RISC-V PR for 11.2
* Add experimental Zvabd extension support
* Mask vsepc according to IALIGN
* Reset vCPU on VM reset via MP_STATE_INIT_RECEIVED
* Improve modeling of the Atlantis UART
* Fix IOMMU entry leak with ioatc-limit=0
* Fix integer handling issues in k230_gsdma and k230_decomp_gzip
* Reclaim invalidated IOATC entries for IOMMU
* Duct tape fix for QMP and RV profiles introspection
* Move RISC-V 'Z' CPU properties section to removed features
* Use TSO barriers instead of full barriers for Ztso
* Make mnstatus.MNPELP writable with Zicfilp
* Gate envcfg CBO fields on extensions
* Fix stale PMP state across reset
* Use 1ULL for a value we're going to shift by 63
* Remove unused IMISC macro
* Encode debug translation ranges in IOMMU
* Allow regular mstatus MPV/GVA writes again
* Fix uninitialised upper half in pmu_timer_trigger_irq
* Fix CPU state access on big-endian hosts
# -----BEGIN PGP SIGNATURE-----
#
# iQIzBAABCgAdFiEEaukCtqfKh31tZZKWr3yVEwxTgBMFAmrgREAACgkQr3yVEwxT
# gBPBHxAAmIzV1LXJAxQTvU46+1j+4+mSvGr37byb1iU8yg+dJCNtYpFLHKdNjF0Q
# Fn+5uBL+QJC3rEA0Xbq6iF4EP2GO8t/Qm4rElLmWCw1xzraj7RAZrNJHWCebLp1j
# PLS53gINaQNIuE6DC91mwcuWanKo7q+tvOiwcShaVyUH771J1+1xVOkpcbkQaVrZ
# a54IfHIcs4TIsKrpmxCJPkEuBcL4VtaK5JwcqbeCQQ68v7L7qQpec75t9idr3o25
# Pn/BOsHwkXoJ1qxFuY61JGhUpFKUzZIqd6HKqwv4SENZY+O87J79R9X/HU9H17xh
# B75+h91ZFSZ2luNd2vZCCMx4vOXuCa+YE/m0ZmyyjJnGLA4LHRoeFRmUUu5Dxzkn
# kP+psnaeUfcI6W71d8Dcqov1g1O7MBdVrQD1hzK8IeAuYL438cLZpo9WT6TVX5cn
# /DRCyDR4f6uzf8Lnh0wItJGzSUlW2xadFLu357KsJ0+lpytpmYolOBxUGJXtJu2g
# BSfgQX9y9xhszCbFopngunu3guOlDoHZEJ9l29+tXicezvJxXw+FRyc4EU3onRtz
# zXGWa7sN4XGifzoDorbVcWGpOT2w2LI1himS4N9qXWNCZ4s115xENMVCMDRt6a9Z
# aZRyBib2nbrrgnO4JJbxBUe/MViBfQlc+AuqMmEwrwdP3LRBbZA=
# =qxZ6
# -----END PGP SIGNATURE-----
# gpg: Signature made Tue 27 Oct 2026 01:27:12 AM CDT
# gpg: using RSA key 6AE902B6A7CA877D6D659296AF7C95130C538013
# gpg: Good signature from "Alistair Francis <alistair@alistair23.me>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 6AE9 02B6 A7CA 877D 6D65 9296 AF7C 9513 0C53 8013
* tag 'pull-riscv-to-apply-20261027' of https://github.com/alistair23/qemu: (29 commits)
target/riscv: Fix CPU state access on big-endian hosts
target/riscv: fix uninitialised upper half in pmu_timer_trigger_irq()
target/riscv/csr.c: allow regular mstatus MPV/GVA writes again
hw/riscv/riscv-iommu: encode debug translation ranges
include/hw/intc/riscv_imsic.h: remove unused macro
target/riscv: Use 1ULL for a value we're going to shift by 63
target/riscv: pmp: reset the derived PMP bounds and rule count
target/riscv: pmp: clear A and L on every implemented PMP entry at reset
target/riscv: gate envcfg CBO fields on extensions
target/riscv: make mnstatus.MNPELP writable with Zicfilp
target/riscv: Use TSO barriers instead of full barriers for Ztso
docs: Move RISC-V 'Z' CPU properties section to removed features
target/riscv/cpu.c: duct tape fix for QMP + RV profiles introspection
hw/riscv/riscv-iommu: reclaim invalidated IOATC entries
hw/riscv/riscv-iommu: serialize IOATC accesses
hw/dma: fix k230_gsdma integer handling issues
qtest: fix k230_decomp_gzip test integer handling issues
hw/misc: use hwaddr for the k230_decomp_gzip input address
hw/misc: fix calculating input address overflow in k230_decomp_gzip
hw/misc: fix calculating output address overflow in k230_decomp_gzip
...
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Add documentation for the Milk-V Duo board. This includes a brief
overview of the hardware, a list of supported devices, and practical
instructions on how to boot the machine using OpenSBI and a Linux
kernel with an emulated SD card.
Signed-off-by: Kuan-Wei Chiu <visitorckw@gmail.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20260927201326.650943-8-visitorckw@gmail.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
The UFS host controller and logical unit devices have no user
documentation. Their properties and the way the two devices fit
together can only be found by reading hw/ufs/.
Add docs/system/devices/ufs.rst with an example command line, the
device properties, and current limitations, and list it under the UFS
entry in MAINTAINERS.
Signed-off-by: Stanley Jhu <stanleyjhu@google.com>
Reviewed-by: Jeuk Kim <jeuk20.kim@samsung.com>
Signed-off-by: Jeuk Kim <jeuk20.kim@samsung.com>
New s390x features for 11.2
- enable boot via virtio-net-pci
- PCI and SCLP fixes
- hardening fixes throughout
- regenerate s390-ccw.img
# -----BEGIN PGP SIGNATURE-----
#
# iIsEABYKADMWIQQB3Dhbwk4ZE3uUN6KmTx4R4Fx3tAUCar0oEBUcZmFybWFuQGxp
# bnV4LmlibS5jb20ACgkQpk8eEeBcd7QO4gEA/LckW2Ay4OVtFtBbj6lOZjfCexJ8
# FVcvnE51+Ynt2mEBAI7iLfw/uJ9HtB7EzGLRapUbWLYLHaP5NIRiPlj0uaUO
# =oO3l
# -----END PGP SIGNATURE-----
# gpg: Signature made Wed 30 Sep 2026 04:17:36 PM BST
# gpg: using EDDSA key 01DC385BC24E19137B9437A2A64F1E11E05C77B4
# gpg: issuer "farman@linux.ibm.com"
# gpg: Good signature from "Eric Farman <farman@linux.ibm.com>" [unknown]
# gpg: WARNING: The key's User ID is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: D2C6 0504 C9E8 F568 CFE5 87B5 3827 B212 71BF 9562
# Subkey fingerprint: 01DC 385B C24E 1913 7B94 37A2 A64F 1E11 E05C 77B4
* tag 's390x-20260930' of https://gitlab.com/efarman/qemu: (23 commits)
pc-bios/s390-ccw.img: update s390x bios
s390x/pci: Reject apertures beyond IOAT capacity in translation mode
s390x/pci: Use qemu_log_mask() for guest-triggered errors in reg_ioat()
s390x/pci: Fix frame stepping in rpcit_service_call()
s390x/sclpconsole: fix indentation for console_reset
tests/functional/s390x: Add tests for virtio net PCI in test_pxelinux.py
tests/qtest: Add s390x virtio net PCI test to pxe-test.c
tests/qtest: Check s390x boot device support in pxe-test.c
hw/virtio: Add "loadparm" property to virtio net PCI devices booting on s390x
pc-bios/s390-ccw: Add support for virtio-net-pci IPL
pc-bios/s390-ccw: Introduce virtio_tswap helpers
pc-bios/s390-ccw: Add dynamic net header size handling
pc-bios/s390-ccw: Move CCW net setup to virtio-ccw
s390x: Expose pv attribute in QOM
s390x/sclp: Reject short headers in PV case
s390x/css: Use datastream pointer for checking no-data CCWs
hw/intc/s390x: Fix check after g_try_realloc
hw/intc/s390x: Fix payload to KVM_HAS_DEVICE_ATTR ioctl
vfio/ccw: Clear error object pointer after non-fatal errors
vfio/ap: Clear error object pointer after non-fatal errors
...
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Host backends supports guest-memfd now by detecting whether it's a
confidential VM. There's no way to choose it yet from the memory level to
use it fully shared. If we use guest-memfd, it so far always implies we
need two layers of memory backends, while the guest-memfd only provides the
private set of pages.
This patch introduces a way so that QEMU can consume guest memfd as the
only source of memory to back the object (aka, fully shared).
To use the fully shared guest-memfd, one can add a memfd object with:
-object memory-backend-memfd,x-guest-memfd=on,share=on
Note that share=on is required with fully shared guest_memfd.
Since guest-memfd is not yet a drop-in replacement for memfd (e.g. lack
of hugepage support), the option is tagged as experimental for now so
that it can be made available for early enablement/testing without
causing any surprises for other users.
PS: there's a trivial touch-up on fd<0 check, because the stub to create
guest-memfd may return negative but not -1.
Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: David Hildenbrand <david@kernel.org>
Co-developed-by: Michael Roth <michael.roth@amd.com>
Signed-off-by: Michael Roth <michael.roth@amd.com>
Acked-by: Markus Armbruster <armbru@redhat.com>
Link: https://lore.kernel.org/r/20260929235109.1398509-11-michael.roth@amd.com
Signed-off-by: Peter Xu <peterx@redhat.com>
The description of virtualization vs non-virtualization use
cases is a crude approximation of the security characteristics
of QEMU devices.
Document how QEMU can be probed to obtain information on the
security status of type classes, and how policies can be set
to inform or control their usage.
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
pci, vhost, virtio, iommu, apci: features, fixes
new vhost-user-media device
virtio-net now supports live-TAP local migration
cxl now supports CFMW restrictions and per-window options
intel_iommu now supports concurrent page fault handling with PRI
pci now batches memory transactions around mapping updates
vhost-user-blk now allows toggling inflight-migration at runtime
virtio-rtc now supports smeared UTC clock type
intel_iommu now exposes SMPWC when SVM is enabled
new reviewer for CXL patches
Fixes, cleanups all over the place
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
# -----BEGIN PGP SIGNATURE-----
#
# iQFDBAABCgAtFiEEXQn9CHHI+FuUyooNKB8NuNKNVGkFAmqkXRUPHG1zdEByZWRo
# YXQuY29tAAoJECgfDbjSjVRpoWsH/jeMRFjgYu5Es05ha87JW6NJW6j/Ggw3F8e5
# kup/SsoeqX+pK1VqXkKimWRf0iXsnweTqviVR88KMmMBP9UNdwgRBM7XflplYiOv
# UOsjZGZAKjOKnyjbQyNihYY4CfaJn2VYkxJBRxweS3/OEK4JV2wmFcWEjFuZEdJT
# SXpYXAPu0e8XTPVk/+bhi6kIYHhsuu1sWhcsoRDGdw5ZrGvwTwF8cS4SWaYHrWc1
# wjvC39P3Hg+Zvw6vDkPP2Amos2s6iheEgsPI0628YYvER+YV641YD48xEXqTG44e
# FGwCihJ97rYYGQEwL+1FL4ZLKcp7HwacqxkJYg+GHbKj1Iog9OQ=
# =9H6A
# -----END PGP SIGNATURE-----
# gpg: Signature made Fri 11 Sep 2026 09:57:09 AM HST
# gpg: using RSA key 5D09FD0871C8F85B94CA8A0D281F0DB8D28D5469
# gpg: issuer "mst@redhat.com"
# gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>" [unknown]
# gpg: aka "Michael S. Tsirkin <mst@redhat.com>" [unknown]
# gpg: WARNING: The key's User ID is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 0270 606B 6F3C DF3D 0B17 0970 C350 3912 AFBE 8E67
# Subkey fingerprint: 5D09 FD08 71C8 F85B 94CA 8A0D 281F 0DB8 D28D 5469
* tag 'for_upstream' of https://git.kernel.org/pub/scm/virt/kvm/mst/qemu: (74 commits)
MAINTAINERS: add Junjie Cao as CXL reviewer
vhost-user-blk: use GET_VRING_BASE_SKIP_DRAIN when inflight-migration is on
vhost-user-blk: move inflight_needed higher
vhost-user-blk: make inflight-migration prop mutable on running vm
vhost-user: use skip_drain with GET_VRING_BASE_SKIP_DRAIN message
vhost-user: add GET_VRING_BASE_SKIP_DRAIN message
vhost-user: add skip_drain param to do_vhost_virtqueue_stop
intel_iommu: Expose SMPWC when SVM is enabled
virtio-net: validate IHL in virtio_net_rsc_extract_unit4 before use
net/tap-solaris: Fix resource leaks on error paths
hw/hotplug: Constify HotplugHandler
hw/hotplug: Reduce some HotplugHandler variables scope
hw/hotplug: Mark various HotplugHandlerClass variables as const
hw/acpi: Make AcpiGedState const in build_ged_aml()
pci: load a device's config inside one memory transaction
pci: batch BAR remapping into one memory transaction
intel_iommu: Always write all the flags passed to vtd_set_flag_in_pte
intel_iommu: Only set dirty bit when PTE exposes write permission
intel_iommu: Support concurrent page fault handling with PRI
virtio-rtc: Report smeared UTC clock type
...
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Expose the CFMWS "Window Restrictions" (CXL r4.0 9.18.1.3) as named
per-window machine properties -- device-coherent, host-only, volatile,
persistent, fixed-config and back-invalidate -- so the advertised
restrictions can be configured per window rather than left at the
default.
No changes in default options. HDM-D and HDM-H are advertised by default;
disabling one (device-coherent=off or host-only=off) narrows the window to
the other. back-invalidate implies device-coherent (HDM-DB) and suppresses
the host-only default. host-only coherent combined with back-invalidate is
rejected as undefined behavior per the spec.
Signed-off-by: Davidlohr Bueso <dave@stgolabs.net>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20260720233242.901544-5-dave@stgolabs.net>
The previous URL worked at the time of submission but it appears that it
was not a portable, durable reference.
This one should work better.
Reviewed-by: Marco Liebel <marco.liebel@oss.qualcomm.com>
Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>
The interface is ambiguous, as "no" is valid file name. So,
using "no" as a special value to disable script is deprecated.
Use an empty string ("script=" / "downscript=") instead.
In a future version, "no" will be treated as a plain file name, just
like any other non-empty value.
Document the deprecation in docs/about/deprecated.rst, qapi/net.json,
and qemu-options.hx. Update other docs to use empty string instead of
"no". Add a warning.
Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Reviewed-by: Ben Chaney <bchaney@akamai.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20260819180201.1970193-4-vsementsov@yandex-team.ru>
The -ftrivial-auto-var-init=zero usage guarantees implicit zero
initializers for all stack variables. Thus most bug reports relying
on undefined behaviour from lack of variable initialization will
not be security issues, or even bugs.
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Baremetal Hexagon programs use trap0 #0 to invoke
semihosting calls for I/O and process control. Wire up the
arm-compatible semihosting framework for softmmu by enabling
CONFIG_ARM_COMPATIBLE_SEMIHOSTING and routing trap0 to the
semihosting handler.
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
Reviewed-by: Brian Cain <brian.cain@oss.qualcomm.com>
Signed-off-by: Matheus Tavares Bernardino <matheus.bernardino@oss.qualcomm.com>
checkpatch: style fixes.
Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>
Add mps3-an555 board modeled after the existing mps3-an547 board.
Add UnimplementedDeivceState for timing adapters and qspi controllers
in MPS2TZMachineState.
Changes in AN555:
Timing adapters in APB PPC EX0 instead of MPC.
Additional QSPI controllers in AHB PPC EX0.
Additional AHB PPC EX1 with DMA.
Create standalone unimplemented devices for MPC instead of timing adapters.
Set fpgaio_has_gpioalt2 to true.
Include documentation for SSE-310 and mps3-an555.
Arm mps3-an555 TRM: https://developer.arm.com/documentation/107642/latest/
As our M85 model doesn't yet have PACBTI, note this omission
in the documentation of where we deviate from the real AN555.
Reviewed-by: Owen Giles <owen.giles@hpe.com>
Reviewed-by: Robert Elliott <elliott@hpe.com>
Signed-off-by: Simon Xu <simonxhy0404@gmail.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-Id: <20260805153005.9989-9-simonxhy0404@gmail.com>
[PMM: added doc note about PACBTI]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
The 'musicpal' machine emulates the Freecom MusicPal, which was an
"internet radio" released in the mid-2000s. The stock system used a
2.6.16 Linux kernel, but as far as I'm aware, support for the
hardware was never upstreamed to the mainline kernel.
There are a number of reasons for deprecating this board:
* The hardware is now solidly obsolete
* It was never supported in mainline Linux
* The SoC is a Marvell one with no public datasheet
* The only QEMU changes to it have been the usual tree wide
updates and refactoring work
* The only bug report we've ever had about it has been one of
the usual "bug found by static analysis" kind
But in fact we can just drop it immediately, because in commit
59754f85ed ("target/arm: Do memory type alignment check when
translation disabled") in 2024 we broke the boot of the standard
firmware image for this board. (The image's u-boot does a LDRH to an
unaligned address, which is UNPREDICTABLE; we used to let it through,
but that commit makes it take a Data Abort, so the image crashes
before it boots the kernel.) Since nobody complained, we can deduce
that nobody's actually using this machine.
Remove the machine proper, and note this in the docs. Devices used
only by this board will be removed in subsequent commits.
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Acked-by: Jan Kiszka <jan.kiszka@web.de>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Message-id: 20260819185430.3467629-4-peter.maydell@linaro.org
When secure boot is enabled (-secure-boot on) and certificate(s) are
provided, the boot operates in True Secure IPL mode.
Any verification error during True Secure IPL mode will cause the
entire boot process to terminate.
Secure IPL in audit mode requires at least one certificate provided in
the key store along with necessary facilities. If secure boot is enabled
but no certificate is provided, the boot process will also terminate, as
this is not a valid secure boot configuration.
Note: True Secure IPL mode is implemented for the SCSI scheme of
virtio-blk/virtio-scsi devices.
Signed-off-by: Zhuoying Cai <zycai@linux.ibm.com>
Reviewed-by: Collin Walling <walling@linux.ibm.com>
Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/20260730214624.2328883-30-zycai@linux.ibm.com
Signed-off-by: Eric Farman <farman@linux.ibm.com>
Enable secure IPL in audit mode, which performs signature verification,
but any error does not terminate the boot process. Only warnings will be
logged to the console instead.
Secure IPL in audit mode requires at least one certificate provided in
the key store along with necessary facilities (Secure IPL Facility,
Certificate Store Facility and secure IPL extension support).
Note: Secure IPL in audit mode is implemented for the SCSI scheme of
virtio-blk/virtio-scsi devices.
Signed-off-by: Zhuoying Cai <zycai@linux.ibm.com>
Reviewed-by: Eric Farman <farman@linux.ibm.com>
Reviewed-by: Jared Rossi <jrossi@linux.ibm.com>
Reviewed-by: Collin Walling <walling@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/20260730214624.2328883-24-zycai@linux.ibm.com
Signed-off-by: Eric Farman <farman@linux.ibm.com>
Add ZiplBootMode enumeration to support multiple IPL boot configurations.
Boot modes differentiate between normal boot and secure IPL operations,
enabled based on boot certificates specified via the boot-certs option.
Normal Mode: IPL when no certificates are provided. No signature
verification is performed.
This prepares for future secure IPL modes requiring signature
verification.
Signed-off-by: Zhuoying Cai <zycai@linux.ibm.com>
Reviewed-by: Collin Walling <walling@linux.ibm.com>
Reviewed-by: Jared Rossi <jrossi@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/20260730214624.2328883-23-zycai@linux.ibm.com
Signed-off-by: Eric Farman <farman@linux.ibm.com>
Introduce a new `boot-certs` machine type option for the s390-ccw-virtio
machine. This allows users to specify one or more certificate file paths
or directories to be used during secure boot.
Each entry is specified using the syntax:
boot-certs.<index>.path=/path/to/cert.pem
Multiple paths can be specify using array properties:
boot-certs.0.path=/path/to/cert.pem,
boot-certs.1.path=/path/to/cert-dir,
boot-certs.2.path=/path/to/another-dir...
Signed-off-by: Zhuoying Cai <zycai@linux.ibm.com>
Acked-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/20260730214624.2328883-2-zycai@linux.ibm.com
Signed-off-by: Eric Farman <farman@linux.ibm.com>
This commit adds test cases for GSDMA.
Imitate the behavior of the driver, set LLT and sdma registers.
After the data transmission is completed, check the destination address data.
Update MAINTAINERS for this test.
Run this qtest:
$ mkdir build && cd build && ../configure --target-list="riscv64-softmmu"
$ QTEST_QEMU_BINARY=./qemu-system-riscv64 tests/qtest/k230-gsdma-test
Signed-off-by: Tao Ding <dingtao0430@163.com>
Reviewed-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
Reviewed-by: Junze Cao <caojunze424@gmail.com>
Message-ID: <20260808062227.66961-4-dingtao0430@163.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
This adds optional UART1 to RiscV virt board if required at
runtime to simplify multicore development.
Note that UART0 remains default serial_hd(0) and it is:
- the lowest address UART
- first serial in DTB
- behind /aliases/serial0 in DTB
- the /chosen/stdout-path in DTB
Note that UART1 is placed at different page from UART0 to
support page level isolation.
Signed-off-by: Yanfeng Liu <yfliu2008@qq.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Message-ID: <tencent_4EEBFC805F3E59863BEDC38094EF5A109206@qq.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
migration/mem pull for 11.2
v2: fixes macos build error
- Dongli's patch to add cpr-transfer support for HMP
- Fabiano's doc update for migration on security issues
- Gavin's fix for MMIO access support for memory APIs, reverting ram_device ops
- Sam's migration test build fix for !ASN1
- Peter's a few migration hardening fixes
# -----BEGIN PGP SIGNATURE-----
#
# iIgEABYKADAWIQS5GE3CDMRX2s990ak7X8zN86vXBgUCan3KARIccGV0ZXJ4QHJl
# ZGhhdC5jb20ACgkQO1/MzfOr1wa76QD/eBLnPtDvmpNHNH3+bm/3XC3zwyy7v69U
# bGK3ocwI3sQA/j9o5FCc7xDCA0QaW6RMeerlLXvXR0uwH46UESKKDloF
# =/Jbs
# -----END PGP SIGNATURE-----
# gpg: Signature made Thu 13 Aug 2026 06:43:29 AM PDT
# gpg: using EDDSA key B9184DC20CC457DACF7DD1A93B5FCCCDF3ABD706
# gpg: issuer "peterx@redhat.com"
# gpg: Good signature from "Peter Xu <xzpeter@gmail.com>" [unknown]
# gpg: aka "Peter Xu <peterx@redhat.com>" [unknown]
# gpg: WARNING: The key's User ID is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: B918 4DC2 0CC4 57DA CF7D D1A9 3B5F CCCD F3AB D706
* tag 'next-pull-request' of https://gitlab.com/peterx/qemu:
migration: Fix rare hang of migration_channel_read_peek()
migration/ram: Check for RAMBlock size mismatch when parsing
migration/multifd: Replace assert() with error_setg() in recv paths
migration/multifd: Validate next_packet_size in zlib/zstd recv
tests/qtest/migration: Only build tls_no_hostname test with TASN1
system/memory: Make ram device region directly accessible
system/memory: Use qemu_ram_move() for directly accessible regions
system/memory: Use memmove() for directly accessible regions
migration/cpr: Add HMP support for cpr-transfer
docs: Add security considerations for migration
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Add the security considerations that are unique to migration and that
do not already fall into one of the other categories. Some aspects are
better framed as security architecture considerations, so extend that
section to mention TLS and clarify that disk images and guest network
also need to be isolated from other processes, not just other guests.
Reviewed-by: Peter Xu <peterx@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/r/20260721131457.3062767-1-farosas@suse.de
Signed-off-by: Peter Xu <peterx@redhat.com>
The documentation stated that writing to HV_X64_MSR_CRASH_CTL
unconditionally causes the guest to shutdown. In reality, it triggers
qemu_system_guest_panicked() via KVM_SYSTEM_EVENT_CRASH and the
resulting action depends on the generic panic action policy
(-action panic=...), which defaults to shutdown.
Reviewed-by: Vitaly Kuznetsov <vkuznets@redhat.com>
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-ID: <20260701122135.3168729-1-marcandre.lureau@redhat.com>
Richard Henderson