qemu/qemu.git, branch v11.0.0

Update version for v11.0.0 release

2026-04-21T15:28:47+00:00

Signed-off-by: Peter Maydell

Update version for v11.0.0-rc4 release

2026-04-14T19:22:00+00:00

Signed-off-by: Peter Maydell

migration: Remove unnecessary zlib include from qemu-file.h

2026-04-14T14:57:46+00:00

Commit 70eb5fde05 removed zlib from the libmigration dependencies but missed removing the zlib include from the header file. zlib doesn't appear to be used anywhere in qemu-file.h. This is fine in most environments where zlib is nearly always in the default include path but breaks the build when it isn't (NixOS for example). Fixes: 70eb5fde05 ("migration: remove unnecessary zlib dependency") Signed-off-by: Chad Jablonski Reviewed-by: Philippe Mathieu-Daudé Signed-off-by: Peter Maydell

docs: Deprecate Arm OABI and NWFPE support

2026-04-14T14:52:48+00:00

Linux for 32-bit Arm has had two major ABIs: the original OABI and the more modern EABI. OABI support was marked as obsolete in GCC 4.7 and dropped in GCC 4.8. In the Linux kernel, compatibility handling for OABI (OABI_COMPAT) is not generally enabled by default and is not compatible with building a Thumb2 kernel. Distros dropped OABI support fifteen years or more ago. NWFPE floating-point emulation handles the ancient FPA11 coprocessor, which is only needed/supported with OABI. Our implementation is old, untested and not thread-safe. Mark OABI and NWFPE support as deprecated so we can remove it in a future release. Our main motivation here is to be able to drop the 2500+ lines of NWFPE emulation code. Signed-off-by: Peter Maydell Reviewed-by: Mohamed Mediouni Reviewed-by: Alex Bennée Reviewed-by: Richard Henderson Message-id: 20260413103754.45745-1-peter.maydell@linaro.org

util/cutils: Fix heap corruption under Windows

2026-04-14T14:52:21+00:00

Under Windows, QEMU would only sporadically start successfully. In the G_OS_WIN32 case, get_relocated_path() first determines a cursor to the end of the "result" string and then increases its size with g_string_set_size(). Since g_string_set_size() may reallocate, the cursor may become dangling. Windows may detect this and crash the QEMU process with the following message: HEAP: Free Heap block 000000000499B640 modified at 000000000499B684 after it was freed Furthermore, QEMU crashes spontaneously, even long after the guest has booted. For example, it presumably crashes due to the guest setting a new cursor icon which may be a result of the heap corruption. Fix this by determining the cursor on the resized string. Fixes: cf60ccc3306c ("cutils: Introduce bundle mechanism") Cc: qemu-stable@nongnu.org Signed-off-by: Bernhard Beschow Reviewed-by: Philippe Mathieu-Daudé Reviewed-by: Akihiko Odaki Message-id: 20260414114033.2360-1-shentey@gmail.com Signed-off-by: Peter Maydell

accel/kvm: return early from kvm_irqchip_create if kvm does not support irqchip

2026-04-14T14:51:57+00:00

During refactoring of kvm_irqchip_create(), the refactored code was returning early from do_kvm_irqchip_create() function if the required essential capabilities were not present in KVM. This was not translating to an early return from kvm_irqchip_create() as was the case before refactoring. This is because, do_kvm_irqchip_create() did not have a means to notify the caller of the lack of required kvm capabilities. Fix this by making do_notify_irqchip_create() return EOPNOTSUPP error when capabilities are absent and then the caller can check the return code and return early. Due to this regression during refactoring, all KVM guests on ppc64le hang immediately during startup and this completely breaks all functionality on that platform. Fixes: 98884e0cc1 ("accel/kvm: add changes required to support KVM VM file descriptor change") Message-ID: <20260413090010.60339-1-anisinha@redhat.com> Reported-by: Misbah Anjum N Reported-by: Gautam Menghani Tested-by: Misbah Anjum N Reviewed-by: Peter Maydell Signed-off-by: Ani Sinha Message-id: 20260414045911.63662-1-anisinha@redhat.com Suggested-by: Fabiano Rosas Suggested-by: Harsh Prateek Bora Tested-by: Misbah Anjum N Reviewed-by: Peter Maydell Signed-off-by: Ani Sinha Signed-off-by: Peter Maydell

Merge tag 'block-pull-request' of https://gitlab.com/stefanha/qemu into staging

2026-04-13T14:13:01+00:00

Pull request virtio-blk zone report CVE DoS fix # -----BEGIN PGP SIGNATURE----- # # iQEzBAABCgAdFiEEhpWov9P5fNqsNXdanKSrs4Grc8gFAmnc72sACgkQnKSrs4Gr # c8h2CQf/TzMkfPv4bV0G3Z7JMOCllVejmlWUJpSh7lQdboNiIrWbtiCaC5n7CfTF # +A8e8g4FYlTHhRj8nWMTd4vs6lmKEHTS7dbBlwB/ZkmAzHGtGizIXK7X7aAz6LZT # KSRJYIm9Qj+c8kGZjPY/XmA6Y3uFS0jAZRd/1fFSshg0NyNxPIipj3YAv2P8mQf8 # y+v32O2WTezQQfTTBZR2moYmo3wBeSXum6NHOGq4DVswvaSQDJ1Eooc30xFswkIM # vg+RqzUFCABsNj6vED61j1mE01vgFAvJKfCXNY1RFYkyeM2uzwlByktocbMTbs+b # BJweRe9fO01GcQAunWT5Y6VmrJib7A== # =m/MG # -----END PGP SIGNATURE----- # gpg: Signature made Mon Apr 13 14:28:11 2026 BST # gpg: using RSA key 8695A8BFD3F97CDAAC35775A9CA4ABB381AB73C8 # gpg: Good signature from "Stefan Hajnoczi " [full] # gpg: aka "Stefan Hajnoczi " [full] # Primary key fingerprint: 8695 A8BF D3F9 7CDA AC35 775A 9CA4 ABB3 81AB 73C8 * tag 'block-pull-request' of https://gitlab.com/stefanha/qemu: virtio-blk: fix zone report buffer out-of-memory (CVE-2026-5761) Signed-off-by: Peter Maydell

virtio-blk: fix zone report buffer out-of-memory (CVE-2026-5761)

2026-04-13T13:21:38+00:00

An internal buffer is used when processing VIRTIO_BLK_T_ZONE_REPORT requests. The buffer's size is controlled by the guest. A large value can result in g_malloc() failure and the QEMU process aborts, resulting in a Denial of Service (DoS) (most likely in cases where an untrusted guest application or a nested guest with virtio-blk passthrough is able to abort QEMU). Modify the zone report implementation to work incrementally with a bounded buffer size. This is purely a QEMU implementation issue and no VIRTIO spec changes are needed. Mingyuan Luo found this bug and provided a reproducer which I haven't put into tests/qtest/ because it requires a zoned storage device (e.g. root and modprobe null_blk): 1) Prepare a zoned nullblk backend (/dev/nullb0): sudo modprobe -r null_blk || true sudo modprobe null_blk nr_devices=1 zoned=1 sudo chmod 0666 /dev/nullb0 cat /sys/block/nullb0/queue/zoned 2) Create qtest input: cat >/tmp/vblk-zone-report-oom.qtest <<'EOF' outl 0xcf8 0x80002004 outw 0xcfc 0x0007 outl 0xcf8 0x80002010 outl 0xcfc 0x0000c001 outb 0xc012 0x00 outb 0xc012 0x01 outb 0xc012 0x03 outl 0xc004 0x00000000 outw 0xc00e 0x0000 outl 0xc008 0x00000100 outb 0xc012 0x07 writel 0x00020000 0x00000010 writel 0x00020004 0x00000000 writeq 0x00020008 0x0000000000000000 writeq 0x00100000 0x0000000000020000 writel 0x00100008 0x00000010 writew 0x0010000c 0x0001 writew 0x0010000e 0x0001 EOF for i in $(seq 1 1022); do d=$((0x00100000 + i * 16)) n=$((i + 1)) printf 'writeq 0x%08x 0x0000000000200000\n' "$d" >> /tmp/vblk-zone-report-oom.qtest printf 'writel 0x%08x 0x1fe00000\n' $((d + 8)) >> /tmp/vblk-zone-report-oom.qtest printf 'writew 0x%08x 0x0003\n' $((d + 12)) >> /tmp/vblk-zone-report-oom.qtest printf 'writew 0x%08x 0x%04x\n' $((d + 14)) "$n" >> /tmp/vblk-zone-report-oom.qtest done d=$((0x00100000 + 1023 * 16)) printf 'writeq 0x%08x 0x0000000000200000\n' "$d" >> /tmp/vblk-zone-report-oom.qtest printf 'writel 0x%08x 0x1fe00000\n' $((d + 8)) >> /tmp/vblk-zone-report-oom.qtest printf 'writew 0x%08x 0x0002\n' $((d + 12)) >> /tmp/vblk-zone-report-oom.qtest printf 'writew 0x%08x 0x0000\n' $((d + 14)) >> /tmp/vblk-zone-report-oom.qtest cat >> /tmp/vblk-zone-report-oom.qtest <<'EOF' writew 0x00104000 0x0000 writew 0x00104002 0x0001 writew 0x00104004 0x0000 outw 0xc010 0x0000 EOF 3) Run the qtest input with ASAN build (compile qemu with --enable-asan): build/qemu-system-x86_64 -display none \ -accel qtest -qtest stdio \ -machine pc -nodefaults -m 512M -monitor none -serial none \ -blockdev driver=host_device,node-name=disk0,filename=/dev/nullb0 \ -device virtio-blk-pci-transitional,drive=disk0,addr=04.0,queue-size=1024 \ < /tmp/vblk-zone-report-oom.qtest Cc: Sam Li Cc: Damien Le Moal Cc: Dmitry Fomichev Fixes: CVE-2026-5761 Fixes: 4f7366506a9 ("virtio-blk: add zoned storage emulation for zoned devices") Reported-by: Mingyuan Luo Reviewed-by: Damien Le Moal Signed-off-by: Stefan Hajnoczi

Update version for v11.0.0-rc3 release

2026-04-09T20:18:56+00:00

Signed-off-by: Peter Maydell

Merge tag 'hw-misc-20260409' of https://github.com/philmd/qemu into staging

2026-04-09T14:54:41+00:00

Misc HW patches Few hw/ fixes and a keymap one. # -----BEGIN PGP SIGNATURE----- # # iQIzBAABCAAdFiEE+qvnXhKRciHc/Wuy4+MsLN6twN4FAmnXtasACgkQ4+MsLN6t # wN6TYxAAkfAJ+bFx35zYD1BJXS9ozboprLFR6EtGzEzomOSNSio4W0Dh+X3G6R69 # CZ6AW11J+17JtIsvVp4UrZVT1Seq4nhEl+LVCvJtIgpKkDv4o1IZh+jyIpwRxlZ8 # JweahVgOgc3z9r+gEM8GTrZmux9P3fYjELPt+71tsrgiVWhXntOyO3MriRHD4+1m # pYMKEh3FEd84VVacKVArnxf/ThUlgxd+nt+KjXMpPnW7oDlLnqaVahn5qqqDgYX8 # Kgva7g7Z30ZCrxuOa+9Fx2FsTof8EW6htGbSr8kfa8gzzveUYRmEFvRFpuTE7rX7 # 4LItAUaKKUsA65cbXPXPNB+3Ua2odtNgjhvbudTsRnpcKNfTW203ct7R9h9OnfIu # WROnegR4qFi1uVRFaI0NUxS9pOWCtK4MotnmBtJPwTBB9xP6qch6i8pOLj7loNEo # QC2AN1RB0N6u3mSXdMWUaWsbsCq7Mw2j7YIpj0N8Cg7/sCzzAXR1XEmHl1bPesbc # D/f89ck2kBe8wFHphkTxkIu1USPMxP9nVYt/UU+dh3iusXu5wzp26a/TSMoCYCYl # LTd/8mYPvAFK71icgZwaGvzhJagA9EYExL2RAWCQZ56K8GG5UvsHmriQovyNMBgX # QRNlKU6X+fbnv5lHOUVVRtPcT4xz7xYycfm2I9bqLXt4aLDRkxs= # =i6vx # -----END PGP SIGNATURE----- # gpg: Signature made Thu Apr 9 15:20:27 2026 BST # gpg: using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE # gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) " [full] # Primary key fingerprint: FAAB E75E 1291 7221 DCFD 6BB2 E3E3 2C2C DEAD C0DE * tag 'hw-misc-20260409' of https://github.com/philmd/qemu: qemu-keymap: fix altgr modifier lookup for newer xkeyboard-config ati-vga: Fix check for overflowing vram hw/timer: ibex_timer: Update IRQs after writing CTRL ati-vga: Fix pitch and offset registers mask Signed-off-by: Peter Maydell