Gate everything with TCG enabled to at least get them out of the way to
enable --disable-tcg.
As a note for the future: other archs have distincts gdbstub files for
each accelerator. There's a strong case for RISC-V to do the same.
Signed-off-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Message-ID: <20260703180538.3346781-20-daniel.barboza@oss.qualcomm.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
riscv_cpu_register_csr_qtest_callback(), vcsr_call() and
csr_qtest_callback() are all TCG only and are not available in
--disable-tcg builds.
Signed-off-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Message-ID: <20260703180538.3346781-19-daniel.barboza@oss.qualcomm.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
target/riscv/cpu.c: filter TCG only bits in riscv_cpu_reset_hold()
We have a lot of TCG only initialization in the common cpu_reset_hold
callback that prevents --disable-tcg to work.
Put a CONFIG_TCG ifdef around those bits to make the build work.
Eventually we'll create a TCG specific reset function in tcg-cpu.c but
for now this suffices.
Signed-off-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20260703180538.3346781-18-daniel.barboza@oss.qualcomm.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
target/riscv: gate riscv_cpu_update_mip with tcg_enabled()
riscv_cpu_update_mip() is a TCG only call. Its KVM equivalent is
kvm_riscv_set_irq(). cpu.c gates the KVM only function with a
kvm_enabled() check, making it unavailable for TCG only builds. We need
to do the same for riscv_cpu_update_mip() otherwise a KVM only build
will fail because it doesn't know what this function is.
Use tcg_enabled() for the couple of riscv_cpu_update_mip() calls we have
unguarded in cpu.c.
We have way more calls to deal with in time_helper.c which isn't using
kvm_riscv_set_irq() at all, so create a riscv_accel_set_irq() local
helper that will choose whether to use the KVM or TCG API.
The reason we're going through all this hassle in time_helper.c is
because hw/int/riscv_aclint.c uses it, and if we don't do something
about we won't have riscv_aclint working for KVM. Whether this is a
real problem or not and we should remove aclint support for KVM is
question for another day.
Signed-off-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20260703180538.3346781-17-daniel.barboza@oss.qualcomm.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
target/riscv/cpu.c: handle TCG bits of riscv_cpu_dump_state
riscv_dump_csr() is a TCG only function but we'll have to implement it
at some capacity for KVM eventually, therefore put it under a CONFIG_TCG
ifdef while making a note that this function is unimplemented in KVM.
The csr_ops array is also TCG specific, thus the for loop inside
dump_state that iterates it is also TCG only business.
Signed-off-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Message-ID: <20260703180538.3346781-16-daniel.barboza@oss.qualcomm.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
target/riscv: move riscv_cpu_claim_interrupts to cpu.c
The function is used by hw/intc/ files that KVM cares about like
riscv_aplic.c. Move it to cpu.c to be accessible for --disable-tcg
builds.
Signed-off-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20260703180538.3346781-15-daniel.barboza@oss.qualcomm.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
riscv_cpu_has_work() uses a handful of irq pending functions from
cpu_helper.c. There is a very high possibility that KVM doesn't need
the current implermentation of has_work(), but the common accel code
needs an implementation of this callback (see cpu_exec_class_post_init)
otherwise the KVM driver won't initialize.
Move the relevant irq helpers to cpu.c to allow KVM to keep using the
current has_work implementation, allowing --disable-tcg to work. We'll
circle it back to evaluate a proper KVM implementation for it in a later
date.
Signed-off-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20260703180538.3346781-14-daniel.barboza@oss.qualcomm.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
target/riscv: move riscv_cpu_set_nmi() to tcg-cpu.c
This function is related to Smrnmi and non-masked interrupts, firing up
interrupts via env->rnmip from riscv_cpu_local_irq_pending().
This is all TCG only code.
Signed-off-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20260703180538.3346781-13-daniel.barboza@oss.qualcomm.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
We have a couple of CPUs that has a set of custom CSRs that uses TCG
specific APIs. Move the related code to tcg-cpu.c and do not set
.custom_csrs if we're not in a TCG build.
What we'll end up doing, sooner or later, is punting all these CPUs to
tcg-cpu.c since they're all TCG specific and KVM has nothing to do with
them. Another time.
Signed-off-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20260703180538.3346781-12-daniel.barboza@oss.qualcomm.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
After KVM is no longer reliant on csr.h move it to the TGC only land.
Signed-off-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20260703180538.3346781-11-daniel.barboza@oss.qualcomm.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Move riscv_new_csr_seed from csr.c to cpu.c since this function is
shared with KVM. With that we can remove the csr.h from kvm-cpu.c.
Signed-off-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20260703180538.3346781-10-daniel.barboza@oss.qualcomm.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
riscv_trigger_* APIs are TCG only. Wrap the usages we have of them
in cpu.c with CONFIG_TCG.
After that we can move the header to the tcg subdir. This will be
enough to get this out of the way for the --disable-tcg build.
Signed-off-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20260703180538.3346781-9-daniel.barboza@oss.qualcomm.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
monitor_get_register at this moment has a TCG exclusive implementation
for RISC-V, even though the callback is supposed to be arch independent.
Until we address how KVM is going to implement it we need to filter it out
in cpu.c.
Same goes for get_phys_addr_debug - it has a TCG only implementation and
KVM can't use it for now. It would also need to be filtered out, but
since we're at it, let's convert it to the newer 'translate_for_debug'
API too. Same restrictions apply.
Suggested-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Signed-off-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Message-ID: <20260703180538.3346781-8-daniel.barboza@oss.qualcomm.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Chao Liu <chao.liu.zevorn@gmail.com>
Message-ID: <20260703180538.3346781-7-daniel.barboza@oss.qualcomm.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
target/riscv/machine.c: do not migrate pmp state with kvm
The PMP emulation isn't present in the KVM driver.
Signed-off-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20260703180538.3346781-6-daniel.barboza@oss.qualcomm.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
We have *way* too much TCG-only code hanging around in target/riscv,
where ideally we would have things that are shared between accelerators.
We'll follow the example of other targets like i386 and loongarch and
move everything to the tcg subir. This will not only cleanup target/riscv
but it will also expose what is common code but it's buried inside a TCG
helper.
We're leaving some stuff behind because these require a little more
case to not end up breaking KVM. We'll take care of them next.
Signed-off-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Chao Liu <chao.liu.zevorn@gmail.com>
Message-ID: <20260703180538.3346781-5-daniel.barboza@oss.qualcomm.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
hw/riscv, target/riscv: move pmu fdt function to fdt-common.c
riscv_pmu_generate_fdt_node() can be moved to fdt_common.c since it has
no PMU TCG internals.
Signed-off-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Message-ID: <20260703180538.3346781-4-daniel.barboza@oss.qualcomm.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
target/riscv: move valid_vm_* satp arrays to cpu.c
These satp arrays are used internally in both csr.c and in cpu.c. csr.c
is going to be moved to the TCG subdir in the next patch, and we want
the satp logic to be available for KVM with --disable-tcg builds.
Move these arrays to cpu.c to keep them available for KVM with
--disable-tcg.
Signed-off-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Message-ID: <20260703180538.3346781-3-daniel.barboza@oss.qualcomm.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Zephyr Li [Fri, 3 Jul 2026 18:05:13 +0000 (15:05 -0300)]
target/riscv: Remove unused tcg/tcg.h include
Signed-off-by: Zephyr Li <fritchleybohrer@gmail.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com> Reviewed-by: Chao Liu <chao.liu.zevorn@gmail.com>
Message-ID: <20260703180538.3346781-2-daniel.barboza@oss.qualcomm.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
hw/riscv/riscv-iommu.c: fault when !PTE_U and no priv access
All IOMMU accesses are assumed to be user mode unless told otherwise,
i.e. we have a process_id. In case we have a non-user mode leaf PTE
(PTE_U isn't set) and we are running in user mode, we need to throw a
fault.
This also reflects on qos-riscv-iommu tests: the tests always run in
user mode so our PTEs must have PTE_U (bit 0x10) set.
Fixes: 0c54acb8243d ("hw/riscv: add RISC-V IOMMU base emulation")
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3553 Signed-off-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com> Reviewed-by: Nutty Liu <nutty.liu@hotmail.com> Reviewed-by: Chao Liu <chao.liu.zevorn@gmail.com>
Message-ID: <20260701121111.537654-3-daniel.barboza@oss.qualcomm.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
hw/riscv/riscv-iommu.c: fix fault type for spa_fetch() faults
Under certain circunstances, like the one described in [1] and [2],
a read operation that faults will be logged as a write fault instead,
and vice-versa, if they happen after the translation phase in
riscv_iommu_spa_fetch().
The first problem is that we're overwriting iotlb->perm with PTE flags,
so an IOMMU_RO access flag can be overwritten by whatever flags
the PTE has. This will cause the wrong fault type to be thrown at
the end of the function in case a fault happens.
To solve the iotlb->perm overwrite we'll bit_and the original
iotlb->perm access flags with the PTE access flags, preserving the
original access type. So a IOMMU_RO access in a R+W PTE will result in
a IOMMU_RO perm.
Second, the resulting fault is received by riscv_iommu_translate(), which
will then report the fault. To do that we require a transaction type
(ttype). We're prioritizing checking "perm & IOMMU_RW" to set a
UADDR_WR ttype, and then checking "perm & IOMMU_RO" to set UADDR_RD
ttype. The issue with that is IOMMU_RO=1 and IOMMU_RW=3, thus checking
"perm & IOMMU_RW" for a write then "perm & IOMMU_RO" for a read will
cause the read fault to always be diagnosed as write.
Make the iotlb->perm matches more strict: "perm & IOMMU_RW" must be
exactly IOMMU_RW, ensuring that 'perm' has both flags. Then we can
check perm & IOMMU_WO and perm & IOMMU_RO without worrying about
overlapping with the RW flag.
Jia Jia [Sun, 31 May 2026 01:34:52 +0000 (09:34 +0800)]
hw/ufs: avoid double unref of wrapped scsi-hd
ufs_init_scsi_device() creates an internal scsi-hd and adds it as a
child of lu->bus. qdev_realize_and_unref() then drops the construction
reference, leaving the bus child ownership to tear it down.
ufs_lu_unrealize() still unrefs lu->scsi_dev directly. If the UFS
controller is ejected through ACPI PCI hotplug, the scsi-hd object can be
finalized there and then the bus child removal RCU callback later unrefs
the same object again.
Keep lu->scsi_dev as a borrowed pointer and clear it during unrealize
without unreffing it.
Add a qtest that ejects the UFS controller through the x86 ACPI PCI
hotplug eject register. On an ASAN build, the test reproduces the UAF
before the fix.
Fixes: 096434fea13a ("hw/ufs: Modify lu.c to share codes with SCSI subsystem") Cc: qemu-stable@nongnu.org Signed-off-by: Jia Jia <physicalmtea@gmail.com> Signed-off-by: Jeuk Kim <jeuk20.kim@samsung.com>
tests/lcitool/refresh: use raw string literal for trailers
Using a list of string is not convenient, as users need to escape it
manually and handle end of lines. By using a raw string literal,
what you see is what you get.
Stefan Hajnoczi [Wed, 8 Jul 2026 14:00:20 +0000 (16:00 +0200)]
Merge tag 'pull-tcg-20260707' of https://gitlab.com/rth7680/qemu into staging
tcg/loongarch64: Fix cmp_vec with TCG_COND_NE
tcg/x86_64: declare MO_ATOM_WITHIN16 host atomicity support
accel/tcg: Make PageFlagsNodes' start and last immutable
accel/tcg: Use TLB_FORCE_SLOW not TLB_MMIO for user-only plugins
* tag 'pull-tcg-20260707' of https://gitlab.com/rth7680/qemu:
tcg/loongarch64: Fix cmp_vec with TCG_COND_NE
tcg/x86_64: declare MO_ATOM_WITHIN16 host atomicity support
Revert "tests/tcg: skip the vma-pthread test on CI"
tests/tcg/multiarch: Improve mutator randomness
accel/tcg: Make PageFlagsNodes' start and last immutable
accel/tcg: Use TLB_FORCE_SLOW not TLB_MMIO for user-only plugins
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
In do_ioctl_dm() we work with a struct dm_ioctl from the guest. This
has a fixed initial part, and then a variable data part; the guest
tells us how long that part is by setting the data_size field. The
data_size is supposed to include the length of the fixed parts of the
struct dm_ioctl. Currently we don't validate anything about the
guest-provided data_size, and we use it to allocate a buffer which we
then copy the fixed part of the dm_ioctl struct into. This means
that if the guest passes a very small data_size the copy of the fixed
part will overrun the buffer.
Perform the same sanitizing of the minimum and maximum limits of the
data_size that the kernel does in drivers/md/dm-ioctl.c in the
copy_params() function.
Randy Schifflin [Mon, 29 Jun 2026 21:49:13 +0000 (14:49 -0700)]
target/sh4: fixup tcg for sh4 fipr/ftrv instructions
Fixes TCG generation for sh4 `fipr` and `ftrv` instructions.
Updates the current logic for these instructions to check the
FPSCR register appropriately (according to the sh4 cpu manual, `fipr`
and `ftrv` are only defined when the FPSCR register PR flag is 0).
Also fixes the mth/nth-vector operands by multiplying by 4 to convert
to the correct floating point register offset.
Signed-off-by: Randy Schifflin <randy.schifflin@gmail.com> Reviewed-by: Yoshinori Sato <yoshinori.sato@nifty.com>
Message-ID: <20260629-fixup-sh4-tcg-fpu-instructions-b4-v1-2-4356b305f971@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
James Hilliard [Mon, 8 Jun 2026 18:59:46 +0000 (12:59 -0600)]
tests/tcg/mips: cover Octeon QMAC instructions
Add smoke coverage for Octeon QMAC and QMACS fixed-point accumulator
instruction paths.
The coverage exercises normal accumulation, saturating accumulation, and
the sticky saturation flag.
Signed-off-by: James Hilliard <james.hilliard1@gmail.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260608-mips-octeon-missing-insns-v2-v16-21-daef7a0d8b04@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
James Hilliard [Mon, 8 Jun 2026 18:59:45 +0000 (12:59 -0600)]
target/mips: add Octeon CvmCount RDHWR support
Octeon exposes CvmCount through RDHWR register 31. Add the Octeon-only
decode path, enable the corresponding HWREna bit for linux-user, and use
an unsigned mask when checking HWREna so bit 31 is handled safely.
For user-mode emulation, return host ticks as a monotonic counter source
suitable for existing Octeon userspace code. In system mode, fall back to
the existing CP0 Count value.
Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Message-ID: <20260608-mips-octeon-missing-insns-v2-v16-20-daef7a0d8b04@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
James Hilliard [Mon, 8 Jun 2026 18:59:44 +0000 (12:59 -0600)]
target/mips: decode Octeon CHORD and LLM COP2 selectors
Add explicit decodetree entries and translator bindings for the Octeon
CHORD and sparse LLM COP2 selectors. CHORD and LLM use their own COP2
selector window rather than the crypto engine windows covered by the
preceding decode patches.
This completes the explicit COP2 selector coverage by adding the
remaining CHORD and LLM register and operation selectors.
Signed-off-by: James Hilliard <james.hilliard1@gmail.com> Acked-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260608-mips-octeon-missing-insns-v2-v16-19-daef7a0d8b04@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Add explicit decodetree entries and translator bindings for the Octeon
AES, SMS4, 3DES, KASUMI, and Camellia COP2 operation selectors. These
selectors consume or update engine state, so keep them as per-operation
helper calls while the simple block-cipher register moves remain direct
TCG loads and stores from the earlier register-selector patch.
This completes the block-cipher selector coverage without reintroducing a
generic runtime selector dispatch path.
Signed-off-by: James Hilliard <james.hilliard1@gmail.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260608-mips-octeon-missing-insns-v2-v16-18-daef7a0d8b04@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
James Hilliard [Mon, 8 Jun 2026 18:59:42 +0000 (12:59 -0600)]
target/mips: decode Octeon ZUC and SNOW3G COP2 selectors
Add explicit decodetree entries and translator bindings for the Octeon
ZUC and SNOW3G COP2 operation selectors. These stream-cipher selectors
operate on the shared HSH register window state, so dispatch them through
the per-operation helpers added with the corresponding engine support.
Keep stream-cipher decode separate because these selectors share the HSH
register window with unrelated engines.
Signed-off-by: James Hilliard <james.hilliard1@gmail.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260608-mips-octeon-missing-insns-v2-v16-17-daef7a0d8b04@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
James Hilliard [Mon, 8 Jun 2026 18:59:41 +0000 (12:59 -0600)]
target/mips: decode Octeon HSH and SHA3 COP2 selectors
Add explicit decodetree entries and translator bindings for the Octeon
HSH shared-window selectors and SHA3 operation selectors. Simple SHA3 DAT
register moves and XORDAT selectors use direct TCG transfers, while HSH
operation selectors and SHA3 STARTOP remain helper-backed for their
visible side effects.
Keep HSH/SHA3 decode separate from direct register transfers because the
shared hash-window aliases and side-effecting operations need their own
selector coverage.
Signed-off-by: James Hilliard <james.hilliard1@gmail.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260608-mips-octeon-missing-insns-v2-v16-16-daef7a0d8b04@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
James Hilliard [Mon, 8 Jun 2026 18:59:40 +0000 (12:59 -0600)]
target/mips: decode Octeon CRC and GFM COP2 selectors
Add explicit decodetree entries and translator bindings for the Octeon
CRC and GFM COP2 operation selectors. Unlike simple register moves,
these selectors update CRC or Galois-field state and therefore remain
per-operation helper calls.
Keep CRC/GFM decode next to the helpers that implement these side
effects while avoiding a monolithic selector-dispatch helper.
Signed-off-by: James Hilliard <james.hilliard1@gmail.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260608-mips-octeon-missing-insns-v2-v16-15-daef7a0d8b04@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Add explicit decodetree entries and translator bindings for Octeon
DMFC2/DMTC2 selectors that are simple COP2 register transfers.
Emit direct TCG loads and stores for register moves. Use signed 32-bit
loads for 32-bit DMFC2 readback and mask narrow writable fields such as
AESKEYLEN and CRCLEN on DMTC2.
Keep operation selectors with side effects in later functional decode
patches.
Signed-off-by: James Hilliard <james.hilliard1@gmail.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260608-mips-octeon-missing-insns-v2-v16-14-daef7a0d8b04@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
James Hilliard [Mon, 8 Jun 2026 18:59:38 +0000 (12:59 -0600)]
target/mips: add Octeon CHORD and LLM COP2 helpers
Add the Octeon CHORD hardware register access path and the LLM 36-bit
and 64-bit read and write windows. Model both CHORD access forms,
including the RDHWR $30 path and the legacy DMFC2 alias.
Implement sparse backing storage for the two LLM sets so user-mode code
can save, restore, and probe the architectural state without allocating a
full hardware-sized backing array.
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Message-ID: <20260608-mips-octeon-missing-insns-v2-v16-13-daef7a0d8b04@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
James Hilliard [Mon, 8 Jun 2026 18:59:37 +0000 (12:59 -0600)]
target/mips: add Octeon HSH COP2 helpers
Add helper support for the Octeon HSH hash selectors. This includes the
base HSH data/IV windows, MD5, SHA1, SHA256, and SHA512 transform paths,
and the shared HSH/SHA512 register-window readback and write operations.
The SHA512 path shares the wide HSH register bank with SHA3, SNOW3G, and
ZUC. Keep the aliased readback and write paths centralized so selector
decode can route register accesses through these helpers when side
effects are required.
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Message-ID: <20260608-mips-octeon-missing-insns-v2-v16-12-daef7a0d8b04@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
James Hilliard [Mon, 8 Jun 2026 18:59:36 +0000 (12:59 -0600)]
target/mips: add Octeon Camellia COP2 helpers
Add helper support for the Octeon Camellia ROUND, FL, and FLINV
selectors. The engine reuses the AES RESINP bank, and guest-managed key
schedules drive the Camellia F-function and FL layers through these COP2
operations.
Implement the Camellia F-function and FL layers directly from RFC 3713.
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Message-ID: <20260608-mips-octeon-missing-insns-v2-v16-11-daef7a0d8b04@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
James Hilliard [Mon, 8 Jun 2026 18:59:35 +0000 (12:59 -0600)]
target/mips: add Octeon 3DES and KASUMI COP2 helpers
Add helper support for the Octeon 3DES and KASUMI operation selectors.
The 3DES helpers implement ECB and CBC encrypt/decrypt over the shared
3DES key, IV, and result bank. KASUMI reuses the same register bank and
adds its own encrypt selectors.
Only the operation selectors require helper code. Simple key, IV, and
result register transfers are handled by direct selector decode.
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Message-ID: <20260608-mips-octeon-missing-insns-v2-v16-10-daef7a0d8b04@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
James Hilliard [Mon, 8 Jun 2026 18:59:34 +0000 (12:59 -0600)]
target/mips: add Octeon SMS4 COP2 helpers
Add helper support for the Octeon SMS4 operation selectors. SMS4 reuses
the AES RESINP, IV, and key banks, so the helpers share the existing AES
state while implementing the SMS4 ECB/CBC encrypt and decrypt operations.
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Message-ID: <20260608-mips-octeon-missing-insns-v2-v16-9-daef7a0d8b04@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
James Hilliard [Mon, 8 Jun 2026 18:59:33 +0000 (12:59 -0600)]
target/mips: add Octeon AES COP2 helpers
Add helper support for the Octeon AES operation selectors. Direct
register-transfer selectors do not need helpers; the ECB/CBC encrypt and
decrypt operations consume the AES input, key, IV, and key-length state.
AESRESINP is modeled as one architectural register bank; operation
helpers consume the current AESRESINP block and write the result back to
the same bank.
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Message-ID: <20260608-mips-octeon-missing-insns-v2-v16-8-daef7a0d8b04@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
James Hilliard [Mon, 8 Jun 2026 18:59:32 +0000 (12:59 -0600)]
target/mips: add Octeon SNOW3G COP2 helpers
Add helper support for the Octeon SNOW3G START and MORE selectors. The
engine state and result are represented through the architectural HSH IV
and DAT register banks that SNOW3G aliases for save and restore.
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Message-ID: <20260608-mips-octeon-missing-insns-v2-v16-7-daef7a0d8b04@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
James Hilliard [Mon, 8 Jun 2026 18:59:31 +0000 (12:59 -0600)]
target/mips: add Octeon ZUC COP2 helpers
Add the Octeon ZUC START and MORE helper operations and model the shared
state window used by the hardware interface. This covers the keystream
and MAC engine state, including the save-and-restore view that overlaps
the HSH/SHA3 bank.
Keep the LFSR words in the architectural HSH DAT input registers and the
runtime MAC/FSM/result state in the documented HASHIV window. The third
MAC lookahead word is generated on demand instead of being kept in a
non-architectural shadow slot.
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Message-ID: <20260608-mips-octeon-missing-insns-v2-v16-6-daef7a0d8b04@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Andrew Jones [Tue, 7 Jul 2026 12:28:19 +0000 (14:28 +0200)]
tcg/x86_64: declare MO_ATOM_WITHIN16 host atomicity support
Just like aarch64's prepare_host_addr(), x86_64 should use
MO_ATOM_WITHIN16 for the memop when it's capable. Unlike aarch64,
which needs to check a CPU feature, x86 has been capable since P6
family processors and newer (see Intel SDM Vol. 3 §11.1.1).
Since a 16-byte aligned region always fits within a 16-byte multiple
sized cache line (x86_64 implementations always have cache lines of
at least 64 bytes), then this enables riscv cpu models with Zama16b
to use the fast path, just as cpu models without Zama16b do.
Cc: LIU Zhiwei <zhiwei_liu@linux.alibaba.com> Signed-off-by: Andrew Jones <andrew.jones@oss.qualcomm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
[rth: Update both atom_and_align_for_opc calls] Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260707122819.114105-1-andrew.jones@oss.qualcomm.com>
James Hilliard [Mon, 8 Jun 2026 18:59:30 +0000 (12:59 -0600)]
target/mips: add Octeon SHA3 COP2 helpers
Add the Octeon SHA3 helper operations for the architectural 25-lane
Keccak state view and implement the Keccak-f[1600] permutation used by
the STARTOP selector.
The simple SHA3 DAT register moves and XORDAT selectors are decoded as
direct TCG transfers in the selector decode patch. This helper patch only
keeps the side-effecting SHA3 operation support.
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Message-ID: <20260608-mips-octeon-missing-insns-v2-v16-5-daef7a0d8b04@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
James Hilliard [Mon, 8 Jun 2026 18:59:29 +0000 (12:59 -0600)]
target/mips: add Octeon GFM COP2 helpers
Add helper support for the Octeon GFM carryless multiply selectors. This
models the normal and reflected multiplication paths, including the
XOR-and-multiply forms that update the result/input state used by Octeon
crypto code.
Reflected selectors operate on the architectural GFM register bank using
bit-reflected register transfers rather than a separate shadow state.
Keep the 64-bit UIA2 reduction path used by SNOW3G F9 and share that
shortcut between the normal and reflected XORMUL1 paths.
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Message-ID: <20260608-mips-octeon-missing-insns-v2-v16-4-daef7a0d8b04@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
James Hilliard [Mon, 8 Jun 2026 18:59:28 +0000 (12:59 -0600)]
target/mips: add Octeon CRC COP2 helpers
Add helper support for the Octeon COP2 CRC register interface. This
covers normal and reflected CRC state handling, byte/halfword/word/
doubleword/variable-width update selectors, and the reflected IV readback
operation.
Register moves that can be represented as direct TCG loads/stores do not
need helpers. Add only the side-effecting CRC helper implementation here.
Signed-off-by: James Hilliard <james.hilliard1@gmail.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260608-mips-octeon-missing-insns-v2-v16-3-daef7a0d8b04@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Add the Octeon COP2 crypto helper source file and build it with the MIPS
TCG target. This provides the common compilation unit for the COP2 engine
helpers.
The instruction dispatch itself remains fully decoded by decodetree, and
operation selectors call per-operation helpers rather than a common
selector-dispatch helper.
Signed-off-by: James Hilliard <james.hilliard1@gmail.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260608-mips-octeon-missing-insns-v2-v16-2-daef7a0d8b04@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
James Hilliard [Mon, 8 Jun 2026 18:59:26 +0000 (12:59 -0600)]
target/mips: add Octeon COP2 crypto state
Add the common architectural state needed by Octeon's selector-driven
COP2 crypto interfaces. This includes storage for the base hash, AES,
CRC, GFM, 3DES, KASUMI, and overlapping HSH/SHA512/SHA3/SNOW3G/ZUC
selector windows.
Keep selector values and helper-local aliasing logic out of the CPU state
header so the state definition remains limited to architectural storage.
Helper code uses the same register banks instead of adding
non-architectural shadow state. Model the SHA3 view as a direct 25-lane
alias of the architectural HSH DAT/IV/SHA3_DAT24 storage.
Migrate the state in an Octeon-only subsection so non-Octeon CPU models
do not grow migration data.
Signed-off-by: James Hilliard <james.hilliard1@gmail.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260608-mips-octeon-missing-insns-v2-v16-1-daef7a0d8b04@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
accel/tcg: Make PageFlagsNodes' start and last immutable
page_check_range() may race with pageflags_set_clear() as follows:
T1 T2
------------------------------------- --------------------------------
p = pageflags_find(start, last);
interval_tree_remove(&p->itree, ...);
p->itree.start = last + 1;
if (start < p->itree.start) {
ret = false;
interval_tree_insert(&p->itree, ...);
leading to errors like
fail indirect write 0x72f0a659aff0 (Bad address)
in vma-pthread test. I am able to reliably reproduce this on a machine
with 32 SMT threads as follows in about 25 seconds:
jobs=32; \
seq "$jobs" | \
time -p parallel \
--jobs="$jobs" \
--halt=now,done=1 \
--ungroup \
'
_={};
while ./qemu-s390x tests/tcg/s390x-linux-user/vma-pthread; do
printf .;
done
'
Also wasmtime project reported a similar failure pattern in their CI [1]
with a similar reproducer [2].
There are other races like this. In general, region bounds mutating
underneath the reader are very hard to reason about. So fix this by
preventing mutations and creating copies instead. Use RCU guards in
readers to avoid uses-after-frees.
Now, when the reader finds a node, it may fearlessly access its fields
and be certain that at some point in time the respective region had the
respective bounds and permissions. The downside is slightly more
expensive mprotect(), but complexity reduction is worth it.
Lockless field accesses should probably be wrapped in qatomic_read(),
but this is a pre-existing issue, so do not change it here.
docs: outline some guidelines for security classification
Beyond the overall virt/non-virt use case classification, there are
a number of scenarios which we have decided will not be treated as
security issues. Start to document some of these to give consistency
in our treatment of incoming disclosures.
Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Mauro Matteo Cascella <mcascell@redhat.com> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Stefan Hajnoczi [Tue, 7 Jul 2026 17:19:33 +0000 (19:19 +0200)]
Merge tag 'hw-misc-20260707' of https://github.com/philmd/qemu into staging
Misc HW patches
- MAINTAINERS update
- Fix in few trace event formats
- A pair of improvements in util/
- FlexCAN3 to imx8mp-evk board
- Various fixes in hw/
(EDU, ATI VGA, IDE AHCI, PCA9552, i8257 DMA,
e1000e/igb, MPT SAS, Hyper-V, QXL, M25P80)
Stefan Hajnoczi [Tue, 7 Jul 2026 17:18:55 +0000 (19:18 +0200)]
Merge tag 's390x-20260707' of https://gitlab.com/cohuck/qemu into staging
s390x updates:
- fix some errors when IPLing from PCI devices
- a number of fixes for guest->host error handling
- add ASTFLE facility 2 support (with headers update)
- regenerate s390-ccw.img
# -----BEGIN PGP SIGNATURE-----
#
# iIgEABYKADAWIQRpo7U29cv8ZSCAJsHeiLtWQd5mwQUCakz2uBIcY29odWNrQHJl
# ZGhhdC5jb20ACgkQ3oi7VkHeZsFLFQD9F0Bf7fy1yD1TMRw64iSU56FbBWzCpb9F
# irXWxz9v3mIBANO/yVamhRffubE1DPIk0FVR8gu1jxtAb/tUPnf00oIH
# =QrlD
# -----END PGP SIGNATURE-----
# gpg: Signature made Tue 07 Jul 2026 14:53:12 CEST
# gpg: using EDDSA key 69A3B536F5CBFC65208026C1DE88BB5641DE66C1
# gpg: issuer "cohuck@redhat.com"
# gpg: Good signature from "Cornelia Huck <conny@cornelia-huck.de>" [unknown]
# gpg: aka "Cornelia Huck <cohuck@kernel.org>" [unknown]
# gpg: aka "Cornelia Huck <cornelia.huck@de.ibm.com>" [full]
# gpg: aka "Cornelia Huck <huckc@linux.vnet.ibm.com>" [full]
# gpg: aka "Cornelia Huck <cohuck@redhat.com>" [unknown]
# gpg: WARNING: The key's User ID is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: C3D0 D66D C362 4FF6 A8C0 18CE DECF 6B93 C6F0 2FAF
# Subkey fingerprint: 69A3 B536 F5CB FC65 2080 26C1 DE88 BB56 41DE 66C1
* tag 's390x-20260707' of https://gitlab.com/cohuck/qemu:
pc-bios/s390-ccw.img: update s390x bios
s390x/css: limit number of CHPIDs in description
s390x/ioinst: Require strict length and format for SEI CHSC handler
s390x/pci: Shrink RPCIT ranges to registered window
s390x/pci: Tighten region detection for BAR read/write
s390x/sclp: reject invalid write event data headers
target/s390x: Fix wrong address handling in address loops
s390x/kvm: Add ASTFLE facility 2 for nested virtualization
linux-headers: Update to Linux v7.2-rc1 with KVM_S390_VM_CPU_FEAT_ASTFLEIE2
s390x: Enable boot menu for virtio pci device
pc-bios/s390-ccw: write IPLB location for non-net virtio devices
pc-bios/s390-ccw: Verify virtio support when booting from virtio PCI device on s390x
pc-bios/s390-ccw: Add per-queue notification offset for multi-queue virtio configurations
pc-bios/s390-ccw/virtio.c: Fix missing break for PCI notifications
pc-bios/s390-ccw: Refactor byte swapping
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Stefan Hajnoczi [Tue, 7 Jul 2026 17:18:19 +0000 (19:18 +0200)]
Merge tag 'pull-aspeed-20260707' of https://github.com/legoater/qemu into staging
aspeed queue :
* Fix stale pending interrupts in INTC for level-triggered sources
* Fix intermittent functional test timeouts on boot completion detection
* Fix off-by-one in pca9552 QOM led index validation
* Fix AST2700 FC machine hardware strap settings
* Drop noisy unhandled read logs for AST2700 SCU/SCUIO
* Add SCUIO RNG support for AST2700
* Add unimplemented Privilege Controller and OTP MMIO regions for SSP/TSP
* tag 'pull-aspeed-20260707' of https://github.com/legoater/qemu:
hw/arm/aspeed_ast27x0: Add unimplemented OTP controller MMIO regions for SSP/TSP
hw/arm/aspeed_ast27x0: Add unimplemented Privilege Controller MMIO regions for SSP/TSP
hw/misc/aspeed_scu: Add AST2700 SCUIO RNG control and data registers
hw/misc/aspeed_scu: Drop noisy unhandled read logs for AST2700 SCU/SCUIO
hw/arm/aspeed_ast27x0-fc: Fix hardware strap settings
hw/gpio/pca9552: fix off-by-one in QOM led index validation
tests/functional/aspeed: unify boot completion detection on 'login:' prompt
hw/intc/aspeed: Drop stale pending interrupts
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
# -----BEGIN PGP SIGNATURE-----
#
# iLMEAAEKAB0WIQS4/x2g0v3LLaCcbCxAov/yOSY+3wUCakz1yAAKCRBAov/yOSY+
# 30ghBACjPw9Tv22Qyl3UEImccxWO9opvxq006pkKCRib8et5SdSROzZQHZOre6M8
# jwY3O7nNHem9MyXvzGo6GoDKUo1qmJlrYGydRb9QXeZS/EHdN9OUNm/tHjKnpJdN
# kyvXpv2fT2FnPQ/doGnUHsYCJl6e9gxEsl4iM17F2vaV+VZnCg==
# =NHlN
# -----END PGP SIGNATURE-----
# gpg: Signature made Tue 07 Jul 2026 14:49:12 CEST
# gpg: using RSA key B8FF1DA0D2FDCB2DA09C6C2C40A2FFF239263EDF
# gpg: Good signature from "Song Gao <m17746591750@163.com>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: B8FF 1DA0 D2FD CB2D A09C 6C2C 40A2 FFF2 3926 3EDF
* tag 'pull-loongarch-20260707' of https://github.com/gaosong715/qemu:
MAINTAINERS: add LoongArch's maintainers
MAINTAINERS: update Song Gao's email address
hw/intc/loongarch_dintc: Fix OOB access in DINT MMIO write handler
target/loongarch: Enable TARGET_PAGE_BITS_VARY for loongarch64 user-only
target/loongarch/kvm: fix cpucfg sync error handling
target/loongarch/kvm: remove redundant cpucfg failure traces
target/loongarch/kvm: pass device attr by reference to kvm_vcpu_ioctl
target/loongarch/kvm: fix uninitialized val and unchecked GET in cpucfg2 check
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
* tag 'pull-monitor-2026-07-07' of https://repo.or.cz/qemu/armbru: (35 commits)
docs: mark '-mon' as deprecated in favour of -object
qemu-options: document new monitor-hmp and monitor-qmp objects
tests: switch from -mon to -object monitor-qmp
monitor: add support for auto-deleting monitors upon close
qom: add trace events for user creatable create/delete APIs
tests/functional: add a stress test for monitor hot unplug
tests/functional: add e2e test for dynamic QMP monitor hotplug
tests/qtest: add tests for dynamic monitor add/remove
monitor: implement support for deleting QMP objects
monitor: protect qemu_chr_fe_accept_input with monitor lock
monitor: reject attempts to delete the current monitor
monitor: convert from oneshot BH to persistent BH
monitor: implement "user creatable" interface for adding monitors
monitor: eliminate monitor_is_hmp_non_interactive method
monitor: drop unused monitor_is_qmp method
monitor: use dynamic cast in monitor_is_hmp_non_interactive
monitor: use dynamic cast in QMP commands
monitor: drop unused monitor_cur_is_qmp
util: use dynamic cast in error vreport
monitor: use dynamic cast in monitor_qmp_requests_pop_any_with_lock
...
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Stefan Hajnoczi [Tue, 7 Jul 2026 17:16:58 +0000 (19:16 +0200)]
Merge tag 'pull-vfio-20260707' of https://github.com/legoater/qemu into staging
vfio queue:
* Fixes ROM read issues in vfio/pci: information leak, error
propagation, and uninitialized state
* Validates VERSION replies in vfio-user and updates the spec
for DMA access mode bits
* Merges .dma_map_file() into .dma_map() in the iommufd backend
* Reworks switchover-ack to be re-usable and implements the
VFIO_PRECOPY_INFO_REINIT feature for additional pre-copy
iterations before switchover
* Adds ATS support for passthrough devices via iommufd
* Fixes translated_addr for non-identity-mapped RAM sections in
the VFIO listener
* Reject invalid MSI-X Table and PBA BIR values
* tag 'pull-vfio-20260707' of https://github.com/legoater/qemu: (27 commits)
vfio/pci: Reject invalid MSI-X Table and PBA BIR values
backends/iommufd: Fix dev_id and type order in viommu trace
vfio/listener: Fix translated_addr for non-identity-mapped RAM sections
vfio/pci: Propagate errors in vfio_pci_load_rom() using Error API
vfio/pci: Add ats property
iommufd: Introduce handler for device ATS support
migration: Fix "switchover" used as a verb in comments and docs
migration: Refactor migration_completion_precopy() to return bool
migration: Enable new switchover-ack
vfio/migration: Check VFIO_PRECOPY_INFO_REINIT during switchover
vfio/migration: Implement VFIO_PRECOPY_INFO_REINIT feature
vfio/migration: Add new switchover-ack mechanism
vfio/migration: Add Error ** parameter to vfio_migration_init()
vfio/migration: Extract VFIO_MIG_FLAG_DEV_INIT_DATA_SENT sending to helper
migration: Fail migration if switchover-ack is requested after switchover decision
migration: Make switchover-ack re-usable
migration: Rename switchover-ack code to legacy
migration: Replace switchover_ack_needed SaveVMHandler
migration: Log the approver in qemu_loadvm_approve_switchover()
migration: Run final save_query_pending at switchover
...
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Stefan Hajnoczi [Tue, 7 Jul 2026 17:11:53 +0000 (19:11 +0200)]
Merge tag 'pull-request-2026-07-07' of https://gitlab.com/huth/qemu into staging
* Add test for hotplugging a virtio-scsi disk
* Improve boot completion detection in aspeed tests
* Use QMP to query available machines in functional tests
# -----BEGIN PGP SIGNATURE-----
#
# iQJGBAABCAAwFiEEJ7iIR+7gJQEY8+q5LtnXdP5wLbUFAmpMl5oSHHRoLmh1dGhA
# cG9zdGVvLmV1AAoJEC7Z13T+cC21pmAQAJa2bVXA7cvKz0w7p7R0AAGrYfetiqbR
# f/HLuO17OE6Df2quoIpcYzAOjyLwFFBjb4RyPVMdcuKWPWcFnCA9i5ft30TLK84I
# 3SIx6M7N9OZnAlxPOGsVy8eyoIny8bQOm1/RsGP+SDkNpfQSPcQzp6IAVazEFcM/
# g6sOPuHp2SOUe+as1+ZTqGDTS5O9VTna/WLGV/Hka1+KCtAwAYws9SWnczHdFvMd
# rvTJOSKVe2gfs0vLdTIOx44Bj8xhty402+jQqvL8Rwm5wjXRECEQQe7g+qPXINot
# pnR2LCe952KHhkSoL+70N4SZTimX+UMt0qACr03isqSpVJDcYDD9T/rY5RL9PYPE
# TdVZM66ZfxmQGSfqNI0GI0vrEXr7zilOjowq/F8BBgT1RG8EzMM23WykPQtwqXuu
# vsVuu1IV99vbSH76EJEsMra5JuQrAnTNAkXLBtI9BQvlrP/553dl/2DQd7GUb8we
# B+bFtIk9QXkmkBGOGWOtOfkazPir5GKyy6zLFomZt1SBsbKyL8ZdHvV/XHeChSqO
# boMFfO67WnoqZeVhc53U3Hm8poo8sIw5UIRU/HAc3thE+esDXnYALEDwwcy8fdnE
# 2FB0PVzqVOuLXe0rNGsPFP/h+Fd30YFsTGQxxvS65ADAGkP5bztuZqejR2tVgeOU
# iHgw5kauDJ31
# =RNE6
# -----END PGP SIGNATURE-----
# gpg: Signature made Tue 07 Jul 2026 08:07:22 CEST
# gpg: using RSA key 27B88847EEE0250118F3EAB92ED9D774FE702DB5
# gpg: issuer "th.huth@posteo.eu"
# gpg: Good signature from "Thomas Huth <th.huth@gmx.de>" [full]
# gpg: aka "Thomas Huth <thuth@redhat.com>" [full]
# gpg: aka "Thomas Huth <huth@tuxfamily.org>" [full]
# gpg: aka "Thomas Huth <th.huth@posteo.de>" [unknown]
# gpg: issuer "th.huth@posteo.eu" does not match any User ID
# gpg: WARNING: The key's User ID is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 27B8 8847 EEE0 2501 18F3 EAB9 2ED9 D774 FE70 2DB5
* tag 'pull-request-2026-07-07' of https://gitlab.com/huth/qemu:
tests/functional: use QMP to query available machines
tests/functional/aspeed: unify boot completion detection on 'login:' prompt
tests/functional: Add hotplug_scsi test to hotplug virtio-scsi disk
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
accel/tcg: Use TLB_FORCE_SLOW not TLB_MMIO for user-only plugins
In 6d03226b422 we set TLB_MMIO to a non-zero value for user-only
so that we could return a non-zero value from probe_* functions
so that we could force callers like Arm SVE vector moves to use
the slow path rather than direct access. All for the sake of
exposing these accesses to plugins.
Back then, TLB_FORCE_SLOW did not exist, so TLB_MMIO seemed like
a reasonable solution. However, user-only doesn't really have
MMIO and this has knock-on effects, like forcing Arm SVE first-fault
vector loads to stop. Better to use TLB_FORCE_SLOW as a more exact
trigger for plugins.
Cc: qemu-stable@nongnu.org Fixes: 6d03226b422 ("plugins: force slow path when plugins instrument memory ops") Acked-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260702171057.47998-1-richard.henderson@linaro.org>
Chao Liu [Tue, 7 Jul 2026 13:27:01 +0000 (21:27 +0800)]
MAINTAINERS: update Chao Liu's email address
I joined Process Mission over a month ago and have verified that sending
patches from my new email address works as expected.
Update my MAINTAINERS entries to use the new address for future upstream
contributions.
Signed-off-by: Chao Liu <chao.liu@processmission.com> Reviewed-by: Bin Meng <bin.meng@processmission.com>
Message-ID: <20260707132701.71164-1-chao.liu@processmission.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
The m25p80 model now accounts for fast-read dummy bytes in its
command decoder. In ASPEED SMC model user mode, guest software
already sends the complete byte stream, including any dummy
bytes needed by the flash. Hence the model should just forward
exactly the bytes supplied by the guest without the need of
decoding guest-supplied flash op codes to inject extra dummy
transfers.
Signed-off-by: Bin Meng <bin.meng@processmission.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Tested-by: Cédric Le Goater <clg@redhat.com>
Message-ID: <20260707083431.219671-10-bin.meng@processmission.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
The incorrect implementation of dummy cycles in m25p80 model is now
corrected. Revert this commit.
Signed-off-by: Bin Meng <bin.meng@processmission.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Tested-by: Cédric Le Goater <clg@redhat.com>
Message-ID: <20260707083431.219671-9-bin.meng@processmission.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Bin Meng [Tue, 7 Jul 2026 08:34:26 +0000 (16:34 +0800)]
hw/ssi: aspeed_smc: Fix direct-read dummy bytes
m25p80 now consumes fast-read dummy phases as byte counts. The
ASPEED SMC direct-read path still treated the CEx dummy field as
raw cycles and emitted field * 8 SSI transfers. Convert the
ASPEED dummy field to SSI byte transfers using the selected
direct-read data width.
Fixes: ac2810defa9d ("aspeed/smc: handle dummy bytes when doing fast reads in command mode") Signed-off-by: Bin Meng <bin.meng@processmission.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Tested-by: Cédric Le Goater <clg@redhat.com>
Message-ID: <20260707083431.219671-8-bin.meng@processmission.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Bin Meng [Tue, 7 Jul 2026 08:34:25 +0000 (16:34 +0800)]
hw/ssi: xilinx_spips: Fix dummy phase handling
The ZynqMP generic FIFO encodes dummy phases as a number of
dummy cycles. QEMU's SSI bus transfers whole bytes, so the
controller model must convert the programmed cycle count to the
number of SSI byte transfers needed for the selected SPI, dual SPI
or quad SPI mode.
The legacy Xilinx QSPI snoop paths had the opposite problem after
the m25p80 dummy handling was fixed. They still treated each dummy
byte queued through the FIFO as a request to generate several SSI
transfers based on the current link width. The flash model now
consumes dummy phases as byte counts, so the manual FIFO path should
forward one SSI transfer per dummy byte.
Update the Xilinx QSPI dummy accounting consistently for the generic
FIFO, manual FIFO and LQSPI direct-read paths. Also make the command
table report the dummy byte counts consumed by m25p80 for dual and
quad output reads, and account for the mode byte before LQSPI data
reads begin.
This matches the ZynqMP TRM (ug1085, v2.2 [1]) description of the
generic FIFO dummy cycle entry and keeps the controller side aligned
with the flash model's dummy byte ownership.
The description of the generic command fifo register says:
When [receive, transmit, data_xfer] = [0,0,1], the [immediate_data]
field represents the number of dummy cycle sent on the SPI interface.
[1] https://www.xilinx.com/support/documentation/user_guides/ug1085-zynq-ultrascale-trm.pdf
table 24‐22, an example of Generic FIFO Contents for Quad I/O Read Command (EBh)
Fixes: ef06ca3946e2 ("xilinx_spips: Add support for RX discard and RX drain") Fixes: c95997a39de6 ("xilinx_spips: Add support for the ZynqMP Generic QSPI") Signed-off-by: Bin Meng <bin.meng@processmission.com> Tested-by: Cédric Le Goater <clg@redhat.com>
Message-ID: <20260707083431.219671-7-bin.meng@processmission.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Bin Meng [Tue, 7 Jul 2026 08:34:24 +0000 (16:34 +0800)]
hw/ssi: npcm7xx_fiu: Correct the dummy cycle emulation logic
Change send_dummy_bits() to send_dummy_bytes() as the FIU register
fields are programmed from spi_mem_op.dummy.nbytes, so they already
describe byte transfers.
Verified the changes by booting OpenBMC image on `gbs` machine all
the way to the Linux login shell:
Bin Meng [Tue, 7 Jul 2026 08:34:23 +0000 (16:34 +0800)]
hw/block: m25p80: Fix dummy byte handling for Spansion flash
Spansion flashes expose the number of dummy clock cycles through CR2V
register [1]. The value is a cycle count, not a byte count, so the
m25p80 model has to convert it to the number of whole SSI transfer
bytes consumed while collecting read command data.
Add a helper that multiplies the CR2V dummy cycle count by the phase
width and rounds up non-byte-aligned counts, matching the byte-oriented
SSI model. The default eight-cycle configuration keeps the same byte
counts as before.
Fixes: cf6f1efe0b57 ("m25p80: Fast read commands family changes") Signed-off-by: Bin Meng <bin.meng@processmission.com> Tested-by: Cédric Le Goater <clg@redhat.com>
Message-ID: <20260707083431.219671-5-bin.meng@processmission.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
hw/arm/msf2-som: Fix spansion-cr2nv value for S25FL128S
The emcraft-sf2 board set spansion-cr2nv to 1, which the old m25p80
code treated as a byte count. With the dummy cycle to byte conversion
fix, CR2V=1 at SPI x1 is 1 bit, not byte-aligned, and triggers an
assertion. Use the S25FL128S default of 0x8 (8 cycles = 1 byte at
SPI x1), preserving the same runtime behavior.
Signed-off-by: Cédric Le Goater <clg@redhat.com> Reviewed-by: Bin Meng <bin.meng@processmission.com> Tested-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Message-Id: <20d58663-a8d1-41ff-9348-cae4982c30f0@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Bin Meng [Tue, 7 Jul 2026 08:34:22 +0000 (16:34 +0800)]
hw/block: m25p80: Fix dummy byte handling for Macronix flash
Macronix flashes expose DC[1:0] bits in the volatile configuration
register [1]. These bits select the number of dummy clock cycles
used by the fast-read command families.
Convert the Macronix dummy-cycle settings through per-command-family
tables and round up the non-byte-aligned cases that the byte-oriented
SSI model cannot represent exactly.
Fixes: cf6f1efe0b57 ("m25p80: Fast read commands family changes") Signed-off-by: Bin Meng <bin.meng@processmission.com> Tested-by: Cédric Le Goater <clg@redhat.com>
Message-ID: <20260707083431.219671-4-bin.meng@processmission.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Bin Meng [Tue, 7 Jul 2026 08:34:21 +0000 (16:34 +0800)]
hw/block: m25p80: Fix dummy byte handling for Numonyx/Micron flash
Numonyx/Micron flashes [1] do not use one fixed dummy-phase width for all
fast-read commands. The volatile configuration register stores a number
of dummy clock cycles, and QEMU must convert that value to the number of
SSI bytes consumed by the flash model.
Keep the existing default: 10 dummy clocks in Quad I/O mode and 8 dummy
clocks otherwise. In Quad I/O and Dual I/O protocol modes, all command
phases are transferred on 4 or 2 lines, so the dummy clock count still
needs to be scaled by that bus width.
Standard SPI, also called extended SPI in the Micron datasheet, is more
subtle. Quad Output Fast Read (6Bh) and Dual Output Fast Read (3Bh) keep
the opcode and address phases on DQ0; their dummy phase is just a clock
gap before data is returned on four or two output lines. Do not scale the
dummy count for those output-only commands. Only Quad I/O Fast Read
(EBh) and Dual I/O Fast Read (BBh) transfer the address and dummy phases
on the 4-bit or 2-bit bus, so keep scaling those commands.
Bin Meng [Tue, 7 Jul 2026 08:34:20 +0000 (16:34 +0800)]
hw/block: m25p80: Fix dummy byte handling for Winbond flash
The m25p80 model uses s->needed_bytes to track how many bytes a
controller must send after an opcode before the flash model can enter
the data phase. For address-bearing commands this includes the address
bytes. For fast-read commands it also includes the dummy phase.
The tricky part is that flash datasheets describe the dummy phase in
clock cycles, while the QEMU SSI interface advances the flash model one
transferred byte at a time. The dummy clock count therefore has to be
converted to the number of SSI bytes that the controller will actually
emit.
Some controllers have drivers that push these dummy bytes into a FIFO.
Other controllers are programmed with a dummy-cycle count and generate
the clocks themselves. The flash model still has to use the same byte
count that a FIFO-style controller or the Linux spi-mem layer would use,
otherwise the model waits too long and drops the first data bytes.
Let's fix the inconsistency from the flash side first. We start from an
easy one, the Winbond flashes.
Per the Windbond W25Q256JV datasheet [1] instruction set table
(chapter 8.1.2, 8.1.3, 8.1.4, 8.1.5), fix the wrong number of
dummy bytes needed for fast read commands.
hw/acpi/ich9: move initial property values into ich9_reset_properties()
Signed-off-by: Mark Cave-Ayland <mark.caveayland@nutanix.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Message-ID: <20260703135512.3213964-7-mark.caveayland@nutanix.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
hw/rtc/mc146818rtc: convert date from object prop to class prop
This is to allow it to be the target of a class alias property.
Signed-off-by: Mark Cave-Ayland <mark.caveayland@nutanix.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Message-ID: <20260703090814.2993188-6-mark.caveayland@nutanix.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
hw/arm: Add basic FlexCAN3 support to TYPE_FSL_IMX8MP and imx8mp-evk
Real hardware supports CAN FD which is missing in the emulation and is
considered future work. Still, CAN communication already works under Linux.
Signed-off-by: Bernhard Beschow <shentey@gmail.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Acked-by: Pavel Pisa <pisa@fel.cvut.cz> Tested-by: Pavel Pisa <pisa@fel.cvut.cz>
Message-ID: <20260702184038.178196-6-shentey@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Introduce class FslImx8mpEvkState which will be needed for holding
CanBusState attributes and associated properties.
Signed-off-by: Bernhard Beschow <shentey@gmail.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Acked-by: Pavel Pisa <pisa@fel.cvut.cz> Tested-by: Pavel Pisa <pisa@fel.cvut.cz>
Message-ID: <20260702184038.178196-5-shentey@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
hw/arm/imx8mp-evk: Open code DEFINE_MACHINE_AARCH64
Open code the DEFINE_MACHINE_AARCH64 macro in preparation of creating
FslImx8mpEvkState class, needed for FlexCAN emulation.
Signed-off-by: Bernhard Beschow <shentey@gmail.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Acked-by: Pavel Pisa <pisa@fel.cvut.cz> Tested-by: Pavel Pisa <pisa@fel.cvut.cz>
Message-ID: <20260702184038.178196-4-shentey@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Subclass TYPE_CAN_FLEXCAN, yielding TYPE_CAN_FLEXCAN2 and
TYPE_CAN_FLEXCAN3.
Since TYPE_CAN_FLEXCAN is now abstract, TYPE_FSL_IMX6 needs to use
TYPE_CAN_FLEXCAN2. TYPE_CAN_FLEXCAN3 will be used in TYPE_FSL_IMX8MP.
Signed-off-by: Bernhard Beschow <shentey@gmail.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Acked-by: Pavel Pisa <pisa@fel.cvut.cz> Tested-by: Pavel Pisa <pisa@fel.cvut.cz>
Message-ID: <20260702184038.178196-3-shentey@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
hw/net/can/flexcan: Wire clock control module via link property
When wiring struct FlexcanState to the clock control module, it is
currently necessary to reach into its private data. Moreover, when
forgetting to wire the clock control module, QEMU will crash after the
guest has already started. Fix both by letting struct FlexcanState
expose a link property whose sanity is checked at realize time.
Suggested-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Signed-off-by: Bernhard Beschow <shentey@gmail.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Acked-by: Pavel Pisa <pisa@fel.cvut.cz> Tested-by: Pavel Pisa <pisa@fel.cvut.cz>
Message-ID: <20260702184038.178196-2-shentey@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Song Gao [Wed, 1 Jul 2026 06:54:54 +0000 (14:54 +0800)]
hw/intc/loongarch_dintc: Fix OOB access in DINT MMIO write handler
Validate guest-controlled cpu_num before using it to index the cpu[] array
or pass to async_run_on_cpu(). Without this check, a malicious guest can
trigger a NULL pointer dereference in async_run_on_cpu() and an
out-of-bounds array access in qemu_set_irq(), causing host crash.
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3616 Fixes: 0d148eaf5a3e ("hw/loongarch: Implement dintc set irq") Reported-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Song Gao <gaosong@loongson.cn> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Message-ID: <20260701065454.1976188-1-gaosong@loongson.cn> Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Thomas Huth [Tue, 30 Jun 2026 10:10:22 +0000 (12:10 +0200)]
hw/display/qxl: Fix mono cursor validation that can read past a cursor chunk
qxl_render_cursor() maps the guest-provided QXLCursor object using the
guest-controlled cursor->chunk.data_size.
For a mono cursor, qxl_cursor() then validates the expected bitmap size
against cursor->data_size, but it does not validate that the first chunk
actually contains that many bytes.
A guest could set cursor->data_size to the correct full mono cursor size
while setting cursor->chunk.data_size to zero. In that case, cursor_set_mono()
reads the AND/XOR masks starting at cursor->chunk.data. If the cursor object
is placed at the end of the QXL RAM BAR, those reads cross the mapped RAM
region and could crash the QEMU process (e.g. under ASan).
Fix it by double-checking cursor->chunk.data_size for the correct size.
This patch is based on the suggested changes by the reporter in the bug
ticket.
Reported-by: huntr bubble
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3646 Signed-off-by: Thomas Huth <thuth@redhat.com> Acked-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-ID: <20260630101022.379057-1-thuth@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Peter Maydell [Tue, 30 Jun 2026 08:48:55 +0000 (09:48 +0100)]
hw/hyperv: Avoid crash if hyperv_find_cpu() passed invalid vp_index
The hyperv_find_cpu() function finds a CPU from a CPU index; this is
basically a wrapper around qemu_get_cpu(). It is allowed to fail, in
which case it returns NULL, which its caller handles. However, it
includes an assertion check which accidentally assumes the CPU
pointer is non-NULL.
We could assert only if cs != NULL, but the assertion here is not
doing anything interesting -- hyperv_vp_index() is a trivial wrapper
returning cs->cpu_index, so this is effectively asserting that
qemu_get_cpu() did what it claims to do, i.e. returned us the CPU
matching the index we gave it. qemu_get_cpu() is a simple "iterate
through list and find matching CPU" which is unlikely to be buggy,
and we don't feel the need to sanity-check it in any of our other
many uses of it. Drop the assertion entirely.
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3568 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Acked-by: Maciej S. Szmigiero <maciej.szmigiero@oracle.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-ID: <20260630084855.2319838-1-peter.maydell@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Peter Maydell [Mon, 29 Jun 2026 18:50:35 +0000 (19:50 +0100)]
hw/scsi/mptsas: Reset doorbell state on reset
Currently the mptsas reset function clears intr_status, but it
doesn't reset the doorbell state machine. This means that the state
machine and the interrupt state get out of sync, and the guest can
trigger an assertion failure in mptsas_doorbell_read() where
s->doorbell_state is still DOORBELL_READ but s->intr_status does not
have MPI_HIS_DOORBELL_INTERRUPT set.
Fix this by having reset also reset the doorbell state. Strictly
speaking we don't need to also clear doorbell_reply_idx and
doorbell_reply_size, because those are only read when in
DOORBELL_READ state, and the code always sets them up before
transitioning into that state. But it's less confusing to clear them
out on reset.
Cc: qemu-stable@nongnu.org
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/304 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Message-ID: <20260629185035.2138238-1-peter.maydell@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
hw/net: fix e1000e/igb ip_len inflation by Ethernet minimum-frame padding
When a guest transmits a short Ethernet frame, iov_size() returns the
padded wire length including any bytes added to reach the Ethernet
minimum frame size of 60 bytes. net_tx_pkt_rebuild_payload() uses
this inflated size as payload_len. net_tx_pkt_update_ip_hdr_checksum()
then overwrites the IPv4 Total Length field with payload_len +
l3_hdr_len, inflating it by the padding. The receiver interprets
Ethernet padding as IP payload, producing a malformed packet.
Fix by removing the ip_len write from net_tx_pkt_update_ip_hdr_checksum()
so it only recomputes the checksum, and moving the ip_len assignment
into net_tx_pkt_update_ip_checksums() where it is only performed for
TSO (where ip_len must be derived from payload_len since the guest sets
ip_len=0 per Intel 82574 datasheet §7.3.4 for super-packets the host
will segment).
Both e1000e and igb already call net_tx_pkt_update_ip_hdr_checksum()
from their IXSM paths, so both are corrected by this single common-
layer change.
Signed-off-by: Sanjeeva Yerrapureddy <y.sanjeevreddy@gmail.com> Reivewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Message-ID: <20260629-net-tx-pkt-ip-length-padding-v5-1-16760e30252e@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Peter Maydell [Mon, 29 Jun 2026 14:01:28 +0000 (15:01 +0100)]
hw/dma/i8257: Return zeroes for read_memory in verify mode
The i8257 DMA controller has a "verify" mode, which the datasheet
describes like this:
> DMA verify, which does not actually involve the transfer of data.
> When an 8257 channel is in the DMA verify mode, it will respond the
> same as described for transfer operations, except that no memory or
> I/O read/write control signals will be generated. When an 8257
> channel is in the DMA verify mode, it will respond the same as
> described for transfer operations, except that no memory or I/O read
> /write control signals will be generated, thus preventing the
> transfer of data. The 8257, however, will gain control of the system
> bus and will acknowledge the peripheral's DMA request for each DMA
> cycle. The perihperal can use these acknowledge signals to enable an
> internal access of each byte of a data block in order to execute some
> verification procedure, such as the accumulation of a CRC check word.
In practice, for QEMU's purposes the only real user of this is the
floppy controller, which can be made to perform a "read data from
floppy disk and check the checksum" by telling the fdc to do a read
and the DMA controller to do a verify. This causes the fdc to do all
the usual read actions including the checksum, but the data is never
written to memory. However, it is possible for a guest doing
something silly to program the DMA controller to do a verify
operation for a device that wants to read from memory. Currently we
simply return early from i8257_dma_read_memory() without writing to
the buffer. None of the callers (the GUS, sb16 and cs4231a sound
cards, plus the fdc) expect this, so they will take the uninitialized
data as if it were from the guest. This can cause us to leak host
data off the stack into the guest.
Make i8257_dma_read_memory() fill the buffer with zeroes rather
than leaving it untouched for a verify operation.
Cc: qemu-stable@nongnu.org
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3487 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-ID: <20260629140128.1900095-1-peter.maydell@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
yujun [Mon, 29 Jun 2026 11:10:26 +0000 (19:10 +0800)]
crypto/x509-utils: fix gnutls error code in crt_init failure path
qcrypto_get_x509_cert_fingerprint() reports gnutls_strerror(ret) when
gnutls_x509_crt_init() fails, but ret is still the initial value -1.
Store the gnutls return code before formatting the error, matching
other gnutls call sites in the tree.
Fixes: 2183ab6251 ("crypto/x509-utils: Check for error from gnutls_x509_crt_init()") Signed-off-by: yujun <yujun@kylinos.cn> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-ID: <20260629111026.281185-1-yujun@kylinos.cn> Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
yujun [Mon, 29 Jun 2026 09:01:16 +0000 (17:01 +0800)]
ebpf: fix swapped toeplitz/indirection args in set_data trace
trace_ebpf_rss_set_data() passes its third and fourth arguments to
the toeplitz-ptr and indirection-ptr fields defined in trace-events.
ebpf_rss_set_all() passed indirections_table and toeplitz_key in the
opposite order, so tracing mislabeled the two pointers.
Match the argument order already used by trace_ebpf_rss_mmap().
Fixes: f5cae19d10 ("ebpf: improve trace event coverage to all key operations") Signed-off-by: yujun <yujun@kylinos.cn> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Message-ID: <20260629090116.266561-1-yujun@kylinos.cn> Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
projects / thirdparty / qemu.git / log
