CTSRD-CHERI · arichardson · Nov 15, 2025 · Nov 14, 2025 · Nov 14, 2025 · Nov 14, 2025
diff --git a/.github/workflows/build-and-test.yml b/.github/workflows/build-and-test.yml
@@ -0,0 +1,75 @@
+name: Build and Test
+
+on:
+  push:
+    branches: [ "main" ]
+  pull_request:
+    branches: [ "main" ]
+
+jobs:
+  build-and-test:
+    runs-on: ubuntu-22.04
+
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          submodules: 'false'
+
+      - name: Install dependencies
+        run: |
+          sudo apt-get update
+          sudo DEBIAN_FRONTEND=noninteractive apt-get install -y \
+              python3 \
+              ninja-build \
+              pkgconf \
+              libglib2.0-dev \
+              libfdt-dev \
+              libslirp-dev \
+              libpixman-1-dev
+
+      - name: Configure
+        run: |
+          mkdir build
+          cd build
+          ../configure \
+            --enable-werror \
+            --disable-docs \
+            --enable-fdt=system \
+            --enable-slirp=system \
+            --disable-capstone \
+            --disable-linux-user \
+            --target-list="arm-softmmu,aarch64-softmmu,morello-softmmu,mips64-softmmu,mips64cheri128-softmmu,riscv64-softmmu,riscv64xcheri-softmmu,riscv32-softmmu,riscv32xcheri-softmmu,x86_64-softmmu,riscv32cheristd-softmmu,riscv64cheristd-softmmu"
+
+      - name: Build
+        run: |
+          cd build
+          make -j$(nproc)
+
+      - name: Run Morello tests
+        run: |
+          git clone https://github.com/rems-project/morello-generated-tests.git
+          pwd
+          python -m venv .venv
+          source .venv/bin/activate
+          pip install pytest-xdist
+          cd tests/morello && pytest \
+            --morello-tests-dir=$GITHUB_WORKSPACE/morello-generated-tests \
+            --qemu=$GITHUB_WORKSPACE/build/qemu-system-morello \
+            --junit-xml=$GITHUB_WORKSPACE/morello-test-results.xml
+
+      - name: Run QEMU tests
+        run: |
+          cd build
+          pwd
+          ../meson/meson.py test --print-errorlogs --timeout-multiplier=2
+          cp meson-logs/testlog.junit.xml $GITHUB_WORKSPACE/qemu-test-results.xml
+        continue-on-error: true
+
+      - name: Publish Test Results
+        uses: EnricoMi/publish-unit-test-result-action@v2
+        with:
+          files: "*-test-results.xml"
+          action_fail_on_inconclusive: 'true'
+          action_fail: 'true'
+          # QEMU test results produce
+          large_files: 'true'
diff --git a/.gitlab-ci.d/cirrus/freebsd-12.vars b/.gitlab-ci.d/cirrus/freebsd-12.vars
@@ -11,6 +11,6 @@ MAKE='/usr/local/bin/gmake'
 NINJA='/usr/local/bin/ninja'
 PACKAGING_COMMAND='pkg'
 PIP3='/usr/local/bin/pip-3.8'
-PKGS='alsa-lib bash bzip2 ca_root_nss capstone4 ccache cdrkit-genisoimage ctags curl cyrus-sasl dbus diffutils dtc fusefs-libs3 gettext git glib gmake gnutls gsed gtk3 libepoxy libffi libgcrypt libjpeg-turbo libnfs libspice-server libssh libtasn1 llvm lzo2 meson ncurses nettle ninja opencv p5-Test-Harness perl5 pixman pkgconf png py38-numpy py38-pillow py38-pip py38-sphinx py38-sphinx_rtd_theme py38-virtualenv py38-yaml python3 rpm2cpio sdl2 sdl2_image snappy spice-protocol tesseract texinfo usbredir virglrenderer vte3 zstd'
+PKGS='alsa-lib bash bzip2 ca_root_nss capstone4 ccache cdrkit-genisoimage ctags curl cyrus-sasl dbus diffutils dtc fusefs-libs3 gettext git glib gmake gnutls gsed gtk3 libepoxy libffi libgcrypt libjpeg-turbo libnfs libspice-server libssh libtasn1 llvm lzo2 meson ncurses nettle ninja opencv perl5 pixman pkgconf png py38-numpy py38-pillow py38-pip py38-sphinx py38-sphinx_rtd_theme py38-virtualenv py38-yaml python3 rpm2cpio sdl2 sdl2_image snappy spice-protocol tesseract texinfo usbredir virglrenderer vte3 zstd'
 PYPI_PKGS=''
 PYTHON='/usr/local/bin/python3'
diff --git a/.gitlab-ci.d/cirrus/freebsd-13.vars b/.gitlab-ci.d/cirrus/freebsd-13.vars
@@ -11,6 +11,6 @@ MAKE='/usr/local/bin/gmake'
 NINJA='/usr/local/bin/ninja'
 PACKAGING_COMMAND='pkg'
 PIP3='/usr/local/bin/pip-3.8'
-PKGS='alsa-lib bash bzip2 ca_root_nss capstone4 ccache cdrkit-genisoimage ctags curl cyrus-sasl dbus diffutils dtc fusefs-libs3 gettext git glib gmake gnutls gsed gtk3 libepoxy libffi libgcrypt libjpeg-turbo libnfs libspice-server libssh libtasn1 llvm lzo2 meson ncurses nettle ninja opencv p5-Test-Harness perl5 pixman pkgconf png py38-numpy py38-pillow py38-pip py38-sphinx py38-sphinx_rtd_theme py38-virtualenv py38-yaml python3 rpm2cpio sdl2 sdl2_image snappy spice-protocol tesseract texinfo usbredir virglrenderer vte3 zstd'
+PKGS='alsa-lib bash bzip2 ca_root_nss capstone4 ccache cdrkit-genisoimage ctags curl cyrus-sasl dbus diffutils dtc fusefs-libs3 gettext git glib gmake gnutls gsed gtk3 libepoxy libffi libgcrypt libjpeg-turbo libnfs libspice-server libssh libtasn1 llvm lzo2 meson ncurses nettle ninja opencv perl5 pixman pkgconf png py38-numpy py38-pillow py38-pip py38-sphinx py38-sphinx_rtd_theme py38-virtualenv py38-yaml python3 rpm2cpio sdl2 sdl2_image snappy spice-protocol tesseract texinfo usbredir virglrenderer vte3 zstd'
 PYPI_PKGS=''
 PYTHON='/usr/local/bin/python3'
diff --git a/.gitlab-ci.d/cirrus/macos-11.vars b/.gitlab-ci.d/cirrus/macos-11.vars
@@ -5,12 +5,12 @@
 # https://gitlab.com/libvirt/libvirt-ci
 
 CCACHE='/usr/local/bin/ccache'
-CPAN_PKGS='Test::Harness'
+CPAN_PKGS=''
 CROSS_PKGS=''
 MAKE='/usr/local/bin/gmake'
 NINJA='/usr/local/bin/ninja'
 PACKAGING_COMMAND='brew'
 PIP3='/usr/local/bin/pip3'
-PKGS='bash bc bzip2 capstone ccache cpanminus ctags curl dbus diffutils dtc gcovr gettext git glib gnu-sed gnutls gtk+3 jemalloc jpeg-turbo libepoxy libffi libgcrypt libiscsi libnfs libpng libslirp libssh libtasn1 libusb llvm lzo make meson ncurses nettle ninja perl pixman pkg-config python3 rpm2cpio sdl2 sdl2_image snappy sparse spice-protocol tesseract texinfo usbredir vde vte3 zlib zstd'
+PKGS='bash bc bzip2 capstone ccache ctags curl dbus diffutils dtc gcovr gettext git glib gnu-sed gnutls gtk+3 jemalloc jpeg-turbo libepoxy libffi libgcrypt libiscsi libnfs libpng libslirp libssh libtasn1 libusb llvm lzo make meson ncurses nettle ninja perl pixman pkg-config python3 rpm2cpio sdl2 sdl2_image snappy sparse spice-protocol tesseract texinfo usbredir vde vte3 zlib zstd'
 PYPI_PKGS='PyYAML numpy pillow sphinx sphinx-rtd-theme virtualenv'
 PYTHON='/usr/local/bin/python3'
diff --git a/.gitlab-ci.d/containers.yml b/.gitlab-ci.d/containers.yml
@@ -19,11 +19,6 @@ amd64-debian-container:
   variables:
     NAME: debian-amd64
 
-amd64-ubuntu1804-container:
-  extends: .container_job_template
-  variables:
-    NAME: ubuntu1804
-
 amd64-ubuntu2004-container:
   extends: .container_job_template
   variables:

diff --git a/.gitlab-ci.d/custom-runners/ubuntu-20.04-aarch32.yml b/.gitlab-ci.d/custom-runners/ubuntu-20.04-aarch32.yml
@@ -1,6 +1,6 @@
 # All ubuntu-20.04 jobs should run successfully in an environment
 # setup by the scripts/ci/setup/qemu/build-environment.yml task
-# "Install basic packages to build QEMU on Ubuntu 18.04/20.04"
+# "Install basic packages to build QEMU on Ubuntu 20.04"
 
 ubuntu-20.04-aarch32-all:
  needs: []

diff --git a/.gitlab-ci.d/custom-runners/ubuntu-20.04-aarch64.yml b/.gitlab-ci.d/custom-runners/ubuntu-20.04-aarch64.yml
@@ -1,6 +1,6 @@
 # All ubuntu-20.04 jobs should run successfully in an environment
 # setup by the scripts/ci/setup/qemu/build-environment.yml task
-# "Install basic packages to build QEMU on Ubuntu 18.04/20.04"
+# "Install basic packages to build QEMU on Ubuntu 20.04"
 
 ubuntu-20.04-aarch64-all-linux-static:
  needs: []

diff --git a/scripts/ci/setup/build-environment.yml b/scripts/ci/setup/build-environment.yml
@@ -33,10 +33,9 @@
       when:
         - ansible_facts['distribution'] == 'Ubuntu'
 
-    - name: Install basic packages to build QEMU on Ubuntu 18.04/20.04
+    - name: Install basic packages to build QEMU on Ubuntu 20.04
       package:
         name:
-        # Originally from tests/docker/dockerfiles/ubuntu1804.docker
           - ccache
           - gcc
           - gettext
@@ -90,7 +89,7 @@
       when:
         - ansible_facts['distribution'] == 'Ubuntu'
 
-    - name: Install packages to build QEMU on Ubuntu 18.04/20.04 on non-s390x
+    - name: Install packages to build QEMU on Ubuntu 20.04 on non-s390x
       package:
         name:
           - libspice-server-dev
@@ -100,15 +99,6 @@
         - ansible_facts['distribution'] == 'Ubuntu'
         - ansible_facts['architecture'] != 's390x'
 
-    - name: Install basic packages to build QEMU on Ubuntu 18.04
-      package:
-        name:
-        # Originally from tests/docker/dockerfiles/ubuntu1804.docker
-          - clang
-      when:
-        - ansible_facts['distribution'] == 'Ubuntu'
-        - ansible_facts['distribution_version'] == '18.04'
-
     - name: Install basic packages to build QEMU on Ubuntu 20.04
       package:
         name:

diff --git a/semihosting/arm-compat-semi.c b/semihosting/arm-compat-semi.c
@@ -231,7 +231,11 @@ common_semi_set_ret(CPUState *cs, target_ulong ret)
 {
     ARMCPU *cpu = ARM_CPU(cs);
     CPUARMState *env = &cpu->env;
-    arm_set_xreg(env, 0, ret);
+    if (is_a64(env)) {
+        arm_set_a64_reg(env, 0, ret);
+    } else {
+        env->regs[0] = ret;
+    }
 }
 
 static inline bool

diff --git a/target/arm/arm-powerctl.c b/target/arm/arm-powerctl.c
@@ -122,7 +122,7 @@ static void arm_set_cpu_on_async_work(CPUState *target_cpu_state,
     assert(info->target_el == arm_current_el(&target_cpu->env));
 
     if (info->target_aa64) {
-        arm_set_xreg(&target_cpu->env, 0, info->context_id);
+        arm_set_a64_reg(&target_cpu->env, 0, info->context_id);
     } else {
         target_cpu->env.regs[0] = info->context_id;
     }

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
@@ -3634,25 +3634,30 @@ static inline QEMU_ALWAYS_INLINE target_ulong arm_get_a64_reg(CPUARMState *env,
 #endif
 }
 
-// Set an integer register by number in any mode.
-static inline void arm_set_xreg(CPUARMState *env, int regnum,
-                                target_ulong value)
+/* Set an AArch32 register by number and log the changed value. */
+static inline void arm_set_a64_reg(CPUARMState *env, int regnum,
+                                   target_ulong value)
 {
+#ifndef TARGET_AARCH64
+    g_assert_not_reached(); /* Should have checked is_a64() */
+#else
 #ifdef TARGET_CHERI
     update_capreg_to_intval(env, regnum, value);
 #else
-#ifdef TARGET_AARCH64
-    if (is_a64(env)) {
-        env->xregs[regnum] = value;
-        qemu_log_instr_reg(env, arm64_regnames[regnum], value, regnum,
-                           LRI_GPR_ACCESS);
-        return;
-    }
+    env->xregs[regnum] = value;
+    qemu_log_instr_reg(env, arm64_regnames[regnum], value, regnum,
+                       LRI_GPR_ACCESS);
 #endif
+#endif
+}
+
+/* Set an AArch32 register by number and log the changed value. */
+static inline void arm_set_a32_reg(CPUARMState *env, int regnum,
+                                   target_ulong value)
+{
     env->regs[regnum] = value;
     qemu_log_instr_reg(env, arm32_regnames[regnum], value, regnum,
                        LRI_GPR_ACCESS);
-#endif
 }
 
 // Increment a register preserving any other fields.

diff --git a/target/arm/gdbstub64.c b/target/arm/gdbstub64.c
@@ -53,12 +53,12 @@ int aarch64_cpu_gdb_write_register(CPUState *cs, uint8_t *mem_buf, int n)
 
     if (n < 31) {
         /* Core integer register.  */
-        arm_set_xreg(env, n, tmp);
+        arm_set_a64_reg(env, n, tmp);
         return 8;
     }
     switch (n) {
     case 31:
-        arm_set_xreg(env, n, tmp);
+        arm_set_a64_reg(env, 31, tmp);
         return 8;
     case 32:
         set_aarch_reg_to_x(env, &env->pc, tmp);

diff --git a/target/arm/helper-a64.c b/target/arm/helper-a64.c
@@ -634,8 +634,8 @@ void HELPER(casp_le_parallel)(CPUARMState *env, uint32_t rs, uint64_t addr,
     newv = int128_make128(new_lo, new_hi);
     oldv = cpu_atomic_cmpxchgo_le_mmu(env, addr, cmpv, newv, oi, ra);
 
-    arm_set_xreg(env, rs, int128_getlo(oldv));
-    arm_set_xreg(env, rs + 1, int128_gethi(oldv));
+    arm_set_a64_reg(env, rs, int128_getlo(oldv));
+    arm_set_a64_reg(env, rs + 1, int128_gethi(oldv));
 }
 
 void HELPER(casp_be_parallel)(CPUARMState *env, uint32_t rs, uint64_t addr,
@@ -656,8 +656,8 @@ void HELPER(casp_be_parallel)(CPUARMState *env, uint32_t rs, uint64_t addr,
     newv = int128_make128(new_lo, new_hi);
     oldv = cpu_atomic_cmpxchgo_be_mmu(env, addr, cmpv, newv, oi, ra);
 
-    arm_set_xreg(env, rs + 1, int128_getlo(oldv));
-    arm_set_xreg(env, rs, int128_gethi(oldv));
+    arm_set_a64_reg(env, rs + 1, int128_getlo(oldv));
+    arm_set_a64_reg(env, rs, int128_gethi(oldv));
 }
 
 /*

diff --git a/target/arm/helper.c b/target/arm/helper.c
@@ -10623,14 +10623,14 @@ static void handle_semihosting(CPUState *cs)
         qemu_log_mask(CPU_LOG_INT,
                       "...handling as semihosting call 0x" TARGET_FMT_lx "\n",
                       arm_get_a64_reg(env, 0));
-        arm_set_xreg(env, 0, do_common_semihosting(cs));
+        arm_set_a64_reg(env, 0, do_common_semihosting(cs));
         increment_aarch_reg(&env->pc, 4);
     } else {
 #ifndef TARGET_CHERI
         qemu_log_mask(CPU_LOG_INT,
                       "...handling as semihosting call 0x%x\n",
                       env->regs[0]);
-        env->regs[0] = do_common_semihosting(cs);
+        arm_set_a64_reg(env, 0, do_common_semihosting(cs));
         env->regs[15] += env->thumb ? 2 : 4;
 #endif
     }

diff --git a/target/arm/psci.c b/target/arm/psci.c
@@ -171,9 +171,9 @@ void arm_handle_psci_call(ARMCPU *cpu)
         }
         /* Powerdown is not supported, we always go into WFI */
         if (is_a64(env)) {
-            arm_set_xreg(env, 0, 0);
+            arm_set_a64_reg(env, 0, 0);
         } else {
-            env->regs[0] = 0;
+            arm_set_a32_reg(env, 0, 0);
         }
         helper_wfi(env, 4);
         break;
@@ -215,9 +215,9 @@ void arm_handle_psci_call(ARMCPU *cpu)
 
 err:
     if (is_a64(env)) {
-        arm_set_xreg(env, 0, ret);
+        arm_set_a64_reg(env, 0, ret);
     } else {
-        env->regs[0] = ret;
+        arm_set_a32_reg(env, 0, ret);
     }
     return;
 

diff --git a/target/cheri-common/cheri-lazy-capregs-types.h b/target/cheri-common/cheri-lazy-capregs-types.h
@@ -105,7 +105,8 @@ typedef struct GPCapRegs {
     aligned_cap_register_t decompressed[NUM_LAZY_CAP_REGS];
 } GPCapRegs;
 
-static inline cap_register_t *get_cap_in_gpregs(GPCapRegs *gpcrs, size_t index)
+static inline QEMU_ALWAYS_INLINE cap_register_t *
+get_cap_in_gpregs(GPCapRegs *gpcrs, size_t index)
 {
     return &gpcrs->decompressed[index].cap;
 }
@@ -114,7 +115,7 @@ static inline cap_register_t *get_cap_in_gpregs(GPCapRegs *gpcrs, size_t index)
  * Whether this lazy capreg is special (and therefore always stored fully
  * decompressed).
  */
-static inline bool lazy_capreg_number_is_special(int reg)
+static inline QEMU_ALWAYS_INLINE bool lazy_capreg_number_is_special(int reg)
 {
     cheri_debug_assert(reg < NUM_LAZY_CAP_REGS);
 #ifdef SCRATCH_REG_NUM

diff --git a/target/cheri-common/op_helper_cheri_common.c b/target/cheri-common/op_helper_cheri_common.c
@@ -1843,15 +1843,18 @@ void CHERI_HELPER_IMPL(debug_cap(CPUArchState *env, uint32_t regndx))
     GPCapRegs *gpcrs = cheri_get_gpcrs(env);
     /* Index manually in order not to decompress */
     const cap_register_t *cap;
-    if (regndx < 32) {
+    if (regndx < NUM_LAZY_CAP_REGS) {
         cap = get_cap_in_gpregs(gpcrs, regndx);
+    } else if (regndx == CHERI_EXC_REGNUM_PCC) {
+        cap = _cheri_get_pcc_unchecked(env);
+    } else if (regndx == CHERI_EXC_REGNUM_DDC) {
+        cap = cheri_get_ddc(env);
     } else {
-        assert(regndx == CHERI_EXC_REGNUM_PCC ||
-               regndx == CHERI_EXC_REGNUM_DDC || regndx < NUM_LAZY_CAP_REGS);
-        cap = get_capreg_or_special(env, regndx);
+        g_assert_not_reached();
     }
-    CapRegState state =
-        regndx < 32 ? get_capreg_state(gpcrs, regndx) : CREG_FULLY_DECOMPRESSED;
+    CapRegState state = regndx < NUM_LAZY_CAP_REGS
+                            ? get_capreg_state(gpcrs, regndx)
+                            : CREG_FULLY_DECOMPRESSED;
     bool stateMeansTagged = state == CREG_TAGGED_CAP;
     bool decompressedMeansTagged =
         (state == CREG_FULLY_DECOMPRESSED) && cap->cr_tag;

diff --git a/tests/docker/dockerfiles/alpine.docker b/tests/docker/dockerfiles/alpine.docker
@@ -73,7 +73,6 @@ RUN apk update && \
         openssh-client \
         pcre-dev \
         perl \
-        perl-test-harness \
         pixman-dev \
         pkgconf \
         pulseaudio-dev \

diff --git a/tests/docker/dockerfiles/centos8.docker b/tests/docker/dockerfiles/centos8.docker
@@ -87,7 +87,6 @@ RUN dnf update -y && \
         pam-devel \
         pcre-static \
         perl \
-        perl-Test-Harness \
         pixman-devel \
         pkgconfig \
         pulseaudio-libs-devel \

diff --git a/tests/docker/dockerfiles/debian-arm64-cross.docker b/tests/docker/dockerfiles/debian-arm64-cross.docker
@@ -29,7 +29,6 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
             hostname \
             libpcre2-dev \
             libspice-protocol-dev \
-            libtest-harness-perl \
             llvm \
             locales \
             make \

diff --git a/tests/docker/dockerfiles/debian-s390x-cross.docker b/tests/docker/dockerfiles/debian-s390x-cross.docker
@@ -29,7 +29,6 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
             hostname \
             libpcre2-dev \
             libspice-protocol-dev \
-            libtest-harness-perl \
             llvm \
             locales \
             make \

diff --git a/tests/docker/dockerfiles/debian-tricore-cross.docker b/tests/docker/dockerfiles/debian-tricore-cross.docker
@@ -25,7 +25,6 @@ RUN apt update && \
        git \
        libglib2.0-dev \
        libpixman-1-dev \
-       libtest-harness-perl \
        locales \
        make \
        ninja-build \