[PULL 0/6] Various fixes for QEMU v11.0-rc1

[PULL 0/6] Various fixes for QEMU v11.0-rc1

[Thomas Huth]

The following changes since commit 8e711856d7639cbffa51405f2cc2366e3d9e3a23:

  Merge tag 'hppa-fixes-for-v11-pull-request' of https://github.com/hdeller/qemu-hppa into staging (2026-03-20 10:04:48 +0000)

are available in the Git repository at:

  https://gitlab.com/thuth/qemu.git tags/pull-request-2026-03-23

for you to fetch changes up to b86eff44ba09b4baea17d2b002afa221de753cc4:

  tests/functional: remove heuristics for finding build dir (2026-03-23 08:16:07 +0100)

----------------------------------------------------------------
* Fix various crashes that can happen when running QEMU with -device xyz,help
* Improve detection of build directory in the functional patches

----------------------------------------------------------------
Daniel P. Berrangé (2):
      tests/functional: fix log placement when run directly
      tests/functional: remove heuristics for finding build dir

Thomas Huth (4):
      hw/pci-host/raven: Fix crash when introspecting raven-pcihost from the CLI
      hw/display/cg3: Fix crash when introspecting cgthree from the CLI
      hw/sparc/sun4m_iommu: Fix crash when introspecting sun4m-iommu from the CLI
      hw/sparc64/sun4u_iommu: Fix crash when introspecting sun4u-iommu from the CLI

 hw/display/cg3.c                     | 18 ++++------
 hw/pci-host/raven.c                  | 68 ++++++++++++++++--------------------
 hw/sparc/sun4m_iommu.c               | 11 +++---
 hw/sparc64/sun4u_iommu.c             | 11 +++---
 tests/functional/meson.build         |  3 +-
 tests/functional/qemu_test/config.py | 13 +++----
 6 files changed, 55 insertions(+), 69 deletions(-)

[PULL 1/6] hw/pci-host/raven: Fix crash when introspecting raven-pcihost from the CLI

[Thomas Huth]

From: Thomas Huth <thuth@redhat.com>

QEMU currently crashes when introspecting raven-pcihost from the command
line interface:

 $ ./qemu-system-ppc -device raven-pcihost,help
 Segmentation fault (core dumped)

This happens because the raven_pcihost_initfn instance init function
calls get_system_memory(), but that is not available here yet.

There does not seem to be a compelling reason for initializing the
memory regions from the instance init function, so let's simply move
the code into the realize() function instead to fix this issue.

Tested-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20260317074049.436460-1-thuth@redhat.com>
---
 hw/pci-host/raven.c | 68 +++++++++++++++++++++------------------------
 1 file changed, 31 insertions(+), 37 deletions(-)

diff --git a/hw/pci-host/raven.c b/hw/pci-host/raven.c
index b3c2678667a..b3836dc9a28 100644
--- a/hw/pci-host/raven.c
+++ b/hw/pci-host/raven.c
@@ -212,8 +212,39 @@ static void raven_pcihost_realizefn(DeviceState *d, Error **errp)
     PCIHostState *h = PCI_HOST_BRIDGE(dev);
     PREPPCIState *s = RAVEN_PCI_HOST_BRIDGE(dev);
     MemoryRegion *address_space_mem = get_system_memory();
+    Object *obj = OBJECT(d);
     int i;
 
+    memory_region_init(&s->pci_io, obj, "pci-io", 0x3f800000);
+    memory_region_init_io(&s->pci_io_non_contiguous, obj, &raven_io_ops, s,
+                          "pci-io-non-contiguous", 0x00800000);
+    memory_region_init(&s->pci_memory, obj, "pci-memory", 0x3f000000);
+    address_space_init(&s->pci_io_as, &s->pci_io, "raven-io");
+
+    /*
+     * Raven's raven_io_ops use the address-space API to access pci-conf-idx
+     * (which is also owned by the raven device). As such, mark the
+     * pci_io_non_contiguous as re-entrancy safe.
+     */
+    s->pci_io_non_contiguous.disable_reentrancy_guard = true;
+
+    /* CPU address space */
+    memory_region_add_subregion(address_space_mem, PCI_IO_BASE_ADDR,
+                                &s->pci_io);
+    memory_region_add_subregion_overlap(address_space_mem, PCI_IO_BASE_ADDR,
+                                        &s->pci_io_non_contiguous, 1);
+    memory_region_add_subregion(address_space_mem, 0xc0000000, &s->pci_memory);
+
+    /* Bus master address space */
+    memory_region_init(&s->bm, obj, "bm-raven", 4 * GiB);
+    memory_region_init_alias(&s->bm_pci_memory_alias, obj, "bm-pci-memory",
+                             &s->pci_memory, 0,
+                             memory_region_size(&s->pci_memory));
+    memory_region_init_alias(&s->bm_ram_alias, obj, "bm-system",
+                             address_space_mem, 0, 0x80000000);
+    memory_region_add_subregion(&s->bm, 0         , &s->bm_pci_memory_alias);
+    memory_region_add_subregion(&s->bm, 0x80000000, &s->bm_ram_alias);
+
     /*
      * According to PReP specification section 6.1.6 "System Interrupt
      * Assignments", all PCI interrupts are routed via IRQ 15
@@ -256,42 +287,6 @@ static void raven_pcihost_realizefn(DeviceState *d, Error **errp)
     pci_setup_iommu(h->bus, &raven_iommu_ops, s);
 }
 
-static void raven_pcihost_initfn(Object *obj)
-{
-    PREPPCIState *s = RAVEN_PCI_HOST_BRIDGE(obj);
-    MemoryRegion *address_space_mem = get_system_memory();
-
-    memory_region_init(&s->pci_io, obj, "pci-io", 0x3f800000);
-    memory_region_init_io(&s->pci_io_non_contiguous, obj, &raven_io_ops, s,
-                          "pci-io-non-contiguous", 0x00800000);
-    memory_region_init(&s->pci_memory, obj, "pci-memory", 0x3f000000);
-    address_space_init(&s->pci_io_as, &s->pci_io, "raven-io");
-
-    /*
-     * Raven's raven_io_ops use the address-space API to access pci-conf-idx
-     * (which is also owned by the raven device). As such, mark the
-     * pci_io_non_contiguous as re-entrancy safe.
-     */
-    s->pci_io_non_contiguous.disable_reentrancy_guard = true;
-
-    /* CPU address space */
-    memory_region_add_subregion(address_space_mem, PCI_IO_BASE_ADDR,
-                                &s->pci_io);
-    memory_region_add_subregion_overlap(address_space_mem, PCI_IO_BASE_ADDR,
-                                        &s->pci_io_non_contiguous, 1);
-    memory_region_add_subregion(address_space_mem, 0xc0000000, &s->pci_memory);
-
-    /* Bus master address space */
-    memory_region_init(&s->bm, obj, "bm-raven", 4 * GiB);
-    memory_region_init_alias(&s->bm_pci_memory_alias, obj, "bm-pci-memory",
-                             &s->pci_memory, 0,
-                             memory_region_size(&s->pci_memory));
-    memory_region_init_alias(&s->bm_ram_alias, obj, "bm-system",
-                             get_system_memory(), 0, 0x80000000);
-    memory_region_add_subregion(&s->bm, 0         , &s->bm_pci_memory_alias);
-    memory_region_add_subregion(&s->bm, 0x80000000, &s->bm_ram_alias);
-}
-
 static void raven_pcihost_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
@@ -330,7 +325,6 @@ static const TypeInfo raven_types[] = {
         .name = TYPE_RAVEN_PCI_HOST_BRIDGE,
         .parent = TYPE_PCI_HOST_BRIDGE,
         .instance_size = sizeof(PREPPCIState),
-        .instance_init = raven_pcihost_initfn,
         .class_init = raven_pcihost_class_init,
     },
     {
-- 
2.53.0

[PULL 2/6] hw/display/cg3: Fix crash when introspecting cgthree from the CLI

[Thomas Huth]

From: Thomas Huth <thuth@redhat.com>

QEMU currently crashes when introspecting the cgthree device from the
command line interface:

 $ ./qemu-system-sparc -device cgthree,help
 Segmentation fault (core dumped)

This happens because the memory_region_init_rom() function internally
calls qemu_ram_alloc_internal() that needs the current_machine pointer
to be set up - which is not the case here since the machine has not
been created yet.

There does not seem to be a compelling reason for initializing the
memory regions from the instance_init function, so let's simply move
the code into the realize() function instead to fix this issue.

Tested-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20260317080623.438230-1-thuth@redhat.com>
---
 hw/display/cg3.c | 18 ++++++------------
 1 file changed, 6 insertions(+), 12 deletions(-)

diff --git a/hw/display/cg3.c b/hw/display/cg3.c
index 61bdb0552e9..0a413fbb7ec 100644
--- a/hw/display/cg3.c
+++ b/hw/display/cg3.c
@@ -277,10 +277,13 @@ static const GraphicHwOps cg3_ops = {
     .gfx_update = cg3_update_display,
 };
 
-static void cg3_initfn(Object *obj)
+static void cg3_realizefn(DeviceState *dev, Error **errp)
 {
-    SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
-    CG3State *s = CG3(obj);
+    SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
+    Object *obj = OBJECT(dev);
+    CG3State *s = CG3(dev);
+    int ret;
+    char *fcode_filename;
 
     memory_region_init_rom(&s->rom, obj, "cg3.prom", FCODE_MAX_ROM_SIZE,
                            &error_fatal);
@@ -289,14 +292,6 @@ static void cg3_initfn(Object *obj)
     memory_region_init_io(&s->reg, obj, &cg3_reg_ops, s, "cg3.reg",
                           CG3_REG_SIZE);
     sysbus_init_mmio(sbd, &s->reg);
-}
-
-static void cg3_realizefn(DeviceState *dev, Error **errp)
-{
-    SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
-    CG3State *s = CG3(dev);
-    int ret;
-    char *fcode_filename;
 
     /* FCode ROM */
     fcode_filename = qemu_find_file(QEMU_FILE_TYPE_BIOS, CG3_ROM_FILE);
@@ -381,7 +376,6 @@ static const TypeInfo cg3_info = {
     .name          = TYPE_CG3,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(CG3State),
-    .instance_init = cg3_initfn,
     .class_init    = cg3_class_init,
 };
 
-- 
2.53.0

[PULL 3/6] hw/sparc/sun4m_iommu: Fix crash when introspecting sun4m-iommu from the CLI

[Thomas Huth]

From: Thomas Huth <thuth@redhat.com>

QEMU currently crashes when introspecting the sun4m-iommu device from the
command line interface:

 $ ./qemu-system-sparc -display none -device sun4m-iommu,help
 qemu-system-sparc: ../../devel/qemu/system/physmem.c:1401:
  register_multipage: Assertion `num_pages' failed.
 Aborted (core dumped)

There does not seem to be a compelling reason for initializing the
memory regions from the instance_init function, so let's simply move
the code into a realize() function instead to fix this issue.

Reported-by: Markus Armbruster <armbru@redhat.com>
Tested-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20260317084450.442071-1-thuth@redhat.com>
---
 hw/sparc/sun4m_iommu.c | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/hw/sparc/sun4m_iommu.c b/hw/sparc/sun4m_iommu.c
index ab5eb67072a..1534445992b 100644
--- a/hw/sparc/sun4m_iommu.c
+++ b/hw/sparc/sun4m_iommu.c
@@ -351,13 +351,14 @@ static void iommu_reset(DeviceState *d)
     s->regs[IOMMU_MASK_ID] = IOMMU_TS_MASK;
 }
 
-static void iommu_init(Object *obj)
+static void iommu_realize(DeviceState *ds, Error **errp)
 {
-    IOMMUState *s = SUN4M_IOMMU(obj);
-    SysBusDevice *dev = SYS_BUS_DEVICE(obj);
+    IOMMUState *s = SUN4M_IOMMU(ds);
+    SysBusDevice *dev = SYS_BUS_DEVICE(ds);
+    Object *obj = OBJECT(ds);
 
     memory_region_init_iommu(&s->iommu, sizeof(s->iommu),
-                             TYPE_SUN4M_IOMMU_MEMORY_REGION, OBJECT(dev),
+                             TYPE_SUN4M_IOMMU_MEMORY_REGION, obj,
                              "iommu-sun4m", UINT64_MAX);
     address_space_init(&s->iommu_as, MEMORY_REGION(&s->iommu), "iommu-as");
 
@@ -377,6 +378,7 @@ static void iommu_class_init(ObjectClass *klass, const void *data)
     DeviceClass *dc = DEVICE_CLASS(klass);
 
     device_class_set_legacy_reset(dc, iommu_reset);
+    dc->realize = iommu_realize;
     dc->vmsd = &vmstate_iommu;
     device_class_set_props(dc, iommu_properties);
 }
@@ -385,7 +387,6 @@ static const TypeInfo iommu_info = {
     .name          = TYPE_SUN4M_IOMMU,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(IOMMUState),
-    .instance_init = iommu_init,
     .class_init    = iommu_class_init,
 };
 
-- 
2.53.0

[PULL 4/6] hw/sparc64/sun4u_iommu: Fix crash when introspecting sun4u-iommu from the CLI

[Thomas Huth]

From: Thomas Huth <thuth@redhat.com>

QEMU currently crashes when introspecting the sun4u-iommu device from the
command line interface:

 $ ./qemu-system-sparc64 -display none -device sun4u-iommu,help
 qemu-system-sparc64: ../../devel/qemu/system/physmem.c:1401:
  register_multipage: Assertion `num_pages' failed.
 Aborted (core dumped)

There does not seem to be a compelling reason for initializing the
memory regions from the instance_init function, so let's simply move
the code into a realize() function instead to fix this issue.

Reported-by: Markus Armbruster <armbru@redhat.com>
Tested-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20260317085839.445178-1-thuth@redhat.com>
---
 hw/sparc64/sun4u_iommu.c | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/hw/sparc64/sun4u_iommu.c b/hw/sparc64/sun4u_iommu.c
index 0188ce35d29..fe9d47b822f 100644
--- a/hw/sparc64/sun4u_iommu.c
+++ b/hw/sparc64/sun4u_iommu.c
@@ -290,13 +290,14 @@ static void iommu_reset(DeviceState *d)
     memset(s->regs, 0, IOMMU_NREGS * sizeof(uint64_t));
 }
 
-static void iommu_init(Object *obj)
+static void iommu_realize(DeviceState *ds, Error **errp)
 {
-    IOMMUState *s = SUN4U_IOMMU(obj);
-    SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
+    IOMMUState *s = SUN4U_IOMMU(ds);
+    SysBusDevice *sbd = SYS_BUS_DEVICE(ds);
+    Object *obj = OBJECT(ds);
 
     memory_region_init_iommu(&s->iommu, sizeof(s->iommu),
-                             TYPE_SUN4U_IOMMU_MEMORY_REGION, OBJECT(s),
+                             TYPE_SUN4U_IOMMU_MEMORY_REGION, obj,
                              "iommu-sun4u", UINT64_MAX);
     address_space_init(&s->iommu_as, MEMORY_REGION(&s->iommu), "iommu-as");
 
@@ -310,13 +311,13 @@ static void iommu_class_init(ObjectClass *klass, const void *data)
     DeviceClass *dc = DEVICE_CLASS(klass);
 
     device_class_set_legacy_reset(dc, iommu_reset);
+    dc->realize = iommu_realize;
 }
 
 static const TypeInfo iommu_info = {
     .name          = TYPE_SUN4U_IOMMU,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(IOMMUState),
-    .instance_init = iommu_init,
     .class_init    = iommu_class_init,
 };
 
-- 
2.53.0

[PULL 5/6] tests/functional: fix log placement when run directly

[Thomas Huth]

From: Daniel P. Berrangé <berrange@redhat.com>

When running functional tests directly there are some heuristics
to figure out where the build directory lives, along with the
possibility to override the logic by setting the QEMU_BUILD_DIR
env variable. This env var is set as part of the test env when
run via Meson but not when run directly.

A particular flaw with the currently logic is that it silently
uses the wrong location when the build directory is a sub-dir
under "./build", which is a common usage scenario for some devs.

With the recent introduction of the 'run' script, we now have
the MESON_BUILD_ROOT env variable set unconditionally, so we
can rely on that from the functional tests to get the correct
location in all scenarios.

Reported-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20260310114756.146083-2-berrange@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 tests/functional/meson.build         | 2 +-
 tests/functional/qemu_test/config.py | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/tests/functional/meson.build b/tests/functional/meson.build
index 9bec5a07516..0f7c90bed0f 100644
--- a/tests/functional/meson.build
+++ b/tests/functional/meson.build
@@ -75,7 +75,7 @@ foreach speed : ['quick', 'thorough']
       test_deps += [qemu_img]
     endif
     test_env.set('QEMU_TEST_QEMU_BINARY', test_emulator.full_path())
-    test_env.set('QEMU_BUILD_ROOT', meson.project_build_root())
+    test_env.set('MESON_BUILD_ROOT', meson.project_build_root())
     test_env.set('PYTHONPATH', meson.project_source_root() / 'python:' +
                                meson.current_source_dir())
 
diff --git a/tests/functional/qemu_test/config.py b/tests/functional/qemu_test/config.py
index 6d4c9c3ce1d..0192027233e 100644
--- a/tests/functional/qemu_test/config.py
+++ b/tests/functional/qemu_test/config.py
@@ -21,7 +21,7 @@ def _source_dir():
     return Path(__file__).parent.parent.parent.parent
 
 def _build_dir():
-    root = os.getenv('QEMU_BUILD_ROOT')
+    root = os.getenv('MESON_BUILD_ROOT')
     if root is not None:
         return Path(root)
     # Makefile.mtest only exists in build dir, so if it is available, use CWD
@@ -32,7 +32,7 @@ def _build_dir():
     if os.path.exists(root):
         return Path(root)
 
-    raise Exception("Cannot identify build dir, set QEMU_BUILD_ROOT")
+    raise Exception("Cannot identify build dir, set MESON_BUILD_ROOT")
 
 BUILD_DIR = _build_dir()
 
-- 
2.53.0

[PULL 6/6] tests/functional: remove heuristics for finding build dir

[Thomas Huth]

From: Daniel P. Berrangé <berrange@redhat.com>

Currently some heuristics are used to locate the build dir, if the
MESON_BUILD_ROOT environment variable is not set. These are not
entirely accurate, however, especially if the developer is using
nested sub-dirs under $PWD/build/...

Since the introduction of the 'run' script, we can ensure any
direct execution of the tests will have MESON_BUILD_ROOT set.

Meanwhile when meson runs the test it will also have this env
set. The only gap is when running pre-caching, and that is easily
fixed to set MESON_BUILD_ROOT.

It can thus be assumed that MESON_BUILD_ROOT will always be set
in any supported execution scenario, which allows the heuristics
to be removed.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20260310114756.146083-3-berrange@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 tests/functional/meson.build         |  1 +
 tests/functional/qemu_test/config.py | 11 +++--------
 2 files changed, 4 insertions(+), 8 deletions(-)

diff --git a/tests/functional/meson.build b/tests/functional/meson.build
index 0f7c90bed0f..3b42299e7ce 100644
--- a/tests/functional/meson.build
+++ b/tests/functional/meson.build
@@ -96,6 +96,7 @@ foreach speed : ['quick', 'thorough']
       teststamp = testname + '.tstamp'
       test_precache_env = environment()
       test_precache_env.set('QEMU_TEST_PRECACHE', meson.current_build_dir() / teststamp)
+      test_precache_env.set('MESON_BUILD_ROOT', meson.project_build_root())
       test_precache_env.set('PYTHONPATH', meson.project_source_root() / 'python:' +
                                           meson.current_source_dir())
       precache = custom_target('func-precache-' + testname,
diff --git a/tests/functional/qemu_test/config.py b/tests/functional/qemu_test/config.py
index 0192027233e..e0893f630ee 100644
--- a/tests/functional/qemu_test/config.py
+++ b/tests/functional/qemu_test/config.py
@@ -24,15 +24,10 @@ def _build_dir():
     root = os.getenv('MESON_BUILD_ROOT')
     if root is not None:
         return Path(root)
-    # Makefile.mtest only exists in build dir, so if it is available, use CWD
-    if os.path.exists('Makefile.mtest'):
-        return Path(os.getcwd())
 
-    root = os.path.join(_source_dir(), 'build')
-    if os.path.exists(root):
-        return Path(root)
-
-    raise Exception("Cannot identify build dir, set MESON_BUILD_ROOT")
+    raise Exception("Missing MESON_BUILD_ROOT environment variable. " +
+                    "Please use the '<BUILD-DIR>/run' script if invoking " +
+                    "directly instead of via make/meson")
 
 BUILD_DIR = _build_dir()
 
-- 
2.53.0

Re: [PULL 0/6] Various fixes for QEMU v11.0-rc1

[Peter Maydell]

On Mon, 23 Mar 2026 at 10:29, Thomas Huth <thuth@redhat.com> wrote:
>
> The following changes since commit 8e711856d7639cbffa51405f2cc2366e3d9e3a23:
>
>   Merge tag 'hppa-fixes-for-v11-pull-request' of https://github.com/hdeller/qemu-hppa into staging (2026-03-20 10:04:48 +0000)
>
> are available in the Git repository at:
>
>   https://gitlab.com/thuth/qemu.git tags/pull-request-2026-03-23
>
> for you to fetch changes up to b86eff44ba09b4baea17d2b002afa221de753cc4:
>
>   tests/functional: remove heuristics for finding build dir (2026-03-23 08:16:07 +0100)
>
> ----------------------------------------------------------------
> * Fix various crashes that can happen when running QEMU with -device xyz,help
> * Improve detection of build directory in the functional patches



Applied, thanks.

Please update the changelog at https://wiki.qemu.org/ChangeLog/11.0
for any user-visible changes.

-- PMM