[PULL 00/14] Misc patches for QEMU 11.0 hard freeze

[PULL 00/14] Misc patches for QEMU 11.0 hard freeze

[Paolo Bonzini]

The following changes since commit 1fd5ff9d76d23ab23a68419cbc76d5ee33e8b455:

  Merge tag 'for-upstream' of https://gitlab.com/kmwolf/qemu into staging (2026-03-10 16:29:24 +0000)

are available in the Git repository at:

  https://gitlab.com/bonzini/qemu.git tags/for-upstream

for you to fetch changes up to c725a896c6b92f733e0eeb236167cbd9b33efda8:

  typedefs: move QIgvm out of typedefs.h (2026-03-12 12:02:55 +0100)

----------------------------------------------------------------
* accel/kvm: fix typo in variable name
* system: fix coverity issues related to confidential guest reset
* target/i386: add compat for migrating error code
* docs fixes
* hyperv/syndbg: check length returned by cpu_physical_memory_map()
* typedefs: move QIgvm out of typedefs.h
* rust: Update Cargo.lock
* i386/cpu: cleanups for ClearwaterForest, AMX and more

----------------------------------------------------------------
Alyssa Ross (1):
      accel/kvm: fix typo in variable name

Ani Sinha (1):
      coverity: fix coverity issues related to confidential guest reset

Fiona Ebner (1):
      target/i386: add compat for migrating error code

Mohamed Mediouni (3):
      docs: remove 64-bit only mentions for accelerators
      qemu-options.hx: document Hyper-V enlightenments accelerator option
      docs: mention that WHPX supports Arm too

Paolo Bonzini (2):
      hyperv/syndbg: check length returned by cpu_physical_memory_map()
      typedefs: move QIgvm out of typedefs.h

Philippe Mathieu-Daudé (1):
      rust: Update Cargo.lock

Zhao Liu (5):
      i386/cpu: Rename AMX mirror cpuid macros with _ALIAS suffix
      i386/cpu: Rename AMX mirror feature words with -alias suffix
      i386/cpu: Remove unnecessary cache_info fields from builtin CPU model
      i386/cpu: Adjust the note for CPU models with its-no
      i386/cpu: Enable CPUID 0x1f & cache model for ClearwaterForest

 docs/about/build-platforms.rst |   4 +-
 docs/system/introduction.rst   |   6 +--
 include/qemu/typedefs.h        |   1 -
 include/system/igvm.h          |   3 +-
 target/i386/cpu.h              |  17 ++++---
 accel/kvm/kvm-all.c            |   4 +-
 hw/hyperv/syndbg.c             |  23 ++++-----
 hw/i386/pc.c                   |   1 +
 system/runstate.c              |  10 ++--
 target/i386/cpu.c              | 113 +++++++++++++++++++++++++++++++++++++----
 target/i386/machine.c          |   2 +-
 target/i386/sev.c              |   4 --
 qemu-options.hx                |   5 ++
 rust/Cargo.lock                |   3 +-
 14 files changed, 144 insertions(+), 52 deletions(-)
-- 
2.53.0

[PULL 01/14] hyperv/syndbg: check length returned by cpu_physical_memory_map()

[Paolo Bonzini]

If cpu_physical_memory_map() returns a length shorter than the one
that was passed into the function, writing the full out_len bytes
causes an access beyond the memory allocated to the guest; or in
the case of the MMIO bounce buffer, an out-of-bounds access in a
heap-allocated object.

Add a check similar to the one already in handle_send_msg(),
and take the occasion to remove repeated computations of
recv_byte_count + UDP_PKT_HEADER_SIZE and clarify that the
code does not write past out_len bytes.

Reported-by: Oleh Konko <https://github.com/1seal>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Fixes: CVE-2026-3842
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/hyperv/syndbg.c | 23 +++++++++++------------
 1 file changed, 11 insertions(+), 12 deletions(-)

diff --git a/hw/hyperv/syndbg.c b/hw/hyperv/syndbg.c
index 1e177f9dd82..10171b19e8f 100644
--- a/hw/hyperv/syndbg.c
+++ b/hw/hyperv/syndbg.c
@@ -194,7 +194,7 @@ static uint16_t handle_recv_msg(HvSynDbg *syndbg, uint64_t outgpa,
     uint16_t ret;
     g_assert(MSG_BUFSZ >= qemu_target_page_size());
     QEMU_UNINITIALIZED uint8_t data_buf[MSG_BUFSZ];
-    hwaddr out_len;
+    hwaddr out_len, out_requested_len;
     void *out_data;
     ssize_t recv_byte_count;
 
@@ -223,29 +223,28 @@ static uint16_t handle_recv_msg(HvSynDbg *syndbg, uint64_t outgpa,
     if (is_raw) {
         out_len += UDP_PKT_HEADER_SIZE;
     }
+    out_requested_len = out_len;
     out_data = cpu_physical_memory_map(outgpa, &out_len, 1);
-    if (!out_data) {
-        return HV_STATUS_INSUFFICIENT_MEMORY;
+    ret = HV_STATUS_INSUFFICIENT_MEMORY;
+    if (!out_data || out_len < out_requested_len) {
+        goto cleanup_out_data;
     }
 
     if (is_raw &&
-        !create_udp_pkt(syndbg, out_data,
-                        recv_byte_count + UDP_PKT_HEADER_SIZE,
+        !create_udp_pkt(syndbg, out_data, out_len,
                         data_buf, recv_byte_count)) {
-        ret = HV_STATUS_INSUFFICIENT_MEMORY;
         goto cleanup_out_data;
     } else if (!is_raw) {
-        memcpy(out_data, data_buf, recv_byte_count);
+        memcpy(out_data, data_buf, out_len);
     }
 
-    *retrieved_count = recv_byte_count;
-    if (is_raw) {
-        *retrieved_count += UDP_PKT_HEADER_SIZE;
-    }
+    *retrieved_count = out_len;
     ret = HV_STATUS_SUCCESS;
 
 cleanup_out_data:
-    cpu_physical_memory_unmap(out_data, out_len, 1, out_len);
+    if (out_data) {
+        cpu_physical_memory_unmap(out_data, out_len, 1, out_len);
+    }
     return ret;
 }
 
-- 
2.53.0

[PULL 02/14] i386/cpu: Rename AMX mirror cpuid macros with _ALIAS suffix

[Paolo Bonzini]

From: Zhao Liu <zhao1.liu@intel.com>

For the similar case - CPUID_EXT2_AMD_ALIASES, the term "alias" has
already been used. Therefore, reintroducing the new term "mirror" is
likely to cause confusion.

Rename the relevant CPUID macros of AMX with _ALIAS suffix, aligning
with KVM's naming convention.

Signed-off-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20260310140819.1563084-2-zhao1.liu@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/cpu.h | 16 ++++++++--------
 target/i386/cpu.c |  6 +++---
 2 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/target/i386/cpu.h b/target/i386/cpu.h
index 5a62aa61579..7bd38f0c039 100644
--- a/target/i386/cpu.h
+++ b/target/i386/cpu.h
@@ -1098,14 +1098,14 @@ uint64_t x86_cpu_get_supported_feature_word(X86CPU *cpu, FeatureWord w);
 /* Packets which contain IP payload have LIP values */
 #define CPUID_14_0_ECX_LIP              (1U << 31)
 
-/* AMX_INT8 instruction (mirror of CPUID_7_0_EDX_AMX_INT8) */
-#define CPUID_1E_1_EAX_AMX_INT8_MIRROR      (1U << 0)
-/* AMX_BF16 instruction (mirror of CPUID_7_0_EDX_AMX_BF16) */
-#define CPUID_1E_1_EAX_AMX_BF16_MIRROR      (1U << 1)
-/* AMX_COMPLEX instruction (mirror of CPUID_7_1_EDX_AMX_COMPLEX) */
-#define CPUID_1E_1_EAX_AMX_COMPLEX_MIRROR   (1U << 2)
-/* AMX_FP16 instruction (mirror of CPUID_7_1_EAX_AMX_FP16) */
-#define CPUID_1E_1_EAX_AMX_FP16_MIRROR      (1U << 3)
+/* AMX_INT8 instruction (alias of CPUID_7_0_EDX_AMX_INT8) */
+#define CPUID_1E_1_EAX_AMX_INT8_ALIAS      (1U << 0)
+/* AMX_BF16 instruction (alias of CPUID_7_0_EDX_AMX_BF16) */
+#define CPUID_1E_1_EAX_AMX_BF16_ALIAS      (1U << 1)
+/* AMX_COMPLEX instruction (alias of CPUID_7_1_EDX_AMX_COMPLEX) */
+#define CPUID_1E_1_EAX_AMX_COMPLEX_ALIAS   (1U << 2)
+/* AMX_FP16 instruction (alias of CPUID_7_1_EAX_AMX_FP16) */
+#define CPUID_1E_1_EAX_AMX_FP16_ALIAS      (1U << 3)
 /* AMX_FP8 instruction */
 #define CPUID_1E_1_EAX_AMX_FP8              (1U << 4)
 /* AMX_TF32 instruction */
diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 0a29ff805fa..e35701b93ba 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -5550,9 +5550,9 @@ static const X86CPUDefinition builtin_x86_defs[] = {
             CPUID_XSAVE_XSAVEOPT | CPUID_XSAVE_XSAVEC |
             CPUID_XSAVE_XGETBV1 | CPUID_XSAVE_XSAVES | CPUID_D_1_EAX_XFD,
         .features[FEAT_1E_1_EAX] =
-            CPUID_1E_1_EAX_AMX_INT8_MIRROR | CPUID_1E_1_EAX_AMX_BF16_MIRROR |
-            CPUID_1E_1_EAX_AMX_COMPLEX_MIRROR |
-            CPUID_1E_1_EAX_AMX_FP16_MIRROR | CPUID_1E_1_EAX_AMX_FP8 |
+            CPUID_1E_1_EAX_AMX_INT8_ALIAS | CPUID_1E_1_EAX_AMX_BF16_ALIAS |
+            CPUID_1E_1_EAX_AMX_COMPLEX_ALIAS |
+            CPUID_1E_1_EAX_AMX_FP16_ALIAS | CPUID_1E_1_EAX_AMX_FP8 |
             CPUID_1E_1_EAX_AMX_TF32 | CPUID_1E_1_EAX_AMX_AVX512 |
             CPUID_1E_1_EAX_AMX_MOVRS,
         .features[FEAT_29_0_EBX] = CPUID_29_0_EBX_APX_NCI_NDD_NF,
-- 
2.53.0

[PULL 03/14] i386/cpu: Rename AMX mirror feature words with -alias suffix

[Paolo Bonzini]

From: Zhao Liu <zhao1.liu@intel.com>

The commit 956b8f0fc38a ("i386/cpu: Add CPUID.0x1E.0x1 subleaf for AMX
instructions") names amx-int8/amx-bf16/amx-complex-amx-fp16 in CPUID
0x1E.1.EAX with "-mirror" suffix.

To align with the naming style of corresponding macros, rename these
feature words with "-alias" suffix.

Since the commit 956b8f0fc38a is merged in v11.0 development cycle,
it's safe to modify the names of feature words (before v11.0 is
released).

Signed-off-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20260310140819.1563084-3-zhao1.liu@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/cpu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index e35701b93ba..08450a9142e 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -1314,7 +1314,7 @@ FeatureWordInfo feature_word_info[FEATURE_WORDS] = {
     [FEAT_1E_1_EAX] = {
         .type = CPUID_FEATURE_WORD,
         .feat_names = {
-            "amx-int8-mirror", "amx-bf16-mirror", "amx-complex-mirror", "amx-fp16-mirror",
+            "amx-int8-alias", "amx-bf16-alias", "amx-complex-alias", "amx-fp16-alias",
             "amx-fp8", NULL, "amx-tf32", "amx-avx512",
             "amx-movrs", NULL, NULL, NULL,
             NULL, NULL, NULL, NULL,
-- 
2.53.0

[PULL 04/14] i386/cpu: Remove unnecessary cache_info fields from builtin CPU model

[Paolo Bonzini]

From: Zhao Liu <zhao1.liu@intel.com>

In x86_cpu_get_versioned_cache_info(), higher version CPU models will
inherit cache_info from lower versions if the cache_info field is not
specified, so there is no need to repeatedly set the same cache_info.

Therefore, remove the repeated cache models from SapphireRapids-v6
(SapphireRapids-v4 has set the cache model), GraniteRapids-v5
(GraniteRapids-v3 has set) and SierraForest-v5 (SierraForest-v3 has
set).

Signed-off-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20260310140819.1563084-4-zhao1.liu@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/cpu.c | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 08450a9142e..05121c5b324 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -5264,7 +5264,6 @@ static const X86CPUDefinition builtin_x86_defs[] = {
             {
                 .version = 6,
                 .note = "with cet-ss, cet-ibt, its-no",
-                .cache_info = &xeon_spr_cache_info,
                 .props = (PropValue[]) {
                     { "its-no", "on" },
                     { /* end of list */ },
@@ -5446,7 +5445,6 @@ static const X86CPUDefinition builtin_x86_defs[] = {
             {
                 .version = 5,
                 .note = "with cet-ss, cet-ibt, its-no",
-                .cache_info = &xeon_gnr_cache_info,
                 .props = (PropValue[]) {
                     { "its-no", "on" },
                     { /* end of list */ },
@@ -5812,7 +5810,6 @@ static const X86CPUDefinition builtin_x86_defs[] = {
             {
                 .version = 5,
                 .note = "with ITS_NO",
-                .cache_info = &xeon_srf_cache_info,
                 .props = (PropValue[]) {
                     { "its-no", "on" },
                     { /* end of list */ },
-- 
2.53.0

[PULL 05/14] i386/cpu: Adjust the note for CPU models with its-no

[Paolo Bonzini]

From: Zhao Liu <zhao1.liu@intel.com>

For new versioned CPU models with its-no enabled, since CET was already
enabled in previous versions, remove the related description from the
notes of its-no related CPU models.

Signed-off-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20260310140819.1563084-5-zhao1.liu@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/cpu.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 05121c5b324..cd44a624201 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -5263,7 +5263,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
             },
             {
                 .version = 6,
-                .note = "with cet-ss, cet-ibt, its-no",
+                .note = "with its-no",
                 .props = (PropValue[]) {
                     { "its-no", "on" },
                     { /* end of list */ },
@@ -5444,7 +5444,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
             },
             {
                 .version = 5,
-                .note = "with cet-ss, cet-ibt, its-no",
+                .note = "with its-no",
                 .props = (PropValue[]) {
                     { "its-no", "on" },
                     { /* end of list */ },
@@ -5809,7 +5809,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
             },
             {
                 .version = 5,
-                .note = "with ITS_NO",
+                .note = "with its-no",
                 .props = (PropValue[]) {
                     { "its-no", "on" },
                     { /* end of list */ },
@@ -5963,7 +5963,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
             },
             {
                 .version = 3,
-                .note = "with cet-ss, cet-ibt, ITS_NO",
+                .note = "with its-no",
                 .props = (PropValue[]) {
                     { "its-no", "on" },
                     { /* end of list */ },
-- 
2.53.0

[PULL 06/14] i386/cpu: Enable CPUID 0x1f & cache model for ClearwaterForest

[Paolo Bonzini]

From: Zhao Liu <zhao1.liu@intel.com>

ClearwaterForest has CPUID 0x1f by default, so force enabling this leaf
for it (ClearwaterForect-v3).

And add the cache model to ClearwaterForest (v3) to better emulate its
environment.

The cache model is based on ClearwaterForest-AP (Advanced Performance):

      --- cache 0 ---
      cache type                         = data cache (1)
      cache level                        = 0x1 (1)
      self-initializing cache level      = true
      fully associative cache            = false
      maximum IDs for CPUs sharing cache = 0x0 (0)
      maximum IDs for cores in pkg       = 0x3f (63)
      system coherency line size         = 0x40 (64)
      physical line partitions           = 0x1 (1)
      ways of associativity              = 0x8 (8)
      number of sets                     = 0x40 (64)
      WBINVD/INVD acts on lower caches   = false
      inclusive to lower caches          = false
      complex cache indexing             = false
      number of sets (s)                 = 64
      (size synth)                       = 32768 (32 KB)
      --- cache 1 ---
      cache type                         = instruction cache (2)
      cache level                        = 0x1 (1)
      self-initializing cache level      = true
      fully associative cache            = false
      maximum IDs for CPUs sharing cache = 0x0 (0)
      maximum IDs for cores in pkg       = 0x3f (63)
      system coherency line size         = 0x40 (64)
      physical line partitions           = 0x1 (1)
      ways of associativity              = 0x8 (8)
      number of sets                     = 0x80 (128)
      WBINVD/INVD acts on lower caches   = false
      inclusive to lower caches          = false
      complex cache indexing             = false
      number of sets (s)                 = 128
      (size synth)                       = 65536 (64 KB)
      --- cache 2 ---
      cache type                         = unified cache (3)
      cache level                        = 0x2 (2)
      self-initializing cache level      = true
      fully associative cache            = false
      maximum IDs for CPUs sharing cache = 0x7 (7)
      maximum IDs for cores in pkg       = 0x3f (63)
      system coherency line size         = 0x40 (64)
      physical line partitions           = 0x1 (1)
      ways of associativity              = 0x10 (16)
      number of sets                     = 0x1000 (4096)
      WBINVD/INVD acts on lower caches   = false
      inclusive to lower caches          = false
      complex cache indexing             = false
      number of sets (s)                 = 4096
      (size synth)                       = 4194304 (4 MB)
      --- cache 3 ---
      cache type                         = unified cache (3)
      cache level                        = 0x3 (3)
      self-initializing cache level      = true
      fully associative cache            = false
      maximum IDs for CPUs sharing cache = 0x3ff (1023)
      maximum IDs for cores in pkg       = 0x3f (63)
      system coherency line size         = 0x40 (64)
      physical line partitions           = 0x1 (1)
      ways of associativity              = 0x10 (16)
      number of sets                     = 0x84000 (540672)
      WBINVD/INVD acts on lower caches   = false
      inclusive to lower caches          = false
      complex cache indexing             = true
      number of sets (s)                 = 540672
      (size synth)                       = 553648128 (528 MB)
      --- cache 4 ---
      cache type                         = no more caches (0)

Suggested-by: Zhijun Zeng <zhijun.zeng@intel.com>
Suggested-by: Chao Peng <chao.p.peng@intel.com>
Signed-off-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20260310140819.1563084-6-zhao1.liu@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/cpu.c | 95 ++++++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 94 insertions(+), 1 deletion(-)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index cd44a624201..1debc0c61fc 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -3318,6 +3318,97 @@ static const CPUCaches xeon_srf_cache_info = {
     },
 };
 
+static const CPUCaches xeon_cwf_cache_info = {
+    .l1d_cache = &(CPUCacheInfo) {
+        /* CPUID 0x4.0x0.EAX */
+        .type = DATA_CACHE,
+        .level = 1,
+        .self_init = true,
+
+        /* CPUID 0x4.0x0.EBX */
+        .line_size = 64,
+        .partitions = 1,
+        .associativity = 8,
+
+        /* CPUID 0x4.0x0.ECX */
+        .sets = 64,
+
+        /* CPUID 0x4.0x0.EDX */
+        .no_invd_sharing = false,
+        .inclusive = false,
+        .complex_indexing = false,
+
+        .size = 32 * KiB,
+        .share_level = CPU_TOPOLOGY_LEVEL_CORE,
+    },
+    .l1i_cache = &(CPUCacheInfo) {
+        /* CPUID 0x4.0x1.EAX */
+        .type = INSTRUCTION_CACHE,
+        .level = 1,
+        .self_init = true,
+
+        /* CPUID 0x4.0x1.EBX */
+        .line_size = 64,
+        .partitions = 1,
+        .associativity = 8,
+
+        /* CPUID 0x4.0x1.ECX */
+        .sets = 128,
+
+        /* CPUID 0x4.0x1.EDX */
+        .no_invd_sharing = false,
+        .inclusive = false,
+        .complex_indexing = false,
+
+        .size = 64 * KiB,
+        .share_level = CPU_TOPOLOGY_LEVEL_CORE,
+    },
+    .l2_cache = &(CPUCacheInfo) {
+        /* CPUID 0x4.0x2.EAX */
+        .type = UNIFIED_CACHE,
+        .level = 2,
+        .self_init = true,
+
+        /* CPUID 0x4.0x2.EBX */
+        .line_size = 64,
+        .partitions = 1,
+        .associativity = 16,
+
+        /* CPUID 0x4.0x2.ECX */
+        .sets = 4096,
+
+        /* CPUID 0x4.0x2.EDX */
+        .no_invd_sharing = false,
+        .inclusive = false,
+        .complex_indexing = false,
+
+        .size = 4 * MiB,
+        .share_level = CPU_TOPOLOGY_LEVEL_MODULE,
+    },
+    .l3_cache = &(CPUCacheInfo) {
+        /* CPUID 0x4.0x3.EAX */
+        .type = UNIFIED_CACHE,
+        .level = 3,
+        .self_init = true,
+
+        /* CPUID 0x4.0x3.EBX */
+        .line_size = 64,
+        .partitions = 1,
+        .associativity = 16,
+
+        /* CPUID 0x4.0x3.ECX */
+        .sets = 540672,
+
+        /* CPUID 0x4.0x3.EDX */
+        .no_invd_sharing = false,
+        .inclusive = false,
+        .complex_indexing = true,
+
+        .size = 528 * MiB,
+        .share_level = CPU_TOPOLOGY_LEVEL_SOCKET,
+    },
+};
+
 static const CPUCaches yongfeng_cache_info = {
     .l1d_cache = &(CPUCacheInfo) {
         /* CPUID 0x4.0x0.EAX */
@@ -5963,9 +6054,11 @@ static const X86CPUDefinition builtin_x86_defs[] = {
             },
             {
                 .version = 3,
-                .note = "with its-no",
+                .note = "with its-no, cwf-ap cache model and 0x1f leaf",
+                .cache_info = &xeon_cwf_cache_info,
                 .props = (PropValue[]) {
                     { "its-no", "on" },
+                    { "x-force-cpuid-0x1f", "on" },
                     { /* end of list */ },
                 }
             },
-- 
2.53.0

[PULL 07/14] coverity: fix coverity issues related to confidential guest reset

[Paolo Bonzini]

From: Ani Sinha <anisinha@redhat.com>

Fix issues reported by Peter.

Fixes: ec9bafd2ea9d12c ("i386/sev: add support for confidential guest reset")
Fixes: e76c30bb13ecb9d ("hw/machine: introduce machine specific option 'x-change-vmfd-on-reset'")
Reported-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Signed-off-by: Ani Sinha <anisinha@redhat.com>
Link: https://lore.kernel.org/r/20260311074048.61367-1-anisinha@redhat.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 system/runstate.c | 10 +++++-----
 target/i386/sev.c |  4 ----
 2 files changed, 5 insertions(+), 9 deletions(-)

diff --git a/system/runstate.c b/system/runstate.c
index eca722b43c6..77cb14ae028 100644
--- a/system/runstate.c
+++ b/system/runstate.c
@@ -508,13 +508,13 @@ static int qemu_debug_requested(void)
  */
 void qemu_system_reset(ShutdownCause reason)
 {
-    MachineClass *mc;
-    ResetType type;
+    MachineClass *mc = current_machine ? MACHINE_GET_CLASS(current_machine) : NULL;
     AccelClass *ac = ACCEL_GET_CLASS(current_accel());
+    bool force_vmfd_change =
+        current_machine ? current_machine->new_accel_vmfd_on_reset : false;
     bool guest_state_rebuilt = false;
     int ret;
-
-    mc = current_machine ? MACHINE_GET_CLASS(current_machine) : NULL;
+    ResetType type;
 
     cpu_synchronize_all_states();
 
@@ -528,7 +528,7 @@ void qemu_system_reset(ShutdownCause reason)
 
     if ((reason == SHUTDOWN_CAUSE_GUEST_RESET ||
          reason == SHUTDOWN_CAUSE_HOST_QMP_SYSTEM_RESET) &&
-        (current_machine->new_accel_vmfd_on_reset || !cpus_are_resettable())) {
+        (force_vmfd_change || !cpus_are_resettable())) {
         if (ac->rebuild_guest) {
             ret = ac->rebuild_guest(current_machine);
             if (ret < 0) {
diff --git a/target/i386/sev.c b/target/i386/sev.c
index cddffe0da8d..9dde972c118 100644
--- a/target/i386/sev.c
+++ b/target/i386/sev.c
@@ -2011,10 +2011,6 @@ static void sev_handle_reset(Object *obj, ResetType type)
     SevCommonState *sev_common = SEV_COMMON(MACHINE(qdev_get_machine())->cgs);
     SevCommonStateClass *klass = SEV_COMMON_GET_CLASS(sev_common);
 
-    if (!sev_common) {
-        return;
-    }
-
     if (!runstate_is_running()) {
         return;
     }
-- 
2.53.0

[PULL 08/14] accel/kvm: fix typo in variable name

[Paolo Bonzini]

From: Alyssa Ross <hi@alyssa.is>

Fixes: 94a8d39afd ("kvm: Consolidate must-have capability checks")
Signed-off-by: Alyssa Ross <hi@alyssa.is>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Link: https://lore.kernel.org/r/20260311095315.25013-1-hi@alyssa.is
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 accel/kvm/kvm-all.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
index 984db977795..774499d34f8 100644
--- a/accel/kvm/kvm-all.c
+++ b/accel/kvm/kvm-all.c
@@ -111,7 +111,7 @@ static uint64_t kvm_supported_memory_attributes;
 static bool kvm_guest_memfd_supported;
 static hwaddr kvm_max_slot_size = ~0;
 
-static const KVMCapabilityInfo kvm_required_capabilites[] = {
+static const KVMCapabilityInfo kvm_required_capabilities[] = {
     KVM_CAP_INFO(USER_MEMORY),
     KVM_CAP_INFO(DESTROY_MEMORY_REGION_WORKS),
     KVM_CAP_INFO(JOIN_MEMORY_REGIONS_WORKS),
@@ -2992,7 +2992,7 @@ static int kvm_init(AccelState *as, MachineState *ms)
         nc++;
     }
 
-    missing_cap = kvm_check_extension_list(s, kvm_required_capabilites);
+    missing_cap = kvm_check_extension_list(s, kvm_required_capabilities);
     if (!missing_cap) {
         missing_cap =
             kvm_check_extension_list(s, kvm_arch_required_capabilities);
-- 
2.53.0

[PULL 09/14] docs: remove 64-bit only mentions for accelerators

[Paolo Bonzini]

From: Mohamed Mediouni <mohamed@unpredictable.fr>

QEMU itself no longer supports 32-bit systems.

Signed-off-by: Mohamed Mediouni <mohamed@unpredictable.fr>
Link: https://lore.kernel.org/r/20260311102626.46546-2-mohamed@unpredictable.fr
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 docs/about/build-platforms.rst | 4 ++--
 docs/system/introduction.rst   | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/docs/about/build-platforms.rst b/docs/about/build-platforms.rst
index e95784cdb55..ae138ff0e02 100644
--- a/docs/about/build-platforms.rst
+++ b/docs/about/build-platforms.rst
@@ -43,7 +43,7 @@ Those hosts are officially supported, with various accelerators:
    * - CPU Architecture
      - Accelerators
    * - Arm
-     - hvf (64 bit only), kvm (64 bit only), tcg, xen
+     - hvf, kvm, tcg, xen
    * - PPC
      - kvm, tcg
    * - RISC-V
@@ -53,7 +53,7 @@ Those hosts are officially supported, with various accelerators:
    * - SPARC
      - tcg
    * - x86
-     - hvf (64 bit only), mshv (64 bit only), kvm, nvmm, tcg, whpx (64 bit only), xen
+     - hvf, mshv, kvm, nvmm, tcg, whpx, xen
 
 Other host architectures are not supported. It is possible to build QEMU system
 emulation on an unsupported host architecture using the configure
diff --git a/docs/system/introduction.rst b/docs/system/introduction.rst
index 9c57523b6c2..2dfa371e0f9 100644
--- a/docs/system/introduction.rst
+++ b/docs/system/introduction.rst
@@ -19,7 +19,7 @@ Tiny Code Generator (TCG) capable of emulating many CPUs.
     - Host Architectures
   * - KVM
     - Linux
-    - Arm (64 bit only), MIPS, PPC, RISC-V, s390x, x86
+    - Arm, MIPS, PPC, RISC-V, s390x, x86
   * - Xen
     - Linux (as dom0)
     - Arm, x86
@@ -28,7 +28,7 @@ Tiny Code Generator (TCG) capable of emulating many CPUs.
     - x86
   * - Hypervisor Framework (hvf)
     - MacOS
-    - x86 (64 bit only), Arm (64 bit only)
+    - x86, Arm
   * - Windows Hypervisor Platform (whpx)
     - Windows
     - x86
-- 
2.53.0

[PULL 10/14] qemu-options.hx: document Hyper-V enlightenments accelerator option

[Paolo Bonzini]

From: Mohamed Mediouni <mohamed@unpredictable.fr>

This option is WHPX-specific and controls whether Hyper-V enlightenments are enabled.

Signed-off-by: Mohamed Mediouni <mohamed@unpredictable.fr>
Link: https://lore.kernel.org/r/20260311102626.46546-3-mohamed@unpredictable.fr
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 qemu-options.hx | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/qemu-options.hx b/qemu-options.hx
index 890c4f1d230..69e5a874c1a 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -325,6 +325,11 @@ SRST
         option can be used to pass the KVM device to use via a file descriptor
         by setting the value to ``/dev/fdset/NN``.
 
+    ``hyperv=on|off|auto``
+        For the WHPX backend, determines whether to enable Hyper-V enlightenments.
+        On x86_64, Hyper-V enlightenments are on by default. On AArch64, they're off
+        by default.
+
 ERST
 
 DEF("smp", HAS_ARG, QEMU_OPTION_smp,
-- 
2.53.0

[PULL 11/14] docs: mention that WHPX supports Arm too

[Paolo Bonzini]

From: Mohamed Mediouni <mohamed@unpredictable.fr>

Signed-off-by: Mohamed Mediouni <mohamed@unpredictable.fr>
Link: https://lore.kernel.org/r/20260311102626.46546-4-mohamed@unpredictable.fr
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 docs/about/build-platforms.rst | 2 +-
 docs/system/introduction.rst   | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/docs/about/build-platforms.rst b/docs/about/build-platforms.rst
index ae138ff0e02..6e3088d524a 100644
--- a/docs/about/build-platforms.rst
+++ b/docs/about/build-platforms.rst
@@ -43,7 +43,7 @@ Those hosts are officially supported, with various accelerators:
    * - CPU Architecture
      - Accelerators
    * - Arm
-     - hvf, kvm, tcg, xen
+     - hvf, kvm, tcg, whpx, xen
    * - PPC
      - kvm, tcg
    * - RISC-V
diff --git a/docs/system/introduction.rst b/docs/system/introduction.rst
index 2dfa371e0f9..be387a66458 100644
--- a/docs/system/introduction.rst
+++ b/docs/system/introduction.rst
@@ -31,7 +31,7 @@ Tiny Code Generator (TCG) capable of emulating many CPUs.
     - x86, Arm
   * - Windows Hypervisor Platform (whpx)
     - Windows
-    - x86
+    - Arm, x86
   * - NetBSD Virtual Machine Monitor (nvmm)
     - NetBSD
     - x86
-- 
2.53.0

[PULL 12/14] target/i386: add compat for migrating error code

[Paolo Bonzini]

From: Fiona Ebner <f.ebner@proxmox.com>

If cpu->env.has_error_code is true, backwards migration of a VM from
a QEMU binary with commit 27535e9cca to a QEMU binary without commit
27535e9cca will fail:

> kvm: error while loading state for instance 0x0 of device 'cpu'

In practice, wrongly setting the error code to 0 on the target is
often unproblematic, so additionally checking error_code != 0 in
cpu_errcode_needed() is not enough to mitigate the issue. Instead, add
proper machine version compat handling.

Cc: qemu-stable@nongnu.org
Fixes: 27535e9cca ("target/i386: Add support for save/load of exception error code")
Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20260310154348.495332-1-f.ebner@proxmox.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/cpu.h     | 1 +
 hw/i386/pc.c          | 1 +
 target/i386/cpu.c     | 1 +
 target/i386/machine.c | 2 +-
 4 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/target/i386/cpu.h b/target/i386/cpu.h
index 7bd38f0c039..0b539155c40 100644
--- a/target/i386/cpu.h
+++ b/target/i386/cpu.h
@@ -2361,6 +2361,7 @@ struct ArchCPU {
     bool expose_tcg;
     bool migratable;
     bool migrate_smi_count;
+    bool migrate_error_code;
     uint32_t apic_id;
 
     /* Enables publishing of TSC increment and Local APIC bus frequencies to
diff --git a/hw/i386/pc.c b/hw/i386/pc.c
index addf602da08..4b53b5be4a9 100644
--- a/hw/i386/pc.c
+++ b/hw/i386/pc.c
@@ -78,6 +78,7 @@ const size_t pc_compat_10_2_len = G_N_ELEMENTS(pc_compat_10_2);
 
 GlobalProperty pc_compat_10_1[] = {
     { "mch", "extended-tseg-mbytes", "16" },
+    { TYPE_X86_CPU, "x-migrate-error-code", "false" },
 };
 const size_t pc_compat_10_1_len = G_N_ELEMENTS(pc_compat_10_1);
 
diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 1debc0c61fc..5b9ae79f165 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -10651,6 +10651,7 @@ static const Property x86_cpu_properties[] = {
     DEFINE_PROP_BOOL("tcg-cpuid", X86CPU, expose_tcg, true),
     DEFINE_PROP_BOOL("x-migrate-smi-count", X86CPU, migrate_smi_count,
                      true),
+    DEFINE_PROP_BOOL("x-migrate-error-code", X86CPU, migrate_error_code, true),
     /*
      * lecacy_cache defaults to true unless the CPU model provides its
      * own cache information (see x86_cpu_load_def()).
diff --git a/target/i386/machine.c b/target/i386/machine.c
index c9139612813..48a2a4b3190 100644
--- a/target/i386/machine.c
+++ b/target/i386/machine.c
@@ -466,7 +466,7 @@ static bool cpu_errcode_needed(void *opaque)
 {
     X86CPU *cpu = opaque;
 
-    return cpu->env.has_error_code != 0;
+    return cpu->env.has_error_code != 0 && cpu->migrate_error_code;
 }
 
 static const VMStateDescription vmstate_error_code = {
-- 
2.53.0

[PULL 13/14] rust: Update Cargo.lock

[Paolo Bonzini]

From: Philippe Mathieu-Daudé <philmd@linaro.org>

Update Cargo.lock on top of commit  7ecd3f71079 ("Merge tag
'for-upstream' of https://gitlab.com/bonzini/qemu into staging").

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Link: https://lore.kernel.org/r/20260309172440.66409-1-philmd@linaro.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 rust/Cargo.lock | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/rust/Cargo.lock b/rust/Cargo.lock
index 801ac5f4f51..cbb3ca15f77 100644
--- a/rust/Cargo.lock
+++ b/rust/Cargo.lock
@@ -172,7 +172,6 @@ dependencies = [
  "migration",
  "qemu_macros",
  "qom",
- "system",
  "util",
 ]
 
@@ -351,7 +350,6 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0dca6411025b24b60bfa7ec1fe1f8e710ac09782dca409ee8237ba74b51295fd"
 dependencies = [
  "serde_core",
- "serde_derive",
 ]
 
 [[package]]
@@ -407,6 +405,7 @@ dependencies = [
  "bql",
  "common",
  "glib-sys",
+ "hwcore",
  "migration",
  "qom",
  "system-sys",
-- 
2.53.0

[PULL 14/14] typedefs: move QIgvm out of typedefs.h

[Paolo Bonzini]

Typedefs.h should only be used for really core types; QIgvm is
just an opaque struct that is defined in system/igvm-internal.h,
and the typedef itself can be placed simply in system/igvm.h.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 include/qemu/typedefs.h | 1 -
 include/system/igvm.h   | 3 ++-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/include/qemu/typedefs.h b/include/qemu/typedefs.h
index cbe6f7f4c7c..416a8c9acea 100644
--- a/include/qemu/typedefs.h
+++ b/include/qemu/typedefs.h
@@ -102,7 +102,6 @@ typedef struct QEMUSGList QEMUSGList;
 typedef struct QemuSpin QemuSpin;
 typedef struct QEMUTimer QEMUTimer;
 typedef struct QEMUTimerListGroup QEMUTimerListGroup;
-typedef struct QIgvm QIgvm;
 typedef struct QList QList;
 typedef struct QNull QNull;
 typedef struct QNum QNum;
diff --git a/include/system/igvm.h b/include/system/igvm.h
index f9231f03ec8..64d3542311a 100644
--- a/include/system/igvm.h
+++ b/include/system/igvm.h
@@ -13,10 +13,11 @@
 #define BACKENDS_IGVM_H
 
 #include "hw/core/boards.h"
-#include "qemu/typedefs.h"
 #include "system/confidential-guest-support.h"
 #include "qapi/error.h"
 
+typedef struct QIgvm QIgvm;
+
 int qigvm_process_file(IgvmCfg *igvm, MachineState *machine_state,
                        bool onlyVpContext, Error **errp);
 
-- 
2.53.0

Re: [PULL 00/14] Misc patches for QEMU 11.0 hard freeze

[Peter Maydell]

On Thu, 12 Mar 2026 at 11:05, Paolo Bonzini <pbonzini@redhat.com> wrote:
>
> The following changes since commit 1fd5ff9d76d23ab23a68419cbc76d5ee33e8b455:
>
>   Merge tag 'for-upstream' of https://gitlab.com/kmwolf/qemu into staging (2026-03-10 16:29:24 +0000)
>
> are available in the Git repository at:
>
>   https://gitlab.com/bonzini/qemu.git tags/for-upstream
>
> for you to fetch changes up to c725a896c6b92f733e0eeb236167cbd9b33efda8:
>
>   typedefs: move QIgvm out of typedefs.h (2026-03-12 12:02:55 +0100)
>
> ----------------------------------------------------------------
> * accel/kvm: fix typo in variable name
> * system: fix coverity issues related to confidential guest reset
> * target/i386: add compat for migrating error code
> * docs fixes
> * hyperv/syndbg: check length returned by cpu_physical_memory_map()
> * typedefs: move QIgvm out of typedefs.h
> * rust: Update Cargo.lock
> * i386/cpu: cleanups for ClearwaterForest, AMX and more
>




Applied, thanks.

Please update the changelog at https://wiki.qemu.org/ChangeLog/11.0
for any user-visible changes.

-- PMM