Beyond the overall virt/non-virt use case classification, there are
a number of scenarios which we have decided will not be treated as
security issues. Start to document some of these to give consistency
in our treatment of incoming disclosures.
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Mauro Matteo Cascella <mcascell@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Monitor patches for 2026-07-07
# -----BEGIN PGP SIGNATURE-----
#
# iQJGBAABCgAwFiEENUvIs9frKmtoZ05fOHC0AOuRhlMFAmpMylQSHGFybWJydUBy
# ZWRoYXQuY29tAAoJEDhwtADrkYZTZR0QALmaLG//ZC/AihLLdHHYgQFWQD+2MQiP
# l91oqTb+p40q0WhQYzCVYUc+8SMBY6pG6uuzn/qgpsP335uaFEk8c++znyXmbofy
# eABrnVETv/SokrvCxwEIZaW49B2gfER2dZ59sLKbvDQN30Dg36dbppHgchWeLO4b
# P2kP0veYHSnPx60JE4a0bcvLUO8aaEpb2dkvLOjJdaavJaF1iJURU5CP4hA979PM
# xt74cxqhEB6bASLcCJNuGumjmuUHCJGvt0bIGU7L/7a18RAXCw6kJlqfniZWjapC
# FMwN5OU8KSq2dy3SjbT6NotUQ8/fLgDqiCsd5gCRPROeAPQ8ZHHqBjyWsdPbHXOo
# A5m/XGAqDmWtqBPQkM158RpK20IeGAvTs3LrNQHoFB5f+iLm6dJf0CqbFCj6a4tc
# 0w9J7nMUPscEZrJRryjpuYKe82wLrsWTaT3/je/dj2MMDy/Rd6HvjXKhY5P9upHH
# SOa8c4L0bG7PpT0paL2cUf03NmyOhWZFx583VID+R/TOQKjyOtdc//eMpuoqpfGU
# ggiMDG6VY1+YUZ4/gZ84v/gZDeMJ/9R6rpKGiMJKCOJJUS9znPOPiKKBMI+5Vz0w
# 5IrugNKhnfMwCbYS2xFjtop9OFSOQBgLz4/7epKBYltWd4Y3h2Y61WsxxFRg85TL
# 4MnzmcrMvoK7
# =Lxcx
# -----END PGP SIGNATURE-----
# gpg: Signature made Tue 07 Jul 2026 11:43:48 CEST
# gpg: using RSA key 354BC8B3D7EB2A6B68674E5F3870B400EB918653
# gpg: issuer "armbru@redhat.com"
# gpg: Good signature from "Markus Armbruster <armbru@redhat.com>" [full]
# gpg: aka "Markus Armbruster <armbru@pond.sub.org>" [full]
# Primary key fingerprint: 354B C8B3 D7EB 2A6B 6867 4E5F 3870 B400 EB91 8653
* tag 'pull-monitor-2026-07-07' of https://repo.or.cz/qemu/armbru: (35 commits)
docs: mark '-mon' as deprecated in favour of -object
qemu-options: document new monitor-hmp and monitor-qmp objects
tests: switch from -mon to -object monitor-qmp
monitor: add support for auto-deleting monitors upon close
qom: add trace events for user creatable create/delete APIs
tests/functional: add a stress test for monitor hot unplug
tests/functional: add e2e test for dynamic QMP monitor hotplug
tests/qtest: add tests for dynamic monitor add/remove
monitor: implement support for deleting QMP objects
monitor: protect qemu_chr_fe_accept_input with monitor lock
monitor: reject attempts to delete the current monitor
monitor: convert from oneshot BH to persistent BH
monitor: implement "user creatable" interface for adding monitors
monitor: eliminate monitor_is_hmp_non_interactive method
monitor: drop unused monitor_is_qmp method
monitor: use dynamic cast in monitor_is_hmp_non_interactive
monitor: use dynamic cast in QMP commands
monitor: drop unused monitor_cur_is_qmp
util: use dynamic cast in error vreport
monitor: use dynamic cast in monitor_qmp_requests_pop_any_with_lock
...
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
According to VFIO uAPI, precopy initial_bytes is considered as critical
data that should be transferred and loaded prior to moving to STOP_COPY
state to ensure precopy phase would be effective.
As currently defined, initial_bytes can only decrease as it's being read
from the data fd. However, there are cases where a new chunk of
initial_bytes should be transferred during precopy.
The new VFIO_PRECOPY_INFO_REINIT feature addresses this and allows
reporting a new value for initial_bytes regardless of any previously
reported values.
Implement VFIO_PRECOPY_INFO_REINIT feature:
1. Opt-in for VFIO_DEVICE_FEATURE_MIG_PRECOPY_INFOv2 to make
VFIO_PRECOPY_INFO_REINIT available.
2. Request a new switchover ACK if initial_bytes increases post of a
previous switchover ACK. This ensures the device is not moved to
STOP_COPY before initial_bytes has reached zero again.
Acked-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Avihai Horon <avihaih@nvidia.com>
Link: https://lore.kernel.org/qemu-devel/20260706085211.13905-13-avihaih@nvidia.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
A new switchover-ack mechanism that will replace the existing one will
be added in the following patches. The new mechanism will not use
switchover_ack_needed SaveVMHandler, however, the old mechanism must
still be kept for backward compatibility.
To keep things clear and decrease API surface of old code, replace
switchover_ack_needed SaveVMHandler with a regular function
migration_request_switchover_ack().
No functional changes intended.
Acked-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Avihai Horon <avihaih@nvidia.com>
Link: https://lore.kernel.org/qemu-devel/20260706085211.13905-6-avihaih@nvidia.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
Now accelerators hold the 'guest debug supported' information
in their state, accessible by the common code. No need to call
a per-accelerator handler, simply check for the SSTEP_ENABLE
in AccelGdbConfig::sstep_flags.
Remove all AccelOpsClass::supports_guest_debug implementations,
inline gdb_supports_guest_debug() and remove the now unnecessary
KVMState::have_guest_debug field.
Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260705215729.62196-18-philmd@oss.qualcomm.com>
We implement the fw_cfg device for more architectures and machines
that we let on about in our documentation. Luckily most of the new
ones (notably riscv and loongarch) have followed the straightforward
layout that the Arm virt board picked.
Restructure the documentation to present this as the "standard"
layout, followed by the other layouts used by various other boards
for historical reasons. This adds PA-RISC, SPARC, PPC and MIPS.
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Message-id: 20260529174639.451353-2-peter.maydell@linaro.org
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Otherwise there would be an ambiguity problem. Suppose that:
1. There is a region from [0x40000, 0x50000) with mmap offset 0x500000.
2. There is a region from [0x48000, 0x58000) with mmap offset 0xA00000.
A request has address 0x44000. Which mmap offset should be used?
This problem appears with both guest and user addresses.
Signed-off-by: Demi Marie Obenour <demiobenour@gmail.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20260522-vhost-user-dev-v1-1-b31646cf19b8@gmail.com>
Add WDAT handling for sbsa-gwdt on arm/virt machine.
WDAT mode is enabled by 'wdat' option: ex: "-device sbsa-gwdt,wdat=on"
When WDAT is enabled:
- Build the WDAT ACPI table instead of the GTDT watchdog entry,
since they are mutually exclusive due to different timer
resolution (WDAT uses 1 kHz vs GTDT's system counter frequency).
- Skip FDT watchdog node creation, as the DT-based Linux driver
would use the system counter frequency which doesn't match the
WDAT-mode 1 kHz clock.
Signed-off-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20260702145856.1539572-8-imammedo@redhat.com>
Allow to use SBSA generic watchdog with virt machine type.
(includes conditional generation of corresponding FDT and
ACPI GTDT descriptors)
Use '-device sbsa-gwdt' to command line to enable it.
Instead of using dynamic sysbus infra to wire up MMIO/IRQ/FDT,
statically assign resources in machine's mem/irq maps and wire
them up at device (pre_)plug handlers. It's similar to dynamic
sysbus wiring, modulo resources are nailed down statically,
and wiring is limited to virt machine only.
(Benefit is that tests don't break anymore on rebase due to
address being stable)
Tested with Fedora 43:
FDT: -M virt,acpi=off -device sbsa-gwdt
ACPI: -M virt -device sbsa-gwdt
Note:
Windows sees GTDT, initializes watchdog but instead pinging WRR
it sets/advances WOR to way too large value, so it's never going
to trigger watchdog reboot (it's Windows driver issue though).
Signed-off-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20260702145856.1539572-5-imammedo@redhat.com>
Jorge Moreira <jemoreira@google.com> pointed out that the ring state
machine is underspecified. In the discussion that followed, we
discovered that the spec says one thing and implementations do something
else. This patch updates the spec to reflect how things are actually
implemented across widely-used front-ends and back-ends including QEMU,
crosvm, rust-vmm, and DPDK. Do this while taking care not to make any
other existing implementations non-compliant by changing the spec.
The spec says rings are started when a kick is received but the
implementations actually start rings when VHOST_USER_SET_VRING_KICK is
received.
Reconcile this as follows:
- Clarify that a ring can be stopped and then started again. The
back-end must resume processing available requests when the ring is
restarted.
- Update the spec to say rings are started when
VHOST_USER_SET_VRING_KICK is received.
- Ensure compatibility by saying front-ends SHOULD inject a kick in case
the back-end strictly implemented the old spec.
- Avoid future back-end dependencies on injected kicks by saying that
back-ends SHOULD NOT expect a kick to start rings.
This way implementors have clarity on how things work while still
allowing compatibility for existing implementations.
Reported-by: Jorge Moreira <jemoreira@google.com>
Cc: "Michael S . Tsirkin" <mst@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20260604201029.250450-2-stefanha@redhat.com>
This reverts commit 52f0b59ec6.
The PowerPC 405 CPU is used by the PPE42 CPU which was added to
QEMU v10.2. The PPE42 CPU is basically a stripped down version
of the PowerPC 405 CPU and is used by the Power9, Power10, and
Power11 CPUs as an embedded processor to handle various tasks.
Also, IBM has plans to use the PowerPC 405 CPU model within a
year to model the On Chip Controller (OCC), which has an embedded
PPC405 CPU. Therefore, this patch removes the PowerPC 405 CPU
from the deprecated list.
Signed-off-by: Glenn Miles <milesg@linux.ibm.com>
Acked-by: Cédric Le Goater <clg@redhat.com>
Acked-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/20260505144621.1308457-1-milesg@linux.ibm.com
Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
RISC-V PR for 11.1
* Fix IMSIC CSR write and add tests
* Parametrise debug trigger number
* Add 'svbare' satp-mode
* Fix RINTC PLIC context ID for KVM
* Avoid abort when reading vtype before env->xl is set
* Skip reset for KVM irqchip
* Skip FP/Vector sync on KVM_PUT_RUNTIME_STATE
* More FDT cleanups (PLIC)
* Make FCTL.BE in IOMMU read only 0
* Check DC.TC reserved bits in IOMMU
* Apply UXL WARL handling to vsstatus
* Set cmd_ill IOFENCE.C if rsvp bits are set in IOMMU
* Set RISCV_IOMMU_FQ_HDR_PV appropriately
* Fix MSI MRIF IOMMU interrupt-pending offset
* Report QEMU CPU archid as 42
* Check PMP before updating PTE
* Add the Tenstorrent Atlantis machine
# -----BEGIN PGP SIGNATURE-----
#
# iQIzBAABCgAdFiEEaukCtqfKh31tZZKWr3yVEwxTgBMFAmpE6SoACgkQr3yVEwxT
# gBOxNQ//bI4BvnT65Kd2UNMgtAwwPPcehpsyPzC2S3BcflniXQL+fV6sQ7IreKta
# 6dclp/v5v+yhbB4bd/E1s/UPOF3YD4A9noUFifIhymBkafmqA4YRNsvPByeGiSD8
# xVkHhX5qUT9NW5wKnivEDjO8mndBMRm5YEXQ6uT5ulUsZr3Ir8wPOCJITZ8ZqKwb
# 6dbbXStf1aTIBzu53KaNhNpi9DQqKV5UeV7CiSuhuwWU0qmVg1RAZMg9X3oB80rE
# WpWqH0rg9Z0Cn+3XL+oKSzbLD5SrrTV+Ohq+K8zT2rEk+hIXOE3shAPm2xfTT9Q2
# g65nBOf2UmNWeHlvn3XC2LtmIWq10/A78ogGgm4XwHx8TXIeA2KIKboyS8T37XAb
# NwUllq9LRtfDVtDevpiTn6t7Oa7TC8zrxDJTT1rg/p+3D6MdfkonifwJJgVAwfuG
# NF7R2iePKPQliWr1hi6W+ghzQMRFXgNBwUNOL39/BQguy5IqvNmSk6ovhl8IFocf
# aXGh9U35DqgrsUvMa/7Fgf4uI2QNhERBGJrHfL0SPZ82sKb5CTrMw9URwg0DFnEF
# 8v/zQ9xL4eF0uZn0OtaNlLXRCblDxcHSgecwix9Vip5toFIc1P8ar9FX98Zd/H5l
# UD/a3ENtiwb6hnKhZ+45iM/NIFJeUK7A0944VnQzx00tA06wJLw=
# =a4hl
# -----END PGP SIGNATURE-----
# gpg: Signature made Wed 01 Jul 2026 12:17:14 CEST
# gpg: using RSA key 6AE902B6A7CA877D6D659296AF7C95130C538013
# gpg: Good signature from "Alistair Francis <alistair@alistair23.me>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 6AE9 02B6 A7CA 877D 6D65 9296 AF7C 9513 0C53 8013
* tag 'pull-riscv-to-apply-20260701' of https://github.com/alistair23/qemu: (39 commits)
hw/riscv/riscv-iommu.c: always fault with SADE=0 and A=0
hw/riscv/atlantis: Add some i2c peripherals
hw/riscv/atlantis: Integrate i2c controllers
hw/i2c: Add DesignWare I2C Controller
tests/functional/riscv64: Add tt-atlantis tests
hw/riscv/atlantis: Ensure OpenSBI has a non-zero next_addr
hw/riscv: Add Tenstorrent Atlantis machine
target/riscv: tt-ascalon: Enable Zkr extension
hw/riscv/aia: Configure stride for the M-mode IMSIC
hw/riscv/aia: Provide number of irq sources
hw/riscv/virt: Move AIA initialisation to helper file
hw/riscv/boot: Account for discontiguous memory when loading firmware
hw/riscv/boot: Describe discontiguous memory in boot_info
target/riscv: Check PMP before updating PTE
target/riscv: Report QEMU CPU archid as 42
hw/riscv/riscv-iommu.c: fix MSI MRIF interrupt-pending offset
hw/riscv/riscv-iommu.c: set RISCV_IOMMU_FQ_HDR_PV appropriately
hw/riscv/riscv-iommu: set cmd_ill IOFENCE.C rsvp bits are set
target/riscv: Apply UXL WARL handling to vsstatus
hw/riscv/riscv-iommu: check DC.TC reserved bits
...
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
The Tenstorrent Atlantis platform is a collaboration between Tenstorrent
and CoreLab Technology. It is based on the Atlantis SoC, which includes
the Ascalon-X CPU and other IP from Tenstorrent and CoreLab Technology.
The Tenstorrent Ascalon-X is a high performance 64-bit RVA23 compliant
RISC-V CPU.
Add the tt-atlantis machine containing serial console, interrupt
controllers, and device tree support.
The Atlantis boot images loaded from include OpenSBI and an initial DTB
that is passed to OpenSBI. This is approximated in the model by having
QEMU build the device tree rather than load a DTB image directly.
Subsequent stages may use the modified DTB provided by OpenSBI or opt to
supply their own.
qemu-system-riscv64 -M tt-atlantis -m 512M \
-kernel Image -initrd rootfs.cpio -nographic
Co-Developed-by: Nicholas Piggin <npiggin@gmail.com>
Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Chao Liu <chao.liu.zevorn@gmail.com>
Signed-off-by: Joel Stanley <joel@jms.id.au>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20260630024952.1520546-8-joel@jms.id.au>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Changes:
- [PATCH v3] docs/system: add general note about architecture and (Linisha <linisha232@gmail.com>)
Link: https://lore.kernel.org/qemu-devel/20260626181118.1136-1-linisha232@gmail.com
# -----BEGIN PGP SIGNATURE-----
#
# iQGzBAABCgAdFiEEN8FWlNi6l2Sxlz/btEQ30ZwoYt8FAmo+zu4ACgkQtEQ30Zwo
# Yt/NQwv+M30mFcGyX1sDBk3G/YTsrDaVsXmHIut4Iuz01jGkCkyR0Vqz/g3gmLTX
# Rouhgov7yzhmiU9XDzK+4SKPkiNCPCAH0Z3EBhYxy/kI9yXCBO9Qp89SbBVpG4BS
# efj6n+gUsojSHfvswp3OBomCxT9MziytCQ2ouNflBEiigPrBHhSTuDU8cgsmcx2E
# disJhObtYuC6UnHQc1wEZDboVsRWPO81RKATmv4mnQIJ1k6SZHPp8pxf09ku+gi2
# IrZZq5tOY1/N974NCFSyLzIUuY98r5hVCvxnMqyXavGVvTfdTIGowwmG5E4w/68J
# zk4ZoJpHUW2fXIfQFHTln7SKtdFsKsUmgTV/PxPG9w6EjSxDMoBHeYhbRKqIbbDW
# +AQymgH7Y2jAuZXpRiynbm/b5gzkYJT8tX8ffmN+0F7LWbiE4XWQD7y35AkgMCct
# TV8oY1HbPjEK5o6hr+TuYq0p5yF0feqAW8gUHUvDhNsIlifkbAyaFYuYCE+7l7RP
# z7Y6K43u
# =xXlR
# -----END PGP SIGNATURE-----
# gpg: Signature made Fri 26 Jun 2026 15:11:42 EDT
# gpg: using RSA key 37C15694D8BA9764B1973FDBB44437D19C2862DF
# gpg: Good signature from "Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 37C1 5694 D8BA 9764 B197 3FDB B444 37D1 9C28 62DF
* tag 'pbouvier/pr/docs-20260626' of https://gitlab.com/p-b-o/qemu:
docs/system: add general note about architecture and machine differences
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
* target/i386/mshv: CPU model support
* target/i386/mshv: first part of migration support
* target/i386/mshv: faster register access for MMIO exits
* target/i386/tdx: add support for AMX alias bits in CPUID and AVX10
* Deprecate memory-encryption in favor of confidential-guest-support
# -----BEGIN PGP SIGNATURE-----
#
# iQFIBAABCgAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAmo9sDwUHHBib256aW5p
# QHJlZGhhdC5jb20ACgkQv/vSX3jHroOHBwf8Dx4gkbzOFxmCNX3EaW+ROYwlyAC7
# ADo9LFloDHXforRYTm4mBXNUVNF1/KFA6Tf92rzBlUZgp9KuMy/KhWZ1GbNsE+9b
# k5/1RF9/IxRHy6GL69apdHEKY2OYzXl76or2HF3wMd6Mu77qD8Onthko81VaLWox
# 5ZOBz6NaSnykzs9RimkVLtD9HswtFile2NWTPSliUV874lEJioNi9RcdhnQvJCnX
# WqGWViC0THucIGCm+NVhSEmvRnAFbPgUBPvQuy7skLu+R7Ryy7GAWmE/gFlSrYy2
# 4c4zt4SB0tFYJlT9db5ZdaUSgCs52CFawQ9uTSEjNSmEEuQFzXGo6BeY4w==
# =4V0w
# -----END PGP SIGNATURE-----
# gpg: Signature made Thu 25 Jun 2026 18:48:28 EDT
# gpg: using RSA key F13338574B662389866C7682BFFBD25F78C7AE83
# gpg: issuer "pbonzini@redhat.com"
# gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" [full]
# gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" [full]
# Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1
# Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83
* tag 'for-upstream' of https://gitlab.com/bonzini/qemu: (45 commits)
i386/tdx: Add CPUID_24_0_EBX_AVX10_VL_MASK as supported
i386/tdx: Make AMX alias bits supported
i386/tdx: Use .has_gpa field to check if the gpa is valid
machine: Deprecate memory-encryption
qemu-options: Add description of tdx-guest object
qemu-options: Add confidential-guest-support to machine options
qemu-options: Change memory-encryption to confidential-guest-support in the example
i386/sev: Remove the example that references memory-encryption
target/i386/mshv: use the register page to set registers
target/i386/mshv: use the register page to get registers
target/i386/mshv: hv_vp_register_page setup for the vcpu
include/hw/hyperv: add hv_vp_register_page struct definition
accel: remove unnecessary #ifdefs
target/i386/mshv: migrate CET/SS MSRs
target/i386/mshv: migrate MTRR MSRs
target/i386/mshv: migrate MSRs
target/i386/mshv: reconstruct hflags after load
target/i386/mshv: migrate XSAVE state
target/i386/mshv: migrate pending ints/excs
target/i386/mshv: move msr code to arch
...
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
