]> git.ipfire.org Git - thirdparty/qemu.git/log
thirdparty/qemu.git
8 days agoMerge tag 'pull-nvme-20251125' of https://gitlab.com/birkelund/qemu into staging
Richard Henderson [Tue, 25 Nov 2025 15:44:15 +0000 (07:44 -0800)] 
Merge tag 'pull-nvme-20251125' of https://gitlab.com/birkelund/qemu into staging

nvme queue

# -----BEGIN PGP SIGNATURE-----
#
# iQEzBAABCgAdFiEEUigzqnXi3OaiR2bATeGvMW1PDekFAmklZyQACgkQTeGvMW1P
# DemROQf+IprPh+u3uPuJ51ED3JrvQ02D+djWmun77f0spF/hiCCEWE708voe3pfp
# 2QT3zCvCruqxBzzpirYZCALTpZ3cQfd5Fq2UuAOWzye4jE4yvgNHpV9vFbC7JY3w
# jJmRSuS3/m06MipEGmuoQGS0wNFpOaNLz15DMPWco0A+U2BgKmX/AVFpUJtvGYXz
# /E3VhwHwS9LCfOMEwZc+e9G4mzM0hB/xgg1qNPe1sp4Ao0hlVXvgVg1Bc6ujhFEc
# yrdCdzmDVwq/jAjYJDW0/5mXOPX+ugcyoMrFPkm0ABnksEnK6pPn6K7oMEXGZ4qr
# GyeSWtdyBZuK453sK3S1C/aX7izWeA==
# =GU3Z
# -----END PGP SIGNATURE-----
# gpg: Signature made Tue 25 Nov 2025 12:21:56 AM PST
# gpg:                using RSA key 522833AA75E2DCE6A24766C04DE1AF316D4F0DE9
# gpg: Good signature from "Klaus Jensen <its@irrelevant.dk>" [unknown]
# gpg:                 aka "Klaus Jensen <k.jensen@samsung.com>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg:          There is no indication that the signature belongs to the owner.
# Primary key fingerprint: DDCA 4D9C 9EF9 31CC 3468  4272 63D5 6FC5 E55D A838
#      Subkey fingerprint: 5228 33AA 75E2 DCE6 A247  66C0 4DE1 AF31 6D4F 0DE9

* tag 'pull-nvme-20251125' of https://gitlab.com/birkelund/qemu:
  hw/nvme: Validate PMR memory size
  hw/nvme: fix up extended protection information format
  hw/nvme: fix namespace atomic parameter setup

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
8 days agohw/nvme: Validate PMR memory size
Philippe Mathieu-Daudé [Mon, 24 Nov 2025 04:02:01 +0000 (05:02 +0100)] 
hw/nvme: Validate PMR memory size

Per the PCI spec 3.0, in section 6.2.5.1, "Address Maps":

  A 32-bit register can be implemented to support a single
  memory size that is a power of 2 from 16 bytes to 2 GB.

Add a check in nvme_init_pmr(), returning an error if the
PMR region size is too small; and update the QTest.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Klaus Jensen <k.jensen@samsung.com>
Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
8 days agohw/nvme: fix up extended protection information format
Keith Busch [Thu, 20 Nov 2025 01:53:35 +0000 (17:53 -0800)] 
hw/nvme: fix up extended protection information format

Set the protection information format (pif) only in the formats that can
support the larger guard types, and update the current in-use format
information when the user changes it.

Signed-off-by: Keith Busch <kbusch@kernel.org>
[k.jensen: fix missing braces and wrong indentation]
Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
8 days agohw/nvme: fix namespace atomic parameter setup
Klaus Jensen [Tue, 4 Nov 2025 10:51:45 +0000 (11:51 +0100)] 
hw/nvme: fix namespace atomic parameter setup

Coverity complains about a possible copy-paste error in the verification
of the namespace atomic parameters (CID 1642811). While the check is
correct, the code (and the intention) is unclear.

Fix this by reworking how the parameters are verified. Peter also
identified that the realize function was not correctly erroring out if
parameters were misconfigured, so fix that too.

Lastly, change the error messages to be more describing.

Coverity: CID 1642811
Fixes: bce51b83709b ("hw/nvme: add atomic boundary support")
Fixes: 3b41acc96299 ("hw/nvme: enable ns atomic writes")
Reviewed-by: Jesper Wendel Devantier <foss@defmacro.it>
Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
9 days agoMerge tag 'pull-target-arm-20251124' of https://gitlab.com/pm215/qemu into staging
Richard Henderson [Mon, 24 Nov 2025 17:03:12 +0000 (09:03 -0800)] 
Merge tag 'pull-target-arm-20251124' of https://gitlab.com/pm215/qemu into staging

target-arm queue:
 * hw/display/exynos4210_fimd: Account for zero length in fimd_update_memory_section()
 * hw/arm/armv7m: Disable reentrancy guard for v7m_sysreg_ns_ops MRs
 * hw/display/exynos4210_fimd: Remove duplicated definition
 * hw/arm/Kconfig: Exclude imx8mp-evk machine from KVM-only build

# -----BEGIN PGP SIGNATURE-----
#
# iQJNBAABCAA3FiEE4aXFk81BneKOgxXPPCUl7RQ2DN4FAmkka80ZHHBldGVyLm1h
# eWRlbGxAbGluYXJvLm9yZwAKCRA8JSXtFDYM3hVpD/48w6peqEy8HmLtmrswBdVt
# TIYAkcz3oGNDnpYqB0UsjEVvmtAQZtGLS0XaOSVlB3l8NPiGe5GFwJJmt8TYBUpB
# rl76Cbmnx9lHyJshuoHb7CdtY2Q2gWxQPaeqD+cFvWTa/HNzeMO8joS9EkNApubP
# B7SQpcZuMgv4mgBTM3ly2/9mmFkKyY+/gkvtOmTMS/wGjrhpIs8DWIgLZ5/odmI5
# +c15aNOsfsnZ7KEsawRyYpn1pV2YeoYWYbQqQGOVLLfF7y/mLSfkI35SoXHI79zu
# nU0f/8NKhFswtx+SoAuQtHmnGLpgc5gRL21hwHZxiLkLQif1HgfCT3YNM2V/03ll
# +n5lOZzvNY4TLaoc5R9a2B+DRpp7ihrDnpW+tUV5LIhpDT4eqRto6+ATqlJ0Hfkw
# konwiahSAuHMMpnmfKbDvieVQasOZZBI0bpdwj3/yzXKh91/cYhAE4RySC1qLWe+
# dHeroqdyWKxbxetQz14kwJVWHDrvZSiSVpc1uVHWYBnrP310kMXlkgGt7MA2qiw5
# Dm01Dz/Upc+FpLGUqwHhZPWf2sJLdQVRqGwEevRkJl80AFpCR10JbSqwN4Fpz2gg
# YlkHmFhJfNM7FYoD+c6y4USwxiv0mMmtkIMuR2csmY5F5oH18H6zJ0lYikz5I0eo
# MVcNV1lPilWh7lKAKlLlGQ==
# =+CbZ
# -----END PGP SIGNATURE-----
# gpg: Signature made Mon 24 Nov 2025 06:29:33 AM PST
# gpg:                using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE
# gpg:                issuer "peter.maydell@linaro.org"
# gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [unknown]
# gpg:                 aka "Peter Maydell <pmaydell@gmail.com>" [unknown]
# gpg:                 aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" [unknown]
# gpg:                 aka "Peter Maydell <peter@archaic.org.uk>" [unknown]
# gpg: WARNING: The key's User ID is not certified with a trusted signature!
# gpg:          There is no indication that the signature belongs to the owner.
# Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83  15CF 3C25 25ED 1436 0CDE

* tag 'pull-target-arm-20251124' of https://gitlab.com/pm215/qemu:
  hw/display/exynos4210_fimd: Account for zero length in fimd_update_memory_section()
  hw/arm/armv7m: Disable reentrancy guard for v7m_sysreg_ns_ops MRs
  hw/display/exynos4210_fimd: Remove duplicated definition
  hw/arm/Kconfig: Exclude imx8mp-evk machine from KVM-only build

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
9 days agoMerge tag 'pull-10.2-gitdm-241125-1' of https://gitlab.com/stsquad/qemu into staging
Richard Henderson [Mon, 24 Nov 2025 17:02:51 +0000 (09:02 -0800)] 
Merge tag 'pull-10.2-gitdm-241125-1' of https://gitlab.com/stsquad/qemu into staging

gitdm updates for 2025

With the latest updates the last year has been made possible by:

  Top changeset contributors by employer
  Linaro                    2959 (37.0%)
  Red Hat                   1919 (24.0%)
  Intel                      313 (3.9%)
  (None)                     308 (3.9%)
  ASPEED Technology Inc.     231 (2.9%)
  Loongson Technology        227 (2.8%)
  IBM                        192 (2.4%)
  Oracle                     187 (2.3%)
  Nutanix                    133 (1.7%)
  Academics (various)         99 (1.2%)

  Top lines changed by employer
  Linaro                    109812 (31.8%)
  Red Hat                   91050 (26.4%)
  ASPEED Technology Inc.    11811 (3.4%)
  Intel                     10606 (3.1%)
  IBM                       10146 (2.9%)
  (None)                    8965 (2.6%)
  Oracle                    8574 (2.5%)
  Loongson Technology       7614 (2.2%)
  Nutanix                   7404 (2.1%)
  Microsoft                 6927 (2.0%)

  Employers with the most hackers (total 433)
  Red Hat                     54 (12.5%)
  IBM                         30 (6.9%)
  Intel                       17 (3.9%)
  (None)                      13 (3.0%)
  AMD                         13 (3.0%)
  Google                      11 (2.5%)
  Rivos Inc                   10 (2.3%)
  Linaro                       9 (2.1%)
  Oracle                       8 (1.8%)
  Huawei                       8 (1.8%)

# -----BEGIN PGP SIGNATURE-----
#
# iQEzBAABCgAdFiEEZoWumedRZ7yvyN81+9DbCVqeKkQFAmkkKsAACgkQ+9DbCVqe
# KkRbcQgAhc2I0HQa9fqFnp8vAZPMEEp3FFuPf1Dhwl4SWP95uZe/giooFyUhoZjw
# fmLu3V+Tza1oX9ymgHcbGu465jgIORotIG9c2jfTNStbWQWMLT+3fsS3+/9oNgry
# TtTNrSR2RpcUvnOWbMCPm68FiekQEmm4lbzNjh5uuGb6IddFyP/gZatbdMw3KzaX
# kYKnlV6Ul5wBjzfH68paRfC1ZcM0/iPy5EbK3FhPVozpA3fV729ZR535WnFHNjc9
# Gk6+oN2o4KQnvgSBY00NNnKUMcvMnvg3LSgmd2YUWh3O5jfVBbzaebP06HgfjLI3
# WwBdlAnhAQRFZqJhiH7mCVmJhuwigQ==
# =OPEI
# -----END PGP SIGNATURE-----
# gpg: Signature made Mon 24 Nov 2025 01:52:00 AM PST
# gpg:                using RSA key 6685AE99E75167BCAFC8DF35FBD0DB095A9E2A44
# gpg: Good signature from "Alex Bennée (Master Work Key) <alex.bennee@linaro.org>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg:          There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 6685 AE99 E751 67BC AFC8  DF35 FBD0 DB09 5A9E 2A44

* tag 'pull-10.2-gitdm-241125-1' of https://gitlab.com/stsquad/qemu:
  contrib/gitdm: add more individual contributors
  contrib/gitdm: add mapping for Nutanix
  contrib/gitdm: add mapping for Eviden
  contrib/gitdm: add University of Tokyo to academic group
  contrib/gitdm: add group-map for Microsoft
  contrib/gitdm: add group-map for Huawei

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
9 days agoMerge tag 'pull-aspeed-20251124' of https://github.com/legoater/qemu into staging
Richard Henderson [Mon, 24 Nov 2025 17:02:22 +0000 (09:02 -0800)] 
Merge tag 'pull-aspeed-20251124' of https://github.com/legoater/qemu into staging

aspeed queue:

* Fixed typo in the AST2700 LTPI device
* Fixed missing wiring of the SPI IRQ in AST10x0, AST2600, AST2700 SoCs
* Updated ASPEED PCIe Root Port capabilities and MSI support

# -----BEGIN PGP SIGNATURE-----
#
# iQIzBAABCAAdFiEEoPZlSPBIlev+awtgUaNDx8/77KEFAmkkA5wACgkQUaNDx8/7
# 7KG/xg/+LqpKxeFhofFSini+NLcD6gelGf2svIlz/q7Q5NhbgBdVC77g7L8aUho3
# gphaMmpafwyUW7OqtddB6FINDOVR8UnbU7NJJv5hedmgC+oxdpMrG2PiIPr6TsRu
# 6g/f4YvEMsehKAJm+x9APCFHmr9bTuY1iVwDJ3jfzWUBo8VPOT+duTLLTmc/RypZ
# elupzVTN7+RwVi18cYkrSQEtkmkz1U42W9ZG+PUKAdta0VfRTSReiEFGsD8pY/CB
# ndPbeEYVwIF2ezH5pXUneXgwMFM/ANYpNx2VXRuWabaRZMfChiDiHBOYt/CvfTH+
# v/o52sjbHtPJ2rKWKnZO+VBuV8Frwz9HgWAKLpoEurTolrnbA592BIxo3XaMS/eq
# 5a3HJ6wHAoU6qfiI3JSsP42nsCh5Ercf1mX8ArJlLePT/5XiQ3/MLBiESHXPptkm
# 4XBwG9zkr6zVhTm+Yj789rSlQgL+7cPZ78bMwCNhFHHXtZSpiWUP1e3LdVIX4pkP
# 1CPNyXRA+DDQEvksKkE6XkQZrnjydRbwCGrtNpuPkFmWDq9vQhUCjaKQBcutYgcD
# mbJVTeK3e7za/toWf88eNOWaJ7D+syXSQ8AfACkg5bG5zKreaQOLc2oC8UDcVJSE
# 3nwj12jDbfbmTDcFOY3diEhA8JiwylagiMZNiSx7bN9t+RO1jlQ=
# =DmJM
# -----END PGP SIGNATURE-----
# gpg: Signature made Sun 23 Nov 2025 11:05:00 PM PST
# gpg:                using RSA key A0F66548F04895EBFE6B0B6051A343C7CFFBECA1
# gpg: Good signature from "Cédric Le Goater <clg@redhat.com>" [full]
# gpg:                 aka "Cédric Le Goater <clg@kaod.org>" [full]

* tag 'pull-aspeed-20251124' of https://github.com/legoater/qemu:
  hw/pci-host/aspeed_pcie: Update ASPEED PCIe Root Port capabilities and enable MSI to support hotplug
  hw/arm/aspeed: Fix missing SPI IRQ connection causing DMA interrupt failure
  hw/arm/ast27x0: Fix typo in LTPI address

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
9 days agohw/display/exynos4210_fimd: Account for zero length in fimd_update_memory_section()
Peter Maydell [Fri, 7 Nov 2025 14:39:13 +0000 (14:39 +0000)] 
hw/display/exynos4210_fimd: Account for zero length in fimd_update_memory_section()

In fimd_update_memory_section() we attempt ot find and map part of
the RAM MR which backs the framebuffer, based on guest-configurable
size and start address.

If the guest configures framebuffer settings which result in a
zero-sized framebuffer, we hit an assertion(), because
memory_region_find() will return a NULL mem_section.mr.

Explicitly check for the zero-size case and treat this as a
guest error.

Because we now have a code path which can reach error_return without
calling memory_region_find to set w->mem_section, we must NULL out
w->mem_section.mr after the unref of the old MR, so that error_return
does not incorrectly double-unref the old MR.

Cc: qemu-stable@nongnu.org
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1407
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20251107143913.1341358-1-peter.maydell@linaro.org

9 days agohw/arm/armv7m: Disable reentrancy guard for v7m_sysreg_ns_ops MRs
Peter Maydell [Fri, 14 Nov 2025 15:53:04 +0000 (15:53 +0000)] 
hw/arm/armv7m: Disable reentrancy guard for v7m_sysreg_ns_ops MRs

For M-profile cores which support TrustZone, there are some memory
areas which are "NS aliases" -- a Secure access to these addresses
really performs an NS access to a different part of the device.  We
implement these using MemoryRegionOps read and write functions which
pass the access on with adjusted attributes using
memory_region_dispatch_read() and memory_region_dispatch_write().

Since the MR we are dispatching to is owned by the same device that
owns the NS-alias MR (the TYPE_ARMV7M container object), this trips
the reentrancy-guard that is applied by access_with_adjusted_size().

Mark the NS alias MemoryRegions as disable_reentrancy_guard; this is
safe because v7m_sysreg_ns_read() and v7m_sysreg_ns_write() do not
touch any of the device's state.  (Any further reentrancy attempts by
the underlying MR will still be caught.)

Without this fix, an attempt to read from an address like 0xe002e010,
which is a register in the NS systick alias, will fail and provoke

 qemu-system-arm: warning: Blocked re-entrant IO on MemoryRegion: v7m_systick at addr: 0x0

We didn't notice this earlier because almost all code accesses
the registers and systick via the non-alias addresses; the NS
aliases are only need for the rarer case of Secure code that needs
to manage the NS timer or system state on behalf of NS code.

Note that although the v7m_systick_ops read and write functions
also call memory_region_dispatch_{read,write}, this MR does not
need to have the reentrancy-guard disabled because the underlying
MR that it forwards to is owned by a different device (the
TYPE_SYSTICK timer device).

Reported via a stackoverflow question:
https://stackoverflow.com/questions/79808107/what-this-error-is-even-about-qemu-system-arm-warning-blocked-re-entrant-io

Cc: qemu-stable@nongnu.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20251114155304.2662414-1-peter.maydell@linaro.org

9 days agohw/display/exynos4210_fimd: Remove duplicated definition
Philippe Mathieu-Daudé [Fri, 21 Nov 2025 09:35:09 +0000 (10:35 +0100)] 
hw/display/exynos4210_fimd: Remove duplicated definition

FIMD_VIDWADD0_END is defined twice, keep only one.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20251121093509.25088-1-philmd@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
9 days agohw/arm/Kconfig: Exclude imx8mp-evk machine from KVM-only build
Bernhard Beschow [Wed, 19 Nov 2025 20:37:59 +0000 (21:37 +0100)] 
hw/arm/Kconfig: Exclude imx8mp-evk machine from KVM-only build

Fixes make check failures on an aarch64 host when QEMU is configured
using '--enable-kvm --disable-tcg':
  qemu-system-aarch64: unknown type 'arm-gicv3'

Reported-by: Cornelia Huck <cohuck@redhat.com>
Tested-by: Cornelia Huck <cohuck@redhat.com>
Reviewed-by: Cornelia Huck <cohuck@redhat.com>
Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Message-id: 20251119203759.5138-1-shentey@gmail.com
Suggested-by: Peter Maydell <peter.maydell@linaro.org>
Tested-by: Cornelia Huck <cohuck@redhat.com>
Reviewed-by: Cornelia Huck <cohuck@redhat.com>
Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
9 days agocontrib/gitdm: add more individual contributors
Alex Bennée [Wed, 19 Nov 2025 11:39:52 +0000 (11:39 +0000)] 
contrib/gitdm: add more individual contributors

I only add names explicitly acked as individual contributors.

Acked-by: Sean Wei <me@sean.taipei>
Acked-by: William Kosasih <kosasihwilliam4@gmail.com>
Message-ID: <20251119113953.1432303-10-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
9 days agocontrib/gitdm: add mapping for Nutanix
Alex Bennée [Wed, 19 Nov 2025 11:39:50 +0000 (11:39 +0000)] 
contrib/gitdm: add mapping for Nutanix

We have a number of hackers from Nutanix, make sure they are grouped
together.

Reviewed-by: Jon Kohler <jon@nutanix.com>
Reviewed-by: John Levon <john.levon@nutanix.com>
Message-ID: <20251119113953.1432303-8-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
9 days agocontrib/gitdm: add mapping for Eviden
Alex Bennée [Wed, 19 Nov 2025 11:39:49 +0000 (11:39 +0000)] 
contrib/gitdm: add mapping for Eviden

Reviewed-by: Clement Mathieu--Drif <clement.mathieu--drif@eviden.com>
Message-ID: <20251119113953.1432303-7-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
9 days agocontrib/gitdm: add University of Tokyo to academic group
Alex Bennée [Wed, 19 Nov 2025 11:39:48 +0000 (11:39 +0000)] 
contrib/gitdm: add University of Tokyo to academic group

From Akihiko:

  I and my colleagues use QEMU for academic microarchitecture
  researches so it is indeed to appropriate to have an entry here.

Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Message-ID: <20251119113953.1432303-6-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
9 days agocontrib/gitdm: add group-map for Microsoft
Alex Bennée [Wed, 19 Nov 2025 11:39:46 +0000 (11:39 +0000)] 
contrib/gitdm: add group-map for Microsoft

While we do see contributions from the top-level domain we want to
catch the linux.microsoft subdomain and those contributors also post
via other addresses.

Cc: Magnus Kulke <magnuskulke@linux.microsoft.com>
Acked-by: Wei Liu <wei.liu@kernel.org>
Message-ID: <20251119113953.1432303-4-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
9 days agocontrib/gitdm: add group-map for Huawei
Alex Bennée [Wed, 19 Nov 2025 11:39:45 +0000 (11:39 +0000)] 
contrib/gitdm: add group-map for Huawei

While we do see contributions from the top-level domain some
contributors also post via other addresses.

Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Reviewed-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Message-ID: <20251119113953.1432303-3-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
9 days agohw/pci-host/aspeed_pcie: Update ASPEED PCIe Root Port capabilities and enable MSI...
Jamin Lin [Fri, 21 Nov 2025 05:01:08 +0000 (13:01 +0800)] 
hw/pci-host/aspeed_pcie: Update ASPEED PCIe Root Port capabilities and enable MSI to support hotplug

This patch updates the ASPEED PCIe Root Port capability layout and interrupt
handling to match the hardware-defined capability structure as documented in
the PCI Express Controller (PCIE) chapter of the ASPEED SoC datasheet.

The following capability offsets and fields are now aligned with the actual
hardware implementation (validated using EVB config-space dumps via
'lspci -s <bdf> -vvv'):

- Added MSI capability at offset 0x50 and enabled 1-vector MSI support
- Added PCI Express Capability structure at offset 0x80
- Added Secondary Subsystem Vendor ID (SSVID) at offset 0xC0
- Added AER capability at offset 0x100
- Implemented aer_vector() callback and MSI init/uninit hooks
- Updated Root Port SSID to 0x1150 to reflect the platform default

Enabling MSI is required for proper PCIe Hotplug event signaling. This change
improves correctness and ensures QEMU Root Port behavior matches the behavior
of ASPEED hardware and downstream kernel expectations.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Fixes: 2af56518fa91 ("hw/pci-host/aspeed: Add AST2600 PCIe Root Port and make address configurable")
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Nabih Estefan <nabihestefan@google.com>
Tested-by: Nabih Estefan <nabihestefan@google.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Link: https://lore.kernel.org/qemu-devel/20251121050108.3407445-2-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
9 days agohw/arm/aspeed: Fix missing SPI IRQ connection causing DMA interrupt failure
Jamin Lin [Thu, 6 Nov 2025 08:49:10 +0000 (16:49 +0800)] 
hw/arm/aspeed: Fix missing SPI IRQ connection causing DMA interrupt failure

It did not connect SPI IRQ to the Interrupt Controller, so even the SPI
model raised the IRQ, the interrupt was not received. The CPU therefore
did not trigger an interrupt via the controller, and the firmware never
received the interrupt.

Fixes: 356b230ed13889e09d087a96498887de695df17e ("aspeed/soc: Add AST1030 support")
Fixes: f25c0ae1079dc0b9de02676eb3e3949a09df9f41 ("aspeed/soc: Add AST2600 support")
Fixes: 5dd883ab0635c9f715c77cc32622e458a0724581 ("aspeed/soc: Add AST2700 support")
Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20251106084925.1253704-2-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
9 days agohw/arm/ast27x0: Fix typo in LTPI address
Nabih Estefan [Tue, 4 Nov 2025 23:37:42 +0000 (23:37 +0000)] 
hw/arm/ast27x0: Fix typo in LTPI address

The address for LTPI has one more 0 that it should, bug introduced in
commit 91064bea6b2d747a981cb3bd2904e56f443e6c67.

Signed-off-by: Nabih Estefan <nabihestefan@google.com>
Fixes: 91064bea6b2d ("aspeed: ast27x0: Map unimplemented devices in SoC memory")
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20251104233742.2147367-1-nabihestefan@google.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
9 days agoMerge tag 'staging-pull-request' of https://gitlab.com/peterx/qemu into staging
Richard Henderson [Sun, 23 Nov 2025 19:46:53 +0000 (11:46 -0800)] 
Merge tag 'staging-pull-request' of https://gitlab.com/peterx/qemu into staging

Migration pull for rc2

- Zhijian's COLO regression fix (since 10.0)
- Matthew's fix to avoid crash on wrong list manipulations
- Markus's error report leak fix and cleanups
- Peter's qtest changes to merge memory_backend and use_shmem

# -----BEGIN PGP SIGNATURE-----
#
# iIgEABYKADAWIQS5GE3CDMRX2s990ak7X8zN86vXBgUCaSEDHxIccGV0ZXJ4QHJl
# ZGhhdC5jb20ACgkQO1/MzfOr1wZSAAEAmixKaiIm+w0vp7YiNNTeq22+y6Eo7ran
# K7g5jCswEH8BAOTPeh7AHBN3L2Zi3tw58Rqyh08kiY/x0/s8DE7sL0wM
# =3a75
# -----END PGP SIGNATURE-----
# gpg: Signature made Fri 21 Nov 2025 04:26:07 PM PST
# gpg:                using EDDSA key B9184DC20CC457DACF7DD1A93B5FCCCDF3ABD706
# gpg:                issuer "peterx@redhat.com"
# gpg: Good signature from "Peter Xu <xzpeter@gmail.com>" [unknown]
# gpg:                 aka "Peter Xu <peterx@redhat.com>" [unknown]
# gpg: WARNING: The key's User ID is not certified with a trusted signature!
# gpg:          There is no indication that the signature belongs to the owner.
# Primary key fingerprint: B918 4DC2 0CC4 57DA CF7D  D1A9 3B5F CCCD F3AB D706

* tag 'staging-pull-request' of https://gitlab.com/peterx/qemu:
  tests/migration-test: Use MEM_TYPE_MEMFD for memory_backend
  tests/migration-test: Add MEM_TYPE_SHMEM
  tests/migration-test: Merge shmem_opts into memory_backend
  tests/migration-test: Introduce MemType
  migration/postcopy-ram: Improve error reporting after loadvm failure
  migration: Use warn_reportf_err() where appropriate
  migration: Plug memory leaks after migrate_set_error()
  migration: set correct list pointer when removing notifier
  migration: Fix transition to COLO state from precopy

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
9 days agoMerge tag 'pull-trivial-patches' of https://gitlab.com/mjt0k/qemu into staging
Richard Henderson [Sun, 23 Nov 2025 19:46:29 +0000 (11:46 -0800)] 
Merge tag 'pull-trivial-patches' of https://gitlab.com/mjt0k/qemu into staging

trivial patches for 2025-11-21

# -----BEGIN PGP SIGNATURE-----
#
# iQIzBAABCgAdFiEEZKoqtTHVaQM2a/75gqpKJDselHgFAmkgYNYACgkQgqpKJDse
# lHgZIA/+MMazD/z4+niWJinTb/NXq5Q5AbE9x1bivYT8eVdyYrklAn5vqA1tQUHg
# nqAHvMEhhl2JtDI/OAABMcMZGay/anqBpuJ17g0CV3nlFQAoYQDI2QZxtBAPXC8K
# n8ZtaWrdeASrVPfxohPn5hJvj5j2m0468QRSa/MKad5iBt3F3JuZn8m20X9YkzkI
# FHGnRzBYg+6s8p312imEmcPqxId6n4xxJY/i8PnXY+dce//zZqX2UPmjf8aRxDgY
# 9eTzio6526w4raIzv/FXUXlnYn/ihRYRWxY/bI0t+7AJ1mY+F5SbFeg0pTr5koEg
# 3UQF/U0yILCIWoyoj8qiRmq62DxKCuvC16RdpJ91x3q3hQKmLn+0rpJlTcBHEGkw
# T28XEniTrYJKD3LbvZE9dnYcskyPSqpskKixdB94wupWA9XZ/BW6Ivq6ni/Jsozz
# wTsdWfyhtI9xd4TKeR2Ondz9xlTjhOTk7OoPgVa+IKESSLZYy4FlFsFV9Bb03I9b
# gaB5C7FDzJMa4JT4Wrc95cTtobno7VD6+Qsg78/piWomBPXSWi9QM0Uap2SdA3Ac
# s+ZjIrO02jsUdA68MSaxQjPDzdHvuAbvqDXY0+ACFutRZn9Yb7PTbr3m0JwXa8pa
# E9nBy850A4XynnU+1wuuPLxJStsKv/182C8x8Mt7hP4HfZ5w0fc=
# =1PPo
# -----END PGP SIGNATURE-----
# gpg: Signature made Fri 21 Nov 2025 04:53:42 AM PST
# gpg:                using RSA key 64AA2AB531D56903366BFEF982AA4A243B1E9478
# gpg: Good signature from "Michael Tokarev <mjt@debian.org>" [unknown]
# gpg:                 aka "Michael Tokarev <mjt@corpit.ru>" [unknown]
# gpg:                 aka "Michael Tokarev <mjt@tls.msk.ru>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg:          There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 9D8B E14E 3F2A 9DD7 9199  28F1 61AD 3D98 ECDF 2C8E
#      Subkey fingerprint: 64AA 2AB5 31D5 6903 366B  FEF9 82AA 4A24 3B1E 9478

* tag 'pull-trivial-patches' of https://gitlab.com/mjt0k/qemu:
  Fix the typo of vfio-pci device's enable-migration option
  qmp: Fix a typo for a USO feature
  qga: use access(2) to check for command existance instead of questionable stat(2)

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
9 days agoMerge tag 'pull-maintainers-2025-11-21' of https://repo.or.cz/qemu/armbru into staging
Richard Henderson [Sun, 23 Nov 2025 19:46:09 +0000 (11:46 -0800)] 
Merge tag 'pull-maintainers-2025-11-21' of https://repo.or.cz/qemu/armbru into staging

MAINTAINERS patches for 2025-11-21

# -----BEGIN PGP SIGNATURE-----
#
# iQJGBAABCAAwFiEENUvIs9frKmtoZ05fOHC0AOuRhlMFAmkgW+MSHGFybWJydUBy
# ZWRoYXQuY29tAAoJEDhwtADrkYZTinoP/1Kte5UCJwsLYgIQZt5X1B1aYhfFKvqS
# eAjpN/zJ2MxfbzkriLOObqumWlJkR4yGctnCCnyQbyoWqJGzHmTW/DF+oBYkc7Tt
# agUIp2yKcqKFcAymavt5r8oiSHrp1OstKmS6HnnblJWeRoOaBba+ETYuSZabziui
# 4E694ulv3r/Nl3THnzqNOlZ2aU51yn0/NHXDryfjgiu3PAG77+OjUVU2JMd/Qwqn
# wrVozgL0s91hHCm6HHu1ucxFXu1+OBSrpylSDGBagn+8wHhBaFa+JugFHbdMRTOP
# qmMtSyPttaZUu0IE6BC8wZnzNZwlGIwDTtYenVq1u8JWErcpVeRe2C+R12/Kv7FJ
# zNm6UzjsL/6Dtjkq4O055Bo1RMb0uxueQZhfsoGQj2ZzeLgZD1KqsGGBchmfLCVN
# wNlPWbTD9b+0OL1ChNB0yKGKro1N0f9UsNsmbl5rY7+lE7N0SIzdJjamxSj5VLNC
# F+Dsjws9aZBc8EKYpfgJC/qtNyDm7w6JwVVeH1glHdcynSZaUKLFP8pYYAAIFAcL
# ES6FbV6MJ4a5yWw1/EskwCNfOXWsObQRVlLbE5kNSz6qmmiCeGw3jMUZNuhIPPRI
# MpYtt1kmQZt0I4VZ3dpOM66ngztHtwxjknYDJWLMmUKe56mo0sdfWlCG4gZ6CO/z
# 8sp+UTeRJudv
# =tX1q
# -----END PGP SIGNATURE-----
# gpg: Signature made Fri 21 Nov 2025 04:32:35 AM PST
# gpg:                using RSA key 354BC8B3D7EB2A6B68674E5F3870B400EB918653
# gpg:                issuer "armbru@redhat.com"
# gpg: Good signature from "Markus Armbruster <armbru@redhat.com>" [unknown]
# gpg:                 aka "Markus Armbruster <armbru@pond.sub.org>" [unknown]
# gpg: WARNING: The key's User ID is not certified with a trusted signature!
# gpg:          There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 354B C8B3 D7EB 2A6B 6867  4E5F 3870 B400 EB91 8653

* tag 'pull-maintainers-2025-11-21' of https://repo.or.cz/qemu/armbru:
  MAINTAINERS: update email of zhenwei pi

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
9 days agoMerge tag 'pull-request-2025-11-21' of https://gitlab.com/thuth/qemu into staging
Richard Henderson [Sun, 23 Nov 2025 19:45:42 +0000 (11:45 -0800)] 
Merge tag 'pull-request-2025-11-21' of https://gitlab.com/thuth/qemu into staging

* Fix a crash that occurs when passing through virtio devices to nested guest
* Update s390x MAINTAINERS
* Fix various pylint warnings in functional tests

# -----BEGIN PGP SIGNATURE-----
#
# iQJFBAABCgAvFiEEJ7iIR+7gJQEY8+q5LtnXdP5wLbUFAmkgMrgRHHRodXRoQHJl
# ZGhhdC5jb20ACgkQLtnXdP5wLbXvEg/8CxLpA1a/lkf17XyGQmxvES5sRZDD2DCg
# CTZfK8j4ZwaDlHH4WIQdvAPHxSMZ4p0Z+HoS+GlKkAMTp6ALJkSg+mRosehy7sH0
# z3DRcGXnR46kArdhLzZIXL0QStAcTRAhTrva/eI+pf6CDD8ypR3Qut6d4hTBVdvB
# lgU1LOOXDOGRsWYq11asUJabwZr4VYYIQlIMd57Lv2MITCt3UNwK279hZQQ/Xe5C
# 07Y9X4aC3m3f8+AHbZJhrSB9ySNQMGuKyGfHf+rQDyYGOybsG/cJoJLUO6eAUU3M
# b3J/YoEViL7JmKqwv2WJQdP2p7/M8M9XlK9rMn7Ry26Wdab/QeNTdjMHuakxHfmn
# oaorN7ua2P+wLKV6h2ElHFKiqhvs/n6vGGE39FsvbgGYhzsqdg0YvKDr61KxpXRp
# rz7LuiLygBFEUwhqlLa2ePoJb9wxgECLgEib17qNhjUlDHegSDGNpENAzvJ/rC2l
# ufCNQR17zocffJp1N/S1ZcjVc+JzMUG5G6ScdQsKUHueSqiXpS6pRI7cX0PFNz70
# jp2Ul+m1Mr9GJn9bFhz2Kf2k74gpW5B27SKnZlcZa/AFtT9WlHcEkStAs0PRe00Q
# rrPkxBJaesLayxX6xW8HMzO+IkBniHtxQesf5WPlf9+z2roM0eXuCXibMGHnK49P
# YqvvLCvBTEA=
# =yxWh
# -----END PGP SIGNATURE-----
# gpg: Signature made Fri 21 Nov 2025 01:36:56 AM PST
# gpg:                using RSA key 27B88847EEE0250118F3EAB92ED9D774FE702DB5
# gpg:                issuer "thuth@redhat.com"
# gpg: Good signature from "Thomas Huth <th.huth@gmx.de>" [unknown]
# gpg:                 aka "Thomas Huth <thuth@redhat.com>" [unknown]
# gpg:                 aka "Thomas Huth <th.huth@posteo.de>" [unknown]
# gpg:                 aka "Thomas Huth <huth@tuxfamily.org>" [unknown]
# gpg: WARNING: The key's User ID is not certified with a trusted signature!
# gpg:          There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 27B8 8847 EEE0 2501 18F3  EAB9 2ED9 D774 FE70 2DB5

* tag 'pull-request-2025-11-21' of https://gitlab.com/thuth/qemu:
  MAINTAINERS: s390 maintainer updates
  tests/functional/aarch64/test_rme_sbsaref: Silence issues reported by pylint
  tests/functional/aarch64/test_reverse_debug: Fix issues reported by pylint
  tests/functional/ppc/test_ppe42: Fix style issues reported by pylint
  tests/functional/ppc/test_amiga: Fix issues reported by pylint and flake8
  tests/functional/x86_64/test_memlock: Silence pylint warnings
  tests/functional/x86_64/test_reverse_debug: Silence pylint warning
  tests/functional/x86_64/test_virtio_gpu: Fix various issues reported by pylint
  tests/functional/arm/test_aspeed_ast2600_buildroot: Fix pylint warnings
  hw/s390x: Fix a possible crash with passed-through virtio devices

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
11 days agotests/migration-test: Use MEM_TYPE_MEMFD for memory_backend
Peter Xu [Mon, 17 Nov 2025 22:39:08 +0000 (17:39 -0500)] 
tests/migration-test: Use MEM_TYPE_MEMFD for memory_backend

The only two users of memory_backend as of now (cpr-exec, cpr-transfer)
uses memfd as backend, now we fully support it.  We can move memory_backend
usage to mem_type and drop it.

Reviewed-by: Juraj Marcin <jmarcin@redhat.com>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/r/20251117223908.415965-5-peterx@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
11 days agotests/migration-test: Add MEM_TYPE_SHMEM
Peter Xu [Mon, 17 Nov 2025 22:39:07 +0000 (17:39 -0500)] 
tests/migration-test: Add MEM_TYPE_SHMEM

Add memfd support for mem_type.  Will be used to replace memory_backend.

Reviewed-by: Juraj Marcin <jmarcin@redhat.com>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/r/20251117223908.415965-4-peterx@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
11 days agotests/migration-test: Merge shmem_opts into memory_backend
Peter Xu [Mon, 17 Nov 2025 22:39:06 +0000 (17:39 -0500)] 
tests/migration-test: Merge shmem_opts into memory_backend

The two parameters are more or less duplicated in migrate_args().  They all
describe the memory type.  When one is used, the other is not.

mem_type currently uses numa parameter to specify the memory backend, while
memory_backend (the two users of such uses "-machine memory-backend=ID").

This patch merges the use of the two variables so that we always generate a
memory object string and put it into "memory_backend" variable.  Now we can
drop shmem_opts parameter in the function.

Meanwhile we always use a memory-backend-* no matter which mem type is
used.  This brings mem_type to be aligned with memory_backend usage, then
we stick with this as this is flexible enough.

This paves way that we merge mem_type and memory_backend in MigrateStart.

Reviewed-by: Juraj Marcin <jmarcin@redhat.com>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/r/20251117223908.415965-3-peterx@redhat.com
[peterx: move MEM_TYPE_ANON case upper, per juraj]
Signed-off-by: Peter Xu <peterx@redhat.com>
11 days agotests/migration-test: Introduce MemType
Peter Xu [Mon, 17 Nov 2025 22:39:05 +0000 (17:39 -0500)] 
tests/migration-test: Introduce MemType

Some migration tests need to be run with shmem, the rest by default use
anonymous memory.

Introduce MemType and replace use_shmem with such a enumeration.  This
prepares for a 3rd type of memory to be tested for migration.

Careful readers may also already notice that MigrateStart has another field
called memory_backend, which makes the whole "memory type" definition
convoluted.  That'll be merged into MemType soon in a follow up patch.

When doing this, introduce some migrate_mem_type_*() helpers to do the
work for each memory type.

Reviewed-by: Juraj Marcin <jmarcin@redhat.com>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/r/20251117223908.415965-2-peterx@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
12 days agomigration/postcopy-ram: Improve error reporting after loadvm failure
Markus Armbruster [Sat, 15 Nov 2025 08:35:00 +0000 (09:35 +0100)] 
migration/postcopy-ram: Improve error reporting after loadvm failure

One of two error messages show __func__.  Drop it; it doesn't help
users, and developers can grep for the message.  This also permits
de-duplicating the code to prepend to the error message.

Both error messages show a numeric error code.  I doubt that's
helpful, but I'm leaving it alone.

Use error_append_hint() for explaining that some dirty bitmaps may be
lost.  Polish the prose.

Don't faff around with g_clear_pointer(), it's not worth its keep
here.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/r/20251115083500.2753895-4-armbru@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
12 days agomigration: Use warn_reportf_err() where appropriate
Markus Armbruster [Sat, 15 Nov 2025 08:34:59 +0000 (09:34 +0100)] 
migration: Use warn_reportf_err() where appropriate

Replace

    warn_report("...: %s", ..., error_get_pretty(err));

by

    warn_reportf_err(err, "...: ", ...);

Prior art: commit 5217f1887a8 (error: Use error_reportf_err() where
appropriate).

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/r/20251115083500.2753895-3-armbru@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
12 days agomigration: Plug memory leaks after migrate_set_error()
Markus Armbruster [Sat, 15 Nov 2025 08:34:58 +0000 (09:34 +0100)] 
migration: Plug memory leaks after migrate_set_error()

migrate_set_error(s, err) stores a copy of @err in @s.  The original
@err is not freed.  Most callers free it immediately.  Some callers
free it later, or pass it on.  And some leak it.  Fix those.

Perhaps migrate_set_error(s, err) should take ownership of @err.  The
callers that free it immediately would become simpler, and avoid a
copy and a deallocation.  The others would have to pass
error_copy(err).

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Link: https://lore.kernel.org/r/20251115083500.2753895-2-armbru@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
12 days agomigration: set correct list pointer when removing notifier
Matthew Rosato [Thu, 13 Nov 2025 21:35:45 +0000 (16:35 -0500)] 
migration: set correct list pointer when removing notifier

In migration_remove_notifier(), g_slist_remove() will search for and
potentially remove an entry from the specified list.  The return value
should be used to update the potentially-changed head pointer of the
list that was just searched (migration_state_notifiers[mode]) instead
of the migration blockers list.

Fixes: dc79c7d5e1 ("migration: multi-mode notifier")
Signed-off-by: Matthew Rosato <mjrosato@linux.ibm.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/r/20251113213545.513453-1-mjrosato@linux.ibm.com
Signed-off-by: Peter Xu <peterx@redhat.com>
12 days agomigration: Fix transition to COLO state from precopy
Li Zhijian [Tue, 4 Nov 2025 01:36:06 +0000 (09:36 +0800)] 
migration: Fix transition to COLO state from precopy

Commit 4881411136 ("migration: Always set DEVICE state") set a new DEVICE
state before completed during migration, which broke the original transition
to COLO. The migration flow for precopy has changed to:
active -> pre-switchover -> device -> completed.

This patch updates the transition state to ensure that the Pre-COLO
state corresponds to DEVICE state correctly.

Cc: qemu-stable <qemu-stable@nongnu.org>
Fixes: 4881411136 ("migration: Always set DEVICE state")
Signed-off-by: Li Zhijian <lizhijian@fujitsu.com>
Reviewed-by: Zhang Chen <zhangckid@gmail.com>
Tested-by: Zhang Chen <zhangckid@gmail.com>
Link: https://lore.kernel.org/r/20251104013606.1937764-1-lizhijian@fujitsu.com
Signed-off-by: Peter Xu <peterx@redhat.com>
12 days agoFix the typo of vfio-pci device's enable-migration option
Yanghang Liu [Fri, 21 Nov 2025 09:43:41 +0000 (17:43 +0800)] 
Fix the typo of vfio-pci device's enable-migration option

Signed-off-by: Yanghang Liu <yanghliu@redhat.com>
Reported-by: Mario Casquero <mcasquer@redhat.com>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
12 days agoqmp: Fix a typo for a USO feature
Jack Wang [Tue, 21 Oct 2025 05:33:09 +0000 (07:33 +0200)] 
qmp: Fix a typo for a USO feature

There is a copy & paste error, USO6 should be there.

Fixes: 58f81689789f ("qmp: update virtio feature maps, vhost-user-gpio introspection")
Signed-off-by: Jack Wang <jinpu.wang@ionos.com>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
12 days agoqga: use access(2) to check for command existance instead of questionable stat(2)
Michael Tokarev [Sat, 1 Nov 2025 10:30:24 +0000 (13:30 +0300)] 
qga: use access(2) to check for command existance instead of questionable stat(2)

The code checks existance of a command (halt/poweroff/reboot) by using
stat(2) and immediately checking for S_ISLNK() on the returned stat
struct.  This check will never be true, because stat(2) always follows
symbolic links and hence will either return ENOENT (in case of dangling
symlink) or the properties for the final target file.  It is lstat(2)
which might return information about the symlink itself.  However, even
there, we want to check the final file properties, not the first symlink.

This check - S_ISLNK - is harmful but useless in this case.  However, it
is confusing and it helps the wrong usage of stat(2) to spread, so it is
better to remove it.

Additionally, the code would better to check for the executable bits
of the final file, not check if it's a regular file - it's sort of
dubious to have anything but regular files in /sbin/.

But a POSIX system provides another command which suits the purpose
perfectly: it is access(2).  And it is so simple that it's not
necessary to create a separate function when usin it.

Replace stat(2) with access(X_OK) to check for file existance in
qga/commands-posix.c

Fixes: c5b4afd4d56e "qga: Support guest shutdown of BusyBox-based systems"
Reviewed-by: Rodrigo Dias Correa <r@drigo.nl>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Kostiantyn Kostiuk <kkostiuk@redhat.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
12 days agoMAINTAINERS: update email of zhenwei pi
zhenwei pi [Wed, 28 May 2025 03:31:56 +0000 (11:31 +0800)] 
MAINTAINERS: update email of zhenwei pi

I will leave ByteDance in the next days. Update email to stay reachable.

Signed-off-by: zhenwei pi <pizhenwei@bytedance.com>
Acked-by: Fam Zheng <fam.zheng@bytedance.com>
Signed-off-by: zhenwei pi <pizhenwei@bytedance.com>
Message-ID: <20250528033156.1188531-1-pizhenwei@bytedance.com>
[Rescued from the list archive, I double-checked it's still valid]
Signed-off-by: Markus Armbruster <armbru@redhat.com>
12 days agoMAINTAINERS: s390 maintainer updates
David Hildenbrand (Red Hat) [Thu, 20 Nov 2025 10:46:02 +0000 (11:46 +0100)] 
MAINTAINERS: s390 maintainer updates

Unfortunately, I don't have a lot of capacity lately to take good care of
s390 in QEMU like I used to; and it doesn't look like that situation
will change. So let me convert myself to a reviewer in the s390 areas I
co-maintain.

Fortunately, we still have two other maintainers for "S390 floating
interrupt controller", so no action needed on that front.

For the other sections we get two new maintainers: Hendrik will
maintain "S390 CPU models" and Ilya will co-maintain "S390 TCG CPUs".

Thanks Hendrik and Ilya for stepping up!

Cc: Richard Henderson <richard.henderson@linaro.org>
Cc: Thomas Huth <thuth@redhat.com>
Cc: Christian Borntraeger <borntraeger@linux.ibm.com>
Cc: Ilya Leoshkevich <iii@linux.ibm.com>
Cc: Halil Pasic <pasic@linux.ibm.com>
Cc: Hendrik Brueckner <brueckner@linux.ibm.com>
Cc: Matthew Rosato <mjrosato@linux.ibm.com>
Signed-off-by: David Hildenbrand (Red Hat) <david@kernel.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Acked-by: Christian Borntraeger <borntraeger@linux.ibm.com>
Message-ID: <20251120104602.205718-1-david@kernel.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
12 days agotests/functional/aarch64/test_rme_sbsaref: Silence issues reported by pylint
Thomas Huth [Wed, 19 Nov 2025 08:26:35 +0000 (09:26 +0100)] 
tests/functional/aarch64/test_rme_sbsaref: Silence issues reported by pylint

Drop unused import and use an encoding for open().

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20251119082636.43286-15-thuth@redhat.com>

12 days agotests/functional/aarch64/test_reverse_debug: Fix issues reported by pylint
Thomas Huth [Wed, 19 Nov 2025 08:26:33 +0000 (09:26 +0100)] 
tests/functional/aarch64/test_reverse_debug: Fix issues reported by pylint

Don't use underscores in CamelCase names and drop an unused import.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20251119082636.43286-13-thuth@redhat.com>

12 days agotests/functional/ppc/test_ppe42: Fix style issues reported by pylint
Thomas Huth [Wed, 19 Nov 2025 08:26:31 +0000 (09:26 +0100)] 
tests/functional/ppc/test_ppe42: Fix style issues reported by pylint

Pylint suggests to write some parts of the code in a slightly different
way ... thus rework the code to make the linter happy.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Glenn Miles <milesg@linux.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20251119082636.43286-11-thuth@redhat.com>

12 days agotests/functional/ppc/test_amiga: Fix issues reported by pylint and flake8
Thomas Huth [Wed, 19 Nov 2025 08:26:30 +0000 (09:26 +0100)] 
tests/functional/ppc/test_amiga: Fix issues reported by pylint and flake8

Pylint complains about unused variable "tar_name" and a missing "check"
for subprocess.run(), and flake8 suggest a second empty line after the
class. While we're at it, also remove the unused "timeout" class variable
(that was only necessary for the avocado framework which we don't use
anymore).

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20251119082636.43286-10-thuth@redhat.com>

12 days agotests/functional/x86_64/test_memlock: Silence pylint warnings
Thomas Huth [Wed, 19 Nov 2025 08:26:29 +0000 (09:26 +0100)] 
tests/functional/x86_64/test_memlock: Silence pylint warnings

Pylint complains about a missing "encoding" parameter for the open()
function here, and about a missing return statement in the "except"
block (which cannot happen since skipTest() never returns). Rework
the code a little bit to silence the warnings.

Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20251119082636.43286-9-thuth@redhat.com>

12 days agotests/functional/x86_64/test_reverse_debug: Silence pylint warning
Thomas Huth [Wed, 19 Nov 2025 08:26:28 +0000 (09:26 +0100)] 
tests/functional/x86_64/test_reverse_debug: Silence pylint warning

Pylint does not like the underscores in the class name here, so
rename the class accordingly to make pylint happy here.

Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20251119082636.43286-8-thuth@redhat.com>

12 days agotests/functional/x86_64/test_virtio_gpu: Fix various issues reported by pylint
Thomas Huth [Wed, 19 Nov 2025 08:26:25 +0000 (09:26 +0100)] 
tests/functional/x86_64/test_virtio_gpu: Fix various issues reported by pylint

Use the recommended order for import statements, specify the kind of
exceptions that we try to catch, use f-strings where it makes sense,
rewrite the vug_log_file part with a proper "with" statement and
fix some FIXMEs by checking for the availability of the devices, etc.

Message-Id: <20251113114015.490303-1-thuth@redhat.com>
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20251119082636.43286-5-thuth@redhat.com>

12 days agotests/functional/arm/test_aspeed_ast2600_buildroot: Fix pylint warnings
Thomas Huth [Wed, 19 Nov 2025 08:26:24 +0000 (09:26 +0100)] 
tests/functional/arm/test_aspeed_ast2600_buildroot: Fix pylint warnings

Pylint recommends to use a "with" context for tempfile.TemporaryDirectory()
to make sure that the directory is deleted once it is not needed anymore,
and it recommends to use the "check" parameter for subprocess.run().
For style reasons, the imports at the beginning of the file should be
grouped by module.

Message-Id: <20251113100601.476900-1-thuth@redhat.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20251119082636.43286-4-thuth@redhat.com>

12 days agohw/s390x: Fix a possible crash with passed-through virtio devices
Thomas Huth [Tue, 18 Nov 2025 17:40:47 +0000 (18:40 +0100)] 
hw/s390x: Fix a possible crash with passed-through virtio devices

Consider the following nested setup: An L1 host uses some virtio device
(e.g. virtio-keyboard) for the L2 guest, and this L2 guest passes this
device through to the L3 guest. Since the L3 guest sees a virtio device,
it might send virtio notifications to the QEMU in L2 for that device.
But since the QEMU in L2 defined this device as vfio-ccw, the function
handle_virtio_ccw_notify() cannot handle this and crashes: It calls
virtio_ccw_get_vdev() that casts sch->driver_data into a VirtioCcwDevice,
but since "sch" belongs to a vfio-ccw device, that driver_data rather
points to a CcwDevice instead. So as soon as QEMU tries to use some
VirtioCcwDevice specific data from that device, we've lost.

We must not take virtio notifications for such devices. Thus fix the
issue by adding a check to the handle_virtio_ccw_notify() handler to
refuse all devices that are not our own virtio devices. Like in the
other branches that detect wrong settings, we return -EINVAL from the
function, which will later be placed in GPR2 to inform the guest about
the error.

Reviewed-by: Halil Pasic <pasic@linux.ibm.com>
Reviewed-by: Eric Farman <farman@linux.ibm.com>
Tested-by: Eric Farman <farman@linux.ibm.com>
Reviewed-by: Cornelia Huck <cohuck@redhat.com>
Acked-by: Christian Borntraeger <borntraeger@linux.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20251118174047.73103-1-thuth@redhat.com>

13 days agoMerge tag 'for-upstream' of https://gitlab.com/bonzini/qemu into staging
Richard Henderson [Thu, 20 Nov 2025 07:12:59 +0000 (08:12 +0100)] 
Merge tag 'for-upstream' of https://gitlab.com/bonzini/qemu into staging

* i386 fixes
* mtest2make cleanups to enable per-speed dependencies
* record/replay tracepoints

# -----BEGIN PGP SIGNATURE-----
#
# iQFIBAABCgAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAmkdftoUHHBib256aW5p
# QHJlZGhhdC5jb20ACgkQv/vSX3jHroOv9Af/foJ7LXUHok8xnPrvKYEIkkVmJFpM
# dt7NzLRoyVHh/zOd/MOfOJCw2+/RLGxA7o1Mm+10DCM6+hcs9VeqeIGSElIP0Uvk
# NGau6/3l/pkE+oyDcziNf1zsgexQ5s258GknlF+QOddcDC1qmpud8Szw/7wHrqcN
# QzxtcYcrbf8USFuekd+5z8GgzMC9CGn6f2Qr5eG40raLB4l+ZKNHIGyR7J0WtxHT
# DcdSDmpHn5qyvAVg3NTkxgzlOnDYNpfnXzXNQ6B+QHb16d6ys4sdMwgxm0aAlzhO
# voLmj5rY1CfQD6EqZmq3sqKwVYLtyHAHtzu4MoAiRGW/7Lhg6QWNiCceGw==
# =b3oh
# -----END PGP SIGNATURE-----
# gpg: Signature made Wed 19 Nov 2025 09:24:58 AM CET
# gpg:                using RSA key F13338574B662389866C7682BFFBD25F78C7AE83
# gpg:                issuer "pbonzini@redhat.com"
# gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" [unknown]
# gpg:                 aka "Paolo Bonzini <pbonzini@redhat.com>" [unknown]
# gpg: WARNING: The key's User ID is not certified with a trusted signature!
# gpg:          There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4  E2F7 7E15 100C CD36 69B1
#      Subkey fingerprint: F133 3857 4B66 2389 866C  7682 BFFB D25F 78C7 AE83

* tag 'for-upstream' of https://gitlab.com/bonzini/qemu:
  replay: add tracing events
  mtest2make: do not repeat the same speed over and over
  mtest2make: add dependencies to the "speed-qualified" suite
  mtest2make: cleanup mtest-suites variables
  target/i386: fix stack size when delivering real mode interrupts
  target/i386: svm: fix sign extension of exit code
  target/i386/tcg: validate segment registers
  target/i386: Mark VPERMILPS as not valid with prefix 0
  target/i386: emulate: Make sure fetch_instruction exist before calling it
  ioapic: fix typo in irqfd check

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2 weeks agoUpdate version for v10.2.0-rc1 release v10.2.0-rc1
Richard Henderson [Wed, 19 Nov 2025 11:48:47 +0000 (12:48 +0100)] 
Update version for v10.2.0-rc1 release

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2 weeks agopython/qapi: delint import statements
John Snow [Tue, 18 Nov 2025 20:06:57 +0000 (15:06 -0500)] 
python/qapi: delint import statements

Missed a spot with isort, which now causes the python-minreqs test on
GitLab to fail. Fix it.

(Hint: the commands in python/tests/qapi-isort.sh can be run without the
"-c" parameter to automatically adjust import statements according to
our style rules. Maybe I should make a pre-submit hook that makes this
adjustment automatically. What do you think?)

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3200
Fixes: 5bd89761a4b ("qapi/command: Avoid generating unused qmp_marshal_output_T")
Signed-off-by: John Snow <jsnow@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20251118200657.1043688-4-jsnow@redhat.com>

2 weeks agopython/qapi: add an ignore for Pylint 4.x
John Snow [Tue, 18 Nov 2025 20:06:56 +0000 (15:06 -0500)] 
python/qapi: add an ignore for Pylint 4.x

Pylint 4.x wants to use a different regex for _Stub for some reason;
just silence this.

Signed-off-by: John Snow <jsnow@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20251118200657.1043688-3-jsnow@redhat.com>

2 weeks agopython/mkvenv: ensure HAVE_LIB variables are actually constants
John Snow [Tue, 18 Nov 2025 20:06:55 +0000 (15:06 -0500)] 
python/mkvenv: ensure HAVE_LIB variables are actually constants

Pylint 4.x has refined checking for variable names that behave as
constants vs ones that do not; unfortunately our tricky import machinery
is perceived as these variables being re-assigned.

Add a temporary variable with an underscore and assign to the global
constants precisely once to alleviate this new nag message. Add an
ignore for this name for older versions of pylint that developers may
have installed locally.

(In other words: there is no solution that will cater to both pre- and
post- 4.x versions, so we target 4.x here and silence older versions.)

Signed-off-by: John Snow <jsnow@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20251118200657.1043688-2-jsnow@redhat.com>

2 weeks agoreplay: add tracing events
Paolo Bonzini [Tue, 18 Nov 2025 13:53:32 +0000 (14:53 +0100)] 
replay: add tracing events

The replay subsystem does not provide any way to see what's going on
and how the replay events interleave with other things happening in QEMU.

Add trace events to improve debuggability; to avoid having too many
events reimplement all functions in terms of (non-traced) replay_getc
and replay_putc and add a single trace event for each datum that is
extracted or written.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2 weeks agomtest2make: do not repeat the same speed over and over
Paolo Bonzini [Mon, 17 Nov 2025 23:26:28 +0000 (00:26 +0100)] 
mtest2make: do not repeat the same speed over and over

There are just two of them (slow and thorough; quick is simply the
default).  Avoid repeating them for as many times as there are tests.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2 weeks agomtest2make: add dependencies to the "speed-qualified" suite
Paolo Bonzini [Mon, 17 Nov 2025 15:51:17 +0000 (16:51 +0100)] 
mtest2make: add dependencies to the "speed-qualified" suite

Thorough tests may have more dependencies than faster ones.
Dependencies are now looked up based on the suites being
executed, not on the suites passed as goals to the makefile.
Therefore, it is possible to limit dependencies to the
speeds that need them.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2 weeks agomtest2make: cleanup mtest-suites variables
Paolo Bonzini [Mon, 17 Nov 2025 15:48:09 +0000 (16:48 +0100)] 
mtest2make: cleanup mtest-suites variables

Remove the "--suite" argument from the .*.mtest-suites variables, and
add it only when actually computing the arguments to "meson test".
This makes it possible to set ninja-cmd-goals from the set of suites,
instead of doing it via many different .ninja-goals.* variables.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2 weeks agoMerge tag 'hw-misc-20251118' of https://github.com/philmd/qemu into staging
Richard Henderson [Wed, 19 Nov 2025 06:38:43 +0000 (07:38 +0100)] 
Merge tag 'hw-misc-20251118' of https://github.com/philmd/qemu into staging

Misc HW patches

- Re-enable xenpvh machine in qemu-system-arm/aarch64 binaries
- Correct Xilinx Zynq DMA Devcfg registers range size
- Correct ACCEL_KERNEL_GSI_IRQFD_POSSIBLE typo
- Allow for multiple CHR_EVENT_CLOSED events in QTest framework
- Fix ACMD41 state machine for SD cards in SPI mode
- Avoid confusing address calculation around eMMC RPMB HMAC
- Fix a pair of build failures on Solaris (guest-agent and RDMA migration)
- Correct QOM parent of LASI south bridge
- Clarify MIPS / PPC 32-bit hosts removal in documentation
- Prevent further uses of DEVICE_NATIVE_ENDIAN definition
- Fix Error uses in eBPF
- Update David Hildenbrand's email address

# -----BEGIN PGP SIGNATURE-----
#
# iQIzBAABCAAdFiEE+qvnXhKRciHc/Wuy4+MsLN6twN4FAmkcwjAACgkQ4+MsLN6t
# wN7Wxg//UMbpEgp92clPcGUX1RFHViEYu5DDM96nwjLpOR8nNAJvLZ5+qxDfyZRQ
# qfVGaE0cm5a/rXRMgFAzeJw5ptcSwLJXsUvnRuNLEpKlIAfqInqqk+JTi/r7hJSq
# W8m07IrdtADwoas0OYKur0XwF+k1hqVOENQWPxiLiyViEH2tR8MFA+nrqQhZzgwo
# Emu3ICc01wX+hhY2R51mf+GdVcmr8RACc07lmG7MnMtvQW8vzCkA/VJ5jWWQv6Xj
# ADKBTciYEK/PKD5vbbwMadZfxaWRiH1l+unfpw0qXC46YOAMvpe3+0mRqk7VeSRc
# anqdXQk9dbqw7qwJ+L+RVdUjNf1bLc9LxOePeMOgsNzd8wxlsBia9PDNxvVTRFmh
# /JxLYO9bM4vRojaGOCFoppoF++JSdZzI6WM56hY465L3VCx36V1p2YESX8x/5F1B
# +w/JPV0dUGeq+MFUNKg/pBy9dgRYIGJfcbcp2jwMxyEB5d0np53zXbMaZmqX/cEO
# AjE/haqtpu/yAqSK7oklx1gJEI9gRE0cJp2B/7l/3RwW3fcMsN3HJB3GH8f+3vg2
# VQMYDrAWBF5wA/5HQtsGNrfImlYGHa535KnLujTcNLVwS+2gZ6N6FwfwhM2fwXQh
# +X7nQZbBsAVa0jDqck8zkIarVuISocC10DWfuP5k4hlKxeyg71M=
# =K5DF
# -----END PGP SIGNATURE-----
# gpg: Signature made Tue 18 Nov 2025 08:00:00 PM CET
# gpg:                using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE
# gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <f4bug@amsat.org>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg:          There is no indication that the signature belongs to the owner.
# Primary key fingerprint: FAAB E75E 1291 7221 DCFD  6BB2 E3E3 2C2C DEAD C0DE

* tag 'hw-misc-20251118' of https://github.com/philmd/qemu:
  ebpf: Make ebpf_rss_load() return value consistent with @errp
  ebpf: Clean up useless error check in ebpf_rss_set_all()
  ebpf: Fix stubs to set an error when they return failure
  scripts/checkpatch: Check DEVICE_NATIVE_ENDIAN
  docs: Mention 32-bit PPC host as removed
  docs: Correct release of MIPS deprecations / removals
  migration/rdma: Check ntohll() availability with meson
  buildsys: Remove dead 'mips' entry in supported_cpus[] array
  hw/southbridge/lasi: Correct LasiState parent
  qga/commands: Include proper Solaris header for getloadavg()
  hw/sd/sdcard: Avoid confusing address calculation in rpmb_calc_hmac
  hw/arm: Re-enable xenpvh machine in qemu-system-arm/aarch64 binaries
  hw/dma/zynq-devcfg: Fix register memory
  hw/sd: Fix ACMD41 state machine in SPI mode
  hw/sd: Fix incorrect idle state reporting in R1 response for SPI mode
  system/qtest.c: Allow for multiple CHR_EVENT_CLOSED events
  hw/intc/ioapic: Fix ACCEL_KERNEL_GSI_IRQFD_POSSIBLE typo
  MAINTAINERS: Update David Hildenbrand's email address

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2 weeks agoMerge tag 'for-upstream' of https://repo.or.cz/qemu/kevin into staging
Richard Henderson [Wed, 19 Nov 2025 06:38:13 +0000 (07:38 +0100)] 
Merge tag 'for-upstream' of https://repo.or.cz/qemu/kevin into staging

Block layer patches

- Multi-threading fixes in several block drivers

# -----BEGIN PGP SIGNATURE-----
#
# iQJFBAABCgAvFiEE3D3rFZqa+V09dFb+fwmycsiPL9YFAmkcpowRHGt3b2xmQHJl
# ZGhhdC5jb20ACgkQfwmycsiPL9bnrA/9HpvuLovahyZH+zke9FAzE9EcZ8eLgT4t
# JM5ijkrfZ8KoyvW9zmUiT/T/BhewFY4if6FqIUvQoCVIQAN+Y3Z8Us/WcZpb3xG7
# EMUr/CeiRl7Ka0SGbxZWR6H10Enuq4hoesfkRPXGV33CKuef09HvgE0184aazZLs
# bfeBn562zUcYzn/HqNFcPqLh6goeHWhsnQuxfJJeu7i05HofeM/3T7WUcCmxhn3V
# 4Pk6o0toYONuZpfUZityieEI54ID95gVmllaE8QT5f0rBXHp6ae5P6x+fnqbj306
# DA5RKBxM5nJ5Md2mo2tJtJ0eUNzbxXpAnT+wMkcDO4OQq8F6KngOTokPPKv13z1f
# uUSwZW5QXV8pvU6AZouUlPStz0MFtfXSVqLZaV51BB7MrIGF79ina9vwMYoteTNJ
# CGi32Ca0dl3PjLm//avmZiHYAeczpK34nPImRLZnhh78zQal/yDpdpi5No/tm4Yf
# /0OAES0legGC3hTsuDh9sXqkmRn3qNvUd40IuDRyvrNYxMUuF+2IQymD5Hcm/6CO
# uIf+/61OPHLHwKFYHyyK44XmcYQHCE0LxilmWVrNaULs4a3nvlRz3GTZ09R/ebAl
# ddtedo9eHN6KfViTa95YWuu53iXzQRPUp3CrSC1gPB04zphpYsCy7eJ/t3kJqCpP
# 9CVf3PMOmZA=
# =FNy0
# -----END PGP SIGNATURE-----
# gpg: Signature made Tue 18 Nov 2025 06:02:04 PM CET
# gpg:                using RSA key DC3DEB159A9AF95D3D7456FE7F09B272C88F2FD6
# gpg:                issuer "kwolf@redhat.com"
# gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>" [unknown]
# gpg: WARNING: The key's User ID is not certified with a trusted signature!
# gpg:          There is no indication that the signature belongs to the owner.
# Primary key fingerprint: DC3D EB15 9A9A F95D 3D74  56FE 7F09 B272 C88F 2FD6

* tag 'for-upstream' of https://repo.or.cz/qemu/kevin:
  win32-aio: Run CB in original context
  null-aio: Run CB in original AioContext
  iscsi: Create AIO BH in original AioContext
  block: Note in which AioContext AIO CBs are called
  blkreplay: Run BH in coroutine’s AioContext
  ssh: Run restart_coroutine in current AioContext
  qcow2: Schedule cache-clean-timer in realtime
  qcow2: Fix cache_clean_timer
  qcow2: Re-initialize lock in invalidate_cache
  block/io: Take reqs_lock for tracked_requests
  nvme: Note in which AioContext some functions run
  nvme: Fix coroutine waking
  nvme: Kick and check completions in BDS context
  gluster: Do not move coroutine into BDS context
  curl: Fix coroutine waking
  nfs: Run co BH CB in the coroutine’s AioContext
  iscsi: Run co BH CB in the coroutine’s AioContext
  rbd: Run co BH CB in the coroutine’s AioContext
  block: Note on aio_co_wake use if not yet yielding

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2 weeks agoebpf: Make ebpf_rss_load() return value consistent with @errp
Markus Armbruster [Tue, 18 Nov 2025 15:47:18 +0000 (16:47 +0100)] 
ebpf: Make ebpf_rss_load() return value consistent with @errp

ebpf_rss_load() returns false for failure without setting an Error
when its @ctx argument already has an eBPF program loaded.  This is
wrong.  Fortunately, it is only called @ctx has a program.  Replace
the incorrect error check by an assertion.

The return value is now obviously reliable.  Change the caller to use
it, because it's more concise.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251118154718.3969982-4-armbru@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2 weeks agoebpf: Clean up useless error check in ebpf_rss_set_all()
Markus Armbruster [Tue, 18 Nov 2025 15:47:17 +0000 (16:47 +0100)] 
ebpf: Clean up useless error check in ebpf_rss_set_all()

ebpf_rss_set_all() is only called when the context has an eBPF program
loaded.  Replace the dead error check with an assertion.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251118154718.3969982-3-armbru@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2 weeks agoebpf: Fix stubs to set an error when they return failure
Markus Armbruster [Tue, 18 Nov 2025 15:47:16 +0000 (16:47 +0100)] 
ebpf: Fix stubs to set an error when they return failure

Stubs in ebpf_rss-stub.c return false for failure without setting an
Error.  This is wrong.  Callers may assume that the functions set an
error when they fail, and crash when they try to examine or report the
error.  Callers may also check the error instead of the return value,
and misinterpret the failure as success.

ebpf_rss_load() and ebpf_rss_load() are reachable via
virtio_net_load_ebpf().  Fix them to set an error.

ebpf_rss_set_all() is unreachable: it can only be called when the
context has an eBPF program loaded, which is impossible with eBPF
support compiled out.  Call abort() there to make that clear, and to
get rid of the latent bug.

Fixes: 00b69f1d867d (ebpf: add formal error reporting to all APIs)
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251118154718.3969982-2-armbru@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2 weeks agoscripts/checkpatch: Check DEVICE_NATIVE_ENDIAN
Djordje Todorovic [Tue, 18 Nov 2025 08:58:11 +0000 (08:58 +0000)] 
scripts/checkpatch: Check DEVICE_NATIVE_ENDIAN

Developers should specify endianess explicitly.

Signed-off-by: Djordje Todorovic <djordje.todorovic@htecgroup.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251118085758.3996513-15-djordje.todorovic@htecgroup.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2 weeks agodocs: Mention 32-bit PPC host as removed
Philippe Mathieu-Daudé [Mon, 17 Nov 2025 15:34:34 +0000 (16:34 +0100)] 
docs: Mention 32-bit PPC host as removed

We removed support for 32-bit PPC hosts in commit 5c1ec5a1ee0
("tcg/ppc: Remove support for 32-bit hosts").

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Acked-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20251117171236.80472-3-philmd@linaro.org>

2 weeks agodocs: Correct release of MIPS deprecations / removals
Philippe Mathieu-Daudé [Mon, 17 Nov 2025 15:59:35 +0000 (16:59 +0100)] 
docs: Correct release of MIPS deprecations / removals

We are going to release 10.2, not 11.0 :)

Reported-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20251117171236.80472-2-philmd@linaro.org>

2 weeks agomigration/rdma: Check ntohll() availability with meson
Philippe Mathieu-Daudé [Mon, 17 Nov 2025 17:25:38 +0000 (18:25 +0100)] 
migration/rdma: Check ntohll() availability with meson

Commit 44ce1b5d2fc ("migration/rdma: define htonll/ntohll
only if not predefined") tried to only include htonll/ntohll
replacements when their symbol is *defined*, but this doesn't
work, as they aren't:

  ../migration/rdma.c:242:17: error: static declaration of 'htonll' follows non-static declaration
    242 | static uint64_t htonll(uint64_t v)
        |                 ^~~~~~
  In file included from /usr/include/netinet/in.h:73,
                   from /usr/include/sys/socket.h:32,
                   from /home/f4bug/qemu/include/system/os-posix.h:30,
                   from /home/f4bug/qemu/include/qemu/osdep.h:176,
                   from ../migration/rdma.c:17:
  /usr/include/sys/byteorder.h:75:18: note: previous declaration of 'htonll' with type 'uint64_t(uint64_t)' {aka 'long unsigned int(long unsigned int)'}
     75 | extern  uint64_t htonll(uint64_t);
        |                  ^~~~~~
  ../migration/rdma.c:252:17: error: static declaration of 'ntohll' follows non-static declaration
    252 | static uint64_t ntohll(uint64_t v)
        |                 ^~~~~~
  /usr/include/sys/byteorder.h:76:18: note: previous declaration of 'ntohll' with type 'uint64_t(uint64_t)' {aka 'long unsigned int(long unsigned int)'}
     76 | extern  uint64_t ntohll(uint64_t);
        |                  ^~~~~~

Better to check the symbol availability with meson.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Acked-by: Peter Xu <peterx@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20251117203834.83713-3-philmd@linaro.org>

2 weeks agobuildsys: Remove dead 'mips' entry in supported_cpus[] array
Philippe Mathieu-Daudé [Mon, 17 Nov 2025 10:05:56 +0000 (11:05 +0100)] 
buildsys: Remove dead 'mips' entry in supported_cpus[] array

Remove 'mips' from supported_cpus[], forgotten in commit
269ffaabc84 ("buildsys: Remove support for 32-bit MIPS hosts").

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-Id: <20251117114200.60917-1-philmd@linaro.org>

2 weeks agohw/southbridge/lasi: Correct LasiState parent
Philippe Mathieu-Daudé [Sun, 16 Nov 2025 22:56:54 +0000 (23:56 +0100)] 
hw/southbridge/lasi: Correct LasiState parent

TYPE_LASI_CHIP inherits from TYPE_SYS_BUS_DEVICE, not
TYPE_PCI_HOST_BRIDGE, so its parent structure is of
SysBusDevice type.

Cc: qemu-stable@nongnu.org
Fixes: 376b851909d ("hppa: Add support for LASI chip with i82596 NIC")
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Gustavo Romero <gustavo.romero@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-Id: <20251117091804.56529-1-philmd@linaro.org>

2 weeks agoqga/commands: Include proper Solaris header for getloadavg()
Philippe Mathieu-Daudé [Mon, 17 Nov 2025 17:20:19 +0000 (18:20 +0100)] 
qga/commands: Include proper Solaris header for getloadavg()

Solaris declares getloadavg() in <sys/loadavg.h>:

    getloadavg(3C)       Standard C Library Functions       getloadavg(3C)

    NAME
           getloadavg - get system load averages

    SYNOPSIS
           #include <sys/loadavg.h>

           int getloadavg(double loadavg[], int nelem);

    [...]

    Oracle Solaris 11.4           23 Jul 2020               getloadavg(3C)

Include it in order to avoid:

  ../qga/commands-posix.c: In function 'qmp_guest_get_load':
  ../qga/commands-posix.c:1408:9: error: implicit declaration of function 'getloadavg' [-Wimplicit-function-declaration]
   1408 |     if (getloadavg(loadavg, G_N_ELEMENTS(loadavg)) < 0) {
      |         ^~~~~~~~~~
  ../qga/commands-posix.c:1408:9: warning: nested extern declaration of 'getloadavg' [-Wnested-externs]

../configure relevant output:

  C compiler for the host machine: gcc (gcc 14.2.0 "gcc (GCC) 14.2.0")
  C linker for the host machine: gcc ld.solaris 5.11-1.3315

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Kostiantyn Kostiuk <kkostiuk@redhat.com>
Acked-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20251117203834.83713-2-philmd@linaro.org>

2 weeks agohw/sd/sdcard: Avoid confusing address calculation in rpmb_calc_hmac
Jan Kiszka [Fri, 14 Nov 2025 21:27:35 +0000 (22:27 +0100)] 
hw/sd/sdcard: Avoid confusing address calculation in rpmb_calc_hmac

From the source frame, we initially need to copy out all fields after
data, thus starting from nonce on. Avoid expressing this indirectly by
pointing to the end of the data field - which also raised the attention
of Coverity (out-of-bound read /wrt data).

Resolves: CID 1642869
Reported-by: GuoHan Zhao <zhaoguohan@kylinos.cn>
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <4f7e1952-ecbd-4484-b128-9d02de3a7935@siemens.com>
[PMD: Add comment before the memcpy() call]
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2 weeks agohw/arm: Re-enable xenpvh machine in qemu-system-arm/aarch64 binaries
Philippe Mathieu-Daudé [Wed, 12 Nov 2025 08:35:19 +0000 (09:35 +0100)] 
hw/arm: Re-enable xenpvh machine in qemu-system-arm/aarch64 binaries

While registering the ARM/Aarch64 machine interfaces
in commit 38c5ab40031 ("hw/arm: Filter machine types
for qemu-system-arm/aarch64 binaries"), we missed the
XenPV machine. Correct that.

Reported-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Message-Id: <20251117091253.56009-1-philmd@linaro.org>

2 weeks agohw/dma/zynq-devcfg: Fix register memory
Yannick Voßen [Tue, 11 Nov 2025 10:28:29 +0000 (11:28 +0100)] 
hw/dma/zynq-devcfg: Fix register memory

Registers are always 32 bit aligned. R_MAX is not the maximum
register address, it is the maximum register number. The memory
size can be determined by 4 * R_MAX.

Currently every register with an offset bigger than 0x40 will be
ignored, because the memory size is set wrong. This effects the
MCTRL register and makes it useless. This commit restores the
correct behaviour.

Cc: qemu-stable@nongnu.org
Fixes: 034c2e69023 ("dma: Add Xilinx Zynq devcfg device model")
Signed-off-by: YannickV <Y.Vossen@beckhoff.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251111102836.212535-9-corvin.koehne@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2 weeks agohw/sd: Fix ACMD41 state machine in SPI mode
Bin Meng [Mon, 10 Nov 2025 11:05:07 +0000 (19:05 +0800)] 
hw/sd: Fix ACMD41 state machine in SPI mode

In SPI mode, the ACMD41 argument only defines bit 30 (HCS); all other
bits are reserved. The current implementation incorrectly checks the
voltage window bits even in SPI mode, preventing the state machine
from transitioning to the READY state. As a result, the U-Boot
mmc-spi driver falls into an endless CMD55/ACMD41 loop.

Fixes: 3241a61a ("hw/sd/sdcard: Use complete SEND_OP_COND implementation in SPI mode")
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2945
Reported-by: Tom Rini <trini@konsulko.com>
Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251110110507.1641042-3-bmeng.cn@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2 weeks agohw/sd: Fix incorrect idle state reporting in R1 response for SPI mode
Bin Meng [Mon, 10 Nov 2025 11:05:06 +0000 (19:05 +0800)] 
hw/sd: Fix incorrect idle state reporting in R1 response for SPI mode

Since commit b66f73a0 ("hw/sd: Add SDHC support for SD card SPI-mode"),
the CARD_POWER_UP bit in the OCR register has been set after reset.
Therefore, checking this bit against zero in sd_response_r1_make() to
determine the card’s idle state is incorrect in SPI mode. As a result,
QEMU makes the U-Boot mmc-spi driver believe the card never leaves the
reset state.

Fixes: 1585ab9f ("hw/sd/sdcard: Fill SPI response bits in card code")
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2945
Reported-by: Tom Rini <trini@konsulko.com>
Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251110110507.1641042-2-bmeng.cn@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2 weeks agosystem/qtest.c: Allow for multiple CHR_EVENT_CLOSED events
Peter Maydell [Fri, 7 Nov 2025 17:43:06 +0000 (17:43 +0000)] 
system/qtest.c: Allow for multiple CHR_EVENT_CLOSED events

In the qtest_event() QEMUChrEvent handler, we create a timer
and log OPENED on CHR_EVENT_OPENED, and we destroy the timer and
log CLOSED on CHR_EVENT_CLOSED. However, the chardev subsystem
can send us more than one CHR_EVENT_CLOSED if we're reading from
a file chardev:
 * the first one happens when we read the last data from the file
 * the second one happens when the user hits ^C to exit QEMU
   and the chardev is finalized: char_fd_finalize()

This causes us to call g_timer_elapsed() with a NULL timer
(which glib complains about) and print an extra CLOSED log line
with a zero timestamp:

[I +0.063829] CLOSED
qemu-system-aarch64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed
[I +0.000000] CLOSED

Avoid this by ignoring a CHR_EVENT_CLOSED if we have already
processed one.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Laurent Vivier <lvivier@redhat.com>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Message-ID: <20251107174306.1408139-1-peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2 weeks agohw/intc/ioapic: Fix ACCEL_KERNEL_GSI_IRQFD_POSSIBLE typo
Cédric Le Goater [Thu, 6 Nov 2025 10:51:48 +0000 (11:51 +0100)] 
hw/intc/ioapic: Fix ACCEL_KERNEL_GSI_IRQFD_POSSIBLE typo

Commit 638ac1c78457 introduced a regression in interrupt remapping
when running a VM configured with an intel-iommu device and an
assigned PCI VF. During boot, Linux reports repeated messages :

 [   15.416794] __common_interrupt: 2.37 No irq handler for vector
 [   15.417266] __common_interrupt: 2.37 No irq handler for vector
 [   15.417733] __common_interrupt: 2.37 No irq handler for vector
 [   15.418202] __common_interrupt: 2.37 No irq handler for vector
 [   15.418670] __common_interrupt: 2.37 No irq handler for vector

and may eventually hang.

The issue is caused by the incorrect use of the macro
ACCEL_KERNEL_GSI_IRQFD_POSSIBLE, which should instead be
ACCEL_GSI_IRQFD_POSSIBLE.

Fixes: 638ac1c78457 ("hw/intc: Generalize APIC helper names from kvm_* to accel_*")
Cc: Magnus Kulke <magnuskulke@linux.microsoft.com>
Signed-off-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251106105148.737093-1-clg@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2 weeks agoMAINTAINERS: Update David Hildenbrand's email address
David Hildenbrand (Red Hat) [Mon, 3 Nov 2025 10:39:46 +0000 (11:39 +0100)] 
MAINTAINERS: Update David Hildenbrand's email address

Switch to kernel.org email address as I will be leaving Red Hat. The
old address will remain active until end of January 2026, so performing
the change now should make sure that most mails will reach me.

Signed-off-by: David Hildenbrand <david@redhat.com>
Signed-off-by: David Hildenbrand (Red Hat) <david@kernel.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251103103947.384401-1-david@kernel.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2 weeks agowin32-aio: Run CB in original context
Hanna Czenczek [Mon, 10 Nov 2025 15:48:54 +0000 (16:48 +0100)] 
win32-aio: Run CB in original context

AIO callbacks must be called in the originally calling AioContext,
regardless of the BDS’s “main” AioContext.

Note: I tried to test this (under wine), but failed.  Whenever I tried
to use multiqueue or even just an I/O thread for a virtio-blk (or
virtio-scsi) device, I/O stalled, both with and without this patch.

For what it’s worth, when not using an I/O thread, I/O continued to work
with this patch.

Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
Message-ID: <20251110154854.151484-20-hreitz@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2 weeks agonull-aio: Run CB in original AioContext
Hanna Czenczek [Mon, 10 Nov 2025 15:48:53 +0000 (16:48 +0100)] 
null-aio: Run CB in original AioContext

AIO callbacks must be called in the originally calling AioContext,
regardless of the BDS’s “main” AioContext.

Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
Message-ID: <20251110154854.151484-19-hreitz@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2 weeks agoiscsi: Create AIO BH in original AioContext
Hanna Czenczek [Mon, 10 Nov 2025 15:48:52 +0000 (16:48 +0100)] 
iscsi: Create AIO BH in original AioContext

AIO callbacks must be called in the original request’s AioContext,
regardless of the BDS’s “main” AioContext.

Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
Message-ID: <20251110154854.151484-18-hreitz@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2 weeks agoblock: Note in which AioContext AIO CBs are called
Hanna Czenczek [Mon, 10 Nov 2025 15:48:51 +0000 (16:48 +0100)] 
block: Note in which AioContext AIO CBs are called

This doesn’t seem to be specified anywhere, but is something we probably
want to be clear.  I believe it is reasonable to implicitly assume that
callbacks are run in the current thread (unless explicitly noted
otherwise), so codify that assumption.

Some implementations don’t actually fulfill this contract yet.  The next
patches should rectify that.

Note: I don’t know of any user-visible bugs produced by not running AIO
callbacks in the original context.  AIO functionality is generally
mapped to coroutines through the use of bdrv_co_io_em_complete(), which
can run in any AioContext, and will always wake the yielding coroutine
in its original context.  The only benefit here is that running
bdrv_co_io_em_complete() in the original context will make that
aio_co_wake() most likely a simpler qemu_coroutine_enter() instead of
scheduling the wakeup through AioContext.co_schedule_bh.

Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
Message-ID: <20251110154854.151484-17-hreitz@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2 weeks agoblkreplay: Run BH in coroutine’s AioContext
Hanna Czenczek [Mon, 10 Nov 2025 15:48:50 +0000 (16:48 +0100)] 
blkreplay: Run BH in coroutine’s AioContext

While it does not matter in which AioContext we run aio_co_wake() to
continue an exactly-once-yielding coroutine, making this commit not
strictly necessary, there is also no reason why the BH should run in any
context but the request’s AioContext.

Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
Message-ID: <20251110154854.151484-16-hreitz@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2 weeks agossh: Run restart_coroutine in current AioContext
Hanna Czenczek [Mon, 10 Nov 2025 15:48:49 +0000 (16:48 +0100)] 
ssh: Run restart_coroutine in current AioContext

restart_coroutine() is attached as an FD handler just to wake the
current coroutine after yielding.  It makes most sense to attach it to
the current (request) AioContext instead of the BDS main context.  This
way, the coroutine can be entered directly from the BH instead of having
yet another indirection through AioContext.co_schedule_bh.

Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
Message-ID: <20251110154854.151484-15-hreitz@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2 weeks agoqcow2: Schedule cache-clean-timer in realtime
Hanna Czenczek [Mon, 10 Nov 2025 15:48:48 +0000 (16:48 +0100)] 
qcow2: Schedule cache-clean-timer in realtime

There is no reason why the cache cleaning timer should run in virtual
time, run it in realtime instead.

Suggested-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
Message-ID: <20251110154854.151484-14-hreitz@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2 weeks agoqcow2: Fix cache_clean_timer
Hanna Czenczek [Mon, 10 Nov 2025 15:48:47 +0000 (16:48 +0100)] 
qcow2: Fix cache_clean_timer

The cache-cleaner runs as a timer CB in the BDS AioContext.  With
multiqueue, it can run concurrently to I/O requests, and because it does
not take any lock, this can break concurrent cache accesses, corrupting
the image.  While the chances of this happening are low, it can be
reproduced e.g. by modifying the code to schedule the timer CB every
5 ms (instead of at most once per second) and modifying the last (inner)
while loop of qcow2_cache_clean_unused() like so:

    while (i < c->size && can_clean_entry(c, i)) {
        for (int j = 0; j < 1000 && can_clean_entry(c, i); j++) {
            usleep(100);
        }
        c->entries[i].offset = 0;
        c->entries[i].lru_counter = 0;
        i++;
        to_clean++;
    }

i.e. making it wait on purpose for the point in time where the cache is
in use by something else.

The solution chosen for this in this patch is not the best solution, I
hope, but I admittedly can’t come up with anything strictly better.

We can protect from concurrent cache accesses either by taking the
existing s->lock, or we introduce a new (non-coroutine) mutex
specifically for cache accesses.  I would prefer to avoid the latter so
as not to introduce additional (very slight) overhead.

Using s->lock, which is a coroutine mutex, however means that we need to
take it in a coroutine, so the timer must run in a coroutine.  We can
transform it from the current timer CB style into a coroutine that
sleeps for the set interval.  As a result, however, we can no longer
just deschedule the timer to instantly guarantee it won’t run anymore,
but have to await the coroutine’s exit.

(Note even before this patch there were places that may not have been so
guaranteed after all: Anything calling cache_clean_timer_del() from the
QEMU main AioContext could have been running concurrently to an existing
timer CB invocation.)

Polling to await the timer to actually settle seems very complicated for
something that’s rather a minor problem, but I can’t come up with any
better solution that doesn’t again just overlook potential problems.

(Not Cc-ing qemu-stable, as the issue is quite unlikely to be hit, and
I’m not too fond of this solution.)

Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
Message-ID: <20251110154854.151484-13-hreitz@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2 weeks agoqcow2: Re-initialize lock in invalidate_cache
Hanna Czenczek [Mon, 10 Nov 2025 15:48:46 +0000 (16:48 +0100)] 
qcow2: Re-initialize lock in invalidate_cache

After clearing our state (memset()-ing it to 0), we should
re-initialize objects that need it.  Specifically, that applies to
s->lock, which is originally initialized in qcow2_open().

Given qemu_co_mutex_init() is just a memset() to 0, this is functionally
a no-op, but still seems like the right thing to do.

Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
Message-ID: <20251110154854.151484-12-hreitz@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2 weeks agoblock/io: Take reqs_lock for tracked_requests
Hanna Czenczek [Mon, 10 Nov 2025 15:48:45 +0000 (16:48 +0100)] 
block/io: Take reqs_lock for tracked_requests

bdrv_co_get_self_request() does not take a lock around iterating through
bs->tracked_requests.  With multiqueue, it may thus iterate over a list
that is in the process of being modified, producing an assertion
failure:

../block/file-posix.c:3702: raw_do_pwrite_zeroes: Assertion `req' failed.

[0] abort() at /lib64/libc.so.6
[1] __assert_fail_base.cold() at /lib64/libc.so.6
[2] raw_do_pwrite_zeroes() at ../block/file-posix.c:3702
[3] bdrv_co_do_pwrite_zeroes() at ../block/io.c:1910
[4] bdrv_aligned_pwritev() at ../block/io.c:2109
[5] bdrv_co_do_zero_pwritev() at ../block/io.c:2192
[6] bdrv_co_pwritev_part() at ../block/io.c:2292
[7] bdrv_co_pwritev() at ../block/io.c:2225
[8] handle_alloc_space() at ../block/qcow2.c:2573
[9] qcow2_co_pwritev_task() at ../block/qcow2.c:2625

Fix this by taking reqs_lock.

Cc: qemu-stable@nongnu.org
Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
Message-ID: <20251110154854.151484-11-hreitz@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2 weeks agonvme: Note in which AioContext some functions run
Hanna Czenczek [Mon, 10 Nov 2025 15:48:44 +0000 (16:48 +0100)] 
nvme: Note in which AioContext some functions run

Sprinkle comments throughout block/nvme.c noting for some functions
(where it may not be obvious) that they require a certain AioContext, or
in which AioContext they do happen to run (for callbacks, BHs, event
notifiers).

Suggested-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
Message-ID: <20251110154854.151484-10-hreitz@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2 weeks agonvme: Fix coroutine waking
Hanna Czenczek [Mon, 10 Nov 2025 15:48:43 +0000 (16:48 +0100)] 
nvme: Fix coroutine waking

nvme wakes the request coroutine via qemu_coroutine_enter() from a BH
scheduled in the BDS AioContext.  This may not be the same context as
the one in which the request originally ran, which would be wrong:
- It could mean we enter the coroutine before it yields,
- We would move the coroutine in to a different context.

(Can be reproduced with multiqueue by adding a usleep(100000) before the
`while (data.ret == -EINPROGRESS)` loop.)

To fix that, use aio_co_wake() to run the coroutine in its home context.
Just like in the preceding iscsi and nfs patches, we can drop the
trivial nvme_rw_cb_bh() and use aio_co_wake() directly.

With this, we can remove NVMeCoData.ctx.

Note the check of data->co == NULL to bypass the BH/yield combination in
case nvme_rw_cb() is called from nvme_submit_command(): We probably want
to keep this fast path for performance reasons, but we have to be quite
careful about it:
- We cannot overload .ret for this, but have to use a dedicated
  .skip_yield field.  Otherwise, if nvme_rw_cb() runs in a different
  thread than the coroutine, it may see .ret set and skip the yield,
  while nvme_rw_cb() will still schedule a BH for waking.   Therefore,
  the signal to skip the yield can only be set in nvme_rw_cb() if waking
  too is skipped, which is independent from communicating the return
  value.
- We can only skip the yield if nvme_rw_cb() actually runs in the
  request coroutine.  Otherwise (specifically if they run in different
  AioContexts), the order between this function’s execution and the
  coroutine yielding (or not yielding) is not reliable.
- There is no point to yielding in a loop; there are no spurious wakes,
  so once we yield, we will only be re-entered once the command is done.
  Replace `while` by `if`.

Cc: qemu-stable@nongnu.org
Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
Message-ID: <20251110154854.151484-9-hreitz@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2 weeks agonvme: Kick and check completions in BDS context
Hanna Czenczek [Mon, 10 Nov 2025 15:48:42 +0000 (16:48 +0100)] 
nvme: Kick and check completions in BDS context

nvme_process_completion() must run in the main BDS context, so schedule
a BH for requests that aren’t there.

The context in which we kick does not matter, but let’s just keep kick
and process_completion together for simplicity’s sake.

(For what it’s worth, a quick fio bandwidth test indicates that on my
test hardware, if anything, this may be a bit better than kicking
immediately before scheduling a pure nvme_process_completion() BH.  But
I wouldn’t take more from those results than that it doesn’t really seem
to matter either way.)

Cc: qemu-stable@nongnu.org
Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
Message-ID: <20251110154854.151484-8-hreitz@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2 weeks agogluster: Do not move coroutine into BDS context
Hanna Czenczek [Mon, 10 Nov 2025 15:48:41 +0000 (16:48 +0100)] 
gluster: Do not move coroutine into BDS context

The request coroutine may not run in the BDS AioContext.  We should wake
it in its own context, not move it.

With that, we can remove GlusterAIOCB.aio_context.

Also add a comment why aio_co_schedule() is safe to use in this way.

**Note:** Due to a lack of a gluster set-up, I have not tested this
commit.  It seemed safe enough to send anyway, just maybe not to
qemu-stable.  To be clear, I don’t know of any user-visible bugs that
would arise from the state without this patch; the request coroutine is
moved into the main BDS AioContext, so guest device completion code will
run in a different context than where the request started, which can’t
be good, but I haven’t actually confirmed any bugs (due to not being
able to test it).

Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
Message-ID: <20251110154854.151484-7-hreitz@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2 weeks agocurl: Fix coroutine waking
Hanna Czenczek [Mon, 10 Nov 2025 15:48:40 +0000 (16:48 +0100)] 
curl: Fix coroutine waking

If we wake a coroutine from a different context, we must ensure that it
will yield exactly once (now or later), awaiting that wake.

curl’s current .ret == -EINPROGRESS loop may lead to the coroutine not
yielding if the request finishes before the loop gets run.  To fix it,
we must drop the loop and yield exactly once, if we need to yield.

Finding out that latter part ("if we need to yield") makes it a bit
complicated: Requests may be served from a cache internal to the curl
block driver, or fail before being submitted.  In these cases, we must
not yield.  However, if we find a matching but still ongoing request in
the cache, we will have to await that, i.e. still yield.

To address this, move the yield inside of the respective functions:
- Inside of curl_find_buf() when awaiting ongoing concurrent requests,
- Inside of curl_setup_preadv() when having created a new request.

Rename curl_setup_preadv() to curl_do_preadv() to reflect this.

(Can be reproduced with multiqueue by adding a usleep(100000) before the
`while (acb.ret == -EINPROGRESS)` loop.)

Also, add a comment why aio_co_wake() is safe regardless of whether the
coroutine and curl_multi_check_completion() run in the same context.

Cc: qemu-stable@nongnu.org
Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
Message-ID: <20251110154854.151484-6-hreitz@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2 weeks agonfs: Run co BH CB in the coroutine’s AioContext
Hanna Czenczek [Mon, 10 Nov 2025 15:48:39 +0000 (16:48 +0100)] 
nfs: Run co BH CB in the coroutine’s AioContext

Like in “rbd: Run co BH CB in the coroutine’s AioContext”, drop the
completion flag, yield exactly once, and run the BH in the coroutine’s
AioContext.

(Can be reproduced with multiqueue by adding a usleep(100000) before the
`while (!task.complete)` loops.)

Like in “iscsi: Run co BH CB in the coroutine’s AioContext”, this makes
nfs_co_generic_bh_cb() trivial, so we can drop it in favor of just
calling aio_co_wake() directly.

Cc: qemu-stable@nongnu.org
Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
Message-ID: <20251110154854.151484-5-hreitz@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2 weeks agoiscsi: Run co BH CB in the coroutine’s AioContext
Hanna Czenczek [Mon, 10 Nov 2025 15:48:38 +0000 (16:48 +0100)] 
iscsi: Run co BH CB in the coroutine’s AioContext

For rbd (and others), as described in “rbd: Run co BH CB in the
coroutine’s AioContext”, the pattern of setting a completion flag and
waking a coroutine that yields while the flag is not set can only work
when both run in the same thread.

iscsi has the same pattern, but the details are a bit different:
iscsi_co_generic_cb() can (as far as I understand) only run through
iscsi_service(), not just from a random thread at a random time.
iscsi_service() in turn can only be run after iscsi_set_events() set up
an FD event handler, which is done in iscsi_co_wait_for_task().

As a result, iscsi_co_wait_for_task() will always yield exactly once,
because iscsi_co_generic_cb() can only run after iscsi_set_events(),
after the completion flag has already been checked, and the yielding
coroutine will then be woken only once the completion flag was set to
true.  So as far as I can tell, iscsi has no bug and already works fine.

Still, we don’t need the completion flag because we know we have to
yield exactly once, so we can drop it.  This simplifies the code and
makes it more obvious that the “rbd bug” isn’t present here.

This makes iscsi_co_generic_bh_cb() and iscsi_retry_timer_expired() a
bit boring, so at least the former we can drop and call aio_co_wake()
directly from scsi_co_generic_cb() to the same effect.  As for the
latter, the timer needs a CB, so we can’t drop it (I suppose we could
technically use aio_co_wake directly as the CB, but that would be
nasty), but we can put it into the coroutine’s AioContext to make its
aio_co_wake() a simple wrapper around qemu_coroutine_enter() without a
further BH indirection.

Finally, remove the iTask->co != NULL checks: This field is set by
iscsi_co_init_iscsitask(), which all users of IscsiTask run before even
setting up iscsi_co_generic_cb() as the callback, and it is never set or
cleared elsewhere, so it is impossible to not be set in
iscsi_co_generic_cb().

Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
Message-ID: <20251110154854.151484-4-hreitz@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2 weeks agorbd: Run co BH CB in the coroutine’s AioContext
Hanna Czenczek [Mon, 10 Nov 2025 15:48:37 +0000 (16:48 +0100)] 
rbd: Run co BH CB in the coroutine’s AioContext

qemu_rbd_completion_cb() schedules the request completion code
(qemu_rbd_finish_bh()) to run in the BDS’s AioContext, assuming that
this is the same thread in which qemu_rbd_start_co() runs.

To explain, this is how both latter functions interact:

In qemu_rbd_start_co():

    while (!task.complete)
        qemu_coroutine_yield();

In qemu_rbd_finish_bh():

    task->complete = true;
    aio_co_wake(task->co); // task->co is qemu_rbd_start_co()

For this interaction to work reliably, both must run in the same thread
so that qemu_rbd_finish_bh() can only run once the coroutine yields.
Otherwise, finish_bh() may run before start_co() checks task.complete,
which will result in the latter seeing .complete as true immediately and
skipping the yield altogether, even though finish_bh() still wakes it.

With multiqueue, the BDS’s AioContext is not necessarily the thread
start_co() runs in, and so finish_bh() may be scheduled to run in a
different thread than start_co().  With the right timing, this will
cause the problems described above; waking a non-yielding coroutine is
not good, as can be reproduced by putting e.g. a usleep(100000) above
the while loop in start_co() (and using multiqueue), giving finish_bh()
a much better chance at exiting before start_co() can yield.

So instead of scheduling finish_bh() in the BDS’s AioContext, schedule
finish_bh() in task->co’s AioContext.

In addition, we can get rid of task.complete altogether because we will
get woken exactly once, when the task is indeed complete, no need to
check.

(We could go further and drop the BH, running aio_co_wake() directly in
qemu_rbd_completion_cb() because we are allowed to do that even if the
coroutine isn’t yet yielding and we’re in a different thread – but the
doc comment on qemu_rbd_completion_cb() says to be careful, so I decided
not to go so far here.)

Buglink: https://issues.redhat.com/browse/RHEL-67115
Reported-by: Junyao Zhao <junzhao@redhat.com>
Cc: qemu-stable@nongnu.org
Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
Message-ID: <20251110154854.151484-3-hreitz@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2 weeks agoblock: Note on aio_co_wake use if not yet yielding
Hanna Czenczek [Mon, 10 Nov 2025 15:48:36 +0000 (16:48 +0100)] 
block: Note on aio_co_wake use if not yet yielding

aio_co_wake() is generally safe to call regardless of whether the
coroutine is already yielding or not.  If it is not yet yielding, it
will be scheduled to run when it does yield.

Caveats:
- The caller must be independent of the coroutine (to ensure the
  coroutine must be yielding if both are in the same AioContext), i.e.
  must not be the same coroutine
- The coroutine must yield at some point

Make note of this so callers can reason that their use is safe.

Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
Message-ID: <20251110154854.151484-2-hreitz@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2 weeks agoMerge tag 'pull-10.2-maintainer-171125-2' of https://gitlab.com/stsquad/qemu into...
Richard Henderson [Tue, 18 Nov 2025 08:18:23 +0000 (09:18 +0100)] 
Merge tag 'pull-10.2-maintainer-171125-2' of https://gitlab.com/stsquad/qemu into staging

testing updates for 10.2

  - fix emsdk image for podman
  - update lcitool and clean-up ENV stanzas
  - include coreutils for io tests
  - move a number of assets due to linaro changes
  - add ppc64le custom runner
  - rationalise the gitlab custom runners with templates
  - clean-up the custom runner rules
  - add a scheduled container build

# -----BEGIN PGP SIGNATURE-----
#
# iQEzBAABCgAdFiEEZoWumedRZ7yvyN81+9DbCVqeKkQFAmkbRI0ACgkQ+9DbCVqe
# KkShRgf+Ma6E/m4ovXO/zrOqLx01XdXExbWPdCm+EqNc7OLvKKODFqFPaRtJvDRs
# s6JAiKWONJfXAHRmXGSlq2gHXMIyUlQds5K96tdyyXywKMOiOSTruOLJcOViWSP0
# i4o7AfxcsqKhIsy2/YaaMDHPcS4IR6AvoJCzgZVsEbSupbMYmLFsiOQa7uaauBtm
# BI2P07EN+q3DWFXnmKsYFtdqI0Kvazv5tMqR5y97TRX84yUAWJ7eVWwd2M7oFfRL
# eWmziUTzKGuwEkzGIxM4m3YD1iEmTKGp0B2se+wTFb0aIqWC5af+HdJvbUznasI/
# IAXZcFZbjSbn7yPLxV9x5CfJVdIYDg==
# =AM+R
# -----END PGP SIGNATURE-----
# gpg: Signature made Mon 17 Nov 2025 04:51:41 PM CET
# gpg:                using RSA key 6685AE99E75167BCAFC8DF35FBD0DB095A9E2A44
# gpg: Good signature from "Alex Bennée (Master Work Key) <alex.bennee@linaro.org>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg:          There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 6685 AE99 E751 67BC AFC8  DF35 FBD0 DB09 5A9E 2A44

* tag 'pull-10.2-maintainer-171125-2' of https://gitlab.com/stsquad/qemu:
  gitlab: add a weekly container building job
  gitlab: make the schedule rules a bit more general
  gitlab: make custom runners need QEMU_CI to run
  gitlab: suppress custom runners being triggered by schedule
  gitlab: simplify the ubuntu-24.04-aarch64 rules
  gitlab: use template for ubuntu-24.04-s390x jobs
  gitlab: add initial ppc64le custom-runner test
  tests: move test_virt_gpu to share.linaro.org
  tests: move test_kvm to share.linaro.org
  tests: move test_kvm_xen to share.linaro.org
  tests: move test_netdev_ethtool to share.linaro.org
  tests: move test_virt assets to share.linaro.org
  tests: move test_xen assets to share.linaro.org
  docs/about/emulation: update assets for uftrace plugin documentation
  tests/docker: add coreutils to the package list
  tests/lcitool: update ENV stanzas outputted by refresh
  libvirt-ci: bump libvirt-ci to latest version
  tests/docker: drop --link from COPYs in emsdk docker

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2 weeks agogitlab: add a weekly container building job
Alex Bennée [Mon, 17 Nov 2025 11:55:23 +0000 (11:55 +0000)] 
gitlab: add a weekly container building job

This will hopefully catch containers that break because of upstream
changes as well as keep the container cache fresh.

As we have all the container jobs as dependants we tweaks the
container template to allow scheduled runs. Because we added a new
rules stanza we also need to make sure we catch the normal runs as
well.

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-ID: <20251117115523.3993105-19-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
2 weeks agogitlab: make the schedule rules a bit more general
Alex Bennée [Mon, 17 Nov 2025 11:55:22 +0000 (11:55 +0000)] 
gitlab: make the schedule rules a bit more general

By default no jobs should run under the schedule and then we can be
more explicit for the ones that we need to. Otherwise I trigger all my
custom runners every time I do a scheduled run.

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-ID: <20251117115523.3993105-18-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
2 weeks agogitlab: make custom runners need QEMU_CI to run
Alex Bennée [Mon, 17 Nov 2025 11:55:21 +0000 (11:55 +0000)] 
gitlab: make custom runners need QEMU_CI to run

In addition to not being triggered by schedule we should follow the
same rules about QEMU_CI. One day we may figure out how to fold the
custom runner rules into the .base_job_template but today is not that
day.

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-ID: <20251117115523.3993105-17-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
2 weeks agogitlab: suppress custom runners being triggered by schedule
Alex Bennée [Mon, 17 Nov 2025 11:55:20 +0000 (11:55 +0000)] 
gitlab: suppress custom runners being triggered by schedule

Otherwise the mere presence of the RUNNER env vars is enough to
trigger the jobs.

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-ID: <20251117115523.3993105-16-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>