[PATCH 0/4] Bump min compiler versions again

[PATCH 0/4] Bump min compiler versions again

[Daniel P. Berrangé]

With the security policy we want to rely on usage of
the -ftrivial-auto-var-init=zero flag to declare
bugs "not a CVE" if they rely on uninitialized stack
variables.

This arg is only supported by  CLang 17 or GCC 12 though,
both of which are beyond our current min versions.

This series bumps CLang to enable this, but we can't
bump GCC far enough due to the NetBSD constraint due to
its system GCC being 10.x. They do have newer GCC in the
pkg-src as non-default add-ons but we mostly stick with
default system versions.

We could bump to 12.x and force NetBSD users into use of
the non-default versions, but the last patch took the view
that we can just warn that use of old GCC versions takes
you outside the security policy.  If people prefer the
former though, I can respin.

Also historically the macOS XCode versions reported by
clang did not appear to align with upstream CLang versions
so we checked versions separately for macOS.

With this set of patches we happen to end up on 17.0 for
both upstream CLang and macOS Clang, and this makes me
wonder if we can rely on aligned versions going forward ?

Latest XCode 26.6 apparently reports clang 21.0.0 which
appears to be a match for a modern llvm release.

I'm no macOS expert though so looking for feedback from
people with more direct knowledge.

Daniel P. Berrangé (4):
  meson: simplify clang version checks
  meson: bump min XCode CLang to 17.0
  meson: bump min upstream CLang to 17.0
  meson: warn on GCC < 12.0 due to lack of -ftrivial-auto-var-init=zero

 meson.build | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

-- 
2.55.0

[PATCH 1/4] meson: simplify clang version checks

[Daniel P. Berrangé]

The checks for the clang minor versions are currently redundant since
there can never be a minor version less than zero. Going forward it
is likely sufficient to always pick a NN.0.0 release as the min CLang
version, so drop the minor version checks.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 meson.build | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/meson.build b/meson.build
index 5c9de307b0..70e2755149 100644
--- a/meson.build
+++ b/meson.build
@@ -330,11 +330,11 @@ foreach lang : all_languages
     # ok
   elif compiler.get_id() == 'clang' and compiler.compiles('''
       #ifdef __apple_build_version__
-      # if __clang_major__ < 15 || (__clang_major__ == 15 && __clang_minor__ < 0)
+      # if __clang_major__ < 15
       #  error You need at least XCode Clang v15.0 to compile QEMU
       # endif
       #else
-      # if __clang_major__ < 10 || (__clang_major__ == 10 && __clang_minor__ < 0)
+      # if __clang_major__ < 10
       #  error You need at least Clang v10.0 to compile QEMU
       # endif
       #endif''')
-- 
2.55.0

[PATCH 2/4] meson: bump min XCode CLang to 17.0

[Daniel P. Berrangé]

The current two latest macOS releases (Tahoe and Sequoia) support
XCode 17.x, XCode 26.x and XCode 27.x is in Beta.

XCode 17.x reported CLang 17.0.0, and this continued with XCode 26.0
stream until XCode 26.4 switched to reporting CLang 21.0.0.

A min XCode CLang of 17.0.0 looks appropriate and matches our current
CI job matrix.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 meson.build | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/meson.build b/meson.build
index 70e2755149..388423e4fd 100644
--- a/meson.build
+++ b/meson.build
@@ -330,8 +330,8 @@ foreach lang : all_languages
     # ok
   elif compiler.get_id() == 'clang' and compiler.compiles('''
       #ifdef __apple_build_version__
-      # if __clang_major__ < 15
-      #  error You need at least XCode Clang v15.0 to compile QEMU
+      # if __clang_major__ < 17
+      #  error You need at least XCode Clang v17.0 to compile QEMU
       # endif
       #else
       # if __clang_major__ < 10
@@ -342,7 +342,7 @@ foreach lang : all_languages
   elif compiler.get_id() == 'emscripten'
     # ok
   else
-    error('You either need GCC v10.4 or Clang v10.0 (or XCode Clang v15.0) to compile QEMU')
+    error('You either need GCC v10.4 or Clang v10.0 (or XCode Clang v17.0) to compile QEMU')
   endif
 endforeach
 
-- 
2.55.0

[PATCH 3/4] meson: bump min upstream CLang to 17.0

[Daniel P. Berrangé]

Per our supported platform policy, oldest distros we target
have the following CLang available:

          Fedora 43: 21.1.2
    CentOS Stream 9: 22.1.8
          Debian 13: 17.0.6
       Ubuntu 24.04: 20.1.2
            OpenBSD: 22.1.8
            FreeBSD: 23.1.0
             NetBSD: 21.1.8
 OpenSUSE Leap 16.0: 19.1.7

Thus Debian is our prime constraint and we can move from 10.0
to 17.0 as our min version.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 meson.build | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/meson.build b/meson.build
index 388423e4fd..5315420a41 100644
--- a/meson.build
+++ b/meson.build
@@ -334,15 +334,15 @@ foreach lang : all_languages
       #  error You need at least XCode Clang v17.0 to compile QEMU
       # endif
       #else
-      # if __clang_major__ < 10
-      #  error You need at least Clang v10.0 to compile QEMU
+      # if __clang_major__ < 17
+      #  error You need at least Clang v17.0 to compile QEMU
       # endif
       #endif''')
     # ok
   elif compiler.get_id() == 'emscripten'
     # ok
   else
-    error('You either need GCC v10.4 or Clang v10.0 (or XCode Clang v17.0) to compile QEMU')
+    error('You either need GCC v10.4 or Clang v17.0 (or XCode Clang v17.0) to compile QEMU')
   endif
 endforeach
 
-- 
2.55.0

[PATCH 4/4] meson: warn on GCC < 12.0 due to lack of -ftrivial-auto-var-init=zero

[Daniel P. Berrangé]

The security policy for assigning CVEs has an assumption that all
stack variables are zero initialized. Our CLang min version gives
us -ftrivial-auto-var-init=zero, but that is only available in GCC
12 onwards.

Our min GCC is 10.4 but only NetBSD has such an old version.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 meson.build | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/meson.build b/meson.build
index 5315420a41..eeca8d074a 100644
--- a/meson.build
+++ b/meson.build
@@ -327,6 +327,12 @@ endif
 foreach lang : all_languages
   compiler = meson.get_compiler(lang)
   if compiler.get_id() == 'gcc' and compiler.version().version_compare('>=10.4')
+      if not compiler.version().version_compare('>=12.0')
+          warning('GCC < 12.0 does not support -ftrivial-auto-var-init=zero.')
+          warning('This compiler will not satisfy the QEMU security policy ')
+          warning('for assigning CVE which is predicated on zero-initialization ')
+          warning('of  stack variables. Update to GCC 12.0 or use CLang >= 17.0 ')
+      endif
     # ok
   elif compiler.get_id() == 'clang' and compiler.compiles('''
       #ifdef __apple_build_version__
-- 
2.55.0

Re: [PATCH 2/4] meson: bump min XCode CLang to 17.0

[Philippe Mathieu-Daudé]

On 3/9/26 12:35, Daniel P. Berrangé wrote:
> The current two latest macOS releases (Tahoe and Sequoia) support
> XCode 17.x, XCode 26.x and XCode 27.x is in Beta.
> 
> XCode 17.x reported CLang 17.0.0, and this continued with XCode 26.0
> stream until XCode 26.4 switched to reporting CLang 21.0.0.
> 
> A min XCode CLang of 17.0.0 looks appropriate and matches our current
> CI job matrix.
> 
> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
> ---
>   meson.build | 6 +++---
>   1 file changed, 3 insertions(+), 3 deletions(-)

Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>

Re: [PATCH 4/4] meson: warn on GCC < 12.0 due to lack of -ftrivial-auto-var-init=zero

[Marc-André Lureau]

On Thu, Sep 3, 2026 at 2:36 PM Daniel P. Berrangé <berrange@redhat.com> wrote:
>
> The security policy for assigning CVEs has an assumption that all
> stack variables are zero initialized. Our CLang min version gives
> us -ftrivial-auto-var-init=zero, but that is only available in GCC
> 12 onwards.
>
> Our min GCC is 10.4 but only NetBSD has such an old version.
>
> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>

Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>

> ---
>  meson.build | 6 ++++++
>  1 file changed, 6 insertions(+)
>
> diff --git a/meson.build b/meson.build
> index 5315420a41..eeca8d074a 100644
> --- a/meson.build
> +++ b/meson.build
> @@ -327,6 +327,12 @@ endif
>  foreach lang : all_languages
>    compiler = meson.get_compiler(lang)
>    if compiler.get_id() == 'gcc' and compiler.version().version_compare('>=10.4')
> +      if not compiler.version().version_compare('>=12.0')
> +          warning('GCC < 12.0 does not support -ftrivial-auto-var-init=zero.')
> +          warning('This compiler will not satisfy the QEMU security policy ')
> +          warning('for assigning CVE which is predicated on zero-initialization ')
> +          warning('of  stack variables. Update to GCC 12.0 or use CLang >= 17.0 ')
> +      endif
>      # ok
>    elif compiler.get_id() == 'clang' and compiler.compiles('''
>        #ifdef __apple_build_version__
> --
> 2.55.0
>

Re: [PATCH 3/4] meson: bump min upstream CLang to 17.0

[Marc-André Lureau]

On Thu, Sep 3, 2026 at 2:36 PM Daniel P. Berrangé <berrange@redhat.com> wrote:
>
> Per our supported platform policy, oldest distros we target
> have the following CLang available:
>
>           Fedora 43: 21.1.2
>     CentOS Stream 9: 22.1.8
>           Debian 13: 17.0.6
>        Ubuntu 24.04: 20.1.2
>             OpenBSD: 22.1.8
>             FreeBSD: 23.1.0
>              NetBSD: 21.1.8
>  OpenSUSE Leap 16.0: 19.1.7
>
> Thus Debian is our prime constraint and we can move from 10.0
> to 17.0 as our min version.
>
> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>

Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>

> ---
>  meson.build | 6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/meson.build b/meson.build
> index 388423e4fd..5315420a41 100644
> --- a/meson.build
> +++ b/meson.build
> @@ -334,15 +334,15 @@ foreach lang : all_languages
>        #  error You need at least XCode Clang v17.0 to compile QEMU
>        # endif
>        #else
> -      # if __clang_major__ < 10
> -      #  error You need at least Clang v10.0 to compile QEMU
> +      # if __clang_major__ < 17
> +      #  error You need at least Clang v17.0 to compile QEMU
>        # endif
>        #endif''')
>      # ok
>    elif compiler.get_id() == 'emscripten'
>      # ok
>    else
> -    error('You either need GCC v10.4 or Clang v10.0 (or XCode Clang v17.0) to compile QEMU')
> +    error('You either need GCC v10.4 or Clang v17.0 (or XCode Clang v17.0) to compile QEMU')
>    endif
>  endforeach
>
> --
> 2.55.0
>

Re: [PATCH 1/4] meson: simplify clang version checks

[Marc-André Lureau]

Hi

On Thu, Sep 3, 2026 at 2:35 PM Daniel P. Berrangé <berrange@redhat.com> wrote:
>
> The checks for the clang minor versions are currently redundant since
> there can never be a minor version less than zero. Going forward it
> is likely sufficient to always pick a NN.0.0 release as the min CLang
> version, so drop the minor version checks.
>
> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>

This is basically since your commit 2a85a08c998. I'm happy if that is
enough on macos:
Acked-by: Marc-André Lureau <marcandre.lureau@redhat.com>


> ---
>  meson.build | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/meson.build b/meson.build
> index 5c9de307b0..70e2755149 100644
> --- a/meson.build
> +++ b/meson.build
> @@ -330,11 +330,11 @@ foreach lang : all_languages
>      # ok
>    elif compiler.get_id() == 'clang' and compiler.compiles('''
>        #ifdef __apple_build_version__
> -      # if __clang_major__ < 15 || (__clang_major__ == 15 && __clang_minor__ < 0)
> +      # if __clang_major__ < 15
>        #  error You need at least XCode Clang v15.0 to compile QEMU
>        # endif
>        #else
> -      # if __clang_major__ < 10 || (__clang_major__ == 10 && __clang_minor__ < 0)
> +      # if __clang_major__ < 10
>        #  error You need at least Clang v10.0 to compile QEMU
>        # endif
>        #endif''')
> --
> 2.55.0
>

Re: [PATCH 1/4] meson: simplify clang version checks

[Daniel P. Berrangé]

On Thu, Sep 03, 2026 at 03:35:48PM +0400, Marc-André Lureau wrote:
> Hi
> 
> On Thu, Sep 3, 2026 at 2:35 PM Daniel P. Berrangé <berrange@redhat.com> wrote:
> >
> > The checks for the clang minor versions are currently redundant since
> > there can never be a minor version less than zero. Going forward it
> > is likely sufficient to always pick a NN.0.0 release as the min CLang
> > version, so drop the minor version checks.
> >
> > Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
> 
> This is basically since your commit 2a85a08c998. I'm happy if that is
> enough on macos:
> Acked-by: Marc-André Lureau <marcandre.lureau@redhat.com>

Yes, we should arguably add a "Fixes: 2a85a08c998", since that
introduced the bogus  < 0 comparison.

> 
> 
> > ---
> >  meson.build | 4 ++--
> >  1 file changed, 2 insertions(+), 2 deletions(-)
> >
> > diff --git a/meson.build b/meson.build
> > index 5c9de307b0..70e2755149 100644
> > --- a/meson.build
> > +++ b/meson.build
> > @@ -330,11 +330,11 @@ foreach lang : all_languages
> >      # ok
> >    elif compiler.get_id() == 'clang' and compiler.compiles('''
> >        #ifdef __apple_build_version__
> > -      # if __clang_major__ < 15 || (__clang_major__ == 15 && __clang_minor__ < 0)
> > +      # if __clang_major__ < 15
> >        #  error You need at least XCode Clang v15.0 to compile QEMU
> >        # endif
> >        #else
> > -      # if __clang_major__ < 10 || (__clang_major__ == 10 && __clang_minor__ < 0)
> > +      # if __clang_major__ < 10
> >        #  error You need at least Clang v10.0 to compile QEMU
> >        # endif
> >        #endif''')
> > --
> > 2.55.0
> >
> 

With regards,
Daniel
-- 
|: https://berrange.com       ~~        https://hachyderm.io/@berrange :|
|: https://libvirt.org          ~~          https://entangle-photo.org :|
|: https://pixelfed.art/berrange   ~~    https://fstop138.berrange.com :|

Re: [PATCH 0/4] Bump min compiler versions again

[Pierrick Bouvier]

On 9/3/2026 3:35 AM, Daniel P. Berrangé wrote:
> With the security policy we want to rely on usage of
> the -ftrivial-auto-var-init=zero flag to declare
> bugs "not a CVE" if they rely on uninitialized stack
> variables.
> 
> This arg is only supported by  CLang 17 or GCC 12 though,
> both of which are beyond our current min versions.
> 
> This series bumps CLang to enable this, but we can't
> bump GCC far enough due to the NetBSD constraint due to
> its system GCC being 10.x. They do have newer GCC in the
> pkg-src as non-default add-ons but we mostly stick with
> default system versions.
> 
> We could bump to 12.x and force NetBSD users into use of
> the non-default versions, but the last patch took the view
> that we can just warn that use of old GCC versions takes
> you outside the security policy.  If people prefer the
> former though, I can respin.
> 
> Also historically the macOS XCode versions reported by
> clang did not appear to align with upstream CLang versions
> so we checked versions separately for macOS.
> 
> With this set of patches we happen to end up on 17.0 for
> both upstream CLang and macOS Clang, and this makes me
> wonder if we can rely on aligned versions going forward ?
> 
> Latest XCode 26.6 apparently reports clang 21.0.0 which
> appears to be a match for a modern llvm release.
> 
> I'm no macOS expert though so looking for feedback from
> people with more direct knowledge.
> 
> Daniel P. Berrangé (4):
>   meson: simplify clang version checks
>   meson: bump min XCode CLang to 17.0
>   meson: bump min upstream CLang to 17.0
>   meson: warn on GCC < 12.0 due to lack of -ftrivial-auto-var-init=zero
> 
>  meson.build | 16 +++++++++++-----
>  1 file changed, 11 insertions(+), 5 deletions(-)
> 

For the series:
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>

Regards,
Pierrick

Re: [PATCH 0/4] Bump min compiler versions again

[Richard Henderson]

On 9/3/26 00:35, Daniel P. Berrangé wrote:
> We could bump to 12.x and force NetBSD users into use of
> the non-default versions, but the last patch took the view
> that we can just warn that use of old GCC versions takes
> you outside the security policy.  If people prefer the
> former though, I can respin.

In patch 3's commit message you mention that NetBSD has clang 21.  I 
think I'd be happier just rejecting gcc 10 and letting NetBSD compile 
with clang instead.  If someone really wants to build with gcc on 
NetBSD, they can take the extra step of using the pkg version.


r~

Re: [PATCH 0/4] Bump min compiler versions again

[Daniel P. Berrangé]

On Thu, Sep 10, 2026 at 08:04:10AM -1000, Richard Henderson wrote:
> On 9/3/26 00:35, Daniel P. Berrangé wrote:
> > We could bump to 12.x and force NetBSD users into use of
> > the non-default versions, but the last patch took the view
> > that we can just warn that use of old GCC versions takes
> > you outside the security policy.  If people prefer the
> > former though, I can respin.
> 
> In patch 3's commit message you mention that NetBSD has clang 21.  I think
> I'd be happier just rejecting gcc 10 and letting NetBSD compile with clang
> instead.  If someone really wants to build with gcc on NetBSD, they can take
> the extra step of using the pkg version.

NB, that would mean rejecting their "system" compiler since IIUC
they use GCC for that.  Having said that, this will resolve itself
with newer NetBSD, and NetBSD users are rare enough that this is
likely not a major inconvenience.

With regards,
Daniel
-- 
|: https://berrange.com       ~~        https://hachyderm.io/@berrange :|
|: https://libvirt.org          ~~          https://entangle-photo.org :|
|: https://pixelfed.art/berrange   ~~    https://fstop138.berrange.com :|