summary refs log tree commit diff stats
path: root/scripts/rust/rustc_args.py (unfollow)
Commit message (Collapse)AuthorFilesLines
2025-07-21accel/hvf: Display executable bit as 'X'Philippe Mathieu-Daudé1-1/+1
Developers are accustomed to read RWX, not RWE. Replace E -> X. Reported-by: Alex Bennée <alex.bennee@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Mads Ynddal <mads@ynddal.dk> Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2025-07-21crypto: load all certificates in X509 CA fileHenry Kleynhans1-12/+11
Some CA files may contain multiple intermediaries and roots of trust. These may not fit into the hard-coded limit of 16. Extend the validation code to allocate enough space to load all of the certificates present in the CA file and ensure they are cleaned up. Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Signed-off-by: Henry Kleynhans <hkleynhans@fb.com> [DB: drop MAX_CERTS constant & whitespace tweaks] Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2025-07-21hvf: arm: Emulate ICC_RPR_EL1 accesses properlyZenghui Yu1-0/+2
Commit a2260983c655 ("hvf: arm: Add support for GICv3") added GICv3 support by implementing emulation for a few system registers. ICC_RPR_EL1 was defined but not plugged in the sysreg handlers (for no good reason). Fix it. Fixes: a2260983c655 ("hvf: arm: Add support for GICv3") Signed-off-by: Zenghui Yu <zenghui.yu@linux.dev> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-id: 20250714160139.10404-3-zenghui.yu@linux.dev Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2025-07-21hvf: arm: Add permission check in GIC sysreg handlersZenghui Yu1-0/+6
Quoting Peter Maydell: " hvf_sysreg_read_cp() and hvf_sysreg_write_cp() do not check the .access field of the ARMCPRegInfo to ensure that they forbid writes to registers that are marked with a .access field that says they're read-only (and ditto reads to write-only registers). " Before we add more registers in GIC sysreg handlers, let's get it correct by adding the .access checks to hvf_sysreg_read_cp() and hvf_sysreg_write_cp(). With that, a sysreg access with invalid permission will result in an UNDEFINED exception. Suggested-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Zenghui Yu <zenghui.yu@linux.dev> Message-id: 20250714160139.10404-2-zenghui.yu@linux.dev Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2025-07-21target/arm: Make LD1Q decode and trans fn agree about a->uPeter Maydell1-1/+1
For the LD1Q instruction (gather load of quadwords) we use the LD1_zprz pattern with MO_128 elements. At this element size there is no signed vs unsigned distinction, and we only set the 'u' bit in the arg_LD1_zprz struct because we share the code and decode struct with smaller element sizes. However, we set u=0 in the decode pattern line but then accidentally asserted that it was 1 in the trans function. Since our usual convention is that the "default" is unsigned and we only mark operations as signed when they really do need to extend, change the decode pattern line to set u=1 to match the assert. Fixes: d2aa9a804ee6 ("target/arm: Implement LD1Q, ST1Q for SVE2p1") Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20250718173032.2498900-11-peter.maydell@linaro.org
2025-07-21target/arm: Honour FPCR.AH=1 default NaN value in FMAXNMQV, FMINNMQVPeter Maydell1-12/+17
The FMAXNMQV and FMINNMQV insns use the default NaN as their identity value for inactive source vector elements. We open-coded this in sve_helper.c, hoping to avoid a function call. However, this fails to account for FPCR.AH=1 changing the default NaN value to set the sign bit. Use a call to floatN_default_nan() to obtain this value. Fixes: 1de7ecfc12d05 ("target/arm: Implement FADDQV, F{MIN, MAX}{NM}QV for SVE2p1") Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20250718173032.2498900-10-peter.maydell@linaro.org
2025-07-21target/arm: Don't nest H() macro calls in SVE DO_REDUCEPeter Maydell1-1/+1
In the part of the SVE DO_REDUCE macro used by the SVE2p1 FMAXQV, FMINQV, etc insns, we incorrectly applied the H() macro twice when calculating an offset to add to the vn pointer. This has no effect on little-endian hosts but on big-endian hosts the two invocations will cancel each other out and we will access the wrong part of the array. The "s * 16" part of the expression is already aligned, so we only need to use the H macro on the "e". Correct the macro usage. Fixes: 1de7ecfc12d05 ("target/arm: Implement FADDQV, F{MIN, MAX}{NM}QV for SVE2p1") Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20250718173032.2498900-9-peter.maydell@linaro.org
2025-07-21target/arm: Correct sense of FPCR.AH test for FMAXQV and FMINQVPeter Maydell1-2/+2
When we implemented the FMAXQV and FMINQV insns we accidentally inverted the sense of the FPCR.AH test, so we gave the AH=1 behaviour when FPCR.AH was zero, and vice-versa. (The difference is limited to handling of negative zero and NaN inputs.) Fixes: 1de7ecfc12d05 ("target/arm: Implement FADDQV, F{MIN, MAX}{NM}QV for SVE2p1") Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-id: 20250718173032.2498900-8-peter.maydell@linaro.org
2025-07-21target/arm: Add BFMLA, BFMLS (indexed)Peter Maydell2-9/+18
FEAT_SVE_B16B16 adds bfloat16 versions of the FMLA and FMLS insns in the SVE floating-point multiply-add (indexed) insn group. Implement these. Fixes: 7b1613a1020d2942 ("target/arm: Enable FEAT_SME2p1 on -cpu max") Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20250718173032.2498900-7-peter.maydell@linaro.org
2025-07-21target/arm: Add BFMLA, BFMLS (vectors)Peter Maydell3-6/+98
FEAT_SVE_B16B16 adds bfloat16 versions of the FMLA and FMLS insns in the "SVE floating-point multiply-accumulate writing addend" group, encoded as sz=0b00. Fixes: 7b1613a1020d2942 ("target/arm: Enable FEAT_SME2p1 on -cpu max") Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20250718173032.2498900-6-peter.maydell@linaro.org
2025-07-21target/arm: Add BFMUL (indexed)Peter Maydell4-1/+5
FEAT_SVE_B16B16 adds a bfloat16 version of the FMUL insn in the floating-point multiply (indexed) instruction group. The encoding is slightly bespoke; in our implementation we use MO_8 to indicate bfloat16, as with the other B16B16 insns. Fixes: 7b1613a1020d2942 ("target/arm: Enable FEAT_SME2p1 on -cpu max") Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20250718173032.2498900-5-peter.maydell@linaro.org
2025-07-21target/arm: Add BFMIN, BFMAX (predicated)Peter Maydell3-2/+27
FEAT_SVE_B16B16 adds bfloat16 versions of the SVE floating point (predicated) instructions, which are encoded via sz=0b00. Add the BFMAX and BFMIN insns. These have separate behaviour for AH=1 and AH=0; we have already implemented the AH=1 helper for the SME2 versions of these insns. Fixes: 7b1613a1020d2942 ("target/arm: Enable FEAT_SME2p1 on -cpu max") Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20250718173032.2498900-4-peter.maydell@linaro.org
2025-07-21target/arm: Add BFADD, BFSUB, BFMUL, BFMAXNM, BFMINNM (predicated)Peter Maydell3-5/+32
FEAT_SVE_B16B16 adds bfloat16 versions of the SVE floating point (predicated) instructions, which are encoded via sz=0b00. Add BFADD, BFSUB, BFMUL, BFMAXNM, BFMINNM; these are all the insns in this group which do not change behaviour for AH=1. We will deal with BFMAX/BFMIN (which do have different AH=1 behaviour) in a following commit. Fixes: 7b1613a1020d2942 ("target/arm: Enable FEAT_SME2p1 on -cpu max") Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20250718173032.2498900-3-peter.maydell@linaro.org
2025-07-21target/arm: Add BFADD, BFSUB, BFMUL (unpredicated)Peter Maydell3-1/+11
FEAT_SVE_B16B16 adds bfloat16 versions of the SVE floating point (unpredicated) instructions, which are encoded via sz==0b00. Fixes: 7b1613a1020d2942 ("target/arm: Enable FEAT_SME2p1 on -cpu max") Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20250718173032.2498900-2-peter.maydell@linaro.org
2025-07-21docs: Fix Aspeed titleCédric Le Goater1-0/+1
commit ad8e0e8a0088 removed the "======" underlining the file title which broke documentation rendering. Add it back. Fixes: ad8e0e8a0088 ("docs: add support for gb200-bmc") Cc: Ed Tanous <etanous@nvidia.com> Reported-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Cédric Le Goater <clg@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Ed Tanous <etanous@nvidia.com> Message-id: 20250715061904.97540-1-clg@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2025-07-21hw/misc/max78000_aes: Comment Internal Key StorageJackson Donaldson1-0/+6
Coverity Scan noted an unusual pattern in the MAX78000 aes device, with duplicated calls to set_decrypt. This commit adds a comment noting why the implementation is correct. Signed-off-by: Jackson Donaldson <jcksn@duck.com> Message-id: 20250716002622.84685-1-jcksn@duck.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2025-07-21host-utils: Drop workaround for buggy Apple Clang __builtin_subcll()Peter Maydell2-14/+1
In commit b0438861efe ("host-utils: Avoid using __builtin_subcll on buggy versions of Apple Clang") we added a workaround for a bug in Apple Clang 14 where its __builtin_subcll() implementation was wrong. This bug was only present in Apple Clang 14, not in upstream clang, and is not present in Apple Clang versions 15 and newer. Since commit 4e035201 we have required at least Apple Clang 15, so we no longer build with the buggy versions. We can therefore drop the workaround. This is effectively a revert of b0438861efe. This should not be backported to stable branches, which may still need to support Apple Clang 14. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3030 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-id: 20250714145033.1908788-1-peter.maydell@linaro.org
2025-07-21target/arm: Provide always-false kvm_arm_*_supported() stubs for usermodePeter Maydell1-0/+35
If you try to build aarch64-linux-user with clang and --enable-debug then it fails to compile: ld: libqemu-aarch64-linux-user.a.p/target_arm_cpu64.c.o: in function `cpu_arm_set_sve': ../../target/arm/cpu64.c:321:(.text+0x1254): undefined reference to `kvm_arm_sve_supported' This is a regression introduced in commit f86d4220, which switched the kvm-stub.c file away from being built for all arm targets to only being built for system emulation binaries. It doesn't affect gcc, presumably because even at -O0 gcc folds away the always-false kvm_enabled() condition but clang does not. We would prefer not to build kvm-stub.c once for usermode and once for system-emulation binaries, and we can't build it just once for both because it includes cpu.h. So instead provide always-false versions of the five functions that are valid to call without KVM support in kvm_arm.h. Fixes: f86d42205c2eba ("target/arm/meson: accelerator files are not needed in user mode") Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3033 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Message-id: 20250714135152.1896214-1-peter.maydell@linaro.org
2025-07-21hw/misc/ivshmem-pci: Improve error handlingPeter Maydell1-1/+8
Coverity points out that the ivshmem-pci code has some error handling cases where it incorrectly tries to use an invalid filedescriptor. These generally happen because ivshmem_recv_msg() calls qemu_chr_fe_get_msgfd(), which might return -1, but the code in process_msg() generally assumes that the file descriptor was provided when it was supposed to be. In particular: * the error case in process_msg() only needs to close the fd if one was provided * process_msg_shmem() should fail if no fd was provided Coverity: CID 1508726 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Markus Armbruster <armbru@redhat.com> Message-id: 20250711145012.1521936-1-peter.maydell@linaro.org
2025-07-21target/arm: Correct encoding of Debug Communications Channel registersPeter Maydell1-2/+11
We don't implement the Debug Communications Channel (DCC), but we do attempt to provide dummy versions of its system registers so that software that tries to access them doesn't fall over. However, we got the tx/rx register definitions wrong. These should be: AArch32: DBGDTRTX p14 0 c0 c5 0 (on writes) DBGDTRRX p14 0 c0 c5 0 (on reads) AArch64: DBGDTRTX_EL0 2 3 0 5 0 (on writes) DBGDTRRX_EL0 2 3 0 5 0 (on reads) DBGDTR_EL0 2 3 0 4 0 (reads and writes) where DBGDTRTX and DBGDTRRX are effectively different names for the same 32-bit register, which has tx behaviour on writes and rx behaviour on reads. The AArch64-only DBGDTR_EL0 is a 64-bit wide register whose top and bottom halves map to the DBGDTRRX and DBGDTRTX registers. Currently we have just one cpreg struct, which: * calls itself DBGDTR_EL0 * uses the DBGDTRTX_EL0/DBGDTRRX_EL0 encoding * is marked as ARM_CP_STATE_BOTH but has the wrong opc1 value for AArch32 * is implemented as RAZ/WI Correct the encoding so: * we name the DBGDTRTX/DBGDTRRX register correctly * we split it into AA64 and AA32 versions so we can get the AA32 encoding right * we implement DBGDTR_EL0 at its correct encoding Cc: qemu-stable@nongnu.org Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2986 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20250708141049.778361-1-peter.maydell@linaro.org
2025-07-21hvf: arm: Remove $pc from trace_hvf_data_abort()Zenghui Yu2-2/+2
We don't synchronize vcpu registers from the hardware accelerator (e.g., by cpu_synchronize_state()) in the Dabort handler, so env->pc points to the instruction which has nothing to do with the Dabort at all. And it doesn't seem to make much sense to log PC in every Dabort handler, let's just remove it from this trace event. Signed-off-by: Zenghui Yu <zenghui.yu@linux.dev> Reviewed-by: Mads Ynddal <mads@ynddal.dk> Message-id: 20250713154719.4248-1-zenghui.yu@linux.dev Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2025-07-21docs/devel: fix over-quoting of QEMU_TEST_KEEP_SCRATCHAlex Bennée1-1/+1
Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Message-ID: <20250717104105.2656786-1-alex.bennee@linaro.org> Signed-off-by: Thomas Huth <thuth@redhat.com>
2025-07-21functional: always enable all python warningsDaniel P. Berrangé1-0/+4
Of most importance is that this gives us a heads-up if anything we rely on has been deprecated. The default python behaviour only emits a warning if triggered from __main__ which is very limited. Setting the env variable further ensures that any python child processes will also display warnings. Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> Acked-by: Thomas Huth <thuth@redhat.com> Message-ID: <20250715143023.1851000-11-berrange@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2025-07-21functional: ensure sockets and files are closedDaniel P. Berrangé2-0/+5
The multiprocess and virtio_gpu tests open sockets but then forget to close them, which triggers resource leak warnings The virtio_gpu test also fails to close a log file it opens. Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Message-ID: <20250715143023.1851000-10-berrange@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2025-07-21functional: ensure log handlers are closedDaniel P. Berrangé1-0/+2
This avoids a resource leak warning from python when the log handler is garbage collected. Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Message-ID: <20250715143023.1851000-9-berrange@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2025-07-21linux-headers: Remove the 32-bit arm headersThomas Huth9-783/+0
KVM support for 32-bit arm has been dropped a while ago, so we don't need these headers in QEMU anymore. Fixes: 82bf7ae84ce ("target/arm: Remove KVM support for 32-bit Arm hosts") Acked-by: Cornelia Huck <cohuck@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Thomas Huth <thuth@redhat.com> Message-ID: <20250710120035.169376-1-thuth@redhat.com>
2025-07-21net/vhost-user: Remove unused "err" from chr_closed_bh() (CID 1612365)Laurent Vivier1-4/+0
The "err" variable was declared but never used within the chr_closed_bh() function. This resulted in a dead code warning (CID 1612365) from Coverity. Remove the unused variable and the associated error block to resolve the issue. Signed-off-by: Laurent Vivier <lvivier@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Jason Wang <jasowang@redhat.com>
2025-07-21net/passt: Initialize "error" variable in net_passt_send() (CID 1612368)Laurent Vivier1-1/+1
This was flagged by Coverity as a memory illegal access. Initialize the pointer to NULL at declaration. Signed-off-by: Laurent Vivier <lvivier@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Jason Wang <jasowang@redhat.com>
2025-07-21net/passt: Check return value of g_remove() in net_passt_cleanup() (CID 1612369)Laurent Vivier1-1/+4
If g_remove() fails, use warn_report() to log an error. Signed-off-by: Laurent Vivier <lvivier@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Jason Wang <jasowang@redhat.com>
2025-07-21net/passt: Remove dead code in passt_vhost_user_start error path (CID 1612371)Laurent Vivier1-8/+2
In passt_vhost_user_start(), if vhost_net_init() fails, the "net" variable is NULL and execution jumps to the "err:" label. The cleanup code within this label is conditioned on "if (net)", which can never be true in this error case. This makes the cleanup block dead code, as reported by Coverity (CID 1612371). Refactor the error handling to occur inline, removing the goto and the unreachable cleanup block. Signed-off-by: Laurent Vivier <lvivier@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Jason Wang <jasowang@redhat.com>
2025-07-21net/vhost-user: Remove unused "err" from net_vhost_user_event() (CID 1612372)Laurent Vivier1-5/+0
The "err" variable was declared but never used within the net_vhost_user_event() function. This resulted in a dead code warning (CID 1612372) from Coverity. Remove the unused variable and the associated error block to resolve the issue. Signed-off-by: Laurent Vivier <lvivier@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Jason Wang <jasowang@redhat.com>
2025-07-21net/passt: Remove unused "err" from passt_vhost_user_event() (CID 1612375)Laurent Vivier1-5/+0
The "err" variable was declared but never used within the passt_vhost_user_event() function. This resulted in a dead code warning (CID 1612375) from Coverity. Remove the unused variable and the associated error block to resolve the issue. Signed-off-by: Laurent Vivier <lvivier@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Jason Wang <jasowang@redhat.com>
2025-07-21hw/net/npcm_gmac.c: Drop 'buf' local variablePeter Maydell1-8/+4
We use the local variable 'buf' only when we call dma_memory_read(), and it is always set to &tx_send_buffer[prev_buf_size] immediately before both of those calls. So remove the variable and pass tx_send_buffer + prev_buf_size to dma_memory_read(). This fixes in passing a place where we set buf = tx_send_buffer but never used that value because we always updated buf to something else later before using it. Coverity: CID 1534027 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Jason Wang <jasowang@redhat.com>
2025-07-21hw/net/npcm_gmac.c: Correct test for when to reallocate packet bufferPeter Maydell1-2/+2
In gmac_try_send_next_packet() we have code that does "if this block of data won't fit in the buffer, reallocate it". However, the condition it uses is if ((prev_buf_size + tx_buf_len) > sizeof(buf)) where buf is a uint8_t *. This means that sizeof(buf) is always 8 bytes, and the condition will almost always be true, so we will reallocate the buffer more often than we need to. Correct the condition to test against tx_buffer_size, which is where we track how big the allocated buffer is. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Jason Wang <jasowang@redhat.com>
2025-07-21hw/net/npcm_gmac.c: Unify length and prev_buf_size variablesPeter Maydell1-4/+5
After the bug fix in the previous commit, the length and prev_buf_size variables are identical, except that prev_buf_size is uint32_t and length is uint16_t. We can therefore unify them. The only place where the type makes a difference is that we will truncate the packet at 64K when sending it; this commit preserves that behaviour by using a local variable when doing the packet send. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Jason Wang <jasowang@redhat.com>
2025-07-21hw/net/npcm_gmac.c: Send the right data for second packet in a rowPeter Maydell1-0/+1
The transmit loop in gmac_try_send_next_packet() is constructed in a way that means it will send incorrect data if it it sends more than one packet. The function assembles the outbound data in a dynamically allocated block of memory which is pointed to by tx_send_buffer. We track the first point in this block of memory which is not yet used with the prev_buf_size offset, initially zero. We track the size of the packet we're sending with the length variable, also initially zero. As we read chunks of data out of guest memory, we write them to tx_send_buffer[prev_buf_size], and then increment both prev_buf_size and length. (We might dynamically reallocate the buffer if needed.) When we send a packet, we checksum and send length bytes, starting at tx_send_buffer, and then we reset length to 0. This gives the right data for the first packet. But we don't reset prev_buf_size. This means that if we process more descriptors with further data for the next packet, that data will continue to accumulate at offset prev_buf_size, i.e. after the data for the first packet. But when we transmit that second packet, we send length bytes from tx_send_buffer, so we will send a packet which has the length of the second packet but the data of the first one. The fix for this is to also clear prev_buf_size after the packet has been sent -- we never need the data from packet one after we've sent it, so we can write packet two's data starting at the beginning of the buffer. Cc: qemu-stable@nongnu.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Jason Wang <jasowang@redhat.com>
2025-07-21tap: fix net_init_tap() return codeSteve Sistare1-2/+2
net_init_tap intends to return 0 for success and -1 on error. However, when net_init_tap() succeeds for a multi-queue device, it returns 1, because of this code where ret becomes 1 when g_unix_set_fd_nonblocking succeeds: ret = g_unix_set_fd_nonblocking(fd, true, NULL); if (!ret) { ... error ... free_fail: ... return ret; Luckily, the only current call site checks for negative, rather than non-zero: net_client_init1() if (net_client_init_fun[](...) < 0) Also, in the unlikely case that g_unix_set_fd_nonblocking fails and returns false, ret=0 is returned, and net_client_init1 will use a broken interface. Fix it to be future proof. Signed-off-by: Steve Sistare <steven.sistare@oracle.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2025-07-21net/tap: drop too small packetsVladimir Sementsov-Ogievskiy1-0/+5
Theoretically tap_read_packet() may return size less than s->host_vnet_hdr_len, and next, we'll work with negative size (in case of !s->using_vnet_hdr). Let's avoid it. Don't proceed with size == s->host_vnet_hdr_len as well in case of !s->using_vnet_hdr, it doesn't make sense. Tested-by: Lei Yang <leiyang@redhat.com> Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru> Signed-off-by: Jason Wang <jasowang@redhat.com>
2025-07-18hw/i386: Add the ramfb romfile compatibilityShaoqin Huang6-2/+20
ramfb is a sysbus device so it can only used for machine types where it is explicitly enabled: # git grep machine_class_allow_dynamic_sysbus_dev.*TYPE_RAMFB_DEVICE hw/arm/virt.c: machine_class_allow_dynamic_sysbus_dev(mc, TYPE_RAMFB_DEVICE); hw/i386/microvm.c: machine_class_allow_dynamic_sysbus_dev(mc, TYPE_RAMFB_DEVICE); hw/i386/pc_piix.c: machine_class_allow_dynamic_sysbus_dev(m, TYPE_RAMFB_DEVICE); hw/i386/pc_q35.c: machine_class_allow_dynamic_sysbus_dev(m, TYPE_RAMFB_DEVICE); hw/loongarch/virt.c: machine_class_allow_dynamic_sysbus_dev(mc, TYPE_RAMFB_DEVICE); hw/riscv/virt.c: machine_class_allow_dynamic_sysbus_dev(mc, TYPE_RAMFB_DEVICE); So these six are the only machine types we have to worry about. The three x86 machine types (pc, q35, microvm) will actually use the rom (when booting with seabios). For arm/riscv/loongarch virt we want to disable the rom. This patch sets ramfb romfile option to false by default, except for x86 machines types (pc, q35, microvm) which need the rom file when booting with seabios and machine types <= 10.0 (handling the case of arm virt, for compat reasons). At the same time, set the "use-legacy-x86-rom" property to true on those historical versioned machine types in order to avoid the memory layout being changed. Acked-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Zhao Liu <zhao1.liu@intel.com> Reviewed-by: Eric Auger <eric.auger@redhat.com> Signed-off-by: Shaoqin Huang <shahuang@redhat.com> Message-ID: <20250717100941.2230408-4-shahuang@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2025-07-18vfio: Move the TYPE_* to hw/vfio/types.hShaoqin Huang2-9/+22
Move the TYPE_* to a new file hw/vfio/types.h because the TYPE_VFIO_PCI will be used in later patch, but directly include the hw/vfio/pci.h can cause some compilation error when cross build the windows version. The hw/vfio/types.h can be included to mitigate that problem. Signed-off-by: Shaoqin Huang <shahuang@redhat.com> Message-ID: <20250717100941.2230408-3-shahuang@redhat.com> Reviewed-by: Zhao Liu <zhao1.liu@intel.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2025-07-17i386/tdx: Remove the redundant qemu_mutex_init(&tdx->lock)Xiaoyao Li1-2/+0
Commit 40da501d8989 ("i386/tdx: handle TDG.VP.VMCALL<GetQuote>") added redundant qemu_mutex_init(&tdx->lock) in tdx_guest_init by mistake. Fix it by removing the redundant one. Fixes: 40da501d8989 ("i386/tdx: handle TDG.VP.VMCALL<GetQuote>") Reported-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Link: https://lore.kernel.org/r/20250717103707.688929-1-xiaoyao.li@intel.com Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2025-07-17i386/cpu: Cleanup host_cpu_max_instance_init()Xiaoyao Li1-1/+0
The implementation of host_cpu_max_instance_init() was merged into host_cpu_instance_init() by commit 29f1ba338baf ("target/i386: merge host_cpu_instance_init() and host_cpu_max_instance_init()"), while the declaration of it remains in host-cpu.h. Clean it up. Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Zhao Liu <zhao1.liu@intel.com> Link: https://lore.kernel.org/r/20250716063117.602050-1-xiaoyao.li@intel.com Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2025-07-17target/i386: tdx: fix locking for interrupt injectionPaolo Bonzini1-3/+7
Take tdx_guest->lock when injecting the event notification interrupt into the guest. Fixes CID 1612364. Reported-by: Peter Maydell <peter.maydell@linaro.org> Cc: Xiaoyao Li <xiaoyao.li@intel.com> Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2025-07-17meson: re-generate scripts/meson-buildoptions.sh to fix IGVM entryStefano Garzarella1-1/+1
Commit 84fe49d94a ("meson: Add optional dependency on IGVM library") was inconsistent with the contents of meson_options.txt and the one generated in scripts/meson-buildoptions.sh Let's regenerate the file in this way to keep them consistent and prevent future changes from including the spurious diff: touch meson_options.txt make update-buildoptions Fixes: 84fe49d94a ("meson: Add optional dependency on IGVM library") Cc: roy.hopkins@randomman.co.uk Reported-by: Daniel P. Berrangé <berrange@redhat.com> Signed-off-by: Stefano Garzarella <sgarzare@redhat.com> Link: https://lore.kernel.org/r/20250717131256.157383-1-sgarzare@redhat.com Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2025-07-17i386/cpu: Move x86_ext_save_areas[] initialization to .instance_initZhao Liu1-7/+15
In x86_cpu_post_initfn(), the initialization of x86_ext_save_areas[] marks the unsupported xsave areas based on Host support. This step must be done before accel_cpu_instance_init(), otherwise, KVM's assertion on host xsave support would fail: qemu-system-x86_64: ../target/i386/kvm/kvm-cpu.c:149: kvm_cpu_xsave_init: Assertion `esa->size == eax' failed. (on AMD EPYC 7302 16-Core Processor) Move x86_ext_save_areas[] initialization to .instance_init and place it before accel_cpu_instance_init(). Fixes: commit 5f158abef44c ("target/i386: move accel_cpu_instance_init to .instance_init") Reported-by: Paolo Abeni <pabeni@redhat.com> Tested-by: Paolo Abeni <pabeni@redhat.com> Signed-off-by: Zhao Liu <zhao1.liu@intel.com> Link: https://lore.kernel.org/r/20250717023933.2502109-1-zhao1.liu@intel.com Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2025-07-17target/i386: do not expose ARCH_CAPABILITIES on AMD CPUPaolo Bonzini1-1/+5
KVM emulates the ARCH_CAPABILITIES on x86 for both Intel and AMD cpus, although the IA32_ARCH_CAPABILITIES MSR is an Intel-specific MSR and it makes no sense to emulate it on AMD. As a consequence, VMs created on AMD with qemu -cpu host and using KVM will advertise the ARCH_CAPABILITIES feature and provide the IA32_ARCH_CAPABILITIES MSR. This can cause issues (like Windows BSOD) as the guest OS might not expect this MSR to exist on such cpus (the AMD documentation specifies that ARCH_CAPABILITIES feature and MSR are not defined on the AMD architecture). A fix was proposed in KVM code, however KVM maintainers don't want to change this behavior that exists for 6+ years and suggest changes to be done in QEMU instead. Therefore, hide the bit from "-cpu host": migration of -cpu host guests is only possible between identical host kernel and QEMU versions, therefore this is not a problematic breakage. If a future AMD machine does include the MSR, that would re-expose the Windows guest bug; but it would not be KVM/QEMU's problem at that point, as we'd be following a genuine physical CPU impl. Reported-by: Alexandre Chartre <alexandre.chartre@oracle.com> Suggested-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2025-07-17ramfb: Add property to control if load the romfileShaoqin Huang7-7/+15
Currently the ramfb device loads the vgabios-ramfb.bin unconditionally, but only the x86 need the vgabios-ramfb.bin, this can cause that when use the release package on arm64 it can't find the vgabios-ramfb.bin. Because only seabios will use the vgabios-ramfb.bin, load the rom logic is x86-specific. For other !x86 platforms, the edk2 ships an EFI driver for ramfb, so they don't need to load the romfile. So add a new property use-legacy-x86-rom in both ramfb and vfio_pci device, because the vfio display also use the ramfb_setup() to load the vgabios-ramfb.bin file. After have this property, the machine type can set the compatibility to not load the vgabios-ramfb.bin if the arch doesn't need it. For now the default value is true but it will be turned off by default in subsequent patch when compats get properly handled. Reviewed-by: Zhao Liu <zhao1.liu@intel.com> Reviewed-by: Eric Auger <eric.auger@redhat.com> Signed-off-by: Shaoqin Huang <shahuang@redhat.com> Message-ID: <20250717100941.2230408-2-shahuang@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2025-07-16python: fix editable installs for modern pip/setuptoolsJohn Snow1-2/+2
The way editable installs work has changed at some point since Fedora 40 was released. Generally, we should be opting to use pyproject.toml installs (PEP517/518) - but those are not fully supported until v61 of setuptools, and CentOS Stream 9 ships v53. Until that time, we can make use of a transitional feature in pip/setuptools to use "legacy" editable installs, which is enough to fix "make check-dev" on modern local workstations for now. By using the environment variable approach to configure pip, we avoid any problems for older versions of pip that don't recognize this option, so it's harmless. The config-settings option first appeared in v23 of pip. editable_mode was first supported by setuptools in v64. (I'm not currently precisely aware of when the default behavior of '-e' switched away from 'compat', but it appears to be a joint effect between setuptools and pip versions.) Version information for supported build platforms: distro python3 pip setuptools sphinx -------------------------------------------------------- centos_stream_9 3.9.23 21.3.1 53.0.0 3.4.3 ubuntu_22_04 3.10.12 22.0.2 59.6.0 4.3.2 ** pyproject.toml installs supported as of here ** freebsd 3.11.13 23.3.2 63.1.0 5.3.0 debian_12 3.11.2 23.0.1 66.1.1 5.3.0 ubuntu_24_04 3.12.3 24.0 68.1.2 7.2.6 centos_stream_10 3.12.11 23.3.2 69.0.3 7.2.6 fedora_41 3.13.5 24.2 69.2.0 7.3.7 alpine_3_19 3.11.13 23.3.1 70.3.0 6.2.1 alpine_3_20 3.12.11 24.0 70.3.0 7.2.6 alpine_3_21 3.12.11 24.3.1 70.3.0 8.1.3 ubuntu_24_10 3.12.7 24.2 74.1.2 7.4.7 fedora_42 3.13.5 24.3.1 74.1.3 8.1.3 ubuntu_25_04 3.13.3 25.0 75.8.0 8.1.3 macports 3.13.5 25.1.1 78.1.1 8.2.3 openbsd 3.12.11 25.1.1 79.0.1 8.2.3 alpine_3_22 3.12.11 25.1.1 80.9.0 8.2.3 homebrew 3.13.5 --- 80.9.0 8.2.3 pkgsrc_current 3.12.11 25.1.1 80.9.0 8.2.3 Signed-off-by: John Snow <jsnow@redhat.com> Message-ID: <20250715222548.198888-1-jsnow@redhat.com> Tested-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com>
2025-07-16MAINTAINERS: Add docs/requirements.txtAkihiko Odaki1-0/+1
Add docs/requirements.txt to "Sphinx documentation configuration and build machinery". Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Signed-off-by: John Snow <jsnow@redhat.com> Message-ID: <20250715212848.171879-3-jsnow@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com>
2025-07-16docs: Bump sphinx to 6.2.1Akihiko Odaki2-4/+4
sphinx 5.3.0 fails with Python 3.13.1: ../docs/meson.build:37: WARNING: /home/me/qemu/build/pyvenv/bin/sphinx-build: Extension error: Could not import extension sphinx.builders.epub3 (exception: No module named 'imghdr') ../docs/meson.build:39:6: ERROR: Problem encountered: Install a Python 3 version of python-sphinx and the readthedoc theme Bump sphinx to 6.2.1 and also sphinx_rtd_theme as required for the new sphinx version. (jsnow note: this patch bumps the recommended version for Sphinx to install when it is missing, but allows old versions to be used if they are present and functional. The version used for building docs on readthedocs is pinned to the recommended version, 6.2.1.) Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Tested-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com> Signed-off-by: John Snow <jsnow@redhat.com> Message-ID: <20250715212848.171879-2-jsnow@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com>