The comment about @start_powered_off is buried within the
CPUState structure. Hoist it to the structure docstring
comment.
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20260423170229.64655-6-philmd@linaro.org>
Stefan Hajnoczi [Fri, 24 Apr 2026 00:51:57 +0000 (20:51 -0400)]
Merge tag 'pull-11.1-virtio-gpu-hotfixes-230426-1' of https://gitlab.com/stsquad/qemu into staging
virtio-gpu fixes:
- fix build on Windows due to EGL assumption
- fix use-after-free on virgl resource
# -----BEGIN PGP SIGNATURE-----
#
# iQEzBAABCgAdFiEEZoWumedRZ7yvyN81+9DbCVqeKkQFAmnqN/sACgkQ+9DbCVqe
# KkR+cAf+INMexc1Wzc81XUs3UamDOPQmIKTu/36P7K3PrVwvwtb/KhIjlgsiUDjy
# thP9wZcMVJNA8heCFOp3kMzydEBbZ3Ywiz5TWulrvGrwBwPDf93+bTlgr1cDzDwI
# bi2CjR4NUHtICGC/6Smh9UbRLMh5FkGB/XpyXr+Gkl+THT4s+evQXP8xYuvbfKZj
# qKsxz2oaCZNqYJRfUPBxNLaiS7VRGVJBaOLSuhLUegQZ4T0CzcyprOfreOfjolwC
# hmGcC1w/Sb1EJZkgE9ZKi30AMXS4NuHfMXHNCI76xIMYd/c9/B19AVUv3ZVIbuNs
# vAdamiBnIRffPLGhttOqhLCndNHGHA==
# =uXFe
# -----END PGP SIGNATURE-----
# gpg: Signature made Thu 23 Apr 2026 11:17:15 EDT
# gpg: using RSA key 6685AE99E75167BCAFC8DF35FBD0DB095A9E2A44
# gpg: Good signature from "Alex Bennée (Master Work Key) <alex.bennee@linaro.org>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 6685 AE99 E751 67BC AFC8 DF35 FBD0 DB09 5A9E 2A44
* tag 'pull-11.1-virtio-gpu-hotfixes-230426-1' of https://gitlab.com/stsquad/qemu:
hw/display: don't accidentally autofree existing virgl resources
ui/sdl2: Fix assumption of EGL presence at runtime
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Stefan Hajnoczi [Fri, 24 Apr 2026 00:51:46 +0000 (20:51 -0400)]
Merge tag 'for-upstream' of https://gitlab.com/bonzini/qemu into staging
* accel/mshv: ioeventfd fixes
* memory: avoid memmove in flatview_simplify()
* first batch of clang-cl support patches for qemu-ga
* target/i386: fix emulator issue
* target/i386: fix strList leak
* target/i386: emulate: include name of unhandled instruction
* target/i386/tcg: fix decoding of MOVBE and CRC32 in 16-bit mode
* thread-win32: replace CRITICAL_SECTION with SRWLOCK
* target/i386: fix missing PF_INSTR in SIGSEGV context
* util: actually use in pthread_condattr_setclock
* vapic: restore IRQ polling for non-kernel irqchip backends
* tag 'for-upstream' of https://gitlab.com/bonzini/qemu: (25 commits)
target/i386: emulate: include name of unhandled instruction
memory: Optimize flatview_simplify() to eliminate redundant memmove calls
meson: add missing semicolon in pthread_condattr_setclock test
thread-win32: replace CRITICAL_SECTION with SRWLOCK
target/i386/tcg: fix decoding of MOVBE and CRC32 in 16-bit mode
accel/mshv: return correct errno value from ioeventfd failure
accel/mshv: fix ioeventfd deassignment to forward correct datamatch value
target/i386/mshv: Fix segment regression in MMIO emu
meson: Don't require nm for non-modular builds
storage-daemon: use same link arguments as other tools
util: Remove unused sys/param.h
util: Remove unused dirent.h
osdep: Remove unused strings.h
hw/ppc: Use glib2 instead of strcasecmp/strncasecmp
target/xtensa: Use glib2 instead of strcasecmp/strncasecmp
target/ppc: Use glib2 instead of strcasecmp/strncasecmp
target/riscv: Use glib2 instead of strcasecmp/strncasecmp
target/sparc: Use glib2 instead of strcasecmp/strncasecmp
io: Use glib2 instead of strcasecmp/strncasecmp
block: Use glib2 instead of strcasecmp/strncasecmp
...
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Stefan Hajnoczi [Fri, 24 Apr 2026 00:51:23 +0000 (20:51 -0400)]
Merge tag 'pull-target-arm-20260423' of https://gitlab.com/pm215/qemu into staging
target-arm queue:
* virt: Allow user to specify cache topology
* target/arm: Move OMAP CP15 register definitions to cpregs-omap.c
* target/arm: cleanups for single-binary work
* MAINTAINERS: remove people who are no longer active in the project
Marco Liebel [Thu, 22 Jan 2026 22:34:23 +0000 (14:34 -0800)]
target/hexagon: Change DisasContext packet type
The pkt variable inside DisasContext is of type Packet * and gets
assigned to a local variable in decode_and_translate_packet. Right now
there seems to be no problem with it but future changes to e.g.
hexagon_tr_transalte_packet are potentially dangerous if pkt is accessed
after the local variable goes out of scope.
Since packets are being translated one at a time, the type of pkt can be
changed to just Packet to avoid risk of having a dangling pointer.
Signed-off-by: Marco Liebel <marco.liebel@oss.qualcomm.com> Reviewed-by: Brian Cain <brian.cain@oss.qualcomm.com> Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>
Signed-off-by: Taylor Simpson <ltaylorsimpson@gmail.com> Reviewed-by: Anton Johansson <anjo@rev.ng> Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>
Brian Cain [Tue, 17 Feb 2026 21:22:44 +0000 (14:22 -0700)]
tests/tcg/hexagon: Add test for revision-gated instruction decoding
Add check_rev_gating, a linux-user test that verifies the decoder
rejects instructions from a newer CPU revision than the one selected
by the ELF binary's e_flags.
Co-authored-by: Taylor Simpson <ltaylorsimpson@gmail.com> Co-authored-by: Matheus Tavares Bernardino <matheus.bernardino@oss.qualcomm.com> Reviewed-by: Marco Liebel <marco.liebel@oss.qualcomm.com> Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>
Taylor Simpson [Tue, 17 Feb 2026 21:22:43 +0000 (14:22 -0700)]
Hexagon (target/hexagon) Disassembly of invalid packets
We pass the Hexagon CPU definition to disassemble_hexagon. This allows
decode_packet to know if the opcodes are supported.
Note that we print valid instructions in a packet when one or more is
invalid. Rather than this
0x0002128c: 0x1eae4fec { <invalid>
0x00021290: 0x1c434c04 <invalid>
0x00021294: 0x1e03edf0 <invalid> }
We print this
0x0002128c: 0x1eae4fec { <invalid>
0x00021290: 0x1c434c04 V4.w = vadd(V12.w,V3.w)
0x00021294: 0x1e03edf0 V16 = V13 }
Co-authored-by: Matheus Tavares Bernardino <matheus.bernardino@oss.qualcomm.com> Co-authored-by: Brian Cain <brian.cain@oss.qualcomm.com> Signed-off-by: Taylor Simpson <ltaylorsimpson@gmail.com> Reviewed-by: Anton Johansson <anjo@rev.ng> Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>
Taylor Simpson [Tue, 17 Feb 2026 21:22:42 +0000 (14:22 -0700)]
Hexagon (target/hexagon) Check each opcode against current CPU definition
During decoding, check that the opcode is supported in the current
Hexagon CPU definition
Co-authored-by: Matheus Tavares Bernardino <matheus.bernardino@oss.qualcomm.com> Co-authored-by: Brian Cain <brian.cain@oss.qualcomm.com> Signed-off-by: Taylor Simpson <ltaylorsimpson@gmail.com> Reviewed-by: Anton Johansson <anjo@rev.ng> Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>
Table that records which CPU revision introduced or removed
for each opcode
Co-authored-by: Brian Cain <brian.cain@oss.qualcomm.com> Co-authored-by: Taylor Simpson <ltaylorsimpson@gmail.com> Signed-off-by: Taylor Simpson <ltaylorsimpson@gmail.com> Reviewed-by: Anton Johansson <anjo@rev.ng> Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>
Taylor Simpson [Tue, 17 Feb 2026 21:22:40 +0000 (14:22 -0700)]
Hexagon (target/hexagon) Add Hexagon definition field to DisasContext
Initialize the field in hexagon_tr_init_disas_context
Co-authored-by: Matheus Tavares Bernardino <matheus.bernardino@oss.qualcomm.com> Co-authored-by: Brian Cain <brian.cain@oss.qualcomm.com> Signed-off-by: Taylor Simpson <ltaylorsimpson@gmail.com> Reviewed-by: Anton Johansson <anjo@rev.ng> Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>
Taylor Simpson [Tue, 17 Feb 2026 21:22:39 +0000 (14:22 -0700)]
Hexagon (linux-user/hexagon) Identify Hexagon version in ELF file
Return proper Hexagon CPU version from get_elf_cpu_model
Co-authored-by: Matheus Tavares Bernardino <matheus.bernardino@oss.qualcomm.com> Co-authored-by: Brian Cain <brian.cain@oss.qualcomm.com> Signed-off-by: Taylor Simpson <ltaylorsimpson@gmail.com> Reviewed-by: Anton Johansson <anjo@rev.ng> Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>
Taylor Simpson [Tue, 17 Feb 2026 21:22:38 +0000 (14:22 -0700)]
Hexagon (target/hexagon) Properly handle Hexagon CPU version
Add the following CPU versions that were previously missing
v5
v55
v60
v61
v62
v65
Create a CPUHexagonDef struct to represent the definition of a core
Currently contains an enum with the known Hexagon CPU versions
Add a field to HexagonCPUClass to note the Hexagon definition
Co-authored-by: Matheus Tavares Bernardino <matheus.bernardino@oss.qualcomm.com> Co-authored-by: Brian Cain <brian.cain@oss.qualcomm.com> Signed-off-by: Taylor Simpson <ltaylorsimpson@gmail.com> Reviewed-by: Anton Johansson <anjo@rev.ng> Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>
Junjie Cao [Mon, 20 Apr 2026 20:13:16 +0000 (04:13 +0800)]
migration/file: switch file_write_ramblock_iov to pwritev_all
file_write_ramblock_iov() uses single-shot qio_channel_pwritev() and
only checks for ret < 0. A short write (0 <= ret < requested) would be
treated as success.
Switch to qio_channel_pwritev_all() which retries until all bytes are
written or an error occurs.
Junjie Cao [Mon, 20 Apr 2026 20:13:15 +0000 (04:13 +0800)]
migration/qemu-file: switch buffer_at functions to positioned I/O _all helpers
qemu_put_buffer_at() and qemu_get_buffer_at() have the same pattern as
the bug fixed in multifd_file_recv_data(): the ssize_t return value from
the channel layer is stored in a size_t variable, and a short transfer
would be mishandled rather than retried.
Switch to qio_channel_pwrite_all() / qio_channel_pread_all() which
handle short transfers internally and make the code more robust and
consistent with the rest of the positioned I/O call sites.
Fixes: 7f5b50a401 ("migration/qemu-file: add utility methods for working with seekable channels") Signed-off-by: Junjie Cao <junjie.cao@intel.com> Reviewed-by: Peter Xu <peterx@redhat.com> Link: https://lore.kernel.org/qemu-devel/20260420201317.30199-2-junjie.cao@intel.com Signed-off-by: Fabiano Rosas <farosas@suse.de>
tests/qtest/migration: fix fd leak in ufd_version_check
ufd_version_check() opens a userfaultfd via uffd_open() but never closes
it on any path where the open succeeded: the UFFDIO_API failure path,
the missing-ioctls path, and the success path all returned without
calling close(ufd).
Convert to a goto-out pattern consistent with uffd_open() used in
util/userfaultfd.c and migration/postcopy-ram.c, ensuring the fd is
always closed before returning.
Junjie Cao [Mon, 13 Apr 2026 21:45:49 +0000 (05:45 +0800)]
tests/unit: add pread/pwrite _all tests for io channel file
Add unit tests for the new qio_channel_pread{v,}_all{,_eof}() and
qio_channel_pwrite{v,}_all() APIs.
The basic tests write data to a file channel, then read it back at
various offsets using both the single-buffer and iovec variants to
make sure the round-trip produces identical content. The _eof tests
verify all three return cases -- full read (1), clean EOF (0), and
partial-then-EOF (-1 with error set) -- and check that the strict
wrappers (preadv_all / pread_all) treat a clean EOF as an error.
All tests are guarded by CONFIG_PREADV since the underlying channel
methods require preadv(2).
Signed-off-by: Junjie Cao <junjie.cao@intel.com> Reviewed-by: Fabiano Rosas <farosas@suse.de> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Acked-by: Daniel P. Berrangé <berrange@redhat.com> Link: https://lore.kernel.org/qemu-devel/20260413214549.926435-5-junjie.cao@intel.com Signed-off-by: Fabiano Rosas <farosas@suse.de>
Junjie Cao [Mon, 13 Apr 2026 21:45:48 +0000 (05:45 +0800)]
migration/file: fix type mismatch and NULL deref in multifd_file_recv_data
multifd_file_recv_data() stores the return value of qio_channel_pread()
(ssize_t) in a size_t variable. On I/O error the -1 return value wraps
to SIZE_MAX, producing a nonsensical read size in the error message.
More critically, a short read (0 <= ret < data->size) is possible when
the migration file is truncated. In that case qio_channel_pread()
returns a non-negative value without setting *errp. The function then
calls error_prepend(errp, ...) which dereferences *errp -- a NULL
pointer -- crashing QEMU.
Fix both issues by switching to qio_channel_pread_all() introduced in
a previous patch, which retries on short reads and treats end-of-file
as an error, so the caller no longer needs to check the byte count
manually. Add ERRP_GUARD() so that error_prepend() works correctly
even when errp is &error_fatal or NULL.
Fixes: a49d15a38d3d ("migration/multifd: Support incoming mapped-ram stream format") Suggested-by: Peter Xu <peterx@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Signed-off-by: Junjie Cao <junjie.cao@intel.com> Reviewed-by: Fabiano Rosas <farosas@suse.de> Link: https://lore.kernel.org/qemu-devel/20260413214549.926435-4-junjie.cao@intel.com Signed-off-by: Fabiano Rosas <farosas@suse.de>
qio_channel_pread() and qio_channel_preadv() perform a single
positioned read and may return a short result. Callers that need all
bytes currently have to open-code a retry loop or simply treat a short
read as an error.
Introduce four new helpers following the existing read_all / readv_all
pattern:
qio_channel_preadv_all_eof() -- retry loop; returns 1 on success,
0 on clean EOF, -1 on error.
qio_channel_preadv_all() -- wraps _eof; treats early EOF as
error; returns 0 / -1.
qio_channel_pread_all_eof() -- single-buffer convenience wrapper
around preadv_all_eof().
qio_channel_pread_all() -- single-buffer convenience wrapper
around preadv_all().
These advance the file offset internally after each partial read.
All four are marked coroutine_mixed_fn, consistent with the existing
_all helpers.
Suggested-by: Peter Xu <peterx@redhat.com> Signed-off-by: Junjie Cao <junjie.cao@intel.com> Reviewed-by: Fabiano Rosas <farosas@suse.de> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Acked-by: Daniel P. Berrangé <berrange@redhat.com> Link: https://lore.kernel.org/qemu-devel/20260413214549.926435-2-junjie.cao@intel.com Signed-off-by: Fabiano Rosas <farosas@suse.de>
migration: validate page_size in mapped-ram header before use
mapped_ram_read_header() reads page_size from the migration stream and
stores it in MappedRamHeader, but does not validate that the value is
non-zero before it is later used in parse_ramblock_mapped_ram():
num_pages = length / header.page_size;
If a corrupted or malformed migration stream provides invalid, guest
resumes either with corrupted memory or crashes unexpectedly (eg.
page_size = 0)
Add validation in mapped_ram_read_header() to reject invalid page_size
values early and return an error instead of continuing with an invalid
header.
Steps to reproduce:
Create a migration snapshot with mapped-ram enabled:
(qemu) migrate_set_capability mapped-ram on
(qemu) migrate file:/tmp/qemu-snapshots/snapshot.bin
Modify the snapshot so that MappedRamHeader.page_size becomes diff with
target psize. (0/512/8192/1GB).
Restore the snapshot:
(qemu) migrate_set_capability mapped-ram on
(qemu) migrate_incoming file:/tmp/qemu-snapshots/snapshot.bin
tests/unit/test-vmstate: add tests for VMS_ARRAY_OF_POINTER_AUTO_ALLOC
Add tests for VMSTATE_VARRAY_OF_POINTER_TO_STRUCT_UINT32_ALLOC.
Signed-off-by: Alexander Mikhalitsyn <aleksandr.mikhalitsyn@futurfusion.io>
[peterx: Removed two tests due to macro not used, rebase, fix warning] Signed-off-by: Peter Xu <peterx@redhat.com> Reviewed-by: Juraj Marcin <jmarcin@redhat.com> Link: https://lore.kernel.org/qemu-devel/20260401202844.673494-12-peterx@redhat.com Signed-off-by: Fabiano Rosas <farosas@suse.de>
vmstate: Stop checking size for nullptr compression
The NULL pointer marker code applies only to VMS_ARRAY_OF_POINTER,
where the size is never NULL. Move the setting of is_null under
VMS_ARRAY_OF_POINTER, so we can stop checking the size.
Introduce a new flag, VMS_ARRAY_OF_POINTER_AUTO_ALLOC, for VMSD field. It
must be used together with VMS_ARRAY_OF_POINTER.
It can be used to allow migration of an array of pointers where the
pointers may point to NULLs.
Note that we used to allow migration of a NULL pointer within an array that
is being migrated. That corresponds to the code around vmstate_info_nullptr
where we may get/put one byte showing that the element of an array is NULL.
That usage is fine but very limited, it's because even if it will migrate a
NULL pointer with a marker, it still works in a way that both src and dest
QEMUs must know exactly which elements of the array are non-NULL, so
instead of dynamically loading an array (which can have NULL pointers), it
actually only verifies the known NULL pointers are still NULL pointers
after migration.
Also, in that case since dest QEMU knows exactly which element is NULL,
which is not NULL, dest QEMU's device code will manage all allocations for
the elements before invoking vmstate_load_vmsd().
That's not enough per evolving needs of new device states that may want to
provide real dynamic array of pointers, like what Alexander proposed here
with the NVMe device migration:
Reviewed-by: Alexander Mikhalitsyn <aleksandr.mikhalitsyn@futurfusion.io> Tested-by: Alexander Mikhalitsyn <aleksandr.mikhalitsyn@futurfusion.io> Signed-off-by: Peter Xu <peterx@redhat.com> Reviewed-by: Juraj Marcin <jmarcin@redhat.com> Link: https://lore.kernel.org/qemu-devel/20260401202844.673494-10-peterx@redhat.com Signed-off-by: Fabiano Rosas <farosas@suse.de>
Peter Xu [Wed, 1 Apr 2026 20:28:41 +0000 (16:28 -0400)]
vmstate: Implement load of ptr marker in vmstate core
The loader side of ptr marker is pretty straightforward, instead of playing
the inner_field trick, just do the load manually assuming the marker layout
is a stable ABI (which it is true already).
This will remove some logic while loading VMSD, and hopefully it makes it
slightly easier to read. Unfortunately, we still need to keep the sender
side because of the JSON blob we're maintaining..
This paves way for future processing of non-NULL markers as well.
When at it, not check "size" anymore for existing NULL markers, and move it
under the same VMS_ARRAY_OF_POINTER section because that's the only place
that NULL marker can happen (which guarantess size==host ptr size, which is
non-zero).
Reviewed-by: Fabiano Rosas <farosas@suse.de> Reviewed-by: Alexander Mikhalitsyn <aleksandr.mikhalitsyn@futurfusion.io> Signed-off-by: Peter Xu <peterx@redhat.com> Reviewed-by: Juraj Marcin <jmarcin@redhat.com> Link: https://lore.kernel.org/qemu-devel/20260401202844.673494-9-peterx@redhat.com Signed-off-by: Fabiano Rosas <farosas@suse.de>
Introduce a helper to do both the JSON blob generations and save vmstate.
This further shrinks the function a bit. More importantly, we'll need to
save two fields in one loop very soon in the future with the JSON blob.
Reviewed-by: Alexander Mikhalitsyn <aleksandr.mikhalitsyn@futurfusion.io> Reviewed-by: Fabiano Rosas <farosas@suse.de> Signed-off-by: Peter Xu <peterx@redhat.com> Reviewed-by: Juraj Marcin <jmarcin@redhat.com> Link: https://lore.kernel.org/qemu-devel/20260401202844.673494-7-peterx@redhat.com Signed-off-by: Fabiano Rosas <farosas@suse.de>
Peter Xu [Wed, 1 Apr 2026 20:28:37 +0000 (16:28 -0400)]
vmstate: Update max_elems early and check field compressable once
QEMU has a trick in vmstate_save_vmsd_v(), where it will try to compress
multiple JSON entries into one with a count to avoid duplicated entries.
That only applies to the cases where vmsd_can_compress() should return
true. For example, vmsd_desc_field_start() later (who will take the
updated max_elems as the last parameter) will ignore the value passed in
when vmsd_can_compress() returns false.
Do that check once at the start of loop, and use it to update max_elems, so
that max_elems keeps 1 for uncompressable VMSD fields, which is more
straightforward.
This also paves way to make this counter work for ptr marker VMSD fields
too.
No functional change intended in this patch alone.
Reviewed-by: Fabiano Rosas <farosas@suse.de> Reviewed-by: Alexander Mikhalitsyn <aleksandr.mikhalitsyn@futurfusion.io> Signed-off-by: Peter Xu <peterx@redhat.com> Reviewed-by: Juraj Marcin <jmarcin@redhat.com> Link: https://lore.kernel.org/qemu-devel/20260401202844.673494-5-peterx@redhat.com Signed-off-by: Fabiano Rosas <farosas@suse.de>
Trieu Huynh [Sat, 28 Mar 2026 12:12:14 +0000 (21:12 +0900)]
migration: fix QIOChannelFile leak on error in file_connect_outgoing
Commit 03a680c978 changed g_autoptr(QIOChannelFile) to a plain pointer
but failed to restore the necessary object_unref() calls on error paths.
Previously, these were handled implicitly by the g_autoptr cleanup
mechanism.
Two error paths currently leak the QIOChannelFile object and its
underlying file descriptor:
1. When ftruncate() fails (e.g., on character or block devices).
2. When qio_channel_io_seek() fails after the channel is created.
In environments that retry migration automatically (e.g., libvirt),
these FDs accumulate until QEMU hits RLIMIT_NOFILE and fails with
EMFILE (Too many open files).
Add the missing object_unref() calls to both error paths to ensure
resources are properly released.
migration: introduce vmstate_load_vmsd() and vmstate_save_vmsd()
Introduce new APIs, returning bool.
The analysis
https://lore.kernel.org/qemu-devel/aQDdRn8t0B8oE3gf@x1.local/
shows, that vmstate_load_state() return value actually only
used to check for success, specific errno values doesn't make
sense.
With this commit we introduce new functions with modern bool
interface, and in following commits we'll update the
code base to use them, starting from migration/ code, and
finally we will remove old vmstate_load_state() and
vmstate_save_state().
This patch reworks existing functions to new one, so that
old interfaces are simple wrappers, which will be easy to
remove later.
To simplify further changes (convertion to bool+errp APIs),
let's rework some error paths:
- get rid of int ret in traces, as we are moving to bool+errp APIs
- split traces to _fail / _success (seems better than add boolean
result to the message).
- prefer short error paths (return immediately on error)
- around trace_vmstate_load_field_error(), do not call
qemu_file_set_error(), if the erroc comes from qemu_file_get_error()
All other handlers now have _errp() variants. Should we go this way
for .post_save()? Actually it's rather strange, when the vmstate do
successful preparations in .pre_save(), then successfully save all
sections and subsections, end then fail when all the state is
successfully transferred to the target.
Happily, we have only three .post_save() realizations, all always
successful. Let's make this a rule.
Also note, that we call .post_save() in two places, and handle
its (theoretical) failure inconsistently. Fix that too.
We may call error_setg twice on same errp if inner
vmstate_save_state_v() or vmstate_save_state() call fails. Next we will
crash on assertion in error_setv().
tests/functional: Make socat wait longer in migration exec test
The migration_with_exec test is failing sporadically for all
architectures due to a race when the destination socat process takes
too long to start listening while the source process is already
issuing connect().
The race is inherent because the exec: migration spawns the
to-be-exec'ed command asynchronously and returns from the
migrate-incoming command. The localhost-only testcase is not
representative of the majority of migrations. In a real scenario
between two different hosts that race wouldn't happen.
Fix the testcase by configuring the source socat command to wait
indefinitely while trying to connect.
While sanity checking a create blob operation the use of the auto
freed res variable could lead to inadvertently freeing an existing
blob.
Avoid this by in-lining the virtio_gpu_virgl_find_resource() check as
the value is not needed anyway.
While at it add a comment to the end and use g_steal_pointer to make
it clearer the object lifetime exceeds the function bounds if we pass
all the checks.
Anthony Roberts [Thu, 9 Apr 2026 11:02:55 +0000 (12:02 +0100)]
ui/sdl2: Fix assumption of EGL presence at runtime
The original commit had a section of code which worked on the assumption
that if OpenGL was enabled at build, it was present on the end user machine,
and calls could be made to it. This is not always the case (such as Windows
on Arm devices).
This line should have also included a runtime check.
This commit moves the relevant line to inside a runtime check for OpenGL.
Fixes: 52053b7e0a0e ("ui/sdl2: Implement dpy dmabuf functions")
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3347 Cc: qemu-stable@nongnu.org Signed-off-by: Anthony Roberts <anthony.roberts@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20260409110256.684-1-anthony.roberts@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
checkpatch: Allow spaces after all coroutine annotations
The coroutine annotations may be used in the declaration of function
pointers, which triggers checkpatch due to the space before the
parentheses. E.g:
int coroutine_fn (*run)(Job *job, Error **errp);
^
The coroutine_fn annotation is already included in the list of terms
where spaces are allowed. Add the other coroutine annotations:
coroutine_mixed_fn and no_coroutine_fn.
Bin Guo [Tue, 31 Mar 2026 06:07:31 +0000 (14:07 +0800)]
memory: Optimize flatview_simplify() to eliminate redundant memmove calls
The original flatview_simplify() implementation uses memmove() to shift
array elements after each merge operation, resulting in O(n²) time
complexity in the worst case. This is inefficient for VMs with large
memory topologies containing hundreds of MemoryRegions.
Replace the memmove-based approach with a two-pointer in-place compression
algorithm that achieves O(n) time complexity. The new algorithm uses a
write pointer i and a read pointer j, where i ≤ j is always maintained.
This invariant ensures we never overwrite unprocessed data, making memmove
unnecessary.
Paolo Bonzini [Mon, 30 Mar 2026 14:17:15 +0000 (16:17 +0200)]
thread-win32: replace CRITICAL_SECTION with SRWLOCK
SRWLOCK is a much cheaper primitive than CRITICAL_SECTION, which
basically exists only as a legacy API. The SRWLOCK is a single word
in memory and it is cheaper to just initialize it always.
Reviewed-by: Kostiantyn Kostiuk <kkostiuk@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
However, this is incorrect. Both MOVBE and (for 0xF1) CRC32
take Gv, Ev or Mv operands. In 16-bit mode therefore the
operand is of 16-bit size without prefix and 32-bit mode
with 0x66 (the data size override).
accel/mshv: return correct errno value from ioeventfd failure
Returning the raw ioctl return value results in misleading error
message. Ensure that actual failure reason is propagated by returning
-errno for ioeventfd failure.
accel/mshv: fix ioeventfd deassignment to forward correct datamatch value
unregister_ioevent() is not forwarding the datamatch (queue index) to
the mshv driver, causing only the first VirtIO-MMIO queue to be
deassigned correctly. Subsequent queues fail with `-ENOENT`, triggering
a fatal abort().
This failure was discovered while booting arm64 EDK2 firmware with mshv
accel.
Magnus Kulke [Fri, 10 Apr 2026 14:26:52 +0000 (16:26 +0200)]
target/i386/mshv: Fix segment regression in MMIO emu
When the segmentation code has been reworked, there is now an
unconditional call to emul_ops->read_segment_descriptor(). The MSHV impl
was delegating this to x86_read_segement_descriptor(), which read from
the GDT in guest memory. This fails for selector.idx == 0 and when no
GDT is set up (which is the case in real mode).
In the fix we change the MSHV impl to fill segment descriptor from
SegmentCache, that was populated from the hypervisor by mshv_load_regs()
before instruction emulation.
We dropped the use of PATH_MAX in commit f3a8bdc1d5b26 (which
basically completely rewrote the path handling).
Now we don't need any sys/param.h defines.
hw/ppc: Use glib2 instead of strcasecmp/strncasecmp
This is a change in semantics. g_ascii_strcasecmp() doesn't honour
locale but strcasecmp() does. But this is OK for at least one reason:
(1) QEMU always runs with the C locale so there's not an actual
behaviour change here
target/xtensa: Use glib2 instead of strcasecmp/strncasecmp
This is a change in semantics. g_ascii_strcasecmp() doesn't honour
locale but strcasecmp() does. But this is OK for at least one reason:
(1) QEMU always runs with the C locale so there's not an actual
behaviour change here
target/ppc: Use glib2 instead of strcasecmp/strncasecmp
This is a change in semantics. g_ascii_strcasecmp() doesn't honour
locale but strcasecmp() does. But this is OK for at least one reason:
(1) QEMU always runs with the C locale so there's not an actual
behaviour change here
target/riscv: Use glib2 instead of strcasecmp/strncasecmp
This is a change in semantics. g_ascii_strcasecmp() doesn't honour
locale but strcasecmp() does. But this is OK for at least one reason:
(1) QEMU always runs with the C locale so there's not an actual
behaviour change here
Signed-off-by: Kostiantyn Kostiuk <kkostiuk@redhat.com> Reviewed-by: Chao Liu <chao.liu.zevorn@gmail.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Link: https://lore.kernel.org/r/20260327134401.270186-8-kkostiuk@redhat.com Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
target/sparc: Use glib2 instead of strcasecmp/strncasecmp
This is a change in semantics. g_ascii_strcasecmp() doesn't honour
locale but strcasecmp() does. But this is OK for at least one reason:
(1) QEMU always runs with the C locale so there's not an actual
behaviour change here
(2) we want the comparison on boolean property value to be a plain
ASCII one, not to do weird things with "I" in Turkish locales,
so g_ascii_strcasecmp() is better as it's explicit about that
This is a change in semantics. g_ascii_strcasecmp() doesn't honour
locale but strcasecmp() does. But this is OK for at least one reason:
(1) QEMU always runs with the C locale so there's not an actual
behaviour change here
(2) we want the comparison data in HTTP header and it should be a plain
ASCII one, not to do weird things with "I" in Turkish locales,
so g_ascii_strcasecmp() is better as it's explicit about that
block: Use glib2 instead of strcasecmp/strncasecmp
This is a change in semantics. g_ascii_strcasecmp() doesn't honour
locale but strcasecmp() does. But this is OK for at least one reason:
(1) QEMU always runs with the C locale so there's not an actual
behaviour change here
(2) we want the comparison on url prefix and it should be a plain ASCII
one, not to do weird things with "I" in Turkish locales,
so g_ascii_strcasecmp() is better as it's explicit about that
This is a change in semantics. g_ascii_strcasecmp() doesn't honour
locale but strcasecmp() does. But this is OK for at least one reason:
(1) QEMU always runs with the C locale so there's not an actual
behaviour change here
(2) we want the comparison on class names to be a plain ASCII
one, not to do weird things with "I" in Turkish locales,
so g_ascii_strcasecmp() is better as it's explicit about that
POSIX says stddef.h provides size_t, which is the only thing
we care about here. unistd.h can be missing in non-POSIX runtimes,
so include stddef.h instead.
hw: i386: vapic: restore IRQ polling for non-kernel irqchip backends
69dfc078 extended vAPIC handling for WHPX with user-mode irqchip, but it
also changed vapic_write() case 4 in a way that excludes TCG from
apic_poll_irq().
Before that change, IRQ polling happened whenever no in-kernel irqchip
was active. After the change, it only happened for KVM or WHPX with a
user-mode irqchip. Under TCG, both kvm_enabled() and whpx_enabled() are
false, so the poll never happens.
This regresses 32-bit Windows XP guests on a Windows host with
-machine pc-i440fx-10.0,accel=tcg, causing a STOP 0x0000000A during boot.
Fix it by making the decision depend on whether KVM or WHPX is using an
in-kernel irqchip, instead of whether either accelerator is enabled.
Fixes: 69dfc078a6f0 ("hw: i386: vapic: enable on WHPX with user-mode irqchip") Signed-off-by: rickgcn <rickgcn@gmail.com> Link: https://lore.kernel.org/r/20260418061429.16898-1-rickgcn@gmail.com Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Simon Scherer [Mon, 13 Apr 2026 11:56:22 +0000 (13:56 +0200)]
target/i386: fix missing PF_INSTR in SIGSEGV context
When running linux-user emulation, the SIGSEGV handler does not
correctly set the 4th bit (PF_INSTR) in the error_code variable of
the context argument (context->uc_mcontext.gregs[REG_ERR]).
Because this bit is never set, guest applications cannot distinguish
if a fault was due to missing executable permissions. This patch
ensures that when a page fault occurs during an instruction fetch,
the PF_INSTR flag is properly populated in the signal context.
target/i386: fix strList leak in x86_cpu_get_unavailable_features
The result list built by x86_cpu_list_feature_names() was never freed
after being visited, causing a memory leak detected by ASan.
(the getter visitor is VISITOR_OUTPUT kind and doesn't own data)
Peter Maydell [Thu, 16 Apr 2026 09:16:54 +0000 (10:16 +0100)]
MAINTAINERS: Remove Xie Changlong
Xie Changlong has not posted to qemu-devel in some years and did not
respond to a query about whether they still wished to be listed in
our MAINTAINERS file. Remove them, on the assumption that they are
no longer active in QEMU.
This makes the "Replication" block filter orphan.
Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Lukas Straub <lukasstraub2@web.de>
Message-id: 20260416091654.316158-29-peter.maydell@linaro.org
Peter Maydell [Thu, 16 Apr 2026 09:16:53 +0000 (10:16 +0100)]
MAINTAINERS: Remove Xiao Guangrong
Xiao Guangrong has not posted to qemu-devel in some years and did not
respond to a query about whether they still wished to be listed in
our MAINTAINERS file. Remove them, on the assumption that they are
no longer active in QEMU.
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20260416091654.316158-28-peter.maydell@linaro.org
Peter Maydell [Thu, 16 Apr 2026 09:16:52 +0000 (10:16 +0100)]
MAINTAINERS: Remove Wen Congyang
Wen Congyang has not posted to qemu-devel in some years and did not
respond to a query about whether they still wished to be listed in
our MAINTAINERS file. Remove them, on the assumption that they are
no longer active in QEMU.
Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Lukas Straub <lukasstraub2@web.de>
Message-id: 20260416091654.316158-27-peter.maydell@linaro.org
Peter Maydell [Thu, 16 Apr 2026 09:16:51 +0000 (10:16 +0100)]
MAINTAINERS: Remove Yanan Wang
Yanan Wang has not posted to qemu-devel in some years and did not
respond to a query about whether they still wished to be listed in
our MAINTAINERS file. Remove them, on the assumption that they are
no longer active in QEMU.
Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-id: 20260416091654.316158-26-peter.maydell@linaro.org
Peter Maydell [Thu, 16 Apr 2026 09:16:50 +0000 (10:16 +0100)]
MAINTAINERS: Remove Vijai Kumar K
Vijai Kumar K has not posted to qemu-devel in some years and did not
respond to a query about whether they still wished to be listed in
our MAINTAINERS file. Remove them, on the assumption that they are
no longer active in QEMU.
This makes the Shakti C class RISC-V SoC orphan.
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20260416091654.316158-25-peter.maydell@linaro.org
Peter Maydell [Thu, 16 Apr 2026 09:16:49 +0000 (10:16 +0100)]
MAINTAINERS: Remove Su Hang
Su Hang has not posted to qemu-devel in some years and did not
respond to a query about whether they still wished to be listed in
our MAINTAINERS file. Remove them, on the assumption that they are
no longer active in QEMU.
This makes the Intel Hexadecimal Object File Loader orphan.
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20260416091654.316158-24-peter.maydell@linaro.org
Peter Maydell [Thu, 16 Apr 2026 09:16:48 +0000 (10:16 +0100)]
MAINTAINERS: Remove Shannon Zhao
Shannon Zhao has not posted to qemu-devel in some years and did not
respond to a query about whether they still wished to be listed in
our MAINTAINERS file. Remove them, on the assumption that they are
no longer active in QEMU.
This makes the "ARM ACPI Subsystem" orphan.
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20260416091654.316158-23-peter.maydell@linaro.org
Peter Maydell [Thu, 16 Apr 2026 09:16:47 +0000 (10:16 +0100)]
MAINTAINERS: Remove Ryo ONODERA
Ryo ONODERA has not posted to qemu-devel in some years and did not
respond to a query about whether they still wished to be listed in
our MAINTAINERS file. Remove them, on the assumption that they are
no longer active in QEMU.
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20260416091654.316158-22-peter.maydell@linaro.org
Peter Maydell [Thu, 16 Apr 2026 09:16:46 +0000 (10:16 +0100)]
MAINTAINERS: Remove Ronnie Sahlberg
Ronnie Sahlberg has not posted to qemu-devel in some years and did not
respond to a query about whether they still wished to be listed in
our MAINTAINERS file. Remove them, on the assumption that they are
no longer active in QEMU.
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20260416091654.316158-21-peter.maydell@linaro.org
Peter Maydell [Thu, 16 Apr 2026 09:16:45 +0000 (10:16 +0100)]
MAINTAINERS: Remove Luigi Rizzo
Luigi Rizzo has not posted to qemu-devel in some years and did not
respond to a query about whether they still wished to be listed in
our MAINTAINERS file. Remove them, on the assumption that they are
no longer active in QEMU.
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20260416091654.316158-20-peter.maydell@linaro.org
Peter Maydell [Thu, 16 Apr 2026 09:16:44 +0000 (10:16 +0100)]
MAINTAINERS: Remove Qiuhao Li
Qiuhao Li has not posted to qemu-devel in some years and did not
respond to a query about whether they still wished to be listed in
our MAINTAINERS file. Remove them, on the assumption that they are
no longer active in QEMU.
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20260416091654.316158-19-peter.maydell@linaro.org
Peter Maydell [Thu, 16 Apr 2026 09:16:43 +0000 (10:16 +0100)]
MAINTAINERS: Remove Jia Liu
Jia Liu has not posted to qemu-devel in some years and did not
respond to a query about whether they still wished to be listed in
our MAINTAINERS file. Remove them, on the assumption that they are
no longer active in QEMU.
This makes the or1k-sim OpenRISC machine orphan.
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20260416091654.316158-18-peter.maydell@linaro.org
Peter Maydell [Thu, 16 Apr 2026 09:16:42 +0000 (10:16 +0100)]
MAINTAINERS: Remove Paul Burton
Paul Burton has not posted to qemu-devel in some years and did not
respond to a query about whether they still wished to be listed in
our MAINTAINERS file. Remove them, on the assumption that they are
no longer active in QEMU.
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20260416091654.316158-17-peter.maydell@linaro.org
Peter Maydell [Thu, 16 Apr 2026 09:16:41 +0000 (10:16 +0100)]
MAINTAINERS: Remove Aarushi Mehta
Aarushi Mehta has not posted to qemu-devel in some years and did not
respond to a query about whether they still wished to be listed in
our MAINTAINERS file. Remove them, on the assumption that they are
no longer active in QEMU.
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20260416091654.316158-16-peter.maydell@linaro.org
Peter Maydell [Thu, 16 Apr 2026 09:16:40 +0000 (10:16 +0100)]
MAINTAINERS: Remove Marcel Apfelbaum
Marcel Apfelbaum has not posted to qemu-devel in some years and did not
respond to a query about whether they still wished to be listed in
our MAINTAINERS file. Remove them, on the assumption that they are
no longer active in QEMU.
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20260416091654.316158-15-peter.maydell@linaro.org
Peter Maydell [Thu, 16 Apr 2026 09:16:39 +0000 (10:16 +0100)]
MAINTAINERS: Remove Magnus Damm
Magnus Damm has not posted to qemu-devel in some years and did not
respond to a query about whether they still wished to be listed in
our MAINTAINERS file. Remove them, on the assumption that they are
no longer active in QEMU.
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20260416091654.316158-14-peter.maydell@linaro.org
projects / thirdparty / qemu.git / log
