* Optional use of Meson wrap for slirp

* Coverity fixes * Avoid -Werror=maybe-uninitialized * Mark coroutine QMP command functions as coroutine_fn * Mark functions that suspend as coroutine_mixed_fn * target/i386: Fix SGX CPUID leaf * First batch of qatomic_mb_read() removal * Small atomic.rst improvement * NBD cleanup * Update libvirt-ci submodule -----BEGIN PGP SIGNATURE----- iQFIBAABCAAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAmRBAzwUHHBib256aW5p QHJlZGhhdC5jb20ACgkQv/vSX3jHroP64gf+NzLW95tylCfhKuuLq/TjuOTQqHCD KVLlA1I3pwJfk4SUuigrnaJtwfa/tBiWxfaivUdPAzPzeXyxcVSOps0neohrmFBh 2e3ylBWWz22K0gkLtrFwJT99TVy6w6Xhj9SX8HPRfxl4k8yMPrUJNW78hh6APAwq /etZY6+ieHC7cwG4xluhxsHnxnBYBYD+18hUd+b5LchD/yvCSCNNiursutpa0Ar/ r/HtDwNFKlaApO3sU4R3yYgdS1Fvcas4tDZaumADsQlSG5z+UeJldc98LiRlFrAA gnskBSaaly/NgWqY3hVCYaBGyjD4lWPkX/FEChi0XX6Fl1P0umQAv/7z3w== =XSAs -----END PGP SIGNATURE----- Merge tag 'for-upstream' of https://gitlab.com/bonzini/qemu into staging * Optional use of Meson wrap for slirp * Coverity fixes * Avoid -Werror=maybe-uninitialized * Mark coroutine QMP command functions as coroutine_fn * Mark functions that suspend as coroutine_mixed_fn * target/i386: Fix SGX CPUID leaf * First batch of qatomic_mb_read() removal * Small atomic.rst improvement * NBD cleanup * Update libvirt-ci submodule # -----BEGIN PGP SIGNATURE----- # # iQFIBAABCAAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAmRBAzwUHHBib256aW5p # QHJlZGhhdC5jb20ACgkQv/vSX3jHroP64gf+NzLW95tylCfhKuuLq/TjuOTQqHCD # KVLlA1I3pwJfk4SUuigrnaJtwfa/tBiWxfaivUdPAzPzeXyxcVSOps0neohrmFBh # 2e3ylBWWz22K0gkLtrFwJT99TVy6w6Xhj9SX8HPRfxl4k8yMPrUJNW78hh6APAwq # /etZY6+ieHC7cwG4xluhxsHnxnBYBYD+18hUd+b5LchD/yvCSCNNiursutpa0Ar/ # r/HtDwNFKlaApO3sU4R3yYgdS1Fvcas4tDZaumADsQlSG5z+UeJldc98LiRlFrAA # gnskBSaaly/NgWqY3hVCYaBGyjD4lWPkX/FEChi0XX6Fl1P0umQAv/7z3w== # =XSAs # -----END PGP SIGNATURE----- # gpg: Signature made Thu 20 Apr 2023 10:17:48 AM BST # gpg: using RSA key F13338574B662389866C7682BFFBD25F78C7AE83 # gpg: issuer "pbonzini@redhat.com" # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" [undefined] # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" [undefined] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * tag 'for-upstream' of https://gitlab.com/bonzini/qemu: (25 commits) tests: lcitool: Switch to OpenSUSE Leap 15.4 tests: libvirt-ci: Update to commit '2fa24dce8bc' configure: Honour cross-prefix when finding ObjC compiler coverity: unify Fedora dockerfiles nbd: a BlockExport always has a BlockBackend docs: explain effect of smp_read_barrier_depends() on modern architectures qemu-coroutine: remove qatomic_mb_read() postcopy-ram: do not use qatomic_mb_read block-backend: remove qatomic_mb_read() target/i386: Change wrong XFRM value in SGX CPUID leaf monitor: mark mixed functions that can suspend migration: mark mixed functions that can suspend io: mark mixed functions that can suspend qapi-gen: mark coroutine QMP command functions as coroutine_fn target/mips: tcg: detect out-of-bounds accesses to cpu_gpr and cpu_gpr_hi coverity: update COMPONENTS.md lasi: fix RTC migration target/i386: Avoid unreachable variable declaration in mmu_translate() configure: Avoid -Werror=maybe-uninitialized tests: bios-tables-test: replace memset with initializer ... Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2024-12-01 07:43:35 +08:00 · 2023-04-22 06:10:51 +01:00 · 2023-04-22 06:10:51 +01:00 · 1cc6e1a201
commit 1cc6e1a201
parent 45608654aa 5f9efbbcf6
45 changed files with 425 additions and 396 deletions
--- a/.gitignore
+++ b/.gitignore
@ -20,3 +20,5 @@ GTAGS
 *.swp
 *.patch
 *.gcov
+
+/subprojects/slirp
--- a/block/block-backend.c
+++ b/block/block-backend.c
@ -1845,7 +1845,7 @@ void blk_drain(BlockBackend *blk)

    /* We may have -ENOMEDIUM completions in flight */
    AIO_WAIT_WHILE(blk_get_aio_context(blk),
-                   qatomic_mb_read(&blk->in_flight) > 0);
+                   qatomic_read(&blk->in_flight) > 0);

    if (bs) {
        bdrv_drained_end(bs);
@ -1867,7 +1867,7 @@ void blk_drain_all(void)
        aio_context_acquire(ctx);

        /* We may have -ENOMEDIUM completions in flight */
-        AIO_WAIT_WHILE(ctx, qatomic_mb_read(&blk->in_flight) > 0);
+        AIO_WAIT_WHILE(ctx, qatomic_read(&blk->in_flight) > 0);

        aio_context_release(ctx);
    }
--- a/40
+++ b/40
@ -316,6 +316,8 @@ for opt do
  ;;
  --cxx=*) CXX="$optarg"
  ;;
+  --objcc=*) objcc="$optarg"
+  ;;
  --cpu=*) cpu="$optarg"
  ;;
  --extra-cflags=*)
@ -361,6 +363,21 @@ else
  cxx="${CXX-${cross_prefix}g++}"
 fi

+# Preferred ObjC compiler:
+# $objcc (if set, i.e. via --objcc option)
+# ${cross_prefix}clang (if cross-prefix specified)
+# clang (if available)
+# $cc
+if test -z "${objcc}${cross_prefix}"; then
+  if has clang; then
+    objcc=clang
+  else
+    objcc="$cc"
+  fi
+else
+  objcc="${objcc-${cross_prefix}clang}"
+fi
+
 ar="${AR-${cross_prefix}ar}"
 as="${AS-${cross_prefix}as}"
 ccas="${CCAS-$cc}"
@ -647,13 +664,6 @@ do
    fi
 done

-# Default objcc to clang if available, otherwise use CC
-if has clang; then
-  objcc=clang
-else
-  objcc="$cc"
-fi
-
 if test "$mingw32" = "yes" ; then
  EXESUF=".exe"
  # MinGW needs -mthreads for TLS and macro _MT.
@ -713,7 +723,7 @@ for opt do
  ;;
  --cxx=*)
  ;;
-  --objcc=*) objcc="$optarg"
+  --objcc=*)
  ;;
  --make=*) make="$optarg"
  ;;
@ -1749,13 +1759,9 @@ if test "$sanitizers" = "yes" ; then
  # detect the static linking issue of ubsan, see also:
  # https://gcc.gnu.org/bugzilla/show_bug.cgi?id=84285
  cat > $TMPC << EOF
-#include <stdlib.h>
-int main(void) {
-    void *tmp = malloc(10);
-    if (tmp != NULL) {
-        return *(int *)(tmp + 2);
-    }
-    return 1;
+int main(int argc, char **argv)
+{
+    return argc + 1;
 }
 EOF
  if compile_prog "$CPU_CFLAGS -Werror -fsanitize=undefined" ""; then
@ -2615,6 +2621,10 @@ if test "$skip_meson" = no; then

  rm -rf meson-private meson-info meson-logs

+  # Prevent meson from automatically downloading wrapped subprojects when missing.
+  # You can use 'meson subprojects download' before running configure.
+  meson_option_add "--wrap-mode=nodownload"
+
  # Built-in options
  test "$bindir" != "bin" && meson_option_add "-Dbindir=$bindir"
  test "$default_feature" = no && meson_option_add -Dauto_features=disabled
--- a/docs/devel/atomics.rst
+++ b/docs/devel/atomics.rst
@ -220,10 +220,9 @@ They come in six kinds:
  retrieves the address to which the second load will be directed),
  the processor will guarantee that the first LOAD will appear to happen
  before the second with respect to the other components of the system.
-  However, this is not always true---for example, it was not true on
-  Alpha processors.  Whenever this kind of access happens to shared
-  memory (that is not protected by a lock), a read barrier is needed,
-  and ``smp_read_barrier_depends()`` can be used instead of ``smp_rmb()``.
+  Therefore, unlike ``smp_rmb()`` or ``qatomic_load_acquire()``,
+  ``smp_read_barrier_depends()`` can be just a compiler barrier on
+  weakly-ordered architectures such as Arm or PPC[#]_.

  Note that the first load really has to have a _data_ dependency and not
  a control dependency.  If the address for the second load is dependent
@ -231,6 +230,10 @@ They come in six kinds:
  than actually loading the address itself, then it's a _control_
  dependency and a full read barrier or better is required.

+.. [#] The DEC Alpha is an exception, because ``smp_read_barrier_depends()``
+   needs a processor barrier.  On strongly-ordered architectures such
+   as x86 or s390, ``smp_rmb()`` and ``qatomic_load_acquire()`` can
+   also be compiler barriers only.

 Memory barriers and ``qatomic_load_acquire``/``qatomic_store_release`` are
 mostly used when a data structure has one thread that is always a writer
--- a/hw/misc/lasi.c
+++ b/hw/misc/lasi.c
@ -194,7 +194,7 @@ static const MemoryRegionOps lasi_chip_ops = {

 static const VMStateDescription vmstate_lasi = {
    .name = "Lasi",
-    .version_id = 1,
+    .version_id = 2,
    .minimum_version_id = 1,
    .fields = (VMStateField[]) {
        VMSTATE_UINT32(irr, LasiState),
@ -204,6 +204,7 @@ static const VMStateDescription vmstate_lasi = {
        VMSTATE_UINT32(iar, LasiState),
        VMSTATE_UINT32(errlog, LasiState),
        VMSTATE_UINT32(amr, LasiState),
+        VMSTATE_UINT32_V(rtc_ref, LasiState, 2),
        VMSTATE_END_OF_LIST()
    }
 };
@ -233,7 +234,6 @@ static void lasi_reset(DeviceState *dev)
    s->iar = 0xFFFB0000 + 3; /* CPU_HPA + 3 */

    /* Real time clock (RTC), it's only one 32-bit counter @9000 */
-    s->rtc = time(NULL);
    s->rtc_ref = 0;
 }

--- a/hw/nvme/ctrl.c
+++ b/hw/nvme/ctrl.c
@ -7158,9 +7158,7 @@ static int nvme_start_ctrl(NvmeCtrl *n)

    if (pci_is_vf(PCI_DEVICE(n)) && !sctrl->scs) {
        trace_pci_nvme_err_startfail_virt_state(le16_to_cpu(sctrl->nvi),
-                                                le16_to_cpu(sctrl->nvq),
-                                                sctrl->scs ? "ONLINE" :
-                                                             "OFFLINE");
+                                                le16_to_cpu(sctrl->nvq));
        return -1;
    }
    if (unlikely(n->cq[0])) {
--- a/hw/nvme/trace-events
+++ b/hw/nvme/trace-events
@ -187,7 +187,7 @@ pci_nvme_err_startfail_asqent_sz_zero(void) "nvme_start_ctrl failed because the
 pci_nvme_err_startfail_acqent_sz_zero(void) "nvme_start_ctrl failed because the admin completion queue size is zero"
 pci_nvme_err_startfail_zasl_too_small(uint32_t zasl, uint32_t pagesz) "nvme_start_ctrl failed because zone append size limit %"PRIu32" is too small, needs to be >= %"PRIu32""
 pci_nvme_err_startfail(void) "setting controller enable bit failed"
-pci_nvme_err_startfail_virt_state(uint16_t vq, uint16_t vi, const char *state) "nvme_start_ctrl failed due to ctrl state: vi=%u vq=%u %s"
+pci_nvme_err_startfail_virt_state(uint16_t vq, uint16_t vi) "nvme_start_ctrl failed due to ctrl state: vi=%u vq=%u"
 pci_nvme_err_invalid_mgmt_action(uint8_t action) "action=0x%"PRIx8""
 pci_nvme_err_ignored_mmio_vf_offline(uint64_t addr, unsigned size) "addr 0x%"PRIx64" size %d"

--- a/include/hw/misc/lasi.h
+++ b/include/hw/misc/lasi.h
@ -69,8 +69,7 @@ struct LasiState {

    uint32_t errlog;
    uint32_t amr;
-    uint32_t rtc;
-    time_t rtc_ref;
+    uint32_t rtc_ref;

    MemoryRegion this_mem;
 };
--- a/include/io/channel.h
+++ b/include/io/channel.h
@ -301,10 +301,10 @@ ssize_t qio_channel_writev_full(QIOChannel *ioc,
 * Returns: 1 if all bytes were read, 0 if end-of-file
 *          occurs without data, or -1 on error
 */
-int qio_channel_readv_all_eof(QIOChannel *ioc,
-                              const struct iovec *iov,
-                              size_t niov,
-                              Error **errp);
+int coroutine_mixed_fn qio_channel_readv_all_eof(QIOChannel *ioc,
+                                                 const struct iovec *iov,
+                                                 size_t niov,
+                                                 Error **errp);

 /**
 * qio_channel_readv_all:
@ -328,10 +328,10 @@ int qio_channel_readv_all_eof(QIOChannel *ioc,
 *
 * Returns: 0 if all bytes were read, or -1 on error
 */
-int qio_channel_readv_all(QIOChannel *ioc,
-                          const struct iovec *iov,
-                          size_t niov,
-                          Error **errp);
+int coroutine_mixed_fn qio_channel_readv_all(QIOChannel *ioc,
+                                             const struct iovec *iov,
+                                             size_t niov,
+                                             Error **errp);


 /**
@ -353,10 +353,10 @@ int qio_channel_readv_all(QIOChannel *ioc,
 *
 * Returns: 0 if all bytes were written, or -1 on error
 */
-int qio_channel_writev_all(QIOChannel *ioc,
-                           const struct iovec *iov,
-                           size_t niov,
-                           Error **errp);
+int coroutine_mixed_fn qio_channel_writev_all(QIOChannel *ioc,
+                                              const struct iovec *iov,
+                                              size_t niov,
+                                              Error **errp);

 /**
 * qio_channel_readv:
@ -437,10 +437,10 @@ ssize_t qio_channel_write(QIOChannel *ioc,
 * Returns: 1 if all bytes were read, 0 if end-of-file occurs
 *          without data, or -1 on error
 */
-int qio_channel_read_all_eof(QIOChannel *ioc,
-                             char *buf,
-                             size_t buflen,
-                             Error **errp);
+int coroutine_mixed_fn qio_channel_read_all_eof(QIOChannel *ioc,
+                                                char *buf,
+                                                size_t buflen,
+                                                Error **errp);

 /**
 * qio_channel_read_all:
@ -457,10 +457,10 @@ int qio_channel_read_all_eof(QIOChannel *ioc,
 *
 * Returns: 0 if all bytes were read, or -1 on error
 */
-int qio_channel_read_all(QIOChannel *ioc,
-                         char *buf,
-                         size_t buflen,
-                         Error **errp);
+int coroutine_mixed_fn qio_channel_read_all(QIOChannel *ioc,
+                                            char *buf,
+                                            size_t buflen,
+                                            Error **errp);

 /**
 * qio_channel_write_all:
@ -476,10 +476,10 @@ int qio_channel_read_all(QIOChannel *ioc,
 *
 * Returns: 0 if all bytes were written, or -1 on error
 */
-int qio_channel_write_all(QIOChannel *ioc,
-                          const char *buf,
-                          size_t buflen,
-                          Error **errp);
+int coroutine_mixed_fn qio_channel_write_all(QIOChannel *ioc,
+                                             const char *buf,
+                                             size_t buflen,
+                                             Error **errp);

 /**
 * qio_channel_set_blocking:
@ -812,11 +812,11 @@ void qio_channel_set_aio_fd_handler(QIOChannel *ioc,
 *          occurs without data, or -1 on error
 */

-int qio_channel_readv_full_all_eof(QIOChannel *ioc,
-                                   const struct iovec *iov,
-                                   size_t niov,
-                                   int **fds, size_t *nfds,
-                                   Error **errp);
+int coroutine_mixed_fn qio_channel_readv_full_all_eof(QIOChannel *ioc,
+                                                      const struct iovec *iov,
+                                                      size_t niov,
+                                                      int **fds, size_t *nfds,
+                                                      Error **errp);

 /**
 * qio_channel_readv_full_all:
@ -838,11 +838,11 @@ int qio_channel_readv_full_all_eof(QIOChannel *ioc,
 * Returns: 0 if all bytes were read, or -1 on error
 */

-int qio_channel_readv_full_all(QIOChannel *ioc,
-                               const struct iovec *iov,
-                               size_t niov,
-                               int **fds, size_t *nfds,
-                               Error **errp);
+int coroutine_mixed_fn qio_channel_readv_full_all(QIOChannel *ioc,
+                                                  const struct iovec *iov,
+                                                  size_t niov,
+                                                  int **fds, size_t *nfds,
+                                                  Error **errp);

 /**
 * qio_channel_writev_full_all:
@ -872,11 +872,11 @@ int qio_channel_readv_full_all(QIOChannel *ioc,
 * Returns: 0 if all bytes were written, or -1 on error
 */

-int qio_channel_writev_full_all(QIOChannel *ioc,
-                                const struct iovec *iov,
-                                size_t niov,
-                                int *fds, size_t nfds,
-                                int flags, Error **errp);
+int coroutine_mixed_fn qio_channel_writev_full_all(QIOChannel *ioc,
+                                                   const struct iovec *iov,
+                                                   size_t niov,
+                                                   int *fds, size_t nfds,
+                                                   int flags, Error **errp);

 /**
 * qio_channel_flush:
--- a/include/migration/qemu-file-types.h
+++ b/include/migration/qemu-file-types.h
@ -35,7 +35,7 @@ void qemu_put_byte(QEMUFile *f, int v);
 void qemu_put_be16(QEMUFile *f, unsigned int v);
 void qemu_put_be32(QEMUFile *f, unsigned int v);
 void qemu_put_be64(QEMUFile *f, uint64_t v);
-size_t qemu_get_buffer(QEMUFile *f, uint8_t *buf, size_t size);
+size_t coroutine_mixed_fn qemu_get_buffer(QEMUFile *f, uint8_t *buf, size_t size);

 int qemu_get_byte(QEMUFile *f);

@ -161,7 +161,7 @@ static inline void qemu_get_sbe64s(QEMUFile *f, int64_t *pv)
    qemu_get_be64s(f, (uint64_t *)pv);
 }

-size_t qemu_get_counted_string(QEMUFile *f, char buf[256]);
+size_t coroutine_mixed_fn qemu_get_counted_string(QEMUFile *f, char buf[256]);

 void qemu_put_counted_string(QEMUFile *f, const char *name);

--- a/include/qapi/qmp/dispatch.h
+++ b/include/qapi/qmp/dispatch.h
@ -55,8 +55,8 @@ bool qmp_command_available(const QmpCommand *cmd, Error **errp);
 const char *qmp_command_name(const QmpCommand *cmd);
 bool qmp_has_success_response(const QmpCommand *cmd);
 QDict *qmp_error_response(Error *err);
-QDict *qmp_dispatch(const QmpCommandList *cmds, QObject *request,
-                    bool allow_oob, Monitor *cur_mon);
+QDict *coroutine_mixed_fn qmp_dispatch(const QmpCommandList *cmds, QObject *request,
+                                       bool allow_oob, Monitor *cur_mon);
 bool qmp_is_oob(const QDict *dict);

 typedef void (*qmp_cmd_callback_fn)(const QmpCommand *cmd, void *opaque);
--- a/io/channel.c
+++ b/io/channel.c
@ -109,27 +109,27 @@ ssize_t qio_channel_writev_full(QIOChannel *ioc,
 }


-int qio_channel_readv_all_eof(QIOChannel *ioc,
-                              const struct iovec *iov,
-                              size_t niov,
-                              Error **errp)
+int coroutine_mixed_fn qio_channel_readv_all_eof(QIOChannel *ioc,
+                                                 const struct iovec *iov,
+                                                 size_t niov,
+                                                 Error **errp)
 {
    return qio_channel_readv_full_all_eof(ioc, iov, niov, NULL, NULL, errp);
 }

-int qio_channel_readv_all(QIOChannel *ioc,
-                          const struct iovec *iov,
-                          size_t niov,
-                          Error **errp)
+int coroutine_mixed_fn qio_channel_readv_all(QIOChannel *ioc,
+                                             const struct iovec *iov,
+                                             size_t niov,
+                                             Error **errp)
 {
    return qio_channel_readv_full_all(ioc, iov, niov, NULL, NULL, errp);
 }

-int qio_channel_readv_full_all_eof(QIOChannel *ioc,
-                                   const struct iovec *iov,
-                                   size_t niov,
-                                   int **fds, size_t *nfds,
-                                   Error **errp)
+int coroutine_mixed_fn qio_channel_readv_full_all_eof(QIOChannel *ioc,
+                                                      const struct iovec *iov,
+                                                      size_t niov,
+                                                      int **fds, size_t *nfds,
+                                                      Error **errp)
 {
    int ret = -1;
    struct iovec *local_iov = g_new(struct iovec, niov);
@ -215,11 +215,11 @@ next_iter:
    return ret;
 }

-int qio_channel_readv_full_all(QIOChannel *ioc,
-                               const struct iovec *iov,
-                               size_t niov,
-                               int **fds, size_t *nfds,
-                               Error **errp)
+int coroutine_mixed_fn qio_channel_readv_full_all(QIOChannel *ioc,
+                                                  const struct iovec *iov,
+                                                  size_t niov,
+                                                  int **fds, size_t *nfds,
+                                                  Error **errp)
 {
    int ret = qio_channel_readv_full_all_eof(ioc, iov, niov, fds, nfds, errp);

@ -234,19 +234,19 @@ int qio_channel_readv_full_all(QIOChannel *ioc,
    return ret;
 }

-int qio_channel_writev_all(QIOChannel *ioc,
-                           const struct iovec *iov,
-                           size_t niov,
-                           Error **errp)
+int coroutine_mixed_fn qio_channel_writev_all(QIOChannel *ioc,
+                                              const struct iovec *iov,
+                                              size_t niov,
+                                              Error **errp)
 {
    return qio_channel_writev_full_all(ioc, iov, niov, NULL, 0, 0, errp);
 }

-int qio_channel_writev_full_all(QIOChannel *ioc,
-                                const struct iovec *iov,
-                                size_t niov,
-                                int *fds, size_t nfds,
-                                int flags, Error **errp)
+int coroutine_mixed_fn qio_channel_writev_full_all(QIOChannel *ioc,
+                                                   const struct iovec *iov,
+                                                   size_t niov,
+                                                   int *fds, size_t nfds,
+                                                   int flags, Error **errp)
 {
    int ret = -1;
    struct iovec *local_iov = g_new(struct iovec, niov);
@ -325,30 +325,30 @@ ssize_t qio_channel_write(QIOChannel *ioc,
 }


-int qio_channel_read_all_eof(QIOChannel *ioc,
-                             char *buf,
-                             size_t buflen,
-                             Error **errp)
+int coroutine_mixed_fn qio_channel_read_all_eof(QIOChannel *ioc,
+                                                char *buf,
+                                                size_t buflen,
+                                                Error **errp)
 {
    struct iovec iov = { .iov_base = buf, .iov_len = buflen };
    return qio_channel_readv_all_eof(ioc, &iov, 1, errp);
 }


-int qio_channel_read_all(QIOChannel *ioc,
-                         char *buf,
-                         size_t buflen,
-                         Error **errp)
+int coroutine_mixed_fn qio_channel_read_all(QIOChannel *ioc,
+                                            char *buf,
+                                            size_t buflen,
+                                            Error **errp)
 {
    struct iovec iov = { .iov_base = buf, .iov_len = buflen };
    return qio_channel_readv_all(ioc, &iov, 1, errp);
 }


-int qio_channel_write_all(QIOChannel *ioc,
-                          const char *buf,
-                          size_t buflen,
-                          Error **errp)
+int coroutine_mixed_fn qio_channel_write_all(QIOChannel *ioc,
+                                             const char *buf,
+                                             size_t buflen,
+                                             Error **errp)
 {
    struct iovec iov = { .iov_base = (char *)buf, .iov_len = buflen };
    return qio_channel_writev_all(ioc, &iov, 1, errp);
--- a/migration/postcopy-ram.c
+++ b/migration/postcopy-ram.c
@ -1500,7 +1500,7 @@ static PostcopyState incoming_postcopy_state;

 PostcopyState  postcopy_state_get(void)
 {
-    return qatomic_mb_read(&incoming_postcopy_state);
+    return qatomic_load_acquire(&incoming_postcopy_state);
 }

 /* Set the state and return the old state */
--- a/migration/qemu-file.c
+++ b/migration/qemu-file.c
@ -392,7 +392,7 @@ size_t ram_control_save_page(QEMUFile *f, ram_addr_t block_offset,
 * case if the underlying file descriptor gives a short read, and that can
 * happen even on a blocking fd.
 */
-static ssize_t qemu_fill_buffer(QEMUFile *f)
+static ssize_t coroutine_mixed_fn qemu_fill_buffer(QEMUFile *f)
 {
    int len;
    int pending;
@ -585,7 +585,7 @@ void qemu_file_skip(QEMUFile *f, int size)
 * return as many as it managed to read (assuming blocking fd's which
 * all current QEMUFile are)
 */
-size_t qemu_peek_buffer(QEMUFile *f, uint8_t **buf, size_t size, size_t offset)
+size_t coroutine_mixed_fn qemu_peek_buffer(QEMUFile *f, uint8_t **buf, size_t size, size_t offset)
 {
    ssize_t pending;
    size_t index;
@ -633,7 +633,7 @@ size_t qemu_peek_buffer(QEMUFile *f, uint8_t **buf, size_t size, size_t offset)
 * return as many as it managed to read (assuming blocking fd's which
 * all current QEMUFile are)
 */
-size_t qemu_get_buffer(QEMUFile *f, uint8_t *buf, size_t size)
+size_t coroutine_mixed_fn qemu_get_buffer(QEMUFile *f, uint8_t *buf, size_t size)
 {
    size_t pending = size;
    size_t done = 0;
@ -674,7 +674,7 @@ size_t qemu_get_buffer(QEMUFile *f, uint8_t *buf, size_t size)
 * Note: Since **buf may get changed, the caller should take care to
 *       keep a pointer to the original buffer if it needs to deallocate it.
 */
-size_t qemu_get_buffer_in_place(QEMUFile *f, uint8_t **buf, size_t size)
+size_t coroutine_mixed_fn qemu_get_buffer_in_place(QEMUFile *f, uint8_t **buf, size_t size)
 {
    if (size < IO_BUF_SIZE) {
        size_t res;
@ -696,7 +696,7 @@ size_t qemu_get_buffer_in_place(QEMUFile *f, uint8_t **buf, size_t size)
 * Peeks a single byte from the buffer; this isn't guaranteed to work if
 * offset leaves a gap after the previous read/peeked data.
 */
-int qemu_peek_byte(QEMUFile *f, int offset)
+int coroutine_mixed_fn qemu_peek_byte(QEMUFile *f, int offset)
 {
    int index = f->buf_index + offset;

@ -713,7 +713,7 @@ int qemu_peek_byte(QEMUFile *f, int offset)
    return f->buf[index];
 }

-int qemu_get_byte(QEMUFile *f)
+int coroutine_mixed_fn qemu_get_byte(QEMUFile *f)
 {
    int result;

@ -894,7 +894,7 @@ int qemu_put_qemu_file(QEMUFile *f_des, QEMUFile *f_src)
 *          else 0
 *          (Note a 0 length string will return 0 either way)
 */
-size_t qemu_get_counted_string(QEMUFile *f, char buf[256])
+size_t coroutine_fn qemu_get_counted_string(QEMUFile *f, char buf[256])
 {
    size_t len = qemu_get_byte(f);
    size_t res = qemu_get_buffer(f, (uint8_t *)buf, len);
--- a/migration/qemu-file.h
+++ b/migration/qemu-file.h
@ -108,8 +108,8 @@ bool qemu_file_is_writable(QEMUFile *f);

 #include "migration/qemu-file-types.h"

-size_t qemu_peek_buffer(QEMUFile *f, uint8_t **buf, size_t size, size_t offset);
-size_t qemu_get_buffer_in_place(QEMUFile *f, uint8_t **buf, size_t size);
+size_t coroutine_mixed_fn qemu_peek_buffer(QEMUFile *f, uint8_t **buf, size_t size, size_t offset);
+size_t coroutine_mixed_fn qemu_get_buffer_in_place(QEMUFile *f, uint8_t **buf, size_t size);
 ssize_t qemu_put_compression_data(QEMUFile *f, z_stream *stream,
                                  const uint8_t *p, size_t size);
 int qemu_put_qemu_file(QEMUFile *f_des, QEMUFile *f_src);
@ -119,7 +119,7 @@ int qemu_put_qemu_file(QEMUFile *f_des, QEMUFile *f_src);
 * is; you aren't guaranteed to be able to peak to +n bytes unless you've
 * previously peeked +n-1.
 */
-int qemu_peek_byte(QEMUFile *f, int offset);
+int coroutine_mixed_fn qemu_peek_byte(QEMUFile *f, int offset);
 void qemu_file_skip(QEMUFile *f, int size);
 /*
 * qemu_file_credit_transfer:
--- a/nbd/server.c
+++ b/nbd/server.c
@ -1847,15 +1847,13 @@ static void nbd_export_delete(BlockExport *blk_exp)
    g_free(exp->description);
    exp->description = NULL;

-    if (exp->common.blk) {
-        if (exp->eject_notifier_blk) {
-            notifier_remove(&exp->eject_notifier);
-            blk_unref(exp->eject_notifier_blk);
-        }
-        blk_remove_aio_context_notifier(exp->common.blk, blk_aio_attached,
-                                        blk_aio_detach, exp);
-        blk_set_disable_request_queuing(exp->common.blk, false);
+    if (exp->eject_notifier_blk) {
+        notifier_remove(&exp->eject_notifier);
+        blk_unref(exp->eject_notifier_blk);
    }
+    blk_remove_aio_context_notifier(exp->common.blk, blk_aio_attached,
+                                    blk_aio_detach, exp);
+    blk_set_disable_request_queuing(exp->common.blk, false);

    for (i = 0; i < exp->nr_export_bitmaps; i++) {
        bdrv_dirty_bitmap_set_busy(exp->export_bitmaps[i], false);
--- a/qapi/qmp-dispatch.c
+++ b/qapi/qmp-dispatch.c
@ -134,8 +134,8 @@ static void do_qmp_dispatch_bh(void *opaque)
 * Runs outside of coroutine context for OOB commands, but in coroutine
 * context for everything else.
 */
-QDict *qmp_dispatch(const QmpCommandList *cmds, QObject *request,
-                    bool allow_oob, Monitor *cur_mon)
+QDict *coroutine_mixed_fn qmp_dispatch(const QmpCommandList *cmds, QObject *request,
+                                       bool allow_oob, Monitor *cur_mon)
 {
    Error *err = NULL;
    bool oob;
--- a/scripts/coverity-scan/COMPONENTS.md
+++ b/scripts/coverity-scan/COMPONENTS.md
@ -12,6 +12,9 @@ avr
 cris
  ~ (/qemu)?((/include)?/hw/cris/.*|/target/cris/.*)

+hexagon-gen (component should be ignored in analysis)
+  ~ (/qemu)?(/target/hexagon/.*generated.*)
+
 hexagon
  ~ (/qemu)?(/target/hexagon/.*)

@ -64,14 +67,11 @@ audio
  ~ (/qemu)?((/include)?/(audio|hw/audio)/.*)

 block
-  ~ (/qemu)?(/block.*|(/include?)(/hw)?/(block|storage-daemon)/.*|(/include)?/hw/ide/.*|/qemu-(img|io).*|/util/(aio|async|thread-pool).*)
+  ~ (/qemu)?(/block.*|(/include?)/(block|storage-daemon)/.*|(/include)?/hw/(block|ide|nvme)/.*|/qemu-(img|io).*|/util/(aio|async|thread-pool).*)

 char
  ~ (/qemu)?(/qemu-char\.c|/include/sysemu/char\.h|(/include)?/hw/char/.*)

-capstone
-  ~ (/qemu)?(/capstone/.*)
-
 crypto
  ~ (/qemu)?((/include)?/crypto/.*|/hw/.*/crypto.*)

@ -108,9 +108,6 @@ qemu-ga
 scsi
  ~ (/qemu)?(/scsi/.*|/hw/scsi/.*|/include/hw/scsi/.*)

-slirp (component should be ignored in analysis)
-  ~ (/qemu)?(/slirp/.*)
-
 tcg
  ~ (/qemu)?(/accel/tcg/.*|/replay/.*|/(.*/)?softmmu.*)

--- a/scripts/coverity-scan/coverity-scan.docker
+++ b/scripts/coverity-scan/coverity-scan.docker
@ -15,112 +15,152 @@
 # The work of actually doing the build is handled by the
 # run-coverity-scan script.

-FROM fedora:30
-ENV PACKAGES \
-    alsa-lib-devel \
-    bc \
-    brlapi-devel \
-    bzip2 \
-    bzip2-devel \
-    ccache \
-    clang \
-    curl \
-    cyrus-sasl-devel \
-    dbus-daemon \
-    device-mapper-multipath-devel \
-    findutils \
-    gcc \
-    gcc-c++ \
-    gettext \
-    git \
-    glib2-devel \
-    glusterfs-api-devel \
-    gnutls-devel \
-    gtk3-devel \
-    hostname \
-    libaio-devel \
-    libasan \
-    libattr-devel \
-    libblockdev-mpath-devel \
-    libcap-devel \
-    libcap-ng-devel \
-    libcurl-devel \
-    libepoxy-devel \
-    libfdt-devel \
-    libgbm-devel \
-    libiscsi-devel \
-    libjpeg-devel \
-    libpmem-devel \
-    libnfs-devel \
-    libpng-devel \
-    librbd-devel \
-    libseccomp-devel \
-    libssh-devel \
-    libubsan \
-    libudev-devel \
-    libusbx-devel \
-    libzstd-devel \
-    llvm \
-    lzo-devel \
-    make \
-    mingw32-bzip2 \
-    mingw32-curl \
-    mingw32-glib2 \
-    mingw32-gmp \
-    mingw32-gnutls \
-    mingw32-gtk3 \
-    mingw32-libjpeg-turbo \
-    mingw32-libpng \
-    mingw32-libtasn1 \
-    mingw32-nettle \
-    mingw32-nsis \
-    mingw32-pixman \
-    mingw32-pkg-config \
-    mingw32-SDL2 \
-    mingw64-bzip2 \
-    mingw64-curl \
-    mingw64-glib2 \
-    mingw64-gmp \
-    mingw64-gnutls \
-    mingw64-gtk3 \
-    mingw64-libjpeg-turbo \
-    mingw64-libpng \
-    mingw64-libtasn1 \
-    mingw64-nettle \
-    mingw64-pixman \
-    mingw64-pkg-config \
-    mingw64-SDL2 \
-    ncurses-devel \
-    nettle-devel \
-    numactl-devel \
-    perl \
-    perl-Test-Harness \
-    pixman-devel \
-    pulseaudio-libs-devel \
-    python3 \
-    python3-sphinx \
-    PyYAML \
-    rdma-core-devel \
-    SDL2-devel \
-    snappy-devel \
-    sparse \
-    spice-server-devel \
-    systemd-devel \
-    systemtap-sdt-devel \
-    tar \
-    usbredir-devel \
-    virglrenderer-devel \
-    vte291-devel \
-    wget \
-    which \
-    xen-devel \
-    xfsprogs-devel \
-    zlib-devel
-ENV QEMU_CONFIGURE_OPTS --python=/usr/bin/python3
+FROM registry.fedoraproject.org/fedora:37

-RUN dnf install -y $PACKAGES
-RUN rpm -q $PACKAGES | sort > /packages.txt
-ENV PATH $PATH:/usr/libexec/python3-sphinx/
+RUN dnf install -y nosync && \
+    echo -e '#!/bin/sh\n\
+if test -d /usr/lib64\n\
+then\n\
+    export LD_PRELOAD=/usr/lib64/nosync/nosync.so\n\
+else\n\
+    export LD_PRELOAD=/usr/lib/nosync/nosync.so\n\
+fi\n\
+exec "$@"' > /usr/bin/nosync && \
+    chmod +x /usr/bin/nosync && \
+    nosync dnf update -y && \
+    nosync dnf install -y \
+               SDL2-devel \
+               SDL2_image-devel \
+               alsa-lib-devel \
+               bash \
+               bc \
+               bison \
+               brlapi-devel \
+               bzip2 \
+               bzip2-devel \
+               ca-certificates \
+               capstone-devel \
+               ccache \
+               clang \
+               ctags \
+               cyrus-sasl-devel \
+               daxctl-devel \
+               dbus-daemon \
+               device-mapper-multipath-devel \
+               diffutils \
+               findutils \
+               flex \
+               fuse3-devel \
+               gcc \
+               gcc-c++ \
+               gcovr \
+               genisoimage \
+               gettext \
+               git \
+               glib2-devel \
+               glib2-static \
+               glibc-langpack-en \
+               glibc-static \
+               glusterfs-api-devel \
+               gnutls-devel \
+               gtk3-devel \
+               hostname \
+               jemalloc-devel \
+               json-c-devel \
+               libaio-devel \
+               libasan \
+               libattr-devel \
+               libbpf-devel \
+               libcacard-devel \
+               libcap-ng-devel \
+               libcmocka-devel \
+               libcurl-devel \
+               libdrm-devel \
+               libepoxy-devel \
+               libfdt-devel \
+               libffi-devel \
+               libgcrypt-devel \
+               libiscsi-devel \
+               libjpeg-devel \
+               libnfs-devel \
+               libpmem-devel \
+               libpng-devel \
+               librbd-devel \
+               libseccomp-devel \
+               libselinux-devel \
+               libslirp-devel \
+               libssh-devel \
+               libtasn1-devel \
+               libubsan \
+               liburing-devel \
+               libusbx-devel \
+               libzstd-devel \
+               llvm \
+               lttng-ust-devel \
+               lzo-devel \
+               make \
+               mesa-libgbm-devel \
+               meson \
+               ncurses-devel \
+               nettle-devel \
+               ninja-build \
+               nmap-ncat \
+               numactl-devel \
+               openssh-clients \
+               pam-devel \
+               pcre-static \
+               pixman-devel \
+               pkgconfig \
+               pulseaudio-libs-devel \
+               python3 \
+               python3-PyYAML \
+               python3-numpy \
+               python3-opencv \
+               python3-pillow \
+               python3-pip \
+               python3-sphinx \
+               python3-sphinx_rtd_theme \
+               rdma-core-devel \
+               rpm \
+               sed \
+               snappy-devel \
+               socat \
+               sparse \
+               spice-protocol \
+               spice-server-devel \
+               systemd-devel \
+               systemtap-sdt-devel \
+               tar \
+               tesseract \
+               tesseract-langpack-eng \
+               usbredir-devel \
+               util-linux \
+               virglrenderer-devel \
+               vte291-devel \
+               which \
+               xen-devel \
+               xfsprogs-devel \
+               zlib-devel \
+               zlib-static \
+               zstd && \
+    nosync dnf autoremove -y && \
+    nosync dnf clean all -y && \
+    rpm -qa | sort > /packages.txt && \
+    mkdir -p /usr/libexec/ccache-wrappers && \
+    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/c++ && \
+    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/cc && \
+    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/clang && \
+    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/g++ && \
+    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/gcc
+
+ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"
+ENV LANG "en_US.UTF-8"
+ENV MAKE "/usr/bin/make"
+ENV NINJA "/usr/bin/ninja"
+ENV PYTHON "/usr/bin/python3"
+ENV QEMU_CONFIGURE_OPTS --meson=internal
+
+RUN dnf install -y curl wget
 ENV COVERITY_TOOL_BASE=/coverity-tools
 COPY coverity_tool.tgz coverity_tool.tgz
 RUN mkdir -p /coverity-tools/coverity_tool && cd /coverity-tools/coverity_tool && tar xf /coverity_tool.tgz
--- a/scripts/mtest2make.py
+++ b/scripts/mtest2make.py
@ -51,10 +51,11 @@ def process_tests(test, targets, suites):

    test_suites = test['suite'] or ['default']
    for s in test_suites:
-        # The suite name in the introspection info is "PROJECT:SUITE"
-        s = s.split(':')[1]
-        if s == 'slow' or s == 'thorough':
-            continue
+        # The suite name in the introspection info is "PROJECT" or "PROJECT:SUITE"
+        if ':' in s:
+            s = s.split(':')[1]
+            if s == 'slow' or s == 'thorough':
+                continue
        if s.endswith('-slow'):
            s = s[:-5]
            suites[s].speeds.append('slow')
--- a/scripts/qapi/commands.py
+++ b/scripts/qapi/commands.py
@ -41,11 +41,13 @@ from .source import QAPISourceInfo
 def gen_command_decl(name: str,
                     arg_type: Optional[QAPISchemaObjectType],
                     boxed: bool,
-                     ret_type: Optional[QAPISchemaType]) -> str:
+                     ret_type: Optional[QAPISchemaType],
+                     coroutine: bool) -> str:
    return mcgen('''
-%(c_type)s qmp_%(c_name)s(%(params)s);
+%(c_type)s %(coroutine_fn)sqmp_%(c_name)s(%(params)s);
 ''',
                 c_type=(ret_type and ret_type.c_type()) or 'void',
+                 coroutine_fn='coroutine_fn ' if coroutine else '',
                 c_name=c_name(name),
                 params=build_params(arg_type, boxed, 'Error **errp'))

@ -157,16 +159,21 @@ static void qmp_marshal_output_%(c_name)s(%(c_type)s ret_in,
                 c_type=ret_type.c_type(), c_name=ret_type.c_name())


-def build_marshal_proto(name: str) -> str:
-    return ('void qmp_marshal_%s(QDict *args, QObject **ret, Error **errp)'
-            % c_name(name))
+def build_marshal_proto(name: str,
+                        coroutine: bool) -> str:
+    return ('void %(coroutine_fn)sqmp_marshal_%(c_name)s(%(params)s)' % {
+        'coroutine_fn': 'coroutine_fn ' if coroutine else '',
+        'c_name': c_name(name),
+        'params': 'QDict *args, QObject **ret, Error **errp',
+    })


-def gen_marshal_decl(name: str) -> str:
+def gen_marshal_decl(name: str,
+                     coroutine: bool) -> str:
    return mcgen('''
 %(proto)s;
 ''',
-                 proto=build_marshal_proto(name))
+                 proto=build_marshal_proto(name, coroutine))


 def gen_trace(name: str) -> str:
@ -181,7 +188,8 @@ def gen_marshal(name: str,
                arg_type: Optional[QAPISchemaObjectType],
                boxed: bool,
                ret_type: Optional[QAPISchemaType],
-                gen_tracing: bool) -> str:
+                gen_tracing: bool,
+                coroutine: bool) -> str:
    have_args = boxed or (arg_type and not arg_type.is_empty())
    if have_args:
        assert arg_type is not None
@ -195,7 +203,7 @@ def gen_marshal(name: str,
    bool ok = false;
    Visitor *v;
 ''',
-                proto=build_marshal_proto(name))
+                proto=build_marshal_proto(name, coroutine))

    if ret_type:
        ret += mcgen('''
@ -387,10 +395,11 @@ void %(c_prefix)sqmp_init_marshal(QmpCommandList *cmds)
                           self._genh, self._genc):
                self._genc.add(gen_marshal_output(ret_type))
        with ifcontext(ifcond, self._genh, self._genc):
-            self._genh.add(gen_command_decl(name, arg_type, boxed, ret_type))
-            self._genh.add(gen_marshal_decl(name))
+            self._genh.add(gen_command_decl(name, arg_type, boxed,
+                                            ret_type, coroutine))
+            self._genh.add(gen_marshal_decl(name, coroutine))
            self._genc.add(gen_marshal(name, arg_type, boxed, ret_type,
-                                       self._gen_tracing))
+                                       self._gen_tracing, coroutine))
            if self._gen_tracing:
                self._gen_trace_events.add(gen_trace(name))
        with self._temp_module('./init'):
--- a/subprojects/slirp.wrap
+++ b/subprojects/slirp.wrap
@ -0,0 +1,6 @@
+[wrap-git]
+url = https://gitlab.freedesktop.org/slirp/libslirp
+revision = 15c52d697529eb3e78c5d8aa324d61715bce33b6
+
+[provide]
+slirp = libslirp_dep
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@ -5731,8 +5731,8 @@ void cpu_x86_cpuid(CPUX86State *env, uint32_t index, uint32_t count,
        } else {
            *eax &= env->features[FEAT_SGX_12_1_EAX];
            *ebx &= 0; /* ebx reserve */
-            *ecx &= env->features[FEAT_XSAVE_XSS_LO];
-            *edx &= env->features[FEAT_XSAVE_XSS_HI];
+            *ecx &= env->features[FEAT_XSAVE_XCR0_LO];
+            *edx &= env->features[FEAT_XSAVE_XCR0_HI];

            /* FP and SSE are always allowed regardless of XSAVE/XCR0. */
            *ecx |= XSTATE_FP_MASK | XSTATE_SSE_MASK;
--- a/target/i386/tcg/sysemu/excp_helper.c
+++ b/target/i386/tcg/sysemu/excp_helper.c
@ -147,6 +147,7 @@ static bool mmu_translate(CPUX86State *env, const TranslateParams *in,
    hwaddr pte_addr, paddr;
    uint32_t pkr;
    int page_size;
+    int error_code;

 restart_all:
    rsvd_mask = ~MAKE_64BIT_MASK(0, env_archcpu(env)->phys_bits);
@ -467,7 +468,6 @@ do_check_protect_pse36:
    out->page_size = page_size;
    return true;

-    int error_code;
 do_fault_rsvd:
    error_code = PG_ERROR_RSVD_MASK;
    goto do_fault_cont;
--- a/target/mips/tcg/translate.c
+++ b/target/mips/tcg/translate.c
@ -1223,6 +1223,7 @@ static const char regnames_LO[][4] = {
 /* General purpose registers moves. */
 void gen_load_gpr(TCGv t, int reg)
 {
+    assert(reg >= 0 && reg <= ARRAY_SIZE(cpu_gpr));
    if (reg == 0) {
        tcg_gen_movi_tl(t, 0);
    } else {
@ -1232,6 +1233,7 @@ void gen_load_gpr(TCGv t, int reg)

 void gen_store_gpr(TCGv t, int reg)
 {
+    assert(reg >= 0 && reg <= ARRAY_SIZE(cpu_gpr));
    if (reg != 0) {
        tcg_gen_mov_tl(cpu_gpr[reg], t);
    }
@ -1240,6 +1242,7 @@ void gen_store_gpr(TCGv t, int reg)
 #if defined(TARGET_MIPS64)
 void gen_load_gpr_hi(TCGv_i64 t, int reg)
 {
+    assert(reg >= 0 && reg <= ARRAY_SIZE(cpu_gpr_hi));
    if (reg == 0) {
        tcg_gen_movi_i64(t, 0);
    } else {
@ -1249,6 +1252,7 @@ void gen_load_gpr_hi(TCGv_i64 t, int reg)

 void gen_store_gpr_hi(TCGv_i64 t, int reg)
 {
+    assert(reg >= 0 && reg <= ARRAY_SIZE(cpu_gpr_hi));
    if (reg != 0) {
        tcg_gen_mov_i64(cpu_gpr_hi[reg], t);
    }
--- a/tests/docker/dockerfiles/centos8.docker
+++ b/tests/docker/dockerfiles/centos8.docker
@ -100,7 +100,6 @@ RUN dnf distro-sync -y && \
        python38-setuptools \
        python38-wheel \
        rdma-core-devel \
-        rpm \
        sed \
        snappy-devel \
        socat \
--- a/tests/docker/dockerfiles/debian-amd64-cross.docker
+++ b/tests/docker/dockerfiles/debian-amd64-cross.docker
@ -148,7 +148,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
    eatmydata apt-get autoremove -y && \
    eatmydata apt-get autoclean -y && \
    mkdir -p /usr/local/share/meson/cross && \
-    echo "[binaries]\n\
+    printf "[binaries]\n\
 c = '/usr/bin/x86_64-linux-gnu-gcc'\n\
 ar = '/usr/bin/x86_64-linux-gnu-gcc-ar'\n\
 strip = '/usr/bin/x86_64-linux-gnu-strip'\n\
@ -158,7 +158,7 @@ pkgconfig = '/usr/bin/x86_64-linux-gnu-pkg-config'\n\
 system = 'linux'\n\
 cpu_family = 'x86_64'\n\
 cpu = 'x86_64'\n\
-endian = 'little'" > /usr/local/share/meson/cross/x86_64-linux-gnu && \
+endian = 'little'\n" > /usr/local/share/meson/cross/x86_64-linux-gnu && \
    dpkg-query --showformat '${Package}_${Version}_${Architecture}\n' --show > /packages.txt && \
    mkdir -p /usr/libexec/ccache-wrappers && \
    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/x86_64-linux-gnu-c++ && \
--- a/tests/docker/dockerfiles/debian-arm64-cross.docker
+++ b/tests/docker/dockerfiles/debian-arm64-cross.docker
@ -147,7 +147,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
    eatmydata apt-get autoremove -y && \
    eatmydata apt-get autoclean -y && \
    mkdir -p /usr/local/share/meson/cross && \
-    echo "[binaries]\n\
+    printf "[binaries]\n\
 c = '/usr/bin/aarch64-linux-gnu-gcc'\n\
 ar = '/usr/bin/aarch64-linux-gnu-gcc-ar'\n\
 strip = '/usr/bin/aarch64-linux-gnu-strip'\n\
@ -157,7 +157,7 @@ pkgconfig = '/usr/bin/aarch64-linux-gnu-pkg-config'\n\
 system = 'linux'\n\
 cpu_family = 'aarch64'\n\
 cpu = 'aarch64'\n\
-endian = 'little'" > /usr/local/share/meson/cross/aarch64-linux-gnu && \
+endian = 'little'\n" > /usr/local/share/meson/cross/aarch64-linux-gnu && \
    dpkg-query --showformat '${Package}_${Version}_${Architecture}\n' --show > /packages.txt && \
    mkdir -p /usr/libexec/ccache-wrappers && \
    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/aarch64-linux-gnu-c++ && \
--- a/tests/docker/dockerfiles/debian-armel-cross.docker
+++ b/tests/docker/dockerfiles/debian-armel-cross.docker
@ -146,7 +146,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
    eatmydata apt-get autoremove -y && \
    eatmydata apt-get autoclean -y && \
    mkdir -p /usr/local/share/meson/cross && \
-    echo "[binaries]\n\
+    printf "[binaries]\n\
 c = '/usr/bin/arm-linux-gnueabi-gcc'\n\
 ar = '/usr/bin/arm-linux-gnueabi-gcc-ar'\n\
 strip = '/usr/bin/arm-linux-gnueabi-strip'\n\
@ -156,7 +156,7 @@ pkgconfig = '/usr/bin/arm-linux-gnueabi-pkg-config'\n\
 system = 'linux'\n\
 cpu_family = 'arm'\n\
 cpu = 'arm'\n\
-endian = 'little'" > /usr/local/share/meson/cross/arm-linux-gnueabi && \
+endian = 'little'\n" > /usr/local/share/meson/cross/arm-linux-gnueabi && \
    dpkg-query --showformat '${Package}_${Version}_${Architecture}\n' --show > /packages.txt && \
    mkdir -p /usr/libexec/ccache-wrappers && \
    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/arm-linux-gnueabi-c++ && \
--- a/tests/docker/dockerfiles/debian-armhf-cross.docker
+++ b/tests/docker/dockerfiles/debian-armhf-cross.docker
@ -147,7 +147,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
    eatmydata apt-get autoremove -y && \
    eatmydata apt-get autoclean -y && \
    mkdir -p /usr/local/share/meson/cross && \
-    echo "[binaries]\n\
+    printf "[binaries]\n\
 c = '/usr/bin/arm-linux-gnueabihf-gcc'\n\
 ar = '/usr/bin/arm-linux-gnueabihf-gcc-ar'\n\
 strip = '/usr/bin/arm-linux-gnueabihf-strip'\n\
@ -157,7 +157,7 @@ pkgconfig = '/usr/bin/arm-linux-gnueabihf-pkg-config'\n\
 system = 'linux'\n\
 cpu_family = 'arm'\n\
 cpu = 'armhf'\n\
-endian = 'little'" > /usr/local/share/meson/cross/arm-linux-gnueabihf && \
+endian = 'little'\n" > /usr/local/share/meson/cross/arm-linux-gnueabihf && \
    dpkg-query --showformat '${Package}_${Version}_${Architecture}\n' --show > /packages.txt && \
    mkdir -p /usr/libexec/ccache-wrappers && \
    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/arm-linux-gnueabihf-c++ && \
--- a/tests/docker/dockerfiles/debian-mips64el-cross.docker
+++ b/tests/docker/dockerfiles/debian-mips64el-cross.docker
@ -144,7 +144,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
    eatmydata apt-get autoremove -y && \
    eatmydata apt-get autoclean -y && \
    mkdir -p /usr/local/share/meson/cross && \
-    echo "[binaries]\n\
+    printf "[binaries]\n\
 c = '/usr/bin/mips64el-linux-gnuabi64-gcc'\n\
 ar = '/usr/bin/mips64el-linux-gnuabi64-gcc-ar'\n\
 strip = '/usr/bin/mips64el-linux-gnuabi64-strip'\n\
@ -154,7 +154,7 @@ pkgconfig = '/usr/bin/mips64el-linux-gnuabi64-pkg-config'\n\
 system = 'linux'\n\
 cpu_family = 'mips64'\n\
 cpu = 'mips64el'\n\
-endian = 'little'" > /usr/local/share/meson/cross/mips64el-linux-gnuabi64 && \
+endian = 'little'\n" > /usr/local/share/meson/cross/mips64el-linux-gnuabi64 && \
    dpkg-query --showformat '${Package}_${Version}_${Architecture}\n' --show > /packages.txt && \
    mkdir -p /usr/libexec/ccache-wrappers && \
    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/mips64el-linux-gnuabi64-c++ && \
--- a/tests/docker/dockerfiles/debian-mipsel-cross.docker
+++ b/tests/docker/dockerfiles/debian-mipsel-cross.docker
@ -144,7 +144,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
    eatmydata apt-get autoremove -y && \
    eatmydata apt-get autoclean -y && \
    mkdir -p /usr/local/share/meson/cross && \
-    echo "[binaries]\n\
+    printf "[binaries]\n\
 c = '/usr/bin/mipsel-linux-gnu-gcc'\n\
 ar = '/usr/bin/mipsel-linux-gnu-gcc-ar'\n\
 strip = '/usr/bin/mipsel-linux-gnu-strip'\n\
@ -154,7 +154,7 @@ pkgconfig = '/usr/bin/mipsel-linux-gnu-pkg-config'\n\
 system = 'linux'\n\
 cpu_family = 'mips'\n\
 cpu = 'mipsel'\n\
-endian = 'little'" > /usr/local/share/meson/cross/mipsel-linux-gnu && \
+endian = 'little'\n" > /usr/local/share/meson/cross/mipsel-linux-gnu && \
    dpkg-query --showformat '${Package}_${Version}_${Architecture}\n' --show > /packages.txt && \
    mkdir -p /usr/libexec/ccache-wrappers && \
    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/mipsel-linux-gnu-c++ && \
--- a/tests/docker/dockerfiles/debian-ppc64el-cross.docker
+++ b/tests/docker/dockerfiles/debian-ppc64el-cross.docker
@ -146,7 +146,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
    eatmydata apt-get autoremove -y && \
    eatmydata apt-get autoclean -y && \
    mkdir -p /usr/local/share/meson/cross && \
-    echo "[binaries]\n\
+    printf "[binaries]\n\
 c = '/usr/bin/powerpc64le-linux-gnu-gcc'\n\
 ar = '/usr/bin/powerpc64le-linux-gnu-gcc-ar'\n\
 strip = '/usr/bin/powerpc64le-linux-gnu-strip'\n\
@ -156,7 +156,7 @@ pkgconfig = '/usr/bin/powerpc64le-linux-gnu-pkg-config'\n\
 system = 'linux'\n\
 cpu_family = 'ppc64'\n\
 cpu = 'powerpc64le'\n\
-endian = 'little'" > /usr/local/share/meson/cross/powerpc64le-linux-gnu && \
+endian = 'little'\n" > /usr/local/share/meson/cross/powerpc64le-linux-gnu && \
    dpkg-query --showformat '${Package}_${Version}_${Architecture}\n' --show > /packages.txt && \
    mkdir -p /usr/libexec/ccache-wrappers && \
    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/powerpc64le-linux-gnu-c++ && \
--- a/tests/docker/dockerfiles/debian-s390x-cross.docker
+++ b/tests/docker/dockerfiles/debian-s390x-cross.docker
@ -145,7 +145,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
    eatmydata apt-get autoremove -y && \
    eatmydata apt-get autoclean -y && \
    mkdir -p /usr/local/share/meson/cross && \
-    echo "[binaries]\n\
+    printf "[binaries]\n\
 c = '/usr/bin/s390x-linux-gnu-gcc'\n\
 ar = '/usr/bin/s390x-linux-gnu-gcc-ar'\n\
 strip = '/usr/bin/s390x-linux-gnu-strip'\n\
@ -155,7 +155,7 @@ pkgconfig = '/usr/bin/s390x-linux-gnu-pkg-config'\n\
 system = 'linux'\n\
 cpu_family = 's390x'\n\
 cpu = 's390x'\n\
-endian = 'big'" > /usr/local/share/meson/cross/s390x-linux-gnu && \
+endian = 'big'\n" > /usr/local/share/meson/cross/s390x-linux-gnu && \
    dpkg-query --showformat '${Package}_${Version}_${Architecture}\n' --show > /packages.txt && \
    mkdir -p /usr/libexec/ccache-wrappers && \
    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/s390x-linux-gnu-c++ && \
--- a/tests/docker/dockerfiles/fedora-win32-cross.docker
+++ b/tests/docker/dockerfiles/fedora-win32-cross.docker
@ -7,14 +7,14 @@
 FROM registry.fedoraproject.org/fedora:37

 RUN dnf install -y nosync && \
-    echo -e '#!/bin/sh\n\
+    printf '#!/bin/sh\n\
 if test -d /usr/lib64\n\
 then\n\
    export LD_PRELOAD=/usr/lib64/nosync/nosync.so\n\
 else\n\
    export LD_PRELOAD=/usr/lib/nosync/nosync.so\n\
 fi\n\
-exec "$@"' > /usr/bin/nosync && \
+exec "$@"\n' > /usr/bin/nosync && \
    chmod +x /usr/bin/nosync && \
    nosync dnf update -y && \
    nosync dnf install -y \
@ -50,7 +50,6 @@ exec "$@"' > /usr/bin/nosync && \
               python3-pip \
               python3-sphinx \
               python3-sphinx_rtd_theme \
-               rpm \
               sed \
               socat \
               sparse \
--- a/tests/docker/dockerfiles/fedora-win64-cross.docker
+++ b/tests/docker/dockerfiles/fedora-win64-cross.docker
@ -7,14 +7,14 @@
 FROM registry.fedoraproject.org/fedora:37

 RUN dnf install -y nosync && \
-    echo -e '#!/bin/sh\n\
+    printf '#!/bin/sh\n\
 if test -d /usr/lib64\n\
 then\n\
    export LD_PRELOAD=/usr/lib64/nosync/nosync.so\n\
 else\n\
    export LD_PRELOAD=/usr/lib/nosync/nosync.so\n\
 fi\n\
-exec "$@"' > /usr/bin/nosync && \
+exec "$@"\n' > /usr/bin/nosync && \
    chmod +x /usr/bin/nosync && \
    nosync dnf update -y && \
    nosync dnf install -y \
@ -50,7 +50,6 @@ exec "$@"' > /usr/bin/nosync && \
               python3-pip \
               python3-sphinx \
               python3-sphinx_rtd_theme \
-               rpm \
               sed \
               socat \
               sparse \
--- a/tests/docker/dockerfiles/fedora.docker
+++ b/tests/docker/dockerfiles/fedora.docker
@ -7,14 +7,14 @@
 FROM registry.fedoraproject.org/fedora:37

 RUN dnf install -y nosync && \
-    echo -e '#!/bin/sh\n\
+    printf '#!/bin/sh\n\
 if test -d /usr/lib64\n\
 then\n\
    export LD_PRELOAD=/usr/lib64/nosync/nosync.so\n\
 else\n\
    export LD_PRELOAD=/usr/lib/nosync/nosync.so\n\
 fi\n\
-exec "$@"' > /usr/bin/nosync && \
+exec "$@"\n' > /usr/bin/nosync && \
    chmod +x /usr/bin/nosync && \
    nosync dnf update -y && \
    nosync dnf install -y \
@ -110,7 +110,6 @@ exec "$@"' > /usr/bin/nosync && \
               python3-sphinx \
               python3-sphinx_rtd_theme \
               rdma-core-devel \
-               rpm \
               sed \
               snappy-devel \
               socat \
--- a/tests/docker/dockerfiles/opensuse-leap.docker
+++ b/tests/docker/dockerfiles/opensuse-leap.docker
@ -1,10 +1,10 @@
 # THIS FILE WAS AUTO-GENERATED
 #
-#  $ lcitool dockerfile --layers all opensuse-leap-153 qemu
+#  $ lcitool dockerfile --layers all opensuse-leap-15 qemu
 #
 # https://gitlab.com/libvirt/libvirt-ci

-FROM registry.opensuse.org/opensuse/leap:15.3
+FROM registry.opensuse.org/opensuse/leap:15.4

 RUN zypper update -y && \
    zypper install -y \
@ -93,7 +93,6 @@ RUN zypper update -y && \
           python39-pip \
           python39-setuptools \
           rdma-core-devel \
-           rpm \
           sed \
           snappy-devel \
           sndio-devel \
--- a/tests/lcitool/libvirt-ci
+++ b/tests/lcitool/libvirt-ci
@ -1 +1 @@
-Subproject commit 232f41f160d4567b8c82dd52aa96c2bc3a5b75c1
+Subproject commit 85487e140415b2ac54b01a9a6b600fd7c21edc2f
--- a/tests/lcitool/mappings.yml
+++ b/tests/lcitool/mappings.yml
@ -1,71 +1,71 @@
 mappings:
  flake8:
    CentOSStream8:
-    OpenSUSELeap153:
+    OpenSUSELeap15:

  meson:
    CentOSStream8:
-    OpenSUSELeap153:
+    OpenSUSELeap15:

  python3:
    CentOSStream8: python38
-    OpenSUSELeap153: python39-base
+    OpenSUSELeap15: python39-base

  python3-PyYAML:
    CentOSStream8: python38-PyYAML
-    OpenSUSELeap153:
+    OpenSUSELeap15:

  python3-devel:
    CentOSStream8: python38-devel
-    OpenSUSELeap153: python39-devel
+    OpenSUSELeap15: python39-devel

  python3-docutils:
    CentOSStream8:
-    OpenSUSELeap153:
+    OpenSUSELeap15:

  python3-numpy:
    CentOSStream8: python38-numpy
-    OpenSUSELeap153:
+    OpenSUSELeap15:

  python3-opencv:
    CentOSStream8:
-    OpenSUSELeap153:
+    OpenSUSELeap15:

  python3-pillow:
    CentOSStream8:
-    OpenSUSELeap153:
+    OpenSUSELeap15:

  python3-pip:
    CentOSStream8: python38-pip
-    OpenSUSELeap153: python39-pip
+    OpenSUSELeap15: python39-pip

  python3-pillow:
    CentOSStream8:
-    OpenSUSELeap153:
+    OpenSUSELeap15:

  python3-selinux:
    CentOSStream8:
-    OpenSUSELeap153:
+    OpenSUSELeap15:

  python3-setuptools:
    CentOSStream8: python38-setuptools
-    OpenSUSELeap153: python39-setuptools
+    OpenSUSELeap15: python39-setuptools

  python3-sphinx:
    CentOSStream8:
-    OpenSUSELeap153:
+    OpenSUSELeap15:

  python3-sphinx-rtd-theme:
    CentOSStream8:
-    OpenSUSELeap153:
+    OpenSUSELeap15:

  python3-venv:
    CentOSStream8: python38
-    OpenSUSELeap153: python39-base
+    OpenSUSELeap15: python39-base

  python3-wheel:
    CentOSStream8: python38-wheel
-    OpenSUSELeap153: python39-pip
+    OpenSUSELeap15: python39-pip

 pypi_mappings:
  # Request more recent version
@ -74,4 +74,4 @@ pypi_mappings:

  # Drop packages that need devel headers
  python3-numpy:
-    OpenSUSELeap153:
+    OpenSUSELeap15:
--- a/tests/lcitool/refresh
+++ b/tests/lcitool/refresh
@ -120,7 +120,7 @@ try:
    generate_dockerfile("debian-amd64", "debian-11",
                        trailer="".join(debian11_extras))
    generate_dockerfile("fedora", "fedora-37")
-    generate_dockerfile("opensuse-leap", "opensuse-leap-153")
+    generate_dockerfile("opensuse-leap", "opensuse-leap-15")
    generate_dockerfile("ubuntu2004", "ubuntu-2004")
    generate_dockerfile("ubuntu2204", "ubuntu-2204")

--- a/tests/lcitool/targets/opensuse-leap-153.yml
+++ b/tests/lcitool/targets/opensuse-leap-153.yml
--- a/tests/qtest/bios-tables-test.c
+++ b/tests/qtest/bios-tables-test.c
@ -438,10 +438,9 @@ static void test_acpi_asl(test_data *data)
 {
    int i;
    AcpiSdtTable *sdt, *exp_sdt;
-    test_data exp_data;
+    test_data exp_data = {};
    gboolean exp_err, err, all_tables_match = true;

-    memset(&exp_data, 0, sizeof(exp_data));
    exp_data.tables = load_expected_aml(data);
    dump_aml_files(data, false);
    for (i = 0; i < data->tables->len; ++i) {
@ -853,12 +852,11 @@ static uint8_t base_required_struct_types[] = {

 static void test_acpi_piix4_tcg(void)
 {
-    test_data data;
+    test_data data = {};

    /* Supplying -machine accel argument overrides the default (qtest).
     * This is to make guest actually run.
     */
-    memset(&data, 0, sizeof(data));
    data.machine = MACHINE_PC;
    data.required_struct_types = base_required_struct_types;
    data.required_struct_types_len = ARRAY_SIZE(base_required_struct_types);
@ -868,9 +866,8 @@ static void test_acpi_piix4_tcg(void)

 static void test_acpi_piix4_tcg_bridge(void)
 {
-    test_data data;
+    test_data data = {};

-    memset(&data, 0, sizeof(data));
    data.machine = MACHINE_PC;
    data.variant = ".bridge";
    data.required_struct_types = base_required_struct_types;
@ -906,9 +903,8 @@ static void test_acpi_piix4_tcg_bridge(void)

 static void test_acpi_piix4_no_root_hotplug(void)
 {
-    test_data data;
+    test_data data = {};

-    memset(&data, 0, sizeof(data));
    data.machine = MACHINE_PC;
    data.variant = ".roothp";
    data.required_struct_types = base_required_struct_types;
@ -923,9 +919,8 @@ static void test_acpi_piix4_no_root_hotplug(void)

 static void test_acpi_piix4_no_bridge_hotplug(void)
 {
-    test_data data;
+    test_data data = {};

-    memset(&data, 0, sizeof(data));
    data.machine = MACHINE_PC;
    data.variant = ".hpbridge";
    data.required_struct_types = base_required_struct_types;
@ -940,9 +935,8 @@ static void test_acpi_piix4_no_bridge_hotplug(void)

 static void test_acpi_piix4_no_acpi_pci_hotplug(void)
 {
-    test_data data;
+    test_data data = {};

-    memset(&data, 0, sizeof(data));
    data.machine = MACHINE_PC;
    data.variant = ".hpbrroot";
    data.required_struct_types = base_required_struct_types;
@ -962,9 +956,8 @@ static void test_acpi_piix4_no_acpi_pci_hotplug(void)

 static void test_acpi_q35_tcg(void)
 {
-    test_data data;
+    test_data data = {};

-    memset(&data, 0, sizeof(data));
    data.machine = MACHINE_Q35;
    data.required_struct_types = base_required_struct_types;
    data.required_struct_types_len = ARRAY_SIZE(base_required_struct_types);
@ -994,9 +987,8 @@ static void test_acpi_q35_tcg_core_count2(void)

 static void test_acpi_q35_tcg_bridge(void)
 {
-    test_data data;
+    test_data data = {};

-    memset(&data, 0, sizeof(data));
    data.machine = MACHINE_Q35;
    data.variant = ".bridge";
    data.required_struct_types = base_required_struct_types;
@ -1009,9 +1001,8 @@ static void test_acpi_q35_tcg_bridge(void)

 static void test_acpi_q35_tcg_no_acpi_hotplug(void)
 {
-    test_data data;
+    test_data data = {};

-    memset(&data, 0, sizeof(data));
    data.machine = MACHINE_Q35;
    data.variant = ".noacpihp";
    data.required_struct_types = base_required_struct_types;
@ -1105,9 +1096,8 @@ static void test_acpi_q35_tcg_mmio64(void)

 static void test_acpi_piix4_tcg_cphp(void)
 {
-    test_data data;
+    test_data data = {};

-    memset(&data, 0, sizeof(data));
    data.machine = MACHINE_PC;
    data.variant = ".cphp";
    test_acpi_one("-smp 2,cores=3,sockets=2,maxcpus=6"
@ -1121,9 +1111,8 @@ static void test_acpi_piix4_tcg_cphp(void)

 static void test_acpi_q35_tcg_cphp(void)
 {
-    test_data data;
+    test_data data = {};

-    memset(&data, 0, sizeof(data));
    data.machine = MACHINE_Q35;
    data.variant = ".cphp";
    test_acpi_one(" -smp 2,cores=3,sockets=2,maxcpus=6"
@ -1141,9 +1130,8 @@ static uint8_t ipmi_required_struct_types[] = {

 static void test_acpi_q35_tcg_ipmi(void)
 {
-    test_data data;
+    test_data data = {};

-    memset(&data, 0, sizeof(data));
    data.machine = MACHINE_Q35;
    data.variant = ".ipmibt";
    data.required_struct_types = ipmi_required_struct_types;
@ -1156,9 +1144,8 @@ static void test_acpi_q35_tcg_ipmi(void)

 static void test_acpi_q35_tcg_smbus_ipmi(void)
 {
-    test_data data;
+    test_data data = {};

-    memset(&data, 0, sizeof(data));
    data.machine = MACHINE_Q35;
    data.variant = ".ipmismbus";
    data.required_struct_types = ipmi_required_struct_types;
@ -1171,12 +1158,11 @@ static void test_acpi_q35_tcg_smbus_ipmi(void)

 static void test_acpi_piix4_tcg_ipmi(void)
 {
-    test_data data;
+    test_data data = {};

    /* Supplying -machine accel argument overrides the default (qtest).
     * This is to make guest actually run.
     */
-    memset(&data, 0, sizeof(data));
    data.machine = MACHINE_PC;
    data.variant = ".ipmikcs";
    data.required_struct_types = ipmi_required_struct_types;
@ -1189,9 +1175,8 @@ static void test_acpi_piix4_tcg_ipmi(void)

 static void test_acpi_q35_tcg_memhp(void)
 {
-    test_data data;
+    test_data data = {};

-    memset(&data, 0, sizeof(data));
    data.machine = MACHINE_Q35;
    data.variant = ".memhp";
    test_acpi_one(" -m 128,slots=3,maxmem=1G"
@ -1205,9 +1190,8 @@ static void test_acpi_q35_tcg_memhp(void)

 static void test_acpi_piix4_tcg_memhp(void)
 {
-    test_data data;
+    test_data data = {};

-    memset(&data, 0, sizeof(data));
    data.machine = MACHINE_PC;
    data.variant = ".memhp";
    test_acpi_one(" -m 128,slots=3,maxmem=1G"
@ -1221,9 +1205,8 @@ static void test_acpi_piix4_tcg_memhp(void)

 static void test_acpi_piix4_tcg_nosmm(void)
 {
-    test_data data;
+    test_data data = {};

-    memset(&data, 0, sizeof(data));
    data.machine = MACHINE_PC;
    data.variant = ".nosmm";
    test_acpi_one("-machine smm=off", &data);
@ -1232,9 +1215,8 @@ static void test_acpi_piix4_tcg_nosmm(void)

 static void test_acpi_piix4_tcg_smm_compat(void)
 {
-    test_data data;
+    test_data data = {};

-    memset(&data, 0, sizeof(data));
    data.machine = MACHINE_PC;
    data.variant = ".smm-compat";
    test_acpi_one("-global PIIX4_PM.smm-compat=on", &data);
@ -1243,9 +1225,8 @@ static void test_acpi_piix4_tcg_smm_compat(void)

 static void test_acpi_piix4_tcg_smm_compat_nosmm(void)
 {
-    test_data data;
+    test_data data = {};

-    memset(&data, 0, sizeof(data));
    data.machine = MACHINE_PC;
    data.variant = ".smm-compat-nosmm";
    test_acpi_one("-global PIIX4_PM.smm-compat=on -machine smm=off", &data);
@ -1254,9 +1235,8 @@ static void test_acpi_piix4_tcg_smm_compat_nosmm(void)

 static void test_acpi_piix4_tcg_nohpet(void)
 {
-    test_data data;
+    test_data data = {};

-    memset(&data, 0, sizeof(data));
    data.machine = MACHINE_PC;
    data.machine_param = ",hpet=off";
    data.variant = ".nohpet";
@ -1266,9 +1246,8 @@ static void test_acpi_piix4_tcg_nohpet(void)

 static void test_acpi_q35_tcg_numamem(void)
 {
-    test_data data;
+    test_data data = {};

-    memset(&data, 0, sizeof(data));
    data.machine = MACHINE_Q35;
    data.variant = ".numamem";
    test_acpi_one(" -object memory-backend-ram,id=ram0,size=128M"
@ -1278,9 +1257,8 @@ static void test_acpi_q35_tcg_numamem(void)

 static void test_acpi_q35_kvm_xapic(void)
 {
-    test_data data;
+    test_data data = {};

-    memset(&data, 0, sizeof(data));
    data.machine = MACHINE_Q35;
    data.variant = ".xapic";
    test_acpi_one(" -object memory-backend-ram,id=ram0,size=128M"
@ -1291,9 +1269,8 @@ static void test_acpi_q35_kvm_xapic(void)

 static void test_acpi_q35_tcg_nosmm(void)
 {
-    test_data data;
+    test_data data = {};

-    memset(&data, 0, sizeof(data));
    data.machine = MACHINE_Q35;
    data.variant = ".nosmm";
    test_acpi_one("-machine smm=off", &data);
@ -1302,9 +1279,8 @@ static void test_acpi_q35_tcg_nosmm(void)

 static void test_acpi_q35_tcg_smm_compat(void)
 {
-    test_data data;
+    test_data data = {};

-    memset(&data, 0, sizeof(data));
    data.machine = MACHINE_Q35;
    data.variant = ".smm-compat";
    test_acpi_one("-global ICH9-LPC.smm-compat=on", &data);
@ -1313,9 +1289,8 @@ static void test_acpi_q35_tcg_smm_compat(void)

 static void test_acpi_q35_tcg_smm_compat_nosmm(void)
 {
-    test_data data;
+    test_data data = {};

-    memset(&data, 0, sizeof(data));
    data.machine = MACHINE_Q35;
    data.variant = ".smm-compat-nosmm";
    test_acpi_one("-global ICH9-LPC.smm-compat=on -machine smm=off", &data);
@ -1324,9 +1299,8 @@ static void test_acpi_q35_tcg_smm_compat_nosmm(void)

 static void test_acpi_q35_tcg_nohpet(void)
 {
-    test_data data;
+    test_data data = {};

-    memset(&data, 0, sizeof(data));
    data.machine = MACHINE_Q35;
    data.machine_param = ",hpet=off";
    data.variant = ".nohpet";
@ -1336,9 +1310,8 @@ static void test_acpi_q35_tcg_nohpet(void)

 static void test_acpi_q35_kvm_dmar(void)
 {
-    test_data data;
+    test_data data = {};

-    memset(&data, 0, sizeof(data));
    data.machine = MACHINE_Q35;
    data.variant = ".dmar";
    test_acpi_one("-machine kernel-irqchip=split -accel kvm"
@ -1348,9 +1321,8 @@ static void test_acpi_q35_kvm_dmar(void)

 static void test_acpi_q35_tcg_ivrs(void)
 {
-    test_data data;
+    test_data data = {};

-    memset(&data, 0, sizeof(data));
    data.machine = MACHINE_Q35;
    data.variant = ".ivrs";
    data.tcg_only = true,
@ -1360,9 +1332,8 @@ static void test_acpi_q35_tcg_ivrs(void)

 static void test_acpi_piix4_tcg_numamem(void)
 {
-    test_data data;
+    test_data data = {};

-    memset(&data, 0, sizeof(data));
    data.machine = MACHINE_PC;
    data.variant = ".numamem";
    test_acpi_one(" -object memory-backend-ram,id=ram0,size=128M"
@ -1379,7 +1350,7 @@ static void test_acpi_tcg_tpm(const char *machine, const char *tpm_if,
                                          machine, tpm_if);
    char *tmp_path = g_dir_make_tmp(tmp_dir_name, NULL);
    TPMTestState test;
-    test_data data;
+    test_data data = {};
    GThread *thread;
    const char *suffix = tpm_version == TPM_VERSION_2_0 ? "tpm2" : "tpm12";
    char *args, *variant = g_strdup_printf(".%s.%s", tpm_if, suffix);
@ -1399,7 +1370,6 @@ static void test_acpi_tcg_tpm(const char *machine, const char *tpm_if,
    thread = g_thread_new(NULL, tpm_emu_ctrl_thread, &test);
    tpm_emu_test_wait_cond(&test);

-    memset(&data, 0, sizeof(data));
    data.machine = machine;
    data.variant = variant;

@ -1434,9 +1404,8 @@ static void test_acpi_q35_tcg_tpm12_tis(void)

 static void test_acpi_tcg_dimm_pxm(const char *machine)
 {
-    test_data data;
+    test_data data = {};

-    memset(&data, 0, sizeof(data));
    data.machine = machine;
    data.variant = ".dimmpxm";
    test_acpi_one(" -machine nvdimm=on,nvdimm-persistence=cpu"
@ -1504,7 +1473,6 @@ static void test_acpi_virt_tcg_memhp(void)

 static void test_acpi_microvm_prepare(test_data *data)
 {
-    memset(data, 0, sizeof(*data));
    data->machine = "microvm";
    data->required_struct_types = NULL; /* no smbios */
    data->required_struct_types_len = 0;
@ -1513,7 +1481,7 @@ static void test_acpi_microvm_prepare(test_data *data)

 static void test_acpi_microvm_tcg(void)
 {
-    test_data data;
+    test_data data = {};

    test_acpi_microvm_prepare(&data);
    test_acpi_one(" -machine microvm,acpi=on,ioapic2=off,rtc=off",
@ -1523,7 +1491,7 @@ static void test_acpi_microvm_tcg(void)

 static void test_acpi_microvm_usb_tcg(void)
 {
-    test_data data;
+    test_data data = {};

    test_acpi_microvm_prepare(&data);
    data.variant = ".usb";
@ -1534,7 +1502,7 @@ static void test_acpi_microvm_usb_tcg(void)

 static void test_acpi_microvm_rtc_tcg(void)
 {
-    test_data data;
+    test_data data = {};

    test_acpi_microvm_prepare(&data);
    data.variant = ".rtc";
@ -1545,7 +1513,7 @@ static void test_acpi_microvm_rtc_tcg(void)

 static void test_acpi_microvm_pcie_tcg(void)
 {
-    test_data data;
+    test_data data = {};

    test_acpi_microvm_prepare(&data);
    data.variant = ".pcie";
@ -1557,7 +1525,7 @@ static void test_acpi_microvm_pcie_tcg(void)

 static void test_acpi_microvm_ioapic2_tcg(void)
 {
-    test_data data;
+    test_data data = {};

    test_acpi_microvm_prepare(&data);
    data.variant = ".ioapic2";
@ -1622,9 +1590,8 @@ static void test_acpi_virt_tcg_pxb(void)

 static void test_acpi_tcg_acpi_hmat(const char *machine)
 {
-    test_data data;
+    test_data data = {};

-    memset(&data, 0, sizeof(data));
    data.machine = machine;
    data.variant = ".acpihmat";
    test_acpi_one(" -machine hmat=on"
@ -1721,9 +1688,8 @@ static void test_acpi_virt_tcg_acpi_hmat(void)

 static void test_acpi_q35_tcg_acpi_hmat_noinitiator(void)
 {
-    test_data data;
+    test_data data = {};

-    memset(&data, 0, sizeof(data));
    data.machine = MACHINE_Q35;
    data.variant = ".acpihmat-noinitiator";
    test_acpi_one(" -machine hmat=on"
@ -1772,9 +1738,8 @@ static void test_acpi_erst(const char *machine)
 {
    gchar *tmp_path = g_dir_make_tmp("qemu-test-erst.XXXXXX", NULL);
    gchar *params;
-    test_data data;
+    test_data data = {};

-    memset(&data, 0, sizeof(data));
    data.machine = machine;
    data.variant = ".acpierst";
    params = g_strdup_printf(
@ -1802,7 +1767,7 @@ static void test_acpi_microvm_acpi_erst(void)
 {
    gchar *tmp_path = g_dir_make_tmp("qemu-test-erst.XXXXXX", NULL);
    gchar *params;
-    test_data data;
+    test_data data = {};

    test_acpi_microvm_prepare(&data);
    data.variant = ".pcie";
@ -2003,10 +1968,9 @@ static void test_oem_fields(test_data *data)

 static void test_acpi_piix4_oem_fields(void)
 {
-    test_data data;
    char *args;
+    test_data data = {};

-    memset(&data, 0, sizeof(data));
    data.machine = MACHINE_PC;
    data.required_struct_types = base_required_struct_types;
    data.required_struct_types_len = ARRAY_SIZE(base_required_struct_types);
@ -2022,10 +1986,9 @@ static void test_acpi_piix4_oem_fields(void)

 static void test_acpi_q35_oem_fields(void)
 {
-    test_data data;
    char *args;
+    test_data data = {};

-    memset(&data, 0, sizeof(data));
    data.machine = MACHINE_Q35;
    data.required_struct_types = base_required_struct_types;
    data.required_struct_types_len = ARRAY_SIZE(base_required_struct_types);
@ -2041,7 +2004,7 @@ static void test_acpi_q35_oem_fields(void)

 static void test_acpi_microvm_oem_fields(void)
 {
-    test_data data;
+    test_data data = {};
    char *args;

    test_acpi_microvm_prepare(&data);
--- a/ui/vnc.c
+++ b/ui/vnc.c
@ -3751,7 +3751,7 @@ static int vnc_display_get_address(const char *addrstr,

        addr->type = SOCKET_ADDRESS_TYPE_INET;
        inet = &addr->u.inet;
-        if (addrstr[0] == '[' && addrstr[hostlen - 1] == ']') {
+        if (hostlen && addrstr[0] == '[' && addrstr[hostlen - 1] == ']') {
            inet->host = g_strndup(addrstr + 1, hostlen - 2);
        } else {
            inet->host = g_strndup(addrstr, hostlen);
--- a/util/qemu-coroutine.c
+++ b/util/qemu-coroutine.c
@ -127,9 +127,13 @@ void qemu_aio_coroutine_enter(AioContext *ctx, Coroutine *co)
        Coroutine *to = QSIMPLEQ_FIRST(&pending);
        CoroutineAction ret;

-        /* Cannot rely on the read barrier for to in aio_co_wake(), as there are
-         * callers outside of aio_co_wake() */
-        const char *scheduled = qatomic_mb_read(&to->scheduled);
+        /*
+         * Read to before to->scheduled; pairs with qatomic_cmpxchg in
+         * qemu_co_sleep(), aio_co_schedule() etc.
+         */
+        smp_read_barrier_depends();
+
+        const char *scheduled = qatomic_read(&to->scheduled);

        QSIMPLEQ_REMOVE_HEAD(&pending, co_queue_next);