Move stubs to the global stub_ss[] source set. These files
are now built once for all binaries, instead of one time
per system binary.
Add pixman to qemuutil library dependencies since pixman is
transitively included, which is needed to be able to include
prototypes for stubs we declared:
In file included from include/ui/console.h:4,
include/ui/qemu-pixman.h:10:10: fatal error: pixman.h: No such file or directory
10 | #include <pixman.h>
| ^~~~~~~~~~
On OpenBSD, opengl headers are not available in default
include path, and thus we need to add opengl to list of
qemuutil dependencies, otherwise we get:
In file included from ../hw/display/acpi-vga-stub.c:4:
In file included from ../hw/display/vga_int.h:28:
In file included from include/ui/console.h:9:
include/ui/surface.h:11:11: fatal error: 'epoxy/gl.h' file not found
# include <epoxy/gl.h>
^~~~~~~~~~~~
1 error generated.
migrate_add_blocker() can fail (e.g. if migration is already in
progress), in which case it returns a negative value and populates
its errp argument with the reason.
The previous code ignored the return value. Pass &error_fatal so
that on failure QEMU exits cleanly with an informative error message
rather than continuing in an inconsistent state.
Fabiano Rosas [Fri, 13 Mar 2026 18:29:53 +0000 (15:29 -0300)]
tests/qtest: Don't dup machine name in qtest_cb_for_every_machine callbacks
The qtest_get_machines function caches the list of machines in a
static variable. Dup'ing the machine->name string only serves to leak
that memory when a single test is executed.
Aadeshveer Singh [Mon, 16 Mar 2026 13:45:09 +0000 (19:15 +0530)]
migration: fix implicit integer division in migration_update_counters
switchover_bw is a uint64_t, so switchover_bw / 1000 results in an
integer division. This value is then assigned to expected_bw_per_ms
which is of type double. This results in losing precision and is type
unsafe. Adding explicit cast ensures floating-point division.
Akihiko Odaki [Wed, 4 Mar 2026 06:16:57 +0000 (15:16 +0900)]
coreaudio: Commit the result of init in the end
init_out_device may only commit some part of the result and leave the
state inconsistent when it encounters a fatal error or the device gets
unplugged during the operation, which is expressed by
kAudioHardwareBadObjectError or kAudioHardwareBadDeviceError. Commit the
result in the end of the function so that it commits the result iff it
sees no fatal error and the device remains plugged.
With this change, handle_voice_change can rely on core->outputDeviceID
to know whether the output device is initialized after calling
init_out_device.
Akihiko Odaki [Wed, 4 Mar 2026 06:16:56 +0000 (15:16 +0900)]
coreaudio: Improve naming
coreaudio had names that are not conforming to QEMU codding style.
coreaudioVoiceOut also had some members that are prefixed with redundant
words like "output" or "audio".
Global names included "out" to tell they are specific to output devices,
but this rule was not completely enforced.
The frame size had three different names "frameSize", "bufferFrameSize",
and "frameCount".
Akihiko Odaki [Tue, 3 Mar 2026 13:08:56 +0000 (22:08 +0900)]
ui/surface: Avoid including epoxy/gl.h in header files
include/ui/shader.h and include/ui/surface.h are included by files that
do not depend on Epoxy so they shouldn't include epoxy/gl.h. Otherwise,
compilations of these files can fail because the path to the directory
containing epoxy/gl.h may not be passed to the compiler.
Akihiko Odaki [Tue, 3 Mar 2026 13:08:54 +0000 (22:08 +0900)]
ui/console: Unify pixman-OpenGL format mapping
console_gl_check_format() was supposed to check if the pixman format is
supported by surface_gl_create_texture(), but it missed
PIXMAN_BE_x8r8g8b8 and PIXMAN_BE_a8r8g8b8, which are properly mapped to
OpenGL formats by surface_gl_create_texture().
Fix the discrepancy of the two functions by sharing the code to map
pixman formats to OpenGL ones.
Initializing descriptor with zero is unsafe: during cleanup we risk to
unconditional close of fd == 0 in case dump state wasn't fully
initialized. Thus, let's init fd with -1 value and check its value
before closing it.
Signed-off-by: Nikolai Barybin <nikolai.barybin@virtuozzo.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-Id: <20250911123656.413160-2-nikolai.barybin@virtuozzo.com>
Dongwon Kim [Tue, 3 Mar 2026 01:11:51 +0000 (17:11 -0800)]
ui/gtk-egl: Ensure EGL surface is available before drawing
The EGL surface and context are destroyed when a new GTK window is
created. We must ensure these are recreated and initialized before
any rendering happens in gd_egl_refresh.
Currently, the check for a pending draw is performed before the
surface initialization block. This can result in an attempt to
draw when the EGL surface (vc->gfx.esurface) is not yet available.
This patch moves the drawing check after the surface initialization
to ensure a valid surface exists before rendering in gd_egl_refresh.
ui/dbus-listener: remove dbus_filter on connection close
The dbus filter holds a strong reference to the DBusDisplayListener
(via GDestroyNotify) to ensure the listener remains alive while the
filter may still be running in another thread. This creates a
reference cycle (ddl -> conn -> filter -> ddl) that prevents the
listener from being freed.
Break the cycle by connecting to the connection's "closed" signal
and removing the filter when the connection closes.
Fixes: commit fa88b85dea96 ("ui/dbus: filter out pending messages when scanout") Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
ui/dbus-listener: Fix FBO leak in dbus_cursor_dmabuf
cursor_fb is a local egl_fb that gets an FBO allocated via
egl_fb_setup_for_tex but is never destroyed, leaking the
framebuffer object on every cursor update.
Add egl_fb_destroy() after the cursor data has been read.
virtio-gpu: fix overflow check when allocating 2d image
The calc_image_hostmem() comment says pixman_image_create_bits() checks
for overflow. However, this relied on the facts that "bits" was NULL and
it performed it when it was introduced. Since commit 9462ff4695aa, the
"bits" argument can be provided and the check is no longer applied.
Promotes the computation to uint64_t and adds an explicit overflow check
to avoid potential later OOB read/write on the image data.
Fiona Ebner [Tue, 10 Mar 2026 14:25:39 +0000 (15:25 +0100)]
ui/vdagent: add migration blocker when machine version < 10.1
In QEMU 10.1, commit 5d56bff11e ("ui/vdagent: add migration support")
added migration support for the vdagent chardev and commit 42000e0013
("ui/vdagent: remove migration blocker") removed the migration
blocker. No compat for older machine versions was added, so migration
with pre-10.1 machine version, from a 10.1 binary to a pre-10.1 binary
will result in a failure when loading the VM state in the target
instance:
> Unknown savevm section or instance 'vdagent' 0. Make sure that your
> current VM setup matches your saved VM setup, including any
> hotplugged devices
Add a compat flag to block migration when the machine version is less
than 10.1 to avoid this.
rutabaga: improve error handling, fix potential crash during init
When virtio_gpu_rutabaga_get_num_capsets() returns 0, virtio_init()
isn't called and the device later crashes during realize.
==72545==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x556ad6f7ba9e bp 0x7ffe6958f810 sp 0x7ffe6958f7e0 T0)
==72545==The signal is caused by a READ memory access.
==72545==Hint: address points to the zero page.
#0 0x556ad6f7ba9e in virtio_memory_listener_commit ../hw/virtio/virtio.c:4034
#1 0x556ad6a24c96 in listener_add_address_space ../system/memory.c:3128
#2 0x556ad6a25d15 in memory_listener_register ../system/memory.c:3216
#3 0x556ad6f7bf11 in virtio_device_realize ../hw/virtio/virtio.c:4075
Rework error handling of the function to set Error appropriately. 0
capset may be ok now.
The NULL checks for be, name, callback_fn, and as in
audio_mixeng_backend_open_{in,out} are redundant: the callers
audio_be_open_{in,out} already assert that name, callback_fn, and as
are non-NULL, and dereference be unconditionally via
AUDIO_BACKEND_GET_CLASS(be) before the call.
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-Id: <20260224163229.2918858-1-marcandre.lureau@redhat.com>
Fabiano Rosas [Thu, 12 Mar 2026 20:46:19 +0000 (17:46 -0300)]
migration/options: Fix leaks in StrOrNull qdev accessors
Fix a couple of possible leaks detected by Coverity. Both are
currently harmless. This code is only used for the very specific
purpose of maintaining compatibility of a few migration options which
can be set via QEMU command line (-global migration.tls-*). The
command line interface is not supported and only used during
development and testing.
1) The setter function set_StrOrNull() is invoked whenever the -global
migration.tls-* command line options are set. The way it could leak is
that the temporary "StrOrNull *str_or_null" object is allocated before
calling the visitor, which could fail and cause an early return of the
function, leaving *ptr unset and str_or_null leaking.
2) The getter function get_StrOrNull() is unreachable code. It's only
there to provide a complete implementation of the property. Still, the
way it could leak is that the temporary "StrOrNull *str_or_null" might
be allocated and is simply never returned to the caller nor freed.
Fix the possible leaks:
1) at set_StrOrNull(): change the allocation of str_or_null to happen
only after the visit call has returned successfully.
2) at get_StrOrNull(): assert that the object is non-NULL, there is no
need for a temporary object.
The reason it should be non-NULL is that the property is initialized
by the default setter of the qdev property. The initialization is
unlikely to fail because the call to the setter is setup by qdev,
which has boilerplate ensuring the to-be-set object is allocated and
of the correct type. Moreover, passing NULL via command line to
-global migration.tls-* is not possible.
A programming error could result in an invalid call to the setter,
which would leave the object NULL and cause a crash in the getter, but
that's not a worthwhile scenario to protect against given the low
probability of this code being even reached.
While here, update the comment about why there's no QNULL in this
StrOrNull property to be more clear.
Fixes: CID 1643919 Fixes: CID 1643920 Cc: Markus Armbruster <armbru@redhat.com> Reported-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Peter Xu <peterx@redhat.com> Reviewed-by: Prasad Pandit <pjp@fedoraproject.org> Link: https://lore.kernel.org/qemu-devel/20260312204619.1969-1-farosas@suse.de Signed-off-by: Fabiano Rosas <farosas@suse.de>
Ani Sinha [Wed, 11 Mar 2026 07:01:14 +0000 (12:31 +0530)]
migration: assert that the same migration handler is not being added twice
Currently the code that adds a migration blocker does not check if the same
blocker already exists. Assert that the migration handler being added has
not been added already.
CC: Markus Armbruster <armbru@redhat.com> CC: Peter Xu <peterx@redhat.com> CC: Prasad Pandit <pjp@fedoraproject.org> Reviewed-by: Peter Xu <peterx@redhat.com> Signed-off-by: Ani Sinha <anisinha@redhat.com> Link: https://lore.kernel.org/qemu-devel/20260311070114.164434-1-anisinha@redhat.com Signed-off-by: Fabiano Rosas <farosas@suse.de>
Fabiano Rosas [Wed, 11 Mar 2026 21:34:18 +0000 (18:34 -0300)]
tests/qtest/migration: Force exit-on-error=false
Some tests can cause QEMU to exit(1) too early while the incoming
coroutine has not yielded for a first time yet. This trips ASAN
because resources related to dispatching the incoming process will
still be allocated in the io/channel.c layer without a
straight-forward way for the migration code to clean them up.
As an example of one such issue, the UUID validation happens early
enough that the temporary socket from qio_net_listener_channel_func()
still has an elevated refcount. If it fails, the listener dispatch
code never gets to free the resource:
Direct leak of 400 byte(s) in 1 object(s) allocated from:
#0 0x55e668890a07 in malloc asan_malloc_linux.cpp:68:3
#1 0x7f3c7e2b6648 in g_malloc ../glib/gmem.c:130
#2 0x55e66a8ef05f in object_new_with_type ../qom/object.c:767:15
#3 0x55e66a8ef178 in object_new ../qom/object.c:789:12
#4 0x55e66a93bcc6 in qio_channel_socket_new ../io/channel-socket.c:70:31
#5 0x55e66a93f34f in qio_channel_socket_accept ../io/channel-socket.c:401:12
#6 0x55e66a96752a in qio_net_listener_channel_func ../io/net-listener.c:64:12
#7 0x55e66a94bdac in qio_channel_fd_source_dispatch ../io/channel-watch.c:84:12
#8 0x7f3c7e2adf4b in g_main_dispatch ../glib/gmain.c:3476
#9 0x7f3c7e2adf4b in g_main_context_dispatch_unlocked ../glib/gmain.c:4284
#10 0x7f3c7e2b00c8 in g_main_context_dispatch ../glib/gmain.c:4272
The exit(1) also requires some tests to setup qtest to expect a return
code of 1 from the QEMU process. Although we can check migration
status changes to be fairly certain where the failure happened, there
is always the possibility of QEMU exiting for another reason and the
test passing. This happens frequently with sanitizers enabled, but
also risks masking issues in the regular build.
Stop allowing the incoming migration to exit and instead require the
tests to wait for the FAILED state and end QEMU gracefully with
qtest_quit.
In practice this means setting exit-on-error=false for every incoming
migration, changing MIG_TEST_FAIL_DEST_QUIT_ERR to MIG_TEST_FAIL and
waiting for a change of state where necessary.
With this, the MIG_TEST_FAIL_DEST_QUIT_ERR error result is now unused,
remove it.
Also add a comment to QEMU source explaining that the incoming
coroutine might block for a while until it yields as this is the
actual root cause of the issue.
Fabiano Rosas [Wed, 11 Mar 2026 21:34:17 +0000 (18:34 -0300)]
migration/multifd: Fix leaks of TLS error objects
The code currently ignores errors from multifd threads that happen
after a first error has already been propagated. Make sure the
subsequent errors are freed appopriately.
This fixes a leak of the TLS session->werr when the certificate
validation fails after multifd threads are already running. The first
writes on the threads will fail deep into the gnutls stack.
No need to check if(err) because the callers are all under a similar
check.
Fabiano Rosas [Wed, 11 Mar 2026 21:34:15 +0000 (18:34 -0300)]
io: Fix TLS bye task leak
Recent fixes to TLS tasks memory handling have left the TLS bye task
uncovered. Fix by freeing the task in the same way the handshake task
is freed.
Direct leak of 704 byte(s) in 4 object(s) allocated from:
#1 0x7f5909b1d6a0 in g_malloc0 ../glib/gmem.c:163
#2 0x557650496d61 in qio_task_new ../io/task.c:58:12
#3 0x557650475d7f in qio_channel_tls_bye ../io/channel-tls.c:352:12
#4 0x55764f7a1bb4 in migration_tls_channel_end ../migration/tls.c:159:5
#5 0x55764f709750 in migration_ioc_shutdown_gracefully ../migration/multifd.c:462:9
#6 0x55764f6fcf53 in multifd_send_terminate_threads ../migration/multifd.c:493:13
#7 0x55764f6fcafb in multifd_send_shutdown ../migration/multifd.c:580:5
#8 0x55764f6e1b14 in migration_cleanup ../migration/migration.c:1323:9
#9 0x55764f6f5bac in migration_cleanup_bh ../migration/migration.c:1350:5
Fixes: d39d0f3acd ("io: fix cleanup for TLS I/O source data on cancellation") Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Acked-by: Daniel P. Berrangé <berrange@redhat.com> Link: https://lore.kernel.org/qemu-devel/20260311213418.16951-3-farosas@suse.de Signed-off-by: Fabiano Rosas <farosas@suse.de>
Fabiano Rosas [Wed, 11 Mar 2026 21:34:14 +0000 (18:34 -0300)]
tests/qtest/migration: Fix leak of migration tests data
When the migration-test is invoked with the '-p' flag (to run a single
test), the glib code won't call the destroy function for the
not-executed tests, causing the MigrationTest wrapper data to leak.
This doesn't affect make check, but affects debugging use-cases where
having a leak pop up in ASAN output is extra annoying.
Fix by adding the tests data to a list and freeing them all at the end
of migration-test execution. Any tests actually dispatched by glib
will have the destroy function called as usual.
Note that migration_test_add_suffix() is altered to call
migration_test_add() so that there's only one place adding the data to
the list.
Performance is not an issue at the moment, we have < 100 tests.
Fiona Ebner [Wed, 11 Mar 2026 14:54:25 +0000 (15:54 +0100)]
block/mirror: fix assertion failure upon duplicate complete for job using 'replaces'
If s->replace_blocker was already set by an earlier invocation of
mirror_complete(), then there will be an assertion failure when
error_setg() is called for it a second time. The bdrv_op_block_all()
and bdrv_ref() operations should only be done a single time too.
Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
Message-Id: <20260311145717.668492-2-f.ebner@proxmox.com> Reviewed-by: Hanna Czenczek <hreitz@redhat.com> Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
Paolo Bonzini [Sat, 14 Mar 2026 07:50:51 +0000 (08:50 +0100)]
rust: fix build when --disable-rust and meson < 1.9
Commit e65030ed50ee moved rust_std and build.rust_std from per-target
override_options into the project's default_options, in order to avoid
repetition. However, default_options are validated unconditionally at
project initialization, even when Rust is disabled. This breaks builds
with meson < 1.9.0 which does not know about "build.rust_std":
Pierrick Bouvier [Fri, 13 Mar 2026 06:34:41 +0000 (23:34 -0700)]
contrib/plugins/uftrace.c: fix depth for exit events
Uftrace plugin was recording wrong depth for exit events, resulting in
incoherent traces, especially for partial ones.
Thanks to Honggyu Kim, one of the original author of uftrace, who
spotted the issue.
https://github.com/namhyung/uftrace/pull/2031#issuecomment-4051762627
Alberto Garcia [Thu, 12 Mar 2026 12:12:00 +0000 (13:12 +0100)]
throttle-group: Fix race condition in throttle_group_restart_queue()
When a timer is fired a pending I/O request is restarted and
tg->any_timer_armed is reset so other requests can be scheduled.
However we're resetting any_timer_armed first in timer_cb() before
the request is actually restarted, and there's a window between both
moments in which another thread can arm the same timer, hitting an
assertion in throttle_group_restart_queue().
This can be solved by deferring the reset of tg->any_timer_armed to
the moment when the queue is actually restarted, which is protected by
tg->lock, preventing other threads from arming the timer before that.
In addition to that, throttle_group_restart_tgm() is also updated to
hold tg->lock while the timer is being inspected. Here we consider
three different scenarios:
- If the tgm has a timer set, fire it immediately
- If another tgm has a timer set, restart the queue anyway
- If there is no timer set in this group then simulate a timer that
fires immediately, by setting tg->any_timer_armed in order to
prevent other threads from arming a timer in the meantime.
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3194 Signed-off-by: Alberto Garcia <berto@igalia.com>
Message-Id: <825598ef34ad384d936da19d634eda75598508f7.1773316842.git.berto@igalia.com> Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
* tag 'pull-trivial-patches' of https://gitlab.com/mjt0k/qemu:
rename CONFIG_EPOLL_CREATE1 to CONFIG_EPOLL, and stop checking for epoll in meson.build
meson.build: do not check for epoll.h (CONFIG_EPOLL)
linux-user: assume epoll is always present
meson.build: stop checking for inotify_init()
linux-user: assume inotify sycalls are always present
meson.build: stop checking for splice()
linux-user/syscall.c: assume splice is always present
docs: Move xbzrle.txt into the migration folder and convert to rst
target/i386: fix NULL pointer dereference in legacy-cache=off handling
hw/usb/core.c: reorder usage and assertion of p->ep
system/physmem.c: remove useless assertion of block
dump/dump.c: reorder usage and assertion of block
migration/savevm.c: reorder usage and assertion of mis->from_src_file
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Peter Maydell [Mon, 16 Mar 2026 13:07:17 +0000 (13:07 +0000)]
Merge tag 'pull-target-arm-20260316' of https://gitlab.com/pm215/qemu into staging
target-arm queue:
* hw/net/rtl8319: Work around GCC sanitizer / -Wstringop-overflow bug
* semihosting: Correctly byteswap data when CPU is in big-endian mode
* hw/dma/pl080: Fix various minor bugs
* MAINTAINERS: Remove some no-longer active maintainers
* tests/qtest: Use g_strdup_printf() in various arm tests
* tag 'pull-target-arm-20260316' of https://gitlab.com/pm215/qemu:
tests/qtest/aspeed_gpio-test: Use g_strdup_printf() instead of char arrays
tests/qtest/ast2700-gpio-test: Use g_strdup_printf() instead of char arrays
tests/qtest/arm-cpu-features: Use g_strdup_printf() instead of char arrays
tests/qtest/ast2700-sgpio-test: Use g_strdup_printf() instead of char arrays
MAINTAINERS: Remove Chris Browy
MAINTAINERS: Remove Andrey Smirnov
MAINTAINERS: Remove Radoslaw Biernacki
MAINTAINERS: Remove Eduardo Habkost
MAINTAINERS: Remove Cameron Esfahani
MAINTAINERS: Remove Hannes Reinecke
hw/dma/pl080: Ignore bottom 2 bits of LLI register
hw/dma/pl080: Update interrupts after pl080_run()
hw/dma/pl080: Handle bogus swidth and dwidth in transfers
semihosting/uaccess: Use the cpu_internal_tswap() functions
include/exec: Provide the cpu_internal_tswap() functions
include/hw/core: Rename virtio_is_big_endian to internal_is_big_endian
hw/net/rtl8319: Work around GCC sanitizer / -Wstringop-overflow bug
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Michael Tokarev [Fri, 9 Jan 2026 21:14:57 +0000 (00:14 +0300)]
linux-user: assume epoll is always present
epoll is in linux since 2.6 (glibc 2.3.2).
epoll_init1 has been added in 2.6.27 (glibc 2.9).
There's no need to check for its presence, including all other
epoll-related syscalls.
Modern architectures don't have epoll_create(), only
epoll_create1(), so keep conditional around the former.
Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Michael Tokarev [Fri, 9 Jan 2026 20:48:09 +0000 (23:48 +0300)]
meson.build: stop checking for inotify_init()
the only place in qemu which used the check for inotify_init()
was linux-user, which now assumes inotify_init() is always
present. There's no need to check for this function anymore.
Michael Tokarev [Fri, 9 Jan 2026 20:27:05 +0000 (23:27 +0300)]
linux-user/syscall.c: assume splice is always present
splice() &Co are defined since linux 2.6.17 (glibc 2.5).
Assume it is always present.
Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Thomas Huth [Tue, 10 Mar 2026 09:28:22 +0000 (10:28 +0100)]
docs: Move xbzrle.txt into the migration folder and convert to rst
xbzrle is a feature of migration and thus this file should go
into the docs/devel/migration/ folder. While we're at it, turn
it into proper .rst format, too.
Signed-off-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Peter Xu <peterx@redhat.com> Reviewed-by: Michael Tokarev <mjt@tls.msk.ru> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Sergei Heifetz [Thu, 5 Mar 2026 06:04:31 +0000 (11:04 +0500)]
target/i386: fix NULL pointer dereference in legacy-cache=off handling
The check that xcc->model is not NULL occurs after it is dereferenced
inside x86_cpu_get_versioned_cache_info(), so something like
`-cpu host,legacy-cache=off` leads to a segfault rather than an error.
This patch fixes that.
Fixes: cca0a000d06f897411a8a ("target/i386: allow versioned CPUs to specify new cache_info") Signed-off-by: Sergei Heifetz <heifetz@yandex-team.com> Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru> Reviewed-by: Zhao Liu <zhao1.liu@intel.com> Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
[Mjt: simplify the following condition too] Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Sergei Heifetz [Sun, 8 Feb 2026 10:39:58 +0000 (15:39 +0500)]
hw/usb/core.c: reorder usage and assertion of p->ep
Reorder the code so the assertion of p->ep occurs before it is
used in the subsequent lines.
Signed-off-by: Sergei Heifetz <heifetz@yandex-team.com> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Reviewed-by: Peter Xu <peterx@redhat.com> Reviewed-by: Michael Tokarev <mjt@tls.msk.ru> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Sergei Heifetz [Sun, 8 Feb 2026 10:39:57 +0000 (15:39 +0500)]
system/physmem.c: remove useless assertion of block
It is useless to assert that block is not NULL because it is
already dereferenced in the first line of the function.
The assertion is also unnecessary because the function is called
in only two places, and `block` can't be NULL in either of them:
- In `migration/ram.c`, we have already dereferenced `block` in
the code just before the call.
- In `system/memory.c`, we assert `mr->ram_block` before passing
it to the function.
(We could split the declaration and initialization of oldsize,
but then we would need to remove the const qualifier. As the
assertion is useless anyway, removing the const qualifier seems
worse.)
Signed-off-by: Sergei Heifetz <heifetz@yandex-team.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Peter Xu <peterx@redhat.com> Reviewed-by: Michael Tokarev <mjt@tls.msk.ru> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Sergei Heifetz [Sun, 8 Feb 2026 10:39:56 +0000 (15:39 +0500)]
dump/dump.c: reorder usage and assertion of block
Reorder the code so the assertion of block occurs before it is
used in the subsequent lines.
Signed-off-by: Sergei Heifetz <heifetz@yandex-team.com> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Reviewed-by: Peter Xu <peterx@redhat.com> Reviewed-by: Michael Tokarev <mjt@tls.msk.ru> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Sergei Heifetz [Sun, 8 Feb 2026 10:39:55 +0000 (15:39 +0500)]
migration/savevm.c: reorder usage and assertion of mis->from_src_file
Reorder the code so the assertion of mis->from_src_file occurs before
the call to migration_ioc_unregister_yank_from_file, which dereferences
it in qemu_file_get_ioc.
Fixes: 39675ffffb3394 ("migration: Move the yank unregister of channel_close out") Signed-off-by: Sergei Heifetz <heifetz@yandex-team.com> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Reviewed-by: Peter Xu <peterx@redhat.com> Reviewed-by: Michael Tokarev <mjt@tls.msk.ru> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
* tag 'pull-request-2026-03-16' of https://gitlab.com/thuth/qemu:
MAINTAINERS: Add another reviewer to s390x boot
MAINTAINERS: Downgrade the functional testing section to "Odd Fixes"
MAINTAINERS: Remove myself from various sections
MAINTAINERS: Update the s390x maintainers
MAINTAINERS: Update S390-ccw boot maintainers/reviewers
hw/acpi: generic_event_device: Don't call qdev_get_machine in initfn
hw/arm: fsl-imx6: Don't call qdev_get_machine in soc init
hw/arm: fsl-imx8mp: Don't call qdev_get_machine in soc init
hw/arm: fsl-imx7: Don't call qdev_get_machine in soc init
hw/arm: xlnx-zynqmp: Don't call qdev_get_machine in soc init
hw/riscv: microchip_pfsoc: Don't call qdev_get_machine in soc init
hw/riscv: sifive_e: Don't call qdev_get_machine in soc init
target/mips/cpu: Move initialization of memory region to realize function
target/xtensa/cpu: Move initialization of memory region to realize function
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Peter Maydell [Mon, 16 Mar 2026 10:42:41 +0000 (10:42 +0000)]
Merge tag 'linux-user-for-v11-pull-request' of https://github.com/hdeller/qemu-hppa into staging
Two linux-user patches
Two linux-user patches from Razvan Ghiorghe.
# -----BEGIN PGP SIGNATURE-----
#
# iHUEABYKAB0WIQS86RI+GtKfB8BJu973ErUQojoPXwUCabRXkwAKCRD3ErUQojoP
# X8E4AQDtltuCmD+RnJ5yWNAh4Rx8kOU/tChL8kE44NjMz9HdxAEA37DKINiPHCOs
# G7kmfKqwUpJWVSXeMjUp0iaNOUydbAw=
# =ahOd
# -----END PGP SIGNATURE-----
# gpg: Signature made Fri Mar 13 18:29:39 2026 GMT
# gpg: using EDDSA key BCE9123E1AD29F07C049BBDEF712B510A23A0F5F
# gpg: Good signature from "Helge Deller <deller@gmx.de>" [unknown]
# gpg: aka "Helge Deller <deller@kernel.org>" [unknown]
# gpg: aka "Helge Deller <deller@debian.org>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 4544 8228 2CD9 10DB EF3D 25F8 3E5F 3D04 A7A2 4603
# Subkey fingerprint: BCE9 123E 1AD2 9F07 C049 BBDE F712 B510 A23A 0F5F
* tag 'linux-user-for-v11-pull-request' of https://github.com/hdeller/qemu-hppa:
linux-user: fix mremap with old_size=0 for shared mappings
linux-user: Fix zero_bss for RX PT_LOAD segments
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Eric Farman [Fri, 13 Mar 2026 19:48:10 +0000 (20:48 +0100)]
MAINTAINERS: Add another reviewer to s390x boot
Jason offered to help review this area of code;
let's make sure he's notified of changes.
Signed-off-by: Eric Farman <farman@linux.ibm.com>
Message-ID: <20260313194810.1844241-2-farman@linux.ibm.com> Acked-by: Jason J. Herne <jjherne@linux.ibm.com> Acked-by: Matthew Rosato <mjrosato@linux.ibm.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
Thomas Huth [Fri, 13 Mar 2026 11:34:22 +0000 (12:34 +0100)]
MAINTAINERS: Downgrade the functional testing section to "Odd Fixes"
I won't have that much time for QEMU anymore in the future, so downgrade
the status of the "functional testing framework" section to "Odd Fixes"
to avoid wrong expectations. While we're at it, also switch to my other
e-mail address here that I'm already using for the other sections where
I am still listed as maintainer / reviewer.
Message-ID: <20260313113424.15583-5-thuth@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Thomas Huth <thuth@redhat.com>
Thomas Huth [Fri, 13 Mar 2026 11:34:21 +0000 (12:34 +0100)]
MAINTAINERS: Remove myself from various sections
I likely won't have much time in the future for QEMU anymore, so
remove myself from various sections that have already enough other
maintainers / reviewers.
Message-ID: <20260313113424.15583-4-thuth@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Thomas Huth <thuth@redhat.com>
Thomas Huth [Fri, 13 Mar 2026 11:34:20 +0000 (12:34 +0100)]
MAINTAINERS: Update the s390x maintainers
I'm going to move to another project next month, so I will not have
enough time to take care of s390x patches anymore. Fortunately,
Cornelia volunteered to take over the job of collecting s390x patches,
and Eric and Matthew offered help to back her up, so we can keep
the "S390 general architecture support" section in the "supported"
state. Thanks for your help, Cornelia, Eric and Matthew!
Message-ID: <20260313113424.15583-3-thuth@redhat.com> Reviewed-by: Cornelia Huck <cohuck@redhat.com> Acked-by: Eric Farman <farman@linux.ibm.com> Acked-by: Matthew Rosato <mjrosato@linux.ibm.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
Christian Borntraeger is no longer active in this space. Promote myself to
maintainer and demote Christian to reviewer.
Signed-off-by: Jared Rossi <jrossi@linux.ibm.com> Acked-by: Eric Farman <farman@linux.ibm.com> Acked-by: Christian Borntraeger <borntraeger@linux.ibm.com> Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20260310142118.1120291-1-jrossi@linux.ibm.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20260313113424.15583-2-thuth@redhat.com>
as the machine wasn't created yet. We call qdev_get_machine() to obtain
the ram slots of the machine. So instead of initialising the GED in
the init let's instead do it in the realise where the machine
will exist.
Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Tested-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20260312043158.4191378-8-alistair.francis@wdc.com>
[thuth: Replaced soc_init with acpi_ged_initfn in the patch description] Signed-off-by: Thomas Huth <thuth@redhat.com>
as the machine wasn't created yet. We call qdev_get_machine() to obtain
the number of CPUs in the machine. So instead of initialising the CPUs in
the SoC init let's instead do it in the realise where the machine
will exist.
Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Tested-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20260312043158.4191378-7-alistair.francis@wdc.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
as the machine wasn't created yet. We call qdev_get_machine() to obtain
the number of CPUs in the machine. So instead of initialising the CPUs in
the SoC init let's instead do it in the realise where the machine
will exist.
Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Tested-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20260312043158.4191378-6-alistair.francis@wdc.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
as the machine wasn't created yet. We call qdev_get_machine() to obtain
the number of CPUs in the machine. So instead of initialising the CPUs in
the SoC init let's instead do it in the realise where the machine
will exist.
Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Tested-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20260312043158.4191378-5-alistair.francis@wdc.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
as the machine wasn't created yet. We call qdev_get_machine() to obtain
the number of CPUs in the machine. So instead of initialising the CPUs in
the SoC init let's instead do it in the realise where the machine
will exist.
Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Tested-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20260312043158.4191378-4-alistair.francis@wdc.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
as the machine wasn't created yet. We call qdev_get_machine() to obtain
the number of CPUs in the machine. So instead of setting the CPU
num-harts in the init function let's set it in realise where the machine
will exist.
Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Tested-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20260312043158.4191378-3-alistair.francis@wdc.com>
[thuth: Fix a complaint from checkpatch.pl with regards to multi-line comment] Signed-off-by: Thomas Huth <thuth@redhat.com>
as the machine wasn't created yet. We call qdev_get_machine() to obtain
the number of CPUs in the machine. So instead of setting the CPU
num-harts in the init function let's set it in realise where the machine
will exist.
Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Tested-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20260312043158.4191378-2-alistair.francis@wdc.com>
[thuth: Fix a complaint from checkpatch.pl with regards to multi-line comment] Signed-off-by: Thomas Huth <thuth@redhat.com>
Move the initialization of the memory regions to the realize function
to fix this problem.
Reported-by: Markus Armbruster <armbru@redhat.com> Tested-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20260311202503.107026-1-thuth@redhat.com>
Ani Sinha [Tue, 10 Mar 2026 09:44:48 +0000 (15:14 +0530)]
runstate: handle return code of EOPNOTSUPP properly from rebuild_guest()
If rebuild_guest() accelerator callback returns EOPNOTSUPP, this means that the
accelerator does not support rebuilding the guest state. Handle this case
properly and separately from other error return codes.
Fixes: 4003e5e65fe0("hw/accel: add a per-accelerator callback to change VM accelerator handle") Reported-by: Harsh Prateek Bora <harshpb@linux.ibm.com> Signed-off-by: Ani Sinha <anisinha@redhat.com> Link: https://lore.kernel.org/r/20260310094450.35861-2-anisinha@redhat.com Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Peter Maydell [Tue, 10 Mar 2026 15:33:34 +0000 (15:33 +0000)]
tests/qtest/aspeed_gpio-test: Use g_strdup_printf() instead of char arrays
Older versions of gcc with -Wformat-overflow=2 don't like the usage of
fixed size char arrays in this test; gcc 7.5.0 (SUSE Linux) says:
../tests/qtest/aspeed_gpio-test.c: In function ‘test_set_input_pins’:
../tests/qtest/aspeed_gpio-test.c:149:36: error: ‘sprintf’ may write a terminating nul past the end of the destination [-Werror=format-overflow=]
sprintf(name, "gpio%c%d", c, i);
^
../tests/qtest/aspeed_gpio-test.c:149:13: note: ‘sprintf’ output between 7 and 17 bytes into a destination of size 16
sprintf(name, "gpio%c%d", c, i);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
This can't actually happen because of the limited size of the values
being substituted in. However rather than require readers to check
whether the arrays really have been declared large enough, we prefer
to use g_strdup_printf() for this kind of string work.
Reported-by: Fabiano Rosas <farosas@suse.de> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Tested-by: Fabiano Rosas <farosas@suse.de> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20260310153334.3063224-3-peter.maydell@linaro.org
Peter Maydell [Tue, 10 Mar 2026 15:33:33 +0000 (15:33 +0000)]
tests/qtest/ast2700-gpio-test: Use g_strdup_printf() instead of char arrays
Older versions of gcc with -Wformat-overflow=2 don't like the usage of
fixed size char arrays in this test; gcc 7.5.0 (SUSE Linux) says:
../tests/qtest/ast2700-gpio-test.c: In function ‘test_input_pins’:
../tests/qtest/ast2700-gpio-test.c:54:36: error: ‘sprintf’ may write a terminating nul past the end of the destination [-Werror=format-overflow=]
sprintf(name, "gpio%c%d", c, i);
^
../tests/qtest/ast2700-gpio-test.c:54:13: note: ‘sprintf’ output between 7 and 17 bytes into a destination of size 16
sprintf(name, "gpio%c%d", c, i);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
This can't actually happen because of the limited size of the values
being substituted in. However rather than require readers to check
whether the arrays really have been declared large enough, we prefer
to use g_strdup_printf() for this kind of string work.
Reported-by: Fabiano Rosas <farosas@suse.de> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Tested-by: Fabiano Rosas <farosas@suse.de> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20260310153334.3063224-2-peter.maydell@linaro.org
Peter Maydell [Tue, 10 Mar 2026 15:15:07 +0000 (15:15 +0000)]
tests/qtest/arm-cpu-features: Use g_strdup_printf() instead of char arrays
Older versions of gcc with -Wformat-overflow=2 don't like the usage of
fixed size char arrays in this test; gcc 7.5.0 (SUSE Linux) says:
../tests/qtest/arm-cpu-features.c: In function ‘test_query_cpu_model_expansion_kvm’:
../tests/qtest/arm-cpu-features.c:578:35: error: ‘%u’ directive writing
between 1 and 10 bytes into a region of size 5
[-Werror=format-overflow=]
These can't actually happen because of the limited size of the values
being substituted in. However rather than require readers to check
whether the arrays really have been declared large enough, we prefer
to use g_strdup_printf() for this kind of string work.
Reported-by: Fabiano Rosas <farosas@suse.de> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Tested-by: Fabiano Rosas <farosas@suse.de> Reviewed-by: Cédric Le Goater <clg@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20260310151507.2973843-3-peter.maydell@linaro.org
Peter Maydell [Tue, 10 Mar 2026 15:15:06 +0000 (15:15 +0000)]
tests/qtest/ast2700-sgpio-test: Use g_strdup_printf() instead of char arrays
Older versions of gcc with -Wformat-overflow=2 don't like the usage of
fixed size char arrays in this test; gcc 7.5.0 (SUSE Linux) says:
../tests/qtest/ast2700-sgpio-test.c: In function ‘test_output_pins’:
../tests/qtest/ast2700-sgpio-test.c:27:33: error: ‘sprintf’ may write a
terminating nul past the end of the destination
[-Werror=format-overflow=]
../tests/qtest/ast2700-sgpio-test.c: In function ‘test_irq_level_high’:
../tests/qtest/ast2700-sgpio-test.c:85:33: error: ‘sprintf’ may write a
terminating nul past the end of the destination
[-Werror=format-overflow=]
These can't actually happen because of the limited size of the values
being substituted in. However rather than require readers to check
whether the arrays really have been declared large enough, we prefer
to use g_strdup_printf() for this kind of string work.
Reported-by: Fabiano Rosas <farosas@suse.de> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Tested-by: Fabiano Rosas <farosas@suse.de> Reviewed-by: Cédric Le Goater <clg@redhat.com>
Message-id: 20260310151507.2973843-2-peter.maydell@linaro.org
Peter Maydell [Fri, 6 Mar 2026 12:05:55 +0000 (12:05 +0000)]
MAINTAINERS: Remove Chris Browy
Chris Browy's listed email address is undeliverable:
The recipient server did not accept our requests to connect; it
times out on attempts to connect by my sending mail server (gmail):
[avery-design.com 99.83.249.127: timed out]
[avery-design.com 75.2.78.167: timed out]
Remove his name from the file.
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20260306120555.2035421-7-peter.maydell@linaro.org
Tao Ding [Thu, 12 Mar 2026 08:02:35 +0000 (16:02 +0800)]
hw/dma/pl080: Ignore bottom 2 bits of LLI register
The PL080 channel LLI (linked list item) register has bits [31:2] of
the address of the next LLI in bits [31:2], with bit [1] reserved
and bits [0] the AHB master select. We were incorrectly using the
whole register value as the address, which meant that if the guest
programmed something into the AHB master select bit we would use
an incorrect address, and read incorrect data from memory.
The following reproducer creates a setup which has bit 0 set in
an LLI value:
Tao Ding [Thu, 12 Mar 2026 08:02:33 +0000 (16:02 +0800)]
hw/dma/pl080: Update interrupts after pl080_run()
In the codepath in pl080_write() where we run the DMA engine
after a change in the channel configuration register, we were
missing a pl080_update() call, which meant that we weren't
raising any interrupts generated by that DMA transfer.
A repro case for this is to program the PL080 and then
check the interrupt status by looking at the PL190 status
register, since the PL080 interrupt output is connected
to input 17 of the PL190. We look at the register value via
the QEMU monitor:
Peter Maydell [Fri, 6 Mar 2026 15:21:40 +0000 (15:21 +0000)]
hw/dma/pl080: Handle bogus swidth and dwidth in transfers
The PL080 TRM states that the DWidth and SWidth fields of the channel
control registers can only validly specify widths up to 32 bits (i.e.
values from 0 to 2) and all other values are reserved.
Currently we don't check this, so if the guest specifies an invalid
value we will transfer more data into our local 'buff[]' array than
it can hold.
Check the widths; since the TRM doesn't clearly specify any behaviour
for what to do on invalid values, we choose to log them and then
ignore the channel for transfers.
Cc: qemu-stable@nongnu.org
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3203 Reviewed-by: Jim MacArthur <jim.macarthur@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20260306152140.2191653-1-peter.maydell@linaro.org
Razvan Ghiorghe [Mon, 9 Mar 2026 23:30:32 +0000 (01:30 +0200)]
linux-user: fix mremap with old_size=0 for shared mappings
When old_size is zero and old_address refers to a shareable mapping,
mremap() should create a new mapping of the same pages according to the
mremap(2) man page. The MREMAP_MAYMOVE flag must be specified in this case.
Previously, QEMU's target_mremap() rejected this valid case with EFAULT
during the initial validation, before checking for the special
old_size == 0 behaviour.
This patch adds proper handling for old_size == 0:
- Validates that MREMAP_MAYMOVE flag is set (required by man spec)
- Passes the call through to the host mremap()
- Creates a new mapping without invalidating the original, with both
being valid and sharing the same physical memory frames.
- Ensures the new mapping address falls within the valid guest address
region before returning it to the guest.
Tested with the reproducer from the issue on qemu-riscv64, qemu-hppa,
and qemu-aarch64.
Razvan Ghiorghe [Mon, 2 Feb 2026 00:24:46 +0000 (02:24 +0200)]
linux-user: Fix zero_bss for RX PT_LOAD segments
zero_bss() incorrectly assumed that any PT_LOAD containing .bss must be
writable, rejecting valid ELF binaries where .bss overlaps the tail of
an RX file-backed page.
Instead of failing, temporarily enable write access on the overlapping
page to zero the fractional bss range, then restore the original page
permissions once initialization is complete.
Martin Kröning [Wed, 11 Mar 2026 16:27:16 +0000 (17:27 +0100)]
semihosting/uaccess: Use the cpu_internal_tswap() functions
The semihosting ABI [1] states:
> Multi-byte values in memory must be formatted as pure little-endian or pure
> big-endian to match the endianness mapping configuration of the processor.
This commits ensures that semihosting data is properly byte-swapped if
the guest's CPU is currently in a different runtime-configurable
endianness than the host's CPU.
Signed-off-by: Martin Kröning <martin.kroening@eonerc.rwth-aachen.de> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20260311-semihosting-cpu-tswap-v3-3-8e239575ec08@eonerc.rwth-aachen.de Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Martin Kröning [Wed, 11 Mar 2026 16:27:15 +0000 (17:27 +0100)]
include/exec: Provide the cpu_internal_tswap() functions
These functions are needed to support semihosting on CPUs that support
runtime-configurable endianness. They should not be used in other contexts.
Signed-off-by: Martin Kröning <martin.kroening@eonerc.rwth-aachen.de>
Message-id: 20260311-semihosting-cpu-tswap-v3-2-8e239575ec08@eonerc.rwth-aachen.de Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Martin Kröning [Wed, 11 Mar 2026 16:27:14 +0000 (17:27 +0100)]
include/hw/core: Rename virtio_is_big_endian to internal_is_big_endian
These functions are needed to do semihosting on CPUs that support
runtime-configurable endiannes. This commit renames them and allows
using them for semihosting, but makes sure to signal that these
functions should not be used in other circumstances.
Signed-off-by: Martin Kröning <martin.kroening@eonerc.rwth-aachen.de> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20260311-semihosting-cpu-tswap-v3-1-8e239575ec08@eonerc.rwth-aachen.de Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Peter Maydell [Thu, 12 Mar 2026 18:28:00 +0000 (18:28 +0000)]
hw/net/rtl8319: Work around GCC sanitizer / -Wstringop-overflow bug
If you compile QEMU with GCC with -fsanitize=address and
-Wstringop-overflow, this causes GCC to produce a false-positive
warning which it does not produce when the sanitizer is not enabled
(and which makes compilation fail if you're using -Werror, as we do
by default for builds from git):
../../hw/net/rtl8139.c: In function ‘rtl8139_io_writeb’:
../../hw/net/rtl8139.c:2264:17: error: writing 8 bytes into a region of size 0 [-Werror=stringop-overflow=]
2264 | memcpy(data_to_checksum, saved_ip_header + 12, 8);
| ^
In file included from ../../hw/net/rtl8139.c:62:
/home/pm215/qemu/include/net/eth.h:50:14: note: at offset [8, 48] into destination object ‘ip_ver_len’ of size 1
50 | uint8_t ip_ver_len; /* version and header length */
| ^~~~~~~~~~
../../hw/net/rtl8139.c:2192:21: error: writing 8 bytes into a region of size 0 [-Werror=stringop-overflow=]
2192 | memcpy(data_to_checksum, saved_ip_header + 12, 8);
| ^
/home/pm215/qemu/include/net/eth.h:50:14: note: at offset [8, 48] into destination object ‘ip_ver_len’ of size 1
50 | uint8_t ip_ver_len; /* version and header length */
| ^~~~~~~~~~
../../hw/net/rtl8139.c:2192:21: error: writing 8 bytes into a region of size 0 [-Werror=stringop-overflow=]
2192 | memcpy(data_to_checksum, saved_ip_header + 12, 8);
| ^
/home/pm215/qemu/include/net/eth.h:50:14: note: at offset [8, 48] into destination object ‘ip_ver_len’ of size 1
50 | uint8_t ip_ver_len; /* version and header length */
| ^~~~~~~~~~
In file included from /home/pm215/qemu/include/system/memory.h:21,
from /home/pm215/qemu/include/hw/pci/pci.h:4,
from /home/pm215/qemu/include/hw/pci/pci_device.h:4,
from ../../hw/net/rtl8139.c:54:
In function ‘stl_he_p’,
inlined from ‘stl_be_p’ at /home/pm215/qemu/include/qemu/bswap.h:371:5,
inlined from ‘rtl8139_cplus_transmit_one’ at ../../hw/net/rtl8139.c:2244:21,
inlined from ‘rtl8139_cplus_transmit’ at ../../hw/net/rtl8139.c:2345:28,
inlined from ‘rtl8139_io_writeb’ at ../../hw/net/rtl8139.c:2728:17:
/home/pm215/qemu/include/qemu/bswap.h:284:5: error: writing 4 bytes into a region of size 0 [-Werror=stringop-overflow=]
284 | __builtin_memcpy(ptr, &v, sizeof(v));
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
/home/pm215/qemu/include/net/eth.h: In function ‘rtl8139_io_writeb’:
/home/pm215/qemu/include/net/eth.h:50:14: note: at offset [24, 64] into destination object ‘ip_ver_len’ of size 1
50 | uint8_t ip_ver_len; /* version and header length */
| ^~~~~~~~~~
This has been triaged as a bug in GCC:
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114494
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99673
(the sanitizer pass rewrites the IR in a way that conflicts with its
use by the warning pass that runs afterwards).
Since this is the only place in our code where we hit this, work
around it by disabling the -Wstringop-overflow in the part of
the function that hits it. We do this only when using the
address sanitizer on GCC, so that we still get the benefit
of the warning in most compilation scenarios.
Cc: qemu-stable@nongnu.org
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3006 Suggested-by: Daniel P. Berrangé <berrange@redhat.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Tested-by: Alex Bennée <alex.bennee@linaro.org> Tested-by: Yodel Eldar <yodel.eldar@yodel.dev> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-id: 20260305140512.1330691-1-peter.maydell@linaro.org
Peter Maydell [Thu, 12 Mar 2026 15:21:06 +0000 (15:21 +0000)]
Merge tag 'for-upstream' of https://gitlab.com/bonzini/qemu into staging
* accel/kvm: fix typo in variable name
* system: fix coverity issues related to confidential guest reset
* target/i386: add compat for migrating error code
* docs fixes
* hyperv/syndbg: check length returned by cpu_physical_memory_map()
* typedefs: move QIgvm out of typedefs.h
* rust: Update Cargo.lock
* i386/cpu: cleanups for ClearwaterForest, AMX and more
* tag 'for-upstream' of https://gitlab.com/bonzini/qemu:
typedefs: move QIgvm out of typedefs.h
rust: Update Cargo.lock
target/i386: add compat for migrating error code
docs: mention that WHPX supports Arm too
qemu-options.hx: document Hyper-V enlightenments accelerator option
docs: remove 64-bit only mentions for accelerators
accel/kvm: fix typo in variable name
coverity: fix coverity issues related to confidential guest reset
i386/cpu: Enable CPUID 0x1f & cache model for ClearwaterForest
i386/cpu: Adjust the note for CPU models with its-no
i386/cpu: Remove unnecessary cache_info fields from builtin CPU model
i386/cpu: Rename AMX mirror feature words with -alias suffix
i386/cpu: Rename AMX mirror cpuid macros with _ALIAS suffix
hyperv/syndbg: check length returned by cpu_physical_memory_map()
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Paolo Bonzini [Wed, 11 Mar 2026 16:19:16 +0000 (17:19 +0100)]
typedefs: move QIgvm out of typedefs.h
Typedefs.h should only be used for really core types; QIgvm is
just an opaque struct that is defined in system/igvm-internal.h,
and the typedef itself can be placed simply in system/igvm.h.
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Fiona Ebner [Tue, 10 Mar 2026 15:43:23 +0000 (16:43 +0100)]
target/i386: add compat for migrating error code
If cpu->env.has_error_code is true, backwards migration of a VM from
a QEMU binary with commit 27535e9cca to a QEMU binary without commit 27535e9cca will fail:
> kvm: error while loading state for instance 0x0 of device 'cpu'
In practice, wrongly setting the error code to 0 on the target is
often unproblematic, so additionally checking error_code != 0 in
cpu_errcode_needed() is not enough to mitigate the issue. Instead, add
proper machine version compat handling.
Cc: qemu-stable@nongnu.org Fixes: 27535e9cca ("target/i386: Add support for save/load of exception error code") Signed-off-by: Fiona Ebner <f.ebner@proxmox.com> Reviewed-by: Zhao Liu <zhao1.liu@intel.com> Link: https://lore.kernel.org/r/20260310154348.495332-1-f.ebner@proxmox.com Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Ani Sinha [Wed, 11 Mar 2026 07:40:48 +0000 (13:10 +0530)]
coverity: fix coverity issues related to confidential guest reset
Fix issues reported by Peter.
Fixes: ec9bafd2ea9d12c ("i386/sev: add support for confidential guest reset") Fixes: e76c30bb13ecb9d ("hw/machine: introduce machine specific option 'x-change-vmfd-on-reset'") Reported-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Zhao Liu <zhao1.liu@intel.com> Signed-off-by: Ani Sinha <anisinha@redhat.com> Link: https://lore.kernel.org/r/20260311074048.61367-1-anisinha@redhat.com Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Peter Maydell [Thu, 12 Mar 2026 09:48:03 +0000 (09:48 +0000)]
Merge tag 'qtest-20260311-pull-request' of https://gitlab.com/farosas/qemu into staging
Qtest pull request
- memory leak fixes
# -----BEGIN PGP SIGNATURE-----
#
# iQJEBAABCAAuFiEEqhtIsKIjJqWkw2TPx5jcdBvsMZ0FAmmx49sQHGZhcm9zYXNA
# c3VzZS5kZQAKCRDHmNx0G+wxnSVPEAC5YnD2OAn6MYYWolLtauIMI1VKL0Z2fKLg
# f/qymCek5w7ktfi455kQoQIfixBYV8yPT5CLC+qvgYuL+BRQykUYwzHYP+As+boC
# etdmjdwJUkUEQEuIDuoSBWomVNEB6f2plgFJpcyTCbHlXAmEQYhcSQruEhWGMmwg
# F5UgJPbHOIhm0wk6S3wLs43V3M+wZnEnxa+AxT7wkWdTI3ZCAymRpvL3coUA0ACZ
# SkImWuxdx1Y8LW970vCw/AbIdTYnaB8WiPShbvVAkbTe2Sk9WkWyJ5zB2bEdVg/Z
# 8AsP1+/nVZDb4PdCeSYlD/0G378NFGpm5lF1I0OSPeI9yRuSxo0rS/aZsfxajOrH
# XNM0s6daWmyRkqPz00EcuKjWQwd26tv0sz6rmTkIj/XMBvlW5H455Z0lUM5TQ6K3
# dbmkZ0fkwlxpcIJqBi0JzVakBNjNnRVv6NzyFoYJ6I5gvv/8h/SwGk36pRBb0BSi
# X0sle6qEmpF9IRb56FI9vVhUdldCrIu8I0lY0cSWqWleMKO+geVcMOFixdmCOKwk
# CR8ZhaqkC6qdhFqlGX4nIoy2bvhrj5ULtQjXSnpfSRZCZajpfMxG4VNhrNpDy/CE
# bFajU+mNO29wJ9ACqE43cx/YpvGzkv5qvAg8yR52gjPQ8+sx7HU4cSdm1VTLcU/Z
# /UnojkSTJg==
# =8Bwh
# -----END PGP SIGNATURE-----
# gpg: Signature made Wed Mar 11 21:51:23 2026 GMT
# gpg: using RSA key AA1B48B0A22326A5A4C364CFC798DC741BEC319D
# gpg: issuer "farosas@suse.de"
# gpg: Good signature from "Fabiano Rosas <farosas@suse.de>" [unknown]
# gpg: aka "Fabiano Almeida Rosas <fabiano.rosas@suse.com>" [unknown]
# gpg: WARNING: The key's User ID is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: AA1B 48B0 A223 26A5 A4C3 64CF C798 DC74 1BEC 319D
* tag 'qtest-20260311-pull-request' of https://gitlab.com/farosas/qemu:
tests/qtest/test-x86-cpuid-compat: Switch test_feature_flag to data-driven
tests/qtest/test-x86-cpuid-compat: Switch test_cpuid_prop to data-driven
tests/qtest/vhost-user-test: Use g_timeout_add() to schedule connect
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
projects / thirdparty / qemu.git / log
