Rather than add a second non-architected IPLB type for scsi-pci devices,
let's add the relevant fields to the existing struct so that it can handle
both PCI and CCW scsi controllers.
The PCI and CCW fields of the IplBlockQemuScsi are aligned with same
offsets as the corresponding fields in IplBlockPci and IplBlockCcw for
potential union access.
Add comments for PCI/CCW specifics and also denote that the S390IplType
enum values must fit in uint8_t.
Reviewed-by: Eric Farman <farman@linux.ibm.com>
Signed-off-by: Jared Rossi <jrossi@linux.ibm.com>
Reviewed-by: Jason J. Herne <jjherne@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/20260831194919.3830270-5-jrossi@linux.ibm.com
Signed-off-by: Eric Farman <farman@linux.ibm.com>
NS 87560 SuperIO chip
This series adds the emulation of a "NS 87560 SuperIO chip".
The SuperIO chip includes a floppy controller, two serial ports, one parallel
port, an IDE controller and one OHCI USB port.
This National Semiconductor SuperIO chip was commonly used in many HP PA-RISC
B- and C-class workstations, as in the HP C3700 machine which is being
emulated by QEMU already. The last patch wires up this SuperIO driver to the
existing C3700 machine emulation.
This driver was developed during the last few months by Abizer Lokhandwala
<abizerlokhandwalastd10@gmail.com> and mentored and reviewed by me.
# -----BEGIN PGP SIGNATURE-----
#
# iHUEABYKAB0WIQS86RI+GtKfB8BJu973ErUQojoPXwUCaq1o6wAKCRD3ErUQojoP
# XzJQAP4pIMGOQDxjVOVnRUg2H6uS9TlBNnjXZNkw3ZFxbrbz3AD9Fnl7gelHlY1v
# p/aYziW6JzRgUBuIPcRSUWlPjzPVfQk=
# =Vqwl
# -----END PGP SIGNATURE-----
# gpg: Signature made Fri 18 Sep 2026 06:38:03 AM HST
# gpg: using EDDSA key BCE9123E1AD29F07C049BBDEF712B510A23A0F5F
# gpg: Good signature from "Helge Deller <deller@gmx.de>" [unknown]
# gpg: aka "Helge Deller <deller@kernel.org>" [unknown]
# gpg: aka "Helge Deller <deller@debian.org>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 4544 8228 2CD9 10DB EF3D 25F8 3E5F 3D04 A7A2 4603
# Subkey fingerprint: BCE9 123E 1AD2 9F07 C049 BBDE F712 B510 A23A 0F5F
* tag 'superio-hppa-pull-request' of https://github.com/hdeller/qemu-hppa:
hw/hppa: Add NS 87560 SuperIO chip to HP C3700 machine
hw/pc87560: Wire up emulation of NS 87560 SuperIO chip
hw/usb/pc87560-ohci: Add USB OHCI emulation of NS 87560 SuperIO chip
hw/usb/hcd-ohci: Add big endian and consistency check support
hw/ide/pc87560-ide: Add IDE emulation of NS 87560 SuperIO chip
hw/isa/pc87560: Add main isa code for NS 87560 SuperIO chip
hw/pci/pci_ids: Add PCI vendor ID and IDs for NS chips
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Mem api pull
- Peter's patchset to drop some dead code for 32bit hosts
- Phil/Bin's patch to enhance error message for mem allocations
- Cam's fix to virtio-mem crash in multi-source work
# -----BEGIN PGP SIGNATURE-----
#
# iIgEABYKADAWIQS5GE3CDMRX2s990ak7X8zN86vXBgUCaq0ivhIccGV0ZXJ4QHJl
# ZGhhdC5jb20ACgkQO1/MzfOr1wbtGQD/djQyYM2zWEh5SyDDhbT4cj7iPIkvFtCM
# MVQNJPFkZLUBANMM8sWaoEaIsehh+tLq+6zvqyAB5U9yF8ecuYgR6iEH
# =n5bF
# -----END PGP SIGNATURE-----
# gpg: Signature made Fri 18 Sep 2026 01:38:38 AM HST
# gpg: using EDDSA key B9184DC20CC457DACF7DD1A93B5FCCCDF3ABD706
# gpg: issuer "peterx@redhat.com"
# gpg: Good signature from "Peter Xu <xzpeter@gmail.com>" [unknown]
# gpg: aka "Peter Xu <peterx@redhat.com>" [unknown]
# gpg: WARNING: The key's User ID is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: B918 4DC2 0CC4 57DA CF7D D1A9 3B5F CCCD F3AB D706
* tag 'next-pull-request' of https://gitlab.com/peterx/qemu:
system/ram-discard-manager: fix offset_within_address_space in replay_by_populated_state()
system/physmem: Improve guest memory allocation failure error message
machine: Remove 32bit limitation on ram size
hw/arm/raspi4b: Drop board_rev for 32bit hosts
arm/aspeed: Drop ASPEED_RAM_SIZE
linux-user: Remove 32bit host support in thunk_convert|print()
bsd-user: Remove 32bit host support in thunk_convert|print()
xen-mapcache: Remove 32bit support
arm/mps: Remove 32bit define for MPS3_DDR_SIZE
hw/vexpress.c: Remove forced cast to u64
system: Define ram_addr_t to be always uint64_t
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
So far, only rudimentary checks have been made to ensure that
the guest only performs state transitions described in
virtio-v1.2-csd01 5.14.6.6.1 PCM Command Lifecycle. While this
is not a Device Requirement, let's add a state variable
per audio stream and check all state transitions.
Because only permitted state transitions are now possible, only one
copy of the audio stream parameters is required and these do not
need to be initialised with default values.
The state variable will also make it easier to restore the audio
stream after migration.
[AM: there were too many conflicts, I did `git checkout --ours -- <.>`
and then reimplemented the patch idea
/AM]
Signed-off-by: Volker Rümelin <vr_qemu@t-online.de>
Signed-off-by: Alexander Mikhalitsyn <aleksandr.mikhalitsyn@futurfusion.io>
Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Message-ID: <20260803081159.91981-8-alexander@mihalicyn.com>
Signed-off-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
It is much easier to migrate an array of structs than individual
structs that are accessed via a pointer to a pointer to an array
of pointers to struct.
For this reason, allocate an array of streams in
virtio_snd_realize() and initialise all stream variables that
are constant at runtime immediately after allocation.
This makes it easier to remove the virtio_snd_set_pcm_params()
and virtio_snd_pcm_prepare() calls in the realisation phase and
to migrate the audio streams of the virtio sound device after
the next few patches.
[AM: there were too many conflicts, I did `git checkout --ours -- <.>`
and then reimplemented the patch idea
/AM]
Signed-off-by: Volker Rümelin <vr_qemu@t-online.de>
Signed-off-by: Alexander Mikhalitsyn <aleksandr.mikhalitsyn@futurfusion.io>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-ID: <20260803081159.91981-5-alexander@mihalicyn.com>
Signed-off-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Merge support for recording & reporting object security status
* '-compat' gains a new option 'insecure-types=reject|warn|accept'
* '-device help', '-accel help' and '-machine help' report
security status of their objects
* 'qom-list-types' can filter and report on security status of types
* 'query-machines' can report on security status of machines
* Adding macros for defining secure machine types
# -----BEGIN PGP SIGNATURE-----
#
# iQIzBAABCAAdFiEEOSEivHoFu8YQee2OpU5XPKwd8GwFAmqsD5wACgkQpU5XPKwd
# 8GwCoA//Q7PMN03PA+goSRLA3iyYGf6hEbiy/rMUfaqUD0qU+pSPxAzvDMAO4QXO
# 6Sn6iqo44y1j4CLPPsAAydQwG9VpzbYcBrtU2z7qLRccNPD4qQzYNTJnmSshApLW
# L1aEfZo1fKMio3mmAkUy7W7g/0vV9BUtHsdNtFfH4t8jQKLRC5XSSjcN2HPWaxQ/
# uniC4wWJRyzFpajVzQPaPQU3JeQLXfxHY7O+U8NSGltVDQJY9FowXJQ9RisuOerj
# kNe1CdXlyp6DPQybwFUHpAl6KBVxYq51b5uIAake7L4kw7XbmFPw0cRKuUkikBBV
# XK5u0PQc5WXwIxSDb5Op6j7W2Suuq3/hj8KKsHFuUz9PsQa9+CuWPQzK5jeoHNDw
# UWqowADq9OHP39DvR+DrBFD8kGikmKKA+DB7ay675zM/NEbhSdCTbM+BaiBg6ySX
# 6/lZ3cnScXZ9NJy8KmLIRGC1JJZbmkzZ59k7VeMg+InVHBPw44eJKgz+tIU/6SlH
# gPcLx8M0xpfg8CpcZ99N/6ePRjRVsuqdtgKr55k2592oWGLRIYVXynbULFtL3oEu
# P1Cj6JaEIcWL/tJdaWbJ2ewtksqQCojyWCRp1pWgnU2YFoU8uBmpUWbzS8AvgHfH
# +kGtIFP05N/fNhIXCJX2gdBnWbg3gyfuBuWBHcc8TyYTHnb7w3o=
# =LKqO
# -----END PGP SIGNATURE-----
# gpg: Signature made Thu 17 Sep 2026 06:04:44 AM HST
# gpg: using RSA key 392122BC7A05BBC61079ED8EA54E573CAC1DF06C
# gpg: Good signature from "Daniel P. Berrange <dan@berrange.com>" [unknown]
# gpg: aka "Daniel P. Berrange <berrange@redhat.com>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: DAF3 A6FD B26B 6291 2D0E 8E3F BE86 EBB4 1510 4FDF
# Subkey fingerprint: 3921 22BC 7A05 BBC6 1079 ED8E A54E 573C AC1D F06C
* tag 'misc-fixes-pull-request' of https://gitlab.com/berrange/qemu:
machine: add helpers for declaring secure/insecure machine types
docs: expand security docs with info about security status
qom: report & filter on security status in qom-list-types
qom: refactor data passing for QOM list filtering
hw/core: report security status in query-machines
system: report device security status in help output
system: check security of device types
system: report machine security status in help output
system: check security for machine types
system: report acclerator security status in help output
system: check security for accelerator types
qom: add helper API for checking object class security policy compliance
qapi: add 'insecure-types' option for -compat argument
qom: add tracking of security state of object types
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
The current DEFINE_MACHINE macro will declare machine type without any
explicit statement about the security status. As such the machine type
will be treated as implicitly insecure at runtime.
Introduce a new DEFINE_SECURE_MACHINE macro (with variants) that
allow code to make an explicit statement that the machine is treated
as secure. This should primarily be used for versioned machine types
that are intended to be used with KVM, though some others may warrant
a security declaration.
Use of the existing macros marks a machine as insecure, which is the
desired default for most machines servicing emulation use cases.
The same is done for the specialized i386 PC related macros.
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
This introduces a new 'insecure-types' option for the 'compat'
argument that accepts three values
* accept: Allow any usage
* reject: Reject with an error reported
* warn: Allow any usage, with a warning reported
For historical compatibility it defaults to 'accept'.
The 'reject' and 'warn' values will take effect for any type
that has been explicitly marked insecure, or is lacking an
explicit declaration of its security status.
This new command line option is currently a no-op, but will
become functional as following patches enable the checks.
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
This introduces a new flag "secure" against the Type/TypeInfo
structs, and helpers to check this against the ObjectClass
struct.
If an object is considered to provide a security boundary to
protect against untrusted code, the "secure" flag must be
explicitly set to true.
If it is set to false, or left unset, this indicates that
the object does not intend to provide a security boundary.
Bugs related to this object class will be ineligible for
CVE assignment.
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Traditional edk2 behavior is to require a self-signed platform key when
enrolling secure boot certificates in setup mode. In 2023 a config
option has been added (PcdRequireSelfSignedPk) which allows to relax
that requirement, see edk2 commit 566cdfc675fa ("SecurityPkg: limit
verification of enrolled PK in setup mode").
This patch adds a similar config option to the qemu uefi variable
driver.
No functional change, the default value for the new config option
maintains existing behavior.
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Message-ID: <20260904085509.2267560-2-kraxel@redhat.com>
Parameter directive handlers either ignore param->byte_offset,
overwriting each other when several parameters share one area, or use
it without validating it, letting a malformed IGVM file corrupt QEMU's
memory.
Add qigvm_get_param_data(), which validates byte_offset against the
parameter area size and returns the offset-adjusted pointer together
with the space left after it. Convert all parameter directive handlers
to use it and to check their writes against that remaining space, so
that no parameter can be written past the end of its area.
Fixes: c1d466d267 ("backends/igvm: Add IGVM loader and configuration")
Fixes: dea1f68a5c ("igvm: Fill MADT IGVM parameter field on x86_64")
Fixes: 1c4bd8f13c ("igvm: add device tree parameter support")
Signed-off-by: Luigi Leonardi <leonardi@redhat.com>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Message-ID: <20260916-fix_offset-v5-1-11cf8ef37854@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
A QEMUCursor outlives the call that publishes it and is shared between
threads, but its refcount was a plain int with no single lock covering
every user. qemu_console_set_cursor() takes and drops references from
the main loop under the BQL alone, hw/display/qxl-render.c does so from
the SPICE display worker thread, and ui/spice-display.c does so under
SimpleSpiceDisplay::lock. ui/cocoa.m and ui/dbus-listener.c add two more
threads.
The pair that collides is qemu_spice_cursor_refresh_bh(), which drops
ssd->lock before calling qemu_console_set_cursor(), and the worker
refcounting the same cursor under that lock. A lost increment frees the
cursor while the console still points at it, so the console's next unref
decrements memory the allocator has already handed out again. Locking
ssd.cursor is not enough on its own: with that done, this is the race
that remains.
Assert on the value the decrement observed while here. Dropping a
reference that was never taken used to be silent, because the decrement
lands in the allocator metadata of the freed chunk: nothing is logged,
the object is not freed twice, and the process runs on until some later
allocation walks the damaged free list and faults, arbitrarily far from
the code that caused it.
Fixes: 0b2824e5e4 ("spice: use bottom half instead of refresh timer for cursor updates")
Cc: qemu-stable@nongnu.org
Cc: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Denis V. Lunev <den@openvz.org>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-ID: <20260903192647.2677279-3-den@openvz.org>
Add emulation of the core components (PCI function 1 aka I/O
Peripherals) of the National Semiconductor SuperIO chip which was
commonly used in HP PA-RISC B- and C-class workstations. This includes
the PIC interrupt controller, the floppy controller, serial and parallel
ports.
Signed-off-by: Abizer Lokhandwala <abizerlokhandwalastd10@gmail.com>
Signed-off-by: Helge Deller <deller@gmx.de>
Some HP B- and C-class workstations used a PCI SuperIO chip from National
Semiconductor for USB, serial, parallel and FDC. Add the relevant PCI IDs, so
that the QEMU driver can reuse the constants.
Signed-off-by: Helge Deller <deller@gmx.de>
pci, vhost, virtio, iommu, apci: features, fixes
new vhost-user-media device
virtio-net now supports live-TAP local migration
cxl now supports CFMW restrictions and per-window options
intel_iommu now supports concurrent page fault handling with PRI
pci now batches memory transactions around mapping updates
vhost-user-blk now allows toggling inflight-migration at runtime
virtio-rtc now supports smeared UTC clock type
intel_iommu now exposes SMPWC when SVM is enabled
new reviewer for CXL patches
Fixes, cleanups all over the place
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
# -----BEGIN PGP SIGNATURE-----
#
# iQFDBAABCgAtFiEEXQn9CHHI+FuUyooNKB8NuNKNVGkFAmqkXRUPHG1zdEByZWRo
# YXQuY29tAAoJECgfDbjSjVRpoWsH/jeMRFjgYu5Es05ha87JW6NJW6j/Ggw3F8e5
# kup/SsoeqX+pK1VqXkKimWRf0iXsnweTqviVR88KMmMBP9UNdwgRBM7XflplYiOv
# UOsjZGZAKjOKnyjbQyNihYY4CfaJn2VYkxJBRxweS3/OEK4JV2wmFcWEjFuZEdJT
# SXpYXAPu0e8XTPVk/+bhi6kIYHhsuu1sWhcsoRDGdw5ZrGvwTwF8cS4SWaYHrWc1
# wjvC39P3Hg+Zvw6vDkPP2Amos2s6iheEgsPI0628YYvER+YV641YD48xEXqTG44e
# FGwCihJ97rYYGQEwL+1FL4ZLKcp7HwacqxkJYg+GHbKj1Iog9OQ=
# =9H6A
# -----END PGP SIGNATURE-----
# gpg: Signature made Fri 11 Sep 2026 09:57:09 AM HST
# gpg: using RSA key 5D09FD0871C8F85B94CA8A0D281F0DB8D28D5469
# gpg: issuer "mst@redhat.com"
# gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>" [unknown]
# gpg: aka "Michael S. Tsirkin <mst@redhat.com>" [unknown]
# gpg: WARNING: The key's User ID is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 0270 606B 6F3C DF3D 0B17 0970 C350 3912 AFBE 8E67
# Subkey fingerprint: 5D09 FD08 71C8 F85B 94CA 8A0D 281F 0DB8 D28D 5469
* tag 'for_upstream' of https://git.kernel.org/pub/scm/virt/kvm/mst/qemu: (74 commits)
MAINTAINERS: add Junjie Cao as CXL reviewer
vhost-user-blk: use GET_VRING_BASE_SKIP_DRAIN when inflight-migration is on
vhost-user-blk: move inflight_needed higher
vhost-user-blk: make inflight-migration prop mutable on running vm
vhost-user: use skip_drain with GET_VRING_BASE_SKIP_DRAIN message
vhost-user: add GET_VRING_BASE_SKIP_DRAIN message
vhost-user: add skip_drain param to do_vhost_virtqueue_stop
intel_iommu: Expose SMPWC when SVM is enabled
virtio-net: validate IHL in virtio_net_rsc_extract_unit4 before use
net/tap-solaris: Fix resource leaks on error paths
hw/hotplug: Constify HotplugHandler
hw/hotplug: Reduce some HotplugHandler variables scope
hw/hotplug: Mark various HotplugHandlerClass variables as const
hw/acpi: Make AcpiGedState const in build_ged_aml()
pci: load a device's config inside one memory transaction
pci: batch BAR remapping into one memory transaction
intel_iommu: Always write all the flags passed to vtd_set_flag_in_pte
intel_iommu: Only set dirty bit when PTE exposes write permission
intel_iommu: Support concurrent page fault handling with PRI
virtio-rtc: Report smeared UTC clock type
...
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Currently during live migration vhost-user-blk sends GET_VRING_BASE to
stop vrings, which causes the back-end to drain all in-flight I/O before
returning. This blocks the migration source until all I/O completes,
adding significant downtime proportional to the I/O load.
When inflight-migration is enabled, send GET_VRING_BASE_SKIP_DRAIN
instead. This instructs the back-end to immediately suspend in-flight
I/O and record it in the shared inflight region, which is then migrated
to the destination host along with the rest of the device state.
Since inflight-migration can only be toggled while the VM is running,
i2ts value at stop time reliably reflects the intent set on a live VM.
There is no need to check migration runstate to decide whether to skip
draining. Using GET_VRING_BASE_SKIP_DRAIN on a regular VM stop is
safe - the back-end records any in-flight requests in the shared
inflight region, and they will be resubmitted when the VM starts again
via SET_INFLIGHT_FD.
If the back-end does not support
VHOST_USER_PROTOCOL_F_GET_VRING_BASE_SKIP_DRAIN,
migration is aborted with an error in pre_save rather than hitting an
assert at runtime.
Signed-off-by: Alexandr Moshkov <dtalexundeer@yandex-team.ru>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20260803072853.2920007-7-dtalexundeer@yandex-team.ru>
VHOST_USER_PROTOCOL_F_GET_VRING_BASE_INFLIGHT was introduced to allow
the back-end to suspend in-flight I/O during GET_VRING_BASE instead of
draining it, enabling live migration of in-flight requests. However,
this behaviour is tied to the protocol feature itself - once negotiated,
there is no way for the front-end to tell the back-end to fall back to
the normal drain behaviour on a per-stop basis.
Introduce a separate message VHOST_USER_GET_VRING_BASE_SKIP_DRAIN
(id=45) guarded by a new protocol feature
VHOST_USER_PROTOCOL_F_GET_VRING_BASE_SKIP_DRAIN. The message is
identical to GET_VRING_BASE except that the back-end must immediately suspend all
in-flight I/O and record it in the inflight region. This way the
front-end has explicit per-call control: send GET_VRING_BASE for normal drain,
send GET_VRING_BASE_SKIP_DRAIN when immediate suspend is needed.
The new feature requires both
VHOST_USER_PROTOCOL_F_GET_VRING_BASE_INFLIGHT
and VHOST_USER_PROTOCOL_F_INFLIGHT_SHMFD to be negotiated.
Signed-off-by: Alexandr Moshkov <dtalexundeer@yandex-team.ru>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20260803072853.2920007-3-dtalexundeer@yandex-team.ru>
Currently do_vhost_virtqueue_stop always sends GET_VRING_BASE to the
back-end, which requires the back-end to drain all in-flight I/O before
stopping the vring.
Add a skip_drain parameter to do_vhost_virtqueue_stop and propagate it
up through vhost_virtqueue_stop, vhost_dev_stop and their callers.
The parameter will be used in a follow-up commit to send a new protocol
message that instructs the back-end to suspend in-flight I/O immediately
instead of draining it.
Signed-off-by: Alexandr Moshkov <dtalexundeer@yandex-team.ru>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20260803072853.2920007-2-dtalexundeer@yandex-team.ru>
HotplugHandler value returned from qdev_get_hotplug_handler()
points to the handler of and object implementing the
TYPE_HOTPLUG_HANDLER interface. That handler mostly points to
read-only section which shouldn't not be updated. Better
protect it with the const qualifier.
Mechanical change using 'sed' then manually adapted coding style.
Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20260903230245.65601-5-philmd@oss.qualcomm.com>
vhost_virtqueue_mask() currently reports failures from
vhost_set_vring_call() but always returns void, so callers cannot
react. In particular, vhost_virtqueue_start() has a TODO next to the
unmask call when !use_guest_notifier_mask.
Make vhost_virtqueue_mask() return the underlying errno, and on failure
in vhost_virtqueue_start() jump to the existing fail path which unmaps
the vring and propagates the error to the device start caller. Other
call sites keep today's behavior by ignoring the return value.
Signed-off-by: Xiong Weimin <xiongweimin@kylinos.cn>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20260807024359.2157914-1-xiongweimin@kylinos.cn>
When a guest triggers PCIe hot-unplug while the free-page-hint BH
is running on an IOThread, the BH will keep accessing
vq->used_elems array when running it. Note that qemu_bh_delete
merely prevents new BHs from running, it does not wait
for already running ones to finish.
We need to wait for it to finish - do it like virtio scsi and
run a dummy oneshot AIO in the same context, and wait for it.
But there's a twist: BH could be blocked in qemu_cond_wait,
then AIO won't run.
Add a special reporting state FREE_PAGE_HINT_S_UNREALIZE to make BH exit
immediately.
Cc: David Hildenbrand <david@kernel.org>
Fixes: CVE-2026-66899
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4079
Reported-by: mhun512 <mhun512@gmail.com>
Reviewed-by: David Hildenbrand <david@kernel.org>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <0967d574d9ffe469edf5fc16da86237e54a69c34.1785327742.git.mst@redhat.com>
Expose the CFMWS "Window Restrictions" (CXL r4.0 9.18.1.3) as named
per-window machine properties -- device-coherent, host-only, volatile,
persistent, fixed-config and back-invalidate -- so the advertised
restrictions can be configured per window rather than left at the
default.
No changes in default options. HDM-D and HDM-H are advertised by default;
disabling one (device-coherent=off or host-only=off) narrows the window to
the other. back-invalidate implies device-coherent (HDM-DB) and suppresses
the host-only default. host-only coherent combined with back-invalidate is
rejected as undefined behavior per the spec.
Signed-off-by: Davidlohr Bueso <dave@stgolabs.net>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20260720233242.901544-5-dave@stgolabs.net>
Next commit will introduce live-migration (with fd-passing) for
TAP net backend. So, now we prepare virtio-net for it
Add virtio-net option local-migration, which is true by default,
but false for older machine types, which doesn't support the feature.
We introduce interface for live-migrating backends:
1. ->is_wait_incoming() handler, so that virtio-net knows, that
backend is not fully intialized, as it waits for incoming migration
stream.
2. MIG_PRI_BACKEND priority: backends should migrate with higher
priority than virtio-net, so that we can do final preparations
here in post-load handlers and be sure, that backends are already
prepared.
Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Reviewed-by: Ben Chaney <bchaney@akamai.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20260819180201.1970193-14-vsementsov@yandex-team.ru>
We are going to implement local-migration feature: some devices will be
able to transfer open file descriptors through migration stream (which
must UNIX domain socket for that purpose). This allows to transfer the
whole backend state without reconnecting and restarting the backend
service. For example, virtio-net will migrate its attached TAP netdev,
together with its connected file descriptors.
In this commit we introduce a migration parameter, which enables
the feature for devices that support it (none at the moment).
We can't simply auto-detect local migration by checking whether the
migration channel is a UNIX domain socket: the UNIX socket may be only
the first part of the transfer channel to a remote target. Hence an
explicit parameter is needed. Moreover, "local" migration parameter
may be useful in cpr-exec mode, when FDs are passed through exec
instead of UNIX socket.
Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Acked-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Peter Xu <peterx@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20260819180201.1970193-10-vsementsov@yandex-team.ru>
The same loop iterating scanouts and disabling those matching a given
resource_id was duplicated across four call sites in three backends.
Factor it into a shared helper.
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Release the scanout dmabuf before installing the texture. A full
virtio_gpu_disable_scanout() is not used because the scanout is
reassigned immediately afterwards.
Fixes: 7c092f17cc ("virtio-gpu: Handle resource blob commands")
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
The per-resource scanout_bitmask is a reverse index of which
scanouts reference a given resource. The information is already
available from scanout->resource_id. Performance impact should be
negligible.
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Display backend GL callbacks (scanout, flush, release, etc.) may be
invoked from a different GL context, like virgl. Since framebuffer
objects are per-context and textures require a valid context for
deletion, each callback must ensure the correct context is active before
performing GL operations.
Make each backend's own GL context current at the entry of every
callback that performs GL work.
For GTK, the previously shared gd_gl_release_dmabuf is split into
backend-specific gd_egl_release_dmabuf and gd_gl_area_release_dmabuf,
matching the existing pattern where each backend manages its own
context.
On the virgl side, restore ctx0 with virgl_renderer_force_ctx_0()
after SET_SCANOUT, RESOURCE_FLUSH, and SET_SCANOUT_BLOB command
handlers, since their display callbacks may have changed the current
GL context.
Note: restoring virgl ctx0 current is not necessarily correct,
fences may not work. We will follow-up with a complementary fix.
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Make qemu_dmabuf_free() call qemu_dmabuf_close(), so the dmabuf always
owns and closes its fds. This removes the need for callers to
explicitly close fds before freeing and simplify the code.
To support this, virtio_gpu_create_dmabuf() now dup()s the resource fd
so each QemuDmaBuf has an independent copy. The scanout-matching loop
in virtio_gpu_fini_udmabuf() is no longer needed and is removed.
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
VirtIOGPU tracks presented dmabufs both through a per-scanout primary
pointer and a device-wide list of VGPUDMABuf wrappers. Only the current
DMA-BUF for a scanout can ever be presented, so the list and the wrapper
struct are redundant bookkeeping.
Store the QemuDmaBuf directly in virtio_gpu_scanout and drop VGPUDMABuf
and the device-wide list. The wrapper only carried the buffer and its
scanout id; the id is now implicit in the owning scanout.
No functional change intended.
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
The draw_submitted flag on QemuDmaBuf is only used by the GTK display
backend to gate the draw pipeline and prevent gl_block refcount
imbalance when the guest submits frames faster than GTK draws them. It
is not an intrinsic property of the DMA-BUF but transient display
listener state.
Move it to VirtualGfxConsole, replacing the getter/setter calls with
direct struct member access. Reset the flag when the active dmabuf is
released in gd_gl_release_dmabuf().
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
The sync and fence_fd fields on QemuDmaBuf are only used by the GTK
display backend for GPU fence synchronization during draw. They are not
intrinsic properties of the DMA-BUF itself but transient GL state tied
to the display listener.
Move fence_fd to VirtualGfxConsole and keep the EGL sync local to the
draw operation. Change egl_dmabuf_create_sync() and
egl_dmabuf_create_fence() to return values instead of storing them on the
dmabuf. This makes the fence lifecycle independent of the dmabuf
lifetime.
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
All allocation sites used g_new0() which zero-initializes fields.
However share_handle must be SHAREABLE_NONE (-1 on Unix, NULL on
Windows) and dmabuf_fd must be -1, not 0. Centralize allocation and
field initialization in new constructors fix this and reduce code
duplication.
This fixes -display dbus with virtio-gpu blob resources. The other
end is currently receiving qemu fd 0.
Fixes: 5f899c34af (“virtio-gpu: allocate shareable 2d resources on !win32”)
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
