[PULL 00/10] target-arm queue

[PULL 00/10] target-arm queue

[Peter Maydell]

Hi; not so many patches in this one, but notably it includes the
fix for various Avocado CI tests failing (incorrectly reported by
Avocado as a timeout, but really a QEMU exit-with-error).

thanks
-- PMM

The following changes since commit c8de6ec63d766ca1998c5af468483ce912fdc0c2:

  Merge tag 'pull-request-2022-09-28' of https://gitlab.com/thuth/qemu into staging (2022-09-28 17:04:11 -0400)

are available in the Git repository at:

  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20220930

for you to fetch changes up to beeec926d24aac28f95cc7694ef3837d7a4cd3bb:

  target/arm: mark SP_EL1 with ARM_CP_EL3_NO_EL2_KEEP (2022-09-29 18:01:09 +0100)

----------------------------------------------------------------
target-arm queue:
 * Fix breakage of icount mode when guest touches MDCR_EL3, MDCR_EL2,
   PMCNTENSET_EL0 or PMCNTENCLR_EL0
 * Make writes to MDCR_EL3 use PMU start/finish calls
 * Let AArch32 write to SDCR.SCCD
 * Rearrange cpu64.c so all the CPU initfns are together
 * hw/arm/xlnx-zynqmp: Connect ZynqMP's USB controllers
 * hw/arm/virt: fix some minor issues with generated device tree
 * Fix regression where EL3 could not write to SP_EL1 if there is no EL2

----------------------------------------------------------------
Francisco Iglesias (1):
      hw/arm/xlnx-zynqmp: Connect ZynqMP's USB controllers

Jean-Philippe Brucker (4):
      hw/arm/virt: Fix devicetree warning about the root node
      hw/arm/virt: Fix devicetree warning about the GIC node
      hw/arm/virt: Use "msi-map" devicetree property for PCI
      hw/arm/virt: Fix devicetree warning about the SMMU node

Jerome Forissier (1):
      target/arm: mark SP_EL1 with ARM_CP_EL3_NO_EL2_KEEP

Peter Maydell (4):
      target/arm: Mark registers which call pmu_op_start() as ARM_CP_IO
      target/arm: Make writes to MDCR_EL3 use PMU start/finish calls
      target/arm: Update SDCR_VALID_MASK to include SCCD
      target/arm: Rearrange cpu64.c so all the CPU initfns are together

 include/hw/arm/xlnx-zynqmp.h |   3 +
 target/arm/cpu.h             |   8 +-
 hw/arm/virt.c                |   8 +-
 hw/arm/xlnx-zynqmp.c         |  36 +++
 target/arm/cpu64.c           | 712 +++++++++++++++++++++----------------------
 target/arm/helper.c          |  32 +-
 6 files changed, 427 insertions(+), 372 deletions(-)

Re: [PULL 00/10] target-arm queue

[Stefan Hajnoczi]

[-- Attachment #1: Type: text/plain, Size: 115 bytes --]

Applied, thanks.

Please update the changelog at https://wiki.qemu.org/ChangeLog/7.2 for any user-visible changes.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

[PULL 00/10] target-arm queue

[Peter Maydell]

Hi; here are some arm patches for the freeze; mostly these are
fairly unexciting minor bug fixes.

I did find in my CI run for this that the check-python-minreqs
job failed with:
"ERROR: /builds/pm215/qemu/scripts/qapi/commands.py Imports are incorrectly sorted and/or formatted."
https://gitlab.com/pm215/qemu/-/jobs/12092087877

but since this pullreq doesn't touch that file or anything
else python-related I assume that's a pre-existing CI failure.

thanks
-- PMM

The following changes since commit 9febfa94b69b7146582c48a868bd2330ac45037f:

  Merge tag 'for-upstream' of https://repo.or.cz/qemu/kevin into staging (2025-11-12 11:47:42 +0100)

are available in the Git repository at:

  https://gitlab.com/pm215/qemu.git tags/pull-target-arm-20251114

for you to fetch changes up to 522444744eb79dd01e377ad2ed15544f10bcc70c:

  hw/audio/lm4549: Don't try to open a zero-frequency audio voice (2025-11-14 13:20:10 +0000)

----------------------------------------------------------------
target-arm queue:
 * MAINTAINERS file update for whpx
 * target/arm: Fix accidental write to TCG constant
 * target/arm/cpu64: remove duplicate include
 * hw/display/xlnx_dp: don't abort() on guest errors
 * cxl, vfio, tests: clean up includes
 * hw/misc/npcm_clk: Don't divide by zero when calculating frequency
 * hw/audio/lm4549: Don't try to open a zero-frequency audio voice

----------------------------------------------------------------
Mohamed Mediouni (1):
      MAINTAINERS: update maintainers for WHPX

Osama Abdelkader (1):
      target/arm/cpu64: remove duplicate include

Peter Maydell (7):
      hw/display/xlnx_dp.c: Don't abort on AUX FIFO overrun/underrun
      hw/display/xlnx_dp: Don't abort for unsupported graphics formats
      cxl: Clean up includes
      vfio: Clean up includes
      tests: Clean up includes
      hw/misc/npcm_clk: Don't divide by zero when calculating frequency
      hw/audio/lm4549: Don't try to open a zero-frequency audio voice

Richard Henderson (1):
      target/arm: Fix accidental write to TCG constant

 MAINTAINERS                          |  3 +-
 hw/vfio-user/container.h             |  1 -
 hw/vfio-user/device.h                |  1 -
 hw/vfio/pci-quirks.h                 |  1 -
 tests/qtest/aspeed-hace-utils.h      |  1 -
 tests/qtest/aspeed-smc-utils.h       |  1 -
 hw/audio/lm4549.c                    | 17 +++++++-
 hw/cxl/cxl-mailbox-utils.c           |  2 +-
 hw/display/xlnx_dp.c                 | 83 ++++++++++++++++++++++++++++++++----
 hw/mem/cxl_type3.c                   |  2 +-
 hw/misc/npcm_clk.c                   |  5 ++-
 hw/vfio-user/container.c             |  2 +-
 hw/vfio-user/pci.c                   |  2 +-
 hw/vfio/ap.c                         |  1 -
 hw/vfio/container.c                  |  2 +-
 hw/vfio/cpr-legacy.c                 |  2 +-
 target/arm/cpu64.c                   |  1 -
 target/arm/tcg/translate.c           | 11 +++--
 tests/qtest/aspeed_gpio-test.c       |  1 -
 tests/qtest/dbus-display-test.c      |  3 --
 tests/qtest/pnv-spi-seeprom-test.c   |  1 -
 tests/unit/test-cutils.c             |  2 +-
 tests/unit/test-error-report.c       |  1 -
 tests/unit/test-io-channel-command.c |  2 -
 24 files changed, 110 insertions(+), 38 deletions(-)

[PULL 01/10] MAINTAINERS: update maintainers for WHPX

[Peter Maydell]

From: Mohamed Mediouni <mohamed@unpredictable.fr>

From Pedro Barbuda (on Teams):

> we meant to have that switched a while back. you can add me as the maintainer. Pedro Barbuda (pbarbuda@microsoft.com)

Signed-off-by: Mohamed Mediouni <mohamed@unpredictable.fr>
Message-id: 20251107072337.28932-1-mohamed@unpredictable.fr
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 MAINTAINERS | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/MAINTAINERS b/MAINTAINERS
index 9cb181e1da7..38325e0617c 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -547,7 +547,8 @@ F: include/system/hvf.h
 F: include/system/hvf_int.h
 
 WHPX CPUs
-M: Sunil Muthuswamy <sunilmut@microsoft.com>
+M: Pedro Barbuda <pbarbuda@microsoft.com>
+M: Mohamed Mediouni <mohamed@unpredictable.fr>
 S: Supported
 F: target/i386/whpx/
 F: accel/stubs/whpx-stub.c
-- 
2.43.0

[PULL 02/10] target/arm: Fix accidental write to TCG constant

[Peter Maydell]

From: Richard Henderson <richard.henderson@linaro.org>

Currently an unpredictable movw such as

  movw pc, 0x123

results in the tinycode

   and_i32 $0x123,$0x123,$0xfffffffc
   mov_i32 pc,$0x123
   exit_tb $0x0

which is clearly a bug: writing to a constant is incorrect and
discards the result of the mask.  Fix this by always doing an and_i32
and trusting the optimizer to turn this into a simple move when the
mask is zero.

Signed-off-by: Anton Johansson <anjo@rev.ng>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Gustavo Romero <gustavo.romero@linaro.org>
Reviewed-by: <gustavo.romero@linaro.org>
Message-id: 20251106144909.533997-1-richard.henderson@linaro.org
[rth: Avoid an extra temp and extra move.]
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
[PMM: commit message tweak]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/translate.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/target/arm/tcg/translate.c b/target/arm/tcg/translate.c
index 5f64fed2202..63735d97898 100644
--- a/target/arm/tcg/translate.c
+++ b/target/arm/tcg/translate.c
@@ -303,20 +303,23 @@ TCGv_i32 add_reg_for_lit(DisasContext *s, int reg, int ofs)
    marked as dead.  */
 void store_reg(DisasContext *s, int reg, TCGv_i32 var)
 {
+    uint32_t mask = 0;
+
     if (reg == 15) {
-        /* In Thumb mode, we must ignore bit 0.
+        /*
+         * In Thumb mode, we must ignore bit 0.
          * In ARM mode, for ARMv4 and ARMv5, it is UNPREDICTABLE if bits [1:0]
          * are not 0b00, but for ARMv6 and above, we must ignore bits [1:0].
          * We choose to ignore [1:0] in ARM mode for all architecture versions.
          */
-        tcg_gen_andi_i32(var, var, s->thumb ? ~1 : ~3);
+        mask = s->thumb ? 1 : 3;
         s->base.is_jmp = DISAS_JUMP;
         s->pc_save = -1;
     } else if (reg == 13 && arm_dc_feature(s, ARM_FEATURE_M)) {
         /* For M-profile SP bits [1:0] are always zero */
-        tcg_gen_andi_i32(var, var, ~3);
+        mask = 3;
     }
-    tcg_gen_mov_i32(cpu_R[reg], var);
+    tcg_gen_andi_i32(cpu_R[reg], var, ~mask);
 }
 
 /*
-- 
2.43.0

[PULL 03/10] target/arm/cpu64: remove duplicate include

[Peter Maydell]

From: Osama Abdelkader <osama.abdelkader@gmail.com>

cpregs.h is included twice.

Signed-off-by: Osama Abdelkader <osama.abdelkader@gmail.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Gavin Shan <gshan@redhat.com>
Message-id: 20251110161552.700333-1-osama.abdelkader@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu64.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index f81cfd0113c..ae84d8e4205 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -34,7 +34,6 @@
 #include "hw/qdev-properties.h"
 #include "internals.h"
 #include "cpu-features.h"
-#include "cpregs.h"
 
 /* convert between <register>_IDX and SYS_<register> */
 #define DEF(NAME, OP0, OP1, CRN, CRM, OP2)      \
-- 
2.43.0

[PULL 04/10] hw/display/xlnx_dp.c: Don't abort on AUX FIFO overrun/underrun

[Peter Maydell]

The documentation of the Xilinx DisplayPort subsystem at
https://www.xilinx.com/support/documents/ip_documentation/v_dp_txss1/v3_1/pg299-v-dp-txss1.pdf
doesn't say what happens if a guest tries to issue an AUX write
command with a length greater than the amount of data in the AUX
write FIFO, or tries to write more data to the write FIFO than it can
hold, or issues multiple commands that put data into the AUX read
FIFO without reading it such that it overflows.

Currently QEMU will abort() in these guest-error situations, either
in xlnx_dp.c itself or in the fifo8 code.  Make these cases all be
logged as guest errors instead.  We choose to ignore the new data on
overflow, and return 0 on underflow. This is in line with how we handled
the "read from empty RX FIFO" case in commit a09ef5040477.

Cc: qemu-stable@nongnu.org
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1418
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1419
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1424
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Message-id: 20251106145209.1083998-2-peter.maydell@linaro.org
---
 hw/display/xlnx_dp.c | 28 ++++++++++++++++++++++++++--
 1 file changed, 26 insertions(+), 2 deletions(-)

diff --git a/hw/display/xlnx_dp.c b/hw/display/xlnx_dp.c
index 96cbb1b3a7d..c2bf692e7b1 100644
--- a/hw/display/xlnx_dp.c
+++ b/hw/display/xlnx_dp.c
@@ -435,7 +435,18 @@ static void xlnx_dp_aux_clear_rx_fifo(XlnxDPState *s)
 
 static void xlnx_dp_aux_push_rx_fifo(XlnxDPState *s, uint8_t *buf, size_t len)
 {
+    size_t avail = fifo8_num_free(&s->rx_fifo);
     DPRINTF("Push %u data in rx_fifo\n", (unsigned)len);
+    if (len > avail) {
+        /*
+         * Data sheet doesn't specify behaviour here: we choose to ignore
+         * the excess data.
+         */
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: ignoring %zu bytes pushed to full RX_FIFO\n",
+                      __func__, len - avail);
+        len = avail;
+    }
     fifo8_push_all(&s->rx_fifo, buf, len);
 }
 
@@ -466,7 +477,18 @@ static void xlnx_dp_aux_clear_tx_fifo(XlnxDPState *s)
 
 static void xlnx_dp_aux_push_tx_fifo(XlnxDPState *s, uint8_t *buf, size_t len)
 {
+    size_t avail = fifo8_num_free(&s->tx_fifo);
     DPRINTF("Push %u data in tx_fifo\n", (unsigned)len);
+    if (len > avail) {
+        /*
+         * Data sheet doesn't specify behaviour here: we choose to ignore
+         * the excess data.
+         */
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: ignoring %zu bytes pushed to full TX_FIFO\n",
+                      __func__, len - avail);
+        len = avail;
+    }
     fifo8_push_all(&s->tx_fifo, buf, len);
 }
 
@@ -475,8 +497,10 @@ static uint8_t xlnx_dp_aux_pop_tx_fifo(XlnxDPState *s)
     uint8_t ret;
 
     if (fifo8_is_empty(&s->tx_fifo)) {
-        error_report("%s: TX_FIFO underflow", __func__);
-        abort();
+        /* Data sheet doesn't specify behaviour here: we choose to return 0 */
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: attempt to read empty TX_FIFO\n",
+                      __func__);
+        return 0;
     }
     ret = fifo8_pop(&s->tx_fifo);
     DPRINTF("pop 0x%2.2X from tx_fifo.\n", ret);
-- 
2.43.0

[PULL 05/10] hw/display/xlnx_dp: Don't abort for unsupported graphics formats

[Peter Maydell]

If the guest writes an invalid or unsupported value to the
AV_BUF_FORMAT register, currently we abort().  Instead, log this as
either a guest error or an unimplemented error and continue.

The existing code treats DP_NL_VID_CB_Y0_CR_Y1 as x8b8g8r8
via a "case 0" that does not use the enum constant name for some
reason; we leave that alone beyond adding a comment about the
weird code.

Documentation of this register seems to be at:
https://docs.amd.com/r/en-US/ug1087-zynq-ultrascale-registers/AV_BUF_FORMAT-DISPLAY_PORT-Register

Cc: qemu-stable@nongnu.org
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1415
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20251106145209.1083998-3-peter.maydell@linaro.org
---
 hw/display/xlnx_dp.c | 55 +++++++++++++++++++++++++++++++++++++++-----
 1 file changed, 49 insertions(+), 6 deletions(-)

diff --git a/hw/display/xlnx_dp.c b/hw/display/xlnx_dp.c
index c2bf692e7b1..a248b943a5a 100644
--- a/hw/display/xlnx_dp.c
+++ b/hw/display/xlnx_dp.c
@@ -665,14 +665,28 @@ static void xlnx_dp_change_graphic_fmt(XlnxDPState *s)
     case DP_GRAPHIC_BGR888:
         s->g_plane.format = PIXMAN_b8g8r8;
         break;
+    case DP_GRAPHIC_RGBA5551:
+    case DP_GRAPHIC_RGBA4444:
+    case DP_GRAPHIC_8BPP:
+    case DP_GRAPHIC_4BPP:
+    case DP_GRAPHIC_2BPP:
+    case DP_GRAPHIC_1BPP:
+        qemu_log_mask(LOG_UNIMP, "%s: unimplemented graphic format %u",
+                      __func__,
+                      s->avbufm_registers[AV_BUF_FORMAT] & DP_GRAPHIC_MASK);
+        s->g_plane.format = PIXMAN_r8g8b8a8;
+        break;
     default:
-        error_report("%s: unsupported graphic format %u", __func__,
-                     s->avbufm_registers[AV_BUF_FORMAT] & DP_GRAPHIC_MASK);
-        abort();
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: invalid graphic format %u",
+                      __func__,
+                      s->avbufm_registers[AV_BUF_FORMAT] & DP_GRAPHIC_MASK);
+        s->g_plane.format = PIXMAN_r8g8b8a8;
+        break;
     }
 
     switch (s->avbufm_registers[AV_BUF_FORMAT] & DP_NL_VID_FMT_MASK) {
     case 0:
+        /* This is DP_NL_VID_CB_Y0_CR_Y1 ??? */
         s->v_plane.format = PIXMAN_x8b8g8r8;
         break;
     case DP_NL_VID_Y0_CB_Y1_CR:
@@ -681,10 +695,39 @@ static void xlnx_dp_change_graphic_fmt(XlnxDPState *s)
     case DP_NL_VID_RGBA8880:
         s->v_plane.format = PIXMAN_x8b8g8r8;
         break;
+    case DP_NL_VID_CR_Y0_CB_Y1:
+    case DP_NL_VID_Y0_CR_Y1_CB:
+    case DP_NL_VID_YV16:
+    case DP_NL_VID_YV24:
+    case DP_NL_VID_YV16CL:
+    case DP_NL_VID_MONO:
+    case DP_NL_VID_YV16CL2:
+    case DP_NL_VID_YUV444:
+    case DP_NL_VID_RGB888:
+    case DP_NL_VID_RGB888_10BPC:
+    case DP_NL_VID_YUV444_10BPC:
+    case DP_NL_VID_YV16CL2_10BPC:
+    case DP_NL_VID_YV16CL_10BPC:
+    case DP_NL_VID_YV16_10BPC:
+    case DP_NL_VID_YV24_10BPC:
+    case DP_NL_VID_Y_ONLY_10BPC:
+    case DP_NL_VID_YV16_420:
+    case DP_NL_VID_YV16CL_420:
+    case DP_NL_VID_YV16CL2_420:
+    case DP_NL_VID_YV16_420_10BPC:
+    case DP_NL_VID_YV16CL_420_10BPC:
+    case DP_NL_VID_YV16CL2_420_10BPC:
+        qemu_log_mask(LOG_UNIMP, "%s: unimplemented video format %u",
+                      __func__,
+                      s->avbufm_registers[AV_BUF_FORMAT] & DP_NL_VID_FMT_MASK);
+        s->v_plane.format = PIXMAN_x8b8g8r8;
+        break;
     default:
-        error_report("%s: unsupported video format %u", __func__,
-                     s->avbufm_registers[AV_BUF_FORMAT] & DP_NL_VID_FMT_MASK);
-        abort();
+        qemu_log_mask(LOG_UNIMP, "%s: invalid video format %u",
+                      __func__,
+                      s->avbufm_registers[AV_BUF_FORMAT] & DP_NL_VID_FMT_MASK);
+        s->v_plane.format = PIXMAN_x8b8g8r8;
+        break;
     }
 
     xlnx_dp_recreate_surface(s);
-- 
2.43.0

[PULL 06/10] cxl: Clean up includes

[Peter Maydell]

This commit was created with scripts/clean-includes:
 ./scripts/clean-includes --git cxl hw/cxl hw/mem

All .c should include qemu/osdep.h first.  The script performs three
related cleanups:

* Ensure .c files include qemu/osdep.h first.
* Including it in a .h is redundant, since the .c  already includes
  it.  Drop such inclusions.
* Likewise, including headers qemu/osdep.h includes is redundant.
  Drop these, too.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Acked-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Message-id: 20251104160943.751997-8-peter.maydell@linaro.org
---
 hw/cxl/cxl-mailbox-utils.c | 2 +-
 hw/mem/cxl_type3.c         | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/cxl/cxl-mailbox-utils.c b/hw/cxl/cxl-mailbox-utils.c
index 68c7cc98912..6cfdd98168f 100644
--- a/hw/cxl/cxl-mailbox-utils.c
+++ b/hw/cxl/cxl-mailbox-utils.c
@@ -7,9 +7,9 @@
  * COPYING file in the top-level directory.
  */
 
+#include "qemu/osdep.h"
 #include <math.h>
 
-#include "qemu/osdep.h"
 #include "hw/pci/msi.h"
 #include "hw/pci/msix.h"
 #include "hw/cxl/cxl.h"
diff --git a/hw/mem/cxl_type3.c b/hw/mem/cxl_type3.c
index be609ff9d03..4f3688a71b6 100644
--- a/hw/mem/cxl_type3.c
+++ b/hw/mem/cxl_type3.c
@@ -8,9 +8,9 @@
  *
  * SPDX-License-Identifier: GPL-v2-only
  */
+#include "qemu/osdep.h"
 #include <math.h>
 
-#include "qemu/osdep.h"
 #include "qemu/units.h"
 #include "qemu/error-report.h"
 #include "qapi/qapi-commands-cxl.h"
-- 
2.43.0

[PULL 07/10] vfio: Clean up includes

[Peter Maydell]

This commit was created with scripts/clean-includes:
 ./scripts/clean-includes --git vfio hw/vfio hw/vfio-user

All .c should include qemu/osdep.h first.  The script performs three
related cleanups:

* Ensure .c files include qemu/osdep.h first.
* Including it in a .h is redundant, since the .c  already includes
  it.  Drop such inclusions.
* Likewise, including headers qemu/osdep.h includes is redundant.
  Drop these, too.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20251104160943.751997-9-peter.maydell@linaro.org
---
 hw/vfio-user/container.h | 1 -
 hw/vfio-user/device.h    | 1 -
 hw/vfio/pci-quirks.h     | 1 -
 hw/vfio-user/container.c | 2 +-
 hw/vfio-user/pci.c       | 2 +-
 hw/vfio/ap.c             | 1 -
 hw/vfio/container.c      | 2 +-
 hw/vfio/cpr-legacy.c     | 2 +-
 8 files changed, 4 insertions(+), 8 deletions(-)

diff --git a/hw/vfio-user/container.h b/hw/vfio-user/container.h
index a2b42e3169d..c952e090631 100644
--- a/hw/vfio-user/container.h
+++ b/hw/vfio-user/container.h
@@ -7,7 +7,6 @@
 #ifndef HW_VFIO_USER_CONTAINER_H
 #define HW_VFIO_USER_CONTAINER_H
 
-#include "qemu/osdep.h"
 
 #include "hw/vfio/vfio-container.h"
 #include "hw/vfio-user/proxy.h"
diff --git a/hw/vfio-user/device.h b/hw/vfio-user/device.h
index d183a3950e2..49c05848f1a 100644
--- a/hw/vfio-user/device.h
+++ b/hw/vfio-user/device.h
@@ -9,7 +9,6 @@
  * SPDX-License-Identifier: GPL-2.0-or-later
  */
 
-#include "qemu/osdep.h"
 #include "linux/vfio.h"
 
 #include "hw/vfio-user/proxy.h"
diff --git a/hw/vfio/pci-quirks.h b/hw/vfio/pci-quirks.h
index d1532e379b1..a6282e063a1 100644
--- a/hw/vfio/pci-quirks.h
+++ b/hw/vfio/pci-quirks.h
@@ -12,7 +12,6 @@
 #ifndef HW_VFIO_VFIO_PCI_QUIRKS_H
 #define HW_VFIO_VFIO_PCI_QUIRKS_H
 
-#include "qemu/osdep.h"
 #include "exec/memop.h"
 
 /*
diff --git a/hw/vfio-user/container.c b/hw/vfio-user/container.c
index e45192fef65..dab7a23224c 100644
--- a/hw/vfio-user/container.c
+++ b/hw/vfio-user/container.c
@@ -6,9 +6,9 @@
  * SPDX-License-Identifier: GPL-2.0-or-later
  */
 
+#include "qemu/osdep.h"
 #include <sys/ioctl.h>
 #include <linux/vfio.h>
-#include "qemu/osdep.h"
 
 #include "hw/vfio-user/container.h"
 #include "hw/vfio-user/device.h"
diff --git a/hw/vfio-user/pci.c b/hw/vfio-user/pci.c
index b53ed3b456f..353d07e7819 100644
--- a/hw/vfio-user/pci.c
+++ b/hw/vfio-user/pci.c
@@ -6,8 +6,8 @@
  * SPDX-License-Identifier: GPL-2.0-or-later
  */
 
-#include <sys/ioctl.h>
 #include "qemu/osdep.h"
+#include <sys/ioctl.h>
 #include "qapi-visit-sockets.h"
 #include "qemu/error-report.h"
 
diff --git a/hw/vfio/ap.c b/hw/vfio/ap.c
index 7719f245797..3368ac89150 100644
--- a/hw/vfio/ap.c
+++ b/hw/vfio/ap.c
@@ -10,7 +10,6 @@
  * directory.
  */
 
-#include <stdbool.h>
 #include "qemu/osdep.h"
 #include CONFIG_DEVICES /* CONFIG_IOMMUFD */
 #include <linux/vfio.h>
diff --git a/hw/vfio/container.c b/hw/vfio/container.c
index 9ddec300e35..013a691bc5a 100644
--- a/hw/vfio/container.c
+++ b/hw/vfio/container.c
@@ -10,10 +10,10 @@
  * SPDX-License-Identifier: GPL-2.0-or-later
  */
 
+#include "qemu/osdep.h"
 #include <sys/ioctl.h>
 #include <linux/vfio.h>
 
-#include "qemu/osdep.h"
 #include "system/tcg.h"
 #include "system/ram_addr.h"
 #include "qapi/error.h"
diff --git a/hw/vfio/cpr-legacy.c b/hw/vfio/cpr-legacy.c
index 86c943158e2..7c03ddb9610 100644
--- a/hw/vfio/cpr-legacy.c
+++ b/hw/vfio/cpr-legacy.c
@@ -4,9 +4,9 @@
  * SPDX-License-Identifier: GPL-2.0-or-later
  */
 
+#include "qemu/osdep.h"
 #include <sys/ioctl.h>
 #include <linux/vfio.h>
-#include "qemu/osdep.h"
 #include "hw/vfio/vfio-container-legacy.h"
 #include "hw/vfio/vfio-device.h"
 #include "hw/vfio/vfio-listener.h"
-- 
2.43.0

[PULL 08/10] tests: Clean up includes

[Peter Maydell]

This commit was created with scripts/clean-includes:
 ./scripts/clean-includes --git tests tests

with one hand-edit to remove a now-empty #ifndef WIN32...#endif
from tests/qtest/dbus-display-test.c .

All .c should include qemu/osdep.h first.  The script performs three
related cleanups:

* Ensure .c files include qemu/osdep.h first.
* Including it in a .h is redundant, since the .c  already includes
  it.  Drop such inclusions.
* Likewise, including headers qemu/osdep.h includes is redundant.
  Drop these, too.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Message-id: 20251104160943.751997-10-peter.maydell@linaro.org
---
 tests/qtest/aspeed-hace-utils.h      | 1 -
 tests/qtest/aspeed-smc-utils.h       | 1 -
 tests/qtest/aspeed_gpio-test.c       | 1 -
 tests/qtest/dbus-display-test.c      | 3 ---
 tests/qtest/pnv-spi-seeprom-test.c   | 1 -
 tests/unit/test-cutils.c             | 2 +-
 tests/unit/test-error-report.c       | 1 -
 tests/unit/test-io-channel-command.c | 2 --
 8 files changed, 1 insertion(+), 11 deletions(-)

diff --git a/tests/qtest/aspeed-hace-utils.h b/tests/qtest/aspeed-hace-utils.h
index c8b2ec45af2..27ab2bb9758 100644
--- a/tests/qtest/aspeed-hace-utils.h
+++ b/tests/qtest/aspeed-hace-utils.h
@@ -8,7 +8,6 @@
 #ifndef TESTS_ASPEED_HACE_UTILS_H
 #define TESTS_ASPEED_HACE_UTILS_H
 
-#include "qemu/osdep.h"
 #include "libqtest.h"
 #include "qemu/bitops.h"
 
diff --git a/tests/qtest/aspeed-smc-utils.h b/tests/qtest/aspeed-smc-utils.h
index b07870f3b8f..e2fd8ff1bd1 100644
--- a/tests/qtest/aspeed-smc-utils.h
+++ b/tests/qtest/aspeed-smc-utils.h
@@ -26,7 +26,6 @@
 #ifndef TESTS_ASPEED_SMC_UTILS_H
 #define TESTS_ASPEED_SMC_UTILS_H
 
-#include "qemu/osdep.h"
 #include "qemu/bswap.h"
 #include "libqtest-single.h"
 #include "qemu/bitops.h"
diff --git a/tests/qtest/aspeed_gpio-test.c b/tests/qtest/aspeed_gpio-test.c
index c2f9ca2298a..decbba23c8f 100644
--- a/tests/qtest/aspeed_gpio-test.c
+++ b/tests/qtest/aspeed_gpio-test.c
@@ -27,7 +27,6 @@
 #include "qemu/timer.h"
 #include "qobject/qdict.h"
 #include "libqtest-single.h"
-#include "qemu/typedefs.h"
 
 #define AST2600_GPIO_BASE 0x1E780000
 
diff --git a/tests/qtest/dbus-display-test.c b/tests/qtest/dbus-display-test.c
index f7fc873bfb3..1d5951b7117 100644
--- a/tests/qtest/dbus-display-test.c
+++ b/tests/qtest/dbus-display-test.c
@@ -7,9 +7,6 @@
 #include <gio/gio.h>
 #include <gio/gunixfdlist.h>
 #include "libqtest.h"
-#ifndef WIN32
-#include <sys/mman.h>
-#endif
 #include "ui/dbus-display1.h"
 
 static GDBusConnection*
diff --git a/tests/qtest/pnv-spi-seeprom-test.c b/tests/qtest/pnv-spi-seeprom-test.c
index 600493c425d..8033261758b 100644
--- a/tests/qtest/pnv-spi-seeprom-test.c
+++ b/tests/qtest/pnv-spi-seeprom-test.c
@@ -5,7 +5,6 @@
  *
  * SPDX-License-Identifier: GPL-2.0-or-later
  */
-#include <unistd.h>
 #include "qemu/osdep.h"
 #include "libqtest.h"
 #include "qemu/bswap.h"
diff --git a/tests/unit/test-cutils.c b/tests/unit/test-cutils.c
index 227acc59955..75fae29003a 100644
--- a/tests/unit/test-cutils.c
+++ b/tests/unit/test-cutils.c
@@ -25,9 +25,9 @@
  * THE SOFTWARE.
  */
 
+#include "qemu/osdep.h"
 #include <math.h>
 
-#include "qemu/osdep.h"
 #include "qemu/cutils.h"
 #include "qemu/units.h"
 
diff --git a/tests/unit/test-error-report.c b/tests/unit/test-error-report.c
index 0cbde3c4cf5..a8532fc58fc 100644
--- a/tests/unit/test-error-report.c
+++ b/tests/unit/test-error-report.c
@@ -8,7 +8,6 @@
  */
 
 #include "qemu/osdep.h"
-#include "glib-compat.h"
 #include <locale.h>
 
 #include "qemu/error-report.h"
diff --git a/tests/unit/test-io-channel-command.c b/tests/unit/test-io-channel-command.c
index 4f022617df0..964418b5cd9 100644
--- a/tests/unit/test-io-channel-command.c
+++ b/tests/unit/test-io-channel-command.c
@@ -20,8 +20,6 @@
 
 #include "qemu/osdep.h"
 #include <glib/gstdio.h>
-#include <sys/types.h>
-#include <sys/stat.h>
 #include "io/channel-command.h"
 #include "io-channel-helpers.h"
 #include "qapi/error.h"
-- 
2.43.0

[PULL 09/10] hw/misc/npcm_clk: Don't divide by zero when calculating frequency

[Peter Maydell]

If the guest misprograms the PLL registers to request a zero
divisor, we currently fall over with a division by zero:

../../hw/misc/npcm_clk.c:221:14: runtime error: division by zero
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior ../../hw/misc/npcm_clk.c:221:14

Thread 1 "qemu-system-aar" received signal SIGFPE, Arithmetic exception.
0x00005555584d8f6d in npcm7xx_clk_update_pll (opaque=0x7fffed159a20) at ../../hw/misc/npcm_clk.c:221
221             freq /= PLLCON_INDV(con) * PLLCON_OTDV1(con) * PLLCON_OTDV2(con);

Avoid this by treating this invalid setting like a stopped clock
(setting freq to 0).

Cc: qemu-stable@nongnu.org
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/549
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20251107150137.1353532-1-peter.maydell@linaro.org
---
 hw/misc/npcm_clk.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/hw/misc/npcm_clk.c b/hw/misc/npcm_clk.c
index c48d40b4468..e202a8a2998 100644
--- a/hw/misc/npcm_clk.c
+++ b/hw/misc/npcm_clk.c
@@ -212,13 +212,14 @@ static void npcm7xx_clk_update_pll(void *opaque)
 {
     NPCM7xxClockPLLState *s = opaque;
     uint32_t con = s->clk->regs[s->reg];
-    uint64_t freq;
+    uint64_t freq, freq_div;
 
     /* The PLL is grounded if it is not locked yet. */
     if (con & PLLCON_LOKI) {
         freq = clock_get_hz(s->clock_in);
         freq *= PLLCON_FBDV(con);
-        freq /= PLLCON_INDV(con) * PLLCON_OTDV1(con) * PLLCON_OTDV2(con);
+        freq_div = PLLCON_INDV(con) * PLLCON_OTDV1(con) * PLLCON_OTDV2(con);
+        freq = freq_div ? freq / freq_div : 0;
     } else {
         freq = 0;
     }
-- 
2.43.0

[PULL 10/10] hw/audio/lm4549: Don't try to open a zero-frequency audio voice

[Peter Maydell]

If the guest incorrectly programs the lm4549 audio chip with a zero
frequency, we will pass this to AUD_open_out(), which will complain:

   A bug was just triggered in AUD_open_out
   Save all your work and restart without audio
   I am sorry
   Context:
   audio: frequency=0 nchannels=2 fmt=S16 endianness=little

The datasheet doesn't say what we should do here, only that the valid
range for the freqency is 4000 to 48000 Hz; we choose to log the
guest error and ignore an attempt to change the DAC rate to something
outside the valid range.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/410
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20251107154116.1396769-1-peter.maydell@linaro.org
---
 hw/audio/lm4549.c | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/hw/audio/lm4549.c b/hw/audio/lm4549.c
index 745441bd790..bf711c49c04 100644
--- a/hw/audio/lm4549.c
+++ b/hw/audio/lm4549.c
@@ -15,6 +15,7 @@
 
 #include "qemu/osdep.h"
 #include "hw/hw.h"
+#include "qemu/log.h"
 #include "qemu/audio.h"
 #include "lm4549.h"
 #include "migration/vmstate.h"
@@ -179,9 +180,23 @@ void lm4549_write(lm4549_state *s,
         break;
 
     case LM4549_PCM_Front_DAC_Rate:
-        regfile[LM4549_PCM_Front_DAC_Rate] = value;
         DPRINTF("DAC rate change = %i\n", value);
 
+        /*
+         * Valid sample rates are 4kHz to 48kHz.
+         * The datasheet doesn't say what happens if you try to
+         * set the frequency to zero. AUD_open_out() will print
+         * a bug message if we pass it a zero frequency, so just
+         * ignore attempts to set the DAC frequency to zero.
+         */
+        if (value < 4000 || value > 48000) {
+            qemu_log_mask(LOG_GUEST_ERROR,
+                          "%s: DAC sample rate %d Hz is invalid, ignoring it\n",
+                          __func__, value);
+            break;
+        }
+        regfile[LM4549_PCM_Front_DAC_Rate] = value;
+
         /* Re-open a voice with the new sample rate */
         struct audsettings as;
         as.freq = value;
-- 
2.43.0

Re: [PULL 00/10] target-arm queue

[Richard Henderson]

On 11/14/25 16:21, Peter Maydell wrote:
> Hi; here are some arm patches for the freeze; mostly these are
> fairly unexciting minor bug fixes.
> 
> I did find in my CI run for this that the check-python-minreqs
> job failed with:
> "ERROR: /builds/pm215/qemu/scripts/qapi/commands.py Imports are incorrectly sorted and/or formatted."
> https://gitlab.com/pm215/qemu/-/jobs/12092087877
> 
> but since this pullreq doesn't touch that file or anything
> else python-related I assume that's a pre-existing CI failure.
> 
> thanks
> -- PMM
> 
> The following changes since commit 9febfa94b69b7146582c48a868bd2330ac45037f:
> 
>    Merge tag 'for-upstream' ofhttps://repo.or.cz/qemu/kevin into staging (2025-11-12 11:47:42 +0100)
> 
> are available in the Git repository at:
> 
>    https://gitlab.com/pm215/qemu.git tags/pull-target-arm-20251114
> 
> for you to fetch changes up to 522444744eb79dd01e377ad2ed15544f10bcc70c:
> 
>    hw/audio/lm4549: Don't try to open a zero-frequency audio voice (2025-11-14 13:20:10 +0000)
> 
> ----------------------------------------------------------------
> target-arm queue:
>   * MAINTAINERS file update for whpx
>   * target/arm: Fix accidental write to TCG constant
>   * target/arm/cpu64: remove duplicate include
>   * hw/display/xlnx_dp: don't abort() on guest errors
>   * cxl, vfio, tests: clean up includes
>   * hw/misc/npcm_clk: Don't divide by zero when calculating frequency
>   * hw/audio/lm4549: Don't try to open a zero-frequency audio voice

Applied, thanks.  Please update https://wiki.qemu.org/ChangeLog/10.2 as appropriate.

r~