hw/display/qxl: fix TOCTOU in cursor chunk data_size handling
Snapshot chunk.data_size into a host-local variable before passing it to
qxl_phys2virt() for validation, and pass it through qxl_cursor() and
qxl_unpack_chunks() so that no subsequent code re-reads the field.
Without this, a racing vCPU can inflate data_size between the
qxl_phys2virt() validation and the memcpy in qxl_unpack_chunks(),
causing a source read past the validated region. In practice the read
stays within the guest's own VRAM mmap, so the impact is limited.
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3757 Reported-by: Feifan Qian <bea1e@proton.me> Signed-off-by: Marc-Andre Lureau <marcandre.lureau@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Message-ID: <20260710134352.2313675-1-marcandre.lureau@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Miao Wang [Thu, 9 Jul 2026 19:21:40 +0000 (03:21 +0800)]
hw/scsi/vmw_pvscsi: add a comment to explain the endianness
Add a comment to explain the endianness of the pvscsi device. We have
no information about the endianness should be little-endian or CPU
native endian because the current driver code is designed to work only
on x86 and is not endianness aware. We assume that the pvscsi device is
implicitly little-endian.
Signed-off-by: Miao Wang <shankerwangmiao@gmail.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Message-ID: <20260710-pvscsi-endianness-v3-2-27fe1c4d1f6e@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Miao Wang [Thu, 9 Jul 2026 19:21:39 +0000 (03:21 +0800)]
hw/scsi/vmw_pvscsi: translate data endianness
This patch improves the implementation of the pvscsi device by
translating the endianness of the data sent or received from the guest.
This ensures pvscsi can work on big-endian hosts with little-endian
guests.
This patch assumes, although not having found any specifications, that
the pvscsi device is little-endian, since pvscsi seems to be used only
on x86 platforms, which are little-endian.
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Signed-off-by: Miao Wang <shankerwangmiao@gmail.com>
Message-ID: <20260710-pvscsi-endianness-v3-1-27fe1c4d1f6e@gmail.com>
[PMD: Rebased on top of commit cb30b8758d4 physmem API conversion] Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Bin Meng [Tue, 30 Jun 2026 13:57:29 +0000 (21:57 +0800)]
docs/devel: Document SSI dummy-cycle ownership
Document the boundary between SPI/SSI controller models and SPI flash
models when representing fast-read dummy cycles. It explains that
flash models own command semantics, while controllers own
hardware-generated dummy transfers and cycle-to-byte conversion.
Signed-off-by: Bin Meng <bin.meng@processmission.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Message-ID: <20260707083431.219671-11-bin.meng@processmission.com>
[PMD: Update MAINTAINERS] Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Haotian Jiang [Mon, 29 Jun 2026 02:59:03 +0000 (10:59 +0800)]
hw/misc/ivshmem: clear chardev handlers before freeing peers
ivshmem_exit() frees s->peers and s->msi_vectors but does not clear
the chardev handlers registered in ivshmem_common_realize(). Those
handlers are only removed later in object_finalize() via release_chr,
which runs after ivshmem_exit().
Between exit and finalize, ivshmem_read() can fire on pending chardev
data and process_msg_connect() dereferences the freed s->peers.
Additionally, s->peers, s->nb_peers, and s->msi_vectors are not
zeroed after free, leaving dangling pointers that make the UAF code
paths reachable.
Fix by clearing chardev handlers at the beginning of ivshmem_exit(),
before any resources they access are freed, and nullifying freed
pointers.
Thomas Huth [Mon, 9 Mar 2026 18:14:52 +0000 (19:14 +0100)]
hw/sparc64/sun4u: Mark unusable PCI busses as full to ease device plugging
When trying to plug a PCI device to a Sparc64 machine, you currently
have to specify the right bus ("bus=pciB"), otherwise you get this error:
$ qemu-system-sparc64 -device virtio-scsi-pci
qemu-system-sparc64: -device virtio-scsi-pci: PCI: no slot/function
available for virtio-scsi-pci, all in use or reserved
This is quite annoying for the unexperienced users, and it also breaks
e.g. the iotests ("make check-block") when running with qemu-system-sparc64.
Mark the non-usable PCI busses as full now, so that QEMU can automatically
plug new PCI devices to the right "pciB" bus.
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20260309181452.83702-1-thuth@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Stefan Hajnoczi [Tue, 14 Jul 2026 19:33:34 +0000 (20:33 +0100)]
Merge tag 's390x-20260714' of https://gitlab.com/cohuck/qemu into staging
more s390x guest->host interface hardening (sclp, css)
# -----BEGIN PGP SIGNATURE-----
#
# iIgEABYKADAWIQRpo7U29cv8ZSCAJsHeiLtWQd5mwQUCalYBQxIcY29odWNrQHJl
# ZGhhdC5jb20ACgkQ3oi7VkHeZsEg8gEA2leqR6LLqQFqacysYj7uu2NK7NqWbShY
# k3wvWVq6h7IBAMzLs/pnrNdJM8VjlPnAdD1UUCXme4MbzDFPv9tFElII
# =+khB
# -----END PGP SIGNATURE-----
# gpg: Signature made Tue 14 Jul 2026 10:28:35 BST
# gpg: using EDDSA key 69A3B536F5CBFC65208026C1DE88BB5641DE66C1
# gpg: issuer "cohuck@redhat.com"
# gpg: Good signature from "Cornelia Huck <conny@cornelia-huck.de>" [unknown]
# gpg: aka "Cornelia Huck <cohuck@kernel.org>" [unknown]
# gpg: aka "Cornelia Huck <cornelia.huck@de.ibm.com>" [full]
# gpg: aka "Cornelia Huck <huckc@linux.vnet.ibm.com>" [full]
# gpg: aka "Cornelia Huck <cohuck@redhat.com>" [unknown]
# gpg: WARNING: The key's User ID is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: C3D0 D66D C362 4FF6 A8C0 18CE DECF 6B93 C6F0 2FAF
# Subkey fingerprint: 69A3 B536 F5CB FC65 2080 26C1 DE88 BB56 41DE 66C1
* tag 's390x-20260714' of https://gitlab.com/cohuck/qemu:
s390x/css: firm up handling of chained TIC CCWs
s390x/sclpcpi: check event length field before reading from buffer
s390x/sclp: prevent re-reading the sclp header
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Eric Farman [Mon, 13 Jul 2026 07:47:08 +0000 (09:47 +0200)]
s390x/css: firm up handling of chained TIC CCWs
The logic in css_interpret_ccw() correctly returns -EINVAL if a
Transfer-In-Channel (TIC) CCW is command chained to another TIC CCW.
The same routine also correctly returns -EINVAL if 256 CCWs do not
perform a data transfer as part of the I/O operation [0].
What is missing, however, is a combination of these two, where a loop
can be generated that will continue processing CCWs but without
providing an opportunity to catch a breath. Fix this by capping
the number of TIC CCWs in a channel program at the same limit as
the CCWs without data transfer.
[0] See "Invalid Sequence" in z/Architecture Principles of Operation
(SA22-7832-14), p16-27
Cc: qemu-stable@nongnu.org Signed-off-by: Eric Farman <farman@linux.ibm.com> Acked-by: Christian Borntraeger <borntraeger@linux.ibm.com> Reviewed-by: Farhan Ali <alifm@linux.ibm.com> Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
Message-ID: <20260713074708.884282-1-borntraeger@linux.ibm.com> Signed-off-by: Cornelia Huck <cohuck@redhat.com>
qom: Fix device-list-properties & friends to show legacy-FOO props
qmp_device_list_properties() skips properties whose name starts with
"legacy-". This is a flawed test for "is a legacy property".
The test is flawed because non-legacy properties can and do start with
"legacy-". Back when it was added, no such properties existed. Right
now, three such properties do: property "legacy-cmb" of device "nvme",
and properties "legacy-cache" and "legacy-multi-node" of devices
"x86_64-cpu", "i386-cpu", and its children.
This affects QMP command "device-list-properties", HMP command
"device_add T,help", and command line option "-device T,help".
Legacy properties are gone since commit a61383f7ab (qdev: Legacy
properties are now unused internally, drop, 2025-10-22). This makes
the fix easy: delete the code that skips them.
Reproducer: -device nvme,help doesn't show legacy-cmb before the
patch, and does after.
Fixes: f4eb32b590 (qmp: show QOM properties in device-list-properties, 2014-05-20) Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20260708140948.2622814-1-armbru@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Stefan Hajnoczi [Tue, 14 Jul 2026 06:26:45 +0000 (07:26 +0100)]
Merge tag 'pull-riscv-to-apply-20260714' of https://github.com/alistair23/qemu into staging
RISC-V PR for 11.1
* Mark Microchip PolarFire SoC as Odd Fixes in MAINTAINERS
* Fix RISC-V privilege level in uftrace plugin
* Add K230 Linux boot tests
* Fix kernel command line for sifive_u test
# -----BEGIN PGP SIGNATURE-----
#
# iQIzBAABCgAdFiEEaukCtqfKh31tZZKWr3yVEwxTgBMFAmpVteUACgkQr3yVEwxT
# gBOPmxAAmPrfbQUTe2Zs0jZGYc3joPHWLIjBwx1p/623WtjXYwXYXbkgKw3BVNOf
# qtu8O2dkNeUK7V8Udmi2tPiANHrV0bbvhFWPgLOINtQQyQV79mpwZGO9id1eU2Xj
# rRLxB190rA2IKFN4Stum1SCuVQpO3DiDtf6B+VppgpShH08TIFeaDtCySOv5UfHS
# WoYlpCFyp99dkkOD+fBNojILiJSLfquhw5tmMgKeFUJXAvVJxDKhAtIHKziCbTUx
# VozVx7blAUEMsf4z+ZUq1Buu/6p8kDD6f+eEQ4eCqHh2HfB6V0BV1uvQFaaxMMF2
# h4mOGuZV1L1d1h5cGtSg1aMJNgAUEUKo+ykiXsGGiaYvUnt3eNZh2xAYwJImliVA
# U9Y6MizID3DaECP27wETTLmrbayuJ8GzSlkoI7jwm9QDmxYFp+TvneTuz9xSlIEy
# lRz/l3mUMJ0RCpvrEbBX56RPbCGIuXgOTdCyAd1hxvCMjwzqtsmQ0vftuFTbWliO
# t5/4EPDJuZVseIKFMSE2RHM2kWWcIOUs5Op42tNxP0Yp/UjBdhNy8KaNWpWmn8vF
# PPSBsFr2dsVSaQz0kSiYTSTg2TcOlGug6mvZJeTdXDNRY0uWIPPrMFpHwk/Fa5G5
# VQC6s/BX9dFAiJDqDwwN9CZR3TzYOHmQfiSWY71+lfb6AI4CuLg=
# =mUxx
# -----END PGP SIGNATURE-----
# gpg: Signature made Tue 14 Jul 2026 05:07:01 BST
# gpg: using RSA key 6AE902B6A7CA877D6D659296AF7C95130C538013
# gpg: Good signature from "Alistair Francis <alistair@alistair23.me>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 6AE9 02B6 A7CA 877D 6D65 9296 AF7C 9513 0C53 8013
* tag 'pull-riscv-to-apply-20260714' of https://github.com/alistair23/qemu:
tests/functional/riscv64: sifive_u: Fix kernel command line
tests/functional/riscv64: Add K230 Linux boot tests
uftrace: riscv privilege level
MAINTAINERS: Mark Microchip PolarFire SoC as Odd Fixes
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Stefan Hajnoczi [Tue, 14 Jul 2026 06:25:53 +0000 (07:25 +0100)]
Merge tag 'pbouvier/pr/plugins-20260713' of https://gitlab.com/p-b-o/qemu into staging
Changes:
- [PATCH v1] uftrace: riscv privilege level (Yanfeng Liu <yfliu2008@qq.com>) Link: https://lore.kernel.org/qemu-devel/tencent_E17E8F6494EE130F71527C6BCE481AF33E08@qq.com
- [PATCH v12 0/2] contrib/plugins: add dlcall to call host functions (Ziyang Zhang <functioner@sjtu.edu.cn>) Link: https://lore.kernel.org/qemu-devel/20260711094523.622997-1-functioner@sjtu.edu.cn
# -----BEGIN PGP SIGNATURE-----
#
# iQGzBAABCgAdFiEEN8FWlNi6l2Sxlz/btEQ30ZwoYt8FAmpVKSgACgkQtEQ30Zwo
# Yt9wYgv8D3Uh6ebumK4SlHAmMm41gF5wjZsfmA5YXstcPlmxt2sZEbVaTnyLyhZd
# Q8F34HVJ5vaClPoFiQKz+arCLFvLZ4MAgqMy/pxedIhJVhW2b/dt0Z10HkJc8kDx
# baJyv36GmUwnXrTWGZAuLZq7CbQ1xSH4BN6qHAY6mpHogdISABhG6hArz9leHZO/
# NlnxFpfkr29Hd1XLu5u7de35SWRtQbAJYCqtELmR/ZxhKOJU6kr63VR4zr5jVVNX
# px6JQxPkeSFypHV1+klbxCQiXkflwBrYpIKRXrAVNZ7HwMXK6iDw4D/L5TzyxdJn
# 7yMVZ05+xI0o+yS46A0btGoinrnNyjeZjKh1VV7A4DuZ7mfbIII+fvE3JdAzvhzO
# xvrTwwYksiztEK86r8yq7DT9FIx5LLF+B93NgdUtUvvOQP1z1BvvCdePN1KwUrpo
# UgO45akAv8QBVD5uNS4Lh/fG3HarYgdrwt87P3vgynEhuGIE+7QZfOmooNwlwu8v
# SSngbr/5
# =9JyL
# -----END PGP SIGNATURE-----
# gpg: Signature made Mon 13 Jul 2026 19:06:32 BST
# gpg: using RSA key 37C15694D8BA9764B1973FDBB44437D19C2862DF
# gpg: Good signature from "Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 37C1 5694 D8BA 9764 B197 3FDB B444 37D1 9C28 62DF
* tag 'pbouvier/pr/plugins-20260713' of https://gitlab.com/p-b-o/qemu:
docs/about/emulation: document the dlcall plugin
contrib/plugins: add a minimal dlcall plugin
uftrace: riscv privilege level
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Stefan Hajnoczi [Tue, 14 Jul 2026 06:25:42 +0000 (07:25 +0100)]
Merge tag 'pull-11.1-gitdm-updates-130726-1' of https://gitlab.com/stsquad/qemu into staging
gitdm updates
- various mailmap fixes
- update IBM gitdm map
- add more individual contributors to gitdm
- update Qualcomm entries
- migrate gitdm to scripts/
# -----BEGIN PGP SIGNATURE-----
#
# iQEzBAABCgAdFiEEZoWumedRZ7yvyN81+9DbCVqeKkQFAmpVD1oACgkQ+9DbCVqe
# KkQlVQf/W7AyRksRaBM9JdfJwq3po5iDrUqBCU1VInz1fviltSOVD0qluInqzcnH
# ZbBA9l9B0Luq9RLFUSHfaX3kvyF2Ti+/6kmdFLkuAxKdyEuzY5k4yGhPmNUyPm6r
# gWQds6dMKcEzChmfzKloDUVkWbnlDrtUCLrjFXIA/32qODMNG/hUEAGO5xR6XojF
# 2sCJhBgeuEbBPEqghv6oCv4YAPLipmk2TgAAia7CPMX9pDlEBH9bs5T5O6QMoepF
# ZsYG+QALVEIEJAwAgQcHwzPEzSajb47BEPGskiXyL9oFZ0jUwyMAI1iQqzBhJvbB
# i7w+4CTMgAXgrjnmg1HoB2R0o1rgTg==
# =+6U6
# -----END PGP SIGNATURE-----
# gpg: Signature made Mon 13 Jul 2026 17:16:26 BST
# gpg: using RSA key 6685AE99E75167BCAFC8DF35FBD0DB095A9E2A44
# gpg: Good signature from "Alex Bennée (Master Work Key) <alex.bennee@linaro.org>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 6685 AE99 E751 67BC AFC8 DF35 FBD0 DB09 5A9E 2A44
* tag 'pull-11.1-gitdm-updates-130726-1' of https://gitlab.com/stsquad/qemu:
scripts/gitdm: migrate from contrib
contrib/gitdm: Update Qualcomm entries
contrib/gitdm: add more individual contributors
contrib/gitdm: Update IBM map
mailmap: add fix for Zhongyao Chen
mailmap: add email mapping for Alexander Mikhalitsyn
mailmap: Fix Ryan Zhang email address
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Stefan Hajnoczi [Tue, 14 Jul 2026 06:25:30 +0000 (07:25 +0100)]
Merge tag 'pull-target-arm-20260713' of https://gitlab.com/pm215/qemu into staging
target-arm queue:
* hw/misc/zynq_slcr.c: drop duplicate reset value for DDRIOB_DCI_CTRL
* hw/arm/tegra241-cmdqv: Do not sync GERRORN on VCMDQ allocation
* hw/arm/smmuv3: Sanitize fields provided by guest
* hw/i2c: pmbus: clear output buffer on write
* docs/system/arm: Add some missing FEAT_FOO we already implement
* arm/virt: fix smmuv3_devices leak
* target/arm: Be more defensive for invalid tlbi_aa64_get_range
* hw/dma: don't allow weird transfer lengths for bcm2835
* hw/net/vmxnet3: Correct bounds check on tx queue index
* hw/usb/dev-wacom: Don't write off end of buffer
* hw/display/sm501: Don't let guest write off end of buffer
* hw/misc/allwinner-r40-ccu.c: Correct handling of out of range accesses
* hw/misc/stm32_rcc: Correct offset-to-irq calculation
* tag 'pull-target-arm-20260713' of https://gitlab.com/pm215/qemu: (26 commits)
hw/misc/stm32_rcc: Correct offset-to-irq calculation
hw/misc/allwinner-r40-ccu.c: Correct handling of out of range accesses
hw/display/sm501: Don't allow guest to set ram size larger than it is
hw/display/sm501: Avoid overflow problems in bounds check calculations
hw/display/sm501: Catch bad coordinates for RTL operations
hw/usb/dev-wacom: Don't write off end of buffer
hw/net/vmxnet3: Correct bounds check on tx queue index
hw/dma: don't allow weird transfer lengths for bcm2835
target/arm: Be more defensive for invalid tlbi_aa64_get_range
arm/virt: fix smmuv3_devices leak
docs/system: add FEAT_HAF
docs/system: add FEAT_S2TGran[4|16|64]K features
docs/system: fix sorting of FEAT_S2[PIE|FWB]
docs/system: document FEAT_IVIPT
docs/system: document FEAT_MTE4
docs/system: document FEAT_Secure
docs/system: add big and little endian features names
docs/system: declare support for FEAT_EVT2
hw/i2c: pmbus: clear output buffer on write
hw/arm/smmuv3: Enforce alignment of L2Ptr according to the span
...
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Stefan Hajnoczi [Tue, 14 Jul 2026 06:25:06 +0000 (07:25 +0100)]
Merge tag 'linux-user-for-v11.1-pull-request' of https://github.com/hdeller/qemu-hppa into staging
linux-user-for-v11.1 pull request
Please pull two fixes for linux-user for v11.1:
- Validate guest-passed dm_ioctl data_size
- Alpha: Fix programs using getauxval(AT_HWCAP) to detect BWX/FIX/CIX
# -----BEGIN PGP SIGNATURE-----
#
# iHUEABYKAB0WIQS86RI+GtKfB8BJu973ErUQojoPXwUCalT3fwAKCRD3ErUQojoP
# X7twAPsH/PcMbDMiwKluAOE+/r1rZ95Qp9YXuKfZhUypoizivwEAs5IdB5PKwI5s
# lGaJdOpkm7HWAEbjiYgr25d+dPBcagg=
# =zCLL
# -----END PGP SIGNATURE-----
# gpg: Signature made Mon 13 Jul 2026 15:34:39 BST
# gpg: using EDDSA key BCE9123E1AD29F07C049BBDEF712B510A23A0F5F
# gpg: Good signature from "Helge Deller <deller@gmx.de>" [unknown]
# gpg: aka "Helge Deller <deller@kernel.org>" [unknown]
# gpg: aka "Helge Deller <deller@debian.org>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 4544 8228 2CD9 10DB EF3D 25F8 3E5F 3D04 A7A2 4603
# Subkey fingerprint: BCE9 123E 1AD2 9F07 C049 BBDE F712 B510 A23A 0F5F
* tag 'linux-user-for-v11.1-pull-request' of https://github.com/hdeller/qemu-hppa:
linux-user/alpha: populate AT_HWCAP from env->amask
linux-user: Validate guest-passed dm_ioctl data_size
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Bin Meng [Mon, 13 Jul 2026 12:02:44 +0000 (20:02 +0800)]
tests/functional/riscv64: sifive_u: Fix kernel command line
Build the complete kernel command line before adding it to the QEMU
arguments. This ensures the panic, noreboot and rootwait options are
passed to the guest.
Fixes: 7db162fa0138 ("tests/functional: Test SPI-SD adapter without SD card connected") Signed-off-by: Bin Meng <bin.meng@processmission.com> Reviewed-by: Chao Liu <chao.liu@processmission.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Message-ID: <20260713120245.781959-1-bin.meng@processmission.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Junze Cao [Sat, 11 Jul 2026 12:53:20 +0000 (20:53 +0800)]
tests/functional/riscv64: Add K230 Linux boot tests
The K230 machine supports direct Linux boot and firmware boot through
the SDK U-Boot, but neither path has functional test coverage.
Add one test for each boot path. Both tests use the Yocto initramfs
assets and wait for the shell prompt to confirm a successful boot.
Fetch the boot assets from the k230-boot-assets repository maintained
by Chao Liu. Pin the URLs to a repository commit and verify each asset
with its SHA-256 digest.
Signed-off-by: Junze Cao <caojunze424@gmail.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20260711125320.72319-1-caojunze424@gmail.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Yanfeng Liu [Sun, 12 Jul 2026 08:45:53 +0000 (16:45 +0800)]
uftrace: riscv privilege level
This adds RiscV virtual user and supervisor privilege levels to
uftrace plugin to avoid crashing with H extension guests.
Signed-off-by: Yanfeng Liu <yfliu2008@qq.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <tencent_E17E8F6494EE130F71527C6BCE481AF33E08@qq.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Document the dlcall plugin under Example Plugins: what it does, the trusted-
guests and guest_base == 0 constraints, how to load it, and a pointer to
Lorelei, one end-to-end userspace implementation, for the toolchain and a
runnable example.
Add a minimal dlcall plugin that lets the guest invoke host functions
through magic system calls. The plugin registers a vCPU syscall filter
callback that intercepts a reserved syscall number and dispatches a set
of pass-through operations: querying host attributes, loading and freeing
shared libraries, resolving symbols, retrieving the last library error,
and invoking a host function through a common interface.
The magic syscall number defaults to 4096 and can be overridden at load
time with the "syscall_num=N" argument; values low enough to clash with a
real syscall are rejected.
Joel Stanley [Thu, 9 Jul 2026 08:00:34 +0000 (09:00 +0100)]
contrib/gitdm: Update IBM map
A number of us have moved on from IBM.
* Alexey moved to AMD in 2022.
* Andrew moved to Code Construct in 2023.
* Ben moved to Amazon in 2019.
* Cedric moved to Redhat.
* Daniel moved to Ventana in 2024.
* Greg moved to Redhat.
* Joel moved to Tenstorrent in 2025.
* Suraj moved to Amazon in 2019
Most have either stopped working on QEMU or swtiched to corp addresses.
Signed-off-by: Joel Stanley <joel@jms.id.au> Acked-by: Greg Kurz <groug@kaod.org>
Message-ID: <20260709080040.4157324-5-alex.bennee@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
mailmap: add email mapping for Alexander Mikhalitsyn
I use my company's email to sign-off patches, but send them from my
personal email cause it's Gmail hosted and works much better than Outlook.
It causes some misunderstanding and inconvenience for maintainers sometimes [1].
So I would like to add this email mapping to clear out all possible confusion here.
Matt Turner [Mon, 13 Jul 2026 01:36:07 +0000 (21:36 -0400)]
linux-user/alpha: populate AT_HWCAP from env->amask
Alpha has never set AT_HWCAP in linux-user emulation, so getauxval(AT_HWCAP)
always returned 0 regardless of the emulated CPU model.
The Linux kernel computes ELF_HWCAP as ~amask(-1), i.e. the set of ISA
extension bits that the amask instruction reports as supported (cleared in
its output). env->amask stores exactly those bits with the same layout
(BWX=0x1, FIX=0x2, CIX=0x4, MVI=0x100, TRAP=0x200, PREFETCH=0x1000), so
returning it directly from get_elf_hwcap matches the kernel convention.
Add HAVE_ELF_HWCAP to target_elf.h and implement get_elf_hwcap() in
elfload.c to expose the emulated CPU's capability mask to user-space
programs via the auxiliary vector.
Without this fix, programs using getauxval(AT_HWCAP) to detect BWX/FIX/CIX
(such as glibc's memcpy or JIT compilers targeting Alpha) incorrectly
concluded that no extensions were available even when emulating ev56+.
s390x/sclpcpi: check event length field before reading from buffer
A guest might send a too short SCCB with SCLP_EVENT_CTRL_PGM_ID. QEMU
would fill its data structures with garbage data. Check for the precise
length of the CBI data structure and reject otherwise.
Fixes: f345978f24be ("hw/s390x: add Control-Program Identification to QOM") Cc: qemu-stable@nongnu.org Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com> Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com> Reviewed-by: Janosch Frank <frankja@linux.ibm.com> Reviewed-by: Eric Farman <farman@linux.ibm.com>
Message-ID: <20260709142906.197474-3-borntraeger@linux.ibm.com> Signed-off-by: Cornelia Huck <cohuck@redhat.com>
We verify the sccb length and then allocate based on that length. The
following access re-reads the sccb again. This can race against other
vCPUs overwriting the length field.
sclp_service_call_protected does not need a change as the ultravisor
provides a consistent snapshot.
Fixes: c1db53a5910f ("s390/sclp: read sccb from mem based on provided length") Cc: qemu-stable@nongnu.org Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com> Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com> Reviewed-by: Eric Farman <farman@linux.ibm.com> Reviewed-by: Collin Walling <walling@linux.ibm.com>
Message-ID: <20260709142906.197474-2-borntraeger@linux.ibm.com> Signed-off-by: Cornelia Huck <cohuck@redhat.com>
In the STM32 RCC, there is a block of 5 "enable" registers, each of
which has 32 bits; each bit determines the level of one of the 5 * 32
= 160 enable_irq output lines. The code calculates the irq to be
worked on using
irq_offset = ((addr - STM32_RCC_AHB1_ENR) / 4) * 32;
This assumes that the registers are all consecutive; however, there
is a gap between the AHB1/2/3 registers and the APB1/2 registers, so
for the APB1/2 registers we calculate a number that is 32 too high
and can index off the end of the enable_irq[] array.
The handling of the reset registers has an identical bug.
Adjust the calculation of irq_offset to cope with the gap, and fix
the case labels so accesses to the gap fall into the default
LOG_UNIMP rather than being treated as if they were an actual
register.
Coverity CID: 1663683, 1663686 Cc: qemu-stable@nongnu.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20260709104832.1989240-1-peter.maydell@linaro.org
Peter Maydell [Mon, 13 Jul 2026 11:34:17 +0000 (12:34 +0100)]
hw/misc/allwinner-r40-ccu.c: Correct handling of out of range accesses
In allwinner_r40_ccu_write() we handle writes to a MemoryRegion of
size AW_R40_CCU_IOSIZE, and the register array is sized accordingly
at (AW_R40_CCU_IOSIZE / sizeof(uint32_t)). However, one of the cases
in the switch is a range up to AW_R40_CCU_IOSIZE, which makes
Coverity think we might index off the end of the array. We also
have a similar case in the read function, but since that returns
early it doesn't have the same issue.
Adjust the handling of out of range accesses:
- use AW_R40_CCU_IOSIZE - 4 as the upper bound, as this is the
largest value we will actually see
- return early in the write case, as we do in the read case
Coverity CID: 1663687 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Reviewed-by: Strahinja Jankovic <strahinja.p.jankovic@gmail.com>
Message-id: 20260709104802.1989086-1-peter.maydell@linaro.org
Peter Maydell [Mon, 13 Jul 2026 11:34:17 +0000 (12:34 +0100)]
hw/display/sm501: Don't allow guest to set ram size larger than it is
The SM501 DRAM_CONTROL register has a 7 bit Size field which allows
the guest to change the local memory size. We use the local memory
size in bounds checks calculations for 2D operations. Currently we
have no check on the validity of the value the guest programs to
this field, which means that the guest can:
- set it to a reserved value (6 or 7) which will cause
get_local_mem_size() to read outside sm501_mem_local_size[]
- set it to a value corresponding to more RAM than the card
was created with, so that the 2D bounds check will let 2D
operations access off the end of the memory region
Fix this by decoupling the value the guest reads and writes to this
field from the internal size we consider the local memory to have.
We validate changes and ignore them except for readback if they would
be reserved values or values for more memory than the card has.
Cc: qemu-stable@nongnu.org Reported-by: Heechan Kang Tested-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: BALATON Zoltan <balaton@eik.bme.hu> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20260707150933.1410507-4-peter.maydell@linaro.org
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3811 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Peter Maydell [Mon, 13 Jul 2026 11:34:17 +0000 (12:34 +0100)]
hw/display/sm501: Avoid overflow problems in bounds check calculations
When we check that a 2D rectangle operation isn't going to run off
the end of video RAM, we do the calculations as 32 bit arithmetic.
This means that carefully chosen guest register values can cause an
overflow so we don't detect that the operation is going to go outside
video memory.
Abstract the check out into a function, do the calculations as
64-bit arithmetic, and add assertions about the ranges of the
inputs.
Peter Maydell [Mon, 13 Jul 2026 11:34:17 +0000 (12:34 +0100)]
hw/display/sm501: Catch bad coordinates for RTL operations
The sm501 code doesn't check whether a right-to-left operation has
specified a width greater than the x-coordinate (which would make it
extend off the left edge of the screen), or similarly a height
greater than the y-coordinate. This means the guest can misprogram
the device so that we underflow when calculating the address of the
top left pixel, which might result in accessing out of bounds
memory. Catch this as a guest error and ignore the operation.
Reported-by: Yannick Wang Tested-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: BALATON Zoltan <balaton@eik.bme.hu> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20260707150933.1410507-2-peter.maydell@linaro.org Cc: qemu-stable@nongnu.org
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3920 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Peter Maydell [Mon, 13 Jul 2026 11:34:17 +0000 (12:34 +0100)]
hw/usb/dev-wacom: Don't write off end of buffer
In usb_wacom_handle_data() we allocate a buffer with a size
determined by the transfer size requested by the guest. We then fill
it in by calling either usb_mouse_poll() or usb_wacom_poll(), both of
which functions take a length and return an actual length, which we
pass to usb_packet_copy(). However, usb_mouse_poll() doesn't check
the buffer size as it fills in the buffer, so if the guest passes an
overly short transfer size then it will write off the end of the
allocated buffer.
Check the length is at least big enough for the minimum 3 byte
packet and return nothing if it is not, as usb_wacom_poll() does.
Cc: qemu-stable@nongnu.org
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3672 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Message-id: 20260706182034.1003176-1-peter.maydell@linaro.org
Peter Maydell [Mon, 13 Jul 2026 11:34:17 +0000 (12:34 +0100)]
hw/net/vmxnet3: Correct bounds check on tx queue index
In vmxnet3_io_bar0_write(), we try to bounds-check the TX queue index
provided by the guest against the total number of queues. However,
we have an off-by-one error: the valid indexes are from 0 to
txq_num-1, so we need a "<" comparison, not "<=".
Cc: qemu-stable@nongnu.org
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3780 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Message-id: 20260706175408.905362-1-peter.maydell@linaro.org
Alex Bennée [Mon, 13 Jul 2026 11:34:17 +0000 (12:34 +0100)]
hw/dma: don't allow weird transfer lengths for bcm2835
The datasheet doesn't explicitly say that TXFR_LEN has to be word
aligned but the fact there is a DMA_D_WIDTH flag to select between 32
bit and 128 bit strongly implies that is how it works. The downstream
rpi kernel also goes to efforts to not write sub-4 byte lengths so
lets:
- fail when mis-programmed and report GUEST_ERROR
- catch setting D_WIDTH for 128 bit and report UNIMP
Yodel did some digging into the specs (see discussion link):
However was unable to come up with an unambiguous conclusion without
testing on the real hardware. So in the absence of certainty and for
the sake of addressing the DoS I suggest we merge as is for now.
target/arm: Be more defensive for invalid tlbi_aa64_get_range
It's possible to program TCR_ELx with an invalid granule size,
which could match passing an invalid granule size to TLBI RVA,
which would then fall through to assert in arm_granule_bits.
Cc: qemu-stable@nongnu.org Fixes: 3c003f7029e ("target/arm: Use ARMGranuleSize in ARMVAParameters") Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Message-id: 20260710175818.528974-1-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Fixes: 92e340997f861 ("hw/arm/virt: Use stored SMMUv3 device list for IORT build") Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-id: 20260709111225.1106856-1-marcandre.lureau@redhat.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Alex Bennée [Mon, 13 Jul 2026 11:34:17 +0000 (12:34 +0100)]
docs/system: add FEAT_HAF
This is a subset of FEAT_HAFDBS which we have already implemented.
Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20260708145841.3032079-9-alex.bennee@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Alex Bennée [Mon, 13 Jul 2026 11:34:17 +0000 (12:34 +0100)]
docs/system: add FEAT_S2TGran[4|16|64]K features
We already have the logic to handle these granule sizes in our stage 2
page table walk code.
Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20260708145841.3032079-8-alex.bennee@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Alex Bennée [Mon, 13 Jul 2026 11:34:17 +0000 (12:34 +0100)]
docs/system: fix sorting of FEAT_S2[PIE|FWB]
Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20260708145841.3032079-7-alex.bennee@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Alex Bennée [Mon, 13 Jul 2026 11:34:17 +0000 (12:34 +0100)]
docs/system: document FEAT_IVIPT
This is for documentation completeness - a system implements
FEAT_IVIPT if it implements any permitted instruction cache
implementation. QEMU doesn't model caches which is a
permitted (non)implementation.
Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20260708145841.3032079-6-alex.bennee@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Alex Bennée [Mon, 13 Jul 2026 11:34:17 +0000 (12:34 +0100)]
docs/system: document FEAT_MTE4
FEAT_MTE4 includes the sub-features: FEAT_MTE_CANONICAL_TAGS,
FEAT_MTE_TAGGED_FAR, FEAT_MTE_STORE_ONLY and FEAT_MTE_NO_ADDRESS_TAGS.
We have already implemented those so update the docs to include the
rolled up feature.
Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20260708145841.3032079-5-alex.bennee@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Alex Bennée [Mon, 13 Jul 2026 11:34:17 +0000 (12:34 +0100)]
docs/system: document FEAT_Secure
We have had support for Secure state ever since the initial TrustZone
support.
Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20260708145841.3032079-4-alex.bennee@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Alex Bennée [Mon, 13 Jul 2026 11:34:17 +0000 (12:34 +0100)]
docs/system: add big and little endian features names
We've always supported these features but they have official feature
names in the Arm ARM now so we should declare them for completeness.
Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20260708145841.3032079-3-alex.bennee@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Alex Bennée [Mon, 13 Jul 2026 11:34:17 +0000 (12:34 +0100)]
docs/system: declare support for FEAT_EVT2
The actual implementation supports the additional trapping registers
of HCR_TTLBIS | HCR_TTLBOS. We already set the value to 2 for -cpu max
and don't currently model any CPUs that only have FEAT_EVT.
Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20260708145841.3032079-2-alex.bennee@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Generally we expect a PMBus sensor to issue writes after all pending
reads have completed. If a data read needs to be resumed, this state can
be tracked in the device model and the pending data placed in the output
buffer.
Signed-off-by: Titus Rwantare <titusr@google.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Message-id: 20260706230056.1888992-4-titusr@google.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Eric Auger [Mon, 13 Jul 2026 11:34:16 +0000 (12:34 +0100)]
hw/arm/smmuv3: Fix possible overflow in strtab_base computation
In the linear stream table mode (FMT = 0), if the guest programs
SMMU_STRTAB_BASE_CFG.LOG2SIZE (8 bits) to something bigger than 58,
MAKE_64BIT_MASK() will overflow. So cap the mask length to 64. We
still comply with the spec ADDR alignment computation:
ADDR[LOG2SIZE + 5:0] = 0.
In the 2 level stream table mode (FMT = 1), we don't have this risk
anymore since SPLIT is sanitized and equals to 6 at minimum.
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3632 Signed-off-by: Eric Auger <eric.auger@redhat.com> Reviewed-by: Shameer Kolothum <skolothumtho@nvidia.com>
Message-id: 20260707085028.165557-4-eric.auger@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Currently the guest value for the SPLIT field is not checked.
Also the spec says that values different from 6, 8, 10, respectively
meaning 4KB, 16kB and 64kB leaf tables are reserved and behave as 6.
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3632 Signed-off-by: Eric Auger <eric.auger@redhat.com> Reviewed-by: Shameer Kolothum <skolothumtho@nvidia.com>
Message-id: 20260707085028.165557-3-eric.auger@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Eric Auger [Mon, 13 Jul 2026 11:34:16 +0000 (12:34 +0100)]
hw/arm/smmuv3: Fix off-by-one bug in alignment strtab mask
The stream table base address needs to be aligned to its size.
With FMT == 0 (linear stream table), the table size is log2size *
STE_SIZE (2^6). So the spec says the base address
must have ADDR[LOG2SIZE + 5:0] = 0.
With FMT == 1 (2 level stream table), the table size is
(log2size - split) * L1STD_SIZE (2^3) So the spec days
the effective base address is aligned by the SMMU to the larger of
64 bytes or the first-level table size:
ADDR[MAX(5, (LOG2SIZE - SPLIT - 1 + 3)):0] = 0.
MAKE_64BIT_MASK() second argument is a size and not a shift, so
fix this off-by-one computation.
Subsequent patches will fix the risk of overflow in MAKE_64BIT_MASK()
Signed-off-by: Eric Auger <eric.auger@redhat.com> Reviewed-by: Shameer Kolothum <skolothumtho@nvidia.com>
Message-id: 20260707085028.165557-2-eric.auger@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
hw/arm/tegra241-cmdqv: Do not sync GERRORN on VCMDQ allocation
When a guest hits a command error, the hardware sets GERROR and the guest
acknowledges it by writing GERRORN to match. These registers use toggle
semantics, and since GERROR is read-only, both GERROR and GERRORN may
remain set after an error has been handled. As long as they stay equal
there is no pending error, so a subsequent VM is unaffected.
When a new VM starts, QEMU allocates the hardware VCMDQ and flushes its
cached GERRORN of zero, while the hardware may still have both GERROR and
GERRORN set from an error the previous guest acknowledged. This makes them
differ again, so the hardware sees a pending error and stall the VCMDQ,
leading to CMD_SYNC timeouts.
Do not sync GERRORN when allocating a hardware VCMDQ.
Fixes: 1d0f77535417 ("hw/arm/tegra241-cmdqv: Route allocated VCMDQ Page0 accesses to the mmap'd host VINTF page0") Suggested-by: Nicolin Chen <nicolinc@nvidia.com> Signed-off-by: Shameer Kolothum <skolothumtho@nvidia.com> Reviewed-by: Nicolin Chen <nicolinc@nvidia.com> Tested-by: Nicolin Chen <nicolinc@nvidia.com> Reviewed-by: Eric Auger <eric.auger@redhat.com>
Message-id: 20260707112450.111178-1-skolothumtho@nvidia.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
hw/misc/zynq_slcr.c: drop duplicate reset value for DDRIOB_DCI_CTRL
When adding a reset value for DDRIOB_DCI_CTRL in c8ba862dbfdc, we haven't
noticed that a reset value already exists. DDRIOB is a 32 bit register, so
incrementing it by 12 will access the DDRIOB_DCI_CTRL register. According to
the manual [1] the correct reset value is 0x00000020. Additionally, c8ba862dbfdc won't work with a reset value of 0x00000021 because it tries to
detect a toggle of the reset bit (bit 0). Therefore, we drop the old reset
value and keep the new one introduced in c8ba862dbfdc.
TAP version 13
ok 1 test_hotplug_blk.HotPlugBlk.test # SKIP no support for machine q35
1..1
Fixes: 0e7aa78b0bee50 ("tests/functional: use QMP to query available machines") Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-ID: <20260710090317.498350-1-vsementsov@yandex-team.ru> Signed-off-by: Thomas Huth <th.huth@posteo.eu>
* tag 'pull-lu-20260710' of https://gitlab.com/rth7680/qemu:
common-user: Move guest_base, have_guest_base to probe-guest-base.c
bsd-user: Use probe_guest_base
common-user: Move probe_guest_base from linux-user
common-user: Implement read_self_maps for FreeBSD
common-user: Move selfmap from util
include/user/guest-host: Include missing cpu.h
common-user: Initialize mmap_min_addr for FreeBSD
common-user: Move mmap_min_addr from linux-user
linux-user: Use PGBRange for commpage
linux-user: Pass image_range to probe_guest_base
linux-user: Drop hiaddr out-of-range check in probe_guest_base
linux-user: Use PGBRange in load_elf_image
linux-user: Introduce PGBRange
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Stefan Hajnoczi [Sat, 11 Jul 2026 05:15:22 +0000 (07:15 +0200)]
Merge tag 'pull-tpm-2026-07-10-1' of https://github.com/stefanberger/qemu-tpm into staging
Merge tpm 2026/07/10 v1
# -----BEGIN PGP SIGNATURE-----
#
# iQEzBAABCgAdFiEEuBi5yt+QicLVzsZrda1lgCoLQhEFAmpRAe4ACgkQda1lgCoL
# QhGL0gf9HIR8FclQjPEi4qEYylE0hD7CXEpOkxmiX3dIP8fVn/FX8fYjSetgcJdb
# DINIiph2ypTRv+ZUtAC+s8UaYMCYUV9CM5Fs3TnwEayAvVNuuIRfz5gi00eZyprE
# RxL4b6LMoucTm9HnBre8SYlGzlb25MgstHy86s0vl4O9LuLZ9PgJq8aONp99YvCK
# IdAIbyOoL3wAyzpK55igRa1Ld6uxLGALByWWXZOKyLnutog/V8yOhV2uo70h8u6j
# DhFeAVNTZHDRwFvONO1n0M97mY21tWaU4QQ3gmznEknfpnbB66y503LhuKwmlOgg
# FdOSO+cB93wECvXi7uK7nR9VYHMDsg==
# =WrOS
# -----END PGP SIGNATURE-----
# gpg: Signature made Fri 10 Jul 2026 16:30:06 CEST
# gpg: using RSA key B818B9CADF9089C2D5CEC66B75AD65802A0B4211
# gpg: Good signature from "Stefan Berger <stefanb@linux.vnet.ibm.com>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: B818 B9CA DF90 89C2 D5CE C66B 75AD 6580 2A0B 4211
* tag 'pull-tpm-2026-07-10-1' of https://github.com/stefanberger/qemu-tpm:
hw/core/machine: disable tpm-tis-device PPI for machine type <= 11.0
hw/tpm: gate PPI support on tpm-tis-device behind a device property
hw/core/platform-bus: guard platform_bus_get_mmio_addr() against NULL
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Pass a PGBRange structure instead of separate guest_loaddr
and guest_hiaddr parameters. This allows NULL to indicate
that the image is relocatable, so that image_range->lo == 0
is a valid fixed setting.
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/1890 Tested-by: Helge Deller <deller@gmx.de> Reviewed-by: Warner Losh <imp@bsdimp.com> Reviewed-by: Helge Deller <deller@gmx.de> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
linux-user: Drop hiaddr out-of-range check in probe_guest_base
Since dropping 32-bit host support, a guest address cannot
overflow a host pointer. This means guest_hiaddr is unused
for relocatable images, so don't pass guest_hiaddr as size.
Reviewed-by: Warner Losh <imp@bsdimp.com> Reviewed-by: Helge Deller <deller@gmx.de> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
hw/tpm: gate PPI support on tpm-tis-device behind a device property
Add a "ppi" boolean property (default: true) to tpm-tis-device.
When ppi=off the RAMBlock is never registered and the migration
stream omits "tpm-ppi", restoring backward compatibility.
Move sysbus_init_mmio() calls from instance_init to realizefn so
the memory regions are initialized before being registered. When
ppi=off, the PPI MMIO region is simply not exposed.
Fixes: 46cd2c1050f0 ("hw/tpm: add PPI support to tpm-tis-device for ARM64 virt") Signed-off-by: Mohammadfaiz Bawa <mbawa@redhat.com> Reviewed-by: Stefan Berger <stefanb@linux.ibm.com> Link: https://lore.kernel.org/qemu-devel/20260619093140.832136-3-mbawa@redhat.com Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
hw/core/platform-bus: guard platform_bus_get_mmio_addr() against NULL
sysbus_mmio_get_region() returns NULL when a device has fewer MMIO
regions than the requested slot index. platform_bus_get_mmio_addr()
passes the result directly to memory_region_is_mapped() without a
NULL check, causing a SIGSEGV.
Return -1 early when the region pointer is NULL, consistent with the
existing "not mapped" path.
Stefan Hajnoczi [Fri, 10 Jul 2026 05:11:03 +0000 (07:11 +0200)]
Merge tag 'pull-riscv-to-apply-20260710' of https://github.com/alistair23/qemu into staging
RISC-V PR for 11.1
* Fix IOMMU fault type for spa_fetch() faults
* Check IOMMU for reserved PTE bits
* Fault when IOMMU !PTE_U and no priv access
* Fault IOMMU for non-user PTE in G_STAGE
* Check IOMMU reserved MSI PTE basic bits
* Record fault on IOMMU-generated MSI write
* Move RISC-V TCG files and fix --disable-tcg
* Check for misaligned IOMMU IOHGATP_PPN
* Update IOMMU ioval2 when faulting in spa_fetch()
* Forbid IOMMU GATE/SADE if caps.AMO_HWADD is zero
* Set IOMMU ftype and iova in riscv_iommu_ctx()
* Check PCIe DOE mailbox length for overflows
* Add extensions after v7.1-rc4 update
* Remove job building OpenSBI firmware binaries
* Correct ACPI field sequence in SPCR table
# -----BEGIN PGP SIGNATURE-----
#
# iQIzBAABCgAdFiEEaukCtqfKh31tZZKWr3yVEwxTgBMFAmpQXvUACgkQr3yVEwxT
# gBPkyQ/+J3Lhx3W1Go5+m4oRBbCPxq5w4ZyV3VUPNBcwLXtcZJQNiW2YghCGegNn
# 1HJzHihA1W9YromNlmIJzcOOWM81yScf0tV29NXCQW0Si1N9cA2jr4z8Nunwcndu
# L+T5s5nLKaijwM0xnL4CtnhZ3fu+gcowS1V2ohaQvRyMVkHCHUsz9nqoHa/j6GsX
# ipItcOQt6tXcAD1n+MqD5lm1UlQ1eV1d3pMLIwTU3+WpvDJzgOGriF+t56kbVIlT
# NcyT2ShmSSVpl6nu8VqqmE8nMLkKzw7c6uAJI8QR99yCqCWeFhkCeE6boE0CWFZl
# qAsmWL3tY1FcKU1bKiSZBaeDDFJUq1lKTMzJFyTDOR6O0kuVtUi9vJvSK1BXyGza
# zBjmRvnZYVM1CPu6IE/HvVWc3L1EECv1v6LF+yIOKfSpWe5k+AM8NN82awHPBQLO
# wnsUWFziecLae9ipdOnhmf7MB2oHiYzmjyRahgr4/ZbCOvcBdUF8l43nH067iNub
# 9DXuQt61dcayEkfz281ziiHBwSqkwK6aEpuEDcG8MFXyYth98Rl6e0iz5AHp5+rv
# YVp1sKcel9ZJSIdHb2zo/yXJNh/0tG6MChpoQnaJ2xHw+KHlRs1xZjt04itJl0lK
# utEe24epJCzE2HPeRVBTPSMRRvh5KudaAMdOgj5dsPCM6cq3qEM=
# =cZmZ
# -----END PGP SIGNATURE-----
# gpg: Signature made Fri 10 Jul 2026 04:54:45 CEST
# gpg: using RSA key 6AE902B6A7CA877D6D659296AF7C95130C538013
# gpg: Good signature from "Alistair Francis <alistair@alistair23.me>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 6AE9 02B6 A7CA 877D 6D65 9296 AF7C 9513 0C53 8013
* tag 'pull-riscv-to-apply-20260710' of https://github.com/alistair23/qemu: (40 commits)
tests: update SPCR loongarch64 and riscv64 test data
hw/acpi: correct field sequence in SPCR table
tests: allow differences in SPCR
gitlab-ci: Remove job building OpenSBI firmware binaries
target/riscv/kvm: add extensions after v7.1-rc4 update
hw/pci/pcie_doe: Check mailbox length for overflows
hw/riscv/riscv-iommu.c: set ftype and iova in riscv_iommu_ctx()
hw/riscv/riscv-iommu: forbid GATE/SADE if caps.AMO_HWADD is zero
hw/riscv/riscv-iommu.c: update ioval2 when faulting in spa_fetch()
hw/riscv/riscv-iommu.c: check for misaligned IOHGATP_PPN
gitlab-ci.d/crossbuilds: add riscv64 KVM-only build job
target/riscv: move riscv_cpu_set_aia_ireg_rmw_cb() to riscv_imsic
target/riscv: move riscv_cpu_set_geilen() to riscv-imsic
target/riscv/tcg: remove unused riscv_cpu_get_geilen()
target/riscv: move riscv_cpu_set_rdtime_fn to riscv_aclint
target/riscv/gdbstub.c: isolate TCG only checks
hw/riscv/riscv_hart.c isolate tcg only bits
target/riscv/cpu.c: filter TCG only bits in riscv_cpu_reset_hold()
target/riscv: gate riscv_cpu_update_mip with tcg_enabled()
target/riscv/cpu.c: handle TCG bits of riscv_cpu_dump_state
...
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
* tag 'misc-next-pull-request' of https://gitlab.com/berrange/qemu:
docs: outline some guidelines for security classification
io/channel-socket: Document why we can ignore socket_set_cork() errors
util/filemonitor-inotify: Use QEMU_LOCK_GUARD()
crypto/x509-utils: fix gnutls error code in crt_init failure path
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
tests: update SPCR loongarch64 and riscv64 test data
On LoongArch and RISC-V the SPCR test data contained:
Terminal Type : 00
Language : 03
The corrected values are:
Terminal Type : 03
Language : 00
See the specification of the table in
https://learn.microsoft.com/en-us/windows-hardware/drivers/bringup/serial-port-console-redirection-table
The ACPI table data was rebuilt with
tests/data/acpi/rebuild-expected-aml.sh.
Remove SPCR expections from tests/qtest/bios-tables-test-allowed-diff.h.
Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com> Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20260705063147.199732-4-heinrich.schuchardt@canonical.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
For easier bisection add the SPCR table to bios-tables-test-allowed-diff.h.
Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com> Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20260705063147.199732-2-heinrich.schuchardt@canonical.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Bin Meng [Mon, 6 Jul 2026 16:17:16 +0000 (00:17 +0800)]
gitlab-ci: Remove job building OpenSBI firmware binaries
The OpenSBI firmware build job follows the same pattern as the EDK2 job
[1] that was removed earlier [2]: it exists to produce firmware binaries
from CI artifacts, but those outputs are not consumed by the tree.
Remove the job definition and its project include to avoid maintaining
bitrotting container and firmware build logic.
[1] 71920809ceab ("gitlab-ci.yml: Add jobs to build EDK2 firmware binaries")
[2] 690ceb71936f ("gitlab-ci: Remove job building EDK2 firmware binaries")
Signed-off-by: Bin Meng <bin.meng@processmission.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Message-ID: <20260706161716.29488-1-bin.meng@processmission.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Wang Yechao [Tue, 7 Jul 2026 07:26:10 +0000 (15:26 +0800)]
target/riscv/kvm: add extensions after v7.1-rc4 update
Expose zilsd, zclsd and zalasr.
Signed-off-by: Wang Yechao <wang.yechao255@zte.com.cn> Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20260707072610.403595-1-wang.yechao255@zte.com.cn> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
hw/pci/pcie_doe: Check mailbox length for overflows
It was possible that a guest could overflow the `doe_cap->write_mbox`
buffer by writing more then PCI_DOE_DW_SIZE_MAX dwords.
`doe_cap->write_mbox_len` would continue to increment and there were no
bounds checks on the length when offsetting into doe_cap->write_mbox.
This patch adds a check and reports a guest error if we would overflow.
On an overflow we also silenty discard the entire object as instructed
to do in the PCIe spec when the length specified in the header
(up to PCI_DOE_DW_SIZE_MAX dwords) doesn't match the length of the
object.
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3679 Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Reviewed-by: Tao Tang <tangtao1634@phytium.com.cn>
Message-ID: <20260707020750.788960-1-alistair.francis@wdc.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
hw/riscv/riscv-iommu.c: set ftype and iova in riscv_iommu_ctx()
We're hardcoding faulting type as READ, where it could very well be a
write access, and we're not recording the faulting addr/iova.
A note was added in the fault_type logic because I wasn't able to
trivially handle a probable code repeitition it in this same patch.
Something to do in a later date.
Fixes: 0c54acb8243d ("hw/riscv: add RISC-V IOMMU base emulation")
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3564 Signed-off-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
Message-ID: <20260701092241.307801-1-daniel.barboza@oss.qualcomm.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
hw/riscv/riscv-iommu.c: update ioval2 when faulting in spa_fetch()
riscv_iommu_translate(), the only caller of riscv_iommu_spa_fetch(),
will use riscv_iommu_report_fault() for all faults it detects. And it
will use iotlb->translated_addr as 'iotval2' every time.
At this moment we're updating iotlb->translated_addr only after a
translation step is completed, meaning any fault that occur before that
will have a zeroed iotlb->translated_addr, and as a result iotval2 will
also be zero later on.
Keep iotlb->translated_addr updated with the latest translated addr we
have.
Fixes: 0c54acb8243d ("hw/riscv: add RISC-V IOMMU base emulation")
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3559 Signed-off-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com> Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20260702171202.1322493-1-daniel.barboza@oss.qualcomm.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Add CI coverage for a riscv64 --disable-tcg cross build. This ensures that
RISC-V no-TCG/KVM-only builds keep working and prevents TCG-only code from
being accidentally pulled into common RISC-V sources again.
The cross_accel_build_job template enables KVM by default via
--enable-${ACCEL:-kvm}, so the extra options only need to disable TCG.
Signed-off-by: Zephyr Li <fritchleybohrer@gmail.com> Reviewed-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20260703180538.3346781-25-daniel.barboza@oss.qualcomm.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
target/riscv: move riscv_cpu_set_aia_ireg_rmw_cb() to riscv_imsic
riscv_imsic.c is the only caller. Having it sitting in the TCG only
cpu_helper.c gets in the way of --disable-tcg for no good reason.
Signed-off-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20260703180538.3346781-24-daniel.barboza@oss.qualcomm.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
target/riscv: move riscv_cpu_set_geilen() to riscv-imsic
riscv_imsic.c is the only caller. Having it sitting in the TCG only
cpu_helper.c gets in the way of --disable-tcg for no good reason.
Signed-off-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20260703180538.3346781-23-daniel.barboza@oss.qualcomm.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Message-ID: <20260703180538.3346781-22-daniel.barboza@oss.qualcomm.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
target/riscv: move riscv_cpu_set_rdtime_fn to riscv_aclint
There's no need for it to be in cpu_helper since riscv_aclint is the
only caller.
Signed-off-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20260703180538.3346781-21-daniel.barboza@oss.qualcomm.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
projects / thirdparty / qemu.git / log
