aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2025-08-12hw/uefi: return success for notificationsGerd Hoffmann1-0/+2
Set status to SUCCESS for ready-to-boot and exit-boot-services notification calls. Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-ID: <20250811130110.820958-2-kraxel@redhat.com>
2025-08-12hw/uefi: clear uefi-vars buffer in uefi_vars_write callbackMauro Matteo Cascella1-2/+2
When the guest writes to register UEFI_VARS_REG_BUFFER_SIZE, the .write callback `uefi_vars_write` is invoked. The function allocates a heap buffer without zeroing the memory, leaving the buffer filled with residual data from prior allocations. When the guest later reads from register UEFI_VARS_REG_PIO_BUFFER_TRANSFER, the .read callback `uefi_vars_read` returns leftover metadata or other sensitive process memory from the previously allocated buffer, leading to an information disclosure vulnerability. Fixes: CVE-2025-8860 Fixes: 90ca4e03c27d ("hw/uefi: add var-service-core.c") Reported-by: ZDI <zdi-disclosures@trendmicro.com> Suggested-by: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Mauro Matteo Cascella <mcascell@redhat.com> Message-ID: <20250811101128.17661-1-mcascell@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2025-08-11Merge tag 'pull-nvme-20250811' of https://gitlab.com/birkelund/qemu into stagingStefan Hajnoczi1-15/+28
nvme queue # -----BEGIN PGP SIGNATURE----- # # iQEzBAABCgAdFiEEUigzqnXi3OaiR2bATeGvMW1PDekFAmiZmYQACgkQTeGvMW1P # DenI0wf9GPov0a82A2F23UTU+R8NC/NASBovEfPRTz7/J9fGL844ID3G6uT4emFP # wAilGmMbNuPHKAtII4holCximP/7yosVZJIIdjLsRBBP9AZqpMHkr27VBny9rklZ # X7TW6zI8INIjdqvRlIBevH5t5By/qLiaDc6GzRWJ3PoeXE6SKACDi0lNBsn75xah # IbcHi72c96CwYJCEtOHXBs+zECo1yGDhK0OPvs/s7OykuRcOumF21IzuY958bVs/ # 7dJZkTL+oarZHIvKiUrErKK3gWfSrLeaWrR6sW1QNuOhzEeNHk47w86p+CEQ7CrU # w0ioEaZ9awXk7wnZeY//CpUKFbsmwQ== # =Qfvu # -----END PGP SIGNATURE----- # gpg: Signature made Mon 11 Aug 2025 03:19:32 EDT # gpg: using RSA key 522833AA75E2DCE6A24766C04DE1AF316D4F0DE9 # gpg: Good signature from "Klaus Jensen <its@irrelevant.dk>" [unknown] # gpg: aka "Klaus Jensen <k.jensen@samsung.com>" [unknown] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: DDCA 4D9C 9EF9 31CC 3468 4272 63D5 6FC5 E55D A838 # Subkey fingerprint: 5228 33AA 75E2 DCE6 A247 66C0 4DE1 AF31 6D4F 0DE9 * tag 'pull-nvme-20250811' of https://gitlab.com/birkelund/qemu: hw/nvme: cap MDTS value for internal limitation hw/nvme: revert CMIC behavior hw/nvme: fix namespace attachment Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2025-08-11Merge tag 'pull-vfio-20250810' of https://github.com/legoater/qemu into stagingStefan Hajnoczi4-4/+117
vfio queue: * Add documentation for the use-legacy-x86-rom property * Preserve pending VFIO interrupts during CPR # -----BEGIN PGP SIGNATURE----- # # iQIzBAABCAAdFiEEoPZlSPBIlev+awtgUaNDx8/77KEFAmiYwgkACgkQUaNDx8/7 # 7KH5ew//ThaCgYlT2KwwJFfNUw290uQuvZAZUCB0vx+zhsQzQW5vzAx6KvFO+UQu # k64BQLk8OV97tDpsEcnZEUoPfLo/05mxlcSKYfG3rTpp+ZxoCXUBhQ9f0ZR9t2gz # WihHrA+g/r69VlcW9fCdar/n2svvysmY2OzybSAILplmJlk5CsJRB4cbpy09AR70 # t70bWGl+4+voENeVQjdYa35588bjwTdnzpOqy7fbFacs6L17NzaW30lJ8S8AWX8W # a84nnuJgL2qkR73EvY1wL10EyqqR6gYCsbE39ARf4GoC8UE0cRp7tSXm/xkFd6U1 # I6Wv/7zx9FkKq51b8GB9n8NfW9U3XTTfJSS6QR6GYU77zcukUj06Fr5PNLEg9yOf # 9dfrPt6pap1vx4xuoq9IqrwOVcKd9e9vi9hARLonlzcLMXZqJnKr3KcelcCcF8El # Sf994H1izHjr1PqpKCDn7dDJ5Bp7CkvnR9RSCzRssovDzfRBmSI5iC75vpjcEd9z # zMpKG1auyamlpjyFIBOw3rlMXSkv4vk0wmjv/P5aQxKTlu0Oyyp4dZMPl7C4Grut # WmXJao6zrcUsxvxf2pi2aELGKzLow240Xh4oceD+dDyLQ6Z25J5aj/4MUWxXbbUT # YffunKYQ00Bk5+x0gp7tiitNu9s4Z2ezshqebweBxNGHWMiJ5sI= # =lM1W # -----END PGP SIGNATURE----- # gpg: Signature made Sun 10 Aug 2025 12:00:09 EDT # gpg: using RSA key A0F66548F04895EBFE6B0B6051A343C7CFFBECA1 # gpg: Good signature from "Cédric Le Goater <clg@redhat.com>" [full] # gpg: aka "Cédric Le Goater <clg@kaod.org>" [full] # Primary key fingerprint: A0F6 6548 F048 95EB FE6B 0B60 51A3 43C7 CFFB ECA1 * tag 'pull-vfio-20250810' of https://github.com/legoater/qemu: vfio: Document 'use-legacy-x86-rom' property vfio/pci: preserve pending interrupts vfio/pci: augment set_handler Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2025-08-11tests/functional: fix URLs in PCI hotplug test for aarch64Stefan Hajnoczi1-2/+2
Debian trixie has been released. The "stable" alias no longer refers to the Debian bookworm release, so URLs referring to bookworm artifacts via the "stable" alias no longer work. Switch to explicit release naming ("bookworm") to make a permalink so the test passes again. Suggested-by: Peter Maydell <peter.maydell@linaro.org> Fixes: 374a245573b8 ("tests/functional: Add PCI hotplug test for aarch64") Resolves: #3073 ("PCI hotplug test for aarch64 fails due to broken Debian installer URL") Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-ID: <20250811162315.59997-1-stefanha@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2025-08-11hw/nvme: cap MDTS value for internal limitationKeith Busch1-0/+5
The emulated device had let the user set whatever max transfers size they wanted, including no limit. However the device does have an internal limit of 1024 segments. NVMe doesn't report max segments, though. This is implicitly inferred based on the MDTS and MPSMIN values. IOV_MAX is currently 1024 which 4k PRPs can exceed with 2MB transfers. Don't allow MDTS values that can exceed this, otherwise users risk seeing "internal error" status to their otherwise protocol compliant commands. Signed-off-by: Keith Busch <kbusch@kernel.org> Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
2025-08-11hw/nvme: revert CMIC behaviorKlaus Jensen1-13/+17
Commit cd59f50ab017 ("hw/nvme: always initialize a subsystem") causes the controller to always set the CMIC.MCTRS ("Multiple Controllers") bit. While spec-compliant, this is a deviation from the previous behavior where this was only set if an nvme-subsys device was explicitly created (to configure a subsystem with multiple controllers/namespaces). Revert the behavior to only set CMIC.MCTRS if an nvme-subsys device is created explicitly. Reported-by: Alan Adamson <alan.adamson@oracle.com> Fixes: cd59f50ab017 ("hw/nvme: always initialize a subsystem") Reviewed-by: Alan Adamson <alan.adamson@oracle.com> Tested-by: Alan Adamson <alan.adamson@oracle.com> Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
2025-08-11hw/nvme: fix namespace attachmentKlaus Jensen1-2/+6
Commit 6ccca4b6bb9f ("hw/nvme: rework csi handling") introduced a bug in Namespace Attachment, causing it to a) not allow a controller to attach namespaces to other controllers b) assert if a valid non-attached namespace is detached This fixes both issues. Fixes: 6ccca4b6bb9f ("hw/nvme: rework csi handling") Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2976 Reviewed-by: Jesper Wendel Devantier <foss@defmacro.it> Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
2025-08-09Merge tag 'pull-qapi-2025-08-09' of https://repo.or.cz/qemu/armbru into stagingStefan Hajnoczi2-7/+13
QAPI patches for 2025-08-09 # -----BEGIN PGP SIGNATURE----- # # iQJGBAABCAAwFiEENUvIs9frKmtoZ05fOHC0AOuRhlMFAmiW4TgSHGFybWJydUBy # ZWRoYXQuY29tAAoJEDhwtADrkYZTuQEP+waO/E590BU0LIBUoZZbi5/xYY0mavtn # oMn7dtJZGdjV4c247/YghuwhVvPTmNdPsTTsvf1T/Q1SSXmuAgW3vTtsaG/NzbBy # gJMkvjNOBN5ihI+3cIDC95w8l1e93Wg6YcHsPKQh/NYoBSoy5Kk+QJctcO2Y1R66 # f/9rxaVBAjnWEmCGrP9acJnsTvxWIwmk+E6ABhlt24DCYG1Wjp8CgTrLqveqi8Fx # lmhVF0XuHgnkwsItj6mnSAnj60SVQjT6F7iaAO8L+4UxHhO+LzXIQiTjdgBHppfJ # llakFeFLKDulBvRnsnxxrT1CkO1apMfrNkua8JCwHzQAxikuhhkgV1QTIlXQXa7A # hBE/5VQ5Jev+W6rzM6hmYl0HByKjKB23bQK7j8m8logV9OJCw+1Scsn2kgFX7rWL # PLIyp63auXnt+vX29+T80KYu+qGi4o9BcQIr44myq/nIuAgcE7eEz7r6y0N66OiQ # cvShDvd9YO0v8JtPbtUZAeUEyjLOEiYaExBJIAY98r0XFtxlroT8C7o8kjYlQX1K # K5mv1Xs9y4J8kgxRjveYDosFbJAW4EOkypDc1tV50WV7f83kHRFUx340u+pnX3AI # vmB/2KIftlt3bDVbJrJkWdbNshJyG4YBsfkzi7WScn/2BnpboNNzk8yKKkGOxrOl # NQ3QQbUj4Gid # =RYBV # -----END PGP SIGNATURE----- # gpg: Signature made Sat 09 Aug 2025 01:48:40 EDT # gpg: using RSA key 354BC8B3D7EB2A6B68674E5F3870B400EB918653 # gpg: issuer "armbru@redhat.com" # gpg: Good signature from "Markus Armbruster <armbru@redhat.com>" [full] # gpg: aka "Markus Armbruster <armbru@pond.sub.org>" [full] # Primary key fingerprint: 354B C8B3 D7EB 2A6B 6867 4E5F 3870 B400 EB91 8653 * tag 'pull-qapi-2025-08-09' of https://repo.or.cz/qemu/armbru: docs/devel/qapi-code-gen: Update cross-reference syntax docs/devel/qapi-code-gen: Fix typos in QAPI schema language grammar docs/devel/qapi-code-gen: Add two cross-references we missed Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2025-08-09docs/devel/qapi-code-gen: Update cross-reference syntaxMarkus Armbruster2-3/+9
The new QAPI code generator creates a cross-reference target for each definition documentation. Enabled for the QEMU QMP Reference manual in commit a377f39f38f, and for the QEMU Storage Daemon QMP Reference Manual and the QEMU Guest Agent Protocol Reference in commit a6af5443440. We've put these targets to use since, but neglected to update doc comment markup documentation. Do that now. Co-developed-by: John Snow <jsnow@redhat.com> Signed-off-by: John Snow <jsnow@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-ID: <20250731054044.4011789-4-armbru@redhat.com>
2025-08-09docs/devel/qapi-code-gen: Fix typos in QAPI schema language grammarMarkus Armbruster1-2/+2
Fixes: 3248c1aaf2db (docs: update the documentation upfront about schema configuration) Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-ID: <20250731054044.4011789-3-armbru@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com>
2025-08-09docs/devel/qapi-code-gen: Add two cross-references we missedMarkus Armbruster1-2/+2
Missed in commit 9c66762a601 (docs/qapi-code-gen: add cross-references). Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-ID: <20250731054044.4011789-2-armbru@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com>
2025-08-09vfio: Document 'use-legacy-x86-rom' propertyCédric Le Goater1-0/+3
Commit 350785d41d8b ("ramfb: Add property to control if load the romfile") introduced the `use-legacy-x86-rom` property for the `vfio-pci-nohotplug` device. Add documentation for the property. Fixes: d5fcf0d960d8 ("hw/i386: Add the ramfb romfile compatibility") Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Link: https://lore.kernel.org/qemu-devel/20250805065543.120091-1-clg@redhat.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
2025-08-09vfio/pci: preserve pending interruptsSteve Sistare4-0/+100
cpr-transfer may lose a VFIO interrupt because the KVM instance is destroyed and recreated. If an interrupt arrives in the middle, it is dropped. To fix, stop pending new interrupts during cpr save, and pick up the pieces. In more detail: Stop the VCPUs. Call kvm_irqchip_remove_irqfd_notifier_gsi --> KVM_IRQFD to deassign the irqfd gsi that routes interrupts directly to the VCPU and KVM. After this call, interrupts fall back to the kernel vfio_msihandler, which writes to QEMU's kvm_interrupt eventfd. CPR already preserves that eventfd. When the route is re-established in new QEMU, the kernel tests the eventfd and injects an interrupt to KVM if necessary. Deassign INTx in a similar manner. For both MSI and INTx, remove the eventfd handler so old QEMU does not consume an event. If an interrupt was already pended to KVM prior to the completion of kvm_irqchip_remove_irqfd_notifier_gsi, it will be recovered by the subsequent call to cpu_synchronize_all_states, which pulls KVM interrupt state to userland prior to saving it in vmstate. Signed-off-by: Steve Sistare <steven.sistare@oracle.com> Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com> Link: https://lore.kernel.org/qemu-devel/1752689169-233452-3-git-send-email-steven.sistare@oracle.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
2025-08-09vfio/pci: augment set_handlerSteve Sistare3-4/+14
Extend vfio_pci_msi_set_handler() so it can set or clear the handler. Add a similar accessor for INTx. No functional change. Signed-off-by: Steve Sistare <steven.sistare@oracle.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Link: https://lore.kernel.org/qemu-devel/1752689169-233452-2-git-send-email-steven.sistare@oracle.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
2025-08-08Merge tag 'pull-loongarch-20250808' of https://github.com/gaosong715/qemu ↵Stefan Hajnoczi1-3/+3
into staging pul-loongarch-20250808 # -----BEGIN PGP SIGNATURE----- # # iLMEAAEIAB0WIQTKRzxE1qCcGJoZP81FK5aFKyaCFgUCaJVRCAAKCRBFK5aFKyaC # Fn9TA/97BaWn3s3HlDy8HhIEereLJ1NWz9FGmYw2jBT77IVrpWeSSmUY3LapmHT0 # lVTrj4aCRlY5zjKn4xw8AQLACrNl2SL5brPXg4YMuwow062Akq/Ow+ooj3LHSlnX # qXULIMi7hq3gPcmjLeR03AJjiSR2fgIjTzUN8RjangAS+PZ8/A== # =ZQ4o # -----END PGP SIGNATURE----- # gpg: Signature made Thu 07 Aug 2025 21:21:12 EDT # gpg: using RSA key CA473C44D6A09C189A193FCD452B96852B268216 # gpg: Good signature from "Song Gao <gaosong@loongson.cn>" [unknown] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: CA47 3C44 D6A0 9C18 9A19 3FCD 452B 9685 2B26 8216 * tag 'pull-loongarch-20250808' of https://github.com/gaosong715/qemu: target/loongarch: Fix [X]VLDI raising exception incorrectly Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2025-08-08Merge tag 'pull-trivial-patches' of https://gitlab.com/mjt0k/qemu into stagingStefan Hajnoczi2-4/+6
trivial patches for 2025-08-07 # -----BEGIN PGP SIGNATURE----- # # iQIzBAABCgAdFiEEZKoqtTHVaQM2a/75gqpKJDselHgFAmiVEtUACgkQgqpKJDse # lHh6Lg/+MdkCRc9q+1lo2pQqu5AY3uWMVxCgHZSGgTkkBpSgp4AXgPU9AusOU7jd # ZEKsmfHTiSodahE7+c6k09yzD+6FIBO3CTi502YPvzJ4Fmyd1Y5hWjUcG+lh9Qhs # zDA4rg3Gfg8ecCZX9S4A0DAlLmgxCCnqJaGnJhv1sCYgmG1/jshTdpZbgxHDhxho # 202yMqJagsWApTPmslEBgdBBC8cKUqd8+Lb9AYd+68As9mvCyLq8VbA4lPJ9sSgm # PdeJzNdFSc5UNKbUe5AYghXeof++mBdKrvegIzRfCVtDkS64ermh2kL22iZI+9Ij # nxgxYWQAYrsyF6d3vrRTVDWovAPEReu4j1VywOAbaQX6464EVnXDAeq+y9JOlZDs # +d2pb1uyyFUqGh1A3OwSApyiGGOeMXxDxm77ixkFgf+WTPZ+BNOOrl/YootRxk87 # z7BmTqzycO2eRo6OGNh04LfEOTILhXtENy7NrS/dC2EG4+lgWuGOb3Cl4v1O6cE9 # E2cS7pqpihGyNTXai//USazr3Dh6NxmBsMEfZvWw/WMDy71kBx7XpKn4jv6Dnh+b # wgg3CoLu9YeCdpmp1zb/g0wKEvFU41f2W1dR7BvCG18xtalr5zmFbdiDRwhnSwJh # VW8k0XHcBXYHeBBqyrNglZ31alGq2UlmVG29LOzZyfFEVxz+HfM= # =GrRa # -----END PGP SIGNATURE----- # gpg: Signature made Thu 07 Aug 2025 16:55:49 EDT # gpg: using RSA key 64AA2AB531D56903366BFEF982AA4A243B1E9478 # gpg: Good signature from "Michael Tokarev <mjt@debian.org>" [unknown] # gpg: aka "Michael Tokarev <mjt@corpit.ru>" [unknown] # gpg: aka "Michael Tokarev <mjt@tls.msk.ru>" [unknown] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 9D8B E14E 3F2A 9DD7 9199 28F1 61AD 3D98 ECDF 2C8E # Subkey fingerprint: 64AA 2AB5 31D5 6903 366B FEF9 82AA 4A24 3B1E 9478 * tag 'pull-trivial-patches' of https://gitlab.com/mjt0k/qemu: meson: Fix brlapi compile test for Windows builds tests/qemu-iotests/tests/mirror-sparse: actually require O_DIRECT Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2025-08-08target/loongarch: Fix [X]VLDI raising exception incorrectlyWANG Rui1-3/+3
According to the specification, [X]VLDI should trigger an invalid instruction exception only when Bit[12] is 1 and Bit[11:8] > 12. This patch fixes an issue where an exception was incorrectly raised even when Bit[12] was 0. Test case: ``` .global main main: vldi $vr0, 3328 ret ``` Reported-by: Zhou Qiankang <wszqkzqk@qq.com> Signed-off-by: WANG Rui <wangrui@loongson.cn> Reviewed-by: Song Gao <gaosong@loongson.cn> Message-ID: <20250804132212.4816-1-wangrui@loongson.cn> Signed-off-by: Song Gao <gaosong@loongson.cn>
2025-08-07meson: Fix brlapi compile test for Windows buildsStefan Weil via1-3/+5
brlapi__openConnection returns a brlapi_fileDescriptor which is a pointer for Windows builds. The test for brlapi fails with cross builds on Debian trixie (x86_64-w64-mingw32-gcc (GCC) 14-win32): testfile.c:4:30: error: returning 'brlapi_fileDescriptor' {aka 'void *'} from a function with return type 'int' makes integer from pointer without a cast [-Wint-conversion] 4 | int main(void) { return brlapi__openConnection (NULL, NULL, NULL); } | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ----------- ../../../meson.build:1607: WARNING: could not link brlapi, disabling Signed-off-by: Stefan Weil <sw@weilnetz.de> Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Reviewed-by: Michael Tokarev <mjt@tls.msk.ru> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2025-08-07tests/qemu-iotests/tests/mirror-sparse: actually require O_DIRECTMichael Tokarev1-1/+1
Commit c0ddcb2cbc146e introduced the test which uses cache=direct mode, without checking if the scratch filesystem supports O_DIRECT. A subsequent commit, afeb002e0ad49d, tried to fix that issue, but instead of checking for o_direct, it checked for `_supported_cache_modes none directsync`, which is not what the original mirror-sparse test uses. Fix both by actually checking for o_direct. Fixes: c0ddcb2cbc146e "tests: Add iotest mirror-sparse for recent patches" Fixes: afeb002e0ad49d "tests/qemu-iotests/tests/mirror-sparse: skip if O_DIRECT is not supported" Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2025-08-07Merge tag 'ui-pull-request' of https://gitlab.com/marcandre.lureau/qemu into ↵Stefan Hajnoczi1-4/+6
staging UI-fix for v10.1.0-rc3 # -----BEGIN PGP SIGNATURE----- # # iQJQBAABCgA6FiEEh6m9kz+HxgbSdvYt2ujhCXWWnOUFAmiUez8cHG1hcmNhbmRy # ZS5sdXJlYXVAcmVkaGF0LmNvbQAKCRDa6OEJdZac5RL+D/92hJRQpHex+m5JjJGW # zpsIK1bbP+rN7waYN8YY+QpyJ8ihSvypT5tp/Qg4Q2SsGbLs1QuVrKsseDma/lVb # DRV7JFS6FbLApOx/zvTWK88stKbbzHua93H3XQS2wHIkGYCBgZ/LlK0EIjniWCOP # 2vfld0WT1FfUag6oiHO/s0fO3/uXep9RzCFAZguDd0WnU/i+qMH60Mwi35x4dIIy # XqXDlYKUBEoYV8m3WuUtqq4otttm08/5ufkkME5rt3HjrWRjnCnAsvg4Rx4RQLuk # /azEXVlFTS7FIxsjq2jLF+ZjUeysOHOLOZNKNV4h2bV+5/nvqaNxQqLt7pq+/k14 # gSv8CB1p/fxFfhnIg6x+QHEraZ25MfBafkZM7M5ocLlPPw9uAwu/5ZJBlD5vNO90 # imcDkzHGNWOYtzV03aiQ5o4jHsee/21hCiWo/XGhGfXVACxODI0RjYJwQQ7dsxqh # yEFFwMO0Z8jxPrqDL5J6i+6/IrcMgqPlYmM8/9PqDo1yNBBhaMPc5JhFpxRDPoda # suNEBXzbiR8s4CHZqcAH+8Sl7GT9s6DQOJCguOafXtHUeSa7Sr9TfNAn2X2vTEFC # PNTcDIeXiDy/liep7gpW/W/51aNTPu651tq60ZlCzGa7Fl46KhF2ginSrOhAxMHm # aGrQgkGdXWTnXlV9Awh3nJDdGw== # =1aW6 # -----END PGP SIGNATURE----- # gpg: Signature made Thu 07 Aug 2025 06:09:03 EDT # gpg: using RSA key 87A9BD933F87C606D276F62DDAE8E10975969CE5 # gpg: issuer "marcandre.lureau@redhat.com" # gpg: Good signature from "Marc-André Lureau <marcandre.lureau@redhat.com>" [full] # gpg: aka "Marc-André Lureau <marcandre.lureau@gmail.com>" [full] # Primary key fingerprint: 87A9 BD93 3F87 C606 D276 F62D DAE8 E109 7596 9CE5 * tag 'ui-pull-request' of https://gitlab.com/marcandre.lureau/qemu: ui/curses: Fix infinite loop on windows Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2025-08-07ui/curses: Fix infinite loop on windowsWilliam Hu1-4/+6
Replace -1 comparisons for wint_t with WEOF to fix infinite loop caused by a 65535 == -1 comparison. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2905 Signed-off-by: William Hu <purplearmadillo77@proton.me> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> [ Marc-André - Add missing similar code change, remove a comment ] Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-ID: <tSO5to8--iex6QMThG3Z8ElfnNOUahK_yitw2G2tEVRPoMKV936CBdrpyfbeNpVEpziKqeQ1ShBwPOoDkofgApM8YWwnPKJR_JrPDThV8Bc=@proton.me>
2025-08-06Merge tag 'migration-20250805-pull-request' of ↵Stefan Hajnoczi3-10/+3
https://gitlab.com/farosas/qemu into staging Migration pull request - Disable GNUTLS bug workaround # -----BEGIN PGP SIGNATURE----- # # iQJEBAABCAAuFiEEqhtIsKIjJqWkw2TPx5jcdBvsMZ0FAmiSaOQQHGZhcm9zYXNA # c3VzZS5kZQAKCRDHmNx0G+wxnakhD/4tpM3NvFiz0h+nDfkTU0ha5wzWz0eWAw1+ # utmaxuqta6hvKN34ZvfrAYXpnUhbvaGb5KT1sSo9+v81kSom2lnAjBxZl/jIQzPp # zKnJaR8pnqBg9z9Gx22bZ68lekcnyez3gMRHOm8xtT7knwde9/7dEXl1dsWpE7Jw # xewuJQg3YR3uuHBH7FWXY/6i8htOlw+kSmlkFEVMcH7qXqj5+QVaELo8M0SH4UNO # eohmJv5nK9Z2B3lBUm0hj45EmjGWyuGUMdcVIVceNvsBDkdfmut3V8+h3qb2vPcn # YJOaLZFu5JJevE+sy9fgVfgNVbIBxWF3Va4Sm3z7dBisZtsHmQl46If2ehXGJPN0 # n1qYDwW8QPepNfpnHmxh9lEXoBljLU2XfjLYdq0t5U0fIrYuI7R4a+c8Cs6h2oCn # IdKXMMjGFMbw7uDPwTzUhgYqhwwaJ+RWA8h08Hv6/QwRrpF4dmaUi6b7uU6aFwQr # OgtSM6S+0+/fKaLzHAZ3WypnrwhZXOlGodRDfYJFp5Q+84+R34nx0CRO9nZh5OYn # 5wvQIMfUwZ6NbprG/4qwjzYhtAqZrE/yBV38XzFe3ajJI46LbHnNkMcbb70hviZH # PiLTQX66u4ZWWeZZLJCrnaZW2NBr2STDzp0gqfVwPcZEdjP7drthoPCNkf85zF87 # zcRW1yzDYQ== # =UPOe # -----END PGP SIGNATURE----- # gpg: Signature made Tue 05 Aug 2025 16:26:12 EDT # gpg: using RSA key AA1B48B0A22326A5A4C364CFC798DC741BEC319D # gpg: issuer "farosas@suse.de" # gpg: Good signature from "Fabiano Rosas <farosas@suse.de>" [unknown] # gpg: aka "Fabiano Almeida Rosas <fabiano.rosas@suse.com>" [unknown] # gpg: WARNING: The key's User ID is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: AA1B 48B0 A223 26A5 A4C3 64CF C798 DC74 1BEC 319D * tag 'migration-20250805-pull-request' of https://gitlab.com/farosas/qemu: meson: remove 'gnutls-bug1717-workaround' for migration TLS crashes Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2025-08-05meson: remove 'gnutls-bug1717-workaround' for migration TLS crashesDaniel P. Berrangé3-10/+3
The implementation of this workaround does not currently work, so remove the option entirely to avoid exposing it to users. The code will remain (temporarily dormant) to be fixed in the next release cycle. Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Fabiano Rosas <farosas@suse.de> Link: https://lore.kernel.org/qemu-devel/20250805182431.504158-1-berrange@redhat.com Signed-off-by: Fabiano Rosas <farosas@suse.de>
2025-08-05Update version for the v10.1.0-rc2 releasev10.1.0-rc2Stefan Hajnoczi1-1/+1
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2025-08-05Merge tag 'hw-misc-20250805' of https://github.com/philmd/qemu into stagingStefan Hajnoczi15-167/+251
Misc HW patches - Fix SD cards wired in SPI mode - Fix microvm-only build by selecting Kconfig ACPI_PCI - Fix legacy Intel SMT info removing 'x-vendor-cpuid-only-v2' property check # -----BEGIN PGP SIGNATURE----- # # iQIzBAABCAAdFiEE+qvnXhKRciHc/Wuy4+MsLN6twN4FAmiSP8sACgkQ4+MsLN6t # wN52pw//R2z+DDdtezzOGIsCS8lmcI+sp0rM2UXA0LLuqH4++/SNgSOuH/yr0k9g # 3DxvYxQ+zgx2gxrxG9T/KlGYdl6lE3mb9cWBah8+4UUeKuji2Zt3dh0LrZoIt9A0 # EfHfPihpmVxf0OWXzDUsu3WdUyso3QHHJWVqiUCqnhvNsx1ZSAA7gOUOURL8YUEt # BsCJ4ufRJA6SRqLgiOQHSn1zRVwEmXZWRt6lqWx45ynzxkquaA+pvGY3UlzUsw4b # 5XyBL5Wyq1K7/FTXVXiMCYSNhgSUEbKy7Agnrr1i5s+/XfBjXMuzGFwjAWdCdwVW # /Kqqndlu6COla9APndqjfMhCHU6Ql8KyKqb9HImvZyMks4QNiX3c18CjAuCVoIzE # GxoXaTQ/y+Dv4tarI4EEP5m4P3gka7QVekhbSLQZJAdNDrt0QlOgmyvDLin4tQho # ot/jXYTnbPZBfyZyecFnY/6Uszr5dcrI1bXdEYhiy3LZUWkzM2xNq9BJ6Y2495Ad # ryqZ09UzVK8Rn6KaXTXx926eFWxFVN2VOolmLJ50D8MQfwrmMAsHtHl+qoa6T6Ta # ezgnuHwONjNYAgGQgVz483/nKu4TvQ6q9bATYrZIumBITXLgVqS7GRFZ9Q17Y+V4 # UHlIJ/Ay32KkMAKD+cNj01s7g6nK3YS2tP7tt16IOQHhVmsNvGE= # =Rq7l # -----END PGP SIGNATURE----- # gpg: Signature made Tue 05 Aug 2025 13:30:51 EDT # gpg: using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE # gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <f4bug@amsat.org>" [full] # Primary key fingerprint: FAAB E75E 1291 7221 DCFD 6BB2 E3E3 2C2C DEAD C0DE * tag 'hw-misc-20250805' of https://github.com/philmd/qemu: hw/i386/microvm: Explicitly select ACPI_PCI target/i386/cpu: Move addressable ID encoding out of compat property in CPUID[0x1] tests/functional: Test SD cards in SPI mode (using sifive_u machine) hw/sd/sdcard: Remove SDState::mode field hw/sd/sdcard: Disable checking STBY mode in SPI SEND_CSD/CID hw/sd/sdcard: Factor spi_cmd_SEND_CxD() out hw/sd/sdcard: Allow using SWITCH_FUNCTION in more SPI states hw/sd/sdcard: Use complete SEND_OP_COND implementation in SPI mode hw/sd/sdcard: Implement SPI R2 return value hw/sd/sdcard: Fill SPI response bits in card code hw/sd/sdbus: Provide buffer size to sdbus_do_command() hw/sd/sdcard: Factor sd_response_size() out hw/sd/sdcard: Do not ignore errors in sd_cmd_to_sendingdata() Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2025-08-05tests/qemu-iotests/tests/mirror-sparse: skip if O_DIRECT is not supportedMichael Tokarev1-0/+1
This test uses cache.direct=true, but does not check if O_DIRECT is supported by the underlying filesystem, and fails, for example, on a tmpfs (which is rather common on various auto-builders, in CI, etc). Fix this by using `_supported_cache_modes none directsync`. Fixes: c0ddcb2cbc146e "tests: Add iotest mirror-sparse for recent patches" Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Message-ID: <20250805181731.282677-1-mjt@tls.msk.ru> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2025-08-05qga: correctly write to /sys/power/state on linuxMichael Tokarev1-6/+8
Commit v9.0.0-343-g2048129625 introduced usage of g_file_set_contents() function to write to /sys/power/state. This function uses G_FILE_SET_CONTENTS_CONSISTENT flag to g_file_set_contents_full(), which is implemented by creating a temp file in the same directory and renaming it to the final destination. Which is not how sysfs works. Here, there's not a big deal to do open/write/close - it becomes almost the same as using g_file_set_contents[_full](). But it does not have surprises like this. Also, since this is linux code, it should be ok to use %m in the error reporting function. Fixes: 2048129625 "qga/commands-posix: don't do fork()/exec() when suspending via sysfs" Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3057 Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Message-ID: <20250801115316.6845-1-mjt@tls.msk.ru> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2025-08-05hw/i386/microvm: Explicitly select ACPI_PCIEric Auger1-0/+1
With a microvm-only build based on a custom device config, we get a link failure due to undefined reference to build_pci_host_bridge_osc_method() which is defined in hw/acpi/pci.c and whose compilation depends on CONFIG_ACPI_PCI. Although CONFIG_ACPI and CONFIG_PCI are set with such configuration, implied CONFIG_ACPI_PCI in config PCI_EXPRESS_GENERIC_BRIDGE is not selected as expected. It Looks like CONFIG_ACPI_PCI must be enforced and this patch selects CONFIG_ACPI_PCI in MICROVM config directly as done for PC config. Reproducer: ../configure \ --without-default-features \ --target-list=x86_64-softmmu \ --enable-kvm --disable-tcg \ --enable-pixman \ --enable-vnc \ --audio-drv-list="" \ --without-default-devices \ --with-devices-x86_64=microvm \ --enable-vhost-user with configs/devices/x86_64-softmmu/microvm.mak: CONFIG_PCI_DEVICES=n CONFIG_MICROVM=y CONFIG_VIRTIO_BLK=y CONFIG_VIRTIO_SERIAL=y CONFIG_VIRTIO_INPUT=y CONFIG_VIRTIO_INPUT_HOST=y CONFIG_VHOST_USER_INPUT=y CONFIG_VIRTIO_NET=y CONFIG_VIRTIO_SCSI=y CONFIG_VIRTIO_RNG=y CONFIG_VIRTIO_CRYPTO=y CONFIG_VIRTIO_BALLOON=y CONFIG_VIRTIO_GPU=y CONFIG_VHOST_USER_GPU=y FAILED: qemu-system-x86_64 cc -m64 @qemu-system-x86_64.rsp /usr/bin/ld: libsystem.a.p/hw_pci-host_gpex-acpi.c.o: in function `acpi_dsdt_add_host_bridge_methods': hw/pci-host/gpex-acpi.c:83:(.text+0x274): undefined reference to `build_pci_host_bridge_osc_method' collect2: error: ld returned 1 exit status Fixes: af151d50eac24 "hw/pci-host/gpex-acpi: Use build_pci_host_bridge_osc_method" Signed-off-by: Eric Auger <eric.auger@redhat.com> Reported-by: Michael Tokarev <mjt@tls.msk.ru> Reviewed-by: Michael Tokarev <mjt@tls.msk.ru> Message-ID: <20250804152008.247673-1-eric.auger@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2025-08-05target/i386/cpu: Move addressable ID encoding out of compat property in ↵Zhao Liu1-2/+1
CPUID[0x1] Currently, the addressable ID encoding for CPUID[0x1].EBX[bits 16-23] (Maximum number of addressable IDs for logical processors in this physical package) is covered by vendor_cpuid_only_v2 compat property. The previous consideration was to avoid breaking migration and this compat property makes it unfriendly to backport the commit f985a1195ba2 ("i386/cpu: Fix number of addressable IDs field for CPUID.01H.EBX [23:16]"). However, NetBSD booting is broken since the commit 88dd4ca06c83 ("i386/cpu: Use APIC ID info to encode cache topo in CPUID[4]"), because NetBSD calculates smt information via `lp_max` / `core_max` for legacy Intel CPUs which doesn't support 0xb leaf, where `lp_max` is from CPUID[0x1].EBX.bits[16-23] and `core_max` is from CPUID[0x4].0x0.bits[26 -31]. The commit 88dd4ca0 changed the encoding rule of `core_max` but didn't update `lp_max`, so that NetBSD would get the wrong smt information, which leads to the module loading failure. Luckily, the commit f985a1195ba2 ("i386/cpu: Fix number of addressable IDs field for CPUID.01H.EBX[23:16]") updated the encoding rule for `lp_max` and accidentally fixed the NetBSD issue too. This also shows that using CPUID[0x1] and CPUID[0x4].0x0 to calculate HT/SMT information is a common practice to detect CPU topology on legacy Intel CPUs. Therefore, it's necessary to backport the commit f985a1195ba2 to previous stable QEMU to help address the similar issues as well. Then the compat property is not needed any more since all stable QEMUs will follow the same encoding way. So, in CPUID[0x1], move addressable ID encoding out of compat property. Reported-by: Michael Tokarev <mjt@tls.msk.ru> Inspired-by: Chuang Xu <xuchuangxclwt@bytedance.com> Fixes: commit f985a1195ba2 ("i386/cpu: Fix number of addressable IDs field for CPUID.01H.EBX[23:16]") Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3061 Signed-off-by: Zhao Liu <zhao1.liu@intel.com> Reviewed-by: Michael Tokarev <mjt@tls.msk.ru> Tested-by: Michael Tokarev <mjt@tls.msk.ru> Message-ID: <20250804053548.1808629-1-zhao1.liu@intel.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2025-08-05Merge tag 'pull-10.1-rc2-maintainer-040825-2' of ↵Stefan Hajnoczi3-16/+48
https://gitlab.com/stsquad/qemu into staging Testing and doc fixes - add information about patch submission with b4 - fix make-release script to include all EDK submodules - fix debian-all-test-cross docker image # -----BEGIN PGP SIGNATURE----- # # iQEzBAABCgAdFiEEZoWumedRZ7yvyN81+9DbCVqeKkQFAmiQzlAACgkQ+9DbCVqe # KkScxAf/dMJeC1SWwyXK/To44W0IMRNTKSisAksEVg5MeDAwxZkGjwh2einCyGne # +Ac3KetXunswne3OOxBF24TyYwk6ITX1WSs2ViYI6qOKAehvKuweiTZSZiNUg9KB # fSP4NTMrkk6sbD1fGjLWBOb/E84qoVOdoxW6Th0cnQxCX5WpaIcL84xvR4yOl37i # nRisB36ZiO7ntMKRLU/yYffLq8gnRLQaYt/S17k6SlNTCQkL/rlYwpNwfvEaCwIX # B3Nb6QveeNiyRdIP5TnmqSzu/OtIoJHe62pKcbHXpuDqynycnh/I+ML7nTbOHjWA # tTDHjoLKo8be2jfYT14lkQbS11loHg== # =lQIU # -----END PGP SIGNATURE----- # gpg: Signature made Mon 04 Aug 2025 11:14:24 EDT # gpg: using RSA key 6685AE99E75167BCAFC8DF35FBD0DB095A9E2A44 # gpg: Good signature from "Alex Bennée (Master Work Key) <alex.bennee@linaro.org>" [unknown] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 6685 AE99 E751 67BC AFC8 DF35 FBD0 DB09 5A9E 2A44 * tag 'pull-10.1-rc2-maintainer-040825-2' of https://gitlab.com/stsquad/qemu: tests/docker: fix debian-all-test-cross scripts/make-release: Go back to cloning all the EDK2 submodules docs/devel/submitting-a-patch.rst: add b4 section Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2025-08-05tests/functional: Test SD cards in SPI mode (using sifive_u machine)Philippe Mathieu-Daudé3-0/+53
Add a test which uses the sifive_u machine to boot a Linux kernel from a SD card connected via a SPI interface. Inspired from the command provided in: - https://lore.kernel.org/qemu-devel/94b2c5bf-53d0-4c74-8264-f3021916f38c@roeck-us.net/ - https://lore.kernel.org/qemu-devel/840016d0-0d49-4ef4-8372-b62b3bcd0ac6@codethink.co.uk/ Inspired-by: Guenter Roeck <linux@roeck-us.net> Inspired-by: Ben Dooks <ben.dooks@codethink.co.uk> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Acked-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20250804133406.17456-12-philmd@linaro.org>
2025-08-05hw/sd/sdcard: Remove SDState::mode fieldPhilippe Mathieu-Daudé2-20/+19
SD card mode is a superset of its state (SDState::state), no need to migrate it. Use sd_mode() to get the SDCardModes from the SDCardStates. Fixes: 50a5be6c3d5 ("hw/sd.c: add SD card save/load support") Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Acked-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20250804133406.17456-11-philmd@linaro.org>
2025-08-05hw/sd/sdcard: Disable checking STBY mode in SPI SEND_CSD/CIDPhilippe Mathieu-Daudé1-0/+11
The card should be in STANDBY mode to process SEND_CSD or SEND_CID, but is still in IDLE mode. Unfortunately I don't have enough time to keep debugging this issue, so disable the check for the time being and the next release, as it blocks Linux. I'll keep looking. Reported-by: Guenter Roeck <linux@roeck-us.net> Reported-by: Ben Dooks <ben.dooks@codethink.co.uk> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Acked-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20250804133406.17456-10-philmd@linaro.org>
2025-08-05hw/sd/sdcard: Factor spi_cmd_SEND_CxD() outPhilippe Mathieu-Daudé1-9/+10
spi_cmd_SEND_CSD() and spi_cmd_SEND_CID() are very similar. Factor the common code as spi_cmd_SEND_CxD(). Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Acked-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20250804133406.17456-9-philmd@linaro.org>
2025-08-05hw/sd/sdcard: Allow using SWITCH_FUNCTION in more SPI statesPhilippe Mathieu-Daudé1-2/+8
In SPI mode, SWITCH_FUNCTION is valid in all mode (except the IDLE one). Fixes: 775616c3ae8 ("Partial SD card SPI mode support") Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Acked-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20250804133406.17456-8-philmd@linaro.org>
2025-08-05hw/sd/sdcard: Use complete SEND_OP_COND implementation in SPI modePhilippe Mathieu-Daudé1-10/+5
While spi_cmd_SEND_OP_COND() is incomplete, sd_cmd_SEND_OP_COND() is, except it doesn't return the correct value in SPI mode. Correct and use, removing the need for spi_cmd_SEND_OP_COND(). Fixes: 775616c3ae8 ("Partial SD card SPI mode support") Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Acked-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20250804133406.17456-7-philmd@linaro.org>
2025-08-05hw/sd/sdcard: Implement SPI R2 return valuePhilippe Mathieu-Daudé2-6/+35
In SPI mode, R2 is a 2-byte value. Implement in spi_response_r2_make() and return SPI R2 in the SEND_STATUS commands. Reported-by: Guenter Roeck <linux@roeck-us.net> Fixes: 775616c3ae8 ("Partial SD card SPI mode support") Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Acked-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20250804133406.17456-6-philmd@linaro.org>
2025-08-05hw/sd/sdcard: Fill SPI response bits in card codePhilippe Mathieu-Daudé2-84/+35
ssi-sd.c contains the SPI link layer adaptation, while sd.c contains all the SD card internal details. We already handle the response values in sd.c, but missed the SPI case. Complete them (fill R1, prepend R1 in R3/R7 and always return something in SPI mode). Remove all the duplication in ssi-sd.c. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Acked-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20250804133406.17456-5-philmd@linaro.org>
2025-08-05hw/sd/sdbus: Provide buffer size to sdbus_do_command()Philippe Mathieu-Daudé9-30/+47
We provide to sdbus_do_command() a pointer to a buffer to be filled with a varying number of bytes. By not providing the buffer size, the callee can not check the buffer is big enough. Pass the buffer size as argument to follow good practices. sdbus_do_command() doesn't return any error, only the size filled in the buffer. Convert the returned type to unsigned and remove the few unreachable lines in callers. This allow to check for possible overflow in sd_do_command(). Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20250804133406.17456-4-philmd@linaro.org>
2025-08-05hw/sd/sdcard: Factor sd_response_size() outPhilippe Mathieu-Daudé1-7/+29
Set @rsplen once before switching to fill the response buffer. This will allow to assert in a single place that the buffer is big enough to be filled with the response. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20250804133406.17456-3-philmd@linaro.org>
2025-08-05hw/sd/sdcard: Do not ignore errors in sd_cmd_to_sendingdata()Philippe Mathieu-Daudé1-1/+1
Unfortunately when adding sd_cmd_to_sendingdata() in commit f486bf7d109 we neglected to return any possible error. Fix. Fixes: f486bf7d109 ("hw/sd/sdcard: Introduce sd_cmd_to_sendingdata and sd_generic_read_byte") Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-Id: <20250804133406.17456-2-philmd@linaro.org>
2025-08-04tests/docker: fix debian-all-test-crossAlex Bennée1-3/+1
It turns out you can't easily expand an ENV var across multiple steps in a dockerfile. This meant we silently dropped the architectures we should have even on amd64 hosts. As the updated AVAILABLE_COMPILERS is only needed for the following apt install line just merge them. Fixes: 6da616bb170 (tests/docker: handle host-arch selection for all-test-cross) Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-ID: <20250804104308.250949-1-alex.bennee@linaro.org>
2025-08-04Merge tag 'pull-aspeed-20250804' of https://github.com/legoater/qemu into ↵Stefan Hajnoczi6-1/+7
staging aspeed queue: * Fixed vbootrom build under roms/ * Updated vbootrom image to 183c9ff805 * Fixed SMC model of AST1030 SoC # -----BEGIN PGP SIGNATURE----- # # iQIzBAABCAAdFiEEoPZlSPBIlev+awtgUaNDx8/77KEFAmiQkpMACgkQUaNDx8/7 # 7KFVFw//X8mpLW97oCdh2ZuelkwQh+udAn34/f8cZWu97g9/Dmi6oDNb/GmPy5t2 # lFNg4hCSBh3JcRbHSMLVieE3lZLi5XuRb/g64TSH0gzgfhFKaPsqxzaD51R5cxVF # JG9JSsGKJdbp1inWZvr1uEZsioAOdUPP4qeD+WLoTHKrhSPCrUHsjslVmReBKu/O # sbgTGHkI8RJA6knz+j5JzXgy5y7XGsfbkl3pWlI8Ni9l6VDVrgfCcSgGtjQdzF4Q # J/QtpYYjo6crJ4wbvAPhKP3RZNNl0m60oxn0BSLFzrM3fZ95VP4pGVOrkCKtZLgG # Q0KvHcDKvm3BsgLPaUeyMjYHKbku2f/U3acsY4VqfLbvLNarmsG8OtFPiEs1tKnu # Dkqb1Ac85O/8dKohyIFhxEy1nEY4iW4495iDD2CklD2lY1Ck+bFkwC2jBNfpgaO6 # xzfLPpiyyU+GbnXbV5HASHland+5AyIjxEKfYpIcARIsfuDOR0qYPl/wmPkV8utO # /X0cKHZxSZ0x3E7xiOwTo6ZIgKdYbNEljTRT0AYxChB/ZRIEByQvYnwAXaL9IqLc # qSc2GRXTy+G8WNy4z1kn2B0Sp9rENvB5uzoRGZ1PtwBySclzUHICQ653a7HKEYeH # imXU9dGNhkQ+RMdA9+bZ3B3H8ykJDtX27woK6yerlbk3CUT9ZIs= # =oAuL # -----END PGP SIGNATURE----- # gpg: Signature made Mon 04 Aug 2025 06:59:31 EDT # gpg: using RSA key A0F66548F04895EBFE6B0B6051A343C7CFFBECA1 # gpg: Good signature from "Cédric Le Goater <clg@redhat.com>" [full] # gpg: aka "Cédric Le Goater <clg@kaod.org>" [full] # Primary key fingerprint: A0F6 6548 F048 95EB FE6B 0B60 51A3 43C7 CFFB ECA1 * tag 'pull-aspeed-20250804' of https://github.com/legoater/qemu: hw/ssi/aspeed_smc: Fix incorrect FMC_WDT2 register read on AST1030 pc-bios: Update vbootrom image to commit 183c9ff8056b roms/Makefile: build ast27x0_bootrom roms/vbootrom: update to 7b1eb5f7fe6a Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2025-08-04Merge tag 'pull-target-arm-20250801' of https://gitlab.com/pm215/qemu into ↵Stefan Hajnoczi9-25/+106
staging target-arm queue: * Add missing 64-bit PMCCNTR in AArch32 mode * Reinstate bogus AArch32 DBGDTRTX register for migration compat * fix big-endian handling of AArch64 FPU registers in gdbstub * fix handling of setting SVE registers from gdbstub * hw/intc/arm_gicv3_kvm: fix writing of enable/active/pending state to KVM * hw/display/framebuffer: Add cast to force 64x64 multiply * tests/tcg: Fix run for tests with specific plugin # -----BEGIN PGP SIGNATURE----- # # iQJMBAABCAA3FiEE4aXFk81BneKOgxXPPCUl7RQ2DN4FAmiM4mgZHHBldGVyLm1h # eWRlbGxAbGluYXJvLm9yZwAKCRA8JSXtFDYM3lH/D/iniJpHRVDVAvHcYe7vSgLl # HHfdEro/lOJJbaktQwOwkSuyl5HFy3YoIg3/5K2kX40DRkeA/M1HWkaWpwpCUReV # 6XS8fCDmxw5M0oncJsTD1cYxCAAHm/CSt2uvdwgHo6nU+vnEa85ml3Q57phLEkvl # 2R6xjXDD2FY3Xi6l2Jvqhnx/y60D5YnZVo/G9jcwRI2kIvpwTxukge5rGRTeagzL # fKwsgr8jThvWyzTJtd88n36uD8xiH8/IfHh+e0kGYfzPRjEGfN3rKh4OlyfRyv7D # AVI8qgVz0ex7DEjJTCS2nNYmNhO8hTE+cybcsH6AU2e3V7/vqg3Lh0/1cWlmvGnR # 8L0/RBy0exPI1kRABfjXPV4VtNSuByxp+F+s4LvUrxgnnbv29ldOnQNHn3BZJtZn # OuuixZNa3/tJFa+2U20fPW+q2H9uhPhvLn5fhtCx1ucYONLMrWl3Z8Q3/qwbW+5e # FR459UaVHUvqKDGL6cjnaQ3VclrsXngCbeBmLm7fDfniRf/4uIc3q6RzdwY3waj3 # t7D/+GmLwZzajEaCU1NcI+Uz+yO/wJhEXUtWAzm6xeowYfOEeZc1pRgGWSqy4qvi # L9vKmZtRW5LvwLwpMLdcoB3BOIszSDy7AylX4onSWl3Vp3GYiOhYqv9OKlQoUGtu # xjFCVDCB/0FPl9b+xoYK # =lN06 # -----END PGP SIGNATURE----- # gpg: Signature made Fri 01 Aug 2025 11:51:04 EDT # gpg: using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE # gpg: issuer "peter.maydell@linaro.org" # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [full] # gpg: aka "Peter Maydell <pmaydell@gmail.com>" [full] # gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" [full] # gpg: aka "Peter Maydell <peter@archaic.org.uk>" [unknown] # Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83 15CF 3C25 25ED 1436 0CDE * tag 'pull-target-arm-20250801' of https://gitlab.com/pm215/qemu: tests/tcg: Fix run for tests with specific plugin target/arm: Fix handling of setting SVE registers from gdb target/arm: Fix big-endian handling of NEON gdb remote debugging target/arm: Reinstate bogus AArch32 DBGDTRTX register for migration compat hw/display/framebuffer: Add cast to force 64x64 multiply hw/intc/arm_gicv3_kvm: Write all 1's to clear enable/active hw/intc/arm_gicv3_kvm: Remove writes to ICPENDR registers target/arm: add support for 64-bit PMCCNTR in AArch32 mode Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2025-08-04scripts/make-release: Go back to cloning all the EDK2 submodulesPeter Maydell1-11/+9
In commit bd0da3a3d4f we changed make-release so that instead of cloning every git submodule of EDK2 we only cloned a fixed list. The original motivation for this was that one of the submodules: * was from a non-github repo * that repo had a "SSL certificate expired" failure * wasn't actually needed for the set of EDK2 binaries we build and at the time we were trying to build the EDK2 binaries in one of our CI jobs. Unfortunately this change meant that we were exposed to bugs where EDK2 adds a new submodule and the sources we ship in the release tarball won't build any more. In particular, in EDK2 commit c6bb7d54beb05 the MipiSysTLib submodule was added, causing failure of the ROM build in our tarball starting from QEMU release 8.2.0: /tmp/qemu-10.0.0/roms/edk2/MdePkg/MdePkg.dec(32): error 000E: File/directory not found in workspace Library/MipiSysTLib/mipisyst/library/include is not found in packages path: /tmp/qemu-10.0.0/roms/. /tmp/qemu-10.0.0/roms/edk2 (Building from a QEMU git checkout works fine.) In the intervening time EDK2 moved the submodule that had a problem to be one they mirrored themselves (and at time of writing all their submodules are hosted on github), and we stopped trying to build EDK2 binaries in our own CI jobs with commit 690ceb71936f9037f6. Go back to cloning every EDK2 submodule, so we don't have an untested explicit list of submodules which will break without our noticing it. This increases the size of the QEMU tarball .tar.xz file from 133M to 139M in my testing. Cc: qemu-stable@nongnu.org Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3041 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Michael Tokarev <mjt@tls.msk.ru> Message-ID: <20250721153341.2910800-1-peter.maydell@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
2025-08-04docs/devel/submitting-a-patch.rst: add b4 sectionManos Pitsidianakis1-2/+38
Add a section about b4, an actively maintained and widely packaged CLI tool for contributing to patch-based development projects. Reviewed-by: Gustavo Romero <gustavo.romero@linaro.org> Signed-off-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org> Message-ID: <20250717-docs_add_b4_section-v2-1-69212ed39299@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
2025-08-04hw/ssi/aspeed_smc: Fix incorrect FMC_WDT2 register read on AST1030Jamin Lin1-1/+2
On AST1030, reading the FMC_WDT2 register always returns 0xFFFFFFFF. This issue is due to the aspeed_smc_read function, which checks for the ASPEED_SMC_FEATURE_WDT_CONTROL feature. Since AST1030 was missing this feature flag, the read operation fails and returns -1. To resolve this, add the WDT_CONTROL feature to AST1030's feature set so that FMC_WDT2 can be correctly accessed by firmware. Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Fixes: 2850df6a81bcdc2e063dfdd56751ee2d11c58030 ("aspeed/smc: Add AST1030 support ") Link: https://lore.kernel.org/qemu-devel/20250804014633.512737-1-jamin_lin@aspeedtech.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
2025-08-03pc-bios: Update vbootrom image to commit 183c9ff8056bCédric Le Goater3-0/+0
Full changelog since last update (1287b6e42e83) : Hao Wu (2): Automatically search for UBOOT location for NPCM8xx images. Dynamically detects NPCM8XX UBOOT destination and size. Jamin Lin (5): Add initial support for AST27x0 ast27x0: Show build date and git version ast27x0: Initialize and enable SSP/TSP using SCU with reserved-memory from DTB ast27x0: Fix missing SCU module reset for SSP and TSP initialization ast27x0: Fix Makefile to unconditionally set CC to support correct cross-compilation Compiled with gcc version 13.3.0 Reviewed-by: Jamin Lin <jamin_lin@aspeedtech.com> Reviewed-by: Michael Tokarev <mjt@tls.msk.ru> Signed-off-by: Cédric Le Goater <clg@redhat.com>
2025-08-03roms/Makefile: build ast27x0_bootromMichael Tokarev1-0/+5
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3052 Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org> Link: https://lore.kernel.org/qemu-devel/607a943a587248fbe0ff0897de80aee98a093caa.1753654515.git.mjt@tls.msk.ru [ clg: Removed make CC= workaround ] Reviewed-by: Jamin Lin <jamin_lin@aspeedtech.com> Signed-off-by: Cédric Le Goater <clg@redhat.com>
generated by cgit v1.1 at 2025-09-19 08:49:36 +0000