testing updates (tcg, gdbstub):
- make sure we have TCG to run test_acpi_bits
- fix overflow in linux-sigrtminmax
- make .dir-locals aware of PYTHONPATH
- detect gdb in top-level meson
- fetch kernel assets with symbols for x86, aarch64 and s390 tuxruns
- use arrays in gdb run-test to make quoting less messy
- add support for --symbols and --kargs to gdbstub run-test.py
- restore old kvm gdb test script with a few fixes
- add tuxrun_kvm_gdb tests for x86,aarch64 and s390
# -----BEGIN PGP SIGNATURE-----
#
# iQEzBAABCgAdFiEEZoWumedRZ7yvyN81+9DbCVqeKkQFAmrbjRYACgkQ+9DbCVqe
# KkTtGwf/eDJawSsUD6rDYuNEegv5buJVlE5Vkh8EUUSbrr56xstPlclLXZQbXZKN
# gGxw7RGpoZZMUN/RGRbV001E6HhsUhWjkSDFGOH21MkQUj9OPVlroPhFPo+m0Xvb
# ppXSRvK09tXlM7YKFS8GWOT5sYzsHl/b5nbI2UONlLDmLl0futFlVeTMQ/qptR7t
# EKzsi86O6iEb69TuFlypZnIf++NsXYhcgSf/3pWGzLDBcstM+PDqHQn5Y+TTZUS3
# S56sCr6ihLNPRZl3ynkQvFArln3lO8I/K6RlOssRtUZ9QKV0oQ2aZDvMIqBytxBe
# sfBhrL/KrLgL8Uw4S8sQELXR8we+Bg==
# =u32E
# -----END PGP SIGNATURE-----
# gpg: Signature made Fri 23 Oct 2026 06:36:38 PM CEST
# gpg: using RSA key 6685AE99E75167BCAFC8DF35FBD0DB095A9E2A44
# gpg: Good signature from "Alex Bennée (Master Work Key) <alex.bennee@linaro.org>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 6685 AE99 E751 67BC AFC8 DF35 FBD0 DB09 5A9E 2A44
* tag 'pull-11.2-gdbstub-kvm-231026-1' of https://gitlab.com/stsquad/qemu:
tests/functional: add tuxrun kvm gdb test for s390x
tests/functional: update s390x tuxrun images
tests/functional: split s390x tuxrun into tcg and kvm run
tests/functional: add tuxrun kvm gdb test for arm64
tests/functional: update arm64 tuxrun images
tests/functional: split aarch64 tuxrun into tcg and kvm run
tests/functional: add tuxrun kvm gdb test for x86_64
tests/functional: teach tuxrun about launching gdb tests
tests/guest-debug: add --symbols option to run-test
tests/guest-debug: add --kargs option to run-test
tests/guest-debug: convert cmd to an qemu_cmd array
tests/guest-debug: convert gdb_cmd to an array
tests/functional: update x86_64 tuxrun images
tests/functional: split x86_64 tuxrun into tcg and kvm run
tests/functional: allow tuxrun tests to be passed "accel"
meson: move gdb detection into the top level build file
.dir-locals: include QEMU code in PYTHONPATH
tests/tcg: fix buffer overflow in multiarch/linux/linux-sigrtminmax
tests/functional: test_acpi_bits requires TCG
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
The hardware devices do identify themselves when the driver turns the
protocol off and on again. NVDA expects to get it.
Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
baum_chr_open() registers baum->brlapi_fd with the main loop through a
raw qemu_set_fd_handler() call. The chardev base class does not know
about this handler, and char_braille_finalize() only closes the brlapi
connection and frees the handle; it never removes the fd handler.
When the chardev is removed at runtime (QMP chardev-remove /
object_unparent), BaumChardev is finalized and freed while the main loop
still holds an fd handler whose opaque points to the freed object. The
next time brlapi_fd becomes readable (or the connection drops) the loop
calls baum_chr_read() with a dangling opaque, dereferencing freed
memory -> host use-after-free.
Unregister the handler in char_braille_finalize() before tearing the
connection down, using the same descriptor that baum_chr_open()
registered, and NULL the handle afterwards as a belt-and-braces guard.
Only do so while baum->brlapi is valid: baum_chr_open() sets
baum->brlapi_fd from brlapi__openConnection(), which is
BRLAPI_INVALID_FILE_DESCRIPTOR on failure, and that error path already
g_free()s the handle and returns before any handler is installed.
Signed-off-by: Hongyan Xu <getshell@seu.edu.cn>
Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
Message-ID: <20260904033055.413-1-getshell@seu.edu.cn>
qemu-sparc queue
# -----BEGIN PGP SIGNATURE-----
#
# iQFSBAABCgA8FiEEzGIauY6CIA2RXMnEW8LFb64PMh8FAmrbtYAeHG1hcmsuY2F2
# ZS1heWxhbmRAaWxhbmRlLmNvLnVrAAoJEFvCxW+uDzIf0JoH/3aWW42DgR5RIOaU
# 0vHkSh1HaHbzJyF0blDnwt4Cvr7uqzy+mtE17j68mjKnP+RFlLDBz6+P5ZgYc/lq
# 6WwDyBe6HN9EYmguz/Av/HRvDuSLf0nkuH2fcUL2UGdJAkM1ndESfimiMQ48WiLO
# HNRYQstNYd2RdRqg5NGMusnaK2M73mg6NikoqmVIr6q+ljsU0I/t7VBGmJmKoBDK
# S7s9eqapA+gs+Wg55BK4eOVLtKtwjeZp4Kd9TPSvWKjHGblPiVSYiHgDy3SgC2pH
# nAqE3ZXR+rYFFPohfBSDWiK1YT8+dTkBpXf1l0Z23aajTEnVphCI5kslOsU3ANej
# kw7jed0=
# =y2Lx
# -----END PGP SIGNATURE-----
# gpg: Signature made Fri 23 Oct 2026 09:29:04 PM CEST
# gpg: using RSA key CC621AB98E82200D915CC9C45BC2C56FAE0F321F
# gpg: issuer "mark.cave-ayland@ilande.co.uk"
# gpg: Good signature from "Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>" [unknown]
# gpg: WARNING: The key's User ID is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: CC62 1AB9 8E82 200D 915C C9C4 5BC2 C56F AE0F 321F
* tag 'qemu-sparc-20261023' of https://github.com/mcayland/qemu:
target/sparc: Add the SHA instructions
target/sparc: Add the CRC32C instruction
target/sparc: Add the AES key expansion instructions
target/sparc: Add the eight AES round instructions
target/sparc: Return CFR when crypto feature is enabled
target/sparc: Add crypto feature
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
qom-qdev queue
# -----BEGIN PGP SIGNATURE-----
#
# iHUEABYKAB0WIQT1gm3ws3USUB3fevcsojbiRimx9AUCatt1NgAKCRAsojbiRimx
# 9IG+AQCxutZkiIqrq2CfNk7dyDBAs13IqzI1JMl6TOdibvniBQEA+8Z2aqWGttZ1
# EzrltmiDf0FeCvLCW3eN4g+q1NWjpgE=
# =o5GE
# -----END PGP SIGNATURE-----
# gpg: Signature made Fri 23 Oct 2026 04:54:46 PM CEST
# gpg: using EDDSA key F5826DF0B37512501DDF7AF72CA236E24629B1F4
# gpg: Good signature from "Mark Cave-Ayland (Nutanix) <mark.caveayland@nutanix.com>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: F582 6DF0 B375 1250 1DDF 7AF7 2CA2 36E2 4629 B1F4
* tag 'qom-qdev-20261023' of https://gitlab.com/mcayland-ntx/qemu: (28 commits)
i8259_common.c: add missing 0x prefixes to "info pic" output
i8259_common.c: remove static irq_count and irq_level variables
i8259.c: switch isa_pic from I8259State to I8259PICState
i8259: move InterruptStatsProviderClass get_statistics() from i8259 to PIC
i8259_common.c: remove unused i8259_init_chip() function
xen/xen-hvm.c: introduce TYPE_XEN_I8259_PIC device
xen-hvm.c: rename xen_interrupt_controller_init() to xen_i8259_init()
kvm/i8259.c: introduce TYPE_KVM_I8259_PIC device
i8259.c: properly cascade secondary i8259 from primary i8259
i8259.c: introduce TYPE_I8259_PIC device
isa-bus.c: introduce isa_realize() function
kvm/i8259.c: convert to use DEFINE_TYPES() macro
i8259.c: convert to use DEFINE_TYPES() macro
i8259_common.c: convert to use DEFINE_TYPES() macro
kvm/i8259.c: use kvm_i8259 prefix for functions
i8259.c: use i8259 prefix for functions
i8259_common.c: use i8259/i8259_common prefix for functions
i8259_common.c: always use cs for I8259CommonState variables
kvm/i8259.c: always use cs for I8259CommonState variables
kvm/i8259.c: introduce TYPE_KVM_I8259 device
...
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Misc target patches queue
- Make TCG halt-to-exec transition explicit and remove cpu_exec_halt()
- Various conversions to translate_for_debug()
- Add common CPUClass::exception_name() handler
- multi-target: prefix helpers with target prefix
- Remove target_long_bits() from GDB register reads
- MAINTAINERS updates
# -----BEGIN PGP SIGNATURE-----
#
# iQJPBAABCAA5FiEE+qvnXhKRciHc/Wuy4+MsLN6twN4FAmrcf1sbFIAAAAAABAAO
# bWFudTIsMi41KzEuMTIsMCwzAAoJEOPjLCzercDeRS4QAJVD/i+tYZJ+b2OPsVuL
# 5rU3R7pyAQ0O+H/kXAE5T4cB3FxG6bTcczbbb4LTlVEZF/H3GKm8OgBg6syyvygq
# wLAbNuQyZsCTG5DfeLruwADt2IsCg3BGC92Gz8eo+dkEg/8YHOThaMqj9wwK3Pre
# vYotjM/XcKB/+IiMgtO931JAAofJ3NwHeTsgS02U1Noh97OkxcJYEKv8Q6exYgdk
# 7vqRIdavZUlwxUUqRFsEBoFECDx0mO8mi3ehKEHZzbSOPkhWZDmz6ooKUt1Cc/DA
# rhgXG/lW0Pbu+tP9nO3Ah1ib2AB7NEtRoatAMhXbByhybTxZ3mGrCh7gfEJnmysq
# COSE1Aq8CUyup5TmLFPN7jqumb3jw6j/aktiXaGopeMiJn3Q6P//XXlwCJ5R+VWN
# rJVUkG9jw6vsvePFf0uIALIRYzUz1gZnK1iMHGE6UpYilln9OKNwyP8/+qW3pOep
# yofR+2gpnVCxA0+6lZnO+rkhukGi+AM6fV4wjvE56jC027SP5yxaTcDqd2MG6avJ
# MZ8yE0Xso7PlenYpBzPlV873zGoYKudOIBfZDSvMBzKcjwtCFpLIKBtOslB3iJgS
# bOtW2wAlmvvP6vgf442KJLWqCjrm0SrtOoZ8TeOLXXs0a7scBCHIw8OLpMsxcNNk
# yuo+mIVum48DUkC94J0u6Cvi
# =LbEJ
# -----END PGP SIGNATURE-----
# gpg: Signature made Sat 24 Oct 2026 11:50:19 AM CEST
# gpg: using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE
# gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <f4bug@amsat.org>" [unknown]
# gpg: Signature notation: manu=2,2.5+1.12,0,3
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: FAAB E75E 1291 7221 DCFD 6BB2 E3E3 2C2C DEAD C0DE
* tag 'target-misc-20261024' of https://github.com/philmd/qemu: (81 commits)
MAINTAINERS: cover riscv GDB XML files
MAINTAINERS: cover x86 GDB XML files
MAINTAINERS: cover m68k GDB XML files
target/mips: Convert to translate_for_debug
target/m68k: Convert to translate_for_debug
target/loongarch: Convert to translate_for_debug
target/hppa: Convert to translate_for_debug
target/hexagon: Convert to translate_for_debug
target/tricore: define and call helpers using HELPER macro
target/sparc: define and call helpers using HELPER macro
target/sh4: define and call helpers using HELPER macro
target/s390x: define and call helpers using HELPER macro
target/riscv: define and call helpers using HELPER macro
target/ppc: define and call helpers using HELPER macro
target/or1k: define and call helpers using HELPER macro
target/mips: define and call helpers using HELPER macro
target/microblaze: define and call helpers using HELPER macro
target/m68k: define and call helpers using HELPER macro
target/loongarch: define and call helpers using HELPER macro
target/i386: define and call helpers using HELPER macro
...
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Implement xtensa_exception_name() and register it as the
CPUClass::exception_name() handler, so the common exception
logging can resolve Xtensa exception codes to names.
Use the new helper in xtensa_cpu_do_interrupt().
With '-d int', xtensa_cpu_do_interrupt() now logs the exception
name after its number.
Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
Message-ID: <20261022215115.19680-34-philmd@oss.qualcomm.com>
For each SPARC / SPARC64 target:
factor sparc_exception_name() out of sparc_cpu_do_interrupt()
and register it as the CPUClass::exception_name() handler, so
the common exception logging can resolve SPARC exception codes
to names.
With '-d int', unlisted codes are now logged as "unknown" instead
of "Unknown". On SPARC, the "Error state" abort message now names
trap instructions (0x80-0xff) instead of calling them "Unknown".
On SPARC64, trap 0x1ff is now named "Hyperprivileged Trap
Instruction"; it was "Unknown" because of an off-by-one in the
former range check.
Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
Message-ID: <20261022215115.19680-33-philmd@oss.qualcomm.com>
DEBUG_PCALL has been unconditionally defined for 14 years now
(see commit b884fc5eca "target-sparc: Make CPU_LOG_INT useful
by default"), so the #ifdef guards around the exception name
table and the CPU_LOG_INT block are always taken. Remove the
define and the now-redundant guards.
Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
Message-ID: <20261022215115.19680-32-philmd@oss.qualcomm.com>
Implement s390x_exception_name() and register it as the
CPUClass::exception_name() handler, so the common exception
logging can resolve s390x exception codes to names.
Use the new helper in s390_cpu_do_interrupt() and helper_exception().
With '-d int', s390_cpu_do_interrupt() now logs the exception
name in parentheses after its number.
Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
Message-ID: <20261022215115.19680-28-philmd@oss.qualcomm.com>
Factor rx_exception_name() out of rx_cpu_do_interrupt()
and register it as the CPUClass::exception_name() handler,
so the common exception logging can resolve RX exception
codes to names.
With '-d int', unlisted codes are now logged as "unknown"
instead of "unknown exception".
Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
Message-ID: <20261022215115.19680-27-philmd@oss.qualcomm.com>
Replace the switch statement with a static lookup table.
Unlisted exception codes now return "unknown" instead of reaching
g_assert_not_reached(), so with '-d int' they are logged instead
of aborting QEMU. Do this before registering the function as the
CPUClass::exception_name() handler, which must accept any code.
Suggested-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
Message-ID: <20261022215115.19680-22-philmd@oss.qualcomm.com>
Richard Henderson