]> git.ipfire.org Git - thirdparty/qemu.git/log
thirdparty/qemu.git
3 days agomigration/cpr: Avoid crashing QEMU when cpr-exec runs with no args
Peter Xu [Tue, 21 Oct 2025 22:04:07 +0000 (18:04 -0400)] 
migration/cpr: Avoid crashing QEMU when cpr-exec runs with no args

If an user invokes cpr-exec without setting the exec args first, currently
it'll crash QEMU.

Avoid it, instead fail the QMP migrate command.

Reviewed-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/r/20251021220407.2662288-5-peterx@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
3 days agomigration/cpr: Fix UAF in cpr_exec_cb() when execvp() fails
Peter Xu [Tue, 21 Oct 2025 22:04:06 +0000 (18:04 -0400)] 
migration/cpr: Fix UAF in cpr_exec_cb() when execvp() fails

Per reported and analyzed by Peter:

https://lore.kernel.org/r/CAFEAcA82ih8RVCm-u1oxiS0V2K4rV4jMzNb13pAV=e2ivmiDRA@mail.gmail.com

Fix the issue by moving the error_setg_errno() earlier.  When at it, clear
argv variable after freed.

Resolves: Coverity CID 1641397
Fixes: a3eae205c6 ("migration: cpr-exec mode")
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/r/20251021220407.2662288-4-peterx@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
3 days agomigration/cpr: Fix coverity report in cpr_exec_persist_state()
Peter Xu [Tue, 21 Oct 2025 22:04:05 +0000 (18:04 -0400)] 
migration/cpr: Fix coverity report in cpr_exec_persist_state()

Per reported and analyzed by Peter:

https://lore.kernel.org/r/CAFEAcA_mUQ2NeoguR5efrhw7XYGofnriWEA=+Dg+Ocvyam1wAw@mail.gmail.com

mfd leak is a false positive, try to use a coverity annotation (which I
didn't find manual myself, but still give it a shot).

Fix the other one by capture error if setenv() failed.  When at it, pass
the error to the top (cpr_state_save()).  Along the way, changing all
retval to bool when errp is around.

Resolves: Coverity CID 1641391
Resolves: Coverity CID 1641392
Fixes: efc6587313 ("migration: cpr-exec save and load")
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/r/20251021220407.2662288-3-peterx@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
3 days agomigration: Fix error leak in postcopy_ram_listen_thread()
Peter Xu [Tue, 21 Oct 2025 22:04:04 +0000 (18:04 -0400)] 
migration: Fix error leak in postcopy_ram_listen_thread()

As reported and analyzed by Peter:

https://lore.kernel.org/r/CAFEAcA9otBWtR7rPQ0Y9aBm+7ZWJzd4VWpXrAmGr8XspPn+zpw@mail.gmail.com

Fix it by freeing the error.  When at it, always reset the local_err
pointer in both paths.

Cc: Arun Menon <armenon@redhat.com>
Resolves: Coverity CID 1641390
Fixes: 94272d9b45 ("migration: Capture error in postcopy_ram_listen_thread()")
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/r/20251021220407.2662288-2-peterx@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
3 days agomigration: Remove unused VMSTATE_UINTTL_EQUAL[_V]() macros
Philippe Mathieu-Daudé [Thu, 16 Oct 2025 16:03:13 +0000 (18:03 +0200)] 
migration: Remove unused VMSTATE_UINTTL_EQUAL[_V]() macros

The last use of VMSTATE_UINTTL_EQUAL() was removed in commit
16a2497bd44 ("target-ppc: Fix CPU migration from qemu-2.6 <->
later versions"), 9 years ago; remove it.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Link: https://lore.kernel.org/r/20251016160313.25751-1-philmd@linaro.org
Signed-off-by: Peter Xu <peterx@redhat.com>
3 days agomigration: mapped-ram: handle zero pages
Marco Cavenati [Fri, 10 Oct 2025 11:59:54 +0000 (13:59 +0200)] 
migration: mapped-ram: handle zero pages

Make mapped-ram compatible with loadvm snapshot restoring by explicitly
zeroing memory pages in this case.
Skip zeroing for -incoming and -loadvm migrations to preserve performance.

Signed-off-by: Marco Cavenati <Marco.Cavenati@eurecom.fr>
Link: https://lore.kernel.org/r/20251010115954.1995298-3-Marco.Cavenati@eurecom.fr
Signed-off-by: Peter Xu <peterx@redhat.com>
3 days agomigration: add FEATURE_SEEKABLE to QIOChannelBlock
Marco Cavenati [Fri, 10 Oct 2025 11:59:53 +0000 (13:59 +0200)] 
migration: add FEATURE_SEEKABLE to QIOChannelBlock

Enable the use of the mapped-ram migration feature with savevm/loadvm
snapshots by adding the QIO_CHANNEL_FEATURE_SEEKABLE feature to
QIOChannelBlock. Implement io_preadv and io_pwritev methods to provide
positioned I/O capabilities that don't modify the channel's position
pointer.

Signed-off-by: Marco Cavenati <Marco.Cavenati@eurecom.fr>
Link: https://lore.kernel.org/r/20251010115954.1995298-2-Marco.Cavenati@eurecom.fr
Signed-off-by: Peter Xu <peterx@redhat.com>
3 days agomigration/ram: fix docs of ram_handle_zero
Marco Cavenati [Wed, 1 Oct 2025 16:18:22 +0000 (18:18 +0200)] 
migration/ram: fix docs of ram_handle_zero

Remove outdated 'ch' parameter from the function documentation.

Signed-off-by: Marco Cavenati <Marco.Cavenati@eurecom.fr>
Reviewed-by: Juraj Marcin <jmarcin@redhat.com>
Link: https://lore.kernel.org/r/20251001161823.2032399-3-Marco.Cavenati@eurecom.fr
Signed-off-by: Peter Xu <peterx@redhat.com>
3 days agoMAINTAINERS: update cpr reviewers
Steve Sistare [Fri, 10 Oct 2025 12:16:40 +0000 (05:16 -0700)] 
MAINTAINERS: update cpr reviewers

Update cpr reviewers.  Some of these files overlap with migration
files, but some do not.

Signed-off-by: Steve Sistare <steven.sistare@oracle.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Link: https://lore.kernel.org/r/1760098600-399192-1-git-send-email-steven.sistare@oracle.com
Signed-off-by: Peter Xu <peterx@redhat.com>
3 days agomigration/savevm: Add a compatibility check for capabilities
Fabiano Rosas [Tue, 7 Oct 2025 18:42:13 +0000 (15:42 -0300)] 
migration/savevm: Add a compatibility check for capabilities

It has always been possible to enable arbitrary migration capabilities
and attempt to take a snapshot of the VM with the savevm/loadvm
commands as well as their QMP counterparts
snapshot-save/snapshot-load.

Most migration capabilities are not meant to be used with snapshots
and there's a risk of crashing QEMU or producing incorrect
behavior. Ideally, every migration capability would either be
implemented for savevm or explicitly rejected.

Add a compatibility check routine and reject the snapshot command if
an incompatible capability is enabled. For now only act on the the two
that actually cause a crash: multifd and mapped-ram.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2881
Signed-off-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/r/20251007184213.5990-1-farosas@suse.de
Signed-off-by: Peter Xu <peterx@redhat.com>
4 days agoMerge tag 'igvm-20251103--pull-request' of https://gitlab.com/kraxel/qemu into staging
Richard Henderson [Mon, 3 Nov 2025 09:21:01 +0000 (10:21 +0100)] 
Merge tag 'igvm-20251103--pull-request' of https://gitlab.com/kraxel/qemu into staging

igvm: improve native mode (non-confidential guest) supportY

# -----BEGIN PGP SIGNATURE-----
#
# iQIzBAABCgAdFiEEoDKM/7k6F6eZAf59TLbY7tPocTgFAmkIas0ACgkQTLbY7tPo
# cTjDMBAAsYpXOwWFHfSrAMbNw8a4hXcUJ6qvm1qMZIANX33jAX9v2rPN7W7PCldk
# Ch6mkouubIUUdSk0i8RIyobm+UwyHag9lHICul1Pv91B/+F1wC353f5YDK7EJsdg
# FBT0SIIz4ZEkRKWbLvF6i6a1SW0jaT2jRxjXV3wUBGCyUal84qKNsv2KQIoeYUk3
# zmH9mBZXKv6nM5hc7VEp2g/G8e18flrCHClohMJdBIiK2hFqFcRcULlT6eVuUVxP
# gzq8lhoZZeWPpxDopq3IKDEA8NQUTYImdLbOfdjncBpcAXX0FNykH9JRmC7X+ObZ
# FtjHzQIW2Ry68SBmNhBm8kj5e4uybd+DqoIcrGa8TJBlfrl/Zkc63PXaWWs3BnnN
# eTYKamV9YR03yD9fTt3RnGwisZloSeRBn06grcdq7Lynwnap7S6PJMaDlOOGeopn
# Ocdj7w6LS05ocl3d+kRmor+z8L8AQ12drjaOqX8n9XcbUw7+RmrNyw66lGkMBhfM
# BSdFi2cpAdtz4rYxf60rkk10cWaPlO65MhTFkWDbdv5f+LFVeRwKJt61U1RLcSRM
# hbwJXRCspVSALjQ5gtEIhQjojxXEkiCkO3ap+sILb/nXh92y+QQ7DzX4vOFQ879e
# r9dCEGO+hyIea0+6Gy10cfrUyNKbqm501k61DP4ij2YwvxFAx9M=
# =g/cv
# -----END PGP SIGNATURE-----
# gpg: Signature made Mon 03 Nov 2025 09:41:49 AM CET
# gpg:                using RSA key A0328CFFB93A17A79901FE7D4CB6D8EED3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" [unknown]
# gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>" [unknown]
# gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg:          There is no indication that the signature belongs to the owner.
# Primary key fingerprint: A032 8CFF B93A 17A7 9901  FE7D 4CB6 D8EE D3E8 7138

* tag 'igvm-20251103--pull-request' of https://gitlab.com/kraxel/qemu:
  igvm: add MAINTAINERS entry
  igvm: add support for initial register state load in native mode
  igvm: add support for igvm memory map parameter in native mode
  igvm: fix off by one bug in memmap entry count checking
  igvm: move igvm.h file to include/system

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
4 days agoigvm: add MAINTAINERS entry
Gerd Hoffmann [Wed, 29 Oct 2025 10:55:55 +0000 (11:55 +0100)] 
igvm: add MAINTAINERS entry

Roy Hopkins (the original author) does not respond, so the new plan
going forward is that I will maintain this together with Stefano.  Also
add Ani as reviewer.

Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Message-ID: <20251029105555.2492276-6-kraxel@redhat.com>

4 days agoigvm: add support for initial register state load in native mode
Gerd Hoffmann [Wed, 29 Oct 2025 10:55:54 +0000 (11:55 +0100)] 
igvm: add support for initial register state load in native mode

Add IgvmNativeVpContextX64 struct holding the register state (see igvm
spec), and the qigvm_x86_load_context() function to load the register
state.

Wire up using two new functions: qigvm_x86_set_vp_context() is called
from igvm file handling code and stores the boot processor context.
qigvm_x86_bsp_reset() is called from i386 target cpu reset code and
loads the context into the cpu registers.

Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Reviewed-by: Luigi Leonardi <leonardi@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Message-ID: <20251029105555.2492276-5-kraxel@redhat.com>

4 days agoigvm: add support for igvm memory map parameter in native mode
Gerd Hoffmann [Wed, 29 Oct 2025 10:55:53 +0000 (11:55 +0100)] 
igvm: add support for igvm memory map parameter in native mode

Add and wire up qigvm_x86_get_mem_map_entry function which converts the
e820 table into an igvm memory map parameter.  This makes igvm files for
the native (non-confidential) platform with memory map parameter work.

Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Reviewed-by: Luigi Leonardi <leonardi@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Message-ID: <20251029105555.2492276-4-kraxel@redhat.com>

4 days agoigvm: fix off by one bug in memmap entry count checking
Gerd Hoffmann [Wed, 29 Oct 2025 10:55:52 +0000 (11:55 +0100)] 
igvm: fix off by one bug in memmap entry count checking

Fixes: c1d466d267 ("backends/igvm: Add IGVM loader and configuration")
Reviewed-by: Luigi Leonardi <leonardi@redhat.com>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Message-ID: <20251029105555.2492276-3-kraxel@redhat.com>

4 days agoigvm: move igvm.h file to include/system
Gerd Hoffmann [Wed, 29 Oct 2025 10:55:51 +0000 (11:55 +0100)] 
igvm: move igvm.h file to include/system

Prepare for arch-specific igvm code being added to the code base.

Reviewed-by: Ani Sinha <anisinha@redhat.com>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Reviewed-by: Luigi Leonardi <leonardi@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Message-ID: <20251029105555.2492276-2-kraxel@redhat.com>

6 days agoMerge tag 'pull-target-arm-20251031' of https://gitlab.com/pm215/qemu into staging
Richard Henderson [Sat, 1 Nov 2025 09:52:48 +0000 (10:52 +0100)] 
Merge tag 'pull-target-arm-20251031' of https://gitlab.com/pm215/qemu into staging

target-arm queue:
 *  hw/gpio/pl061: Declare pullups/pulldowns as 8-bit types
 * docs/system/arm/virt: Document user-creatable SMMUv3
 * docs/system/security: Restrict "virtualization use case" to specific machines
 * target/arm: Add assert to arm_to_core_mmu_idx()
 * hw/arm/virt: remove deprecated virt-4.1 and virt-4.2 machine types
 * hvf: Refactorings and cleanups

# -----BEGIN PGP SIGNATURE-----
#
# iQJNBAABCAA3FiEE4aXFk81BneKOgxXPPCUl7RQ2DN4FAmkFAKcZHHBldGVyLm1h
# eWRlbGxAbGluYXJvLm9yZwAKCRA8JSXtFDYM3oSZD/0ekFlrMRFZCYg7ie9t/Cgz
# 7OBZGjK+WfuKsD9odYesZzxJ+aPMBQHu6l/44cYaqf+NTRM2hI9ZeaV9e4fXPG0e
# fYImjYMLKPHj4UTam42uN0btl3poq+oaVPKqDPovy+9E09NctO4fmTl7Zys6pH/1
# EwznCk1x3+JLW0xPXXEvfTniB1nB+hvKA/n7NS0qe6n2ddenhQzG8DpdnGEGB+75
# whMwhE/UJ5Y8rP6/Nfc8XqzgU6fmEpPsDRHjDCULy/CiGCV6k8/C8J94UTf2SExh
# iiMLySUb2Rv6qIL2nJX2+xup79UB7umxxoIL0eeN1U/M1L7zMB64rlcU/cym2I40
# mAFuW2qzdsADnpRP8d4KTMJQmFxtZuKuxpkapvIFuusiKq5vBwTxfzyLWdM6nPI9
# 7tbKImzLxC1mnOAT0QeZYhLrWMZgQi3tBcS852JAXpiW1eT7SWsl59bKNgCVzI7r
# malptTniE1G+F4VWlghApLympBhNMMaFBfY4XBQ+VxEu+JNhO+MQlJhcLVbqX+oY
# m2OQhPHRv2YUM2VGv40JuzaUE1cXHXNsC7s9hHsB/3UwIp3fXOsdGuq6KviHdcbP
# moQn3M8S/vdFB+1spkhVxS7xgIZJo9f2kaTe9VlpEY7/k5n36BTsxPN6Uae2gIVq
# w4qzOjXFEyeIxLLKQZqyZg==
# =9IV+
# -----END PGP SIGNATURE-----
# gpg: Signature made Fri 31 Oct 2025 07:32:07 PM CET
# gpg:                using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE
# gpg:                issuer "peter.maydell@linaro.org"
# gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [unknown]
# gpg:                 aka "Peter Maydell <pmaydell@gmail.com>" [unknown]
# gpg:                 aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" [unknown]
# gpg:                 aka "Peter Maydell <peter@archaic.org.uk>" [unknown]
# gpg: WARNING: The key's User ID is not certified with a trusted signature!
# gpg:          There is no indication that the signature belongs to the owner.
# Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83  15CF 3C25 25ED 1436 0CDE

* tag 'pull-target-arm-20251031' of https://gitlab.com/pm215/qemu: (38 commits)
  accel/hvf: Trace prefetch abort
  target/arm/hvf/hvf: Document $pc adjustment in HVF & SMC
  target/arm: Share ARM_PSCI_CALL trace event between TCG and HVF
  target/arm: Re-use arm_is_psci_call() in HVF
  target/arm/hvf: Rename 'vgic' -> 'emu_reginfo' in trace events
  target/arm: Rename init_cpreg_list() -> arm_init_cpreg_list()
  accel/hvf: Restrict ARM specific fields of AccelCPUState
  target/arm: Call aarch64_add_pauth_properties() once in host_initfn()
  accel/hvf: Guard hv_vcpu_run() between cpu_exec_start/end() calls
  cpus: Trace cpu_exec_start() and cpu_exec_end() calls
  target/arm/hvf: Keep calling hv_vcpu_run() in loop
  target/arm/hvf: Factor hvf_handle_vmexit() out
  target/i386/hvf: Factor hvf_handle_vmexit() out
  target/arm/hvf: Factor hvf_handle_exception() out
  target/arm/hvf: switch hvf_arm_get_host_cpu_features to not create a vCPU
  target/arm/hvf: Simplify hvf_arm_get_host_cpu_features()
  target/arm/hvf: Hardcode Apple MIDR
  accel/hvf: Implement hvf_arch_vcpu_destroy()
  target/arm/hvf: Mention hvf_inject_interrupts() must run on vCPU thread
  accel/hvf: Mention hvf_arch_update_guest_debug() must run on vCPU
  ...

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
6 days agoMerge tag 'audio-test-pull-request' of https://gitlab.com/marcandre.lureau/qemu into...
Richard Henderson [Sat, 1 Nov 2025 09:51:32 +0000 (10:51 +0100)] 
Merge tag 'audio-test-pull-request' of https://gitlab.com/marcandre.lureau/qemu into staging

Audio clean-ups

# -----BEGIN PGP SIGNATURE-----
#
# iQJQBAABCgA6FiEEh6m9kz+HxgbSdvYt2ujhCXWWnOUFAmkEWqwcHG1hcmNhbmRy
# ZS5sdXJlYXVAcmVkaGF0LmNvbQAKCRDa6OEJdZac5a4RD/49KcP8h/5+QT3nu703
# OL/c/+M0DEZCVikzbj1T+nZNlUZtto/wE1vY0/xxzoyMh/4XbUFI0b/YK8WcQyUx
# ozrWOCi6TquS1QpR62FBmDJ6QDA2KteTF8Zq/owdFj+l7VJ5F5mzcuuFCxLx1EVH
# 7qOIf37Vk4r8jz42CLRTusPGQZLSvS8LbTBP62guauXlVAKVWI8k9macRSqoTBRo
# VrQO3QC/JFSqkB2jGfes8AMU+RWLYPG3ICCf0UYHH/kMik/JEL+1arx7au7oukTb
# 3kp8cxGnuJzBKCvY8SLwQF3YiCotYQIjSkvAQrMYBXalPBjQIIh+vzegcF1D+xZb
# 6KR4kh3oXPHtVCG2AXcxA4IuAi50jYFPn6TgDkRrUAEhsOqOxLo5bmZsqWK7L3/u
# 61jLKSjLRSc+NjhwHN0YVy1ocdsLf2z1LQNHjC1TuxrgI//9fQnOE2gASb8tmJGg
# BlPYp5h6G50IEaACzlZEtudWpKRb/XyflWpHbWte0VUO9dpz/cUvO1P38CpPD1dr
# ohENb8eLn0L23M12tUABV0IoA729phBYh3Eua9uIzEVfuRVfoPCuocx6VxQked91
# SZr7X9G80Nyh5YYiMlrwpN8eDgPtKfW5JwI2wYME6clGLnf/catkqCl/qp4nQeG5
# LPZiFy5Krz+QuSq41DjcSWRD+g==
# =qTgA
# -----END PGP SIGNATURE-----
# gpg: Signature made Fri 31 Oct 2025 07:43:56 AM CET
# gpg:                using RSA key 87A9BD933F87C606D276F62DDAE8E10975969CE5
# gpg:                issuer "marcandre.lureau@redhat.com"
# gpg: Good signature from "Marc-André Lureau <marcandre.lureau@redhat.com>" [unknown]
# gpg:                 aka "Marc-André Lureau <marcandre.lureau@gmail.com>" [unknown]
# gpg: WARNING: The key's User ID is not certified with a trusted signature!
# gpg:          There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 87A9 BD93 3F87 C606 D276  F62D DAE8 E109 7596 9CE5

* tag 'audio-test-pull-request' of https://gitlab.com/marcandre.lureau/qemu: (36 commits)
  audio: deprecate HMP audio commands
  audio: Rename @endianness argument as @big_endian for clarity
  audio: Remove pointless local variables
  audio: drop needless audio_driver "descr" field
  audio: move capture API to own header
  audio: cleanup, use bool for booleans
  audio: remove dependency on spice header
  audio: move audio.h under include/qemu/
  audio/dbus: use a helper function to set the backend dbus server
  audio: remove QEMUSoundCard
  audio: rename AudioState -> AudioBackend
  audio: move internal APIs to audio_int.h
  audio/replay: fix type punning
  audio: introduce AUD_set_volume_{in,out}_lr()
  audio: remove AUDIO_HOST_ENDIANNESS
  audio: remove some needless headers
  audio: initialize card_head during object init
  audio: register and unregister vmstate with AudioState
  audio: keep vmstate handle with AudioState
  audio: drop needless error message
  ...

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
6 days agoMerge tag 'qga-pull-2025-10-30' of https://github.com/kostyanf14/qemu into staging
Richard Henderson [Sat, 1 Nov 2025 08:46:17 +0000 (09:46 +0100)] 
Merge tag 'qga-pull-2025-10-30' of https://github.com/kostyanf14/qemu into staging

qga-pull-2025-10-30

# -----BEGIN PGP SIGNATURE-----
#
# iQIzBAABCgAdFiEEwsLBCepDxjwUI+uE711egWG6hOcFAmkDYhwACgkQ711egWG6
# hOcMLQ//X/xmrP+PMFbEkPVHCYV0OB5CqvWXw01NOUTRfzMr/xoW+Bws9gC3ok8b
# j1OfsQp48l7e347ZzOYTCaU05lKz7uxgniciwV76tqZM0hPF8ftjRFh4Sia4gGDD
# yqAo9utZ9gE3fW2KEDgjjHtzujj7O0jkV2tqwhjkFr74LH99b422HCgM21GUC03W
# hOLXuNkUVZZVR3JSMweVjSUf+/3NX17lU6EBTdZJ9fF7OF4tpQeLIrgQfI03Tkee
# ZXiVbUbpbRC8LUJhA6sfm0+YCK4x5kRhveSk9nJx5qcARLG0V4RS/DEyZatr2R7/
# KsBR7VSKPWwHhS+MbHako0nMbO76UCZ5Tqx+9i0evHe6KIiMq6O8QhENGtrCwpV0
# wcycFqgtmEyMqoqoHIDAIFrOblo9DzgsxE3QchBOl+EDc/zfKNE4nho+KVT9H2J5
# IjcljLkQUSFcw5pcW+QRsg/HL+rgoSrb8FXuUDZKXeD8jnyM/ISHA8EX0CxJWhUi
# FbkHvhWk7S/SarENr2WnQzuAoPa/eFTd3HKOizZNNkhwyOjox349QwudIEpjdusE
# GCiBrEh3q3fSwgy85KaZH5NYTvgCRa9Ol8CAeIDJxiEb3ywpZJTgnOf21m8Lj5J1
# FITBVpZ+z8fu0PUXScHQ3KZmHh3OoDs++sa7iOqghpDYvJVeUM0=
# =OGKA
# -----END PGP SIGNATURE-----
# gpg: Signature made Thu 30 Oct 2025 02:03:24 PM CET
# gpg:                using RSA key C2C2C109EA43C63C1423EB84EF5D5E8161BA84E7
# gpg: Good signature from "Kostiantyn Kostiuk (Upstream PR sign) <kkostiuk@redhat.com>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg:          There is no indication that the signature belongs to the owner.
# Primary key fingerprint: C2C2 C109 EA43 C63C 1423  EB84 EF5D 5E81 61BA 84E7

* tag 'qga-pull-2025-10-30' of https://github.com/kostyanf14/qemu:
  qga: Support guest shutdown of BusyBox-based systems
  qga: Improve Windows filesystem space info retrieval logic
  scripts/qemu-guest-agent/fsfreeze-hook: improve script description

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
6 days agoMerge tag 'pull-ppc-for-10.2-d4-20251030' of https://gitlab.com/harshpb/qemu into...
Richard Henderson [Sat, 1 Nov 2025 08:39:10 +0000 (09:39 +0100)] 
Merge tag 'pull-ppc-for-10.2-d4-20251030' of https://gitlab.com/harshpb/qemu into staging

ppc queue for 10.2

* Firmware updates for SLOF, sam460ex u-boot
* Removal of unusable e200 CPUs
* Coverity fixes for fadump
* Other minor fixes, cleanups for pegasos, spapr.

# -----BEGIN PGP SIGNATURE-----
#
# iQIzBAABCAAdFiEEa4EM1tK+EPOIPSFCRUTplPnWj7sFAmkDH0MACgkQRUTplPnW
# j7tRjQ/+JbtHt8v4liav4EXRMvM0b8ASDQZFtltC8cg/vpgy/CbYgqcltQDKC4+F
# NjBwSR4mKMTLX95LQsdFCLZY6FENKCirjpsCvHDxU9Hw/UdsVA12rFd/+lgytrTe
# yvJzyhUAoUMSFgpYGZSRQVV+eMEMgHBZekR2RLXwEeuLf/TOAdG+giCMM92Xs7bz
# petdqCspKvpw8RHjb2nyIh67RQ3zYVisU9/pczoNRytjQHYgllddXRt1/DOdF/Gi
# zREc7qE3biDg5jYgWScByy6EwBBBPqNbvR1GLjMV2rM77785KD9GsIzKCCzg6YQY
# CSN/fy8V4TXVkJn8nY2s3SHvBz3szNSvx/nL8sCyKXol/5Naha5CLN0ykz5VcrIf
# 9gNwifW22lHbAtvbmRY9yuTrao8RoQwEZ/3o8Te3W/U9iCFLnwCmKWb/3GT6i/kw
# yyJlUBuW5WASf5N+G0N7IB5BAwzoQQtd0WXW1ugXAFG+Bd/nkRvVkIf9sPWUxWJ/
# 0Tx+2rPZOFzju8VYO8188wh/zDLuNRTEdfo+L21GMI2OBBEUO2nIiwPTLIMrCT4e
# ycC7Vvyu3IahX9ojIL9g0RhPH4K4JDbQuDnszp9SBGcgJYzwLh5Hb436A30A6qJE
# 7r5FTCiwtG27eMKCeZU3iBGpcj+g4kWIvmYEITsyCl8CxKv5+fs=
# =fzVo
# -----END PGP SIGNATURE-----
# gpg: Signature made Thu 30 Oct 2025 09:18:11 AM CET
# gpg:                using RSA key 6B810CD6D2BE10F3883D21424544E994F9D68FBB
# gpg: Good signature from "Harsh Prateek Bora <harsh.prateek.bora@gmail.com>" [undefined]
# gpg:                 aka "Harsh Prateek Bora <harshpb@linux.ibm.com>" [undefined]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg:          There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 6B81 0CD6 D2BE 10F3 883D  2142 4544 E994 F9D6 8FBB

* tag 'pull-ppc-for-10.2-d4-20251030' of https://gitlab.com/harshpb/qemu:
  hw/ppc/pegasos: Update documentation for pegasos1
  hw/ppc/pegasos2: Rename to pegasos
  hw/ppc/pegasos2: Add /chosen/stdin node with VOF
  hw/ppc: Fix memory leak in get_cpu_state_data()
  hw/ppc: Fix missing return on allocation failure
  ppc/spapr: Cleanup MSI IRQ number handling
  target/ppc: Remove the unusable e200 CPUs
  target/ppc/cpu_init: Simplify the setup of the TLBxCFG SPR registers
  hw/ppc/sam460ex: Update u-boot-sam460ex
  pseries: Update SLOF firmware image to release 20251027

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
7 days agoaccel/hvf: Trace prefetch abort
Philippe Mathieu-Daudé [Tue, 28 Oct 2025 05:42:06 +0000 (06:42 +0100)] 
accel/hvf: Trace prefetch abort

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
7 days agotarget/arm/hvf/hvf: Document $pc adjustment in HVF & SMC
Philippe Mathieu-Daudé [Tue, 28 Oct 2025 05:42:05 +0000 (06:42 +0100)] 
target/arm/hvf/hvf: Document $pc adjustment in HVF & SMC

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
7 days agotarget/arm: Share ARM_PSCI_CALL trace event between TCG and HVF
Philippe Mathieu-Daudé [Tue, 28 Oct 2025 05:42:04 +0000 (06:42 +0100)] 
target/arm: Share ARM_PSCI_CALL trace event between TCG and HVF

It is useful to compare PSCI calls of the same guest running
under TCG or HVF.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
7 days agotarget/arm: Re-use arm_is_psci_call() in HVF
Philippe Mathieu-Daudé [Tue, 28 Oct 2025 05:42:03 +0000 (06:42 +0100)] 
target/arm: Re-use arm_is_psci_call() in HVF

Re-use arm_is_psci_call() instead of open-coding it.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
7 days agotarget/arm/hvf: Rename 'vgic' -> 'emu_reginfo' in trace events
Philippe Mathieu-Daudé [Tue, 28 Oct 2025 05:42:02 +0000 (06:42 +0100)] 
target/arm/hvf: Rename 'vgic' -> 'emu_reginfo' in trace events

In order to extend the trace events to other registers,
rename and pass the register group as argument.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
7 days agotarget/arm: Rename init_cpreg_list() -> arm_init_cpreg_list()
Philippe Mathieu-Daudé [Tue, 28 Oct 2025 05:42:01 +0000 (06:42 +0100)] 
target/arm: Rename init_cpreg_list() -> arm_init_cpreg_list()

Prefix init_cpreg_list() with 'arm_'.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
7 days agoaccel/hvf: Restrict ARM specific fields of AccelCPUState
Philippe Mathieu-Daudé [Tue, 28 Oct 2025 05:42:00 +0000 (06:42 +0100)] 
accel/hvf: Restrict ARM specific fields of AccelCPUState

Do not expose ARM specific fields to X86 implementation,
allowing to use the proper 'hv_vcpu_exit_t' type.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
7 days agotarget/arm: Call aarch64_add_pauth_properties() once in host_initfn()
Philippe Mathieu-Daudé [Tue, 28 Oct 2025 05:41:59 +0000 (06:41 +0100)] 
target/arm: Call aarch64_add_pauth_properties() once in host_initfn()

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
7 days agoaccel/hvf: Guard hv_vcpu_run() between cpu_exec_start/end() calls
Philippe Mathieu-Daudé [Tue, 28 Oct 2025 05:41:58 +0000 (06:41 +0100)] 
accel/hvf: Guard hv_vcpu_run() between cpu_exec_start/end() calls

Similarly to 1d78a3c3ab8 for KVM, wrap hv_vcpu_run() with
cpu_exec_start/end(), so that the accelerator can perform
pending operations while all vCPUs are quiescent. See also
explanation in commit c265e976f46 ("cpus-common: lock-free
fast path for cpu_exec_start/end").

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
7 days agocpus: Trace cpu_exec_start() and cpu_exec_end() calls
Philippe Mathieu-Daudé [Tue, 28 Oct 2025 05:41:57 +0000 (06:41 +0100)] 
cpus: Trace cpu_exec_start() and cpu_exec_end() calls

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
7 days agotarget/arm/hvf: Keep calling hv_vcpu_run() in loop
Philippe Mathieu-Daudé [Tue, 28 Oct 2025 05:41:56 +0000 (06:41 +0100)] 
target/arm/hvf: Keep calling hv_vcpu_run() in loop

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Mads Ynddal <mads@ynddal.dk>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
7 days agotarget/arm/hvf: Factor hvf_handle_vmexit() out
Philippe Mathieu-Daudé [Tue, 28 Oct 2025 05:41:55 +0000 (06:41 +0100)] 
target/arm/hvf: Factor hvf_handle_vmexit() out

Factor hvf_handle_vmexit() out of hvf_vcpu_exec().

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Mads Ynddal <mads@ynddal.dk>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
7 days agotarget/i386/hvf: Factor hvf_handle_vmexit() out
Philippe Mathieu-Daudé [Tue, 28 Oct 2025 05:41:54 +0000 (06:41 +0100)] 
target/i386/hvf: Factor hvf_handle_vmexit() out

Factor hvf_handle_vmexit() out of hvf_arch_vcpu_exec().

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
7 days agotarget/arm/hvf: Factor hvf_handle_exception() out
Philippe Mathieu-Daudé [Tue, 28 Oct 2025 05:41:53 +0000 (06:41 +0100)] 
target/arm/hvf: Factor hvf_handle_exception() out

Factor hvf_handle_exception() out of hvf_vcpu_exec().

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Mads Ynddal <mads@ynddal.dk>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
7 days agotarget/arm/hvf: switch hvf_arm_get_host_cpu_features to not create a vCPU
Mohamed Mediouni [Tue, 28 Oct 2025 05:41:52 +0000 (06:41 +0100)] 
target/arm/hvf: switch hvf_arm_get_host_cpu_features to not create a vCPU

Creating a vCPU locks out APIs such as hv_gic_create().

As a result, switch to using the hv_vcpu_config_get_feature_reg interface.

Besides, all the following methods must be run on a vCPU thread:

  - hv_vcpu_create()
  - hv_vcpu_get_sys_reg()
  - hv_vcpu_destroy()

Signed-off-by: Mohamed Mediouni <mohamed@unpredictable.fr>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Mads Ynddal <mads@ynddal.dk>
Message-ID: <20250808070137.48716-3-mohamed@unpredictable.fr>
[PMD: Release config calling os_release()]
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
7 days agotarget/arm/hvf: Simplify hvf_arm_get_host_cpu_features()
Philippe Mathieu-Daudé [Tue, 28 Oct 2025 05:41:51 +0000 (06:41 +0100)] 
target/arm/hvf: Simplify hvf_arm_get_host_cpu_features()

Use index in the structure, dereference &host_isar.idregs[] once.

Suggested-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
7 days agotarget/arm/hvf: Hardcode Apple MIDR
Mohamed Mediouni [Tue, 28 Oct 2025 05:41:50 +0000 (06:41 +0100)] 
target/arm/hvf: Hardcode Apple MIDR

Hardcode MIDR because Apple deliberately doesn't expose
a divergent MIDR across systems.

Signed-off-by: Mohamed Mediouni <mohamed@unpredictable.fr>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
7 days agoaccel/hvf: Implement hvf_arch_vcpu_destroy()
Philippe Mathieu-Daudé [Tue, 28 Oct 2025 05:41:49 +0000 (06:41 +0100)] 
accel/hvf: Implement hvf_arch_vcpu_destroy()

Call hv_vcpu_destroy() to destroy our vCPU context.

As hv_vcpu_destroy() must be called by the owning thread,
document hvf_arch_vcpu_destroy() also does.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Mads Ynddal <mads@ynddal.dk>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
7 days agotarget/arm/hvf: Mention hvf_inject_interrupts() must run on vCPU thread
Philippe Mathieu-Daudé [Tue, 28 Oct 2025 05:41:48 +0000 (06:41 +0100)] 
target/arm/hvf: Mention hvf_inject_interrupts() must run on vCPU thread

Since hvf_inject_interrupts() calls hv_vcpu_set_pending_interrupt(),
which must run on a vCPU, it also must. Mention it.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Mads Ynddal <mads@ynddal.dk>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
7 days agoaccel/hvf: Mention hvf_arch_update_guest_debug() must run on vCPU
Philippe Mathieu-Daudé [Tue, 28 Oct 2025 05:41:47 +0000 (06:41 +0100)] 
accel/hvf: Mention hvf_arch_update_guest_debug() must run on vCPU

Since hvf_arch_update_guest_debug() calls hvf_arch_set_traps()
and hvf_arch_update_guest_debug(), which must run on a vCPU, it
also must. Mention it.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Mads Ynddal <mads@ynddal.dk>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
7 days agotarget/arm/hvf: Mention hvf_arch_set_traps() must run on vCPU thread
Philippe Mathieu-Daudé [Tue, 28 Oct 2025 05:41:46 +0000 (06:41 +0100)] 
target/arm/hvf: Mention hvf_arch_set_traps() must run on vCPU thread

Since hvf_arch_set_traps() calls hv_vcpu_set_trap_debug_exceptions()
and hv_vcpu_set_trap_debug_reg_accesses(), which must run on a vCPU,
it also must. Mention it.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Mads Ynddal <mads@ynddal.dk>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
7 days agotarget/arm/hvf: Mention hvf_sync_vtimer() must run on vCPU thread
Philippe Mathieu-Daudé [Tue, 28 Oct 2025 05:41:45 +0000 (06:41 +0100)] 
target/arm/hvf: Mention hvf_sync_vtimer() must run on vCPU thread

Since hvf_sync_vtimer() calls hv_vcpu_get_sys_reg(),
which must run on a vCPU, it also must. Mention it.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Mads Ynddal <mads@ynddal.dk>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
7 days agoaccel/hvf: Mention hvf_arch_init_vcpu() must run on vCPU thread
Philippe Mathieu-Daudé [Tue, 28 Oct 2025 05:41:44 +0000 (06:41 +0100)] 
accel/hvf: Mention hvf_arch_init_vcpu() must run on vCPU thread

hvf_arch_init_vcpu(), along with hvf_put_guest_debug_registers()
and hvf_put_gdbstub_debug_registers(), calls hv_vcpu_set_sys_reg(),
which must run on a vCPU. Mention they also must.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Mads Ynddal <mads@ynddal.dk>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
7 days agotarget/arm/hvf: Mention flush_cpu_state() must run on vCPU thread
Philippe Mathieu-Daudé [Tue, 28 Oct 2025 05:41:43 +0000 (06:41 +0100)] 
target/arm/hvf: Mention flush_cpu_state() must run on vCPU thread

Since flush_cpu_state() calls hvf_arch_put_registers(),
which must run on a vCPU, it also must. Mention it.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Mads Ynddal <mads@ynddal.dk>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
7 days agoaccel/hvf: Rename hvf_put|get_registers -> hvf_arch_put|get_registers
Philippe Mathieu-Daudé [Tue, 28 Oct 2025 05:41:42 +0000 (06:41 +0100)] 
accel/hvf: Rename hvf_put|get_registers -> hvf_arch_put|get_registers

hvf_put_registers() and hvf_get_registers() are implemented per
target, rename them using the 'hvf_arch_' prefix following the
per target pattern.

Since they call hv_vcpu_set_reg() / hv_vcpu_get_reg(), mention
they must be called on the vCPU.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Mads Ynddal <mads@ynddal.dk>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
7 days agoaccel/hvf: Rename hvf_vcpu_exec() -> hvf_arch_vcpu_exec()
Philippe Mathieu-Daudé [Tue, 28 Oct 2025 05:41:41 +0000 (06:41 +0100)] 
accel/hvf: Rename hvf_vcpu_exec() -> hvf_arch_vcpu_exec()

hvf_vcpu_exec() is implemented per target, rename it as
hvf_arch_vcpu_exec(), following the per target pattern.

Since it calls hv_vcpu_run(), mention it must be called
on the vCPU.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Mads Ynddal <mads@ynddal.dk>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
7 days agotarget/arm/hvf: Check hv_vcpu_set_vtimer_mask() returned value
Philippe Mathieu-Daudé [Tue, 28 Oct 2025 05:41:40 +0000 (06:41 +0100)] 
target/arm/hvf: Check hv_vcpu_set_vtimer_mask() returned value

hv_vcpu_set_vtimer_mask() returns a hv_return_t enum type
(defined in <Hypervisor/hv_error.h>). Assert we succeeded,
as we are not ready to handle any error path.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Mads Ynddal <mads@ynddal.dk>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
7 days agotarget/arm/hvf: Check hv_vcpus_exit() returned value
Philippe Mathieu-Daudé [Tue, 28 Oct 2025 05:41:39 +0000 (06:41 +0100)] 
target/arm/hvf: Check hv_vcpus_exit() returned value

hv_vcpus_exit() returns a hv_return_t enum type (defined
in <Hypervisor/hv_error.h>). Assert we succeeded, as we
are not ready to handle any error path.

Suggested-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Mads Ynddal <mads@ynddal.dk>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
7 days agotarget/arm/hvf: Trace vCPU KICK events
Philippe Mathieu-Daudé [Tue, 28 Oct 2025 05:41:38 +0000 (06:41 +0100)] 
target/arm/hvf: Trace vCPU KICK events

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
7 days agotarget/arm/hvf: Release memory allocated by hv_vcpu_config_create()
Philippe Mathieu-Daudé [Tue, 28 Oct 2025 05:41:37 +0000 (06:41 +0100)] 
target/arm/hvf: Release memory allocated by hv_vcpu_config_create()

hv_vcpu_config_create() is documented in <Hypervisor/hv_vcpu_config.h>
as:

  /*!
   @abstract Creates a vcpu configuration object.
   @result A new vcpu configuration object. This should be released with os_release when no longer used.
   */
  OS_OBJECT_RETURNS_RETAINED OS_WARN_RESULT
  hv_vcpu_config_t hv_vcpu_config_create(void);

Release the memory allocated by hv_vcpu_config_create() with
os_release().

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Mads Ynddal <mads@ynddal.dk>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
7 days agohw/arm/virt: Remove VirtMachineClass::kvm_no_adjvtime field
Philippe Mathieu-Daudé [Mon, 20 Oct 2025 09:40:21 +0000 (11:40 +0200)] 
hw/arm/virt: Remove VirtMachineClass::kvm_no_adjvtime field

The VirtMachineClass::kvm_no_adjvtime field was only used by the
virt-4.2 machine, which got removed. Remove it as now unused, but
keep the ARMCPU homonym property.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20251020094022.68768-5-philmd@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
7 days agohw/arm/virt: Remove deprecated virt-4.2 machine
Philippe Mathieu-Daudé [Mon, 20 Oct 2025 09:40:20 +0000 (11:40 +0200)] 
hw/arm/virt: Remove deprecated virt-4.2 machine

This machine has been supported for a period of more than 6 years.
According to our versioned machine support policy (see commit
ce80c4fa6ff "docs: document special exception for machine type
deprecation & removal") it can now be removed.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20251020094022.68768-4-philmd@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
7 days agohw/arm/virt: Remove VirtMachineClass::no_ged field
Philippe Mathieu-Daudé [Mon, 20 Oct 2025 09:40:19 +0000 (11:40 +0200)] 
hw/arm/virt: Remove VirtMachineClass::no_ged field

The VirtMachineClass::no_ged field was only used by virt-4.1
machine, which got removed. Remove it as now unused.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20251020094022.68768-3-philmd@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
7 days agohw/arm/virt: Remove deprecated virt-4.1 machine
Philippe Mathieu-Daudé [Mon, 20 Oct 2025 09:40:18 +0000 (11:40 +0200)] 
hw/arm/virt: Remove deprecated virt-4.1 machine

This machine has been supported for a period of more than 6 years.
According to our versioned machine support policy (see commit
ce80c4fa6ff "docs: document special exception for machine type
deprecation & removal") it can now be removed.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20251020094022.68768-2-philmd@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
7 days agotarget/arm: Add assert to arm_to_core_mmu_idx()
Peter Maydell [Thu, 23 Oct 2025 10:13:39 +0000 (11:13 +0100)] 
target/arm: Add assert to arm_to_core_mmu_idx()

Before commit f76cee647c ("target/arm: Introduce mmu indexes for
GCS") it was impossible for arm_to_core_mmu_idx() to return an
invalid core MMU index, because NB_MMU_MODES was 16 and
ARM_MMU_IDX_COREIDX_MASK was 0xf.

That commit raises ARM_MMU_IDX_COREIDX_MASK to 0x1f and NB_MMU_MODES
to 22, so it's now possible for a bogus Arm mmu index to result in an
out of range core mmu index (which can then get used as an array
index in the CPUTLB struct arrays). Coverity complains that this
might result in an out-of-bounds access.

The out-of-bounds access can't happen because we construct all the
ARMMMUIdx values we will use for TLBs to have valid core MMU indexes
in the COREIDX field.  But we can add an assert() so that if we ever
do end up operating on a corrupted or wrong ARMMMUIdx value we get an
assert rather than silently indexing off the end of an array. This
should also make Coverity happier.

Coverity: CID 1641404
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20251023101339.1983809-1-peter.maydell@linaro.org

7 days agodocs/system/security: Restrict "virtualization use case" to specific machines
Peter Maydell [Thu, 16 Oct 2025 13:11:59 +0000 (14:11 +0100)] 
docs/system/security: Restrict "virtualization use case" to specific machines

Currently our security policy defines a "virtualization use case"
where we consider bugs to be security issues, and a
"non-virtualization use case" where we do not make any security
guarantees and don't consider bugs to be security issues.

The rationale for this split is that much code in QEMU is older and
was not written with malicious guests in mind, and we don't have the
resources to audit, fix and defend it.  So instead we inform users
about what the can in practice rely on as a security barrier, and
what they can't.

We don't currently restrict the "virtualization use case" to any
particular set of machine types.  This means that we have effectively
barred ourselves from adding KVM support to any machine type that we
don't want to put into the "bugs are security issues" category, even
if it would be useful for users to be able to get better performance
with a trusted guest by enabling KVM. This seems an unnecessary
restriction, and in practice the set of machine types it makes
sense to use for untrusted-guest virtualization is quite small.

Specifically, we would like to be able to enable the use of
KVM with the imx8 development board machine types, but we don't
want to commit ourselves to having to support those SoC models
and device models as part of QEMU's security boundary:
https://lore.kernel.org/qemu-devel/20250629204851.1778-3-shentey@gmail.com/

This patch updates the security policy to explicitly list the
machine types we consider to be useful for the "virtualization
use case".

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Acked-by: Christian Borntraeger <borntraeger@linux.ibm.com>
Reviewed-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
Reviewed-by: Bernhard Beschow <shentey@gmail.com>
Message-id: 20251016131159.750480-1-peter.maydell@linaro.org
Acked-by: Markus Armbruster <armbru@redhat.com>
7 days agodocs/system/arm/virt: Document user-creatable SMMUv3
Peter Maydell [Mon, 27 Oct 2025 12:40:47 +0000 (12:40 +0000)] 
docs/system/arm/virt: Document user-creatable SMMUv3

The virt machine now supports creating multiple SMMUv3 instances, each
associated with a separate PCIe root complex.

Update the documentation with an example.

Signed-off-by: Shameer Kolothum <skolothumtho@nvidia.com>
[PMM: some minor wording tweaks]

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
7 days agohw/gpio/pl061: Declare pullups/pulldowns as 8-bit types
Philippe Mathieu-Daudé [Tue, 21 Oct 2025 14:53:13 +0000 (16:53 +0200)] 
hw/gpio/pl061: Declare pullups/pulldowns as 8-bit types

uint8_t is good enough to hold a property "between 0 and 0xff".

Define pullups/pulldowns properties using DEFINE_PROP_UINT8()
macro, remove unnecessary range checks in pl061_realize().
Update the two caller sites.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
7 days agoMerge tag 'pull-nvme-20251030' of https://gitlab.com/birkelund/qemu into staging
Richard Henderson [Fri, 31 Oct 2025 11:56:05 +0000 (12:56 +0100)] 
Merge tag 'pull-nvme-20251030' of https://gitlab.com/birkelund/qemu into staging

nvme queue

# -----BEGIN PGP SIGNATURE-----
#
# iQEzBAABCgAdFiEEUigzqnXi3OaiR2bATeGvMW1PDekFAmkDE7gACgkQTeGvMW1P
# DekCOwgAuOQKWWW/UA1MmZ4ZHs+djf4q5UDwqGDx8tra8d32mZWRHgpJ/OBBOY2z
# CmuHqWLgooAqfx4hsrXELdNBEe7ccNE9nvsE3GjnYWxjoe51yl2Xc0RD5CZBVrN4
# RRMbBZRCewxGShyUaT31eedolWdr4zBuqkpLf9gcG8Yk7YD+xUkHUPeMXeAy+vkS
# pxW59AkXdjJZgBktOdV5uVj9gaCPgTcGaQNH2FYSnzHwdu5VyV8BKiiZE/fXS6FU
# xZvu+5p1Ro5vOdwG+iFBrbBwcGyjVOF1OfBZctyc83foyFxwzxqoqj9gy0ewuT2g
# HsupUiJgbkZ1Ut9fzaS5pHx3dd3dKw==
# =WDrH
# -----END PGP SIGNATURE-----
# gpg: Signature made Thu 30 Oct 2025 08:28:56 AM CET
# gpg:                using RSA key 522833AA75E2DCE6A24766C04DE1AF316D4F0DE9
# gpg: Good signature from "Klaus Jensen <its@irrelevant.dk>" [unknown]
# gpg:                 aka "Klaus Jensen <k.jensen@samsung.com>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg:          There is no indication that the signature belongs to the owner.
# Primary key fingerprint: DDCA 4D9C 9EF9 31CC 3468  4272 63D5 6FC5 E55D A838
#      Subkey fingerprint: 5228 33AA 75E2 DCE6 A247  66C0 4DE1 AF31 6D4F 0DE9

* tag 'pull-nvme-20251030' of https://gitlab.com/birkelund/qemu:
  hw/nvme: add atomic boundary support
  hw/nvme: enable ns atomic writes
  hw/nvme: connect SPDM over NVMe Security Send/Recv
  spdm: define SPDM transport enum types
  hw/nvme: add NVMe Admin Security SPDM support
  spdm: add spdm storage transport virtual header
  spdm-socket: add seperate send/recv functions

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
7 days agoMerge tag 'pull-loongarch-20251030' of https://github.com/bibo-mao/qemu into staging
Richard Henderson [Fri, 31 Oct 2025 11:55:44 +0000 (12:55 +0100)] 
Merge tag 'pull-loongarch-20251030' of https://github.com/bibo-mao/qemu into staging

loongarch queue

# -----BEGIN PGP SIGNATURE-----
#
# iHUEABYKAB0WIQQNhkKjomWfgLCz0aQfewwSUazn0QUCaQLPjQAKCRAfewwSUazn
# 0c6EAP4wnAifbVCAMLxvMXtacIO7LomcdGDxXtwSh8l7GXvCtwD9E8MvJhrb7gMb
# tty5M+P2eIzOafaRHscarWLrnI01mAY=
# =zfDK
# -----END PGP SIGNATURE-----
# gpg: Signature made Thu 30 Oct 2025 03:38:05 AM CET
# gpg:                using EDDSA key 0D8642A3A2659F80B0B3D1A41F7B0C1251ACE7D1
# gpg: Good signature from "bibo mao <maobibo@loongson.cn>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg:          There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 7044 3A00 19C0 E97A 31C7  13C4 8E86 8FB7 A176 9D4C
#      Subkey fingerprint: 0D86 42A3 A265 9F80 B0B3  D1A4 1F7B 0C12 51AC E7D1

* tag 'pull-loongarch-20251030' of https://github.com/bibo-mao/qemu:
  target/loongarch: Add PTW feature support in KVM mode
  linux-headers: Update to Linux v6.18-rc3

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
7 days agoMerge tag 'pull-misc-20251031' of https://gitlab.com/rth7680/qemu into staging
Richard Henderson [Fri, 31 Oct 2025 11:55:28 +0000 (12:55 +0100)] 
Merge tag 'pull-misc-20251031' of https://gitlab.com/rth7680/qemu into staging

linux-user: permit sendto() with NULL buf and 0 len
tests/functional: Mark the MIPS replay tests as flaky
tests/functional: Mark the MIPS Debian Wheezy tests as flaky
accel/tcg: Introduce and use MO_ALIGN_TLB_ONLY
tcg: Simplify extract2 usage in tcg_gen_shifti_i64

# -----BEGIN PGP SIGNATURE-----
#
# iQFRBAABCgA7FiEEekgeeIaLTbaoWgXAZN846K9+IV8FAmkEou4dHHJpY2hhcmQu
# aGVuZGVyc29uQGxpbmFyby5vcmcACgkQZN846K9+IV/+/gf/XVoIbDCTgwt9hIbU
# azcxXgc+2kKpEK08OHTMA0Vfv06elR+ls5SXJuIV/ZvhM7amjOehs6rU5bX349Yi
# on901/zsa1woED6c3Jhp9FdQ3edFR8T3gvFaLIlhMoTHbe+CDRNHM7iYE5ASIdYx
# F2exgsZoUlcu12x5InttHvanC8lumLMBntlTnBgLZKjmW2tUehlMyAMRga0gyW5j
# EUG4v3frKI6rNMRSK6uE62I3paLvmU4zwlieCiqMtB5gT9+LKg//1Cfn149pLryj
# tuQ3kQfDZ9Lr5/18QtskfiTWnFoFx4xUyOHEQHUcmLpV/hvIBMq17pL+8ftcUdTB
# pjvzhg==
# =S/88
# -----END PGP SIGNATURE-----
# gpg: Signature made Fri 31 Oct 2025 12:52:14 PM CET
# gpg:                using RSA key 7A481E78868B4DB6A85A05C064DF38E8AF7E215F
# gpg:                issuer "richard.henderson@linaro.org"
# gpg: Good signature from "Richard Henderson <richard.henderson@linaro.org>" [ultimate]

* tag 'pull-misc-20251031' of https://gitlab.com/rth7680/qemu:
  linux-user: permit sendto() with NULL buf and 0 len
  tests/functional: Mark the MIPS Debian Wheezy tests as flaky
  tests/functional: Mark the MIPS replay tests as flaky
  tcg: Simplify extract2 usage in tcg_gen_shifti_i64
  accel/tcg: Introduce and use MO_ALIGN_TLB_ONLY

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
7 days agolinux-user: permit sendto() with NULL buf and 0 len
Peter Maydell [Tue, 28 Oct 2025 14:20:01 +0000 (14:20 +0000)] 
linux-user: permit sendto() with NULL buf and 0 len

If you pass sendto() a NULL buffer, this is usually an error
(causing an EFAULT return); however if you pass a 0 length then
we should not try to validate the buffer provided. Instead we
skip the copying of the user data and possible processing
through fd_trans_target_to_host_data, and call the host syscall
with NULL, 0.

(unlock_user() permits a NULL buffer pointer for "do nothing"
so we don't need to special case the unlock code.)

Cc: qemu-stable@nongnu.org
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3102
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20251028142001.3011630-1-peter.maydell@linaro.org>

7 days agotests/functional: Mark the MIPS Debian Wheezy tests as flaky
Philippe Mathieu-Daudé [Fri, 31 Oct 2025 09:41:18 +0000 (10:41 +0100)] 
tests/functional: Mark the MIPS Debian Wheezy tests as flaky

test_malta.py sometimes times out (likely hang) under GitLab CI:

  1/57 qemu:func-thorough+func-mips-thorough+thorough / func-mips-malta    TIMEOUT   480.11s   killed by signal 15 SIGTERM

console.log shows a soft lockup failure:

  06:46,426: INIT: version 2.88 booting
  06:46,942: [[36minfo[39;49m] Using makefile-style concurrent boot in runlevel S.
  06:47,378: findfs: unable to resolve 'UUID=042f1883-e9a5-4801-bb9b-667b5c8e87ea'
  06:50,448: [....] Starting the hotplug events dispatcher: udevd[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c.
  06:52,269: [....] Synthesizing the initial hotplug events...module e1000: dangerous R_MIPS_LO16 REL relocation
  07:17,707: BUG: soft lockup - CPU#0 stuck for 22s! [modprobe:208]
  07:17,707: Modules linked in:
  07:17,707: Cpu 0
  07:17,708: $ 0   : 00000000 1000a400 0000003d 87808b00
  07:17,708: $ 4   : 87808b00 87808bf0 00000000 00000000
  07:17,709: $ 8   : 86862100 86862100 86862100 86862100
  07:17,709: $12   : 86862100 00000000 00000001 86862100
  07:17,709: $16   : 87808a00 86862100 1000a401 c008fa60
  07:17,709: $20   : 86862100 8041d230 00000000 ffff0000
  07:17,710: $24   : 00000000 77711470
  07:17,710: $28   : 87bb6000 87bb7df8 8041d230 801f7388
  07:17,710: Hi    : 00000000
  07:17,710: Lo    : 00000000
  07:17,711: epc   : 801f7308 kfree+0x104/0x19c
  07:17,711: Not tainted
  07:17,711: ra    : 801f7388 kfree+0x184/0x19c
  07:17,712: Status: 1000a403    KERNEL EXL IE
  07:17,712: Cause : 50808000
  07:17,712: PrId  : 00019300 (MIPS 24Kc)
  07:45,707: BUG: soft lockup - CPU#0 stuck for 22s! [modprobe:208]
  07:45,707: Modules linked in:

Reported-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20251031094118.28440-3-philmd@linaro.org>

7 days agotests/functional: Mark the MIPS replay tests as flaky
Philippe Mathieu-Daudé [Fri, 31 Oct 2025 09:41:17 +0000 (10:41 +0100)] 
tests/functional: Mark the MIPS replay tests as flaky

MIPS test_replay.py often times out (likely hang) under GitLab CI:

  2/21 qemu:func-thorough+func-mips64el-thorough+thorough / func-mips64el-replay   TIMEOUT   180.12s   killed by signal 15 SIGTERM

The console.log file is empty, and recording.logs only shows:

  qemu-system-mips64el: terminating on signal 15 from pid 344

Since this is a long term issue affecting our CI, disable the tests.

Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20251031094118.28440-2-philmd@linaro.org>

7 days agotcg: Simplify extract2 usage in tcg_gen_shifti_i64
Richard Henderson [Wed, 1 Jan 2025 18:04:00 +0000 (10:04 -0800)] 
tcg: Simplify extract2 usage in tcg_gen_shifti_i64

The else after the TCG_TARGET_HAS_extract2 test is exactly
the same as what tcg_gen_extract2_i32 would emit itself.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
7 days agoaccel/tcg: Introduce and use MO_ALIGN_TLB_ONLY
Richard Henderson [Tue, 21 Oct 2025 19:35:39 +0000 (14:35 -0500)] 
accel/tcg: Introduce and use MO_ALIGN_TLB_ONLY

For Arm, we need 3 cases: (1) the alignment required when accessing
Normal memory, (2) the alignment required when accessing Device memory,
and (3) the atomicity of the access.

When we added TLB_CHECK_ALIGNED, we assumed that cases 2 and 3 were
identical, and thus used memop_atomicity_bits for TLB_CHECK_ALIGNED.

This is incorrect for multiple reasons, including that the atomicity
of the access is adjusted depending on whether or not we are executing
within a serial context.

For Arm, what is true is that there is an underlying alignment
requirement of the access, and for that access Normal memory
will support unalignement.

Introduce MO_ALIGN_TLB_ONLY to indicate that the alignment
specified in MO_AMASK only applies when the TLB entry has
TLB_CHECK_ALIGNED set; otherwise no alignment required.

Introduce memop_tlb_alignment_bits with an additional bool
argument that specifies whether TLB_CHECK_ALIGNED is set.
All other usage of memop_alignment_bits assumes it is not.

Remove memop_atomicity_bits as unused; it didn't properly
support MO_ATOM_SUBWORD anyway.

Update target/arm finalize_memop_atom to set MO_ALIGN_TLB_ONLY
when strict alignment isn't otherwise required.

Suggested-by: Peter Maydell <peter.maydell@linaro.org>
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3171
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
7 days agoMerge tag 'single-binary-20251030' of https://github.com/philmd/qemu into staging
Richard Henderson [Fri, 31 Oct 2025 09:26:34 +0000 (10:26 +0100)] 
Merge tag 'single-binary-20251030' of https://github.com/philmd/qemu into staging

Various patches related to single binary work:

- Make hw/arm/ common by adding a QOM type to machines to
  tag in which binary (32 or 64-bit) they can be used.
  Convert the Virt and SBSA-Ref machines.
- Build Xen files once

# -----BEGIN PGP SIGNATURE-----
#
# iQIzBAABCAAdFiEE+qvnXhKRciHc/Wuy4+MsLN6twN4FAmkDbS4ACgkQ4+MsLN6t
# wN7LOQ/9HQSArWumcPtJNjfdKyN4BI+evdJuIsJlGnVirZzAShd/aA3emeVoIQXf
# kb1xAJvbL6IryasuFFrWJjLKAdTk8RgTzbDwSS07dEvNE/fVo22OarBfusrO+/fJ
# 6da3j08gwb0EV9m8eUbTwuRBxIF/tnPzZMzyRwx23b4wRb4jnIsshutHX9/hoZBj
# 8cdCJx284EZgj5gLTmk+jEyPEU+miKpnHWqpxSKZCXg7UfzXH34gOo6IBZIzylZs
# kJqcPXaJHF//ISMQQGzl7k1GNyr1fZZBIuCd7zdOIBntWjb45g/7lEKTGFaVrR5Y
# yqaUsNZNj8z3ESA4y42RUPSYAvjwGh+AKafZiHE6K7Oa/WIjeqfr33GHNSMrDYk1
# UDz4o6/VhA/T7VaQjcd/IG9vYsF3jwjhbXQRa1xXKxhuIC0PzEKxpyWo3mAIEfm8
# 7vw90xx4no29WsUpKi6kyplJ/fq9o3h0kWpd6fYlJQsCtwVZFLT9UeBVIQHrfGec
# xkJx/L1OZFzym8Y4bcj0/V4zRJyvyuKK30+bFvu0fKcNR3uijKUjYcQHYg04fSG9
# PgQtCgHxwdbO8vCwHf0WIVtOhqC0aOgtE10jh9HdLG07Ef5K1JBkE90XX27rCOV3
# rAVo/czNnHpx2j0kRGpyRlz9M/eqOVcz4z3TFzKOFPEEumvz1MM=
# =Ncy4
# -----END PGP SIGNATURE-----
# gpg: Signature made Thu 30 Oct 2025 02:50:38 PM CET
# gpg:                using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE
# gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <f4bug@amsat.org>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg:          There is no indication that the signature belongs to the owner.
# Primary key fingerprint: FAAB E75E 1291 7221 DCFD  6BB2 E3E3 2C2C DEAD C0DE

* tag 'single-binary-20251030' of https://github.com/philmd/qemu: (23 commits)
  hw/riscv: Replace target_ulong uses
  hw/xen: Build only once
  hw/xen: Replace target_ulong by agnostic target_long_bits()
  hw/xen: Use BITS_PER_BYTE & MAKE_64BIT_MASK() in req_size_bits()
  hw/arm/meson: Move Xen files to arm_common_ss[]
  hw/arm/virt: Build only once
  hw/arm/virt-acpi-build: Build only once
  hw/arm/virt-acpi-build: Include missing 'cpu.h' header
  hw/arm/sbsa-ref: Build only once
  hw/arm/sbsa-ref: Include missing 'cpu.h' header
  hw/arm/virt: Get default CPU type at runtime
  hw/arm/virt: Replace TARGET_AARCH64 -> target_aarch64()
  qemu/target_info: Add target_base_arm() helper
  qemu/target_info: Add target_aarch64() helper
  qemu/target_info: Add target_arm() helper
  hw/arm/virt: Check accelerator availability at runtime
  hw/arm/virt: Register valid CPU types dynamically
  config/target: Implement per-binary TargetInfo structure (ARM, AARCH64)
  meson: Prepare to accept per-binary TargetInfo structure implementation
  hw/arm: Filter machine types for qemu-system-arm/aarch64 binaries
  ...

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
7 days agoaudio: deprecate HMP audio commands
Marc-André Lureau [Wed, 22 Oct 2025 10:57:53 +0000 (14:57 +0400)] 
audio: deprecate HMP audio commands

The command is niche and better served by the host audio system.
There is no QMP equivalent, fortunately. You can capture the audio
stream via remote desktop protocols too (dbus, vnc, spice).

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Acked-by: Dr. David Alan Gilbert <dave@treblig.org>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-Id: <20251022105753.1474739-1-marcandre.lureau@redhat.com>

7 days agoaudio: Rename @endianness argument as @big_endian for clarity
Philippe Mathieu-Daudé [Wed, 22 Oct 2025 07:53:52 +0000 (09:53 +0200)] 
audio: Rename @endianness argument as @big_endian for clarity

@endianness is used as a boolean, rename for clarity.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
7 days agoaudio: Remove pointless local variables
Philippe Mathieu-Daudé [Wed, 22 Oct 2025 07:53:51 +0000 (09:53 +0200)] 
audio: Remove pointless local variables

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
7 days agoaudio: drop needless audio_driver "descr" field
Marc-André Lureau [Fri, 17 Oct 2025 20:15:57 +0000 (00:15 +0400)] 
audio: drop needless audio_driver "descr" field

Was it ever used?

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
7 days agoaudio: move capture API to own header
Marc-André Lureau [Thu, 16 Oct 2025 13:46:07 +0000 (17:46 +0400)] 
audio: move capture API to own header

For modularity/clarity reasons, move the capture API in a specific
header.

The current audio/ header license is MIT.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
7 days agoaudio: cleanup, use bool for booleans
Marc-André Lureau [Wed, 15 Oct 2025 06:40:01 +0000 (10:40 +0400)] 
audio: cleanup, use bool for booleans

Use slightly better types for the job.
Fix some checkpatch issues.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
7 days agoaudio: remove dependency on spice header
Marc-André Lureau [Tue, 14 Oct 2025 14:19:12 +0000 (18:19 +0400)] 
audio: remove dependency on spice header

It is no longer required.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
7 days agoaudio: move audio.h under include/qemu/
Marc-André Lureau [Tue, 14 Oct 2025 13:30:41 +0000 (17:30 +0400)] 
audio: move audio.h under include/qemu/

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
7 days agoaudio/dbus: use a helper function to set the backend dbus server
Marc-André Lureau [Mon, 27 Oct 2025 14:31:32 +0000 (18:31 +0400)] 
audio/dbus: use a helper function to set the backend dbus server

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
7 days agoaudio: remove QEMUSoundCard
Marc-André Lureau [Tue, 21 Oct 2025 13:07:43 +0000 (17:07 +0400)] 
audio: remove QEMUSoundCard

There is no clear need for this extra intermediary structure between
the audio backend and its user.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
7 days agoaudio: rename AudioState -> AudioBackend
Marc-André Lureau [Tue, 14 Oct 2025 12:35:28 +0000 (16:35 +0400)] 
audio: rename AudioState -> AudioBackend

Naming is hard. But in general in QEMU, a host "backend" is the term
used to fullfill the request made by the device or frontend.

AudioBackend will become an abstract base class in a follow-up series.

Currently the frontend is QEMUSoundCard, we are going to drop that next.

Note that "audiodev" is the corresponding QAPI type name (or configuration).

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
7 days agoaudio: move internal APIs to audio_int.h
Marc-André Lureau [Tue, 14 Oct 2025 10:06:08 +0000 (14:06 +0400)] 
audio: move internal APIs to audio_int.h

Fix some check-patch issues while at it.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
7 days agoaudio/replay: fix type punning
Marc-André Lureau [Tue, 14 Oct 2025 10:43:36 +0000 (14:43 +0400)] 
audio/replay: fix type punning

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
7 days agoaudio: introduce AUD_set_volume_{in,out}_lr()
Marc-André Lureau [Tue, 14 Oct 2025 09:56:14 +0000 (13:56 +0400)] 
audio: introduce AUD_set_volume_{in,out}_lr()

There are 2 sets of functions since the introduction of multi-channel
Volume structure: AUD_set_volume_{in,out} and audio_set_volume_{in,out}.

Use the AUD_ prefix for consistency with other audio.c functions. Rename
the stereo function with "_lr" suffix.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
7 days agoaudio: remove AUDIO_HOST_ENDIANNESS
Marc-André Lureau [Tue, 14 Oct 2025 08:31:37 +0000 (12:31 +0400)] 
audio: remove AUDIO_HOST_ENDIANNESS

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
7 days agoaudio: remove some needless headers
Marc-André Lureau [Tue, 14 Oct 2025 08:02:07 +0000 (12:02 +0400)] 
audio: remove some needless headers

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
7 days agoaudio: initialize card_head during object init
Marc-André Lureau [Mon, 13 Oct 2025 20:05:22 +0000 (00:05 +0400)] 
audio: initialize card_head during object init

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
7 days agoaudio: register and unregister vmstate with AudioState
Marc-André Lureau [Mon, 13 Oct 2025 20:01:42 +0000 (00:01 +0400)] 
audio: register and unregister vmstate with AudioState

Proper lifecycle management with QOM state.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
8 days agohw/riscv: Replace target_ulong uses
Anton Johansson [Mon, 27 Oct 2025 12:35:11 +0000 (13:35 +0100)] 
hw/riscv: Replace target_ulong uses

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Anton Johansson <anjo@rev.ng>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20251027-feature-single-binary-hw-v1-v2-2-44478d589ae9@rev.ng>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
8 days agohw/xen: Build only once
Philippe Mathieu-Daudé [Fri, 4 Apr 2025 15:00:42 +0000 (17:00 +0200)] 
hw/xen: Build only once

Now than hw/xen/ files don't use any target-specific code,
we can build all file units once, removing the need for the
xen_specific_ss[] source set.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Message-Id: <20251022140114.72372-4-philmd@linaro.org>

8 days agohw/xen: Replace target_ulong by agnostic target_long_bits()
Philippe Mathieu-Daudé [Fri, 4 Apr 2025 15:07:04 +0000 (17:07 +0200)] 
hw/xen: Replace target_ulong by agnostic target_long_bits()

Both are equivalent:

  target_long_bits()

  sizeof(target_u?long) * BITS_PER_BYTE

Prefer the former which is target-agnostic.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Message-Id: <20251022140114.72372-3-philmd@linaro.org>

8 days agohw/xen: Use BITS_PER_BYTE & MAKE_64BIT_MASK() in req_size_bits()
Philippe Mathieu-Daudé [Fri, 4 Apr 2025 15:00:03 +0000 (17:00 +0200)] 
hw/xen: Use BITS_PER_BYTE & MAKE_64BIT_MASK() in req_size_bits()

Replace magic 8 by BITS_PER_BYTE, use MAKE_64BIT_MASK()
instead of open coding it.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Message-Id: <20251022140114.72372-2-philmd@linaro.org>

8 days agohw/arm/meson: Move Xen files to arm_common_ss[]
Philippe Mathieu-Daudé [Wed, 16 Apr 2025 08:01:11 +0000 (10:01 +0200)] 
hw/arm/meson: Move Xen files to arm_common_ss[]

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Acked-by: Peter Maydell <peter.maydell@linaro.org>
Message-Id: <20251021210655.59278-1-philmd@linaro.org>

8 days agohw/arm/virt: Build only once
Philippe Mathieu-Daudé [Thu, 3 Apr 2025 23:02:00 +0000 (01:02 +0200)] 
hw/arm/virt: Build only once

Previous commits removed the TARGET_AARCH64 uses in virt.c,
we can now move it to arm_common_ss[] and build it once.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Acked-by: Peter Maydell <peter.maydell@linaro.org>
Message-Id: <20251021210934.60483-1-philmd@linaro.org>

8 days agohw/arm/virt-acpi-build: Build only once
Philippe Mathieu-Daudé [Thu, 3 Apr 2025 22:15:41 +0000 (00:15 +0200)] 
hw/arm/virt-acpi-build: Build only once

Previous commits removed the target-specificities,
we can now move virt-acpi-build.c to arm_common_ss[].

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Acked-by: Peter Maydell <peter.maydell@linaro.org>
Message-Id: <20251021210144.58108-9-philmd@linaro.org>

8 days agohw/arm/virt-acpi-build: Include missing 'cpu.h' header
Philippe Mathieu-Daudé [Tue, 2 Sep 2025 08:44:45 +0000 (10:44 +0200)] 
hw/arm/virt-acpi-build: Include missing 'cpu.h' header

"cpu.h" is indirectly pulled in by another header. Include
it explicitly in order to avoid when changing default CPPFLAGS path:

  hw/arm/virt-acpi-build.c:903:34: error: call to undeclared function 'arm_feature';
    903 |         uint32_t pmu_interrupt = arm_feature(&armcpu->env, ARM_FEATURE_PMU) ?
        |                                  ^
  hw/arm/virt-acpi-build.c:903:53: error: incomplete definition of type 'ARMCPU' (aka 'struct ArchCPU')
    903 |         uint32_t pmu_interrupt = arm_feature(&armcpu->env, ARM_FEATURE_PMU) ?
        |                                               ~~~~~~^
  include/qemu/typedefs.h:30:16: note: forward declaration of 'struct ArchCPU'
     30 | typedef struct ArchCPU ArchCPU;
        |                ^
  hw/arm/virt-acpi-build.c:903:60: error: use of undeclared identifier 'ARM_FEATURE_PMU'
    903 |         uint32_t pmu_interrupt = arm_feature(&armcpu->env, ARM_FEATURE_PMU) ?
        |                                                            ^
  hw/arm/virt-acpi-build.c:993:10: error: use of undeclared identifier 'QEMU_PSCI_CONDUIT_DISABLED'
    993 |     case QEMU_PSCI_CONDUIT_DISABLED:
        |          ^
  hw/arm/virt-acpi-build.c:996:10: error: use of undeclared identifier 'QEMU_PSCI_CONDUIT_HVC'
    996 |     case QEMU_PSCI_CONDUIT_HVC:
        |          ^
  hw/arm/virt-acpi-build.c:1000:10: error: use of undeclared identifier 'QEMU_PSCI_CONDUIT_SMC'
   1000 |     case QEMU_PSCI_CONDUIT_SMC:
        |          ^

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Acked-by: Peter Maydell <peter.maydell@linaro.org>
Message-Id: <20251021210144.58108-8-philmd@linaro.org>

8 days agohw/arm/sbsa-ref: Build only once
Philippe Mathieu-Daudé [Thu, 3 Apr 2025 22:16:13 +0000 (00:16 +0200)] 
hw/arm/sbsa-ref: Build only once

Since previous commit allowed the use of accelerator definitions
in common code, we can now move sbsa-ref.c to arm_common_ss[].

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Acked-by: Peter Maydell <peter.maydell@linaro.org>
Message-Id: <20251021210144.58108-7-philmd@linaro.org>

8 days agohw/arm/sbsa-ref: Include missing 'cpu.h' header
Philippe Mathieu-Daudé [Mon, 20 Oct 2025 20:31:24 +0000 (22:31 +0200)] 
hw/arm/sbsa-ref: Include missing 'cpu.h' header

"cpu.h" is indirectly pulled in by another header. Include
it explicitly in order to avoid when changing default CPPFLAGS path:

  hw/arm/sbsa-ref.c:162:25: error: use of undeclared identifier 'ARM_DEFAULT_CPUS_PER_CLUSTER'
    162 |     uint8_t clustersz = ARM_DEFAULT_CPUS_PER_CLUSTER;
        |                         ^
  hw/arm/sbsa-ref.c:163:12: error: call to undeclared function 'arm_build_mp_affinity'
    163 |     return arm_build_mp_affinity(idx, clustersz);
        |            ^
  hw/arm/sbsa-ref.c:746:25: error: use of undeclared identifier 'QEMU_PSCI_CONDUIT_DISABLED'
    746 |     sms->psci_conduit = QEMU_PSCI_CONDUIT_DISABLED;
        |                         ^

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Acked-by: Peter Maydell <peter.maydell@linaro.org>
Message-Id: <20251021210144.58108-6-philmd@linaro.org>

8 days agohw/arm/virt: Get default CPU type at runtime
Philippe Mathieu-Daudé [Tue, 22 Apr 2025 08:22:34 +0000 (10:22 +0200)] 
hw/arm/virt: Get default CPU type at runtime

Prefer MachineClass::get_default_cpu_type() over
MachineClass::default_cpu_type to get CPU type,
evaluating TCG availability at runtime calling
tcg_enabled().

It's worth noting that this is a behavior change:

- Previously only

  ./configure --disable-tcg --enable-kvm
  ./qemu-system-aarch64 -M virt -accel kvm

  would default to 'max' and

  ./configure --enable-tcg --enable-kvm
  ./qemu-system-aarch64 -M virt -accel kvm

  would default to 'cortex-a15'.

- Afterward, -accel kvm will always default to 'max'.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Zhang Chen <zhangckid@gmail.com>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Acked-by: Peter Maydell <peter.maydell@linaro.org>
Message-Id: <20251021210144.58108-5-philmd@linaro.org>

8 days agohw/arm/virt: Replace TARGET_AARCH64 -> target_aarch64()
Philippe Mathieu-Daudé [Thu, 3 Apr 2025 22:56:51 +0000 (00:56 +0200)] 
hw/arm/virt: Replace TARGET_AARCH64 -> target_aarch64()

Replace the target-specific TARGET_AARCH64 definition
by a call to the generic target_aarch64() helper.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Acked-by: Peter Maydell <peter.maydell@linaro.org>
Message-Id: <20251021210144.58108-4-philmd@linaro.org>

8 days agoqemu/target_info: Add target_base_arm() helper
Philippe Mathieu-Daudé [Tue, 13 May 2025 11:50:10 +0000 (12:50 +0100)] 
qemu/target_info: Add target_base_arm() helper

Add a helper to check whether the target base architecture
is ARM (either 32-bit or 64-bit).

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Acked-by: Peter Maydell <peter.maydell@linaro.org>
Message-Id: <20251021210144.58108-3-philmd@linaro.org>

8 days agoqemu/target_info: Add target_aarch64() helper
Philippe Mathieu-Daudé [Fri, 4 Apr 2025 22:41:48 +0000 (00:41 +0200)] 
qemu/target_info: Add target_aarch64() helper

Add a helper to distinct whether the binary is targetting
Aarch64 or not.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Acked-by: Peter Maydell <peter.maydell@linaro.org>
Message-Id: <20251021210144.58108-2-philmd@linaro.org>

8 days agoqemu/target_info: Add target_arm() helper
Philippe Mathieu-Daudé [Mon, 20 Oct 2025 20:21:57 +0000 (22:21 +0200)] 
qemu/target_info: Add target_arm() helper

Add a helper to distinct whether the binary is targetting
ARM (32-bit only) or not.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Acked-by: Peter Maydell <peter.maydell@linaro.org>
Message-Id: <20251021210144.58108-1-philmd@linaro.org>