summary refs log tree commit diff stats
path: root/system (follow)
Commit message (Collapse)AuthorAgeFilesLines
* system/physmem: Extract API out of 'system/ram_addr.h' headerPhilippe Mathieu-Daudé2025-10-072-0/+2
| | | | | | | | | | Very few files use the Physical Memory API. Declare its methods in their own header: "system/physmem.h". Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Cédric Le Goater <clg@redhat.com> Message-Id: <20251001175448.18933-19-philmd@linaro.org>
* system/physmem: Drop 'cpu_' prefix in Physical Memory APIPhilippe Mathieu-Daudé2025-10-073-29/+29
| | | | | | | | | | | The functions related to the Physical Memory API declared in "system/ram_addr.h" do not operate on vCPU. Remove the 'cpu_' prefix. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Cédric Le Goater <clg@redhat.com> Message-Id: <20251001175448.18933-18-philmd@linaro.org>
* system/physmem: Reduce cpu_physical_memory_clear_dirty_range() scopePhilippe Mathieu-Daudé2025-10-071-1/+8
| | | | | | | | | | | cpu_physical_memory_clear_dirty_range() is now only called within system/physmem.c, by qemu_ram_resize(). Reduce its scope by making it internal to this file. Since it doesn't involve any CPU, remove the 'cpu_' prefix. As it operates on a range, rename @start as @addr. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20251001175448.18933-16-philmd@linaro.org>
* system/physmem: Un-inline cpu_physical_memory_dirty_bits_cleared()Philippe Mathieu-Daudé2025-10-071-0/+7
| | | | | | | | | Avoid maintaining large functions in header, rely on the linker to optimize at linking time. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20251001175448.18933-15-philmd@linaro.org>
* system/physmem: Un-inline cpu_physical_memory_set_dirty_lebitmap()Philippe Mathieu-Daudé2025-10-071-0/+103
| | | | | | | | | | | Avoid maintaining large functions in header, rely on the linker to optimize at linking time. Remove the now unneeded "system/xen.h" header. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20251001175448.18933-14-philmd@linaro.org>
* system/physmem: Un-inline cpu_physical_memory_set_dirty_range()Philippe Mathieu-Daudé2025-10-071-0/+51
| | | | | | | | | Avoid maintaining large functions in header, rely on the linker to optimize at linking time. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20251001175448.18933-12-philmd@linaro.org>
* system/physmem: Un-inline cpu_physical_memory_set_dirty_flag()Philippe Mathieu-Daudé2025-10-071-0/+18
| | | | | | | | | Avoid maintaining large functions in header, rely on the linker to optimize at linking time. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20251001175448.18933-11-philmd@linaro.org>
* system/physmem: Un-inline cpu_physical_memory_range_includes_clean()Philippe Mathieu-Daudé2025-10-071-0/+60
| | | | | | | | | | | | Avoid maintaining large functions in header, rely on the linker to optimize at linking time. cpu_physical_memory_all_dirty() doesn't involve any CPU, remove the 'cpu_' prefix. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20251001175448.18933-10-philmd@linaro.org>
* system/physmem: Un-inline cpu_physical_memory_is_clean()Philippe Mathieu-Daudé2025-10-071-0/+9
| | | | | | | | | Avoid maintaining large functions in header, rely on the linker to optimize at linking time. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20251001175448.18933-9-philmd@linaro.org>
* system/physmem: Un-inline cpu_physical_memory_get_dirty_flag()Philippe Mathieu-Daudé2025-10-071-0/+44
| | | | | | | | | | | | Avoid maintaining large functions in header, rely on the linker to optimize at linking time. cpu_physical_memory_get_dirty() doesn't involve any CPU, remove the 'cpu_' prefix. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20251001175448.18933-8-philmd@linaro.org>
* system/physmem: Remove legacy cpu_physical_memory_rw()Philippe Mathieu-Daudé2025-10-071-7/+0
| | | | | | | | | The legacy cpu_physical_memory_rw() method is no more used, remove it. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20251002084203.63899-16-philmd@linaro.org>
* system/physmem: Avoid cpu_physical_memory_rw when is_write is constantPhilippe Mathieu-Daudé2025-10-071-2/+4
| | | | | | | | | | | | | Following the mechanical changes of commit adeefe01671 ("Avoid cpu_physical_memory_rw() with a constant is_write argument"), replace: - cpu_physical_memory_rw(, is_write=false) -> address_space_read() - cpu_physical_memory_rw(, is_write=true) -> address_space_write() Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20251002084203.63899-15-philmd@linaro.org>
* system/physmem: Un-inline cpu_physical_memory_read/write()Philippe Mathieu-Daudé2025-10-071-0/+10
| | | | | | | | | | | In order to remove cpu_physical_memory_rw() in a pair of commits, and due to a cyclic dependency between "exec/cpu-common.h" and "system/memory.h", un-inline cpu_physical_memory_read() and cpu_physical_memory_write() as a prerequired step. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20251002084203.63899-14-philmd@linaro.org>
* system/physmem: Pass address space argument to cpu_flush_icache_range()Philippe Mathieu-Daudé2025-10-071-3/+2
| | | | | | | | | | Rename cpu_flush_icache_range() as address_space_flush_icache_range(), passing an address space by argument. The single caller, rom_reset(), already operates on an address space. Use it. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20251002084203.63899-7-philmd@linaro.org>
* system/physmem: Remove cpu_physical_memory_is_io()Philippe Mathieu-Daudé2025-10-071-5/+0
| | | | | | | | | There are no more uses of the legacy cpu_physical_memory_is_io() method. Remove it. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20251002084203.63899-6-philmd@linaro.org>
* system/memory: Factor address_space_is_io() outPhilippe Mathieu-Daudé2025-10-071-9/+12
| | | | | | | | | Factor address_space_is_io() out of cpu_physical_memory_is_io(). Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20251002084203.63899-3-philmd@linaro.org>
* system/memory: Split address_space_write_rom_internalRichard Henderson2025-10-071-45/+29
| | | | | | | | | | | | | | | | | | | | In 2dbaf58bbe7 we conditionally skipped the increment of buf because ubsan warns incrementing NULL, and buf is always NULL for FLUSH_CACHE. However, the existence of the test for NULL caused Coverity to warn that the memcpy in the WRITE_DATA case lacked a test for NULL. Duplicate address_space_write_rom_internal into the two callers, dropping enum write_rom_type, and simplify. This eliminates buf in the flush case, and eliminates the conditional increment of buf in the write case. Coverity: CID 1621220 Fixes: 2dbaf58bbe7 ("system/physmem: Silence warning from ubsan") Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Thomas Huth <thuth@redhat.com> Message-ID: <20250922192940.2908002-1-richard.henderson@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
* system/ramblock: Rename @start -> @offset in ram_block_discard_range()Philippe Mathieu-Daudé2025-10-071-14/+14
| | | | | | | | | Rename @start as @offset, since it express an offset within a RAMBlock. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Acked-by: Peter Xu <peterx@redhat.com> Message-Id: <20251002032812.26069-5-philmd@linaro.org>
* system/ramblock: Move ram_block_is_pmem() declarationPhilippe Mathieu-Daudé2025-10-071-2/+3
| | | | | | | | | | | | Move ramblock_is_pmem() along with the RAM Block API exposed by the "system/ramblock.h" header. Rename as ram_block_is_pmem() to keep API prefix consistency. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Acked-by: Peter Xu <peterx@redhat.com> Message-Id: <20251002032812.26069-3-philmd@linaro.org>
* Merge tag 'for_upstream' of https://git.kernel.org/pub/scm/virt/kvm/mst/qemu ↵Richard Henderson2025-10-061-7/+3
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | into staging virtio,pci,pc: features, fixes users can now control VM bit in smbios. vhost-user-device is now user-createable. intel_iommu now supports PRI virtio-net now supports GSO over UDP tunnel ghes now supports error injection amd iommu now supports dma remapping for vfio better error messages for virtio small fixes all over the place. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> # -----BEGIN PGP SIGNATURE----- # # iQFDBAABCgAtFiEEXQn9CHHI+FuUyooNKB8NuNKNVGkFAmji0s0PHG1zdEByZWRo # YXQuY29tAAoJECgfDbjSjVRpuH4H/09h70IqAWZGHIWKGmmGGtdKOj3g54KuI0Ss # mGECEsHvvBexOy670Qy8jdgXfaW4UuNui8BiOnJnGsBX8Y0dy+/yZori3KhkXkaY # D57Ap9agkpHem7Vw0zgNsAF2bzDdlzTiQ6ns5oDnSq8yt82onCb5WGkWTGkPs/jL # Gf8Jv+Ddcpt5SU4/hHPYC8pUhl7z4xPOOyl0Qp1GG21Pxf5v4sGFcWuGGB7UEPSQ # MjZeoM0rSnLDtNg18sGwD5RPLQs13TbtgsVwijI79c3w3rcSpPNhGR5OWkdRCIYF # 8A0Nhq0Yfo0ogTht7yt1QNPf/ktJkuoBuGVirvpDaix2tCBECes= # =Zvq/ # -----END PGP SIGNATURE----- # gpg: Signature made Sun 05 Oct 2025 01:19:25 PM PDT # gpg: using RSA key 5D09FD0871C8F85B94CA8A0D281F0DB8D28D5469 # gpg: issuer "mst@redhat.com" # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>" [unknown] # gpg: aka "Michael S. Tsirkin <mst@redhat.com>" [unknown] # gpg: WARNING: The key's User ID is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 0270 606B 6F3C DF3D 0B17 0970 C350 3912 AFBE 8E67 # Subkey fingerprint: 5D09 FD08 71C8 F85B 94CA 8A0D 281F 0DB8 D28D 5469 * tag 'for_upstream' of https://git.kernel.org/pub/scm/virt/kvm/mst/qemu: (75 commits) virtio: improve virtqueue mapping error messages pci: Fix wrong parameter passing to pci_device_get_iommu_bus_devfn() intel_iommu: Simplify caching mode check with VFIO device intel_iommu: Enable Enhanced Set Root Table Pointer Support (ESRTPS) vdpa-dev: add get_vhost() callback for vhost-vdpa device amd_iommu: HATDis/HATS=11 support intel-iommu: Move dma_translation to x86-iommu amd_iommu: Refactor amdvi_page_walk() to use common code for page walk amd_iommu: Do not assume passthrough translation when DTE[TV]=0 amd_iommu: Toggle address translation mode on devtab entry invalidation amd_iommu: Add dma-remap property to AMD vIOMMU device amd_iommu: Set all address spaces to use passthrough mode on reset amd_iommu: Toggle memory regions based on address translation mode amd_iommu: Invalidate address translations on INVALIDATE_IOMMU_ALL amd_iommu: Add replay callback amd_iommu: Unmap all address spaces under the AMD IOMMU on reset amd_iommu: Use iova_tree records to determine large page size on UNMAP amd_iommu: Sync shadow page tables on page invalidation amd_iommu: Add basic structure to support IOMMU notifier updates amd_iommu: Add a page walker to sync shadow page tables on invalidation ... Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
| * memory: Adjust event ranges to fit within notifier boundariesAlejandro Jimenez2025-10-051-7/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Invalidating the entire address space (i.e. range of [0, ~0ULL]) is a valid and required operation by vIOMMU implementations. However, such invalidations currently trigger an assertion unless they originate from device IOTLB invalidations. Although in recent Linux guests this case is not exercised by the VTD implementation due to various optimizations, the assertion will be hit by upcoming AMD vIOMMU changes to support DMA address translation. More specifically, when running a Linux guest with VFIO passthrough device, and a kernel that does not contain commmit 3f2571fed2fa ("iommu/amd: Remove redundant domain flush from attach_device()"). Remove the assertion altogether and adjust the range to ensure it does not cross notifier boundaries. Signed-off-by: Alejandro Jimenez <alejandro.j.jimenez@oracle.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Acked-by: David Hildenbrand <david@redhat.com> Acked-by: Peter Xu <peterx@redhat.com> Message-Id: <20201116165506.31315-6-eperezma@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Message-ID: <20250919213515.917111-2-alejandro.j.jimenez@oracle.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
* | system/runstate: remove duplicate in runstate transitionsMarco Cavenati2025-10-051-3/+1
| | | | | | | | | | | | | | | | | | Remove duplicate entry PRELAUNCH->INMIGRATE from runstate_transitions_def. Move PRELAUNCH->SUSPENDED entry with all the other PRELAUNCH->XXX entries. Signed-off-by: Marco Cavenati <Marco.Cavenati@eurecom.fr> Reviewed-by: Michael Tokarev <mjt@tls.msk.ru> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
* | migration: cpr-exec modeSteve Sistare2025-10-031-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add the cpr-exec migration mode. Usage: qemu-system-$arch -machine aux-ram-share=on ... migrate_set_parameter mode cpr-exec migrate_set_parameter cpr-exec-command \ <arg1> <arg2> ... -incoming <uri-1> \ migrate -d <uri-1> The migrate command stops the VM, saves state to uri-1, directly exec's a new version of QEMU on the same host, replacing the original process while retaining its PID, and loads state from uri-1. Guest RAM is preserved in place, albeit with new virtual addresses. The new QEMU process is started by exec'ing the command specified by the @cpr-exec-command parameter. The first word of the command is the binary, and the remaining words are its arguments. The command may be a direct invocation of new QEMU, or may be a non-QEMU command that exec's the new QEMU binary. This mode creates a second migration channel that is not visible to the user. At the start of migration, old QEMU saves CPR state to the second channel, and at the end of migration, it tells the main loop to call cpr_exec. New QEMU loads CPR state early, before objects are created. Because old QEMU terminates when new QEMU starts, one cannot stream data between the two, so uri-1 must be a type, such as a file, that accepts all data before old QEMU exits. Otherwise, old QEMU may quietly block writing to the channel. Memory-backend objects must have the share=on attribute, but memory-backend-epc is not supported. The VM must be started with the '-machine aux-ram-share=on' option, which allows anonymous memory to be transferred in place to the new process. The memfds are kept open across exec by clearing the close-on-exec flag, their values are saved in CPR state, and they are mmap'd in new QEMU. Signed-off-by: Steve Sistare <steven.sistare@oracle.com> Acked-by: Markus Armbruster <armbru@redhat.com> Link: https://lore.kernel.org/r/1759332851-370353-7-git-send-email-steven.sistare@oracle.com Signed-off-by: Peter Xu <peterx@redhat.com>
* | physmem: Destroy all CPU AddressSpaces on unrealizePeter Maydell2025-10-031-17/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When we unrealize a CPU object (which happens on vCPU hot-unplug), we should destroy all the AddressSpace objects we created via calls to cpu_address_space_init() when the CPU was realized. Commit 24bec42f3d6eae added a function to do this for a specific AddressSpace, but did not add any places where the function was called. Since we always want to destroy all the AddressSpaces on unrealize, regardless of the target architecture, we don't need to try to keep track of how many are still undestroyed, or make the target architecture code manually call a destroy function for each AS it created. Instead we can adjust the function to always completely destroy the whole cpu->ases array, and arrange for it to be called during CPU unrealize as part of the common code. Without this fix, AddressSanitizer will report a leak like this from a run where we hot-plugged and then hot-unplugged an x86 KVM vCPU: Direct leak of 416 byte(s) in 1 object(s) allocated from: #0 0x5b638565053d in calloc (/data_nvme1n1/linaro/qemu-from-laptop/qemu/build/x86-tgts-asan/qemu-system-x86_64+0x1ee153d) (BuildId: c1cd6022b195142106e1bffeca23498c2b752bca) #1 0x7c28083f77b1 in g_malloc0 (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x637b1) (BuildId: 1eb6131419edb83b2178b682829a6913cf682d75) #2 0x5b6386999c7c in cpu_address_space_init /data_nvme1n1/linaro/qemu-from-laptop/qemu/build/x86-tgts-asan/../../system/physmem.c:797:25 #3 0x5b638727f049 in kvm_cpu_realizefn /data_nvme1n1/linaro/qemu-from-laptop/qemu/build/x86-tgts-asan/../../target/i386/kvm/kvm-cpu.c:102:5 #4 0x5b6385745f40 in accel_cpu_common_realize /data_nvme1n1/linaro/qemu-from-laptop/qemu/build/x86-tgts-asan/../../accel/accel-common.c:101:13 #5 0x5b638568fe3c in cpu_exec_realizefn /data_nvme1n1/linaro/qemu-from-laptop/qemu/build/x86-tgts-asan/../../hw/core/cpu-common.c:232:10 #6 0x5b63874a2cd5 in x86_cpu_realizefn /data_nvme1n1/linaro/qemu-from-laptop/qemu/build/x86-tgts-asan/../../target/i386/cpu.c:9321:5 #7 0x5b6387a0469a in device_set_realized /data_nvme1n1/linaro/qemu-from-laptop/qemu/build/x86-tgts-asan/../../hw/core/qdev.c:494:13 #8 0x5b6387a27d9e in property_set_bool /data_nvme1n1/linaro/qemu-from-laptop/qemu/build/x86-tgts-asan/../../qom/object.c:2375:5 #9 0x5b6387a2090b in object_property_set /data_nvme1n1/linaro/qemu-from-laptop/qemu/build/x86-tgts-asan/../../qom/object.c:1450:5 #10 0x5b6387a35b05 in object_property_set_qobject /data_nvme1n1/linaro/qemu-from-laptop/qemu/build/x86-tgts-asan/../../qom/qom-qobject.c:28:10 #11 0x5b6387a21739 in object_property_set_bool /data_nvme1n1/linaro/qemu-from-laptop/qemu/build/x86-tgts-asan/../../qom/object.c:1520:15 #12 0x5b63879fe510 in qdev_realize /data_nvme1n1/linaro/qemu-from-laptop/qemu/build/x86-tgts-asan/../../hw/core/qdev.c:276:12 Cc: qemu-stable@nongnu.org Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2517 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: David Hildenbrand <david@redhat.com> Link: https://lore.kernel.org/r/20250929144228.1994037-4-peter.maydell@linaro.org Signed-off-by: Peter Xu <peterx@redhat.com>
* | memory: New AS helper to serialize destroy+freePeter Xu2025-10-031-1/+19
|/ | | | | | | | | | | | | | | | | | | | | | | | | | If an AddressSpace has been created in its own allocated memory, cleaning it up requires first destroying the AS and then freeing the memory. Doing this doesn't work: address_space_destroy(as); g_free_rcu(as, rcu); because both address_space_destroy() and g_free_rcu() try to use the same 'rcu' node in the AddressSpace struct and the address_space_destroy hook gets overwritten. Provide a new address_space_destroy_free() function which will destroy the AS and then free the memory it uses, all in one RCU callback. (CC to stable because the next commit needs this function.) Cc: qemu-stable@nongnu.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: David Hildenbrand <david@redhat.com> Link: https://lore.kernel.org/r/20250929144228.1994037-3-peter.maydell@linaro.org Signed-off-by: Peter Xu <peterx@redhat.com>
* Merge tag 'for-upstream' of https://gitlab.com/bonzini/qemu into stagingRichard Henderson2025-09-183-15/+11
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * cpu-exec: more cleanups to CPU loop exits * python: bump bundled Meson to 1.9.0 * rust: require Rust 1.83.0 * rust: temporarily remove from Ubuntu CI * rust: vmstate: convert to use builder pattern * rust: split "qemu-api" crate * rust: rename qemu_api_macros -> qemu_macros * rust: re-export qemu macros from other crates * x86: fix functional test failure for Xen emulation * x86: cleanups # -----BEGIN PGP SIGNATURE----- # # iQFIBAABCgAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAmjK6ZsUHHBib256aW5p # QHJlZGhhdC5jb20ACgkQv/vSX3jHroNBKwf/aadInCT4vASOfpxbwZgYfYgR2m2m # BJE9oYKxZJ6MlEOU/1Wfywf9fg4leMSh3XxkDKkEIL19yS6emwin8n3SNYrdAFn3 # 6u4IIWO4NI1Ht3NKytrqFk9wtbH9pAs/gVHLlnmpMxIqtOtZLumPAKNz8rlantmK # UVDYL3Y0L4pD9i5FK1ObMNpk5AsWNr8Tr64fmb+nTkHutld3sBrEMCLI0+EByGyN # lQ16sLn9PGqHOr210zuQP7wP2T3NCI3YokFSPQrUUL8LZGxRdXoNF4hI4uZDKGdn # UbtRu9EkM052qzfsFMrEw5JSbdxEfIjKlPoFKseMv+aWvNAuximAraD3Vg== # =Lr+x # -----END PGP SIGNATURE----- # gpg: Signature made Wed 17 Sep 2025 10:02:19 AM PDT # gpg: using RSA key F13338574B662389866C7682BFFBD25F78C7AE83 # gpg: issuer "pbonzini@redhat.com" # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" [unknown] # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" [unknown] # gpg: WARNING: The key's User ID is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * tag 'for-upstream' of https://gitlab.com/bonzini/qemu: (60 commits) accel/kvm: Set guest_memfd_offset to non-zero value only when guest_memfd is valid accel/kvm: Zero out mem explicitly in kvm_set_user_memory_region() accel/kvm: Switch to check KVM_CAP_GUEST_MEMFD and KVM_CAP_USER_MEMORY2 on VM i386/kvm: Drop KVM_CAP_X86_SMM check in kvm_arch_init() multiboot: Fix the split lock target/i386: Define enum X86ASIdx for x86's address spaces i386/cpu: Enable SMM cpu address space under KVM hpet: guard IRQ handling with BQL rust: do not inline do_init_io rust: meson: remove unnecessary complication in device crates docs: update rust.rst rust: re-export qemu macros from common/qom/hwcore rust: re-export qemu_macros internal helper in "bits" rust: repurpose qemu_api -> tests rust/pl011: drop dependency on qemu_api rust/hpet: drop now unneeded qemu_api dep rust: rename qemu_api_macros -> qemu_macros rust: split "hwcore" crate rust: split "system" crate rust: split "chardev" crate ... Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
| * i386/cpu: Enable SMM cpu address space under KVMXiaoyao Li2025-09-171-5/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Kirill Martynov reported assertation in cpu_asidx_from_attrs() being hit when x86_cpu_dump_state() is called to dump the CPU state[*]. It happens when the CPU is in SMM and KVM emulation failure due to misbehaving guest. The root cause is that QEMU i386 never enables the SMM address space for cpu since KVM SMM support has been added. Enable the SMM cpu address space under KVM when the SMM is enabled for the x86machine. [*] https://lore.kernel.org/qemu-devel/20250523154431.506993-1-stdcalllevi@yandex-team.ru/ Reported-by: Kirill Martynov <stdcalllevi@yandex-team.ru> Reviewed-by: Zhao Liu <zhao1.liu@intel.com> Tested-by: Kirill Martynov <stdcalllevi@yandex-team.ru> Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com> Link: https://lore.kernel.org/r/20250730095253.1833411-2-xiaoyao.li@intel.com Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| * cpus: clear exit_request in qemu_process_cpu_eventsPaolo Bonzini2025-09-171-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Make the code common to all accelerators: after seeing cpu->exit_request set to true, accelerator code needs to reach qemu_process_cpu_events_common(). So for the common cases where they use qemu_process_cpu_events(), go ahead and clear it in there. Note that the cheap qatomic_set() is enough because at this point the thread has taken the BQL; qatomic_set_mb() is not needed. In particular, this is the ordering of the communication between I/O and vCPU threads is always the same. In the I/O thread: (a) store other memory locations that will be checked if cpu->exit_request or cpu->interrupt_request is 1 (for example cpu->stop or cpu->work_list for cpu->exit_request) (b) cpu_exit(): store-release cpu->exit_request, or (b) cpu_interrupt(): store-release cpu->interrupt_request >>> at this point, cpu->halt_cond is broadcast and the BQL released (c) do the accelerator-specific kick (e.g. write icount_decr for TCG, pthread_kill for KVM, etc.) In the vCPU thread instead the opposite order is respected: (c) the accelerator's execution loop exits thanks to the kick (b) then the inner execution loop checks cpu->interrupt_request and cpu->exit_request. If needed cpu->interrupt_request is converted into cpu->exit_request when work is needed outside the execution loop. (a) then the other memory locations are checked. Some may need to be read under the BQL, but the vCPU thread may also take other locks (e.g. for queued work items) or none at all. qatomic_set_mb() would only be needed if the halt sleep was done outside the BQL (though in that case, cpu->exit_request probably would be replaced by a QemuEvent or something like that). Reviewed-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| * treewide: rename qemu_wait_io_event/qemu_wait_io_event_commonPaolo Bonzini2025-09-171-3/+3
| | | | | | | | | | | | | | | | Do so before extending it to the user-mode emulators, where there is no such thing as an "I/O thread". Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| * cpus: properly kick CPUs out of inner execution loopPaolo Bonzini2025-09-172-5/+6
| | | | | | | | | | | | | | | | Now that cpu_exit() actually kicks all accelerators, use it whenever the message to another thread is processed in qemu_wait_io_event(). Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| * cpu-common: use atomic access for interrupt_requestPaolo Bonzini2025-09-171-2/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | Writes to interrupt_request used non-atomic accesses, but there are a few cases where the access was not protected by the BQL. Now that there is a full set of helpers, it's easier to guarantee that interrupt_request accesses are fully atomic, so just drop the requirement instead of fixing them. Reviewed-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* | Merge tag 'pull-target-arm-20250916' of https://gitlab.com/pm215/qemu into ↵Richard Henderson2025-09-172-5/+0
|\ \ | |/ |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | staging target-arm queue: * tests, scripts: Don't import print_function from __future__ * Implement FEAT_ATS1A * Remove deprecated pxa CPU family * arm/kvm: report registers we failed to set * Expose SME registers to GDB via gdbstub * linux-user/aarch64: Generate ESR signal records * hw/arm/raspi4b: remove redundant check in raspi_add_memory_node * hw/arm/virt: Allow user-creatable SMMUv3 dev instantiation * system: drop the -old-param option # -----BEGIN PGP SIGNATURE----- # # iQJNBAABCAA3FiEE4aXFk81BneKOgxXPPCUl7RQ2DN4FAmjJpt8ZHHBldGVyLm1h # eWRlbGxAbGluYXJvLm9yZwAKCRA8JSXtFDYM3vRGEACO3VrePiMIA9N7egqlUiGn # aRQVqIKeuPVj6TRVG7BSNWlAX8qvnOWOKg1yGVHDZv/nLvRje9UyfUAw7pf6jXod # bzxWBCPJ0J0eOB64Tz87WRCLltKB5pEN+uIG00PtpBcXT1ixYCDgBZXyD3mwuJ4Q # 5Yc5hEwQzpmh+EycLtfCHbmjKDw3x1ncpVlGceOG4h5fvzIvIhcNcZJXfAHhbhyO # Y4c5PELrCkCLZaTtSSxd6VJ+vXQ9bNWyKaSZu2KRRnLcMeAqw2Ic7dLPlkzCVyxM # PTOHy4TuDu+kqCbkxdnhpI6fvq5kcHyfTL6qX6tth8ZZS+qKGtvMEIXnYoy6q1kh # 4jV5vizK8avx31fSiuTKVpttRv4dC+Aq5QrcgYtIVMeOwtkWHv610D8gcFPmXoG+ # uHX9WdzOjrYOzXVKzJaCZF6b7L31ptSEfOrx7asBC9k2wPRwonFXg4JGNq16Yann # aAO5TM7NAUvM2IPgqS+Tf1Bk0iQqORxGfqzCyL76OO/QMMgfBy9elKH0UR0G+ePJ # yjpub1oWIELSXsQGMrdFo1W4/NIpFMTu3DP9W+6XRPu1AvrAx/AsrTuvSvXoeFY9 # d/U3yWAXm5XxRzbCIUg7ke8I8zLwRz924M5PA8vophvSnfDLS3V8CJHLwbz/PqYc # 0P2KCeI6d2NIhVik4mgEoQ== # =5tK3 # -----END PGP SIGNATURE----- # gpg: Signature made Tue 16 Sep 2025 11:05:19 AM PDT # gpg: using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE # gpg: issuer "peter.maydell@linaro.org" # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [unknown] # gpg: aka "Peter Maydell <pmaydell@gmail.com>" [unknown] # gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" [unknown] # gpg: aka "Peter Maydell <peter@archaic.org.uk>" [unknown] # gpg: WARNING: The key's User ID is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83 15CF 3C25 25ED 1436 0CDE * tag 'pull-target-arm-20250916' of https://gitlab.com/pm215/qemu: (36 commits) hw/usb/network: Remove hardcoded 0x40 prefix in STRING_ETHADDR response qtest/bios-tables-test: Update tables for smmuv3 tests qtest/bios-tables-test: Add tests for legacy smmuv3 and smmuv3 device bios-tables-test: Allow for smmuv3 test data. qemu-options.hx: Document the arm-smmuv3 device hw/arm/virt: Allow user-creatable SMMUv3 dev instantiation hw/pci: Introduce pci_setup_iommu_per_bus() for per-bus IOMMU ops retrieval hw/arm/virt: Add an SMMU_IO_LEN macro hw/arm/virt: Factor out common SMMUV3 dt bindings code hw/arm/virt-acpi-build: Update IORT for multiple smmuv3 devices hw/arm/virt-acpi-build: Re-arrange SMMUv3 IORT build hw/arm/smmu-common: Check SMMU has PCIe Root Complex association target/arm: Added test case for SME register exposure to GDB target/arm: Added support for SME register exposure to GDB target/arm: Increase MAX_PACKET_LENGTH for SME ZA remote gdb debugging arm/kvm: report registers we failed to set system: drop the -old-param option target/arm: Drop ARM_FEATURE_IWMMXT handling target/arm: Drop ARM_FEATURE_XSCALE handling target/arm: Remove iwmmxt helper functions ... Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
| * system: drop the -old-param optionPeter Maydell2025-09-162-5/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We deprecated the command line option -old-param for the 10.0 release, which allows us to drop it in 10.2. This option was used to boot Arm targets with a very old boot protocol using the 'param_struct' ABI. We only ever needed this on a handful of board types which have all now been removed from QEMU. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Message-id: 20250828162700.3308812-1-peter.maydell@linaro.org
* | memory: Fix leaks due to owner-shared MRs circular referencesPeter Xu2025-09-151-9/+37
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently, QEMU refcounts the MR by always taking it from the owner. It's common that one object will have multiple MR objects embeded in the object itself. All the MRs in this case share the same lifespan of the owner object. It's also common that in the instance_init() of an object, MR A can be a container of MR B, C, D, by using memory_region_add_subregion*() set of memory region APIs. Now we have a circular reference issue, as when adding subregions for MR A, we essentially incremented the owner's refcount within the instance_init(), meaning the object will be self-boosted and its refcount can never go down to zero if the MRs won't get detached properly before object's finalize(). Delete subregions within object's finalize() won't work either, because finalize() will be invoked only if the refcount goes to zero first. What is worse, object_finalize() will do object_property_del_all() first before object_deinit(). Since embeded MRs will be properties of the owner object, it means they'll be freed _before_ the owner's finalize(). To fix that, teach memory API to stop refcount on MRs that share the same owner. Because if they share the lifecycle of the owner, then they share the same lifecycle between themselves, hence the refcount doesn't help but only introduce troubles. Meanwhile, allow auto-detachments of MRs during finalize() of MRs even against its container, as long as they belong to the same owner. The latter is needed because now it's possible to have MRs' finalize() happen in any order when they share the same lifespan with a same owner. In this case, we should allow finalize() to happen in any order of either the parent or child MR. Loose the mr->container check in MR's finalize() to allow auto-detach. Double check it shares the same owner. Proper document this behavior in code. This patch is heavily based on the work done by Akihiko Odaki: https://lore.kernel.org/r/CAFEAcA8DV40fGsci76r4yeP1P-SP_QjNRDD2OzPxjx5wRs0GEg@mail.gmail.com Cc: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp> Cc: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Clément Mathieu--Drif <clement.mathieu--drif@eviden.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Tested-by: Peter Maydell <peter.maydell@linaro.org> Link: https://lore.kernel.org/r/20250826221750.285242-1-peterx@redhat.com Signed-off-by: Peter Xu <peterx@redhat.com>
* | memory: Fix addr/len for flatview_access_allowed()Peter Xu2025-09-151-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | flatview_access_allowed() should pass in the address offset of the memory region, rather than the global address space. Shouldn't be a major issue yet, since the addr is only used in an error log. Cc: Philippe Mathieu-Daudé <philmd@linaro.org> Fixes: 3ab6fdc91b ("softmmu/physmem: Introduce MemTxAttrs::memory field and MEMTX_ACCESS_ERROR") Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: David Hildenbrand <david@redhat.com> Link: https://lore.kernel.org/r/20250903142932.1038765-1-peterx@redhat.com Signed-off-by: Peter Xu <peterx@redhat.com>
* | system/physmem: Silence warning from ubsanThomas Huth2025-09-091-1/+3
|/ | | | | | | | | | | | | | | When compiling QEMU with --enable-ubsan there is a undefined behavior warning when running the bios-tables-test for example: .../system/physmem.c:3243:13: runtime error: applying non-zero offset 262144 to null pointer #0 0x55ac1df5fbc4 in address_space_write_rom_internal .../system/physmem.c:3243:13 The problem is that buf is indeed NULL if the function is e.g. called with type == FLUSH_CACHE. Add a check to fix the issue. Reviewed-by: David Hildenbrand <david@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com> Message-ID: <20250728172545.314178-1-thuth@redhat.com>
* memory: reintroduce BQL-free fine-grained PIO/MMIOIgor Mammedov2025-08-292-1/+16
| | | | | | | | | | | | | | | | This patch brings back Jan's idea [1] of BQL-free IO access This will let us make access to ACPI PM/HPET timers cheaper, and prevent BQL contention in case of workload that heavily uses the timers with a lot of vCPUs. 1) 196ea13104f (memory: Add global-locking property to memory regions) ... de7ea885c539 (kvm: Switch to unlocked MMIO) Signed-off-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: Peter Xu <peterx@redhat.com> Link: https://lore.kernel.org/r/20250814160600.2327672-2-imammedo@redhat.com Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* add cpu_test_interrupt()/cpu_set_interrupt() helpers and use them tree wideIgor Mammedov2025-08-291-1/+8
| | | | | | | | | | | | | | | | The helpers form load-acquire/store-release pair and ensure that appropriate barriers are in place in case checks happen outside of BQL. Use them to replace open-coded checkers/setters across the code, to make sure that barriers are not missed. Helpers also make code a bit more readable. Signed-off-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: Peter Xu <peterx@redhat.com> Reviewed-by: Jason J. Herne <jjherne@linux.ibm.com> Link: https://lore.kernel.org/r/20250821155603.2422553-1-imammedo@redhat.com Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* system/physmem: fix use-after-free with dispatchPierrick Bouvier2025-07-291-12/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | A use-after-free bug was reported when booting a Linux kernel during the pci setup phase. It's quite hard to reproduce (needs smp, and favored by having several pci devices with BAR and specific Linux config, which is Debian default one in this case). After investigation (see the associated bug ticket), it appears that, under specific conditions, we might access a cached AddressSpaceDispatch that was reclaimed by RCU thread meanwhile. In the Linux boot scenario, during the pci phase, memory region are destroyed/recreated, resulting in exposition of the bug. The core of the issue is that we cache the dispatch associated to current cpu in cpu->cpu_ases[asidx].memory_dispatch. It is updated with tcg_commit, which runs asynchronously on a given cpu. At some point, we leave the rcu critial section, and the RCU thread starts reclaiming it, but tcg_commit is not yet invoked, resulting in the use-after-free. It's not the first problem around this area, and commit 0d58c660689 [1] ("softmmu: Use async_run_on_cpu in tcg_commit") already tried to address it. It did a good job, but it seems that we found a specific situation where it's not enough. This patch takes a simple approach: remove the cached value creating the issue, and make sure we always get the current mapping for address space, using address_space_to_dispatch(cpu->cpu_ases[asidx].as). It's equivalent to qatomic_rcu_read(&as->current_map)->dispatch; This is not really costly, we just need two dereferences, including one atomic (rcu) read, which is negligible considering we are already on mmu slow path anyway. Note that tcg_commit is still needed, as it's taking care of flushing TLB, removing previously mapped entries. Another solution would be to cache directly values under the dispatch (dispatch themselves are not ref counted), keep an active reference on associated memory section, and release it when appropriate (tricky). Given the time already spent debugging this area now and previously, I strongly prefer eliminating the root of the issue, instead of adding more complexity for a hypothetical performance gain. RCU is precisely used to ensure good performance when reading data, so caching is not as beneficial as it might seem IMHO. [1] https://gitlab.com/qemu-project/qemu/-/commit/0d58c660689f6da1e3feff8a997014003d928b3b Cc: qemu-stable@nongnu.org Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3040 Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Michael Tokarev <mjt@tls.msk.ru> Tested-by: Michael Tokarev <mjt@tls.msk.ru> Message-ID: <20250724161142.2803091-1-pierrick.bouvier@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
* Merge tag 'accel-20250715' of https://github.com/philmd/qemu into stagingStefan Hajnoczi2025-07-163-31/+2
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Accelerators patches - Unify x86/arm hw/xen/arch_hvm.h header - Move non-system-specific 'accel/accel-ops.h' and 'accel-cpu-ops.h' to accel/ - Move KVM definitions qapi/accelerator.json - Add @qom-type field to CpuInfoFast QAPI structure - Display CPU model name in 'info cpus' HMP command - Introduce @x-accel-stats QMP command - Add 'info accel' on HMP - Improve qemu_add_vm_change_state_handler*() docstring - Extract TCG statistic related code to tcg-stats.c - Implement AccelClass::get_[vcpu]_stats() handlers for TCG and HVF - Do not dump NaN in TCG statistics - Revert incomplete "accel/tcg: Unregister the RCU before exiting RR thread" # -----BEGIN PGP SIGNATURE----- # # iQIzBAABCAAdFiEE+qvnXhKRciHc/Wuy4+MsLN6twN4FAmh2r4UACgkQ4+MsLN6t # wN5i6xAAkOvwFh1GmsPUdz5RxzsWoIUDvyENg6E8Axwe5tSEMRFiPjabbTQJomQg # GZt75XIS24LZFZ+hvqrLSA+dFgXTgWv08ZE81EjwjmAMBlLCOPhCgeN6C1p8100Y # scSvRJbP9k9lpA5K7et/1X4AkK2cZyh+LGJgCjr2Al2mbERpPueDF8fxqeohFvXQ # nTSks4XlA0yQ06+9r49aQAiuXvgg9lDT1wIglD2HEV7vOVs/ud+yyL8+z5YMeFzx # pSIc6wDu4PqdA46w4MZs90uTy7S/PMvBiYDEiV3tKzg0MLttvFGlT58/YjVtguTP # mNkfwIEwQtDQzoxsFIJO7yBTlTRBs95V4aIVk3pB+Gb/bideRPIkeVQvgMSEBKj7 # N0pEXWOxfB9iIWO6b1utYpQ4uxeDOU/8DPUCit1IBbNgKTaJkJb77fboYk7NaB0K # KEtObAk6jMatB/xr+vUFWc4sMk9wlm72w8wcQzgKZ0xV2U3d1/Y/9nS4GvI510ev # TRQ3mKj7N319uCeId1czF6W8rillCJ2u8ZK53u+Nfp7R3PbsRSMc6IDJ1UdDUlyR # HFcWHxbcbEGhe8SnFGab4Qd6fWChcn2EaEoAJJz+Rqv0k3zcwqccNM5waCABAjTE # 0S22JIHePJKcpkMLGq3EOUAQuu+8Zsol7gPCLxSAMclVqPTl9ck= # =rAav # -----END PGP SIGNATURE----- # gpg: Signature made Tue 15 Jul 2025 15:44:05 EDT # gpg: using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE # gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <f4bug@amsat.org>" [full] # Primary key fingerprint: FAAB E75E 1291 7221 DCFD 6BB2 E3E3 2C2C DEAD C0DE * tag 'accel-20250715' of https://github.com/philmd/qemu: system/runstate: Document qemu_add_vm_change_state_handler_prio* in hdr system/runstate: Document qemu_add_vm_change_state_handler() accel/hvf: Implement AccelClass::get_vcpu_stats() handler accel/tcg: Implement AccelClass::get_stats() handler accel/tcg: Propagate AccelState to dump_accel_info() accel/system: Add 'info accel' on human monitor accel/system: Introduce @x-accel-stats QMP command accel/tcg: Extract statistic related code to tcg-stats.c Revert "accel/tcg: Unregister the RCU before exiting RR thread" accel: Extract AccelClass definition to 'accel/accel-ops.h' accel: Rename 'system/accel-ops.h' -> 'accel/accel-cpu-ops.h' accel/tcg: Do not dump NaN statistics hw/core/machine: Display CPU model name in 'info cpus' command qapi/machine: Add @qom-type field to CpuInfoFast structure qapi/accel: Move definitions related to accelerators in their own file hw/arm/xen-pvh: Remove unnecessary 'hw/xen/arch_hvm.h' header hw/xen/arch_hvm: Unify x86 and ARM variants Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Conflicts: qapi/machine.json Commit 0462da9d6b19 ("qapi: remove trivial "Returns:" sections") removed trivial "Returns:". This caused a conflict with the move from machine.json to accelerator.json.
| * system/runstate: Document qemu_add_vm_change_state_handler_prio* in hdrPhilippe Mathieu-Daudé2025-07-151-30/+0
| | | | | | | | | | | | | | | | | | | | | | | | Generally APIs to the rest of QEMU should be documented in the headers. Comments on individual functions or internal details are fine to live in the C files. Make qemu_add_vm_change_state_handler_prio[_full]() docstrings consistent by moving them from source to header. Suggested-by: Xiaoyao Li <xiaoyao.li@intel.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Message-Id: <20250715171920.89670-1-philmd@linaro.org>
| * accel: Extract AccelClass definition to 'accel/accel-ops.h'Philippe Mathieu-Daudé2025-07-151-0/+1
| | | | | | | | | | | | | | | | | | | | | | Only accelerator implementations (and the common accelator code) need to know about AccelClass internals. Move the definition out but forward declare AccelState and AccelClass. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Zhao Liu <zhao1.liu@intel.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20250703173248.44995-39-philmd@linaro.org>
| * accel: Rename 'system/accel-ops.h' -> 'accel/accel-cpu-ops.h'Philippe Mathieu-Daudé2025-07-151-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Unfortunately "system/accel-ops.h" handlers are not only system-specific. For example, the cpu_reset_hold() hook is part of the vCPU creation, after it is realized. Mechanical rename to drop 'system' using: $ sed -i -e s_system/accel-ops.h_accel/accel-cpu-ops.h_g \ $(git grep -l system/accel-ops.h) Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Zhao Liu <zhao1.liu@intel.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20250703173248.44995-38-philmd@linaro.org>
* | Merge tag 'ui-pull-request' of https://gitlab.com/marcandre.lureau/qemu into ↵Stefan Hajnoczi2025-07-161-2/+3
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | staging UI-related for 10.1 - [PATCH v3 0/2] ui/vnc: Do not copy z_stream - [PATCH v6 0/7] ui/spice: Enable gl=on option for non-local or remote clients - [PATCH v6 0/1] Allow injection of virtio-gpu EDID name - [PATCH 0/2] ui/gtk: Add keep-aspect-ratio and scale option # -----BEGIN PGP SIGNATURE----- # # iQJQBAABCgA6FiEEh6m9kz+HxgbSdvYt2ujhCXWWnOUFAmh19eYcHG1hcmNhbmRy # ZS5sdXJlYXVAcmVkaGF0LmNvbQAKCRDa6OEJdZac5cLsEAC1NV4DFQmb0TjuK/Bb # 81dDED9DGHsYybVy5x3xSqVkJtAoHTC4FmCm8x9T8wwg+utDvCGFfRM1GeMFR/yI # IzM+2xs9PcG/+7j/HhVLWr9QhoWV/yoKHcjJScfkTrTtZxAQRA3suUdQT1RjvwUY # NEuKaOx42dEpV7E+OHp8172eG8CWBzFMjH+cx2b6yKoxF1kVsB7kgVb+kCMYBEQi # 1YHf34G+HGTev+IzzpxnO+P7p2lJ1ud93kCp1Yz8ua5zOUEPiaHkbClFj4M9mdsn # xvaxby+zJqe33rh8pVr3qD/4R2j35OW7F5uiAQ8C96KF5Eviia8Cno1s4QInpcw/ # sqtorkaP+OLO6sCnvBQqo99iMH2KloCV7b5sUzfxlUkS+3txD1AKRbodz+vhBqMN # dbESdd1veUFEvi00DGbxfJbbkzVIhxAwad8CNnSjCdsvJdfYLA7TuSEuBtf1lQPF # lqpVZFB6C3LQMbmTwT9YrOzMtMXQcT+GFpJLOBk0Cxv4rCSil+TeDpEUNXHurYjI # qWZT+vyGDqyhoZHyQMPsBwAywKgtMC3IwnkKgJdTHroJ57Am86BvZqELRzh8Tffl # nkdu1uHdNQXT/u8ybU3mStaQ7xMJALL4tlMuIZ5TIkvMeQm4CiViGb/i5LSn/GMk # lx2JmBwXXf/imsXeBUfxktJFrw== # =QQ/7 # -----END PGP SIGNATURE----- # gpg: Signature made Tue 15 Jul 2025 02:32:06 EDT # gpg: using RSA key 87A9BD933F87C606D276F62DDAE8E10975969CE5 # gpg: issuer "marcandre.lureau@redhat.com" # gpg: Good signature from "Marc-André Lureau <marcandre.lureau@redhat.com>" [full] # gpg: aka "Marc-André Lureau <marcandre.lureau@gmail.com>" [full] # Primary key fingerprint: 87A9 BD93 3F87 C606 D276 F62D DAE8 E109 7596 9CE5 * tag 'ui-pull-request' of https://gitlab.com/marcandre.lureau/qemu: tpm: "qemu -tpmdev help" should return success ui/gtk: Add scale option ui/gtk: Add keep-aspect-ratio option hw/display: Allow injection of virtio-gpu EDID name ui/spice: Blit the scanout texture if its memory layout is not linear ui/spice: Create a new texture with linear layout when gl=on is specified ui/console-gl: Add a helper to create a texture with linear memory layout ui/spice: Add an option to submit gl_draw requests at fixed rate ui/spice: Add an option for users to provide a preferred video codec ui/spice: Enable gl=on option for non-local or remote clients ui/egl-helpers: Error check the fds in egl_dmabuf_export_texture() ui/vnc: Introduce the VncWorker type ui/vnc: Do not copy z_stream Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
| * | tpm: "qemu -tpmdev help" should return successMarc-André Lureau2025-07-151-2/+3
| |/ | | | | | | | | | | | | | | | | | | | | | | | | Like other "-foo help" CLI, the qemu process should return 0 for "-tpmdev help". While touching this, switch to is_help_option() utility function as suggested by Peter Maydell. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-Id: <20250707101412.2055581-1-marcandre.lureau@redhat.com>
* | qemu: Convert target_words_bigendian() to TargetInfo APIPhilippe Mathieu-Daudé2025-07-152-0/+2
| | | | | | | | | | | | | | | | | | Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20250708215320.70426-6-philmd@linaro.org> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
* | softmmu/runstate: add a way to detect force shutdownsDaniil Tatianin2025-07-141-0/+10
|/ | | | | | | | | | | | | | | | This can be useful for devices that might take too long to shut down gracefully, but may have a way to shutdown quickly otherwise if needed or explicitly requested by a force shutdown. For now we only consider SIGTERM or the QMP quit() command a force shutdown, since those bypass the guest entirely and are equivalent to pulling the power plug. Signed-off-by: Daniil Tatianin <d-tatianin@yandex-team.ru> Message-Id: <20250609212547.2859224-2-d-tatianin@yandex-team.ru> Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
* system/qdev: Remove pointless NULL check in qdev_device_add_from_qdictPhilippe Mathieu-Daudé2025-07-101-5/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Coverity reported a unnecessary NULL check: qemu/system/qdev-monitor.c: 720 in qdev_device_add_from_qdict() 683 /* create device */ 684 dev = qdev_new(driver); ... 719 err_del_dev: >>> CID 1590192: Null pointer dereferences (REVERSE_INULL) >>> Null-checking "dev" suggests that it may be null, but it has already been dereferenced on all paths leading to the check. 720 if (dev) { 721 object_unparent(OBJECT(dev)); 722 object_unref(OBJECT(dev)); 723 } 724 return NULL; 725 } Indeed, unlike qdev_try_new() which can return NULL, qdev_new() always returns a heap pointer (or aborts). Remove the unnecessary assignment and check. Fixes: f3a85056569 ("qdev/qbus: add hidden device support") Resolves: Coverity CID 1590192 (Null pointer dereferences) Suggested-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* Merge tag 'accel-20250704' of https://github.com/philmd/qemu into stagingStefan Hajnoczi2025-07-071-3/+1
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Accelerators patches - Generic API consolidation, cleanups (dead code removal, documentation added) - Remove monitor TCG 'info opcount' and @x-query-opcount - Have HVF / NVMM / WHPX use generic CPUState::vcpu_dirty field - Expose nvmm_enabled() and whpx_enabled() to common code - Report missing com.apple.security.hypervisor entitlement - Have hmp_info_registers() dump vector registers # -----BEGIN PGP SIGNATURE----- # # iQIzBAABCAAdFiEE+qvnXhKRciHc/Wuy4+MsLN6twN4FAmhn2RwACgkQ4+MsLN6t # wN6MEBAAw4CuK+t4TSmI+CctfSHmYzWvvflIM2CRZylgo1byAmF+g3FRBbvdSQUr # eITVUSrdHpwdDWYQrbyaW1+eBQMbSBANID1a02sITBQPg6KTKoDygBPL2Kp4h/nH # JlBLTWLYPbjT/Xnv9ZLzaln2AEdLQc+h+7ahfoIxjWGKFG82G+6zY7GZwO1JlwCF # UaurFHM9atvER5Yb4mmy1nCk3r+NRZf7mir3GFQOpPAELJnE4JC1P9lxaDSuh8bG # sh+c2ERR7uzyb6hSJVLu+7Ic/4DsTzjZW61JhEarLZmjS7B0MCHd2Wx8mAEKleUh # BV3Y0w9foVvX4GitdpoO3JPejUV1/eh1VxG2DieV/LS5glgQTGUTlbfRLMmJXHIe # 6S/gMj3g8KRCsRAoaWeAUj2HMzzWL0tN1hCv9dnx/uwhnYapfMYa9nIIP+opsrG4 # ouxGiLG8YZvkLkqrOLE+qelagByoiMl8JANqYeuzIvOdvcZlI4aVhwrq0f/+xmvT # QD6FfylEL6v7xnN/WsBEC/lnqMYU+ZJ7eTdCQWWz7hffqqqY5PskfOOKGjpJPbzo # ljTzk4xU+nieiCCk1o1kRJTMWCYp/hafSsxY93tEL4VPDU2zFBm1nHkds90dQKDS # Xfefd/K50JUmbv3Dn8gghNLkSvYKpC1xnBbiZP9DiASJXVltctU= # =jzsW # -----END PGP SIGNATURE----- # gpg: Signature made Fri 04 Jul 2025 09:37:32 EDT # gpg: using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE # gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <f4bug@amsat.org>" [full] # Primary key fingerprint: FAAB E75E 1291 7221 DCFD 6BB2 E3E3 2C2C DEAD C0DE * tag 'accel-20250704' of https://github.com/philmd/qemu: (35 commits) MAINTAINERS: Add me as reviewer of overall accelerators section monitor/hmp-cmds-target: add CPU_DUMP_VPU in hmp_info_registers() accel/system: Convert pre_resume() from AccelOpsClass to AccelClass accel: Pass AccelState argument to gdbstub_supported_sstep_flags() accel: Remove unused MachineState argument of AccelClass::setup_post() accel: Directly pass AccelState argument to AccelClass::has_memory() accel/kvm: Directly pass KVMState argument to do_kvm_create_vm() accel/kvm: Prefer local AccelState over global MachineState::accel accel/tcg: Prefer local AccelState over global current_accel() accel/hvf: Re-use QOM allocated state accel: Propagate AccelState to AccelClass::init_machine() accel: Keep reference to AccelOpsClass in AccelClass accel: Expose and register generic_handle_interrupt() accel/dummy: Extract 'dummy-cpus.h' header from 'system/cpus.h' accel/whpx: Expose whpx_enabled() to common code accel/nvmm: Expose nvmm_enabled() to common code accel/system: Document cpu_synchronize_state_post_init/reset() accel/system: Document cpu_synchronize_state() accel/kvm: Remove kvm_cpu_synchronize_state() stub accel/whpx: Replace @dirty field by generic CPUState::vcpu_dirty field ... Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Conflicts: accel/accel-system.c accel/hvf/hvf-all.c include/qemu/accel.h pre_resume_vm()-related conflicts.
| * accel/system: Convert pre_resume() from AccelOpsClass to AccelClassPhilippe Mathieu-Daudé2025-07-041-3/+1
| | | | | | | | | | | | | | | | | | | | Accelerators call pre_resume() once. Since it isn't a method to call for each vCPU, move it from AccelOpsClass to AccelClass. Adapt WHPX. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20250702185332.43650-21-philmd@linaro.org>