[PULL 00/22] Single binary patches for 2026-05-28

[PULL 00/22] Single binary patches for 2026-05-28

[Philippe Mathieu-Daudé]

The following changes since commit 2db91528542672cf0db78b3f2cc0e22b36302b38:

  Merge tag 'pull-vfio-20260527' of https://github.com/legoater/qemu into staging (2026-05-27 14:45:58 -0400)

are available in the Git repository at:

  https://github.com/philmd/qemu.git tags/single-binary-20260528

for you to fetch changes up to 603813bfc2aa57410cffdf4bccf4b45a82ea006a:

  hw/core: Remove SysemuCPUOps::get_phys_addr_attrs_debug (2026-05-28 22:18:35 +0200)

Checkpatch warnings ignored:

  WARNING: line over 80 characters
  #47: FILE: target/microblaze/helper.h:30:
  +DEF_HELPER_FLAGS_2(microblaze_unaligned_access, TCG_CALL_NO_WG, noreturn, env, i64)

  WARNING: added, moved or deleted file(s), does MAINTAINERS need updating?
    accel/accel-target.c

----------------------------------------------------------------
Various patches loosely related to single binary effort:

- Fix possible stub conflicts in meson.build
- Remove SysemuCPUOps::get_phys_addr_attrs_debug()
- Few other fixes and .mailmap updates
----------------------------------------------------------------

Knutsson Development (1):
  monitor: fix missing spaces in screendump help text

Mohammadfaiz Bawa (1):
  hw/tpm/tpm_tis_sysbus: defer resource allocation to realize

Peter Maydell (3):
  target/microblaze: Convert to translate_for_debug
  target/i386: Convert to translate_for_debug
  hw/core: Remove SysemuCPUOps::get_phys_addr_attrs_debug

Philippe Mathieu-Daudé (6):
  target/tcg: Rename unaligned_access() helpers
  docs/devel/tcg-ops: Stop listing dup2_vec()
  docs/devel/tcg-ops: List more vector opcodes
  mailmap: Update email addresses for Daniel Henrique Barboza
  mailmap: Update email addresses for Andrew Jones
  accel/common: Remove last bit of target-specific code

Pierrick Bouvier (7):
  meson.build: move some subdir before system lib creation
  target/arm: move kvm-stub to arm_stubs_ss
  target/arm: move whpx-stub to arm_stubs_ss
  migration: use stub_ss for vfio-stub.c
  net: use stub_ss for vhost-user-stub.c and vhost-vdpa-stub.c
  hw/net: use stub_ss for vhost_net-stub.c
  hw/vfio: use stub_ss for iommufd-stubs.c

Quan Sun (1):
  meson: fix close_range detection on older glibc

Richard W.M. Jones (1):
  system/exit-with-parent: Close the file descriptor before exit

Thomas Huth (2):
  system/vl: Free allocate memory for pid file name in case realpath()
    failed
  system/qtest: Fix length parameter in the b64write code

 docs/devel/tcg-ops.rst           | 13 ++++++----
 meson.build                      | 28 +++++++++++-----------
 include/hw/core/sysemu-cpu-ops.h | 14 -----------
 target/arm/tcg/helper-a64-defs.h |  2 +-
 target/i386/cpu.h                |  4 ++--
 target/microblaze/cpu.h          |  4 ++--
 target/microblaze/helper.h       |  2 +-
 accel/accel-common.c             | 15 ++++++++++++
 accel/accel-target.c             | 41 --------------------------------
 hw/core/cpu-system.c             | 11 ++-------
 hw/tpm/tpm_tis_sysbus.c          | 18 +++++++-------
 system/exit-with-parent.c        |  1 +
 system/qtest.c                   |  2 +-
 system/vl.c                      |  3 +++
 target/arm/tcg/helper-a64.c      |  4 ++--
 target/arm/tcg/translate-a64.c   |  4 ++--
 target/i386/cpu.c                |  2 +-
 target/i386/helper.c             | 31 +++++++++++++-----------
 target/i386/whpx/whpx-all.c      |  2 +-
 target/microblaze/cpu.c          |  2 +-
 target/microblaze/helper.c       | 18 +++++++-------
 target/microblaze/translate.c    |  2 +-
 .mailmap                         |  5 ++++
 accel/meson.build                |  1 -
 hmp-commands.hx                  |  4 ++--
 hw/net/meson.build               |  5 ++--
 hw/vfio/meson.build              |  2 +-
 migration/meson.build            |  4 ++--
 net/meson.build                  |  6 +++--
 target/arm/meson.build           |  6 +++--
 target/arm/whpx/meson.build      |  2 +-
 31 files changed, 114 insertions(+), 144 deletions(-)
 delete mode 100644 accel/accel-target.c

-- 
2.53.0

[PULL 01/22] system/exit-with-parent: Close the file descriptor before exit

[Philippe Mathieu-Daudé]

From: "Richard W.M. Jones" <rjones@redhat.com>

On macOS we leak the open file descriptor in the background thread.
Close it before returning.

Link: https://lists.gnu.org/archive/html/qemu-devel/2026-05/msg04286.html
Reported-by: Thomas Huth
Fixes: commit 886898baad ("Implement -run-with exit-with-parent=on")
Signed-off-by: Richard W.M. Jones <rjones@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20260518184333.8505-1-rjones@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 system/exit-with-parent.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/system/exit-with-parent.c b/system/exit-with-parent.c
index df65d2231a2..d236944572f 100644
--- a/system/exit-with-parent.c
+++ b/system/exit-with-parent.c
@@ -109,6 +109,7 @@ exit_with_parent_loop(void *vp)
         /* Behave like Linux and FreeBSD above, as if SIGTERM was sent */
         qemu_system_killed(SIGTERM, ppid);
     }
+    close(fd);
 
     return NULL;
 }
-- 
2.53.0

[PULL 02/22] target/tcg: Rename unaligned_access() helpers

[Philippe Mathieu-Daudé]

In order to avoid symbol name clash when building
a single binary, rename TCG helpers prefixing with
the target name.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Brian Cain <brian.cain@oss.qualcomm.com>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Message-Id: <20260224193028.2370-4-philmd@linaro.org>
---
 target/arm/tcg/helper-a64-defs.h | 2 +-
 target/microblaze/helper.h       | 2 +-
 target/arm/tcg/helper-a64.c      | 4 ++--
 target/arm/tcg/translate-a64.c   | 4 ++--
 target/microblaze/helper.c       | 2 +-
 target/microblaze/translate.c    | 2 +-
 6 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/target/arm/tcg/helper-a64-defs.h b/target/arm/tcg/helper-a64-defs.h
index b7880f773e7..cae543a7a15 100644
--- a/target/arm/tcg/helper-a64-defs.h
+++ b/target/arm/tcg/helper-a64-defs.h
@@ -113,7 +113,7 @@ DEF_HELPER_FLAGS_2(ldgm, TCG_CALL_NO_WG, i64, env, i64)
 DEF_HELPER_FLAGS_3(stgm, TCG_CALL_NO_WG, void, env, i64, i64)
 DEF_HELPER_FLAGS_3(stzgm_tags, TCG_CALL_NO_WG, void, env, i64, i64)
 
-DEF_HELPER_FLAGS_4(unaligned_access, TCG_CALL_NO_WG,
+DEF_HELPER_FLAGS_4(arm_unaligned_access, TCG_CALL_NO_WG,
                    noreturn, env, i64, i32, i32)
 
 DEF_HELPER_3(setp, void, env, i32, i32)
diff --git a/target/microblaze/helper.h b/target/microblaze/helper.h
index 01eba592b26..1429c1727ef 100644
--- a/target/microblaze/helper.h
+++ b/target/microblaze/helper.h
@@ -27,7 +27,7 @@ DEF_HELPER_FLAGS_3(put, TCG_CALL_NO_RWG, void, i32, i32, i32)
 #ifndef CONFIG_USER_ONLY
 DEF_HELPER_FLAGS_3(mmu_read, TCG_CALL_NO_RWG, i32, env, i32, i32)
 DEF_HELPER_FLAGS_4(mmu_write, TCG_CALL_NO_RWG, void, env, i32, i32, i32)
-DEF_HELPER_FLAGS_2(unaligned_access, TCG_CALL_NO_WG, noreturn, env, i64)
+DEF_HELPER_FLAGS_2(microblaze_unaligned_access, TCG_CALL_NO_WG, noreturn, env, i64)
 DEF_HELPER_FLAGS_2(lbuea, TCG_CALL_NO_WG, i32, env, i64)
 DEF_HELPER_FLAGS_2(lhuea_be, TCG_CALL_NO_WG, i32, env, i64)
 DEF_HELPER_FLAGS_2(lhuea_le, TCG_CALL_NO_WG, i32, env, i64)
diff --git a/target/arm/tcg/helper-a64.c b/target/arm/tcg/helper-a64.c
index 6505ee3c942..093c697e050 100644
--- a/target/arm/tcg/helper-a64.c
+++ b/target/arm/tcg/helper-a64.c
@@ -835,8 +835,8 @@ void HELPER(dc_zva)(CPUARMState *env, uint64_t vaddr_in)
     clear_helper_retaddr();
 }
 
-void HELPER(unaligned_access)(CPUARMState *env, uint64_t addr,
-                              uint32_t access_type, uint32_t mmu_idx)
+void HELPER(arm_unaligned_access)(CPUARMState *env, uint64_t addr,
+                                  uint32_t access_type, uint32_t mmu_idx)
 {
     arm_cpu_do_unaligned_access(env_cpu(env), addr, access_type,
                                 mmu_idx, GETPC());
diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
index 15b40090c0f..eb533ebc651 100644
--- a/target/arm/tcg/translate-a64.c
+++ b/target/arm/tcg/translate-a64.c
@@ -382,8 +382,8 @@ static void check_lse2_align(DisasContext *s, int rn, int imm,
 
     type = is_write ? MMU_DATA_STORE : MMU_DATA_LOAD,
     mmu_idx = get_mem_index(s);
-    gen_helper_unaligned_access(tcg_env, addr, tcg_constant_i32(type),
-                                tcg_constant_i32(mmu_idx));
+    gen_helper_arm_unaligned_access(tcg_env, addr, tcg_constant_i32(type),
+                                    tcg_constant_i32(mmu_idx));
 
     gen_set_label(over_label);
 
diff --git a/target/microblaze/helper.c b/target/microblaze/helper.c
index f81c4f625b5..3434ea47e8c 100644
--- a/target/microblaze/helper.c
+++ b/target/microblaze/helper.c
@@ -69,7 +69,7 @@ void mb_cpu_do_unaligned_access(CPUState *cs, vaddr addr,
 
 #ifndef CONFIG_USER_ONLY
 
-void HELPER(unaligned_access)(CPUMBState *env, uint64_t addr)
+void HELPER(microblaze_unaligned_access)(CPUMBState *env, uint64_t addr)
 {
     mb_unaligned_access_internal(env_cpu(env), addr, GETPC());
 }
diff --git a/target/microblaze/translate.c b/target/microblaze/translate.c
index 74b5420ed24..a93f14d6e09 100644
--- a/target/microblaze/translate.c
+++ b/target/microblaze/translate.c
@@ -692,7 +692,7 @@ static void gen_alignment_check_ea(DisasContext *dc, TCGv_i64 ea, int rb,
         record_unaligned_ess(dc, rd, size, store);
 
         tcg_gen_brcondi_i64(TCG_COND_TSTEQ, ea, (1 << size) - 1, over);
-        gen_helper_unaligned_access(tcg_env, ea);
+        gen_helper_microblaze_unaligned_access(tcg_env, ea);
         gen_set_label(over);
     }
 }
-- 
2.53.0

[PULL 03/22] monitor: fix missing spaces in screendump help text

[Philippe Mathieu-Daudé]

From: Knutsson Development <development@knutsson.it>

Signed-off-by: Knutsson Development <development@knutsson.it>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-ID: <20260410151818.817298-1-development@knutsson.it>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hmp-commands.hx | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hmp-commands.hx b/hmp-commands.hx
index c3a1a95c5fb..0d780e6da30 100644
--- a/hmp-commands.hx
+++ b/hmp-commands.hx
@@ -271,8 +271,8 @@ ERST
         .name       = "screendump",
         .args_type  = "filename:F,format:-fs,device:s?,head:i?",
         .params     = "filename [-f format] [device [head]]",
-        .help       = "save screen from head 'head' of display device 'device'"
-                      "in specified format 'format' as image 'filename'."
+        .help       = "save screen from head 'head' of display device 'device' "
+                      "in specified format 'format' as image 'filename'. "
                       "Currently only 'png' and 'ppm' formats are supported.",
          .cmd        = hmp_screendump,
         .coroutine  = true,
-- 
2.53.0

[PULL 04/22] docs/devel/tcg-ops: Stop listing dup2_vec()

[Philippe Mathieu-Daudé]

dup2_vec() opcode was removed in commit 6e7b13936d4
("tcg: Remove INDEX_op_dup2_vec").

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
Message-Id: <20260504125032.35465-2-philmd@linaro.org>
---
 docs/devel/tcg-ops.rst | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/docs/devel/tcg-ops.rst b/docs/devel/tcg-ops.rst
index fd3a50bf4c4..c417ebe65a8 100644
--- a/docs/devel/tcg-ops.rst
+++ b/docs/devel/tcg-ops.rst
@@ -769,11 +769,6 @@ specifies the length of the element (if applicable) in log2 8-bit units.
      - | Similarly, for a constant.
        | Smaller values will be replicated to host register size by the expanders.
 
-   * - dup2_vec *v0*, *r1*, *r2*
-
-     - | Duplicate *r2*:*r1* into TYPE/64 copies across *v0*. This opcode is
-         only present for 32-bit hosts.
-
    * - add_vec *v0*, *v1*, *v2*
 
      - | *v0* = *v1* + *v2*, in elements across the vector.
-- 
2.53.0

[PULL 05/22] docs/devel/tcg-ops: List more vector opcodes

[Philippe Mathieu-Daudé]

Few logical and arithmetic vector opcodes are missing, list them.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20260504125032.35465-3-philmd@linaro.org>
---
 docs/devel/tcg-ops.rst | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/docs/devel/tcg-ops.rst b/docs/devel/tcg-ops.rst
index c417ebe65a8..56c0b0bd3de 100644
--- a/docs/devel/tcg-ops.rst
+++ b/docs/devel/tcg-ops.rst
@@ -816,10 +816,16 @@ specifies the length of the element (if applicable) in log2 8-bit units.
 
    * - and_vec *v0*, *v1*, *v2*
 
+       nand_vec *v0*, *v1*, *v2*
+
        or_vec *v0*, *v1*, *v2*
 
+       nor_vec *v0*, *v1*, *v2*
+
        xor_vec *v0*, *v1*, *v2*
 
+       eqv_vec *v0*, *v1*, *v2*
+
        andc_vec *v0*, *v1*, *v2*
 
        orc_vec *v0*, *v1*, *v2*
@@ -852,6 +858,8 @@ specifies the length of the element (if applicable) in log2 8-bit units.
 
        sars_vec *v0*, *v1*, *s2*
 
+       rotls_vec *v0*, *v1*, *s2*
+
      - | Similarly for logical and arithmetic right shift, and left rotate.
 
    * - shlv_vec *v0*, *v1*, *v2*
-- 
2.53.0

[PULL 06/22] system/vl: Free allocate memory for pid file name in case realpath() failed

[Philippe Mathieu-Daudé]

From: Thomas Huth <thuth@redhat.com>

In case realpath() fails, the code returns early in the function
qemu_maybe_daemonize(), without freeing the allocated memory. Add
a g_free() here to fix it.
And while we're at it, also free the memory in the qemu_unlink_pidfile()
function - it's not that important since QEMU is going to terminate anyway,
but some malloc sanitizers might still complain if we don't free it.

Fixes: dee2a4d4d2f ("vl: defuse PID file path resolve error")
Signed-off-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Fiona Ebner <f.ebner@proxmox.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20260518114514.684401-1-thuth@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 system/vl.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/system/vl.c b/system/vl.c
index da36b2c6e18..dbdd4f22572 100644
--- a/system/vl.c
+++ b/system/vl.c
@@ -1634,6 +1634,8 @@ static void qemu_unlink_pidfile(Notifier *n, void *data)
 
     upn = DO_UPCAST(struct UnlinkPidfileNotifier, notifier, n);
     unlink(upn->pid_file_realpath);
+    g_free(upn->pid_file_realpath);
+    upn->pid_file_realpath = NULL;
 }
 
 static const QEMUOption *lookup_opt(int argc, char **argv,
@@ -2672,6 +2674,7 @@ static void qemu_maybe_daemonize(const char *pid_file)
                 warn_report("not removing PID file on exit: cannot resolve PID "
                             "file path: %s: %s", pid_file, strerror(errno));
             }
+            g_free(pid_file_realpath);
             return;
         }
 
-- 
2.53.0

[PULL 07/22] system/qtest: Fix length parameter in the b64write code

[Philippe Mathieu-Daudé]

From: Thomas Huth <thuth@redhat.com>

The b64write code has a sanity check that the given lengths matches
the real length of the given data, and calculates the minimum of the
two values to be on the safe side. However, the address_space_write()
then uses the original value and ignores the calculated minimum. Use
out_len here to fix the problem.

Fixes: 70da30483e7 ("qtest: Use cpu address space instead of system memory")
Signed-off-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Laurent Vivier <lvivier@redhat.com>
Message-ID: <20260518134020.1420932-1-thuth@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 system/qtest.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/system/qtest.c b/system/qtest.c
index a79d10d1361..d6db057b0a2 100644
--- a/system/qtest.c
+++ b/system/qtest.c
@@ -698,7 +698,7 @@ static void qtest_process_command(CharFrontend *chr, gchar **words)
         }
 
         address_space_write(first_cpu->as, addr, MEMTXATTRS_UNSPECIFIED, data,
-                            len);
+                            out_len);
 
         qtest_send(chr, "OK\n");
     } else if (strcmp(words[0], "endianness") == 0) {
-- 
2.53.0

[PULL 08/22] meson: fix close_range detection on older glibc

[Philippe Mathieu-Daudé]

From: Quan Sun <Quan.Sun@windriver.com>

The has_function('close_range') check succeeds at link time on hosts
with kernel >= 5.9 even when glibc does not declare the function
(glibc < 2.34, e.g. AlmaLinux 8 / CentOS 8 with glibc 2.28). This
causes CONFIG_CLOSE_RANGE to be set, but compilation then fails with:

  error: implicit declaration of function 'close_range'

Fix by adding a prefix that includes <unistd.h>, so the meson check
only succeeds when the C library actually declares close_range() in
its headers.

Signed-off-by: Quan Sun <Quan.Sun@windriver.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20260522201850.1342167-1-Quan.Sun@windriver.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 meson.build | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/meson.build b/meson.build
index eb074918193..e396394f4c1 100644
--- a/meson.build
+++ b/meson.build
@@ -2596,7 +2596,7 @@ if host_os == 'windows'
 endif
 
 # has_function
-config_host_data.set('CONFIG_CLOSE_RANGE', cc.has_function('close_range'))
+config_host_data.set('CONFIG_CLOSE_RANGE', cc.has_function('close_range', prefix: '#include <unistd.h>'))
 config_host_data.set('CONFIG_ACCEPT4', cc.has_function('accept4'))
 config_host_data.set('CONFIG_CLOCK_ADJTIME', cc.has_function('clock_adjtime'))
 config_host_data.set('CONFIG_DUP3', cc.has_function('dup3'))
-- 
2.53.0

[PULL 09/22] meson.build: move some subdir before system lib creation

[Philippe Mathieu-Daudé]

From: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>

Allows to use stub_ss in those sub directories.

Signed-off-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20260528051642.115721-6-pierrick.bouvier@oss.qualcomm.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 meson.build | 26 +++++++++++++-------------
 1 file changed, 13 insertions(+), 13 deletions(-)

diff --git a/meson.build b/meson.build
index e396394f4c1..19e123423b5 100644
--- a/meson.build
+++ b/meson.build
@@ -3730,6 +3730,19 @@ subdir('fsdev')
 subdir('dump')
 subdir('accel')
 
+subdir('backends')
+subdir('configs/targets')
+subdir('disas')
+subdir('migration')
+subdir('monitor')
+subdir('net')
+subdir('replay')
+subdir('stats')
+subdir('tcg')
+subdir('fpu')
+subdir('plugins')
+subdir('ebpf')
+
 if have_system
   subdir('hw')
 else
@@ -3838,19 +3851,6 @@ system_ss.add(files('page-vary-system.c'))
 common_ss.add(files('target-info.c'))
 system_ss.add(files('target-info-qom.c'))
 
-subdir('backends')
-subdir('configs/targets')
-subdir('disas')
-subdir('migration')
-subdir('monitor')
-subdir('net')
-subdir('replay')
-subdir('stats')
-subdir('tcg')
-subdir('fpu')
-subdir('plugins')
-subdir('ebpf')
-
 if 'CONFIG_TCG' in config_all_accel
   subdir('contrib/plugins')
 endif
-- 
2.53.0

[PULL 10/22] target/arm: move kvm-stub to arm_stubs_ss

[Philippe Mathieu-Daudé]

From: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>

This eliminates symbol conflicts for kvm symbols on linux-aarch64 host.

Signed-off-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20260528051642.115721-2-pierrick.bouvier@oss.qualcomm.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 target/arm/meson.build | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/target/arm/meson.build b/target/arm/meson.build
index 9408131d178..4412fde065f 100644
--- a/target/arm/meson.build
+++ b/target/arm/meson.build
@@ -35,7 +35,10 @@ arm_system_ss.add(when: 'CONFIG_KVM', if_true: files('hyp_gdbstub.c', 'kvm.c'))
 arm_system_ss.add(when: 'CONFIG_HVF', if_true: files('hyp_gdbstub.c'))
 
 arm_user_ss.add(files('cpu.c'))
-arm_stubs_ss.add(files('cpu32-stubs.c'))
+arm_stubs_ss.add(files(
+  'cpu32-stubs.c',
+  'kvm-stub.c'
+))
 arm_user_ss.add(files(
   'el2-stubs.c',
   'cpregs-omap-stub.c',
@@ -44,7 +47,6 @@ arm_user_ss.add(when: 'CONFIG_ARM_COMPATIBLE_SEMIHOSTING',
 		        if_true: files('common-semi-target.c'))
 
 arm_common_system_ss.add(files('cpu.c'))
-arm_common_system_ss.add(when: 'CONFIG_KVM', if_false: files('kvm-stub.c'))
 arm_common_system_ss.add(when: 'CONFIG_ARM_COMPATIBLE_SEMIHOSTING',
 		                 if_true: files('common-semi-target.c'))
 arm_common_system_ss.add(files(
-- 
2.53.0

[PULL 11/22] target/arm: move whpx-stub to arm_stubs_ss

[Philippe Mathieu-Daudé]

From: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>

This eliminates symbol conflicts for whpx symbols on windows-aarch64 host.

Signed-off-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Message-ID: <20260528051642.115721-3-pierrick.bouvier@oss.qualcomm.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 target/arm/whpx/meson.build | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/arm/whpx/meson.build b/target/arm/whpx/meson.build
index 3df632c9d30..7385c14f534 100644
--- a/target/arm/whpx/meson.build
+++ b/target/arm/whpx/meson.build
@@ -2,4 +2,4 @@ arm_system_ss.add(when: 'CONFIG_WHPX', if_true: files(
   'whpx-all.c',
 ))
 
-arm_common_system_ss.add(when: 'CONFIG_WHPX', if_false: files('whpx-stub.c'))
+arm_stubs_ss.add(files('whpx-stub.c'))
-- 
2.53.0

[PULL 12/22] migration: use stub_ss for vfio-stub.c

[Philippe Mathieu-Daudé]

From: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>

Signed-off-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20260528051642.115721-8-pierrick.bouvier@oss.qualcomm.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 migration/meson.build | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/migration/meson.build b/migration/meson.build
index e583822dec6..0a9a5d0d374 100644
--- a/migration/meson.build
+++ b/migration/meson.build
@@ -50,5 +50,5 @@ system_ss.add(when: qpl, if_true: files('multifd-qpl.c'))
 system_ss.add(when: uadk, if_true: files('multifd-uadk.c'))
 system_ss.add(when: qatzip, if_true: files('multifd-qatzip.c'))
 system_ss.add(when: 'CONFIG_VFIO',
-              if_true: files('vfio.c'),
-              if_false: files('vfio-stub.c'))
+              if_true: files('vfio.c'))
+stub_ss.add(files('vfio-stub.c'))
-- 
2.53.0

[PULL 13/22] net: use stub_ss for vhost-user-stub.c and vhost-vdpa-stub.c

[Philippe Mathieu-Daudé]

From: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>

Signed-off-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Message-ID: <20260528051642.115721-9-pierrick.bouvier@oss.qualcomm.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 net/meson.build | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/net/meson.build b/net/meson.build
index da6ea635e95..9c8068b06d1 100644
--- a/net/meson.build
+++ b/net/meson.build
@@ -46,8 +46,9 @@ endif
 system_ss.add(when: [libxdp, libbpf], if_true: files('af-xdp.c'))
 
 if have_vhost_net_user
-  system_ss.add(when: 'CONFIG_VIRTIO_NET', if_true: files('vhost-user.c'), if_false: files('vhost-user-stub.c'))
+  system_ss.add(when: 'CONFIG_VIRTIO_NET', if_true: files('vhost-user.c'))
 endif
+stub_ss.add(files('vhost-user-stub.c'))
 
 if host_os == 'windows'
   system_ss.add(files('tap-win32.c'))
@@ -61,8 +62,9 @@ else
   system_ss.add(files('tap.c', 'tap-stub.c'))
 endif
 if have_vhost_net_vdpa
-  system_ss.add(when: 'CONFIG_VIRTIO_NET', if_true: files('vhost-vdpa.c'), if_false: files('vhost-vdpa-stub.c'))
+  system_ss.add(when: 'CONFIG_VIRTIO_NET', if_true: files('vhost-vdpa.c'))
 endif
+stub_ss.add(files('vhost-vdpa-stub.c'))
 
 vmnet_files = files(
   'vmnet-common.m',
-- 
2.53.0

[PULL 14/22] hw/net: use stub_ss for vhost_net-stub.c

[Philippe Mathieu-Daudé]

From: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>

Removes conflict with several targets where some support vhost, and some
don't.

Signed-off-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20260528051642.115721-7-pierrick.bouvier@oss.qualcomm.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/net/meson.build | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/hw/net/meson.build b/hw/net/meson.build
index 31025874699..84f142df222 100644
--- a/hw/net/meson.build
+++ b/hw/net/meson.build
@@ -48,10 +48,9 @@ system_ss.add(when: 'CONFIG_VIRTIO_NET', if_true: files('net_rx_pkt.c'))
 system_ss.add(when: 'CONFIG_VIRTIO_NET', if_true: files('virtio-net.c'))
 
 if have_vhost_net
-  system_ss.add(when: 'CONFIG_VIRTIO_NET', if_true: files('vhost_net.c'), if_false: files('vhost_net-stub.c'))
-else
-  system_ss.add(files('vhost_net-stub.c'))
+  system_ss.add(when: 'CONFIG_VIRTIO_NET', if_true: files('vhost_net.c'))
 endif
+stub_ss.add(files('vhost_net-stub.c'))
 
 system_ss.add(when: 'CONFIG_ETSEC', if_true: files(
   'fsl_etsec/etsec.c',
-- 
2.53.0

[PULL 15/22] hw/vfio: use stub_ss for iommufd-stubs.c

[Philippe Mathieu-Daudé]

From: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>

Solves conflict for vmstate_cpr_vfio_devices.

Signed-off-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Message-ID: <20260528051642.115721-11-pierrick.bouvier@oss.qualcomm.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/vfio/meson.build | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/vfio/meson.build b/hw/vfio/meson.build
index fa0ea6ecf0e..c7c31b78f68 100644
--- a/hw/vfio/meson.build
+++ b/hw/vfio/meson.build
@@ -34,7 +34,7 @@ system_ss.add(when: ['CONFIG_VFIO', 'CONFIG_IOMMUFD'], if_true: files(
   'iommufd.c',
   'cpr-iommufd.c',
 ))
-system_ss.add(when: 'CONFIG_IOMMUFD', if_false: files('iommufd-stubs.c'))
+stub_ss.add(files('iommufd-stubs.c'))
 system_ss.add(when: 'CONFIG_VFIO_PCI', if_true: files(
   'display.c',
 ))
-- 
2.53.0

[PULL 16/22] mailmap: Update email addresses for Daniel Henrique Barboza

[Philippe Mathieu-Daudé]

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
Message-Id: <20260528083814.32795-1-philmd@linaro.org>
---
 .mailmap | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.mailmap b/.mailmap
index 273661c758e..a35de7cfbd4 100644
--- a/.mailmap
+++ b/.mailmap
@@ -82,6 +82,9 @@ Brian Cain <brian.cain@oss.qualcomm.com> <bcain@quicinc.com>
 Brian Cain <brian.cain@oss.qualcomm.com> <quic_bcain@quicinc.com>
 Christian Borntraeger <borntraeger@linux.ibm.com> <borntraeger@de.ibm.com>
 Damien Hedde <damien.hedde@dahe.fr> <damien.hedde@greensocs.com>
+Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com> <dbarboza@ventanamicro.com>
+Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com> <danielhb413@gmail.com>
+Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com> <danielhb@linux.vnet.ibm.com>
 David Hildenbrand <david@kernel.org> <david@redhat.com>
 Filip Bozuta <filip.bozuta@syrmia.com> <filip.bozuta@rt-rk.com.com>
 Frederic Konrad <konrad.frederic@yahoo.fr> <fred.konrad@greensocs.com>
-- 
2.53.0

[PULL 17/22] mailmap: Update email addresses for Andrew Jones

[Philippe Mathieu-Daudé]

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Acked-by: Andrew Jones <andrew.jones@oss.qualcomm.com>
Message-Id: <20260528083920.33105-1-philmd@linaro.org>
---
 .mailmap | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.mailmap b/.mailmap
index a35de7cfbd4..34c092714a2 100644
--- a/.mailmap
+++ b/.mailmap
@@ -76,6 +76,8 @@ Aleksandar Rikalo <aleksandar.rikalo@syrmia.com> <arikalo@wavecomp.com>
 Aleksandar Rikalo <aleksandar.rikalo@syrmia.com> <aleksandar.rikalo@rt-rk.com>
 Alex Williamson <alex@shazbot.org> <alex.williamson@redhat.com>
 Alexander Graf <agraf@csgraf.de> <agraf@suse.de>
+Andrew Jones <andrew.jones@oss.qualcomm.com> <ajones@ventanamicro.com>
+Andrew Jones <andrew.jones@oss.qualcomm.com> <drjones@redhat.com>
 Ani Sinha <anisinha@redhat.com> <ani@anisinha.ca>
 Anthony Liguori <anthony@codemonkey.ws> Anthony Liguori <aliguori@us.ibm.com>
 Brian Cain <brian.cain@oss.qualcomm.com> <bcain@quicinc.com>
-- 
2.53.0

[PULL 18/22] hw/tpm/tpm_tis_sysbus: defer resource allocation to realize

[Philippe Mathieu-Daudé]

From: Mohammadfaiz Bawa <mbawa@redhat.com>

Calling memory_region_init_ram_device_ptr() and
memory_region_init_io() from tpm_tis_sysbus_initfn() crashes
when the device is introspected without being realized, because
the memory subsystem has not been initialized at that point.

So running:
  $ qemu-system-aarch64 -device tpm-tis-device,help

triggers qdev_device_help() which creates the device object
to list its properties, calling instance_init, but never
realizefn. The memory region calls in instance_init then hit
uninitialized subsystems:

With CONFIG_DEBUG_TCG:
  Assertion 'target_page.decided' failed. (physmem.c:2524)

Without CONFIG_DEBUG_TCG:
  Assertion 'mutex->initialized' failed. (qemu-thread-posix.c:107)

Since realizefn is only called when the device is actually
used in a running VM, moving resource allocation there avoids
the crash without breaking introspection.

Signed-off-by: Mohammadfaiz Bawa <mbawa@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20260528093123.55403-1-mbawa@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/tpm/tpm_tis_sysbus.c | 18 ++++++++----------
 1 file changed, 8 insertions(+), 10 deletions(-)

diff --git a/hw/tpm/tpm_tis_sysbus.c b/hw/tpm/tpm_tis_sysbus.c
index 6bec30c36fc..f9cd1c8b5c6 100644
--- a/hw/tpm/tpm_tis_sysbus.c
+++ b/hw/tpm/tpm_tis_sysbus.c
@@ -100,19 +100,9 @@ static void tpm_tis_sysbus_initfn(Object *obj)
 {
     TPMStateSysBus *sbdev = TPM_TIS_SYSBUS(obj);
     TPMState *s = &sbdev->state;
-    size_t host_page_size = qemu_real_host_page_size();
-
-    memory_region_init_io(&s->mmio, obj, &tpm_tis_memory_ops,
-                          s, "tpm-tis-mmio",
-                          TPM_TIS_NUM_LOCALITIES << TPM_TIS_LOCALITY_SHIFT);
 
     sysbus_init_mmio(SYS_BUS_DEVICE(obj), &s->mmio);
     sysbus_init_irq(SYS_BUS_DEVICE(obj), &s->irq);
-
-    s->ppi.buf = qemu_memalign(host_page_size,
-                                ROUND_UP(TPM_PPI_ADDR_SIZE, host_page_size));
-    memory_region_init_ram_device_ptr(&s->ppi.ram, obj, "tpm-ppi",
-                                      TPM_PPI_ADDR_SIZE, s->ppi.buf);
     sysbus_init_mmio(SYS_BUS_DEVICE(obj), &s->ppi.ram);
 }
 
@@ -120,6 +110,7 @@ static void tpm_tis_sysbus_realizefn(DeviceState *dev, Error **errp)
 {
     TPMStateSysBus *sbdev = TPM_TIS_SYSBUS(dev);
     TPMState *s = &sbdev->state;
+    const size_t host_page_size = qemu_real_host_page_size();
 
     if (!tpm_find()) {
         error_setg(errp, "at most one TPM device is permitted");
@@ -131,6 +122,13 @@ static void tpm_tis_sysbus_realizefn(DeviceState *dev, Error **errp)
         return;
     }
 
+    s->ppi.buf = qemu_memalign(host_page_size,
+                               ROUND_UP(TPM_PPI_ADDR_SIZE, host_page_size));
+    memory_region_init_io(&s->mmio, OBJECT(dev), &tpm_tis_memory_ops,
+                          s, "tpm-tis-mmio",
+                          TPM_TIS_NUM_LOCALITIES << TPM_TIS_LOCALITY_SHIFT);
+    memory_region_init_ram_device_ptr(&s->ppi.ram, OBJECT(dev), "tpm-ppi",
+                                      TPM_PPI_ADDR_SIZE, s->ppi.buf);
     vmstate_register_ram(&s->ppi.ram, dev);
 }
 
-- 
2.53.0

[PULL 19/22] accel/common: Remove last bit of target-specific code

[Philippe Mathieu-Daudé]

Initialize the TypeInfo structure at runtime using the TargetInfo
API to resolve TYPE_ACCEL_CPU, replacing CPU_RESOLVING_TYPE by
target_cpu_type(). Since the code is no more target-specific, move
it to accel-common.c, removing the need for accel-target.c.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Anton Johansson <anjo@rev.ng>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
Message-Id: <20260528140857.44130-1-philmd@linaro.org>
---
 accel/accel-common.c | 15 +++++++++++++++
 accel/accel-target.c | 41 -----------------------------------------
 accel/meson.build    |  1 -
 3 files changed, 15 insertions(+), 42 deletions(-)
 delete mode 100644 accel/accel-target.c

diff --git a/accel/accel-common.c b/accel/accel-common.c
index 9c5b4111c8d..62590a7d9a6 100644
--- a/accel/accel-common.c
+++ b/accel/accel-common.c
@@ -134,3 +134,18 @@ static const TypeInfo accel_types[] = {
 };
 
 DEFINE_TYPES(accel_types)
+
+static void register_accel_target_type(void)
+{
+    g_autofree char *name = g_strconcat("accel-", target_cpu_type(), NULL);
+    const TypeInfo accel_cpu_type = {
+        .name = name,
+        .parent = TYPE_OBJECT,
+        .abstract = true,
+        .class_size = sizeof(AccelCPUClass),
+    };
+
+    type_register_static(&accel_cpu_type);
+}
+
+type_init(register_accel_target_type);
diff --git a/accel/accel-target.c b/accel/accel-target.c
deleted file mode 100644
index 7fd392fbc4a..00000000000
--- a/accel/accel-target.c
+++ /dev/null
@@ -1,41 +0,0 @@
-/*
- * QEMU accel class, components common to system emulation and user mode
- *
- * Copyright (c) 2003-2008 Fabrice Bellard
- * Copyright (c) 2014 Red Hat Inc.
- *
- * Permission is hereby granted, free of charge, to any person obtaining a copy
- * of this software and associated documentation files (the "Software"), to deal
- * in the Software without restriction, including without limitation the rights
- * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
- * copies of the Software, and to permit persons to whom the Software is
- * furnished to do so, subject to the following conditions:
- *
- * The above copyright notice and this permission notice shall be included in
- * all copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
- * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
- * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
- * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
- * THE SOFTWARE.
- */
-
-#include "qemu/osdep.h"
-#include "accel/accel-cpu-target.h"
-
-static const TypeInfo accel_cpu_type = {
-    .name = TYPE_ACCEL_CPU,
-    .parent = TYPE_OBJECT,
-    .abstract = true,
-    .class_size = sizeof(AccelCPUClass),
-};
-
-static void register_accel_types(void)
-{
-    type_register_static(&accel_cpu_type);
-}
-
-type_init(register_accel_types);
diff --git a/accel/meson.build b/accel/meson.build
index 7da12b9741f..1b5b37e3097 100644
--- a/accel/meson.build
+++ b/accel/meson.build
@@ -1,5 +1,4 @@
 common_ss.add(files('accel-common.c'))
-specific_ss.add(files('accel-target.c'))
 system_ss.add(files('accel-system.c', 'accel-blocker.c', 'accel-qmp.c', 'accel-irq.c'))
 user_ss.add(files('accel-user.c'))
 
-- 
2.53.0

[PULL 20/22] target/microblaze: Convert to translate_for_debug

[Philippe Mathieu-Daudé]

From: Peter Maydell <peter.maydell@linaro.org>

The get_phys_addr_attrs_debug method of SysemuCPUOps is used only by
x86 and microblaze.  Convert microblaze to the newer
translate_for_debug method, as a step towards being able to remove
get_phys_addr_attrs_debug.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260528161450.3564396-2-peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 target/microblaze/cpu.h    |  4 ++--
 target/microblaze/cpu.c    |  2 +-
 target/microblaze/helper.c | 16 +++++++++-------
 3 files changed, 12 insertions(+), 10 deletions(-)

diff --git a/target/microblaze/cpu.h b/target/microblaze/cpu.h
index 068da605295..b9602f72b94 100644
--- a/target/microblaze/cpu.h
+++ b/target/microblaze/cpu.h
@@ -369,8 +369,8 @@ struct MicroBlazeCPUClass {
 #ifndef CONFIG_USER_ONLY
 void mb_cpu_do_interrupt(CPUState *cs);
 bool mb_cpu_exec_interrupt(CPUState *cs, int int_req);
-hwaddr mb_cpu_get_phys_addr_attrs_debug(CPUState *cpu, vaddr addr,
-                                        MemTxAttrs *attrs);
+bool mb_cpu_translate_for_debug(CPUState *cs, vaddr addr,
+                                TranslateForDebugResult *result);
 #endif /* !CONFIG_USER_ONLY */
 G_NORETURN void mb_cpu_do_unaligned_access(CPUState *cs, vaddr vaddr,
                                            MMUAccessType access_type,
diff --git a/target/microblaze/cpu.c b/target/microblaze/cpu.c
index c6a456dd5ec..a97c92a7b68 100644
--- a/target/microblaze/cpu.c
+++ b/target/microblaze/cpu.c
@@ -428,7 +428,7 @@ static ObjectClass *mb_cpu_class_by_name(const char *cpu_model)
 
 static const struct SysemuCPUOps mb_sysemu_ops = {
     .has_work = mb_cpu_has_work,
-    .get_phys_addr_attrs_debug = mb_cpu_get_phys_addr_attrs_debug,
+    .translate_for_debug = mb_cpu_translate_for_debug,
 };
 #endif
 
diff --git a/target/microblaze/helper.c b/target/microblaze/helper.c
index 3434ea47e8c..6a982c18c0f 100644
--- a/target/microblaze/helper.c
+++ b/target/microblaze/helper.c
@@ -280,8 +280,8 @@ void mb_cpu_do_interrupt(CPUState *cs)
     }
 }
 
-hwaddr mb_cpu_get_phys_addr_attrs_debug(CPUState *cs, vaddr addr,
-                                        MemTxAttrs *attrs)
+bool mb_cpu_translate_for_debug(CPUState *cs, vaddr addr,
+                                TranslateForDebugResult *result)
 {
     MicroBlazeCPU *cpu = MICROBLAZE_CPU(cs);
     hwaddr paddr = 0;
@@ -289,10 +289,6 @@ hwaddr mb_cpu_get_phys_addr_attrs_debug(CPUState *cs, vaddr addr,
     int mmu_idx = cpu_mmu_index(cs, false);
     unsigned int hit;
 
-    /* Caller doesn't initialize */
-    *attrs = (MemTxAttrs) {};
-    attrs->secure = mb_cpu_access_is_secure(cpu, MMU_DATA_LOAD);
-
     if (mmu_idx != MMU_NOMMU_IDX) {
         hit = mmu_translate(cpu, &lu, addr, 0, 0);
         if (hit) {
@@ -303,7 +299,13 @@ hwaddr mb_cpu_get_phys_addr_attrs_debug(CPUState *cs, vaddr addr,
         paddr = addr;
     }
 
-    return paddr;
+    *result = (TranslateForDebugResult) {
+        .physaddr = paddr,
+        .lg_page_size = TARGET_PAGE_BITS,
+        .attrs.secure = mb_cpu_access_is_secure(cpu, MMU_DATA_LOAD),
+        .attrs.debug = 1,
+    };
+    return true;
 }
 
 bool mb_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
-- 
2.53.0

[PULL 21/22] target/i386: Convert to translate_for_debug

[Philippe Mathieu-Daudé]

From: Peter Maydell <peter.maydell@linaro.org>

The get_phys_addr_attrs_debug method of SysemuCPUOps is used only by
x86 and microblaze.  Convert x86 to the newer translate_for_debug
method, as a step towards being able to remove
get_phys_addr_attrs_debug.

The new API allows us to tell the caller the actual size of the
mapping via lg_page_size, so we do that, although no caller will care
since it's always at least TARGET_PAGE_BITS.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20260528161450.3564396-3-peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 target/i386/cpu.h           |  4 ++--
 target/i386/cpu.c           |  2 +-
 target/i386/helper.c        | 31 +++++++++++++++++--------------
 target/i386/whpx/whpx-all.c |  2 +-
 4 files changed, 21 insertions(+), 18 deletions(-)

diff --git a/target/i386/cpu.h b/target/i386/cpu.h
index bdd4fff89d6..67e2ecf3251 100644
--- a/target/i386/cpu.h
+++ b/target/i386/cpu.h
@@ -2581,8 +2581,8 @@ int cpu_x86_support_mca_broadcast(CPUX86State *env);
 #ifndef CONFIG_USER_ONLY
 int x86_cpu_pending_interrupt(CPUState *cs, int interrupt_request);
 
-hwaddr x86_cpu_get_phys_addr_attrs_debug(CPUState *cpu, vaddr addr,
-                                         MemTxAttrs *attrs);
+bool x86_cpu_translate_for_debug(CPUState *cpu, vaddr addr,
+                                 TranslateForDebugResult *result);
 int cpu_get_pic_interrupt(CPUX86State *s);
 
 /* MS-DOS compatibility mode FPU exception support */
diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 7248720a0eb..8929a75c7c9 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -10877,7 +10877,7 @@ static const struct SysemuCPUOps i386_sysemu_ops = {
     .has_work = x86_cpu_has_work,
     .get_memory_mapping = x86_cpu_get_memory_mapping,
     .get_paging_enabled = x86_cpu_get_paging_enabled,
-    .get_phys_addr_attrs_debug = x86_cpu_get_phys_addr_attrs_debug,
+    .translate_for_debug = x86_cpu_translate_for_debug,
     .asidx_from_attrs = x86_asidx_from_attrs,
     .get_crash_info = x86_cpu_get_crash_info,
     .write_elf32_note = x86_cpu_write_elf32_note,
diff --git a/target/i386/helper.c b/target/i386/helper.c
index 8cc73f619a9..30f1fa41b32 100644
--- a/target/i386/helper.c
+++ b/target/i386/helper.c
@@ -252,8 +252,8 @@ void cpu_x86_update_cr4(CPUX86State *env, uint32_t new_cr4)
 }
 
 #if !defined(CONFIG_USER_ONLY)
-hwaddr x86_cpu_get_phys_addr_attrs_debug(CPUState *cs, vaddr addr,
-                                         MemTxAttrs *attrs)
+bool x86_cpu_translate_for_debug(CPUState *cs, vaddr addr,
+                                 TranslateForDebugResult *result)
 {
     X86CPU *cpu = X86_CPU(cs);
     CPUX86State *env = &cpu->env;
@@ -263,8 +263,6 @@ hwaddr x86_cpu_get_phys_addr_attrs_debug(CPUState *cs, vaddr addr,
     uint32_t page_offset;
     int page_size;
 
-    *attrs = cpu_get_mem_attrs(env);
-
     a20_mask = x86_get_a20_mask(env);
     if (!(env->cr[0] & CR0_PG_MASK)) {
         pte = addr & a20_mask;
@@ -283,7 +281,7 @@ hwaddr x86_cpu_get_phys_addr_attrs_debug(CPUState *cs, vaddr addr,
             /* test virtual address sign extension */
             sext = la57 ? (int64_t)addr >> 56 : (int64_t)addr >> 47;
             if (sext != 0 && sext != -1) {
-                return -1;
+                return false;
             }
 
             if (la57) {
@@ -291,7 +289,7 @@ hwaddr x86_cpu_get_phys_addr_attrs_debug(CPUState *cs, vaddr addr,
                         (((addr >> 48) & 0x1ff) << 3)) & a20_mask;
                 pml5e = x86_ldq_phys(cs, pml5e_addr);
                 if (!(pml5e & PG_PRESENT_MASK)) {
-                    return -1;
+                    return false;
                 }
             } else {
                 pml5e = env->cr[3];
@@ -301,13 +299,13 @@ hwaddr x86_cpu_get_phys_addr_attrs_debug(CPUState *cs, vaddr addr,
                     (((addr >> 39) & 0x1ff) << 3)) & a20_mask;
             pml4e = x86_ldq_phys(cs, pml4e_addr);
             if (!(pml4e & PG_PRESENT_MASK)) {
-                return -1;
+                return false;
             }
             pdpe_addr = ((pml4e & PG_ADDRESS_MASK) +
                          (((addr >> 30) & 0x1ff) << 3)) & a20_mask;
             pdpe = x86_ldq_phys(cs, pdpe_addr);
             if (!(pdpe & PG_PRESENT_MASK)) {
-                return -1;
+                return false;
             }
             if (pdpe & PG_PSE_MASK) {
                 page_size = 1024 * 1024 * 1024;
@@ -322,14 +320,14 @@ hwaddr x86_cpu_get_phys_addr_attrs_debug(CPUState *cs, vaddr addr,
                 a20_mask;
             pdpe = x86_ldq_phys(cs, pdpe_addr);
             if (!(pdpe & PG_PRESENT_MASK))
-                return -1;
+                return false;
         }
 
         pde_addr = ((pdpe & PG_ADDRESS_MASK) +
                     (((addr >> 21) & 0x1ff) << 3)) & a20_mask;
         pde = x86_ldq_phys(cs, pde_addr);
         if (!(pde & PG_PRESENT_MASK)) {
-            return -1;
+            return false;
         }
         if (pde & PG_PSE_MASK) {
             /* 2 MB page */
@@ -343,7 +341,7 @@ hwaddr x86_cpu_get_phys_addr_attrs_debug(CPUState *cs, vaddr addr,
             pte = x86_ldq_phys(cs, pte_addr);
         }
         if (!(pte & PG_PRESENT_MASK)) {
-            return -1;
+            return false;
         }
     } else {
         uint32_t pde;
@@ -352,7 +350,7 @@ hwaddr x86_cpu_get_phys_addr_attrs_debug(CPUState *cs, vaddr addr,
         pde_addr = ((env->cr[3] & ~0xfff) + ((addr >> 20) & 0xffc)) & a20_mask;
         pde = x86_ldl_phys(cs, pde_addr);
         if (!(pde & PG_PRESENT_MASK))
-            return -1;
+            return false;
         if ((pde & PG_PSE_MASK) && (env->cr[4] & CR4_PSE_MASK)) {
             pte = pde | ((pde & 0x1fe000LL) << (32 - 13));
             page_size = 4096 * 1024;
@@ -361,7 +359,7 @@ hwaddr x86_cpu_get_phys_addr_attrs_debug(CPUState *cs, vaddr addr,
             pte_addr = ((pde & ~0xfff) + ((addr >> 10) & 0xffc)) & a20_mask;
             pte = x86_ldl_phys(cs, pte_addr);
             if (!(pte & PG_PRESENT_MASK)) {
-                return -1;
+                return false;
             }
             page_size = 4096;
         }
@@ -373,7 +371,12 @@ out:
 #endif
     pte &= PG_ADDRESS_MASK & ~(page_size - 1);
     page_offset = addr & (page_size - 1);
-    return pte | page_offset;
+
+    result->attrs = cpu_get_mem_attrs(env);
+    result->attrs.debug = 1;
+    result->physaddr = pte | page_offset;
+    result->lg_page_size = ctz64(page_size);
+    return true;
 }
 
 typedef struct MCEInjectionParams {
diff --git a/target/i386/whpx/whpx-all.c b/target/i386/whpx/whpx-all.c
index 7943adb93fe..e626acef2f0 100644
--- a/target/i386/whpx/whpx-all.c
+++ b/target/i386/whpx/whpx-all.c
@@ -247,7 +247,7 @@ struct whpx_register_set {
  *          e. Let the affected CPU run in the exclusive mode.
  *          f. Restore the original handler and the exception exit bitmap.
  *        Note that handling all corner cases related to IDT/GDT is harder
- *        than it may seem. See x86_cpu_get_phys_addr_attrs_debug() for a
+ *        than it may seem. See x86_cpu_translate_for_debug() for a
  *        rough idea.
  *
  *     3. In order to properly support guest-level debugging in parallel with
-- 
2.53.0

[PULL 22/22] hw/core: Remove SysemuCPUOps::get_phys_addr_attrs_debug

[Philippe Mathieu-Daudé]

From: Peter Maydell <peter.maydell@linaro.org>

No targets use the SysemuCPUOps::get_phys_addr_attrs_debug method
any more, so we can remove it, together with the handling of it
in cpu_translate_for_debug().

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20260528161450.3564396-4-peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 include/hw/core/sysemu-cpu-ops.h | 14 --------------
 hw/core/cpu-system.c             | 11 ++---------
 2 files changed, 2 insertions(+), 23 deletions(-)

diff --git a/include/hw/core/sysemu-cpu-ops.h b/include/hw/core/sysemu-cpu-ops.h
index 441901fae8e..8be6a84bd54 100644
--- a/include/hw/core/sysemu-cpu-ops.h
+++ b/include/hw/core/sysemu-cpu-ops.h
@@ -39,20 +39,6 @@ typedef struct SysemuCPUOps {
      * for a complete target page or they use memory attributes).
      */
     hwaddr (*get_phys_addr_debug)(CPUState *cpu, vaddr addr);
-    /**
-     * @get_phys_addr_attrs_debug: Callback for obtaining a physical address
-     *       and the associated memory transaction attributes to use for the
-     *       access.
-     *
-     * This must be able to handle a non-page-aligned address, and will
-     * return the physical address corresponding to that address.
-     *
-     * CPUs should prefer to implement translate_for_debug instead of
-     * this (and must do so if their translations are not always valid
-     * for a complete target page).
-     */
-    hwaddr (*get_phys_addr_attrs_debug)(CPUState *cpu, vaddr addr,
-                                        MemTxAttrs *attrs);
     /**
      * @translate_for_debug: Callback for translating a virtual address into
      * a physical address for debug purposes.
diff --git a/hw/core/cpu-system.c b/hw/core/cpu-system.c
index 16f048c9565..14eb4ed87f8 100644
--- a/hw/core/cpu-system.c
+++ b/hw/core/cpu-system.c
@@ -63,15 +63,8 @@ bool cpu_translate_for_debug(CPUState *cpu, vaddr addr,
         return cpu->cc->sysemu_ops->translate_for_debug(cpu, addr, result);
     } else {
         /* Fallbacks for CPUs which don't implement translate_for_debug */
-        if (cpu->cc->sysemu_ops->get_phys_addr_attrs_debug) {
-            result->physaddr =
-                cpu->cc->sysemu_ops->get_phys_addr_attrs_debug(cpu, addr,
-                                                               &result->attrs);
-        } else {
-            result->physaddr
-                = cpu->cc->sysemu_ops->get_phys_addr_debug(cpu, addr);
-            result->attrs = MEMTXATTRS_UNSPECIFIED;
-        }
+        result->physaddr = cpu->cc->sysemu_ops->get_phys_addr_debug(cpu, addr);
+        result->attrs = MEMTXATTRS_UNSPECIFIED;
         if (result->physaddr == -1) {
             return false;
         }
-- 
2.53.0

Re: [PULL 00/22] Single binary patches for 2026-05-28

[Stefan Hajnoczi]

[-- Attachment #1: Type: text/plain, Size: 116 bytes --]

Applied, thanks.

Please update the changelog at https://wiki.qemu.org/ChangeLog/11.1 for any user-visible changes.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]