Peter Maydell [Mon, 24 Nov 2025 17:34:07 +0000 (17:34 +0000)]
replay: Improve assert in replay_char_read_all_load()
In replay_char_read_all_load() we get a buffer and size from the
replay log. We know the size has to fit an int because of how we
write the log. However the way we assert this is wrong: we cast the
size_t from replay_get_array() to an int and then check that it is
non-negative. This misses cases where an over-large size is
truncated into a positive value by the cast.
Replace the assertion with checking that the size is in-range
before doing the cast.
Coverity complained about the possible overflow: CID 1643440.
Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251124173407.50124-1-peter.maydell@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
hw/virtio: Use error_setg_file_open() for a better error message
The error message changes from
vhost-vsock: failed to open vhost device: REASON
to
Could not open '/dev/vhost-vsock': REASON
I think the exact file name is more useful to know than the file's
purpose.
Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251121121438.1249498-8-armbru@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
hw/scsi: Use error_setg_file_open() for a better error message
The error message changes from
vhost-scsi: open vhost char device failed: REASON
to
Could not open '/dev/vhost-scsi': REASON
I think the exact file name is more useful to know than the file's
purpose.
We could put back the "vhost-scsi: " prefix with error_prepend(). Not
worth the bother.
Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dave@treblig.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251121121438.1249498-7-armbru@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
hw/usb: Convert to qemu_create() for a better error message
The error message changes from
open FILENAME failed
to
Could not create 'FILENAME': REASON
where REASON is the value of strerror(errno).
Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251121121438.1249498-3-armbru@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
"Unsupported 'parameter=1' SMP configuration" was proposed to be
deprecated in the commit 54c4ea8f3ae6 ("hw/core/machine-smp: Deprecate
unsupported "parameter=1" SMP configurations").
But the related code was reverted later in the commit 9d7950edb0cd
("hw/core: allow parameter=1 for SMP topology on any machine").
Thus, this SMP behavior is still valid and is not actually deprecated.
Remove outdated document descriptions.
Reported-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Zhao Liu <zhao1.liu@intel.com> Reviewed-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20251121084416.1031466-1-zhao1.liu@intel.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Peter Maydell [Fri, 7 Nov 2025 13:10:44 +0000 (13:10 +0000)]
hw/pci: Make msix_init take a uint32_t for nentries
msix_init() and msix_init_exclusive_bar() take an "unsigned short"
argument for the number of MSI-X vectors to try to use. This is big
enough for the maximum permitted number of vectors, which is 2048.
Unfortunately, we have several devices (most notably virtio) which
allow the user to specify the desired number of vectors, and which
use uint32_t properties for this. If the user sets the property to a
value that is too big for a uint16_t, the value will be truncated
when it is passed to msix_init(), and msix_init() may then return
success if the truncated value is a valid one.
The resulting mismatch between the number of vectors the msix code
thinks the device has and the number of vectors the device itself
thinks it has can cause assertions, such as the one in issue 2631,
where "-device virtio-mouse-pci,vectors=19923041" is interpreted by
msix as "97 vectors" and by the virtio-pci layer as "19923041
vectors"; a guest attempt to access vector 97 thus passes the
virtio-pci bounds checking and hits an essertion in
msix_vector_use().
Avoid this by making msix_init() and its wrapper function
msix_init_exclusive_bar() take the number of vectors as a uint32_t.
The erroneous command line will now produce the warning
qemu-system-i386: -device virtio-mouse-pci,vectors=19923041:
warning: unable to init msix vectors to 19923041
and proceed without crashing. (The virtio device warns and falls
back to not using MSIX, rather than complaining that the option is
not a valid value this is the same as the existing behaviour for
values that are beyond the MSI-X maximum possible value but fit into
a 16-bit integer, like 2049.)
To ensure this doesn't result in potential overflows in calculation
of the BAR size in msix_init_exclusive_bar(), we duplicate the
nentries error-check from msix_init() at the top of
msix_init_exclusive_bar(), so we know nentries is sane before we
start using it.
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2631 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251107131044.1321637-1-peter.maydell@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Peter Maydell [Thu, 6 Nov 2025 15:19:59 +0000 (15:19 +0000)]
qtest: Allow and ignore blank lines in input
Currently the code that reads the qtest protocol commands insists
that every input line has a command. If it receives a line with
nothing but whitespace it will trip an assertion in
qtest_process_command().
This is a little awkward for the case where we are feeding qtest a
set of bug-reproduction commands via standard input or a file,
because it means you need to be careful not to leave a blank line at
the start or the end when cutting and pasting the command sequence
from a bug report.
Change the code to allow and ignore blank lines in the input.
Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Fabiano Rosas <farosas@suse.de>
Message-ID: <20251106151959.1088095-1-peter.maydell@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Merge tag 'for-upstream' of https://repo.or.cz/qemu/kevin into staging
Block layer patches
- Image creation: Honour pwrite_zeroes_alignment for zeroing first sector
- block-backend: Fix race (causing a crash) when resuming queued requests
# -----BEGIN PGP SIGNATURE-----
#
# iQJFBAABCgAvFiEE3D3rFZqa+V09dFb+fwmycsiPL9YFAmklvQMRHGt3b2xmQHJl
# ZGhhdC5jb20ACgkQfwmycsiPL9byFA//d9VtU3wLZpJRL2mnYH2qJME3WeqJaSB+
# FzkG32gkCb0JtH5yr427oJYKhZsKpNkz20E7z4+1ZT4ovcjo7mddJYW7DwaMjUmO
# G3UXWE33ayLNZFMDrsMRV5tfiQkSb7Y0ekYfwU7GjC3qhMhRIX9eCRBrCLD6jdUx
# mg2h0ML0smE9AV5AEuunwSoqp+rD+OpRQ6EBkkCVF5iMlIHeiewP/TQbJtKBtxdK
# AumiIcYgPbH7QFG8kDTmVCCGPDC0v2i1G6Owtptbt9RmWTEGp++Ngm8F+7u/kPMk
# weRhlVhnxwDxVxmHzvysh0m+n08oVJyA2vB4QJrti6ZmgDcJYulxFfQgPCKxjvGd
# 6va02q0DYrCbO3YiViaAtnudEuqqaB1to57jeQq6tP9KrpH8uzAddrFWeb3TY4gN
# CvWr+p4V7bYvteNASJt/+VC5T3haR+U5eCRD5nOKPyXqCbMT+z6zZRuYxP2q1W6i
# VwQLIjuWIx+bXVRUrHkf9VNy1clB4ga+ZDbTGFrl0NOLDcn6u3Vcr4GQ7VvQ31Pj
# ulGA9F+DXjPRQpZC+WnCZsBSLwVBrNeYPyxsCSk2ORH930djgb7e1lxX5OawT7MT
# lNzbQ+N7PXCd5Yt0UyJ3uCF6gqlpvmUV7IZMbyoYHceoCnz8+McqvGORYfzkLwk9
# HUDS3UTI8Ks=
# =57x4
# -----END PGP SIGNATURE-----
# gpg: Signature made Tue 25 Nov 2025 06:28:19 AM PST
# gpg: using RSA key DC3DEB159A9AF95D3D7456FE7F09B272C88F2FD6
# gpg: issuer "kwolf@redhat.com"
# gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>" [unknown]
# gpg: WARNING: The key's User ID is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: DC3D EB15 9A9A F95D 3D74 56FE 7F09 B272 C88F 2FD6
* tag 'for-upstream' of https://repo.or.cz/qemu/kevin:
iotests: add Linux loop device image creation test
block: use pwrite_zeroes_alignment when writing first sector
file-posix: populate pwrite_zeroes_alignment
block-backend: Fix race when resuming queued requests
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Merge tag 'fix-pull-request' of https://gitlab.com/marcandre.lureau/qemu into staging
ui/chardev fixes for v10.2
# -----BEGIN PGP SIGNATURE-----
#
# iQJQBAABCgA6FiEEh6m9kz+HxgbSdvYt2ujhCXWWnOUFAmkluXscHG1hcmNhbmRy
# ZS5sdXJlYXVAcmVkaGF0LmNvbQAKCRDa6OEJdZac5YHAEACTqxHta05VSpzwnHxv
# A8NOasN02V6KYrN6Cjtowy5JULPOWQANadG4H3CZIm1CQ6sZ0u5grA8ZOUHBQaSZ
# HLF+baugBqTUQYyQdGX2JBwrqD0PxF2uohzIdQI8yiaXJQ2c/rp9HXVZNv+Cd80F
# sajq8TsIvdBP/IDUMAud+MOMYGl4TvkkMd1Rdbq11PZaVBu5bbmMuVOeqaJeqFgP
# /8uVlvZaYMqep6WSRShhrnwPuernGqdJCesGV3eooaZ9pO0LC6yiEw/5mVyZ+u1S
# nO6DVOhvZv519RoMiBbwtkS8HjjXQaKbY0TQYu1p6vDcXnfSvRYmX0skrx7B0ZHR
# IMC6h8JVXe6q8FV7iXz6RnIGycPz318HCG1JC+Rvts4VtO9A4MSlItJiNSVFcdkA
# 66PSV7MUd67XYzAODOxN4g5XTCC2EYR3t5wRh2VgkSc2Y3fVmWKsQtsu4PRkfspV
# 4ciwuhqDG1UQeis7x0m8RD6bUefg5ZXdpHWOCQdX9VKcOHoV13EMOHURuONWCFEE
# xzf3TG6uLg4GvJBT2kcRhp1gOSgI4XZ1lpCoTUp7nuZPtMzuoxeNVkHP+D7isRF2
# RQDmKuyQc1SeDXfUU3KvakXPv8Aq1Mb7kGgjivfyGzAAlimKhDw5HxuCCsEjKfMi
# cliGeoytFgZJlZpCp9LINq2sAQ==
# =OZt5
# -----END PGP SIGNATURE-----
# gpg: Signature made Tue 25 Nov 2025 06:13:15 AM PST
# gpg: using RSA key 87A9BD933F87C606D276F62DDAE8E10975969CE5
# gpg: issuer "marcandre.lureau@redhat.com"
# gpg: Good signature from "Marc-André Lureau <marcandre.lureau@redhat.com>" [unknown]
# gpg: aka "Marc-André Lureau <marcandre.lureau@gmail.com>" [unknown]
# gpg: WARNING: The key's User ID is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 87A9 BD93 3F87 C606 D276 F62D DAE8 E109 7596 9CE5
* tag 'fix-pull-request' of https://gitlab.com/marcandre.lureau/qemu:
ui/vnc: Fix qemu abort when query vnc info
chardev/char-pty: Do not ignore chr_write() failures
chardev/char-file: fix failure path
ui/vdagent: fix windows agent regression
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Merge tag 'pull-nvme-20251125' of https://gitlab.com/birkelund/qemu into staging
nvme queue
# -----BEGIN PGP SIGNATURE-----
#
# iQEzBAABCgAdFiEEUigzqnXi3OaiR2bATeGvMW1PDekFAmklZyQACgkQTeGvMW1P
# DemROQf+IprPh+u3uPuJ51ED3JrvQ02D+djWmun77f0spF/hiCCEWE708voe3pfp
# 2QT3zCvCruqxBzzpirYZCALTpZ3cQfd5Fq2UuAOWzye4jE4yvgNHpV9vFbC7JY3w
# jJmRSuS3/m06MipEGmuoQGS0wNFpOaNLz15DMPWco0A+U2BgKmX/AVFpUJtvGYXz
# /E3VhwHwS9LCfOMEwZc+e9G4mzM0hB/xgg1qNPe1sp4Ao0hlVXvgVg1Bc6ujhFEc
# yrdCdzmDVwq/jAjYJDW0/5mXOPX+ugcyoMrFPkm0ABnksEnK6pPn6K7oMEXGZ4qr
# GyeSWtdyBZuK453sK3S1C/aX7izWeA==
# =GU3Z
# -----END PGP SIGNATURE-----
# gpg: Signature made Tue 25 Nov 2025 12:21:56 AM PST
# gpg: using RSA key 522833AA75E2DCE6A24766C04DE1AF316D4F0DE9
# gpg: Good signature from "Klaus Jensen <its@irrelevant.dk>" [unknown]
# gpg: aka "Klaus Jensen <k.jensen@samsung.com>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: DDCA 4D9C 9EF9 31CC 3468 4272 63D5 6FC5 E55D A838
# Subkey fingerprint: 5228 33AA 75E2 DCE6 A247 66C0 4DE1 AF31 6D4F 0DE9
* tag 'pull-nvme-20251125' of https://gitlab.com/birkelund/qemu:
hw/nvme: Validate PMR memory size
hw/nvme: fix up extended protection information format
hw/nvme: fix namespace atomic parameter setup
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Stefan Hajnoczi [Tue, 7 Oct 2025 14:17:00 +0000 (10:17 -0400)]
iotests: add Linux loop device image creation test
This qemu-iotests test case is based on the reproducer that Jean-Louis
Dupond <jean-louis@dupond.be> shared in
https://gitlab.com/qemu-project/qemu/-/issues/3127.
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-ID: <20251007141700.71891-4-stefanha@redhat.com> Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru> Tested-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru> Tested-by: Fiona Ebner <f.ebner@proxmox.com> Reviewed-by: Fiona Ebner <f.ebner@proxmox.com> Reviewed-by: Kevin Wolf <kwolf@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Stefan Hajnoczi [Tue, 7 Oct 2025 14:16:59 +0000 (10:16 -0400)]
block: use pwrite_zeroes_alignment when writing first sector
Since commit 5634622bcb33 ("file-posix: allow BLKZEROOUT with -t
writeback"), qemu-img create errors out on a Linux loop block device
with a 4 KB sector size:
# dd if=/dev/zero of=blockfile bs=1M count=1024
# losetup --sector-size 4096 /dev/loop0 blockfile
# qemu-img create -f raw /dev/loop0 1G
Formatting '/dev/loop0', fmt=raw size=1073741824
qemu-img: /dev/loop0: Failed to clear the new image's first sector: Invalid argument
Use the pwrite_zeroes_alignment block limit to avoid misaligned
fallocate(2) or ioctl(BLKZEROOUT) in the block/file-posix.c block
driver.
Cc: qemu-stable@nongnu.org Fixes: 5634622bcb33 ("file-posix: allow BLKZEROOUT with -t writeback") Reported-by: Jean-Louis Dupond <jean-louis@dupond.be> Buglink: https://gitlab.com/qemu-project/qemu/-/issues/3127 Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-ID: <20251007141700.71891-3-stefanha@redhat.com> Tested-by: Fiona Ebner <f.ebner@proxmox.com> Reviewed-by: Fiona Ebner <f.ebner@proxmox.com> Reviewed-by: Kevin Wolf <kwolf@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Stefan Hajnoczi [Tue, 7 Oct 2025 14:16:58 +0000 (10:16 -0400)]
file-posix: populate pwrite_zeroes_alignment
Linux block devices require write zeroes alignment whereas files do not.
It may come as a surprise that block devices opened in buffered I/O mode
require the alignment for write zeroes requests although normal
read/write requests do not.
Therefore it is necessary to populate the pwrite_zeroes_alignment field.
Cc: qemu-stable@nongnu.org Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-ID: <20251007141700.71891-2-stefanha@redhat.com> Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru> Tested-by: Fiona Ebner <f.ebner@proxmox.com> Reviewed-by: Fiona Ebner <f.ebner@proxmox.com> Reviewed-by: Kevin Wolf <kwolf@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Kevin Wolf [Wed, 19 Nov 2025 17:27:20 +0000 (18:27 +0100)]
block-backend: Fix race when resuming queued requests
When new requests arrive at a BlockBackend that is currently drained,
these requests are queued until the drain section ends.
There is a race window between blk_root_drained_end() waking up a queued
request in an iothread from the main thread and blk_wait_while_drained()
actually being woken up in the iothread and calling blk_inc_in_flight().
If the BlockBackend is drained again during this window, drain won't
wait for this request and it will sneak in when the BlockBackend is
already supposed to be quiesced. This causes assertion failures in
bdrv_drain_all_begin() and can have other unintended consequences.
Fix this by increasing the in_flight counter immediately when scheduling
the request to be resumed so that the next drain will wait for it to
complete.
Cc: qemu-stable@nongnu.org Reported-by: Andrey Drobyshev <andrey.drobyshev@virtuozzo.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Message-ID: <20251119172720.135424-1-kwolf@redhat.com> Reviewed-by: Hanna Czenczek <hreitz@redhat.com> Tested-by: Andrey Drobyshev <andrey.drobyshev@virtuozzo.com> Reviewed-by: Fiona Ebner <f.ebner@proxmox.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
When there is no display device on qemu machine,
and user only access qemu by remote vnc.
At the same time user input `info vnc` by QMP,
the qemu will abort.
To avoid the abort above, I add display device check,
when query vnc info in qmp_query_vnc_servers().
Per the PCI spec 3.0, in section 6.2.5.1, "Address Maps":
A 32-bit register can be implemented to support a single
memory size that is a power of 2 from 16 bytes to 2 GB.
Add a check in nvme_init_pmr(), returning an error if the
PMR region size is too small; and update the QTest.
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Klaus Jensen <k.jensen@samsung.com> Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
Keith Busch [Thu, 20 Nov 2025 01:53:35 +0000 (17:53 -0800)]
hw/nvme: fix up extended protection information format
Set the protection information format (pif) only in the formats that can
support the larger guard types, and update the current in-use format
information when the user changes it.
Signed-off-by: Keith Busch <kbusch@kernel.org>
[k.jensen: fix missing braces and wrong indentation] Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
Klaus Jensen [Tue, 4 Nov 2025 10:51:45 +0000 (11:51 +0100)]
hw/nvme: fix namespace atomic parameter setup
Coverity complains about a possible copy-paste error in the verification
of the namespace atomic parameters (CID 1642811). While the check is
correct, the code (and the intention) is unclear.
Fix this by reworking how the parameters are verified. Peter also
identified that the realize function was not correctly erroring out if
parameters were misconfigured, so fix that too.
Lastly, change the error messages to be more describing.
Since commit f626116f ("ui/vdagent: factor out clipboard peer
registration"), the QEMU clipboard serial is reset whenever the vdagent
chardev receives the guest caps. This triggers a CHR_EVENT_CLOSED which
is handled by virtio_serial_close() to notify the guest.
The "reconnection logic" is there to reset the agent when a
client (dbus, spice etc) reconnects, or the agent is restarted.
It is required to sync the clipboard serials and to prevent races or
loops due to clipboard managers on both ends (but this is not
implemented by windows vdagent).
The Unix agent has been reconnecting without resending caps, thus
working with this approach.
However, the Windows agent does not seem to have a way to handle
VIRTIO_CONSOLE_PORT_OPEN=0 event and do not receive further data...
Let's not trigger this disconnection/reset logic if the agent does not
support VD_AGENT_CAP_CLIPBOARD_GRAB_SERIAL.
Fixes: f626116f ("ui/vdagent: factor out clipboard peer registration") Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reported-by: Lucas Kornicki <lucas.kornicki@nutanix.com> Tested-by: Fiona Ebner <f.ebner@proxmox.com> Reviewed-by: Fiona Ebner <f.ebner@proxmox.com> Tested-by: Lucas Kornicki <lucas.kornicki@nutanix.com>
Merge tag 'pull-target-arm-20251124' of https://gitlab.com/pm215/qemu into staging
target-arm queue:
* hw/display/exynos4210_fimd: Account for zero length in fimd_update_memory_section()
* hw/arm/armv7m: Disable reentrancy guard for v7m_sysreg_ns_ops MRs
* hw/display/exynos4210_fimd: Remove duplicated definition
* hw/arm/Kconfig: Exclude imx8mp-evk machine from KVM-only build
# -----BEGIN PGP SIGNATURE-----
#
# iQJNBAABCAA3FiEE4aXFk81BneKOgxXPPCUl7RQ2DN4FAmkka80ZHHBldGVyLm1h
# eWRlbGxAbGluYXJvLm9yZwAKCRA8JSXtFDYM3hVpD/48w6peqEy8HmLtmrswBdVt
# TIYAkcz3oGNDnpYqB0UsjEVvmtAQZtGLS0XaOSVlB3l8NPiGe5GFwJJmt8TYBUpB
# rl76Cbmnx9lHyJshuoHb7CdtY2Q2gWxQPaeqD+cFvWTa/HNzeMO8joS9EkNApubP
# B7SQpcZuMgv4mgBTM3ly2/9mmFkKyY+/gkvtOmTMS/wGjrhpIs8DWIgLZ5/odmI5
# +c15aNOsfsnZ7KEsawRyYpn1pV2YeoYWYbQqQGOVLLfF7y/mLSfkI35SoXHI79zu
# nU0f/8NKhFswtx+SoAuQtHmnGLpgc5gRL21hwHZxiLkLQif1HgfCT3YNM2V/03ll
# +n5lOZzvNY4TLaoc5R9a2B+DRpp7ihrDnpW+tUV5LIhpDT4eqRto6+ATqlJ0Hfkw
# konwiahSAuHMMpnmfKbDvieVQasOZZBI0bpdwj3/yzXKh91/cYhAE4RySC1qLWe+
# dHeroqdyWKxbxetQz14kwJVWHDrvZSiSVpc1uVHWYBnrP310kMXlkgGt7MA2qiw5
# Dm01Dz/Upc+FpLGUqwHhZPWf2sJLdQVRqGwEevRkJl80AFpCR10JbSqwN4Fpz2gg
# YlkHmFhJfNM7FYoD+c6y4USwxiv0mMmtkIMuR2csmY5F5oH18H6zJ0lYikz5I0eo
# MVcNV1lPilWh7lKAKlLlGQ==
# =+CbZ
# -----END PGP SIGNATURE-----
# gpg: Signature made Mon 24 Nov 2025 06:29:33 AM PST
# gpg: using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE
# gpg: issuer "peter.maydell@linaro.org"
# gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [unknown]
# gpg: aka "Peter Maydell <pmaydell@gmail.com>" [unknown]
# gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" [unknown]
# gpg: aka "Peter Maydell <peter@archaic.org.uk>" [unknown]
# gpg: WARNING: The key's User ID is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83 15CF 3C25 25ED 1436 0CDE
* tag 'pull-target-arm-20251124' of https://gitlab.com/pm215/qemu:
hw/display/exynos4210_fimd: Account for zero length in fimd_update_memory_section()
hw/arm/armv7m: Disable reentrancy guard for v7m_sysreg_ns_ops MRs
hw/display/exynos4210_fimd: Remove duplicated definition
hw/arm/Kconfig: Exclude imx8mp-evk machine from KVM-only build
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Merge tag 'pull-10.2-gitdm-241125-1' of https://gitlab.com/stsquad/qemu into staging
gitdm updates for 2025
With the latest updates the last year has been made possible by:
Top changeset contributors by employer
Linaro 2959 (37.0%)
Red Hat 1919 (24.0%)
Intel 313 (3.9%)
(None) 308 (3.9%)
ASPEED Technology Inc. 231 (2.9%)
Loongson Technology 227 (2.8%)
IBM 192 (2.4%)
Oracle 187 (2.3%)
Nutanix 133 (1.7%)
Academics (various) 99 (1.2%)
Top lines changed by employer
Linaro 109812 (31.8%)
Red Hat 91050 (26.4%)
ASPEED Technology Inc. 11811 (3.4%)
Intel 10606 (3.1%)
IBM 10146 (2.9%)
(None) 8965 (2.6%)
Oracle 8574 (2.5%)
Loongson Technology 7614 (2.2%)
Nutanix 7404 (2.1%)
Microsoft 6927 (2.0%)
Employers with the most hackers (total 433)
Red Hat 54 (12.5%)
IBM 30 (6.9%)
Intel 17 (3.9%)
(None) 13 (3.0%)
AMD 13 (3.0%)
Google 11 (2.5%)
Rivos Inc 10 (2.3%)
Linaro 9 (2.1%)
Oracle 8 (1.8%)
Huawei 8 (1.8%)
# -----BEGIN PGP SIGNATURE-----
#
# iQEzBAABCgAdFiEEZoWumedRZ7yvyN81+9DbCVqeKkQFAmkkKsAACgkQ+9DbCVqe
# KkRbcQgAhc2I0HQa9fqFnp8vAZPMEEp3FFuPf1Dhwl4SWP95uZe/giooFyUhoZjw
# fmLu3V+Tza1oX9ymgHcbGu465jgIORotIG9c2jfTNStbWQWMLT+3fsS3+/9oNgry
# TtTNrSR2RpcUvnOWbMCPm68FiekQEmm4lbzNjh5uuGb6IddFyP/gZatbdMw3KzaX
# kYKnlV6Ul5wBjzfH68paRfC1ZcM0/iPy5EbK3FhPVozpA3fV729ZR535WnFHNjc9
# Gk6+oN2o4KQnvgSBY00NNnKUMcvMnvg3LSgmd2YUWh3O5jfVBbzaebP06HgfjLI3
# WwBdlAnhAQRFZqJhiH7mCVmJhuwigQ==
# =OPEI
# -----END PGP SIGNATURE-----
# gpg: Signature made Mon 24 Nov 2025 01:52:00 AM PST
# gpg: using RSA key 6685AE99E75167BCAFC8DF35FBD0DB095A9E2A44
# gpg: Good signature from "Alex Bennée (Master Work Key) <alex.bennee@linaro.org>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 6685 AE99 E751 67BC AFC8 DF35 FBD0 DB09 5A9E 2A44
* tag 'pull-10.2-gitdm-241125-1' of https://gitlab.com/stsquad/qemu:
contrib/gitdm: add more individual contributors
contrib/gitdm: add mapping for Nutanix
contrib/gitdm: add mapping for Eviden
contrib/gitdm: add University of Tokyo to academic group
contrib/gitdm: add group-map for Microsoft
contrib/gitdm: add group-map for Huawei
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Merge tag 'pull-aspeed-20251124' of https://github.com/legoater/qemu into staging
aspeed queue:
* Fixed typo in the AST2700 LTPI device
* Fixed missing wiring of the SPI IRQ in AST10x0, AST2600, AST2700 SoCs
* Updated ASPEED PCIe Root Port capabilities and MSI support
# -----BEGIN PGP SIGNATURE-----
#
# iQIzBAABCAAdFiEEoPZlSPBIlev+awtgUaNDx8/77KEFAmkkA5wACgkQUaNDx8/7
# 7KG/xg/+LqpKxeFhofFSini+NLcD6gelGf2svIlz/q7Q5NhbgBdVC77g7L8aUho3
# gphaMmpafwyUW7OqtddB6FINDOVR8UnbU7NJJv5hedmgC+oxdpMrG2PiIPr6TsRu
# 6g/f4YvEMsehKAJm+x9APCFHmr9bTuY1iVwDJ3jfzWUBo8VPOT+duTLLTmc/RypZ
# elupzVTN7+RwVi18cYkrSQEtkmkz1U42W9ZG+PUKAdta0VfRTSReiEFGsD8pY/CB
# ndPbeEYVwIF2ezH5pXUneXgwMFM/ANYpNx2VXRuWabaRZMfChiDiHBOYt/CvfTH+
# v/o52sjbHtPJ2rKWKnZO+VBuV8Frwz9HgWAKLpoEurTolrnbA592BIxo3XaMS/eq
# 5a3HJ6wHAoU6qfiI3JSsP42nsCh5Ercf1mX8ArJlLePT/5XiQ3/MLBiESHXPptkm
# 4XBwG9zkr6zVhTm+Yj789rSlQgL+7cPZ78bMwCNhFHHXtZSpiWUP1e3LdVIX4pkP
# 1CPNyXRA+DDQEvksKkE6XkQZrnjydRbwCGrtNpuPkFmWDq9vQhUCjaKQBcutYgcD
# mbJVTeK3e7za/toWf88eNOWaJ7D+syXSQ8AfACkg5bG5zKreaQOLc2oC8UDcVJSE
# 3nwj12jDbfbmTDcFOY3diEhA8JiwylagiMZNiSx7bN9t+RO1jlQ=
# =DmJM
# -----END PGP SIGNATURE-----
# gpg: Signature made Sun 23 Nov 2025 11:05:00 PM PST
# gpg: using RSA key A0F66548F04895EBFE6B0B6051A343C7CFFBECA1
# gpg: Good signature from "Cédric Le Goater <clg@redhat.com>" [full]
# gpg: aka "Cédric Le Goater <clg@kaod.org>" [full]
* tag 'pull-aspeed-20251124' of https://github.com/legoater/qemu:
hw/pci-host/aspeed_pcie: Update ASPEED PCIe Root Port capabilities and enable MSI to support hotplug
hw/arm/aspeed: Fix missing SPI IRQ connection causing DMA interrupt failure
hw/arm/ast27x0: Fix typo in LTPI address
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Peter Maydell [Fri, 7 Nov 2025 14:39:13 +0000 (14:39 +0000)]
hw/display/exynos4210_fimd: Account for zero length in fimd_update_memory_section()
In fimd_update_memory_section() we attempt ot find and map part of
the RAM MR which backs the framebuffer, based on guest-configurable
size and start address.
If the guest configures framebuffer settings which result in a
zero-sized framebuffer, we hit an assertion(), because
memory_region_find() will return a NULL mem_section.mr.
Explicitly check for the zero-size case and treat this as a
guest error.
Because we now have a code path which can reach error_return without
calling memory_region_find to set w->mem_section, we must NULL out
w->mem_section.mr after the unref of the old MR, so that error_return
does not incorrectly double-unref the old MR.
Cc: qemu-stable@nongnu.org
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1407 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20251107143913.1341358-1-peter.maydell@linaro.org
Peter Maydell [Fri, 14 Nov 2025 15:53:04 +0000 (15:53 +0000)]
hw/arm/armv7m: Disable reentrancy guard for v7m_sysreg_ns_ops MRs
For M-profile cores which support TrustZone, there are some memory
areas which are "NS aliases" -- a Secure access to these addresses
really performs an NS access to a different part of the device. We
implement these using MemoryRegionOps read and write functions which
pass the access on with adjusted attributes using
memory_region_dispatch_read() and memory_region_dispatch_write().
Since the MR we are dispatching to is owned by the same device that
owns the NS-alias MR (the TYPE_ARMV7M container object), this trips
the reentrancy-guard that is applied by access_with_adjusted_size().
Mark the NS alias MemoryRegions as disable_reentrancy_guard; this is
safe because v7m_sysreg_ns_read() and v7m_sysreg_ns_write() do not
touch any of the device's state. (Any further reentrancy attempts by
the underlying MR will still be caught.)
Without this fix, an attempt to read from an address like 0xe002e010,
which is a register in the NS systick alias, will fail and provoke
qemu-system-arm: warning: Blocked re-entrant IO on MemoryRegion: v7m_systick at addr: 0x0
We didn't notice this earlier because almost all code accesses
the registers and systick via the non-alias addresses; the NS
aliases are only need for the rarer case of Secure code that needs
to manage the NS timer or system state on behalf of NS code.
Note that although the v7m_systick_ops read and write functions
also call memory_region_dispatch_{read,write}, this MR does not
need to have the reentrancy-guard disabled because the underlying
MR that it forwards to is owned by a different device (the
TYPE_SYSTICK timer device).
Reported via a stackoverflow question:
https://stackoverflow.com/questions/79808107/what-this-error-is-even-about-qemu-system-arm-warning-blocked-re-entrant-io
Cc: qemu-stable@nongnu.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20251114155304.2662414-1-peter.maydell@linaro.org
FIMD_VIDWADD0_END is defined twice, keep only one.
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20251121093509.25088-1-philmd@linaro.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Alex Bennée [Wed, 19 Nov 2025 11:39:52 +0000 (11:39 +0000)]
contrib/gitdm: add more individual contributors
I only add names explicitly acked as individual contributors.
Acked-by: Sean Wei <me@sean.taipei> Acked-by: William Kosasih <kosasihwilliam4@gmail.com>
Message-ID: <20251119113953.1432303-10-alex.bennee@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Alex Bennée [Wed, 19 Nov 2025 11:39:50 +0000 (11:39 +0000)]
contrib/gitdm: add mapping for Nutanix
We have a number of hackers from Nutanix, make sure they are grouped
together.
Reviewed-by: Jon Kohler <jon@nutanix.com> Reviewed-by: John Levon <john.levon@nutanix.com>
Message-ID: <20251119113953.1432303-8-alex.bennee@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Alex Bennée [Wed, 19 Nov 2025 11:39:46 +0000 (11:39 +0000)]
contrib/gitdm: add group-map for Microsoft
While we do see contributions from the top-level domain we want to
catch the linux.microsoft subdomain and those contributors also post
via other addresses.
Cc: Magnus Kulke <magnuskulke@linux.microsoft.com> Acked-by: Wei Liu <wei.liu@kernel.org>
Message-ID: <20251119113953.1432303-4-alex.bennee@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Jamin Lin [Fri, 21 Nov 2025 05:01:08 +0000 (13:01 +0800)]
hw/pci-host/aspeed_pcie: Update ASPEED PCIe Root Port capabilities and enable MSI to support hotplug
This patch updates the ASPEED PCIe Root Port capability layout and interrupt
handling to match the hardware-defined capability structure as documented in
the PCI Express Controller (PCIE) chapter of the ASPEED SoC datasheet.
The following capability offsets and fields are now aligned with the actual
hardware implementation (validated using EVB config-space dumps via
'lspci -s <bdf> -vvv'):
- Added MSI capability at offset 0x50 and enabled 1-vector MSI support
- Added PCI Express Capability structure at offset 0x80
- Added Secondary Subsystem Vendor ID (SSVID) at offset 0xC0
- Added AER capability at offset 0x100
- Implemented aer_vector() callback and MSI init/uninit hooks
- Updated Root Port SSID to 0x1150 to reflect the platform default
Enabling MSI is required for proper PCIe Hotplug event signaling. This change
improves correctness and ensures QEMU Root Port behavior matches the behavior
of ASPEED hardware and downstream kernel expectations.
Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> Fixes: 2af56518fa91 ("hw/pci-host/aspeed: Add AST2600 PCIe Root Port and make address configurable") Reviewed-by: Cédric Le Goater <clg@redhat.com> Reviewed-by: Nabih Estefan <nabihestefan@google.com> Tested-by: Nabih Estefan <nabihestefan@google.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Link: https://lore.kernel.org/qemu-devel/20251121050108.3407445-2-jamin_lin@aspeedtech.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
It did not connect SPI IRQ to the Interrupt Controller, so even the SPI
model raised the IRQ, the interrupt was not received. The CPU therefore
did not trigger an interrupt via the controller, and the firmware never
received the interrupt.
Merge tag 'staging-pull-request' of https://gitlab.com/peterx/qemu into staging
Migration pull for rc2
- Zhijian's COLO regression fix (since 10.0)
- Matthew's fix to avoid crash on wrong list manipulations
- Markus's error report leak fix and cleanups
- Peter's qtest changes to merge memory_backend and use_shmem
# -----BEGIN PGP SIGNATURE-----
#
# iIgEABYKADAWIQS5GE3CDMRX2s990ak7X8zN86vXBgUCaSEDHxIccGV0ZXJ4QHJl
# ZGhhdC5jb20ACgkQO1/MzfOr1wZSAAEAmixKaiIm+w0vp7YiNNTeq22+y6Eo7ran
# K7g5jCswEH8BAOTPeh7AHBN3L2Zi3tw58Rqyh08kiY/x0/s8DE7sL0wM
# =3a75
# -----END PGP SIGNATURE-----
# gpg: Signature made Fri 21 Nov 2025 04:26:07 PM PST
# gpg: using EDDSA key B9184DC20CC457DACF7DD1A93B5FCCCDF3ABD706
# gpg: issuer "peterx@redhat.com"
# gpg: Good signature from "Peter Xu <xzpeter@gmail.com>" [unknown]
# gpg: aka "Peter Xu <peterx@redhat.com>" [unknown]
# gpg: WARNING: The key's User ID is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: B918 4DC2 0CC4 57DA CF7D D1A9 3B5F CCCD F3AB D706
* tag 'staging-pull-request' of https://gitlab.com/peterx/qemu:
tests/migration-test: Use MEM_TYPE_MEMFD for memory_backend
tests/migration-test: Add MEM_TYPE_SHMEM
tests/migration-test: Merge shmem_opts into memory_backend
tests/migration-test: Introduce MemType
migration/postcopy-ram: Improve error reporting after loadvm failure
migration: Use warn_reportf_err() where appropriate
migration: Plug memory leaks after migrate_set_error()
migration: set correct list pointer when removing notifier
migration: Fix transition to COLO state from precopy
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Merge tag 'pull-trivial-patches' of https://gitlab.com/mjt0k/qemu into staging
trivial patches for 2025-11-21
# -----BEGIN PGP SIGNATURE-----
#
# iQIzBAABCgAdFiEEZKoqtTHVaQM2a/75gqpKJDselHgFAmkgYNYACgkQgqpKJDse
# lHgZIA/+MMazD/z4+niWJinTb/NXq5Q5AbE9x1bivYT8eVdyYrklAn5vqA1tQUHg
# nqAHvMEhhl2JtDI/OAABMcMZGay/anqBpuJ17g0CV3nlFQAoYQDI2QZxtBAPXC8K
# n8ZtaWrdeASrVPfxohPn5hJvj5j2m0468QRSa/MKad5iBt3F3JuZn8m20X9YkzkI
# FHGnRzBYg+6s8p312imEmcPqxId6n4xxJY/i8PnXY+dce//zZqX2UPmjf8aRxDgY
# 9eTzio6526w4raIzv/FXUXlnYn/ihRYRWxY/bI0t+7AJ1mY+F5SbFeg0pTr5koEg
# 3UQF/U0yILCIWoyoj8qiRmq62DxKCuvC16RdpJ91x3q3hQKmLn+0rpJlTcBHEGkw
# T28XEniTrYJKD3LbvZE9dnYcskyPSqpskKixdB94wupWA9XZ/BW6Ivq6ni/Jsozz
# wTsdWfyhtI9xd4TKeR2Ondz9xlTjhOTk7OoPgVa+IKESSLZYy4FlFsFV9Bb03I9b
# gaB5C7FDzJMa4JT4Wrc95cTtobno7VD6+Qsg78/piWomBPXSWi9QM0Uap2SdA3Ac
# s+ZjIrO02jsUdA68MSaxQjPDzdHvuAbvqDXY0+ACFutRZn9Yb7PTbr3m0JwXa8pa
# E9nBy850A4XynnU+1wuuPLxJStsKv/182C8x8Mt7hP4HfZ5w0fc=
# =1PPo
# -----END PGP SIGNATURE-----
# gpg: Signature made Fri 21 Nov 2025 04:53:42 AM PST
# gpg: using RSA key 64AA2AB531D56903366BFEF982AA4A243B1E9478
# gpg: Good signature from "Michael Tokarev <mjt@debian.org>" [unknown]
# gpg: aka "Michael Tokarev <mjt@corpit.ru>" [unknown]
# gpg: aka "Michael Tokarev <mjt@tls.msk.ru>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 9D8B E14E 3F2A 9DD7 9199 28F1 61AD 3D98 ECDF 2C8E
# Subkey fingerprint: 64AA 2AB5 31D5 6903 366B FEF9 82AA 4A24 3B1E 9478
* tag 'pull-trivial-patches' of https://gitlab.com/mjt0k/qemu:
Fix the typo of vfio-pci device's enable-migration option
qmp: Fix a typo for a USO feature
qga: use access(2) to check for command existance instead of questionable stat(2)
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Merge tag 'pull-request-2025-11-21' of https://gitlab.com/thuth/qemu into staging
* Fix a crash that occurs when passing through virtio devices to nested guest
* Update s390x MAINTAINERS
* Fix various pylint warnings in functional tests
# -----BEGIN PGP SIGNATURE-----
#
# iQJFBAABCgAvFiEEJ7iIR+7gJQEY8+q5LtnXdP5wLbUFAmkgMrgRHHRodXRoQHJl
# ZGhhdC5jb20ACgkQLtnXdP5wLbXvEg/8CxLpA1a/lkf17XyGQmxvES5sRZDD2DCg
# CTZfK8j4ZwaDlHH4WIQdvAPHxSMZ4p0Z+HoS+GlKkAMTp6ALJkSg+mRosehy7sH0
# z3DRcGXnR46kArdhLzZIXL0QStAcTRAhTrva/eI+pf6CDD8ypR3Qut6d4hTBVdvB
# lgU1LOOXDOGRsWYq11asUJabwZr4VYYIQlIMd57Lv2MITCt3UNwK279hZQQ/Xe5C
# 07Y9X4aC3m3f8+AHbZJhrSB9ySNQMGuKyGfHf+rQDyYGOybsG/cJoJLUO6eAUU3M
# b3J/YoEViL7JmKqwv2WJQdP2p7/M8M9XlK9rMn7Ry26Wdab/QeNTdjMHuakxHfmn
# oaorN7ua2P+wLKV6h2ElHFKiqhvs/n6vGGE39FsvbgGYhzsqdg0YvKDr61KxpXRp
# rz7LuiLygBFEUwhqlLa2ePoJb9wxgECLgEib17qNhjUlDHegSDGNpENAzvJ/rC2l
# ufCNQR17zocffJp1N/S1ZcjVc+JzMUG5G6ScdQsKUHueSqiXpS6pRI7cX0PFNz70
# jp2Ul+m1Mr9GJn9bFhz2Kf2k74gpW5B27SKnZlcZa/AFtT9WlHcEkStAs0PRe00Q
# rrPkxBJaesLayxX6xW8HMzO+IkBniHtxQesf5WPlf9+z2roM0eXuCXibMGHnK49P
# YqvvLCvBTEA=
# =yxWh
# -----END PGP SIGNATURE-----
# gpg: Signature made Fri 21 Nov 2025 01:36:56 AM PST
# gpg: using RSA key 27B88847EEE0250118F3EAB92ED9D774FE702DB5
# gpg: issuer "thuth@redhat.com"
# gpg: Good signature from "Thomas Huth <th.huth@gmx.de>" [unknown]
# gpg: aka "Thomas Huth <thuth@redhat.com>" [unknown]
# gpg: aka "Thomas Huth <th.huth@posteo.de>" [unknown]
# gpg: aka "Thomas Huth <huth@tuxfamily.org>" [unknown]
# gpg: WARNING: The key's User ID is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 27B8 8847 EEE0 2501 18F3 EAB9 2ED9 D774 FE70 2DB5
* tag 'pull-request-2025-11-21' of https://gitlab.com/thuth/qemu:
MAINTAINERS: s390 maintainer updates
tests/functional/aarch64/test_rme_sbsaref: Silence issues reported by pylint
tests/functional/aarch64/test_reverse_debug: Fix issues reported by pylint
tests/functional/ppc/test_ppe42: Fix style issues reported by pylint
tests/functional/ppc/test_amiga: Fix issues reported by pylint and flake8
tests/functional/x86_64/test_memlock: Silence pylint warnings
tests/functional/x86_64/test_reverse_debug: Silence pylint warning
tests/functional/x86_64/test_virtio_gpu: Fix various issues reported by pylint
tests/functional/arm/test_aspeed_ast2600_buildroot: Fix pylint warnings
hw/s390x: Fix a possible crash with passed-through virtio devices
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Peter Xu [Mon, 17 Nov 2025 22:39:08 +0000 (17:39 -0500)]
tests/migration-test: Use MEM_TYPE_MEMFD for memory_backend
The only two users of memory_backend as of now (cpr-exec, cpr-transfer)
uses memfd as backend, now we fully support it. We can move memory_backend
usage to mem_type and drop it.
Peter Xu [Mon, 17 Nov 2025 22:39:06 +0000 (17:39 -0500)]
tests/migration-test: Merge shmem_opts into memory_backend
The two parameters are more or less duplicated in migrate_args(). They all
describe the memory type. When one is used, the other is not.
mem_type currently uses numa parameter to specify the memory backend, while
memory_backend (the two users of such uses "-machine memory-backend=ID").
This patch merges the use of the two variables so that we always generate a
memory object string and put it into "memory_backend" variable. Now we can
drop shmem_opts parameter in the function.
Meanwhile we always use a memory-backend-* no matter which mem type is
used. This brings mem_type to be aligned with memory_backend usage, then
we stick with this as this is flexible enough.
This paves way that we merge mem_type and memory_backend in MigrateStart.
Peter Xu [Mon, 17 Nov 2025 22:39:05 +0000 (17:39 -0500)]
tests/migration-test: Introduce MemType
Some migration tests need to be run with shmem, the rest by default use
anonymous memory.
Introduce MemType and replace use_shmem with such a enumeration. This
prepares for a 3rd type of memory to be tested for migration.
Careful readers may also already notice that MigrateStart has another field
called memory_backend, which makes the whole "memory type" definition
convoluted. That'll be merged into MemType soon in a follow up patch.
When doing this, introduce some migrate_mem_type_*() helpers to do the
work for each memory type.
migration/postcopy-ram: Improve error reporting after loadvm failure
One of two error messages show __func__. Drop it; it doesn't help
users, and developers can grep for the message. This also permits
de-duplicating the code to prepend to the error message.
Both error messages show a numeric error code. I doubt that's
helpful, but I'm leaving it alone.
Use error_append_hint() for explaining that some dirty bitmaps may be
lost. Polish the prose.
Don't faff around with g_clear_pointer(), it's not worth its keep
here.
migration: Plug memory leaks after migrate_set_error()
migrate_set_error(s, err) stores a copy of @err in @s. The original
@err is not freed. Most callers free it immediately. Some callers
free it later, or pass it on. And some leak it. Fix those.
Perhaps migrate_set_error(s, err) should take ownership of @err. The
callers that free it immediately would become simpler, and avoid a
copy and a deallocation. The others would have to pass
error_copy(err).
Matthew Rosato [Thu, 13 Nov 2025 21:35:45 +0000 (16:35 -0500)]
migration: set correct list pointer when removing notifier
In migration_remove_notifier(), g_slist_remove() will search for and
potentially remove an entry from the specified list. The return value
should be used to update the potentially-changed head pointer of the
list that was just searched (migration_state_notifiers[mode]) instead
of the migration blockers list.
Li Zhijian [Tue, 4 Nov 2025 01:36:06 +0000 (09:36 +0800)]
migration: Fix transition to COLO state from precopy
Commit 4881411136 ("migration: Always set DEVICE state") set a new DEVICE
state before completed during migration, which broke the original transition
to COLO. The migration flow for precopy has changed to:
active -> pre-switchover -> device -> completed.
This patch updates the transition state to ensure that the Pre-COLO
state corresponds to DEVICE state correctly.
Cc: qemu-stable <qemu-stable@nongnu.org> Fixes: 4881411136 ("migration: Always set DEVICE state") Signed-off-by: Li Zhijian <lizhijian@fujitsu.com> Reviewed-by: Zhang Chen <zhangckid@gmail.com> Tested-by: Zhang Chen <zhangckid@gmail.com> Link: https://lore.kernel.org/r/20251104013606.1937764-1-lizhijian@fujitsu.com Signed-off-by: Peter Xu <peterx@redhat.com>
Yanghang Liu [Fri, 21 Nov 2025 09:43:41 +0000 (17:43 +0800)]
Fix the typo of vfio-pci device's enable-migration option
Signed-off-by: Yanghang Liu <yanghliu@redhat.com> Reported-by: Mario Casquero <mcasquer@redhat.com> Reviewed-by: Michael Tokarev <mjt@tls.msk.ru> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Michael Tokarev [Sat, 1 Nov 2025 10:30:24 +0000 (13:30 +0300)]
qga: use access(2) to check for command existance instead of questionable stat(2)
The code checks existance of a command (halt/poweroff/reboot) by using
stat(2) and immediately checking for S_ISLNK() on the returned stat
struct. This check will never be true, because stat(2) always follows
symbolic links and hence will either return ENOENT (in case of dangling
symlink) or the properties for the final target file. It is lstat(2)
which might return information about the symlink itself. However, even
there, we want to check the final file properties, not the first symlink.
This check - S_ISLNK - is harmful but useless in this case. However, it
is confusing and it helps the wrong usage of stat(2) to spread, so it is
better to remove it.
Additionally, the code would better to check for the executable bits
of the final file, not check if it's a regular file - it's sort of
dubious to have anything but regular files in /sbin/.
But a POSIX system provides another command which suits the purpose
perfectly: it is access(2). And it is so simple that it's not
necessary to create a separate function when usin it.
Replace stat(2) with access(X_OK) to check for file existance in
qga/commands-posix.c
Fixes: c5b4afd4d56e "qga: Support guest shutdown of BusyBox-based systems" Reviewed-by: Rodrigo Dias Correa <r@drigo.nl> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Kostiantyn Kostiuk <kkostiuk@redhat.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
zhenwei pi [Wed, 28 May 2025 03:31:56 +0000 (11:31 +0800)]
MAINTAINERS: update email of zhenwei pi
I will leave ByteDance in the next days. Update email to stay reachable.
Signed-off-by: zhenwei pi <pizhenwei@bytedance.com> Acked-by: Fam Zheng <fam.zheng@bytedance.com> Signed-off-by: zhenwei pi <pizhenwei@bytedance.com>
Message-ID: <20250528033156.1188531-1-pizhenwei@bytedance.com>
[Rescued from the list archive, I double-checked it's still valid] Signed-off-by: Markus Armbruster <armbru@redhat.com>
Unfortunately, I don't have a lot of capacity lately to take good care of
s390 in QEMU like I used to; and it doesn't look like that situation
will change. So let me convert myself to a reviewer in the s390 areas I
co-maintain.
Fortunately, we still have two other maintainers for "S390 floating
interrupt controller", so no action needed on that front.
For the other sections we get two new maintainers: Hendrik will
maintain "S390 CPU models" and Ilya will co-maintain "S390 TCG CPUs".
Thanks Hendrik and Ilya for stepping up!
Cc: Richard Henderson <richard.henderson@linaro.org> Cc: Thomas Huth <thuth@redhat.com> Cc: Christian Borntraeger <borntraeger@linux.ibm.com> Cc: Ilya Leoshkevich <iii@linux.ibm.com> Cc: Halil Pasic <pasic@linux.ibm.com> Cc: Hendrik Brueckner <brueckner@linux.ibm.com> Cc: Matthew Rosato <mjrosato@linux.ibm.com> Signed-off-by: David Hildenbrand (Red Hat) <david@kernel.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Acked-by: Christian Borntraeger <borntraeger@linux.ibm.com>
Message-ID: <20251120104602.205718-1-david@kernel.org> Signed-off-by: Thomas Huth <thuth@redhat.com>
Thomas Huth [Wed, 19 Nov 2025 08:26:35 +0000 (09:26 +0100)]
tests/functional/aarch64/test_rme_sbsaref: Silence issues reported by pylint
Drop unused import and use an encoding for open().
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20251119082636.43286-15-thuth@redhat.com>
Thomas Huth [Wed, 19 Nov 2025 08:26:33 +0000 (09:26 +0100)]
tests/functional/aarch64/test_reverse_debug: Fix issues reported by pylint
Don't use underscores in CamelCase names and drop an unused import.
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20251119082636.43286-13-thuth@redhat.com>
Thomas Huth [Wed, 19 Nov 2025 08:26:31 +0000 (09:26 +0100)]
tests/functional/ppc/test_ppe42: Fix style issues reported by pylint
Pylint suggests to write some parts of the code in a slightly different
way ... thus rework the code to make the linter happy.
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Glenn Miles <milesg@linux.ibm.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20251119082636.43286-11-thuth@redhat.com>
Thomas Huth [Wed, 19 Nov 2025 08:26:30 +0000 (09:26 +0100)]
tests/functional/ppc/test_amiga: Fix issues reported by pylint and flake8
Pylint complains about unused variable "tar_name" and a missing "check"
for subprocess.run(), and flake8 suggest a second empty line after the
class. While we're at it, also remove the unused "timeout" class variable
(that was only necessary for the avocado framework which we don't use
anymore).
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20251119082636.43286-10-thuth@redhat.com>
Pylint complains about a missing "encoding" parameter for the open()
function here, and about a missing return statement in the "except"
block (which cannot happen since skipTest() never returns). Rework
the code a little bit to silence the warnings.
Reviewed-by: Zhao Liu <zhao1.liu@intel.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20251119082636.43286-9-thuth@redhat.com>
Pylint does not like the underscores in the class name here, so
rename the class accordingly to make pylint happy here.
Reviewed-by: Zhao Liu <zhao1.liu@intel.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20251119082636.43286-8-thuth@redhat.com>
Thomas Huth [Wed, 19 Nov 2025 08:26:25 +0000 (09:26 +0100)]
tests/functional/x86_64/test_virtio_gpu: Fix various issues reported by pylint
Use the recommended order for import statements, specify the kind of
exceptions that we try to catch, use f-strings where it makes sense,
rewrite the vug_log_file part with a proper "with" statement and
fix some FIXMEs by checking for the availability of the devices, etc.
Message-Id: <20251113114015.490303-1-thuth@redhat.com> Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp> Reviewed-by: Zhao Liu <zhao1.liu@intel.com> Tested-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20251119082636.43286-5-thuth@redhat.com>
Pylint recommends to use a "with" context for tempfile.TemporaryDirectory()
to make sure that the directory is deleted once it is not needed anymore,
and it recommends to use the "check" parameter for subprocess.run().
For style reasons, the imports at the beginning of the file should be
grouped by module.
Message-Id: <20251113100601.476900-1-thuth@redhat.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20251119082636.43286-4-thuth@redhat.com>
Thomas Huth [Tue, 18 Nov 2025 17:40:47 +0000 (18:40 +0100)]
hw/s390x: Fix a possible crash with passed-through virtio devices
Consider the following nested setup: An L1 host uses some virtio device
(e.g. virtio-keyboard) for the L2 guest, and this L2 guest passes this
device through to the L3 guest. Since the L3 guest sees a virtio device,
it might send virtio notifications to the QEMU in L2 for that device.
But since the QEMU in L2 defined this device as vfio-ccw, the function
handle_virtio_ccw_notify() cannot handle this and crashes: It calls
virtio_ccw_get_vdev() that casts sch->driver_data into a VirtioCcwDevice,
but since "sch" belongs to a vfio-ccw device, that driver_data rather
points to a CcwDevice instead. So as soon as QEMU tries to use some
VirtioCcwDevice specific data from that device, we've lost.
We must not take virtio notifications for such devices. Thus fix the
issue by adding a check to the handle_virtio_ccw_notify() handler to
refuse all devices that are not our own virtio devices. Like in the
other branches that detect wrong settings, we return -EINVAL from the
function, which will later be placed in GPR2 to inform the guest about
the error.
Reviewed-by: Halil Pasic <pasic@linux.ibm.com> Reviewed-by: Eric Farman <farman@linux.ibm.com> Tested-by: Eric Farman <farman@linux.ibm.com> Reviewed-by: Cornelia Huck <cohuck@redhat.com> Acked-by: Christian Borntraeger <borntraeger@linux.ibm.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20251118174047.73103-1-thuth@redhat.com>
# -----BEGIN PGP SIGNATURE-----
#
# iQFIBAABCgAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAmkdftoUHHBib256aW5p
# QHJlZGhhdC5jb20ACgkQv/vSX3jHroOv9Af/foJ7LXUHok8xnPrvKYEIkkVmJFpM
# dt7NzLRoyVHh/zOd/MOfOJCw2+/RLGxA7o1Mm+10DCM6+hcs9VeqeIGSElIP0Uvk
# NGau6/3l/pkE+oyDcziNf1zsgexQ5s258GknlF+QOddcDC1qmpud8Szw/7wHrqcN
# QzxtcYcrbf8USFuekd+5z8GgzMC9CGn6f2Qr5eG40raLB4l+ZKNHIGyR7J0WtxHT
# DcdSDmpHn5qyvAVg3NTkxgzlOnDYNpfnXzXNQ6B+QHb16d6ys4sdMwgxm0aAlzhO
# voLmj5rY1CfQD6EqZmq3sqKwVYLtyHAHtzu4MoAiRGW/7Lhg6QWNiCceGw==
# =b3oh
# -----END PGP SIGNATURE-----
# gpg: Signature made Wed 19 Nov 2025 09:24:58 AM CET
# gpg: using RSA key F13338574B662389866C7682BFFBD25F78C7AE83
# gpg: issuer "pbonzini@redhat.com"
# gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" [unknown]
# gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" [unknown]
# gpg: WARNING: The key's User ID is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1
# Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83
* tag 'for-upstream' of https://gitlab.com/bonzini/qemu:
replay: add tracing events
mtest2make: do not repeat the same speed over and over
mtest2make: add dependencies to the "speed-qualified" suite
mtest2make: cleanup mtest-suites variables
target/i386: fix stack size when delivering real mode interrupts
target/i386: svm: fix sign extension of exit code
target/i386/tcg: validate segment registers
target/i386: Mark VPERMILPS as not valid with prefix 0
target/i386: emulate: Make sure fetch_instruction exist before calling it
ioapic: fix typo in irqfd check
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
John Snow [Tue, 18 Nov 2025 20:06:57 +0000 (15:06 -0500)]
python/qapi: delint import statements
Missed a spot with isort, which now causes the python-minreqs test on
GitLab to fail. Fix it.
(Hint: the commands in python/tests/qapi-isort.sh can be run without the
"-c" parameter to automatically adjust import statements according to
our style rules. Maybe I should make a pre-submit hook that makes this
adjustment automatically. What do you think?)
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3200 Fixes: 5bd89761a4b ("qapi/command: Avoid generating unused qmp_marshal_output_T") Signed-off-by: John Snow <jsnow@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20251118200657.1043688-4-jsnow@redhat.com>
John Snow [Tue, 18 Nov 2025 20:06:56 +0000 (15:06 -0500)]
python/qapi: add an ignore for Pylint 4.x
Pylint 4.x wants to use a different regex for _Stub for some reason;
just silence this.
Signed-off-by: John Snow <jsnow@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20251118200657.1043688-3-jsnow@redhat.com>
John Snow [Tue, 18 Nov 2025 20:06:55 +0000 (15:06 -0500)]
python/mkvenv: ensure HAVE_LIB variables are actually constants
Pylint 4.x has refined checking for variable names that behave as
constants vs ones that do not; unfortunately our tricky import machinery
is perceived as these variables being re-assigned.
Add a temporary variable with an underscore and assign to the global
constants precisely once to alleviate this new nag message. Add an
ignore for this name for older versions of pylint that developers may
have installed locally.
(In other words: there is no solution that will cater to both pre- and
post- 4.x versions, so we target 4.x here and silence older versions.)
Signed-off-by: John Snow <jsnow@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20251118200657.1043688-2-jsnow@redhat.com>
Paolo Bonzini [Tue, 18 Nov 2025 13:53:32 +0000 (14:53 +0100)]
replay: add tracing events
The replay subsystem does not provide any way to see what's going on
and how the replay events interleave with other things happening in QEMU.
Add trace events to improve debuggability; to avoid having too many
events reimplement all functions in terms of (non-traced) replay_getc
and replay_putc and add a single trace event for each datum that is
extracted or written.
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Paolo Bonzini [Mon, 17 Nov 2025 15:51:17 +0000 (16:51 +0100)]
mtest2make: add dependencies to the "speed-qualified" suite
Thorough tests may have more dependencies than faster ones.
Dependencies are now looked up based on the suites being
executed, not on the suites passed as goals to the makefile.
Therefore, it is possible to limit dependencies to the
speeds that need them.
Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Tested-by: Alex Bennée <alex.bennee@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Paolo Bonzini [Mon, 17 Nov 2025 15:48:09 +0000 (16:48 +0100)]
mtest2make: cleanup mtest-suites variables
Remove the "--suite" argument from the .*.mtest-suites variables, and
add it only when actually computing the arguments to "meson test".
This makes it possible to set ninja-cmd-goals from the set of suites,
instead of doing it via many different .ninja-goals.* variables.
Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Tested-by: Alex Bennée <alex.bennee@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Merge tag 'hw-misc-20251118' of https://github.com/philmd/qemu into staging
Misc HW patches
- Re-enable xenpvh machine in qemu-system-arm/aarch64 binaries
- Correct Xilinx Zynq DMA Devcfg registers range size
- Correct ACCEL_KERNEL_GSI_IRQFD_POSSIBLE typo
- Allow for multiple CHR_EVENT_CLOSED events in QTest framework
- Fix ACMD41 state machine for SD cards in SPI mode
- Avoid confusing address calculation around eMMC RPMB HMAC
- Fix a pair of build failures on Solaris (guest-agent and RDMA migration)
- Correct QOM parent of LASI south bridge
- Clarify MIPS / PPC 32-bit hosts removal in documentation
- Prevent further uses of DEVICE_NATIVE_ENDIAN definition
- Fix Error uses in eBPF
- Update David Hildenbrand's email address
# -----BEGIN PGP SIGNATURE-----
#
# iQIzBAABCAAdFiEE+qvnXhKRciHc/Wuy4+MsLN6twN4FAmkcwjAACgkQ4+MsLN6t
# wN7Wxg//UMbpEgp92clPcGUX1RFHViEYu5DDM96nwjLpOR8nNAJvLZ5+qxDfyZRQ
# qfVGaE0cm5a/rXRMgFAzeJw5ptcSwLJXsUvnRuNLEpKlIAfqInqqk+JTi/r7hJSq
# W8m07IrdtADwoas0OYKur0XwF+k1hqVOENQWPxiLiyViEH2tR8MFA+nrqQhZzgwo
# Emu3ICc01wX+hhY2R51mf+GdVcmr8RACc07lmG7MnMtvQW8vzCkA/VJ5jWWQv6Xj
# ADKBTciYEK/PKD5vbbwMadZfxaWRiH1l+unfpw0qXC46YOAMvpe3+0mRqk7VeSRc
# anqdXQk9dbqw7qwJ+L+RVdUjNf1bLc9LxOePeMOgsNzd8wxlsBia9PDNxvVTRFmh
# /JxLYO9bM4vRojaGOCFoppoF++JSdZzI6WM56hY465L3VCx36V1p2YESX8x/5F1B
# +w/JPV0dUGeq+MFUNKg/pBy9dgRYIGJfcbcp2jwMxyEB5d0np53zXbMaZmqX/cEO
# AjE/haqtpu/yAqSK7oklx1gJEI9gRE0cJp2B/7l/3RwW3fcMsN3HJB3GH8f+3vg2
# VQMYDrAWBF5wA/5HQtsGNrfImlYGHa535KnLujTcNLVwS+2gZ6N6FwfwhM2fwXQh
# +X7nQZbBsAVa0jDqck8zkIarVuISocC10DWfuP5k4hlKxeyg71M=
# =K5DF
# -----END PGP SIGNATURE-----
# gpg: Signature made Tue 18 Nov 2025 08:00:00 PM CET
# gpg: using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE
# gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <f4bug@amsat.org>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: FAAB E75E 1291 7221 DCFD 6BB2 E3E3 2C2C DEAD C0DE
* tag 'hw-misc-20251118' of https://github.com/philmd/qemu:
ebpf: Make ebpf_rss_load() return value consistent with @errp
ebpf: Clean up useless error check in ebpf_rss_set_all()
ebpf: Fix stubs to set an error when they return failure
scripts/checkpatch: Check DEVICE_NATIVE_ENDIAN
docs: Mention 32-bit PPC host as removed
docs: Correct release of MIPS deprecations / removals
migration/rdma: Check ntohll() availability with meson
buildsys: Remove dead 'mips' entry in supported_cpus[] array
hw/southbridge/lasi: Correct LasiState parent
qga/commands: Include proper Solaris header for getloadavg()
hw/sd/sdcard: Avoid confusing address calculation in rpmb_calc_hmac
hw/arm: Re-enable xenpvh machine in qemu-system-arm/aarch64 binaries
hw/dma/zynq-devcfg: Fix register memory
hw/sd: Fix ACMD41 state machine in SPI mode
hw/sd: Fix incorrect idle state reporting in R1 response for SPI mode
system/qtest.c: Allow for multiple CHR_EVENT_CLOSED events
hw/intc/ioapic: Fix ACCEL_KERNEL_GSI_IRQFD_POSSIBLE typo
MAINTAINERS: Update David Hildenbrand's email address
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Merge tag 'for-upstream' of https://repo.or.cz/qemu/kevin into staging
Block layer patches
- Multi-threading fixes in several block drivers
# -----BEGIN PGP SIGNATURE-----
#
# iQJFBAABCgAvFiEE3D3rFZqa+V09dFb+fwmycsiPL9YFAmkcpowRHGt3b2xmQHJl
# ZGhhdC5jb20ACgkQfwmycsiPL9bnrA/9HpvuLovahyZH+zke9FAzE9EcZ8eLgT4t
# JM5ijkrfZ8KoyvW9zmUiT/T/BhewFY4if6FqIUvQoCVIQAN+Y3Z8Us/WcZpb3xG7
# EMUr/CeiRl7Ka0SGbxZWR6H10Enuq4hoesfkRPXGV33CKuef09HvgE0184aazZLs
# bfeBn562zUcYzn/HqNFcPqLh6goeHWhsnQuxfJJeu7i05HofeM/3T7WUcCmxhn3V
# 4Pk6o0toYONuZpfUZityieEI54ID95gVmllaE8QT5f0rBXHp6ae5P6x+fnqbj306
# DA5RKBxM5nJ5Md2mo2tJtJ0eUNzbxXpAnT+wMkcDO4OQq8F6KngOTokPPKv13z1f
# uUSwZW5QXV8pvU6AZouUlPStz0MFtfXSVqLZaV51BB7MrIGF79ina9vwMYoteTNJ
# CGi32Ca0dl3PjLm//avmZiHYAeczpK34nPImRLZnhh78zQal/yDpdpi5No/tm4Yf
# /0OAES0legGC3hTsuDh9sXqkmRn3qNvUd40IuDRyvrNYxMUuF+2IQymD5Hcm/6CO
# uIf+/61OPHLHwKFYHyyK44XmcYQHCE0LxilmWVrNaULs4a3nvlRz3GTZ09R/ebAl
# ddtedo9eHN6KfViTa95YWuu53iXzQRPUp3CrSC1gPB04zphpYsCy7eJ/t3kJqCpP
# 9CVf3PMOmZA=
# =FNy0
# -----END PGP SIGNATURE-----
# gpg: Signature made Tue 18 Nov 2025 06:02:04 PM CET
# gpg: using RSA key DC3DEB159A9AF95D3D7456FE7F09B272C88F2FD6
# gpg: issuer "kwolf@redhat.com"
# gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>" [unknown]
# gpg: WARNING: The key's User ID is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: DC3D EB15 9A9A F95D 3D74 56FE 7F09 B272 C88F 2FD6
* tag 'for-upstream' of https://repo.or.cz/qemu/kevin:
win32-aio: Run CB in original context
null-aio: Run CB in original AioContext
iscsi: Create AIO BH in original AioContext
block: Note in which AioContext AIO CBs are called
blkreplay: Run BH in coroutine’s AioContext
ssh: Run restart_coroutine in current AioContext
qcow2: Schedule cache-clean-timer in realtime
qcow2: Fix cache_clean_timer
qcow2: Re-initialize lock in invalidate_cache
block/io: Take reqs_lock for tracked_requests
nvme: Note in which AioContext some functions run
nvme: Fix coroutine waking
nvme: Kick and check completions in BDS context
gluster: Do not move coroutine into BDS context
curl: Fix coroutine waking
nfs: Run co BH CB in the coroutine’s AioContext
iscsi: Run co BH CB in the coroutine’s AioContext
rbd: Run co BH CB in the coroutine’s AioContext
block: Note on aio_co_wake use if not yet yielding
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
ebpf: Make ebpf_rss_load() return value consistent with @errp
ebpf_rss_load() returns false for failure without setting an Error
when its @ctx argument already has an eBPF program loaded. This is
wrong. Fortunately, it is only called @ctx has a program. Replace
the incorrect error check by an assertion.
The return value is now obviously reliable. Change the caller to use
it, because it's more concise.
Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251118154718.3969982-4-armbru@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
ebpf: Clean up useless error check in ebpf_rss_set_all()
ebpf_rss_set_all() is only called when the context has an eBPF program
loaded. Replace the dead error check with an assertion.
Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251118154718.3969982-3-armbru@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
ebpf: Fix stubs to set an error when they return failure
Stubs in ebpf_rss-stub.c return false for failure without setting an
Error. This is wrong. Callers may assume that the functions set an
error when they fail, and crash when they try to examine or report the
error. Callers may also check the error instead of the return value,
and misinterpret the failure as success.
ebpf_rss_load() and ebpf_rss_load() are reachable via
virtio_net_load_ebpf(). Fix them to set an error.
ebpf_rss_set_all() is unreachable: it can only be called when the
context has an eBPF program loaded, which is impossible with eBPF
support compiled out. Call abort() there to make that clear, and to
get rid of the latent bug.
Fixes: 00b69f1d867d (ebpf: add formal error reporting to all APIs) Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251118154718.3969982-2-armbru@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
We removed support for 32-bit PPC hosts in commit 5c1ec5a1ee0
("tcg/ppc: Remove support for 32-bit hosts").
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Acked-by: Harsh Prateek Bora <harshpb@linux.ibm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20251117171236.80472-3-philmd@linaro.org>
docs: Correct release of MIPS deprecations / removals
We are going to release 10.2, not 11.0 :)
Reported-by: Daniel P. Berrangé <berrange@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20251117171236.80472-2-philmd@linaro.org>
migration/rdma: Check ntohll() availability with meson
Commit 44ce1b5d2fc ("migration/rdma: define htonll/ntohll
only if not predefined") tried to only include htonll/ntohll
replacements when their symbol is *defined*, but this doesn't
work, as they aren't:
../migration/rdma.c:242:17: error: static declaration of 'htonll' follows non-static declaration
242 | static uint64_t htonll(uint64_t v)
| ^~~~~~
In file included from /usr/include/netinet/in.h:73,
from /usr/include/sys/socket.h:32,
from /home/f4bug/qemu/include/system/os-posix.h:30,
from /home/f4bug/qemu/include/qemu/osdep.h:176,
from ../migration/rdma.c:17:
/usr/include/sys/byteorder.h:75:18: note: previous declaration of 'htonll' with type 'uint64_t(uint64_t)' {aka 'long unsigned int(long unsigned int)'}
75 | extern uint64_t htonll(uint64_t);
| ^~~~~~
../migration/rdma.c:252:17: error: static declaration of 'ntohll' follows non-static declaration
252 | static uint64_t ntohll(uint64_t v)
| ^~~~~~
/usr/include/sys/byteorder.h:76:18: note: previous declaration of 'ntohll' with type 'uint64_t(uint64_t)' {aka 'long unsigned int(long unsigned int)'}
76 | extern uint64_t ntohll(uint64_t);
| ^~~~~~
Better to check the symbol availability with meson.
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Acked-by: Peter Xu <peterx@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20251117203834.83713-3-philmd@linaro.org>
buildsys: Remove dead 'mips' entry in supported_cpus[] array
Remove 'mips' from supported_cpus[], forgotten in commit 269ffaabc84 ("buildsys: Remove support for 32-bit MIPS hosts").
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-Id: <20251117114200.60917-1-philmd@linaro.org>
TYPE_LASI_CHIP inherits from TYPE_SYS_BUS_DEVICE, not
TYPE_PCI_HOST_BRIDGE, so its parent structure is of
SysBusDevice type.
Cc: qemu-stable@nongnu.org Fixes: 376b851909d ("hppa: Add support for LASI chip with i82596 NIC") Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Gustavo Romero <gustavo.romero@linaro.org> Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-Id: <20251117091804.56529-1-philmd@linaro.org>
qga/commands: Include proper Solaris header for getloadavg()
Solaris declares getloadavg() in <sys/loadavg.h>:
getloadavg(3C) Standard C Library Functions getloadavg(3C)
NAME
getloadavg - get system load averages
SYNOPSIS
#include <sys/loadavg.h>
int getloadavg(double loadavg[], int nelem);
[...]
Oracle Solaris 11.4 23 Jul 2020 getloadavg(3C)
Include it in order to avoid:
../qga/commands-posix.c: In function 'qmp_guest_get_load':
../qga/commands-posix.c:1408:9: error: implicit declaration of function 'getloadavg' [-Wimplicit-function-declaration]
1408 | if (getloadavg(loadavg, G_N_ELEMENTS(loadavg)) < 0) {
| ^~~~~~~~~~
../qga/commands-posix.c:1408:9: warning: nested extern declaration of 'getloadavg' [-Wnested-externs]
../configure relevant output:
C compiler for the host machine: gcc (gcc 14.2.0 "gcc (GCC) 14.2.0")
C linker for the host machine: gcc ld.solaris 5.11-1.3315
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Kostiantyn Kostiuk <kkostiuk@redhat.com> Acked-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20251117203834.83713-2-philmd@linaro.org>
Jan Kiszka [Fri, 14 Nov 2025 21:27:35 +0000 (22:27 +0100)]
hw/sd/sdcard: Avoid confusing address calculation in rpmb_calc_hmac
From the source frame, we initially need to copy out all fields after
data, thus starting from nonce on. Avoid expressing this indirectly by
pointing to the end of the data field - which also raised the attention
of Coverity (out-of-bound read /wrt data).
Resolves: CID 1642869 Reported-by: GuoHan Zhao <zhaoguohan@kylinos.cn> Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <4f7e1952-ecbd-4484-b128-9d02de3a7935@siemens.com>
[PMD: Add comment before the memcpy() call] Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
hw/arm: Re-enable xenpvh machine in qemu-system-arm/aarch64 binaries
While registering the ARM/Aarch64 machine interfaces
in commit 38c5ab40031 ("hw/arm: Filter machine types
for qemu-system-arm/aarch64 binaries"), we missed the
XenPV machine. Correct that.
Reported-by: Edgar E. Iglesias <edgar.iglesias@amd.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Tested-by: Edgar E. Iglesias <edgar.iglesias@amd.com> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Message-Id: <20251117091253.56009-1-philmd@linaro.org>
Yannick Voßen [Tue, 11 Nov 2025 10:28:29 +0000 (11:28 +0100)]
hw/dma/zynq-devcfg: Fix register memory
Registers are always 32 bit aligned. R_MAX is not the maximum
register address, it is the maximum register number. The memory
size can be determined by 4 * R_MAX.
Currently every register with an offset bigger than 0x40 will be
ignored, because the memory size is set wrong. This effects the
MCTRL register and makes it useless. This commit restores the
correct behaviour.
Cc: qemu-stable@nongnu.org Fixes: 034c2e69023 ("dma: Add Xilinx Zynq devcfg device model") Signed-off-by: YannickV <Y.Vossen@beckhoff.com> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251111102836.212535-9-corvin.koehne@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Bin Meng [Mon, 10 Nov 2025 11:05:07 +0000 (19:05 +0800)]
hw/sd: Fix ACMD41 state machine in SPI mode
In SPI mode, the ACMD41 argument only defines bit 30 (HCS); all other
bits are reserved. The current implementation incorrectly checks the
voltage window bits even in SPI mode, preventing the state machine
from transitioning to the READY state. As a result, the U-Boot
mmc-spi driver falls into an endless CMD55/ACMD41 loop.
Fixes: 3241a61a ("hw/sd/sdcard: Use complete SEND_OP_COND implementation in SPI mode")
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2945 Reported-by: Tom Rini <trini@konsulko.com> Signed-off-by: Bin Meng <bmeng.cn@gmail.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251110110507.1641042-3-bmeng.cn@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Bin Meng [Mon, 10 Nov 2025 11:05:06 +0000 (19:05 +0800)]
hw/sd: Fix incorrect idle state reporting in R1 response for SPI mode
Since commit b66f73a0 ("hw/sd: Add SDHC support for SD card SPI-mode"),
the CARD_POWER_UP bit in the OCR register has been set after reset.
Therefore, checking this bit against zero in sd_response_r1_make() to
determine the card’s idle state is incorrect in SPI mode. As a result,
QEMU makes the U-Boot mmc-spi driver believe the card never leaves the
reset state.
Fixes: 1585ab9f ("hw/sd/sdcard: Fill SPI response bits in card code")
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2945 Reported-by: Tom Rini <trini@konsulko.com> Signed-off-by: Bin Meng <bmeng.cn@gmail.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251110110507.1641042-2-bmeng.cn@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Peter Maydell [Fri, 7 Nov 2025 17:43:06 +0000 (17:43 +0000)]
system/qtest.c: Allow for multiple CHR_EVENT_CLOSED events
In the qtest_event() QEMUChrEvent handler, we create a timer
and log OPENED on CHR_EVENT_OPENED, and we destroy the timer and
log CLOSED on CHR_EVENT_CLOSED. However, the chardev subsystem
can send us more than one CHR_EVENT_CLOSED if we're reading from
a file chardev:
* the first one happens when we read the last data from the file
* the second one happens when the user hits ^C to exit QEMU
and the chardev is finalized: char_fd_finalize()
This causes us to call g_timer_elapsed() with a NULL timer
(which glib complains about) and print an extra CLOSED log line
with a zero timestamp:
Commit 638ac1c78457 introduced a regression in interrupt remapping
when running a VM configured with an intel-iommu device and an
assigned PCI VF. During boot, Linux reports repeated messages :
[ 15.416794] __common_interrupt: 2.37 No irq handler for vector
[ 15.417266] __common_interrupt: 2.37 No irq handler for vector
[ 15.417733] __common_interrupt: 2.37 No irq handler for vector
[ 15.418202] __common_interrupt: 2.37 No irq handler for vector
[ 15.418670] __common_interrupt: 2.37 No irq handler for vector
and may eventually hang.
The issue is caused by the incorrect use of the macro
ACCEL_KERNEL_GSI_IRQFD_POSSIBLE, which should instead be
ACCEL_GSI_IRQFD_POSSIBLE.
Fixes: 638ac1c78457 ("hw/intc: Generalize APIC helper names from kvm_* to accel_*") Cc: Magnus Kulke <magnuskulke@linux.microsoft.com> Signed-off-by: Cédric Le Goater <clg@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251106105148.737093-1-clg@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
MAINTAINERS: Update David Hildenbrand's email address
Switch to kernel.org email address as I will be leaving Red Hat. The
old address will remain active until end of January 2026, so performing
the change now should make sure that most mails will reach me.
Signed-off-by: David Hildenbrand <david@redhat.com> Signed-off-by: David Hildenbrand (Red Hat) <david@kernel.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251103103947.384401-1-david@kernel.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Hanna Czenczek [Mon, 10 Nov 2025 15:48:54 +0000 (16:48 +0100)]
win32-aio: Run CB in original context
AIO callbacks must be called in the originally calling AioContext,
regardless of the BDS’s “main” AioContext.
Note: I tried to test this (under wine), but failed. Whenever I tried
to use multiqueue or even just an I/O thread for a virtio-blk (or
virtio-scsi) device, I/O stalled, both with and without this patch.
For what it’s worth, when not using an I/O thread, I/O continued to work
with this patch.
Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
Message-ID: <20251110154854.151484-20-hreitz@redhat.com> Reviewed-by: Kevin Wolf <kwolf@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Hanna Czenczek [Mon, 10 Nov 2025 15:48:53 +0000 (16:48 +0100)]
null-aio: Run CB in original AioContext
AIO callbacks must be called in the originally calling AioContext,
regardless of the BDS’s “main” AioContext.
Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
Message-ID: <20251110154854.151484-19-hreitz@redhat.com> Reviewed-by: Kevin Wolf <kwolf@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Hanna Czenczek [Mon, 10 Nov 2025 15:48:52 +0000 (16:48 +0100)]
iscsi: Create AIO BH in original AioContext
AIO callbacks must be called in the original request’s AioContext,
regardless of the BDS’s “main” AioContext.
Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
Message-ID: <20251110154854.151484-18-hreitz@redhat.com> Reviewed-by: Kevin Wolf <kwolf@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Hanna Czenczek [Mon, 10 Nov 2025 15:48:51 +0000 (16:48 +0100)]
block: Note in which AioContext AIO CBs are called
This doesn’t seem to be specified anywhere, but is something we probably
want to be clear. I believe it is reasonable to implicitly assume that
callbacks are run in the current thread (unless explicitly noted
otherwise), so codify that assumption.
Some implementations don’t actually fulfill this contract yet. The next
patches should rectify that.
Note: I don’t know of any user-visible bugs produced by not running AIO
callbacks in the original context. AIO functionality is generally
mapped to coroutines through the use of bdrv_co_io_em_complete(), which
can run in any AioContext, and will always wake the yielding coroutine
in its original context. The only benefit here is that running
bdrv_co_io_em_complete() in the original context will make that
aio_co_wake() most likely a simpler qemu_coroutine_enter() instead of
scheduling the wakeup through AioContext.co_schedule_bh.
Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
Message-ID: <20251110154854.151484-17-hreitz@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Kevin Wolf <kwolf@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Hanna Czenczek [Mon, 10 Nov 2025 15:48:50 +0000 (16:48 +0100)]
blkreplay: Run BH in coroutine’s AioContext
While it does not matter in which AioContext we run aio_co_wake() to
continue an exactly-once-yielding coroutine, making this commit not
strictly necessary, there is also no reason why the BH should run in any
context but the request’s AioContext.
Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
Message-ID: <20251110154854.151484-16-hreitz@redhat.com> Reviewed-by: Kevin Wolf <kwolf@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Hanna Czenczek [Mon, 10 Nov 2025 15:48:49 +0000 (16:48 +0100)]
ssh: Run restart_coroutine in current AioContext
restart_coroutine() is attached as an FD handler just to wake the
current coroutine after yielding. It makes most sense to attach it to
the current (request) AioContext instead of the BDS main context. This
way, the coroutine can be entered directly from the BH instead of having
yet another indirection through AioContext.co_schedule_bh.
Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
Message-ID: <20251110154854.151484-15-hreitz@redhat.com> Reviewed-by: Kevin Wolf <kwolf@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Hanna Czenczek [Mon, 10 Nov 2025 15:48:48 +0000 (16:48 +0100)]
qcow2: Schedule cache-clean-timer in realtime
There is no reason why the cache cleaning timer should run in virtual
time, run it in realtime instead.
Suggested-by: Kevin Wolf <kwolf@redhat.com> Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
Message-ID: <20251110154854.151484-14-hreitz@redhat.com> Reviewed-by: Kevin Wolf <kwolf@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
projects / thirdparty / qemu.git / log
