qemu/qemu.git/backends, branch master

build-sys: make HMP source files conditional on have_hmp

2026-08-29T08:07:45+00:00

Exclude all *-hmp-cmds.c files and HMP-only source files from the build when HMP is disabled. Also conditionalise the hmp-commands.hx header generation and the test-hmp qtest. Acked-by: Dr. David Alan Gilbert Reviewed-by: Philippe Mathieu-Daudé Signed-off-by: Marc-André Lureau Message-ID: <20260828-qemu-no-hmp-v5-45-9227de146347@redhat.com>

monitor: tighten monitor_printf*()

2026-08-29T08:07:45+00:00

Rename monitor_printf->monitor_hmp_printf, monitor_vprintf-> monitor_hmp_vprintf, and monitor_printc->monitor_hmp_printc, changing the first parameter from Monitor * to MonitorHMP * to enforce type safety. The implementation is also simplified: monitor_hmp_vprintf now directly calls g_strdup_vprintf + monitor_puts, removing the virtual dispatch via moncls->vprintf. The dev_print() callbacks are temporarily using the MONITOR_HMP(mon) cast, they are fixed in the following commits. Early return in qemu_vprintf() if "hmp" is NULL, relying on monitor_hmp_vprintf() handling NULL case is a bit uncommon. Reviewed-by: Philippe Mathieu-Daudé Signed-off-by: Marc-André Lureau Message-ID: <20260828-qemu-no-hmp-v5-37-9227de146347@redhat.com>

monitor: change HMPCommand cmd to take MonitorHMP

2026-08-29T08:07:44+00:00

HMP commands are specific to the HMP monitor, so make the cmd function pointer in HMPCommand take MonitorHMP * instead of Monitor *. This strengthens type safety and makes the HMP-specific nature of these handlers explicit. Handler functions are renamed to take MonitorHMP *hmp, with a local Monitor *mon = MONITOR(hmp) added where the body needs the base type. Following patches will drop it, since most functions are HMP specific. Reviewed-by: Daniel P. Berrangé Reviewed-by: Jason J. Herne Reviewed-by: Dr. David Alan Gilbert Signed-off-by: Marc-André Lureau Message-ID: <20260828-qemu-no-hmp-v5-31-9227de146347@redhat.com>

char-fe: implement qemu_chr_fe_backend_name

2026-08-28T10:40:02+00:00

A number of chardev users where calling qemu_chr_fe_get_driver() which is discouraged as it blocks backend hotswap. As the pattern is common and need for the string is transitory add a helper and keep qemu_chr_fe_get_driver() for those that really need the funkiness of poking around the backend setup. Suggested-by: Peter Maydell Reviewed-by: Marc-André Lureau Message-ID: <20260824-fixes-for-11-2-v2-4-352c6b890402@linaro.org> Signed-off-by: Alex Bennée

backends/igvm: add a tracepoint for qigvm_cleanup_memory

2026-08-20T14:40:33+00:00

Useful for debugging memory region cleanups. Signed-off-by: Ani Sinha Message-ID: <20260817142010.80693-6-anisinha@redhat.com> Signed-off-by: Gerd Hoffmann

igvm: cleanup memory regions

2026-08-20T14:40:33+00:00

This change cleans up existing memory regions that were created by the current IGVM. The cleanup would be necessary when a new IGVM is loaded. This cleanup function is called in a subsequent patch. Reviewed-by: Alexander Graf Tested-by: Ani Sinha Signed-off-by: Gerd Hoffmann Message-ID: <20260817142010.80693-4-anisinha@redhat.com> Signed-off-by: Gerd Hoffmann

igvm: track memory regions

2026-08-20T14:40:33+00:00

Memory regions added by the current IGVM needs to be tracked so that they can be freed when a new IGVM is loaded. Reviewed-by: Ani Sinha Reviewed-by: Alexander Graf Signed-off-by: Gerd Hoffmann Message-ID: <20260817142010.80693-3-anisinha@redhat.com> Signed-off-by: Gerd Hoffmann

igvm: store IgvmCfg pointer in QIgvm

2026-08-20T14:40:33+00:00

Store a pointer to IgvmCfg instead of only IgvmFile in QIgvm. Allows to store additional state in the (persistent) IgvmCfg struct. Reviewed-by: Ani Sinha Reviewed-by: Alexander Graf Signed-off-by: Gerd Hoffmann Message-ID: <20260817142010.80693-2-anisinha@redhat.com> Signed-off-by: Gerd Hoffmann

backends/rng: cap request size to avoid oversized allocation

2026-07-27T19:14:13+00:00

rng_backend_request_entropy() uses the requested size to allocate a buffer with g_malloc(). With virtio-rng, this size comes from guest-supplied descriptor lengths. A malicious guest can set a very large descriptor length, causing QEMU to attempt a multi-gigabyte allocation and abort. Cap the allocation to 64 KiB. The virtio-rng queue size is hardcoded to 8 entries, the EGD backend protocol limits requests to 255 bytes, the Linux kernel hwrng framework requests at most SMP_CACHE_BYTES per call (64 bytes on x86_64), and the Windows viorng driver uses a 4 KiB buffer. The worst legitimate case is 8 x 4 KiB = 32 KiB, so 64 KiB is well above any legitimate use. Fixes: 14417039653d ("virtio-rng: use virtqueue_get_avail_bytes, fix migration") Cc: qemu-stable@nongnu.org Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3983 Reported-by: dong ling Signed-off-by: Laurent Vivier Reviewed-by: Thomas Huth Reviewed-by: Michael S. Tsirkin Signed-off-by: Michael S. Tsirkin Message-ID: <20260715141300.2295392-1-lvivier@redhat.com>

hw/virtio-rng: Fix host use-after-free (CVE-2026-50624)

2026-07-27T19:14:13+00:00

Fix a heap-use-after-free in the virtio-rng frontend when a delayed rng-random backend completion arrives after the virtio-rng device has been hot-unplugged. Fixes: CVE-2026-50624 Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3917 Reported-by: Jia Jia Reviewed-by: Philippe Mathieu-Daudé Signed-off-by: Laurent Vivier Reviewed-by: Michael S. Tsirkin Signed-off-by: Michael S. Tsirkin Message-ID: <20260724094931.3005968-1-lvivier@redhat.com>