qemu/qemu.git/include, branch master

Merge tag 'firmware-20260704-pull-request' of https://gitlab.com/kraxel/qemu into staging

2026-07-05T06:42:47+00:00

igvm: add device tree support # -----BEGIN PGP SIGNATURE----- # # iQIzBAABCgAdFiEEoDKM/7k6F6eZAf59TLbY7tPocTgFAmpIkaMACgkQTLbY7tPo # cTg4NA/8CB9HEZG6kKV1fh/7N5ev0iL5S1K3HCxKYcHoyMfkkhDvORSa5oF8gYoP # HiJC4D+8X+523YFOzvxsaRgTC0J6iRucktIz2PNHBpy7npcQpiRjI1l9Z4FPEH0b # iPSuKgpliOYIUi/ckeTKK4q2GwYsxIaLhu/uGsEr10cCf62JkXigkc5t1ZXa/ggv # HYBVNE9HM6CG6SWQKEqrfuSYex8Xa4+x/euzsAgDkuEBfYykHt4duDD1iObEJ6Cy # 3UXodgkcLrnz5baWbtTNjmVRsQfyjtD7/kfo4yPNvzC80UIjdvxg4COXF6YxId5P # gDBWl8bY9rqYah8zQ4QzxbVZ7HWJDCILLWc0O2Mlw70KdUQ7g5JA1Gjf6Ms5YgB6 # PEH+rJ9ir09MJ9Z7AWRo3Ry91opDGrKUos2maQHdf8AADV9afmJVQ1frnDgUjF/3 # PXZVVCSpVoLBP5GLT+2l60qFYzJPqd/HsK5cWGaZEJyfvejrZjEVI6l9FliQFJ9l # HiLEo2yhWVtRzruy7Uv16tU42xODmDMBKU12HZfQLvYbKUaBf24YpLiBprEzUM72 # snXGhZX7wQl6ghQ7mxdLncECRRvFwuknZPeLBPWyp6rm5IuTvxkhRtgCHS4RFYbr # 7NDjzJ3/gg9YXy3z0cJjRkaBfJvwdYTUTpuq0yDVOfNL53L0jbA= # =7c95 # -----END PGP SIGNATURE----- # gpg: Signature made Sat 04 Jul 2026 06:52:51 CEST # gpg: using RSA key A0328CFFB93A17A79901FE7D4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) " [full] # gpg: aka "Gerd Hoffmann " [full] # gpg: aka "Gerd Hoffmann (private) " [full] # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * tag 'firmware-20260704-pull-request' of https://gitlab.com/kraxel/qemu: igvm: add device tree parameter support igvm: use idiomatic meson conditional for IGVM build files igvm: Report error on missing parameter area in directive handlers Signed-off-by: Stefan Hajnoczi

Merge tag 'pull-qobject-2026-07-02' of https://repo.or.cz/qemu/armbru into staging

2026-07-03T05:42:51+00:00

QObject patches for 2026-07-02 # -----BEGIN PGP SIGNATURE----- # # iQJGBAABCgAwFiEENUvIs9frKmtoZ05fOHC0AOuRhlMFAmpGUpgSHGFybWJydUBy # ZWRoYXQuY29tAAoJEDhwtADrkYZTA3wP/jXwy30ND7OQE5HErDKp4priCm9cMPcR # 30FxOS+E9bAT6KCDmnUqRVELebGn0x3gz9MXWO8qQcU4MHneN4M/42Dh/oa1t+xd # Zva2rIfVW1FHPvzEfsKsUFPq1LaY+uM9XW2DdEjyv11RoMZwVHiWseURXwB2HNLH # HNfxBOlGa8VTvI5kpRafN+DNRjeMEWcIXqZRHr51GeFfc6av0CTUYM2xdwRQTw3m # GQGDvLIllxb9STwnSKieBdkCpBGSwffcjJipt7VmvORYNsi3pcJgAhWFzM9UWqPp # ZENwziphyd/4XLAC4EaMlXnXlAzLJh+H7+th6Ylirkjo1sULO9cCFbYcANqljLdT # GIIafRoe4zuZp1gFPgT51nA53Adzd1TWCT462R1uzbVJxoEdthsYVB7WMamBJySA # MuuMjq4JVeROBgDbO/X7+EnzmI0torT24XpFxFjfBGb9zSnG7YRzSSf8sDQIwir+ # tlh0e6LzsVJckJ0IUAjglLKb49QUnmzrSx8+6LCH0iFMkHWwXdtd5Vyk5SofIXIy # Dc6t2qH8USkOjwgs5vKdr9m8LEv2iELegpanmZDTd+zIEFR1WP1SRiirmkoD7QJY # 0zK3gabC5uUpcfKx6EE2UXWpFW/tVDjMUN43QoL48/pVDuYUcqXJ8y2DEqjHV4Sd # O5wd3ZOFdvVc # =jshD # -----END PGP SIGNATURE----- # gpg: Signature made Thu 02 Jul 2026 13:59:20 CEST # gpg: using RSA key 354BC8B3D7EB2A6B68674E5F3870B400EB918653 # gpg: issuer "armbru@redhat.com" # gpg: Good signature from "Markus Armbruster " [full] # gpg: aka "Markus Armbruster " [full] # Primary key fingerprint: 354B C8B3 D7EB 2A6B 6867 4E5F 3870 B400 EB91 8653 * tag 'pull-qobject-2026-07-02' of https://repo.or.cz/qemu/armbru: json-parser: add location to JSON parsing errors json-streamer: do not heap-allocate JSONToken json-streamer: remove token queue json-streamer: make brace/bracket count unsigned json-streamer: reuse parser json-parser: replace with a push parser qobject/json-writer: preallocate output buffer Signed-off-by: Stefan Hajnoczi

Merge tag 'dump-pr-v1' of https://gitlab.com/marcandre.lureau/qemu into staging

2026-07-02T14:04:08+00:00

Dump patches for 2026-06-30 To: qemu-devel@nongnu.org Cc: Stefan Hajnoczi Signed-off-by: Marc-André Lureau # -----BEGIN PGP SIGNATURE----- # # iQIzBAABCgAdFiEEh6m9kz+HxgbSdvYt2ujhCXWWnOUFAmpD3PsACgkQ2ujhCXWW # nOUW8g//W75y5yaaujNXQ/tqRmIGpVKuB1rC5QXJgRYQlpEIh21tPeHHUUFpOSgU # llgo2NZM4fqX450vBDU2L6J+qtGc7Q6tm3EKlAe+dZeIlqCcrvHDTGHLq83pCGZQ # LbABgwnxRcK+BOmSH/LdsP33dFYWBMMwSNZ0P/C986pAs5m/Ji6oz7OI1hRvv5E/ # /HjwJLaXbCyOesWicKpFmN2wiwi3GRiiwI5mBBrue3mmkTvHzb52Pas/B+jT/q/G # WzIKMYUAwlvYIg2NiWcr1r5UAaXohq4Z4O8jWSpXFoZbg24B5GfmPzg2/mWKtFs1 # UN5J5soqHA/7DV+hDK6v3dPWFnjAMe5PtxjtFdxlt7z5B0LS2hnwHW3tbZtWIhbV # cFUheXb+ySVw6h0ieK/Ym5k76tExvWHMDfacBHD6oo+ikiOxifCdSSvADYYvnpIU # ySfjfnEwXg2F/TrsL1o4uotcHeyONJEjy/V6l+pgOATyTGfUvUk0PCRwGNNBhshx # fZVbP8TSFw3NmS5j86dPUa8hyX1AZPRwSnxPzN/iOnCGigyPjJ3clcGQZ1YGwnip # KvDXQjmoirJutwEWVd1HZmGnWUqAfrJuselSvER5dWFEKnukbn7wmkIQx3aixZT4 # 1/AUNqPsMNREDTMHN6KCAK7mj7024Gq2Gmupu7aYpdZZtPHUXPA= # =NMTJ # -----END PGP SIGNATURE----- # gpg: Signature made Tue 30 Jun 2026 17:12:59 CEST # gpg: using RSA key 87A9BD933F87C606D276F62DDAE8E10975969CE5 # gpg: Good signature from "Marc-André Lureau " [full] # gpg: aka "Marc-André Lureau " [full] # Primary key fingerprint: 87A9 BD93 3F87 C606 D276 F62D DAE8 E109 7596 9CE5 * tag 'dump-pr-v1' of https://gitlab.com/marcandre.lureau/qemu: dump: fix misleading VMCOREINFO phys_base parse error tests/qtest/dump: cover win-dmp availability via vmcoreinfo tests/qtest/dump: reject win-dmp without vmcoreinfo tests/qtest: add dump-guest-memory test dump: make win_dump_available() check vmcoreinfo for a Windows dump header system/cpus: refuse memsave/pmemsave while guest RAM is being migrated dump: refuse dump-guest-memory while guest RAM is being migrated migration: add migration_guest_ram_loading() helper Signed-off-by: Stefan Hajnoczi

json-parser: add location to JSON parsing errors

2026-07-02T11:56:35+00:00

Now that all calls to parse_error have a token, add the line and column to the message. As far as I can see the two important TODOs (better errors and better EOI handling) are done, and the others (token range information and "parsed size"?) do not really matter or are handled better by json-streamer.c. So remove the list, which had sat unchanged since 2009. This needs some adjustments to provide a good x and y for error messages. First of all, they switch from zero-based to one-based, which is safe because they were both sitting unused. Second, right now the x and y are those of the *last* character in the token. Modify json-lexer.c to freeze tok->x and tok->y at the first character added to the GString. Signed-off-by: Paolo Bonzini Message-ID: <20260626101727.1727389-7-pbonzini@redhat.com> Reviewed-by: Markus Armbruster Signed-off-by: Markus Armbruster

json-streamer: remove token queue

2026-07-02T11:55:41+00:00

Now fully exploit the push parser, feeding it one token at a time without having to wait until braces and brackets are balanced. While the nesting counts are retained for error recovery purposes, the system can now report the first parsing error without waiting for parentheses to be balanced. This also means that JSON_ERROR can be handled in json-parser.c, not json-streamer.c. After reporting the error, json-streamer.c then enters an error recovery mode where subsequent errors are suppressed. This mimics the previous error reporting behavior, but it provides prompt feedback on parsing errors. As an example, here is an example interaction with qemu-ga. BEFORE (error reported only once braces are balanced): >> {"execute":foo >> } << {"error": {"class": "GenericError", "desc": "JSON parse error, invalid keyword 'foo'"}} >> {"execute":"somecommand"} << {"error": {"class": "CommandNotFound", "desc": "The command somecommand has not been found"}} AFTER (error reported immediately, but similar error recovery as before): >> {"execute":foo << {"error": {"class": "GenericError", "desc": "JSON parse error, invalid keyword 'foo'"}} >> } >> {"execute":"somecommand"} << {"error": {"class": "CommandNotFound", "desc": "The command somecommand has not been found"}} Signed-off-by: Paolo Bonzini Message-ID: <20260626101727.1727389-5-pbonzini@redhat.com> Reviewed-by: Markus Armbruster [Token size limit check off-by-one fixed] Signed-off-by: Markus Armbruster

json-streamer: make brace/bracket count unsigned

2026-07-02T11:55:01+00:00

It makes no sense to let brace_count and bracket_count go negative, also because it immediately ends error recovery and sets them both back to zero. Instead set them to zero *before* choosing whether to process the token queue; this makes it possible to have the fields as unsigned. Note that JSON_END_OF_INPUT now forces the parentheses to appear balanced, so that the queue is emptied and an error is reported; hence, the "type != JSON_END_OF_INPUT" condition can be removed. Signed-off-by: Paolo Bonzini Message-ID: <20260626101727.1727389-4-pbonzini@redhat.com> Reviewed-by: Markus Armbruster [Comment tweaked] Signed-off-by: Markus Armbruster

json-streamer: reuse parser

2026-07-02T11:50:13+00:00

The push parser can be reset, so reuse it when the json-streamer detects a completed toplevel object. Reviewed-by: Markus Armbruster Signed-off-by: Paolo Bonzini Message-ID: <20260626101727.1727389-3-pbonzini@redhat.com> Reviewed-by: Philippe Mathieu-Daudé Signed-off-by: Markus Armbruster

json-parser: replace with a push parser

2026-07-02T11:48:56+00:00

In order to avoid stashing all the tokens corresponding to a JSON value, embed the parsing stack and state machine in JSONParser. This is more efficient and allows for more prompt error recovery; it also does not make the code substantially larger than the current recursive descent parser, though the state machine is probably a bit harder to follow. The stack consists of QLists and QDicts corresponding to open brackets and braces, plus optionally a QString with the current key on top of each QDict. After each value is parsed, it is added to the top array or dictionary or, if the stack is empty, json_parser_feed returns the complete QObject. For now, json-streamer.c keeps tracking the tokens up until braces and brackets are balanced, and then shoves the whole queue of tokens into the push parser. The only logic change is that JSON_END_OF_INPUT always triggers the emptying of the queue; the parser takes notice and checks that there is nothing on the stack. Not using brace_count and bracket_count for this is the first step towards improved separation of concerns between json-parser.c and json-streamer.c. Signed-off-by: Paolo Bonzini Message-ID: <20260626101727.1727389-2-pbonzini@redhat.com> Reviewed-by: Markus Armbruster [Minor comment improvements] Signed-off-by: Markus Armbruster

igvm: Report error on missing parameter area in directive handlers

2026-07-02T09:14:19+00:00

Parameter areas are how an IGVM file tells QEMU to allocate buffers for runtime information the guest needs — VP count, memory map, MADT and so on. Usage directives reference a parameter area by index to tell QEMU where to write each piece of data. If the index doesn't match any declared parameter area, the data has nowhere to go and should be treated as an error. The directive handlers that look up a parameter area all return 0 (success) when `qigvm_find_param_entry()` can't find it. Therefore, the load succeeds but the guest never gets the expected parameters. Note that the IGVM library already validates parameter area indices when the file is loaded, so this path should only be reachable with a malformed file that bypassed library validation. This is defensive programming against that case. Report the error with error_setg() and return -1 instead. Signed-off-by: Luigi Leonardi Reviewed-by: Stefano Garzarella Message-ID: <20260626-microvm_device_tree-v6-1-9cd13cf057e2@redhat.com> Signed-off-by: Gerd Hoffmann

Merge tag 'pull-riscv-to-apply-20260701' of https://github.com/alistair23/qemu into staging

2026-07-02T08:44:50+00:00

RISC-V PR for 11.1 * Fix IMSIC CSR write and add tests * Parametrise debug trigger number * Add 'svbare' satp-mode * Fix RINTC PLIC context ID for KVM * Avoid abort when reading vtype before env->xl is set * Skip reset for KVM irqchip * Skip FP/Vector sync on KVM_PUT_RUNTIME_STATE * More FDT cleanups (PLIC) * Make FCTL.BE in IOMMU read only 0 * Check DC.TC reserved bits in IOMMU * Apply UXL WARL handling to vsstatus * Set cmd_ill IOFENCE.C if rsvp bits are set in IOMMU * Set RISCV_IOMMU_FQ_HDR_PV appropriately * Fix MSI MRIF IOMMU interrupt-pending offset * Report QEMU CPU archid as 42 * Check PMP before updating PTE * Add the Tenstorrent Atlantis machine # -----BEGIN PGP SIGNATURE----- # # iQIzBAABCgAdFiEEaukCtqfKh31tZZKWr3yVEwxTgBMFAmpE6SoACgkQr3yVEwxT # gBOxNQ//bI4BvnT65Kd2UNMgtAwwPPcehpsyPzC2S3BcflniXQL+fV6sQ7IreKta # 6dclp/v5v+yhbB4bd/E1s/UPOF3YD4A9noUFifIhymBkafmqA4YRNsvPByeGiSD8 # xVkHhX5qUT9NW5wKnivEDjO8mndBMRm5YEXQ6uT5ulUsZr3Ir8wPOCJITZ8ZqKwb # 6dbbXStf1aTIBzu53KaNhNpi9DQqKV5UeV7CiSuhuwWU0qmVg1RAZMg9X3oB80rE # WpWqH0rg9Z0Cn+3XL+oKSzbLD5SrrTV+Ohq+K8zT2rEk+hIXOE3shAPm2xfTT9Q2 # g65nBOf2UmNWeHlvn3XC2LtmIWq10/A78ogGgm4XwHx8TXIeA2KIKboyS8T37XAb # NwUllq9LRtfDVtDevpiTn6t7Oa7TC8zrxDJTT1rg/p+3D6MdfkonifwJJgVAwfuG # NF7R2iePKPQliWr1hi6W+ghzQMRFXgNBwUNOL39/BQguy5IqvNmSk6ovhl8IFocf # aXGh9U35DqgrsUvMa/7Fgf4uI2QNhERBGJrHfL0SPZ82sKb5CTrMw9URwg0DFnEF # 8v/zQ9xL4eF0uZn0OtaNlLXRCblDxcHSgecwix9Vip5toFIc1P8ar9FX98Zd/H5l # UD/a3ENtiwb6hnKhZ+45iM/NIFJeUK7A0944VnQzx00tA06wJLw= # =a4hl # -----END PGP SIGNATURE----- # gpg: Signature made Wed 01 Jul 2026 12:17:14 CEST # gpg: using RSA key 6AE902B6A7CA877D6D659296AF7C95130C538013 # gpg: Good signature from "Alistair Francis " [unknown] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 6AE9 02B6 A7CA 877D 6D65 9296 AF7C 9513 0C53 8013 * tag 'pull-riscv-to-apply-20260701' of https://github.com/alistair23/qemu: (39 commits) hw/riscv/riscv-iommu.c: always fault with SADE=0 and A=0 hw/riscv/atlantis: Add some i2c peripherals hw/riscv/atlantis: Integrate i2c controllers hw/i2c: Add DesignWare I2C Controller tests/functional/riscv64: Add tt-atlantis tests hw/riscv/atlantis: Ensure OpenSBI has a non-zero next_addr hw/riscv: Add Tenstorrent Atlantis machine target/riscv: tt-ascalon: Enable Zkr extension hw/riscv/aia: Configure stride for the M-mode IMSIC hw/riscv/aia: Provide number of irq sources hw/riscv/virt: Move AIA initialisation to helper file hw/riscv/boot: Account for discontiguous memory when loading firmware hw/riscv/boot: Describe discontiguous memory in boot_info target/riscv: Check PMP before updating PTE target/riscv: Report QEMU CPU archid as 42 hw/riscv/riscv-iommu.c: fix MSI MRIF interrupt-pending offset hw/riscv/riscv-iommu.c: set RISCV_IOMMU_FQ_HDR_PV appropriately hw/riscv/riscv-iommu: set cmd_ill IOFENCE.C rsvp bits are set target/riscv: Apply UXL WARL handling to vsstatus hw/riscv/riscv-iommu: check DC.TC reserved bits ... Signed-off-by: Stefan Hajnoczi