GuoHan Zhao [Thu, 26 Mar 2026 06:51:11 +0000 (14:51 +0800)]
ui/dbus: associate add_client completion with its request
Commit 99997823bbbd ("ui/dbus: add p2p=on/off option")
introduced an asynchronous D-Bus client setup path, with the completion
handler reaching back into the global dbus_display state.
This makes the callback effectively operate on whatever request is
current when it runs, rather than the one that created it. A completion
from an older request can therefore clear a newer
add_client_cancellable or install its connection after a replacement
request has already been issued. It also relies on the DBusDisplay
instance remaining alive until completion.
Fix this by passing the DBusDisplay and GCancellable as callback data,
taking references while the async setup is in flight, and only acting
on completion if it still matches the current request. Also drop the
previous cancellable before creating a new request.
audio/mixeng: fix sw/hw mixup in audio_pcm_sw_init_
Commit 42061a14358 ("audio/mixeng: replace redundant pcm_info fields
with AudioFormat") accidentally changed the conv/clip function selection
in audio_pcm_sw_init_ to use hw->info.af (the hardware voice format)
instead of sw->info.af (the software voice format). This causes audio
distortion when the software and hardware voices use different formats,
as the wrong conversion functions are applied to the audio data.
Fix by using sw->info.af, restoring the original behavior.
Paolo Bonzini [Fri, 27 Mar 2026 20:46:54 +0000 (21:46 +0100)]
hpet: lower HPET_MAX_TIMERS to 24
Each timer block occupies 32 bytes, but they only start at
offset 256 of the 1024-byte MMIO register space. Therefore
the correct limit for HPET_MAX_TIMERS is 24, not 32.
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Paolo Bonzini [Fri, 27 Mar 2026 16:25:06 +0000 (17:25 +0100)]
hpet: fix bounds check for s->timer[]
Fix an off-by-one issue in QEMU's HPET read and write MMIO handlers.
Both handlers check timer_id > s->num_timers instead of timer_id >=
s->num_timers, allowing a guest to access one timer beyond the valid
range.
The affected slot is initialized properly in hpet_realize, which goes
through all HPET_MAX_TIMERS elements of the array, so even though
it is not reset in hpet_reset() the bug does not cause any use of
uninitialized host memory. Because of this, and also because (even
though HPET_MAX_TIMERS is 32) the HPET only has room for 24 timers in
its MMIO region, the bug has no security implications.
Commit 869b0afa4fa ("rust/hpet: Drop BqlCell wrapper for num_timers",
2025-06-06) silently fixed the same bug in rust/hw/timer/hpet/src/device.rs.
Reported-by: Yuma Kurogome, Ricerca Security, Inc. <yumak@ricsec.co.jp> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
linhuang [Fri, 27 Mar 2026 07:39:35 +0000 (15:39 +0800)]
net/ftgmac100: preserve full VLAN TCI in TX tag insertion
The VLAN tag insertion helper took vlan_tci as an 8-bit value, while
the descriptor provides a 16-bit VLAN TCI. This truncated egress tags
and caused VLAN ID corruption (for example, 4088/0x0ff8 became
248/0x00f8 at the receiver).
Change vlan_tci to uint16_t in the TX VLAN insertion path so the full
802.1Q TCI is preserved and transmitted correctly.
GuoHan Zhao [Wed, 25 Mar 2026 08:54:50 +0000 (16:54 +0800)]
hw/i2c/aspeed_i2c: reset and migrate pending_intr_sts
Commit 7e82393ed058 ("hw/i2c/aspeed: fix lost interrupts on
back-to-back commands") introduced pending_intr_sts to preserve
interrupt bits that collide with already pending status bits.
That deferred interrupt state is consumed later when the guest clears
INTR_STS, but it is not reset in aspeed_i2c_bus_reset() and it is not
part of the bus migration state. A reset can therefore leave stale
deferred bits behind, and migration can silently drop them.
Clear pending_intr_sts on reset and include it in VMState while keeping
compatibility with older migration streams.
Fixes: 7e82393ed058 ("hw/i2c/aspeed: fix lost interrupts on back-to-back commands") Signed-off-by: GuoHan Zhao <zhaoguohan@kylinos.cn> Link: https://lore.kernel.org/qemu-devel/20260325085450.126595-1-zhaoguohan@kylinos.cn Reviewed-by: Cédric Le Goater <clg@redhat.com> Reviewed-by: Jithu Joseph <jithu.joseph@oss.qualcomm.com> Signed-off-by: Cédric Le Goater <clg@redhat.com>
We must also remove the pre-built blob to avoid a GPL violation
from lack of complete & corresponding source.
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Message-ID: <20260324122025.892666-1-berrange@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Thomas Huth <thuth@redhat.com>
Thomas Huth [Thu, 26 Mar 2026 15:48:50 +0000 (16:48 +0100)]
hw/display/cirrus_vga_isa: Disable global_vmstate by default for new machines
In the long run, we would like to get rid of the code that allows to
register migration state globally, so set global_vmstate to false when
using the isa-cirrus-vga device with new machines, and only enable it
for older machines to avoid breaking the migration there.
Reviewed-by: Fabiano Rosas <farosas@suse.de> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20260326154850.301609-1-thuth@redhat.com>
Thomas Huth [Thu, 26 Mar 2026 11:34:57 +0000 (12:34 +0100)]
hw/display/vga-isa: Fix migration of the isa-vga device
QEMU currently crashes when migrating a guest that uses the
isa-vga device as display. This happens because vga_isa_class_initfn()
registers a vmsd for vmstate_vga_common that operates on VGACommonState.
But the isa-vga device is derived from ISADevice, not from VGACommonState,
so the migration code tries to fill in the data for VGACommonState to
the memory that is a ISADevice instead, which is of cause causing trouble.
We need an indirection here as it's also e.g. done in vga-pci.c, so
that the migration data gets filled into the right location.
While we're at it, also drop the "global_vmstate = true" here. Since
migration was broken for this device during the last 15 years (!) anyway,
we don't have to worry about maintaining backward compatibility with this
switch for older versions of QEMU anymore.
Fixes: 7435b791ca9 ("vga-isa: convert to qdev") Reviewed-by: Fabiano Rosas <farosas@suse.de> Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20260326113457.159065-1-thuth@redhat.com>
Thomas Huth [Tue, 24 Mar 2026 16:35:41 +0000 (17:35 +0100)]
tests/functional/qemu_test: Silence warnings from pylint in config.py
Pylint complains here:
config.py:1:0: C0114: Missing module docstring (missing-module-docstring)
config.py:28:4: W0719: Raising too general exception: Exception (broad-exception-raised)
Add a module description and replace the general Exception to fix this.
And while we're at it, and since we've got a proper module description
string now, also replace the copy-n-pasted comment at the top of the file
with a proper SPDX identifier.
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20260324163543.55503-5-thuth@redhat.com>
Thomas Huth [Tue, 24 Mar 2026 16:35:40 +0000 (17:35 +0100)]
tests/functional/qemu_test: Split huge fetch() function in asset.py
The fetch() function has become really huge and pylint complains about
that. Extract the internal retry-three-times-download loop into a
separate function to make it a little bit more readable and to make
pylint happy about this file again.
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20260324163543.55503-4-thuth@redhat.com>
Thomas Huth [Tue, 24 Mar 2026 16:35:39 +0000 (17:35 +0100)]
tests/functional/qemu_test: Silence (most) warnings from pylint in asset.py
Pylint currently complains:
asset.py:1:0: C0114: Missing module docstring (missing-module-docstring)
asset.py:21:0: C0115: Missing class docstring (missing-class-docstring)
asset.py:28:15: C0209: Formatting a regular string which could be an f-string (consider-using-f-string)
asset.py:34:0: C0115: Missing class docstring (missing-class-docstring)
asset.py:49:15: C0209: Formatting a regular string which could be an f-string (consider-using-f-string)
asset.py:73:4: C0116: Missing function or method docstring (missing-function-docstring)
asset.py:80:4: C0116: Missing function or method docstring (missing-function-docstring)
asset.py:83:4: C0116: Missing function or method docstring (missing-function-docstring)
asset.py:125:4: C0116: Missing function or method docstring (missing-function-docstring)
asset.py:181:43: C0209: Formatting a regular string which could be an f-string (consider-using-f-string)
asset.py:190:39: C0209: Formatting a regular string which could be an f-string (consider-using-f-string)
asset.py:201:39: C0209: Formatting a regular string which could be an f-string (consider-using-f-string)
asset.py:213:15: W0718: Catching too general exception Exception (broad-exception-caught)
asset.py:218:35: C0209: Formatting a regular string which could be an f-string (consider-using-f-string)
asset.py:125:4: R0912: Too many branches (16/12) (too-many-branches)
asset.py:125:4: R0915: Too many statements (64/50) (too-many-statements)
asset.py:228:4: C0116: Missing function or method docstring (missing-function-docstring)
asset.py:249:4: C0116: Missing function or method docstring (missing-function-docstring)
asset.py:257:4: C0116: Missing function or method docstring (missing-function-docstring)
Fix all the warnings except for the R0912 and R0915 which will be tackled
in a later commit.
And while we're at it, also add a proper SPDX license identifier.
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20260324163543.55503-3-thuth@redhat.com>
Peter Maydell [Fri, 27 Mar 2026 18:41:05 +0000 (18:41 +0000)]
Merge tag 'qga-pull-2026-03-27' of https://github.com/kostyanf14/qemu into staging
qga-pull-2026-03-27
# -----BEGIN PGP SIGNATURE-----
#
# iQIzBAABCgAdFiEEwsLBCepDxjwUI+uE711egWG6hOcFAmnGxwgACgkQ711egWG6
# hOdp2Q/+KEAF9+CNBJSwlfiNpC8U0SK0IzgP/PRGADUrZa422dWxmbwxyU3RkMY5
# HbFyupLCpnUn+CrmLwUyEDVXAWDox78SGPNt9L/E/GxnVKXgIi/caPayk2SSMrll
# gGlbvc4NMQc6bZwoPiqms58Fm9N0QlgA20TP8yg7doViuWOEhVK2cP8rR0TWWkQ1
# 69EJ7uEwNYhAVrC66ajPZMcH1JEmsLydNbHZK0AcsId32C+mbug71ewRTG5Uq9hS
# a1y3UaylDNuO+alLqpYj2Ej9ouTO0leSvnWOPrPGNdpONHhb5FXZ2whviiKbpAq/
# nGYi39slrxMsc67kkpnlztWwDrUW2XL2D1eF71WwAvSSGJdKd/4tJo1zvW3kMmTG
# NB4rJ7tud7ko63lsuMYnlocKgobeqDBjtY+OjDjn294gVJ5qkpWIdvbGn4pCePEZ
# EPgeRso3zoIYW0FQmOfxJ8pj3RkaINP3CvGbrbPoozYD6Q+Y3O5KEzwLCn1RofGc
# FwyaOlTAAFdTjGYveRhGfk/4TffI29MzJD2dSqdRDJNjDfhjJDK6E2MHwkEMgOXB
# 7dkZhEIssgQIGEVElVv8xb0sadAGkEWA8a0ytcdSqYGGjzgbEPWbz2Ywp5Mee+8T
# XNCam/GlzwnYSpU+Ar2VsicYK20nKeu0CO5RzuCzKJw/QZv2FF8=
# =8J6E
# -----END PGP SIGNATURE-----
# gpg: Signature made Fri Mar 27 18:06:00 2026 GMT
# gpg: using RSA key C2C2C109EA43C63C1423EB84EF5D5E8161BA84E7
# gpg: Good signature from "Kostiantyn Kostiuk (Upstream PR sign) <kkostiuk@redhat.com>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: C2C2 C109 EA43 C63C 1423 EB84 EF5D 5E81 61BA 84E7
* tag 'qga-pull-2026-03-27' of https://github.com/kostyanf14/qemu:
scripts/qemu-guest-agent/fsfreeze-hook: Fix syslog-fallback logic
scripts/qemu-guest-agent/fsfreeze-hook: Avoid use of PIPESTATUS
scripts/qemu-guest-agent/fsfreeze-hook: Avoid bash-isms
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Pierrick Bouvier [Thu, 26 Mar 2026 21:44:36 +0000 (14:44 -0700)]
docs and tests: assets moved after GitHub account renaming
GitHub setup a permanent redirection for all repositories when accounts,
so the old links will keep on working also.
However, GitHub allow this username to be reused again. To ensure no one
can inject malicious content, I took ownership of the (newly free)
pbo-linaro account [1], so no one else can claim it.
This has a weird behaviour if it is run in a setup where we have
permissions that would allow us to write to $LOGFILE but it does not
currently exist. On the first execution, the '-w' fails and so we
set USE_SYSLOG=1. But since we also do the "touch $LOGFILE" step we
create an empty logfile. Then on the second time the script is
executed, we see a writeable logfile and will use it. The effect is
"log to syslog once, then to the logfile thereafter", which is not
likely to be what anybody wants.
Update the condition of the first check to only pick syslog if
the logfile exists but is not writable. This means that:
* if the logfile doesn't exist but we are able to create it,
we will create it and use it
* if the logfile already exists and we can write to it,
we will use it
* if the logfile already exists but we can't write to it,
we will fall back to syslog
* if the logfile doesn't exist and we can't create it,
we will fall back to syslog
Cc: qemu-stable@nongnu.org Fixes: 85978dfb6b1c133 ("qemu-ga: Optimize freeze-hook script logic of logging error") Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Kostiantyn Kostiuk <kkostiuk@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Link: https://lore.kernel.org/qemu-devel/20260317094806.1944053-4-peter.maydell@linaro.org Signed-off-by: Kostiantyn Kostiuk <kkostiuk@redhat.com>
Peter Maydell [Tue, 17 Mar 2026 09:48:05 +0000 (09:48 +0000)]
scripts/qemu-guest-agent/fsfreeze-hook: Avoid use of PIPESTATUS
PIPESTATUS is a bash-specific construct, and this script is supposed
to be POSIX shell. We only use it in one place, to capture the exit
status of a command whose output we are piping to 'logger'.
Replace the PIPESTATUS usage with the trick described in
https://unix.stackexchange.com/questions/14270/get-exit-status-of-process-thats-piped-to-another/70675#70675
which uses a command-group to capture the status of the
first process in the pipeline.
The fsfreeze-hook script starts with #!/bin/sh, but it uses
several bash-specific constructs, resulting in misbehaviour
on guest systems where /bin/sh is some other POSIX shell.
Fix the simple ones reported by shellcheck:
In scripts/qemu-guest-agent/fsfreeze-hook line 27:
touch "$LOGFILE" &>/dev/null || USE_SYSLOG=1
^---------^ SC3020 (warning): In POSIX sh, &> is undefined.
In scripts/qemu-guest-agent/fsfreeze-hook line 31:
local message="$1"
^-----------^ SC3043 (warning): In POSIX sh, 'local' is undefined.
In scripts/qemu-guest-agent/fsfreeze-hook line 46:
log_message "Executing $file $@"
^-- SC2145 (error): Argument mixes string and array. Use * or separate argument.
In scripts/qemu-guest-agent/fsfreeze-hook line 55:
if [ $STATUS -ne 0 ]; then
^-----^ SC2086 (info): Double quote to prevent globbing and word splitting.
There is also a use of PIPESTATUS that is more complex to fix;
that will be dealt with in a separate commit.
* tag 'pull-nvme-20260326' of https://gitlab.com/birkelund/qemu:
hw/nvme: fix heap-buffer-overflow in nvme_abort
hw/nvme: re-enable wzds bit in namespace dlfeat
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Peter Maydell [Thu, 26 Mar 2026 10:26:30 +0000 (10:26 +0000)]
Merge tag 'pr-plugins-20260325' of https://gitlab.com/pbo-linaro/qemu into staging
Changes:
- [PATCH 0/3] plugins: fix endianness for qemu_plugin_mem_get_value() (Pierrick Bouvier <pierrick.bouvier@linaro.org>) Link: https://lore.kernel.org/qemu-devel/20260325024252.3369186-1-pierrick.bouvier@linaro.org
# -----BEGIN PGP SIGNATURE-----
#
# iQGzBAABCgAdFiEEZrmU7KFPfy5auggff5BUDQoc0A8FAmnEWRAACgkQf5BUDQoc
# 0A/bnwv+M7tE/AxJBopnzMcAl2TAzYJXW2ZvipPutnPd83XNu5O/g1IBaQzGr06n
# 21SmDiNy7hUIW13bTPJXljycrykAgx320Fuj6R+E59Pa2D4sk7vJcwN7aJhMTgWy
# S0HhAeasHiNcPoEb8jPq6sGzS+wt4Xh+kmdjBa3CjIeerMMo/0bipUGn92Q01M81
# h+R9gDKmgtDci/fDx66Fvz8hE7P6jFTx6rHL1e1ksFBJ+FqYt9SQXQLqCcDLKzbo
# SW9k8wju1POxaKvf3Dg5vctejoogFzJCtKF7M/Fa4qo0DXzJP6eDMhlHcvzjfedJ
# xeVirOd5x3CO4AZ5KHCAoQWPu++UeGhirGhRCFc4s2MUopTwN8t4FGR0wpZxzGYC
# gNHB7/F3cm+pulMbr2MQZg3xVyy0q9+2ltNGjwo/vyjG4RxUIvNX6dsxu2sZ7Zpw
# lT1NqX0/4AlMsfeQCV3Rnx0V7+4HGarpbBZw5+Pgz2uhbP5g5ik5WBJY9rCzpwM/
# tFY4CTL4
# =NqGd
# -----END PGP SIGNATURE-----
# gpg: Signature made Wed Mar 25 21:52:16 2026 GMT
# gpg: using RSA key 66B994ECA14F7F2E5ABA081F7F90540D0A1CD00F
# gpg: Good signature from "Pierrick Bouvier <pierrick.bouvier@linaro.org>" [undefined]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 66B9 94EC A14F 7F2E 5ABA 081F 7F90 540D 0A1C D00F
* tag 'pr-plugins-20260325' of https://gitlab.com/pbo-linaro/qemu:
tests/tcg/plugins/mem.c: fix endian swap in update_region_info
include/plugins/qemu-plugin.h: add note about endianness of value returned by qemu_plugin_mem_get_value
tcg: Pass host-endian values to plugin_gen_mem_callbacks_*
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Kaixuan Li [Thu, 19 Mar 2026 09:46:00 +0000 (10:46 +0100)]
hw/nvme: fix heap-buffer-overflow in nvme_abort
In nvme_abort(), the submission queue pointer is dereferenced from the
guest-controlled sqid before validating it with nvme_check_sqid():
NvmeSQueue *sq = n->sq[sqid];
Since sqid is a 16-bit value (range 0-65535) taken directly from CDW10,
and n->sq[] is typically only max_ioqpairs+1 (65) entries, a malicious
guest can trigger an out-of-bounds heap read by sending an Abort command
with a large sqid.
ASan reports this as heap-buffer-overflow in nvme_abort.
Fix this by moving the array dereference to after the nvme_check_sqid()
bounds validation.
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3348 Fixes: 75209c071a ("hw/nvme: actually implement abort") Cc: qemu-stable@nongnu.org Signed-off-by: Kaixuan Li <kaixuanli@ntu.edu.sg> Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
Pankaj Raghav [Sun, 1 Mar 2026 16:07:21 +0000 (17:07 +0100)]
hw/nvme: re-enable wzds bit in namespace dlfeat
dlfeat was changed from 0x9 to 0x1 when PI support was added.
It was removed because we can't rely on unmap and have to physically
clear it to get the checksums right but that doesnt mean that we do not
support the bit.
The spec says that if wzds is enabled, then the controller supports
deallocate (DEAC) on write zeroes. But DEAC bit in write zeroes command
is only a hint, the controller might choose to physically write zeroes in
those areas.
As we are sending write zeroes command with BDRV_REQ_MAY_UNMAP to the
underlying block device anyway (if the unmap operation is supported),
change the dlfeat value back to 0x9.
A new flag FALLOC_FL_WRITE_ZEROES has been introduced in linux for
fallocate which will use the wzds bit in dlfeat to quickly zeroout extents
using unmap operation whenever possible[1].
tcg: Pass host-endian values to plugin_gen_mem_callbacks_*
If the host does not support swapped-endian loads and stores,
then we emulate those within the tcg expanders with explicit
bswap operations.
However, we were passing values to the plugin interface in
the middle of those bswap operations, which meant that we
would pass values of the wrong endianness to plugins when
running on hosts without swapped-endian loads and stores.
hw/audio/sb16: validate VMState fields in post_load
The SB16 VMState loads in_index and out_data_len as raw INT32
values with no bounds validation. A crafted migration stream or
VM snapshot can set these to values exceeding their respective
buffer sizes (in2_data[10] and out_data[50]), causing heap OOB
write in dsp_write() and heap OOB read in dsp_read().
Add bounds checks in sb16_post_load() to reject invalid values
before they can be used as array indices.
Mohamed Mediouni [Tue, 24 Mar 2026 15:13:17 +0000 (16:13 +0100)]
target/i386: emulate: add new callbacks
On Hyper-V fetching some guest registers is really expensive, so
add a way to query some state from information provided by Hyper-V
to save time on vmexits.
Mohamed Mediouni [Tue, 24 Mar 2026 15:13:12 +0000 (16:13 +0100)]
whpx: i386: workaround for Windows 10 support
Windows Server 2022 and later support
WHvCapabilityCodeProcessorPerfmonFeatures and
WHvPartitionPropertyCodeSyntheticProcessorFeaturesBanks.
Windows 10 supports neither of those.
As the QEMU executable doesn't have a manifest, OS version
queries do not return the actual Windows version but 6.2.9200
which corresponds to Windows 8. Windows Server 2022 and Windows
11 still use the 10.0 number, with distinction being the build
number.
As such, use the absence of perf monitoring feature query as
a cutoff to detect if a legacy OS is present.
Alyssa Ross [Mon, 23 Mar 2026 08:47:39 +0000 (09:47 +0100)]
tests/functional: preserve PYTHONPATH entries
Otherwise, it's not possible to use a packaged qemu.qmp.
Fixes: 1497377857 ("tests/functional: Prepare the meson build system for the functional tests") Signed-off-by: Alyssa Ross <hi@alyssa.is> Link: https://lore.kernel.org/r/20260323084739.1013748-1-hi@alyssa.is Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* tag 'for-upstream' of https://gitlab.com/kmwolf/qemu:
io-uring: Resubmit tails of short writes
linux-aio: Resubmit tails of short reads/writes
linux-aio: Put all parameters into qemu_laiocb
block/curl: free s->password in cleanup paths
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Hanna Czenczek [Tue, 24 Mar 2026 08:43:36 +0000 (09:43 +0100)]
io-uring: Resubmit tails of short writes
Short writes can happen, too, not just short reads. The difference to
aio=native is that the kernel will actually retry the tail of short
requests internally already -- so it is harder to reproduce. But if the
tail of a short request returns an error to the kernel, we will see it
in userspace still. To reproduce this, apply the following patch on top
of the one shown in HEAD^ (again %s/escaped // to apply):
QEMU_BUILD_BUG_ON(FUSE_MAX_WRITE_BYTES > BDRV_REQUEST_MAX_BYTES);
/* Limited by max_write, should not happen */
I know this is a bit artificial because to produce this, there must be
an I/O error somewhere anyway, but if it does happen, qemu will
understand it to mean ENOSPC for short writes, which is incorrect. So I
believe we need to resubmit the tail to maybe have it succeed now, or at
least get the correct error code.
So short reads already work (because there is code for that), but short
writes incorrectly produce ENOSPC. This patch fixes that by
resubmitting not only the tail of short reads but short writes also.
(And this patch uses the opportunity to make it so qemu_iovec_destroy()
is called only if req->resubmit_qiov.iov is non-NULL. Functionally a
non-op, but this is how the code generally checks whether the
resubmit_qiov has been set up or not.)
Reviewed-by: Kevin Wolf <kwolf@redhat.com> Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
Message-ID: <20260324084338.37453-4-hreitz@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Hanna Czenczek [Tue, 24 Mar 2026 08:43:35 +0000 (09:43 +0100)]
linux-aio: Resubmit tails of short reads/writes
Short reads/writes can happen. One way to reproduce them is via our
FUSE export, with the following diff applied (%s/escaped // to apply --
if you put plain diffs in commit messages, git-am will apply them, and I
would rather avoid breaking FUSE accidentally via this patch):
if (in->major != 7) {
error_report("FUSE major version mismatch: We have 7, but kernel has %"
@@ -1060,6 +1060,8 @@ fuse_co_read(FuseExport *exp, void **bufptr, uint64_t offset, uint32_t size)
void *buf;
int ret;
+ size = MIN(size, 4096);
+
/* Limited by max_read, should not happen */
if (size > FUSE_MAX_READ_BYTES) {
return -EINVAL;
@@ -1110,6 +1112,8 @@ fuse_co_write(FuseExport *exp, struct fuse_write_out *out,
int64_t blk_len;
int ret;
+ size = MIN(size, 4096);
+
QEMU_BUILD_BUG_ON(FUSE_MAX_WRITE_BYTES > BDRV_REQUEST_MAX_BYTES);
/* Limited by max_write, should not happen */
if (size > FUSE_MAX_WRITE_BYTES) {
But with aio=native, it does not:
$ ./qemu-io --image-opts -c 'read -P 23 0 8k' \
driver=file,filename=test.raw,cache.direct=on,aio=native
Pattern verification failed at offset 0, 8192 bytes
read 8192/8192 bytes at offset 0
8 KiB, 1 ops; 00.00 sec (86.155 MiB/sec and 11027.7900 ops/sec)
$ ./qemu-io --image-opts -c 'write -P 42 0 8k' \
driver=file,filename=test.raw,cache.direct=on,aio=native
write failed: No space left on device
$ hexdump -C test.raw 00000000 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a |****************|
* 00001000 17 17 17 17 17 17 17 17 17 17 17 17 17 17 17 17 |................|
* 00002000
This patch fixes that.
Reviewed-by: Kevin Wolf <kwolf@redhat.com> Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
Message-ID: <20260324084338.37453-3-hreitz@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Hanna Czenczek [Tue, 24 Mar 2026 08:43:34 +0000 (09:43 +0100)]
linux-aio: Put all parameters into qemu_laiocb
Put all request parameters into the qemu_laiocb struct, which will allow
re-submitting the tail of short reads/writes.
Reviewed-by: Kevin Wolf <kwolf@redhat.com> Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
Message-ID: <20260324084338.37453-2-hreitz@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
GuoHan Zhao [Fri, 20 Mar 2026 06:30:16 +0000 (14:30 +0800)]
block/curl: free s->password in cleanup paths
When password-secret is used, curl_open() resolves it with
qcrypto_secret_lookup_as_utf8() and stores the returned buffer in
s->password.
Unlike s->proxypassword, s->password is not freed either in the open
failure path or in curl_close(), so the resolved secret leaks once it
has been allocated.
Free s->password in both cleanup paths.
Fixes: 1bff96064290 ('curl: add support for HTTP authentication parameters') Signed-off-by: GuoHan Zhao <zhaoguohan@kylinos.cn>
Message-ID: <20260320063016.262954-1-zhaoguohan_salmon@163.com> Reviewed-by: Kevin Wolf <kwolf@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
* tag 'pull-target-arm-20260324' of https://gitlab.com/pm215/qemu:
qemu-options.hx: Document arm-smmuv3 device's accel properties
hw/arm/smmuv3-accel: Change "oas" property type to OasMode
qdev: Add an OasMode property type
hw/arm/smmuv3-accel: Change "ssidsize" property type to SsidSizeMode
qdev: Add a SsidSizeMode property type
hw/arm/smmuv3-accel: Change "ril" property type to OnOffAuto
hw/arm/smmuv3-accel: Change "ats" property type to OnOffAuto
hw/arm/smmuv3-accel: Check ATS compatibility between host and guest
hw/dma/pl080: Fix transfer logic in PL080
linux-user/i386/signal.c: Correct definition of target_fpstate_32
target/arm: fix s2prot not set for two-stage PMSA translations
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* tag 'pull-aspeed-20260324' of https://github.com/legoater/qemu:
hw/i2c/aspeed_i2c: Remove assert
hw/ssi/aspeed_smc: Convert mem ops to read/write_with_attrs for error handling
tests/functional/aarch64/test_aspeed: Disable kernel crypto self-tests in AST2700 boot tests
MAINTAINERS: Add Kane Chen as reviewer for Aspeed machines
hw/i2c/aspeed: fix lost interrupts on back-to-back commands
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Peter Maydell [Tue, 24 Mar 2026 15:13:52 +0000 (15:13 +0000)]
Merge tag 's390x-20260324' of https://gitlab.com/cohuck/qemu into staging
s390x maintainer and mailmap updates
# -----BEGIN PGP SIGNATURE-----
#
# iIgEABYKADAWIQRpo7U29cv8ZSCAJsHeiLtWQd5mwQUCacKAvBIcY29odWNrQHJl
# ZGhhdC5jb20ACgkQ3oi7VkHeZsE0xAEAmTo6hXLZS9uOsZ/fvKBPkmKFP4JptdLA
# JrIZp1BqOEMBAP6XoTzHg60UcimvnAtAquyMlw/GNAbJh/5pk1kC/2oJ
# =IX9E
# -----END PGP SIGNATURE-----
# gpg: Signature made Tue Mar 24 12:17:00 2026 GMT
# gpg: using EDDSA key 69A3B536F5CBFC65208026C1DE88BB5641DE66C1
# gpg: issuer "cohuck@redhat.com"
# gpg: Good signature from "Cornelia Huck <conny@cornelia-huck.de>" [marginal]
# gpg: aka "Cornelia Huck <huckc@linux.vnet.ibm.com>" [full]
# gpg: aka "Cornelia Huck <cornelia.huck@de.ibm.com>" [full]
# gpg: aka "Cornelia Huck <cohuck@kernel.org>" [marginal]
# gpg: aka "Cornelia Huck <cohuck@redhat.com>" [marginal]
# gpg: WARNING: The key's User ID is not certified with sufficiently trusted signatures!
# gpg: It is not certain that the signature belongs to the owner.
# Primary key fingerprint: C3D0 D66D C362 4FF6 A8C0 18CE DECF 6B93 C6F0 2FAF
# Subkey fingerprint: 69A3 B536 F5CB FC65 2080 26C1 DE88 BB56 41DE 66C1
* tag 's390x-20260324' of https://gitlab.com/cohuck/qemu:
mailmap: Update email for Nina Schoetterl-Glausch
MAINTAINERS: S390 CPU topology: Change maintainer
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Document arm-smmuv3 properties for setting HW-acceleration,
Range Invalidation, and Address Translation Services support, as
well as setting Output Address size and Substream ID size.
Reviewed-by: Eric Auger <eric.auger@redhat.com> Tested-by: Eric Auger <eric.auger@redhat.com> Reviewed-by: Shameer Kolothum <skolothumtho@nvidia.com> Tested-by: Shameer Kolothum <skolothumtho@nvidia.com> Signed-off-by: Nathan Chen <nathanc@nvidia.com>
Message-id: 20260323182454.1416110-9-nathanc@nvidia.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Nathan Chen [Tue, 24 Mar 2026 14:02:30 +0000 (14:02 +0000)]
hw/arm/smmuv3-accel: Change "oas" property type to OasMode
Change accel SMMUv3 OAS property from uint8_t to OasMode. The
'auto' value is not implemented, as this commit is meant to
set the property to the correct type and avoid breaking JSON/QMP
when the auto mode is introduced. A future patch will implement
resolution of 'auto' value to match the host SMMUv3 OAS value.
The conversion of the "oas" property type to OnOffAuto is an
incompatible change for JSON/QMP when a uint8_t value is expected for
"oas", but this property is new in 11.0 and this patch is
submitted as a fix to the property type.
Fixes: a015ac990fd3 ("hw/arm/smmuv3-accel: Add property to specify OAS bits") Tested-by: Eric Auger <eric.auger@redhat.com> Reviewed-by: Shameer Kolothum <skolothumtho@nvidia.com> Reviewed-by: Eric Auger <eric.auger@redhat.com> Tested-by: Shameer Kolothum <skolothumtho@nvidia.com> Acked-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Nathan Chen <nathanc@nvidia.com>
Message-id: 20260323182454.1416110-8-nathanc@nvidia.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Nathan Chen [Tue, 24 Mar 2026 14:02:29 +0000 (14:02 +0000)]
qdev: Add an OasMode property type
Introduce a new enum type property allowing to set an Output Address
Size. Values are auto, 32, 36, 40, 42, 44, 48, 52, and 56, where a
value of N specifies an N-bit OAS.
Reviewed-by: Eric Auger <eric.auger@redhat.com> Tested-by: Eric Auger <eric.auger@redhat.com> Tested-by: Shameer Kolothum <skolothumtho@nvidia.com> Acked-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Nathan Chen <nathanc@nvidia.com>
Message-id: 20260323182454.1416110-7-nathanc@nvidia.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Nathan Chen [Tue, 24 Mar 2026 14:02:29 +0000 (14:02 +0000)]
hw/arm/smmuv3-accel: Change "ssidsize" property type to SsidSizeMode
Change accel SMMUv3 SSIDSIZE property from uint8_t to SsidSizeMode.
The 'auto' value is not implemented, as this commit is meant to set the
property to the correct type and avoid breaking JSON/QMP when the auto
mode is introduced. A future patch will implement resolution of 'auto'
value to match the host SMMUv3 SSIDSIZE value.
The conversion of the "ssidsize" property type to OnOffAuto is an
incompatible change for JSON/QMP when a uint8_t value is expected for
"ssidsize", but this property is new in 11.0 and this patch is
submitted as a fix to the property type.
Fixes: b8c6f8a69d27 ("hw/arm/smmuv3-accel: Make SubstreamID support configurable") Tested-by: Eric Auger <eric.auger@redhat.com> Reviewed-by: Shameer Kolothum <skolothumtho@nvidia.com> Reviewed-by: Eric Auger <eric.auger@redhat.com> Tested-by: Shameer Kolothum <skolothumtho@nvidia.com> Acked-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Nathan Chen <nathanc@nvidia.com>
Message-id: 20260323182454.1416110-6-nathanc@nvidia.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Nathan Chen [Tue, 24 Mar 2026 14:02:29 +0000 (14:02 +0000)]
qdev: Add a SsidSizeMode property type
Introduce a new enum type property allowing to set a Substream ID size
for HW-accelerated smmuv3. Values are auto and 0..20. The auto value
allows SSID size property to be derived from host IOMMU capabilities.
A value of 0 disables SubstreamID, while non-zero values specify the
SSID size in bits.
Reviewed-by: Eric Auger <eric.auger@redhat.com> Tested-by: Eric Auger <eric.auger@redhat.com> Tested-by: Shameer Kolothum <skolothumtho@nvidia.com> Acked-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Nathan Chen <nathanc@nvidia.com>
Message-id: 20260323182454.1416110-5-nathanc@nvidia.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Nathan Chen [Tue, 24 Mar 2026 14:02:29 +0000 (14:02 +0000)]
hw/arm/smmuv3-accel: Change "ril" property type to OnOffAuto
Change accel SMMUv3 RIL property from bool to OnOffAuto. The 'auto'
value is not implemented, as this commit is meant to set the property
to the correct type and avoid breaking JSON/QMP when the auto mode is
introduced. A future patch will implement resolution of the 'auto'
value to match the host SMMUv3 RIL support.
The conversion of the RIL property type to OnOffAuto is an
incompatible change for JSON/QMP when a bool value is expected for
"ril", but the "ril" property is new in 11.0 and this patch is
submitted as a fix to the property type.
Fixes: bd715ff5bda9 ("hw/arm/smmuv3-accel: Add a property to specify RIL support") Tested-by: Eric Auger <eric.auger@redhat.com> Reviewed-by: Shameer Kolothum <skolothumtho@nvidia.com> Tested-by: Shameer Kolothum <skolothumtho@nvidia.com> Reviewed-by: Eric Auger <eric.auger@redhat.com> Acked-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Nathan Chen <nathanc@nvidia.com>
Message-id: 20260323182454.1416110-4-nathanc@nvidia.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Nathan Chen [Tue, 24 Mar 2026 14:02:29 +0000 (14:02 +0000)]
hw/arm/smmuv3-accel: Change "ats" property type to OnOffAuto
Change accel SMMUv3 ATS property from bool to OnOffAuto. The 'auto'
value is not implemented, as this commit is meant to set the property
to the correct type and avoid breaking JSON/QMP when the auto mode is
introduced. A future patch will implement resolution of the 'auto'
value to match the host SMMUv3 ATS support.
The conversion of the ATS property type to OnOffAuto is an
incompatible change for JSON/QMP when a bool value is expected for
"ats", but the "ats" property is new in 11.0 and this patch is
submitted as a fix to the property type.
Fixes: f7f5013a55a3 ("hw/arm/smmuv3-accel: Add support for ATS") Tested-by: Eric Auger <eric.auger@redhat.com> Reviewed-by: Shameer Kolothum <skolothumtho@nvidia.com> Tested-by: Shameer Kolothum <skolothumtho@nvidia.com> Reviewed-by: Eric Auger <eric.auger@redhat.com> Acked-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Nathan Chen <nathanc@nvidia.com>
Message-id: 20260323182454.1416110-3-nathanc@nvidia.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Nathan Chen [Tue, 24 Mar 2026 14:02:29 +0000 (14:02 +0000)]
hw/arm/smmuv3-accel: Check ATS compatibility between host and guest
Compare the host SMMUv3 ATS support bit with the guest SMMUv3 ATS support
bit in IDR0 and fail the compatibility check if ATS support is opted as
enabled on the guest SMMUv3 when it is not supported on host SMMUv3.
Fixes: f7f5013a55a3 ("hw/arm/smmuv3-accel: Add support for ATS") Reviewed-by: Eric Auger <eric.auger@redhat.com> Tested-by: Eric Auger <eric.auger@redhat.com> Reviewed-by: Shameer Kolothum <skolothumtho@nvidia.com> Tested-by: Shameer Kolothum <skolothumtho@nvidia.com> Signed-off-by: Nathan Chen <nathanc@nvidia.com>
Message-id: 20260323182454.1416110-2-nathanc@nvidia.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Tao Ding [Tue, 24 Mar 2026 14:02:29 +0000 (14:02 +0000)]
hw/dma/pl080: Fix transfer logic in PL080
The logic in the PL080 for transferring data has multiple bugs:
* The TransferSize field in the channel control register counts
in units of the source width; because our loop may do multiple
source loads if the destination width is greater than the
source width, we need to decrement it by (xsize / swidth),
not by 1, each loop
* It is documented in the TRM that it is a software error to program
the source and destination width such that SWidth < DWidth and
TransferSize * SWidth is not a multiple of DWidth. (This would
mean that there isn't enough data to do a full final destination
write.) We weren't doing anything sensible with this case.
The TRM doesn't document what the hardware actually does (though
it drops some hints that suggest that it probably over-reads
from the source).
* In the loop to write to the destination, each loop adds swidth
to ch->dest for each loop and also uses (ch->dest + n) as the
destination address. This moves the destination address on
further than we should each time round the loop, and also
is incrementing ch->dest by swidth when it should be dwidth.
This patch fixes these problems:
* decrement TransferSize by the correct amount
* log and ignore the transfer size mismatch case
* correct the loop logic for the destination writes
A repro case which exercises some of this is as follows. It
configures swidth to 1 byte, dwidth to 4 bytes, and transfer size 4,
for a transfer from 0x00000000 to 0x000010000. Examining the
destination memory in the QEMU monitor should show that the
source data 0x44332211 has all been copied, but before this
fix it is not:
Without this patch the QEMU monitor shows:
(qemu) xp /1wx 0x00001000 00001000: 0x00002211
Correct result:
(qemu) xp /1wx 0x00001000 00001000: 0x44332211
Cc: qemu-stable@nongnu.org Suggested-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Tao Ding <dingtao0430@163.com>
[PMM: Wrote up what we are fixing in the commit message] Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Peter Maydell [Tue, 24 Mar 2026 14:02:29 +0000 (14:02 +0000)]
linux-user/i386/signal.c: Correct definition of target_fpstate_32
Our definition of the target_fpstate_32 struct doesn't match the
kernel's version. We only use this struct definition in the
definition of 'struct sigframe', where it is used in a field that is
present only for legacy reasons to retain the offset of the following
'extramask' field. So really all that matters is its length, and we
do get that right; but our previous definition using
X86LegacySaveArea implicitly added an extra alignment constraint
(because X86LegacySaveArea is tagged as 16-aligned) which the real
target_fpstate_32 does not have. Because we allocate and use a
'struct sigframe' on the guest's stack with the guest's alignment
requirements, this resulted in the undefined-behaviour sanitizer
complaining during 'make check-tcg' for i386-linux-user:
../../linux-user/i386/signal.c:471:35: runtime error: member access within misaligned address 0x1000c07f75ec for type 'struct sigframe', which requires 16 byte alignment
0x1000c07f75ec: note: pointer points here
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
^
../../linux-user/i386/signal.c:808:5: runtime error: member access within misaligned address 0x1000c07f75f4 for type 'struct target_sigcontext_32', which requires 8 byte alignment
0x1000c07f75f4: note: pointer points here
0a 00 00 00 33 00 00 00 00 00 00 00 2b 00 00 00 2b 00 00 00 40 05 80 40 f4 7f 10 08 58 05 80 40
^
and various similar errors.
Replace the use of X86LegacyXSaveArea with a set of fields that match
the kernel _fpstate_32 struct, and assert that the length is correct.
We could equally have used
uint8_t legacy_area[512];
but following the kernel is probably less confusing overall.
Since in target/i386/cpu.h we assert that X86LegacySaveArea is 512
bytes, and in linux-user/i386/signal.c we assert that
target_fregs_state is (32 + 80) bytes, the new assertion confirms
that we didn't change the size of target_fpstate_32 here, only its
alignment requirements.
Cc: qemu-stable@nongnu.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20260305161739.1775232-1-peter.maydell@linaro.org
Jose Martins [Tue, 24 Mar 2026 14:02:29 +0000 (14:02 +0000)]
target/arm: fix s2prot not set for two-stage PMSA translations
Commit a811c5dafb7 ("target/arm: Implement get_S2prot_indirect")
changed get_phys_addr_twostage() to combine stage 1 and stage 2
permissions using the new s2prot field:
result->f.prot = s1_prot & result->s2prot;
The LPAE stage 2 path sets result->s2prot explicitly, but the PMSA
stage 2 path (get_phys_addr_pmsav8) only sets result->f.prot, leaving
s2prot at zero. This causes the combined permission to be zero,
resulting in addr_read being set to -1 in the TLB entry and triggering
an assertion in atomic_mmu_lookup() when the guest executes an atomic
instruction on a two-stage PMSA platform (e.g. Cortex-R52 with EL2).
Set s2prot from f.prot after the PMSA stage 2 lookup, consistent with
what the LPAE path does.
Cc: qemu-stable@nongnu.org Fixes: a811c5dafb7 ("target/arm: Implement get_S2prot_indirect") Signed-off-by: Jose Martins <josemartins90@gmail.com>
[PMM: refer to the right commit in the commit message] Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20260321231916.2852653-1-josemartins90@gmail.com Reviewed-by: Gustavo Romero <gustavo.romero@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* tag 'pull-trivial-patches' of https://gitlab.com/mjt0k/qemu:
Fix several typos in documentation (found by codespell)
docs: Update GitHub URL of libu2f-emu
Fix include statement for u2f-emu.h
tests: fix typo in char unit test comment
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Cédric Le Goater [Mon, 23 Mar 2026 12:55:45 +0000 (13:55 +0100)]
hw/i2c/aspeed_i2c: Remove assert
According to the Aspeed datasheet, the RX_BUF_LEN_W1T and
TX_BUF_LEN_W1T bits of the A_I2CS_DMA_LEN (0x2c) register allow
firmware to program the TX and RX DMA length (TX_BUF_LEN and
RX_BUF_LEN fields of the same register) separately without the need to
read/modify/write the value. If RX_BUF_LEN_W1T and TX_BUF_LEN_W1T
bits are 0, then both TX and RX DMA length will be written.
When setting the RX_BUF_LEN field, the TX_BUF_LEN field being set is
not an invalid condition. Remove the assert.
Jamin Lin [Mon, 16 Mar 2026 08:15:50 +0000 (08:15 +0000)]
tests/functional/aarch64/test_aspeed: Disable kernel crypto self-tests in AST2700 boot tests
Disable the kernel crypto self-tests in the AST2700 functional tests by
appending "cryptomgr.notests=1" to the U-Boot bootargs before booting
the kernel.
The ASPEED SDK enables crypto self-tests during kernel startup to
validate the hardware crypto engine. However, the current QEMU
implementation of the AST2700 HACE/crypto engine is still incomplete.
As a result, the kernel crypto self-tests trigger multiple warnings
during boot when running under QEMU.
Typical examples observed in the kernel log include failures for
several cipher modes such as DES/TDES/AES in ECB/CBC/CTR modes:
alg: self-tests for ctr(des) using aspeed-ctr-des failed (rc=-22)
alg: self-tests for ecb(des3_ede) using aspeed-ecb-tdes failed (rc=-22)
alg: self-tests for cbc(aes) using aspeed-cbc-aes failed (rc=-22)
...
To reduce noise in the functional test logs, the tests now append
the following parameter to the kernel bootargs:
cryptomgr.notests=1
This disables the kernel crypto self-tests when running the functional
tests under QEMU.
For validating the HACE implementation, we should instead rely on the
dedicated QEMU unit tests located in:
tests/qtest/ast2700-hace-test.c
Once the QEMU implementation of the ASPEED HACE/crypto model has
progressed further and supports the missing crypto modes, we can
reassess whether enabling the kernel crypto self-tests again in the
functional tests is appropriate.
Jithu Joseph [Wed, 11 Mar 2026 02:37:12 +0000 (19:37 -0700)]
hw/i2c/aspeed: fix lost interrupts on back-to-back commands
QEMU executes I2C commands synchronously inside the CMD register write
handler. On real hardware each command takes time on the bus, so the
ISR can clear the previous interrupt status before the next completion
arrives. In QEMU, when the guest ISR handles a TX_ACK and immediately
issues the next command by writing to CMD, that command completes
instantly — before the ISR returns to W1C-clear the first TX_ACK.
Since the bit is already set, setting it again is a no-op. The ISR
then clears it, wiping both completions at once. No interrupt fires
for the second command and the driver stalls.
This affects any multi-step I2C transaction: register reads, SMBus
word reads, and PMBus device probes all fail ("Error: Read failed"
from i2cget, -ETIMEDOUT from kernel drivers).
The issue is exposed when the guest kernel includes commit "i2c:
aspeed: Acknowledge Tx done with and without ACK irq late" [1] which
defers W1C acknowledgment of TX_ACK until after the ISR has issued
the next command. This means the old TX_ACK is still set when the
next command completes synchronously, and the subsequent W1C wipes
both completions at once.
The trace below shows `i2cget -y 15 0x50 0x00` (read EEPROM register
0x00) failing without the fix. The first START+TX sets TX_ACK. The
ISR handles it and issues a second TX to send the register address.
That TX completes synchronously while TX_ACK is still set:
The driver sees INTR_STS=0 and never proceeds to the read phase.
Fix this by tracking interrupt bits that collide with already-pending
bits. Before calling aspeed_i2c_bus_handle_cmd(), save and clear
INTR_STS so that only freshly set bits are visible after the call.
Any overlap between the old and new bits is saved in pending_intr_sts.
When the ISR later W1C-clears the old bits, re-apply the saved
pending bits so the ISR sees them on its next loop iteration.
With the fix, the same operation completes successfully:
Peter Maydell [Mon, 23 Mar 2026 16:58:15 +0000 (16:58 +0000)]
Merge tag 'hw-misc-20260323' of https://github.com/philmd/qemu into staging
Misc HW patches
- Fix guest-triggerable abort in FTGMAC100 Gigabit Ethernet
- Fix uninitialized value in DesignWare I3C controller
- Clear dangling GLib event source tag in virtio-console
- Mark RISC-V specific peripherals as little-endian
- Correct virtual address formatting in monitor
- Improve error handling path in core loader
- Improve error hints in IOMMU FD
- Prevent hang in USB OHCI
- ATI VGA, HyperV & CXL fixes
* tag 'hw-misc-20260323' of https://github.com/philmd/qemu: (27 commits)
hw/hyperv: add QEMU_PACKED to uapi structs
monitor: Correctly display virtual addresses while dumping memory
hw/net/ftgmac100: Improve DMA error handling
ati-vga: Make sure hardware cursor data is within vram
ati-vga: Simplify pointer image handling
ati-vga: Add work around for fuloong2e
ati-vga: Fix display updates in non-32 bit modes
ati-vga: Avoid warnings about sign extension
ati-vga: Do not add crtc offset to src and dst data address
ati-vga: Also switch mode on HW cursor enable bit change
ati-vga: Fix colors when frame buffer endianness does not match host
hw/usb/hcd-ohci: check for MPS=0 to avoid infinite loop
hw/hyperv: Fix SynIC not initialized except on first vCPU
hw/vfio/iommufd: report hint to user when vfio-dev/vfio*/dev is missing
backends/iommufd: report error when /dev/iommu is not available
hw/cxl: Exclude Discovery from Media Operation Discovery output
hw/cxl: Respect Media Operation max ops discovery semantics
hw/i386/hyperv: add stubs for synic enablement
hw/i386/pc_sysfw: stub out x86_firmware_configure
hw/pci/msix: fix error handling for msix_init callers
...
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Peter Maydell [Mon, 23 Mar 2026 16:58:07 +0000 (16:58 +0000)]
Merge tag 'pull-11.0-testing-updates-230326-1' of https://gitlab.com/stsquad/qemu into staging
testing updates: tcg, functional, lcitool
- add TCG_TEST_FILTER to filter check-tcg runs
- use portable version of dirent64 in linux-test
- add VBSA linux tests
- drop python3-sqlite from deps
- update openSUSE to version 16
- replace ncat with socat for migration tests
* tag 'pull-11.0-testing-updates-230326-1' of https://gitlab.com/stsquad/qemu:
tests: Replace ncat with socat in migration test and drop ncat from containers
tests/docker: Update the opensuse-leap container file to version 16
tests/lcitool: Update openSUSE to version 16
tests/lcitool: Remove python3-sqlite3 from the list of needed packages
tests/functional: add VBSA linux tests
tests/functional: allow tests to define decompression target
tests/tcg/multiarch/linux-test: use portable alternative for dirent64
tests/tcg: allow filtering of TCG tests
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Stefan Weil [Thu, 19 Mar 2026 18:34:53 +0000 (19:34 +0100)]
Fix several typos in documentation (found by codespell)
Signed-off-by: Stefan Weil <sw@weilnetz.de> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
[Mjt: add 2 fixes suggested by Peter: "as a" and "deactivate"] Reviewed-by: Michael Tokarev <mjt@tls.msk.ru> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Magnus Kulke [Mon, 23 Mar 2026 12:06:13 +0000 (13:06 +0100)]
hw/hyperv: add QEMU_PACKED to uapi structs
The uapi definitions are marked with __packed hints in the kernel
headers, since we want to keep the contract of the Microsoft Hypervisor
ABI explicit, we should also added them in our vendored files, with a
few notable exceptions where the attribute is a noop.
Signed-off-by: Magnus Kulke <magnuskulke@linux.microsoft.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20260323120613.355019-1-magnuskulke@linux.microsoft.com>
[PMD: Do not include "qemu/compiler.h"] Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
$ qemu-system-ppc64 -monitor stdio -S
QEMU 10.2.90 monitor - type 'help' for more information
(qemu) x/x 0
00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000: 0x00000000
Correct the format width to restore the previous behavior:
$ qemu-system-ppc -monitor stdio -S
QEMU 10.2.90 monitor - type 'help' for more information
(qemu) x/x 0 00000000: 0x00000000
$ qemu-system-ppc64 -monitor stdio -S
QEMU 10.2.90 monitor - type 'help' for more information
(qemu) x/x 0 0000000000000000: 0x00000000
Fixes: 6ad593a75a8 ("monitor/hmp: Use plain uint64_t @addr argument in memory_dump()") Reported-by: BALATON Zoltan <balaton@eik.bme.hu> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-Id: <20260323095020.66658-1-philmd@linaro.org>
Cédric Le Goater [Sun, 22 Mar 2026 21:57:31 +0000 (22:57 +0100)]
hw/net/ftgmac100: Improve DMA error handling
Currently, DMA memory operation errors in the ftgmac100 model are not
all tested and this can lead to a guest-triggerable denial of service
as described in https://gitlab.com/qemu-project/qemu/-/work_items/3335.
To fix this, check the return value of ftgmac100_write_bd() in the TX
path and exit the TX loop on error to prevent further processing. In
the event of a DMA error, also set FTGMAC100_INT_AHB_ERR interrupt
flag as appropriate.
The FTGMAC100_INT_AHB_ERR interrupt status bit only applies to the
AST2400 SoC; on newer Aspeed SoCs, it is a reserved bit.
Nevertheless, since it is supported by the Linux driver and it should
be safe to use in the QEMU implementation across all SoCs.
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3335 Signed-off-by: Cédric Le Goater <clg@redhat.com> Reviewed-by: Jamin Lin <jamin_lin@aspeedtech.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20260322215732.387383-3-clg@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
BALATON Zoltan [Sat, 21 Mar 2026 16:30:18 +0000 (17:30 +0100)]
ati-vga: Simplify pointer image handling
Rewrite reading of mouse pointer image. I am not sure this is entirely
correct but appears to work at least on little endian host with PPC
guests using little or big endian frame buffer (MorphOS and MacOS) but
still produces broken pointer image with Linux where I am not sure if
it is a guest driver bug or still missing something.
Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
Message-ID: <b9de530074b954d661a0eb9b8b4ad82a66085456.1774110169.git.balaton@eik.bme.hu>
[PMD: Replaced BIT() -> BIT_ULL() in ati_cursor_draw_line()] Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
BALATON Zoltan [Sat, 21 Mar 2026 16:30:17 +0000 (17:30 +0100)]
ati-vga: Add work around for fuloong2e
With the linear aperture size fixed to match real card fuloong2e no
longer works due to running out of PCI memory because only one PCI bus
is emulated on that machine. Add a property to allow fuloong2e to set
a smaller linear aperture size to work around that problem until the
machine model is improved.
Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Chad Jablonski <chad@jablonski.xyz>
Message-ID: <47cbdc7ad2291f22467f9fc86e7287eb8983c927.1774110169.git.balaton@eik.bme.hu> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
BALATON Zoltan [Sat, 21 Mar 2026 16:30:16 +0000 (17:30 +0100)]
ati-vga: Fix display updates in non-32 bit modes
The memory_region_set_dirty used to mark changes should use stride
value in vram which is normally only the same as surface_stride in 32
bit modes. This caused missed updates in 8 and 16 bit modes.
Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Chad Jablonski <chad@jablonski.xyz>
Message-ID: <6e1b83ef3fe7a1ebc246b474eb2b0c7cd05d5deb.1774110169.git.balaton@eik.bme.hu> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
BALATON Zoltan [Sat, 21 Mar 2026 16:30:15 +0000 (17:30 +0100)]
ati-vga: Avoid warnings about sign extension
Coverity reports several possible sign extension errors (latest is CID 1645615). These cannot happen because the values are limited when
writing the registers and only 32 bits of the return value matter but
change type of the variable storing the return value to uint32_t to
avoid these warnings. Also change DEFAULT_SC_BOTTOM_RIGHT register
read to match what other similar registers do for consistency.
Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-ID: <9a3263a06bc72aa5a56bafe0a11ad189d5f60528.1774110169.git.balaton@eik.bme.hu> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
BALATON Zoltan [Sat, 21 Mar 2026 16:30:13 +0000 (17:30 +0100)]
ati-vga: Do not add crtc offset to src and dst data address
Drivers seem to program these registers with values that already
include the crtc offset so this is not needed. This fixes blit outside
of vram errors with non-0 crtc offset.
Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Chad Jablonski <chad@jablonski.xyz>
Message-ID: <7d96c67f864845893d4903b988a4da7c7b010f66.1774110169.git.balaton@eik.bme.hu> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
BALATON Zoltan [Sat, 21 Mar 2026 16:30:12 +0000 (17:30 +0100)]
ati-vga: Also switch mode on HW cursor enable bit change
This does nothing for most drivers but works around issue and fixes
output with the Solaris R128 driver that only sets display parameters
after enabling CRT controller which we would miss otherwise.
Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Tested-by: Chad Jablonski <chad@jablonski.xyz> Reviewed-by: Chad Jablonski <chad@jablonski.xyz>
Message-ID: <ad3f415749178984c764f4ba810c663d1299ddfd.1774110169.git.balaton@eik.bme.hu> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
BALATON Zoltan [Sat, 21 Mar 2026 16:30:11 +0000 (17:30 +0100)]
ati-vga: Fix colors when frame buffer endianness does not match host
When writing pixels we have to take into account if the frame buffer
endianness matches the host endianness or we need to swap to correct
endianness. This caused wrong colors e.g. with PPC Linux guest that
uses big endian frame buffer when running on little endian host.
Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Tested-by: Chad Jablonski <chad@jablonski.xyz> Reviewed-by: Chad Jablonski <chad@jablonski.xyz>
Message-ID: <759ed5e3b019cce94e9a4ef003f1fc2e0cea2ec1.1774110169.git.balaton@eik.bme.hu> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
hw/usb/hcd-ohci: check for MPS=0 to avoid infinite loop
When a guest sets MaxPacketSize to 0 in an OHCI Endpoint Descriptor,
ohci_service_td() transfers 0 bytes per iteration. The Transfer
Descriptor never completes because CBP never advances toward BE,
causing ohci_service_ed_list() to loop indefinitely and hang QEMU.
Add a check for MPS==0 after extracting the field from ED flags.
If MPS is zero, call ohci_die() to reset the controller and return
an error, preventing the infinite loop.
Sourav Poddar [Fri, 20 Mar 2026 15:47:52 +0000 (21:17 +0530)]
hw/hyperv: Fix SynIC not initialized except on first vCPU
hyperv_is_synic_enabled() is a global flag that returns true after the
first CPU initializes SynIC. With -smp N, all subsequent CPUs skip
hyperv_x86_synic_add(), leaving them without a synic object. This causes
get_synic() to return NULL, making hyperv_sint_route_new() fail and
triggering an assertion crash in hyperv_testdev.
Fix by introducing hyperv_is_synic_present() which checks per-CPU
whether a synic object is already attached instead of using the global
flag.
Fixes: c4cf32fc63f1 ("kvm/hyperv: add synic feature to CPU only if its not enabled") Reported-by: Xudong Hao <xudong.hao@intel.com> Co-authored-by: Ani Sinha <anisinha@redhat.com> Signed-off-by: Sourav Poddar <souravpoddar93042@gmail.com> Tested-by: Xudong Hao <xudong.hao@intel.com>
Message-ID: <20260320154752.204725-1-anisinha@redhat.com>
[PMD: Reworded subject] Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Pierrick Bouvier [Thu, 19 Mar 2026 20:59:41 +0000 (13:59 -0700)]
backends/iommufd: report error when /dev/iommu is not available
In case current kernel does not support /dev/iommu, qemu will probably
fail first because /sys/bus/pci/devices/*/vfio-dev/ is not present,
since QEMU opens it before /dev/iommu.
Instead, report an error directly when completing an iommufd object, to
inform user that kernel does not support it, with a hint about missing
CONFIG_IOMMUFD. We can't do this from initialize as there is no way to
return an error, and we don't want to abort at this step.
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Cédric Le Goater <clg@redhat.com> Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Message-ID: <20260319205942.367705-2-pierrick.bouvier@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Davidlohr Bueso [Thu, 19 Mar 2026 18:42:56 +0000 (11:42 -0700)]
hw/cxl: Exclude Discovery from Media Operation Discovery output
Per CXL 4.0 Table 8-331, the Discovery operation "returns a list of
all Media Operations that the device supports, with the exception of
the Discovery operation (Class=0, Subclass=0)."
Filter out Discovery entries when building the output list and adjust
total_supported_operations accordingly.
Fixes: 77a8e9fe0ecb ("hw/cxl/cxl-mailbox-utils: Add support for Media operations discovery commands cxl r3.2 (8.2.10.9.5.3)") Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com> Signed-off-by: Davidlohr Bueso <dave@stgolabs.net>
Message-ID: <20260319184256.3762391-3-dave@stgolabs.net> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Davidlohr Bueso [Thu, 19 Mar 2026 18:42:55 +0000 (11:42 -0700)]
hw/cxl: Respect Media Operation max ops discovery semantics
The Discovery rejects requests where start_index + num_ops
exceeds the total number of supported operations. Per CXL 4.0
Table 8-332, num_ops is the "Maximum number of Media Operation to
return" - a maximum, not an exact count. The device should return
up to that many entries, not reject the request.
Cap num_ops to the available entries from start_index instead of
erroring the command.
Fixes: 77a8e9fe0ecb ("hw/cxl/cxl-mailbox-utils: Add support for Media operations discovery commands cxl r3.2 (8.2.10.9.5.3)") Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com> Signed-off-by: Davidlohr Bueso <dave@stgolabs.net>
Message-ID: <20260319184256.3762391-2-dave@stgolabs.net> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
projects / thirdparty / qemu.git / log
