa/machine.c +++ b/hw/hppa/machine.c @@ -7,7 +7,7 @@ #include "qemu/osdep.h" #include "qemu/datadir.h" -#include "cpu.h" +#include "target/hppa/cpu.h" #include "elf.h" #include "hw/core/loader.h" #include "qemu/error-report.h" From 61f26fc177aae27d32dc6dc75c7ccd18857686a8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Fri, 13 Mar 2026 06:10:00 +0100 Subject: [PATCH 08/62] hw/i386: Include full path to target 'cpu.h' header MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Philippe Mathieu-Daudé Reviewed-by: Pierrick Bouvier Message-Id: <20260313062055.2188-25-philmd@linaro.org> --- hw/i386/multiboot.c | 2 +- hw/i386/pc_sysfw_ovmf.c | 2 +- hw/i386/vmmouse.c | 2 +- hw/isa/lpc_ich9.c | 2 +- include/hw/i386/apic_internal.h | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) diff --git a/hw/i386/multiboot.c b/hw/i386/multiboot.c index 0e960a15dd..d544b62afb 100644 --- a/hw/i386/multiboot.c +++ b/hw/i386/multiboot.c @@ -24,7 +24,7 @@ #include "qemu/osdep.h" #include "qemu/option.h" -#include "cpu.h" +#include "target/i386/cpu.h" #include "hw/nvram/fw_cfg.h" #include "multiboot.h" #include "hw/core/loader.h" diff --git a/hw/i386/pc_sysfw_ovmf.c b/hw/i386/pc_sysfw_ovmf.c index 2f7d15c9f3..822c611710 100644 --- a/hw/i386/pc_sysfw_ovmf.c +++ b/hw/i386/pc_sysfw_ovmf.c @@ -27,7 +27,7 @@ #include "qemu/error-report.h" #include "hw/i386/pc.h" #include "exec/target_page.h" -#include "cpu.h" +#include "target/i386/cpu.h" #include "target/i386/sev.h" #include "kvm/tdx.h" diff --git a/hw/i386/vmmouse.c b/hw/i386/vmmouse.c index c1aeeca0c9..20ebb0dbbf 100644 --- a/hw/i386/vmmouse.c +++ b/hw/i386/vmmouse.c @@ -29,7 +29,7 @@ #include "hw/input/i8042.h" #include "hw/core/qdev-properties.h" #include "migration/vmstate.h" -#include "cpu.h" +#include "target/i386/cpu.h" #include "qom/object.h" #include "trace.h" diff --git a/hw/isa/lpc_ich9.c b/hw/isa/lpc_ich9.c index 51dc680029..9cec18a378 100644 --- a/hw/isa/lpc_ich9.c +++ b/hw/isa/lpc_ich9.c @@ -30,7 +30,7 @@ #include "qemu/osdep.h" #include "qemu/log.h" -#include "cpu.h" +#include "target/i386/cpu.h" #include "qapi/error.h" #include "qapi/visitor.h" #include "qemu/range.h" diff --git a/include/hw/i386/apic_internal.h b/include/hw/i386/apic_internal.h index 0cb06bbc76..a26d53bb9d 100644 --- a/include/hw/i386/apic_internal.h +++ b/include/hw/i386/apic_internal.h @@ -21,7 +21,7 @@ #ifndef QEMU_APIC_INTERNAL_H #define QEMU_APIC_INTERNAL_H -#include "cpu.h" +#include "target/i386/cpu.h" #include "hw/i386/apic.h" #include "system/memory.h" #include "qemu/timer.h" From 7c85f3a5b134d33321709fd8de304da83c0c1912 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Fri, 13 Mar 2026 06:09:21 +0100 Subject: [PATCH 09/62] hw/m68k: Include full path to target 'cpu.h' header MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Philippe Mathieu-Daudé Reviewed-by: Thomas Huth Reviewed-by: Pierrick Bouvier Message-Id: <20260313062055.2188-26-philmd@linaro.org> --- hw/intc/m68k_irqc.c | 2 +- hw/m68k/an5206.c | 2 +- hw/m68k/mcf5206.c | 2 +- hw/m68k/mcf5208.c | 2 +- hw/m68k/mcf_intc.c | 2 +- hw/m68k/q800-glue.c | 2 +- hw/m68k/q800.c | 2 +- hw/m68k/virt.c | 2 +- 8 files changed, 8 insertions(+), 8 deletions(-) diff --git a/hw/intc/m68k_irqc.c b/hw/intc/m68k_irqc.c index c652bf143f..68ddb5351b 100644 --- a/hw/intc/m68k_irqc.c +++ b/hw/intc/m68k_irqc.c @@ -8,7 +8,7 @@ */ #include "qemu/osdep.h" -#include "cpu.h" +#include "target/m68k/cpu.h" #include "migration/vmstate.h" #include "hw/core/qdev-properties.h" #include "hw/core/nmi.h" diff --git a/hw/m68k/an5206.c b/hw/m68k/an5206.c index f92a5d6a33..1acd2fbdfb 100644 --- a/hw/m68k/an5206.c +++ b/hw/m68k/an5206.c @@ -8,7 +8,7 @@ #include "qemu/osdep.h" #include "qapi/error.h" -#include "cpu.h" +#include "target/m68k/cpu.h" #include "hw/m68k/mcf.h" #include "hw/core/boards.h" #include "hw/core/loader.h" diff --git a/hw/m68k/mcf5206.c b/hw/m68k/mcf5206.c index c5befa02eb..9f373b99b1 100644 --- a/hw/m68k/mcf5206.c +++ b/hw/m68k/mcf5206.c @@ -9,7 +9,7 @@ #include "qemu/osdep.h" #include "qemu/error-report.h" #include "qemu/log.h" -#include "cpu.h" +#include "target/m68k/cpu.h" #include "hw/core/qdev-properties.h" #include "hw/core/boards.h" #include "hw/core/irq.h" diff --git a/hw/m68k/mcf5208.c b/hw/m68k/mcf5208.c index 0e07aa45e9..a8068c91f2 100644 --- a/hw/m68k/mcf5208.c +++ b/hw/m68k/mcf5208.c @@ -20,7 +20,7 @@ #include "qemu/log.h" #include "qapi/error.h" #include "qemu/datadir.h" -#include "cpu.h" +#include "target/m68k/cpu.h" #include "hw/core/irq.h" #include "hw/m68k/mcf.h" #include "hw/m68k/mcf_fec.h" diff --git a/hw/m68k/mcf_intc.c b/hw/m68k/mcf_intc.c index 1014fe6fa5..e8d3bd937d 100644 --- a/hw/m68k/mcf_intc.c +++ b/hw/m68k/mcf_intc.c @@ -10,7 +10,7 @@ #include "qapi/error.h" #include "qemu/module.h" #include "qemu/log.h" -#include "cpu.h" +#include "target/m68k/cpu.h" #include "hw/core/irq.h" #include "hw/core/sysbus.h" #include "hw/m68k/mcf.h" diff --git a/hw/m68k/q800-glue.c b/hw/m68k/q800-glue.c index 24fccab966..ac9062c648 100644 --- a/hw/m68k/q800-glue.c +++ b/hw/m68k/q800-glue.c @@ -21,7 +21,7 @@ */ #include "qemu/osdep.h" -#include "cpu.h" +#include "target/m68k/cpu.h" #include "hw/m68k/q800-glue.h" #include "hw/core/boards.h" #include "hw/core/irq.h" diff --git a/hw/m68k/q800.c b/hw/m68k/q800.c index c0d78eb7d7..ab64250c47 100644 --- a/hw/m68k/q800.c +++ b/hw/m68k/q800.c @@ -26,7 +26,7 @@ #include "qemu/guest-random.h" #include "exec/target_page.h" #include "system/system.h" -#include "cpu.h" +#include "target/m68k/cpu.h" #include "hw/core/boards.h" #include "hw/core/or-irq.h" #include "elf.h" diff --git a/hw/m68k/virt.c b/hw/m68k/virt.c index ffe6e23415..cf8ebd65e3 100644 --- a/hw/m68k/virt.c +++ b/hw/m68k/virt.c @@ -12,7 +12,7 @@ #include "qemu/guest-random.h" #include "exec/target_page.h" #include "system/system.h" -#include "cpu.h" +#include "target/m68k/cpu.h" #include "hw/core/boards.h" #include "hw/core/qdev-properties.h" #include "elf.h" From c924767ab1efdfb26dff105ec098d33d8f16124d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Fri, 13 Mar 2026 06:09:43 +0100 Subject: [PATCH 10/62] hw/microblaze: Include full path to target 'cpu.h' header MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Philippe Mathieu-Daudé Reviewed-by: Pierrick Bouvier Message-Id: <20260313062055.2188-27-philmd@linaro.org> --- hw/microblaze/boot.c | 2 +- hw/microblaze/petalogix_ml605_mmu.c | 2 +- hw/microblaze/petalogix_s3adsp1800_mmu.c | 2 +- hw/microblaze/xlnx-zynqmp-pmu.c | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/hw/microblaze/boot.c b/hw/microblaze/boot.c index 4ad5ffd34b..a93b68e1e4 100644 --- a/hw/microblaze/boot.c +++ b/hw/microblaze/boot.c @@ -26,7 +26,7 @@ #include "qemu/osdep.h" #include "qemu/datadir.h" -#include "cpu.h" +#include "target/microblaze/cpu.h" #include "qemu/option.h" #include "qemu/config-file.h" #include "qemu/error-report.h" diff --git a/hw/microblaze/petalogix_ml605_mmu.c b/hw/microblaze/petalogix_ml605_mmu.c index b3bdc4d65f..8f9f54ff1e 100644 --- a/hw/microblaze/petalogix_ml605_mmu.c +++ b/hw/microblaze/petalogix_ml605_mmu.c @@ -28,7 +28,7 @@ #include "qemu/osdep.h" #include "qemu/units.h" #include "qapi/error.h" -#include "cpu.h" +#include "target/microblaze/cpu.h" #include "hw/core/sysbus.h" #include "net/net.h" #include "hw/block/flash.h" diff --git a/hw/microblaze/petalogix_s3adsp1800_mmu.c b/hw/microblaze/petalogix_s3adsp1800_mmu.c index 0c9a6bf252..c5f6431900 100644 --- a/hw/microblaze/petalogix_s3adsp1800_mmu.c +++ b/hw/microblaze/petalogix_s3adsp1800_mmu.c @@ -27,7 +27,7 @@ #include "qemu/target-info.h" #include "qemu/units.h" #include "qapi/error.h" -#include "cpu.h" +#include "target/microblaze/cpu.h" #include "hw/core/sysbus.h" #include "net/net.h" #include "hw/block/flash.h" diff --git a/hw/microblaze/xlnx-zynqmp-pmu.c b/hw/microblaze/xlnx-zynqmp-pmu.c index f4c55589b7..00154236bf 100644 --- a/hw/microblaze/xlnx-zynqmp-pmu.c +++ b/hw/microblaze/xlnx-zynqmp-pmu.c @@ -19,7 +19,7 @@ #include "qapi/error.h" #include "system/address-spaces.h" #include "hw/core/boards.h" -#include "cpu.h" +#include "target/microblaze/cpu.h" #include "boot.h" #include "hw/intc/xlnx-zynqmp-ipi.h" From 0eb25d4ad51c87144bf73435bc331a9f88e69548 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Fri, 13 Mar 2026 06:09:08 +0100 Subject: [PATCH 11/62] hw/mips: Include full path to target 'cpu.h' header MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Philippe Mathieu-Daudé Reviewed-by: Pierrick Bouvier Message-Id: <20260313062055.2188-28-philmd@linaro.org> --- hw/mips/bootloader.c | 2 +- hw/mips/fuloong2e.c | 2 +- hw/mips/jazz.c | 2 +- hw/mips/malta.c | 2 +- hw/misc/mips_cpc.c | 2 +- include/hw/intc/mips_gic.h | 2 +- 6 files changed, 6 insertions(+), 6 deletions(-) diff --git a/hw/mips/bootloader.c b/hw/mips/bootloader.c index 1dd6ef2096..aa4abcf4c3 100644 --- a/hw/mips/bootloader.c +++ b/hw/mips/bootloader.c @@ -11,7 +11,7 @@ #include "qemu/osdep.h" #include "qemu/bitops.h" -#include "cpu.h" +#include "target/mips/cpu.h" #include "hw/mips/bootloader.h" typedef enum bl_reg { diff --git a/hw/mips/fuloong2e.c b/hw/mips/fuloong2e.c index 72ad4507df..9a712ee930 100644 --- a/hw/mips/fuloong2e.c +++ b/hw/mips/fuloong2e.c @@ -22,7 +22,7 @@ #include "qemu/datadir.h" #include "qemu/units.h" #include "qapi/error.h" -#include "cpu.h" +#include "target/mips/cpu.h" #include "hw/core/clock.h" #include "net/net.h" #include "hw/core/boards.h" diff --git a/hw/mips/jazz.c b/hw/mips/jazz.c index e0adb96c54..bec534d38b 100644 --- a/hw/mips/jazz.c +++ b/hw/mips/jazz.c @@ -52,7 +52,7 @@ #ifdef CONFIG_TCG #include "accel/tcg/cpu-ops.h" #endif /* CONFIG_TCG */ -#include "cpu.h" +#include "target/mips/cpu.h" enum jazz_model_e { JAZZ_MAGNUM, diff --git a/hw/mips/malta.c b/hw/mips/malta.c index 812ff64d83..0cbe9956e7 100644 --- a/hw/mips/malta.c +++ b/hw/mips/malta.c @@ -61,7 +61,7 @@ #include "hw/core/qdev-clock.h" #include "target/mips/internal.h" #include "trace.h" -#include "cpu.h" +#include "target/mips/cpu.h" #define ENVP_PADDR 0x2000 #define ENVP_VADDR cpu_mips_phys_to_kseg0(NULL, ENVP_PADDR) diff --git a/hw/misc/mips_cpc.c b/hw/misc/mips_cpc.c index d092f76f44..9d9c8bf6ec 100644 --- a/hw/misc/mips_cpc.c +++ b/hw/misc/mips_cpc.c @@ -19,7 +19,7 @@ #include "qemu/osdep.h" #include "qapi/error.h" -#include "cpu.h" +#include "target/mips/cpu.h" #include "qemu/log.h" #include "qemu/module.h" #include "hw/core/cpu.h" diff --git a/include/hw/intc/mips_gic.h b/include/hw/intc/mips_gic.h index e2e6f0a168..b3b64fec85 100644 --- a/include/hw/intc/mips_gic.h +++ b/include/hw/intc/mips_gic.h @@ -14,7 +14,7 @@ #include "qemu/units.h" #include "hw/timer/mips_gictimer.h" #include "hw/core/sysbus.h" -#include "cpu.h" +#include "target/mips/cpu.h" #include "qom/object.h" /* * GIC Specific definitions From 2d494b7ce3165eb3f73fc8ff56b28962ded0c1ca Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Fri, 13 Mar 2026 06:09:51 +0100 Subject: [PATCH 12/62] hw/or1k: Include full path to target 'cpu.h' header MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Philippe Mathieu-Daudé Reviewed-by: Pierrick Bouvier Message-Id: <20260313062055.2188-29-philmd@linaro.org> --- hw/or1k/boot.c | 2 +- hw/or1k/cputimer.c | 2 +- hw/or1k/or1k-sim.c | 2 +- hw/or1k/virt.c | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/hw/or1k/boot.c b/hw/or1k/boot.c index c18f4a6a9f..714634b5f3 100644 --- a/hw/or1k/boot.c +++ b/hw/or1k/boot.c @@ -7,7 +7,7 @@ */ #include "qemu/osdep.h" -#include "cpu.h" +#include "target/or1k/cpu.h" #include "exec/cpu-defs.h" #include "exec/target_page.h" #include "elf.h" diff --git a/hw/or1k/cputimer.c b/hw/or1k/cputimer.c index 51da226fcd..b35411aa1e 100644 --- a/hw/or1k/cputimer.c +++ b/hw/or1k/cputimer.c @@ -19,7 +19,7 @@ */ #include "qemu/osdep.h" -#include "cpu.h" +#include "target/or1k/cpu.h" #include "migration/vmstate.h" #include "qemu/timer.h" #include "system/reset.h" diff --git a/hw/or1k/or1k-sim.c b/hw/or1k/or1k-sim.c index f1b1f63274..b55105cd14 100644 --- a/hw/or1k/or1k-sim.c +++ b/hw/or1k/or1k-sim.c @@ -21,7 +21,7 @@ #include "qemu/osdep.h" #include "qemu/error-report.h" #include "qapi/error.h" -#include "cpu.h" +#include "target/or1k/cpu.h" #include "hw/core/irq.h" #include "hw/core/boards.h" #include "hw/char/serial-mm.h" diff --git a/hw/or1k/virt.c b/hw/or1k/virt.c index 39f54058ab..2ff5c084a2 100644 --- a/hw/or1k/virt.c +++ b/hw/or1k/virt.c @@ -10,7 +10,7 @@ #include "qemu/error-report.h" #include "qemu/guest-random.h" #include "qapi/error.h" -#include "cpu.h" +#include "target/or1k/cpu.h" #include "system/address-spaces.h" #include "hw/core/irq.h" #include "hw/core/boards.h" From e6407b73a39bcbdce26b37e33c22043fe9d00d8c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Fri, 13 Mar 2026 06:07:16 +0100 Subject: [PATCH 13/62] hw/ppc: Include full path to target 'cpu.h' header MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Philippe Mathieu-Daudé Reviewed-by: Pierrick Bouvier Message-Id: <20260313062055.2188-30-philmd@linaro.org> --- hw/ppc/mpc8544_guts.c | 2 +- hw/ppc/mpc8544ds.c | 2 +- hw/ppc/ppc440_uc.c | 2 +- hw/ppc/ppc4xx_devs.c | 2 +- hw/ppc/ppc_booke.c | 2 +- hw/ppc/prep_systemio.c | 2 +- hw/ppc/spapr_vhyp_mmu.c | 2 +- hw/ppc/virtex_ml507.c | 2 +- include/hw/ppc/pnv.h | 2 +- include/hw/ppc/spapr_fadump.h | 2 +- 10 files changed, 10 insertions(+), 10 deletions(-) diff --git a/hw/ppc/mpc8544_guts.c b/hw/ppc/mpc8544_guts.c index 88ae573d1e..3f2bbc0a51 100644 --- a/hw/ppc/mpc8544_guts.c +++ b/hw/ppc/mpc8544_guts.c @@ -20,7 +20,7 @@ #include "qemu/osdep.h" #include "qemu/log.h" #include "system/runstate.h" -#include "cpu.h" +#include "target/ppc/cpu.h" #include "hw/core/sysbus.h" #include "qom/object.h" diff --git a/hw/ppc/mpc8544ds.c b/hw/ppc/mpc8544ds.c index 582698559d..6a5d3edc49 100644 --- a/hw/ppc/mpc8544ds.c +++ b/hw/ppc/mpc8544ds.c @@ -15,7 +15,7 @@ #include "hw/ppc/openpic.h" #include "qemu/error-report.h" #include "qemu/units.h" -#include "cpu.h" +#include "target/ppc/cpu.h" static void mpc8544ds_fixup_devtree(void *fdt) { diff --git a/hw/ppc/ppc440_uc.c b/hw/ppc/ppc440_uc.c index 0f28a7937f..634046506e 100644 --- a/hw/ppc/ppc440_uc.c +++ b/hw/ppc/ppc440_uc.c @@ -19,7 +19,7 @@ #include "hw/pci/pci.h" #include "exec/cpu-common.h" #include "system/reset.h" -#include "cpu.h" +#include "target/ppc/cpu.h" #include "ppc440.h" /*****************************************************************************/ diff --git a/hw/ppc/ppc4xx_devs.c b/hw/ppc/ppc4xx_devs.c index 1e6b6fec5d..ae1ac4f467 100644 --- a/hw/ppc/ppc4xx_devs.c +++ b/hw/ppc/ppc4xx_devs.c @@ -23,7 +23,7 @@ */ #include "qemu/osdep.h" -#include "cpu.h" +#include "target/ppc/cpu.h" #include "hw/ppc/ppc4xx.h" #include "hw/core/qdev-properties.h" #include "qapi/error.h" diff --git a/hw/ppc/ppc_booke.c b/hw/ppc/ppc_booke.c index 7c6e5df9fd..052c8c931a 100644 --- a/hw/ppc/ppc_booke.c +++ b/hw/ppc/ppc_booke.c @@ -23,7 +23,7 @@ */ #include "qemu/osdep.h" -#include "cpu.h" +#include "target/ppc/cpu.h" #include "exec/target_page.h" #include "hw/ppc/ppc.h" #include "qemu/timer.h" diff --git a/hw/ppc/prep_systemio.c b/hw/ppc/prep_systemio.c index bc8b0964e7..5cd18a9e12 100644 --- a/hw/ppc/prep_systemio.c +++ b/hw/ppc/prep_systemio.c @@ -33,7 +33,7 @@ #include "qemu/error-report.h" /* for error_report() */ #include "qemu/module.h" #include "system/runstate.h" -#include "cpu.h" +#include "target/ppc/cpu.h" #include "trace.h" #define TYPE_PREP_SYSTEMIO "prep-systemio" diff --git a/hw/ppc/spapr_vhyp_mmu.c b/hw/ppc/spapr_vhyp_mmu.c index 2d41d7f77b..9cc3aeb2a2 100644 --- a/hw/ppc/spapr_vhyp_mmu.c +++ b/hw/ppc/spapr_vhyp_mmu.c @@ -11,7 +11,7 @@ #include "qemu/cutils.h" #include "qemu/memalign.h" #include "qemu/error-report.h" -#include "cpu.h" +#include "target/ppc/cpu.h" #include "helper_regs.h" #include "hw/ppc/spapr.h" #include "mmu-hash64.h" diff --git a/hw/ppc/virtex_ml507.c b/hw/ppc/virtex_ml507.c index 51b3d7d712..d10d913589 100644 --- a/hw/ppc/virtex_ml507.c +++ b/hw/ppc/virtex_ml507.c @@ -26,7 +26,7 @@ #include "qemu/datadir.h" #include "qemu/units.h" #include "exec/page-protection.h" -#include "cpu.h" +#include "target/ppc/cpu.h" #include "hw/core/sysbus.h" #include "hw/char/serial-mm.h" #include "hw/block/flash.h" diff --git a/include/hw/ppc/pnv.h b/include/hw/ppc/pnv.h index 90028f974d..ce3ce73b53 100644 --- a/include/hw/ppc/pnv.h +++ b/include/hw/ppc/pnv.h @@ -20,7 +20,7 @@ #ifndef PPC_PNV_H #define PPC_PNV_H -#include "cpu.h" +#include "target/ppc/cpu.h" #include "hw/core/boards.h" #include "hw/core/sysbus.h" #include "hw/ipmi/ipmi.h" diff --git a/include/hw/ppc/spapr_fadump.h b/include/hw/ppc/spapr_fadump.h index 82681fb9a6..778981bc95 100644 --- a/include/hw/ppc/spapr_fadump.h +++ b/include/hw/ppc/spapr_fadump.h @@ -6,7 +6,7 @@ #ifndef PPC_SPAPR_FADUMP_H #define PPC_SPAPR_FADUMP_H -#include "cpu.h" +#include "target/ppc/cpu.h" /* Fadump commands */ #define FADUMP_CMD_REGISTER 1 From 1ee7220bd0d1f56f6c398a280d01cdc2b52e7350 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Fri, 13 Mar 2026 06:07:29 +0100 Subject: [PATCH 14/62] hw/riscv: Include full path to target 'cpu.h' header MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Philippe Mathieu-Daudé Reviewed-by: Pierrick Bouvier Message-Id: <20260313062055.2188-31-philmd@linaro.org> --- hw/misc/riscv_cmgcr.c | 2 +- hw/misc/riscv_cpc.c | 2 +- hw/riscv/microblaze-v-generic.c | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/hw/misc/riscv_cmgcr.c b/hw/misc/riscv_cmgcr.c index b0294e7663..ab9b6c7d87 100644 --- a/hw/misc/riscv_cmgcr.c +++ b/hw/misc/riscv_cmgcr.c @@ -20,7 +20,7 @@ #include "hw/misc/riscv_cmgcr.h" #include "hw/core/qdev-properties.h" -#include "cpu.h" +#include "target/riscv/cpu.h" #define CM_RESET_VEC 0x1FC00000 #define GCR_ADDRSPACE_SZ 0x8000 diff --git a/hw/misc/riscv_cpc.c b/hw/misc/riscv_cpc.c index e04ccdf54f..37fdd0b39b 100644 --- a/hw/misc/riscv_cpc.c +++ b/hw/misc/riscv_cpc.c @@ -13,7 +13,7 @@ #include "qemu/osdep.h" #include "qapi/error.h" -#include "cpu.h" +#include "target/riscv/cpu.h" #include "qemu/log.h" #include "qemu/module.h" #include "qemu/timer.h" diff --git a/hw/riscv/microblaze-v-generic.c b/hw/riscv/microblaze-v-generic.c index d56b64792d..b0494b1ac5 100644 --- a/hw/riscv/microblaze-v-generic.c +++ b/hw/riscv/microblaze-v-generic.c @@ -16,7 +16,7 @@ #include "qemu/osdep.h" #include "qemu/units.h" #include "qapi/error.h" -#include "cpu.h" +#include "target/riscv/cpu.h" #include "hw/core/sysbus.h" #include "system/system.h" #include "net/net.h" From 3db78d53d355a2bdd0eb370e4324c93e53c76b93 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Fri, 13 Mar 2026 06:07:41 +0100 Subject: [PATCH 15/62] hw/s390x: Include full path to target 'cpu.h' header MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Philippe Mathieu-Daudé Reviewed-by: Thomas Huth Reviewed-by: Pierrick Bouvier Message-Id: <20260313062055.2188-32-philmd@linaro.org> --- hw/s390x/ap-bridge.c | 2 +- hw/s390x/ipl.h | 2 +- hw/s390x/s390-hypercall.c | 2 +- hw/s390x/s390-hypercall.h | 2 +- hw/s390x/s390-stattrib.c | 2 +- hw/s390x/tod-tcg.c | 2 +- 6 files changed, 6 insertions(+), 6 deletions(-) diff --git a/hw/s390x/ap-bridge.c b/hw/s390x/ap-bridge.c index 5cdbf09807..c7e49d966b 100644 --- a/hw/s390x/ap-bridge.c +++ b/hw/s390x/ap-bridge.c @@ -14,7 +14,7 @@ #include "qemu/bitops.h" #include "qemu/module.h" #include "hw/s390x/ap-bridge.h" -#include "cpu.h" +#include "target/s390x/cpu.h" static char *ap_bus_get_dev_path(DeviceState *dev) { diff --git a/hw/s390x/ipl.h b/hw/s390x/ipl.h index 403cd08450..fac30763df 100644 --- a/hw/s390x/ipl.h +++ b/hw/s390x/ipl.h @@ -13,7 +13,7 @@ #ifndef HW_S390_IPL_H #define HW_S390_IPL_H -#include "cpu.h" +#include "target/s390x/cpu.h" #include "exec/target_page.h" #include "system/address-spaces.h" #include "system/memory.h" diff --git a/hw/s390x/s390-hypercall.c b/hw/s390x/s390-hypercall.c index 508dd97ca0..71dc717d08 100644 --- a/hw/s390x/s390-hypercall.c +++ b/hw/s390x/s390-hypercall.c @@ -11,7 +11,7 @@ #include "qemu/osdep.h" #include "qemu/error-report.h" -#include "cpu.h" +#include "target/s390x/cpu.h" #include "hw/s390x/s390-virtio-ccw.h" #include "hw/s390x/s390-hypercall.h" #include "hw/s390x/ioinst.h" diff --git a/hw/s390x/s390-hypercall.h b/hw/s390x/s390-hypercall.h index 4f07209128..c5a2b17e85 100644 --- a/hw/s390x/s390-hypercall.h +++ b/hw/s390x/s390-hypercall.h @@ -12,7 +12,7 @@ #ifndef HW_S390_HYPERCALL_H #define HW_S390_HYPERCALL_H -#include "cpu.h" +#include "target/s390x/cpu.h" #define DIAG500_VIRTIO_NOTIFY 0 /* legacy, implemented as a NOP */ #define DIAG500_VIRTIO_RESET 1 /* legacy */ diff --git a/hw/s390x/s390-stattrib.c b/hw/s390x/s390-stattrib.c index d808ece3b9..2e83aa211c 100644 --- a/hw/s390x/s390-stattrib.c +++ b/hw/s390x/s390-stattrib.c @@ -20,7 +20,7 @@ #include "qemu/error-report.h" #include "qapi/error.h" #include "qobject/qdict.h" -#include "cpu.h" +#include "target/s390x/cpu.h" /* 512KiB cover 2GB of guest memory */ #define CMMA_BLOCK_SIZE (512 * KiB) diff --git a/hw/s390x/tod-tcg.c b/hw/s390x/tod-tcg.c index 0cc96624e1..448b531b2e 100644 --- a/hw/s390x/tod-tcg.c +++ b/hw/s390x/tod-tcg.c @@ -14,7 +14,7 @@ #include "qemu/timer.h" #include "qemu/cutils.h" #include "qemu/module.h" -#include "cpu.h" +#include "target/s390x/cpu.h" #include "tcg/tcg_s390x.h" #include "system/rtc.h" From e0d10ec06d35b62133f7c3518181a7d084dc87ed Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Fri, 13 Mar 2026 06:10:10 +0100 Subject: [PATCH 16/62] hw/sh4: Include full path to target 'cpu.h' header MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Philippe Mathieu-Daudé Reviewed-by: Pierrick Bouvier Message-Id: <20260313062055.2188-33-philmd@linaro.org> --- hw/intc/sh_intc.c | 2 +- hw/sh4/r2d.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/hw/intc/sh_intc.c b/hw/intc/sh_intc.c index 16e4b619d6..0da82f9d5e 100644 --- a/hw/intc/sh_intc.c +++ b/hw/intc/sh_intc.c @@ -10,7 +10,7 @@ #include "qemu/osdep.h" #include "qemu/log.h" -#include "cpu.h" +#include "target/sh4/cpu.h" #include "hw/sh4/sh_intc.h" #include "hw/core/irq.h" #include "hw/sh4/sh.h" diff --git a/hw/sh4/r2d.c b/hw/sh4/r2d.c index acb3fe75a8..99afe3618e 100644 --- a/hw/sh4/r2d.c +++ b/hw/sh4/r2d.c @@ -27,7 +27,7 @@ #include "qemu/units.h" #include "qapi/error.h" #include "qemu/error-report.h" -#include "cpu.h" +#include "target/sh4/cpu.h" #include "hw/core/sysbus.h" #include "hw/sh4/sh.h" #include "system/reset.h" From ec01abc8783e0800babd324c24a645062a87073d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Fri, 13 Mar 2026 06:10:19 +0100 Subject: [PATCH 17/62] hw/sparc: Include full path to target 'cpu.h' header MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Philippe Mathieu-Daudé Reviewed-by: Pierrick Bouvier Message-Id: <20260313062055.2188-34-philmd@linaro.org> --- hw/sparc/leon3.c | 2 +- hw/sparc/sun4m.c | 2 +- hw/sparc64/niagara.c | 2 +- hw/sparc64/sparc64.c | 2 +- hw/sparc64/sun4u.c | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) diff --git a/hw/sparc/leon3.c b/hw/sparc/leon3.c index 9147d56bd4..d4a6e91759 100644 --- a/hw/sparc/leon3.c +++ b/hw/sparc/leon3.c @@ -30,7 +30,7 @@ #include "qapi/error.h" #include "qemu/datadir.h" #include "exec/cpu-common.h" -#include "cpu.h" +#include "target/sparc/cpu.h" #include "hw/core/irq.h" #include "qemu/timer.h" #include "hw/core/ptimer.h" diff --git a/hw/sparc/sun4m.c b/hw/sparc/sun4m.c index 46fcbdda97..550acdff6d 100644 --- a/hw/sparc/sun4m.c +++ b/hw/sparc/sun4m.c @@ -26,7 +26,7 @@ #include "qemu/units.h" #include "qapi/error.h" #include "qemu/datadir.h" -#include "cpu.h" +#include "target/sparc/cpu.h" #include "exec/target_page.h" #include "hw/core/sysbus.h" #include "qemu/error-report.h" diff --git a/hw/sparc64/niagara.c b/hw/sparc64/niagara.c index 209be38047..1211ecb82d 100644 --- a/hw/sparc64/niagara.c +++ b/hw/sparc64/niagara.c @@ -25,7 +25,7 @@ #include "qemu/osdep.h" #include "block/block_int-common.h" #include "qemu/units.h" -#include "cpu.h" +#include "target/sparc/cpu.h" #include "hw/core/boards.h" #include "hw/char/serial-mm.h" #include "hw/misc/unimp.h" diff --git a/hw/sparc64/sparc64.c b/hw/sparc64/sparc64.c index ce7eded143..16f4aa052b 100644 --- a/hw/sparc64/sparc64.c +++ b/hw/sparc64/sparc64.c @@ -25,7 +25,7 @@ #include "qemu/osdep.h" #include "qapi/error.h" -#include "cpu.h" +#include "target/sparc/cpu.h" #include "hw/core/boards.h" #include "hw/sparc/sparc64.h" #include "qemu/timer.h" diff --git a/hw/sparc64/sun4u.c b/hw/sparc64/sun4u.c index 2e41785b78..d69ed9a81a 100644 --- a/hw/sparc64/sun4u.c +++ b/hw/sparc64/sun4u.c @@ -27,7 +27,7 @@ #include "qemu/error-report.h" #include "qapi/error.h" #include "qemu/datadir.h" -#include "cpu.h" +#include "target/sparc/cpu.h" #include "exec/target_page.h" #include "hw/core/irq.h" #include "hw/pci/pci.h" From d4cd5ef4f8583f59e878657e55350c1e5942e35a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Fri, 13 Mar 2026 06:10:23 +0100 Subject: [PATCH 18/62] hw/tricore: Include full path to target 'cpu.h' header MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Philippe Mathieu-Daudé Reviewed-by: Pierrick Bouvier Message-Id: <20260313062055.2188-35-philmd@linaro.org> --- hw/tricore/tricore_testboard.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/tricore/tricore_testboard.c b/hw/tricore/tricore_testboard.c index 60772d4f1d..d5d796c8ee 100644 --- a/hw/tricore/tricore_testboard.c +++ b/hw/tricore/tricore_testboard.c @@ -21,7 +21,7 @@ #include "qemu/osdep.h" #include "qemu/units.h" #include "qapi/error.h" -#include "cpu.h" +#include "target/tricore/cpu.h" #include "net/net.h" #include "hw/core/boards.h" #include "hw/core/loader.h" From c58e3e0e280a36c2379b7bbc53ec110b011cbd24 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Fri, 13 Mar 2026 06:08:50 +0100 Subject: [PATCH 19/62] hw/xtensa: Include full path to target 'cpu.h' header MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Philippe Mathieu-Daudé Reviewed-by: Pierrick Bouvier Message-Id: <20260313062055.2188-36-philmd@linaro.org> --- hw/xtensa/pic_cpu.c | 2 +- hw/xtensa/xtensa_memory.h | 2 +- hw/xtensa/xtfpga.c | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/hw/xtensa/pic_cpu.c b/hw/xtensa/pic_cpu.c index c00167859a..370a353f1e 100644 --- a/hw/xtensa/pic_cpu.c +++ b/hw/xtensa/pic_cpu.c @@ -26,7 +26,7 @@ */ #include "qemu/osdep.h" -#include "cpu.h" +#include "target/xtensa/cpu.h" #include "exec/cpu-interrupt.h" #include "hw/core/irq.h" #include "qemu/log.h" diff --git a/hw/xtensa/xtensa_memory.h b/hw/xtensa/xtensa_memory.h index af7e8025e3..c86ad06685 100644 --- a/hw/xtensa/xtensa_memory.h +++ b/hw/xtensa/xtensa_memory.h @@ -28,7 +28,7 @@ #ifndef XTENSA_MEMORY_H #define XTENSA_MEMORY_H -#include "cpu.h" +#include "target/xtensa/cpu.h" void xtensa_create_memory_regions(const XtensaMemory *memory, const char *name, diff --git a/hw/xtensa/xtfpga.c b/hw/xtensa/xtfpga.c index ed24720f94..5e509216df 100644 --- a/hw/xtensa/xtfpga.c +++ b/hw/xtensa/xtfpga.c @@ -28,7 +28,7 @@ #include "qemu/osdep.h" #include "qemu/units.h" #include "qapi/error.h" -#include "cpu.h" +#include "target/xtensa/cpu.h" #include "system/system.h" #include "hw/core/boards.h" #include "hw/core/loader.h" From 60ab4a04379632294a57ed1878371bbfba418568 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Tue, 17 Mar 2026 12:26:56 +0100 Subject: [PATCH 20/62] hw/tpm: Factor tpm_ppi_enabled() out MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Factor out tpm_ppi_enabled() before modifying it in a unique place. Signed-off-by: Philippe Mathieu-Daudé Reviewed-by: Stefan Berger Message-Id: <20260317120241.16320-2-philmd@linaro.org> --- hw/acpi/tpm.c | 2 +- hw/i386/acpi-build.c | 2 +- include/system/tpm.h | 9 +++++++++ 3 files changed, 11 insertions(+), 2 deletions(-) diff --git a/hw/acpi/tpm.c b/hw/acpi/tpm.c index cdc0227536..5fe95f2e3f 100644 --- a/hw/acpi/tpm.c +++ b/hw/acpi/tpm.c @@ -25,7 +25,7 @@ void tpm_build_ppi_acpi(TPMIf *tpm, Aml *dev) Aml *method, *field, *ifctx, *ifctx2, *ifctx3, *func_mask, *not_implemented, *pak, *tpm2, *tpm3, *pprm, *pprq, *zero, *one; - if (!object_property_get_bool(OBJECT(tpm), "ppi", &error_abort)) { + if (!tpm_ppi_enabled(tpm)) { return; } diff --git a/hw/i386/acpi-build.c b/hw/i386/acpi-build.c index f622b91b76..4f01e2c476 100644 --- a/hw/i386/acpi-build.c +++ b/hw/i386/acpi-build.c @@ -2218,7 +2218,7 @@ void acpi_setup(void) tables.tcpalog->data, acpi_data_len(tables.tcpalog)); tpm = tpm_find(); - if (tpm && object_property_get_bool(OBJECT(tpm), "ppi", &error_abort)) { + if (tpm_ppi_enabled(tpm)) { tpm_config = (FwCfgTPMConfig) { .tpmppi_address = cpu_to_le32(TPM_PPI_ADDR_BASE), .tpm_version = tpm_get_version(tpm), diff --git a/include/system/tpm.h b/include/system/tpm.h index 1ee568b3b6..b90dd4e8cb 100644 --- a/include/system/tpm.h +++ b/include/system/tpm.h @@ -13,6 +13,7 @@ #define QEMU_TPM_H #include "qapi/qapi-types-tpm.h" +#include "qapi/error.h" #include "qom/object.h" #ifdef CONFIG_TPM @@ -78,6 +79,14 @@ static inline TPMVersion tpm_get_version(TPMIf *ti) return TPM_IF_GET_CLASS(ti)->get_version(ti); } +static inline bool tpm_ppi_enabled(TPMIf *ti) +{ + if (!ti) { + return false; + } + return object_property_get_bool(OBJECT(ti), "ppi", &error_abort); +} + #else /* CONFIG_TPM */ #define tpm_init() (0) From 6f4a9599521a9a2feded3e0eaa000546fc9d9e77 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Tue, 17 Mar 2026 12:31:42 +0100 Subject: [PATCH 21/62] hw/tpm: Add TPMIfClass::ppi_enabled field MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Each TPM derived device has a @ppi_enabled field, itself exposed as a QOM property. External layers (like the ACPI subsystem) wanting to know whether a device implements PPI has to check for the QOM property available. This can be simplified by declaring a single field in the TPM interface. Here we add such field to TPMIfClass, before converting each TPM devices to use it in the following commits. Signed-off-by: Philippe Mathieu-Daudé Reviewed-by: Stefan Berger Message-Id: <20260317120241.16320-3-philmd@linaro.org> --- include/system/tpm.h | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/include/system/tpm.h b/include/system/tpm.h index b90dd4e8cb..9458ad6668 100644 --- a/include/system/tpm.h +++ b/include/system/tpm.h @@ -43,6 +43,7 @@ struct TPMIfClass { enum TpmModel model; void (*request_completed)(TPMIf *obj, int ret); enum TPMVersion (*get_version)(TPMIf *obj); + bool ppi_enabled; }; #define TYPE_TPM_TIS_ISA "tpm-tis" @@ -84,6 +85,9 @@ static inline bool tpm_ppi_enabled(TPMIf *ti) if (!ti) { return false; } + if (TPM_IF_GET_CLASS(ti)->ppi_enabled) { + return true; + } return object_property_get_bool(OBJECT(ti), "ppi", &error_abort); } From 46427d53eb9551e947242fd10451acc4000c5cac Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Tue, 17 Mar 2026 12:32:06 +0100 Subject: [PATCH 22/62] hw/tpm: Remove CRBState::ppi_enabled field MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The CRBState::ppi_enabled boolean was only set in the hw_compat_3_1[] array, via the 'ppi=false' property. We removed all machines using that array, and the array itself in commit a861ffef237 ("hw/core/machine: Remove the hw_compat_3_1[] array"). We can safely remove the now unused property. Since CRB devices always use PPI, simplify removing the CRBState::ppi_enabled field. Set the generic TPMIfClass::ppi_enabled so ACPI subsystem can keep checking its availability. Signed-off-by: Philippe Mathieu-Daudé Reviewed-by: Stefan Berger Message-Id: <20260317120241.16320-4-philmd@linaro.org> --- hw/tpm/tpm_crb.c | 13 ++++--------- 1 file changed, 4 insertions(+), 9 deletions(-) diff --git a/hw/tpm/tpm_crb.c b/hw/tpm/tpm_crb.c index 8723536f93..02701ab948 100644 --- a/hw/tpm/tpm_crb.c +++ b/hw/tpm/tpm_crb.c @@ -43,7 +43,6 @@ struct CRBState { size_t be_buffer_size; - bool ppi_enabled; TPMPPI ppi; }; typedef struct CRBState CRBState; @@ -228,16 +227,13 @@ static const VMStateDescription vmstate_tpm_crb = { static const Property tpm_crb_properties[] = { DEFINE_PROP_TPMBE("tpmdev", CRBState, tpmbe), - DEFINE_PROP_BOOL("ppi", CRBState, ppi_enabled, true), }; static void tpm_crb_reset(void *dev) { CRBState *s = CRB(dev); - if (s->ppi_enabled) { - tpm_ppi_reset(&s->ppi); - } + tpm_ppi_reset(&s->ppi); tpm_backend_reset(s->tpmbe); memset(s->regs, 0, sizeof(s->regs)); @@ -303,10 +299,8 @@ static void tpm_crb_realize(DeviceState *dev, Error **errp) memory_region_add_subregion(get_system_memory(), TPM_CRB_ADDR_BASE + sizeof(s->regs), &s->cmdmem); - if (s->ppi_enabled) { - tpm_ppi_init(&s->ppi, get_system_memory(), - TPM_PPI_ADDR_BASE, OBJECT(s)); - } + tpm_ppi_init(&s->ppi, get_system_memory(), + TPM_PPI_ADDR_BASE, OBJECT(s)); if (xen_enabled()) { tpm_crb_reset(dev); @@ -325,6 +319,7 @@ static void tpm_crb_class_init(ObjectClass *klass, const void *data) dc->vmsd = &vmstate_tpm_crb; dc->user_creatable = true; tc->model = TPM_MODEL_TPM_CRB; + tc->ppi_enabled = true; tc->get_version = tpm_crb_get_version; tc->request_completed = tpm_crb_request_completed; From 0a4682368b75bdc584bc3aae99c1fd3f6d735546 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Tue, 17 Mar 2026 12:41:31 +0100 Subject: [PATCH 23/62] hw/tpm: Propagate @ppi_enabled to tpm_tis_reset() and remove in TPMState MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Of the TPM devices using FIFO mode, only the ISA variant has PPI, and calls tpm_ppi_init() to initialize the PPI state. Propagate @ppi_enabled to tpm_tis_reset() so it only resets the PPI part when requested (ISA case) otherwise the PPI is in uninitialized state. Remove the now unused TPMState::ppi_enabled field. Set the generic TPMIfClass::ppi_enabled so ACPI subsystem can keep checking its availability. Signed-off-by: Philippe Mathieu-Daudé Reviewed-by: Stefan Berger Message-Id: <20260317120241.16320-5-philmd@linaro.org> --- hw/tpm/tpm_tis.h | 3 +-- hw/tpm/tpm_tis_common.c | 4 ++-- hw/tpm/tpm_tis_i2c.c | 2 +- hw/tpm/tpm_tis_isa.c | 10 ++++------ hw/tpm/tpm_tis_sysbus.c | 2 +- 5 files changed, 9 insertions(+), 12 deletions(-) diff --git a/hw/tpm/tpm_tis.h b/hw/tpm/tpm_tis.h index 184632ff66..1531620bf9 100644 --- a/hw/tpm/tpm_tis.h +++ b/hw/tpm/tpm_tis.h @@ -75,7 +75,6 @@ typedef struct TPMState { size_t be_buffer_size; - bool ppi_enabled; TPMPPI ppi; } TPMState; @@ -83,7 +82,7 @@ extern const VMStateDescription vmstate_locty; extern const MemoryRegionOps tpm_tis_memory_ops; int tpm_tis_pre_save(TPMState *s); -void tpm_tis_reset(TPMState *s); +void tpm_tis_reset(TPMState *s, bool ppi_enabled); enum TPMVersion tpm_tis_get_tpm_version(TPMState *s); void tpm_tis_request_completed(TPMState *s, int ret); uint32_t tpm_tis_read_data(TPMState *s, hwaddr addr, unsigned size); diff --git a/hw/tpm/tpm_tis_common.c b/hw/tpm/tpm_tis_common.c index f594b15b8a..a134d5c205 100644 --- a/hw/tpm/tpm_tis_common.c +++ b/hw/tpm/tpm_tis_common.c @@ -813,7 +813,7 @@ enum TPMVersion tpm_tis_get_tpm_version(TPMState *s) * This function is called when the machine starts, resets or due to * S3 resume. */ -void tpm_tis_reset(TPMState *s) +void tpm_tis_reset(TPMState *s, bool ppi_enabled) { int c; @@ -821,7 +821,7 @@ void tpm_tis_reset(TPMState *s) s->be_buffer_size = MIN(tpm_backend_get_buffer_size(s->be_driver), TPM_TIS_BUFFER_MAX); - if (s->ppi_enabled) { + if (ppi_enabled) { tpm_ppi_reset(&s->ppi); } tpm_backend_reset(s->be_driver); diff --git a/hw/tpm/tpm_tis_i2c.c b/hw/tpm/tpm_tis_i2c.c index 9f13e0ec12..b4f258c7bc 100644 --- a/hw/tpm/tpm_tis_i2c.c +++ b/hw/tpm/tpm_tis_i2c.c @@ -523,7 +523,7 @@ static void tpm_tis_i2c_reset(DeviceState *dev) i2cst->csum_enable = 0; i2cst->loc_sel = 0x00; - return tpm_tis_reset(s); + return tpm_tis_reset(s, false); } static void tpm_tis_i2c_class_init(ObjectClass *klass, const void *data) diff --git a/hw/tpm/tpm_tis_isa.c b/hw/tpm/tpm_tis_isa.c index 61e95434f5..1ca403241d 100644 --- a/hw/tpm/tpm_tis_isa.c +++ b/hw/tpm/tpm_tis_isa.c @@ -88,13 +88,12 @@ static void tpm_tis_isa_reset(DeviceState *dev) TPMStateISA *isadev = TPM_TIS_ISA(dev); TPMState *s = &isadev->state; - return tpm_tis_reset(s); + return tpm_tis_reset(s, true); } static const Property tpm_tis_isa_properties[] = { DEFINE_PROP_UINT32("irq", TPMStateISA, state.irq_num, TPM_TIS_IRQ), DEFINE_PROP_TPMBE("tpmdev", TPMStateISA, state.be_driver), - DEFINE_PROP_BOOL("ppi", TPMStateISA, state.ppi_enabled, true), }; static void tpm_tis_isa_initfn(Object *obj) @@ -132,10 +131,8 @@ static void tpm_tis_isa_realizefn(DeviceState *dev, Error **errp) memory_region_add_subregion(isa_address_space(ISA_DEVICE(dev)), TPM_TIS_ADDR_BASE, &s->mmio); - if (s->ppi_enabled) { - tpm_ppi_init(&s->ppi, isa_address_space(ISA_DEVICE(dev)), - TPM_PPI_ADDR_BASE, OBJECT(dev)); - } + tpm_ppi_init(&s->ppi, isa_address_space(ISA_DEVICE(dev)), + TPM_PPI_ADDR_BASE, OBJECT(dev)); } static void build_tpm_tis_isa_aml(AcpiDevAmlIf *adev, Aml *scope) @@ -175,6 +172,7 @@ static void tpm_tis_isa_class_init(ObjectClass *klass, const void *data) device_class_set_props(dc, tpm_tis_isa_properties); dc->vmsd = &vmstate_tpm_tis_isa; tc->model = TPM_MODEL_TPM_TIS; + tc->ppi_enabled = true; dc->realize = tpm_tis_isa_realizefn; device_class_set_legacy_reset(dc, tpm_tis_isa_reset); tc->request_completed = tpm_tis_isa_request_completed; diff --git a/hw/tpm/tpm_tis_sysbus.c b/hw/tpm/tpm_tis_sysbus.c index e9372e7316..dd30344d5a 100644 --- a/hw/tpm/tpm_tis_sysbus.c +++ b/hw/tpm/tpm_tis_sysbus.c @@ -87,7 +87,7 @@ static void tpm_tis_sysbus_reset(DeviceState *dev) TPMStateSysBus *sbdev = TPM_TIS_SYSBUS(dev); TPMState *s = &sbdev->state; - return tpm_tis_reset(s); + return tpm_tis_reset(s, false); } static const Property tpm_tis_sysbus_properties[] = { From 3912e312ae8486eb00bf4c4a1e0048dbc976e19e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Tue, 17 Mar 2026 12:42:09 +0100 Subject: [PATCH 24/62] hw/tpm: Simplify tpm_ppi_enabled() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit TPM instances don't expose any "ppi" property anymore, remove that dead code. Signed-off-by: Philippe Mathieu-Daudé Reviewed-by: Stefan Berger Message-Id: <20260317120241.16320-6-philmd@linaro.org> --- include/system/tpm.h | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/include/system/tpm.h b/include/system/tpm.h index 9458ad6668..874068d19a 100644 --- a/include/system/tpm.h +++ b/include/system/tpm.h @@ -13,7 +13,6 @@ #define QEMU_TPM_H #include "qapi/qapi-types-tpm.h" -#include "qapi/error.h" #include "qom/object.h" #ifdef CONFIG_TPM @@ -85,10 +84,7 @@ static inline bool tpm_ppi_enabled(TPMIf *ti) if (!ti) { return false; } - if (TPM_IF_GET_CLASS(ti)->ppi_enabled) { - return true; - } - return object_property_get_bool(OBJECT(ti), "ppi", &error_abort); + return TPM_IF_GET_CLASS(ti)->ppi_enabled; } #else /* CONFIG_TPM */ From ed713ddec5972c2795b06da767facfdc94f7e997 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Wed, 18 Mar 2026 17:37:41 +0100 Subject: [PATCH 25/62] hw/ppc/spapr: Un-inline rtas_load/store() helpers MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The 32-bit binary doesn't use these helpers, so don't need to compile them. Rather than using 64-bit target #ifdef'ry in a global header, un-inline the calls since the helpers are called from I/O (cold) path. Signed-off-by: Philippe Mathieu-Daudé Reviewed-by: Harsh Prateek Bora Reviewed-by: Chinmay Rath Acked-by: Glenn Miles Message-Id: <20260319111936.68041-2-philmd@linaro.org> --- hw/ppc/spapr_rtas.c | 15 +++++++++++++++ include/hw/ppc/spapr.h | 18 +++--------------- 2 files changed, 18 insertions(+), 15 deletions(-) diff --git a/hw/ppc/spapr_rtas.c b/hw/ppc/spapr_rtas.c index cb79ad3405..0871425237 100644 --- a/hw/ppc/spapr_rtas.c +++ b/hw/ppc/spapr_rtas.c @@ -52,6 +52,21 @@ #include "migration/blocker.h" #include "helper_regs.h" +uint32_t rtas_ld(target_ulong phys, int n) +{ + return ldl_be_phys(&address_space_memory, ppc64_phys_to_real(phys + 4 * n)); +} + +uint64_t rtas_ldq(target_ulong phys, int n) +{ + return (uint64_t)rtas_ld(phys, n) << 32 | rtas_ld(phys, n + 1); +} + +void rtas_st(target_ulong phys, int n, uint32_t val) +{ + stl_be_phys(&address_space_memory, ppc64_phys_to_real(phys + 4 * n), val); +} + static void rtas_display_character(PowerPCCPU *cpu, SpaprMachineState *spapr, uint32_t token, uint32_t nargs, target_ulong args, diff --git a/include/hw/ppc/spapr.h b/include/hw/ppc/spapr.h index b022f8dd25..9acda15d4f 100644 --- a/include/hw/ppc/spapr.h +++ b/include/hw/ppc/spapr.h @@ -796,21 +796,9 @@ static inline uint64_t ppc64_phys_to_real(uint64_t addr) return addr & ~0xF000000000000000ULL; } -static inline uint32_t rtas_ld(target_ulong phys, int n) -{ - return ldl_be_phys(&address_space_memory, - ppc64_phys_to_real(phys + 4 * n)); -} - -static inline uint64_t rtas_ldq(target_ulong phys, int n) -{ - return (uint64_t)rtas_ld(phys, n) << 32 | rtas_ld(phys, n + 1); -} - -static inline void rtas_st(target_ulong phys, int n, uint32_t val) -{ - stl_be_phys(&address_space_memory, ppc64_phys_to_real(phys + 4 * n), val); -} +uint32_t rtas_ld(target_ulong phys, int n); +uint64_t rtas_ldq(target_ulong phys, int n); +void rtas_st(target_ulong phys, int n, uint32_t val); typedef void (*spapr_rtas_fn)(PowerPCCPU *cpu, SpaprMachineState *sm, uint32_t token, From b9ef483245e63ba846c3c70728a06deafd7bb68a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Thu, 19 Mar 2026 09:02:18 +0100 Subject: [PATCH 26/62] hw/hyperv: Replace legacy ld_phys() -> address_space_ld() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Prefer the address_space_ld/st API over the legacy ld/st_phys() because it allow checking for bus access fault, which shouldn't happen here. Signed-off-by: Philippe Mathieu-Daudé Acked-by: Maciej S. Szmigiero Message-ID: <20260319082954.65069-1-philmd@linaro.org> --- hw/hyperv/hyperv.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/hw/hyperv/hyperv.c b/hw/hyperv/hyperv.c index a42c2850e3..a19f330e19 100644 --- a/hw/hyperv/hyperv.c +++ b/hw/hyperv/hyperv.c @@ -709,13 +709,16 @@ uint16_t hyperv_hcall_signal_event(uint64_t param, bool fast) EventFlagHandler *handler; if (unlikely(!fast)) { + MemTxResult result; hwaddr addr = param; if (addr & (__alignof__(addr) - 1)) { return HV_STATUS_INVALID_ALIGNMENT; } - param = ldq_phys(&address_space_memory, addr); + param = address_space_ldq_le(&address_space_memory, addr, + MEMTXATTRS_UNSPECIFIED, &result); + assert(result == MEMTX_OK); } /* From 712e2b9aa847a66671cd2a3a667149fc5120fc7a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Thu, 19 Mar 2026 13:26:31 +0100 Subject: [PATCH 27/62] system/memory: Constify various AddressSpace arguments (flatview) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Mark the AddressSpace structure const when it is only accessed read-only. Signed-off-by: Philippe Mathieu-Daudé Reviewed-by: Pierrick Bouvier Message-Id: <20260319191017.12636-2-philmd@linaro.org> --- include/system/memory.h | 2 +- system/memory-internal.h | 5 +++-- system/memory.c | 2 +- 3 files changed, 5 insertions(+), 4 deletions(-) diff --git a/include/system/memory.h b/include/system/memory.h index d7b18b632d..1417132f6d 100644 --- a/include/system/memory.h +++ b/include/system/memory.h @@ -1201,7 +1201,7 @@ struct FlatView { MemoryRegion *root; }; -static inline FlatView *address_space_to_flatview(AddressSpace *as) +static inline FlatView *address_space_to_flatview(const AddressSpace *as) { return qatomic_rcu_read(&as->current_map); } diff --git a/system/memory-internal.h b/system/memory-internal.h index 5f0524756e..0066ffdffb 100644 --- a/system/memory-internal.h +++ b/system/memory-internal.h @@ -20,12 +20,13 @@ static inline AddressSpaceDispatch *flatview_to_dispatch(FlatView *fv) return fv->dispatch; } -static inline AddressSpaceDispatch *address_space_to_dispatch(AddressSpace *as) +static inline +AddressSpaceDispatch *address_space_to_dispatch(const AddressSpace *as) { return flatview_to_dispatch(address_space_to_flatview(as)); } -FlatView *address_space_get_flatview(AddressSpace *as); +FlatView *address_space_get_flatview(const AddressSpace *as); void flatview_unref(FlatView *view); extern const MemoryRegionOps unassigned_mem_ops; diff --git a/system/memory.c b/system/memory.c index 0ff066c348..225bbe38c3 100644 --- a/system/memory.c +++ b/system/memory.c @@ -820,7 +820,7 @@ static void address_space_add_del_ioeventfds(AddressSpace *as, } } -FlatView *address_space_get_flatview(AddressSpace *as) +FlatView *address_space_get_flatview(const AddressSpace *as) { FlatView *view; From 1bfa19a3fd51c91e7086eb47e67dfa37bc8670dd Mon Sep 17 00:00:00 2001 From: Cornelia Huck Date: Tue, 31 Mar 2026 16:03:47 +0200 Subject: [PATCH 28/62] hw: add compat machines for 11.1 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Add 11.1 machine types for arm/i440fx/m68k/q35/s390x/spapr. Reviewed-by: Eric Farman # s390 Signed-off-by: Cornelia Huck Acked-by: Michael S. Tsirkin Message-ID: <20260331140347.653404-1-cohuck@redhat.com> Signed-off-by: Philippe Mathieu-Daudé --- hw/arm/virt.c | 11 +++++++++-- hw/core/machine.c | 3 +++ hw/i386/pc.c | 3 +++ hw/i386/pc_piix.c | 13 +++++++++++-- hw/i386/pc_q35.c | 13 +++++++++++-- hw/m68k/virt.c | 11 +++++++++-- hw/ppc/spapr.c | 17 ++++++++++++++--- hw/s390x/s390-virtio-ccw.c | 14 +++++++++++++- include/hw/core/boards.h | 3 +++ include/hw/i386/pc.h | 3 +++ 10 files changed, 79 insertions(+), 12 deletions(-) diff --git a/hw/arm/virt.c b/hw/arm/virt.c index 1725744d1a..f62253e1ab 100644 --- a/hw/arm/virt.c +++ b/hw/arm/virt.c @@ -4052,10 +4052,17 @@ static void machvirt_machine_init(void) } type_init(machvirt_machine_init); -static void virt_machine_11_0_options(MachineClass *mc) +static void virt_machine_11_1_options(MachineClass *mc) { } -DEFINE_VIRT_MACHINE_AS_LATEST(11, 0) +DEFINE_VIRT_MACHINE_AS_LATEST(11, 1) + +static void virt_machine_11_0_options(MachineClass *mc) +{ + virt_machine_11_1_options(mc); + compat_props_add(mc->compat_props, hw_compat_11_0, hw_compat_11_0_len); +} +DEFINE_VIRT_MACHINE(11, 0) static void virt_machine_10_2_options(MachineClass *mc) { diff --git a/hw/core/machine.c b/hw/core/machine.c index 0aa77a57e9..1abc8ae737 100644 --- a/hw/core/machine.c +++ b/hw/core/machine.c @@ -38,6 +38,9 @@ #include "hw/acpi/generic_event_device.h" #include "qemu/audio.h" +GlobalProperty hw_compat_11_0[] = {}; +const size_t hw_compat_11_0_len = G_N_ELEMENTS(hw_compat_11_0); + GlobalProperty hw_compat_10_2[] = { { "scsi-block", "migrate-pr", "off" }, { "isa-cirrus-vga", "global-vmstate", "true" }, diff --git a/hw/i386/pc.c b/hw/i386/pc.c index 4b53b5be4a..2ecad3c503 100644 --- a/hw/i386/pc.c +++ b/hw/i386/pc.c @@ -73,6 +73,9 @@ #include "hw/xen/xen-bus.h" #endif +GlobalProperty pc_compat_11_0[] = {}; +const size_t pc_compat_11_0_len = G_N_ELEMENTS(pc_compat_11_0); + GlobalProperty pc_compat_10_2[] = {}; const size_t pc_compat_10_2_len = G_N_ELEMENTS(pc_compat_10_2); diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c index 4d71e0d51a..82457bdb16 100644 --- a/hw/i386/pc_piix.c +++ b/hw/i386/pc_piix.c @@ -428,12 +428,21 @@ static void pc_i440fx_machine_options(MachineClass *m) pc_piix_compat_defaults, pc_piix_compat_defaults_len); } -static void pc_i440fx_machine_11_0_options(MachineClass *m) +static void pc_i440fx_machine_11_1_options(MachineClass *m) { pc_i440fx_machine_options(m); } -DEFINE_I440FX_MACHINE_AS_LATEST(11, 0); +DEFINE_I440FX_MACHINE_AS_LATEST(11, 1); + +static void pc_i440fx_machine_11_0_options(MachineClass *m) +{ + pc_i440fx_machine_11_1_options(m); + compat_props_add(m->compat_props, hw_compat_11_0, hw_compat_11_0_len); + compat_props_add(m->compat_props, pc_compat_11_0, pc_compat_11_0_len); +} + +DEFINE_I440FX_MACHINE(11, 0); static void pc_i440fx_machine_10_2_options(MachineClass *m) { diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c index cb23322f5a..972dd9275f 100644 --- a/hw/i386/pc_q35.c +++ b/hw/i386/pc_q35.c @@ -364,12 +364,21 @@ static void pc_q35_machine_options(MachineClass *m) pc_q35_compat_defaults, pc_q35_compat_defaults_len); } -static void pc_q35_machine_11_0_options(MachineClass *m) +static void pc_q35_machine_11_1_options(MachineClass *m) { pc_q35_machine_options(m); } -DEFINE_Q35_MACHINE_AS_LATEST(11, 0); +DEFINE_Q35_MACHINE_AS_LATEST(11, 1); + +static void pc_q35_machine_11_0_options(MachineClass *m) +{ + pc_q35_machine_11_1_options(m); + compat_props_add(m->compat_props, hw_compat_11_0, hw_compat_11_0_len); + compat_props_add(m->compat_props, pc_compat_11_0, pc_compat_11_0_len); +} + +DEFINE_Q35_MACHINE(11, 0); static void pc_q35_machine_10_2_options(MachineClass *m) { diff --git a/hw/m68k/virt.c b/hw/m68k/virt.c index cf8ebd65e3..51158ce1c0 100644 --- a/hw/m68k/virt.c +++ b/hw/m68k/virt.c @@ -367,10 +367,17 @@ type_init(virt_machine_register_types) #define DEFINE_VIRT_MACHINE(major, minor) \ DEFINE_VIRT_MACHINE_IMPL(false, major, minor) -static void virt_machine_11_0_options(MachineClass *mc) +static void virt_machine_11_1_options(MachineClass *mc) { } -DEFINE_VIRT_MACHINE_AS_LATEST(11, 0) +DEFINE_VIRT_MACHINE_AS_LATEST(11, 1) + +static void virt_machine_11_0_options(MachineClass *mc) +{ + virt_machine_11_1_options(mc); + compat_props_add(mc->compat_props, hw_compat_11_0, hw_compat_11_0_len); +} +DEFINE_VIRT_MACHINE(11, 0) static void virt_machine_10_2_options(MachineClass *mc) { diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c index 0ab39dfea6..428b491a7d 100644 --- a/hw/ppc/spapr.c +++ b/hw/ppc/spapr.c @@ -4761,14 +4761,25 @@ static void spapr_machine_latest_class_options(MachineClass *mc) DEFINE_SPAPR_MACHINE_IMPL(false, major, minor) /* - * pseries-11.0 + * pseries-11.1 */ -static void spapr_machine_11_0_class_options(MachineClass *mc) +static void spapr_machine_11_1_class_options(MachineClass *mc) { /* Defaults for the latest behaviour inherited from the base class */ } -DEFINE_SPAPR_MACHINE_AS_LATEST(11, 0); +DEFINE_SPAPR_MACHINE_AS_LATEST(11, 1); + +/* + * pseries-11.0 + */ +static void spapr_machine_11_0_class_options(MachineClass *mc) +{ + spapr_machine_11_1_class_options(mc); + compat_props_add(mc->compat_props, hw_compat_11_0, hw_compat_11_0_len); +} + +DEFINE_SPAPR_MACHINE(11, 0); /* * pseries-10.2 diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c index 3ef009463d..cc768daeb0 100644 --- a/hw/s390x/s390-virtio-ccw.c +++ b/hw/s390x/s390-virtio-ccw.c @@ -907,14 +907,26 @@ static const TypeInfo ccw_machine_info = { DEFINE_CCW_MACHINE_IMPL(false, major, minor) +static void ccw_machine_11_1_instance_options(MachineState *machine) +{ +} + +static void ccw_machine_11_1_class_options(MachineClass *mc) +{ +} +DEFINE_CCW_MACHINE_AS_LATEST(11, 1); + static void ccw_machine_11_0_instance_options(MachineState *machine) { + ccw_machine_11_1_instance_options(machine); } static void ccw_machine_11_0_class_options(MachineClass *mc) { + ccw_machine_11_1_class_options(mc); + compat_props_add(mc->compat_props, hw_compat_11_0, hw_compat_11_0_len); } -DEFINE_CCW_MACHINE_AS_LATEST(11, 0); +DEFINE_CCW_MACHINE(11, 0); static void ccw_machine_10_2_instance_options(MachineState *machine) { diff --git a/include/hw/core/boards.h b/include/hw/core/boards.h index f38b3f5f78..9d4ccd1c1c 100644 --- a/include/hw/core/boards.h +++ b/include/hw/core/boards.h @@ -803,6 +803,9 @@ struct MachineState { } \ } while (0) +extern GlobalProperty hw_compat_11_0[]; +extern const size_t hw_compat_11_0_len; + extern GlobalProperty hw_compat_10_2[]; extern const size_t hw_compat_10_2_len; diff --git a/include/hw/i386/pc.h b/include/hw/i386/pc.h index 22325324d0..85a74363b5 100644 --- a/include/hw/i386/pc.h +++ b/include/hw/i386/pc.h @@ -208,6 +208,9 @@ void pc_system_parse_ovmf_flash(uint8_t *flash_ptr, size_t flash_size); /* sgx.c */ void pc_machine_init_sgx_epc(PCMachineState *pcms); +extern GlobalProperty pc_compat_11_0[]; +extern const size_t pc_compat_11_0_len; + extern GlobalProperty pc_compat_10_2[]; extern const size_t pc_compat_10_2_len; From c459df2fc2dd831d43a456e8505e156bbf7cf656 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Wed, 25 Mar 2026 15:43:15 +0100 Subject: [PATCH 29/62] hw/core: Move compat_props_add() to 'hw/core/boards.h' MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit compat_props_add() is only used by board models, no need to expose it to any device model. Restrict by defining it only in "hw/core/boards.h". Signed-off-by: Philippe Mathieu-Daudé Reviewed-by: Michael Tokarev Message-Id: <20260325151728.45378-3-philmd@linaro.org> --- include/hw/core/boards.h | 10 ++++++++++ include/hw/core/qdev.h | 10 ---------- 2 files changed, 10 insertions(+), 10 deletions(-) diff --git a/include/hw/core/boards.h b/include/hw/core/boards.h index 9d4ccd1c1c..89388530fd 100644 --- a/include/hw/core/boards.h +++ b/include/hw/core/boards.h @@ -803,6 +803,16 @@ struct MachineState { } \ } while (0) +static inline void +compat_props_add(GPtrArray *arr, + GlobalProperty props[], size_t nelem) +{ + int i; + for (i = 0; i < nelem; i++) { + g_ptr_array_add(arr, (void *)&props[i]); + } +} + extern GlobalProperty hw_compat_11_0[]; extern const size_t hw_compat_11_0_len; diff --git a/include/hw/core/qdev.h b/include/hw/core/qdev.h index f99a8979cc..778617787c 100644 --- a/include/hw/core/qdev.h +++ b/include/hw/core/qdev.h @@ -421,16 +421,6 @@ typedef struct GlobalProperty { bool optional; } GlobalProperty; -static inline void -compat_props_add(GPtrArray *arr, - GlobalProperty props[], size_t nelem) -{ - int i; - for (i = 0; i < nelem; i++) { - g_ptr_array_add(arr, (void *)&props[i]); - } -} - /*** Board API. This should go away once we have a machine config file. ***/ /** From da36151de17e25cd68192bd00ae10de03bf48437 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Wed, 25 Mar 2026 15:44:40 +0100 Subject: [PATCH 30/62] qom: Declare GlobalProperty structure in 'qom/compat-properties.h' MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit While GlobalProperty is expected to only be used by QDev board layer, it is used by the lower QOM API, so define it in the qom/ namespace. This helps to build binary which use QOM but don't need the QDev layer. Signed-off-by: Philippe Mathieu-Daudé Reviewed-by: Michael Tokarev Message-Id: <20260325151728.45378-4-philmd@linaro.org> --- include/hw/core/boards.h | 1 + include/hw/core/qdev-properties.h | 1 + include/hw/core/qdev.h | 17 ---------------- include/qom/compat-properties.h | 32 +++++++++++++++++++++++++++++++ qom/object.c | 2 +- 5 files changed, 35 insertions(+), 18 deletions(-) create mode 100644 include/qom/compat-properties.h diff --git a/include/hw/core/boards.h b/include/hw/core/boards.h index 89388530fd..ca63304c95 100644 --- a/include/hw/core/boards.h +++ b/include/hw/core/boards.h @@ -8,6 +8,7 @@ #include "system/blockdev.h" #include "qapi/qapi-types-machine.h" #include "qemu/module.h" +#include "qom/compat-properties.h" #include "qom/object.h" #include "hw/core/cpu.h" #include "hw/core/resettable.h" diff --git a/include/hw/core/qdev-properties.h b/include/hw/core/qdev-properties.h index d8745d4c65..17543957a6 100644 --- a/include/hw/core/qdev-properties.h +++ b/include/hw/core/qdev-properties.h @@ -1,6 +1,7 @@ #ifndef QEMU_QDEV_PROPERTIES_H #define QEMU_QDEV_PROPERTIES_H +#include "qom/compat-properties.h" #include "hw/core/qdev.h" /** diff --git a/include/hw/core/qdev.h b/include/hw/core/qdev.h index 778617787c..337d69ea2c 100644 --- a/include/hw/core/qdev.h +++ b/include/hw/core/qdev.h @@ -404,23 +404,6 @@ struct BusState { ResettableState reset; }; -/** - * typedef GlobalProperty - a global property type - * - * @used: Set to true if property was used when initializing a device. - * @optional: If set to true, GlobalProperty will be skipped without errors - * if the property doesn't exist. - * - * An error is fatal for non-hotplugged devices, when the global is applied. - */ -typedef struct GlobalProperty { - const char *driver; - const char *property; - const char *value; - bool used; - bool optional; -} GlobalProperty; - /*** Board API. This should go away once we have a machine config file. ***/ /** diff --git a/include/qom/compat-properties.h b/include/qom/compat-properties.h new file mode 100644 index 0000000000..6e44aabc26 --- /dev/null +++ b/include/qom/compat-properties.h @@ -0,0 +1,32 @@ +/* + * QEMU Object Model + * + * Copyright IBM, Corp. 2011 + * + * Authors: + * Anthony Liguori + * + * SPDX-License-Identifier: GPL-2.0-or-later + */ + +#ifndef QEMU_COMPAT_PROPERTIES_H +#define QEMU_COMPAT_PROPERTIES_H + +/** + * typedef GlobalProperty - a global property type + * + * @used: Set to true if property was used when initializing a device. + * @optional: If set to true, GlobalProperty will be skipped without errors + * if the property doesn't exist. + * + * An error is fatal for non-hotplugged devices, when the global is applied. + */ +typedef struct GlobalProperty { + const char *driver; + const char *property; + const char *value; + bool used; + bool optional; +} GlobalProperty; + +#endif diff --git a/qom/object.c b/qom/object.c index e5c0c2f53e..d6500bcbbf 100644 --- a/qom/object.c +++ b/qom/object.c @@ -11,8 +11,8 @@ */ #include "qemu/osdep.h" -#include "hw/core/qdev.h" #include "qapi/error.h" +#include "qom/compat-properties.h" #include "qom/object.h" #include "qom/object_interfaces.h" #include "qemu/cutils.h" From 50362dd65a033eb88bdb7f15a5d188a0f4c756cc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Wed, 25 Mar 2026 15:47:02 +0100 Subject: [PATCH 31/62] qom: Declare compat properties API in 'qom/compat-properties.h' MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit While most of QEMU files use the QOM concept, few of them use the compatibility properties API (mostly use in system emulation). Move its prototype to a new "qom/compat-properties.h" header, keeping "qom/object.h" for generic QOM. Signed-off-by: Philippe Mathieu-Daudé Reviewed-by: Michael Tokarev Message-Id: <20260325151728.45378-5-philmd@linaro.org> --- accel/accel-system.c | 1 + backends/hostmem.c | 1 + hw/core/machine.c | 1 + hw/core/qdev-properties.c | 1 + hw/core/qdev.c | 1 + hw/i386/pc_q35.c | 1 + include/qom/compat-properties.h | 8 ++++++++ include/qom/object.h | 8 -------- rust/bindings/qom-sys/lib.rs | 2 +- system/rtc.c | 1 + system/vl.c | 1 + target/i386/sev.c | 1 + ui/vdagent.c | 1 + 13 files changed, 19 insertions(+), 9 deletions(-) diff --git a/accel/accel-system.c b/accel/accel-system.c index 150af05bf5..9176665202 100644 --- a/accel/accel-system.c +++ b/accel/accel-system.c @@ -25,6 +25,7 @@ #include "qemu/osdep.h" #include "qemu/accel.h" +#include "qom/compat-properties.h" #include "qapi/qapi-commands-accelerator.h" #include "monitor/monitor.h" #include "hw/core/boards.h" diff --git a/backends/hostmem.c b/backends/hostmem.c index 15d4365b69..cd2085fb3c 100644 --- a/backends/hostmem.c +++ b/backends/hostmem.c @@ -18,6 +18,7 @@ #include "qapi/qapi-builtin-visit.h" #include "qapi/visitor.h" #include "qemu/config-file.h" +#include "qom/compat-properties.h" #include "qom/object_interfaces.h" #include "qemu/mmap-alloc.h" #include "qemu/madvise.h" diff --git a/hw/core/machine.c b/hw/core/machine.c index 1abc8ae737..1b661fd36a 100644 --- a/hw/core/machine.c +++ b/hw/core/machine.c @@ -21,6 +21,7 @@ #include "qapi/qapi-visit-machine.h" #include "qapi/qapi-commands-machine.h" #include "qemu/madvise.h" +#include "qom/compat-properties.h" #include "qom/object_interfaces.h" #include "system/cpus.h" #include "system/system.h" diff --git a/hw/core/qdev-properties.c b/hw/core/qdev-properties.c index ba8461e9a4..73539c727b 100644 --- a/hw/core/qdev-properties.c +++ b/hw/core/qdev-properties.c @@ -10,6 +10,7 @@ #include "qemu/units.h" #include "qemu/cutils.h" #include "qdev-prop-internal.h" +#include "qom/compat-properties.h" #include "qom/qom-qobject.h" void qdev_prop_set_after_realize(DeviceState *dev, const char *name, diff --git a/hw/core/qdev.c b/hw/core/qdev.c index e48616b2c6..b36101f3a7 100644 --- a/hw/core/qdev.c +++ b/hw/core/qdev.c @@ -32,6 +32,7 @@ #include "qapi/visitor.h" #include "qemu/error-report.h" #include "qemu/option.h" +#include "qom/compat-properties.h" #include "hw/core/irq.h" #include "hw/core/qdev-properties.h" #include "hw/core/boards.h" diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c index 972dd9275f..d8fed698c7 100644 --- a/hw/i386/pc_q35.c +++ b/hw/i386/pc_q35.c @@ -56,6 +56,7 @@ #include "hw/usb/hcd-uhci.h" #include "qapi/error.h" #include "qemu/error-report.h" +#include "qom/compat-properties.h" #include "system/numa.h" #include "hw/hyperv/vmbus-bridge.h" #include "hw/mem/nvdimm.h" diff --git a/include/qom/compat-properties.h b/include/qom/compat-properties.h index 6e44aabc26..90f8320adf 100644 --- a/include/qom/compat-properties.h +++ b/include/qom/compat-properties.h @@ -29,4 +29,12 @@ typedef struct GlobalProperty { bool optional; } GlobalProperty; +void object_set_machine_compat_props(GPtrArray *compat_props); +void object_set_accelerator_compat_props(GPtrArray *compat_props); +void object_register_sugar_prop(const char *driver, const char *prop, + const char *value, bool optional); +void object_apply_compat_props(Object *obj); +bool object_apply_global_props(Object *obj, const GPtrArray *props, + Error **errp); + #endif diff --git a/include/qom/object.h b/include/qom/object.h index 26df6137b9..510885218b 100644 --- a/include/qom/object.h +++ b/include/qom/object.h @@ -700,14 +700,6 @@ Object *object_new_with_propv(const char *typename, Error **errp, va_list vargs); -bool object_apply_global_props(Object *obj, const GPtrArray *props, - Error **errp); -void object_set_machine_compat_props(GPtrArray *compat_props); -void object_set_accelerator_compat_props(GPtrArray *compat_props); -void object_register_sugar_prop(const char *driver, const char *prop, - const char *value, bool optional); -void object_apply_compat_props(Object *obj); - /** * object_set_props: * @obj: the object instance to set properties on diff --git a/rust/bindings/qom-sys/lib.rs b/rust/bindings/qom-sys/lib.rs index 464b929034..21b996aeaa 100644 --- a/rust/bindings/qom-sys/lib.rs +++ b/rust/bindings/qom-sys/lib.rs @@ -18,7 +18,7 @@ clippy::too_many_arguments )] -use glib_sys::{GHashTable, GHashTableIter, GPtrArray, GSList}; +use glib_sys::{GHashTable, GHashTableIter, GSList}; use util_sys::{Error, QDict, QObject, Visitor}; #[cfg(MESON)] diff --git a/system/rtc.c b/system/rtc.c index 56951288c4..f13dd392a7 100644 --- a/system/rtc.c +++ b/system/rtc.c @@ -28,6 +28,7 @@ #include "qemu/error-report.h" #include "qemu/option.h" #include "qemu/timer.h" +#include "qom/compat-properties.h" #include "qom/object.h" #include "system/replay.h" #include "system/system.h" diff --git a/system/vl.c b/system/vl.c index 246623b319..0e1fc217b4 100644 --- a/system/vl.c +++ b/system/vl.c @@ -119,6 +119,7 @@ #include "qapi/string-input-visitor.h" #include "qapi/opts-visitor.h" #include "qapi/clone-visitor.h" +#include "qom/compat-properties.h" #include "qom/object_interfaces.h" #include "semihosting/semihost.h" #include "crypto/init.h" diff --git a/target/i386/sev.c b/target/i386/sev.c index 9dde972c11..261b6aaa37 100644 --- a/target/i386/sev.c +++ b/target/i386/sev.c @@ -36,6 +36,7 @@ #include "system/reset.h" #include "trace.h" #include "migration/blocker.h" +#include "qom/compat-properties.h" #include "qom/object.h" #include "monitor/monitor.h" #include "monitor/hmp.h" diff --git a/ui/vdagent.c b/ui/vdagent.c index bb0c4aa14c..bb55cbefc9 100644 --- a/ui/vdagent.c +++ b/ui/vdagent.c @@ -5,6 +5,7 @@ #include "qemu/error-report.h" #include "qemu/option.h" #include "qemu/units.h" +#include "qom/compat-properties.h" #include "hw/core/qdev.h" #include "hw/core/qdev-properties.h" #include "migration/blocker.h" From 150072398f3f0c3e5bef360f9d8fb68e81201c98 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Wed, 25 Mar 2026 15:47:12 +0100 Subject: [PATCH 32/62] qom: Restrict compat properties API to system emulation MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Move compat properties API definitions to their own file unit, compile it only when system emulation is configured. Add a pair of stubs for user emulation. Signed-off-by: Philippe Mathieu-Daudé Reviewed-by: Michael Tokarev Message-Id: <20260325151728.45378-6-philmd@linaro.org> --- MAINTAINERS | 1 + qom/compat-properties.c | 76 +++++++++++++++++++++++++++++++++++ qom/meson.build | 3 ++ qom/object.c | 60 --------------------------- stubs/meson.build | 1 + stubs/qom-compat-properties.c | 14 +++++++ 6 files changed, 95 insertions(+), 60 deletions(-) create mode 100644 qom/compat-properties.c create mode 100644 stubs/qom-compat-properties.c diff --git a/MAINTAINERS b/MAINTAINERS index facc4b499a..45d258f64f 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -3533,6 +3533,7 @@ F: qapi/qom.json F: scripts/coccinelle/qom-parent-type.cocci F: scripts/qom-cast-macro-clean-cocci-gen.py F: qom/ +F: stubs/qom-compat-properties.c F: tests/unit/check-qom-interface.c F: tests/unit/check-qom-proplist.c F: tests/qtest/qom-test.c diff --git a/qom/compat-properties.c b/qom/compat-properties.c new file mode 100644 index 0000000000..2110754155 --- /dev/null +++ b/qom/compat-properties.c @@ -0,0 +1,76 @@ +/* + * QEMU Object Model + * + * Copyright IBM, Corp. 2011 + * + * Authors: + * Anthony Liguori + * + * SPDX-License-Identifier: GPL-2.0-or-later + */ + +#include "qemu/osdep.h" +#include "qapi/error.h" +#include "qom/compat-properties.h" +#include "qom/qom-qobject.h" +#include "hw/core/qdev.h" + +/* + * Global property defaults + * Slot 0: accelerator's global property defaults + * Slot 1: machine's global property defaults + * Slot 2: global properties from legacy command line option + * Each is a GPtrArray of GlobalProperty. + * Applied in order, later entries override earlier ones. + */ +static GPtrArray *object_compat_props[3]; + +/* + * Retrieve @GPtrArray for global property defined with options + * other than "-global". These are generally used for syntactic + * sugar and legacy command line options. + */ +void object_register_sugar_prop(const char *driver, const char *prop, + const char *value, bool optional) +{ + GlobalProperty *g; + if (!object_compat_props[2]) { + object_compat_props[2] = g_ptr_array_new(); + } + g = g_new0(GlobalProperty, 1); + g->driver = g_strdup(driver); + g->property = g_strdup(prop); + g->value = g_strdup(value); + g->optional = optional; + g_ptr_array_add(object_compat_props[2], g); +} + +/* + * Set machine's global property defaults to @compat_props. + * May be called at most once. + */ +void object_set_machine_compat_props(GPtrArray *compat_props) +{ + assert(!object_compat_props[1]); + object_compat_props[1] = compat_props; +} + +/* + * Set accelerator's global property defaults to @compat_props. + * May be called at most once. + */ +void object_set_accelerator_compat_props(GPtrArray *compat_props) +{ + assert(!object_compat_props[0]); + object_compat_props[0] = compat_props; +} + +void object_apply_compat_props(Object *obj) +{ + int i; + + for (i = 0; i < ARRAY_SIZE(object_compat_props); i++) { + object_apply_global_props(obj, object_compat_props[i], + i == 2 ? &error_fatal : &error_abort); + } +} diff --git a/qom/meson.build b/qom/meson.build index 8192243430..bd6f4aadd7 100644 --- a/qom/meson.build +++ b/qom/meson.build @@ -5,6 +5,9 @@ qom_ss.add(files( 'object_interfaces.c', 'qom-qobject.c', )) +if have_system + qom_ss.add(files('compat-properties.c')) +endif qmp_ss.add(files('qom-qmp-cmds.c')) system_ss.add(files('qom-hmp-cmds.c')) diff --git a/qom/object.c b/qom/object.c index d6500bcbbf..f981e27044 100644 --- a/qom/object.c +++ b/qom/object.c @@ -480,66 +480,6 @@ bool object_apply_global_props(Object *obj, const GPtrArray *props, return true; } -/* - * Global property defaults - * Slot 0: accelerator's global property defaults - * Slot 1: machine's global property defaults - * Slot 2: global properties from legacy command line option - * Each is a GPtrArray of GlobalProperty. - * Applied in order, later entries override earlier ones. - */ -static GPtrArray *object_compat_props[3]; - -/* - * Retrieve @GPtrArray for global property defined with options - * other than "-global". These are generally used for syntactic - * sugar and legacy command line options. - */ -void object_register_sugar_prop(const char *driver, const char *prop, - const char *value, bool optional) -{ - GlobalProperty *g; - if (!object_compat_props[2]) { - object_compat_props[2] = g_ptr_array_new(); - } - g = g_new0(GlobalProperty, 1); - g->driver = g_strdup(driver); - g->property = g_strdup(prop); - g->value = g_strdup(value); - g->optional = optional; - g_ptr_array_add(object_compat_props[2], g); -} - -/* - * Set machine's global property defaults to @compat_props. - * May be called at most once. - */ -void object_set_machine_compat_props(GPtrArray *compat_props) -{ - assert(!object_compat_props[1]); - object_compat_props[1] = compat_props; -} - -/* - * Set accelerator's global property defaults to @compat_props. - * May be called at most once. - */ -void object_set_accelerator_compat_props(GPtrArray *compat_props) -{ - assert(!object_compat_props[0]); - object_compat_props[0] = compat_props; -} - -void object_apply_compat_props(Object *obj) -{ - int i; - - for (i = 0; i < ARRAY_SIZE(object_compat_props); i++) { - object_apply_global_props(obj, object_compat_props[i], - i == 2 ? &error_fatal : &error_abort); - } -} - static void object_class_property_init_all(Object *obj) { ObjectPropertyIterator iter; diff --git a/stubs/meson.build b/stubs/meson.build index 7189ff63ed..f33b1d2a08 100644 --- a/stubs/meson.build +++ b/stubs/meson.build @@ -54,6 +54,7 @@ if have_user # Symbols that are used by hw/core. stub_ss.add(files('cpu-synchronize-state.c')) stub_ss.add(files('cpu-destroy-address-spaces.c')) + stub_ss.add(files('qom-compat-properties.c')) # Stubs for QAPI events. Those can always be included in the build, but # they are not built at all for --disable-system builds. diff --git a/stubs/qom-compat-properties.c b/stubs/qom-compat-properties.c new file mode 100644 index 0000000000..2c955677be --- /dev/null +++ b/stubs/qom-compat-properties.c @@ -0,0 +1,14 @@ +/* + * QEMU Object Model (compat properties stubs for user emulation) + * + * Copyright (c) Linaro + * + * SPDX-License-Identifier: GPL-2.0-or-later + */ + +#include "qemu/osdep.h" +#include "qom/compat-properties.h" + +void object_apply_compat_props(Object *obj) +{ +} From ffdd1949a159502d4e85d76e27b51020929a9d1c Mon Sep 17 00:00:00 2001 From: Mohammadfaiz Bawa Date: Fri, 27 Mar 2026 23:02:07 +0530 Subject: [PATCH 33/62] docs/specs/tpm: document PPI support on ARM64 virt MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Document that tpm-tis-device on the ARM virt machine supports PPI with dynamically allocated MMIO via the platform bus, unlike x86 where PPI is at the fixed address 0xFED45000. Also add hw/arm/virt-acpi-build.c and hw/acpi/tpm.c to the list of files related to TPM ACPI tables. Reviewed-by: Stefan Berger Signed-off-by: Mohammadfaiz Bawa Message-ID: <20260327173209.148180-2-mbawa@redhat.com> Signed-off-by: Philippe Mathieu-Daudé --- docs/specs/tpm.rst | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/docs/specs/tpm.rst b/docs/specs/tpm.rst index b630a351b4..ba2b0d7267 100644 --- a/docs/specs/tpm.rst +++ b/docs/specs/tpm.rst @@ -187,8 +187,32 @@ The location of the table is given by the fw_cfg ``tpmppi_address`` field. The PPI memory region size is 0x400 (``TPM_PPI_ADDR_SIZE``) to leave enough room for future updates. +PPI on ARM64 virt +----------------- + +The ARM virt machine supports PPI for ``tpm-tis-device`` as defined +in the `PPI specification`_. + +Unlike the x86 TIS device where the PPI memory region is mapped at +the fixed address ``0xFED45000`` (within the TIS MMIO range), the +ARM64 sysbus device registers PPI memory as a second MMIO region +on the platform bus. The platform bus assigns the guest physical +address dynamically at device plug time. The ACPI ``_DSM`` method +and PPI operation regions reference this dynamically resolved +address. + +PPI is controlled by the ``ppi`` property (default ``on``):: + + -device tpm-tis-device,tpmdev=tpm0,ppi=on + +Without PPI, guest operating systems such as Windows 11 +ARM64 will log errors when attempting to query TPM Physical +Presence capabilities via the ACPI ``_DSM`` method. + QEMU files related to TPM ACPI tables: - ``hw/i386/acpi-build.c`` + - ``hw/arm/virt-acpi-build.c`` + - ``hw/acpi/tpm.c`` - ``include/hw/acpi/tpm.h`` TPM backend devices From 859252e13bb5a84bb9d25490168ec37e621ab92a Mon Sep 17 00:00:00 2001 From: Mohammadfaiz Bawa Date: Fri, 27 Mar 2026 23:02:08 +0530 Subject: [PATCH 34/62] hw/acpi/tpm: parameterize PPI base address in tpm_build_ppi_acpi MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Add a ppi_base parameter to tpm_build_ppi_acpi() instead of hardcoding TPM_PPI_ADDR_BASE. This prepares for ARM64 support where PPI memory is dynamically allocated by the platform bus and the address is not known at compile time. Update the x86 callers (ISA TIS and CRB) to pass TPM_PPI_ADDR_BASE explicitly. No behavioral change. Reviewed-by: Stefan Berger Signed-off-by: Mohammadfaiz Bawa Reviewed-by: Philippe Mathieu-Daudé Message-ID: <20260327173209.148180-3-mbawa@redhat.com> Signed-off-by: Philippe Mathieu-Daudé --- hw/acpi/tpm.c | 8 ++++---- hw/i386/acpi-build.c | 2 +- hw/tpm/tpm_tis_isa.c | 2 +- include/hw/acpi/tpm.h | 3 ++- 4 files changed, 8 insertions(+), 7 deletions(-) diff --git a/hw/acpi/tpm.c b/hw/acpi/tpm.c index 5fe95f2e3f..e703775984 100644 --- a/hw/acpi/tpm.c +++ b/hw/acpi/tpm.c @@ -20,7 +20,7 @@ #include "qapi/error.h" #include "hw/acpi/tpm.h" -void tpm_build_ppi_acpi(TPMIf *tpm, Aml *dev) +void tpm_build_ppi_acpi(TPMIf *tpm, Aml *dev, hwaddr ppi_base) { Aml *method, *field, *ifctx, *ifctx2, *ifctx3, *func_mask, *not_implemented, *pak, *tpm2, *tpm3, *pprm, *pprq, *zero, *one; @@ -40,7 +40,7 @@ void tpm_build_ppi_acpi(TPMIf *tpm, Aml *dev) */ aml_append(dev, aml_operation_region("TPP2", AML_SYSTEM_MEMORY, - aml_int(TPM_PPI_ADDR_BASE + 0x100), + aml_int(ppi_base + 0x100), 0x5A)); field = aml_field("TPP2", AML_ANY_ACC, AML_NOLOCK, AML_PRESERVE); aml_append(field, aml_named_field("PPIN", 8)); @@ -56,7 +56,7 @@ void tpm_build_ppi_acpi(TPMIf *tpm, Aml *dev) aml_append(dev, aml_operation_region( "TPP3", AML_SYSTEM_MEMORY, - aml_int(TPM_PPI_ADDR_BASE + + aml_int(ppi_base + 0x15a /* movv, docs/specs/tpm.rst */), 0x1)); field = aml_field("TPP3", AML_BYTE_ACC, AML_NOLOCK, AML_PRESERVE); @@ -78,7 +78,7 @@ void tpm_build_ppi_acpi(TPMIf *tpm, Aml *dev) aml_append(method, aml_operation_region("TPP1", AML_SYSTEM_MEMORY, - aml_add(aml_int(TPM_PPI_ADDR_BASE), op, NULL), 0x1)); + aml_add(aml_int(ppi_base), op, NULL), 0x1)); field = aml_field("TPP1", AML_BYTE_ACC, AML_NOLOCK, AML_PRESERVE); aml_append(field, aml_named_field("TPPF", 8)); aml_append(method, field); diff --git a/hw/i386/acpi-build.c b/hw/i386/acpi-build.c index 4f01e2c476..0d7c83d5e9 100644 --- a/hw/i386/acpi-build.c +++ b/hw/i386/acpi-build.c @@ -1219,7 +1219,7 @@ build_dsdt(GArray *table_data, BIOSLinker *linker, aml_append(dev, aml_name_decl("_STA", aml_int(0xf))); aml_append(dev, aml_name_decl("_UID", aml_int(1))); - tpm_build_ppi_acpi(tpm, dev); + tpm_build_ppi_acpi(tpm, dev, TPM_PPI_ADDR_BASE); aml_append(sb_scope, dev); } diff --git a/hw/tpm/tpm_tis_isa.c b/hw/tpm/tpm_tis_isa.c index 1ca403241d..2b1267133a 100644 --- a/hw/tpm/tpm_tis_isa.c +++ b/hw/tpm/tpm_tis_isa.c @@ -159,7 +159,7 @@ static void build_tpm_tis_isa_aml(AcpiDevAmlIf *adev, Aml *scope) */ /* aml_append(crs, aml_irq_no_flags(isadev->state.irq_num)); */ aml_append(dev, aml_name_decl("_CRS", crs)); - tpm_build_ppi_acpi(ti, dev); + tpm_build_ppi_acpi(ti, dev, TPM_PPI_ADDR_BASE); aml_append(scope, dev); } diff --git a/include/hw/acpi/tpm.h b/include/hw/acpi/tpm.h index d2bf6637c5..2ab186a745 100644 --- a/include/hw/acpi/tpm.h +++ b/include/hw/acpi/tpm.h @@ -20,6 +20,7 @@ #include "hw/core/registerfields.h" #include "hw/acpi/aml-build.h" #include "system/tpm.h" +#include "exec/hwaddr.h" #ifdef CONFIG_TPM @@ -250,7 +251,7 @@ REG32(CRB_DATA_BUFFER, 0x80) */ #define TPM_I2C_INT_ENABLE_MASK 0x0 -void tpm_build_ppi_acpi(TPMIf *tpm, Aml *dev); +void tpm_build_ppi_acpi(TPMIf *tpm, Aml *dev, hwaddr ppi_base); #endif /* CONFIG_TPM */ From 46cd2c1050f0fde1a384234264ff8afdcb42d82f Mon Sep 17 00:00:00 2001 From: Mohammadfaiz Bawa Date: Fri, 27 Mar 2026 23:02:09 +0530 Subject: [PATCH 35/62] hw/tpm: add PPI support to tpm-tis-device for ARM64 virt MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Add PPI memory region and ACPI _STA, _DSM to tpm-tis-sysbus so Windows 11 ARM64 guests no longer log Event ID 15 errors from tpm.sys on every boot. Reviewed-by: Stefan Berger Signed-off-by: Mohammadfaiz Bawa Reviewed-by: Philippe Mathieu-Daudé Message-ID: <20260327173209.148180-4-mbawa@redhat.com> Signed-off-by: Philippe Mathieu-Daudé --- hw/arm/virt-acpi-build.c | 9 ++++++++- hw/tpm/tpm_tis_sysbus.c | 11 +++++++++++ 2 files changed, 19 insertions(+), 1 deletion(-) diff --git a/hw/arm/virt-acpi-build.c b/hw/arm/virt-acpi-build.c index 41ca0bab08..6817a72e2e 100644 --- a/hw/arm/virt-acpi-build.c +++ b/hw/arm/virt-acpi-build.c @@ -240,7 +240,8 @@ static void acpi_dsdt_add_tpm(Aml *scope, VirtMachineState *vms) Aml *dev = aml_device("TPM0"); aml_append(dev, aml_name_decl("_HID", aml_string("MSFT0101"))); aml_append(dev, aml_name_decl("_STR", aml_string("TPM 2.0 Device"))); - aml_append(dev, aml_name_decl("_UID", aml_int(0))); + aml_append(dev, aml_name_decl("_UID", aml_int(1))); + aml_append(dev, aml_name_decl("_STA", aml_int(0xF))); Aml *crs = aml_resource_template(); aml_append(crs, @@ -248,6 +249,12 @@ static void acpi_dsdt_add_tpm(Aml *scope, VirtMachineState *vms) (uint32_t)memory_region_size(sbdev_mr), AML_READ_WRITE)); aml_append(dev, aml_name_decl("_CRS", crs)); + + hwaddr ppi_base = platform_bus_get_mmio_addr(pbus, sbdev, 1); + if (ppi_base != -1) { + ppi_base += pbus_base; + tpm_build_ppi_acpi(TPM_IF(sbdev), dev, ppi_base); + } aml_append(scope, dev); } #endif diff --git a/hw/tpm/tpm_tis_sysbus.c b/hw/tpm/tpm_tis_sysbus.c index dd30344d5a..6bec30c36f 100644 --- a/hw/tpm/tpm_tis_sysbus.c +++ b/hw/tpm/tpm_tis_sysbus.c @@ -30,6 +30,7 @@ #include "hw/core/sysbus.h" #include "tpm_tis.h" #include "qom/object.h" +#include "qemu/memalign.h" struct TPMStateSysBus { /*< private >*/ @@ -99,6 +100,7 @@ static void tpm_tis_sysbus_initfn(Object *obj) { TPMStateSysBus *sbdev = TPM_TIS_SYSBUS(obj); TPMState *s = &sbdev->state; + size_t host_page_size = qemu_real_host_page_size(); memory_region_init_io(&s->mmio, obj, &tpm_tis_memory_ops, s, "tpm-tis-mmio", @@ -106,6 +108,12 @@ static void tpm_tis_sysbus_initfn(Object *obj) sysbus_init_mmio(SYS_BUS_DEVICE(obj), &s->mmio); sysbus_init_irq(SYS_BUS_DEVICE(obj), &s->irq); + + s->ppi.buf = qemu_memalign(host_page_size, + ROUND_UP(TPM_PPI_ADDR_SIZE, host_page_size)); + memory_region_init_ram_device_ptr(&s->ppi.ram, obj, "tpm-ppi", + TPM_PPI_ADDR_SIZE, s->ppi.buf); + sysbus_init_mmio(SYS_BUS_DEVICE(obj), &s->ppi.ram); } static void tpm_tis_sysbus_realizefn(DeviceState *dev, Error **errp) @@ -122,6 +130,8 @@ static void tpm_tis_sysbus_realizefn(DeviceState *dev, Error **errp) error_setg(errp, "'tpmdev' property is required"); return; } + + vmstate_register_ram(&s->ppi.ram, dev); } static void tpm_tis_sysbus_class_init(ObjectClass *klass, const void *data) @@ -132,6 +142,7 @@ static void tpm_tis_sysbus_class_init(ObjectClass *klass, const void *data) device_class_set_props(dc, tpm_tis_sysbus_properties); dc->vmsd = &vmstate_tpm_tis_sysbus; tc->model = TPM_MODEL_TPM_TIS; + tc->ppi_enabled = true; dc->realize = tpm_tis_sysbus_realizefn; device_class_set_legacy_reset(dc, tpm_tis_sysbus_reset); tc->request_completed = tpm_tis_sysbus_request_completed; From bf7ce99494a217beb6cebc27589e263c22c146f8 Mon Sep 17 00:00:00 2001 From: Bin Guo Date: Wed, 1 Apr 2026 18:00:05 +0800 Subject: [PATCH 36/62] physmem: Simplify dirty memory type checks with loop MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit In physical_memory_range_includes_clean(), we have three nearly identical if-statements checking different DIRTY_MEMORY types (VGA, CODE, MIGRATION). This code duplication makes maintenance harder and increases the risk of inconsistencies when adding new dirty memory types. Replace the repetitive checks with a simple loop that iterates through all DIRTY_MEMORY_NUM types, checking only those specified in the mask. This reduces code size and makes it easier to add new dirty memory types in the future. Signed-off-by: Bin Guo Reviewed-by: Philippe Mathieu-Daudé Message-ID: <20260401100005.20651-1-guobin@linux.alibaba.com> Signed-off-by: Philippe Mathieu-Daudé --- system/physmem.c | 16 +++++----------- 1 file changed, 5 insertions(+), 11 deletions(-) diff --git a/system/physmem.c b/system/physmem.c index 4e26f1a1d4..c58d940e80 100644 --- a/system/physmem.c +++ b/system/physmem.c @@ -981,17 +981,11 @@ uint8_t physical_memory_range_includes_clean(ram_addr_t start, { uint8_t ret = 0; - if (mask & (1 << DIRTY_MEMORY_VGA) && - !physical_memory_all_dirty(start, length, DIRTY_MEMORY_VGA)) { - ret |= (1 << DIRTY_MEMORY_VGA); - } - if (mask & (1 << DIRTY_MEMORY_CODE) && - !physical_memory_all_dirty(start, length, DIRTY_MEMORY_CODE)) { - ret |= (1 << DIRTY_MEMORY_CODE); - } - if (mask & (1 << DIRTY_MEMORY_MIGRATION) && - !physical_memory_all_dirty(start, length, DIRTY_MEMORY_MIGRATION)) { - ret |= (1 << DIRTY_MEMORY_MIGRATION); + for (int i = 0; i < DIRTY_MEMORY_NUM; i++) { + if ((mask & (1 << i)) && + !physical_memory_all_dirty(start, length, i)) { + ret |= (1 << i); + } } return ret; } From 4c7fefc2d043a66f799cf2c2e34ed680b1b44b5c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Thu, 9 Apr 2026 13:35:56 +0200 Subject: [PATCH 37/62] hw/arm/smmuv3: Have smmuv3_accel_init() take an Error* parameter MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit By giving smmuv3_accel_init() the ability to populate an error, we can fail early in smmu_realize() when CONFIG_ARM_SMMUV3_ACCEL is not available, simplifying smmu_validate_property(). Suggested-by: Shameer Kolothum Thodi Co-developed-by: Shameer Kolothum Thodi Signed-off-by: Philippe Mathieu-Daudé Reviewed-by: Shameer Kolothum Message-Id: <20260410200031.18572-2-philmd@linaro.org> --- hw/arm/smmuv3-accel.c | 3 ++- hw/arm/smmuv3-accel.h | 7 +++++-- hw/arm/smmuv3.c | 11 +++-------- 3 files changed, 10 insertions(+), 11 deletions(-) diff --git a/hw/arm/smmuv3-accel.c b/hw/arm/smmuv3-accel.c index 3630078751..862be814a0 100644 --- a/hw/arm/smmuv3-accel.c +++ b/hw/arm/smmuv3-accel.c @@ -918,11 +918,12 @@ static void smmuv3_accel_as_init(SMMUv3State *s) address_space_init(shared_as_sysmem, &root, "smmuv3-accel-as-sysmem"); } -void smmuv3_accel_init(SMMUv3State *s) +bool smmuv3_accel_init(SMMUv3State *s, Error **errp) { SMMUState *bs = ARM_SMMU(s); s->s_accel = g_new0(SMMUv3AccelState, 1); bs->iommu_ops = &smmuv3_accel_ops; smmuv3_accel_as_init(s); + return true; } diff --git a/hw/arm/smmuv3-accel.h b/hw/arm/smmuv3-accel.h index 908a13cbcc..d2756c8c48 100644 --- a/hw/arm/smmuv3-accel.h +++ b/hw/arm/smmuv3-accel.h @@ -42,7 +42,7 @@ typedef struct SMMUv3AccelDevice { } SMMUv3AccelDevice; #ifdef CONFIG_ARM_SMMUV3_ACCEL -void smmuv3_accel_init(SMMUv3State *s); +bool smmuv3_accel_init(SMMUv3State *s, Error **errp); bool smmuv3_accel_install_ste(SMMUv3State *s, SMMUDevice *sdev, int sid, Error **errp); bool smmuv3_accel_install_ste_range(SMMUv3State *s, SMMUSIDRange *range, @@ -54,8 +54,11 @@ void smmuv3_accel_idr_override(SMMUv3State *s); bool smmuv3_accel_alloc_veventq(SMMUv3State *s, Error **errp); void smmuv3_accel_reset(SMMUv3State *s); #else -static inline void smmuv3_accel_init(SMMUv3State *s) +#include "qapi/error.h" +static inline bool smmuv3_accel_init(SMMUv3State *s, Error **errp) { + error_setg(errp, "accel=on support not compiled in"); + return false; } static inline bool smmuv3_accel_install_ste(SMMUv3State *s, SMMUDevice *sdev, int sid, diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c index 5570a13c8a..5c2855c377 100644 --- a/hw/arm/smmuv3.c +++ b/hw/arm/smmuv3.c @@ -1965,13 +1965,6 @@ static void smmu_reset_exit(Object *obj, ResetType type) static bool smmu_validate_property(SMMUv3State *s, Error **errp) { -#ifndef CONFIG_ARM_SMMUV3_ACCEL - if (s->accel) { - error_setg(errp, "accel=on support not compiled in"); - return false; - } -#endif - if (s->ats == ON_OFF_AUTO_AUTO) { error_setg(errp, "ats auto mode is not supported"); return false; @@ -2033,7 +2026,9 @@ static void smmu_realize(DeviceState *d, Error **errp) } if (s->accel) { - smmuv3_accel_init(s); + if (!smmuv3_accel_init(s, errp)) { + return; + } error_setg(&s->migration_blocker, "Migration not supported with SMMUv3 " "accelerator mode enabled"); if (migrate_add_blocker(&s->migration_blocker, errp) < 0) { From 12ce4d9630ae09edec706f6254417e3ec96e08e5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Tue, 10 Mar 2026 12:06:19 +0100 Subject: [PATCH 38/62] hw/arm/smmuv3: Avoid including CONFIG_DEVICES in hw/ header MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit By turning the inline functions into stubs we can avoid the use of target-specific CONFIG_DEVICES include in a hw/ header, allowing to build the source files including it as common objects. Signed-off-by: Philippe Mathieu-Daudé Reviewed-by: Thomas Huth Reviewed-by: Shameer Kolothum Message-Id: <20260410200031.18572-3-philmd@linaro.org> --- hw/arm/meson.build | 5 ++-- hw/arm/smmuv3-accel-stubs.c | 52 +++++++++++++++++++++++++++++++++++++ hw/arm/smmuv3-accel.h | 42 ------------------------------ 3 files changed, 55 insertions(+), 44 deletions(-) create mode 100644 hw/arm/smmuv3-accel-stubs.c diff --git a/hw/arm/meson.build b/hw/arm/meson.build index b187b946f0..3be1252c4f 100644 --- a/hw/arm/meson.build +++ b/hw/arm/meson.build @@ -84,8 +84,9 @@ arm_common_ss.add(when: 'CONFIG_ARMSSE', if_true: files('armsse.c')) arm_common_ss.add(when: 'CONFIG_FSL_IMX7', if_true: files('fsl-imx7.c', 'mcimx7d-sabre.c')) arm_common_ss.add(when: 'CONFIG_FSL_IMX8MP', if_true: files('fsl-imx8mp.c')) arm_common_ss.add(when: 'CONFIG_FSL_IMX8MP_EVK', if_true: files('imx8mp-evk.c')) -arm_ss.add(when: 'CONFIG_ARM_SMMUV3', if_true: files('smmuv3.c')) -arm_ss.add(when: 'CONFIG_ARM_SMMUV3_ACCEL', if_true: files('smmuv3-accel.c')) +arm_common_ss.add(when: 'CONFIG_ARM_SMMUV3', if_true: files('smmuv3.c')) +arm_common_ss.add(when: 'CONFIG_ARM_SMMUV3_ACCEL', if_true: files('smmuv3-accel.c')) +stub_ss.add(files('smmuv3-accel-stubs.c')) arm_common_ss.add(when: 'CONFIG_FSL_IMX6UL', if_true: files('fsl-imx6ul.c', 'mcimx6ul-evk.c')) arm_common_ss.add(when: 'CONFIG_NRF51_SOC', if_true: files('nrf51_soc.c')) arm_common_ss.add(when: 'CONFIG_XEN', if_true: files( diff --git a/hw/arm/smmuv3-accel-stubs.c b/hw/arm/smmuv3-accel-stubs.c new file mode 100644 index 0000000000..70cef66966 --- /dev/null +++ b/hw/arm/smmuv3-accel-stubs.c @@ -0,0 +1,52 @@ +/* + * Stubs for accelerated SMMU instance backed by an iommufd vIOMMU object. + * + * SPDX-License-Identifier: GPL-2.0-or-later + */ + +#include "qemu/osdep.h" +#include "qapi/error.h" +#include "hw/arm/smmuv3.h" +#include "hw/arm/smmuv3-accel.h" + +bool smmuv3_accel_init(SMMUv3State *s, Error **errp) +{ + error_setg(errp, "accel=on support not compiled in"); + return false; +} + +bool smmuv3_accel_install_ste(SMMUv3State *s, SMMUDevice *sdev, int sid, + Error **errp) +{ + return true; +} + +bool smmuv3_accel_install_ste_range(SMMUv3State *s, SMMUSIDRange *range, + Error **errp) +{ + return true; +} + +bool smmuv3_accel_attach_gbpa_hwpt(SMMUv3State *s, Error **errp) +{ + return true; +} + +bool smmuv3_accel_issue_inv_cmd(SMMUv3State *s, void *cmd, SMMUDevice *sdev, + Error **errp) +{ + return true; +} + +void smmuv3_accel_idr_override(SMMUv3State *s) +{ +} + +bool smmuv3_accel_alloc_veventq(SMMUv3State *s, Error **errp) +{ + return true; +} + +void smmuv3_accel_reset(SMMUv3State *s) +{ +} diff --git a/hw/arm/smmuv3-accel.h b/hw/arm/smmuv3-accel.h index d2756c8c48..407940616c 100644 --- a/hw/arm/smmuv3-accel.h +++ b/hw/arm/smmuv3-accel.h @@ -14,7 +14,6 @@ #ifdef CONFIG_LINUX #include #endif -#include CONFIG_DEVICES /* * Represents an accelerated SMMU instance backed by an iommufd vIOMMU object. @@ -41,7 +40,6 @@ typedef struct SMMUv3AccelDevice { SMMUv3AccelState *s_accel; } SMMUv3AccelDevice; -#ifdef CONFIG_ARM_SMMUV3_ACCEL bool smmuv3_accel_init(SMMUv3State *s, Error **errp); bool smmuv3_accel_install_ste(SMMUv3State *s, SMMUDevice *sdev, int sid, Error **errp); @@ -53,45 +51,5 @@ bool smmuv3_accel_issue_inv_cmd(SMMUv3State *s, void *cmd, SMMUDevice *sdev, void smmuv3_accel_idr_override(SMMUv3State *s); bool smmuv3_accel_alloc_veventq(SMMUv3State *s, Error **errp); void smmuv3_accel_reset(SMMUv3State *s); -#else -#include "qapi/error.h" -static inline bool smmuv3_accel_init(SMMUv3State *s, Error **errp) -{ - error_setg(errp, "accel=on support not compiled in"); - return false; -} -static inline bool -smmuv3_accel_install_ste(SMMUv3State *s, SMMUDevice *sdev, int sid, - Error **errp) -{ - return true; -} -static inline bool -smmuv3_accel_install_ste_range(SMMUv3State *s, SMMUSIDRange *range, - Error **errp) -{ - return true; -} -static inline bool smmuv3_accel_attach_gbpa_hwpt(SMMUv3State *s, Error **errp) -{ - return true; -} -static inline bool -smmuv3_accel_issue_inv_cmd(SMMUv3State *s, void *cmd, SMMUDevice *sdev, - Error **errp) -{ - return true; -} -static inline void smmuv3_accel_idr_override(SMMUv3State *s) -{ -} -static inline bool smmuv3_accel_alloc_veventq(SMMUv3State *s, Error **errp) -{ - return true; -} -static inline void smmuv3_accel_reset(SMMUv3State *s) -{ -} -#endif #endif /* HW_ARM_SMMUV3_ACCEL_H */ From 774e6f5c1533aba9e04f95cb8cfba64d8329fcb0 Mon Sep 17 00:00:00 2001 From: Vivien LEGER Date: Sat, 11 Apr 2026 17:45:35 +0200 Subject: [PATCH 39/62] hw/ppc/e500: fix bus-frequency property hardcoded to zero in CPU FDT node MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The bus-frequency property in the CPU FDT node was hardcoded to 0. This is incorrect - it should reflect the actual platform bus clock frequency, as firmware and RTOSes use it to derive peripheral clock rates. Notably, the RTEMS QorIQ BSP uses bus-frequency to program the MPIC global timer interval. With bus-frequency=0, the timer interval overflows to ~85 seconds, preventing any clock interrupts from firing. Fix by adding a bus_freq field to PPCE500MachineClass and using it in the FDT generator. Set bus_freq = PLATFORM_CLK_FREQ_HZ (400MHz) for existing machines, matching the existing clock_freq value. Signed-off-by: Vivien LEGER Reviewed-by: Bernhard Beschow Message-ID: <20260411154535.1451361-1-vivien.leger@gmail.com> Signed-off-by: Philippe Mathieu-Daudé --- hw/ppc/e500.c | 2 +- hw/ppc/e500.h | 1 + hw/ppc/e500plat.c | 1 + hw/ppc/mpc8544ds.c | 1 + 4 files changed, 4 insertions(+), 1 deletion(-) diff --git a/hw/ppc/e500.c b/hw/ppc/e500.c index d6ca2e8563..5be2f2095f 100644 --- a/hw/ppc/e500.c +++ b/hw/ppc/e500.c @@ -518,7 +518,7 @@ static int ppce500_load_device_tree(PPCE500MachineState *pms, env->icache_line_size); qemu_fdt_setprop_cell(fdt, cpu_name, "d-cache-size", 0x8000); qemu_fdt_setprop_cell(fdt, cpu_name, "i-cache-size", 0x8000); - qemu_fdt_setprop_cell(fdt, cpu_name, "bus-frequency", 0); + qemu_fdt_setprop_cell(fdt, cpu_name, "bus-frequency", pmc->bus_freq); if (cpu->cpu_index) { qemu_fdt_setprop_string(fdt, cpu_name, "status", "disabled"); qemu_fdt_setprop_string(fdt, cpu_name, "enable-method", diff --git a/hw/ppc/e500.h b/hw/ppc/e500.h index 11f8ae5317..6d56c7b4cb 100644 --- a/hw/ppc/e500.h +++ b/hw/ppc/e500.h @@ -40,6 +40,7 @@ struct PPCE500MachineClass { hwaddr pci_mmio_bus_base; hwaddr spin_base; uint32_t clock_freq; + uint32_t bus_freq; uint32_t tb_freq; }; diff --git a/hw/ppc/e500plat.c b/hw/ppc/e500plat.c index ca5647284d..85cec810d9 100644 --- a/hw/ppc/e500plat.c +++ b/hw/ppc/e500plat.c @@ -94,6 +94,7 @@ static void e500plat_machine_class_init(ObjectClass *oc, const void *data) pmc->pci_mmio_bus_base = 0xE0000000ULL; pmc->spin_base = 0xFEF000000ULL; pmc->clock_freq = PLATFORM_CLK_FREQ_HZ; + pmc->bus_freq = PLATFORM_CLK_FREQ_HZ; pmc->tb_freq = PLATFORM_CLK_FREQ_HZ; mc->desc = "generic paravirt e500 platform"; diff --git a/hw/ppc/mpc8544ds.c b/hw/ppc/mpc8544ds.c index 6a5d3edc49..a5717a9cde 100644 --- a/hw/ppc/mpc8544ds.c +++ b/hw/ppc/mpc8544ds.c @@ -56,6 +56,7 @@ static void mpc8544ds_machine_class_init(ObjectClass *oc, const void *data) pmc->pci_pio_base = 0xE1000000ULL; pmc->spin_base = 0xEF000000ULL; pmc->clock_freq = PLATFORM_CLK_FREQ_HZ; + pmc->bus_freq = PLATFORM_CLK_FREQ_HZ; pmc->tb_freq = PLATFORM_CLK_FREQ_HZ; mc->desc = "mpc8544ds"; From 0990cc8b286b9981b2548c3d591584d22c7bf2f1 Mon Sep 17 00:00:00 2001 From: Junjie Cao Date: Tue, 14 Apr 2026 22:14:58 +0800 Subject: [PATCH 40/62] ati-vga: fix unsigned integer overflow in cursor bounds checks MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The cursor bounds checks compare (srcoff + N) against vram_size, but both sides are uint32_t so the addition can wrap past UINT32_MAX when srcoff underflows from the cur_hv_offs subtraction, causing the check to be bypassed. Rewrite the checks as (srcoff > vram_size - N) to avoid the overflow-prone addition, matching the style already used in ati_mm_read() and ati_mm_write(). Cc: qemu-stable@nongnu.org Fixes: 2f1fbe6ee9b5 ("ati-vga: Make sure hardware cursor data is within vram") Signed-off-by: Junjie Cao Message-ID: <20260414141458.1076014-1-junjie.cao@intel.com> Reviewed-by: BALATON Zoltan Signed-off-by: Philippe Mathieu-Daudé --- hw/display/ati.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/hw/display/ati.c b/hw/display/ati.c index 88a5bbbf07..0489995d00 100644 --- a/hw/display/ati.c +++ b/hw/display/ati.c @@ -149,7 +149,7 @@ static void ati_cursor_define(ATIVGAState *s) /* FIXME handle cur_hv_offs correctly */ srcoff = s->regs.cur_offset - (s->regs.cur_hv_offs >> 16) - (s->regs.cur_hv_offs & 0xffff) * 16; - if (srcoff + 64 * 16 > s->vga.vram_size) { + if (srcoff > s->vga.vram_size - 64 * 16) { return; } for (int i = 0; i < 64; i++, srcoff += 16) { @@ -206,7 +206,7 @@ static void ati_cursor_draw_line(VGACommonState *vga, uint8_t *d, int scr_y) } /* FIXME handle cur_hv_offs correctly */ srcoff = s->cursor_offset + (scr_y - vga->hw_cursor_y) * 16; - if (srcoff + 16 > s->vga.vram_size) { + if (srcoff > s->vga.vram_size - 16) { return; } dp = &dp[vga->hw_cursor_x]; From 536b4746a33ea1b009b0a96eb0710786735948f6 Mon Sep 17 00:00:00 2001 From: Junjie Cao Date: Wed, 15 Apr 2026 05:35:23 +0800 Subject: [PATCH 41/62] ati-vga: mask out lock bit from CUR_OFFSET in cursor offset calculation MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bit 31 of CUR_OFFSET is the cursor lock bit, not part of the actual cursor address (bits 26:4). Although the callers already check for the lock bit and return early, mask it out with 0x07fffff0 when computing the cursor source offset so the calculation only uses the address bits. Suggested-by: BALATON Zoltan Signed-off-by: Junjie Cao Reviewed-by: BALATON Zoltan Message-ID: <20260414213523.1125859-2-junjie.cao@intel.com> Signed-off-by: Philippe Mathieu-Daudé --- hw/display/ati.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/hw/display/ati.c b/hw/display/ati.c index 0489995d00..3a7d45a882 100644 --- a/hw/display/ati.c +++ b/hw/display/ati.c @@ -147,7 +147,7 @@ static void ati_cursor_define(ATIVGAState *s) return; /* Do not update cursor if locked or rendered by guest */ } /* FIXME handle cur_hv_offs correctly */ - srcoff = s->regs.cur_offset - (s->regs.cur_hv_offs >> 16) - + srcoff = (s->regs.cur_offset & 0x07fffff0) - (s->regs.cur_hv_offs >> 16) - (s->regs.cur_hv_offs & 0xffff) * 16; if (srcoff > s->vga.vram_size - 64 * 16) { return; @@ -176,13 +176,15 @@ static void ati_cursor_invalidate(VGACommonState *vga) if (s->cursor_size != size || vga->hw_cursor_x != s->regs.cur_hv_pos >> 16 || vga->hw_cursor_y != (s->regs.cur_hv_pos & 0xffff) || - s->cursor_offset != s->regs.cur_offset - (s->regs.cur_hv_offs >> 16) - + s->cursor_offset != (s->regs.cur_offset & 0x07fffff0) - + (s->regs.cur_hv_offs >> 16) - (s->regs.cur_hv_offs & 0xffff) * 16) { /* Remove old cursor then update and show new one if needed */ vga_invalidate_scanlines(vga, vga->hw_cursor_y, vga->hw_cursor_y + 63); vga->hw_cursor_x = s->regs.cur_hv_pos >> 16; vga->hw_cursor_y = s->regs.cur_hv_pos & 0xffff; - s->cursor_offset = s->regs.cur_offset - (s->regs.cur_hv_offs >> 16) - + s->cursor_offset = (s->regs.cur_offset & 0x07fffff0) - + (s->regs.cur_hv_offs >> 16) - (s->regs.cur_hv_offs & 0xffff) * 16; s->cursor_size = size; if (size) { From 2c1bafb75b79751280f2a067d00905b0cb931c6e Mon Sep 17 00:00:00 2001 From: Peter Maydell Date: Fri, 17 Apr 2026 10:38:05 +0100 Subject: [PATCH 42/62] hw/arm, hw/ppc: Remove unnecessary audio.h includes from board code MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Some boards (mostly arm, but also ppc/prep) include audio.h, but they don't need anything from it. Drop the unnecessary include lines. These seem to have been introduced with commits 2b16397264a8e, b8ab0303de, which added the machine-default audiodev handling, but as far as I can tell they were unecessary right from the start, as the machine_add_audiodev_property() function has always been in boards.h. Signed-off-by: Peter Maydell Reviewed-by: Alex Bennée Message-ID: <20260417093805.1076954-1-peter.maydell@linaro.org> Signed-off-by: Philippe Mathieu-Daudé --- hw/arm/integratorcp.c | 1 - hw/arm/musicpal.c | 1 - hw/arm/realview.c | 1 - hw/arm/versatilepb.c | 1 - hw/arm/vexpress.c | 1 - hw/arm/xlnx-zcu102.c | 1 - hw/ppc/prep.c | 1 - 7 files changed, 7 deletions(-) diff --git a/hw/arm/integratorcp.c b/hw/arm/integratorcp.c index 0bf519b6bb..03633f3d4f 100644 --- a/hw/arm/integratorcp.c +++ b/hw/arm/integratorcp.c @@ -27,7 +27,6 @@ #include "hw/core/irq.h" #include "hw/sd/sd.h" #include "qom/object.h" -#include "qemu/audio.h" #include "target/arm/cpu-qom.h" #define TYPE_INTEGRATOR_CM "integrator_core" diff --git a/hw/arm/musicpal.c b/hw/arm/musicpal.c index 250fdb49b6..441a11100a 100644 --- a/hw/arm/musicpal.c +++ b/hw/arm/musicpal.c @@ -37,7 +37,6 @@ #include "qemu/cutils.h" #include "qom/object.h" #include "hw/net/mv88w8618_eth.h" -#include "qemu/audio.h" #include "qemu/error-report.h" #include "target/arm/cpu-qom.h" diff --git a/hw/arm/realview.c b/hw/arm/realview.c index 7e8acd34ac..7c49995c80 100644 --- a/hw/arm/realview.c +++ b/hw/arm/realview.c @@ -30,7 +30,6 @@ #include "hw/core/irq.h" #include "hw/i2c/arm_sbcon_i2c.h" #include "hw/sd/sd.h" -#include "qemu/audio.h" #include "target/arm/cpu-qom.h" #define SMP_BOOT_ADDR 0xe0000000 diff --git a/hw/arm/versatilepb.c b/hw/arm/versatilepb.c index 254b1610b3..c6991a52e6 100644 --- a/hw/arm/versatilepb.c +++ b/hw/arm/versatilepb.c @@ -26,7 +26,6 @@ #include "hw/char/pl011.h" #include "hw/sd/sd.h" #include "qom/object.h" -#include "qemu/audio.h" #include "target/arm/cpu-qom.h" #include "qemu/log.h" diff --git a/hw/arm/vexpress.c b/hw/arm/vexpress.c index cc6ae7d4c4..b178798085 100644 --- a/hw/arm/vexpress.c +++ b/hw/arm/vexpress.c @@ -45,7 +45,6 @@ #include "hw/sd/sd.h" #include "qobject/qlist.h" #include "qom/object.h" -#include "qemu/audio.h" #include "target/arm/cpu-qom.h" #define VEXPRESS_BOARD_ID 0x8e0 diff --git a/hw/arm/xlnx-zcu102.c b/hw/arm/xlnx-zcu102.c index 3ba2736bab..4e48970274 100644 --- a/hw/arm/xlnx-zcu102.c +++ b/hw/arm/xlnx-zcu102.c @@ -26,7 +26,6 @@ #include "system/device_tree.h" #include "qom/object.h" #include "net/can_emu.h" -#include "qemu/audio.h" struct XlnxZCU102 { MachineState parent_obj; diff --git a/hw/ppc/prep.c b/hw/ppc/prep.c index e973b34099..2672eb9e7a 100644 --- a/hw/ppc/prep.c +++ b/hw/ppc/prep.c @@ -46,7 +46,6 @@ #include "trace.h" #include "elf.h" #include "qemu/units.h" -#include "qemu/audio.h" /* SMP is not enabled, for now */ #define MAX_CPUS 1 From 5e15d28fb3fce5075a151fb955a48912f38e8aa2 Mon Sep 17 00:00:00 2001 From: Osama Abdelkader Date: Mon, 20 Apr 2026 18:30:50 +0200 Subject: [PATCH 43/62] hw/virtio/virtio-iommu: remove duplicate include MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit qemu/reserved-region.h is included twice Signed-off-by: Osama Abdelkader Reviewed-by: Philippe Mathieu-Daudé Message-ID: <20260420163050.321668-1-osama.abdelkader@gmail.com> Signed-off-by: Philippe Mathieu-Daudé --- hw/virtio/virtio-iommu.c | 1 - 1 file changed, 1 deletion(-) diff --git a/hw/virtio/virtio-iommu.c b/hw/virtio/virtio-iommu.c index 4226a676d0..08f7e8b783 100644 --- a/hw/virtio/virtio-iommu.c +++ b/hw/virtio/virtio-iommu.c @@ -28,7 +28,6 @@ #include "system/kvm.h" #include "system/reset.h" #include "system/system.h" -#include "qemu/reserved-region.h" #include "qemu/units.h" #include "qapi/error.h" #include "qemu/error-report.h" From 5ecfcae22187b544b12d1309ffe9f7c213f077c4 Mon Sep 17 00:00:00 2001 From: Osama Abdelkader Date: Mon, 20 Apr 2026 18:34:53 +0200 Subject: [PATCH 44/62] hw/hyperv: remove duplicate include MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit exec/target_page.h is included twice Signed-off-by: Osama Abdelkader Reviewed-by: Pierrick Bouvier Message-ID: <20260420163452.327350-2-osama.abdelkader@gmail.com> Reviewed-by: Maciej S. Szmigiero Reviewed-by: Philippe Mathieu-Daudé Message-ID: <20260420163844.332663-1-osama.abdelkader@gmail.com> Signed-off-by: Philippe Mathieu-Daudé --- hw/hyperv/hyperv.c | 1 - hw/hyperv/vmbus.c | 1 - 2 files changed, 2 deletions(-) diff --git a/hw/hyperv/hyperv.c b/hw/hyperv/hyperv.c index a19f330e19..a854a4927a 100644 --- a/hw/hyperv/hyperv.c +++ b/hw/hyperv/hyperv.c @@ -26,7 +26,6 @@ #include "hw/hyperv/hyperv.h" #include "qom/object.h" #include "target/i386/kvm/hyperv-proto.h" -#include "exec/target_page.h" struct SynICState { DeviceState parent_obj; diff --git a/hw/hyperv/vmbus.c b/hw/hyperv/vmbus.c index 5388f4277f..dcfce70005 100644 --- a/hw/hyperv/vmbus.c +++ b/hw/hyperv/vmbus.c @@ -21,7 +21,6 @@ #include "hw/core/sysbus.h" #include "exec/cpu-common.h" #include "system/kvm.h" -#include "exec/target_page.h" #include "trace.h" enum { From 80b3dd77b30ba9b01a5ad6479f7c462010b180e3 Mon Sep 17 00:00:00 2001 From: Osama Abdelkader Date: Mon, 20 Apr 2026 18:40:58 +0200 Subject: [PATCH 45/62] hw/ppc/amigaone: remove duplicate include MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit hw/ppc/ppc.h is included twice Signed-off-by: Osama Abdelkader Reviewed-by: Philippe Mathieu-Daudé Reviewed-by: BALATON Zoltan Message-ID: <20260420164058.335872-1-osama.abdelkader@gmail.com> Signed-off-by: Philippe Mathieu-Daudé --- hw/ppc/amigaone.c | 1 - 1 file changed, 1 deletion(-) diff --git a/hw/ppc/amigaone.c b/hw/ppc/amigaone.c index 8074713fbe..9fba5ca03a 100644 --- a/hw/ppc/amigaone.c +++ b/hw/ppc/amigaone.c @@ -20,7 +20,6 @@ #include "hw/isa/vt82c686.h" #include "hw/ide/pci.h" #include "hw/i2c/smbus_eeprom.h" -#include "hw/ppc/ppc.h" #include "exec/cpu-common.h" #include "system/block-backend.h" #include "system/qtest.h" From c0306d2b8f45a708f7ab45c846bb24851d6e17f2 Mon Sep 17 00:00:00 2001 From: Thomas Huth Date: Tue, 21 Apr 2026 10:29:35 +0200 Subject: [PATCH 46/62] hw/misc: Fix the valid access size to the avr-power device MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Accessing the device with in non-single byte mode currently causes QEMU to abort: $ echo "writew 0x800064 0x4142" | \ ./qemu-system-avr -M mega2560 -display none -qtest stdio -accel qtest [I 0.000000] OPENED [R +0.001784] writew 0x800064 0x4142 qemu-system-avr: ../../devel/qemu/hw/misc/avr_power.c:58: avr_mask_write: Assertion `offset == 0' failed. Aborted (core dumped) Set the valid max access size to 1 to fix the problem. Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3393 Signed-off-by: Thomas Huth Reviewed-by: Peter Maydell Reviewed-by: Philippe Mathieu-Daudé Message-ID: <20260421082935.85995-1-thuth@redhat.com> Signed-off-by: Philippe Mathieu-Daudé --- hw/misc/avr_power.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/hw/misc/avr_power.c b/hw/misc/avr_power.c index f42cf4fd90..42be265691 100644 --- a/hw/misc/avr_power.c +++ b/hw/misc/avr_power.c @@ -73,6 +73,9 @@ static const MemoryRegionOps avr_mask_ops = { .impl = { .max_access_size = 1, }, + .valid = { + .max_access_size = 1, + }, }; static void avr_mask_init(Object *dev) From 3ab47a47d716f8f2b7686cc06c8312db2e6fc2d4 Mon Sep 17 00:00:00 2001 From: Thomas Huth Date: Wed, 22 Apr 2026 09:54:29 +0200 Subject: [PATCH 47/62] hw/sh4/sh7750: Remove forgotten abort() in the MM_ITLB_DATA handler MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit QEMU currently aborts when the guest writes to the MM_ITLB_DATA register: echo "writel 0xf3000000 0x11223344" | \ ./qemu-system-sh4 -M r2d -display none -accel qtest -qtest stdio [I 0.000000] OPENED [R +0.004476] writel 0xf3000000 0x11223344 Aborted (core dumped) Looking at the history of the code, the abort() here has likely just been forgotten when the register handler had been implemented (it used to be a reminder about unimplemented functionality initially): https://gitlab.com/qemu-project/qemu/-/commit/9f97309a70f12df5f9104f1f Thus simply remove the abort() now to get rid of the problem. Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3420 Signed-off-by: Thomas Huth Reviewed-by: Philippe Mathieu-Daudé Message-ID: <20260422075429.341409-1-thuth@redhat.com> Signed-off-by: Philippe Mathieu-Daudé --- hw/sh4/sh7750.c | 1 - 1 file changed, 1 deletion(-) diff --git a/hw/sh4/sh7750.c b/hw/sh4/sh7750.c index 3ae71f99fe..6aa7f63773 100644 --- a/hw/sh4/sh7750.c +++ b/hw/sh4/sh7750.c @@ -687,7 +687,6 @@ static void sh7750_mmct_write(void *opaque, hwaddr addr, break; case MM_ITLB_DATA: cpu_sh4_write_mmaped_itlb_data(&s->cpu->env, addr, mem_value); - abort(); break; case MM_OCACHE_ADDR: case MM_OCACHE_DATA: From b73b24f6bbd1eba0216180579f3d687c80f6c1e4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Wed, 22 Apr 2026 11:11:09 +0200 Subject: [PATCH 48/62] hw/cxl: Define cxl_fmws_get_all_sorted() stub MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Add a stub for cxl_fmws_get_all_sorted() to fix building a QEMU configured with the '--without-default-devices' option: Undefined symbols for architecture arm64: "_cxl_fmws_get_all_sorted", referenced from: _cxl_build_cedt in hw_acpi_cxl.c.o Note, the CXL <-> ACPI Kconfig relationship is a bit convoluted. Signed-off-by: Philippe Mathieu-Daudé Reviewed-by: Richard Henderson Message-Id: <20260423170229.64655-3-philmd@linaro.org> --- hw/cxl/cxl-host-stubs.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/hw/cxl/cxl-host-stubs.c b/hw/cxl/cxl-host-stubs.c index c015baac81..9b515913ea 100644 --- a/hw/cxl/cxl-host-stubs.c +++ b/hw/cxl/cxl-host-stubs.c @@ -18,3 +18,8 @@ hwaddr cxl_fmws_set_memmap(hwaddr base, hwaddr max_addr) void cxl_fmws_update_mmio(void) {}; const MemoryRegionOps cfmws_ops; + +GSList *cxl_fmws_get_all_sorted(void) +{ + g_assert_not_reached(); +} From acbd37b8b4bbf8ecbb8a32507d30ca48ba48f3b6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Wed, 22 Apr 2026 11:22:31 +0200 Subject: [PATCH 49/62] hw/arm/virt: Do not select Kconfig symbol PCI_EXPRESS MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The PCIe bus is not provided by the Virt machine but by its GPEX host bridge (selected via PCI_EXPRESS_GENERIC_BRIDGE). Signed-off-by: Philippe Mathieu-Daudé Reviewed-by: Richard Henderson Message-Id: <20260423170229.64655-4-philmd@linaro.org> --- hw/arm/Kconfig | 1 - 1 file changed, 1 deletion(-) diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig index 4e50fb1111..41d5e968c8 100644 --- a/hw/arm/Kconfig +++ b/hw/arm/Kconfig @@ -15,7 +15,6 @@ config ARM_VIRT select GPIO_KEY select DEVICE_TREE select FW_CFG_DMA - select PCI_EXPRESS select PCI_EXPRESS_GENERIC_BRIDGE select PFLASH_CFI01 select PL011 # UART From da335e605a70ef141c5eee72aba30109ef3bd5e8 Mon Sep 17 00:00:00 2001 From: Jamin Lin Date: Fri, 24 Apr 2026 08:05:12 +0000 Subject: [PATCH 50/62] hw/usb/hcd-ehci: Remove unused EHCIfstn structure and dead code MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The EHCIfstn structure, defined according to EHCI spec section 3.7, is currently unused in the EHCI implementation. Remove it to reduce unused code and improve maintainability. Additionally, drop a block of disabled (#if 0) code in ehci_state_advqueue() that was never implemented. This code path is incomplete and has no functional impact. No functional change. Signed-off-by: Jamin Lin Reviewed-by: Cédric Le Goater Message-ID: <20260424080508.53992-3-jamin_lin@aspeedtech.com> Signed-off-by: Philippe Mathieu-Daudé --- hw/usb/hcd-ehci.c | 6 ------ hw/usb/hcd-ehci.h | 7 ------- 2 files changed, 13 deletions(-) diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c index 57f930b099..23167bf96f 100644 --- a/hw/usb/hcd-ehci.c +++ b/hw/usb/hcd-ehci.c @@ -1756,16 +1756,10 @@ static int ehci_state_fetchsitd(EHCIState *ehci, int async) /* Section 4.10.2 - paragraph 3 */ static int ehci_state_advqueue(EHCIQueue *q) { -#if 0 /* TO-DO: 4.10.2 - paragraph 2 * if I-bit is set to 1 and QH is not active * go to horizontal QH */ - if (I-bit set) { - ehci_set_state(ehci, async, EST_HORIZONTALQH); - goto out; - } -#endif /* * want data and alt-next qTD is valid diff --git a/hw/usb/hcd-ehci.h b/hw/usb/hcd-ehci.h index 0ae8c06331..3aec0e047c 100644 --- a/hw/usb/hcd-ehci.h +++ b/hw/usb/hcd-ehci.h @@ -202,13 +202,6 @@ typedef struct EHCIqh { #define BUFPTR_SBYTES_SH 5 } EHCIqh; -/* EHCI spec version 1.0 Section 3.7 - */ -typedef struct EHCIfstn { - uint32_t next; /* Standard next link pointer */ - uint32_t backptr; /* Standard next link pointer */ -} EHCIfstn; - enum async_state { EHCI_ASYNC_NONE = 0, EHCI_ASYNC_INITIALIZED, From 4d8f3c086c9af045c5ce5e60da0ac19535759756 Mon Sep 17 00:00:00 2001 From: Jamin Lin Date: Wed, 11 Mar 2026 08:26:17 +0100 Subject: [PATCH 51/62] hw/usb/hcd-ehci.h: Fix coding style issues reported by checkpatch MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit No functional change. Signed-off-by: Jamin Lin Reviewed-by: Cédric Le Goater Reviewed-by: Philippe Mathieu-Daudé Message-ID: <20260424080508.53992-4-jamin_lin@aspeedtech.com> Signed-off-by: Philippe Mathieu-Daudé --- hw/usb/hcd-ehci.h | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) diff --git a/hw/usb/hcd-ehci.h b/hw/usb/hcd-ehci.h index 3aec0e047c..736407fd52 100644 --- a/hw/usb/hcd-ehci.h +++ b/hw/usb/hcd-ehci.h @@ -43,7 +43,8 @@ typedef struct EHCIPacket EHCIPacket; typedef struct EHCIQueue EHCIQueue; typedef struct EHCIState EHCIState; -/* EHCI spec version 1.0 Section 3.3 +/* + * EHCI spec version 1.0 Section 3.3 */ typedef struct EHCIitd { uint32_t next; @@ -74,7 +75,8 @@ typedef struct EHCIitd { #define ITD_BUFPTR_MULT_SH 0 } EHCIitd; -/* EHCI spec version 1.0 Section 3.4 +/* + * EHCI spec version 1.0 Section 3.4 */ typedef struct EHCIsitd { uint32_t next; /* Standard next link pointer */ @@ -118,7 +120,8 @@ typedef struct EHCIsitd { uint32_t backptr; /* Standard next link pointer */ } EHCIsitd; -/* EHCI spec version 1.0 Section 3.5 +/* + * EHCI spec version 1.0 Section 3.5 */ typedef struct EHCIqtd { uint32_t next; /* Standard next link pointer */ @@ -148,7 +151,8 @@ typedef struct EHCIqtd { #define QTD_BUFPTR_SH 12 } EHCIqtd; -/* EHCI spec version 1.0 Section 3.6 +/* + * EHCI spec version 1.0 Section 3.6 */ typedef struct EHCIqh { uint32_t next; /* Standard next link pointer */ @@ -230,7 +234,8 @@ struct EHCIQueue { int async; int transact_ctr; - /* cached data from guest - needs to be flushed + /* + * cached data from guest - needs to be flushed * when guest removes an entry (doorbell, handshake sequence) */ EHCIqh qh; /* copy of current QH (being worked on) */ @@ -268,7 +273,7 @@ struct EHCIState { */ uint8_t caps[CAPA_SIZE]; union { - uint32_t opreg[0x44/sizeof(uint32_t)]; + uint32_t opreg[0x44 / sizeof(uint32_t)]; struct { uint32_t usbcmd; uint32_t usbsts; From 674a77a2f51be9f15327a979ab8ccddf281b0ff6 Mon Sep 17 00:00:00 2001 From: Jamin Lin Date: Wed, 11 Mar 2026 08:26:18 +0100 Subject: [PATCH 52/62] hw/usb/hcd-ehci.c: Fix coding style issues reported by checkpatch MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit No functional change. Signed-off-by: Jamin Lin Reviewed-by: Cédric Le Goater Reviewed-by: Philippe Mathieu-Daudé Message-ID: <20260424080508.53992-5-jamin_lin@aspeedtech.com> Signed-off-by: Philippe Mathieu-Daudé --- hw/usb/hcd-ehci.c | 129 +++++++++++++++++++++++++--------------------- 1 file changed, 71 insertions(+), 58 deletions(-) diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c index 23167bf96f..7e0b767eb9 100644 --- a/hw/usb/hcd-ehci.c +++ b/hw/usb/hcd-ehci.c @@ -41,21 +41,23 @@ #define FRAME_TIMER_NS (NANOSECONDS_PER_SECOND / FRAME_TIMER_FREQ) #define UFRAME_TIMER_NS (FRAME_TIMER_NS / 8) -#define NB_MAXINTRATE 8 // Max rate at which controller issues ints -#define BUFF_SIZE 5*4096 // Max bytes to transfer per transaction -#define MAX_QH 100 // Max allowable queue heads in a chain +#define NB_MAXINTRATE 8 /* Max rate at which controller issues ints */ +#define BUFF_SIZE (5 * 4096) /* Max bytes to transfer per transaction */ +#define MAX_QH 100 /* Max allowable queue heads in a chain */ #define MIN_UFR_PER_TICK 24 /* Min frames to process when catching up */ #define PERIODIC_ACTIVE 512 /* Micro-frames */ -/* Internal periodic / asynchronous schedule state machine states +/* + * Internal periodic / asynchronous schedule state machine states */ typedef enum { EST_INACTIVE = 1000, EST_ACTIVE, EST_EXECUTING, EST_SLEEPING, - /* The following states are internal to the state machine function - */ + /* + * The following states are internal to the state machine function + */ EST_WAITLISTHEAD, EST_FETCHENTRY, EST_FETCHQH, @@ -71,13 +73,13 @@ typedef enum { /* macros for accessing fields within next link pointer entry */ #define NLPTR_GET(x) ((x) & 0xffffffe0) #define NLPTR_TYPE_GET(x) (((x) >> 1) & 3) -#define NLPTR_TBIT(x) ((x) & 1) // 1=invalid, 0=valid +#define NLPTR_TBIT(x) ((x) & 1) /* 1=invalid, 0=valid */ /* link pointer types */ -#define NLPTR_TYPE_ITD 0 // isoc xfer descriptor -#define NLPTR_TYPE_QH 1 // queue head -#define NLPTR_TYPE_STITD 2 // split xaction, isoc xfer descriptor -#define NLPTR_TYPE_FSTN 3 // frame span traversal node +#define NLPTR_TYPE_ITD 0 /* isoc xfer descriptor */ +#define NLPTR_TYPE_QH 1 /* queue head */ +#define NLPTR_TYPE_STITD 2 /* split xaction, isoc xfer descriptor */ +#define NLPTR_TYPE_FSTN 3 /* frame span traversal node */ #define SET_LAST_RUN_CLOCK(s) \ (s)->last_run_ns = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL); @@ -88,10 +90,10 @@ typedef enum { #define set_field(data, newval, field) do { \ uint32_t val = *data; \ - val &= ~ field##_MASK; \ + val &= ~field##_MASK; \ val |= ((newval) << field##_SH) & field##_MASK; \ *data = val; \ - } while(0) + } while (0) static const char *ehci_state_names[] = { [EST_INACTIVE] = "INACTIVE", @@ -472,8 +474,10 @@ static bool ehci_verify_pid(EHCIQueue *q, EHCIqtd *qtd) } } -/* Finish executing and writeback a packet outside of the regular - fetchqh -> fetchqtd -> execute -> writeback cycle */ +/* + * Finish executing and writeback a packet outside of the regular + * fetchqh -> fetchqtd -> execute -> writeback cycle + */ static void ehci_writeback_async_complete_packet(EHCIPacket *p) { EHCIQueue *q = p->queue; @@ -733,7 +737,7 @@ static void ehci_detach(USBPort *port) ehci_queues_rip_device(s, port->dev, 0); ehci_queues_rip_device(s, port->dev, 1); - *portsc &= ~(PORTSC_CONNECT|PORTSC_PED|PORTSC_SUSPEND); + *portsc &= ~(PORTSC_CONNECT | PORTSC_PED | PORTSC_SUSPEND); *portsc |= PORTSC_CSC; ehci_raise_irq(s, USBSTS_PCD); @@ -858,7 +862,7 @@ void ehci_reset(void *opaque) * Do the detach before touching portsc, so that it correctly gets send to * us or to our companion based on PORTSC_POWNER before the reset. */ - for(i = 0; i < EHCI_PORTS; i++) { + for (i = 0; i < EHCI_PORTS; i++) { devs[i] = s->ports[i].dev; if (devs[i] && devs[i]->attached) { usb_detach(&s->ports[i]); @@ -877,7 +881,7 @@ void ehci_reset(void *opaque) s->astate = EST_INACTIVE; s->pstate = EST_INACTIVE; - for(i = 0; i < EHCI_PORTS; i++) { + for (i = 0; i < EHCI_PORTS; i++) { if (s->companion_ports[i]) { s->portsc[i] = PORTSC_POWNER | PORTSC_PPOWER; } else { @@ -942,8 +946,9 @@ static void handle_port_owner_write(EHCIState *s, int port, uint32_t owner) uint32_t *portsc = &s->portsc[port]; uint32_t orig; - if (s->companion_ports[port] == NULL) + if (s->companion_ports[port] == NULL) { return; + } owner = owner & PORTSC_POWNER; orig = *portsc & PORTSC_POWNER; @@ -988,7 +993,7 @@ static void ehci_port_write(void *ptr, hwaddr addr, trace_usb_ehci_port_reset(port, 1); } - if (!(val & PORTSC_PRESET) &&(*portsc & PORTSC_PRESET)) { + if (!(val & PORTSC_PRESET) && (*portsc & PORTSC_PRESET)) { trace_usb_ehci_port_reset(port, 0); if (dev && dev->attached) { usb_port_reset(&s->ports[port]); @@ -1065,8 +1070,10 @@ static void ehci_opreg_write(void *ptr, hwaddr addr, break; case USBSTS: - val &= USBSTS_RO_MASK; // bits 6 through 31 are RO - ehci_clear_usbsts(s, val); // bits 0 through 5 are R/WC + /* bits 6 through 31 are RO */ + val &= USBSTS_RO_MASK; + /* bits 0 through 5 are R/WC */ + ehci_clear_usbsts(s, val); val = s->usbsts; ehci_update_irq(s); break; @@ -1131,8 +1138,7 @@ static void ehci_flush_qh(EHCIQueue *q) put_dwords(q->ehci, addr + 3 * sizeof(uint32_t), qh + 3, dwords - 3); } -// 4.10.2 - +/* 4.10.2 */ static int ehci_qh_do_overlay(EHCIQueue *q) { EHCIPacket *p = QTAILQ_FIRST(&q->packets); @@ -1145,8 +1151,7 @@ static int ehci_qh_do_overlay(EHCIQueue *q) assert(p != NULL); assert(p->qtdaddr == q->qtdaddr); - // remember values in fields to preserve in qh after overlay - + /* remember values in fields to preserve in qh after overlay */ dtoggle = q->qh.token & QTD_TOKEN_DTOGGLE; ping = q->qh.token & QTD_TOKEN_PING; @@ -1170,7 +1175,7 @@ static int ehci_qh_do_overlay(EHCIQueue *q) } if (!(q->qh.epchar & QH_EPCHAR_DTC)) { - // preserve QH DT bit + /* preserve QH DT bit */ q->qh.token &= ~QTD_TOKEN_DTOGGLE; q->qh.token |= dtoggle; } @@ -1397,9 +1402,7 @@ static int ehci_execute(EHCIPacket *p, const char *action) return 1; } -/* 4.7.2 - */ - +/* 4.7.2 */ static int ehci_process_itd(EHCIState *ehci, EHCIitd *itd, uint32_t addr) @@ -1411,13 +1414,13 @@ static int ehci_process_itd(EHCIState *ehci, ehci->periodic_sched_active = PERIODIC_ACTIVE; - dir =(itd->bufptr[1] & ITD_BUFPTR_DIRECTION); + dir = (itd->bufptr[1] & ITD_BUFPTR_DIRECTION); devaddr = get_field(itd->bufptr[0], ITD_BUFPTR_DEVADDR); endp = get_field(itd->bufptr[0], ITD_BUFPTR_EP); max = get_field(itd->bufptr[1], ITD_BUFPTR_MAXPKT); mult = get_field(itd->bufptr[2], ITD_BUFPTR_MULT); - for(i = 0; i < 8; i++) { + for (i = 0; i < 8; i++) { if (itd->transact[i] & ITD_XACT_ACTIVE) { pg = get_field(itd->transact[i], ITD_XACT_PGSEL); off = itd->transact[i] & ITD_XACT_OFFSET_MASK; @@ -1513,8 +1516,9 @@ static int ehci_process_itd(EHCIState *ehci, } -/* This state is the entry point for asynchronous schedule - * processing. Entry here constitutes a EHCI start event state (4.8.5) +/* + * This state is the entry point for asynchronous schedule + * processing. Entry here constitutes a EHCI start event state (4.8.5) */ static int ehci_state_waitlisthead(EHCIState *ehci, int async) { @@ -1531,7 +1535,7 @@ static int ehci_state_waitlisthead(EHCIState *ehci, int async) ehci_queues_rip_unused(ehci, async); /* Find the head of the list (4.9.1.1) */ - for(i = 0; i < MAX_QH; i++) { + for (i = 0; i < MAX_QH; i++) { if (get_dwords(ehci, NLPTR_GET(entry), (uint32_t *) &qh, sizeof(EHCIqh) >> 2) < 0) { return 0; @@ -1564,8 +1568,9 @@ out: } -/* This state is the entry point for periodic schedule processing as - * well as being a continuation state for async processing. +/* + * This state is the entry point for periodic schedule processing as + * well as being a continuation state for async processing. */ static int ehci_state_fetchentry(EHCIState *ehci, int async) { @@ -1674,7 +1679,7 @@ static EHCIQueue *ehci_state_fetchqh(EHCIState *ehci, int async) #if EHCI_DEBUG if (q->qhaddr != q->qh.next) { - DPRINTF("FETCHQH: QH 0x%08x (h %x halt %x active %x) next 0x%08x\n", + DPRINTF("FETCHQH: QH 0x%08x (h %x halt %x active %x) next 0x%08x\n", q->qhaddr, q->qh.epchar & QH_EPCHAR_H, q->qh.token & QTD_TOKEN_HALT, @@ -1756,7 +1761,8 @@ static int ehci_state_fetchsitd(EHCIState *ehci, int async) /* Section 4.10.2 - paragraph 3 */ static int ehci_state_advqueue(EHCIQueue *q) { - /* TO-DO: 4.10.2 - paragraph 2 + /* + * TO-DO: 4.10.2 - paragraph 2 * if I-bit is set to 1 and QH is not active * go to horizontal QH */ @@ -1929,8 +1935,10 @@ static int ehci_state_execute(EHCIQueue *q) return -1; } - // TODO verify enough time remains in the uframe as in 4.4.1.1 - // TODO write back ptr to async list when done or out of time + /* + * TODO verify enough time remains in the uframe as in 4.4.1.1 + * TODO write back ptr to async list when done or out of time + */ /* 4.10.3, bottom of page 82, go horizontal on transaction counter == 0 */ if (!q->async && q->transact_ctr == 0) { @@ -2041,7 +2049,7 @@ static void ehci_advance_state(EHCIState *ehci, int async) int again; do { - switch(ehci_get_state(ehci, async)) { + switch (ehci_get_state(ehci, async)) { case EST_WAITLISTHEAD: again = ehci_state_waitlisthead(ehci, async); break; @@ -2120,21 +2128,20 @@ static void ehci_advance_state(EHCIState *ehci, int async) ehci_reset(ehci); again = 0; } - } - while (again); + } while (again); } static void ehci_advance_async_state(EHCIState *ehci) { const int async = 1; - switch(ehci_get_state(ehci, async)) { + switch (ehci_get_state(ehci, async)) { case EST_INACTIVE: if (!ehci_async_enabled(ehci)) { break; } ehci_set_state(ehci, async, EST_ACTIVE); - // No break, fall through to ACTIVE + /* No break, fall through to ACTIVE */ case EST_ACTIVE: if (!ehci_async_enabled(ehci)) { @@ -2158,7 +2165,8 @@ static void ehci_advance_async_state(EHCIState *ehci) ehci_set_state(ehci, async, EST_WAITLISTHEAD); ehci_advance_state(ehci, async); - /* If the doorbell is set, the guest wants to make a change to the + /* + * If the doorbell is set, the guest wants to make a change to the * schedule. The host controller needs to release cached data. * (section 4.8.2) */ @@ -2185,13 +2193,13 @@ static void ehci_advance_periodic_state(EHCIState *ehci) uint32_t list; const int async = 0; - // 4.6 + /* 4.6 */ - switch(ehci_get_state(ehci, async)) { + switch (ehci_get_state(ehci, async)) { case EST_INACTIVE: if (!(ehci->frindex & 7) && ehci_periodic_enabled(ehci)) { ehci_set_state(ehci, async, EST_ACTIVE); - // No break, fall through to ACTIVE + /* No break, fall through to ACTIVE */ } else break; @@ -2215,7 +2223,7 @@ static void ehci_advance_periodic_state(EHCIState *ehci) DPRINTF("PERIODIC state adv fr=%d. [%08X] -> %08X\n", ehci->frindex / 8, list, entry); - ehci_set_fetch_addr(ehci, async,entry); + ehci_set_fetch_addr(ehci, async, entry); ehci_set_state(ehci, async, EST_FETCHENTRY); ehci_advance_state(ehci, async); ehci_queues_rip_unused(ehci, async); @@ -2240,7 +2248,8 @@ static void ehci_update_frindex(EHCIState *ehci, int uframes) ehci_raise_irq(ehci, USBSTS_FLR); } - /* How many times will frindex roll over 0x4000 with this frame count? + /* + * How many times will frindex roll over 0x4000 with this frame count? * usbsts_frindex is decremented by 0x4000 on rollover until it reaches 0 */ int rollovers = (ehci->frindex + uframes) / 0x4000; @@ -2320,8 +2329,9 @@ static void ehci_work_bh(void *opaque) ehci->async_stepdown++; } - /* Async is not inside loop since it executes everything it can once - * called + /* + * Async is not inside loop since it executes everything it can once + * called */ if (ehci_async_enabled(ehci) || ehci->astate != EST_INACTIVE) { need_timer++; @@ -2339,15 +2349,18 @@ static void ehci_work_bh(void *opaque) } if (need_timer) { - /* If we've raised int, we speed up the timer, so that we quickly - * notice any new packets queued up in response */ + /* + * If we've raised int, we speed up the timer, so that we quickly + * notice any new packets queued up in response + */ if (ehci->int_req_by_async && (ehci->usbsts & USBSTS_INT)) { expire_time = t_now + NANOSECONDS_PER_SECOND / (FRAME_TIMER_FREQ * 4); ehci->int_req_by_async = false; } else { - expire_time = t_now + (NANOSECONDS_PER_SECOND - * (ehci->async_stepdown+1) / FRAME_TIMER_FREQ); + expire_time = t_now + + (NANOSECONDS_PER_SECOND * (ehci->async_stepdown + 1) / + FRAME_TIMER_FREQ); } timer_mod(ehci->frame_timer, expire_time); } From f94c2a3415423683e9fe252798becfaca3a938d8 Mon Sep 17 00:00:00 2001 From: Jamin Lin Date: Thu, 23 Apr 2026 07:18:11 +0200 Subject: [PATCH 53/62] hw/usb/hcd-ehci.c: Replace fprintf(stderr, ...) with qemu_log_mask(LOG_GUEST_ERROR) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Replace direct fprintf(stderr, ...) calls with qemu_log_mask() using LOG_GUEST_ERROR in the EHCI controller implementation. Direct writes to stderr are discouraged in QEMU as they bypass the logging framework and cannot be filtered or controlled at runtime. Using qemu_log_mask() ensures that guest-visible errors are properly categorized and can be managed via QEMU logging options. All affected messages correspond to guest-triggerable error conditions, so LOG_GUEST_ERROR is used consistently. This change improves integration with QEMU's logging infrastructure and aligns with upstream coding guidelines. Signed-off-by: Jamin Lin Reviewed-by: Cédric Le Goater Message-ID: <20260424080508.53992-6-jamin_lin@aspeedtech.com> Signed-off-by: Philippe Mathieu-Daudé --- hw/usb/hcd-ehci.c | 46 +++++++++++++++++++++++++--------------------- 1 file changed, 25 insertions(+), 21 deletions(-) diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c index 7e0b767eb9..8acaedeaa9 100644 --- a/hw/usb/hcd-ehci.c +++ b/hw/usb/hcd-ehci.c @@ -36,6 +36,7 @@ #include "qemu/error-report.h" #include "qemu/main-loop.h" #include "system/runstate.h" +#include "qemu/log.h" #define FRAME_TIMER_FREQ 1000 #define FRAME_TIMER_NS (NANOSECONDS_PER_SECOND / FRAME_TIMER_FREQ) @@ -425,7 +426,7 @@ static int ehci_get_pid(EHCIqtd *qtd) case 2: return USB_TOKEN_SETUP; default: - fprintf(stderr, "bad token\n"); + qemu_log_mask(LOG_GUEST_ERROR, "bad token\n"); return 0; } } @@ -532,7 +533,7 @@ static void ehci_free_packet(EHCIPacket *p) } if (p->async == EHCI_ASYNC_FINISHED && p->packet.status == USB_RET_SUCCESS) { - fprintf(stderr, + qemu_log_mask(LOG_GUEST_ERROR, "EHCI: Dropping completed packet from halted %s ep %02X\n", (p->pid == USB_TOKEN_IN) ? "in" : "out", get_field(p->queue->qh.epchar, QH_EPCHAR_EP)); @@ -1042,8 +1043,9 @@ static void ehci_opreg_write(void *ptr, hwaddr addr, /* not supporting dynamic frame list size at the moment */ if ((val & USBCMD_FLS) && !(s->usbcmd & USBCMD_FLS)) { - fprintf(stderr, "attempt to set frame list size -- value %d\n", - (int)val & USBCMD_FLS); + qemu_log_mask(LOG_GUEST_ERROR, + "attempt to set frame list size -- value %" PRId64 + "\n", val & USBCMD_FLS); val &= ~USBCMD_FLS; } @@ -1101,7 +1103,7 @@ static void ehci_opreg_write(void *ptr, hwaddr addr, case PERIODICLISTBASE: if (ehci_periodic_enabled(s)) { - fprintf(stderr, + qemu_log_mask(LOG_GUEST_ERROR, "ehci: PERIODIC list base register set while periodic schedule\n" " is enabled and HC is enabled\n"); } @@ -1109,7 +1111,7 @@ static void ehci_opreg_write(void *ptr, hwaddr addr, case ASYNCLISTADDR: if (ehci_async_enabled(s)) { - fprintf(stderr, + qemu_log_mask(LOG_GUEST_ERROR, "ehci: ASYNC list address register set while async schedule\n" " is enabled and HC is enabled\n"); } @@ -1200,7 +1202,7 @@ static int ehci_init_transfer(EHCIPacket *p) while (bytes > 0) { if (cpage > 4) { - fprintf(stderr, "cpage out of range (%u)\n", cpage); + qemu_log_mask(LOG_GUEST_ERROR, "cpage out of range (%u)\n", cpage); qemu_sglist_destroy(&p->sgl); return -1; } @@ -1306,7 +1308,8 @@ static void ehci_execute_complete(EHCIQueue *q) break; default: /* should not be triggerable */ - fprintf(stderr, "USB invalid response %d\n", p->packet.status); + qemu_log_mask(LOG_GUEST_ERROR, "USB invalid response %d\n", + p->packet.status); g_assert_not_reached(); } @@ -1354,7 +1357,7 @@ static int ehci_execute(EHCIPacket *p, const char *action) p->async == EHCI_ASYNC_INITIALIZED); if (!(p->qtd.token & QTD_TOKEN_ACTIVE)) { - fprintf(stderr, "Attempting to execute inactive qtd\n"); + qemu_log_mask(LOG_GUEST_ERROR, "Attempting to execute inactive qtd\n"); return -1; } @@ -1395,7 +1398,8 @@ static int ehci_execute(EHCIPacket *p, const char *action) p->packet.actual_length); if (p->packet.actual_length > BUFF_SIZE) { - fprintf(stderr, "ret from usb_handle_packet > BUFF_SIZE\n"); + qemu_log_mask(LOG_GUEST_ERROR, + "ret from usb_handle_packet > BUFF_SIZE\n"); return -1; } @@ -1479,8 +1483,9 @@ static int ehci_process_itd(EHCIState *ehci, case USB_RET_SUCCESS: break; default: - fprintf(stderr, "Unexpected iso usb result: %d\n", - ehci->ipacket.status); + qemu_log_mask(LOG_GUEST_ERROR, + "Unexpected iso usb result: %d\n", + ehci->ipacket.status); /* Fall through */ case USB_RET_IOERROR: case USB_RET_NODEV: @@ -1584,7 +1589,8 @@ static int ehci_state_fetchentry(EHCIState *ehci, int async) /* section 4.8, only QH in async schedule */ if (async && (NLPTR_TYPE_GET(entry) != NLPTR_TYPE_QH)) { - fprintf(stderr, "non queue head request in async schedule\n"); + qemu_log_mask(LOG_GUEST_ERROR, + "non queue head request in async schedule\n"); return -1; } @@ -1606,8 +1612,10 @@ static int ehci_state_fetchentry(EHCIState *ehci, int async) default: /* TODO: handle FSTN type */ - fprintf(stderr, "FETCHENTRY: entry at %X is of type %u " - "which is not supported yet\n", entry, NLPTR_TYPE_GET(entry)); + qemu_log_mask(LOG_GUEST_ERROR, + "FETCHENTRY: entry at 0x%x is of type %u " + "which is not supported yet\n", + entry, NLPTR_TYPE_GET(entry)); return -1; } @@ -2118,13 +2126,13 @@ static void ehci_advance_state(EHCIState *ehci, int async) break; default: - fprintf(stderr, "Bad state!\n"); g_assert_not_reached(); } if (again < 0 || itd_count > 16) { /* TODO: notify guest (raise HSE irq?) */ - fprintf(stderr, "processing error - resetting ehci HC\n"); + qemu_log_mask(LOG_GUEST_ERROR, + "processing error - resetting ehci HC\n"); ehci_reset(ehci); again = 0; } @@ -2181,8 +2189,6 @@ static void ehci_advance_async_state(EHCIState *ehci) default: /* this should only be due to a developer mistake */ - fprintf(stderr, "ehci: Bad asynchronous state %d. " - "Resetting to active\n", ehci->astate); g_assert_not_reached(); } } @@ -2231,8 +2237,6 @@ static void ehci_advance_periodic_state(EHCIState *ehci) default: /* this should only be due to a developer mistake */ - fprintf(stderr, "ehci: Bad periodic state %d. " - "Resetting to active\n", ehci->pstate); g_assert_not_reached(); } } From 6fc2655f706c7cc6252217eb157d9d2949a37877 Mon Sep 17 00:00:00 2001 From: Jamin Lin Date: Thu, 23 Apr 2026 07:18:13 +0200 Subject: [PATCH 54/62] hw/usb/hcd-ehci: Replace DPRINTF debug logs with trace events MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Replace legacy DPRINTF() debug logging in the EHCI host controller implementation with QEMU trace events. The EHCI_DEBUG macro and associated DPRINTF() definitions are removed as they are no longer needed. Trace events are added for: - packet submission and completion - queue head execution state - periodic schedule advancement - ITD error conditions - port state handling - skipped microframes No functional change. Signed-off-by: Jamin Lin Reviewed-by: Philippe Mathieu-Daudé Message-ID: <20260424080508.53992-7-jamin_lin@aspeedtech.com> Signed-off-by: Philippe Mathieu-Daudé --- hw/usb/hcd-ehci.c | 49 +++++++++++++++++++-------------------------- hw/usb/hcd-ehci.h | 10 --------- hw/usb/trace-events | 9 +++++++++ 3 files changed, 30 insertions(+), 38 deletions(-) diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c index 8acaedeaa9..28a60e4c1a 100644 --- a/hw/usb/hcd-ehci.c +++ b/hw/usb/hcd-ehci.c @@ -839,7 +839,7 @@ static USBDevice *ehci_find_device(EHCIState *ehci, uint8_t addr) for (i = 0; i < EHCI_PORTS; i++) { port = &ehci->ports[i]; if (!(ehci->portsc[i] & PORTSC_PED)) { - DPRINTF("Port %d not enabled\n", i); + trace_usb_ehci_port_disable(i); continue; } dev = usb_find_device(port, addr); @@ -1281,10 +1281,8 @@ static void ehci_execute_complete(EHCIQueue *q) assert(p->async == EHCI_ASYNC_INITIALIZED || p->async == EHCI_ASYNC_FINISHED); - DPRINTF("execute_complete: qhaddr 0x%x, next 0x%x, qtdaddr 0x%x, " - "status %d, actual_length %d\n", - q->qhaddr, q->qh.next, q->qtdaddr, - p->packet.status, p->packet.actual_length); + trace_usb_ehci_execute_complete(q->qhaddr, q->qh.next, q->qtdaddr, + p->packet.status, p->packet.actual_length); switch (p->packet.status) { case USB_RET_SUCCESS: @@ -1327,7 +1325,7 @@ static void ehci_execute_complete(EHCIQueue *q) } else { tbytes = 0; } - DPRINTF("updating tbytes to %d\n", tbytes); + trace_usb_ehci_qh_tbytes(tbytes); set_field(&q->qh.token, tbytes, QTD_TOKEN_TBYTES); ehci_finish_transfer(q, p->packet.actual_length); @@ -1392,10 +1390,9 @@ static int ehci_execute(EHCIPacket *p, const char *action) trace_usb_ehci_packet_action(p->queue, p, action); usb_handle_packet(p->queue->dev, &p->packet); - DPRINTF("submit: qh 0x%x next 0x%x qtd 0x%x pid 0x%x len %zd endp 0x%x " - "status %d actual_length %d\n", p->queue->qhaddr, p->qtd.next, - p->qtdaddr, p->pid, p->packet.iov.size, endp, p->packet.status, - p->packet.actual_length); + trace_usb_ehci_packet_submit(p->queue->qhaddr, p->qtd.next, p->qtdaddr, + p->pid, p->packet.iov.size, endp, + p->packet.status, p->packet.actual_length); if (p->packet.actual_length > BUFF_SIZE) { qemu_log_mask(LOG_GUEST_ERROR, @@ -1472,7 +1469,8 @@ static int ehci_process_itd(EHCIState *ehci, usb_handle_packet(dev, &ehci->ipacket); usb_packet_unmap(&ehci->ipacket, &ehci->isgl); } else { - DPRINTF("ISOCH: attempt to address non-iso endpoint\n"); + trace_usb_ehci_log("ISOCH: " + "attempt to address non-iso endpoint"); ehci->ipacket.status = USB_RET_NAK; ehci->ipacket.actual_length = 0; } @@ -1677,24 +1675,22 @@ static EHCIQueue *ehci_state_fetchqh(EHCIState *ehci, int async) if (ehci->usbsts & USBSTS_REC) { ehci_clear_usbsts(ehci, USBSTS_REC); } else { - DPRINTF("FETCHQH: QH 0x%08x. H-bit set, reclamation status reset" - " - done processing\n", q->qhaddr); + trace_usb_ehci_fetchqh_reclaim_done(q->qhaddr); ehci_set_state(ehci, async, EST_ACTIVE); q = NULL; goto out; } } -#if EHCI_DEBUG - if (q->qhaddr != q->qh.next) { - DPRINTF("FETCHQH: QH 0x%08x (h %x halt %x active %x) next 0x%08x\n", - q->qhaddr, - q->qh.epchar & QH_EPCHAR_H, - q->qh.token & QTD_TOKEN_HALT, - q->qh.token & QTD_TOKEN_ACTIVE, - q->qh.next); + if (trace_event_get_state_backends(TRACE_USB_EHCI_FETCHQH_DBG)) { + if (q->qhaddr != q->qh.next) { + trace_usb_ehci_fetchqh_dbg(q->qhaddr, + q->qh.epchar & QH_EPCHAR_H, + q->qh.token & QTD_TOKEN_HALT, + q->qh.token & QTD_TOKEN_ACTIVE, + q->qh.next); + } } -#endif if (q->qh.token & QTD_TOKEN_HALT) { ehci_set_state(ehci, async, EST_HORIZONTALQH); @@ -2161,7 +2157,7 @@ static void ehci_advance_async_state(EHCIState *ehci) /* make sure guest has acknowledged the doorbell interrupt */ /* TO-DO: is this really needed? */ if (ehci->usbsts & USBSTS_IAA) { - DPRINTF("IAA status bit still set.\n"); + trace_usb_ehci_log("IAA status bit still set."); break; } @@ -2226,9 +2222,7 @@ static void ehci_advance_periodic_state(EHCIState *ehci) if (get_dwords(ehci, list, &entry, 1) < 0) { break; } - - DPRINTF("PERIODIC state adv fr=%d. [%08X] -> %08X\n", - ehci->frindex / 8, list, entry); + trace_usb_ehci_periodic_state_advance(ehci->frindex / 8, list, entry); ehci_set_fetch_addr(ehci, async, entry); ehci_set_state(ehci, async, EST_FETCHENTRY); ehci_advance_state(ehci, async); @@ -2294,8 +2288,7 @@ static void ehci_work_bh(void *opaque) ehci_update_frindex(ehci, skipped_uframes); ehci->last_run_ns += UFRAME_TIMER_NS * skipped_uframes; uframes -= skipped_uframes; - DPRINTF("WARNING - EHCI skipped %"PRIu64" uframes\n", - skipped_uframes); + trace_usb_ehci_skipped_uframes(skipped_uframes); } for (i = 0; i < uframes; i++) { diff --git a/hw/usb/hcd-ehci.h b/hw/usb/hcd-ehci.h index 736407fd52..4234591cb4 100644 --- a/hw/usb/hcd-ehci.h +++ b/hw/usb/hcd-ehci.h @@ -24,16 +24,6 @@ #include "hw/pci/pci_device.h" #include "hw/core/sysbus.h" -#ifndef EHCI_DEBUG -#define EHCI_DEBUG 0 -#endif - -#if EHCI_DEBUG -#define DPRINTF printf -#else -#define DPRINTF(...) -#endif - #define MMIO_SIZE 0x1000 #define CAPA_SIZE 0x10 diff --git a/hw/usb/trace-events b/hw/usb/trace-events index dd04f14add..0d4318dcf1 100644 --- a/hw/usb/trace-events +++ b/hw/usb/trace-events @@ -89,6 +89,7 @@ usb_ehci_state(const char *schedule, const char *state) "%s schedule %s" usb_ehci_qh_ptrs(void *q, uint32_t addr, uint32_t nxt, uint32_t c_qtd, uint32_t n_qtd, uint32_t a_qtd) "q %p - QH @ 0x%08x: next 0x%08x qtds 0x%08x,0x%08x,0x%08x" usb_ehci_qh_fields(uint32_t addr, int rl, int mplen, int eps, int ep, int devaddr) "QH @ 0x%08x - rl %d, mplen %d, eps %d, ep %d, dev %d" usb_ehci_qh_bits(uint32_t addr, int c, int h, int dtc, int i) "QH @ 0x%08x - c %d, h %d, dtc %d, i %d" +usb_ehci_qh_tbytes(uint32_t tbytes) "updating tbytes to %d" usb_ehci_qtd_ptrs(void *q, uint32_t addr, uint32_t nxt, uint32_t altnext) "q %p - QTD @ 0x%08x: next 0x%08x altnext 0x%08x" usb_ehci_qtd_fields(uint32_t addr, int tbytes, int cpage, int cerr, int pid) "QTD @ 0x%08x - tbytes %d, cpage %d, cerr %d, pid %d" usb_ehci_qtd_bits(uint32_t addr, int ioc, int active, int halt, int babble, int xacterr) "QTD @ 0x%08x - ioc %d, active %d, halt %d, babble %d, xacterr %d" @@ -100,13 +101,21 @@ usb_ehci_port_reset(uint32_t port, int enable) "reset port #%d - %d" usb_ehci_port_suspend(uint32_t port) "port #%d" usb_ehci_port_wakeup(uint32_t port) "port #%d" usb_ehci_port_resume(uint32_t port) "port #%d" +usb_ehci_port_disable(uint32_t port) "port #%d" usb_ehci_queue_action(void *q, const char *action) "q %p: %s" usb_ehci_packet_action(void *q, void *p, const char *action) "q %p p %p: %s" +usb_ehci_packet_submit(uint32_t qhaddr, uint32_t next, uint32_t qtdaddr, int pid, size_t len, int endp, int status, int actual_length) "qh=0x%x, next=0x%x, qtd=0x%x, pid=0x%x, len=%zd, endp=0x%x, status=%d, actual_length=%d" usb_ehci_irq(uint32_t level, uint32_t frindex, uint32_t sts, uint32_t mask) "level %d, frindex 0x%04x, sts 0x%x, mask 0x%x" usb_ehci_guest_bug(const char *reason) "%s" usb_ehci_doorbell_ring(void) "" usb_ehci_doorbell_ack(void) "" usb_ehci_dma_error(void) "" +usb_ehci_execute_complete(uint32_t qhaddr, uint32_t next, uint32_t qtdaddr, int status, int actual_length) "qhaddr=0x%x, next=0x%x, qtdaddr=0x%x, status=%d, actual_length=%d" +usb_ehci_fetchqh_reclaim_done(uint32_t qhaddr) "QH 0x%08x H-bit set, reclamation status reset - done processing" +usb_ehci_fetchqh_dbg(uint32_t qhaddr, uint32_t h, uint32_t halt, uint32_t active, uint32_t next) "QH 0x%08x (h 0x%x halt 0x%x active 0x%x) next 0x%08x" +usb_ehci_periodic_state_advance(uint32_t frame, uint32_t list, uint32_t entry) "frame=%d, list=0x%x, entry=0x%x" +usb_ehci_skipped_uframes(uint64_t skipped_uframes) "skipped %" PRIu64 " uframes" +usb_ehci_log(const char *msg) "%s" # hcd-uhci.c usb_uhci_reset(void) "=== RESET ===" From 4a80a676571788eebc0965c1e74112986a742539 Mon Sep 17 00:00:00 2001 From: Jamin Lin Date: Thu, 23 Apr 2026 07:18:14 +0200 Subject: [PATCH 55/62] hw/usb/hcd-ehci: Introduce common properties macro for sysbus and pci MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit EHCI properties are currently defined separately in both sysbus and PCI implementations, leading to duplicated code for common fields such as "maxframes". Introduce DEFINE_EHCI_COMMON_PROPERTIES() to consolidate shared property definitions and reuse them across both EHCISysBusState and EHCIPCIState. This reduces code duplication and keeps property definitions consistent between different EHCI device variants. No functional change. Signed-off-by: Jamin Lin Reviewed-by: Philippe Mathieu-Daudé Message-ID: <20260424080508.53992-8-jamin_lin@aspeedtech.com> Signed-off-by: Philippe Mathieu-Daudé --- hw/usb/hcd-ehci-pci.c | 2 +- hw/usb/hcd-ehci-sysbus.c | 2 +- hw/usb/hcd-ehci.h | 3 +++ 3 files changed, 5 insertions(+), 2 deletions(-) diff --git a/hw/usb/hcd-ehci-pci.c b/hw/usb/hcd-ehci-pci.c index 9febcc1031..fd35d25340 100644 --- a/hw/usb/hcd-ehci-pci.c +++ b/hw/usb/hcd-ehci-pci.c @@ -136,7 +136,7 @@ static void usb_ehci_pci_write_config(PCIDevice *dev, uint32_t addr, } static const Property ehci_pci_properties[] = { - DEFINE_PROP_UINT32("maxframes", EHCIPCIState, ehci.maxframes, 128), + DEFINE_EHCI_COMMON_PROPERTIES(EHCIPCIState), }; static const VMStateDescription vmstate_ehci_pci = { diff --git a/hw/usb/hcd-ehci-sysbus.c b/hw/usb/hcd-ehci-sysbus.c index b31032bbf3..7f7c7f8a2f 100644 --- a/hw/usb/hcd-ehci-sysbus.c +++ b/hw/usb/hcd-ehci-sysbus.c @@ -31,7 +31,7 @@ static const VMStateDescription vmstate_ehci_sysbus = { }; static const Property ehci_sysbus_properties[] = { - DEFINE_PROP_UINT32("maxframes", EHCISysBusState, ehci.maxframes, 128), + DEFINE_EHCI_COMMON_PROPERTIES(EHCISysBusState), DEFINE_PROP_BOOL("companion-enable", EHCISysBusState, ehci.companion_enable, false), }; diff --git a/hw/usb/hcd-ehci.h b/hw/usb/hcd-ehci.h index 4234591cb4..d038ee1e31 100644 --- a/hw/usb/hcd-ehci.h +++ b/hw/usb/hcd-ehci.h @@ -307,6 +307,9 @@ struct EHCIState { VMChangeStateEntry *vmstate; }; +#define DEFINE_EHCI_COMMON_PROPERTIES(_state) \ + DEFINE_PROP_UINT32("maxframes", _state, ehci.maxframes, 128) + extern const VMStateDescription vmstate_ehci; void usb_ehci_init(EHCIState *s, DeviceState *dev); From 707b019ab07e7981fbd02737a0afe9c73b84c104 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Fri, 17 Apr 2026 12:26:22 +0200 Subject: [PATCH 56/62] MAINTAINERS: Merge PCIe DOE section within SPDM MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit SPDM depends on PCIe DOE, so it makes sense to cover these files there. Cover the spdm.rst document. Add Tao Tang who volunteered to be designated reviewer: https://lore.kernel.org/qemu-devel/44abaece-6a6f-43c6-b29a-53d6eb08033c@phytium.com.cn/ Cc: Tao Tang Cc: Jonathan Cameron Signed-off-by: Philippe Mathieu-Daudé Reviewed-by: Gustavo Romero Reviewed-by: Alistair Francis Message-Id: <20260422080406.62638-6-philmd@linaro.org> --- MAINTAINERS | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/MAINTAINERS b/MAINTAINERS index 45d258f64f..d454b0b15c 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -2150,11 +2150,6 @@ F: docs/pci* F: docs/specs/*pci* F: docs/system/sriov.rst -PCIE DOE -S: Orphan -F: include/hw/pci/pcie_doe.h -F: hw/pci/pcie_doe.c - ARM PCI Hotplug M: Gustavo Romero L: qemu-arm@nongnu.org @@ -3694,11 +3689,15 @@ F: tests/qtest/*tpm* F: docs/specs/tpm.rst T: git https://github.com/stefanberger/qemu-tpm.git tpm-next -SPDM +SPDM, PCIe DOE M: Alistair Francis +R: Tao Tang S: Maintained F: backends/spdm-socket.c F: include/system/spdm-socket.h +F: include/hw/pci/pcie_doe.h +F: hw/pci/pcie_doe.c +F: docs/specs/spdm.rst Checkpatch S: Odd Fixes From 40a8d6cb6cbe24cf7716fa5830a77cb5fc8388c5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Fri, 17 Apr 2026 12:29:13 +0200 Subject: [PATCH 57/62] MAINTAINERS: Cover hexloader tests under the Generic Loader section MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Drop the orphan 'Intel Hexadecimal Object File Loader' section but keep the tests covered under the Generic Loader section, since both loader.c and generic-loader.c calls load_targphys_hex_as(). Signed-off-by: Philippe Mathieu-Daudé Reviewed-by: Alistair Francis Message-Id: <20260422080406.62638-7-philmd@linaro.org> --- MAINTAINERS | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/MAINTAINERS b/MAINTAINERS index d454b0b15c..5d2d58b332 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -2701,6 +2701,8 @@ F: hw/core/generic-loader.c F: hw/core/uboot_image.h F: include/hw/core/generic-loader.h F: docs/system/generic-loader.rst +F: tests/qtest/hexloader-test.c +F: tests/data/hex-loader/test.hex Guest Loader M: Alex Bennée @@ -2709,11 +2711,6 @@ F: hw/core/guest-loader.c F: docs/system/guest-loader.rst F: tests/functional/aarch64/test_xen.py -Intel Hexadecimal Object File Loader -S: Orphan -F: tests/qtest/hexloader-test.c -F: tests/data/hex-loader/test.hex - CHRP NVRAM M: Mark Cave-Ayland S: Maintained From a7f68df5b5735903ec971b230de8918d2d3b75e8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Wed, 22 Apr 2026 09:33:05 +0200 Subject: [PATCH 58/62] MAINTAINERS: Remove my unused git tree locations MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit I haven't used these for years. And as explained in [*] QEMU development workflow doesn't leverage subsystem's git trees. Remove them. [*] https://lore.kernel.org/qemu-devel/CAFEAcA9xCN6XMUFmZ_QAn617W14FAzi4D_H1mgSER10otTtQMQ@mail.gmail.com/ Signed-off-by: Philippe Mathieu-Daudé Reviewed-by: Thomas Huth Message-Id: <20260422080406.62638-2-philmd@linaro.org> --- MAINTAINERS | 2 -- 1 file changed, 2 deletions(-) diff --git a/MAINTAINERS b/MAINTAINERS index 5d2d58b332..2ce0f3cc68 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -2251,7 +2251,6 @@ T: git https://github.com/jasowang/qemu.git net Parallel NOR Flash devices M: Philippe Mathieu-Daudé -T: git https://gitlab.com/philmd/qemu.git pflash-next S: Maintained F: hw/block/pflash_cfi*.c F: include/hw/block/flash.h @@ -2847,7 +2846,6 @@ F: include/hw/nvram/fw_cfg.h F: include/standard-headers/linux/qemu_fw_cfg.h F: tests/qtest/libqos/fw_cfg.c F: tests/qtest/fw_cfg-test.c -T: git https://github.com/philmd/qemu.git fw_cfg-next XIVE R: Gautam Menghani From e202c1ffa1b1b6887fd06ff57ff67dd4601b1bf4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Wed, 22 Apr 2026 09:26:59 +0200 Subject: [PATCH 59/62] MAINTAINERS: Remove my disfunctional emails MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit With retrospective, mentioning email in authorship wasn't really useful, more now than these addresses are dead: - f4bug@amsat.org - philmd@redhat.com Simply remove them. Signed-off-by: Philippe Mathieu-Daudé Reviewed-by: Thomas Huth Acked-by: Michael S. Tsirkin Message-Id: <20260422080406.62638-3-philmd@linaro.org> --- crypto/tls-cipher-suites.c | 2 +- hw/i386/fw_cfg.c | 2 +- hw/i386/pc_sysfw_ovmf-stubs.c | 2 +- hw/misc/bcm2835_thermal.c | 2 +- hw/misc/led.c | 2 +- hw/ppc/fw_cfg.c | 2 +- hw/sd/sd.c | 2 +- hw/sd/sdmmc-internal.h | 2 +- hw/timer/bcm2835_systmr.c | 2 +- hw/usb/bus-stub.c | 2 +- include/crypto/tls-cipher-suites.h | 2 +- include/hw/i2c/arm_sbcon_i2c.h | 2 +- include/hw/misc/bcm2835_thermal.h | 2 +- include/hw/misc/led.h | 2 +- include/hw/timer/bcm2835_systmr.h | 2 +- include/qemu/units.h | 2 +- stubs/fw_cfg.c | 2 +- stubs/hotplug-stubs.c | 2 +- stubs/qdev.c | 2 +- tests/functional/aarch64/test_raspi3.py | 2 +- tests/functional/arm/test_bflt.py | 2 +- tests/functional/arm/test_raspi2.py | 2 +- tests/functional/m68k/test_nextcube.py | 2 +- tests/functional/mips/test_malta.py | 2 +- tests/functional/mips64el/test_fuloong2e.py | 2 +- tests/functional/mips64el/test_malta.py | 2 +- tests/functional/mipsel/test_malta.py | 2 +- tests/functional/ppc/test_40p.py | 2 +- tests/functional/qemu_test/tesseract.py | 2 +- tests/qtest/fuzz-sb16-test.c | 2 +- tests/qtest/fuzz-sdcard-test.c | 2 +- tests/qtest/sdhci-test.c | 2 +- 32 files changed, 32 insertions(+), 32 deletions(-) diff --git a/crypto/tls-cipher-suites.c b/crypto/tls-cipher-suites.c index d9b61d0c08..a6566f13c9 100644 --- a/crypto/tls-cipher-suites.c +++ b/crypto/tls-cipher-suites.c @@ -3,7 +3,7 @@ * * Copyright (c) 2018-2020 Red Hat, Inc. * - * Author: Philippe Mathieu-Daudé + * Author: Philippe Mathieu-Daudé * * SPDX-License-Identifier: GPL-2.0-or-later */ diff --git a/hw/i386/fw_cfg.c b/hw/i386/fw_cfg.c index 5670e8553e..858e6ca9c5 100644 --- a/hw/i386/fw_cfg.c +++ b/hw/i386/fw_cfg.c @@ -4,7 +4,7 @@ * Copyright (c) 2019 Red Hat, Inc. * * Author: - * Philippe Mathieu-Daudé + * Philippe Mathieu-Daudé * * SPDX-License-Identifier: GPL-2.0-or-later * diff --git a/hw/i386/pc_sysfw_ovmf-stubs.c b/hw/i386/pc_sysfw_ovmf-stubs.c index b53906a052..42e300ddec 100644 --- a/hw/i386/pc_sysfw_ovmf-stubs.c +++ b/hw/i386/pc_sysfw_ovmf-stubs.c @@ -4,7 +4,7 @@ * Copyright (c) 2021 Red Hat, Inc. * * Author: - * Philippe Mathieu-Daudé + * Philippe Mathieu-Daudé * * SPDX-License-Identifier: GPL-2.0-or-later * diff --git a/hw/misc/bcm2835_thermal.c b/hw/misc/bcm2835_thermal.c index 0dc1be15b4..413c4179fe 100644 --- a/hw/misc/bcm2835_thermal.c +++ b/hw/misc/bcm2835_thermal.c @@ -1,7 +1,7 @@ /* * BCM2835 dummy thermal sensor * - * Copyright (C) 2019 Philippe Mathieu-Daudé + * Copyright (C) 2019 Philippe Mathieu-Daudé * * SPDX-License-Identifier: GPL-2.0-or-later */ diff --git a/hw/misc/led.c b/hw/misc/led.c index d9256aaaf5..8b758c1b76 100644 --- a/hw/misc/led.c +++ b/hw/misc/led.c @@ -1,7 +1,7 @@ /* * QEMU single LED device * - * Copyright (C) 2020 Philippe Mathieu-Daudé + * Copyright (C) 2020 Philippe Mathieu-Daudé * * SPDX-License-Identifier: GPL-2.0-or-later */ diff --git a/hw/ppc/fw_cfg.c b/hw/ppc/fw_cfg.c index a88b5c4bde..071cf855c2 100644 --- a/hw/ppc/fw_cfg.c +++ b/hw/ppc/fw_cfg.c @@ -4,7 +4,7 @@ * Copyright (c) 2019 Red Hat, Inc. * * Author: - * Philippe Mathieu-Daudé + * Philippe Mathieu-Daudé * * SPDX-License-Identifier: GPL-2.0-or-later * diff --git a/hw/sd/sd.c b/hw/sd/sd.c index 37f6e0702b..58275e7fa1 100644 --- a/hw/sd/sd.c +++ b/hw/sd/sd.c @@ -6,7 +6,7 @@ * * Copyright (c) 2006 Andrzej Zaborowski * Copyright (c) 2007 CodeSourcery - * Copyright (c) 2018 Philippe Mathieu-Daudé + * Copyright (c) 2018 Philippe Mathieu-Daudé * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions diff --git a/hw/sd/sdmmc-internal.h b/hw/sd/sdmmc-internal.h index c115f472ef..f9282a9712 100644 --- a/hw/sd/sdmmc-internal.h +++ b/hw/sd/sdmmc-internal.h @@ -1,7 +1,7 @@ /* * SD/MMC cards common * - * Copyright (c) 2018 Philippe Mathieu-Daudé + * Copyright (c) 2018 Philippe Mathieu-Daudé * * This work is licensed under the terms of the GNU GPL, version 2 or later. * See the COPYING file in the top-level directory. diff --git a/hw/timer/bcm2835_systmr.c b/hw/timer/bcm2835_systmr.c index 00bcfcd05c..06a919b1f8 100644 --- a/hw/timer/bcm2835_systmr.c +++ b/hw/timer/bcm2835_systmr.c @@ -1,7 +1,7 @@ /* * BCM2835 SYS timer emulation * - * Copyright (C) 2019 Philippe Mathieu-Daudé + * Copyright (C) 2019 Philippe Mathieu-Daudé * * SPDX-License-Identifier: GPL-2.0-or-later * diff --git a/hw/usb/bus-stub.c b/hw/usb/bus-stub.c index a7c3909e96..7cf1b49411 100644 --- a/hw/usb/bus-stub.c +++ b/hw/usb/bus-stub.c @@ -1,7 +1,7 @@ /* * QEMU USB device emulation stubs * - * Copyright (C) 2021 Philippe Mathieu-Daudé + * Copyright (C) 2021 Philippe Mathieu-Daudé * * SPDX-License-Identifier: GPL-2.0-or-later */ diff --git a/include/crypto/tls-cipher-suites.h b/include/crypto/tls-cipher-suites.h index 3bd2003f32..31697a7d6d 100644 --- a/include/crypto/tls-cipher-suites.h +++ b/include/crypto/tls-cipher-suites.h @@ -3,7 +3,7 @@ * * Copyright (c) 2018-2020 Red Hat, Inc. * - * Author: Philippe Mathieu-Daudé + * Author: Philippe Mathieu-Daudé * * SPDX-License-Identifier: GPL-2.0-or-later */ diff --git a/include/hw/i2c/arm_sbcon_i2c.h b/include/hw/i2c/arm_sbcon_i2c.h index 39b99f57bf..537de428e1 100644 --- a/include/hw/i2c/arm_sbcon_i2c.h +++ b/include/hw/i2c/arm_sbcon_i2c.h @@ -5,7 +5,7 @@ * * Copyright (c) 2006-2007 CodeSourcery. * Copyright (c) 2012 Oskar Andero - * Copyright (C) 2020 Philippe Mathieu-Daudé + * Copyright (C) 2020 Philippe Mathieu-Daudé * * SPDX-License-Identifier: GPL-2.0-or-later */ diff --git a/include/hw/misc/bcm2835_thermal.h b/include/hw/misc/bcm2835_thermal.h index 13ffc61c1a..04eda5cb83 100644 --- a/include/hw/misc/bcm2835_thermal.h +++ b/include/hw/misc/bcm2835_thermal.h @@ -1,7 +1,7 @@ /* * BCM2835 dummy thermal sensor * - * Copyright (C) 2019 Philippe Mathieu-Daudé + * Copyright (C) 2019 Philippe Mathieu-Daudé * * SPDX-License-Identifier: GPL-2.0-or-later */ diff --git a/include/hw/misc/led.h b/include/hw/misc/led.h index 4d077a7c43..89ccbad466 100644 --- a/include/hw/misc/led.h +++ b/include/hw/misc/led.h @@ -1,7 +1,7 @@ /* * QEMU single LED device * - * Copyright (C) 2020 Philippe Mathieu-Daudé + * Copyright (C) 2020 Philippe Mathieu-Daudé * * SPDX-License-Identifier: GPL-2.0-or-later */ diff --git a/include/hw/timer/bcm2835_systmr.h b/include/hw/timer/bcm2835_systmr.h index 0674a18f12..770e464937 100644 --- a/include/hw/timer/bcm2835_systmr.h +++ b/include/hw/timer/bcm2835_systmr.h @@ -1,7 +1,7 @@ /* * BCM2835 SYS timer emulation * - * Copyright (c) 2019 Philippe Mathieu-Daudé + * Copyright (c) 2019 Philippe Mathieu-Daudé * * SPDX-License-Identifier: GPL-2.0-or-later */ diff --git a/include/qemu/units.h b/include/qemu/units.h index 692db3fbb2..4764e301e5 100644 --- a/include/qemu/units.h +++ b/include/qemu/units.h @@ -2,7 +2,7 @@ * IEC binary prefixes definitions * * Copyright (C) 2015 Nikunj A Dadhania, IBM Corporation - * Copyright (C) 2018 Philippe Mathieu-Daudé + * Copyright (C) 2018 Philippe Mathieu-Daudé * * SPDX-License-Identifier: GPL-2.0-or-later */ diff --git a/stubs/fw_cfg.c b/stubs/fw_cfg.c index bb1e3c8aa9..e7a9f714f3 100644 --- a/stubs/fw_cfg.c +++ b/stubs/fw_cfg.c @@ -4,7 +4,7 @@ * Copyright (c) 2019 Red Hat, Inc. * * Author: - * Philippe Mathieu-Daudé + * Philippe Mathieu-Daudé * * SPDX-License-Identifier: GPL-2.0-or-later * diff --git a/stubs/hotplug-stubs.c b/stubs/hotplug-stubs.c index 23a1678dbb..0f592ee139 100644 --- a/stubs/hotplug-stubs.c +++ b/stubs/hotplug-stubs.c @@ -4,7 +4,7 @@ * Copyright (c) Red Hat * * Authors: - * Philippe Mathieu-Daudé , + * Philippe Mathieu-Daudé, * * SPDX-License-Identifier: GPL-2.0-or-later * diff --git a/stubs/qdev.c b/stubs/qdev.c index 7e957b3e52..61596de5f8 100644 --- a/stubs/qdev.c +++ b/stubs/qdev.c @@ -4,7 +4,7 @@ * Copyright (c) 2021 Red Hat, Inc. * * Author: - * Philippe Mathieu-Daudé + * Philippe Mathieu-Daudé * * SPDX-License-Identifier: GPL-2.0-or-later * diff --git a/tests/functional/aarch64/test_raspi3.py b/tests/functional/aarch64/test_raspi3.py index 74f6630ed2..ae9eed3589 100755 --- a/tests/functional/aarch64/test_raspi3.py +++ b/tests/functional/aarch64/test_raspi3.py @@ -3,7 +3,7 @@ # Functional test that boots a Linux kernel on a Raspberry Pi machine # and checks the console # -# Copyright (c) 2020 Philippe Mathieu-Daudé +# Copyright (c) 2020 Philippe Mathieu-Daudé # # SPDX-License-Identifier: GPL-2.0-or-later diff --git a/tests/functional/arm/test_bflt.py b/tests/functional/arm/test_bflt.py index f273fc8354..835a3354a0 100755 --- a/tests/functional/arm/test_bflt.py +++ b/tests/functional/arm/test_bflt.py @@ -2,7 +2,7 @@ # # Test the bFLT loader format # -# Copyright (C) 2019 Philippe Mathieu-Daudé +# Copyright (C) 2019 Philippe Mathieu-Daudé # # SPDX-License-Identifier: GPL-2.0-or-later diff --git a/tests/functional/arm/test_raspi2.py b/tests/functional/arm/test_raspi2.py index d3c7aaa39b..fe644f04cf 100755 --- a/tests/functional/arm/test_raspi2.py +++ b/tests/functional/arm/test_raspi2.py @@ -3,7 +3,7 @@ # Functional test that boots a Linux kernel on a Raspberry Pi machine # and checks the console # -# Copyright (c) 2019 Philippe Mathieu-Daudé +# Copyright (c) 2019 Philippe Mathieu-Daudé # # SPDX-License-Identifier: GPL-2.0-or-later diff --git a/tests/functional/m68k/test_nextcube.py b/tests/functional/m68k/test_nextcube.py index 71c160d026..d917cf5424 100755 --- a/tests/functional/m68k/test_nextcube.py +++ b/tests/functional/m68k/test_nextcube.py @@ -2,7 +2,7 @@ # # Functional test that boots a VM and run OCR on the framebuffer # -# Copyright (c) 2019 Philippe Mathieu-Daudé +# Copyright (c) 2019 Philippe Mathieu-Daudé # # This work is licensed under the terms of the GNU GPL, version 2 or # later. See the COPYING file in the top-level directory. diff --git a/tests/functional/mips/test_malta.py b/tests/functional/mips/test_malta.py index e8f49f130b..7048d91a9f 100755 --- a/tests/functional/mips/test_malta.py +++ b/tests/functional/mips/test_malta.py @@ -2,7 +2,7 @@ # # Functional tests for the big-endian 32-bit MIPS Malta board # -# Copyright (c) Philippe Mathieu-Daudé +# Copyright (c) Philippe Mathieu-Daudé # # SPDX-License-Identifier: GPL-2.0-or-later diff --git a/tests/functional/mips64el/test_fuloong2e.py b/tests/functional/mips64el/test_fuloong2e.py index 35e500b022..d449e3c39a 100755 --- a/tests/functional/mips64el/test_fuloong2e.py +++ b/tests/functional/mips64el/test_fuloong2e.py @@ -2,7 +2,7 @@ # # Functional tests for the Lemote Fuloong-2E machine. # -# Copyright (c) 2019 Philippe Mathieu-Daudé +# Copyright (c) 2019 Philippe Mathieu-Daudé # # This work is licensed under the terms of the GNU GPL, version 2 or later. # See the COPYING file in the top-level directory. diff --git a/tests/functional/mips64el/test_malta.py b/tests/functional/mips64el/test_malta.py index bc750cb7ad..163bbaf5ca 100755 --- a/tests/functional/mips64el/test_malta.py +++ b/tests/functional/mips64el/test_malta.py @@ -2,7 +2,7 @@ # # Functional tests for the little-endian 64-bit MIPS Malta board # -# Copyright (c) Philippe Mathieu-Daudé +# Copyright (c) Philippe Mathieu-Daudé # # This work is licensed under the terms of the GNU GPL, version 2 or later. # See the COPYING file in the top-level directory. diff --git a/tests/functional/mipsel/test_malta.py b/tests/functional/mipsel/test_malta.py index 59ab4a6058..25bcb33c94 100755 --- a/tests/functional/mipsel/test_malta.py +++ b/tests/functional/mipsel/test_malta.py @@ -2,7 +2,7 @@ # # Functional tests for the little-endian 32-bit MIPS Malta board # -# Copyright (c) Philippe Mathieu-Daudé +# Copyright (c) Philippe Mathieu-Daudé # # This work is licensed under the terms of the GNU GPL, version 2 or later. # See the COPYING file in the top-level directory. diff --git a/tests/functional/ppc/test_40p.py b/tests/functional/ppc/test_40p.py index ed272147f6..4c1c9bad6e 100755 --- a/tests/functional/ppc/test_40p.py +++ b/tests/functional/ppc/test_40p.py @@ -2,7 +2,7 @@ # # Functional test that boots a PReP/40p machine and checks its serial console. # -# Copyright (c) Philippe Mathieu-Daudé +# Copyright (c) Philippe Mathieu-Daudé # # This work is licensed under the terms of the GNU GPL, version 2 or # later. See the COPYING file in the top-level directory. diff --git a/tests/functional/qemu_test/tesseract.py b/tests/functional/qemu_test/tesseract.py index ede6c6501e..862faec2d2 100644 --- a/tests/functional/qemu_test/tesseract.py +++ b/tests/functional/qemu_test/tesseract.py @@ -1,6 +1,6 @@ # ... # -# Copyright (c) 2019 Philippe Mathieu-Daudé +# Copyright (c) 2019 Philippe Mathieu-Daudé # # This work is licensed under the terms of the GNU GPL, version 2 or # later. See the COPYING file in the top-level directory. diff --git a/tests/qtest/fuzz-sb16-test.c b/tests/qtest/fuzz-sb16-test.c index fc445b1871..9995ad8868 100644 --- a/tests/qtest/fuzz-sb16-test.c +++ b/tests/qtest/fuzz-sb16-test.c @@ -1,7 +1,7 @@ /* * QTest fuzzer-generated testcase for sb16 audio device * - * Copyright (c) 2021 Philippe Mathieu-Daudé + * Copyright (c) 2021 Philippe Mathieu-Daudé * * SPDX-License-Identifier: GPL-2.0-or-later */ diff --git a/tests/qtest/fuzz-sdcard-test.c b/tests/qtest/fuzz-sdcard-test.c index cd134cdf55..6d8be9d119 100644 --- a/tests/qtest/fuzz-sdcard-test.c +++ b/tests/qtest/fuzz-sdcard-test.c @@ -1,7 +1,7 @@ /* * QTest fuzzer-generated testcase for sdcard device * - * Copyright (c) 2021 Philippe Mathieu-Daudé + * Copyright (c) 2021 Philippe Mathieu-Daudé * * SPDX-License-Identifier: GPL-2.0-or-later */ diff --git a/tests/qtest/sdhci-test.c b/tests/qtest/sdhci-test.c index 7b32711c8f..cde132228e 100644 --- a/tests/qtest/sdhci-test.c +++ b/tests/qtest/sdhci-test.c @@ -1,7 +1,7 @@ /* * QTest testcase for SDHCI controllers * - * Written by Philippe Mathieu-Daudé + * Written by Philippe Mathieu-Daudé * * This work is licensed under the terms of the GNU GPL, version 2 or later. * See the COPYING file in the top-level directory. From 396be0b1d2492833008302bf5bb4059aad304652 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Fri, 17 Apr 2026 12:38:24 +0200 Subject: [PATCH 60/62] MAINTAINERS: Remove PhilMD from NVMe Block Driver MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit I'm not following this code anymore, no need to be listed as reviewer. My gratitude to Stefan for everything he taught me while supervising this topic. I truly appreciate the time he spent helping me in many occasions. Thank you very much Stefan! Signed-off-by: Philippe Mathieu-Daudé Reviewed-by: Stefan Hajnoczi Message-Id: <20260422080406.62638-8-philmd@linaro.org> --- MAINTAINERS | 1 - 1 file changed, 1 deletion(-) diff --git a/MAINTAINERS b/MAINTAINERS index 2ce0f3cc68..0c5f22ce30 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -4226,7 +4226,6 @@ F: block/null.c NVMe Block Driver M: Stefan Hajnoczi R: Fam Zheng -R: Philippe Mathieu-Daudé L: qemu-block@nongnu.org S: Supported F: block/nvme* From f2d3479bedf4509cd4962bdaded1244d6057e9f2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Fri, 17 Apr 2026 12:22:36 +0200 Subject: [PATCH 61/62] MAINTAINERS: Maintain MIPS Boston MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Maintain the Boston board as just another MIPS board. Signed-off-by: Philippe Mathieu-Daudé Reviewed-by: Thomas Huth Message-Id: <20260422080406.62638-4-philmd@linaro.org> --- MAINTAINERS | 1 + 1 file changed, 1 insertion(+) diff --git a/MAINTAINERS b/MAINTAINERS index 0c5f22ce30..16ed276b37 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -1486,6 +1486,7 @@ F: include/hw/intc/loongson_liointc.h F: tests/functional/mips64el/test_loongson3v.py Boston +M: Philippe Mathieu-Daudé R: Aleksandar Rikalo S: Odd Fixes F: hw/core/loader-fit.c From 128f4f11666b431aedea59d2d517dd09e51927c7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Fri, 17 Apr 2026 12:38:45 +0200 Subject: [PATCH 62/62] MAINTAINERS: Transfer CI maintenance to Pierrick MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Pass the torch to Pierrick who does much better and useful work in this area: https://github.com/p-b-o/qemu-ci Remove me from custom runner files since I don't have contact with OSUOSL or IBM. Cc: Alex Bennée Signed-off-by: Philippe Mathieu-Daudé Reviewed-by: Pierrick Bouvier Reviewed-by: Thomas Huth Message-Id: <20260422080406.62638-11-philmd@linaro.org> --- MAINTAINERS | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/MAINTAINERS b/MAINTAINERS index 16ed276b37..35529266a2 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -4448,7 +4448,7 @@ Build and test automation Build and test automation, general continuous integration M: Alex Bennée T: git https://gitlab.com/stsquad/qemu testing/next -M: Philippe Mathieu-Daudé +M: Pierrick Bouvier S: Maintained F: .github/workflows/lockdown.yml F: .gitlab-ci.yml @@ -4493,13 +4493,11 @@ F: .gitlab-ci.d/windows.yml Guest Test Compilation Support M: Alex Bennée -R: Philippe Mathieu-Daudé S: Maintained F: tests/tcg/Makefile.target GitLab custom runners (HW sponsored by Linaro, OSUOSL and IBM) M: Alex Bennée -M: Philippe Mathieu-Daudé S: Maintained F: .gitlab-ci.d/custom-runners/ubuntu-24.04-aarch64.yml F: .gitlab-ci.d/custom-runners/ubuntu-24.04-s390x.yml @@ -4534,6 +4532,7 @@ M: Paolo Bonzini R: Marc-André Lureau R: Daniel P. Berrange R: Philippe Mathieu-Daudé +R: Pierrick Bouvier S: Maintained F: meson.build F: meson_options.txt